May 2021 - openSUSE Updates - openSUSE Mailing Lists

openSUSE-RU-2021:0701-1: moderate: Recommended update for kexec-tools
by maintenance＠opensuse.org 10 May '21

10 May '21

openSUSE Recommended Update: Recommended update for kexec-tools ______________________________________________________________________________ Announcement ID: openSUSE-RU-2021:0701-1 Rating: moderate References: #1185020 Affected Products: openSUSE Leap 15.2 ______________________________________________________________________________ An update that has one recommended fix can now be installed. Description: This update for kexec-tools fixes the following issue: - Hardening: link as Position-Independent Executable PIE (bsc#1185020). This update was imported from the SUSE:SLE-15-SP2:Update update project. Patch Instructions: To install this openSUSE Recommended Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 15.2: zypper in -t patch openSUSE-2021-701=1 Package List: - openSUSE Leap 15.2 (i586 x86_64): kexec-tools-2.0.20-lp152.4.6.1 kexec-tools-debuginfo-2.0.20-lp152.4.6.1 kexec-tools-debugsource-2.0.20-lp152.4.6.1 References: https://bugzilla.suse.com/1185020

1 0

openSUSE-RU-2021:0697-1: moderate: Recommended update for saphanabootstrap-formula
by maintenance＠opensuse.org 09 May '21

09 May '21

openSUSE Recommended Update: Recommended update for saphanabootstrap-formula ______________________________________________________________________________ Announcement ID: openSUSE-RU-2021:0697-1 Rating: moderate References: #1185090 Affected Products: openSUSE Leap 15.2 ______________________________________________________________________________ An update that has one recommended fix can now be installed. Description: This update for saphanabootstrap-formula fixes the following issues: - Fix the HANA sidadm usage to transform to lowercase some states managing the sudoers file in ha_cluster.sls state file. (bsc#1185090) This update was imported from the SUSE:SLE-15:Update update project. Patch Instructions: To install this openSUSE Recommended Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 15.2: zypper in -t patch openSUSE-2021-697=1 Package List: - openSUSE Leap 15.2 (noarch): saphanabootstrap-formula-0.7.1+git.1619008686.8600866-lp152.2.12.1 References: https://bugzilla.suse.com/1185090

1 0

openSUSE-RU-2021:0696-1: moderate: Recommended update for kimageformats
by maintenance＠opensuse.org 09 May '21

09 May '21

openSUSE Recommended Update: Recommended update for kimageformats ______________________________________________________________________________ Announcement ID: openSUSE-RU-2021:0696-1 Rating: moderate References: Affected Products: openSUSE Backports SLE-15-SP2 ______________________________________________________________________________ An update that has 0 recommended fixes can now be installed. Description: This update for kimageformats fixes the following issues: - Add patch to fix OOB write (oss-fuzz#33742): This update was imported from the openSUSE:Leap:15.2:Update update project. Patch Instructions: To install this openSUSE Recommended Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Backports SLE-15-SP2: zypper in -t patch openSUSE-2021-696=1 Package List: - openSUSE Backports SLE-15-SP2 (aarch64 ppc64le s390x x86_64): kimageformats-5.71.0-bp152.2.3.1 kimageformats-eps-5.71.0-bp152.2.3.1 - openSUSE Backports SLE-15-SP2 (aarch64_ilp32): kimageformats-64bit-5.71.0-bp152.2.3.1 References:

1 0

openSUSE-SU-2021:0695-1: moderate: Security update for alpine
by opensuse-security＠opensuse.org 09 May '21

09 May '21

openSUSE Security Update: Security update for alpine ______________________________________________________________________________ Announcement ID: openSUSE-SU-2021:0695-1 Rating: moderate References: #1173281 Cross-References: CVE-2020-14929 CVSS scores: CVE-2020-14929 (NVD) : 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N CVE-2020-14929 (SUSE): 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N Affected Products: openSUSE Backports SLE-15-SP2 ______________________________________________________________________________ An update that fixes one vulnerability is now available. Description: This update for alpine fixes the following issues: Update to release 2.24 * A few crash fixes * Implementation of XOAUTH2 for Yahoo! Mail. Update to release 2.23.2 * Expansion of the configuration screen for XOAUTH2 to include username, and tenant. * Alpine uses the domain in the From: header of a message to generate a message-id and suppresses all information about Alpine, version, revision, and time of generation of the message-id from this header. * Alpine does not generate Sender or X-X-Sender by default by enabling [X] Disable Sender as the default. * Alpine does not disclose User Agent by default by enabling [X] Suppress User Agent by default. * When messages are selected, pressing the ';' command to broaden or narrow a search, now offers the possibility to completely replace the search, and is almost equivalent to being a shortcut to "unselect all messages, and select again". Update to release 2.23 * Fixes boo#1173281, CVE-2020-14929: Alpine silently proceeds to use an insecure connection after a /tls is sent in certain circumstances. * Implementation of XOAUTH2 authentication support for Outlook. * Add support for the OAUTHBEARER authentication method in Gmail. * Support for the SASL-IR IMAP extension. * Alpine can pass an HTML message to an external web browser, by using the "External" command in the ATTACHMENT INDEX screen. Update to release 2.22 * Support for XOAUTH2 authentication method in Gmail. * NTLM authentication support with the ntlm library. * Added the "/tls1_3" flag for servers that support it. * Add the "g" option to the select command that works in IMAP servers that implement the X-GM-EXT-1 capability (such as the one offered by Gmail). * Added "/auth=XYZ" to the way to define a server. This allows users to select the method to authenticate to an IMAP, SMTP or POP3 server. Examples are /auth=plain, or /auth=gssapi, etc. * When a message is of type multipart/mixed, and its first part is multipart/signed, Alpine will include the text of the original message in a reply message, instead of including a multipart attachment. * Added backward search in the index screen. * pico: Add -dict option to Pico, which allows users to choose a dictionary when spelling. - Drop /usr/bin/mailutil, it is not built by default anymore. * Added Quota subcommands for printing, forwarding, saving, etc. This update was imported from the openSUSE:Leap:15.2:Update update project. Patch Instructions: To install this openSUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Backports SLE-15-SP2: zypper in -t patch openSUSE-2021-695=1 Package List: - openSUSE Backports SLE-15-SP2 (aarch64 ppc64le s390x x86_64): alpine-2.24-bp152.4.3.1 pico-5.07-bp152.4.3.1 pilot-2.99-bp152.4.3.1 References: https://www.suse.com/security/cve/CVE-2020-14929.html https://bugzilla.suse.com/1173281

1 0

openSUSE-SU-2021:0694-1: moderate: Security update for avahi
by opensuse-security＠opensuse.org 09 May '21

09 May '21

openSUSE Security Update: Security update for avahi ______________________________________________________________________________ Announcement ID: openSUSE-SU-2021:0694-1 Rating: moderate References: #1184521 Cross-References: CVE-2021-3468 CVSS scores: CVE-2021-3468 (SUSE): 6.2 CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H Affected Products: openSUSE Leap 15.2 ______________________________________________________________________________ An update that fixes one vulnerability is now available. Description: This update for avahi fixes the following issues: - CVE-2021-3468: avoid infinite loop by handling HUP event in client_work (bsc#1184521). This update was imported from the SUSE:SLE-15-SP1:Update update project. Patch Instructions: To install this openSUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 15.2: zypper in -t patch openSUSE-2021-694=1 Package List: - openSUSE Leap 15.2 (i586 x86_64): avahi-0.7-lp152.3.9.1 avahi-autoipd-0.7-lp152.3.9.1 avahi-autoipd-debuginfo-0.7-lp152.3.9.1 avahi-compat-howl-devel-0.7-lp152.3.9.1 avahi-compat-mDNSResponder-devel-0.7-lp152.3.9.1 avahi-debuginfo-0.7-lp152.3.9.1 avahi-debugsource-0.7-lp152.3.9.1 avahi-glib2-debugsource-0.7-lp152.3.9.1 avahi-utils-0.7-lp152.3.9.1 avahi-utils-debuginfo-0.7-lp152.3.9.1 avahi-utils-gtk-0.7-lp152.3.9.1 avahi-utils-gtk-debuginfo-0.7-lp152.3.9.1 libavahi-client3-0.7-lp152.3.9.1 libavahi-client3-debuginfo-0.7-lp152.3.9.1 libavahi-common3-0.7-lp152.3.9.1 libavahi-common3-debuginfo-0.7-lp152.3.9.1 libavahi-core7-0.7-lp152.3.9.1 libavahi-core7-debuginfo-0.7-lp152.3.9.1 libavahi-devel-0.7-lp152.3.9.1 libavahi-glib-devel-0.7-lp152.3.9.1 libavahi-glib1-0.7-lp152.3.9.1 libavahi-glib1-debuginfo-0.7-lp152.3.9.1 libavahi-gobject-devel-0.7-lp152.3.9.1 libavahi-gobject0-0.7-lp152.3.9.1 libavahi-gobject0-debuginfo-0.7-lp152.3.9.1 libavahi-ui-gtk3-0-0.7-lp152.3.9.1 libavahi-ui-gtk3-0-debuginfo-0.7-lp152.3.9.1 libavahi-ui0-0.7-lp152.3.9.1 libavahi-ui0-debuginfo-0.7-lp152.3.9.1 libdns_sd-0.7-lp152.3.9.1 libdns_sd-debuginfo-0.7-lp152.3.9.1 libhowl0-0.7-lp152.3.9.1 libhowl0-debuginfo-0.7-lp152.3.9.1 python3-avahi-0.7-lp152.3.9.1 python3-avahi-gtk-0.7-lp152.3.9.1 typelib-1_0-Avahi-0_6-0.7-lp152.3.9.1 - openSUSE Leap 15.2 (x86_64): avahi-32bit-debuginfo-0.7-lp152.3.9.1 avahi-mono-0.7-lp152.3.9.1 avahi-qt4-debugsource-0.7-lp152.3.9.1 libavahi-client3-32bit-0.7-lp152.3.9.1 libavahi-client3-32bit-debuginfo-0.7-lp152.3.9.1 libavahi-common3-32bit-0.7-lp152.3.9.1 libavahi-common3-32bit-debuginfo-0.7-lp152.3.9.1 libavahi-glib1-32bit-0.7-lp152.3.9.1 libavahi-glib1-32bit-debuginfo-0.7-lp152.3.9.1 libavahi-qt4-1-0.7-lp152.3.9.1 libavahi-qt4-1-debuginfo-0.7-lp152.3.9.1 libavahi-qt4-devel-0.7-lp152.3.9.1 libdns_sd-32bit-0.7-lp152.3.9.1 libdns_sd-32bit-debuginfo-0.7-lp152.3.9.1 - openSUSE Leap 15.2 (noarch): avahi-lang-0.7-lp152.3.9.1 References: https://www.suse.com/security/cve/CVE-2021-3468.html https://bugzilla.suse.com/1184521

1 0

openSUSE-RU-2021:0693-1: moderate: Recommended update for open-iscsi
by maintenance＠opensuse.org 09 May '21

09 May '21

openSUSE Recommended Update: Recommended update for open-iscsi ______________________________________________________________________________ Announcement ID: openSUSE-RU-2021:0693-1 Rating: moderate References: #1179908 #1183421 Affected Products: openSUSE Leap 15.2 ______________________________________________________________________________ An update that fixes four vulnerabilities is now available. Description: This update for open-iscsi fixes the following issues: - Enabled asynchronous logins for iscsi.service (bsc#1183421) - Fixed a login issue when target is delayed This update was imported from the SUSE:SLE-15-SP2:Update update project. Patch Instructions: To install this openSUSE Recommended Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 15.2: zypper in -t patch openSUSE-2021-693=1 Package List: - openSUSE Leap 15.2 (i586 x86_64): iscsiuio-0.7.8.6-lp152.18.12.1 iscsiuio-debuginfo-0.7.8.6-lp152.18.12.1 libopeniscsiusr0_2_0-2.1.4-lp152.18.12.1 libopeniscsiusr0_2_0-debuginfo-2.1.4-lp152.18.12.1 open-iscsi-2.1.4-lp152.18.12.1 open-iscsi-debuginfo-2.1.4-lp152.18.12.1 open-iscsi-debugsource-2.1.4-lp152.18.12.1 open-iscsi-devel-2.1.4-lp152.18.12.1 References: https://www.suse.com/security/cve/CVE-2020-13987.html https://www.suse.com/security/cve/CVE-2020-13988.html https://www.suse.com/security/cve/CVE-2020-17437.html https://www.suse.com/security/cve/CVE-2020-17438.html https://bugzilla.suse.com/1179908 https://bugzilla.suse.com/1183421

1 0

openSUSE-SU-2021:0692-1: moderate: Security update for libxml2
by opensuse-security＠opensuse.org 09 May '21

09 May '21

openSUSE Security Update: Security update for libxml2 ______________________________________________________________________________ Announcement ID: openSUSE-SU-2021:0692-1 Rating: moderate References: #1185408 #1185409 #1185410 Cross-References: CVE-2021-3516 CVE-2021-3517 CVE-2021-3518 CVSS scores: CVE-2021-3516 (SUSE): 5.9 CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H CVE-2021-3517 (SUSE): 5.9 CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H CVE-2021-3518 (SUSE): 5.9 CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H Affected Products: openSUSE Leap 15.2 ______________________________________________________________________________ An update that fixes three vulnerabilities is now available. Description: This update for libxml2 fixes the following issues: - CVE-2021-3518: Fixed a use after free in xinclude.c:xmlXIncludeDoProcess (bsc#1185408). - CVE-2021-3517: Fixed a heap based buffer overflow in entities.c:xmlEncodeEntitiesInternal (bsc#1185410). - CVE-2021-3516: Fixed a use after free in entities.c:xmlEncodeEntitiesInternal (bsc#1185409). This update was imported from the SUSE:SLE-15:Update update project. Patch Instructions: To install this openSUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 15.2: zypper in -t patch openSUSE-2021-692=1 Package List: - openSUSE Leap 15.2 (i586 x86_64): libxml2-2-2.9.7-lp152.10.9.1 libxml2-2-debuginfo-2.9.7-lp152.10.9.1 libxml2-debugsource-2.9.7-lp152.10.9.1 libxml2-devel-2.9.7-lp152.10.9.1 libxml2-tools-2.9.7-lp152.10.9.1 libxml2-tools-debuginfo-2.9.7-lp152.10.9.1 python-libxml2-python-debugsource-2.9.7-lp152.10.9.1 python2-libxml2-python-2.9.7-lp152.10.9.1 python2-libxml2-python-debuginfo-2.9.7-lp152.10.9.1 python3-libxml2-python-2.9.7-lp152.10.9.1 python3-libxml2-python-debuginfo-2.9.7-lp152.10.9.1 - openSUSE Leap 15.2 (x86_64): libxml2-2-32bit-2.9.7-lp152.10.9.1 libxml2-2-32bit-debuginfo-2.9.7-lp152.10.9.1 libxml2-devel-32bit-2.9.7-lp152.10.9.1 - openSUSE Leap 15.2 (noarch): libxml2-doc-2.9.7-lp152.10.9.1 References: https://www.suse.com/security/cve/CVE-2021-3516.html https://www.suse.com/security/cve/CVE-2021-3517.html https://www.suse.com/security/cve/CVE-2021-3518.html https://bugzilla.suse.com/1185408 https://bugzilla.suse.com/1185409 https://bugzilla.suse.com/1185410

1 0

openSUSE-SU-2021:0691-1: moderate: Security update for vlc
by opensuse-security＠opensuse.org 09 May '21

09 May '21

openSUSE Security Update: Security update for vlc ______________________________________________________________________________ Announcement ID: openSUSE-SU-2021:0691-1 Rating: moderate References: #1181918 Cross-References: CVE-2020-26664 CVSS scores: CVE-2020-26664 (NVD) : 7.8 CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H Affected Products: openSUSE Leap 15.2 ______________________________________________________________________________ An update that fixes one vulnerability is now available. Description: This update for vlc fixes the following issues: Update to version 3.0.13: + Demux: - Adaptive: fix artefacts in HLS streams with wrong profiles/levels - Fix regression on some MP4 files for the audio track - Fix MPGA and ADTS probing in TS files - Fix Flac inside AVI files - Fix VP9/Webm artefacts when seeking + Codec: - Support SSA text scaling - Fix rotation on Android rotation - Fix WebVTT subtitles that start at 00:00 + Access: - Update libnfs to support NFSv4 - Improve SMB2 integration - Fix Blu-ray files using Unicode names on Windows - Disable mcast lookups on Android for RTSP playback + Video Output: Rework the D3D11 rendering wait, to fix choppiness on display + Interfaces: - Fix VLC getting stuck on close on X11 (#21875) - Improve RTL on preferences on macOS - Add mousewheel horizontal axis control - Fix crash on exit on macOS - Fix sizing of the fullscreen controls on macOS + Misc: - Improve MIDI fonts search on Linux - Update Soundcloud, Youtube, liveleak - Fix compilation with GCC11 - Fix input-slave option for subtitles + Updated translations. Update to version 3.0.12: + Access: Add new RIST access module compliant with simple profile (VSF_TR-06-1). + Access Output: Add new RIST access output module compliant with simple profile (VSF_TR-06-1). + Demux: Fixed adaptive's handling of resolution settings. + Audio output: Fix audio distortion on macOS during start of playback. + Video Output: Direct3D11: Fix some potential crashes when using video filters. + Misc: - Several fixes in the web interface, including privacy and security improvements - Update YouTube and Vocaroo scripts. + Updated translations. Patch Instructions: To install this openSUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 15.2: zypper in -t patch openSUSE-2021-691=1 Package List: - openSUSE Leap 15.2 (noarch): vlc-lang-3.0.13-lp152.2.12.1 - openSUSE Leap 15.2 (x86_64): libvlc5-3.0.13-lp152.2.12.1 libvlc5-debuginfo-3.0.13-lp152.2.12.1 libvlccore9-3.0.13-lp152.2.12.1 libvlccore9-debuginfo-3.0.13-lp152.2.12.1 vlc-3.0.13-lp152.2.12.1 vlc-codec-gstreamer-3.0.13-lp152.2.12.1 vlc-codec-gstreamer-debuginfo-3.0.13-lp152.2.12.1 vlc-debuginfo-3.0.13-lp152.2.12.1 vlc-debugsource-3.0.13-lp152.2.12.1 vlc-devel-3.0.13-lp152.2.12.1 vlc-jack-3.0.13-lp152.2.12.1 vlc-jack-debuginfo-3.0.13-lp152.2.12.1 vlc-noX-3.0.13-lp152.2.12.1 vlc-noX-debuginfo-3.0.13-lp152.2.12.1 vlc-opencv-3.0.13-lp152.2.12.1 vlc-opencv-debuginfo-3.0.13-lp152.2.12.1 vlc-qt-3.0.13-lp152.2.12.1 vlc-qt-debuginfo-3.0.13-lp152.2.12.1 vlc-vdpau-3.0.13-lp152.2.12.1 vlc-vdpau-debuginfo-3.0.13-lp152.2.12.1 References: https://www.suse.com/security/cve/CVE-2020-26664.html https://bugzilla.suse.com/1181918

1 0

openSUSE-RU-2021:0689-1: moderate: Recommended update for monitoring-plugins-bind
by maintenance＠opensuse.org 08 May '21

08 May '21

openSUSE Recommended Update: Recommended update for monitoring-plugins-bind ______________________________________________________________________________ Announcement ID: openSUSE-RU-2021:0689-1 Rating: moderate References: #1183201 Affected Products: openSUSE Backports SLE-15-SP1 ______________________________________________________________________________ An update that has one recommended fix can now be installed. Description: This update for monitoring-plugins-bind fixes the following issues: - check_bind.sh uses a static temporary file, allowing users to break the script by creating the same file with permissions that don't allow the nagios user to write to it (boo#1183201). + added monitoring-plugins-bind_-_use_path_tmp.patch Patch Instructions: To install this openSUSE Recommended Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Backports SLE-15-SP1: zypper in -t patch openSUSE-2021-689=1 Package List: - openSUSE Backports SLE-15-SP1 (noarch): monitoring-plugins-bind-1.3-bp151.4.3.1 References: https://bugzilla.suse.com/1183201

1 0

openSUSE-RU-2021:0690-1: moderate: Recommended update for monitoring-plugins-bind
by maintenance＠opensuse.org 08 May '21

08 May '21

openSUSE Recommended Update: Recommended update for monitoring-plugins-bind ______________________________________________________________________________ Announcement ID: openSUSE-RU-2021:0690-1 Rating: moderate References: #1183201 Affected Products: openSUSE Backports SLE-15-SP2 ______________________________________________________________________________ An update that has one recommended fix can now be installed. Description: This update for monitoring-plugins-bind fixes the following issues: - check_bind.sh uses a static temporary file, allowing users to break the script by creating the same file with permissions that don't allow the nagios user to write to it (boo#1183201). + added monitoring-plugins-bind_-_use_path_tmp.patch Patch Instructions: To install this openSUSE Recommended Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Backports SLE-15-SP2: zypper in -t patch openSUSE-2021-690=1 Package List: - openSUSE Backports SLE-15-SP2 (noarch): monitoring-plugins-bind-1.3-bp152.4.3.1 References: https://bugzilla.suse.com/1183201

1 0