May 2021 - openSUSE Updates - openSUSE Mailing Lists

openSUSE-RU-2021:0718-1: moderate: Recommended update for procps
by maintenance＠opensuse.org 13 May '21

13 May '21

openSUSE Recommended Update: Recommended update for procps ______________________________________________________________________________ Announcement ID: openSUSE-RU-2021:0718-1 Rating: moderate References: #1185417 Affected Products: openSUSE Leap 15.2 ______________________________________________________________________________ An update that has one recommended fix can now be installed. Description: This update for procps fixes the following issues: - Support up to 2048 CPU as well. (bsc#1185417) This update was imported from the SUSE:SLE-15:Update update project. Patch Instructions: To install this openSUSE Recommended Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 15.2: zypper in -t patch openSUSE-2021-718=1 Package List: - openSUSE Leap 15.2 (i586 x86_64): libprocps7-3.3.15-lp152.3.9.1 libprocps7-debuginfo-3.3.15-lp152.3.9.1 procps-3.3.15-lp152.3.9.1 procps-debuginfo-3.3.15-lp152.3.9.1 procps-debugsource-3.3.15-lp152.3.9.1 procps-devel-3.3.15-lp152.3.9.1 References: https://bugzilla.suse.com/1185417

1 0

openSUSE-RU-2021:0717-1: Recommended update for git
by maintenance＠opensuse.org 13 May '21

13 May '21

openSUSE Recommended Update: Recommended update for git ______________________________________________________________________________ Announcement ID: openSUSE-RU-2021:0717-1 Rating: low References: #1185147 Affected Products: openSUSE Leap 15.2 ______________________________________________________________________________ An update that has one recommended fix can now be installed. Description: This update for git fixes the following issues: - Removed deprecated "syslog" option from git-daemon.service (bsc#1185147) This update was imported from the SUSE:SLE-15:Update update project. Patch Instructions: To install this openSUSE Recommended Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 15.2: zypper in -t patch openSUSE-2021-717=1 Package List: - openSUSE Leap 15.2 (i586 x86_64): git-2.26.2-lp152.2.9.1 git-arch-2.26.2-lp152.2.9.1 git-core-2.26.2-lp152.2.9.1 git-core-debuginfo-2.26.2-lp152.2.9.1 git-credential-gnome-keyring-2.26.2-lp152.2.9.1 git-credential-gnome-keyring-debuginfo-2.26.2-lp152.2.9.1 git-credential-libsecret-2.26.2-lp152.2.9.1 git-credential-libsecret-debuginfo-2.26.2-lp152.2.9.1 git-cvs-2.26.2-lp152.2.9.1 git-daemon-2.26.2-lp152.2.9.1 git-daemon-debuginfo-2.26.2-lp152.2.9.1 git-debuginfo-2.26.2-lp152.2.9.1 git-debugsource-2.26.2-lp152.2.9.1 git-email-2.26.2-lp152.2.9.1 git-gui-2.26.2-lp152.2.9.1 git-p4-2.26.2-lp152.2.9.1 git-svn-2.26.2-lp152.2.9.1 git-svn-debuginfo-2.26.2-lp152.2.9.1 git-web-2.26.2-lp152.2.9.1 gitk-2.26.2-lp152.2.9.1 - openSUSE Leap 15.2 (noarch): git-doc-2.26.2-lp152.2.9.1 References: https://bugzilla.suse.com/1185147

1 0

openSUSE-SU-2021:0716-1: important: Security update for the Linux Kernel
by opensuse-security＠opensuse.org 12 May '21

12 May '21

openSUSE Security Update: Security update for the Linux Kernel ______________________________________________________________________________ Announcement ID: openSUSE-SU-2021:0716-1 Rating: important References: #1043990 #1055117 #1065729 #1152457 #1152489 #1156395 #1167260 #1168838 #1174416 #1174426 #1178089 #1179243 #1179825 #1179851 #1180846 #1181161 #1182613 #1182999 #1183063 #1183203 #1183289 #1184208 #1184209 #1184436 #1184514 #1184650 #1184724 #1184728 #1184730 #1184731 #1184736 #1184737 #1184738 #1184740 #1184741 #1184742 #1184760 #1184811 #1184893 #1184934 #1184942 #1184957 #1184969 #1184984 #1185041 #1185113 #1185233 #1185244 #1185269 #1185365 #1185454 #1185472 #1185491 #1185549 #1185586 #1185587 #1185606 Cross-References: CVE-2021-29155 CVE-2021-29650 CVSS scores: CVE-2021-29155 (NVD) : 5.5 CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N CVE-2021-29155 (SUSE): 6.2 CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N CVE-2021-29650 (NVD) : 5.5 CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H CVE-2021-29650 (SUSE): 5.5 CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H Affected Products: openSUSE Leap 15.2 ______________________________________________________________________________ An update that solves two vulnerabilities and has 55 fixes is now available. Description: The openSUSE Leap 15.2 kernel was updated to receive various security and bugfixes. The following security bugs were fixed: - CVE-2021-29650: The netfilter subsystem allowed attackers to cause a denial of service (panic) because net/netfilter/x_tables.c and include/linux/netfilter/x_tables.h lack a full memory barrier upon the assignment of a new table value, aka CID-175e476b8cdf (bnc#1184208). - CVE-2021-29155: kernel/bpf/verifier.c performs undesirable out-of-bounds speculation on pointer arithmetic, leading to side-channel attacks that defeat Spectre mitigations and obtain sensitive information from kernel memory. Specifically, for sequences of pointer arithmetic operations, the pointer modification performed by the first operation is not correctly accounted for when restricting subsequent operations (bnc#1184942). The following non-security bugs were fixed: - ACPI: CPPC: Replace cppc_attr with kobj_attribute (git-fixes). - ALSA: core: remove redundant spin_lock pair in snd_card_disconnect (git-fixes). - ALSA: emu8000: Fix a use after free in snd_emu8000_create_mixer (git-fixes). - ALSA: hda/cirrus: Add Headphone and Headset MIC Volume Control (git-fixes). - ALSA: hda/cirrus: Add error handling into CS8409 I2C functions (git-fixes). - ALSA: hda/cirrus: Add jack detect interrupt support from CS42L42 companion codec (git-fixes). - ALSA: hda/cirrus: Add support for CS8409 HDA bridge and CS42L42 companion codec (git-fixes). - ALSA: hda/cirrus: Cleanup patch_cirrus.c code (git-fixes). - ALSA: hda/cirrus: Fix CS42L42 Headset Mic volume control name (git-fixes). - ALSA: hda/cirrus: Make CS8409 driver more generic by using fixups (git-fixes). - ALSA: hda/cirrus: Set Initial DMIC volume for Bullseye to -26 dB (git-fixes). - ALSA: hda/cirrus: Use CS8409 filter to fix abnormal sounds on Bullseye (git-fixes). - ALSA: hda/realtek - Headset Mic issue on HP platform (git-fixes). - ALSA: hda/realtek: Add quirk for Intel Clevo PCx0Dx (git-fixes). - ALSA: hda/realtek: GA503 use same quirks as GA401 (git-fixes). - ALSA: hda/realtek: Re-order ALC269 ASUS quirk table entries (git-fixes). - ALSA: hda/realtek: Re-order ALC269 Acer quirk table entries (git-fixes). - ALSA: hda/realtek: Re-order ALC269 Dell quirk table entries (git-fixes). - ALSA: hda/realtek: Re-order ALC269 HP quirk table entries (git-fixes). - ALSA: hda/realtek: Re-order ALC269 Lenovo quirk table entries (git-fixes). - ALSA: hda/realtek: Re-order ALC269 Sony quirk table entries (git-fixes). - ALSA: hda/realtek: Re-order ALC662 quirk table entries (git-fixes). - ALSA: hda/realtek: Re-order ALC882 Acer quirk table entries (git-fixes). - ALSA: hda/realtek: Re-order ALC882 Clevo quirk table entries (git-fixes). - ALSA: hda/realtek: Re-order ALC882 Sony quirk table entries (git-fixes). - ALSA: hda/realtek: Re-order remaining ALC269 quirk table entries (git-fixes). - ALSA: hda/realtek: Remove redundant entry for ALC861 Haier/Uniwill devices (git-fixes). - ALSA: hda/realtek: fix mic boost on Intel NUC 8 (git-fixes). - ALSA: hda/realtek: fix static noise on ALC285 Lenovo laptops (git-fixes). - ALSA: sb: Fix two use after free in snd_sb_qsound_build (git-fixes). - ALSA: usb-audio: Add DJM450 to Pioneer format quirk (git-fixes). - ALSA: usb-audio: Add MIDI quirk for Vox ToneLab EX (git-fixes). - ALSA: usb-audio: Add error checks for usb_driver_claim_interface() calls (git-fixes). - ALSA: usb-audio: Configure Pioneer DJM-850 samplerate (git-fixes). - ALSA: usb-audio: DJM-750: ensure format is set (git-fixes). - ALSA: usb-audio: Explicitly set up the clock selector (git-fixes). - ALSA: usb-audio: Fix Pioneer DJM devices URB_CONTROL request direction to set samplerate (git-fixes). - ALSA: usb-audio: Fix implicit sync clearance at stopping stream (git-fixes). - ALSA: usb: midi: do not return -ENOMEM when usb_urb_ep_type_check fails (git-fixes). - ASoC: Intel: kbl_da7219_max98927: Fix kabylake_ssp_fixup function (git-fixes). - ASoC: SOF: Intel: HDA: fix core status verification (git-fixes). - ASoC: SOF: Intel: hda: remove unnecessary parentheses (git-fixes). - ASoC: ak5558: Fix s/show/slow/ typo (git-fixes). - ASoC: ak5558: correct reset polarity (git-fixes). - ASoC: samsung: tm2_wm5110: check of of_parse return value (git-fixes). - ASoC: simple-card: fix possible uninitialized single_cpu local variable (git-fixes). - HID: alps: fix error return code in alps_input_configured() (git-fixes). - HID: google: add don USB id (git-fixes). - HID: plantronics: Workaround for double volume key presses (git-fixes). - HID: wacom: Assign boolean values to a bool variable (git-fixes). - HID: wacom: set EV_KEY and EV_ABS only for non-HID_GENERIC type of devices (git-fixes). - Input: i8042 - fix Pegatron C15B ID entry (git-fixes). - Input: nspire-keypad - enable interrupts only when opened (git-fixes). - Input: s6sy761 - fix coordinate read bit shift (git-fixes). - KVM: PPC: Book3S HV P9: Restore host CTRL SPR after guest exit (bsc#1156395). - KVM: PPC: Make the VMX instruction emulation routines static (bsc#1156395). - KVM: kvmclock: Fix vCPUs > 64 can't be online/hotpluged (bsc#1152489). - Move upstreamed i915 fix into sorted section - PCI/AER: Add RCEC AER error injection support (bsc#1174426). - PCI/AER: Add pcie_walk_rcec() to RCEC AER handling (bsc#1174426). - PCI/AER: Clear AER status from Root Port when resetting Downstream Port (bsc#1174426). - PCI/AER: Specify the type of Port that was reset (bsc#1174426). - PCI/AER: Use "aer" variable for capability offset (bsc#1174426). - PCI/AER: Write AER Capability only when we control it (bsc#1174426). - PCI/ERR: Add pci_walk_bridge() to pcie_do_recovery() (bsc#1174426). - PCI/ERR: Add pcie_link_rcec() to associate RCiEPs (bsc#1174426). - PCI/ERR: Avoid negated conditional for clarity (bsc#1174426). - PCI/ERR: Bind RCEC devices to the Root Port driver (bsc#1174426). - PCI/ERR: Cache RCEC EA Capability offset in pci_init_capabilities() (bsc#1174426). - PCI/ERR: Clear AER status only when we control AER (bsc#1174426). - PCI/ERR: Clear PCIe Device Status errors only if OS owns AER (bsc#1174426). - PCI/ERR: Clear status of the reporting device (bsc#1174426). - PCI/ERR: Recover from RCEC AER errors (bsc#1174426). - PCI/ERR: Recover from RCiEP AER errors (bsc#1174426). - PCI/ERR: Rename reset_link() to reset_subordinates() (bsc#1174426). - PCI/ERR: Retain status from error notification (bsc#1174426). - PCI/ERR: Simplify by computing pci_pcie_type() once (bsc#1174426). - PCI/ERR: Simplify by using pci_upstream_bridge() (bsc#1174426). - PCI/ERR: Use "bridge" for clarity in pcie_do_recovery() (bsc#1174426). - PCI/PME: Add pcie_walk_rcec() to RCEC PME handling (bsc#1174426). - PCI/portdrv: Report reset for frozen channel (bsc#1174426). - PCI: designware-ep: Fix the Header Type check (git-fixes). - PCI: tegra: Fix ASPM-L1SS advertisement disable code (git-fixes). - PCI: tegra: Move "dbi" accesses to post common DWC initialization (git-fixes). - PM: runtime: Add documentation for pm_runtime_resume_and_get() (git-fixes). - Revert "USB: cdc-acm: fix rounding error in TIOCSSERIAL" (git-fixes). - Revert "bcache: Kill btree_io_wq" (git-fixes). - Revert "dm cache: fix arm link errors with inline" (git-fixes). - USB: CDC-ACM: fix poison/unpoison imbalance (bsc#1184984). - USB: CDC-ACM: fix poison/unpoison imbalance (git-fixes). - USB: cdc-acm: fix TIOCGSERIAL implementation (git-fixes). - USB: cdc-acm: fix unprivileged TIOCCSERIAL (git-fixes). - USB: gadget: udc: fix wrong pointer passed to IS_ERR() and PTR_ERR() (git-fixes). - USB: serial: ark3116: fix TIOCGSERIAL implementation (git-fixes). - USB: serial: f81232: fix TIOCGSERIAL implementation (git-fixes). - USB: serial: f81534: fix TIOCGSERIAL implementation (git-fixes). - USB: serial: fix return value for unsupported ioctls (git-fixes). - USB: serial: mos7720: fix TIOCGSERIAL implementation (git-fixes). - USB: serial: opticon: fix TIOCGSERIAL implementation (git-fixes). - USB: serial: quatech2: fix TIOCGSERIAL implementation (git-fixes). - USB: serial: ssu100: fix TIOCGSERIAL implementation (git-fixes). - USB: serial: usb_wwan: fix TIOCGSERIAL implementation (git-fixes). - USB: serial: usb_wwan: fix TIOCSSERIAL jiffies conversions (git-fixes). - USB: serial: usb_wwan: fix unprivileged TIOCCSERIAL (git-fixes). - arm: dts: add imx7d pcf2127 fix to blacklist - ata: libahci_platform: fix IRQ check (git-fixes). - ath10k: Fix ath10k_wmi_tlv_op_pull_peer_stats_info() unlock without lock (git-fixes). - ath9k: Fix error check in ath9k_hw_read_revisions() for PCI devices (git-fixes). - backlight: journada720: Fix Wmisleading-indentation warning (git-fixes). - blkcg: fix memleak for iolatency (git-fixes). - block, bfq: set next_rq to waker_bfqq->next_rq in waker injection (bsc#1168838). - block: recalculate segment count for multi-segment discards correctly (bsc#1184724). - block: rsxx: select CONFIG_CRC32 (git-fixes). - bluetooth: eliminate the potential race condition when removing the HCI controller (git-fixes). - bnxt_en: reverse order of TX disable and carrier off (git-fixes). - bsg: free the request before return error code (git-fixes). - btrfs: fix qgroup data rsv leak caused by falloc failure (bsc#1185549). - btrfs: fix race between swap file activation and snapshot creation (bsc#1185587). - btrfs: fix race between writes to swap files and scrub (bsc#1185586). - btrfs: track qgroup released data in own variable in insert_prealloc_file_extent (bsc#1185549). - bus: qcom: Put child node before return (git-fixes). - cfg80211: remove WARN_ON() in cfg80211_sme_connect (git-fixes). - clk: exynos7: Mark aclk_fsys1_200 as critical (git-fixes). - clk: mvebu: armada-37xx-periph: Fix switching CPU freq from 250 Mhz to 1 GHz (git-fixes). - clk: mvebu: armada-37xx-periph: Fix workaround for switching from L1 to L0 (git-fixes). - clk: mvebu: armada-37xx-periph: remove .set_parent method for CPU PM clock (git-fixes). - clk: qcom: a53-pll: Add missing MODULE_DEVICE_TABLE (git-fixes). - clk: uniphier: Fix potential infinite loop (git-fixes). - clk: zynqmp: move zynqmp_pll_set_mode out of round_rate callback (git-fixes). - coresight: etm4x: Fix issues on trcseqevr access (git-fixes). - coresight: etm4x: Fix save and restore of TRCVMIDCCTLR1 register (git-fixes). - coresight: tmc-etr: Fix barrier packet insertion for perf buffer (git-fixes). - cpufreq: Kconfig: fix documentation links (git-fixes). - cpufreq: armada-37xx: Fix determining base CPU frequency (git-fixes). - cpufreq: armada-37xx: Fix driver cleanup when registration failed (git-fixes). - cpufreq: armada-37xx: Fix setting TBG parent for load levels (git-fixes). - cpufreq: armada-37xx: Fix the AVS value for load L1 (git-fixes). - crypto: arm/curve25519 - Move '.fpu' after '.arch' (git-fixes). - crypto: rng - fix crypto_rng_reset() refcounting when !CRYPTO_STATS (git-fixes). - cxgb4/chtls/cxgbit: Keeping the max ofld immediate data size same in cxgb4 and ulds (git-fixes). - cxgb4: avoid collecting SGE_QBASE regs during traffic (git-fixes). - dm era: Fix bitset memory leaks (git-fixes). - dm era: Recover committed writeset after crash (git-fixes). - dm era: Reinitialize bitset cache before digesting a new writeset (git-fixes). - dm era: Update in-core bitset after committing the metadata (git-fixes). - dm era: Use correct value size in equality function of writeset tree (git-fixes). - dm era: Verify the data block size hasn't changed (git-fixes). - dm era: only resize metadata in preresume (git-fixes). - dm integrity: fix error reporting in bitmap mode after creation (git-fixes). - dm ioctl: fix error return code in target_message (git-fixes). - dm mpath: fix racey management of PG initialization (git-fixes). - dm raid: fix discard limits for raid1 (git-fixes). - dm writecache: fix the maximum number of arguments (git-fixes). - dm writecache: handle DAX to partitions on persistent memory correctly (git-fixes). - dm writecache: remove BUG() and fail gracefully instead (git-fixes). - dm zoned: select CONFIG_CRC32 (git-fixes). - dm: eliminate potential source of excessive kernel log noise (git-fixes). - dm: fix bug with RCU locking in dm_blk_report_zones (git-fixes). - dm: remove invalid sparse __acquires and __releases annotations (git-fixes). - dmaengine: dw: Make it dependent to HAS_IOMEM (git-fixes). - dpaa_eth: Remove unnecessary boolean expression in dpaa_get_headroom (git-fixes). - dpaa_eth: Use random MAC address when none is given (bsc#1184811). - dpaa_eth: copy timestamp fields to new skb in A-050385 workaround (git-fixes). - dpaa_eth: fix the RX headroom size alignment (git-fixes). - dpaa_eth: update the buffer layout for non-A050385 erratum scenarios (git-fixes). - drivers: net: xgene: Fix the order of the arguments of 'alloc_etherdev_mqs()' (git-fixes). - drm/amdkfd: fix build error with AMD_IOMMU_V2=m (git-fixes). - drm/ast: AST2500 fixups (bsc#1174416). - drm/ast: Add 25MHz refclk support (bsc#1174416). - drm/ast: Add support for 1152x864 mode (bsc#1174416). - drm/ast: Add support for AIP200 (bsc#1174416). - drm/ast: Correct mode table for AST2500 precatch (bsc#1174416). - drm/ast: Disable VGA decoding while driver is active (bsc#1174416). - drm/ast: Disable screen on register init (bsc#1174416). - drm/ast: Fix P2A config detection (bsc#1174416). - drm/ast: Fix register access in non-P2A mode for DP501 (bsc#1174416). - drm/ast: Keep MISC fields when enabling VGA (bsc#1174416). - drm/ast: drm/ast: Fix boot address for AST2500 (bsc#1174416). - drm/i915/gvt: Fix error code in intel_gvt_init_device() (git-fixes). - drm/imx: imx-ldb: fix out of bounds array access warning (git-fixes). - drm/msm: Fix a5xx/a6xx timestamps (git-fixes). - drm/omap: fix misleading indentation in pixinc() (git-fixes). - drm/radeon: fix copy of uninitialized variable back to userspace (git-fixes). - drm/tegra: dc: Do not set PLL clock to 0Hz (git-fixes). - e1000e: Fix duplicate include guard (git-fixes). - e1000e: Fix error handling in e1000_set_d0_lplu_state_82571 (git-fixes). - e1000e: add rtnl_lock() to e1000_reset_task (git-fixes). - enetc: Let the hardware auto-advance the taprio base-time of 0 (git-fixes). - enetc: Workaround for MDIO register access issue (git-fixes). - ethernet/netronome/nfp: Fix a use after free in nfp_bpf_ctrl_msg_rx (git-fixes). - ext4: do not try to set xattr into ea_inode if value is empty (bsc#1184730). - ext4: find old entry again if failed to rename whiteout (bsc#1184742). - ext4: fix potential error in ext4_do_update_inode (bsc#1184731). - ext4: fix potential htree index checksum corruption (bsc#1184728). - firmware: qcom-scm: Fix QCOM_SCM configuration (git-fixes). - fnic: use scsi_host_busy_iter() to traverse commands (bsc#1179851). - fotg210-udc: Complete OUT requests on short packets (git-fixes). - fotg210-udc: Do not DMA more than the buffer can take (git-fixes). - fotg210-udc: Fix DMA on EP0 for length > max packet size (git-fixes). - fotg210-udc: Fix EP0 IN requests bigger than two packets (git-fixes). - fotg210-udc: Mask GRP2 interrupts we do not handle (git-fixes). - fotg210-udc: Remove a dubious condition leading to fotg210_done (git-fixes). - fs/jfs: fix potential integer overflow on shift of a int (bsc#1184741). - fs: direct-io: fix missing sdio->boundary (bsc#1184736). - fsl/fman: reuse set_mac_address() in dtsec init() (bsc#1184811). - fsl/fman: tolerate missing MAC address in device tree (bsc#1184811). - gpio: omap: Save and restore sysconfig (git-fixes). - gpio: sysfs: Obey valid_mask (git-fixes). - i2c: cadence: add IRQ check (git-fixes). - i2c: emev2: add IRQ check (git-fixes). - i2c: img-scb: fix reference leak when pm_runtime_get_sync fails (git-fixes). - i2c: imx-lpi2c: fix reference leak when pm_runtime_get_sync fails (git-fixes). - i2c: jz4780: add IRQ check (git-fixes). - i2c: omap: fix reference leak when pm_runtime_get_sync fails (git-fixes). - i2c: sh7760: add IRQ check (git-fixes). - i2c: sh7760: fix IRQ error path (git-fixes). - i2c: sprd: fix reference leak when pm_runtime_get_sync fails (git-fixes). - i40e: Add zero-initialization of AQ command structures (git-fixes). - i40e: Added Asym_Pause to supported link modes (git-fixes). - i40e: Fix add TC filter for IPv6 (git-fixes). - i40e: Fix addition of RX filters after enabling FW LLDP agent (git-fixes). - i40e: Fix display statistics for veb_tc (git-fixes). - i40e: Fix endianness conversions (git-fixes). - i40e: Fix flow for IPv6 next header (extension header) (git-fixes). - i40e: Fix kernel oops when i40e driver removes VF's (git-fixes). - i40e: Fix overwriting flow control settings during driver loading (git-fixes). - i40e: Fix sparse errors in i40e_txrx.c (git-fixes). - i40e: Fix sparse warning: missing error code 'err' (git-fixes). - i40e: fix the panic when running bpf in xdpdrv mode (git-fixes). - ibmvnic: avoid calling napi_disable() twice (bsc#1065729). - ibmvnic: clean up the remaining debugfs data structures (bsc#1065729). - ibmvnic: correctly use dev_consume/free_skb_irq (jsc#SLE-17268 jsc#SLE-17043 bsc#1179243 ltc#189290 git-fixes). - ibmvnic: improve failover sysfs entry (bsc#1043990 ltc#155681 git-fixes). - ibmvnic: print adapter state as a string (bsc#1152457 ltc#174432 git-fixes). - ibmvnic: print reset reason as a string (bsc#1152457 ltc#174432 git-fixes). - ibmvnic: queue reset work in system_long_wq (bsc#1152457 ltc#174432 git-fixes). - ibmvnic: remove duplicate napi_schedule call in do_reset function (bsc#1065729). - ibmvnic: remove duplicate napi_schedule call in open function (bsc#1065729). - ice: Account for port VLAN in VF max packet size calculation (git-fixes). - ice: Cleanup fltr list in case of allocation issues (git-fixes). - ice: Fix for dereference of NULL pointer (git-fixes). - ice: Increase control queue timeout (git-fixes). - ice: prevent ice_open and ice_stop during reset (git-fixes). - igb: Fix duplicate include guard (git-fixes). - igb: check timestamp validity (git-fixes). - igc: Fix Pause Frame Advertising (git-fixes). - igc: Fix Supported Pause Frame Link Setting (git-fixes). - igc: reinit_locked() should be called with rtnl_lock (git-fixes). - iio:accel:adis16201: Fix wrong axis assignment that prevents loading (git-fixes). - ima: Free IMA measurement buffer after kexec syscall (git-fixes). - interconnect: core: fix error return code of icc_link_destroy() (git-fixes). - iopoll: introduce read_poll_timeout macro (git-fixes). - ipw2x00: potential buffer overflow in libipw_wx_set_encodeext() (git-fixes). - irqchip/ls-extirq: Add LS1043A, LS1088A external interrupt support (bsc#1185233). - irqchip/ls-extirq: add IRQCHIP_SKIP_SET_WAKE to the irqchip flags (bsc#1185233). - irqchip: Add support for Layerscape external interrupt lines (bsc#1185233). - isofs: release buffer head before return (bsc#1182613). - ixgbe: fail to create xfrm offload of IPsec tunnel mode SA (git-fixes). - jffs2: fix use after free in jffs2_sum_write_data() (bsc#1184740). - kABI: Fix kABI caused by fixes for bsc#1174426 (bsc#1174426). - kABI: cover up change in struct kvm_arch (bsc#1184969). - kABI: powerpc/pseries: Add shutdown() to vio_driver and vio_bus (bsc#1184209 ltc#190917). - kernel/smp: make csdlock timeout depend on boot parameter (bsc#1180846). - libnvdimm/label: Return -ENXIO for no slot in __blk_label_update (bsc#1185269). - libnvdimm/namespace: Fix reaping of invalidated block-window-namespace labels (bsc#1185269). - libnvdimm/region: Fix nvdimm_has_flush() to handle ND_REGION_ASYNC (bsc#1184969 git-fixes). - libnvdimm/security: ensure sysfs poll thread woke up and fetch updated attr (git-fixes). - liquidio: Fix unintented sign extension of a left shift of a u16 (git-fixes). - locking/qrwlock: Fix ordering in queued_write_lock_slowpath() (bsc#1185041). - mac80211: bail out if cipher schemes are invalid (git-fixes). - mac80211: clear sta->fast_rx when STA removed from 4-addr VLAN (git-fixes). - macvlan: macvlan_count_rx() needs to be aware of preemption (git-fixes). - media: dvbdev: Fix memory leak in dvb_media_device_free() (git-fixes). - media: m88rs6000t: avoid potential out-of-bounds reads on arrays (git-fixes). - media: mantis: remove orphan mantis_core.c (git-fixes). - media: omap4iss: return error code when omap4iss_get() failed (git-fixes). - media: platform: sunxi: sun6i-csi: fix error return code of sun6i_video_start_streaming() (git-fixes). - media: staging/intel-ipu3: Fix memory leak in imu_fmt (git-fixes). - media: staging/intel-ipu3: Fix race condition during set_fmt (git-fixes). - media: staging/intel-ipu3: Fix set_fmt error handling (git-fixes). - media: v4l2-ctrls.c: fix race condition in hdl->requests list (git-fixes). - memory: gpmc: fix out of bounds read and dereference on gpmc_cs[] (git-fixes). - memory: pl353: fix mask of ECC page_size config register (git-fixes). - mfd: lpc_sch: Partially revert "Add support for Intel Quark X1000" (git-fixes). - mfd: stm32-timers: Avoid clearing auto reload register (git-fixes). - misc: lis3lv02d: Fix false-positive WARN on various HP models (git-fixes). - misc: vmw_vmci: explicitly initialize vmci_datagram payload (git-fixes). - misc: vmw_vmci: explicitly initialize vmci_notify_bm_set_msg struct (git-fixes). - mm/rmap: fix potential pte_unmap on an not mapped pte (git-fixes). - mm: memcontrol: fix cpuhotplug statistics flushing (bsc#1185606). - mmc: core: Correct descriptions in mmc_of_parse() (git-fixes). - mmc: cqhci: Add cqhci_deactivate() (git-fixes). - mmc: mmc_spi: Drop unused NO_IRQ definition (git-fixes). - mmc: sdhci-of-arasan: Add missed checks for devm_clk_register() (git-fixes). - mmc: sdhci-of-dwcmshc: fix rpmb access (git-fixes). - mmc: sdhci-of-dwcmshc: implement specific set_uhs_signaling (git-fixes). - mmc: sdhci-of-esdhc: make sure delay chain locked for HS400 (git-fixes). - mmc: sdhci-of-esdhc: set timeout to max before tuning (git-fixes). - mmc: sdhci-pci: Fix SDHCI_RESET_ALL for CQHCI for Intel GLK-based controllers (git-fixes). - mmc: sdhci: Use Auto CMD Auto Select only when v4_mode is true (git-fixes). - mmc: uniphier-sd: Fix a resource leak in the remove function (git-fixes). - mmc: uniphier-sd: Fix an error handling path in uniphier_sd_probe() (git-fixes). - mt7601u: fix always true expression (git-fixes). - mtd: Handle possible -EPROBE_DEFER from parse_mtd_partitions() (git-fixes). - mtd: rawnand: atmel: Update ecc_stats.corrected counter (git-fixes). - mtd: rawnand: brcmnand: fix OOB R/W with Hamming ECC (git-fixes). - mtd: rawnand: fsmc: Fix error code in fsmc_nand_probe() (git-fixes). - mtd: rawnand: gpmi: Fix a double free in gpmi_nand_init (git-fixes). - mtd: rawnand: qcom: Return actual error code instead of -ENODEV (git-fixes). - mtd: require write permissions for locking and badblock ioctls (git-fixes). - mtd: spi-nor: Rename "n25q512a" to "mt25qu512a (n25q512a)" (bsc#1167260). - mtd: spi-nor: Split mt25qu512a (n25q512a) entry into two (bsc#1167260). - mtd: spinand: core: add missing MODULE_DEVICE_TABLE() (git-fixes). - nbd: fix a block_device refcount leak in nbd_release (git-fixes). - net/mlx4_core: Add missed mlx4_free_cmd_mailbox() (git-fixes). - net/mlx4_en: update moderation when config reset (git-fixes). - net/mlx5: Do not request more than supported EQs (git-fixes). - net/mlx5e: Do not match on Geneve options in case option masks are all zero (git-fixes). - net/mlx5e: Fix error path for ethtool set-priv-flag (git-fixes). - net/mlx5e: Fix ethtool indication of connector type (git-fixes). - net/mlx5e: fix ingress_ifindex check in mlx5e_flower_parse_meta (jsc#SLE-8464). - net/qlcnic: Fix a use after free in qlcnic_83xx_get_minidump_template (git-fixes). - net: atlantic: fix out of range usage of active_vlans array (git-fixes). - net: atlantic: fix potential error handling (git-fixes). - net: atlantic: fix use after free kasan warn (git-fixes). - net: dsa: felix: implement port flushing on .phylink_mac_link_down (git-fixes). - net: enetc: remove bogus write to SIRXIDR from enetc_setup_rxbdr (git-fixes). - net: enetc: take the MDIO lock only once per NAPI poll cycle (git-fixes). - net: geneve: check skb is large enough for IPv4/IPv6 header (git-fixes). - net: geneve: modify IP header check in geneve6_xmit_skb and geneve_xmit_skb (git-fixes). - net: hns3: Remove un-necessary 'else-if' in the hclge_reset_event() (git-fixes). - net: hns3: clear VF down state bit before request link status (git-fixes). - net: hns3: fix bug when calculating the TCAM table info (git-fixes). - net: hns3: fix query vlan mask value error for flow director (git-fixes). - net: ll_temac: Add more error handling of dma_map_single() calls (git-fixes). - net: ll_temac: Fix RX buffer descriptor handling on GFP_ATOMIC pressure (git-fixes). - net: ll_temac: Fix race condition causing TX hang (git-fixes). - net: ll_temac: Handle DMA halt condition caused by buffer underrun (git-fixes). - net: phy: intel-xway: enable integrated led functions (git-fixes). - net: phy: marvell: fix m88e1011_set_downshift (git-fixes). - net: phy: marvell: fix m88e1111_set_downshift (git-fixes). - net: smc911x: Adjust indentation in smc911x_phy_configure (git-fixes). - net: stmmac: fix missing IFF_MULTICAST check in dwmac4_set_filter (git-fixes). - net: stmmac: xgmac: fix missing IFF_MULTICAST checki in dwxgmac2_set_filter (git-fixes). - net: tulip: Adjust indentation in {dmfe, uli526x}_init_module (git-fixes). - net:nfc:digital: Fix a double free in digital_tg_recv_dep_req (git-fixes). - nfc: pn533: prevent potential memory corruption (git-fixes). - nfp: flower: ignore duplicate merge hints from FW (git-fixes). - node: fix device cleanups in error handling code (git-fixes). - null_blk: fix passing of REQ_FUA flag in null_handle_rq (git-fixes). - nvme-fabrics: reject I/O to offline device (bsc#1181161). - nvme-multipath: reset bdev to ns head when failover (bsc#178378 bsc#1182999). - nvme-tcp: fix possible hang when failing to set io queues (bsc#1181161). - nvme: add 'kato' sysfs attribute (bsc#1179825). - nvme: sanitize KATO setting (bsc#1179825). - ocfs2: fix a use after free on error (bsc#1184738). - pata_arasan_cf: fix IRQ check (git-fixes). - pata_ipx4xx_cf: fix IRQ check (git-fixes). - phy: marvell: ARMADA375_USBCLUSTER_PHY should not default to y, unconditionally (git-fixes). - pinctrl: Ingenic: Add missing pins to the JZ4770 MAC MII group (git-fixes). - pinctrl: core: Fix kernel doc string for pin_get_name() (git-fixes). - pinctrl: lewisburg: Update number of pins in community (git-fixes). - platform/x86: pmc_atom: Match all Beckhoff Automation baytrail boards with critclk_systems DMI table (git-fixes). - powerepc/book3s64/hash: Align start/end address correctly with bolt mapping (bsc#1184957). - powerpc/64s: Fix pte update for kernel memory on radix (bsc#1055117 git-fixes). - powerpc/asm-offsets: GPR14 is not needed either (bsc#1065729). - powerpc/eeh: Fix EEH handling for hugepages in ioremap space (bsc#1156395). - powerpc/fadump: Mark fadump_calculate_reserve_size as __init (bsc#1065729). - powerpc/mm: Add cond_resched() while removing hpte mappings (bsc#1183289 ltc#191637). - powerpc/papr_scm: Fix build error due to wrong printf specifier (bsc#1184969). - powerpc/papr_scm: Implement support for H_SCM_FLUSH hcall (bsc#1184969). - powerpc/perf: Fix PMU constraint check for EBB events (bsc#1065729). - powerpc/prom: Mark identical_pvr_fixup as __init (bsc#1065729). - powerpc/pseries: Add shutdown() to vio_driver and vio_bus (bsc#1184209 ltc#190917). - powerpc/time: Enable sched clock for irqtime (bsc#1156395). - regmap: set debugfs_name to NULL after it is freed (git-fixes). - regulator: Avoid a double 'of_node_get' in 'regulator_of_get_init_node()' (git-fixes). - reintroduce cqhci_suspend for kABI (git-fixes). - reiserfs: update reiserfs_xattrs_initialized() condition (bsc#1184737). - rsi: Use resume_noirq for SDIO (git-fixes). - rsxx: remove extraneous 'const' qualifier (git-fixes). - rtc: ds1307: Fix wday settings for rx8130 (git-fixes). - rtc: fsl-ftm-alarm: add MODULE_TABLE() (bsc#1185454). - rtc: fsl-ftm-alarm: avoid struct rtc_time conversions (bsc#1185454). - rtc: fsl-ftm-alarm: enable acpi support (bsc#1185454). - rtc: fsl-ftm-alarm: fix freeze(s2idle) failed to wake (bsc#1185454). - rtc: fsl-ftm-alarm: report alarm to core (bsc#1185454). - rtc: fsl-ftm-alarm: switch to ktime_get_real_seconds (bsc#1185454). - rtc: fsl-ftm-alarm: switch to rtc_time64_to_tm/rtc_tm_to_time64 (bsc#1185454). - rtc: fsl-ftm-alarm: update acpi device id (bsc#1185454). - rtc: pcf2127: add alarm support (bsc#1185233). - rtc: pcf2127: add pca2129 device id (bsc#1185233). - rtc: pcf2127: add tamper detection support (bsc#1185233). - rtc: pcf2127: add watchdog feature support (bsc#1185233). - rtc: pcf2127: bugfix: watchdog build dependency (bsc#1185233). - rtc: pcf2127: cleanup register and bit defines (bsc#1185233). - rtc: pcf2127: convert to devm_rtc_allocate_device (bsc#1185233). - rtc: pcf2127: fix a bug when not specify interrupts property (bsc#1185233). - rtc: pcf2127: fix alarm handling (bsc#1185233). - rtc: pcf2127: fix pcf2127_nvmem_read/write() returns (bsc#1185233). - rtc: pcf2127: handle boot-enabled watchdog feature (bsc#1185233). - rtc: pcf2127: let the core handle rtc range (bsc#1185233). - rtc: pcf2127: move watchdog initialisation to a separate function (bsc#1185233). - rtc: pcf2127: only use watchdog when explicitly available (bsc#1185233). - rtc: pcf2127: properly set flag WD_CD for rtc chips(pcf2129, pca2129) (bsc#1185233). - rtc: pcf2127: remove unnecessary #ifdef (bsc#1185233). - rtc: pcf2127: set regmap max_register (bsc#1185233). - rtc: pcf2127: watchdog: handle nowayout feature (bsc#1185233). - rtlwifi: 8821ae: upgrade PHY and RF parameters (git-fixes). - rtw88: Fix array overrun in rtw_get_tx_power_params() (git-fixes). - sata_mv: add IRQ checks (git-fixes). - scsi: block: Fix a race in the runtime power management code (git-fixes). - scsi: core: Only return started requests from scsi_host_find_tag() (bsc#1179851). - scsi: core: add scsi_host_busy_iter() (bsc#1179851). - scsi: lpfc: Copyright updates for 12.8.0.9 patches (bsc#1185472). - scsi: lpfc: Eliminate use of LPFC_DRIVER_NAME in lpfc_attr.c (bsc#1185472). - scsi: lpfc: Fix DMA virtual address ptr assignment in bsg (bsc#1185365). - scsi: lpfc: Fix NMI crash during rmmod due to circular hbalock dependency (bsc#1185472). - scsi: lpfc: Fix a bunch of kernel-doc issues (bsc#1185472). - scsi: lpfc: Fix a bunch of kernel-doc misdemeanours (bsc#1185472). - scsi: lpfc: Fix a bunch of misnamed functions (bsc#1185472). - scsi: lpfc: Fix a few incorrectly named functions (bsc#1185472). - scsi: lpfc: Fix a typo (bsc#1185472). - scsi: lpfc: Fix crash when a REG_RPI mailbox fails triggering a LOGO response (bsc#1185472). - scsi: lpfc: Fix error handling for mailboxes completed in MBX_POLL mode (bsc#1185472). - scsi: lpfc: Fix formatting and misspelling issues (bsc#1185472). - scsi: lpfc: Fix gcc -Wstringop-overread warning (bsc#1185472). - scsi: lpfc: Fix illegal memory access on Abort IOCBs (bsc#1183203). - scsi: lpfc: Fix incorrect naming of __lpfc_update_fcf_record() (bsc#1185472). - scsi: lpfc: Fix incorrectly documented function lpfc_debugfs_commonxripools_data() (bsc#1185472). - scsi: lpfc: Fix kernel-doc formatting issue (bsc#1185472). - scsi: lpfc: Fix lack of device removal on port swaps with PRLIs (bsc#1185472). - scsi: lpfc: Fix lpfc_hdw_queue attribute being ignored (bsc#1185472). - scsi: lpfc: Fix missing FDMI registrations after Mgmt Svc login (bsc#1185472). - scsi: lpfc: Fix reference counting errors in lpfc_cmpl_els_rsp() (bsc#1185472). - scsi: lpfc: Fix rmmod crash due to bad ring pointers to abort_iotag (bsc#1185472). - scsi: lpfc: Fix silent memory allocation failure in lpfc_sli4_bsg_link_diag_test() (bsc#1185472). - scsi: lpfc: Fix some error codes in debugfs (bsc#1185472). - scsi: lpfc: Fix use-after-free on unused nodes after port swap (bsc#1185472). - scsi: lpfc: Fix various trivial errors in comments and log messages (bsc#1185472). - scsi: lpfc: Remove unsupported mbox PORT_CAPABILITIES logic (bsc#1185472). - scsi: lpfc: Standardize discovery object logging format (bsc#1185472). - scsi: lpfc: Update lpfc version to 12.8.0.9 (bsc#1185472). - scsi: qla2xxx: Add H:C:T info in the log message for fc ports (bsc#1185491). - scsi: qla2xxx: Add error counters to debugfs node (bsc#1185491). - scsi: qla2xxx: Always check the return value of qla24xx_get_isp_stats() (bsc#1185491). - scsi: qla2xxx: Assign boolean values to a bool variable (bsc#1185491). - scsi: qla2xxx: Check kzalloc() return value (bsc#1185491). - scsi: qla2xxx: Consolidate zio threshold setting for both FCP & NVMe (bsc#1185491). - scsi: qla2xxx: Constify struct qla_tgt_func_tmpl (bsc#1185491). - scsi: qla2xxx: Do logout even if fabric scan retries got exhausted (bsc#1185491). - scsi: qla2xxx: Enable NVMe CONF (BIT_7) when enabling SLER (bsc#1185491). - scsi: qla2xxx: Fix IOPS drop seen in some adapters (bsc#1185491). - scsi: qla2xxx: Fix RISC RESET completion polling (bsc#1185491). - scsi: qla2xxx: Fix a couple of misdocumented functions (bsc#1185491). - scsi: qla2xxx: Fix a couple of misnamed functions (bsc#1185491). - scsi: qla2xxx: Fix broken #endif placement (bsc#1185491). - scsi: qla2xxx: Fix crash in PCIe error handling (bsc#1185491). - scsi: qla2xxx: Fix crash in qla2xxx_mqueuecommand() (bsc#1185491). - scsi: qla2xxx: Fix endianness annotations (bsc#1185491). - scsi: qla2xxx: Fix incorrectly named function qla8044_check_temp() (bsc#1185491). - scsi: qla2xxx: Fix mailbox Ch erroneous error (bsc#1185491). - scsi: qla2xxx: Fix mailbox recovery during PCIe error (bsc#1185491). - scsi: qla2xxx: Fix some incorrect formatting/spelling issues (bsc#1185491). - scsi: qla2xxx: Fix some memory corruption (bsc#1185491). - scsi: qla2xxx: Fix stuck session (bsc#1185491). - scsi: qla2xxx: Fix use after free in bsg (bsc#1185491). - scsi: qla2xxx: Implementation to get and manage host, target stats and initiator port (bsc#1185491). - scsi: qla2xxx: Move some messages from debug to normal log level (bsc#1185491). - scsi: qla2xxx: Remove redundant NULL check (bsc#1185491). - scsi: qla2xxx: Remove unnecessary NULL check (bsc#1185491). - scsi: qla2xxx: Remove unneeded if-null-free check (bsc#1185491). - scsi: qla2xxx: Replace __qla2x00_marker()'s missing underscores (bsc#1185491). - scsi: qla2xxx: Reserve extra IRQ vectors (bsc#1184436). - scsi: qla2xxx: Reuse existing error handling path (bsc#1185491). - scsi: qla2xxx: Simplify if statement (bsc#1185491). - scsi: qla2xxx: Simplify qla8044_minidump_process_control() (bsc#1185491). - scsi: qla2xxx: Simplify the calculation of variables (bsc#1185491). - scsi: qla2xxx: Suppress Coverity complaints about dseg_r* (bsc#1185491). - scsi: qla2xxx: Update default AER debug mask (bsc#1185491). - scsi: qla2xxx: Update version to 10.02.00.105-k (bsc#1185491). - scsi: qla2xxx: Update version to 10.02.00.106-k (bsc#1185491). - scsi: qla2xxx: Use dma_pool_zalloc() (bsc#1185491). - scsi: qla2xxx: Wait for ABTS response on I/O timeouts for NVMe (bsc#1185491). - scsi: qla2xxx: fc_remote_port_chkready() returns a SCSI result value (bsc#1185491). - scsi: smartpqi: Correct driver removal with HBA disks (bsc#1178089). - scsi: smartpqi: Correct pqi_sas_smp_handler busy condition (bsc#1178089). - scsi: smartpqi: Update version to 1.2.16-012 (bsc#1178089). - selftests/powerpc: Add pkey helpers for rights (bsc#1184934 ltc#191460). - selftests/powerpc: Add test for execute-disabled pkeys (bsc#1184934 ltc#191460). - selftests/powerpc: Add test for pkey siginfo verification (bsc#1184934 ltc#191460). - selftests/powerpc: Add wrapper for gettid (bsc#1184934 ltc#191460). - selftests/powerpc: Fix L1D flushing tests for Power10 (bsc#1184934 ltc#191460). - selftests/powerpc: Fix exit status of pkey tests (bsc#1184934 ltc#191460). - selftests/powerpc: Fix pkey syscall redefinitions (bsc#1184934 ltc#191460). - selftests/powerpc: Move pkey helpers to headers (bsc#1184934 ltc#191460). - selftests/powerpc: refactor entry and rfi_flush tests (bsc#1184934 ltc#191460). - series.conf: cleanup - series.conf: cleanup - series.conf: cleanup - soc: aspeed: fix a ternary sign expansion bug (git-fixes). - soc: qcom: mdt_loader: Detect truncated read of segments (git-fixes). - soc: qcom: mdt_loader: Validate that p_filesz < p_memsz (git-fixes). - soundwire: bus: Fix device found flag correctly (git-fixes). - soundwire: stream: fix memory leak in stream config error path (git-fixes). - spi: Introduce dspi_slave_abort() function for NXP's dspi SPI driver (bsc#1167260). - spi: fsl-dspi: fix NULL pointer dereference (bsc#1167260). - spi: fsl-dspi: fix use-after-free in remove path (bsc#1167260). - spi: fsl-dspi: fix wrong pointer in suspend/resume (bsc#1167260). - spi: fsl-lpspi: Fix PM reference leak in lpspi_prepare_xfer_hardware() (git-fixes). - spi: spi-fsl-dspi: Accelerate transfers using larger word size if possible (bsc#1167260). - spi: spi-fsl-dspi: Add comments around dspi_pop_tx and dspi_push_rx functions (bsc#1167260). - spi: spi-fsl-dspi: Add support for LS1028A (bsc#1167260). - spi: spi-fsl-dspi: Adding shutdown hook (bsc#1167260). - spi: spi-fsl-dspi: Always use the TCFQ devices in poll mode (bsc#1167260). - spi: spi-fsl-dspi: Avoid NULL pointer in dspi_slave_abort for non-DMA mode (bsc#1167260). - spi: spi-fsl-dspi: Avoid reading more data than written in EOQ mode (bsc#1167260). - spi: spi-fsl-dspi: Change usage pattern of SPI_MCR_* and SPI_CTAR_* macros (bsc#1167260). - spi: spi-fsl-dspi: Convert TCFQ users to XSPI FIFO mode (bsc#1167260). - spi: spi-fsl-dspi: Convert the instantiations that support it to DMA (bsc#1167260). - spi: spi-fsl-dspi: Demistify magic value in SPI_SR_CLEAR (bsc#1167260). - spi: spi-fsl-dspi: Do not access reserved fields in SPI_MCR (bsc#1167260). - spi: spi-fsl-dspi: Do not mask off undefined bits (bsc#1167260). - spi: spi-fsl-dspi: Exit the ISR with IRQ_NONE when it's not ours (bsc#1167260). - spi: spi-fsl-dspi: Fix 16-bit word order in 32-bit XSPI mode (bsc#1167260). - spi: spi-fsl-dspi: Fix bits-per-word acceleration in DMA mode (bsc#1167260). - spi: spi-fsl-dspi: Fix code alignment (bsc#1167260). - spi: spi-fsl-dspi: Fix external abort on interrupt in resume or exit paths (bsc#1167260). - spi: spi-fsl-dspi: Fix interrupt-less DMA mode taking an XSPI code path (bsc#1167260). - spi: spi-fsl-dspi: Fix little endian access to PUSHR CMD and TXDATA (bsc#1167260). - spi: spi-fsl-dspi: Fix lockup if device is removed during SPI transfer (bsc#1167260). - spi: spi-fsl-dspi: Fix lockup if device is shutdown during SPI transfer (bsc#1167260). - spi: spi-fsl-dspi: Fix race condition in TCFQ/EOQ interrupt (bsc#1167260). - spi: spi-fsl-dspi: Fix typos (bsc#1167260). - spi: spi-fsl-dspi: Free DMA memory with matching function (bsc#1167260). - spi: spi-fsl-dspi: Implement .max_message_size method for EOQ mode (bsc#1167260). - spi: spi-fsl-dspi: Initialize completion before possible interrupt (bsc#1167260). - spi: spi-fsl-dspi: LS2080A and LX2160A support XSPI mode (bsc#1167260). - spi: spi-fsl-dspi: Make bus-num property optional (bsc#1167260). - spi: spi-fsl-dspi: Move dspi_interrupt above dspi_transfer_one_message (bsc#1167260). - spi: spi-fsl-dspi: Move invariant configs out of dspi_transfer_one_message (bsc#1167260). - spi: spi-fsl-dspi: Optimize dspi_setup_accel for lowest interrupt count (bsc#1167260). - spi: spi-fsl-dspi: Parameterize the FIFO size and DMA buffer size (bsc#1167260). - spi: spi-fsl-dspi: Protect against races on dspi->words_in_flight (bsc#1167260). - spi: spi-fsl-dspi: Reduce indentation in dspi_release_dma() (bsc#1167260). - spi: spi-fsl-dspi: Reduce indentation level in dspi_interrupt (bsc#1167260). - spi: spi-fsl-dspi: Remove impossible to reach error check (bsc#1167260). - spi: spi-fsl-dspi: Remove pointless assignment of master->transfer to NULL (bsc#1167260). - spi: spi-fsl-dspi: Remove unused chip->void_write_data (bsc#1167260). - spi: spi-fsl-dspi: Remove unused defines and includes (bsc#1167260). - spi: spi-fsl-dspi: Remove unused initialization of 'ret' in dspi_probe (bsc#1167260). - spi: spi-fsl-dspi: Rename fifo_{read,write} and {tx,cmd}_fifo_write (bsc#1167260). - spi: spi-fsl-dspi: Replace interruptible wait queue with a simple completion (bsc#1167260). - spi: spi-fsl-dspi: Replace legacy spi_master names with spi_controller (bsc#1167260). - spi: spi-fsl-dspi: Simplify bytes_per_word gymnastics (bsc#1167260). - spi: spi-fsl-dspi: Take software timestamp in dspi_fifo_write (bsc#1167260). - spi: spi-fsl-dspi: Use BIT() and GENMASK() macros (bsc#1167260). - spi: spi-fsl-dspi: Use EOQ for last word in buffer even for XSPI mode (bsc#1167260). - spi: spi-fsl-dspi: Use dma_request_chan() instead dma_request_slave_channel() (bsc#1167260). - spi: spi-fsl-dspi: Use poll mode in case the platform IRQ is missing (bsc#1167260). - spi: spi-fsl-dspi: Use reverse Christmas tree declaration order (bsc#1167260). - spi: spi-fsl-dspi: Use specific compatible strings for all SoC instantiations (bsc#1167260). - spi: spi-fsl-dspi: delete EOQ transfer mode (bsc#1167260). - spi: spi-fsl-dspi: fix DMA mapping (bsc#1167260). - spi: spi-fsl-dspi: fix native data copy (bsc#1167260). - spi: spi-fsl-dspi: remove git-fixes Remove git-fixes. Prepare to update the driver. References: bsc#1167260 - spi: spi-fsl-dspi: set ColdFire to DMA mode (bsc#1167260). - spi: spi-fsl-dspi: use XSPI mode instead of DMA for DPAA2 SoCs (bsc#1167260). - spi: spi-ti-qspi: Free DMA resources (git-fixes). - staging: fwserial: fix TIOCGSERIAL implementation (git-fixes). - staging: fwserial: fix TIOCSSERIAL implementation (git-fixes). - staging: fwserial: fix TIOCSSERIAL jiffies conversions (git-fixes). - staging: fwserial: fix TIOCSSERIAL permission check (git-fixes). - staging: rtl8192u: Fix potential infinite loop (git-fixes). - thermal/drivers/cpufreq_cooling: Update cpufreq_state only if state has changed (git-fixes). - usb: Remove dev_err() usage after platform_get_irq() (git-fixes). - usb: dwc2: Fix hibernation between host and device modes (git-fixes). - usb: dwc2: Fix host mode hibernation exit with remote wakeup flow (git-fixes). - usb: dwc2: Fix session request interrupt handler (git-fixes). - usb: dwc3: Switch to use device_property_count_u32() (git-fixes). - usb: dwc3: Update soft-reset wait polling rate (git-fixes). - usb: dwc3: gadget: Fix START_TRANSFER link state check (git-fixes). - usb: dwc3: keystone: use devm_platform_ioremap_resource() to simplify code (git-fixes). - usb: dwc3: meson-g12a: use devm_platform_ioremap_resource() to simplify code (git-fixes). - usb: gadget: Fix double free of device descriptor pointers (git-fixes). - usb: gadget: aspeed: fix dma map failure (git-fixes). - usb: gadget: pch_udc: Check for DMA mapping error (git-fixes). - usb: gadget: pch_udc: Check if driver is present before calling ->setup() (git-fixes). - usb: gadget: pch_udc: Move pch_udc_init() to satisfy kernel doc (git-fixes). - usb: gadget: pch_udc: Replace cpu_to_le32() by lower_32_bits() (git-fixes). - usb: gadget: pch_udc: Revert d3cb25a12138 completely (git-fixes). - usb: gadget: r8a66597: Add missing null check on return from platform_get_resource (git-fixes). - usb: typec: tcpci: Check ROLE_CONTROL while interpreting CC_STATUS (git-fixes). - usb: typec: tcpm: Address incorrect values of tcpm psy for fixed supply (git-fixes). - usb: typec: tcpm: Honour pSnkStdby requirement during negotiation (git-fixes). - veth: Store queue_mapping independently of XDP prog presence (git-fixes). - vfio/pci: Add missing range check in vfio_pci_mmap (git-fixes). - virt_wifi: Return micros for BSS TSF values (git-fixes). - vxlan: move debug check after netdev unregister (git-fixes). - workqueue: Move the position of debug_work_activate() in __queue_work() (bsc#1184893). - x86/crash: Fix crash_setup_memmap_entries() out-of-bounds access (bsc#1152489). - x86/insn: Add some Intel instructions to the opcode map (bsc#1184760). - x86/insn: Add some more Intel instructions to the opcode map (bsc#1184760). - x86/microcode: Check for offline CPUs before requesting new microcode (bsc#1152489). - x86/mm: Fix NX bit clearing issue in kernel_map_pages_in_pgd (bsc#1152489). - x86/platform/uv: Set section block size for hubless architectures (bsc#1152489). - x86/reboot: Force all cpus to exit VMX root if VMX is supported (bsc#1152489). Special Instructions and Notes: Please reboot the system after installing this update. Patch Instructions: To install this openSUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 15.2: zypper in -t patch openSUSE-2021-716=1 Package List: - openSUSE Leap 15.2 (x86_64): kernel-debug-5.3.18-lp152.75.1 kernel-debug-debuginfo-5.3.18-lp152.75.1 kernel-debug-debugsource-5.3.18-lp152.75.1 kernel-debug-devel-5.3.18-lp152.75.1 kernel-debug-devel-debuginfo-5.3.18-lp152.75.1 kernel-default-5.3.18-lp152.75.1 kernel-default-base-5.3.18-lp152.75.1.lp152.8.32.1 kernel-default-base-rebuild-5.3.18-lp152.75.1.lp152.8.32.1 kernel-default-debuginfo-5.3.18-lp152.75.1 kernel-default-debugsource-5.3.18-lp152.75.1 kernel-default-devel-5.3.18-lp152.75.1 kernel-default-devel-debuginfo-5.3.18-lp152.75.1 kernel-kvmsmall-5.3.18-lp152.75.1 kernel-kvmsmall-debuginfo-5.3.18-lp152.75.1 kernel-kvmsmall-debugsource-5.3.18-lp152.75.1 kernel-kvmsmall-devel-5.3.18-lp152.75.1 kernel-kvmsmall-devel-debuginfo-5.3.18-lp152.75.1 kernel-obs-build-5.3.18-lp152.75.1 kernel-obs-build-debugsource-5.3.18-lp152.75.1 kernel-obs-qa-5.3.18-lp152.75.1 kernel-preempt-5.3.18-lp152.75.1 kernel-preempt-debuginfo-5.3.18-lp152.75.1 kernel-preempt-debugsource-5.3.18-lp152.75.1 kernel-preempt-devel-5.3.18-lp152.75.1 kernel-preempt-devel-debuginfo-5.3.18-lp152.75.1 kernel-syms-5.3.18-lp152.75.1 - openSUSE Leap 15.2 (noarch): kernel-devel-5.3.18-lp152.75.1 kernel-docs-5.3.18-lp152.75.1 kernel-docs-html-5.3.18-lp152.75.1 kernel-macros-5.3.18-lp152.75.1 kernel-source-5.3.18-lp152.75.1 kernel-source-vanilla-5.3.18-lp152.75.1 References: https://www.suse.com/security/cve/CVE-2021-29155.html https://www.suse.com/security/cve/CVE-2021-29650.html https://bugzilla.suse.com/1043990 https://bugzilla.suse.com/1055117 https://bugzilla.suse.com/1065729 https://bugzilla.suse.com/1152457 https://bugzilla.suse.com/1152489 https://bugzilla.suse.com/1156395 https://bugzilla.suse.com/1167260 https://bugzilla.suse.com/1168838 https://bugzilla.suse.com/1174416 https://bugzilla.suse.com/1174426 https://bugzilla.suse.com/1178089 https://bugzilla.suse.com/1179243 https://bugzilla.suse.com/1179825 https://bugzilla.suse.com/1179851 https://bugzilla.suse.com/1180846 https://bugzilla.suse.com/1181161 https://bugzilla.suse.com/1182613 https://bugzilla.suse.com/1182999 https://bugzilla.suse.com/1183063 https://bugzilla.suse.com/1183203 https://bugzilla.suse.com/1183289 https://bugzilla.suse.com/1184208 https://bugzilla.suse.com/1184209 https://bugzilla.suse.com/1184436 https://bugzilla.suse.com/1184514 https://bugzilla.suse.com/1184650 https://bugzilla.suse.com/1184724 https://bugzilla.suse.com/1184728 https://bugzilla.suse.com/1184730 https://bugzilla.suse.com/1184731 https://bugzilla.suse.com/1184736 https://bugzilla.suse.com/1184737 https://bugzilla.suse.com/1184738 https://bugzilla.suse.com/1184740 https://bugzilla.suse.com/1184741 https://bugzilla.suse.com/1184742 https://bugzilla.suse.com/1184760 https://bugzilla.suse.com/1184811 https://bugzilla.suse.com/1184893 https://bugzilla.suse.com/1184934 https://bugzilla.suse.com/1184942 https://bugzilla.suse.com/1184957 https://bugzilla.suse.com/1184969 https://bugzilla.suse.com/1184984 https://bugzilla.suse.com/1185041 https://bugzilla.suse.com/1185113 https://bugzilla.suse.com/1185233 https://bugzilla.suse.com/1185244 https://bugzilla.suse.com/1185269 https://bugzilla.suse.com/1185365 https://bugzilla.suse.com/1185454 https://bugzilla.suse.com/1185472 https://bugzilla.suse.com/1185491 https://bugzilla.suse.com/1185549 https://bugzilla.suse.com/1185586 https://bugzilla.suse.com/1185587 https://bugzilla.suse.com/1185606

1 0

openSUSE-SU-2021:0715-1: important: Security update for nagios
by opensuse-security＠opensuse.org 12 May '21

12 May '21

openSUSE Security Update: Security update for nagios ______________________________________________________________________________ Announcement ID: openSUSE-SU-2021:0715-1 Rating: important References: #1003362 #1014637 #1172794 #1182398 #989759 Cross-References: CVE-2016-6209 CVE-2020-13977 CVSS scores: CVE-2016-6209 (NVD) : 6.1 CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N CVE-2020-13977 (NVD) : 4.9 CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:H/A:N CVE-2020-13977 (SUSE): 4.9 CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:H/A:N Affected Products: openSUSE Leap 15.2 ______________________________________________________________________________ An update that solves two vulnerabilities and has three fixes is now available. Description: This update for nagios fixes the following issues: - new nagios-exec-start-post script to fix boo#1003362 - fix nagios_upgrade.sh writing to log file in user controlled directory (boo#1182398). The nagios_upgrade.sh script writes the logfile directly below /var/log/ nagios was updated to 4.4.6: * Fixed Map display in Internet Explorer 11 (#714) * Fixed duplicate properties appearing in statusjson.cgi (#718) * Fixed NERD not building when enabled in ./configure (#723) * Fixed build process when using GCC 10 (#721) * Fixed postauth vulnerabilities in histogram.js, map.js, trends.js (CVE-2020-13977, boo#1172794) * When using systemd, configuration will be verified before reloading (#715) * Fixed HARD OK states triggering on the maximum check attempt (#757) * Fix for CVE-2016-6209 (boo#989759) - The "corewindow" parameter (as in bringing this to our attention go to Dawid Golunski (boo#1014637) Patch Instructions: To install this openSUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 15.2: zypper in -t patch openSUSE-2021-715=1 Package List: - openSUSE Leap 15.2 (x86_64): nagios-4.4.6-lp152.2.3.1 nagios-contrib-4.4.6-lp152.2.3.1 nagios-debuginfo-4.4.6-lp152.2.3.1 nagios-debugsource-4.4.6-lp152.2.3.1 nagios-devel-4.4.6-lp152.2.3.1 nagios-www-4.4.6-lp152.2.3.1 nagios-www-dch-4.4.6-lp152.2.3.1 nagios-www-debuginfo-4.4.6-lp152.2.3.1 - openSUSE Leap 15.2 (noarch): nagios-theme-exfoliation-4.4.6-lp152.2.3.1 References: https://www.suse.com/security/cve/CVE-2016-6209.html https://www.suse.com/security/cve/CVE-2020-13977.html https://bugzilla.suse.com/1003362 https://bugzilla.suse.com/1014637 https://bugzilla.suse.com/1172794 https://bugzilla.suse.com/1182398 https://bugzilla.suse.com/989759

1 0

openSUSE-SU-2021:0714-1: moderate: Security update for vlc
by opensuse-security＠opensuse.org 12 May '21

12 May '21

openSUSE Security Update: Security update for vlc ______________________________________________________________________________ Announcement ID: openSUSE-SU-2021:0714-1 Rating: moderate References: #1181918 Cross-References: CVE-2020-26664 CVSS scores: CVE-2020-26664 (NVD) : 7.8 CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H Affected Products: openSUSE Backports SLE-15-SP2 ______________________________________________________________________________ An update that fixes one vulnerability is now available. Description: This update for vlc fixes the following issues: Update to version 3.0.13: + Demux: - Adaptive: fix artefacts in HLS streams with wrong profiles/levels - Fix regression on some MP4 files for the audio track - Fix MPGA and ADTS probing in TS files - Fix Flac inside AVI files - Fix VP9/Webm artefacts when seeking + Codec: - Support SSA text scaling - Fix rotation on Android rotation - Fix WebVTT subtitles that start at 00:00 + Access: - Update libnfs to support NFSv4 - Improve SMB2 integration - Fix Blu-ray files using Unicode names on Windows - Disable mcast lookups on Android for RTSP playback + Video Output: Rework the D3D11 rendering wait, to fix choppiness on display + Interfaces: - Fix VLC getting stuck on close on X11 (#21875) - Improve RTL on preferences on macOS - Add mousewheel horizontal axis control - Fix crash on exit on macOS - Fix sizing of the fullscreen controls on macOS + Misc: - Improve MIDI fonts search on Linux - Update Soundcloud, Youtube, liveleak - Fix compilation with GCC11 - Fix input-slave option for subtitles + Updated translations. Update to version 3.0.12: + Access: Add new RIST access module compliant with simple profile (VSF_TR-06-1). + Access Output: Add new RIST access output module compliant with simple profile (VSF_TR-06-1). + Demux: Fixed adaptive's handling of resolution settings. + Audio output: Fix audio distortion on macOS during start of playback. + Video Output: Direct3D11: Fix some potential crashes when using video filters. + Misc: - Several fixes in the web interface, including privacy and security improvements - Update YouTube and Vocaroo scripts. + Updated translations. This update was imported from the openSUSE:Leap:15.2:Update update project. Patch Instructions: To install this openSUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Backports SLE-15-SP2: zypper in -t patch openSUSE-2021-714=1 Package List: - openSUSE Backports SLE-15-SP2 (aarch64 ppc64le s390x x86_64): libvlc5-3.0.13-bp152.2.12.1 libvlccore9-3.0.13-bp152.2.12.1 vlc-3.0.13-bp152.2.12.1 vlc-codec-gstreamer-3.0.13-bp152.2.12.1 vlc-devel-3.0.13-bp152.2.12.1 vlc-jack-3.0.13-bp152.2.12.1 vlc-noX-3.0.13-bp152.2.12.1 vlc-opencv-3.0.13-bp152.2.12.1 vlc-qt-3.0.13-bp152.2.12.1 vlc-vdpau-3.0.13-bp152.2.12.1 - openSUSE Backports SLE-15-SP2 (noarch): vlc-lang-3.0.13-bp152.2.12.1 References: https://www.suse.com/security/cve/CVE-2020-26664.html https://bugzilla.suse.com/1181918

1 0

openSUSE-SU-2021:0713-1: moderate: Security update for syncthing
by opensuse-security＠opensuse.org 11 May '21

11 May '21

openSUSE Security Update: Security update for syncthing ______________________________________________________________________________ Announcement ID: openSUSE-SU-2021:0713-1 Rating: moderate References: #1184428 Cross-References: CVE-2021-21404 CVSS scores: CVE-2021-21404 (NVD) : 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H Affected Products: openSUSE Backports SLE-15-SP2 ______________________________________________________________________________ An update that fixes one vulnerability is now available. Description: This update for syncthing fixes the following issues: Update to 1.15.0/1.15.1 * This release fixes a vulnerability where Syncthing and the relay server can crash due to malformed relay protocol messages (CVE-2021-21404); see GHSA-x462-89pf-6r5h. (boo#1184428) * This release updates the CLI to use subcommands and adds the subcommands cli (previously standalone stcli utility) and decrypt (for offline verifying and decrypting encrypted folders). * With this release we invite everyone to test the "untrusted (encrypted) devices" feature. You should not use it yet on important production data. Thus UI controls are hidden behind a feature flag. For more information, visit: https://forum.syncthing.net/t/testing-untrusted-encrypted-devices/16470 Update to 1.14.0 * This release adds configurable device and folder defaults. * The output format of the /rest/db/browse endpoint has changed. update to 1.13.1: * This release adds configuration options for min/max connections (see https://docs.syncthing.net/advanced/option-connection-limits.html) and moves the storage of pending devices/folders from the config to the database (see https://docs.syncthing.net/dev/rest.html#cluster-endpoints) * Bugfixes * Official builds of v1.13.0 come with the Tech Ui, which is impossible to switch back from update to 1.12.1: * Invalid names are allowed and "auto accepted" in folder root path on Windows * Sometimes indexes for some folders aren't sent after starting Syncthing * [Untrusted] Remove Unexpected Items leaves things behind * Wrong theme on selection * Quic spamming address resolving * Deleted locally changed items still shown as locally changed * Allow specifying remote expected web UI port which would generate a href somewhere * Ignore fsync errors when saving ignore files Update to 1.12.0 - The 1.12.0 release - adds a new config REST API. - The 1.11.0 release - adds the sendFullIndexOnUpgrade option to control whether all index data is resent when an upgrade is detected, equivalent to starting Syncthing with --reset-deltas. This (sendFullIndexOnUpgrade=true) used to be the behavior in previous versions, but is mainly useful as a troubleshooting step and causes high database churn. The new default is false. - Update to 1.10.0 - This release adds the config option announceLANAddresses to enable (the default) or disable announcing private (RFC1918) LAN IP addresses to global discovery. - Update to 1.9.0 - This release adds the advanced folder option caseSensitiveFS (https://docs.syncthing.net/advanced/folder-caseSensitiveFS.html) to disable the new safe handling of case insensitive filesystems. - Fix Leap build by requiring at least Go 1.14 - Prevent the build system to download Go modules which would require an internet connection during the build - Update to 1.8.0 - The 1.8.0 release - adds the experimental copyRangeMethod config on folders, for use on filesystems with copy-on-write support. Please see https://docs.syncthing.net/advanced/folder-copyrangemethod.html for details. - adds TCP hole punching, used to establish high performance TCP connections in certain NAT scenarios where only relay or QUIC connections could be used previously. - adds a configuration to file versioning for how often to run cleanup. This defaults to once an hour, but is configurable from very frequently to never. - The 1.7.0 release performs a database migration to optimize for clusters with many devices. - The 1.6.0 release performs a database schema migration, and adds the BlockPullOrder, DisableFsync and MaxConcurrentWrites folder options to the configuration schema. The LocalChangeDetected event no longer has the action set to added for new files, instead showing modified for all local file changes. - The 1.5.0 release changes the default location for the index database under some circumstances. Two new flags can also be used to affect the location of the configuration (-config) and database (-data) separately. The old -home flag is equivalent to setting both of these to the same directory. When no flags are given the following logic is used to determine the data location: If a database exists in the old default location, that location is still used. This means existing installations are not affected by this change. If $XDG_DATA_HOME is set, use $XDG_DATA_HOME/syncthing. If ~/.local/share/syncthing exists, use that location. Use the old default location. - Update to 1.4.2: - Bugfixes: - #6499: panic: nil pointer dereference in usage reporting - Other issues: - revert a change to the upgrade code that puts unnecessary load on the upgrade server - Update to 1.4.1: - Bugfixes: - #6289: "general SOCKS server failure" since syncthing 1.3.3 - #6365: Connection errors not shown in GUI - #6415: Loop in database migration "folder db index missing" after upgrade to v1.4.0 - #6422: "fatal error: runtime: out of memory" during database migration on QNAP NAS - Enhancements: - #5380: gui: Display folder/device name in modal - #5979: UNIX socket permission bits - #6384: Do auto upgrades early and synchronously on startup - Other issues: - #6249: Remove unnecessary RAM/CPU stats from GUI - Update to 1.4.0: - Important changes: - New config option maxConcurrentIncomingRequestKiB - Replace config option maxConcurrentScans with maxFolderConcurrency - Improve database schema - Bugfixes: - #4774: Doesn't react to Ctrl-C when run in a subshell with -no-restart (Linux) - #5952: panic: Should never get a deleted file as needed when we don't have it - #6281: Progress emitter uses 100% CPU - #6300: lib/ignore: panic: runtime error: index out of range [0] with length 0 - #6304: Syncing issues, database missing sequence entries - #6335: Crash or hard shutdown can case database inconsistency, out of sync - Enhancements: - #5786: Consider always running the monitor process - #5898: Database performance: reduce duplication - #5914: Limit folder concurrency to improve performance - #6302: Avoid thundering herd issue by global request limiter - Change the Go build requirement to a more flexible "golang(API) >= 1.12". This update was imported from the openSUSE:Leap:15.2:Update update project. Patch Instructions: To install this openSUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Backports SLE-15-SP2: zypper in -t patch openSUSE-2021-713=1 Package List: - openSUSE Backports SLE-15-SP2 (aarch64 ppc64le s390x x86_64): syncthing-1.15.1-bp152.2.3.1 syncthing-relaysrv-1.15.1-bp152.2.3.1 References: https://www.suse.com/security/cve/CVE-2021-21404.html https://bugzilla.suse.com/1184428

1 0

openSUSE-SU-2021:0712-1: important: Security update for opera
by opensuse-security＠opensuse.org 11 May '21

11 May '21

openSUSE Security Update: Security update for opera ______________________________________________________________________________ Announcement ID: openSUSE-SU-2021:0712-1 Rating: important References: Cross-References: CVE-2021-21206 CVE-2021-21220 CVE-2021-21222 CVE-2021-21223 CVE-2021-21224 CVE-2021-21225 CVE-2021-21226 CVSS scores: CVE-2021-21220 (NVD) : 8.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H CVE-2021-21222 (NVD) : 6.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N CVE-2021-21223 (NVD) : 9.6 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H CVE-2021-21224 (NVD) : 8.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H CVE-2021-21225 (NVD) : 8.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H CVE-2021-21226 (NVD) : 9.6 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H Affected Products: openSUSE Leap 15.2:NonFree ______________________________________________________________________________ An update that fixes 7 vulnerabilities is now available. Description: This update for opera fixes the following issues: Update to version 76.0.4017.94 - released on the stable branch Update to version 76.0.4017.88 - CHR-8404 Update chromium on desktop-stable-90-4017 to 90.0.4430.85 - DNA-92219 Add bookmark API supports to the front-end - DNA-92409 [MAC] ��Present now�� options windows appear behind detached window - DNA-92615 Capture tab from the tab context menu - DNA-92616 Capture tab from Snapshot - DNA-92617 Capture tab from image context menu - DNA-92652 Opera 76 translations - DNA-92680 Make image selector on any page work like bookmarks popup WP2 - DNA-92707 Crash at void base::ObserverList::AddObserver(class content::PrerenderHost::Observer*) - DNA-92710 Autoupdate on macOS 11.3 not working - DNA-92711 Make image selector on any page work like bookmarks popup WP3 - DNA-92730 Make image selector on any page work like bookmarks popup WP4 - DNA-92761 Make image selector on any page work like bookmarks popup WP5 - DNA-92776 Make image selector on any page work like bookmarks popup WP6 - DNA-92862 Make ��View pinboards�� button work - DNA-92906 Provide in-house translations for Cashback strings to Spanish - DNA-92908 API collides with oneclick installer - The update to chromium 90.0.4430.85 fixes following issues: - CVE-2021-21222, CVE-2021-21223, CVE-2021-21224, CVE-2021-21225, CVE-2021-21226 - Complete Opera 76.0 changelog at: https://blogs.opera.com/desktop/changelog-for-76/ Update to version 75.0.3969.218 - CHR-8393 Update chromium on desktop-stable-89-3969 to 89.0.4389.128 - DNA-92113 Windows debug fails to compile opera_components/ipfs/ipfs/ipfs_url_loader_throttle.obj - DNA-92198 [Arm] Update signing scripts - DNA-92200 [Arm] Create universal packages from two buildsets - DNA-92338 [Search tabs] The preview isn��t updated when the tab from another window is closed - DNA-92410 [Download popup] Selected item still looks bad in dark mode - DNA-92441 Compilation error - DNA-92514 Allow to generate universal DMG package from existing universal .tar.xz - DNA-92608 Opera 75 crash during rapid workspace switching - DNA-92627 Crash at automation::Error::code() - DNA-92630 Crash at opera::PremiumExtensionPersistentPrefStorageImpl::IsPremiumExtensionFeature Enabled() - DNA-92648 Amazon icon disappears from Sidebar Extensions section after pressing Hide Amazon button - DNA-92681 Add missing string in Japanese - DNA-92684 Fix issues with signing multiple bsids - DNA-92706 Update repack generation from universal packages - DNA-92725 Enable IPFS for all channels - The update to chromium 89.0.4389.128 fixes following issues: CVE-2021-21206, CVE-2021-21220 Patch Instructions: To install this openSUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 15.2:NonFree: zypper in -t patch openSUSE-2021-712=1 Package List: - openSUSE Leap 15.2:NonFree (x86_64): opera-76.0.4017.94-lp152.2.43.1 References: https://www.suse.com/security/cve/CVE-2021-21206.html https://www.suse.com/security/cve/CVE-2021-21220.html https://www.suse.com/security/cve/CVE-2021-21222.html https://www.suse.com/security/cve/CVE-2021-21223.html https://www.suse.com/security/cve/CVE-2021-21224.html https://www.suse.com/security/cve/CVE-2021-21225.html https://www.suse.com/security/cve/CVE-2021-21226.html

1 0

openSUSE-RU-2021:0711-1: moderate: Recommended update for pcm
by maintenance＠opensuse.org 11 May '21

11 May '21

openSUSE Recommended Update: Recommended update for pcm ______________________________________________________________________________ Announcement ID: openSUSE-RU-2021:0711-1 Rating: moderate References: Affected Products: openSUSE Backports SLE-15-SP2 ______________________________________________________________________________ An update that has 0 recommended fixes can now be installed. Description: This update for pcm fixes the following issues: Update to 202104: * Add Icelake server support This update was imported from the openSUSE:Leap:15.2:Update update project. Patch Instructions: To install this openSUSE Recommended Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Backports SLE-15-SP2: zypper in -t patch openSUSE-2021-711=1 Package List: - openSUSE Backports SLE-15-SP2 (x86_64): pcm-202104-bp152.2.9.1 References:

1 0

openSUSE-RU-2021:0710-1: moderate: Recommended update for python-yarl
by maintenance＠opensuse.org 11 May '21

11 May '21

openSUSE Recommended Update: Recommended update for python-yarl ______________________________________________________________________________ Announcement ID: openSUSE-RU-2021:0710-1 Rating: moderate References: Affected Products: openSUSE Backports SLE-15-SP2 ______________________________________________________________________________ An update that has 0 recommended fixes can now be installed. Description: This update for python-yarl contains the following fixes: - Fix python-yarl to build with new python3 version. - Allows mixing amps and semicolons in query strings as separators over previous changes. This update was imported from the SUSE:SLE-15-SP1:Update update project. This update was imported from the openSUSE:Leap:15.2:Update update project. Patch Instructions: To install this openSUSE Recommended Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Backports SLE-15-SP2: zypper in -t patch openSUSE-2021-710=1 Package List: - openSUSE Backports SLE-15-SP2 (aarch64 ppc64le s390x x86_64): python3-yarl-1.3.0-bp152.2.4.1 References:

1 0

openSUSE-RU-2021:0709-1: moderate: Recommended update for libzypp
by maintenance＠opensuse.org 11 May '21

11 May '21

openSUSE Recommended Update: Recommended update for libzypp ______________________________________________________________________________ Announcement ID: openSUSE-RU-2021:0709-1 Rating: moderate References: #1180851 #1181874 #1182936 #1183628 #1184997 #1185239 Affected Products: openSUSE Leap 15.2 ______________________________________________________________________________ An update that has 6 recommended fixes can now be installed. Description: This update for libzypp fixes the following issues: Upgrade from version 17.25.8 to version 17.25.10 - Properly handle permission denied when providing optional files. (bsc#1185239) - Fix service detection with `cgroupv2`. (bsc#1184997) - Add missing includes for GCC 11. (bsc#1181874) - Fix unsafe usage of static in media verifier. - `Solver`: Avoid segfault if no system is loaded. (bsc#1183628) - `MediaVerifier`: Relax media set verification in case of a single not-volatile medium. (bsc#1180851) - Do no cleanup in custom cache dirs. (bsc#1182936) - `ZConfig`: let `pubkeyCachePath` follow `repoCachePath`. This update was imported from the SUSE:SLE-15-SP2:Update update project. Patch Instructions: To install this openSUSE Recommended Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 15.2: zypper in -t patch openSUSE-2021-709=1 Package List: - openSUSE Leap 15.2 (i586 x86_64): libsolv-debuginfo-0.7.19-lp152.2.22.1 libsolv-debugsource-0.7.19-lp152.2.22.1 libsolv-demo-0.7.19-lp152.2.22.1 libsolv-demo-debuginfo-0.7.19-lp152.2.22.1 libsolv-devel-0.7.19-lp152.2.22.1 libsolv-devel-debuginfo-0.7.19-lp152.2.22.1 libsolv-tools-0.7.19-lp152.2.22.1 libsolv-tools-debuginfo-0.7.19-lp152.2.22.1 libzypp-17.25.10-lp152.2.28.1 libzypp-debuginfo-17.25.10-lp152.2.28.1 libzypp-debugsource-17.25.10-lp152.2.28.1 libzypp-devel-17.25.10-lp152.2.28.1 libzypp-devel-doc-17.25.10-lp152.2.28.1 perl-solv-0.7.19-lp152.2.22.1 perl-solv-debuginfo-0.7.19-lp152.2.22.1 python-solv-0.7.19-lp152.2.22.1 python-solv-debuginfo-0.7.19-lp152.2.22.1 python3-solv-0.7.19-lp152.2.22.1 python3-solv-debuginfo-0.7.19-lp152.2.22.1 ruby-solv-0.7.19-lp152.2.22.1 ruby-solv-debuginfo-0.7.19-lp152.2.22.1 References: https://bugzilla.suse.com/1180851 https://bugzilla.suse.com/1181874 https://bugzilla.suse.com/1182936 https://bugzilla.suse.com/1183628 https://bugzilla.suse.com/1184997 https://bugzilla.suse.com/1185239

1 0

openSUSE-RU-2021:0708-1: Recommended update for libmodulemd
by maintenance＠opensuse.org 11 May '21

11 May '21

openSUSE Recommended Update: Recommended update for libmodulemd ______________________________________________________________________________ Announcement ID: openSUSE-RU-2021:0708-1 Rating: low References: Affected Products: openSUSE Backports SLE-15-SP2 ______________________________________________________________________________ An update that has 0 recommended fixes can now be installed. Description: This update for libmodulemd fixes the following issues: - Added support for 'buildorder' to Packager documents - Fixed an issue with ModuleIndex when input contains only Obsoletes documents - Extended read_packager_[file|string]() to support overriding the module name and stream - Ignore Packager documents when running ModuleIndex.update_from_*() - Added python overrides for XMD in PackagerV3 - Added python override to ignore the GType return when reading packager files - Added PackagerV3.get_mdversion() This update was imported from the SUSE:SLE-15-SP2:Update update project. This update was imported from the openSUSE:Leap:15.2:Update update project. Patch Instructions: To install this openSUSE Recommended Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Backports SLE-15-SP2: zypper in -t patch openSUSE-2021-708=1 Package List: - openSUSE Backports SLE-15-SP2 (aarch64 ppc64le s390x x86_64): libmodulemd-devel-2.12.0-bp152.5.6.1 libmodulemd2-2.12.0-bp152.5.6.1 modulemd-validator-2.12.0-bp152.5.6.1 python3-libmodulemd-2.12.0-bp152.5.6.1 typelib-1_0-Modulemd-2_0-2.12.0-bp152.5.6.1 References:

1 0

openSUSE-SU-2021:0707-1: important: Security update for perl-Image-ExifTool
by opensuse-security＠opensuse.org 10 May '21

10 May '21

openSUSE Security Update: Security update for perl-Image-ExifTool ______________________________________________________________________________ Announcement ID: openSUSE-SU-2021:0707-1 Rating: important References: #1185547 Cross-References: CVE-2021-22204 CVSS scores: CVE-2021-22204 (NVD) : 7.8 CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H Affected Products: openSUSE Leap 15.2 openSUSE Backports SLE-15-SP2 openSUSE Backports SLE-15-SP1 ______________________________________________________________________________ An update that fixes one vulnerability is now available. Description: This update for perl-Image-ExifTool fixes the following issues: Update to version 12.25 fixes (boo#1185547 CVE-2021-22204) * JPEG XL support is now official * Added read support for Medical Research Council (MRC) image files * Added ability to write a number of 3gp tags in video files * Added a new Sony PictureProfile value (thanks Jos Roost) * Added a new Sony LensType (thanks LibRaw) * Added a new Nikon LensID (thanks Niels Kristian Bech Jensen) * Added a new Canon LensType * Decode more GPS information from Blackvue dashcam videos * Decode a couple of new NikonSettings tags (thanks Warren Hatch) * Decode a few new RIFF tags * Improved Validate option to add minor warning if standard XMP is missing xpacket wrapper * Avoid decoding some large arrays in DNG images to improve performance unless the -m option is used * Patched bug that could give runtime warning when trying to write an empty XMP structure * Fixed decoding of ImageWidth/Height for JPEG XL images * Fixed problem were Microsoft Xtra tags couldn't be deleted version 12.24: * Added a new PhaseOne RawFormat value (thanks LibRaw) * Decode a new Sony tag (thanks Jos Roost) * Decode a few new Panasonic and FujiFilm tags (thanks LibRaw and Greybeard) * Patched security vulnerability in DjVu reader * Updated acdsee.config in distribution (thanks StarGeek) * Recognize AutoCAD DXF files * More work on experimental JUMBF read support * More work on experimental JPEG XL read/write support version 12.23: * Added support for Olympus ORI files * Added experimental read/write support for JPEG XL images * Added experimental read support for JUMBF metadata in JPEG and Jpeg2000 images * Added built-in support for parsing GPS track from Denver ACG-8050 videos with the -ee option * Added a some new Sony lenses (thanks Jos Roost and LibRaw) * Changed priority of Samsung trailer tags so the first DepthMapImage takes precedence when -a is not used * Improved identification of M4A audio files * Patched to avoid escaping ',' in "Binary data" message when -struct is used * Removed Unknown flag from MXF VideoCodingSchemeID tag * Fixed -forcewrite=EXIF to apply to EXIF in binary header of EPS files * API Changes: + Added BlockExtract option version 12.22: * Added a few new Sony LensTypes and a new SonyModelID (thanks Jos Roost and LibRaw) * Added Extra BaseName tag * Added a new CanonModelID (thanks LibRaw) * Decode timed GPS from unlisted programs in M2TS videos with the -ee3 option * Decode more Sony rtmd tags * Decode some tags for the Sony ILME-FX3 (thanks Jos Roost) * Allow negative values to be written to XMP-aux:LensID * Recognize HEVC video program in M2TS files * Enhanced -b option so --b suppresses tags with binary data * Improved flexibility when writing GPS coordinates: + Now pulls latitude and longitude from a combined GPSCoordinates string + Recognizes the full word "South" and "West" to write negative coordinates * Improved warning when trying to write an integer QuickTime date/time tag and Time::Local is not available * Convert GPSSpeed from mph to km/h in timed GPS from Garmin MP4 videos version 12.21: * Added a few new iOS QuickTime tags * Decode a couple more Sony rtmd tags * Patch to avoid possible "Use of uninitialized value" warning when attempting to write QuickTime date/time tags with an invalid value * Fixed problem writing Microsoft Xtra tags * Fixed Windows daylight savings time patch for file times that was broken in 12.19 (however directory times will not yet handle DST properly) version 12.20: * Added ability to write some Microsoft Xtra tags in MOV/MP4 videos * Added two new Canon LensType values (thanks Norbert Wasser) * Added a new Nikon LensID * Fixed problem reading FITS comments that start before column 11 version 12.19: * Added -list_dir option * Added the "ls-l" Shortcut tag * Extract Comment and History from FITS files * Enhanced FilePermissions to include device type (similar to "ls -l") * Changed the name of Apple ContentIdentifier tag to MediaGroupUUID (thanks Neal Krawetz) * Fixed a potential "substr outside of string" runtime error when reading corrupted EXIF * Fixed edge case where NikonScanIFD may not be copied properly when copying MakerNotes to another file * API Changes: + Added ability to read/write System tags of directories + Enhanced GetAllGroups() to support family 7 and take optional ExifTool reference + Changed QuickTimeHandler option default to 1 version 12.18: * Added a new SonyModelID * Decode a number of Sony tags for the ILCE-1 (thanks Jos Roost) * Decode a couple of new Canon tags (thanks LibRaw) * Patched to read differently formatted UserData:Keywords as written by iPhone * Patched to tolerate out-of-order Nikon MakerNote IFD entries when obtaining tags necessary for decryption * Fixed a few possible Condition warnings for some NikonSettings tags version 12.17: * Added a new Canon FocusMode value * Added a new FujiFilm FilmMode value * Added a number of new XMP-crs tags (thanks Herb) * Decode a new H264 MDPM tag * Allow non-conforming lower-case XMP boolean "true" and "false" values to be written, but only when print conversion is disabled * Improved Validate option to warn about non-capitalized boolean XMP values * Improved logic for setting GPSLatitude/LongitudeRef values when writing * Changed -json and -php options so the -a option is implied even without the -g option * Avoid extracting audio/video data from AVI videos when -ee -u is used * Patched decoding of Canon ContinuousShootingSpeed for newer firmware versions of the EOS-1DXmkIII * Re-worked LensID patch of version 12.00 (github issue #51) * Fixed a few typos in newly-added NikonSettings tags (thanks Herb) * Fixed problem where group could not be specified for PNG-pHYs tags when writing version 12.16: * Extract another form of video subtitle text * Enhanced -ee option with -ee2 and -ee3 to allow parsing of the H264 video stream in MP4 files * Changed a Nikon FlashMode value * Fixed problem that caused a failed DPX test on Strawberry Perl * API Changes: + Enhanced ExtractEmbedded option version 12.15: * Added a couple of new Sony LensType values (thanks LibRaw and Jos Roost) * Added a new Nikon FlashMode value (thanks Mike) * Decode NikonSettings (thanks Warren Hatch) * Decode thermal information from DJI RJPEG images * Fixed extra newline in -echo3 and -echo4 outputs added in version 12.10 * Fixed out-of-memory problem when writing some very large PNG files under Windows version 12.14: * Added support for 2 more types of timed GPS in video files (that makes 49 different formats now supported) * Added validity check for PDF trailer dictionary Size * Added a new Pentax LensType * Extract metadata from Jpeg2000 Association box * Changed -g:XX:YY and -G:XX:YY options to show empty strings for non-existent groups * Patched to issue warning and avoid writing date/time values with a zero month or day number * Patched to avoid runtime warnings if trying to set FileName to an empty string * Fixed issue that could cause GPS test number 12 to fail on some systems * Fixed problem extracting XML as a block from Jpeg2000 images, and extract XML tags in the XML group instead of XMP - Update URL update to 12.13: * Add time zone automatically to most string-based QuickTime date/time tags when writing unless the PrintConv option is disabled * Added -i HIDDEN option to ignore files with names that start with "." * Added a few new Nikon ShutterMode values (thanks Jan Skoda) * Added ability to write Google GCamera MicroVideo XMP tags * Decode a new Sony tag (thanks LibRaw) * Changed behaviour when writing only pseudo tags to return an error and avoid writing any other tags if writing FileName fails * Print "X image files read" message even if only 1 file is read when at least one other file has failed the -if condition * Added ability to geotag from DJI CSV log files * Added a new CanonModelID * Added a couple of new Sony LensType values (thanks LibRaw) * Enhanced -csvDelim option to allow "\t", "\n", "\r" and "\\" * Unescape "\b" and "\f" in imported JSON values * Fixed bug introduced in 12.10 which generated a "Not an integer" warning when attempting to shift some QuickTime date/time tags * Fixed shared-write permission problem with -@ argfile when using -stay_open and a filename containing special characters on Windows * Added -csvDelim option * Added new Canon and Olympus LensType values (thanks LibRaw) * Added a warning if ICC_Profile is deleted from an image (github issue #63) * EndDir() function for -if option now works when -fileOrder is used * Changed FileSize conversion to use binary prefixes since that is how the conversion is currently done (eg. MiB instead of MB) * Patched -csv option so columns aren't resorted when using -G option and one of the tags is missing from a file * Fixed incompatiblity with Google Photos when writing UserData:GPSCoordinates to MP4 videos * Fixed problem where the tags available in a -p format string were limited to the same as the -if[NUM] option when NUM was specified * Fixed incorrect decoding of SourceFileIndex/SourceDirectoryIndex for Ricoh models Update to 12.10 * Added -validate test for proper TIFF magic number in JPEG EXIF header * Added support for Nikon Z7 LensData version 0801 * Added a new XMP-GPano tag * Decode ColorData for the Canon EOS 1DXmkIII * Decode more tags for the Sony ILCE-7SM3 * Automatically apply QuickTimeUTC option for CR3 files * Improved decoding of XAttrMDLabel from MacOS files * Ignore time zones when writing date/time values and using the -d option * Enhanced -echo3 and -echo4 options to allow exit status to be returned * Changed -execute so the -q option no longer suppresses the "{ready}" message when a synchronization number is used * Added ability to copy CanonMakerNotes from CR3 images to other file types * Added read support for ON1 presets file (.ONP) * Added two new CanonModelID values * Added trailing "/" when writing QuickTime:GPSCoordinates * Added a number of new XMP-crs tags * Added a new Sony LensType (thanks Jos Roost) * Added a new Nikon Z lens (thanks LibRaw) * Added a new Canon LensType * Decode ColorData for Canon EOS R5/R6 * Decode a couple of new HEIF tags * Decode FirmwareVersion for Canon M50 * Improved decoding of Sony CreativeStyle tags * Improved parsing of Radiance files to recognize comments * Renamed GIF AspectRatio tag to PixelAspectRatio * Patched EndDir() feature so subdirectories are always processed when -r is used (previously, EndDir() would end processing of a directory completely) * Avoid loading GoPro module unnecessarily when reading MP4 videos from some other cameras * Fixed problem with an incorrect naming of CodecID tags in some MKV videos * Fixed verbose output to avoid "adding" messages for existing flattened XMP tags * Added a new Sony LensType * Recognize Mac OS X xattr files * Extract ThumbnailImage from MP4 videos of more dashcam models * Improved decoding of a number of Sony tags * Fixed problem where the special -if EndDir() function didn't work properly for directories after the one in which it was initially called * Patched to read DLL files which don't have a .rsrc section * Patched to support new IGC date format when geotagging * Patched to read DLL files with an invalid size in the header * Added support for GoPro .360 videos * Added some new Canon RF and Nikkor Z lenses * Added some new Sony LensType and CreativeStyle values and decode some ILCE-7C tags * Added a number of new Olympus SceneMode values * Added a new Nikon LensID * Decode more timed metadata from Insta360 videos * Decode timed GPS from videos of more Garmin dashcam models * Decode a new GoPro video tag * Reformat time-only EventTime values when writing and prevent arbitrary strings from being written * Patched to accept backslashes in SourceFile entries for -csv option update to 12.06 * Added read support for Lyrics3 metadata (and fixed problem where APE metadata may be ignored if Lyrics3 exists) * Added a new Panasonic VideoBurstMode value * Added a new Olympus MultipleExposureMode value * Added a new Nikon LensID * Added back conversions for XMP-dwc EventTime that were removed in 12.04 with a patch to allow time-only values * Decode GIF AspectRatio * Decode Olympus FocusBracketStepSize * Extract PNG iDOT chunk in Binary format with the name AppleDataOffsets * Process PNG images which do not start with mandatory IHDR chunk * Added a new Panasonic SelfTimer value * Decode a few more DPX tags * Extract AIFF APPL tag as ApplicationData * Fixed bug writing QuickTime ItemList 'gnre' Genre values * Fixed an incorrect value for Panasonic VideoBurstResolution * Fixed problem when applying a time shift to some invalid makernote date/time values update to 12.04: * See /usr/share/doc/packages/perl-Image-ExifTool/Change update to 11.50, see Image-ExifTool-11.50.tar.gz for details Update to version 11.30: * Add a new Sony/Minolta LensType. * Decode streaming metadata from TomTom Bandit Action Cam MP4 videos. * Decode Reconyx HF2 PRO maker notes. * Decode ColorData for some new Canon models. * Enhanced -geotag feature to set AmbientTemperature if available. * Remove non-significant spaces from some DICOM values. * Fix possible "'x' outside of string" error when reading corrupted EXIF. * Fix incorrect write group for GeoTIFF tags. Update to version 11.29 * See /usr/share/doc/packages/perl-Image-ExifTool/Changes Update to version 11.27 * See /usr/share/doc/packages/perl-Image-ExifTool/Changes Update to version 11.24 * See /usr/share/doc/packages/perl-Image-ExifTool/Changes Update to version 11.11 (changes since 11.01): * See /usr/share/doc/packages/perl-Image-ExifTool/Changes Update to 11.01: * Added a new ProfileCMMType * Added a Validate warning about non-standard EXIF or XMP in PNG images * Added a new Canon LensType * Decode a couple more PanasonicRaw tags * Patched to avoid adding tags to QuickTime videos with multiple 'mdat' atoms --> avoids potential corruption of these videos! Update to 11.00: * Added read support for WTV and DVR-MS videos * Added print conversions for some ASF date/time tags * Added a new SonyModelID * Decode a new PanasonicRaw tag * Decode some new Sony RX100 VI tags * Made Padding and OffsetSchema tags "unsafe" so they aren't copied by default Patch Instructions: To install this openSUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 15.2: zypper in -t patch openSUSE-2021-707=1 - openSUSE Backports SLE-15-SP2: zypper in -t patch openSUSE-2021-707=1 - openSUSE Backports SLE-15-SP1: zypper in -t patch openSUSE-2021-707=1 Package List: - openSUSE Leap 15.2 (noarch): exiftool-12.25-lp152.4.3.1 perl-File-RandomAccess-12.25-lp152.4.3.1 perl-Image-ExifTool-12.25-lp152.4.3.1 - openSUSE Backports SLE-15-SP2 (noarch): exiftool-12.25-bp152.4.3.1 perl-File-RandomAccess-12.25-bp152.4.3.1 perl-Image-ExifTool-12.25-bp152.4.3.1 - openSUSE Backports SLE-15-SP1 (noarch): exiftool-12.25-bp151.4.3.1 perl-File-RandomAccess-12.25-bp151.4.3.1 perl-Image-ExifTool-12.25-bp151.4.3.1 References: https://www.suse.com/security/cve/CVE-2021-22204.html https://bugzilla.suse.com/1185547

1 0

openSUSE-SU-2021:0706-1: important: Security update for monitoring-plugins-smart
by opensuse-security＠opensuse.org 10 May '21

10 May '21

openSUSE Security Update: Security update for monitoring-plugins-smart ______________________________________________________________________________ Announcement ID: openSUSE-SU-2021:0706-1 Rating: important References: #1183057 Affected Products: openSUSE Leap 15.2 openSUSE Backports SLE-15-SP2 openSUSE Backports SLE-15-SP1 ______________________________________________________________________________ An update that contains security fixes can now be installed. Description: This update for monitoring-plugins-smart fixes the following issues: monitoring-plugins-smart was updated to 6.9.1: This is a security-release (boo#1183057) + Fixes the regular expression for pseudo-devices under the /dev/bus/N path. from 6.9.0 + Allows using PCI device paths as device name(s) (#64) + Introduce new optional parameter -l/--ssd-lifetime) which additionally checks SMART attribute "Percent_Lifetime_Remain" (available on some SSD drives). (#66 #67) from 6.8.0 + Allow skip self-assessment check (--skip-self-assessment) + Add Command_Timeout to default raw list from 6.7.1 + Bugfix to make --warn work (issue #54) from 6.7.0 + Added support for NVMe drives from 6.6.1 + Fix 'deprecation warning on regex with curly brackets' (6.6.1) from 6.6.0 + The feature was requested in #30 . This PR adds the possibility to use 3ware,N and cciss,N drives in combination with the global -g parameter. + Furthermore this PR adjusts the output of the plugin when the -g is used in combination with hardware raid controllers. Instead of showing the logical device name (/dev/sda for example), the plugin will now show the controller with drive number from 6.5.0: + Add Reported_Uncorrect and Reallocated_Event_Count to default raw list. + As of 6.5 the following SMART attributes are by default checked and may result in alert when threshold (default 0 is reached): 'Current_Pending_Sector,Reallocated_Sector_Ct,Program_Fail_Cnt_Total, Uncorrectable_Error_Cnt,Offline_Uncorrectable,Runtime_Bad_Block, Reported_Uncorrect,Reallocated_Event_Count' - Update to version 6.4 - Allow detection of more than 26 devices / issue #5 (rev 5.3) - Different ATA vs. SCSI lookup (rev 5.4) - Allow script to run outside of nagios plugins dir / wiki url update (rev 5.5) - Change syntax of -g parameter (regex is now awaited from input) (rev 5.6) - Fix Use of uninitialized value $device (rev 5.7) - Allow multiple devices for interface type megaraid, e.g. "megaraid,[1-5]" (rev 5.8) - allow type "auto" (rev 5.9) - Check selftest log for errors using new parameter -s (rev 5.10) - Add exclude list (-e) to ignore certain attributes (5.11) - Fix 'Use of uninitialized value' warnings (5.11.1) - Add raw check list (-r) and warning thresholds (-w) (6.0) - Allow using pseudo bus device /dev/bus/N (6.1) - Add device model and serial number in output (6.2) - Allow exclusion from perfdata as well (-E) and by attribute number (6.3) - Remove dependency on utils.pm, add quiet parameter (6.4) - Drop not longer needed patch: * enable_auto_interface.patch (obsolete, type auto was added upstream in v5.9). Patch Instructions: To install this openSUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 15.2: zypper in -t patch openSUSE-2021-706=1 - openSUSE Backports SLE-15-SP2: zypper in -t patch openSUSE-2021-706=1 - openSUSE Backports SLE-15-SP1: zypper in -t patch openSUSE-2021-706=1 Package List: - openSUSE Leap 15.2 (noarch): monitoring-plugins-smart-6.9.1-lp152.4.3.1 - openSUSE Backports SLE-15-SP2 (noarch): monitoring-plugins-smart-6.9.1-bp152.4.3.1 - openSUSE Backports SLE-15-SP1 (noarch): monitoring-plugins-smart-6.9.1-bp151.4.3.1 References: https://bugzilla.suse.com/1183057

1 0

openSUSE-RU-2021:0705-1: moderate: Recommended update for sapnwbootstrap-formula
by maintenance＠opensuse.org 10 May '21

10 May '21

openSUSE Recommended Update: Recommended update for sapnwbootstrap-formula ______________________________________________________________________________ Announcement ID: openSUSE-RU-2021:0705-1 Rating: moderate References: #1181541 #1185093 Affected Products: openSUSE Leap 15.2 ______________________________________________________________________________ An update that has two recommended fixes can now be installed. Description: This update for sapnwbootstrap-formula fixes the following issues: - Set the virtual ip addresses as permanent, except for HA scenarios, to have them even after a reboot of the machine. (bsc#1185093) - Fix error about missing instance installation requisite when monitoring is enabled. (bsc#1181541) This update was imported from the SUSE:SLE-15:Update update project. Patch Instructions: To install this openSUSE Recommended Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 15.2: zypper in -t patch openSUSE-2021-705=1 Package List: - openSUSE Leap 15.2 (noarch): sapnwbootstrap-formula-0.6.2+git.1619009582.e0ae9e8-lp152.2.12.1 References: https://bugzilla.suse.com/1181541 https://bugzilla.suse.com/1185093

1 0

openSUSE-RU-2021:0704-1: moderate: Recommended update for openssl-1_1
by maintenance＠opensuse.org 10 May '21

10 May '21

openSUSE Recommended Update: Recommended update for openssl-1_1 ______________________________________________________________________________ Announcement ID: openSUSE-RU-2021:0704-1 Rating: moderate References: #1161276 Affected Products: openSUSE Leap 15.2 ______________________________________________________________________________ An update that has one recommended fix can now be installed. Description: This update for openssl-1_1 fixes the following issues: - Do not list disapproved cipher algorithms while in 'FIPS' mode. (bsc#1161276) This update was imported from the SUSE:SLE-15-SP2:Update update project. Patch Instructions: To install this openSUSE Recommended Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 15.2: zypper in -t patch openSUSE-2021-704=1 Package List: - openSUSE Leap 15.2 (i586 x86_64): libopenssl-1_1-devel-1.1.1d-lp152.7.18.1 libopenssl1_1-1.1.1d-lp152.7.18.1 libopenssl1_1-debuginfo-1.1.1d-lp152.7.18.1 libopenssl1_1-hmac-1.1.1d-lp152.7.18.1 openssl-1_1-1.1.1d-lp152.7.18.1 openssl-1_1-debuginfo-1.1.1d-lp152.7.18.1 openssl-1_1-debugsource-1.1.1d-lp152.7.18.1 - openSUSE Leap 15.2 (noarch): openssl-1_1-doc-1.1.1d-lp152.7.18.1 - openSUSE Leap 15.2 (x86_64): libopenssl-1_1-devel-32bit-1.1.1d-lp152.7.18.1 libopenssl1_1-32bit-1.1.1d-lp152.7.18.1 libopenssl1_1-32bit-debuginfo-1.1.1d-lp152.7.18.1 libopenssl1_1-hmac-32bit-1.1.1d-lp152.7.18.1 References: https://bugzilla.suse.com/1161276

1 0

openSUSE-OU-2021:0703-1: Optional update for postgresql10 and postgresql12
by maintenance＠opensuse.org 10 May '21

10 May '21

openSUSE Optional Update: Optional update for postgresql10 and postgresql12 ______________________________________________________________________________ Announcement ID: openSUSE-OU-2021:0703-1 Rating: low References: #1179945 #1183118 Affected Products: openSUSE Leap 15.2 ______________________________________________________________________________ An update that has two optional fixes can now be installed. Description: This update for postgresql10 and postgresql12 does not fix any user visible issues for customers of SLE. It is therefore optional to install. The changes introduced with this package do only affect openSUSE and Tumbleweed. This update was imported from the SUSE:SLE-15-SP1:Update update project. Patch Instructions: To install this openSUSE Optional Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 15.2: zypper in -t patch openSUSE-2021-703=1 Package List: - openSUSE Leap 15.2 (i586 x86_64): libecpg6-12.6-lp152.3.19.1 libecpg6-debuginfo-12.6-lp152.3.19.1 libpq5-12.6-lp152.3.19.1 libpq5-debuginfo-12.6-lp152.3.19.1 postgresql10-10.16-lp152.2.18.1 postgresql10-contrib-10.16-lp152.2.18.1 postgresql10-contrib-debuginfo-10.16-lp152.2.18.1 postgresql10-debuginfo-10.16-lp152.2.18.1 postgresql10-debugsource-10.16-lp152.2.18.1 postgresql10-devel-10.16-lp152.2.18.1 postgresql10-devel-debuginfo-10.16-lp152.2.18.1 postgresql10-plperl-10.16-lp152.2.18.1 postgresql10-plperl-debuginfo-10.16-lp152.2.18.1 postgresql10-plpython-10.16-lp152.2.18.1 postgresql10-plpython-debuginfo-10.16-lp152.2.18.1 postgresql10-pltcl-10.16-lp152.2.18.1 postgresql10-pltcl-debuginfo-10.16-lp152.2.18.1 postgresql10-server-10.16-lp152.2.18.1 postgresql10-server-debuginfo-10.16-lp152.2.18.1 postgresql10-test-10.16-lp152.2.18.1 postgresql12-12.6-lp152.3.19.1 postgresql12-contrib-12.6-lp152.3.19.1 postgresql12-contrib-debuginfo-12.6-lp152.3.19.1 postgresql12-debuginfo-12.6-lp152.3.19.1 postgresql12-debugsource-12.6-lp152.3.19.1 postgresql12-devel-12.6-lp152.3.19.1 postgresql12-devel-debuginfo-12.6-lp152.3.19.1 postgresql12-llvmjit-12.6-lp152.3.19.1 postgresql12-llvmjit-debuginfo-12.6-lp152.3.19.1 postgresql12-plperl-12.6-lp152.3.19.1 postgresql12-plperl-debuginfo-12.6-lp152.3.19.1 postgresql12-plpython-12.6-lp152.3.19.1 postgresql12-plpython-debuginfo-12.6-lp152.3.19.1 postgresql12-pltcl-12.6-lp152.3.19.1 postgresql12-pltcl-debuginfo-12.6-lp152.3.19.1 postgresql12-server-12.6-lp152.3.19.1 postgresql12-server-debuginfo-12.6-lp152.3.19.1 postgresql12-server-devel-12.6-lp152.3.19.1 postgresql12-server-devel-debuginfo-12.6-lp152.3.19.1 postgresql12-test-12.6-lp152.3.19.1 - openSUSE Leap 15.2 (x86_64): libecpg6-32bit-12.6-lp152.3.19.1 libecpg6-32bit-debuginfo-12.6-lp152.3.19.1 libpq5-32bit-12.6-lp152.3.19.1 libpq5-32bit-debuginfo-12.6-lp152.3.19.1 - openSUSE Leap 15.2 (noarch): postgresql10-docs-10.16-lp152.2.18.1 postgresql12-docs-12.6-lp152.3.19.1 References: https://bugzilla.suse.com/1179945 https://bugzilla.suse.com/1183118

1 0

openSUSE-RU-2021:0702-1: moderate: Recommended update for shim
by maintenance＠opensuse.org 10 May '21

10 May '21

openSUSE Recommended Update: Recommended update for shim ______________________________________________________________________________ Announcement ID: openSUSE-RU-2021:0702-1 Rating: moderate References: #1185464 Affected Products: openSUSE Leap 15.2 ______________________________________________________________________________ An update that has one recommended fix can now be installed. Description: This update for shim fixes the following issues: - shim-install: always assume "removable" for Azure to avoid the endless reset loop (boo#1185464) Patch Instructions: To install this openSUSE Recommended Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 15.2: zypper in -t patch openSUSE-2021-702=1 Package List: - openSUSE Leap 15.2 (x86_64): shim-15.4-lp152.4.11.1 shim-debuginfo-15.4-lp152.4.11.1 shim-debugsource-15.4-lp152.4.11.1 References: https://bugzilla.suse.com/1185464

1 0

openSUSE-RU-2021:0698-1: moderate: Recommended update for strawberry
by maintenance＠opensuse.org 10 May '21

10 May '21

openSUSE Recommended Update: Recommended update for strawberry ______________________________________________________________________________ Announcement ID: openSUSE-RU-2021:0698-1 Rating: moderate References: Affected Products: openSUSE Backports SLE-15-SP2 ______________________________________________________________________________ An update that has 0 recommended fixes can now be installed. Description: This update for strawberry fixes the following issues: Update to version 0.9.3: + Bugfixes: + Fix "Show in file browser" to work with thunar. + Check that the clicked rating position is to the right or left of the rectangle. + Fix rescan when collection directory is removed and readded. Enhancements: + Allow editing playlist metadata for radio streams. + Make CollectionQuery subclass QSqlQuery, avoid copying QSqlQuery. + Only enable FTS3 when schema needs upgrading, since FTS5 is used for search. + Add setting for configuring the color for the currently playing song. + Add setting to turn on OSD Pretty fading. + Add commandline option to resize window. This update was imported from the openSUSE:Leap:15.2:Update update project. Patch Instructions: To install this openSUSE Recommended Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Backports SLE-15-SP2: zypper in -t patch openSUSE-2021-698=1 Package List: - openSUSE Backports SLE-15-SP2 (aarch64 ppc64le s390x x86_64): strawberry-0.9.3-bp152.2.28.1 References:

1 0

openSUSE-RU-2021:0699-1: Recommended update for spamassassin
by maintenance＠opensuse.org 10 May '21

10 May '21

openSUSE Recommended Update: Recommended update for spamassassin ______________________________________________________________________________ Announcement ID: openSUSE-RU-2021:0699-1 Rating: low References: #1185184 Affected Products: openSUSE Leap 15.2 ______________________________________________________________________________ An update that has one recommended fix can now be installed. Description: This update for spamassassin fixes the following issues: - Deprecated path "/var/run/" used in systemd-services (bsc#1185184) This update was imported from the SUSE:SLE-15-SP1:Update update project. Patch Instructions: To install this openSUSE Recommended Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 15.2: zypper in -t patch openSUSE-2021-699=1 Package List: - openSUSE Leap 15.2 (x86_64): perl-Mail-SpamAssassin-3.4.5-lp152.10.6.1 perl-Mail-SpamAssassin-Plugin-iXhash2-2.05-lp152.10.6.1 spamassassin-3.4.5-lp152.10.6.1 spamassassin-debuginfo-3.4.5-lp152.10.6.1 spamassassin-debugsource-3.4.5-lp152.10.6.1 References: https://bugzilla.suse.com/1185184

1 0

openSUSE-RU-2021:0700-1: moderate: Recommended update for dovecot
by maintenance＠opensuse.org 10 May '21

10 May '21

openSUSE Recommended Update: Recommended update for dovecot ______________________________________________________________________________ Announcement ID: openSUSE-RU-2021:0700-1 Rating: moderate References: #1185074 Affected Products: openSUSE Leap 15.2 ______________________________________________________________________________ An update that has one recommended fix can now be installed. Description: This update for dovecot fixes the following issues: - Using /run instead of /var/run which was deprecated (bsc#1185074) - The home directories of the internal users was moved from /var/run/dovecot to /run/dovecot as well. This update was imported from the SUSE:SLE-15:Update update project. Patch Instructions: To install this openSUSE Recommended Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 15.2: zypper in -t patch openSUSE-2021-700=1 Package List: - openSUSE Leap 15.2 (noarch): dovecot-2.3-lp152.4.3.1 References: https://bugzilla.suse.com/1185074

1 0

openSUSE-RU-2021:0701-1: moderate: Recommended update for kexec-tools
by maintenance＠opensuse.org 10 May '21

10 May '21

openSUSE Recommended Update: Recommended update for kexec-tools ______________________________________________________________________________ Announcement ID: openSUSE-RU-2021:0701-1 Rating: moderate References: #1185020 Affected Products: openSUSE Leap 15.2 ______________________________________________________________________________ An update that has one recommended fix can now be installed. Description: This update for kexec-tools fixes the following issue: - Hardening: link as Position-Independent Executable PIE (bsc#1185020). This update was imported from the SUSE:SLE-15-SP2:Update update project. Patch Instructions: To install this openSUSE Recommended Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 15.2: zypper in -t patch openSUSE-2021-701=1 Package List: - openSUSE Leap 15.2 (i586 x86_64): kexec-tools-2.0.20-lp152.4.6.1 kexec-tools-debuginfo-2.0.20-lp152.4.6.1 kexec-tools-debugsource-2.0.20-lp152.4.6.1 References: https://bugzilla.suse.com/1185020

1 0

openSUSE-RU-2021:0697-1: moderate: Recommended update for saphanabootstrap-formula
by maintenance＠opensuse.org 09 May '21

09 May '21

openSUSE Recommended Update: Recommended update for saphanabootstrap-formula ______________________________________________________________________________ Announcement ID: openSUSE-RU-2021:0697-1 Rating: moderate References: #1185090 Affected Products: openSUSE Leap 15.2 ______________________________________________________________________________ An update that has one recommended fix can now be installed. Description: This update for saphanabootstrap-formula fixes the following issues: - Fix the HANA sidadm usage to transform to lowercase some states managing the sudoers file in ha_cluster.sls state file. (bsc#1185090) This update was imported from the SUSE:SLE-15:Update update project. Patch Instructions: To install this openSUSE Recommended Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 15.2: zypper in -t patch openSUSE-2021-697=1 Package List: - openSUSE Leap 15.2 (noarch): saphanabootstrap-formula-0.7.1+git.1619008686.8600866-lp152.2.12.1 References: https://bugzilla.suse.com/1185090

1 0

openSUSE-RU-2021:0696-1: moderate: Recommended update for kimageformats
by maintenance＠opensuse.org 09 May '21

09 May '21

openSUSE Recommended Update: Recommended update for kimageformats ______________________________________________________________________________ Announcement ID: openSUSE-RU-2021:0696-1 Rating: moderate References: Affected Products: openSUSE Backports SLE-15-SP2 ______________________________________________________________________________ An update that has 0 recommended fixes can now be installed. Description: This update for kimageformats fixes the following issues: - Add patch to fix OOB write (oss-fuzz#33742): This update was imported from the openSUSE:Leap:15.2:Update update project. Patch Instructions: To install this openSUSE Recommended Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Backports SLE-15-SP2: zypper in -t patch openSUSE-2021-696=1 Package List: - openSUSE Backports SLE-15-SP2 (aarch64 ppc64le s390x x86_64): kimageformats-5.71.0-bp152.2.3.1 kimageformats-eps-5.71.0-bp152.2.3.1 - openSUSE Backports SLE-15-SP2 (aarch64_ilp32): kimageformats-64bit-5.71.0-bp152.2.3.1 References:

1 0

openSUSE-SU-2021:0695-1: moderate: Security update for alpine
by opensuse-security＠opensuse.org 09 May '21

09 May '21

openSUSE Security Update: Security update for alpine ______________________________________________________________________________ Announcement ID: openSUSE-SU-2021:0695-1 Rating: moderate References: #1173281 Cross-References: CVE-2020-14929 CVSS scores: CVE-2020-14929 (NVD) : 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N CVE-2020-14929 (SUSE): 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N Affected Products: openSUSE Backports SLE-15-SP2 ______________________________________________________________________________ An update that fixes one vulnerability is now available. Description: This update for alpine fixes the following issues: Update to release 2.24 * A few crash fixes * Implementation of XOAUTH2 for Yahoo! Mail. Update to release 2.23.2 * Expansion of the configuration screen for XOAUTH2 to include username, and tenant. * Alpine uses the domain in the From: header of a message to generate a message-id and suppresses all information about Alpine, version, revision, and time of generation of the message-id from this header. * Alpine does not generate Sender or X-X-Sender by default by enabling [X] Disable Sender as the default. * Alpine does not disclose User Agent by default by enabling [X] Suppress User Agent by default. * When messages are selected, pressing the ';' command to broaden or narrow a search, now offers the possibility to completely replace the search, and is almost equivalent to being a shortcut to "unselect all messages, and select again". Update to release 2.23 * Fixes boo#1173281, CVE-2020-14929: Alpine silently proceeds to use an insecure connection after a /tls is sent in certain circumstances. * Implementation of XOAUTH2 authentication support for Outlook. * Add support for the OAUTHBEARER authentication method in Gmail. * Support for the SASL-IR IMAP extension. * Alpine can pass an HTML message to an external web browser, by using the "External" command in the ATTACHMENT INDEX screen. Update to release 2.22 * Support for XOAUTH2 authentication method in Gmail. * NTLM authentication support with the ntlm library. * Added the "/tls1_3" flag for servers that support it. * Add the "g" option to the select command that works in IMAP servers that implement the X-GM-EXT-1 capability (such as the one offered by Gmail). * Added "/auth=XYZ" to the way to define a server. This allows users to select the method to authenticate to an IMAP, SMTP or POP3 server. Examples are /auth=plain, or /auth=gssapi, etc. * When a message is of type multipart/mixed, and its first part is multipart/signed, Alpine will include the text of the original message in a reply message, instead of including a multipart attachment. * Added backward search in the index screen. * pico: Add -dict option to Pico, which allows users to choose a dictionary when spelling. - Drop /usr/bin/mailutil, it is not built by default anymore. * Added Quota subcommands for printing, forwarding, saving, etc. This update was imported from the openSUSE:Leap:15.2:Update update project. Patch Instructions: To install this openSUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Backports SLE-15-SP2: zypper in -t patch openSUSE-2021-695=1 Package List: - openSUSE Backports SLE-15-SP2 (aarch64 ppc64le s390x x86_64): alpine-2.24-bp152.4.3.1 pico-5.07-bp152.4.3.1 pilot-2.99-bp152.4.3.1 References: https://www.suse.com/security/cve/CVE-2020-14929.html https://bugzilla.suse.com/1173281

1 0

openSUSE-SU-2021:0694-1: moderate: Security update for avahi
by opensuse-security＠opensuse.org 09 May '21

09 May '21

openSUSE Security Update: Security update for avahi ______________________________________________________________________________ Announcement ID: openSUSE-SU-2021:0694-1 Rating: moderate References: #1184521 Cross-References: CVE-2021-3468 CVSS scores: CVE-2021-3468 (SUSE): 6.2 CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H Affected Products: openSUSE Leap 15.2 ______________________________________________________________________________ An update that fixes one vulnerability is now available. Description: This update for avahi fixes the following issues: - CVE-2021-3468: avoid infinite loop by handling HUP event in client_work (bsc#1184521). This update was imported from the SUSE:SLE-15-SP1:Update update project. Patch Instructions: To install this openSUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 15.2: zypper in -t patch openSUSE-2021-694=1 Package List: - openSUSE Leap 15.2 (i586 x86_64): avahi-0.7-lp152.3.9.1 avahi-autoipd-0.7-lp152.3.9.1 avahi-autoipd-debuginfo-0.7-lp152.3.9.1 avahi-compat-howl-devel-0.7-lp152.3.9.1 avahi-compat-mDNSResponder-devel-0.7-lp152.3.9.1 avahi-debuginfo-0.7-lp152.3.9.1 avahi-debugsource-0.7-lp152.3.9.1 avahi-glib2-debugsource-0.7-lp152.3.9.1 avahi-utils-0.7-lp152.3.9.1 avahi-utils-debuginfo-0.7-lp152.3.9.1 avahi-utils-gtk-0.7-lp152.3.9.1 avahi-utils-gtk-debuginfo-0.7-lp152.3.9.1 libavahi-client3-0.7-lp152.3.9.1 libavahi-client3-debuginfo-0.7-lp152.3.9.1 libavahi-common3-0.7-lp152.3.9.1 libavahi-common3-debuginfo-0.7-lp152.3.9.1 libavahi-core7-0.7-lp152.3.9.1 libavahi-core7-debuginfo-0.7-lp152.3.9.1 libavahi-devel-0.7-lp152.3.9.1 libavahi-glib-devel-0.7-lp152.3.9.1 libavahi-glib1-0.7-lp152.3.9.1 libavahi-glib1-debuginfo-0.7-lp152.3.9.1 libavahi-gobject-devel-0.7-lp152.3.9.1 libavahi-gobject0-0.7-lp152.3.9.1 libavahi-gobject0-debuginfo-0.7-lp152.3.9.1 libavahi-ui-gtk3-0-0.7-lp152.3.9.1 libavahi-ui-gtk3-0-debuginfo-0.7-lp152.3.9.1 libavahi-ui0-0.7-lp152.3.9.1 libavahi-ui0-debuginfo-0.7-lp152.3.9.1 libdns_sd-0.7-lp152.3.9.1 libdns_sd-debuginfo-0.7-lp152.3.9.1 libhowl0-0.7-lp152.3.9.1 libhowl0-debuginfo-0.7-lp152.3.9.1 python3-avahi-0.7-lp152.3.9.1 python3-avahi-gtk-0.7-lp152.3.9.1 typelib-1_0-Avahi-0_6-0.7-lp152.3.9.1 - openSUSE Leap 15.2 (x86_64): avahi-32bit-debuginfo-0.7-lp152.3.9.1 avahi-mono-0.7-lp152.3.9.1 avahi-qt4-debugsource-0.7-lp152.3.9.1 libavahi-client3-32bit-0.7-lp152.3.9.1 libavahi-client3-32bit-debuginfo-0.7-lp152.3.9.1 libavahi-common3-32bit-0.7-lp152.3.9.1 libavahi-common3-32bit-debuginfo-0.7-lp152.3.9.1 libavahi-glib1-32bit-0.7-lp152.3.9.1 libavahi-glib1-32bit-debuginfo-0.7-lp152.3.9.1 libavahi-qt4-1-0.7-lp152.3.9.1 libavahi-qt4-1-debuginfo-0.7-lp152.3.9.1 libavahi-qt4-devel-0.7-lp152.3.9.1 libdns_sd-32bit-0.7-lp152.3.9.1 libdns_sd-32bit-debuginfo-0.7-lp152.3.9.1 - openSUSE Leap 15.2 (noarch): avahi-lang-0.7-lp152.3.9.1 References: https://www.suse.com/security/cve/CVE-2021-3468.html https://bugzilla.suse.com/1184521

1 0

openSUSE-RU-2021:0693-1: moderate: Recommended update for open-iscsi
by maintenance＠opensuse.org 09 May '21

09 May '21

openSUSE Recommended Update: Recommended update for open-iscsi ______________________________________________________________________________ Announcement ID: openSUSE-RU-2021:0693-1 Rating: moderate References: #1179908 #1183421 Affected Products: openSUSE Leap 15.2 ______________________________________________________________________________ An update that fixes four vulnerabilities is now available. Description: This update for open-iscsi fixes the following issues: - Enabled asynchronous logins for iscsi.service (bsc#1183421) - Fixed a login issue when target is delayed This update was imported from the SUSE:SLE-15-SP2:Update update project. Patch Instructions: To install this openSUSE Recommended Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 15.2: zypper in -t patch openSUSE-2021-693=1 Package List: - openSUSE Leap 15.2 (i586 x86_64): iscsiuio-0.7.8.6-lp152.18.12.1 iscsiuio-debuginfo-0.7.8.6-lp152.18.12.1 libopeniscsiusr0_2_0-2.1.4-lp152.18.12.1 libopeniscsiusr0_2_0-debuginfo-2.1.4-lp152.18.12.1 open-iscsi-2.1.4-lp152.18.12.1 open-iscsi-debuginfo-2.1.4-lp152.18.12.1 open-iscsi-debugsource-2.1.4-lp152.18.12.1 open-iscsi-devel-2.1.4-lp152.18.12.1 References: https://www.suse.com/security/cve/CVE-2020-13987.html https://www.suse.com/security/cve/CVE-2020-13988.html https://www.suse.com/security/cve/CVE-2020-17437.html https://www.suse.com/security/cve/CVE-2020-17438.html https://bugzilla.suse.com/1179908 https://bugzilla.suse.com/1183421

1 0

openSUSE-SU-2021:0692-1: moderate: Security update for libxml2
by opensuse-security＠opensuse.org 09 May '21

09 May '21

openSUSE Security Update: Security update for libxml2 ______________________________________________________________________________ Announcement ID: openSUSE-SU-2021:0692-1 Rating: moderate References: #1185408 #1185409 #1185410 Cross-References: CVE-2021-3516 CVE-2021-3517 CVE-2021-3518 CVSS scores: CVE-2021-3516 (SUSE): 5.9 CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H CVE-2021-3517 (SUSE): 5.9 CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H CVE-2021-3518 (SUSE): 5.9 CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H Affected Products: openSUSE Leap 15.2 ______________________________________________________________________________ An update that fixes three vulnerabilities is now available. Description: This update for libxml2 fixes the following issues: - CVE-2021-3518: Fixed a use after free in xinclude.c:xmlXIncludeDoProcess (bsc#1185408). - CVE-2021-3517: Fixed a heap based buffer overflow in entities.c:xmlEncodeEntitiesInternal (bsc#1185410). - CVE-2021-3516: Fixed a use after free in entities.c:xmlEncodeEntitiesInternal (bsc#1185409). This update was imported from the SUSE:SLE-15:Update update project. Patch Instructions: To install this openSUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 15.2: zypper in -t patch openSUSE-2021-692=1 Package List: - openSUSE Leap 15.2 (i586 x86_64): libxml2-2-2.9.7-lp152.10.9.1 libxml2-2-debuginfo-2.9.7-lp152.10.9.1 libxml2-debugsource-2.9.7-lp152.10.9.1 libxml2-devel-2.9.7-lp152.10.9.1 libxml2-tools-2.9.7-lp152.10.9.1 libxml2-tools-debuginfo-2.9.7-lp152.10.9.1 python-libxml2-python-debugsource-2.9.7-lp152.10.9.1 python2-libxml2-python-2.9.7-lp152.10.9.1 python2-libxml2-python-debuginfo-2.9.7-lp152.10.9.1 python3-libxml2-python-2.9.7-lp152.10.9.1 python3-libxml2-python-debuginfo-2.9.7-lp152.10.9.1 - openSUSE Leap 15.2 (x86_64): libxml2-2-32bit-2.9.7-lp152.10.9.1 libxml2-2-32bit-debuginfo-2.9.7-lp152.10.9.1 libxml2-devel-32bit-2.9.7-lp152.10.9.1 - openSUSE Leap 15.2 (noarch): libxml2-doc-2.9.7-lp152.10.9.1 References: https://www.suse.com/security/cve/CVE-2021-3516.html https://www.suse.com/security/cve/CVE-2021-3517.html https://www.suse.com/security/cve/CVE-2021-3518.html https://bugzilla.suse.com/1185408 https://bugzilla.suse.com/1185409 https://bugzilla.suse.com/1185410

1 0

openSUSE-SU-2021:0691-1: moderate: Security update for vlc
by opensuse-security＠opensuse.org 09 May '21

09 May '21

openSUSE Security Update: Security update for vlc ______________________________________________________________________________ Announcement ID: openSUSE-SU-2021:0691-1 Rating: moderate References: #1181918 Cross-References: CVE-2020-26664 CVSS scores: CVE-2020-26664 (NVD) : 7.8 CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H Affected Products: openSUSE Leap 15.2 ______________________________________________________________________________ An update that fixes one vulnerability is now available. Description: This update for vlc fixes the following issues: Update to version 3.0.13: + Demux: - Adaptive: fix artefacts in HLS streams with wrong profiles/levels - Fix regression on some MP4 files for the audio track - Fix MPGA and ADTS probing in TS files - Fix Flac inside AVI files - Fix VP9/Webm artefacts when seeking + Codec: - Support SSA text scaling - Fix rotation on Android rotation - Fix WebVTT subtitles that start at 00:00 + Access: - Update libnfs to support NFSv4 - Improve SMB2 integration - Fix Blu-ray files using Unicode names on Windows - Disable mcast lookups on Android for RTSP playback + Video Output: Rework the D3D11 rendering wait, to fix choppiness on display + Interfaces: - Fix VLC getting stuck on close on X11 (#21875) - Improve RTL on preferences on macOS - Add mousewheel horizontal axis control - Fix crash on exit on macOS - Fix sizing of the fullscreen controls on macOS + Misc: - Improve MIDI fonts search on Linux - Update Soundcloud, Youtube, liveleak - Fix compilation with GCC11 - Fix input-slave option for subtitles + Updated translations. Update to version 3.0.12: + Access: Add new RIST access module compliant with simple profile (VSF_TR-06-1). + Access Output: Add new RIST access output module compliant with simple profile (VSF_TR-06-1). + Demux: Fixed adaptive's handling of resolution settings. + Audio output: Fix audio distortion on macOS during start of playback. + Video Output: Direct3D11: Fix some potential crashes when using video filters. + Misc: - Several fixes in the web interface, including privacy and security improvements - Update YouTube and Vocaroo scripts. + Updated translations. Patch Instructions: To install this openSUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 15.2: zypper in -t patch openSUSE-2021-691=1 Package List: - openSUSE Leap 15.2 (noarch): vlc-lang-3.0.13-lp152.2.12.1 - openSUSE Leap 15.2 (x86_64): libvlc5-3.0.13-lp152.2.12.1 libvlc5-debuginfo-3.0.13-lp152.2.12.1 libvlccore9-3.0.13-lp152.2.12.1 libvlccore9-debuginfo-3.0.13-lp152.2.12.1 vlc-3.0.13-lp152.2.12.1 vlc-codec-gstreamer-3.0.13-lp152.2.12.1 vlc-codec-gstreamer-debuginfo-3.0.13-lp152.2.12.1 vlc-debuginfo-3.0.13-lp152.2.12.1 vlc-debugsource-3.0.13-lp152.2.12.1 vlc-devel-3.0.13-lp152.2.12.1 vlc-jack-3.0.13-lp152.2.12.1 vlc-jack-debuginfo-3.0.13-lp152.2.12.1 vlc-noX-3.0.13-lp152.2.12.1 vlc-noX-debuginfo-3.0.13-lp152.2.12.1 vlc-opencv-3.0.13-lp152.2.12.1 vlc-opencv-debuginfo-3.0.13-lp152.2.12.1 vlc-qt-3.0.13-lp152.2.12.1 vlc-qt-debuginfo-3.0.13-lp152.2.12.1 vlc-vdpau-3.0.13-lp152.2.12.1 vlc-vdpau-debuginfo-3.0.13-lp152.2.12.1 References: https://www.suse.com/security/cve/CVE-2020-26664.html https://bugzilla.suse.com/1181918

1 0

openSUSE-RU-2021:0689-1: moderate: Recommended update for monitoring-plugins-bind
by maintenance＠opensuse.org 08 May '21

08 May '21

openSUSE Recommended Update: Recommended update for monitoring-plugins-bind ______________________________________________________________________________ Announcement ID: openSUSE-RU-2021:0689-1 Rating: moderate References: #1183201 Affected Products: openSUSE Backports SLE-15-SP1 ______________________________________________________________________________ An update that has one recommended fix can now be installed. Description: This update for monitoring-plugins-bind fixes the following issues: - check_bind.sh uses a static temporary file, allowing users to break the script by creating the same file with permissions that don't allow the nagios user to write to it (boo#1183201). + added monitoring-plugins-bind_-_use_path_tmp.patch Patch Instructions: To install this openSUSE Recommended Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Backports SLE-15-SP1: zypper in -t patch openSUSE-2021-689=1 Package List: - openSUSE Backports SLE-15-SP1 (noarch): monitoring-plugins-bind-1.3-bp151.4.3.1 References: https://bugzilla.suse.com/1183201

1 0

openSUSE-RU-2021:0690-1: moderate: Recommended update for monitoring-plugins-bind
by maintenance＠opensuse.org 08 May '21

08 May '21

openSUSE Recommended Update: Recommended update for monitoring-plugins-bind ______________________________________________________________________________ Announcement ID: openSUSE-RU-2021:0690-1 Rating: moderate References: #1183201 Affected Products: openSUSE Backports SLE-15-SP2 ______________________________________________________________________________ An update that has one recommended fix can now be installed. Description: This update for monitoring-plugins-bind fixes the following issues: - check_bind.sh uses a static temporary file, allowing users to break the script by creating the same file with permissions that don't allow the nagios user to write to it (boo#1183201). + added monitoring-plugins-bind_-_use_path_tmp.patch Patch Instructions: To install this openSUSE Recommended Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Backports SLE-15-SP2: zypper in -t patch openSUSE-2021-690=1 Package List: - openSUSE Backports SLE-15-SP2 (noarch): monitoring-plugins-bind-1.3-bp152.4.3.1 References: https://bugzilla.suse.com/1183201

1 0

openSUSE-SU-2021:0688-1: moderate: Security update for syncthing
by opensuse-security＠opensuse.org 08 May '21

08 May '21

openSUSE Security Update: Security update for syncthing ______________________________________________________________________________ Announcement ID: openSUSE-SU-2021:0688-1 Rating: moderate References: #1184428 Cross-References: CVE-2021-21404 CVSS scores: CVE-2021-21404 (NVD) : 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H Affected Products: openSUSE Leap 15.2 ______________________________________________________________________________ An update that fixes one vulnerability is now available. Description: This update for syncthing fixes the following issues: Update to 1.15.0/1.15.1 * This release fixes a vulnerability where Syncthing and the relay server can crash due to malformed relay protocol messages (CVE-2021-21404); see GHSA-x462-89pf-6r5h. (boo#1184428) * This release updates the CLI to use subcommands and adds the subcommands cli (previously standalone stcli utility) and decrypt (for offline verifying and decrypting encrypted folders). * With this release we invite everyone to test the "untrusted (encrypted) devices" feature. You should not use it yet on important production data. Thus UI controls are hidden behind a feature flag. For more information, visit: https://forum.syncthing.net/t/testing-untrusted-encrypted-devices/16470 Update to 1.14.0 * This release adds configurable device and folder defaults. * The output format of the /rest/db/browse endpoint has changed. update to 1.13.1: * This release adds configuration options for min/max connections (see https://docs.syncthing.net/advanced/option-connection-limits.html) and moves the storage of pending devices/folders from the config to the database (see https://docs.syncthing.net/dev/rest.html#cluster-endpoints) * Bugfixes * Official builds of v1.13.0 come with the Tech Ui, which is impossible to switch back from update to 1.12.1: * Invalid names are allowed and "auto accepted" in folder root path on Windows * Sometimes indexes for some folders aren't sent after starting Syncthing * [Untrusted] Remove Unexpected Items leaves things behind * Wrong theme on selection * Quic spamming address resolving * Deleted locally changed items still shown as locally changed * Allow specifying remote expected web UI port which would generate a href somewhere * Ignore fsync errors when saving ignore files Update to 1.12.0 - The 1.12.0 release - adds a new config REST API. - The 1.11.0 release - adds the sendFullIndexOnUpgrade option to control whether all index data is resent when an upgrade is detected, equivalent to starting Syncthing with --reset-deltas. This (sendFullIndexOnUpgrade=true) used to be the behavior in previous versions, but is mainly useful as a troubleshooting step and causes high database churn. The new default is false. - Update to 1.10.0 - This release adds the config option announceLANAddresses to enable (the default) or disable announcing private (RFC1918) LAN IP addresses to global discovery. - Update to 1.9.0 - This release adds the advanced folder option caseSensitiveFS (https://docs.syncthing.net/advanced/folder-caseSensitiveFS.html) to disable the new safe handling of case insensitive filesystems. - Fix Leap build by requiring at least Go 1.14 - Prevent the build system to download Go modules which would require an internet connection during the build - Update to 1.8.0 - The 1.8.0 release - adds the experimental copyRangeMethod config on folders, for use on filesystems with copy-on-write support. Please see https://docs.syncthing.net/advanced/folder-copyrangemethod.html for details. - adds TCP hole punching, used to establish high performance TCP connections in certain NAT scenarios where only relay or QUIC connections could be used previously. - adds a configuration to file versioning for how often to run cleanup. This defaults to once an hour, but is configurable from very frequently to never. - The 1.7.0 release performs a database migration to optimize for clusters with many devices. - The 1.6.0 release performs a database schema migration, and adds the BlockPullOrder, DisableFsync and MaxConcurrentWrites folder options to the configuration schema. The LocalChangeDetected event no longer has the action set to added for new files, instead showing modified for all local file changes. - The 1.5.0 release changes the default location for the index database under some circumstances. Two new flags can also be used to affect the location of the configuration (-config) and database (-data) separately. The old -home flag is equivalent to setting both of these to the same directory. When no flags are given the following logic is used to determine the data location: If a database exists in the old default location, that location is still used. This means existing installations are not affected by this change. If $XDG_DATA_HOME is set, use $XDG_DATA_HOME/syncthing. If ~/.local/share/syncthing exists, use that location. Use the old default location. - Update to 1.4.2: - Bugfixes: - #6499: panic: nil pointer dereference in usage reporting - Other issues: - revert a change to the upgrade code that puts unnecessary load on the upgrade server - Update to 1.4.1: - Bugfixes: - #6289: "general SOCKS server failure" since syncthing 1.3.3 - #6365: Connection errors not shown in GUI - #6415: Loop in database migration "folder db index missing" after upgrade to v1.4.0 - #6422: "fatal error: runtime: out of memory" during database migration on QNAP NAS - Enhancements: - #5380: gui: Display folder/device name in modal - #5979: UNIX socket permission bits - #6384: Do auto upgrades early and synchronously on startup - Other issues: - #6249: Remove unnecessary RAM/CPU stats from GUI - Update to 1.4.0: - Important changes: - New config option maxConcurrentIncomingRequestKiB - Replace config option maxConcurrentScans with maxFolderConcurrency - Improve database schema - Bugfixes: - #4774: Doesn't react to Ctrl-C when run in a subshell with -no-restart (Linux) - #5952: panic: Should never get a deleted file as needed when we don't have it - #6281: Progress emitter uses 100% CPU - #6300: lib/ignore: panic: runtime error: index out of range [0] with length 0 - #6304: Syncing issues, database missing sequence entries - #6335: Crash or hard shutdown can case database inconsistency, out of sync - Enhancements: - #5786: Consider always running the monitor process - #5898: Database performance: reduce duplication - #5914: Limit folder concurrency to improve performance - #6302: Avoid thundering herd issue by global request limiter - Change the Go build requirement to a more flexible "golang(API) >= 1.12". Patch Instructions: To install this openSUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 15.2: zypper in -t patch openSUSE-2021-688=1 Package List: - openSUSE Leap 15.2 (x86_64): syncthing-1.15.1-lp152.2.3.1 syncthing-relaysrv-1.15.1-lp152.2.3.1 References: https://www.suse.com/security/cve/CVE-2021-21404.html https://bugzilla.suse.com/1184428

1 0

openSUSE-RU-2021:0687-1: moderate: Recommended update for monitoring-plugins-bind
by maintenance＠opensuse.org 08 May '21

08 May '21

openSUSE Recommended Update: Recommended update for monitoring-plugins-bind ______________________________________________________________________________ Announcement ID: openSUSE-RU-2021:0687-1 Rating: moderate References: #1183201 Affected Products: openSUSE Leap 15.2 ______________________________________________________________________________ An update that has one recommended fix can now be installed. Description: This update for monitoring-plugins-bind fixes the following issues: - check_bind.sh uses a static temporary file, allowing users to break the script by creating the same file with permissions that don't allow the nagios user to write to it (boo#1183201). Patch Instructions: To install this openSUSE Recommended Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 15.2: zypper in -t patch openSUSE-2021-687=1 Package List: - openSUSE Leap 15.2 (noarch): monitoring-plugins-bind-1.3-lp152.4.3.1 References: https://bugzilla.suse.com/1183201

1 0

openSUSE-RU-2021:0686-1: moderate: Recommended update for pcm
by maintenance＠opensuse.org 08 May '21

08 May '21

openSUSE Recommended Update: Recommended update for pcm ______________________________________________________________________________ Announcement ID: openSUSE-RU-2021:0686-1 Rating: moderate References: Affected Products: openSUSE Leap 15.2 ______________________________________________________________________________ An update that has 0 recommended fixes can now be installed. Description: This update for pcm fixes the following issues: Update to 202104: * Add Icelake server support Patch Instructions: To install this openSUSE Recommended Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 15.2: zypper in -t patch openSUSE-2021-686=1 Package List: - openSUSE Leap 15.2 (x86_64): pcm-202104-lp152.2.9.1 pcm-debuginfo-202104-lp152.2.9.1 pcm-debugsource-202104-lp152.2.9.1 References:

1 0

openSUSE-SU-2021:0684-1: moderate: Security update for p7zip
by opensuse-security＠opensuse.org 08 May '21

08 May '21

openSUSE Security Update: Security update for p7zip ______________________________________________________________________________ Announcement ID: openSUSE-SU-2021:0684-1 Rating: moderate References: #1184699 Cross-References: CVE-2021-3465 CVSS scores: CVE-2021-3465 (SUSE): 4 CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L Affected Products: openSUSE Leap 15.2 ______________________________________________________________________________ An update that fixes one vulnerability is now available. Description: This update for p7zip fixes the following issues: - CVE-2021-3465: Fixed a NULL pointer dereference in NCompress:CCopyCoder:Code (bsc#1184699) This update was imported from the SUSE:SLE-15-SP2:Update update project. Patch Instructions: To install this openSUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 15.2: zypper in -t patch openSUSE-2021-684=1 Package List: - openSUSE Leap 15.2 (i586 x86_64): p7zip-16.02-lp152.8.3.1 p7zip-debugsource-16.02-lp152.8.3.1 p7zip-full-16.02-lp152.8.3.1 p7zip-full-debuginfo-16.02-lp152.8.3.1 - openSUSE Leap 15.2 (noarch): p7zip-doc-16.02-lp152.8.3.1 References: https://www.suse.com/security/cve/CVE-2021-3465.html https://bugzilla.suse.com/1184699

1 0

openSUSE-RU-2021:0685-1: moderate: Recommended update for drbd-formula
by maintenance＠opensuse.org 08 May '21

08 May '21

openSUSE Recommended Update: Recommended update for drbd-formula ______________________________________________________________________________ Announcement ID: openSUSE-RU-2021:0685-1 Rating: moderate References: #1179529 Affected Products: openSUSE Leap 15.2 ______________________________________________________________________________ An update that has one recommended fix can now be installed. Description: This update for drbd-formula fixes the following issues: - Support different backing device per node. (bsc#1179529) This update was imported from the SUSE:SLE-15:Update update project. Patch Instructions: To install this openSUSE Recommended Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 15.2: zypper in -t patch openSUSE-2021-685=1 Package List: - openSUSE Leap 15.2 (noarch): drbd-formula-0.4.2+git.1616116365.1e3ab34-lp152.2.6.1 References: https://bugzilla.suse.com/1179529

1 0

openSUSE-RU-2021:0683-1: moderate: Recommended update for python-yarl
by maintenance＠opensuse.org 08 May '21

08 May '21

openSUSE Recommended Update: Recommended update for python-yarl ______________________________________________________________________________ Announcement ID: openSUSE-RU-2021:0683-1 Rating: moderate References: Affected Products: openSUSE Leap 15.2 ______________________________________________________________________________ An update that has 0 recommended fixes can now be installed. Description: This update for python-yarl contains the following fixes: - Fix python-yarl to build with new python3 version. - Allows mixing amps and semicolons in query strings as separators over previous changes. This update was imported from the SUSE:SLE-15-SP1:Update update project. Patch Instructions: To install this openSUSE Recommended Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 15.2: zypper in -t patch openSUSE-2021-683=1 Package List: - openSUSE Leap 15.2 (x86_64): python-yarl-debugsource-1.3.0-lp152.2.6.1 python3-yarl-1.3.0-lp152.2.6.1 python3-yarl-debuginfo-1.3.0-lp152.2.6.1 References:

1 0

openSUSE-RU-2021:0681-1: moderate: Recommended update for lvm2
by maintenance＠opensuse.org 07 May '21

07 May '21

openSUSE Recommended Update: Recommended update for lvm2 ______________________________________________________________________________ Announcement ID: openSUSE-RU-2021:0681-1 Rating: moderate References: #1178680 Affected Products: openSUSE Leap 15.2 ______________________________________________________________________________ An update that has one recommended fix can now be installed. Description: This update for lvm2 fixes the following issues: - Add metadata-based autoactivation property for volume group and logical volume. (bsc#1178680) This update was imported from the SUSE:SLE-15-SP2:Update update project. Patch Instructions: To install this openSUSE Recommended Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 15.2: zypper in -t patch openSUSE-2021-681=1 Package List: - openSUSE Leap 15.2 (i586 x86_64): device-mapper-1.02.163-lp152.7.21.1 device-mapper-debuginfo-1.02.163-lp152.7.21.1 device-mapper-devel-1.02.163-lp152.7.21.1 libdevmapper-event1_03-1.02.163-lp152.7.21.1 libdevmapper-event1_03-debuginfo-1.02.163-lp152.7.21.1 libdevmapper1_03-1.02.163-lp152.7.21.1 libdevmapper1_03-debuginfo-1.02.163-lp152.7.21.1 liblvm2cmd2_03-2.03.05-lp152.7.21.1 liblvm2cmd2_03-debuginfo-2.03.05-lp152.7.21.1 lvm2-2.03.05-lp152.7.21.1 lvm2-debuginfo-2.03.05-lp152.7.21.1 lvm2-debugsource-2.03.05-lp152.7.21.1 lvm2-devel-2.03.05-lp152.7.21.1 lvm2-device-mapper-debugsource-2.03.05-lp152.7.21.1 lvm2-lockd-2.03.05-lp152.7.21.1 lvm2-lockd-debuginfo-2.03.05-lp152.7.21.1 lvm2-lvmlockd-debugsource-2.03.05-lp152.7.21.1 lvm2-testsuite-2.03.05-lp152.7.21.1 lvm2-testsuite-debuginfo-2.03.05-lp152.7.21.1 - openSUSE Leap 15.2 (x86_64): device-mapper-devel-32bit-1.02.163-lp152.7.21.1 libdevmapper-event1_03-32bit-1.02.163-lp152.7.21.1 libdevmapper-event1_03-32bit-debuginfo-1.02.163-lp152.7.21.1 libdevmapper1_03-32bit-1.02.163-lp152.7.21.1 libdevmapper1_03-32bit-debuginfo-1.02.163-lp152.7.21.1 References: https://bugzilla.suse.com/1178680

1 0

openSUSE-SU-2021:0682-1: important: Security update for redis
by opensuse-security＠opensuse.org 07 May '21

07 May '21

openSUSE Security Update: Security update for redis ______________________________________________________________________________ Announcement ID: openSUSE-SU-2021:0682-1 Rating: important References: #1178205 #1182657 #1185729 #1185730 ECO-2417 ECO-2867 PM-1547 PM-1615 PM-1622 PM-1681 SLE-11578 SLE-12821 Cross-References: CVE-2021-21309 CVE-2021-29477 CVE-2021-29478 CVSS scores: CVE-2021-21309 (NVD) : 8.8 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H CVE-2021-21309 (SUSE): 7.4 CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:H CVE-2021-29477 (SUSE): 7.5 CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H CVE-2021-29478 (SUSE): 7.5 CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H Affected Products: openSUSE Leap 15.2 ______________________________________________________________________________ An update that solves three vulnerabilities, contains 8 features and has one errata is now available. Description: This update for redis fixes the following issues: redis 6.0.13 * CVE-2021-29477: Integer overflow in STRALGO LCS command (boo#1185729) * CVE-2021-29478: Integer overflow in COPY command for large intsets (boo#1185730) * Cluster: Skip unnecessary check which may prevent failure detection * Fix performance regression in BRPOP on Redis 6.0 * Fix edge-case when a module client is unblocked redis 6.0.12: * Fix compilation error on non-glibc systems if jemalloc is not used redis 6.0.11: * CVE-2021-21309: Avoid 32-bit overflows when proto-max-bulk-len is set high (boo#1182657) * Fix handling of threaded IO and CLIENT PAUSE (failover), could lead to data loss or a crash * Fix the selection of a random element from large hash tables * Fix broken protocol in client tracking tracking-redir-broken message * XINFO able to access expired keys on a replica * Fix broken protocol in redis-benchmark when used with -a or --dbnum * Avoid assertions (on older kernels) when testing arm64 CoW bug * CONFIG REWRITE should honor umask settings * Fix firstkey,lastkey,step in COMMAND command for some commands * RM_ZsetRem: Delete key if empty, the bug could leave empty zset keys redis 6.0.10: Command behavior changes: * SWAPDB invalidates WATCHed keys (#8239) * SORT command behaves differently when used on a writable replica (#8283) * EXISTS should not alter LRU (#8016) In Redis 5.0 and 6.0 it would have touched the LRU/LFU of the key. * OBJECT should not reveal logically expired keys (#8016) Will now behave the same TYPE or any other non-DEBUG command. * GEORADIUS[BYMEMBER] can fail with -OOM if Redis is over the memory limit (#8107) Other behavior changes: * Sentinel: Fix missing updates to the config file after SENTINEL SET command (#8229) * CONFIG REWRITE is atomic and safer, but requires write access to the config file's folder (#7824, #8051) This change was already present in 6.0.9, but was missing from the release notes. Bug fixes with compatibility implications (bugs introduced in Redis 6.0): * Fix RDB CRC64 checksum on big-endian systems (#8270) If you're using big-endian please consider the compatibility implications with RESTORE, replication and persistence. * Fix wrong order of key/value in Lua's map response (#8266) If your scripts use redis.setresp() or return a map (new in Redis 6.0), please consider the implications. Bug fixes: * Fix an issue where a forked process deletes the parent's pidfile (#8231) * Fix crashes when enabling io-threads-do-reads (#8230) * Fix a crash in redis-cli after executing cluster backup (#8267) * Handle output buffer limits for module blocked clients (#8141) Could result in a module sending reply to a blocked client to go beyond the limit. * Fix setproctitle related crashes. (#8150, #8088) Caused various crashes on startup, mainly on Apple M1 chips or under instrumentation. * Backup/restore cluster mode keys to slots map for repl-diskless-load=swapdb (#8108) In cluster mode with repl-diskless-load, when loading failed, slot map wouldn't have been restored. * Fix oom-score-adj-values range, and bug when used in config file (#8046) Enabling setting this in the config file in a line after enabling it, would have been buggy. * Reset average ttl when empty databases (#8106) Just causing misleading metric in INFO * Disable rehash when Redis has child process (#8007) This could have caused excessive CoW during BGSAVE, replication or AOFRW. * Further improved ACL algorithm for picking categories (#7966) Output of ACL GETUSER is now more similar to the one provided by ACL SETUSER. * Fix bug with module GIL being released prematurely (#8061) Could in theory (and rarely) cause multi-threaded modules to corrupt memory. * Reduce effect of client tracking causing feedback loop in key eviction (#8100) * Fix cluster access to unaligned memory (SIGBUS on old ARM) (#7958) * Fix saving of strings larger than 2GB into RDB files (#8306) Additional improvements: * Avoid wasteful transient memory allocation in certain cases (#8286, #5954) Platform / toolchain support related improvements: * Fix crash log registers output on ARM. (#8020) * Add a check for an ARM64 Linux kernel bug (#8224) Due to the potential severity of this issue, Redis will print log warning on startup. * Raspberry build fix. (#8095) New configuration options: * oom-score-adj-values config can now take absolute values (besides relative ones) (#8046) Module related fixes: * Moved RMAPI_FUNC_SUPPORTED so that it's usable (#8037) * Improve timer accuracy (#7987) * Allow '\0' inside of result of RM_CreateStringPrintf (#6260) redis 6.0.9: * potential heap overflow when using a heap allocator other than jemalloc or glibc's malloc. Does not affect the openSUSE package - boo#1178205 * Memory reporting of clients argv * Add redis-cli control on raw format line delimiter * Add redis-cli support for rediss:// -u prefix * WATCH no longer ignores keys which have expired for MULTI/EXEC * Correct OBJECT ENCODING response for stream type * Allow blocked XREAD on a cluster replica * TLS: Do not require CA config if not used * multiple bug fixes * Additions to modules API redis 6.0.8 (jsc#PM-1615, jsc#PM-1622, jsc#PM-1681, jsc#ECO-2417, jsc#ECO-2867, jsc#PM-1547, jsc#CAPS-56, jsc#SLE-11578, jsc#SLE-12821): * bug fixes when using with Sentinel * bug fixes when using CONFIG REWRITE * Remove THP warning when set to madvise * Allow EXEC with read commands on readonly replica in cluster * Add masters/replicas options to redis-cli --cluster call command - includes changes from 6.0.7: * CONFIG SET could hung the client when arrives during RDB/ROF loading * LPOS command when RANK is greater than matches responded with broken protocol * Add oom-score-adj configuration option to control Linux OOM killer * Show IO threads statistics and status in INFO output * Add optional tls verification mode (see tls-auth-clients) redis 6.0.6: * Fix crash when enabling CLIENT TRACKING with prefix * EXEC always fails with EXECABORT and multi-state is cleared * RESTORE ABSTTL won't store expired keys into the db * redis-cli better handling of non-pritable key names * TLS: Ignore client cert when tls-auth-clients off * Tracking: fix invalidation message on flush * Notify systemd on Sentinel startup * Fix crash on a misuse of STRALGO * Few fixes in module API * Fix a few rare leaks (STRALGO error misuse, Sentinel) * Fix a possible invalid access in defrag of scripts * Add LPOS command to search in a list * Use user+pass for MIGRATE in redis-cli and redis-benchmark in cluster mode * redis-cli support TLS for --pipe, --rdb and --replica options * TLS: Session caching configuration support redis 6.0.5: * Fix handling of speical chars in ACL LOAD * Make Redis Cluster more robust about operation errors that may lead to two clusters to mix together * Revert the sendfile() implementation of RDB transfer * Fix TLS certificate loading for chained certificates * Fix AOF rewirting of KEEPTTL SET option * Fix MULTI/EXEC behavior during -BUSY script errors Patch Instructions: To install this openSUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 15.2: zypper in -t patch openSUSE-2021-682=1 Package List: - openSUSE Leap 15.2 (i586 x86_64): redis-6.0.13-lp152.2.3.1 redis-debuginfo-6.0.13-lp152.2.3.1 redis-debugsource-6.0.13-lp152.2.3.1 References: https://www.suse.com/security/cve/CVE-2021-21309.html https://www.suse.com/security/cve/CVE-2021-29477.html https://www.suse.com/security/cve/CVE-2021-29478.html https://bugzilla.suse.com/1178205 https://bugzilla.suse.com/1182657 https://bugzilla.suse.com/1185729 https://bugzilla.suse.com/1185730

1 0

openSUSE-RU-2021:0679-1: moderate: Recommended update for cups-filters
by maintenance＠opensuse.org 07 May '21

07 May '21

openSUSE Recommended Update: Recommended update for cups-filters ______________________________________________________________________________ Announcement ID: openSUSE-RU-2021:0679-1 Rating: moderate References: #1182893 Affected Products: openSUSE Leap 15.2 ______________________________________________________________________________ An update that has one recommended fix can now be installed. Description: This update for cups-filters fixes the following issues: - Fixed an issue when 'foomatic-rip-Filter' crashes. (bsc#1182893) This update was imported from the SUSE:SLE-15-SP2:Update update project. Patch Instructions: To install this openSUSE Recommended Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 15.2: zypper in -t patch openSUSE-2021-679=1 Package List: - openSUSE Leap 15.2 (x86_64): cups-filters-1.25.0-lp152.2.3.1 cups-filters-debuginfo-1.25.0-lp152.2.3.1 cups-filters-debugsource-1.25.0-lp152.2.3.1 cups-filters-devel-1.25.0-lp152.2.3.1 References: https://bugzilla.suse.com/1182893

1 0

openSUSE-RU-2021:0680-1: moderate: Recommended update for libhugetlbfs
by maintenance＠opensuse.org 07 May '21

07 May '21

openSUSE Recommended Update: Recommended update for libhugetlbfs ______________________________________________________________________________ Announcement ID: openSUSE-RU-2021:0680-1 Rating: moderate References: #1184123 Affected Products: openSUSE Leap 15.2 ______________________________________________________________________________ An update that has one recommended fix can now be installed. Description: This update for libhugetlbfs fixes the following issues: - Hardening: Link as PIE (bsc#1184123) This update was imported from the SUSE:SLE-15:Update update project. Patch Instructions: To install this openSUSE Recommended Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 15.2: zypper in -t patch openSUSE-2021-680=1 Package List: - openSUSE Leap 15.2 (i586 x86_64): libhugetlbfs-2.20-lp152.4.3.1 libhugetlbfs-debuginfo-2.20-lp152.4.3.1 libhugetlbfs-debugsource-2.20-lp152.4.3.1 libhugetlbfs-devel-2.20-lp152.4.3.1 libhugetlbfs-tests-2.20-lp152.4.3.1 libhugetlbfs-tests-debuginfo-2.20-lp152.4.3.1 - openSUSE Leap 15.2 (x86_64): libhugetlbfs-32bit-2.20-lp152.4.3.1 libhugetlbfs-32bit-debuginfo-2.20-lp152.4.3.1 References: https://bugzilla.suse.com/1184123

1 0

openSUSE-RU-2021:0678-1: Recommended update for libmodulemd
by maintenance＠opensuse.org 07 May '21

07 May '21

openSUSE Recommended Update: Recommended update for libmodulemd ______________________________________________________________________________ Announcement ID: openSUSE-RU-2021:0678-1 Rating: low References: Affected Products: openSUSE Leap 15.2 ______________________________________________________________________________ An update that has 0 recommended fixes can now be installed. Description: This update for libmodulemd fixes the following issues: - Added support for 'buildorder' to Packager documents - Fixed an issue with ModuleIndex when input contains only Obsoletes documents - Extended read_packager_[file|string]() to support overriding the module name and stream - Ignore Packager documents when running ModuleIndex.update_from_*() - Added python overrides for XMD in PackagerV3 - Added python override to ignore the GType return when reading packager files - Added PackagerV3.get_mdversion() This update was imported from the SUSE:SLE-15-SP2:Update update project. Patch Instructions: To install this openSUSE Recommended Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 15.2: zypper in -t patch openSUSE-2021-678=1 Package List: - openSUSE Leap 15.2 (i586 x86_64): libmodulemd-debuginfo-2.12.0-lp152.8.6.1 libmodulemd-debugsource-2.12.0-lp152.8.6.1 libmodulemd-devel-2.12.0-lp152.8.6.1 libmodulemd2-2.12.0-lp152.8.6.1 libmodulemd2-debuginfo-2.12.0-lp152.8.6.1 modulemd-validator-2.12.0-lp152.8.6.1 modulemd-validator-debuginfo-2.12.0-lp152.8.6.1 python3-libmodulemd-2.12.0-lp152.8.6.1 typelib-1_0-Modulemd-2_0-2.12.0-lp152.8.6.1 References:

1 0

openSUSE-RU-2021:0676-1: important: Recommended update for bash
by maintenance＠opensuse.org 07 May '21

07 May '21

openSUSE Recommended Update: Recommended update for bash ______________________________________________________________________________ Announcement ID: openSUSE-RU-2021:0676-1 Rating: important References: #1183064 Affected Products: openSUSE Leap 15.2 ______________________________________________________________________________ An update that has one recommended fix can now be installed. Description: This update for bash fixes the following issues: - Fixed a segmentation fault that used to occur when bash read a history file that was malformed in a very specific way. (bsc#1183064) This update was imported from the SUSE:SLE-15:Update update project. Patch Instructions: To install this openSUSE Recommended Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 15.2: zypper in -t patch openSUSE-2021-676=1 Package List: - openSUSE Leap 15.2 (i586 x86_64): bash-4.4-lp152.12.3.1 bash-debuginfo-4.4-lp152.12.3.1 bash-debugsource-4.4-lp152.12.3.1 bash-devel-4.4-lp152.12.3.1 bash-loadables-4.4-lp152.12.3.1 bash-loadables-debuginfo-4.4-lp152.12.3.1 libreadline7-7.0-lp152.12.3.1 libreadline7-debuginfo-7.0-lp152.12.3.1 readline-devel-7.0-lp152.12.3.1 readline-devel-static-7.0-lp152.12.3.1 - openSUSE Leap 15.2 (noarch): bash-doc-4.4-lp152.12.3.1 bash-lang-4.4-lp152.12.3.1 readline-doc-7.0-lp152.12.3.1 - openSUSE Leap 15.2 (x86_64): bash-32bit-debuginfo-4.4-lp152.12.3.1 libreadline7-32bit-7.0-lp152.12.3.1 libreadline7-32bit-debuginfo-7.0-lp152.12.3.1 readline-devel-32bit-7.0-lp152.12.3.1 References: https://bugzilla.suse.com/1183064

1 0

openSUSE-SU-2021:0677-1: critical: Security update for exim
by opensuse-security＠opensuse.org 07 May '21

07 May '21

openSUSE Security Update: Security update for exim ______________________________________________________________________________ Announcement ID: openSUSE-SU-2021:0677-1 Rating: critical References: #1079832 #1171490 #1171877 #1173693 #1185631 Cross-References: CVE-2017-1000369 CVE-2017-16943 CVE-2017-16944 CVE-2018-6789 CVE-2019-16928 CVE-2020-12783 CVE-2020-28007 CVE-2020-28008 CVE-2020-28009 CVE-2020-28010 CVE-2020-28011 CVE-2020-28012 CVE-2020-28013 CVE-2020-28014 CVE-2020-28015 CVE-2020-28016 CVE-2020-28017 CVE-2020-28018 CVE-2020-28019 CVE-2020-28020 CVE-2020-28021 CVE-2020-28022 CVE-2020-28023 CVE-2020-28024 CVE-2020-28025 CVE-2020-28026 CVSS scores: CVE-2017-1000369 (NVD) : 4 CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N CVE-2017-16943 (NVD) : 9.8 CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H CVE-2017-16944 (NVD) : 7.5 CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H CVE-2018-6789 (NVD) : 9.8 CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H CVE-2019-16928 (NVD) : 9.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H CVE-2020-12783 (NVD) : 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N Affected Products: openSUSE Leap 15.2 ______________________________________________________________________________ An update that fixes 26 vulnerabilities is now available. Description: This update for exim fixes the following issues: Exim was updated to exim-4.94.2 security update (boo#1185631) * CVE-2020-28007: Link attack in Exim's log directory * CVE-2020-28008: Assorted attacks in Exim's spool directory * CVE-2020-28014: Arbitrary PID file creation * CVE-2020-28011: Heap buffer overflow in queue_run() * CVE-2020-28010: Heap out-of-bounds write in main() * CVE-2020-28013: Heap buffer overflow in parse_fix_phrase() * CVE-2020-28016: Heap out-of-bounds write in parse_fix_phrase() * CVE-2020-28015: New-line injection into spool header file (local) * CVE-2020-28012: Missing close-on-exec flag for privileged pipe * CVE-2020-28009: Integer overflow in get_stdinput() * CVE-2020-28017: Integer overflow in receive_add_recipient() * CVE-2020-28020: Integer overflow in receive_msg() * CVE-2020-28023: Out-of-bounds read in smtp_setup_msg() * CVE-2020-28021: New-line injection into spool header file (remote) * CVE-2020-28022: Heap out-of-bounds read and write in extract_option() * CVE-2020-28026: Line truncation and injection in spool_read_header() * CVE-2020-28019: Failure to reset function pointer after BDAT error * CVE-2020-28024: Heap buffer underflow in smtp_ungetc() * CVE-2020-28018: Use-after-free in tls-openssl.c * CVE-2020-28025: Heap out-of-bounds read in pdkim_finish_bodyhash() update to exim-4.94.1 * Fix security issue in BDAT state confusion. Ensure we reset known-good where we know we need to not be reading BDAT data, as a general case fix, and move the places where we switch to BDAT mode until after various protocol state checks. Fixes CVE-2020-BDATA reported by Qualys. * Fix security issue in SMTP verb option parsing (CVE-2020-EXOPT) * Fix security issue with too many recipients on a message (to remove a known security problem if someone does set recipients_max to unlimited, or if local additions add to the recipient list). Fixes CVE-2020-RCPTL reported by Qualys. * Fix CVE-2020-28016 (PFPZA): Heap out-of-bounds write in parse_fix_phrase() * Fix security issue CVE-2020-PFPSN and guard against cmdline invoker providing a particularly obnoxious sender full name. * Fix Linux security issue CVE-2020-SLCWD and guard against PATH_MAX better. - bring back missing exim_db.8 manual page (fixes boo#1173693) - bring in changes from current +fixes (lots of taint check fixes) * Bug 1329: Fix format of Maildir-format filenames to match other mail- related applications. Previously an "H" was used where available info says that "M" should be, so change to match. * Bug 2587: Fix pam expansion condition. Tainted values are commonly used as arguments, so an implementation trying to copy these into a local buffer was taking a taint-enforcement trap. Fix by using dynamically created buffers. * Bug 2586: Fix listcount expansion operator. Using tainted arguments is reasonable, eg. to count headers. Fix by using dynamically created buffers rather than a local. Do similar fixes for ACL actions "dcc", "log_reject_target", "malware" and "spam"; the arguments are expanded so could be handling tainted values. * Bug 2590: Fix -bi (newaliases). A previous code rearrangement had broken the (no-op) support for this sendmail command. Restore it to doing nothing, silently, and returning good status. - update to exim 4.94 * some transports now refuse to use tainted data in constructing their delivery location this WILL BREAK configurations which are not updated accordingly. In particular: any Transport use of $local_user which has been relying upon check_local_user far away in the Router to make it safe, should be updated to replace $local_user with $local_part_data. * Attempting to remove, in router or transport, a header name that ends with an asterisk (which is a standards-legal name) will now result in all headers named starting with the string before the asterisk being removed. - switch pretrans to use lua (fixes boo#1171877) - bring changes from current in +fixes branch (patch-exim-fixes-ee83de04d3087efaf808d1f2235a988275c2ee94) * fixes CVE-2020-12783 (boo#1171490) * Regard command-line recipients as tainted. * Bug 2489: Fix crash in the "pam" expansion condition. * Use tainted buffers for the transport smtp context. * Bug 2493: Harden ARC verify against Outlook, which has been seen to mix the ordering of its ARC headers. This caused a crash. * Bug 2492: Use tainted memory for retry record when needed. Previously when a new record was being constructed with information from the peer, a trap was taken. * Bug 2494: Unset the default for dmarc_tld_file. * Fix an uninitialised flag in early-pipelining. Previously connections could, depending on the platform, hang at the STARTTLS response. * Bug 2498: Reset a counter used for ARC verify before handling another message on a connection. Previously if one message had ARC headers and the following one did not, a crash could result when adding an Authentication-Results: header. * Bug 2500: Rewind some of the common-coding in string handling between the Exim main code and Exim-related utities. * Fix the variables set by the gsasl authenticator. * Bug 2507: Modules: on handling a dynamic-module (lookups) open failure, only retrieve the errormessage once. * Bug 2501: Fix init call in the heimdal authenticator. Previously it adjusted the size of a major service buffer; this failed because the buffer was in use at the time. Change to a compile-time increase in the buffer size, when this authenticator is compiled into exim. - update to exim 4.93.0.4 (+fixes release) * Avoid costly startup code when not strictly needed. This reduces time for some exim process initialisations. It does mean that the logging of TLS configuration problems is only done for the daemon startup. * Early-pipelining support code is now included unless disabled in Makefile. * DKIM verification defaults no long accept sha1 hashes, to conform to RFC 8301. They can still be enabled, using the dkim_verify_hashes main option. * Support CHUNKING from an smtp transport using a transport_filter, when DKIM signing is being done. Previously a transport_filter would always disable CHUNKING, falling back to traditional DATA. * Regard command-line receipients as tainted. * Bug 340: Remove the daemon pid file on exit, whe due to SIGTERM. * Bug 2489: Fix crash in the "pam" expansion condition. It seems that the PAM library frees one of the arguments given to it, despite the documentation. Therefore a plain malloc must be used. * Bug 2491: Use tainted buffers for the transport smtp context. Previously on-stack buffers were used, resulting in a taint trap when DSN information copied from a received message was written into the buffer. * Bug 2493: Harden ARC verify against Outlook, whick has been seen to mix the ordering of its ARC headers. This caused a crash. * Bug 2492: Use tainted memory for retry record when needed. Previously when a new record was being constructed with information from the peer, a trap was taken. * Bug 2494: Unset the default for dmarc_tld_file. Previously a naiive installation would get error messages from DMARC verify, when it hit the nonexistent file indicated by the default. Distros wanting DMARC enabled should both provide the file and set the option. Also enforce no DMARC verification for command-line sourced messages. * Fix an uninitialised flag in early-pipelining. Previously connections could, depending on the platform, hang at the STARTTLS response. * Bug 2498: Reset a counter used for ARC verify before handling another message on a connection. Previously if one message had ARC headers and the following one did not, a crash could result when adding an Authentication-Results: header. * Bug 2500: Rewind some of the common-coding in string handling between the Exim main code and Exim-related utities. The introduction of taint tracking also did many adjustments to string handling. Since then, eximon frequently terminated with an assert failure. * When PIPELINING, synch after every hundred or so RCPT commands sent and check for 452 responses. This slightly helps the inefficieny of doing a large alias-expansion into a recipient-limited target. The max_rcpt transport option still applies (and at the current default, will override the new feature). The check is done for either cause of synch, and forces a fast-retry of all 452'd recipients using a new MAIL FROM on the same connection. The new facility is not tunable at this time. * Fix the variables set by the gsasl authenticator. Previously a pointer to library live data was being used, so the results became garbage. Make copies while it is still usable. * Logging: when the deliver_time selector ise set, include the DT= field on delivery deferred (==) and failed (**) lines (if a delivery was attemtped). Previously it was only on completion (=>) lines. * Authentication: the gsasl driver not provides the $authN variables in time for the expansion of the server_scram_iter and server_scram_salt options. spec file cleanup to make update work - add docdir to spec - update to exim 4.93 * SUPPORT_DMARC replaces EXPERIMENTAL_DMARC * DISABLE_TLS replaces SUPPORT_TLS * Bump the version for the local_scan API. * smtp transport option hosts_try_fastopen defaults to "*". * DNSSec is requested (not required) for all queries. (This seemes to ask for trouble if your resolver is a systemd-resolved.) * Generic router option retry_use_local_part defaults to "true" under specific pre-conditions. * Introduce a tainting mechanism for values read from untrusted sources. * Use longer file names for temporary spool files (this avoids name conflicts with spool on a shared file system). * Use dsn_from main config option (was ignored previously). - update to exim 4.92.3 * CVE-2019-16928: fix against Heap-based buffer overflow in string_vformat, remote code execution seems to be possible - update to exim 4.92.2 * CVE-2019-15846: fix against remote attackers executing arbitrary code as root via a trailing backslash - update to exim 4.92.1 * CVE-2019-13917: Fixed an issue with ${sort} expansion which could allow remote attackers to execute other programs with root privileges (boo#1142207) - spec file cleanup * fix DANE inclusion guard condition * re-enable i18n and remove misleading comment * EXPERIMENTAL_SPF is now SUPPORT_SPF * DANE is now SUPPORT_DANE - update to exim 4.92 * ${l_header:<name>} expansion * ${readsocket} now supports TLS * "utf8_downconvert" option (if built with SUPPORT_I18N) * "pipelining" log_selector * JSON variants for ${extract } expansion * "noutf8" debug option * TCP Fast Open support on MacOS * CVE-2019-10149: Fixed a Remote Command Execution (boo#1136587) - add workaround patch for compile time error on missing printf format annotation (gnu_printf.patch) - update to 4.91 * DEFER rather than ERROR on redis cluster MOVED response. * Catch and remove uninitialized value warning in exiqsumm * Disallow '/' characters in queue names specified for the "queue=" ACL modifier. This matches the restriction on the commandline. * Fix pgsql lookup for multiple result-tuples with a single column. Previously only the last row was returned. * Bug 2217: Tighten up the parsing of DKIM signature headers. * Bug 2215: Fix crash associated with dnsdb lookup done from DKIM ACL. * Fix issue with continued-connections when the DNS shifts unreliably. * Bug 2214: Fix SMTP responses resulting from non-accept result of MIME ACL. * The "support for" informational output now, which built with Content Scanning support, has a line for the malware scanner interfaces compiled in. Interface can be individually included or not at build time. * The "aveserver", "kavdaemon" and "mksd" interfaces are now not included by the template makefile "src/EDITME". The "STREAM" support for an older ClamAV interface method is removed. * Bug 2223: Fix mysql lookup returns for the no-data case (when the number of rows affected is given instead). * The runtime Berkeley DB library version is now additionally output by "exim -d -bV". Previously only the compile-time version was shown. * Bug 2230: Fix cutthrough routing for nonfirst messages in an initiating SMTP connection. * Bug 2229: Fix cutthrough routing for nonstandard port numbers defined by routers. * Bug 2174: A timeout on connect for a callout was also erroneously seen as a timeout on read on a GnuTLS initiating connection, resulting in the initiating connection being dropped. * Relax results from ACL control request to enable cutthrough, in unsupported situations, from error to silently (except under debug) ignoring. * Fix Buffer overflow in base64d() (CVE-2018-6789) * Fix bug in DKIM verify: a buffer overflow could corrupt the malloc metadata, resulting in a crash in free(). * Fix broken Heimdal GSSAPI authenticator integration. * Bug 2113: Fix conversation closedown with the Avast malware scanner. * Bug 2239: Enforce non-usability of control=utf8_downconvert in the mail ACL. * Speed up macro lookups during configuration file read, by skipping non- macro text after a replacement (previously it was only once per line) and by skipping builtin macros when searching for an uppercase lead character. * DANE support moved from Experimental to mainline. The Makefile control for the build is renamed. * Fix memory leak during multi-message connections using STARTTLS. * Bug 2236: When a DKIM verification result is overridden by ACL, DMARC reported the original. Fix to report (as far as possible) the ACL result replacing the original. * Fix memory leak during multi-message connections using STARTTLS under OpenSSL * Bug 2242: Fix exim_dbmbuild to permit directoryless filenames. * Fix utf8_downconvert propagation through a redirect router. * Bug 2253: For logging delivery lines under PRDR, append the overall DATA response info to the (existing) per-recipient response info for the "C=" log element. * Bug 2251: Fix ldap lookups that return a single attribute having zero- length value. * Support Avast multiline protocol, this allows passing flags to newer versions of the scanner. * Ensure that variables possibly set during message acceptance are marked dead before release of memory in the daemon loop. * Bug 2250: Fix a longstanding bug in heavily-pipelined SMTP input (such as a multi-recipient message from a mailinglist manager). * The (EXPERIMENTAL_DMARC) variable $dmarc_ar_header is withdrawn, being replaced by the ${authresults } expansion. * Bug 2257: Fix pipe transport to not use a socket-only syscall. * Set a handler for SIGTERM and call exit(3) if running as PID 1. This allows proper process termination in container environments. * Bug 2258: Fix spool_wireformat in combination with LMTP transport. Previously the "final dot" had a newline after it; ensure it is CR,LF. * SPF: remove support for the "spf" ACL condition outcome values "err_temp" and "err_perm", deprecated since 4.83 when the RFC-defined words " temperror" and "permerror" were introduced. * Re-introduce enforcement of no cutthrough delivery on transports having transport-filters or DKIM-signing. * Cutthrough: for a final-dot response timeout (and nonunderstood responses) in defer=pass mode supply a 450 to the initiator. Previously the message would be spooled. * DANE: add dane_require_tls_ciphers SMTP Transport option; if unset, tls_require_ciphers is used as before. * Malware Avast: Better match the Avast multiline protocol. * Fix reinitialisation of DKIM logging variable between messages. * Bug 2255: Revert the disable of the OpenSSL session caching. * Add util/renew-opendmarc-tlds.sh script for safe renewal of public suffix list. * DKIM: accept Ed25519 pubkeys in SubjectPublicKeyInfo-wrapped form, since the IETF WG has not yet settled on that versus the original "bare" representation. * Fix syslog logging for syslog_timestamp=no and log_selector +millisec. Previously the millisecond value corrupted the output. Fix also for syslog_pid=no and log_selector +pid, for which the pid corrupted the output. - Replace xorg-x11-devel by individual pkgconfig() buildrequires. - update to 4.90.1 * Allow PKG_CONFIG_PATH to be set in Local/Makefile and use it correctly during configuration. Wildcards are allowed and expanded. * Shorten the log line for daemon startup by collapsing adjacent sets of identical IP addresses on different listening ports. Will also affect "exiwhat" output. * Tighten up the checking in isip4 (et al): dotted-quad components larger than 255 are no longer allowed. * Default openssl_options to include +no_ticket, to reduce load on peers. Disable the session-cache too, which might reduce our load. Since we currrectly use a new context for every connection, both as server and client, there is no benefit for these. * Add $SOURCE_DATE_EPOCH support for reproducible builds, per spec at <https://reproducible-builds.org/specs/source-date-epoch/>. * Fix smtp transport use of limited max_rcpt under mua_wrapper. Previously the check for any unsuccessful recipients did not notice the limit, and erroneously found still-pending ones. * Pipeline CHUNKING command and data together, on kernels that support MSG_MORE. Only in-clear (not on TLS connections). * Avoid using a temporary file during transport using dkim. Unless a transport-filter is involved we can buffer the headers in memory for creating the signature, and read the spool data file once for the signature and again for transmission. * Enable use of sendfile in Linux builds as default. It was disabled in 4.77 as the kernel support then wasn't solid, having issues in 64bit mode. Now, it's been long enough. Add support for FreeBSD also. * Add commandline_checks_require_admin option. * Do pipelining under TLS. * For the "sock" variant of the malware scanner interface, accept an empty cmdline element to get the documented default one. Previously it was inaccessible. * Prevent repeated use of -p/-oMr * DKIM: enforce the DNS pubkey record "h" permitted-hashes optional field, if present. * DKIM: when a message has multiple signatures matching an identity given in dkim_verify_signers, run the dkim acl once for each. * Support IDNA2008. * The path option on a pipe transport is now expanded before use * Have the EHLO response advertise VRFY, if there is a vrfy ACL defined. - Several bug fixes - Fix for buffer overflow in base64decode() (boo#1079832 CVE-2018-6789) Patch Instructions: To install this openSUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 15.2: zypper in -t patch openSUSE-2021-677=1 Package List: - openSUSE Leap 15.2 (x86_64): exim-4.94.2-lp152.8.3.1 exim-debuginfo-4.94.2-lp152.8.3.1 exim-debugsource-4.94.2-lp152.8.3.1 eximon-4.94.2-lp152.8.3.1 eximon-debuginfo-4.94.2-lp152.8.3.1 eximstats-html-4.94.2-lp152.8.3.1 References: https://www.suse.com/security/cve/CVE-2017-1000369.html https://www.suse.com/security/cve/CVE-2017-16943.html https://www.suse.com/security/cve/CVE-2017-16944.html https://www.suse.com/security/cve/CVE-2018-6789.html https://www.suse.com/security/cve/CVE-2019-16928.html https://www.suse.com/security/cve/CVE-2020-12783.html https://www.suse.com/security/cve/CVE-2020-28007.html https://www.suse.com/security/cve/CVE-2020-28008.html https://www.suse.com/security/cve/CVE-2020-28009.html https://www.suse.com/security/cve/CVE-2020-28010.html https://www.suse.com/security/cve/CVE-2020-28011.html https://www.suse.com/security/cve/CVE-2020-28012.html https://www.suse.com/security/cve/CVE-2020-28013.html https://www.suse.com/security/cve/CVE-2020-28014.html https://www.suse.com/security/cve/CVE-2020-28015.html https://www.suse.com/security/cve/CVE-2020-28016.html https://www.suse.com/security/cve/CVE-2020-28017.html https://www.suse.com/security/cve/CVE-2020-28018.html https://www.suse.com/security/cve/CVE-2020-28019.html https://www.suse.com/security/cve/CVE-2020-28020.html https://www.suse.com/security/cve/CVE-2020-28021.html https://www.suse.com/security/cve/CVE-2020-28022.html https://www.suse.com/security/cve/CVE-2020-28023.html https://www.suse.com/security/cve/CVE-2020-28024.html https://www.suse.com/security/cve/CVE-2020-28025.html https://www.suse.com/security/cve/CVE-2020-28026.html https://bugzilla.suse.com/1079832 https://bugzilla.suse.com/1171490 https://bugzilla.suse.com/1171877 https://bugzilla.suse.com/1173693 https://bugzilla.suse.com/1185631

1 0

openSUSE-RU-2021:0673-1: moderate: Recommended update for kimageformats
by maintenance＠opensuse.org 06 May '21

06 May '21

openSUSE Recommended Update: Recommended update for kimageformats ______________________________________________________________________________ Announcement ID: openSUSE-RU-2021:0673-1 Rating: moderate References: Affected Products: openSUSE Leap 15.2 ______________________________________________________________________________ An update that has 0 recommended fixes can now be installed. Description: This update for kimageformats fixes the following issues: - Add patch to fix OOB write (oss-fuzz#33742): Patch Instructions: To install this openSUSE Recommended Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 15.2: zypper in -t patch openSUSE-2021-673=1 Package List: - openSUSE Leap 15.2 (i586 x86_64): kimageformats-5.71.0-lp152.2.3.1 kimageformats-debuginfo-5.71.0-lp152.2.3.1 kimageformats-debugsource-5.71.0-lp152.2.3.1 kimageformats-eps-5.71.0-lp152.2.3.1 kimageformats-eps-debuginfo-5.71.0-lp152.2.3.1 - openSUSE Leap 15.2 (x86_64): kimageformats-32bit-5.71.0-lp152.2.3.1 kimageformats-32bit-debuginfo-5.71.0-lp152.2.3.1 References:

1 0

openSUSE-SU-2021:0675-1: moderate: Security update for alpine
by opensuse-security＠opensuse.org 06 May '21

06 May '21

openSUSE Security Update: Security update for alpine ______________________________________________________________________________ Announcement ID: openSUSE-SU-2021:0675-1 Rating: moderate References: #1173281 Cross-References: CVE-2020-14929 CVSS scores: CVE-2020-14929 (NVD) : 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N CVE-2020-14929 (SUSE): 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N Affected Products: openSUSE Leap 15.2 ______________________________________________________________________________ An update that fixes one vulnerability is now available. Description: This update for alpine fixes the following issues: Update to release 2.24 * A few crash fixes * Implementation of XOAUTH2 for Yahoo! Mail. Update to release 2.23.2 * Expansion of the configuration screen for XOAUTH2 to include username, and tenant. * Alpine uses the domain in the From: header of a message to generate a message-id and suppresses all information about Alpine, version, revision, and time of generation of the message-id from this header. * Alpine does not generate Sender or X-X-Sender by default by enabling [X] Disable Sender as the default. * Alpine does not disclose User Agent by default by enabling [X] Suppress User Agent by default. * When messages are selected, pressing the ';' command to broaden or narrow a search, now offers the possibility to completely replace the search, and is almost equivalent to being a shortcut to "unselect all messages, and select again". Update to release 2.23 * Fixes boo#1173281, CVE-2020-14929: Alpine silently proceeds to use an insecure connection after a /tls is sent in certain circumstances. * Implementation of XOAUTH2 authentication support for Outlook. * Add support for the OAUTHBEARER authentication method in Gmail. * Support for the SASL-IR IMAP extension. * Alpine can pass an HTML message to an external web browser, by using the "External" command in the ATTACHMENT INDEX screen. Update to release 2.22 * Support for XOAUTH2 authentication method in Gmail. * NTLM authentication support with the ntlm library. * Added the "/tls1_3" flag for servers that support it. * Add the "g" option to the select command that works in IMAP servers that implement the X-GM-EXT-1 capability (such as the one offered by Gmail). * Added "/auth=XYZ" to the way to define a server. This allows users to select the method to authenticate to an IMAP, SMTP or POP3 server. Examples are /auth=plain, or /auth=gssapi, etc. * When a message is of type multipart/mixed, and its first part is multipart/signed, Alpine will include the text of the original message in a reply message, instead of including a multipart attachment. * Added backward search in the index screen. * pico: Add -dict option to Pico, which allows users to choose a dictionary when spelling. - Drop /usr/bin/mailutil, it is not built by default anymore. * Added Quota subcommands for printing, forwarding, saving, etc. Patch Instructions: To install this openSUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 15.2: zypper in -t patch openSUSE-2021-675=1 Package List: - openSUSE Leap 15.2 (x86_64): alpine-2.24-lp152.5.3.1 alpine-debuginfo-2.24-lp152.5.3.1 alpine-debugsource-2.24-lp152.5.3.1 pico-5.07-lp152.5.3.1 pico-debuginfo-5.07-lp152.5.3.1 pilot-2.99-lp152.5.3.1 pilot-debuginfo-2.99-lp152.5.3.1 References: https://www.suse.com/security/cve/CVE-2020-14929.html https://bugzilla.suse.com/1173281

1 0

openSUSE-RU-2021:0674-1: moderate: Recommended update for strawberry
by maintenance＠opensuse.org 06 May '21

06 May '21

openSUSE Recommended Update: Recommended update for strawberry ______________________________________________________________________________ Announcement ID: openSUSE-RU-2021:0674-1 Rating: moderate References: Affected Products: openSUSE Leap 15.2 ______________________________________________________________________________ An update that has 0 recommended fixes can now be installed. Description: This update for strawberry fixes the following issues: Update to version 0.9.3: + Bugfixes: + Fix "Show in file browser" to work with thunar. + Check that the clicked rating position is to the right or left of the rectangle. + Fix rescan when collection directory is removed and readded. Enhancements: + Allow editing playlist metadata for radio streams. + Make CollectionQuery subclass QSqlQuery, avoid copying QSqlQuery. + Only enable FTS3 when schema needs upgrading, since FTS5 is used for search. + Add setting for configuring the color for the currently playing song. + Add setting to turn on OSD Pretty fading. + Add commandline option to resize window. Patch Instructions: To install this openSUSE Recommended Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 15.2: zypper in -t patch openSUSE-2021-674=1 Package List: - openSUSE Leap 15.2 (x86_64): strawberry-0.9.3-lp152.2.30.1 strawberry-debuginfo-0.9.3-lp152.2.30.1 strawberry-debugsource-0.9.3-lp152.2.30.1 References:

1 0

openSUSE-SU-2021:0672-1: important: Security update for ceph
by opensuse-security＠opensuse.org 06 May '21

06 May '21

openSUSE Security Update: Security update for ceph ______________________________________________________________________________ Announcement ID: openSUSE-SU-2021:0672-1 Rating: important References: #1183074 #1183899 #1184231 Cross-References: CVE-2021-20288 CVSS scores: CVE-2021-20288 (NVD) : 7.2 CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H CVE-2021-20288 (SUSE): 8 CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:H/I:H/A:H Affected Products: openSUSE Leap 15.2 ______________________________________________________________________________ An update that solves one vulnerability and has two fixes is now available. Description: This update for ceph fixes the following issues: - ceph was updated to 15.2.11-83-g8a15f484c2: * CVE-2021-20288: Fixed unauthorized global_id reuse (bsc#1183074). * disk gets replaced with no rocksdb/wal (bsc#1184231). * BlueStore handles huge(>4GB) writes from RocksDB to BlueFS poorly, potentially causing data corruption (bsc#1183899). This update was imported from the SUSE:SLE-15-SP2:Update update project. Patch Instructions: To install this openSUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 15.2: zypper in -t patch openSUSE-2021-672=1 Package List: - openSUSE Leap 15.2 (noarch): ceph-grafana-dashboards-15.2.11.83+g8a15f484c2-lp152.2.15.1 ceph-mgr-cephadm-15.2.11.83+g8a15f484c2-lp152.2.15.1 ceph-mgr-dashboard-15.2.11.83+g8a15f484c2-lp152.2.15.1 ceph-mgr-diskprediction-cloud-15.2.11.83+g8a15f484c2-lp152.2.15.1 ceph-mgr-diskprediction-local-15.2.11.83+g8a15f484c2-lp152.2.15.1 ceph-mgr-k8sevents-15.2.11.83+g8a15f484c2-lp152.2.15.1 ceph-mgr-modules-core-15.2.11.83+g8a15f484c2-lp152.2.15.1 ceph-mgr-rook-15.2.11.83+g8a15f484c2-lp152.2.15.1 ceph-prometheus-alerts-15.2.11.83+g8a15f484c2-lp152.2.15.1 cephadm-15.2.11.83+g8a15f484c2-lp152.2.15.1 - openSUSE Leap 15.2 (x86_64): ceph-15.2.11.83+g8a15f484c2-lp152.2.15.1 ceph-base-15.2.11.83+g8a15f484c2-lp152.2.15.1 ceph-base-debuginfo-15.2.11.83+g8a15f484c2-lp152.2.15.1 ceph-common-15.2.11.83+g8a15f484c2-lp152.2.15.1 ceph-common-debuginfo-15.2.11.83+g8a15f484c2-lp152.2.15.1 ceph-debugsource-15.2.11.83+g8a15f484c2-lp152.2.15.1 ceph-fuse-15.2.11.83+g8a15f484c2-lp152.2.15.1 ceph-fuse-debuginfo-15.2.11.83+g8a15f484c2-lp152.2.15.1 ceph-immutable-object-cache-15.2.11.83+g8a15f484c2-lp152.2.15.1 ceph-immutable-object-cache-debuginfo-15.2.11.83+g8a15f484c2-lp152.2.15.1 ceph-mds-15.2.11.83+g8a15f484c2-lp152.2.15.1 ceph-mds-debuginfo-15.2.11.83+g8a15f484c2-lp152.2.15.1 ceph-mgr-15.2.11.83+g8a15f484c2-lp152.2.15.1 ceph-mgr-debuginfo-15.2.11.83+g8a15f484c2-lp152.2.15.1 ceph-mon-15.2.11.83+g8a15f484c2-lp152.2.15.1 ceph-mon-debuginfo-15.2.11.83+g8a15f484c2-lp152.2.15.1 ceph-osd-15.2.11.83+g8a15f484c2-lp152.2.15.1 ceph-osd-debuginfo-15.2.11.83+g8a15f484c2-lp152.2.15.1 ceph-radosgw-15.2.11.83+g8a15f484c2-lp152.2.15.1 ceph-radosgw-debuginfo-15.2.11.83+g8a15f484c2-lp152.2.15.1 ceph-test-15.2.11.83+g8a15f484c2-lp152.2.15.1 ceph-test-debuginfo-15.2.11.83+g8a15f484c2-lp152.2.15.1 ceph-test-debugsource-15.2.11.83+g8a15f484c2-lp152.2.15.1 cephfs-shell-15.2.11.83+g8a15f484c2-lp152.2.15.1 libcephfs-devel-15.2.11.83+g8a15f484c2-lp152.2.15.1 libcephfs2-15.2.11.83+g8a15f484c2-lp152.2.15.1 libcephfs2-debuginfo-15.2.11.83+g8a15f484c2-lp152.2.15.1 librados-devel-15.2.11.83+g8a15f484c2-lp152.2.15.1 librados-devel-debuginfo-15.2.11.83+g8a15f484c2-lp152.2.15.1 librados2-15.2.11.83+g8a15f484c2-lp152.2.15.1 librados2-debuginfo-15.2.11.83+g8a15f484c2-lp152.2.15.1 libradospp-devel-15.2.11.83+g8a15f484c2-lp152.2.15.1 librbd-devel-15.2.11.83+g8a15f484c2-lp152.2.15.1 librbd1-15.2.11.83+g8a15f484c2-lp152.2.15.1 librbd1-debuginfo-15.2.11.83+g8a15f484c2-lp152.2.15.1 librgw-devel-15.2.11.83+g8a15f484c2-lp152.2.15.1 librgw2-15.2.11.83+g8a15f484c2-lp152.2.15.1 librgw2-debuginfo-15.2.11.83+g8a15f484c2-lp152.2.15.1 python3-ceph-argparse-15.2.11.83+g8a15f484c2-lp152.2.15.1 python3-ceph-common-15.2.11.83+g8a15f484c2-lp152.2.15.1 python3-cephfs-15.2.11.83+g8a15f484c2-lp152.2.15.1 python3-cephfs-debuginfo-15.2.11.83+g8a15f484c2-lp152.2.15.1 python3-rados-15.2.11.83+g8a15f484c2-lp152.2.15.1 python3-rados-debuginfo-15.2.11.83+g8a15f484c2-lp152.2.15.1 python3-rbd-15.2.11.83+g8a15f484c2-lp152.2.15.1 python3-rbd-debuginfo-15.2.11.83+g8a15f484c2-lp152.2.15.1 python3-rgw-15.2.11.83+g8a15f484c2-lp152.2.15.1 python3-rgw-debuginfo-15.2.11.83+g8a15f484c2-lp152.2.15.1 rados-objclass-devel-15.2.11.83+g8a15f484c2-lp152.2.15.1 rbd-fuse-15.2.11.83+g8a15f484c2-lp152.2.15.1 rbd-fuse-debuginfo-15.2.11.83+g8a15f484c2-lp152.2.15.1 rbd-mirror-15.2.11.83+g8a15f484c2-lp152.2.15.1 rbd-mirror-debuginfo-15.2.11.83+g8a15f484c2-lp152.2.15.1 rbd-nbd-15.2.11.83+g8a15f484c2-lp152.2.15.1 rbd-nbd-debuginfo-15.2.11.83+g8a15f484c2-lp152.2.15.1 References: https://www.suse.com/security/cve/CVE-2021-20288.html https://bugzilla.suse.com/1183074 https://bugzilla.suse.com/1183899 https://bugzilla.suse.com/1184231

1 0

openSUSE-RU-2021:0671-1: important: Recommended update for ebtables
by maintenance＠opensuse.org 05 May '21

05 May '21

openSUSE Recommended Update: Recommended update for ebtables ______________________________________________________________________________ Announcement ID: openSUSE-RU-2021:0671-1 Rating: important References: #1182824 Affected Products: openSUSE Leap 15.2 ______________________________________________________________________________ An update that has one recommended fix can now be installed. Description: This update for ebtables fixes the following issue: - Lock properly when on `NFS` shares and the `--concurrent` flag is used in a non standard order. (bsc#1182824) This update was imported from the SUSE:SLE-15-SP2:Update update project. Patch Instructions: To install this openSUSE Recommended Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 15.2: zypper in -t patch openSUSE-2021-671=1 Package List: - openSUSE Leap 15.2 (i586 x86_64): ebtables-2.0.10.4-lp152.8.3.1 ebtables-debuginfo-2.0.10.4-lp152.8.3.1 ebtables-debugsource-2.0.10.4-lp152.8.3.1 References: https://bugzilla.suse.com/1182824

1 0

openSUSE-SU-2021:0670-1: important: Security update for openexr
by opensuse-security＠opensuse.org 05 May '21

05 May '21

openSUSE Security Update: Security update for openexr ______________________________________________________________________________ Announcement ID: openSUSE-SU-2021:0670-1 Rating: important References: #1184353 #1184354 #1184355 #1185216 #1185217 Cross-References: CVE-2021-20296 CVE-2021-23215 CVE-2021-26260 CVE-2021-3477 CVE-2021-3479 CVSS scores: CVE-2021-20296 (NVD) : 5.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L CVE-2021-20296 (SUSE): 5.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L CVE-2021-23215 (SUSE): 5.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L CVE-2021-26260 (SUSE): 5.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L CVE-2021-3477 (NVD) : 5.5 CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H CVE-2021-3477 (SUSE): 5.5 CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H CVE-2021-3479 (NVD) : 5.5 CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H CVE-2021-3479 (SUSE): 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H Affected Products: openSUSE Leap 15.2 ______________________________________________________________________________ An update that fixes 5 vulnerabilities is now available. Description: This update for openexr fixes the following issues: - CVE-2021-23215: Fixed an integer-overflow in Imf_2_5:DwaCompressor:initializeBuffers (bsc#1185216). - CVE-2021-26260: Fixed an Integer-overflow in Imf_2_5:DwaCompressor:initializeBuffers (bsc#1185217). - CVE-2021-20296: Fixed a Null Pointer dereference in Imf_2_5:hufUncompress (bsc#1184355). - CVE-2021-3477: Fixed a Heap-buffer-overflow in Imf_2_5::DeepTiledInputFile::readPixelSampleCounts (bsc#1184353). - CVE-2021-3479: Fixed an Out-of-memory caused by allocation of a very large buffer (bsc#1184354). This update was imported from the SUSE:SLE-15:Update update project. Patch Instructions: To install this openSUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 15.2: zypper in -t patch openSUSE-2021-670=1 Package List: - openSUSE Leap 15.2 (i586 x86_64): libIlmImf-2_2-23-2.2.1-lp152.7.14.1 libIlmImf-2_2-23-debuginfo-2.2.1-lp152.7.14.1 libIlmImfUtil-2_2-23-2.2.1-lp152.7.14.1 libIlmImfUtil-2_2-23-debuginfo-2.2.1-lp152.7.14.1 openexr-2.2.1-lp152.7.14.1 openexr-debuginfo-2.2.1-lp152.7.14.1 openexr-debugsource-2.2.1-lp152.7.14.1 openexr-devel-2.2.1-lp152.7.14.1 openexr-doc-2.2.1-lp152.7.14.1 - openSUSE Leap 15.2 (x86_64): libIlmImf-2_2-23-32bit-2.2.1-lp152.7.14.1 libIlmImf-2_2-23-32bit-debuginfo-2.2.1-lp152.7.14.1 libIlmImfUtil-2_2-23-32bit-2.2.1-lp152.7.14.1 libIlmImfUtil-2_2-23-32bit-debuginfo-2.2.1-lp152.7.14.1 References: https://www.suse.com/security/cve/CVE-2021-20296.html https://www.suse.com/security/cve/CVE-2021-23215.html https://www.suse.com/security/cve/CVE-2021-26260.html https://www.suse.com/security/cve/CVE-2021-3477.html https://www.suse.com/security/cve/CVE-2021-3479.html https://bugzilla.suse.com/1184353 https://bugzilla.suse.com/1184354 https://bugzilla.suse.com/1184355 https://bugzilla.suse.com/1185216 https://bugzilla.suse.com/1185217

1 0

openSUSE-SU-2021:0669-1: moderate: Security update for postsrsd
by opensuse-security＠opensuse.org 05 May '21

05 May '21

openSUSE Security Update: Security update for postsrsd ______________________________________________________________________________ Announcement ID: openSUSE-SU-2021:0669-1 Rating: moderate References: #1180251 Cross-References: CVE-2020-35573 Affected Products: openSUSE Backports SLE-15-SP2 ______________________________________________________________________________ An update that fixes one vulnerability is now available. Description: This update for postsrsd fixes the following issues: Update to release 1.11 [boo#1180251] * Drop group privileges as well as user privileges * Fixed: The subprocess that talks to Postfix could be caused to hang with a very long email address. [CVE-2020-35573] Update to release 1.6 * Fix endianness issue with SHA-1 implementation * Add dual stack support * Make SRS separator configurable This update was imported from the openSUSE:Leap:15.2:Update update project. Patch Instructions: To install this openSUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Backports SLE-15-SP2: zypper in -t patch openSUSE-2021-669=1 Package List: - openSUSE Backports SLE-15-SP2 (aarch64 ppc64le s390x x86_64): postsrsd-1.11-bp152.4.3.1 References: https://www.suse.com/security/cve/CVE-2020-35573.html https://bugzilla.suse.com/1180251

1 0

openSUSE-SU-2021:0668-1: important: Security update for bind
by opensuse-security＠opensuse.org 04 May '21

04 May '21

openSUSE Security Update: Security update for bind ______________________________________________________________________________ Announcement ID: openSUSE-SU-2021:0668-1 Rating: important References: #1183453 #1185345 Cross-References: CVE-2021-25214 CVE-2021-25215 CVSS scores: CVE-2021-25214 (SUSE): 6.5 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H CVE-2021-25215 (SUSE): 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H Affected Products: openSUSE Leap 15.2 ______________________________________________________________________________ An update that fixes two vulnerabilities is now available. Description: This update for bind fixes the following issues: - CVE-2021-25214: Fixed a broken inbound incremental zone update (IXFR) which could have caused named to terminate unexpectedly (bsc#1185345). - CVE-2021-25215: Fixed an assertion check which could have failed while answering queries for DNAME records that required the DNAME to be processed to resolve itself (bsc#1185345). - make /usr/bin/delv in bind-tools position independent (bsc#1183453). This update was imported from the SUSE:SLE-15:Update update project. Patch Instructions: To install this openSUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 15.2: zypper in -t patch openSUSE-2021-668=1 Package List: - openSUSE Leap 15.2 (i586 x86_64): bind-9.16.6-lp152.14.19.1 bind-chrootenv-9.16.6-lp152.14.19.1 bind-debuginfo-9.16.6-lp152.14.19.1 bind-debugsource-9.16.6-lp152.14.19.1 bind-devel-9.16.6-lp152.14.19.1 bind-utils-9.16.6-lp152.14.19.1 bind-utils-debuginfo-9.16.6-lp152.14.19.1 libbind9-1600-9.16.6-lp152.14.19.1 libbind9-1600-debuginfo-9.16.6-lp152.14.19.1 libdns1605-9.16.6-lp152.14.19.1 libdns1605-debuginfo-9.16.6-lp152.14.19.1 libirs-devel-9.16.6-lp152.14.19.1 libirs1601-9.16.6-lp152.14.19.1 libirs1601-debuginfo-9.16.6-lp152.14.19.1 libisc1606-9.16.6-lp152.14.19.1 libisc1606-debuginfo-9.16.6-lp152.14.19.1 libisccc1600-9.16.6-lp152.14.19.1 libisccc1600-debuginfo-9.16.6-lp152.14.19.1 libisccfg1600-9.16.6-lp152.14.19.1 libisccfg1600-debuginfo-9.16.6-lp152.14.19.1 libns1604-9.16.6-lp152.14.19.1 libns1604-debuginfo-9.16.6-lp152.14.19.1 - openSUSE Leap 15.2 (noarch): bind-doc-9.16.6-lp152.14.19.1 python3-bind-9.16.6-lp152.14.19.1 - openSUSE Leap 15.2 (x86_64): bind-devel-32bit-9.16.6-lp152.14.19.1 libbind9-1600-32bit-9.16.6-lp152.14.19.1 libbind9-1600-32bit-debuginfo-9.16.6-lp152.14.19.1 libdns1605-32bit-9.16.6-lp152.14.19.1 libdns1605-32bit-debuginfo-9.16.6-lp152.14.19.1 libirs1601-32bit-9.16.6-lp152.14.19.1 libirs1601-32bit-debuginfo-9.16.6-lp152.14.19.1 libisc1606-32bit-9.16.6-lp152.14.19.1 libisc1606-32bit-debuginfo-9.16.6-lp152.14.19.1 libisccc1600-32bit-9.16.6-lp152.14.19.1 libisccc1600-32bit-debuginfo-9.16.6-lp152.14.19.1 libisccfg1600-32bit-9.16.6-lp152.14.19.1 libisccfg1600-32bit-debuginfo-9.16.6-lp152.14.19.1 libns1604-32bit-9.16.6-lp152.14.19.1 libns1604-32bit-debuginfo-9.16.6-lp152.14.19.1 References: https://www.suse.com/security/cve/CVE-2021-25214.html https://www.suse.com/security/cve/CVE-2021-25215.html https://bugzilla.suse.com/1183453 https://bugzilla.suse.com/1185345

1 0

openSUSE-SU-2021:0664-1: important: Security update for gsoap
by opensuse-security＠opensuse.org 04 May '21

04 May '21

openSUSE Security Update: Security update for gsoap ______________________________________________________________________________ Announcement ID: openSUSE-SU-2021:0664-1 Rating: important References: #1182098 Cross-References: CVE-2020-13576 CVSS scores: CVE-2020-13576 (NVD) : 9.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H Affected Products: openSUSE Backports SLE-15-SP2 ______________________________________________________________________________ An update that fixes one vulnerability is now available. Description: This update for gsoap fixes the following issues: - CVE-2020-13576: Fixed a remote code execution via specially crafted SOAP request inside the WS-Addressing plugin (boo#1182098) This update was imported from the openSUSE:Leap:15.2:Update update project. Patch Instructions: To install this openSUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Backports SLE-15-SP2: zypper in -t patch openSUSE-2021-664=1 Package List: - openSUSE Backports SLE-15-SP2 (aarch64 ppc64le s390x x86_64): gsoap-devel-2.8.102-bp152.2.4.1 libgsoap-2_8_102-2.8.102-bp152.2.4.1 - openSUSE Backports SLE-15-SP2 (noarch): gsoap-doc-2.8.102-bp152.2.4.1 References: https://www.suse.com/security/cve/CVE-2020-13576.html https://bugzilla.suse.com/1182098

1 0

openSUSE-RU-2021:0667-1: moderate: Recommended update for librepo
by maintenance＠opensuse.org 04 May '21

04 May '21

openSUSE Recommended Update: Recommended update for librepo ______________________________________________________________________________ Announcement ID: openSUSE-RU-2021:0667-1 Rating: moderate References: Affected Products: openSUSE Backports SLE-15-SP2 ______________________________________________________________________________ An update that has 0 recommended fixes can now be installed. Description: This update for librepo fixes the following issues: - Updated librepo to version 1.13.0 * Dropped support for python2 * Fixed a memory leak * Support was added for pkcs11 certificate and key for repository authorization * Fixed a bug where the cpu consumption went up to 100% * Added support when working with certificates used in combination with a proxy This update was imported from the SUSE:SLE-15-SP2:Update update project. This update was imported from the openSUSE:Leap:15.2:Update update project. Patch Instructions: To install this openSUSE Recommended Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Backports SLE-15-SP2: zypper in -t patch openSUSE-2021-667=1 Package List: - openSUSE Backports SLE-15-SP2 (aarch64 ppc64le s390x x86_64): librepo-devel-1.13.0-bp152.2.9.1 librepo0-1.13.0-bp152.2.9.1 python3-librepo-1.13.0-bp152.2.9.1 References:

1 0

openSUSE-RU-2021:0663-1: moderate: Recommended update for scap-security-guide
by maintenance＠opensuse.org 03 May '21

03 May '21

openSUSE Recommended Update: Recommended update for scap-security-guide ______________________________________________________________________________ Announcement ID: openSUSE-RU-2021:0663-1 Rating: moderate References: Affected Products: openSUSE Leap 15.2 ______________________________________________________________________________ An update that has 0 recommended fixes can now be installed. Description: This update for scap-security-guide fixes the following issues: This update ships the ComplianceAsCode build version 0.1.55+git containing the following supported file: - SCAP STIG automation for SUSE Linux Enterprise 12 (SUSE supplied, more rules added compared to 0.1.54) - SCAP STIG automation for SUSE Linux Enterprise 15 (SUSE supplied, new, first rules added) - CIS automation for SUSE Linux Enterprise 15 (community supplied) It can be evaluated using "oscap" from "openscap-utils", e.g. by doing on SUSE Linux Enterprise 12: - oscap xccdf eval --profile stig /usr/share/xml/scap/ssg/content/ssg-sle12-ds.xml On SUSE Linux Enterprise 15: - oscap xccdf eval --profile stig /usr/share/xml/scap/ssg/content/ssg-sle15-ds.xml or the community supplied CIS on SUSE Linux Enterprise 15: - oscap xccdf eval --profile cis /usr/share/xml/scap/ssg/content/ssg-sle15-ds.xml More content will be added in future updates. This update was imported from the SUSE:SLE-15:Update update project. Patch Instructions: To install this openSUSE Recommended Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 15.2: zypper in -t patch openSUSE-2021-663=1 Package List: - openSUSE Leap 15.2 (noarch): scap-security-guide-0.1.55git20210323-lp152.8.1 scap-security-guide-debian-0.1.55git20210323-lp152.8.1 scap-security-guide-redhat-0.1.55git20210323-lp152.8.1 scap-security-guide-ubuntu-0.1.55git20210323-lp152.8.1 References:

1 0

openSUSE-RU-2021:0661-1: moderate: Recommended update for dhcp
by maintenance＠opensuse.org 03 May '21

03 May '21

openSUSE Recommended Update: Recommended update for dhcp ______________________________________________________________________________ Announcement ID: openSUSE-RU-2021:0661-1 Rating: moderate References: #1185157 Affected Products: openSUSE Leap 15.2 ______________________________________________________________________________ An update that has one recommended fix can now be installed. Description: This update for dhcp fixes the following issues: - Use '/run' instead of '/var/run' for PIDFile in 'dhcrelay.service'. (bsc#1185157) This update was imported from the SUSE:SLE-15:Update update project. Patch Instructions: To install this openSUSE Recommended Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 15.2: zypper in -t patch openSUSE-2021-661=1 Package List: - openSUSE Leap 15.2 (i586 x86_64): dhcp-4.3.5-lp152.8.3.1 dhcp-client-4.3.5-lp152.8.3.1 dhcp-client-debuginfo-4.3.5-lp152.8.3.1 dhcp-debuginfo-4.3.5-lp152.8.3.1 dhcp-debugsource-4.3.5-lp152.8.3.1 dhcp-devel-4.3.5-lp152.8.3.1 dhcp-doc-4.3.5-lp152.8.3.1 dhcp-relay-4.3.5-lp152.8.3.1 dhcp-relay-debuginfo-4.3.5-lp152.8.3.1 dhcp-server-4.3.5-lp152.8.3.1 dhcp-server-debuginfo-4.3.5-lp152.8.3.1 References: https://bugzilla.suse.com/1185157

1 0

openSUSE-RU-2021:0662-1: moderate: Recommended update for pidentd
by maintenance＠opensuse.org 03 May '21

03 May '21

openSUSE Recommended Update: Recommended update for pidentd ______________________________________________________________________________ Announcement ID: openSUSE-RU-2021:0662-1 Rating: moderate References: #1185070 Affected Products: openSUSE Leap 15.2 ______________________________________________________________________________ An update that has one recommended fix can now be installed. Description: This update for pidentd fixes the following issues: - Use '/run' instead of '/var/run'. (bsc#1185070) This update was imported from the SUSE:SLE-15:Update update project. Patch Instructions: To install this openSUSE Recommended Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 15.2: zypper in -t patch openSUSE-2021-662=1 Package List: - openSUSE Leap 15.2 (x86_64): pidentd-3.0.19-lp152.6.3.1 pidentd-debuginfo-3.0.19-lp152.6.3.1 pidentd-debugsource-3.0.19-lp152.6.3.1 References: https://bugzilla.suse.com/1185070

1 0

openSUSE-RU-2021:0660-1: moderate: Recommended update for libsolv
by maintenance＠opensuse.org 02 May '21

02 May '21

openSUSE Recommended Update: Recommended update for libsolv ______________________________________________________________________________ Announcement ID: openSUSE-RU-2021:0660-1 Rating: moderate References: Affected Products: openSUSE Leap 15.2 ______________________________________________________________________________ An update that has 0 recommended fixes can now be installed. Description: This update for libsolv fixes the following issues: - Fix rare segfault in resolve_jobrules() that could happen if new rules are learnt. - Fix a couple of memory leaks in error cases. - Fix error handling in solv_xfopen_fd() - Fixed 'regex' code on win32. - Fixed memory leak in choice rule generation This update was imported from the SUSE:SLE-15-SP2:Update update project. Patch Instructions: To install this openSUSE Recommended Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 15.2: zypper in -t patch openSUSE-2021-660=1 Package List: - openSUSE Leap 15.2 (i586 x86_64): libsolv-debuginfo-0.7.19-lp152.2.19.1 libsolv-debugsource-0.7.19-lp152.2.19.1 libsolv-demo-0.7.19-lp152.2.19.1 libsolv-demo-debuginfo-0.7.19-lp152.2.19.1 libsolv-devel-0.7.19-lp152.2.19.1 libsolv-devel-debuginfo-0.7.19-lp152.2.19.1 libsolv-tools-0.7.19-lp152.2.19.1 libsolv-tools-debuginfo-0.7.19-lp152.2.19.1 libzypp-17.25.8-lp152.2.25.1 libzypp-debuginfo-17.25.8-lp152.2.25.1 libzypp-debugsource-17.25.8-lp152.2.25.1 libzypp-devel-17.25.8-lp152.2.25.1 libzypp-devel-doc-17.25.8-lp152.2.25.1 perl-solv-0.7.19-lp152.2.19.1 perl-solv-debuginfo-0.7.19-lp152.2.19.1 python-solv-0.7.19-lp152.2.19.1 python-solv-debuginfo-0.7.19-lp152.2.19.1 python3-solv-0.7.19-lp152.2.19.1 python3-solv-debuginfo-0.7.19-lp152.2.19.1 ruby-solv-0.7.19-lp152.2.19.1 ruby-solv-debuginfo-0.7.19-lp152.2.19.1 References:

1 0

openSUSE-OU-2021:0659-1: Optional update for tcpdump
by maintenance＠opensuse.org 02 May '21

02 May '21

openSUSE Optional Update: Optional update for tcpdump ______________________________________________________________________________ Announcement ID: openSUSE-OU-2021:0659-1 Rating: low References: #1183800 Affected Products: openSUSE Leap 15.2 ______________________________________________________________________________ An update that has one optional fix can now be installed. Description: This update for tcpdump fixes the following issues: - Disabled five regression tests that fail with libpcap > 1.8.1 (bsc#1183800) This patch does not fix any user visible issues and is therefore optional to install. This update was imported from the SUSE:SLE-15:Update update project. Patch Instructions: To install this openSUSE Optional Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 15.2: zypper in -t patch openSUSE-2021-659=1 Package List: - openSUSE Leap 15.2 (x86_64): tcpdump-4.9.2-lp152.7.6.1 tcpdump-debuginfo-4.9.2-lp152.7.6.1 tcpdump-debugsource-4.9.2-lp152.7.6.1 References: https://bugzilla.suse.com/1183800

1 0

openSUSE-RU-2021:0655-1: moderate: Recommended update for openslp
by maintenance＠opensuse.org 02 May '21

02 May '21

openSUSE Recommended Update: Recommended update for openslp ______________________________________________________________________________ Announcement ID: openSUSE-RU-2021:0655-1 Rating: moderate References: #1166637 #1184008 Affected Products: openSUSE Leap 15.2 ______________________________________________________________________________ An update that has two recommended fixes can now be installed. Description: This update for openslp fixes the following issues: - Added automated active discovery retries so that DAs do not get dropped, if they are not reachable for some time (bsc#1166637, bsc#1184008) This update was imported from the SUSE:SLE-15:Update update project. Patch Instructions: To install this openSUSE Recommended Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 15.2: zypper in -t patch openSUSE-2021-655=1 Package List: - openSUSE Leap 15.2 (i586 x86_64): openslp-2.0.0-lp152.11.3.1 openslp-debuginfo-2.0.0-lp152.11.3.1 openslp-debugsource-2.0.0-lp152.11.3.1 openslp-devel-2.0.0-lp152.11.3.1 openslp-server-2.0.0-lp152.11.3.1 openslp-server-debuginfo-2.0.0-lp152.11.3.1 - openSUSE Leap 15.2 (x86_64): openslp-32bit-2.0.0-lp152.11.3.1 openslp-32bit-debuginfo-2.0.0-lp152.11.3.1 References: https://bugzilla.suse.com/1166637 https://bugzilla.suse.com/1184008

1 0

openSUSE-RU-2021:0658-1: moderate: Recommended update for ntp
by maintenance＠opensuse.org 02 May '21

02 May '21

openSUSE Recommended Update: Recommended update for ntp ______________________________________________________________________________ Announcement ID: openSUSE-RU-2021:0658-1 Rating: moderate References: #1185171 Affected Products: openSUSE Leap 15.2 ______________________________________________________________________________ An update that has one recommended fix can now be installed. Description: This update for ntp fixes the following issues: - Use '/run' instead of '/var/run' for PIDFile in 'ntpd.service'. (bsc#1185171) This update was imported from the SUSE:SLE-15:Update update project. Patch Instructions: To install this openSUSE Recommended Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 15.2: zypper in -t patch openSUSE-2021-658=1 Package List: - openSUSE Leap 15.2 (i586 x86_64): ntp-4.2.8p15-lp152.3.6.1 ntp-debuginfo-4.2.8p15-lp152.3.6.1 ntp-debugsource-4.2.8p15-lp152.3.6.1 ntp-doc-4.2.8p15-lp152.3.6.1 References: https://bugzilla.suse.com/1185171

1 0

openSUSE-RU-2021:0656-1: moderate: Recommended update for dracut
by maintenance＠opensuse.org 02 May '21

02 May '21

openSUSE Recommended Update: Recommended update for dracut ______________________________________________________________________________ Announcement ID: openSUSE-RU-2021:0656-1 Rating: moderate References: #1178219 Affected Products: openSUSE Leap 15.2 ______________________________________________________________________________ An update that has one recommended fix can now be installed. Description: This update for dracut fixes the following issues: - Fix for adding timeout to umount calls. (bsc#1178219) This update was imported from the SUSE:SLE-15-SP2:Update update project. Patch Instructions: To install this openSUSE Recommended Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 15.2: zypper in -t patch openSUSE-2021-656=1 Package List: - openSUSE Leap 15.2 (i586 x86_64): dracut-049.1+suse.187.g63c1504f-lp152.2.24.1 dracut-debuginfo-049.1+suse.187.g63c1504f-lp152.2.24.1 dracut-debugsource-049.1+suse.187.g63c1504f-lp152.2.24.1 dracut-extra-049.1+suse.187.g63c1504f-lp152.2.24.1 dracut-fips-049.1+suse.187.g63c1504f-lp152.2.24.1 dracut-ima-049.1+suse.187.g63c1504f-lp152.2.24.1 dracut-tools-049.1+suse.187.g63c1504f-lp152.2.24.1 References: https://bugzilla.suse.com/1178219

1 0

openSUSE-RU-2021:0653-1: Recommended update for kyotocabinet
by maintenance＠opensuse.org 02 May '21

02 May '21

openSUSE Recommended Update: Recommended update for kyotocabinet ______________________________________________________________________________ Announcement ID: openSUSE-RU-2021:0653-1 Rating: low References: #1185033 Affected Products: openSUSE Leap 15.2 ______________________________________________________________________________ An update that has one recommended fix can now be installed. Description: This update for kyotocabinet fixes the following issues: - Proactive fix for a hardening making 'kyotokabinet' in SLE as position independent executable. (bsc#1185033) This update was imported from the SUSE:SLE-15:Update update project. Patch Instructions: To install this openSUSE Recommended Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 15.2: zypper in -t patch openSUSE-2021-653=1 Package List: - openSUSE Leap 15.2 (i586 x86_64): kyotocabinet-1.2.77-lp152.5.3.1 kyotocabinet-debuginfo-1.2.77-lp152.5.3.1 kyotocabinet-debugsource-1.2.77-lp152.5.3.1 libkyotocabinet-devel-1.2.77-lp152.5.3.1 libkyotocabinet16-1.2.77-lp152.5.3.1 libkyotocabinet16-debuginfo-1.2.77-lp152.5.3.1 - openSUSE Leap 15.2 (x86_64): libkyotocabinet16-32bit-1.2.77-lp152.5.3.1 libkyotocabinet16-32bit-debuginfo-1.2.77-lp152.5.3.1 References: https://bugzilla.suse.com/1185033

1 0

openSUSE-RU-2021:0654-1: moderate: Recommended update for nvme-cli
by maintenance＠opensuse.org 02 May '21

02 May '21

openSUSE Recommended Update: Recommended update for nvme-cli ______________________________________________________________________________ Announcement ID: openSUSE-RU-2021:0654-1 Rating: moderate References: #1180505 #1182591 Affected Products: openSUSE Leap 15.2 ______________________________________________________________________________ An update that has two recommended fixes can now be installed. Description: This update for nvme-cli fixes the following issues: - Use default port 8009 for NVMeoF discovery (bsc#1180505) - Added missing huck from previous backport (bsc#1182591) This update was imported from the SUSE:SLE-15-SP2:Update update project. Patch Instructions: To install this openSUSE Recommended Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 15.2: zypper in -t patch openSUSE-2021-654=1 Package List: - openSUSE Leap 15.2 (x86_64): nvme-cli-1.10-lp152.2.9.1 nvme-cli-debuginfo-1.10-lp152.2.9.1 nvme-cli-debugsource-1.10-lp152.2.9.1 nvme-cli-regress-script-1.10-lp152.2.9.1 References: https://bugzilla.suse.com/1180505 https://bugzilla.suse.com/1182591

1 0

openSUSE-RU-2021:0657-1: moderate: Recommended update for yast2-samba-client
by maintenance＠opensuse.org 02 May '21

02 May '21

openSUSE Recommended Update: Recommended update for yast2-samba-client ______________________________________________________________________________ Announcement ID: openSUSE-RU-2021:0657-1 Rating: moderate References: #1181595 Affected Products: openSUSE Leap 15.2 ______________________________________________________________________________ An update that has one recommended fix can now be installed. Description: This update for yast2-samba-client fixes the following issues: - Fix joining a domain when running a clustered Samba environment. (bsc#1181595) This update was imported from the SUSE:SLE-15-SP2:Update update project. Patch Instructions: To install this openSUSE Recommended Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 15.2: zypper in -t patch openSUSE-2021-657=1 Package List: - openSUSE Leap 15.2 (noarch): yast2-samba-client-4.2.4-lp152.2.3.1 References: https://bugzilla.suse.com/1181595

1 0

openSUSE-RU-2021:0652-1: moderate: Recommended update for nautilus
by maintenance＠opensuse.org 02 May '21

02 May '21

openSUSE Recommended Update: Recommended update for nautilus ______________________________________________________________________________ Announcement ID: openSUSE-RU-2021:0652-1 Rating: moderate References: #1171506 #1185026 Affected Products: openSUSE Leap 15.2 ______________________________________________________________________________ An update that has two recommended fixes can now be installed. Description: This update for nautilus fixes the following issues: - Use the right value in gio command. (bsc#1185026) - Update to version 3.34.3 (bsc#1171506): + Revert icon emblem fixes in order to prevent performance issues. + Fix crashes often happening when searching. + Fix crashes after conflict dialog response. This update was imported from the SUSE:SLE-15-SP2:Update update project. Patch Instructions: To install this openSUSE Recommended Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 15.2: zypper in -t patch openSUSE-2021-652=1 Package List: - openSUSE Leap 15.2 (x86_64): gnome-shell-search-provider-nautilus-3.34.3-lp152.3.3.1 libnautilus-extension1-3.34.3-lp152.3.3.1 libnautilus-extension1-debuginfo-3.34.3-lp152.3.3.1 nautilus-3.34.3-lp152.3.3.1 nautilus-debuginfo-3.34.3-lp152.3.3.1 nautilus-debugsource-3.34.3-lp152.3.3.1 nautilus-devel-3.34.3-lp152.3.3.1 typelib-1_0-Nautilus-3_0-3.34.3-lp152.3.3.1 - openSUSE Leap 15.2 (noarch): nautilus-lang-3.34.3-lp152.3.3.1 References: https://bugzilla.suse.com/1171506 https://bugzilla.suse.com/1185026

1 0

openSUSE-RU-2021:0651-1: moderate: Recommended update for pulseaudio
by maintenance＠opensuse.org 02 May '21

02 May '21

openSUSE Recommended Update: Recommended update for pulseaudio ______________________________________________________________________________ Announcement ID: openSUSE-RU-2021:0651-1 Rating: moderate References: #1183546 Affected Products: openSUSE Leap 15.2 ______________________________________________________________________________ An update that has one recommended fix can now be installed. Description: This update for pulseaudio fixes the following issues: - Fixed "Failed to open audio file" error for FLAC and OGG (bsc#1183546) This update was imported from the SUSE:SLE-15-SP2:Update update project. Patch Instructions: To install this openSUSE Recommended Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 15.2: zypper in -t patch openSUSE-2021-651=1 Package List: - openSUSE Leap 15.2 (i586 x86_64): libpulse-devel-13.0-lp152.3.3.1 libpulse-mainloop-glib0-13.0-lp152.3.3.1 libpulse-mainloop-glib0-debuginfo-13.0-lp152.3.3.1 libpulse0-13.0-lp152.3.3.1 libpulse0-debuginfo-13.0-lp152.3.3.1 pulseaudio-13.0-lp152.3.3.1 pulseaudio-bash-completion-13.0-lp152.3.3.1 pulseaudio-debuginfo-13.0-lp152.3.3.1 pulseaudio-debugsource-13.0-lp152.3.3.1 pulseaudio-esound-compat-13.0-lp152.3.3.1 pulseaudio-gdm-hooks-13.0-lp152.3.3.1 pulseaudio-module-bluetooth-13.0-lp152.3.3.1 pulseaudio-module-bluetooth-debuginfo-13.0-lp152.3.3.1 pulseaudio-module-gconf-13.0-lp152.3.3.1 pulseaudio-module-gconf-debuginfo-13.0-lp152.3.3.1 pulseaudio-module-gsettings-13.0-lp152.3.3.1 pulseaudio-module-gsettings-debuginfo-13.0-lp152.3.3.1 pulseaudio-module-jack-13.0-lp152.3.3.1 pulseaudio-module-jack-debuginfo-13.0-lp152.3.3.1 pulseaudio-module-lirc-13.0-lp152.3.3.1 pulseaudio-module-lirc-debuginfo-13.0-lp152.3.3.1 pulseaudio-module-x11-13.0-lp152.3.3.1 pulseaudio-module-x11-debuginfo-13.0-lp152.3.3.1 pulseaudio-module-zeroconf-13.0-lp152.3.3.1 pulseaudio-module-zeroconf-debuginfo-13.0-lp152.3.3.1 pulseaudio-system-wide-13.0-lp152.3.3.1 pulseaudio-utils-13.0-lp152.3.3.1 pulseaudio-utils-debuginfo-13.0-lp152.3.3.1 pulseaudio-zsh-completion-13.0-lp152.3.3.1 - openSUSE Leap 15.2 (x86_64): libpulse-devel-32bit-13.0-lp152.3.3.1 libpulse-mainloop-glib0-32bit-13.0-lp152.3.3.1 libpulse-mainloop-glib0-32bit-debuginfo-13.0-lp152.3.3.1 libpulse0-32bit-13.0-lp152.3.3.1 libpulse0-32bit-debuginfo-13.0-lp152.3.3.1 pulseaudio-utils-32bit-13.0-lp152.3.3.1 pulseaudio-utils-32bit-debuginfo-13.0-lp152.3.3.1 - openSUSE Leap 15.2 (noarch): pulseaudio-lang-13.0-lp152.3.3.1 References: https://bugzilla.suse.com/1183546

1 0

openSUSE-SU-2021:0650-1: Security update for giflib
by opensuse-security＠opensuse.org 02 May '21

02 May '21

openSUSE Security Update: Security update for giflib ______________________________________________________________________________ Announcement ID: openSUSE-SU-2021:0650-1 Rating: low References: #1184123 Affected Products: openSUSE Leap 15.2 ______________________________________________________________________________ An update that contains security fixes can now be installed. Description: This update for giflib fixes the following issues: - Enable Position Independent Code and inherit CFLAGS from the build system (bsc#1184123). This update was imported from the SUSE:SLE-15:Update update project. Patch Instructions: To install this openSUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 15.2: zypper in -t patch openSUSE-2021-650=1 Package List: - openSUSE Leap 15.2 (i586 x86_64): giflib-debugsource-5.1.4-lp152.5.3.1 giflib-devel-5.1.4-lp152.5.3.1 giflib-progs-5.1.4-lp152.5.3.1 giflib-progs-debuginfo-5.1.4-lp152.5.3.1 libgif7-5.1.4-lp152.5.3.1 libgif7-debuginfo-5.1.4-lp152.5.3.1 - openSUSE Leap 15.2 (x86_64): giflib-devel-32bit-5.1.4-lp152.5.3.1 libgif7-32bit-5.1.4-lp152.5.3.1 libgif7-32bit-debuginfo-5.1.4-lp152.5.3.1 References: https://bugzilla.suse.com/1184123

1 0

openSUSE-RU-2021:0648-1: moderate: Recommended update for gnome-session
by maintenance＠opensuse.org 01 May '21

01 May '21

openSUSE Recommended Update: Recommended update for gnome-session ______________________________________________________________________________ Announcement ID: openSUSE-RU-2021:0648-1 Rating: moderate References: #1175622 Affected Products: openSUSE Leap 15.2 ______________________________________________________________________________ An update that has one recommended fix can now be installed. Description: This update for gnome-session fixes the following issues: - Fix for an issue when VNC fails after upgrade from 15 SP1 to SP2. (bsc#1175622, glgo!GNOME/gnome-session!60) This update was imported from the SUSE:SLE-15-SP2:Update update project. Patch Instructions: To install this openSUSE Recommended Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 15.2: zypper in -t patch openSUSE-2021-648=1 Package List: - openSUSE Leap 15.2 (noarch): gnome-session-lang-3.34.2-lp152.5.3.1 - openSUSE Leap 15.2 (x86_64): gnome-session-3.34.2-lp152.5.3.1 gnome-session-core-3.34.2-lp152.5.3.1 gnome-session-core-debuginfo-3.34.2-lp152.5.3.1 gnome-session-debugsource-3.34.2-lp152.5.3.1 gnome-session-default-session-3.34.2-lp152.5.3.1 gnome-session-wayland-3.34.2-lp152.5.3.1 References: https://bugzilla.suse.com/1175622

1 0

openSUSE-RU-2021:0649-1: moderate: Recommended update for brp-check-suse
by maintenance＠opensuse.org 01 May '21

01 May '21

openSUSE Recommended Update: Recommended update for brp-check-suse ______________________________________________________________________________ Announcement ID: openSUSE-RU-2021:0649-1 Rating: moderate References: #1184555 Affected Products: openSUSE Leap 15.2 ______________________________________________________________________________ An update that has one recommended fix can now be installed. Description: This update for brp-check-suse fixes the following issues: - Add patch to implement fipscheck. (bsc#1184555) This update was imported from the SUSE:SLE-15:Update update project. Patch Instructions: To install this openSUSE Recommended Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 15.2: zypper in -t patch openSUSE-2021-649=1 Package List: - openSUSE Leap 15.2 (i586 x86_64): brp-check-suse-84.87+git20181106.224b37d-lp152.2.6.1 References: https://bugzilla.suse.com/1184555

1 0

openSUSE-SU-2021:0647-1: moderate: Security update for netdata
by opensuse-security＠opensuse.org 01 May '21

01 May '21

openSUSE Security Update: Security update for netdata ______________________________________________________________________________ Announcement ID: openSUSE-SU-2021:0647-1 Rating: moderate References: #1139094 #1139095 #1139098 Cross-References: CVE-2018-18836 CVE-2018-18837 CVE-2018-18838 CVE-2018-18839 CVSS scores: CVE-2018-18836 (NVD) : 6.5 CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N CVE-2018-18837 (NVD) : 6.1 CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N CVE-2018-18838 (NVD) : 7.5 CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N CVE-2018-18839 (NVD) : 5.3 CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N Affected Products: openSUSE Leap 15.2 ______________________________________________________________________________ An update that fixes four vulnerabilities is now available. Description: This update for netdata fixes the following issues: - Update to 1.29.3 Release v1.29.3 is a patch release to improve the stability of the Netdata Agent. We discovered a bug that when proc.plugin attempts to collect the operstate parameter for a virtual network interface. If the chart is obsoleted, the Netdata Agent crashes. This release also contains additional bug fixes and improvements. Bug fixes * Fix proc.plugin to invalidate RRDSETVAR pointers on obsoletion. - Update to 1.29.2 Release v1.29.2 is a patch release to improve the stability of the Netdata Agent. We discovered that an improvement introduced in v1.29.0 could inadvertently set all os_* host labels to unknown, which could affect users who leverage these host labels to organize their nodes, deploy health entities, or export metrics to external time-series databases. This bug has been fixed. This release also contains additional bug fixes and improvements. Improvements * Make the Opsgenie API URL configurable. * Add k8s_cluster_id host label. * Enable apps.plugin aggregation debug messages. * Add configuration parameter to disable stock alarms. * Add ACLK proxy setting as host label. * Add freeswitch to apps_groups.conf. * Simplify thread creation and remove unnecessary variables in the eBPF plugin. Bug fixes * Fix the context filtering on the data query endpoint. * Fix container/host detection in the system-info.sh script. * Add a small delay to the ipv4_tcp_resets alarms. * Fix collecting operstate for virtual network interfaces. * Fix sendmail unrecognized option F error. * Fix so that raw binary data should never be printed. * Change KSM memory chart type to stacked. * Allow the REMOVED alarm status via ACLK if the previous status was WARN/CRIT. * Reduce excessive logging in the ACLK. - Changes in 1.29.1 Release v1.29.1 is a hotfix release to address a crash in the Netdata Agent. A locking bug in one of the internal collectors in Netdata could cause it to crash during shutdown in a way that would result in the Netdata Agent taking an excessively long time to exit. Bug fixes * Fix crash during shutdown of cgroups internal plugin. - Update to 1.29.0 (go.d.plugin 0.27.0) The v1.29.0 release of the Netdata Agent is a maintenance release that brings incremental but necessary improvements that make your monitoring experience more robust. We've pushed improvements and bug fixes to the installation and update scripts, enriched our library of collectors, and focused on fixing bugs reported by the community. At a glance Netdata now collects and meaningfully organizes metrics from both the Couchbase JSON document database and the nginx-module-vts module for exposing metrics about NGINX virtual hosts. We've also migrated more collectors from Python to Go in our continued efforts to make data collection faster and more robust. The newest effort includes our Redis, Pika, and Energi Core Wallet collectors. On the dashboard, we improved the responsiveness of panning forward and backward through historical metrics data by preventing unnecessary updates and reducing the number of calls. The charts should also now immediately update when you stop panning. Improvements * Reduce the number of alarm updates on ACLK. * Remove unused entries from structures. * Improve the retry/backoff during claiming. * Support multiple chart label keys in data queries. * Truncate excessive information from titles for apps and cgroups collectors. * Use mguid instead of hostname in the ACLK collector list. * Cleanup and minor fixes to eBPF collector. * Add _is_k8s_node label to the host labels. * Move ACLK into a legacy subfolder. * Exclude autofs by default in the diskspace plugin. * Mark internal functions as static in health code. * Remove unused struct in health code. * Add support for per series styling for dygraphs. Dashboard * Fix minor vulnerability alert by updating socket-io dependency. * Fix dygraph panning responsiveness, chart heights and performance improvements. * Make legend position configurable. Collectors * Add Go version of the redis collector. * Add Go version of the pika collector. * Add Go version of the energis collector. * Add a new nginxvts collector. * Add a new couchbase collector. * Add Traefik v2 to the prometheus collector default configuration. * Add an expected_prefix configuration option to the prometheus collector. * Add patterns support to the filecheck collector. Bug fixes * Fix container detection from systemd-detect-virt. * Fix handling of TLS config so that cURL works in all cases. * Fix disconnect message sent via ACLK on agent shutdown * Fix prometheus remote write header * Fix values in Prometheus export for metrics, collected by the Prometheus collector * Fix handling spaces in labels values in the Prometheus collector * Fix mysql.slave_status alarm for go mysql collector * Make mdstat_mismatch_cnt alarm less strict * Dispatch cgroup discovery into another thread * Fix data source option for Prometheus web API in exporting configuration * Fix anomalies collector custom model bug * Fix broken dbengine stress tests. * Fix segmentation fault in the agent * Fix memory allocation when computing standard deviation * Fix temperature parsing in the hddtemp collector * Fix postgres password bug and change default config * Add handling "yes" and "no" and flexible space match in the python.d/fail2ban plugin * Fix spelling mistakes in the Python plugin and documentation. - Update to v1.28 Release v1.28.0 is a hotfix release to address a deadlock in the Netdata Agent. If the Agent-Cloud link (ACLK) connection drops and the Agent fails to queue an on_connect message, it also fails to properly release a lock in the web server thread. - Enable additional dependencies (gprc, json, libcurl, libelf, libwebsockets, protobuf, snappy, xenstat, yajl) - Update to v1.27.0 (go.d.plugin 0.26.2) The v1.27.0 release of the Netdata Agent brings dramatic improvements to long-term metrics storage via the database engine, and new dashboard features like a time & date picker for visualizing precise timeframes. Two new collectors bring incredible new value to existing features, including a bit of machine learning magic. This release contains 8 new collectors, 1 new notification method (2 others enhanced), 54 improvements, 41 documentation updates, and 58 bug fixes. Improvements * Add labels for Kubernetes pods and containers. * Add plugin and module health entities. * Migrate the metadata log to SQLite. * Add an extent cache to the database engine. * Added new data query option allow_past. Netdata Cloud * Add the ability to query child nodes by their GUID. * Add child availability messages to the ACLK. * Add a metric showing how long a query spent in the queue. * Completely hide the SSO iframe. Collectors * Add alarms obsoletion and disable alarms collector by default. * Add calls for tcp_sendmsg, tcp_retransmit_skb, tcp_cleanup_rcv, udp_sendmsg, udp_recvmsg functions charts to the eBPF collector. * Add two more insignificant warnings to suppress in anomalies collector. * Add the number of allocated/stored objects within each storage to the varnish collector. * Add a wireless statistics collector. * Add support for MSE (Massive Storage Engine) to the varnish collector. * Remove remove crit from unmatched alarms in the web_log collector. * Add GPU key metrics (nvidia_smi collector) to dashboard_info.js. * Add allocated space metrics to the oracledb collector. * Restructure the eBPF collector to improve usability. * Add an anomaly detection collector. * Add a Netdata alarms collector. * Add a configuration option to exclude users with zero memory allocated to the nvidia_smi collector. * Add per queue charts to the rabbitmq collector. * Add support for HBA drives to the hpssa collector. * Update the cgroups collector default filtering by adding pod level cgroups. * Add a Go version of the CouchDB collector (couchdb). * Add collecting HTTP method per URL pattern (url_pattern option) to the web_log collector. * Add custom time fields feature to the web_log collector. * Add a Go version of the PowerDNS Authoritative Nameserver collector (powerdns). * Add a Go version of the PowerDNS Recursor collector (powerdns_recursor). * Add a Go version of the PowerDNS DNSdist collector (dnsdist). * Add a Dnsmasq DNS Forwarder collector (dnsmasq). * Add collecting directories size to the filecheck collector. * Add old systemd versions support to the systemdunits collector. * Add unmatched lines logging to the web_log collector. Notifications * Add API V2 support to the PagerDuty health integration. * Add threads support to the Google Hangouts health integration. * Add a Opsgenie health integration. Exporting * Add HTTP and HTTPS support to the simple exporting connector. Packaging/installation * Update React dashboard v2.11. * Update go.d.plugin version to v0.26.2. * Update eBPF collector to 0.4.9. * Add ability to use system libwebsockets instead of bundled version. * Update the version of libJudy that we bundle to 1.0.5-netdata2. Bug fixes * Fix crash in the eBPF plugin by initializing variables. * Fix sending chart definition on every data collection in alarms collector. * Fix a lock check. * Fix issue with chart metadata sent multiple times over ACLK. * Fix a buffer overflow when extracting information from a streaming connection. * Fix hostname configuration in the exporting engine. * Fix units and data source exporting options. * Fix exporting config. * Fix health by disabling used_file_descriptors alarm. * Fix GPU data filtering in the nvidia_smi collector. * Fix username resolution in the nvidia_smi collector. * Fix compilation with HTTPS disabled. * Fix hostname when syslog is used in syslog health integration. * Fix streaming buffer size. * Fix database endless loop when cleaning obsolete charts. * Disable chart obsoletion code for archived chart creation. * Fix Prometheus remote write exporter so that it doesn't stop when data is not available for dimension formatting. * Fix memory calculation by moving shared from cached to used dimension. * Fix parsing in the libreswan collector. * Fix an infinite loop in the statsd plugin * Disregard host tags configuration pointer. * Fix platform dependent printf format. * Fix cgroups collector resolving container names in k8s. * Fix python.d plugin runtime chart creation. * Fix race condition in rrdset_first_entry_t() and rrdset_last_entry_t(). * Fix the data endpoint so that the context param is correctly applied to children. * Fix Coverity errors (CID 364045,364046). * Fix the elasticsearch_last_collected alarm. * Fix spelling error in xenstat.plugin. * Fix chart filtering. * Fix libnetdata headers to be compatible with C++. * Fix registry responses to remove caching. * Fix eBPF memory management. * Fix overlapping memory issue. * Fix response and upstream response time histogram charts in the web_log collector. * Fix logs timestamps always in UTC issue in the go.d.plugin * Fix collecting slave status for MariaDB v10.2.0- in the mysql collector * Fix cumulative_stats configuration option in the unbound collector * Fix parsing configuration file (respect 'include-toplevel' directive) in unbound collector * Fix handling charts with type.id >= 200 (netdata limit) in go.d.plugin * Fix parsing version query response in the mysql collector * Fix Netsplits chart dimensions algorithm in the the vernemq collector. * Fix a typo in dashboard_info.js for VerneMQ. - Allow go plugin to build for Tumbleweed - Fix RPM file list - Update to v1.26.0 (go.d.plugin 0.23.0): Improvements * Add the ability to send Agent alarm notifications to StackPulse * Add a way to get build configuration info from the Agent * Add chart for churn rates to python.d/rabbitmq * Add failed dim to the connection_fails alarm in the Portcheck alarm * Improve the data query when using the context parameter * Add a context parameter to the data endpoint (Netdata Cloud) * Change default ACLK query thread count * Remove leading whitespace before JSON in ACLK * Allow using libwebsockets without SOCKS5 * Add information about Cloud disabled status to -W buildinfo (Collectors) * Update go.d.plugin version to v0.23.0 + Add new filecheck collector + Add new systemd unit state collector + Add new ISC DHCP collector (Dashboard) * Add missing period in Netdata dashboard Bug Fixes * Fix systemd comment syntax * Fix file descriptor leak in Infiniband collector (proc.plugin) * Fix the data endpoint to prioritize chart over context if both are present * Fix cleanup of obsolete charts * Fix build for the AWS Kinesis exporting connector * Fix gauges for go.d.plugin/web_log collector * Fix locking order to address CID_362348 * Fix chart's last accessed time during context queries * Fix resource leak in case of malformed request to Netdata Cloud - Move edit-config to libexeddir - Fix conf.d path in edit-config - Fix building with go support on openSUSE 15.2 - Build with python3 - Protect /etc/netdata as it contains sensitive data (passwords, secrets) - update to 1.25.0: Improvements * Add code to release memory used by the global GUID map (#9729, @stelfrag) * Add check for spurious wakeups Netdata Cloud * Add v2 HTTP message with compression to ACLK (#9895, @underhood) * Add version negotiation to ACLK (#9819, @underhood) * Add claimed_id for child nodes streamed to their parents (#9804, @underhood) * Update netdata-installer.sh to enable Netdata Cloud support in macOS (#9360, @mrbrutti) Collectors * Update go.d.plugin version to v0.22.0 (#9898, @ilyam8) * Add support for IP ranges to Python-based isc_dhcpd collector (#9755, @vsc55) * Add Network viewer charts to ebpf.plugin (#9591, @thiagoftsm) * Add collecting active processes limit on Linux systems (#9843, @Ancairon) * Improve eBPF plugin by removing unnecessary debug messages (#9754, @thiagoftsm) * Add CAP_SYS_CHROOT for netdata service to read LXD network interfaces (#9726, @vlvkobal) * Add collecting maxmemory to python.d/redis (#9767, @ilyam8) * Add option for multiple storage backends in python.d/varnish (#9668, @florianmagnin) * Dashboard * Update dashboard v1.4.2 (#9837, @jacekkolasa) * Lots of documentation improvements and bug fixes - update to 1.24.0: * The v1.24.0 release of the Netdata Agent brings enhancements to the breadth of metrics we collect with a new generic Prometheus/OpenMetrics collector and enhanced storage and querying with a new multi-host database mode. * Add generic Prometheus/OpenMetrics collector (#9644, @ilyam8) * Add locking between different collectors for the same application, implemented in different technologies (#9584, @vlvkobal), (#9564, @ilyam8) * Implement multihost database (#9556, @stelfrag) * Add alarms for FreeBSD interface errors (#8340, @lassebm) * Many bugfixes, see https://github.com/netdata/netdata/releases/tag/v1.24.0 - Update to v1.23.2: * Fixed a buffer overrun vulnerability in Netdata's JSON parsing code. This vulnerability could be used to crash Agents remotely, and in some circumstances, could be used in an arbitrary code execution (ACE) exploit. Improvements: * Add support for multiple ACLK query processing threads * Add Infiniband monitoring to collector proc.plugin * Change the HTTP method to make the IPFS collector compatible with 0.5.0+ * Add support for returning headers using python.d's UrlService Bug fixes: * Fix vulnerability in JSON parsing * Fixed stored number accuracy * Fix transition from archived to active charts not generating alarms * Fix PyMySQL library to respect my.cnf parameter * Remove health from archived metrics * Update exporting engine to read the prefix option from instance config sections * Fix display error in Swagger API documentation * Wrap exporting engine header definitions in compilation conditions * Improve cgroups collector to autodetect unified cgroups * Fix CMake build failing if ACLK is disabled * Fix now_ms in charts.d collector to prevent tc-qos-helper crashes * Fix python.d crashes by adding a lock to stdout write function * Fix an issue with random crashes when updating a chart's metadata on the fly * Fix ACLK protocol version always parsed as 0 * Fix the check condition for chart name change * Fix the exporting engine unit tests * Fix a Coverity defect for resource leaks - update to v1.23.1: - Lots of fixes and improvements, please see CHANGELOG.md - update go.d plugin to v0.19.2 - Update to v1.22.1: Bug fixes: - Fixed the latency issue on the ACLK and suppress the diagnostics. - Restored old semantics of "netdata -W set" command. - Removed check for old alarm status. - Changes for v1.22.0: Breaking Changes: * The previous iteration of Netdata Cloud, accessible through various Sign in and Nodes view (beta) buttons on the Agent dashboard, is deprecated in favor of the new Cloud experience. * Our old documentation site (docs.netdata.cloud) was replaced with Netdata Learn. All existing backlinks redirect to the new site. * Our localization project is no longer actively maintained. We're grateful for the hard work of its contributors. Improvements: * Netdata Cloud: - Enabled support for Netdata Cloud. - Added TTL headers to ACLK responses. - Improved the thread exit fixes in #8750. - Improved ACLK reconnection sequence. - Improved ACLK memory management and shutdown sequence. - Added session-id to ACLK using connect timestamp. * Collectors: - Improved the index size for the eBPF collector. - Added health alarm templates for the whoisquery collector. - Added a whoisquery collector. - Removed an automatic restart of apps.plugin. * Exporting: - Enabled internal statistics for the exporting engine in the Agent dashboard. - Implemented a Prometheus exporter web API endpoint. * Notifications: - Added a certificate revocation alarm for the x509check collector. - Added the ability to send Agent alarm notifications to Dynatrace. * Other: - Updated main copyright and links for the year 2020 in daemon help output. - Moved bind to to [web] section and update netdata.service.v235.in to sync it with recent changes. - Put old dashboard behind a prefix instead of using a script to switch. - Enabled the truthy rule in yamllint. - Added Borg backup, Squeezebox servers, Hiawatha web server, and Microsoft SQL to apps.plugin so that it can appropriately group them by type of service. * Bug fixes: - Fixed mdstat failed devices alarm. - Fixed rare race condition in old Cloud iframe. - Removed no-clear-notification options from portcheck health templates. - Fixed old URLs to silence Netlify's mixed content warnings. - Fixed master streaming fatal exits. - Fixed email authentiation to Cloud/Nodes View. - Fixed non-escaped characters in private registry URLs. - Fixed crash when shutting down an Agent with the ACLK disabled. - Fixed status checks for UPS devices using the apcupsd collector. - Fixed alarm notification script by adding a check to the Dynatrace notification method. - Fixed threads_creation_rate chart context in the python.d MySQL collector. - Fixed sudo check in charts.d libreswan collector to prevent daily security notices. - Update to v1.21.1: Release v1.21.1 is a hotfix release to improve the performance of the new React dashboard, which was merged and enabled by default in v1.21.0. The React dashboard shipped in v1.21.0 did not properly freeze charts that were outside of the browser's viewport. If a user who loaded many charts by scrolling through the dashboard, charts outside of their browser's viewport continued updating. This excess of chart updates caused all charts to update more slowly than every second. v1.21.1 includes improvements to the way the Netdata dashboard freezes, maintains state, and restores charts as users scroll. - Update to v1.21.0 (go.d.plugin v0.18.0): Improvements: * Extended TLS support for 1.3. * Switched to the React dashboard code as the default dashboard. * Collectors: - Added a new Pulsar collector. - Added a new VerneMQ collector. - Added high precision timer support for plugins such as idlejitter. - Added an alarm to the dns_query collector that detects DNS query failure. - Added the ability to get the pod name from cgroup with kubectl in bare-metal deployments. - Added the ability to connect to non-admin user IDs for a Ceph storage cluster. - Added connections (backend) usage to Postgres monitoring. * Exporting: - Added a MongoDB connector to the exporting engine. - Added a Prometheus Remote Write connector to the exporting engine. - Added an AWS Kinesis connector to the exporting engine. Bug fixes: * Removed notifications from the dashboard and fixed the /default.html route. * Fixed help-tooltips styling, private registry node deletion, and the right-hand sidebar "jumping" on document clicks. * Fixed errors reported by Coverity. * Fixed broken pipe ignoring in apps.plugin. * Fixed the bytespersec chart context in the Python Apache collector. * Fixed charts.d.plugin to exit properly during Netdata service restart * Fixed minimist dependency vulnerability. * Fixed how SimpleService truncates Python module names. * Added proper prefix to Python module names during loading. * Fixed the flushing error threshold with the database engine. * Fixed memory leak for host labels streaming from slaves to master. * Fixed streaming scaling. * Fixed missing characters in kernel version field by encoding slave fields. * Fixed Ceph collector to get osd_perf_infos in versions 14.2 and higher. * Removed extraneous commas from chart information in dashboard. * Removed tmem collection from xenstat_plugin to allow Netdata on Xen 4.13 to compile successfully. * Restricted messages to Google Analytics. * Fixed Python 3 dict access in OpenLDAP collector module. - Update to v1.20.0 (go.d.plugin v0.15.0) Breaking Changes: * Removed deprecated bash collectors apache, cpu_apps, cpufreq, exim, hddtemp, load_average, mem_apps, mysql, nginx, phpfpm, postfix, squid, tomcat. If you were still using one of these collectors with custom configurations, you can find the new collector that replaces it in the supported collectors list. Improvements: * Host labels: + Added support for host labels + Improved the monitored system information detection. Added CPU freq & cores, RAM and disk space. + Started distinguishing the monitored system's (host) OS/Kernel etc. from those of the docker container's + Started creating host labels from collected system info + Started passing labels and container environment variables via the streaming protocol + Started sending host labels via exporting connectors + Added label support to alarm definitions and started recording them in alarm logs + Added support for host labels to the API responses + Added configurable host labels to netdata.conf + Added kubernetes labels * New collectors: + eBPF kernel collector + CockroachDB + squidlog: squid access log parser * Collector improvements: + apps.plugin: Created dns group, improved database group, improved ceph & samba groups + varnish: Added SMF metrics (cache on disk) + phpfpm: Fixed per process chart titles and readme + python.d: Formatted the code in all modules + node.d/snmp: - Added snmpv3 support, formatted the code in snmp.node.js + cgroups: Improved LXC monitoring by filtering out irrelevant LXC cgroups + litespeed: Added support for different .rtreport format + proc.plugin: Added pressure stall information + sensors: Improved collection logic + proc: Started monitoring network interface speed, duplex, operstate + smartd_log: Fixed the setting in the reallocated sectors count, by setting ATTR5 chart algorithm to absolute + nvidia-smi: Allow executing nvidia-smi in normal instead of loop mode + wmi: collect logon metrics, collect logical_disk disk latency metrics + weblog: handle MKCOL, PROPFIND, MOVE, SEARCH http request methods + scaleio: storage pools and sdcs metrics * Exporting engine: + Implemented the main flow for the Exporting Engine * Streaming: + Add versioning to the streaming protocol * Installation/Packages: + Improved the systemd service files, by removing unecessary ExecStartPre lines and moving global options to netdata.conf * Privacy: + Added support for opting out of telemetry via the DO_NOT_TRACK environment variable (telemetry is disabled by default on openSUSE) * Other: + Preparations for the next netdata cloud release. Added custom libmosquitto, netdata-cli and other prerequisites. + Applied linter fixes in shell scripts + Started supporting -fno-common in CFLAGS + Completely removed the unbound python collector (dead code) + Added possibility to change badges' text font color + Small updates to sample multi-host dashboard, dash.html + Added missing quoting in shell scripts + Bump handlebars from 4.2.0 to 4.5.3 + Reduce log level for uv_thread_set_name_np from error to info + Set standard name to non-libnetdata threads (libuv, pthread) * Bug fixes: + Fixed problems reported by Coverity for eBPF collector plugin + Fixed invalid literal for float: NN.NNt error in the elasticsearch python plugin, by adding terabyte unit parsing + Fixed timeout failing in docker containers which broke some python.d collectors + Fixed problem with the httpcheck python collector not being able to check URLs with the POST method, by adding body to the URLService. Also record the new options in httpcheck.conf + Fixed dbengine repeated global flushing errors and collectors being blocked, by dropping dirty dbengine pages if the disk cannot keep up + Fixed issue with alarm notifications occasionally ignoring the configured severity filter when the ROLE was set to root + Fixed Netlink Connection Tracker charts in the nfacct plugin + Fixed metric values sent via remote write to Prometheus backends, when using average/sum + Fixed unclosed brackets in softnet alarm + Fixed SEGFAULT when localhost initialization failed + Reduced the number of broken pipe error log entries, after a SIGKILL + Fixed Coverity errors by restoring support for protobuf 3.0 + Fixed inability to disable Prometheus remote API + Fixed SEGFAULT from the cpuidle plugin + Fixed samba collector not working, due to inability to run sudo + Fixed invalid css/js resource errors when URL for slave node has no final / on streaming master + Fixed keys_redis chart in the redis collector, by populating keys at runtime + Fixed UrlService bytes decoding and logger unicode encoding in the python.d plugin + Fixed a warning in the prometheus remote write backend + Fixed not detecting more than one adapter in the hpssa collector + Fixed race conditions in dbengine + Fixed race condition with the dbenging page cache descriptors + Fixed dbengine dirty page flushing warning + Fixed missing parenthesis on alarm softnet.conf + Fixed "Master thread EXPORTING takes too long to exit. Giving up" error, by cleaning up the main exporting engine thread on exit + Fixed rabbitmq error "update() unhandled exception: invalid literal for int() with base 10" + Fixed some LGTM alerts + Fixed valgrind errors + Fixed monit collector LGTM warnings + Fixed the following go.d.plugin collector issues: . mysql: panic in Cleanup (#326) . unbound: gather metrics via unix socket (#319) . logstash: pipelines chart (#317) . unbound: configuration file parsing. . Support include mechanism. (#298) . logstash: pipelines metrics parsing (#293) . phpfpm: processes metrics parsing (#297) - Also package go.d.plugin (v0.14.1) - Update to v1.19.0 Improvements: * New collectors: + AM2320 sensor collector plugin + Added parsing of /proc/pagetypeinfo to provide metrics on fragmentation of free memory pages + The unbound collector module was completely rewritten, in Go * Collector improvements: + We rewrote our web log parser in Go, drastically improving its flexibility and performance + The Kubernetes kubelet collector now reads the service account token and uses it for authorization. We also added a new default job to collect metrics from https://localhost:10250/metrics + Added a new default job to the Kubernetes coredns collector to collect metrics from http://kube-dns.kube-system.svc.cluster.local:9153/metrics + apps.plugin: Synced FRRouting daemons configuration with the frr 7.2 release + apps.plugin: Added process group for git-related processes + apps.plugin: Added balena to the container-engines application group + web_log: Treat 401 Unauthorized requests as successful + xenstat.plugin: Prepare for xen 4.13 by checking for check xenstat_vbd_error presence + mysql: Added galera cluster_status alarm * Metrics database: + Netdata generates alarms if the disk cannot keep up with data collection * Health: + Fine tune various default alarm configurations + Update SYN cookie alarm to be less aggressive + Added support for IRC alarm notifications Bug fixes: * Prevented freezes due to isolated CPUs * Fixed missing streaming when slave has SSL activated * Fixed error 421 in IRC notifications, by removing a line break from the message * proc/pagetypeinfo collection could under particular circumstances cause high CPU load. As a workaround, we disabled pagetypeinfo by default * Fixed incorrect memory allocation in proc plugin��s pagetypeinfo collector * Eliminated cached responses from the postgres collector * rabbitmq: Fixed "disk_free": "disk_free_monitoring_disabled" error * Fixed Apache module not working with letsencrypt certificate by allowing the python UrlService to skip tls_verify for http scheme * Fixed invalid spikes appearing in certain charts, by improving the incremental counter reset/wraparound detection algorithm * Fixed issue with unknown variables in alarm configuration expressions always being evaluated to zero * Fixed issue of automatically picking up Pi-hole stats from a Pi-hole instance installed on another device by disabling the default job that collects metrics from http://pi.hole - Update to v1.18.1 Improvements: * Disable slabinfo plugin by default to reduce the total number of metrics collected * Add dbengine RAM usage statistics * Support Google Hangouts chat notifications * Add CMocka unit tests * Add prerequisites to enable automatic updates for installations via the static binary (kickstart-static64.sh) Bug fixes: * Fix unbound collector timings: Convert recursion timings to milliseconds. * Fix unbound collector unhandled exceptions * Fix megacli collector binary search and sudo check * Fix Clang warnings * Fix python.d error logging: change chart suppress msg level from ERROR to INFO * Fix freeipmi update frequency check: was warning that 5 was too frequent and it was setting it to 5. * Fix alarm configurations not getting loaded, via better handling of chart names with special characters * Don't write HTTP response 204 messages to the logs * Fix build when CMocka isn't installed * Prevent zombie processes when a child is re-parented to netdata when its running in a container, by adding child process reaper - Update to v1.18.0 Improvements: * Database engine: + Make dbengine the default memory mode + Increase dbengine default cache size + Reduce overhead during write IO + Detect deadlock in dbengine page cache + Remove hard cap from page cache size to eliminate deadlocks. * New collectors: + SLAB cache mechanism + Gearman worker statistics + vCenter Server Appliance + Zookeeper servers + Hadoop Distributed File System (HDFS) nodes * Collector improvements: + rabbitmq: Add vhosts message metrics from /api/vhosts + elasticsearch: collect metrics from _cat/indices + mysql: collect galera cluster metrics + Allow configuration of the python.d launch command from netdata.conf + x509check: smtp cert check support + dnsmasq_dhcp: respect conf-dir,conf-file,dhcp-host options + plugin: respect previously running jobs after plugin restart + httpcheck: add current state duration chart + springboot2: fix context * Health: + Enable alarm templates for chart dimensions + Center the chart on the proper chart and time whenever an alarm link is clicked * Other: + API: Include family into the allmetrics JSON response + API: Add fixed width option to badges + Allow hostnames in Access Control Lists Bug fixes: * Fix issue error in alarm notification script, when executed without any arguments * Fix Coverity warnings * Fix dbengine consistency when a writer modifies a page concurrently with a reader querying its metrics * Fix memory leak on netdata exit * Fix for missing boundary data points in certain cases * Fix unhandled exception log warnings in the python.d collector orchestrator start\_job * Fix CORS errors when accessing the health management API, by permitingt x-auth-token in Access-Control-Allow-Headers * Fix misleading error log entries RRDSET: chart name 'XXX' on host 'YYY' already exists, by changing the log level for chart updates * Properly resolve all Kubernetes container names * Fix LGTM warnings * Fix agent UI redirect loop during cloud sign-in * Fix python.d.plugin bug in parsing configuration files with no explicitly defined jobs * Fix potential buffer overflow in the web server * Fix netdata group deletion on linux for uninstall script * Various cppcheck fixes * Fix handling of illegal metric timestamps in database engine * Fix a resource leak * Fix rabbitmq collector error when no vhosts are available. - Update to v1.17.0 Improvements: * Database engine: + Variable granularity support for data collection + Added tips on the UI to encourage users to try the new DB Engine, when they reach the end of their metrics history * Health: + Added support for plain text only email notifications + Started showing ��hidden�� alarm variables in the responses of the chart and data API calls + Added a new API call for alarm status counters, as a first step towards badges that will show the total number of alarms * Security: + Added configurable default locations for trusted CA certificates + Added safer way to get container names + Added SSL connection support to the python mongodb collector * New collectors: + VSphere collector * Archiving: + Added a new MongoDB backend * Other: + Added apps grouping debug messages + GCC warning and linting improvements + Added global configuration option to show charts with zero metrics + Improved the way we parse HTTP requests, so we can avoid issues from edge cases * Bug fixes: + Fixed sensor chips filtering in python sensors collector + Fixed user and group names in apps.plugin when running in a container, by mounting and reading /etc/passwd + Fixed possible buffer overflow in the JSON parser used for health notification silencers + Fixed handling of corrupted DB files in dbengine, that could cause netdata to not start properly (CRC and I/O error handling) + Fixed an issue with Netdata snapshots that could sometimes cause a problem during import + Fixed bug that would cause netdata to attempt to kill already terminated threads again, on shutdown + Fixed out of memory (12) errors by reimplementing the myopen() function family + Fixed wrong redirection of users signing in after clicking Nodes + Fixed python.d smartd collector increasing CPU usage + Fixed mongodb python collector stock configuration mistake, by changing password to pass + Fixed handling of UTF8 characters in badges and added International Support to the URL parser + Fixed nodes menu sizing (responsive) + Fixed issues with http redirection to https and streaming encryption + Fixed broken links to arcstat.py and arc_summary.py in dashboard_info.js + Fixed bug with the nfacct plugin that resulted in missing dimensions from the charts + Stopped anonymous stats from trying to write a log under /tmp + Properly delete obsolete dimensions for inactive disks in smartd_log + Fixed handling of disconnected sockets in unbound python.d collector + Fixed crash in malloc + Fixed issue with mysql collector that resulted in showing only a single slave_status chart, regardless of the number of replication channels + Fixed a segmentation fault in backends + Fixed spigotmc plugin bugs + Fixed dbengine 100% CPU usage due to corrupted transaction payload handling - Update to v1.16.0 Improvements: * Health: + Easily disable alarms, by persisting the silencers configuration + Repeating alarm notifications + Simplified the health cmdapi tester - no setup/cleanup needed + ��dd last_collected alarm to the x509check collector + New alarm for abnormally high number of active processes. * Security: + SSL support in the web server and streaming/replication + Support encrypted connections to OpenTSDB backends * New collectors: + Go.d collector modules for WMI, Dnsmasq DHCP leases and Pihole + Riak KV instances collector + CPU performance statistics using Performance Monitoring Units via the perf_event_open() system call. (perf plugin) * Collector improvements: + Handle different sensor IDs for the same element in the freeipmi plugin + Increase the cpu_limit chart precision in cgroup plugin + Added userstats and deadlocks charts to the python mysql collector + Add perforce server process monitoring to the apps plugin * Backends: + Prometheus remote write backend * DB engine improvements: + Reduced memory requirements by 40-50% + Reduced the number of pages needed to be stored and indexed when using memory mode = dbengine, by adding empty page detection * Rebranding: + Updated the netdata logo and changed links to point to the new website * Other: + Pass the the cloud base url parameter to the notifications mechanism, so that modifications to the configuration are respected when creating the link to the alarm + Improved logging, to be able to trace the CRITICAL: main[main] SIGPIPE received. error Bug fixes: * Fixed ram_available alarm * Stop monitoring /dev and /run in the disk space and inode usage charts * Fixed the monitoring of the ��time�� group of processes * Fixed compilation error PERF_COUNT_HW_REF_CPU_CYCLES' undeclared here in old Linux kernels (perf plugin) * Fixed invalid XML page error (tomcat plugin) * Remove obsolete monit metrics * Fixed Failed to parse error in adaptec_raid * Fixed cluster_health_nodes and cluster_stats_nodes charts in the elasticsearch collector * A modified slave chart's "name" was not properly transferred to the master * Netdata could run out of file descriptors when using the new DB engine * Fixed UI behavior when pressing the End key * Fixed UI link to check the configuration file, to open in a new tab * Prevented Error: 'module' object has no attribute 'Retry' messages from python collectors, by enforcing minimum version check for the UrlService library * Fixed typo that causes nfacct.plugin log messages to incorrectly show freeipmi * The daemon could get stuck during collection or during shutdown, when using the new dbengine. Reduced new dbengine IO utilization by forcing page alignment per dimension of chart. * Properly handle timeouts/no response in dns_query_time python collector * When a collector restarted after having stopped for a long time, the new dbengine would consume a lot of CPU resources. * Fixed error Assertion old_state & PG_CACHE_DESCR_ALLOCATED' failed` of the new dbengine. Eliminated a page cache descriptor race condition * tv.html failed to load the three left charts when accessed via https. Turn tv.html links to https * Change print level from error to info for messages about clearing old files from the database * Fixed warning regarding the x509check_last_collected_secs alarms. Changed the template update frequency to 60s, to match the chart��s update frequency * Email notification header lines were not terminated with \r\n as per the RFC * Some log entries would not be caught by the python web_log plugin. Fixed the regular expressions * Corrected the date used in pushbullet notifications * Fixed FATAL error when using the new dbengine with no direct I/O support, by falling back to buffered I/O * Fixed compatibility issues with varnish v4 (varnish collector) * The total number of disks in mdstat.XX_disks chart was displayed incorrectly. Fixed the "inuse" and "down" disks stacking. * The config option --disable-telemetry was being checked after restarting netdata, which means that we would still send anonymous statistics the first time netdata was started. (NOTE: Telemetry is disabled by default on openSUSE.) * Fixed apcupsd collector errors, by passing correct info to the run function. * apcupsd and libreswan were not enabled by default * Fixed incorrect module name: energi to energid * The nodes view did not work properly when a reverse proxy was configured to access netdata via paths containing subpaths (e.g. myserver/netdata) * Fix error message PLUGINSD : cannot open plugins directory * Corrected invalid links to web_log.conf that appear on the agent UI * Fixed ScaleIO collector endpoint paths * Fixed web client timeout handling in the go.d plugin httpcheck collector - Update to v1.15.0 Bug Fixes: * Prowl notifications were not being sent, unless another notification method was also active * Fix exception handling in the python.d plugin * The node applications group did not include all node processes. * The nvidia_smi collector displayed incorrect power usage * The python.d plugin would sometimes hang, because it lacked a connect timeout * The mongodb collector raised errors due to various KeyErrors * The smartd_log collector would show incorrect temperature values Improvements: * Support for aggregate node view * Database engine * New collector modules: + Go.d collectors for OpenVPN, the Tengine web server and ScaleIO (VxFlex OS) instances + Monitor disk access latency like ioping does * Energi Core daemon monitoring, suits other Bitcoin forks * Collector improvements: + Add docker swarm manager metrics to the go.d docker_engine collector + Implement unified cgroup cpu limit + python.d.plugin: Allow monitoring of HTTP(S) endpoints which require POST data and make the UrlService more flexible * Support the AWS Kinesis backend for long-term storage * Add a new "text-only" chart renderer * API Improvements: + Smarter caching of API calls. Do not cache alarms and info api calls and extend no-cache headers. + Extend the api/v1/info call response with system and collector information + k6 script for API load testing * Kubernetes helmchart improvements: + Added the init container, where sysctl params could be managed, to bypass the Cannot allocate memory issue + Better startup/shutdown of slaves and reduced memory usage with liveness/readiness probes and default memory mode none + Added the option of overriding the default settings for kubelet, kubeproxy and coredns collectors via values.yaml + Make the use of persistent volumes optional, add apiVersion to fix linting errors and correct the location of the env field - Update to v1.14.0 The release introduces major additions to Kubernetes monitoring, with tens of new charts for Kubelet, kube-proxy and coredns metrics, as well as significant improvements to the netdata helm chart. Two new collectors were added, to monitor Docker hub and Docker engine metrics. Finally, v1.14 adds support for version 2 cgroups, OpenLDAP over TLS, NVIDIA SMI free and per process memory and configurable syslog facilities. Bug Fixes: * Fixed problem autodetecting failed jobs in python.d plugin. It now properly restarts jobs that are being rechecked, as soon as they are able to run. * CouchdDB monitoring would stop sometimes with an exception. Fixed the unhandled exception causing the issue. * The netdata api deliberately returned http error 400 when netdata ran in memory mode none. Modified the behavior to return responses, regardless of the memory mode * The python.d plugin sometimes does not receive SIGTERM when netdata exits, resulting in zombie processes. Added a heartbeat so that the process can exit on SIGPIPE. * The new SMS Server Tools notifications did not handle errors well, resulting in cryptic error messages. Improved error handling. * Fix segmentation fault in streaming, when two dimensions had similar names. * Kubernetes Helm Chart: Fixed incorrect use of namespaces in ServiceAccount and ClusterRoleBinding RBAC fixes. * Elastic search: The option to enable HTTPS was not included in the config file, giving the erroneous impression that HTTPS was not supported. The option was added. * RocketChat notifications were not being sent properly. Added default recipients for roles in the health alarm notification configuration. Improvements: * go.d.plugin v0.4.0 : Docker Hub and k8s coredns collectors, springboot2 URI filters support. * go.d.plugin v0.3.1 : Add default job to run k8s_kubelet.conf, k8s_kubeproxy, activemq modules * go.d.plugin v0.3.0 : Docker engine, kubelet and kub-proxy collectors. x509check module reading certs from file support * Added unified cgroup support that includes v2 cgroups * Disk stats: Added preferred disk id pattern, so that users can see the id they prefer, when multiple ids appear for the same device * NVIDIA SMI: Added memory free and per process memory usage charts to the collector * OpenLDAP: Added TLS support, to allow monitoring of LDAPS. * PHP-FPM: Add health check to raise alarms when the phpfm server is unreachable * PostgreSQL: Our configuration options to connect to a DB did not support all possible option. Added option to connect to a PostreSQL instance by defining a connection string (URI). * python.d.plugin: There was no way to delete obsolete dimensions in charts created by the python.d plugin. The plugin can now delete dimension at runtime. * netdata supports sending its logs to Syslog, but the facility was hard-coded. We now support configurable Syslog facilities in netdata.conf. * Kubernetes Helm Chart improvements: + Added serviceName in statefulset spec to align with the k8s documentation + Added preStart command to persist slave machine GUIDs, so that pod deletion/addition during upgrades doesn't lose the slave history. + Disabled non-essential master netdata collector plugins to avoid duplicate data + Added preStop command to wait for netdata to exit gracefully before removing the container + Extended configuration file support to provide more control from the helm command line + Added option to disable Role-based access control + Added liveness and readiness probes. - Update to v1.13.0 netdata has taken the first step into the world of Kubernetes, with a beta version of a Helm chart for deployment to a k8s cluster and proper naming of the cgroup containers. We have big plans for Kubernetes, so stay tuned! A major refactoring of the python.d plugin has resulted in a dramatic decrease of the required memory, making netdata even more resource efficient. We also added charts for IPC shared memory segments and total memory used. Improvements: * Kubernetes: Helm chart and proper cgroup naming * python.d.plugin: Reduce memory usage with separate process for initial module checking and loaders cleanup * IPC shared memory charts * mysql module add ssl connection support * FreeIPMI: Have the debug option apply the internal freeipmi debug flags * Prometheus backend: Support legacy metric names for source=avg * Registry: Allow deleting the host we are looking at * SpigotMC: Use regexes for parsing. Bug Fixes: * Postgres: fix connection issues * Proxmox container: Fix cgroup naming and use total_* memory counters for cgroups * proc.plugin and plugins.d: Fix memory leaks * SpigotMC: Fix UnicodeDecodeError and py2 compatibility fix * Fix non-obsolete dimension deletion * UI: Fix incorrect icon for the streaming master * Docker container names: Retry renaming when a name is not found * apps.plugin: Don't send zeroes for empty process groups * go.d.plugin: Correct sha256sum check * Unbound module: Documentation corrected with troubleshooting section. * Streaming: Prevent UI issues upon GUID duplication between master and slave netdata instances * Linux power supply module: Fix missing zero dimensions * Minor fixes around plugin_directories initialization - Update to v1.12.2 Bug Fixes: * Zombie processes exist after restart netdata - add heartbeat to python.d plugin * RocketChat notifications not working * SIGSEGV crash during shutdown of tc plugin * CMake warning for nfacct plugin Improvements: * Oracledb python module * Show streamed servers even for users that are not signed in - Drop GPG signature (no longer used) - Drop spec compatibility with old distro versions - Drop netdata-automake-no-dist-xz.patch - Refresh netdata-smartd-log-path.patch - Update to v1.12.1 Fixes: * Fix SIGSEGV at startup: Don't free vars of charts that do not exist #5455 * Prevent invalid Linux power supply alarms during startup #5447 * Correct duplicate flag enum in health.h #5441 * Remove extra 'v' for netdata version from Server response header #5440 and spec URL #5427 * apcupsd - Treat ONBATT status the same as ONLINE #5435 * Fix #5430 - LogService._get_raw_data under python3 fails on undecodable data #5431 * Correct version check in UI #5429 * Fix ERROR 405: Cannot download charts index from server - cpuidle handle newlines in names #5425 * Fix clock_gettime() failures with the CLOCK_BOOTTIME argument #5415 * Use netnsid for detecting cgroup networks; #5413 * Python module sensors fix #5406 * Fix ceph.chart.py for Python3 #5396 (GaetanF) * Fix warning condition for mem.available #5353 * cups.plugin: Support older versions #5350 Improvements: * Add driver-type option to the freeipmi plugin #5384 * Add support of tera-byte size for Linux bcache. #5373 * Split nfacct plugin into separate process #5361 * Add cgroup cpu and memory limits and alarms #5172 * Add message queue statistics #5115 - Update to v1.12.0 Key improvements: * Introducing netdata.cloud, the free netdata service for all netdata users * High performance plugins with go.d.plugin (data collection orchestrator written in Go) * 7 new data collectors and 11 rewrites of existing data collectors for improved performance * A new management API for all netdata servers * Bind different functions of the netdata APIs to different ports Management API: Netdata now has a management API. We plan to provide a full set of configuration commands using this API. In this release, the management API supports disabling or silencing alarms during maintenance periods. For more information about the management API, check https://docs.netdata.cloud/web/api/health/#health-management-api Anonymous statistics: Anonymous usage information can be collected and sent to Google Analytics. This functionality is disabled by default in openSUSE. Remove /etc/netdata/.opt-out-from-anonymous-statistics to enable. The statistics calculated from this information will be used for: 1. Quality assurance, to help us understand if netdata behaves as expected and help us identify repeating issues for certain distributions or environment. 2. Usage statistics, to help us focus on the parts of netdata that are used the most, or help us identify the extend our development decisions influence the community. Information is sent to Netdata via two different channels: * Google Tag Manager is used when an agent's dashboard is accessed. * The script anonymous-statistics.sh is executed by the Netdata daemon, when Netdata starts, stops cleanly, or fails. Both methods are controlled via the same opt-out mechanism. For more information, check https://docs.netdata.cloud/docs/anonymous-statistics/ Data collection: This release introduces a new Go plugin orchestrator. This plugin has its own github repo (https://github.com/netdata/go-orchestrator) It is open-source, using the same license and we welcome contributions. The orchestrator can also be used to build custom data collection plugins written in Go. We have used the orchestrator to write many new Go plugins in our go.d plugin github repo. For more information, check https://github.com/netdata/go-orchestrator#go-orchestrator-wip New data collectors: * Activemq (Go) * Consul (Go) * Lighttpd2 (Go) * Solr (Go) * Springboot2 (Go) * mdstat - nonredundant arrays (C) * CUPS printing system (C) High performance versions of older data collectors: * apache (Go) * dns_query (Go) * Freeradius (Go) * Httpcheck (Go) * Lighttpd (Go) * Portcheck (Go) * Nginx (Go) * cpufreq (C) * cpuidle (C) * mdstat (C) * power supply (C) Other improved data collectors: * Fix the python plugin clock (collectors falling behind). * adaptec_raid: add to python.d.conf. * apcupsd: Detect if UPS is online. * apps: Fix process statistics collection for FreeBSD. * apps: Properly lookup docker container name when running in ECS * fail2ban: Add 'Restore Ban' action. * go_expavar: Don't check for duplicate expvars. * hddtemp: Don't use disk model as dim name. * megacli: add to python.d.conf. * nvidia_smi: handle N/A values. * postgres: Fix integer out of range error on Postgres 11, fix locks count. * proc: Don't show zero charts for ZFS filesystem. * proc; Fix cached memory calculation. * sensors: Don't ignore 0 RPM fans on start. * smartd_log: check() unhandled exception: list index out of range. * SNMP: Gracefully ignore the offset if the value is not a number Health Monitoring: * Add Prowl notifications for iOS users. * Show count of active alarms per state in email notifications. * Show evaluated expression and expression variable values in email notifications. * Improve support for slack recipients (channels/users). * Custom notifications: Fix bug with alarm role recipients. Dashboards: * Server filtering in my-netdata menu when signed in to netdata.cloud * All units are now IEC-compliant abbreviations (KiB, MiB etc.). * GUI: Make entire row clickable in the registry menu showing the list of servers. Backends: * Do not report stale metrics to prometheus. Other: * Treat DT_UNKNOWN files as regular files. * API: Stricter rules for URL separators. - Update to v1.11.1 Improved internal database: Overflown incremental values (counters) do not show a zero point at the charts. Netdata detects the width (8bit, 16bit, 32bit, 64bit) of each counter and properly calculates the delta when the counter overflows. The internal database format has been extended to support values above 64bit. New data collection plugins: * openldap, to collect performance statistics from OpenLDAP servers. * tor, to collect traffic statistics from Tor. * nvidia_smi to monitor NVIDIA GPUs. Improved data collection plugins: * BUG FIX: network interface names with colon (:) in them were incorrectly parsed and resulted in faulty data collection values. * BUG FIX: smartd_log has been refactored, has better python v2 compatibility, and now supports SCSI smart attributes * cpufreq has been re-written in C - since this module if common, we decided to convert to an internal plugin to lower the pressure on the python ones. There are a few more that will be transitioned to C in the next release. * BUG FIX: sensors got some compatibility fixes and improved handling for lm-sensors errors. Health monitoring: * BUG FIX: max network interface speed data collection was faulty, which resulted in false-positive alarms on systems with multiple interfaces using different speeds (the speed of the first network interface was used for all network interfaces). Now the interface speed is shown as a badge. * alerta.io notifications got a few improvements * BUG FIX: conntrack_max alarm has been restored (was not working due to an invalid variable name referenced) Registry (my-netdata menu): * It has been refactored a bit to reveal the URLs known for each node and now it supports deleting individual URLs. - Update to 1.11.0 * Stock config files are now in /usr/lib/netdata; use the /etc/netdata/edit-config script to copy and edit them. * The query engine of netdata has been re-written to support query plugins. We have already added the following algorithms that are available for alarm, charts and badges: + stddev, for calculating the standard deviation on any time-frame. + ses or ema or ewma, for calculating the exponential weighted moving average, or single/simple exponential smoothing on any time-frame. + des, for calculating the double exponential smoothing on any time-frame. + cv or rsd, for calculating the coefficient of variation for any time-frame. Fixed security issues: * CVE-2018-18836 Fixed JSON Header Injection (an attacker could send \n encoded in the request to inject a JSON fragment into the response). boo#1139094 * CVE-2018-18837 Fixed HTTP Header Injection (an attacker could send \n encoded in the request to inject an HTTP header into the response). boo#1139095 * CVE-2018-18838 Fixed LOG Injection (an attacker could send \n encoded in the request to inject a log line at access.log). boo#1139098 * CVE-2018-18839 Not fixed Full Path Disclosure, since these are intended (netdata reports the absolute filename of web files, alarm config files and alarm handlers). * Fixed Privilege Escalation by manipulating apps.plugin or cgroup-network error handling. * Fixed LOG injection (by sending URLs with \n in them). New data collection modules: * rethinkdbs for monitoring RethinkDB performance * proxysql for monitoring ProxySQL performance * litespeed for monitoring LiteSpeed web server performance. * uwsgi for monitoring uWSGI performance * unbound for monitoring the performance of Unbound DNS servers. * powerdns for monitoring the performance of PowerDNS servers. * dockerd for monitoring the health of dockerd * puppet for monitoring Puppet Server and Puppet DB. * logind for monitoring the number of active users. * adaptec_raid and megacli for monitoring the relevant raid controller * spigotmc for monitoring minecraft server statistics * boinc for monitoring Berkeley Open Infrastructure Network Computing clients. * w1sensor for monitoring multiple 1-Wire temperature sensors. * monit for collecting process, host, filesystem, etc checks from monit. * linux_power_supplies for monitoring Linux Power Supplies attributes Data collection orchestrators changes: * node.d.plugin does not use the js command any more. * python.d.plugin now uses monotonic clocks. There was a discrepancy in clocks used in netdata that resulted in a shift in time of python module after some time (it was missing 1 sec per day). * added MySQLService for quickly adding plugins using mysql queries. * URLService now supports self-signed certificates and supports custom client certificates. * all python.d.plugin modules that require sudo to collect metrics, are now disabled by default, to avoid security alarms on installations that do not need them. Improved data collection modules: * apps.plugin now detects changes in process file descriptors, also fixed a couple of memory leaks. Its default configuration has been enriched significantly, especially for IoT. * freeipmi.plugin now supports option ignore-status to ignore the status reported by given sensors. * statsd.plugin (for collecting custom APM metrics) + The charting thread has been optimized for lowering its CPU consumption when several millions of metrics are collected. + sets now report zeros instead of gaps when no data are collected + histograms and timers have been optimized for lowering their CPU consumption to support several thousands of such metrics are collected. + histograms had wrong sampling rate calculations. + gauges now ignore sampling rate when no sign is included in the value. + the minimum sampling rate supported is now 0.001. + netdata statsd is now drop-in replacement for datadog statsd (although statsd tags are currently ignored by netdata). * proc.plugin (Linux, system monitoring) + Unused interrupts and softirqs are not used in charts (this saves quite some processing power and memory on systems with dozens of CPU cores). + fixed /proc/net/snmp parsing of IcmpMsg lines that failed on a few systems. + Veritas Volume Manager disks are now recognized and named accordingly. + Now netdata collects TcpExtTCPReqQFullDrop and re-organizes metrics in charts to properly monitor the TCP SYN queue and the TCP Accept queue of the kernel. + Many charts that were previously reported as IPv4, were actually reflecting metrics for both IPv4 and IPv6. They have been renamed to ip.*. + netdata now monitors SCTP. + Fixed BTRFS over BCACHE sector size detection. + BCACHE data collection is now faster. + /proc/interrupts and /proc/softirqs parsing fixes. * diskspace.plugin (Linux, disk space usage monitoring) + It does not stat() excluded mount points any more (it was interfering with kerberos authenticated mount points). + several filesystems are now by default excluded from disk-space monitoring, to avoid breaking suspend on workstations. * python.d.plugin PYTHON modules (applications monitoring) + web_log module now supports virtual hosts, reports http/https metrics, support squid logs + nginx_plus module now handles non-continuous peer IDs + ipfs module is optimized, the use of its Pin API is now disabled by default and can enabled with a netdata module option (using the IPFS Pin API increases the load on the IPFS server). + fail2ban module now supports IPv6 too. + ceph module now checks permissions and properly reports issues + elasticsearch module got better error handling + nginx_plus module now uses upstream ip:port instead of transient id to identify dimensions. + redis, now it supports Pika, collects evited keys, fixes authentication issues reported and improves exception handling. + beanstalk, bug fix for yaml config loading. + mysql, the % of active connections is now monitored, query types are also charted. + varnish, now it supports versions above 5.0.0 + couchdb + phpfpm, now supports IPv6 too. + apache, now supports IPv6 too. + icecast + mongodb, added support for connect URIs + postgress + elasticsearch, now it supports versions above 6.3.0, fixed JSON parse errors + mdstat , now collects mismatch_cnt + openvpn_log * node.d.plugin NODE.JS modules + snmp was incorrectly parsing a new OID names as float. * charts.d.plugin BASH modules + nut now supports naming UPSes. Health monitoring: * Added variable $system.cpu.processors. * Added alarms for detecting abnormally high load average. * TCP SYN and TCP accept queue alarms, replacing the old softnet dropped alarm that was too generic and reported many false positives. * system alarms are now enabled on FreeBSD. * netdata now reads NIC speed and sets alarms on each interface to detect congestion. * Network alarms are now relaxed to avoid false positives. * New bcache alarms. * New mdstat alarms. * New apcupsd alarms. * New mysql alarms. * New notification methods: + rocket.chat + Microsoft Teams + syslog + fleep.io + Amazon SNS Backends: * Host tags are now sent to Graphite * Host variables are now sent to Prometheus Streaming: * Each netdata slave and proxy now filter the charts that are streamed. This allows exposing netdata masters to third parties by limiting the number of charts available at the master. * Fixed a bug in streaming slaves that randomly prevented them to resume streaming after network errors. * Fixed a bug that on slaves that sent duplicated chart names under certain conditions. * Fixed a bug that caused slaves to consume 100% CPU (due to a misplaced lock) when multiple threads were adding dimensions on the same chart. * The receiving nodes of streaming (netdata masters and proxies) can now rate-limit the rate of inbound streaming requests received. * Re-worked time synchronization between netdata slaves and masters. API: * Badges that report time, now show "undefined" instead of "never". Dashboard: * Added UTC timezone to the list of available time-zones. * The dashboard was sending some non-HTTP compliant characters at the URLs that made netdata dashboards break when used under certain proxies. Patch Instructions: To install this openSUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 15.2: zypper in -t patch openSUSE-2021-647=1 Package List: - openSUSE Leap 15.2 (x86_64): netdata-1.29.3-lp152.4.3.1 netdata-debuginfo-1.29.3-lp152.4.3.1 netdata-debugsource-1.29.3-lp152.4.3.1 References: https://www.suse.com/security/cve/CVE-2018-18836.html https://www.suse.com/security/cve/CVE-2018-18837.html https://www.suse.com/security/cve/CVE-2018-18838.html https://www.suse.com/security/cve/CVE-2018-18839.html https://bugzilla.suse.com/1139094 https://bugzilla.suse.com/1139095 https://bugzilla.suse.com/1139098

1 0

openSUSE-RU-2021:0645-1: moderate: Recommended update for f2fs-tools
by maintenance＠opensuse.org 01 May '21

01 May '21

openSUSE Recommended Update: Recommended update for f2fs-tools ______________________________________________________________________________ Announcement ID: openSUSE-RU-2021:0645-1 Rating: moderate References: #1029961 Affected Products: openSUSE Leap 15.2 ______________________________________________________________________________ An update that has one recommended fix can now be installed. Description: This update for f2fs-tools fixes the following issues: - prepare package for usrmerge (boo#1029961) Update to release 1.14 * f2fs_io: add copy command * fsck: Check fsync data always for zoned block devices * fsck: Check write pointer consistency of open zones * fsck: Check write pointer consistency of non-open zones * fsck.f2fs: Enable user-space cache * f2fs-tools: support data compression * dump.f2fs: print more info of inode layout * resize.f2fs: add option for large_nat_bitmap feature * f2fs-tools: Casefolded Encryption support * mkfs.f2fs: allow setting volume UUID manually * f2fs-tools: zns zone-capacity support * mkfs.f2fs: add -T flag * mkfs.f2fs: add -r (fake_seed) flag Update to release 1.13 * introduce some preen mode in fsck.f2fs * add f2fs_io tool * add casefolding support Update to new upstream release 1.12 * resize.f2fs: fix access out-of memory boundary * mkfs.f2fs: support fsverity feature * fsck.f2fs: fix stack overflow when reading out nat block * mkfs.f2fs: avoid selinux denial for unnecessary sysfs node * fsck.f2fs: allow -p without value * mkfs.f2fs: support multiple features with one "-O" * f2fs-tools: add -g to give default options Update to version 1.10.0 * f2fs-tools: support inode creation time * fsck.f2fs: add -y for generic fsck * fsck.f2fs: support quota * mkfs.f2fs: support quota option in mkfs * f2fs-tools: support flexible inline xattr size * add sparse support for f2fs * f2fscrypt: add a tool for encryption management in f2fs Patch Instructions: To install this openSUSE Recommended Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 15.2: zypper in -t patch openSUSE-2021-645=1 Package List: - openSUSE Leap 15.2 (x86_64): f2fs-tools-1.14.0-lp152.4.3.1 f2fs-tools-debuginfo-1.14.0-lp152.4.3.1 f2fs-tools-debugsource-1.14.0-lp152.4.3.1 f2fs-tools-devel-1.14.0-lp152.4.3.1 libf2fs8-1.14.0-lp152.4.3.1 libf2fs8-debuginfo-1.14.0-lp152.4.3.1 libf2fs_format7-1.14.0-lp152.4.3.1 libf2fs_format7-debuginfo-1.14.0-lp152.4.3.1 - openSUSE Leap 15.2 (noarch): f2fs-tools-compat-1.14.0-lp152.4.3.1 References: https://bugzilla.suse.com/1029961

1 0

openSUSE-SU-2021:0646-1: moderate: Security update for postsrsd
by opensuse-security＠opensuse.org 01 May '21

01 May '21

openSUSE Security Update: Security update for postsrsd ______________________________________________________________________________ Announcement ID: openSUSE-SU-2021:0646-1 Rating: moderate References: #1180251 Cross-References: CVE-2020-35573 Affected Products: openSUSE Leap 15.2 ______________________________________________________________________________ An update that fixes one vulnerability is now available. Description: This update for postsrsd fixes the following issues: Update to release 1.11 [boo#1180251] * Drop group privileges as well as user privileges * Fixed: The subprocess that talks to Postfix could be caused to hang with a very long email address. [CVE-2020-35573] Update to release 1.6 * Fix endianness issue with SHA-1 implementation * Add dual stack support * Make SRS separator configurable Patch Instructions: To install this openSUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 15.2: zypper in -t patch openSUSE-2021-646=1 Package List: - openSUSE Leap 15.2 (x86_64): postsrsd-1.11-lp152.4.3.1 postsrsd-debuginfo-1.11-lp152.4.3.1 postsrsd-debugsource-1.11-lp152.4.3.1 References: https://www.suse.com/security/cve/CVE-2020-35573.html https://bugzilla.suse.com/1180251

1 0

openSUSE-SU-2021:0644-1: important: Security update for MozillaThunderbird
by opensuse-security＠opensuse.org 01 May '21

01 May '21

openSUSE Security Update: Security update for MozillaThunderbird ______________________________________________________________________________ Announcement ID: openSUSE-SU-2021:0644-1 Rating: important References: #1184960 Cross-References: CVE-2021-23961 CVE-2021-23994 CVE-2021-23995 CVE-2021-23998 CVE-2021-23999 CVE-2021-24002 CVE-2021-29945 CVE-2021-29946 CVE-2021-29948 CVSS scores: CVE-2021-23961 (NVD) : 7.4 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:N/A:N CVE-2021-23961 (SUSE): 7.4 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:N/A:N CVE-2021-23994 (SUSE): 7.5 CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H CVE-2021-23995 (SUSE): 7.5 CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H CVE-2021-23998 (SUSE): 6.1 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N CVE-2021-23999 (SUSE): 6.1 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N CVE-2021-24002 (SUSE): 6.1 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N CVE-2021-29945 (SUSE): 6.1 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N CVE-2021-29946 (SUSE): 6.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:L CVE-2021-29948 (SUSE): 4.2 CVSS:3.1/AV:L/AC:H/PR:L/UI:R/S:U/C:L/I:L/A:L Affected Products: openSUSE Leap 15.2 ______________________________________________________________________________ An update that fixes 9 vulnerabilities is now available. Description: This update for MozillaThunderbird fixes the following issues: - Firefox was updated to 78.10.0 ESR (bsc#1184960) * CVE-2021-23994: Out of bound write due to lazy initialization * CVE-2021-23995: Use-after-free in Responsive Design Mode * CVE-2021-23998: Secure Lock icon could have been spoofed * CVE-2021-23961: More internal network hosts could have been probed by a malicious webpage * CVE-2021-23999: Blob URLs may have been granted additional privileges * CVE-2021-24002: Arbitrary FTP command execution on FTP servers using an encoded URL * CVE-2021-29945: Incorrect size computation in WebAssembly JIT could lead to null-reads * CVE-2021-29946: Port blocking could be bypassed * CVE-2021-29948: Race condition when reading from disk while verifying signatures This update was imported from the SUSE:SLE-15-SP2:Update update project. Patch Instructions: To install this openSUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 15.2: zypper in -t patch openSUSE-2021-644=1 Package List: - openSUSE Leap 15.2 (x86_64): MozillaThunderbird-78.10.0-lp152.2.41.1 MozillaThunderbird-debuginfo-78.10.0-lp152.2.41.1 MozillaThunderbird-debugsource-78.10.0-lp152.2.41.1 MozillaThunderbird-translations-common-78.10.0-lp152.2.41.1 MozillaThunderbird-translations-other-78.10.0-lp152.2.41.1 References: https://www.suse.com/security/cve/CVE-2021-23961.html https://www.suse.com/security/cve/CVE-2021-23994.html https://www.suse.com/security/cve/CVE-2021-23995.html https://www.suse.com/security/cve/CVE-2021-23998.html https://www.suse.com/security/cve/CVE-2021-23999.html https://www.suse.com/security/cve/CVE-2021-24002.html https://www.suse.com/security/cve/CVE-2021-29945.html https://www.suse.com/security/cve/CVE-2021-29946.html https://www.suse.com/security/cve/CVE-2021-29948.html https://bugzilla.suse.com/1184960

1 0

openSUSE-SU-2021:0636-1: important: Security update for samba
by opensuse-security＠opensuse.org 01 May '21

01 May '21

openSUSE Security Update: Security update for samba ______________________________________________________________________________ Announcement ID: openSUSE-SU-2021:0636-1 Rating: important References: #1178469 #1179156 #1183572 #1183574 #1184310 #1184677 Cross-References: CVE-2020-27840 CVE-2021-20254 CVE-2021-20277 CVSS scores: CVE-2020-27840 (SUSE): 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H CVE-2021-20254 (SUSE): 7.1 CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:L CVE-2021-20277 (SUSE): 7.1 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:H Affected Products: openSUSE Leap 15.2 ______________________________________________________________________________ An update that solves three vulnerabilities and has three fixes is now available. Description: This update for samba fixes the following issues: - CVE-2021-20277: Fixed an out of bounds read in ldb_handler_fold (bsc#1183574). - CVE-2021-20254: Fixed a buffer overrun in sids_to_unixids() (bsc#1184677). - CVE-2020-27840: Fixed an unauthenticated remote heap corruption via bad DNs (bsc#1183572). - Avoid free'ing our own pointer in memcache when memcache_trim attempts to reduce cache size (bsc#1179156). - s3-libads: use dns name to open a ldap session (bsc#1184310). - Adjust smbcacls '--propagate-inheritance' feature to align with upstream (bsc#1178469). This update was imported from the SUSE:SLE-15-SP2:Update update project. Patch Instructions: To install this openSUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 15.2: zypper in -t patch openSUSE-2021-636=1 Package List: - openSUSE Leap 15.2 (i586 x86_64): ctdb-4.11.14+git.247.8c858f7ee14-lp152.3.19.1 ctdb-debuginfo-4.11.14+git.247.8c858f7ee14-lp152.3.19.1 ctdb-pcp-pmda-4.11.14+git.247.8c858f7ee14-lp152.3.19.1 ctdb-pcp-pmda-debuginfo-4.11.14+git.247.8c858f7ee14-lp152.3.19.1 ctdb-tests-4.11.14+git.247.8c858f7ee14-lp152.3.19.1 ctdb-tests-debuginfo-4.11.14+git.247.8c858f7ee14-lp152.3.19.1 libdcerpc-binding0-4.11.14+git.247.8c858f7ee14-lp152.3.19.1 libdcerpc-binding0-debuginfo-4.11.14+git.247.8c858f7ee14-lp152.3.19.1 libdcerpc-devel-4.11.14+git.247.8c858f7ee14-lp152.3.19.1 libdcerpc-samr-devel-4.11.14+git.247.8c858f7ee14-lp152.3.19.1 libdcerpc-samr0-4.11.14+git.247.8c858f7ee14-lp152.3.19.1 libdcerpc-samr0-debuginfo-4.11.14+git.247.8c858f7ee14-lp152.3.19.1 libdcerpc0-4.11.14+git.247.8c858f7ee14-lp152.3.19.1 libdcerpc0-debuginfo-4.11.14+git.247.8c858f7ee14-lp152.3.19.1 libndr-devel-4.11.14+git.247.8c858f7ee14-lp152.3.19.1 libndr-krb5pac-devel-4.11.14+git.247.8c858f7ee14-lp152.3.19.1 libndr-krb5pac0-4.11.14+git.247.8c858f7ee14-lp152.3.19.1 libndr-krb5pac0-debuginfo-4.11.14+git.247.8c858f7ee14-lp152.3.19.1 libndr-nbt-devel-4.11.14+git.247.8c858f7ee14-lp152.3.19.1 libndr-nbt0-4.11.14+git.247.8c858f7ee14-lp152.3.19.1 libndr-nbt0-debuginfo-4.11.14+git.247.8c858f7ee14-lp152.3.19.1 libndr-standard-devel-4.11.14+git.247.8c858f7ee14-lp152.3.19.1 libndr-standard0-4.11.14+git.247.8c858f7ee14-lp152.3.19.1 libndr-standard0-debuginfo-4.11.14+git.247.8c858f7ee14-lp152.3.19.1 libndr0-4.11.14+git.247.8c858f7ee14-lp152.3.19.1 libndr0-debuginfo-4.11.14+git.247.8c858f7ee14-lp152.3.19.1 libnetapi-devel-4.11.14+git.247.8c858f7ee14-lp152.3.19.1 libnetapi0-4.11.14+git.247.8c858f7ee14-lp152.3.19.1 libnetapi0-debuginfo-4.11.14+git.247.8c858f7ee14-lp152.3.19.1 libsamba-credentials-devel-4.11.14+git.247.8c858f7ee14-lp152.3.19.1 libsamba-credentials0-4.11.14+git.247.8c858f7ee14-lp152.3.19.1 libsamba-credentials0-debuginfo-4.11.14+git.247.8c858f7ee14-lp152.3.19.1 libsamba-errors-devel-4.11.14+git.247.8c858f7ee14-lp152.3.19.1 libsamba-errors0-4.11.14+git.247.8c858f7ee14-lp152.3.19.1 libsamba-errors0-debuginfo-4.11.14+git.247.8c858f7ee14-lp152.3.19.1 libsamba-hostconfig-devel-4.11.14+git.247.8c858f7ee14-lp152.3.19.1 libsamba-hostconfig0-4.11.14+git.247.8c858f7ee14-lp152.3.19.1 libsamba-hostconfig0-debuginfo-4.11.14+git.247.8c858f7ee14-lp152.3.19.1 libsamba-passdb-devel-4.11.14+git.247.8c858f7ee14-lp152.3.19.1 libsamba-passdb0-4.11.14+git.247.8c858f7ee14-lp152.3.19.1 libsamba-passdb0-debuginfo-4.11.14+git.247.8c858f7ee14-lp152.3.19.1 libsamba-policy-devel-4.11.14+git.247.8c858f7ee14-lp152.3.19.1 libsamba-policy-python3-devel-4.11.14+git.247.8c858f7ee14-lp152.3.19.1 libsamba-policy0-python3-4.11.14+git.247.8c858f7ee14-lp152.3.19.1 libsamba-policy0-python3-debuginfo-4.11.14+git.247.8c858f7ee14-lp152.3.19.1 libsamba-util-devel-4.11.14+git.247.8c858f7ee14-lp152.3.19.1 libsamba-util0-4.11.14+git.247.8c858f7ee14-lp152.3.19.1 libsamba-util0-debuginfo-4.11.14+git.247.8c858f7ee14-lp152.3.19.1 libsamdb-devel-4.11.14+git.247.8c858f7ee14-lp152.3.19.1 libsamdb0-4.11.14+git.247.8c858f7ee14-lp152.3.19.1 libsamdb0-debuginfo-4.11.14+git.247.8c858f7ee14-lp152.3.19.1 libsmbclient-devel-4.11.14+git.247.8c858f7ee14-lp152.3.19.1 libsmbclient0-4.11.14+git.247.8c858f7ee14-lp152.3.19.1 libsmbclient0-debuginfo-4.11.14+git.247.8c858f7ee14-lp152.3.19.1 libsmbconf-devel-4.11.14+git.247.8c858f7ee14-lp152.3.19.1 libsmbconf0-4.11.14+git.247.8c858f7ee14-lp152.3.19.1 libsmbconf0-debuginfo-4.11.14+git.247.8c858f7ee14-lp152.3.19.1 libsmbldap-devel-4.11.14+git.247.8c858f7ee14-lp152.3.19.1 libsmbldap2-4.11.14+git.247.8c858f7ee14-lp152.3.19.1 libsmbldap2-debuginfo-4.11.14+git.247.8c858f7ee14-lp152.3.19.1 libtevent-util-devel-4.11.14+git.247.8c858f7ee14-lp152.3.19.1 libtevent-util0-4.11.14+git.247.8c858f7ee14-lp152.3.19.1 libtevent-util0-debuginfo-4.11.14+git.247.8c858f7ee14-lp152.3.19.1 libwbclient-devel-4.11.14+git.247.8c858f7ee14-lp152.3.19.1 libwbclient0-4.11.14+git.247.8c858f7ee14-lp152.3.19.1 libwbclient0-debuginfo-4.11.14+git.247.8c858f7ee14-lp152.3.19.1 samba-4.11.14+git.247.8c858f7ee14-lp152.3.19.1 samba-ad-dc-4.11.14+git.247.8c858f7ee14-lp152.3.19.1 samba-ad-dc-debuginfo-4.11.14+git.247.8c858f7ee14-lp152.3.19.1 samba-client-4.11.14+git.247.8c858f7ee14-lp152.3.19.1 samba-client-debuginfo-4.11.14+git.247.8c858f7ee14-lp152.3.19.1 samba-core-devel-4.11.14+git.247.8c858f7ee14-lp152.3.19.1 samba-debuginfo-4.11.14+git.247.8c858f7ee14-lp152.3.19.1 samba-debugsource-4.11.14+git.247.8c858f7ee14-lp152.3.19.1 samba-dsdb-modules-4.11.14+git.247.8c858f7ee14-lp152.3.19.1 samba-dsdb-modules-debuginfo-4.11.14+git.247.8c858f7ee14-lp152.3.19.1 samba-libs-4.11.14+git.247.8c858f7ee14-lp152.3.19.1 samba-libs-debuginfo-4.11.14+git.247.8c858f7ee14-lp152.3.19.1 samba-libs-python3-4.11.14+git.247.8c858f7ee14-lp152.3.19.1 samba-libs-python3-debuginfo-4.11.14+git.247.8c858f7ee14-lp152.3.19.1 samba-python3-4.11.14+git.247.8c858f7ee14-lp152.3.19.1 samba-python3-debuginfo-4.11.14+git.247.8c858f7ee14-lp152.3.19.1 samba-test-4.11.14+git.247.8c858f7ee14-lp152.3.19.1 samba-test-debuginfo-4.11.14+git.247.8c858f7ee14-lp152.3.19.1 samba-winbind-4.11.14+git.247.8c858f7ee14-lp152.3.19.1 samba-winbind-debuginfo-4.11.14+git.247.8c858f7ee14-lp152.3.19.1 - openSUSE Leap 15.2 (noarch): samba-doc-4.11.14+git.247.8c858f7ee14-lp152.3.19.1 - openSUSE Leap 15.2 (x86_64): libdcerpc-binding0-32bit-4.11.14+git.247.8c858f7ee14-lp152.3.19.1 libdcerpc-binding0-32bit-debuginfo-4.11.14+git.247.8c858f7ee14-lp152.3.19.1 libdcerpc-samr0-32bit-4.11.14+git.247.8c858f7ee14-lp152.3.19.1 libdcerpc-samr0-32bit-debuginfo-4.11.14+git.247.8c858f7ee14-lp152.3.19.1 libdcerpc0-32bit-4.11.14+git.247.8c858f7ee14-lp152.3.19.1 libdcerpc0-32bit-debuginfo-4.11.14+git.247.8c858f7ee14-lp152.3.19.1 libndr-krb5pac0-32bit-4.11.14+git.247.8c858f7ee14-lp152.3.19.1 libndr-krb5pac0-32bit-debuginfo-4.11.14+git.247.8c858f7ee14-lp152.3.19.1 libndr-nbt0-32bit-4.11.14+git.247.8c858f7ee14-lp152.3.19.1 libndr-nbt0-32bit-debuginfo-4.11.14+git.247.8c858f7ee14-lp152.3.19.1 libndr-standard0-32bit-4.11.14+git.247.8c858f7ee14-lp152.3.19.1 libndr-standard0-32bit-debuginfo-4.11.14+git.247.8c858f7ee14-lp152.3.19.1 libndr0-32bit-4.11.14+git.247.8c858f7ee14-lp152.3.19.1 libndr0-32bit-debuginfo-4.11.14+git.247.8c858f7ee14-lp152.3.19.1 libnetapi-devel-32bit-4.11.14+git.247.8c858f7ee14-lp152.3.19.1 libnetapi0-32bit-4.11.14+git.247.8c858f7ee14-lp152.3.19.1 libnetapi0-32bit-debuginfo-4.11.14+git.247.8c858f7ee14-lp152.3.19.1 libsamba-credentials0-32bit-4.11.14+git.247.8c858f7ee14-lp152.3.19.1 libsamba-credentials0-32bit-debuginfo-4.11.14+git.247.8c858f7ee14-lp152.3.19.1 libsamba-errors0-32bit-4.11.14+git.247.8c858f7ee14-lp152.3.19.1 libsamba-errors0-32bit-debuginfo-4.11.14+git.247.8c858f7ee14-lp152.3.19.1 libsamba-hostconfig0-32bit-4.11.14+git.247.8c858f7ee14-lp152.3.19.1 libsamba-hostconfig0-32bit-debuginfo-4.11.14+git.247.8c858f7ee14-lp152.3.19.1 libsamba-passdb0-32bit-4.11.14+git.247.8c858f7ee14-lp152.3.19.1 libsamba-passdb0-32bit-debuginfo-4.11.14+git.247.8c858f7ee14-lp152.3.19.1 libsamba-policy0-python3-32bit-4.11.14+git.247.8c858f7ee14-lp152.3.19.1 libsamba-policy0-python3-32bit-debuginfo-4.11.14+git.247.8c858f7ee14-lp152.3.19.1 libsamba-util0-32bit-4.11.14+git.247.8c858f7ee14-lp152.3.19.1 libsamba-util0-32bit-debuginfo-4.11.14+git.247.8c858f7ee14-lp152.3.19.1 libsamdb0-32bit-4.11.14+git.247.8c858f7ee14-lp152.3.19.1 libsamdb0-32bit-debuginfo-4.11.14+git.247.8c858f7ee14-lp152.3.19.1 libsmbclient0-32bit-4.11.14+git.247.8c858f7ee14-lp152.3.19.1 libsmbclient0-32bit-debuginfo-4.11.14+git.247.8c858f7ee14-lp152.3.19.1 libsmbconf0-32bit-4.11.14+git.247.8c858f7ee14-lp152.3.19.1 libsmbconf0-32bit-debuginfo-4.11.14+git.247.8c858f7ee14-lp152.3.19.1 libsmbldap2-32bit-4.11.14+git.247.8c858f7ee14-lp152.3.19.1 libsmbldap2-32bit-debuginfo-4.11.14+git.247.8c858f7ee14-lp152.3.19.1 libtevent-util0-32bit-4.11.14+git.247.8c858f7ee14-lp152.3.19.1 libtevent-util0-32bit-debuginfo-4.11.14+git.247.8c858f7ee14-lp152.3.19.1 libwbclient0-32bit-4.11.14+git.247.8c858f7ee14-lp152.3.19.1 libwbclient0-32bit-debuginfo-4.11.14+git.247.8c858f7ee14-lp152.3.19.1 samba-ad-dc-32bit-4.11.14+git.247.8c858f7ee14-lp152.3.19.1 samba-ad-dc-32bit-debuginfo-4.11.14+git.247.8c858f7ee14-lp152.3.19.1 samba-ceph-4.11.14+git.247.8c858f7ee14-lp152.3.19.1 samba-ceph-debuginfo-4.11.14+git.247.8c858f7ee14-lp152.3.19.1 samba-client-32bit-4.11.14+git.247.8c858f7ee14-lp152.3.19.1 samba-client-32bit-debuginfo-4.11.14+git.247.8c858f7ee14-lp152.3.19.1 samba-libs-32bit-4.11.14+git.247.8c858f7ee14-lp152.3.19.1 samba-libs-32bit-debuginfo-4.11.14+git.247.8c858f7ee14-lp152.3.19.1 samba-libs-python3-32bit-4.11.14+git.247.8c858f7ee14-lp152.3.19.1 samba-libs-python3-32bit-debuginfo-4.11.14+git.247.8c858f7ee14-lp152.3.19.1 samba-winbind-32bit-4.11.14+git.247.8c858f7ee14-lp152.3.19.1 samba-winbind-32bit-debuginfo-4.11.14+git.247.8c858f7ee14-lp152.3.19.1 References: https://www.suse.com/security/cve/CVE-2020-27840.html https://www.suse.com/security/cve/CVE-2021-20254.html https://www.suse.com/security/cve/CVE-2021-20277.html https://bugzilla.suse.com/1178469 https://bugzilla.suse.com/1179156 https://bugzilla.suse.com/1183572 https://bugzilla.suse.com/1183574 https://bugzilla.suse.com/1184310 https://bugzilla.suse.com/1184677

1 0

openSUSE-SU-2021:0639-1: important: Security update for cifs-utils
by opensuse-security＠opensuse.org 01 May '21

01 May '21

openSUSE Security Update: Security update for cifs-utils ______________________________________________________________________________ Announcement ID: openSUSE-SU-2021:0639-1 Rating: important References: #1152930 #1174477 #1183239 #1184815 Cross-References: CVE-2020-14342 CVE-2021-20208 CVSS scores: CVE-2020-14342 (NVD) : 7 CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H CVE-2020-14342 (SUSE): 4.4 CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N CVE-2021-20208 (NVD) : 6.1 CVSS:3.1/AV:L/AC:H/PR:L/UI:R/S:C/C:L/I:H/A:N CVE-2021-20208 (SUSE): 6.1 CVSS:3.1/AV:L/AC:H/PR:L/UI:R/S:C/C:L/I:H/A:N Affected Products: openSUSE Leap 15.2 ______________________________________________________________________________ An update that solves two vulnerabilities and has two fixes is now available. Description: This update for cifs-utils fixes the following security issues: - CVE-2021-20208: Fixed a potential kerberos auth leak escaping from container. (bsc#1183239) - CVE-2020-14342: Fixed a shell command injection vulnerability in mount.cifs. (bsc#1174477) This update for cifs-utils fixes the following issues: - Solve invalid directory mounting. When attempting to change the current working directory into non-existing directories, mount.cifs crashes. (bsc#1152930) - Fixed a bug where it was no longer possible to mount CIFS filesystem after the last maintenance update. (bsc#1184815) This update was imported from the SUSE:SLE-15:Update update project. Patch Instructions: To install this openSUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 15.2: zypper in -t patch openSUSE-2021-639=1 Package List: - openSUSE Leap 15.2 (i586 x86_64): cifs-utils-6.9-lp152.2.3.1 cifs-utils-debuginfo-6.9-lp152.2.3.1 cifs-utils-debugsource-6.9-lp152.2.3.1 cifs-utils-devel-6.9-lp152.2.3.1 pam_cifscreds-6.9-lp152.2.3.1 pam_cifscreds-debuginfo-6.9-lp152.2.3.1 References: https://www.suse.com/security/cve/CVE-2020-14342.html https://www.suse.com/security/cve/CVE-2021-20208.html https://bugzilla.suse.com/1152930 https://bugzilla.suse.com/1174477 https://bugzilla.suse.com/1183239 https://bugzilla.suse.com/1184815

1 0

openSUSE-RU-2021:0641-1: Recommended update for strongswan
by maintenance＠opensuse.org 01 May '21

01 May '21

openSUSE Recommended Update: Recommended update for strongswan ______________________________________________________________________________ Announcement ID: openSUSE-RU-2021:0641-1 Rating: low References: Affected Products: openSUSE Leap 15.2 ______________________________________________________________________________ An update that has 0 recommended fixes can now be installed. Description: This update for strongswan fixes the following issues: - Added rcstrongswan-starter to this package. Please refer to the README.SUSE file to get more information about its usage. This update was imported from the SUSE:SLE-15-SP2:Update update project. Patch Instructions: To install this openSUSE Recommended Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 15.2: zypper in -t patch openSUSE-2021-641=1 Package List: - openSUSE Leap 15.2 (noarch): strongswan-doc-5.8.2-lp152.2.6.2 - openSUSE Leap 15.2 (x86_64): strongswan-5.8.2-lp152.2.6.2 strongswan-debuginfo-5.8.2-lp152.2.6.2 strongswan-debugsource-5.8.2-lp152.2.6.2 strongswan-hmac-5.8.2-lp152.2.6.2 strongswan-ipsec-5.8.2-lp152.2.6.2 strongswan-ipsec-debuginfo-5.8.2-lp152.2.6.2 strongswan-libs0-5.8.2-lp152.2.6.2 strongswan-libs0-debuginfo-5.8.2-lp152.2.6.2 strongswan-mysql-5.8.2-lp152.2.6.2 strongswan-mysql-debuginfo-5.8.2-lp152.2.6.2 strongswan-nm-5.8.2-lp152.2.6.2 strongswan-nm-debuginfo-5.8.2-lp152.2.6.2 strongswan-sqlite-5.8.2-lp152.2.6.2 strongswan-sqlite-debuginfo-5.8.2-lp152.2.6.2 References:

1 0

openSUSE-RU-2021:0640-1: moderate: Recommended update for xorg-x11-server
by maintenance＠opensuse.org 01 May '21

01 May '21

openSUSE Recommended Update: Recommended update for xorg-x11-server ______________________________________________________________________________ Announcement ID: openSUSE-RU-2021:0640-1 Rating: moderate References: #1184072 #1184543 Affected Products: openSUSE Leap 15.2 ______________________________________________________________________________ An update that has two recommended fixes can now be installed. Description: This update for xorg-x11-server fixes the following issues: - Fixed a crash that might occur when talking to Xwayland (bsc#1184072, bsc#1184543) This update was imported from the SUSE:SLE-15-SP2:Update update project. Patch Instructions: To install this openSUSE Recommended Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 15.2: zypper in -t patch openSUSE-2021-640=1 Package List: - openSUSE Leap 15.2 (i586 x86_64): xorg-x11-server-1.20.3-lp152.8.24.1 xorg-x11-server-debuginfo-1.20.3-lp152.8.24.1 xorg-x11-server-debugsource-1.20.3-lp152.8.24.1 xorg-x11-server-extra-1.20.3-lp152.8.24.1 xorg-x11-server-extra-debuginfo-1.20.3-lp152.8.24.1 xorg-x11-server-sdk-1.20.3-lp152.8.24.1 xorg-x11-server-source-1.20.3-lp152.8.24.1 xorg-x11-server-wayland-1.20.3-lp152.8.24.1 xorg-x11-server-wayland-debuginfo-1.20.3-lp152.8.24.1 References: https://bugzilla.suse.com/1184072 https://bugzilla.suse.com/1184543

1 0

openSUSE-RU-2021:0643-1: moderate: Recommended update for python-shaptools
by maintenance＠opensuse.org 01 May '21

01 May '21

openSUSE Recommended Update: Recommended update for python-shaptools ______________________________________________________________________________ Announcement ID: openSUSE-RU-2021:0643-1 Rating: moderate References: #1185090 Affected Products: openSUSE Leap 15.2 ______________________________________________________________________________ An update that has one recommended fix can now be installed. Description: This update for python-shaptools fixes the following issues: - Fix the HANA 'sidadm' user creation to transform to lowercase properly. (bsc#1185090) This update was imported from the SUSE:SLE-15:Update update project. Patch Instructions: To install this openSUSE Recommended Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 15.2: zypper in -t patch openSUSE-2021-643=1 Package List: - openSUSE Leap 15.2 (noarch): python2-shaptools-0.3.12+git.1619007514.1951d23-lp152.2.9.1 python3-shaptools-0.3.12+git.1619007514.1951d23-lp152.2.9.1 References: https://bugzilla.suse.com/1185090

1 0

openSUSE-SU-2021:0629-1: critical: Security update for Chromium
by opensuse-security＠opensuse.org 01 May '21

01 May '21

openSUSE Security Update: Security update for Chromium ______________________________________________________________________________ Announcement ID: openSUSE-SU-2021:0629-1 Rating: critical References: #11845047 #1184764 #1185398 Cross-References: CVE-2021-21201 CVE-2021-21202 CVE-2021-21203 CVE-2021-21204 CVE-2021-21205 CVE-2021-21207 CVE-2021-21208 CVE-2021-21209 CVE-2021-21210 CVE-2021-21211 CVE-2021-21212 CVE-2021-21213 CVE-2021-21221 CVE-2021-21222 CVE-2021-21223 CVE-2021-21224 CVE-2021-21225 CVE-2021-21226 CVE-2021-21227 CVE-2021-21228 CVE-2021-21229 CVE-2021-21230 CVE-2021-21231 CVE-2021-21232 CVE-2021-21233 CVSS scores: CVE-2021-21201 (NVD) : 9.6 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H CVE-2021-21202 (NVD) : 8.6 CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H CVE-2021-21203 (NVD) : 8.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H CVE-2021-21204 (NVD) : 8.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H CVE-2021-21205 (NVD) : 8.1 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:N CVE-2021-21207 (NVD) : 8.6 CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H CVE-2021-21208 (NVD) : 6.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N CVE-2021-21209 (NVD) : 6.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N CVE-2021-21210 (NVD) : 6.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N CVE-2021-21211 (NVD) : 6.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N CVE-2021-21212 (NVD) : 6.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N CVE-2021-21213 (NVD) : 8.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H CVE-2021-21221 (NVD) : 6.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N CVE-2021-21222 (NVD) : 6.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N CVE-2021-21223 (NVD) : 9.6 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H CVE-2021-21224 (NVD) : 8.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H CVE-2021-21225 (NVD) : 8.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H CVE-2021-21226 (NVD) : 9.6 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H Affected Products: openSUSE Leap 15.2 ______________________________________________________________________________ An update that fixes 25 vulnerabilities is now available. Description: This update for chromium fixes the following issues: - Chromium was updated to 90.0.4430.93 (boo#1184764,boo#1185047,boo#1185398) * CVE-2021-21227: Insufficient data validation in V8. * CVE-2021-21232: Use after free in Dev Tools. * CVE-2021-21233: Heap buffer overflow in ANGLE. * CVE-2021-21228: Insufficient policy enforcement in extensions. * CVE-2021-21229: Incorrect security UI in downloads. * CVE-2021-21230: Type Confusion in V8. * CVE-2021-21231: Insufficient data validation in V8. * CVE-2021-21222: Heap buffer overflow in V8 * CVE-2021-21223: Integer overflow in Mojo * CVE-2021-21224: Type Confusion in V8 * CVE-2021-21225: Out of bounds memory access in V8 * CVE-2021-21226: Use after free in navigation * CVE-2021-21201: Use after free in permissions * CVE-2021-21202: Use after free in extensions * CVE-2021-21203: Use after free in Blink * CVE-2021-21204: Use after free in Blink * CVE-2021-21205: Insufficient policy enforcement in navigation * CVE-2021-21221: Insufficient validation of untrusted input in Mojo * CVE-2021-21207: Use after free in IndexedDB * CVE-2021-21208: Insufficient data validation in QR scanner * CVE-2021-21209: Inappropriate implementation in storage * CVE-2021-21210: Inappropriate implementation in Network * CVE-2021-21211: Inappropriate implementation in Navigatio * CVE-2021-21212: Incorrect security UI in Network Config UI * CVE-2021-21213: Use after free in WebMIDI Patch Instructions: To install this openSUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 15.2: zypper in -t patch openSUSE-2021-629=1 Package List: - openSUSE Leap 15.2 (x86_64): chromedriver-90.0.4430.93-lp152.2.89.1 chromedriver-debuginfo-90.0.4430.93-lp152.2.89.1 chromium-90.0.4430.93-lp152.2.89.1 chromium-debuginfo-90.0.4430.93-lp152.2.89.1 References: https://www.suse.com/security/cve/CVE-2021-21201.html https://www.suse.com/security/cve/CVE-2021-21202.html https://www.suse.com/security/cve/CVE-2021-21203.html https://www.suse.com/security/cve/CVE-2021-21204.html https://www.suse.com/security/cve/CVE-2021-21205.html https://www.suse.com/security/cve/CVE-2021-21207.html https://www.suse.com/security/cve/CVE-2021-21208.html https://www.suse.com/security/cve/CVE-2021-21209.html https://www.suse.com/security/cve/CVE-2021-21210.html https://www.suse.com/security/cve/CVE-2021-21211.html https://www.suse.com/security/cve/CVE-2021-21212.html https://www.suse.com/security/cve/CVE-2021-21213.html https://www.suse.com/security/cve/CVE-2021-21221.html https://www.suse.com/security/cve/CVE-2021-21222.html https://www.suse.com/security/cve/CVE-2021-21223.html https://www.suse.com/security/cve/CVE-2021-21224.html https://www.suse.com/security/cve/CVE-2021-21225.html https://www.suse.com/security/cve/CVE-2021-21226.html https://www.suse.com/security/cve/CVE-2021-21227.html https://www.suse.com/security/cve/CVE-2021-21228.html https://www.suse.com/security/cve/CVE-2021-21229.html https://www.suse.com/security/cve/CVE-2021-21230.html https://www.suse.com/security/cve/CVE-2021-21231.html https://www.suse.com/security/cve/CVE-2021-21232.html https://www.suse.com/security/cve/CVE-2021-21233.html https://bugzilla.suse.com/11845047 https://bugzilla.suse.com/1184764 https://bugzilla.suse.com/1185398

1 0

openSUSE-SU-2021:0637-1: important: Security update for webkit2gtk3
by opensuse-security＠opensuse.org 01 May '21

01 May '21

openSUSE Security Update: Security update for webkit2gtk3 ______________________________________________________________________________ Announcement ID: openSUSE-SU-2021:0637-1 Rating: important References: #1182719 #1184155 #1184262 Cross-References: CVE-2020-27918 CVE-2020-29623 CVE-2021-1765 CVE-2021-1788 CVE-2021-1789 CVE-2021-1799 CVE-2021-1801 CVE-2021-1844 CVE-2021-1870 CVE-2021-1871 CVSS scores: CVE-2020-27918 (NVD) : 7.8 CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H CVE-2020-29623 (NVD) : 3.3 CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N CVE-2021-1765 (NVD) : 6.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N CVE-2021-1788 (NVD) : 8.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H CVE-2021-1789 (NVD) : 8.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H CVE-2021-1799 (NVD) : 6.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N CVE-2021-1801 (NVD) : 6.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N CVE-2021-1844 (NVD) : 8.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H CVE-2021-1871 (NVD) : 9.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H Affected Products: openSUSE Leap 15.2 ______________________________________________________________________________ An update that fixes 10 vulnerabilities is now available. Description: This update for webkit2gtk3 fixes the following issues: - Update to version 2.32.0 (bsc#1184155): * Fix the authentication request port when URL omits the port. * Fix iframe scrolling when main frame is scrolled in async * scrolling mode. * Stop using g_memdup. * Show a warning message when overriding signal handler for * threading suspension. * Fix the build on RISC-V with GCC 11. * Fix several crashes and rendering issues. * Security fixes: CVE-2021-1788, CVE-2021-1844, CVE-2021-1871 - Update in version 2.30.6 (bsc#1184262): * Update user agent quirks again for Google Docs and Google Drive. * Fix several crashes and rendering issues. * Security fixes: CVE-2020-27918, CVE-2020-29623, CVE-2021-1765 CVE-2021-1789, CVE-2021-1799, CVE-2021-1801, CVE-2021-1870. - Update _constraints for armv6/armv7 (bsc#1182719) - restore NPAPI plugin support which was removed in 2.32.0 This update was imported from the SUSE:SLE-15-SP2:Update update project. Patch Instructions: To install this openSUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 15.2: zypper in -t patch openSUSE-2021-637=1 Package List: - openSUSE Leap 15.2 (i586 x86_64): libjavascriptcoregtk-4_0-18-2.32.0-lp152.2.13.1 libjavascriptcoregtk-4_0-18-debuginfo-2.32.0-lp152.2.13.1 libwebkit2gtk-4_0-37-2.32.0-lp152.2.13.1 libwebkit2gtk-4_0-37-debuginfo-2.32.0-lp152.2.13.1 typelib-1_0-JavaScriptCore-4_0-2.32.0-lp152.2.13.1 typelib-1_0-WebKit2-4_0-2.32.0-lp152.2.13.1 typelib-1_0-WebKit2WebExtension-4_0-2.32.0-lp152.2.13.1 webkit-jsc-4-2.32.0-lp152.2.13.1 webkit-jsc-4-debuginfo-2.32.0-lp152.2.13.1 webkit2gtk-4_0-injected-bundles-2.32.0-lp152.2.13.1 webkit2gtk-4_0-injected-bundles-debuginfo-2.32.0-lp152.2.13.1 webkit2gtk3-debugsource-2.32.0-lp152.2.13.1 webkit2gtk3-devel-2.32.0-lp152.2.13.1 webkit2gtk3-minibrowser-2.32.0-lp152.2.13.1 webkit2gtk3-minibrowser-debuginfo-2.32.0-lp152.2.13.1 - openSUSE Leap 15.2 (x86_64): libjavascriptcoregtk-4_0-18-32bit-2.32.0-lp152.2.13.1 libjavascriptcoregtk-4_0-18-32bit-debuginfo-2.32.0-lp152.2.13.1 libwebkit2gtk-4_0-37-32bit-2.32.0-lp152.2.13.1 libwebkit2gtk-4_0-37-32bit-debuginfo-2.32.0-lp152.2.13.1 - openSUSE Leap 15.2 (noarch): libwebkit2gtk3-lang-2.32.0-lp152.2.13.1 References: https://www.suse.com/security/cve/CVE-2020-27918.html https://www.suse.com/security/cve/CVE-2020-29623.html https://www.suse.com/security/cve/CVE-2021-1765.html https://www.suse.com/security/cve/CVE-2021-1788.html https://www.suse.com/security/cve/CVE-2021-1789.html https://www.suse.com/security/cve/CVE-2021-1799.html https://www.suse.com/security/cve/CVE-2021-1801.html https://www.suse.com/security/cve/CVE-2021-1844.html https://www.suse.com/security/cve/CVE-2021-1870.html https://www.suse.com/security/cve/CVE-2021-1871.html https://bugzilla.suse.com/1182719 https://bugzilla.suse.com/1184155 https://bugzilla.suse.com/1184262

1 0

openSUSE-RU-2021:0633-1: important: Recommended update for libcap
by maintenance＠opensuse.org 01 May '21

01 May '21

openSUSE Recommended Update: Recommended update for libcap ______________________________________________________________________________ Announcement ID: openSUSE-RU-2021:0633-1 Rating: important References: #1184690 Affected Products: openSUSE Leap 15.2 ______________________________________________________________________________ An update that has one recommended fix can now be installed. Description: This update for libcap fixes the following issues: - Add explicit dependency on 'libcap2' with version to 'libcap-progs' and 'pam_cap'. (bsc#1184690) This update was imported from the SUSE:SLE-15:Update update project. Patch Instructions: To install this openSUSE Recommended Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 15.2: zypper in -t patch openSUSE-2021-633=1 Package List: - openSUSE Leap 15.2 (i586 x86_64): libcap-debugsource-2.26-lp152.5.6.1 libcap-devel-2.26-lp152.5.6.1 libcap-progs-2.26-lp152.5.6.1 libcap-progs-debuginfo-2.26-lp152.5.6.1 libcap2-2.26-lp152.5.6.1 libcap2-debuginfo-2.26-lp152.5.6.1 pam_cap-2.26-lp152.5.6.1 pam_cap-debuginfo-2.26-lp152.5.6.1 - openSUSE Leap 15.2 (x86_64): libcap2-32bit-2.26-lp152.5.6.1 libcap2-32bit-debuginfo-2.26-lp152.5.6.1 pam_cap-32bit-2.26-lp152.5.6.1 pam_cap-32bit-debuginfo-2.26-lp152.5.6.1 References: https://bugzilla.suse.com/1184690

1 0

openSUSE-SU-2021:0630-1: important: Security update for virtualbox
by opensuse-security＠opensuse.org 01 May '21

01 May '21

openSUSE Security Update: Security update for virtualbox ______________________________________________________________________________ Announcement ID: openSUSE-SU-2021:0630-1 Rating: important References: #1181197 #1181198 #1183125 #1183329 #1184542 Cross-References: CVE-2021-2074 CVE-2021-2129 CVE-2021-2264 CVSS scores: CVE-2021-2074 (NVD) : 8.2 CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H CVE-2021-2129 (NVD) : 7.9 CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:N CVE-2021-2264 (NVD) : 8.4 CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:N Affected Products: openSUSE Leap 15.2 ______________________________________________________________________________ An update that solves three vulnerabilities and has two fixes is now available. Description: This update for virtualbox fixes the following issues: - Version bump to 6.1.20 (released April 20 2021 by Oracle) Fixes boo#1183329 "virtualbox 6.1.18 crashes when it runs nested VM" Fixes boo#1183125 "Leap 15.3 installation in Virtualbox without VBox integration" Fixes CVE-2021-2264 and boo#1184542. The directory for the <user>.start files for autostarting VMs is moved from /etc/vbox to /etc/vbox/autostart.d. In addition, the autostart service is hardened (by Oracle). - change the modalias for guest-tools and guest-x11 to get them to autoinstall. - Own %{_sysconfdir}/X11/xinit/xinitrc.d as default packages (eg systemd) no longer do so, breaking package build. - Update fixes_for_leap15.3 for kernel API changes between 5.3.18-45 and 5.3.18-47. - update-extpack.sh: explicitly use https:// protocol for authenticity. The http:// URL is currently redirected to https:// but don't rely on this. - Add code to generate guest modules for Leap 15.2 and Leap 15.3. The kernel versions do not allow window resizing. Files "virtualbox-kmp-files-leap" and "vboxguestconfig.sh" are added - Fixes CVE-2021-2074, boo#1181197 and CVE-2021-2129, boo#1181198. - Under some circumstances, shared folders are mounted as root. Patch Instructions: To install this openSUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 15.2: zypper in -t patch openSUSE-2021-630=1 Package List: - openSUSE Leap 15.2 (noarch): virtualbox-guest-desktop-icons-6.1.20-lp152.2.21.1 virtualbox-guest-source-6.1.20-lp152.2.21.1 virtualbox-host-source-6.1.20-lp152.2.21.1 - openSUSE Leap 15.2 (x86_64): python3-virtualbox-6.1.20-lp152.2.21.1 python3-virtualbox-debuginfo-6.1.20-lp152.2.21.1 virtualbox-6.1.20-lp152.2.21.1 virtualbox-debuginfo-6.1.20-lp152.2.21.1 virtualbox-debugsource-6.1.20-lp152.2.21.1 virtualbox-devel-6.1.20-lp152.2.21.1 virtualbox-guest-tools-6.1.20-lp152.2.21.1 virtualbox-guest-tools-debuginfo-6.1.20-lp152.2.21.1 virtualbox-guest-x11-6.1.20-lp152.2.21.1 virtualbox-guest-x11-debuginfo-6.1.20-lp152.2.21.1 virtualbox-kmp-debugsource-6.1.20-lp152.2.21.1 virtualbox-kmp-default-6.1.20_k5.3.18_lp152.72-lp152.2.21.1 virtualbox-kmp-default-debuginfo-6.1.20_k5.3.18_lp152.72-lp152.2.21.1 virtualbox-kmp-preempt-6.1.20_k5.3.18_lp152.72-lp152.2.21.1 virtualbox-kmp-preempt-debuginfo-6.1.20_k5.3.18_lp152.72-lp152.2.21.1 virtualbox-qt-6.1.20-lp152.2.21.1 virtualbox-qt-debuginfo-6.1.20-lp152.2.21.1 virtualbox-vnc-6.1.20-lp152.2.21.1 virtualbox-websrv-6.1.20-lp152.2.21.1 virtualbox-websrv-debuginfo-6.1.20-lp152.2.21.1 References: https://www.suse.com/security/cve/CVE-2021-2074.html https://www.suse.com/security/cve/CVE-2021-2129.html https://www.suse.com/security/cve/CVE-2021-2264.html https://bugzilla.suse.com/1181197 https://bugzilla.suse.com/1181198 https://bugzilla.suse.com/1183125 https://bugzilla.suse.com/1183329 https://bugzilla.suse.com/1184542

1 0

openSUSE-SU-2021:0635-1: important: Security update for libnettle
by opensuse-security＠opensuse.org 01 May '21

01 May '21

openSUSE Security Update: Security update for libnettle ______________________________________________________________________________ Announcement ID: openSUSE-SU-2021:0635-1 Rating: important References: #1184401 Cross-References: CVE-2021-20305 CVSS scores: CVE-2021-20305 (NVD) : 8.1 CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H CVE-2021-20305 (SUSE): 8.1 CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H Affected Products: openSUSE Leap 15.2 ______________________________________________________________________________ An update that fixes one vulnerability is now available. Description: This update for libnettle fixes the following issues: - CVE-2021-20305: Fixed the multiply function which was being called with out-of-range scalars (bsc#1184401). This update was imported from the SUSE:SLE-15:Update update project. Patch Instructions: To install this openSUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 15.2: zypper in -t patch openSUSE-2021-635=1 Package List: - openSUSE Leap 15.2 (i586 x86_64): libhogweed4-3.4.1-lp152.4.3.1 libhogweed4-debuginfo-3.4.1-lp152.4.3.1 libnettle-debugsource-3.4.1-lp152.4.3.1 libnettle-devel-3.4.1-lp152.4.3.1 libnettle6-3.4.1-lp152.4.3.1 libnettle6-debuginfo-3.4.1-lp152.4.3.1 nettle-3.4.1-lp152.4.3.1 nettle-debuginfo-3.4.1-lp152.4.3.1 - openSUSE Leap 15.2 (x86_64): libhogweed4-32bit-3.4.1-lp152.4.3.1 libhogweed4-32bit-debuginfo-3.4.1-lp152.4.3.1 libnettle-devel-32bit-3.4.1-lp152.4.3.1 libnettle6-32bit-3.4.1-lp152.4.3.1 libnettle6-32bit-debuginfo-3.4.1-lp152.4.3.1 References: https://www.suse.com/security/cve/CVE-2021-20305.html https://bugzilla.suse.com/1184401

1 0

openSUSE-SU-2021:0634-1: important: Security update for librsvg
by opensuse-security＠opensuse.org 01 May '21

01 May '21

openSUSE Security Update: Security update for librsvg ______________________________________________________________________________ Announcement ID: openSUSE-SU-2021:0634-1 Rating: important References: #1183403 Cross-References: CVE-2021-25900 CVSS scores: CVE-2021-25900 (NVD) : 9.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H Affected Products: openSUSE Leap 15.2 ______________________________________________________________________________ An update that fixes one vulnerability is now available. Description: This update for librsvg fixes the following issues: - librsvg was updated to 2.46.5: * Update dependent crates that had security vulnerabilities: smallvec to 0.6.14 - RUSTSEC-2018-0003 - CVE-2021-25900 (bsc#1183403) This update was imported from the SUSE:SLE-15-SP2:Update update project. Patch Instructions: To install this openSUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 15.2: zypper in -t patch openSUSE-2021-634=1 Package List: - openSUSE Leap 15.2 (i586 x86_64): gdk-pixbuf-loader-rsvg-2.46.5-lp152.2.3.1 gdk-pixbuf-loader-rsvg-debuginfo-2.46.5-lp152.2.3.1 librsvg-2-2-2.46.5-lp152.2.3.1 librsvg-2-2-debuginfo-2.46.5-lp152.2.3.1 librsvg-debugsource-2.46.5-lp152.2.3.1 librsvg-devel-2.46.5-lp152.2.3.1 rsvg-convert-2.46.5-lp152.2.3.1 rsvg-convert-debuginfo-2.46.5-lp152.2.3.1 typelib-1_0-Rsvg-2_0-2.46.5-lp152.2.3.1 - openSUSE Leap 15.2 (noarch): librsvg-lang-2.46.5-lp152.2.3.1 rsvg-thumbnailer-2.46.5-lp152.2.3.1 - openSUSE Leap 15.2 (x86_64): gdk-pixbuf-loader-rsvg-32bit-2.46.5-lp152.2.3.1 gdk-pixbuf-loader-rsvg-32bit-debuginfo-2.46.5-lp152.2.3.1 librsvg-2-2-32bit-2.46.5-lp152.2.3.1 librsvg-2-2-32bit-debuginfo-2.46.5-lp152.2.3.1 References: https://www.suse.com/security/cve/CVE-2021-25900.html https://bugzilla.suse.com/1183403

1 0

openSUSE-RU-2021:0631-1: important: Recommended update for hawk2
by maintenance＠opensuse.org 01 May '21

01 May '21

openSUSE Recommended Update: Recommended update for hawk2 ______________________________________________________________________________ Announcement ID: openSUSE-RU-2021:0631-1 Rating: important References: #1184274 Affected Products: openSUSE Leap 15.2 ______________________________________________________________________________ An update that has one recommended fix can now be installed. Description: This update for hawk2 fixes the following issue: Update to version 2.6.4: - Fix the wizards User Interface and show it.(bsc#1184274) This update was imported from the SUSE:SLE-15:Update update project. Patch Instructions: To install this openSUSE Recommended Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 15.2: zypper in -t patch openSUSE-2021-631=1 Package List: - openSUSE Leap 15.2 (x86_64): hawk2-2.6.4+git.1618478653.7272e6b6-lp152.2.21.1 hawk2-debuginfo-2.6.4+git.1618478653.7272e6b6-lp152.2.21.1 hawk2-debugsource-2.6.4+git.1618478653.7272e6b6-lp152.2.21.1 References: https://bugzilla.suse.com/1184274

1 0

openSUSE-SU-2021:0632-1: important: Security update for gsoap
by opensuse-security＠opensuse.org 01 May '21

01 May '21

openSUSE Security Update: Security update for gsoap ______________________________________________________________________________ Announcement ID: openSUSE-SU-2021:0632-1 Rating: important References: #1182098 Cross-References: CVE-2020-13576 CVSS scores: CVE-2020-13576 (NVD) : 9.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H Affected Products: openSUSE Leap 15.2 ______________________________________________________________________________ An update that fixes one vulnerability is now available. Description: This update for gsoap fixes the following issues: - CVE-2020-13576: Fixed a remote code execution via specially crafted SOAP request inside the WS-Addressing plugin (boo#1182098) Patch Instructions: To install this openSUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 15.2: zypper in -t patch openSUSE-2021-632=1 Package List: - openSUSE Leap 15.2 (x86_64): gsoap-debuginfo-2.8.102-lp152.2.3.1 gsoap-debugsource-2.8.102-lp152.2.3.1 gsoap-devel-2.8.102-lp152.2.3.1 gsoap-devel-debuginfo-2.8.102-lp152.2.3.1 libgsoap-2_8_102-2.8.102-lp152.2.3.1 libgsoap-2_8_102-debuginfo-2.8.102-lp152.2.3.1 - openSUSE Leap 15.2 (noarch): gsoap-doc-2.8.102-lp152.2.3.1 References: https://www.suse.com/security/cve/CVE-2020-13576.html https://bugzilla.suse.com/1182098

1 0

openSUSE-RU-2021:0642-1: moderate: Recommended update for librepo
by maintenance＠opensuse.org 01 May '21

01 May '21

openSUSE Recommended Update: Recommended update for librepo ______________________________________________________________________________ Announcement ID: openSUSE-RU-2021:0642-1 Rating: moderate References: Affected Products: openSUSE Leap 15.2 ______________________________________________________________________________ An update that has 0 recommended fixes can now be installed. Description: This update for librepo fixes the following issues: - Updated librepo to version 1.13.0 * Dropped support for python2 * Fixed a memory leak * Support was added for pkcs11 certificate and key for repository authorization * Fixed a bug where the cpu consumption went up to 100% * Added support when working with certificates used in combination with a proxy This update was imported from the SUSE:SLE-15-SP2:Update update project. Patch Instructions: To install this openSUSE Recommended Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 15.2: zypper in -t patch openSUSE-2021-642=1 Package List: - openSUSE Leap 15.2 (i586 x86_64): librepo-debuginfo-1.13.0-lp152.2.9.1 librepo-debugsource-1.13.0-lp152.2.9.1 librepo-devel-1.13.0-lp152.2.9.1 librepo0-1.13.0-lp152.2.9.1 librepo0-debuginfo-1.13.0-lp152.2.9.1 python3-librepo-1.13.0-lp152.2.9.1 python3-librepo-debuginfo-1.13.0-lp152.2.9.1 References:

1 0

openSUSE-SU-2021:0638-1: important: Security update for cups
by opensuse-security＠opensuse.org 01 May '21

01 May '21

openSUSE Security Update: Security update for cups ______________________________________________________________________________ Announcement ID: openSUSE-SU-2021:0638-1 Rating: important References: #1184161 Cross-References: CVE-2021-25317 CVSS scores: CVE-2021-25317 (SUSE): 5.3 CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L Affected Products: openSUSE Leap 15.2 ______________________________________________________________________________ An update that fixes one vulnerability is now available. Description: This update for cups fixes the following issues: - CVE-2021-25317: ownership of /var/log/cups could allow privilege escalation from lp user to root via symlink attacks (bsc#1184161) This update was imported from the SUSE:SLE-15:Update update project. Patch Instructions: To install this openSUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 15.2: zypper in -t patch openSUSE-2021-638=1 Package List: - openSUSE Leap 15.2 (i586 x86_64): cups-2.2.7-lp152.9.9.1 cups-client-2.2.7-lp152.9.9.1 cups-client-debuginfo-2.2.7-lp152.9.9.1 cups-config-2.2.7-lp152.9.9.1 cups-ddk-2.2.7-lp152.9.9.1 cups-ddk-debuginfo-2.2.7-lp152.9.9.1 cups-debuginfo-2.2.7-lp152.9.9.1 cups-debugsource-2.2.7-lp152.9.9.1 cups-devel-2.2.7-lp152.9.9.1 libcups2-2.2.7-lp152.9.9.1 libcups2-debuginfo-2.2.7-lp152.9.9.1 libcupscgi1-2.2.7-lp152.9.9.1 libcupscgi1-debuginfo-2.2.7-lp152.9.9.1 libcupsimage2-2.2.7-lp152.9.9.1 libcupsimage2-debuginfo-2.2.7-lp152.9.9.1 libcupsmime1-2.2.7-lp152.9.9.1 libcupsmime1-debuginfo-2.2.7-lp152.9.9.1 libcupsppdc1-2.2.7-lp152.9.9.1 libcupsppdc1-debuginfo-2.2.7-lp152.9.9.1 - openSUSE Leap 15.2 (x86_64): cups-devel-32bit-2.2.7-lp152.9.9.1 libcups2-32bit-2.2.7-lp152.9.9.1 libcups2-32bit-debuginfo-2.2.7-lp152.9.9.1 libcupscgi1-32bit-2.2.7-lp152.9.9.1 libcupscgi1-32bit-debuginfo-2.2.7-lp152.9.9.1 libcupsimage2-32bit-2.2.7-lp152.9.9.1 libcupsimage2-32bit-debuginfo-2.2.7-lp152.9.9.1 libcupsmime1-32bit-2.2.7-lp152.9.9.1 libcupsmime1-32bit-debuginfo-2.2.7-lp152.9.9.1 libcupsppdc1-32bit-2.2.7-lp152.9.9.1 libcupsppdc1-32bit-debuginfo-2.2.7-lp152.9.9.1 References: https://www.suse.com/security/cve/CVE-2021-25317.html https://bugzilla.suse.com/1184161

1 0