May 2021 - openSUSE Updates - openSUSE Mailing Lists

openSUSE-SU-2021:0807-1: moderate: Security update for libX11
by opensuse-security＠opensuse.org 29 May '21

29 May '21

openSUSE Security Update: Security update for libX11 ______________________________________________________________________________ Announcement ID: openSUSE-SU-2021:0807-1 Rating: moderate References: #1182506 Cross-References: CVE-2021-31535 Affected Products: openSUSE Leap 15.2 ______________________________________________________________________________ An update that fixes one vulnerability is now available. Description: This update for libX11 fixes the following issues: - CVE-2021-31535: Fixed missing request length checks in libX11 (bsc#1182506). This update was imported from the SUSE:SLE-15:Update update project. Patch Instructions: To install this openSUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 15.2: zypper in -t patch openSUSE-2021-807=1 Package List: - openSUSE Leap 15.2 (i586 x86_64): libX11-6-1.6.5-lp152.5.15.1 libX11-6-debuginfo-1.6.5-lp152.5.15.1 libX11-debugsource-1.6.5-lp152.5.15.1 libX11-devel-1.6.5-lp152.5.15.1 libX11-xcb1-1.6.5-lp152.5.15.1 libX11-xcb1-debuginfo-1.6.5-lp152.5.15.1 - openSUSE Leap 15.2 (noarch): libX11-data-1.6.5-lp152.5.15.1 - openSUSE Leap 15.2 (x86_64): libX11-6-32bit-1.6.5-lp152.5.15.1 libX11-6-32bit-debuginfo-1.6.5-lp152.5.15.1 libX11-devel-32bit-1.6.5-lp152.5.15.1 libX11-xcb1-32bit-1.6.5-lp152.5.15.1 libX11-xcb1-32bit-debuginfo-1.6.5-lp152.5.15.1 References: https://www.suse.com/security/cve/CVE-2021-31535.html https://bugzilla.suse.com/1182506

1 0

openSUSE-SU-2021:0806-1: moderate: Security update for hivex
by opensuse-security＠opensuse.org 29 May '21

29 May '21

openSUSE Security Update: Security update for hivex ______________________________________________________________________________ Announcement ID: openSUSE-SU-2021:0806-1 Rating: moderate References: #1185013 Cross-References: CVE-2021-3504 CVSS scores: CVE-2021-3504 (NVD) : 5.4 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:L CVE-2021-3504 (SUSE): 5.4 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:L Affected Products: openSUSE Leap 15.2 ______________________________________________________________________________ An update that fixes one vulnerability is now available. Description: This update for hivex fixes the following issues: - CVE-2021-3504: hivex: missing bounds check within hivex_open() (bsc#1185013) This update was imported from the SUSE:SLE-15:Update update project. Patch Instructions: To install this openSUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 15.2: zypper in -t patch openSUSE-2021-806=1 Package List: - openSUSE Leap 15.2 (x86_64): hivex-1.3.14-lp152.4.3.1 hivex-debuginfo-1.3.14-lp152.4.3.1 hivex-debugsource-1.3.14-lp152.4.3.1 hivex-devel-1.3.14-lp152.4.3.1 libhivex0-1.3.14-lp152.4.3.1 libhivex0-debuginfo-1.3.14-lp152.4.3.1 ocaml-hivex-1.3.14-lp152.4.3.1 ocaml-hivex-debuginfo-1.3.14-lp152.4.3.1 ocaml-hivex-devel-1.3.14-lp152.4.3.1 perl-Win-Hivex-1.3.14-lp152.4.3.1 perl-Win-Hivex-debuginfo-1.3.14-lp152.4.3.1 python-hivex-1.3.14-lp152.4.3.1 python-hivex-debuginfo-1.3.14-lp152.4.3.1 - openSUSE Leap 15.2 (noarch): hivex-lang-1.3.14-lp152.4.3.1 References: https://www.suse.com/security/cve/CVE-2021-3504.html https://bugzilla.suse.com/1185013

1 0

openSUSE-SU-2021:0808-1: moderate: Security update for curl
by opensuse-security＠opensuse.org 29 May '21

29 May '21

openSUSE Security Update: Security update for curl ______________________________________________________________________________ Announcement ID: openSUSE-SU-2021:0808-1 Rating: moderate References: #1186114 SLE-17956 Cross-References: CVE-2021-22898 CVSS scores: CVE-2021-22898 (SUSE): 5.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N Affected Products: openSUSE Leap 15.2 ______________________________________________________________________________ An update that fixes one vulnerability, contains one feature is now available. Description: This update for curl fixes the following issues: - CVE-2021-22898: Fixed curl TELNET stack contents disclosure (bsc#1186114). - Allow partial chain verification [jsc#SLE-17956] * Have intermediate certificates in the trust store be treated as trust-anchors, in the same way as self-signed root CA certificates are. This allows users to verify servers using the intermediate cert only, instead of needing the whole chain. * Set FLAG_TRUSTED_FIRST unconditionally. * Do not check partial chains with CRL check. This update was imported from the SUSE:SLE-15-SP2:Update update project. Patch Instructions: To install this openSUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 15.2: zypper in -t patch openSUSE-2021-808=1 Package List: - openSUSE Leap 15.2 (i586 x86_64): curl-7.66.0-lp152.3.18.1 curl-debuginfo-7.66.0-lp152.3.18.1 curl-debugsource-7.66.0-lp152.3.18.1 curl-mini-7.66.0-lp152.3.18.1 curl-mini-debuginfo-7.66.0-lp152.3.18.1 curl-mini-debugsource-7.66.0-lp152.3.18.1 libcurl-devel-7.66.0-lp152.3.18.1 libcurl-mini-devel-7.66.0-lp152.3.18.1 libcurl4-7.66.0-lp152.3.18.1 libcurl4-debuginfo-7.66.0-lp152.3.18.1 libcurl4-mini-7.66.0-lp152.3.18.1 libcurl4-mini-debuginfo-7.66.0-lp152.3.18.1 - openSUSE Leap 15.2 (x86_64): libcurl-devel-32bit-7.66.0-lp152.3.18.1 libcurl4-32bit-7.66.0-lp152.3.18.1 libcurl4-32bit-debuginfo-7.66.0-lp152.3.18.1 References: https://www.suse.com/security/cve/CVE-2021-22898.html https://bugzilla.suse.com/1186114

1 0

openSUSE-RU-2021:0805-1: important: Recommended update for yast2-pkg-bindings
by maintenance＠opensuse.org 29 May '21

29 May '21

openSUSE Recommended Update: Recommended update for yast2-pkg-bindings ______________________________________________________________________________ Announcement ID: openSUSE-RU-2021:0805-1 Rating: important References: #1185240 Affected Products: openSUSE Leap 15.2 ______________________________________________________________________________ An update that has one recommended fix can now be installed. Description: This update for yast2-pkg-bindings fixes the following issues: - Fixes an issue in the self-installer, where sometimes old package versions were downloaded instead of the latest ones (bsc#1185240) This update was imported from the SUSE:SLE-15-SP2:Update update project. Patch Instructions: To install this openSUSE Recommended Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 15.2: zypper in -t patch openSUSE-2021-805=1 Package List: - openSUSE Leap 15.2 (i586 x86_64): yast2-pkg-bindings-4.2.16-lp152.2.13.1 yast2-pkg-bindings-debuginfo-4.2.16-lp152.2.13.1 yast2-pkg-bindings-debugsource-4.2.16-lp152.2.13.1 - openSUSE Leap 15.2 (noarch): yast2-pkg-bindings-devel-doc-4.2.16-lp152.2.13.1 References: https://bugzilla.suse.com/1185240

1 0

openSUSE-RU-2021:0804-1: moderate: Recommended update for coccinelle
by maintenance＠opensuse.org 28 May '21

28 May '21

openSUSE Recommended Update: Recommended update for coccinelle ______________________________________________________________________________ Announcement ID: openSUSE-RU-2021:0804-1 Rating: moderate References: #1184563 Affected Products: openSUSE Leap 15.2 ______________________________________________________________________________ An update that has one recommended fix can now be installed. Description: This update for coccinelle fixes the following issues: - Add wrapper script to set COCCINELLE_HOME [boo#1184563] Patch Instructions: To install this openSUSE Recommended Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 15.2: zypper in -t patch openSUSE-2021-804=1 Package List: - openSUSE Leap 15.2 (x86_64): coccinelle-1.0.8-lp152.2.3.1 References: https://bugzilla.suse.com/1184563

1 0

openSUSE-RU-2021:0802-1: moderate: Recommended update for discord
by maintenance＠opensuse.org 28 May '21

28 May '21

openSUSE Recommended Update: Recommended update for discord ______________________________________________________________________________ Announcement ID: openSUSE-RU-2021:0802-1 Rating: moderate References: Affected Products: openSUSE Leap 15.2:NonFree ______________________________________________________________________________ An update that has 0 recommended fixes can now be installed. Description: This update for discord fixes the following issues: discord was updated to 0.0.15. Patch Instructions: To install this openSUSE Recommended Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 15.2:NonFree: zypper in -t patch openSUSE-2021-802=1 Package List: - openSUSE Leap 15.2:NonFree (x86_64): discord-0.0.15-lp152.3.3.1 discord-debuginfo-0.0.15-lp152.3.3.1 References:

1 0

openSUSE-RU-2021:0803-1: moderate: Recommended update for fwts
by maintenance＠opensuse.org 28 May '21

28 May '21

openSUSE Recommended Update: Recommended update for fwts ______________________________________________________________________________ Announcement ID: openSUSE-RU-2021:0803-1 Rating: moderate References: Affected Products: openSUSE Leap 15.2 openSUSE Backports SLE-15-SP2 openSUSE Backports SLE-15-SP1 ______________________________________________________________________________ An update that has 0 recommended fixes can now be installed. Description: This update for fwts fixes the following issues: Update to version 21.05.00: * lib: fwts_version.h - update to V21.05.00 * debian: update changelog * auto-packager:mkpackage.sh: add impish * fwts-test: sync up with dbgp changes * acpi: dbgp/spmi: check space ids by fwts_acpi_space_id * acpiinfo: update ACPI 6.4 vs. ACPICA versions * lib: acpi: fix incorrect actual vs. struct length outputs * acpi: shorten helper function names by removing "check" * lib: acpi: unify naming style by removing "ACPI" * fwts-test: sync up with PMTT refactoring changes * acpi: refactor length check by fwts_acpi_structure_length_check * acpi: refactor zero length by fwts_acpi_structure_length_zero_check Update to version 21.03.00: * uefirtvariable: fix memory leak * acpi: refactor by fwts_acpi_reserved_type_check * acpi: refactor by fwts_acpi_structure_range_check * uefirtauthvar: check variable runtime services supported before testing (LP: #1913351) * uefirtvariable: check variable runtime services supported before testing (LP: #1913351) * uefirtmisc: check misc runtime services supported before testing (LP: #1913351) * uefirttime: check time services supported before testing (LP: #1913351) * acpi: spcr: accept baud rate 0x0 as a preconfigured state * fwts-test: sync up with PMTT rev 2 changes * acpi: pmtt: update PMTT to revision 2 (mantis 1975) Patch Instructions: To install this openSUSE Recommended Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 15.2: zypper in -t patch openSUSE-2021-803=1 - openSUSE Backports SLE-15-SP2: zypper in -t patch openSUSE-2021-803=1 - openSUSE Backports SLE-15-SP1: zypper in -t patch openSUSE-2021-803=1 Package List: - openSUSE Leap 15.2 (x86_64): fwts-21.05.00-lp152.3.12.1 fwts-debuginfo-21.05.00-lp152.3.12.1 fwts-debugsource-21.05.00-lp152.3.12.1 - openSUSE Backports SLE-15-SP2 (aarch64 ppc64le s390x x86_64): fwts-21.05.00-bp152.4.12.1 fwts-debuginfo-21.05.00-bp152.4.12.1 fwts-debugsource-21.05.00-bp152.4.12.1 - openSUSE Backports SLE-15-SP1 (aarch64 ppc64le s390x x86_64): fwts-21.05.00-bp151.4.12.1 References:

1 0

openSUSE-RU-2021:0801-1: moderate: Recommended update for nvme-cli
by maintenance＠opensuse.org 28 May '21

28 May '21

openSUSE Recommended Update: Recommended update for nvme-cli ______________________________________________________________________________ Announcement ID: openSUSE-RU-2021:0801-1 Rating: moderate References: #1179825 Affected Products: openSUSE Leap 15.2 ______________________________________________________________________________ An update that has one recommended fix can now be installed. Description: This update for nvme-cli fixes the following issues: - Lookup existing persistent controllers (bsc#1179825) This update was imported from the SUSE:SLE-15-SP2:Update update project. Patch Instructions: To install this openSUSE Recommended Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 15.2: zypper in -t patch openSUSE-2021-801=1 Package List: - openSUSE Leap 15.2 (x86_64): nvme-cli-1.10-lp152.2.12.1 nvme-cli-debuginfo-1.10-lp152.2.12.1 nvme-cli-debugsource-1.10-lp152.2.12.1 nvme-cli-regress-script-1.10-lp152.2.12.1 References: https://bugzilla.suse.com/1179825

1 0

openSUSE-SU-2021:0799-1: moderate: Security update for libu2f-host
by opensuse-security＠opensuse.org 28 May '21

28 May '21

openSUSE Security Update: Security update for libu2f-host ______________________________________________________________________________ Announcement ID: openSUSE-SU-2021:0799-1 Rating: moderate References: #1124781 #1128140 #1184648 ECO-3687 Cross-References: CVE-2018-20340 CVE-2019-9578 CVSS scores: CVE-2018-20340 (NVD) : 6.8 CVSS:3.0/AV:P/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H CVE-2018-20340 (SUSE): 6.4 CVSS:3.0/AV:P/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H CVE-2019-9578 (NVD) : 7.5 CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H CVE-2019-9578 (SUSE): 2.1 CVSS:3.0/AV:P/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:L Affected Products: openSUSE Leap 15.2 ______________________________________________________________________________ An update that solves two vulnerabilities, contains one feature and has one errata is now available. Description: This update for libu2f-host fixes the following issues: This update ships the u2f-host package (jsc#ECO-3687 bsc#1184648) Version 1.1.10 (released 2019-05-15) - Add new devices to udev rules. - Fix a potentially uninitialized buffer (CVE-2019-9578, bsc#1128140) Version 1.1.9 (released 2019-03-06) - Fix CID copying from the init response, which broke compatibility with some devices. Version 1.1.8 (released 2019-03-05) - Add udev rules - Drop 70-old-u2f.rules and use 70-u2f.rules for everything - Use a random nonce for setting up CID to prevent fingerprinting - CVE-2019-9578: Parse the response to init in a more stable way to prevent leakage of uninitialized stack memory back to the device (bsc#1128140). Version 1.1.7 (released 2019-01-08) - Fix for trusting length from device in device init. - Fix for buffer overflow when receiving data from device. (YSA-2019-01, CVE-2018-20340, bsc#1124781) - Add udev rules for some new devices. - Add udev rule for Feitian ePass FIDO - Add a timeout to the register and authenticate actions. This update was imported from the SUSE:SLE-15:Update update project. Patch Instructions: To install this openSUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 15.2: zypper in -t patch openSUSE-2021-799=1 Package List: - openSUSE Leap 15.2 (x86_64): libu2f-host-debuginfo-1.1.10-lp152.4.3.1 libu2f-host-debugsource-1.1.10-lp152.4.3.1 libu2f-host-devel-1.1.10-lp152.4.3.1 libu2f-host-doc-1.1.10-lp152.4.3.1 libu2f-host0-1.1.10-lp152.4.3.1 libu2f-host0-debuginfo-1.1.10-lp152.4.3.1 u2f-host-1.1.10-lp152.4.3.1 u2f-host-debuginfo-1.1.10-lp152.4.3.1 References: https://www.suse.com/security/cve/CVE-2018-20340.html https://www.suse.com/security/cve/CVE-2019-9578.html https://bugzilla.suse.com/1124781 https://bugzilla.suse.com/1128140 https://bugzilla.suse.com/1184648

1 0

openSUSE-RU-2021:0800-1: moderate: Recommended update for expect
by maintenance＠opensuse.org 28 May '21

28 May '21

openSUSE Recommended Update: Recommended update for expect ______________________________________________________________________________ Announcement ID: openSUSE-RU-2021:0800-1 Rating: moderate References: #1172681 #1183904 #1184122 Affected Products: openSUSE Leap 15.2 ______________________________________________________________________________ An update that has three recommended fixes can now be installed. Description: This update for expect fixes the following issues: - Fixed an issue when expect in permanently open connection causes hanging for scripts. (bsc#1183904) - pass explicit -pie flag to CFLAGS and hack `make` invocation so that /usr/bin/expect actually becomes a PIE binary. This is especially awkard since the expect build system implicitly passes -fPIC which breaks our gcc-PIE package, but does not pass -pie while linking the executable. Shared libraries are also not linked with -shared so we need to explicitly pass this, too, to avoid build breakage. (bsc#1184122) - Add an unversioned symlink to make linking easier for applications that use libexpect without Tcl. (bsc#1172681) This update was imported from the SUSE:SLE-15:Update update project. Patch Instructions: To install this openSUSE Recommended Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 15.2: zypper in -t patch openSUSE-2021-800=1 Package List: - openSUSE Leap 15.2 (i586 x86_64): expect-5.45.4-lp152.4.3.1 expect-debuginfo-5.45.4-lp152.4.3.1 expect-debugsource-5.45.4-lp152.4.3.1 expect-devel-5.45.4-lp152.4.3.1 References: https://bugzilla.suse.com/1172681 https://bugzilla.suse.com/1183904 https://bugzilla.suse.com/1184122

1 0