June 2021 - openSUSE Updates - openSUSE Mailing Lists

openSUSE-RU-2021:0905-1: moderate: Recommended update for csync2
by maintenance＠opensuse.org 23 Jun '21

23 Jun '21

openSUSE Recommended Update: Recommended update for csync2 ______________________________________________________________________________ Announcement ID: openSUSE-RU-2021:0905-1 Rating: moderate References: #1187080 Affected Products: openSUSE Leap 15.2 ______________________________________________________________________________ An update that has one recommended fix can now be installed. Description: This update for csync2 fixes the following issues: - Removal of csync2 package throws error for non-existent service template. (bsc#1187080) This update was imported from the SUSE:SLE-15:Update update project. Patch Instructions: To install this openSUSE Recommended Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 15.2: zypper in -t patch openSUSE-2021-905=1 Package List: - openSUSE Leap 15.2 (x86_64): csync2-2.0+git.1461714863.10636a4-lp152.5.6.1 csync2-debuginfo-2.0+git.1461714863.10636a4-lp152.5.6.1 csync2-debugsource-2.0+git.1461714863.10636a4-lp152.5.6.1 References: https://bugzilla.suse.com/1187080

1 0

openSUSE-SU-2021:0899-1: critical: Security update for salt
by opensuse-security＠opensuse.org 23 Jun '21

23 Jun '21

openSUSE Security Update: Security update for salt ______________________________________________________________________________ Announcement ID: openSUSE-SU-2021:0899-1 Rating: critical References: #1171257 #1176293 #1179831 #1181368 #1182281 #1182293 #1182382 #1185092 #1185281 #1186674 ECO-3212 SLE-18028 SLE-18033 Cross-References: CVE-2018-15750 CVE-2018-15751 CVE-2020-11651 CVE-2020-11652 CVE-2020-25592 CVE-2021-25315 CVE-2021-31607 CVSS scores: CVE-2018-15750 (NVD) : 5.3 CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N CVE-2018-15750 (SUSE): 8.7 CVSS:3.0/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:N CVE-2018-15751 (NVD) : 9.8 CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H CVE-2018-15751 (SUSE): 9.8 CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H CVE-2020-11651 (NVD) : 9.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H CVE-2020-11651 (SUSE): 9.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H CVE-2020-11652 (NVD) : 6.5 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N CVE-2020-11652 (SUSE): 7.2 CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H CVE-2020-25592 (NVD) : 9.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H CVE-2020-25592 (SUSE): 9.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H CVE-2021-25315 (NVD) : 7.8 CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H CVE-2021-25315 (SUSE): 9.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H CVE-2021-31607 (NVD) : 7.8 CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H CVE-2021-31607 (SUSE): 7 CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H Affected Products: openSUSE Leap 15.2 ______________________________________________________________________________ An update that solves 7 vulnerabilities, contains three features and has three fixes is now available. Description: This update for salt fixes the following issues: Update to Salt release version 3002.2 (jsc#ECO-3212, jsc#SLE-18033, jsc#SLE-18028) - Check if dpkgnotify is executable (bsc#1186674) - Drop support for Python2. Obsoletes `python2-salt` package (jsc#SLE-18028) - virt module updates * network: handle missing ipv4 netmask attribute * more network support * PCI/USB host devices passthrough support - Set distro requirement to oldest supported version in requirements/base.txt - Bring missing part of async batch implementation back (CVE-2021-25315, bsc#1182382) - Always require `python3-distro` (bsc#1182293) - Remove deprecated warning that breaks minion execution when "server_id_use_crc" opts is missing - Fix pkg states when DEB package has "all" arch - Do not force beacons configuration to be a list. - Remove msgpack < 1.0.0 from base requirements (bsc#1176293) - msgpack support for version >= 1.0.0 (bsc#1171257) - Fix issue parsing errors in ansiblegate state module - Prevent command injection in the snapper module (bsc#1185281, CVE-2021-31607) - transactional_update: detect recursion in the executor - Add subpackage salt-transactional-update (jsc#SLE-18033) - Improvements on "ansiblegate" module (bsc#1185092): * New methods: ansible.targets / ansible.discover_playbooks - Add support for Alibaba Cloud Linux 2 (Aliyun Linux) - Regression fix of salt-ssh on processing targets - Update target fix for salt-ssh and avoiding race condition on salt-ssh event processing (bsc#1179831, bsc#1182281) - Add notify beacon for Debian/Ubuntu systems - Fix zmq bug that causes salt-call to freeze (bsc#1181368) This update was imported from the SUSE:SLE-15-SP2:Update update project. Patch Instructions: To install this openSUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 15.2: zypper in -t patch openSUSE-2021-899=1 Package List: - openSUSE Leap 15.2 (x86_64): python3-salt-3002.2-lp152.3.36.1 salt-3002.2-lp152.3.36.1 salt-api-3002.2-lp152.3.36.1 salt-cloud-3002.2-lp152.3.36.1 salt-doc-3002.2-lp152.3.36.1 salt-master-3002.2-lp152.3.36.1 salt-minion-3002.2-lp152.3.36.1 salt-proxy-3002.2-lp152.3.36.1 salt-ssh-3002.2-lp152.3.36.1 salt-standalone-formulas-configuration-3002.2-lp152.3.36.1 salt-syndic-3002.2-lp152.3.36.1 salt-transactional-update-3002.2-lp152.3.36.1 - openSUSE Leap 15.2 (noarch): salt-bash-completion-3002.2-lp152.3.36.1 salt-fish-completion-3002.2-lp152.3.36.1 salt-zsh-completion-3002.2-lp152.3.36.1 References: https://www.suse.com/security/cve/CVE-2018-15750.html https://www.suse.com/security/cve/CVE-2018-15751.html https://www.suse.com/security/cve/CVE-2020-11651.html https://www.suse.com/security/cve/CVE-2020-11652.html https://www.suse.com/security/cve/CVE-2020-25592.html https://www.suse.com/security/cve/CVE-2021-25315.html https://www.suse.com/security/cve/CVE-2021-31607.html https://bugzilla.suse.com/1171257 https://bugzilla.suse.com/1176293 https://bugzilla.suse.com/1179831 https://bugzilla.suse.com/1181368 https://bugzilla.suse.com/1182281 https://bugzilla.suse.com/1182293 https://bugzilla.suse.com/1182382 https://bugzilla.suse.com/1185092 https://bugzilla.suse.com/1185281 https://bugzilla.suse.com/1186674

1 0

openSUSE-SU-2021:0898-1: important: Security update for chromium
by opensuse-security＠opensuse.org 21 Jun '21

21 Jun '21

openSUSE Security Update: Security update for chromium ______________________________________________________________________________ Announcement ID: openSUSE-SU-2021:0898-1 Rating: important References: #1187481 Cross-References: CVE-2021-30554 CVE-2021-30555 CVE-2021-30556 CVE-2021-30557 Affected Products: openSUSE Leap 15.2 ______________________________________________________________________________ An update that fixes four vulnerabilities is now available. Description: This update for chromium fixes the following issues: Chromium 91.0.4472.114 (boo#1187481) * CVE-2021-30554: Use after free in WebGL * CVE-2021-30555: Use after free in Sharing * CVE-2021-30556: Use after free in WebAudio * CVE-2021-30557: Use after free in TabGroups Chromium 91.0.4472.106 * Fix use-after-free in SendTabToSelfSubMenuModel * Destroy system-token NSSCertDatabase on the IO thread Patch Instructions: To install this openSUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 15.2: zypper in -t patch openSUSE-2021-898=1 Package List: - openSUSE Leap 15.2 (x86_64): chromedriver-91.0.4472.114-lp152.2.107.1 chromedriver-debuginfo-91.0.4472.114-lp152.2.107.1 chromium-91.0.4472.114-lp152.2.107.1 chromium-debuginfo-91.0.4472.114-lp152.2.107.1 References: https://www.suse.com/security/cve/CVE-2021-30554.html https://www.suse.com/security/cve/CVE-2021-30555.html https://www.suse.com/security/cve/CVE-2021-30556.html https://www.suse.com/security/cve/CVE-2021-30557.html https://bugzilla.suse.com/1187481

1 0

openSUSE-RU-2021:0897-1: moderate: Recommended update for obs-service-tar_scm
by maintenance＠opensuse.org 20 Jun '21

20 Jun '21

openSUSE Recommended Update: Recommended update for obs-service-tar_scm ______________________________________________________________________________ Announcement ID: openSUSE-RU-2021:0897-1 Rating: moderate References: #1127353 #1127907 #1168573 Affected Products: openSUSE Leap 15.2 ______________________________________________________________________________ An update that has three recommended fixes can now be installed. Description: This update for obs-service-tar_scm fixes the following issues: - Fixes an issue when user 'obsservicerun' and group 'obsrun' do not exist. (bsc#1168573) - Fixes 'python3' compatibilty. (bsc#1127353) - Fixed an issue when unicode filenames breaks the program. (bsc#1127907) This update was imported from the SUSE:SLE-15:Update update project. Patch Instructions: To install this openSUSE Recommended Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 15.2: zypper in -t patch openSUSE-2021-897=1 Package List: - openSUSE Leap 15.2 (noarch): obs-service-appimage-0.10.21.1612422695.2fdf897-lp152.2.4.1 obs-service-appimage-0.10.21.1612422695.2fdf897-lp152.2.5.1 obs-service-obs_scm-0.10.21.1612422695.2fdf897-lp152.2.4.1 obs-service-obs_scm-0.10.21.1612422695.2fdf897-lp152.2.5.1 obs-service-obs_scm-common-0.10.21.1612422695.2fdf897-lp152.2.4.1 obs-service-obs_scm-common-0.10.21.1612422695.2fdf897-lp152.2.5.1 obs-service-snapcraft-0.10.21.1612422695.2fdf897-lp152.2.4.1 obs-service-snapcraft-0.10.21.1612422695.2fdf897-lp152.2.5.1 obs-service-tar-0.10.21.1612422695.2fdf897-lp152.2.4.1 obs-service-tar-0.10.21.1612422695.2fdf897-lp152.2.5.1 obs-service-tar_scm-0.10.21.1612422695.2fdf897-lp152.2.4.1 obs-service-tar_scm-0.10.21.1612422695.2fdf897-lp152.2.5.1 References: https://bugzilla.suse.com/1127353 https://bugzilla.suse.com/1127907 https://bugzilla.suse.com/1168573

1 0

openSUSE-RU-2021:0896-1: moderate: Recommended update for perl-Curses
by maintenance＠opensuse.org 20 Jun '21

20 Jun '21

openSUSE Recommended Update: Recommended update for perl-Curses ______________________________________________________________________________ Announcement ID: openSUSE-RU-2021:0896-1 Rating: moderate References: #1119646 Affected Products: openSUSE Backports SLE-15-SP2 ______________________________________________________________________________ An update that has one recommended fix can now be installed. Description: This update for perl-Curses fixes the following issues: - Build and link against ncurses version 5 to fix missing exported symbols [boo#1119646] This update was imported from the openSUSE:Leap:15.2:Update update project. Patch Instructions: To install this openSUSE Recommended Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Backports SLE-15-SP2: zypper in -t patch openSUSE-2021-896=1 Package List: - openSUSE Backports SLE-15-SP2 (aarch64 ppc64le s390x x86_64): perl-Curses-1.32-bp152.4.3.1 References: https://bugzilla.suse.com/1119646

1 0

openSUSE-SU-2021:0895-1: important: Security update for htmldoc
by opensuse-security＠opensuse.org 18 Jun '21

18 Jun '21

openSUSE Security Update: Security update for htmldoc ______________________________________________________________________________ Announcement ID: openSUSE-SU-2021:0895-1 Rating: important References: #1184424 Cross-References: CVE-2021-20308 CVSS scores: CVE-2021-20308 (NVD) : 9.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H CVE-2021-20308 (SUSE): 3.3 CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:L Affected Products: openSUSE Backports SLE-15-SP1 ______________________________________________________________________________ An update that fixes one vulnerability is now available. Description: This update for htmldoc fixes the following issues: Update to version 1.9.12 * Fixed buffer-overflow CVE-2021-20308 ( boo#1184424 ) * Fixed a crash bug with "data:" URIs and EPUB output * Fixed several other crash bugs * Fixed JPEG error handling * Fixed some minor issues * Removed the bundled libjpeg, libpng, and zlib. update to 1.9.11: - Added high-resolution desktop icons for Linux. - Updated the internal HTTP library to fix truncation of redirection URLs - Fixed a regression in the handling of character entities for UTF-8 input - The `--numbered` option did not work when the table-of-contents was disabled - Updated local zlib to v1.2.11. - Updated local libpng to v1.6.37. - Fixed packaging issues on macOS and Windows - Now ignore sRGB profile errors in PNG files - The GUI would crash when saving - Page comments are now allowed in `pre` text update to 1.9.9: - Added support for a `HTMLDOC.filename` META keyword that controls the filename reported in CGI mode; the default remains "htmldoc.pdf" (Issue #367) - Fixed a paragraph formatting issue with large inline images (Issue #369) - Fixed a buffer underflow issue (Issue #370) - Fixed PDF page numbers (Issue #371) - Added support for a new `L` header/footer format (`$LETTERHEAD`), which inserts a letterhead image at its full size (Issue #372, Issue #373, Issue #375) - Updated the build documentation (Issue #374) - Refactored the PRE rendering code to work around compiler optimization bugs - Added support for links with targets (Issue #351) - Fixed a table rowspan + valign bug (Issue #360) - Added support for data URIs (Issue #340) - HTMLDOC no longer includes a PDF table of contents when converting a single web page (Issue #344) - Updated the markdown support with external links, additional inline markup, and hard line breaks. - Links in markdown text no longer render with a leading space as part of the link (Issue #346) - Fixed a buffer underflow bug discovered by AddressSanitizer. - Fixed a bug in UTF-8 support (Issue #348) - PDF output now includes the base language of the input document(s) - Optimized the loading of font widths (Issue #354) - Optimized PDF page resources (Issue #356) - Optimized the base memory used for font widths (Issue #357) - Added proper `` support (Issue #361) - Title files can now be markdown. - The GUI did not support EPUB output. - Empty markdown table cells were not rendered in PDF or PostScript output. - The automatically-generated title page now supports both "docnumber" and "version" metadata. - Added support for dc:subject and dc:language metadata in EPUB output from the HTML keywords and lang values. - Added support for the subject and language metadata in markdown input. - Fixed a buffer underflow bug (Issue #338) - `htmldoc --help` now reports whether HTTPS URLs are supported (Issue #339) - Fixed an issue with HTML title pages and EPUB output. - Inline fixed-width text is no longer reduced in size automatically - Optimized initialization of font width data (Issue #334) - Fixed formatting bugs with aligned images (Issue #322, Issue #324) - Fixed support for three digit "#RGB" color values (Issue #323) - Fixed character set support for markdown metadata. - Updated libpng to v1.6.34 (Issue #326) - The makefiles did not use the CPPFLAGS value (Issue #328) - Added Markdown table support. - Fixed parsing of TBODY, TFOOT, and THEAD elements in HTML files. Patch Instructions: To install this openSUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Backports SLE-15-SP1: zypper in -t patch openSUSE-2021-895=1 Package List: - openSUSE Backports SLE-15-SP1 (aarch64 ppc64le s390x x86_64): htmldoc-1.9.12-bp151.4.3.1 References: https://www.suse.com/security/cve/CVE-2021-20308.html https://bugzilla.suse.com/1184424

1 0

openSUSE-SU-2021:0894-1: moderate: Security update for postgresql10
by opensuse-security＠opensuse.org 18 Jun '21

18 Jun '21

openSUSE Security Update: Security update for postgresql10 ______________________________________________________________________________ Announcement ID: openSUSE-SU-2021:0894-1 Rating: moderate References: #1183168 #1185924 #1185925 Cross-References: CVE-2021-32027 CVE-2021-32028 CVSS scores: CVE-2021-32027 (NVD) : 8.8 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H CVE-2021-32027 (SUSE): 6.5 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N CVE-2021-32028 (SUSE): 6.5 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N Affected Products: openSUSE Leap 15.2 ______________________________________________________________________________ An update that solves two vulnerabilities and has one errata is now available. Description: This update for postgresql10 fixes the following issues: - Upgrade to version 10.17: - CVE-2021-32027: Fixed integer overflows in array subscripting calculations (bsc#1185924). - CVE-2021-32028: Fixed mishandling of junk columns in INSERT ... ON CONFLICT ... UPDATE target lists (bsc#1185925). - Don't use %_stop_on_removal, because it was meant to be private and got removed from openSUSE. %_restart_on_update is also private, but still supported and needed for now (bsc#1183168). This update was imported from the SUSE:SLE-15-SP1:Update update project. Patch Instructions: To install this openSUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 15.2: zypper in -t patch openSUSE-2021-894=1 Package List: - openSUSE Leap 15.2 (i586 x86_64): postgresql10-10.17-lp152.2.21.1 postgresql10-contrib-10.17-lp152.2.21.1 postgresql10-contrib-debuginfo-10.17-lp152.2.21.1 postgresql10-debuginfo-10.17-lp152.2.21.1 postgresql10-debugsource-10.17-lp152.2.21.1 postgresql10-devel-10.17-lp152.2.21.1 postgresql10-devel-debuginfo-10.17-lp152.2.21.1 postgresql10-plperl-10.17-lp152.2.21.1 postgresql10-plperl-debuginfo-10.17-lp152.2.21.1 postgresql10-plpython-10.17-lp152.2.21.1 postgresql10-plpython-debuginfo-10.17-lp152.2.21.1 postgresql10-pltcl-10.17-lp152.2.21.1 postgresql10-pltcl-debuginfo-10.17-lp152.2.21.1 postgresql10-server-10.17-lp152.2.21.1 postgresql10-server-debuginfo-10.17-lp152.2.21.1 postgresql10-test-10.17-lp152.2.21.1 - openSUSE Leap 15.2 (noarch): postgresql10-docs-10.17-lp152.2.21.1 References: https://www.suse.com/security/cve/CVE-2021-32027.html https://www.suse.com/security/cve/CVE-2021-32028.html https://bugzilla.suse.com/1183168 https://bugzilla.suse.com/1185924 https://bugzilla.suse.com/1185925

1 0

openSUSE-SU-2021:0893-1: important: Security update for htmldoc
by opensuse-security＠opensuse.org 17 Jun '21

17 Jun '21

openSUSE Security Update: Security update for htmldoc ______________________________________________________________________________ Announcement ID: openSUSE-SU-2021:0893-1 Rating: important References: #1184424 Cross-References: CVE-2021-20308 CVSS scores: CVE-2021-20308 (NVD) : 9.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H CVE-2021-20308 (SUSE): 3.3 CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:L Affected Products: openSUSE Backports SLE-15-SP2 ______________________________________________________________________________ An update that fixes one vulnerability is now available. Description: This update for htmldoc fixes the following issues: htmldoc was updated to version 1.9.12 * Fixed buffer-overflow CVE-2021-20308 ( boo#1184424 ) * Fixed a crash bug with "data:" URIs and EPUB output * Fixed several other crash bugs * Fixed JPEG error handling * Fixed some minor issues * Removed the bundled libjpeg, libpng, and zlib. update to 1.9.11: - Added high-resolution desktop icons for Linux. - Updated the internal HTTP library to fix truncation of redirection URLs - Fixed a regression in the handling of character entities for UTF-8 input - The `--numbered` option did not work when the table-of-contents was disabled - Updated local zlib to v1.2.11. - Updated local libpng to v1.6.37. - Fixed packaging issues on macOS and Windows - Now ignore sRGB profile errors in PNG files - The GUI would crash when saving - Page comments are now allowed in `pre` text update to 1.9.9: - Added support for a `HTMLDOC.filename` META keyword that controls the filename reported in CGI mode; the default remains "htmldoc.pdf" (Issue #367) - Fixed a paragraph formatting issue with large inline images (Issue #369) - Fixed a buffer underflow issue (Issue #370) - Fixed PDF page numbers (Issue #371) - Added support for a new `L` header/footer format (`$LETTERHEAD`), which inserts a letterhead image at its full size (Issue #372, Issue #373, Issue #375) - Updated the build documentation (Issue #374) - Refactored the PRE rendering code to work around compiler optimization bugs - Added support for links with targets (Issue #351) - Fixed a table rowspan + valign bug (Issue #360) - Added support for data URIs (Issue #340) - HTMLDOC no longer includes a PDF table of contents when converting a single web page (Issue #344) - Updated the markdown support with external links, additional inline markup, and hard line breaks. - Links in markdown text no longer render with a leading space as part of the link (Issue #346) - Fixed a buffer underflow bug discovered by AddressSanitizer. - Fixed a bug in UTF-8 support (Issue #348) - PDF output now includes the base language of the input document(s) - Optimized the loading of font widths (Issue #354) - Optimized PDF page resources (Issue #356) - Optimized the base memory used for font widths (Issue #357) - Added proper `` support (Issue #361) - Title files can now be markdown. - The GUI did not support EPUB output. - Empty markdown table cells were not rendered in PDF or PostScript output. - The automatically-generated title page now supports both "docnumber" and "version" metadata. - Added support for dc:subject and dc:language metadata in EPUB output from the HTML keywords and lang values. - Added support for the subject and language metadata in markdown input. - Fixed a buffer underflow bug (Issue #338) - `htmldoc --help` now reports whether HTTPS URLs are supported (Issue #339) - Fixed an issue with HTML title pages and EPUB output. - Inline fixed-width text is no longer reduced in size automatically - Optimized initialization of font width data (Issue #334) - Fixed formatting bugs with aligned images (Issue #322, Issue #324) - Fixed support for three digit "#RGB" color values (Issue #323) - Fixed character set support for markdown metadata. - Updated libpng to v1.6.34 (Issue #326) - The makefiles did not use the CPPFLAGS value (Issue #328) - Added Markdown table support. - Fixed parsing of TBODY, TFOOT, and THEAD elements in HTML files. Patch Instructions: To install this openSUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Backports SLE-15-SP2: zypper in -t patch openSUSE-2021-893=1 Package List: - openSUSE Backports SLE-15-SP2 (aarch64 ppc64le s390x x86_64): htmldoc-1.9.12-bp152.4.3.1 References: https://www.suse.com/security/cve/CVE-2021-20308.html https://bugzilla.suse.com/1184424

1 0

openSUSE-RU-2021:0889-1: moderate: Recommended update for xorg-x11-server
by maintenance＠opensuse.org 16 Jun '21

16 Jun '21

openSUSE Recommended Update: Recommended update for xorg-x11-server ______________________________________________________________________________ Announcement ID: openSUSE-RU-2021:0889-1 Rating: moderate References: #1184906 #1186092 Affected Products: openSUSE Leap 15.2 ______________________________________________________________________________ An update that has two recommended fixes can now be installed. Description: This update for xorg-x11-server fixes the following issues: - xwayland: Fix invisible window produced by Xwayland. (bsc#1186092, bsc#1184906) This update was imported from the SUSE:SLE-15-SP2:Update update project. Patch Instructions: To install this openSUSE Recommended Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 15.2: zypper in -t patch openSUSE-2021-889=1 Package List: - openSUSE Leap 15.2 (i586 x86_64): xorg-x11-server-1.20.3-lp152.8.27.1 xorg-x11-server-debuginfo-1.20.3-lp152.8.27.1 xorg-x11-server-debugsource-1.20.3-lp152.8.27.1 xorg-x11-server-extra-1.20.3-lp152.8.27.1 xorg-x11-server-extra-debuginfo-1.20.3-lp152.8.27.1 xorg-x11-server-sdk-1.20.3-lp152.8.27.1 xorg-x11-server-source-1.20.3-lp152.8.27.1 xorg-x11-server-wayland-1.20.3-lp152.8.27.1 xorg-x11-server-wayland-debuginfo-1.20.3-lp152.8.27.1 References: https://bugzilla.suse.com/1184906 https://bugzilla.suse.com/1186092

1 0

openSUSE-SU-2021:0877-1: important: Security update for djvulibre
by opensuse-security＠opensuse.org 16 Jun '21

16 Jun '21

openSUSE Security Update: Security update for djvulibre ______________________________________________________________________________ Announcement ID: openSUSE-SU-2021:0877-1 Rating: important References: #1186253 Cross-References: CVE-2021-3500 CVSS scores: CVE-2021-3500 (SUSE): 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H Affected Products: openSUSE Leap 15.2 ______________________________________________________________________________ An update that fixes one vulnerability is now available. Description: This update for djvulibre fixes the following issues: - CVE-2021-3500: Stack overflow in function DJVU:DjVuDocument:get_djvu_file() via crafted djvu file (bsc#1186253) This update was imported from the SUSE:SLE-15-SP2:Update update project. Patch Instructions: To install this openSUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 15.2: zypper in -t patch openSUSE-2021-877=1 Package List: - openSUSE Leap 15.2 (i586 x86_64): djvulibre-3.5.27-lp152.7.6.1 djvulibre-debuginfo-3.5.27-lp152.7.6.1 djvulibre-debugsource-3.5.27-lp152.7.6.1 libdjvulibre-devel-3.5.27-lp152.7.6.1 libdjvulibre21-3.5.27-lp152.7.6.1 libdjvulibre21-debuginfo-3.5.27-lp152.7.6.1 - openSUSE Leap 15.2 (noarch): djvulibre-doc-3.5.27-lp152.7.6.1 References: https://www.suse.com/security/cve/CVE-2021-3500.html https://bugzilla.suse.com/1186253

1 0