June 2021 - openSUSE Updates - openSUSE Mailing Lists

openSUSE-SU-2021:0919-1: important: Security update for libgcrypt
by opensuse-security＠opensuse.org 25 Jun '21

25 Jun '21

openSUSE Security Update: Security update for libgcrypt ______________________________________________________________________________ Announcement ID: openSUSE-SU-2021:0919-1 Rating: important References: #1187212 Cross-References: CVE-2021-33560 CVSS scores: CVE-2021-33560 (NVD) : 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N CVE-2021-33560 (SUSE): 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N Affected Products: openSUSE Leap 15.2 ______________________________________________________________________________ An update that fixes one vulnerability is now available. Description: This update for libgcrypt fixes the following issues: - CVE-2021-33560: Fixed a side-channel against ElGamal encryption, caused by missing exponent blinding (bsc#1187212). This update was imported from the SUSE:SLE-15-SP1:Update update project. Patch Instructions: To install this openSUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 15.2: zypper in -t patch openSUSE-2021-919=1 Package List: - openSUSE Leap 15.2 (i586 x86_64): libgcrypt-cavs-1.8.2-lp152.17.3.1 libgcrypt-cavs-debuginfo-1.8.2-lp152.17.3.1 libgcrypt-debugsource-1.8.2-lp152.17.3.1 libgcrypt-devel-1.8.2-lp152.17.3.1 libgcrypt-devel-debuginfo-1.8.2-lp152.17.3.1 libgcrypt20-1.8.2-lp152.17.3.1 libgcrypt20-debuginfo-1.8.2-lp152.17.3.1 libgcrypt20-hmac-1.8.2-lp152.17.3.1 - openSUSE Leap 15.2 (x86_64): libgcrypt-devel-32bit-1.8.2-lp152.17.3.1 libgcrypt-devel-32bit-debuginfo-1.8.2-lp152.17.3.1 libgcrypt20-32bit-1.8.2-lp152.17.3.1 libgcrypt20-32bit-debuginfo-1.8.2-lp152.17.3.1 libgcrypt20-hmac-32bit-1.8.2-lp152.17.3.1 References: https://www.suse.com/security/cve/CVE-2021-33560.html https://bugzilla.suse.com/1187212

1 0

openSUSE-SU-2021:0920-1: important: Security update for dovecot23
by opensuse-security＠opensuse.org 25 Jun '21

25 Jun '21

openSUSE Security Update: Security update for dovecot23 ______________________________________________________________________________ Announcement ID: openSUSE-SU-2021:0920-1 Rating: important References: #1187418 #1187419 Cross-References: CVE-2021-29157 CVE-2021-33515 CVSS scores: CVE-2021-29157 (SUSE): 6.7 CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N CVE-2021-33515 (SUSE): 4.2 CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:L/I:L/A:N Affected Products: openSUSE Leap 15.2 ______________________________________________________________________________ An update that fixes two vulnerabilities is now available. Description: This update for dovecot23 fixes the following issues: - CVE-2021-29157: Local attacker can login as any user and access their emails (bsc#1187418) - CVE-2021-33515: Attacker can potentially steal user credentials and mails (bsc#1187419) Patch Instructions: To install this openSUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 15.2: zypper in -t patch openSUSE-2021-920=1 Package List: - openSUSE Leap 15.2 (x86_64): dovecot23-2.3.11.3-lp152.2.9.1 dovecot23-backend-mysql-2.3.11.3-lp152.2.9.1 dovecot23-backend-mysql-debuginfo-2.3.11.3-lp152.2.9.1 dovecot23-backend-pgsql-2.3.11.3-lp152.2.9.1 dovecot23-backend-pgsql-debuginfo-2.3.11.3-lp152.2.9.1 dovecot23-backend-sqlite-2.3.11.3-lp152.2.9.1 dovecot23-backend-sqlite-debuginfo-2.3.11.3-lp152.2.9.1 dovecot23-debuginfo-2.3.11.3-lp152.2.9.1 dovecot23-debugsource-2.3.11.3-lp152.2.9.1 dovecot23-devel-2.3.11.3-lp152.2.9.1 dovecot23-fts-2.3.11.3-lp152.2.9.1 dovecot23-fts-debuginfo-2.3.11.3-lp152.2.9.1 dovecot23-fts-lucene-2.3.11.3-lp152.2.9.1 dovecot23-fts-lucene-debuginfo-2.3.11.3-lp152.2.9.1 dovecot23-fts-solr-2.3.11.3-lp152.2.9.1 dovecot23-fts-solr-debuginfo-2.3.11.3-lp152.2.9.1 dovecot23-fts-squat-2.3.11.3-lp152.2.9.1 dovecot23-fts-squat-debuginfo-2.3.11.3-lp152.2.9.1 References: https://www.suse.com/security/cve/CVE-2021-29157.html https://www.suse.com/security/cve/CVE-2021-33515.html https://bugzilla.suse.com/1187418 https://bugzilla.suse.com/1187419

1 0

openSUSE-SU-2021:0917-1: important: Security update for gupnp
by opensuse-security＠opensuse.org 25 Jun '21

25 Jun '21

openSUSE Security Update: Security update for gupnp ______________________________________________________________________________ Announcement ID: openSUSE-SU-2021:0917-1 Rating: important References: #1186590 Cross-References: CVE-2021-33516 CVSS scores: CVE-2021-33516 (NVD) : 8.1 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:N CVE-2021-33516 (SUSE): 9.4 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:L Affected Products: openSUSE Leap 15.2 ______________________________________________________________________________ An update that fixes one vulnerability is now available. Description: This update for gupnp fixes the following issues: - CVE-2021-33516: Fixed a DNS rebinding, which could trick the browser into triggering actions against local UPnP services (bsc#1186590). This update was imported from the SUSE:SLE-15-SP2:Update update project. Patch Instructions: To install this openSUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 15.2: zypper in -t patch openSUSE-2021-917=1 Package List: - openSUSE Leap 15.2 (i586 x86_64): gupnp-debugsource-1.2.2-lp152.2.3.1 libgupnp-1_2-0-1.2.2-lp152.2.3.1 libgupnp-1_2-0-debuginfo-1.2.2-lp152.2.3.1 libgupnp-devel-1.2.2-lp152.2.3.1 typelib-1_0-GUPnP-1_0-1.2.2-lp152.2.3.1 - openSUSE Leap 15.2 (x86_64): libgupnp-1_2-0-32bit-1.2.2-lp152.2.3.1 libgupnp-1_2-0-32bit-debuginfo-1.2.2-lp152.2.3.1 References: https://www.suse.com/security/cve/CVE-2021-33516.html https://bugzilla.suse.com/1186590

1 0

openSUSE-SU-2021:0918-1: important: Security update for ovmf
by opensuse-security＠opensuse.org 25 Jun '21

25 Jun '21

openSUSE Security Update: Security update for ovmf ______________________________________________________________________________ Announcement ID: openSUSE-SU-2021:0918-1 Rating: important References: #1186151 Affected Products: openSUSE Leap 15.2 ______________________________________________________________________________ An update that contains security fixes can now be installed. Description: This update for ovmf fixes the following issues: - Fixed a possible buffer overflow in IScsiDxe (bsc#1186151) This update was imported from the SUSE:SLE-15-SP2:Update update project. Patch Instructions: To install this openSUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 15.2: zypper in -t patch openSUSE-2021-918=1 Package List: - openSUSE Leap 15.2 (i586 x86_64): ovmf-201911-lp152.6.17.1 ovmf-tools-201911-lp152.6.17.1 - openSUSE Leap 15.2 (x86_64): qemu-ovmf-x86_64-debug-201911-lp152.6.17.1 - openSUSE Leap 15.2 (noarch): qemu-ovmf-ia32-201911-lp152.6.17.1 qemu-ovmf-x86_64-201911-lp152.6.17.1 References: https://bugzilla.suse.com/1186151

1 0

openSUSE-RU-2021:0916-1: moderate: Recommended update for ceph
by maintenance＠opensuse.org 25 Jun '21

25 Jun '21

openSUSE Recommended Update: Recommended update for ceph ______________________________________________________________________________ Announcement ID: openSUSE-RU-2021:0916-1 Rating: moderate References: #1174526 Affected Products: openSUSE Leap 15.2 ______________________________________________________________________________ An update that has one recommended fix can now be installed. Description: This update for ceph fixes the following issues: - updated ceph to upstream version 15.2.13: * mgr/dashboard: allow getting fresh inventory data from the orchestrator (bsc#1174526) The whole upstream changelog can be found here: https://ceph.io/releases/v15-2-13-octopus-released/ This update was imported from the SUSE:SLE-15-SP2:Update update project. Patch Instructions: To install this openSUSE Recommended Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 15.2: zypper in -t patch openSUSE-2021-916=1 Package List: - openSUSE Leap 15.2 (x86_64): ceph-15.2.13.79+g51835b62d61-lp152.2.21.1 ceph-base-15.2.13.79+g51835b62d61-lp152.2.21.1 ceph-base-debuginfo-15.2.13.79+g51835b62d61-lp152.2.21.1 ceph-common-15.2.13.79+g51835b62d61-lp152.2.21.1 ceph-common-debuginfo-15.2.13.79+g51835b62d61-lp152.2.21.1 ceph-debugsource-15.2.13.79+g51835b62d61-lp152.2.21.1 ceph-fuse-15.2.13.79+g51835b62d61-lp152.2.21.1 ceph-fuse-debuginfo-15.2.13.79+g51835b62d61-lp152.2.21.1 ceph-immutable-object-cache-15.2.13.79+g51835b62d61-lp152.2.21.1 ceph-immutable-object-cache-debuginfo-15.2.13.79+g51835b62d61-lp152.2.21.1 ceph-mds-15.2.13.79+g51835b62d61-lp152.2.21.1 ceph-mds-debuginfo-15.2.13.79+g51835b62d61-lp152.2.21.1 ceph-mgr-15.2.13.79+g51835b62d61-lp152.2.21.1 ceph-mgr-debuginfo-15.2.13.79+g51835b62d61-lp152.2.21.1 ceph-mon-15.2.13.79+g51835b62d61-lp152.2.21.1 ceph-mon-debuginfo-15.2.13.79+g51835b62d61-lp152.2.21.1 ceph-osd-15.2.13.79+g51835b62d61-lp152.2.21.1 ceph-osd-debuginfo-15.2.13.79+g51835b62d61-lp152.2.21.1 ceph-radosgw-15.2.13.79+g51835b62d61-lp152.2.21.1 ceph-radosgw-debuginfo-15.2.13.79+g51835b62d61-lp152.2.21.1 ceph-test-15.2.13.79+g51835b62d61-lp152.2.21.1 ceph-test-debuginfo-15.2.13.79+g51835b62d61-lp152.2.21.1 ceph-test-debugsource-15.2.13.79+g51835b62d61-lp152.2.21.1 cephfs-shell-15.2.13.79+g51835b62d61-lp152.2.21.1 libcephfs-devel-15.2.13.79+g51835b62d61-lp152.2.21.1 libcephfs2-15.2.13.79+g51835b62d61-lp152.2.21.1 libcephfs2-debuginfo-15.2.13.79+g51835b62d61-lp152.2.21.1 librados-devel-15.2.13.79+g51835b62d61-lp152.2.21.1 librados-devel-debuginfo-15.2.13.79+g51835b62d61-lp152.2.21.1 librados2-15.2.13.79+g51835b62d61-lp152.2.21.1 librados2-debuginfo-15.2.13.79+g51835b62d61-lp152.2.21.1 libradospp-devel-15.2.13.79+g51835b62d61-lp152.2.21.1 librbd-devel-15.2.13.79+g51835b62d61-lp152.2.21.1 librbd1-15.2.13.79+g51835b62d61-lp152.2.21.1 librbd1-debuginfo-15.2.13.79+g51835b62d61-lp152.2.21.1 librgw-devel-15.2.13.79+g51835b62d61-lp152.2.21.1 librgw2-15.2.13.79+g51835b62d61-lp152.2.21.1 librgw2-debuginfo-15.2.13.79+g51835b62d61-lp152.2.21.1 python3-ceph-argparse-15.2.13.79+g51835b62d61-lp152.2.21.1 python3-ceph-common-15.2.13.79+g51835b62d61-lp152.2.21.1 python3-cephfs-15.2.13.79+g51835b62d61-lp152.2.21.1 python3-cephfs-debuginfo-15.2.13.79+g51835b62d61-lp152.2.21.1 python3-rados-15.2.13.79+g51835b62d61-lp152.2.21.1 python3-rados-debuginfo-15.2.13.79+g51835b62d61-lp152.2.21.1 python3-rbd-15.2.13.79+g51835b62d61-lp152.2.21.1 python3-rbd-debuginfo-15.2.13.79+g51835b62d61-lp152.2.21.1 python3-rgw-15.2.13.79+g51835b62d61-lp152.2.21.1 python3-rgw-debuginfo-15.2.13.79+g51835b62d61-lp152.2.21.1 rados-objclass-devel-15.2.13.79+g51835b62d61-lp152.2.21.1 rbd-fuse-15.2.13.79+g51835b62d61-lp152.2.21.1 rbd-fuse-debuginfo-15.2.13.79+g51835b62d61-lp152.2.21.1 rbd-mirror-15.2.13.79+g51835b62d61-lp152.2.21.1 rbd-mirror-debuginfo-15.2.13.79+g51835b62d61-lp152.2.21.1 rbd-nbd-15.2.13.79+g51835b62d61-lp152.2.21.1 rbd-nbd-debuginfo-15.2.13.79+g51835b62d61-lp152.2.21.1 - openSUSE Leap 15.2 (noarch): ceph-grafana-dashboards-15.2.13.79+g51835b62d61-lp152.2.21.1 ceph-mgr-cephadm-15.2.13.79+g51835b62d61-lp152.2.21.1 ceph-mgr-dashboard-15.2.13.79+g51835b62d61-lp152.2.21.1 ceph-mgr-diskprediction-cloud-15.2.13.79+g51835b62d61-lp152.2.21.1 ceph-mgr-diskprediction-local-15.2.13.79+g51835b62d61-lp152.2.21.1 ceph-mgr-k8sevents-15.2.13.79+g51835b62d61-lp152.2.21.1 ceph-mgr-modules-core-15.2.13.79+g51835b62d61-lp152.2.21.1 ceph-mgr-rook-15.2.13.79+g51835b62d61-lp152.2.21.1 ceph-prometheus-alerts-15.2.13.79+g51835b62d61-lp152.2.21.1 cephadm-15.2.13.79+g51835b62d61-lp152.2.21.1 References: https://bugzilla.suse.com/1174526

1 0

openSUSE-RU-2021:0914-1: moderate: Recommended update for wget
by maintenance＠opensuse.org 24 Jun '21

24 Jun '21

openSUSE Recommended Update: Recommended update for wget ______________________________________________________________________________ Announcement ID: openSUSE-RU-2021:0914-1 Rating: moderate References: #1181173 Affected Products: openSUSE Leap 15.2 ______________________________________________________________________________ An update that has one recommended fix can now be installed. Description: This update for wget fixes the following issue: - When running recursively, wget will verify the length of the whole URL when saving the files. This will make it overwrite files with truncated names, throwing the following message: "The name is too long,... trying to shorten". (bsc#1181173) This update was imported from the SUSE:SLE-15:Update update project. Patch Instructions: To install this openSUSE Recommended Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 15.2: zypper in -t patch openSUSE-2021-914=1 Package List: - openSUSE Leap 15.2 (i586 x86_64): wget-1.20.3-lp152.2.3.1 wget-debuginfo-1.20.3-lp152.2.3.1 wget-debugsource-1.20.3-lp152.2.3.1 - openSUSE Leap 15.2 (noarch): wget-lang-1.20.3-lp152.2.3.1 References: https://bugzilla.suse.com/1181173

1 0

openSUSE-SU-2021:0915-1: moderate: Security update for live555
by opensuse-security＠opensuse.org 24 Jun '21

24 Jun '21

openSUSE Security Update: Security update for live555 ______________________________________________________________________________ Announcement ID: openSUSE-SU-2021:0915-1 Rating: moderate References: #1146283 #1185874 Cross-References: CVE-2019-15232 CVE-2021-28899 CVSS scores: CVE-2019-15232 (NVD) : 9.8 CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H CVE-2021-28899 (NVD) : 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H Affected Products: openSUSE Leap 15.2 ______________________________________________________________________________ An update that fixes two vulnerabilities is now available. Description: This update for live555 fixes the following issues: Update to 2021.05.22: - Lots of fixes and updates, including the security fix for CVE-2021-28899 (boo#1185874) and CVE-2019-15232 (boo#1146283). See the list in http://live555.com/liveMedia/public/changelog.txt Patch Instructions: To install this openSUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 15.2: zypper in -t patch openSUSE-2021-915=1 Package List: - openSUSE Leap 15.2 (x86_64): libBasicUsageEnvironment1-2021.05.22-lp152.3.6.1 libBasicUsageEnvironment1-debuginfo-2021.05.22-lp152.3.6.1 libUsageEnvironment3-2021.05.22-lp152.3.6.1 libUsageEnvironment3-debuginfo-2021.05.22-lp152.3.6.1 libgroupsock30-2021.05.22-lp152.3.6.1 libgroupsock30-debuginfo-2021.05.22-lp152.3.6.1 libliveMedia94-2021.05.22-lp152.3.6.1 libliveMedia94-debuginfo-2021.05.22-lp152.3.6.1 live555-2021.05.22-lp152.3.6.1 live555-debuginfo-2021.05.22-lp152.3.6.1 live555-debugsource-2021.05.22-lp152.3.6.1 live555-devel-2021.05.22-lp152.3.6.1 References: https://www.suse.com/security/cve/CVE-2019-15232.html https://www.suse.com/security/cve/CVE-2021-28899.html https://bugzilla.suse.com/1146283 https://bugzilla.suse.com/1185874

1 0

openSUSE-SU-2021:0910-1: important: Security update for MozillaThunderbird
by opensuse-security＠opensuse.org 24 Jun '21

24 Jun '21

openSUSE Security Update: Security update for MozillaThunderbird ______________________________________________________________________________ Announcement ID: openSUSE-SU-2021:0910-1 Rating: important References: #1186696 Cross-References: CVE-2021-29964 CVE-2021-29967 Affected Products: openSUSE Leap 15.2 ______________________________________________________________________________ An update that fixes two vulnerabilities is now available. Description: This update for MozillaThunderbird fixes the following issues: Mozilla Thunderbird 78.11 (bsc#1186696) Security issues fixed: - CVE-2021-29964: Out of bounds-read when parsing a `WM_COPYDATA` message - CVE-2021-29967: Memory safety bugs fixed in Thunderbird 78.11 General improvements: - OpenPGP could not be disabled for an account if a key was previously configured - Recipients were unable to decrypt some messages when the sender had changed the message encryption from OpenPGP to S/MIME - Contacts moved between CardDAV address books were not synced to the new server - CardDAV compatibility fixes for Google Contacts - Folder pane had no clear indication of focus on macOS This update was imported from the SUSE:SLE-15-SP2:Update update project. Patch Instructions: To install this openSUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 15.2: zypper in -t patch openSUSE-2021-910=1 Package List: - openSUSE Leap 15.2 (x86_64): MozillaThunderbird-78.11.0-lp152.2.45.1 MozillaThunderbird-debuginfo-78.11.0-lp152.2.45.1 MozillaThunderbird-debugsource-78.11.0-lp152.2.45.1 MozillaThunderbird-translations-common-78.11.0-lp152.2.45.1 MozillaThunderbird-translations-other-78.11.0-lp152.2.45.1 References: https://www.suse.com/security/cve/CVE-2021-29964.html https://www.suse.com/security/cve/CVE-2021-29967.html https://bugzilla.suse.com/1186696

1 0

openSUSE-SU-2021:0909-1: important: Security update for wireshark, libvirt, sbc, libqt5-qtmultimedia
by opensuse-security＠opensuse.org 24 Jun '21

24 Jun '21

openSUSE Security Update: Security update for wireshark, libvirt, sbc, libqt5-qtmultimedia ______________________________________________________________________________ Announcement ID: openSUSE-SU-2021:0909-1 Rating: important References: #1179930 #1179931 #1179932 #1179933 #1180102 #1180232 #1181598 #1181599 #1183353 #1184110 #1185128 Cross-References: CVE-2020-26418 CVE-2020-26419 CVE-2020-26420 CVE-2020-26421 CVE-2020-26422 CVE-2021-22173 CVE-2021-22174 CVE-2021-22191 CVE-2021-22207 CVSS scores: CVE-2020-26418 (NVD) : 5.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L CVE-2020-26418 (SUSE): 5.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L CVE-2020-26419 (NVD) : 5.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L CVE-2020-26420 (NVD) : 5.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L CVE-2020-26420 (SUSE): 4.3 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L CVE-2020-26421 (NVD) : 5.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L CVE-2020-26421 (SUSE): 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H CVE-2020-26422 (NVD) : 5.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L CVE-2020-26422 (SUSE): 5.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L CVE-2021-22173 (NVD) : 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H CVE-2021-22173 (SUSE): 4.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:L CVE-2021-22174 (NVD) : 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H CVE-2021-22174 (SUSE): 4.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:L CVE-2021-22191 (NVD) : 8.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H CVE-2021-22191 (SUSE): 7.5 CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H CVE-2021-22207 (NVD) : 6.5 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H CVE-2021-22207 (SUSE): 4.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:L Affected Products: openSUSE Leap 15.2 ______________________________________________________________________________ An update that solves 9 vulnerabilities and has two fixes is now available. Description: This update for wireshark, libvirt, sbc and libqt5-qtmultimedia fixes the following issues: Update wireshark to version 3.4.5 - New and updated support and bug fixes for multiple protocols - Asynchronous DNS resolution is always enabled - Protobuf fields can be dissected as Wireshark (header) fields - UI improvements Including security fixes for: - CVE-2021-22191: Wireshark could open unsafe URLs (bsc#1183353). - CVE-2021-22207: MS-WSP dissector excessive memory consumption (bsc#1185128) - CVE-2020-26422: QUIC dissector crash (bsc#1180232) - CVE-2020-26418: Kafka dissector memory leak (bsc#1179930) - CVE-2020-26419: Multiple dissector memory leaks (bsc#1179931) - CVE-2020-26420: RTPS dissector memory leak (bsc#1179932) - CVE-2020-26421: USB HID dissector crash (bsc#1179933) - CVE-2021-22173: Fix USB HID dissector memory leak (bsc#1181598) - CVE-2021-22174: Fix USB HID dissector crash (bsc#1181599) libqt5-qtmultimedia and sbc are necessary dependencies. libvirt is needed to rebuild wireshark-plugin-libvirt. Patch Instructions: To install this openSUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 15.2: zypper in -t patch openSUSE-2021-909=1 Package List: - openSUSE Leap 15.2 (i586 x86_64): libwireshark14-3.4.5-lp152.2.12.1 libwireshark14-debuginfo-3.4.5-lp152.2.12.1 libwiretap11-3.4.5-lp152.2.12.1 libwiretap11-debuginfo-3.4.5-lp152.2.12.1 libwsutil12-3.4.5-lp152.2.12.1 libwsutil12-debuginfo-3.4.5-lp152.2.12.1 wireshark-3.4.5-lp152.2.12.1 wireshark-debuginfo-3.4.5-lp152.2.12.1 wireshark-debugsource-3.4.5-lp152.2.12.1 wireshark-devel-3.4.5-lp152.2.12.1 wireshark-ui-qt-3.4.5-lp152.2.12.1 wireshark-ui-qt-debuginfo-3.4.5-lp152.2.12.1 References: https://www.suse.com/security/cve/CVE-2020-26418.html https://www.suse.com/security/cve/CVE-2020-26419.html https://www.suse.com/security/cve/CVE-2020-26420.html https://www.suse.com/security/cve/CVE-2020-26421.html https://www.suse.com/security/cve/CVE-2020-26422.html https://www.suse.com/security/cve/CVE-2021-22173.html https://www.suse.com/security/cve/CVE-2021-22174.html https://www.suse.com/security/cve/CVE-2021-22191.html https://www.suse.com/security/cve/CVE-2021-22207.html https://bugzilla.suse.com/1179930 https://bugzilla.suse.com/1179931 https://bugzilla.suse.com/1179932 https://bugzilla.suse.com/1179933 https://bugzilla.suse.com/1180102 https://bugzilla.suse.com/1180232 https://bugzilla.suse.com/1181598 https://bugzilla.suse.com/1181599 https://bugzilla.suse.com/1183353 https://bugzilla.suse.com/1184110 https://bugzilla.suse.com/1185128

1 0

openSUSE-RU-2021:0913-1: moderate: Recommended update for trytond, trytond_account, trytond_account_invoice, trytond_account_invoice_stock, trytond_account_product, trytond_company, trytond_country, trytond_currency, trytond_party, trytond_product, trytond_purchase, trytond_purchase_request, trytond_stock, trytond_stock_lot, trytond_stock_supply
by maintenance＠opensuse.org 24 Jun '21

24 Jun '21

openSUSE Recommended Update: Recommended update for trytond, trytond_account, trytond_account_invoice, trytond_account_invoice_stock, trytond_account_product, trytond_company, trytond_country, trytond_currency, trytond_party, trytond_product, trytond_purchase, trytond_purchase_request, trytond_stock, trytond_stock_lot, trytond_stock_supply ______________________________________________________________________________ Announcement ID: openSUSE-RU-2021:0913-1 Rating: moderate References: Affected Products: openSUSE Leap 15.2 ______________________________________________________________________________ An update that has 0 recommended fixes can now be installed. Description: This update for trytond, trytond_account, trytond_account_invoice, trytond_account_invoice_stock, trytond_account_product, trytond_company, trytond_country, trytond_currency, trytond_party, trytond_product, trytond_purchase, trytond_purchase_request, trytond_stock, trytond_stock_lot, trytond_stock_supply fixes the following issues: Changes in trytond_stock_supply: - Version 5.0.7 - Bugfix Release Changes in trytond_stock_lot: - Version 5.0.3 - Bugfix Release Changes in trytond_stock: - Version 5.0.14 - Bugfix Release - Version 5.0.13 - Bugfix Release - Version 5.0.12 - Bugfix Release Changes in trytond_purchase_request: - Version 5.0.5 - Bugfix Release Changes in trytond_purchase: - Version 5.0.7 - Bugfix Release - Version 5.0.6 - Bugfix Release - Version 5.0.5 - Bugfix Release Changes in trytond_product: - Version 5.0.4 - Bugfix Release Changes in trytond_party: - Version 5.0.5 - Bugfix Release - Version 5.0.4 - Bugfix Release Changes in trytond_currency: - Version 5.0.6 - Bugfix Release - Version 5.0.5 - Bugfix Release Changes in trytond_country: - Version 5.0.3 - Bugfix Release Changes in trytond_company: - Version 5.0.3 - Bugfix Release Changes in trytond_account_product: - Version 5.0.5 - Bugfix Release Changes in trytond_account_invoice_stock: - Version 5.0.4 - Bugfix Release Changes in trytond_account_invoice: - Version 5.0.13 - Bugfix Release - Version 5.0.12 - Bugfix Release - Version 5.0.11 - Bugfix Release Changes in trytond_account: - Version 5.0.18 - Bugfix Release - Version 5.0.17 - Bugfix Release Changes in trytond: - Version 5.0.36 - Bugfix Release - Version 5.0.35 - Bugfix Release - Parameter for webdav server added to trytond.conf - Version 5.0.34 - Bugfix Release Patch Instructions: To install this openSUSE Recommended Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 15.2: zypper in -t patch openSUSE-2021-913=1 Package List: - openSUSE Leap 15.2 (noarch): trytond-5.0.36-lp152.2.25.1 trytond_account-5.0.18-lp152.2.12.1 trytond_account_invoice-5.0.13-lp152.2.9.1 trytond_account_invoice_stock-5.0.4-lp152.2.3.1 trytond_account_product-5.0.5-lp152.2.3.1 trytond_company-5.0.3-lp152.2.3.1 trytond_country-5.0.3-lp152.2.3.1 trytond_currency-5.0.6-lp152.2.3.1 trytond_party-5.0.5-lp152.2.3.1 trytond_product-5.0.4-lp152.2.3.1 trytond_purchase-5.0.7-lp152.2.3.1 trytond_purchase_request-5.0.5-lp152.2.3.1 trytond_stock-5.0.14-lp152.2.6.1 trytond_stock_lot-5.0.3-lp152.2.3.1 trytond_stock_supply-5.0.7-lp152.2.3.1 References:

1 0