July 2021 - openSUSE Updates - openSUSE Mailing Lists

openSUSE-RU-2021:1879-1: important: Recommended update for libzypp, zypper
by maintenance＠opensuse.org 10 Jul '21

10 Jul '21

openSUSE Recommended Update: Recommended update for libzypp, zypper ______________________________________________________________________________ Announcement ID: openSUSE-RU-2021:1879-1 Rating: important References: #1184326 #1184399 #1184997 #1185325 Affected Products: openSUSE Leap 15.3 ______________________________________________________________________________ An update that has four recommended fixes can now be installed. Description: This update for libzypp, zypper fixes the following issues: libzypp was updated to 17.26.0: - Work around download.o.o broken https redirects. - Allow trusted repos to add additional signing keys (bsc#1184326) Repositories signed with a trusted gpg key may import additional package signing keys. This is needed if different keys were used to sign the the packages shipped by the repository. - MediaCurl: Fix logging of redirects. - Use 15.3 resolver problem and solution texts on all distros. - $ZYPP_LOCK_TIMEOUT: Let negative values wait forever for the zypp lock (bsc#1184399) Helps boot time services like 'zypper purge-kernels' to wait for the zypp lock until other services using zypper have completed. - Fix purge-kernels is broken in Leap 15.3 (bsc#1185325) Leap 15.3 introduces a new kernel package called kernel-flavour-extra, which contain kmp's. Currently kmp's are detected by name ".*-kmp(-.*)?" but this does not work which those new packages. This patch fixes the problem by checking packages for kmod(*) and ksym(*) provides and only falls back to name checking if the package in question does not provide one of those. - Introduce zypp-runpurge, a tool to run purge-kernels on testcases. zypper was updated to 1.14.45: - Fix service detection with cgroupv2 (bsc#1184997) - Add hints to 'trust GPG key' prompt. - Add report when receiving new package signing keys from a trusted repo (bsc#1184326) - Added translation using Weblate (Kabyle) Patch Instructions: To install this openSUSE Recommended Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 15.3: zypper in -t patch openSUSE-SLE-15.3-2021-1879=1 Package List: - openSUSE Leap 15.3 (aarch64 ppc64le s390x x86_64): libsolv-debuginfo-0.7.19-6.1 libsolv-debugsource-0.7.19-6.1 libsolv-demo-0.7.19-6.1 libsolv-demo-debuginfo-0.7.19-6.1 libsolv-devel-0.7.19-6.1 libsolv-devel-debuginfo-0.7.19-6.1 libsolv-tools-0.7.19-6.1 libsolv-tools-debuginfo-0.7.19-6.1 libzypp-17.26.0-9.1 libzypp-debuginfo-17.26.0-9.1 libzypp-debugsource-17.26.0-9.1 libzypp-devel-17.26.0-9.1 libzypp-devel-doc-17.26.0-9.1 perl-solv-0.7.19-6.1 perl-solv-debuginfo-0.7.19-6.1 python-solv-0.7.19-6.1 python-solv-debuginfo-0.7.19-6.1 python3-solv-0.7.19-6.1 python3-solv-debuginfo-0.7.19-6.1 ruby-solv-0.7.19-6.1 ruby-solv-debuginfo-0.7.19-6.1 zypper-1.14.45-10.1 zypper-debuginfo-1.14.45-10.1 zypper-debugsource-1.14.45-10.1 - openSUSE Leap 15.3 (noarch): zypper-aptitude-1.14.45-10.1 zypper-log-1.14.45-10.1 zypper-needs-restarting-1.14.45-10.1 References: https://bugzilla.suse.com/1184326 https://bugzilla.suse.com/1184399 https://bugzilla.suse.com/1184997 https://bugzilla.suse.com/1185325

1 0

openSUSE-RU-2021:2286-1: moderate: Recommended update for dosfstools
by maintenance＠opensuse.org 10 Jul '21

10 Jul '21

openSUSE Recommended Update: Recommended update for dosfstools ______________________________________________________________________________ Announcement ID: openSUSE-RU-2021:2286-1 Rating: moderate References: #1172863 Affected Products: openSUSE Leap 15.3 ______________________________________________________________________________ An update that has one recommended fix can now be installed. Description: This update for dosfstools fixes the following issue: - Fixed a bug that was causing an installation issue when trying to create an EFI partition on an NVMe-over-Fabrics device (bsc#1172863) Patch Instructions: To install this openSUSE Recommended Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 15.3: zypper in -t patch openSUSE-SLE-15.3-2021-2286=1 Package List: - openSUSE Leap 15.3 (aarch64 ppc64le s390x x86_64): dosfstools-4.1-3.3.1 dosfstools-debuginfo-4.1-3.3.1 dosfstools-debugsource-4.1-3.3.1 References: https://bugzilla.suse.com/1172863

1 0

openSUSE-RU-2021:1018-1: moderate: Recommended update for mariadb-connector-c
by maintenance＠lists.opensuse.org 10 Jul '21

10 Jul '21

openSUSE Recommended Update: Recommended update for mariadb-connector-c ______________________________________________________________________________ Announcement ID: openSUSE-RU-2021:1018-1 Rating: moderate References: #1179921 #1183878 #1185868 #1185870 #1185872 #1187459 Affected Products: openSUSE Leap 15.2 ______________________________________________________________________________ An update that has 6 recommended fixes can now be installed. Description: This update for mariadb-connector-c fixes the following issues: Update to release 3.1.13 [bsc#1185870], [bsc#1185872], [bsc#1185868] - CONC-537: Only read from MYSQL_HOME if MARIADB_HOME was not set - CONC-548: Symbol conflict with libsodium - CONC-490: Handshake error when CLIENT_CONNECT_WITH_DB flag was set without specifying database - CONC-543: Hash functions conflict with GnuTLS - CONC-539: Added cipher suites ECDHE-RSA-AES128-SHA256 (0xC027) and ECDHE-RSA-AES256-SHA384 (0xC028) to the cipher map which maps cipher suite names to the corresponding algorithm ids (Windows Schannel) - CONC-535: Disabled checksum ignored in events (replication/ binlog API) This update was imported from the SUSE:SLE-15:Update update project. Patch Instructions: To install this openSUSE Recommended Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 15.2: zypper in -t patch openSUSE-2021-1018=1 Package List: - openSUSE Leap 15.2 (i586 x86_64): libmariadb-devel-3.1.13-lp152.10.1 libmariadb-devel-debuginfo-3.1.13-lp152.10.1 libmariadb3-3.1.13-lp152.10.1 libmariadb3-debuginfo-3.1.13-lp152.10.1 libmariadb_plugins-3.1.13-lp152.10.1 libmariadb_plugins-debuginfo-3.1.13-lp152.10.1 libmariadbprivate-3.1.13-lp152.10.1 libmariadbprivate-debuginfo-3.1.13-lp152.10.1 mariadb-connector-c-debugsource-3.1.13-lp152.10.1 - openSUSE Leap 15.2 (x86_64): libmariadb3-32bit-3.1.13-lp152.10.1 libmariadb3-32bit-debuginfo-3.1.13-lp152.10.1 References: https://bugzilla.suse.com/1179921 https://bugzilla.suse.com/1183878 https://bugzilla.suse.com/1185868 https://bugzilla.suse.com/1185870 https://bugzilla.suse.com/1185872 https://bugzilla.suse.com/1187459

1 0

openSUSE-SU-2021:1914-1: moderate: Security update for libopenmpt
by security＠lists.opensuse.org 09 Jul '21

09 Jul '21

openSUSE Security Update: Security update for libopenmpt ______________________________________________________________________________ Announcement ID: openSUSE-SU-2021:1914-1 Rating: moderate References: #1186663 Affected Products: openSUSE Leap 15.3 ______________________________________________________________________________ An update that contains security fixes can now be installed. Description: This update for libopenmpt fixes the following issues: Various bugfix and stability issues were fixed, some of those might have security impact. libopenmpt was updated to 0.3.28: * Fixed excessive memory consumption with malformed files in various formats. Changes in 0.3.27: * AMS: Avoid allocating excessive amount of memory for compressed song message in malformed files. * S3M: Some samples were imported with a too high sample rate if module was saved with Scream Tracker 3. Changes in 0.3.26: * DMF: Improve import of finetune effect with parameters larger than +/-15. Changes in 0.3.25: * AMS: An upper bound for uncompressed sample size is now established to avoid memory exhaustion from malformed files. * MO3: Avoid certain ModPlug hacks from being fixed up twice, which could lead to e.g. very narrow pan swing range for old OpenMPT IT files saved with a recent MO3 encoder version. * IMF: Instrument sample mapping was off by one octave, notable in the guitar part of Astaris by Karsten Koch. * PLM: Percentage offset (Mxx) was slightly off. Changes in 0.3.24: * PP20: The first few bytes of some files were not decompressed properly, making some files unplayable (depending on the original format). Changes in 0.3.23: * IT: Global volume slides with both nibbles set preferred the ��slide up�� nibble over the ��slide down�� nibble in old OpenMPT versions, unlike other slides. Such old files are now imported correctly again. * IT: Fixed an edge case where, if the filter hit full cutoff / no resonance on the first tick of a row where a new delayed note would be triggered, the filter would be disabled even though it should stay active. Fixes trace.it by maddie. * XM: Out-of-range arpeggio clamping behaviour broke in OpenMPT 1.23.05.00. The arpeggios in Binary World by Dakota now play correctly again. * S3M: Support old-style sample pre-amp value in very early S3M files. * S3M: Only force-enable fast slides for files ST 3.00. Previously, any S3M file made with an ST3 version older than 3.20 enabled them. * M15: Improve tracker detection heuristics to never assume SoundTracker 2.0 if there is a huge number of Dxx commands, as that is a definite hint that they should be treated as volume slides. Fixes Monty On The Run by Master Blaster. Changes in 0.3.22: * IT: Disable retrigger with short notes quirk for modules saved with Chibi Tracker, as it does not implement that quirk. * MOD: Fix early song ending due to ProTracker pattern jump quirk (EEx + Dxx on same row) if infinite looping is disabled. Fixes Haunted Tracks.mod by Triace. * MOD: Vibrato type ��ramp down�� was upside down. Changes in 0.3.21: * IT: Vibrato was too fast in Old Effects mode since libopenmpt 0.3. * XM: Treat 8bitbubsy��s FT2 clone exactly like Fasttracker 2 with respect to compatibility and playback flags. For example, FT2 Pan Law was not applied. * DMF: Some files had a wrong tempo since libopenmpt 0.2.5705-beta15. Patch Instructions: To install this openSUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 15.3: zypper in -t patch openSUSE-SLE-15.3-2021-1914=1 Package List: - openSUSE Leap 15.3 (aarch64 ppc64le s390x x86_64): libmodplug-devel-0.3.28-2.13.1 libmodplug1-0.3.28-2.13.1 libmodplug1-debuginfo-0.3.28-2.13.1 libopenmpt-debugsource-0.3.28-2.13.1 libopenmpt-devel-0.3.28-2.13.1 libopenmpt0-0.3.28-2.13.1 libopenmpt0-debuginfo-0.3.28-2.13.1 libopenmpt_modplug1-0.3.28-2.13.1 libopenmpt_modplug1-debuginfo-0.3.28-2.13.1 openmpt123-0.3.28-2.13.1 openmpt123-debuginfo-0.3.28-2.13.1 - openSUSE Leap 15.3 (x86_64): libmodplug1-32bit-0.3.28-2.13.1 libmodplug1-32bit-debuginfo-0.3.28-2.13.1 libopenmpt0-32bit-0.3.28-2.13.1 libopenmpt0-32bit-debuginfo-0.3.28-2.13.1 libopenmpt_modplug1-32bit-0.3.28-2.13.1 libopenmpt_modplug1-32bit-debuginfo-0.3.28-2.13.1 References: https://bugzilla.suse.com/1186663

1 0

openSUSE-RU-2021:2193-1: moderate: Recommended update for tar
by maintenance＠lists.opensuse.org 09 Jul '21

09 Jul '21

openSUSE Recommended Update: Recommended update for tar ______________________________________________________________________________ Announcement ID: openSUSE-RU-2021:2193-1 Rating: moderate References: #1184124 Affected Products: openSUSE Leap 15.3 ______________________________________________________________________________ An update that has one recommended fix can now be installed. Description: This update for tar fixes the following issues: - Link '/var/lib/tests/tar/bin/genfile' as Position-Independent Executable (bsc#1184124) Patch Instructions: To install this openSUSE Recommended Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 15.3: zypper in -t patch openSUSE-SLE-15.3-2021-2193=1 Package List: - openSUSE Leap 15.3 (aarch64 ppc64le s390x x86_64): tar-1.30-3.9.1 tar-debuginfo-1.30-3.9.1 tar-debugsource-1.30-3.9.1 tar-rmt-1.30-3.9.1 tar-rmt-debuginfo-1.30-3.9.1 tar-tests-1.30-3.9.1 tar-tests-debuginfo-1.30-3.9.1 - openSUSE Leap 15.3 (noarch): tar-backup-scripts-1.30-3.9.1 tar-doc-1.30-3.9.1 tar-lang-1.30-3.9.1 References: https://bugzilla.suse.com/1184124

1 0

openSUSE-SU-2021:2011-1: important: Security update for xterm
by security＠lists.opensuse.org 09 Jul '21

09 Jul '21

openSUSE Security Update: Security update for xterm ______________________________________________________________________________ Announcement ID: openSUSE-SU-2021:2011-1 Rating: important References: #1182091 Cross-References: CVE-2021-27135 CVSS scores: CVE-2021-27135 (NVD) : 9.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H CVE-2021-27135 (SUSE): 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H Affected Products: openSUSE Leap 15.3 ______________________________________________________________________________ An update that fixes one vulnerability is now available. Description: This update for xterm fixes the following issues: - CVE-2021-27135: Fixed buffer-overflow when clicking on selected utf8 text. (bsc#1182091) Patch Instructions: To install this openSUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 15.3: zypper in -t patch openSUSE-SLE-15.3-2021-2011=1 Package List: - openSUSE Leap 15.3 (aarch64 ppc64le s390x x86_64): xterm-330-11.3.1 xterm-bin-330-11.3.1 xterm-bin-debuginfo-330-11.3.1 xterm-debugsource-330-11.3.1 References: https://www.suse.com/security/cve/CVE-2021-27135.html https://bugzilla.suse.com/1182091

1 0

openSUSE-SU-2021:2213-1: moderate: Security update for qemu
by security＠lists.opensuse.org 09 Jul '21

09 Jul '21

openSUSE Security Update: Security update for qemu ______________________________________________________________________________ Announcement ID: openSUSE-SU-2021:2213-1 Rating: moderate References: #1185981 #1185990 #1186010 Cross-References: CVE-2021-3544 CVE-2021-3545 CVE-2021-3546 CVSS scores: CVE-2021-3544 (NVD) : 6.5 CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:N/I:N/A:H CVE-2021-3544 (SUSE): 5 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:N/A:N CVE-2021-3545 (NVD) : 6.5 CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N CVE-2021-3545 (SUSE): 5 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:N/A:N CVE-2021-3546 (NVD) : 8.2 CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H CVE-2021-3546 (SUSE): 6.5 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H Affected Products: openSUSE Leap 15.3 ______________________________________________________________________________ An update that fixes three vulnerabilities is now available. Description: This update for qemu fixes the following issues: - CVE-2021-3546: Fixed out-of-bounds write in virgl_cmd_get_capset (bsc#1185981). - CVE-2021-3544: Fixed memory leaks found in the virtio vhost-user GPU device (bsc#1186010). - CVE-2021-3545: Fixed information disclosure due to uninitialized memory read (bsc#1185990). Patch Instructions: To install this openSUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 15.3: zypper in -t patch openSUSE-SLE-15.3-2021-2213=1 Package List: - openSUSE Leap 15.3 (aarch64 ppc64le s390x x86_64): qemu-5.2.0-20.1 qemu-arm-5.2.0-20.1 qemu-arm-debuginfo-5.2.0-20.1 qemu-audio-alsa-5.2.0-20.1 qemu-audio-alsa-debuginfo-5.2.0-20.1 qemu-audio-pa-5.2.0-20.1 qemu-audio-pa-debuginfo-5.2.0-20.1 qemu-audio-spice-5.2.0-20.1 qemu-audio-spice-debuginfo-5.2.0-20.1 qemu-block-curl-5.2.0-20.1 qemu-block-curl-debuginfo-5.2.0-20.1 qemu-block-dmg-5.2.0-20.1 qemu-block-dmg-debuginfo-5.2.0-20.1 qemu-block-gluster-5.2.0-20.1 qemu-block-gluster-debuginfo-5.2.0-20.1 qemu-block-iscsi-5.2.0-20.1 qemu-block-iscsi-debuginfo-5.2.0-20.1 qemu-block-nfs-5.2.0-20.1 qemu-block-nfs-debuginfo-5.2.0-20.1 qemu-block-rbd-5.2.0-20.1 qemu-block-rbd-debuginfo-5.2.0-20.1 qemu-block-ssh-5.2.0-20.1 qemu-block-ssh-debuginfo-5.2.0-20.1 qemu-chardev-baum-5.2.0-20.1 qemu-chardev-baum-debuginfo-5.2.0-20.1 qemu-chardev-spice-5.2.0-20.1 qemu-chardev-spice-debuginfo-5.2.0-20.1 qemu-debuginfo-5.2.0-20.1 qemu-debugsource-5.2.0-20.1 qemu-extra-5.2.0-20.1 qemu-extra-debuginfo-5.2.0-20.1 qemu-guest-agent-5.2.0-20.1 qemu-guest-agent-debuginfo-5.2.0-20.1 qemu-hw-display-qxl-5.2.0-20.1 qemu-hw-display-qxl-debuginfo-5.2.0-20.1 qemu-hw-display-virtio-gpu-5.2.0-20.1 qemu-hw-display-virtio-gpu-debuginfo-5.2.0-20.1 qemu-hw-display-virtio-gpu-pci-5.2.0-20.1 qemu-hw-display-virtio-gpu-pci-debuginfo-5.2.0-20.1 qemu-hw-display-virtio-vga-5.2.0-20.1 qemu-hw-display-virtio-vga-debuginfo-5.2.0-20.1 qemu-hw-s390x-virtio-gpu-ccw-5.2.0-20.1 qemu-hw-s390x-virtio-gpu-ccw-debuginfo-5.2.0-20.1 qemu-hw-usb-redirect-5.2.0-20.1 qemu-hw-usb-redirect-debuginfo-5.2.0-20.1 qemu-hw-usb-smartcard-5.2.0-20.1 qemu-hw-usb-smartcard-debuginfo-5.2.0-20.1 qemu-ivshmem-tools-5.2.0-20.1 qemu-ivshmem-tools-debuginfo-5.2.0-20.1 qemu-ksm-5.2.0-20.1 qemu-lang-5.2.0-20.1 qemu-ppc-5.2.0-20.1 qemu-ppc-debuginfo-5.2.0-20.1 qemu-s390x-5.2.0-20.1 qemu-s390x-debuginfo-5.2.0-20.1 qemu-tools-5.2.0-20.1 qemu-tools-debuginfo-5.2.0-20.1 qemu-ui-curses-5.2.0-20.1 qemu-ui-curses-debuginfo-5.2.0-20.1 qemu-ui-gtk-5.2.0-20.1 qemu-ui-gtk-debuginfo-5.2.0-20.1 qemu-ui-opengl-5.2.0-20.1 qemu-ui-opengl-debuginfo-5.2.0-20.1 qemu-ui-spice-app-5.2.0-20.1 qemu-ui-spice-app-debuginfo-5.2.0-20.1 qemu-ui-spice-core-5.2.0-20.1 qemu-ui-spice-core-debuginfo-5.2.0-20.1 qemu-vhost-user-gpu-5.2.0-20.1 qemu-vhost-user-gpu-debuginfo-5.2.0-20.1 qemu-x86-5.2.0-20.1 qemu-x86-debuginfo-5.2.0-20.1 - openSUSE Leap 15.3 (s390x x86_64): qemu-kvm-5.2.0-20.1 - openSUSE Leap 15.3 (noarch): qemu-ipxe-1.0.0+-20.1 qemu-microvm-5.2.0-20.1 qemu-seabios-1.14.0_0_g155821a-20.1 qemu-sgabios-8-20.1 qemu-skiboot-5.2.0-20.1 qemu-vgabios-1.14.0_0_g155821a-20.1 References: https://www.suse.com/security/cve/CVE-2021-3544.html https://www.suse.com/security/cve/CVE-2021-3545.html https://www.suse.com/security/cve/CVE-2021-3546.html https://bugzilla.suse.com/1185981 https://bugzilla.suse.com/1185990 https://bugzilla.suse.com/1186010

1 0

openSUSE-RU-2021:1015-1: moderate: Recommended update for yast2
by maintenance＠lists.opensuse.org 09 Jul '21

09 Jul '21

openSUSE Recommended Update: Recommended update for yast2 ______________________________________________________________________________ Announcement ID: openSUSE-RU-2021:1015-1 Rating: moderate References: #1187018 Affected Products: openSUSE Leap 15.2 ______________________________________________________________________________ An update that has one recommended fix can now be installed. Description: This update for yast2 fixes the following issues: - Ignore 'sysctl' configuration files that do not have the '.conf', extension except kernel files. (bsc#1187018) This update was imported from the SUSE:SLE-15-SP2:Update update project. Patch Instructions: To install this openSUSE Recommended Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 15.2: zypper in -t patch openSUSE-2021-1015=1 Package List: - openSUSE Leap 15.2 (i586 x86_64): yast2-4.2.94-lp152.2.28.1 yast2-logs-4.2.94-lp152.2.28.1 References: https://bugzilla.suse.com/1187018

1 0

openSUSE-SU-2021:1016-1: important: Security update for libqt5-qtwebengine
by security＠lists.opensuse.org 09 Jul '21

09 Jul '21

openSUSE Security Update: Security update for libqt5-qtwebengine ______________________________________________________________________________ Announcement ID: openSUSE-SU-2021:1016-1 Rating: important References: #1130395 #1158516 #1163744 #1163766 #1182233 Cross-References: CVE-2020-16044 CVE-2021-21118 CVE-2021-21119 CVE-2021-21120 CVE-2021-21121 CVE-2021-21122 CVE-2021-21123 CVE-2021-21125 CVE-2021-21126 CVE-2021-21127 CVE-2021-21128 CVE-2021-21129 CVE-2021-21130 CVE-2021-21131 CVE-2021-21132 CVE-2021-21135 CVE-2021-21137 CVE-2021-21140 CVE-2021-21141 CVE-2021-21145 CVE-2021-21146 CVE-2021-21147 CVE-2021-21148 CVE-2021-21149 CVE-2021-21150 CVE-2021-21152 CVE-2021-21153 CVE-2021-21156 CVE-2021-21157 CVSS scores: CVE-2020-16044 (SUSE): 7.5 CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H CVE-2021-21118 (NVD) : 8.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H CVE-2021-21119 (NVD) : 8.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H CVE-2021-21120 (NVD) : 8.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H CVE-2021-21121 (NVD) : 9.6 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H CVE-2021-21122 (NVD) : 8.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H CVE-2021-21123 (NVD) : 6.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N CVE-2021-21125 (NVD) : 8.1 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:N CVE-2021-21126 (NVD) : 6.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N CVE-2021-21127 (NVD) : 8.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H CVE-2021-21128 (NVD) : 8.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H CVE-2021-21129 (NVD) : 6.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N CVE-2021-21130 (NVD) : 6.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N CVE-2021-21131 (NVD) : 6.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N CVE-2021-21132 (NVD) : 9.6 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H CVE-2021-21135 (NVD) : 6.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N CVE-2021-21137 (NVD) : 6.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N CVE-2021-21140 (NVD) : 6.8 CVSS:3.1/AV:P/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H CVE-2021-21141 (NVD) : 6.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N CVE-2021-21148 (NVD) : 8.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H Affected Products: openSUSE Backports SLE-15-SP2 ______________________________________________________________________________ An update that fixes 29 vulnerabilities is now available. Description: This update for libqt5-qtwebengine fixes the following issues: Update to version 5.15.3 CVE fixes backported in chromium updates: - CVE-2020-16044: Use after free in WebRTC - CVE-2021-21118: Heap buffer overflow in Blink - CVE-2021-21119: Use after free in Media - CVE-2021-21120: Use after free in WebSQL - CVE-2021-21121: Use after free in Omnibox - CVE-2021-21122: Use after free in Blink - CVE-2021-21123: Insufficient data validation in File System API - CVE-2021-21125: Insufficient policy enforcement in File System API - CVE-2021-21126: Insufficient policy enforcement in extensions - CVE-2021-21127: Insufficient policy enforcement in extensions - CVE-2021-21128: Heap buffer overflow in Blink - CVE-2021-21129: Insufficient policy enforcement in File System API - CVE-2021-21130: Insufficient policy enforcement in File System API - CVE-2021-21131: Insufficient policy enforcement in File System API - CVE-2021-21132: Inappropriate implementation in DevTools - CVE-2021-21135: Inappropriate implementation in Performance API - CVE-2021-21137: Inappropriate implementation in DevTools - CVE-2021-21140: Uninitialized Use in USB - CVE-2021-21141: Insufficient policy enforcement in File System API - CVE-2021-21145: Use after free in Fonts - CVE-2021-21146: Use after free in Navigation - CVE-2021-21147: Inappropriate implementation in Skia - CVE-2021-21148: Heap buffer overflow in V8 - CVE-2021-21149: Stack overflow in Data Transfer - CVE-2021-21150: Use after free in Downloads - CVE-2021-21152: Heap buffer overflow in Media - CVE-2021-21153: Stack overflow in GPU Process - CVE-2021-21156: Heap buffer overflow in V8 - CVE-2021-21157: Use after free in Web Sockets This update was imported from the openSUSE:Leap:15.2:Update update project. Patch Instructions: To install this openSUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Backports SLE-15-SP2: zypper in -t patch openSUSE-2021-1016=1 Package List: - openSUSE Backports SLE-15-SP2 (aarch64 x86_64): libQt5Pdf5-5.15.3-bp152.3.3.1 libQt5PdfWidgets5-5.15.3-bp152.3.3.1 libqt5-qtpdf-devel-5.15.3-bp152.3.3.1 libqt5-qtpdf-examples-5.15.3-bp152.3.3.1 libqt5-qtpdf-imports-5.15.3-bp152.3.3.1 libqt5-qtwebengine-5.15.3-bp152.3.3.1 libqt5-qtwebengine-devel-5.15.3-bp152.3.3.1 libqt5-qtwebengine-examples-5.15.3-bp152.3.3.1 - openSUSE Backports SLE-15-SP2 (noarch): libqt5-qtpdf-private-headers-devel-5.15.3-bp152.3.3.1 libqt5-qtwebengine-private-headers-devel-5.15.3-bp152.3.3.1 References: https://www.suse.com/security/cve/CVE-2020-16044.html https://www.suse.com/security/cve/CVE-2021-21118.html https://www.suse.com/security/cve/CVE-2021-21119.html https://www.suse.com/security/cve/CVE-2021-21120.html https://www.suse.com/security/cve/CVE-2021-21121.html https://www.suse.com/security/cve/CVE-2021-21122.html https://www.suse.com/security/cve/CVE-2021-21123.html https://www.suse.com/security/cve/CVE-2021-21125.html https://www.suse.com/security/cve/CVE-2021-21126.html https://www.suse.com/security/cve/CVE-2021-21127.html https://www.suse.com/security/cve/CVE-2021-21128.html https://www.suse.com/security/cve/CVE-2021-21129.html https://www.suse.com/security/cve/CVE-2021-21130.html https://www.suse.com/security/cve/CVE-2021-21131.html https://www.suse.com/security/cve/CVE-2021-21132.html https://www.suse.com/security/cve/CVE-2021-21135.html https://www.suse.com/security/cve/CVE-2021-21137.html https://www.suse.com/security/cve/CVE-2021-21140.html https://www.suse.com/security/cve/CVE-2021-21141.html https://www.suse.com/security/cve/CVE-2021-21145.html https://www.suse.com/security/cve/CVE-2021-21146.html https://www.suse.com/security/cve/CVE-2021-21147.html https://www.suse.com/security/cve/CVE-2021-21148.html https://www.suse.com/security/cve/CVE-2021-21149.html https://www.suse.com/security/cve/CVE-2021-21150.html https://www.suse.com/security/cve/CVE-2021-21152.html https://www.suse.com/security/cve/CVE-2021-21153.html https://www.suse.com/security/cve/CVE-2021-21156.html https://www.suse.com/security/cve/CVE-2021-21157.html https://bugzilla.suse.com/1130395 https://bugzilla.suse.com/1158516 https://bugzilla.suse.com/1163744 https://bugzilla.suse.com/1163766 https://bugzilla.suse.com/1182233

1 0

openSUSE-RU-2021:1861-1: moderate: Recommended update for gcc10
by maintenance＠lists.opensuse.org 09 Jul '21

09 Jul '21

openSUSE Recommended Update: Recommended update for gcc10 ______________________________________________________________________________ Announcement ID: openSUSE-RU-2021:1861-1 Rating: moderate References: #1029961 #1106014 #1178577 #1178624 #1178675 #1182016 Affected Products: openSUSE Leap 15.3 ______________________________________________________________________________ An update that has 6 recommended fixes can now be installed. Description: This update for gcc10 fixes the following issues: - Disable nvptx offloading for aarch64 again since it doesn't work - Fixed a build failure issue. (bsc#1182016) - Fix for memory miscompilation on 'aarch64'. (bsc#1178624, bsc#1178577) - Fix 32bit 'libgnat.so' link. (bsc#1178675) - prepare usrmerge: Install libgcc_s into %_libdir. ABI wise it stays /%lib. (bsc#1029961) - Build complete set of multilibs for arm-none target. (bsc#1106014) Patch Instructions: To install this openSUSE Recommended Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 15.3: zypper in -t patch openSUSE-SLE-15.3-2021-1861=1 Package List: - openSUSE Leap 15.3 (aarch64 ppc64le s390x x86_64): cpp10-10.3.0+git1587-1.6.4 cpp10-debuginfo-10.3.0+git1587-1.6.4 cross-arm-gcc10-10.3.0+git1587-1.6.3 cross-arm-gcc10-debuginfo-10.3.0+git1587-1.6.3 cross-arm-gcc10-debugsource-10.3.0+git1587-1.6.3 cross-arm-gcc10-icecream-backend-10.3.0+git1587-1.6.3 cross-hppa-gcc10-10.3.0+git1587-1.6.3 cross-hppa-gcc10-debuginfo-10.3.0+git1587-1.6.3 cross-hppa-gcc10-debugsource-10.3.0+git1587-1.6.3 cross-hppa-gcc10-icecream-backend-10.3.0+git1587-1.6.3 cross-i386-gcc10-10.3.0+git1587-1.6.3 cross-i386-gcc10-debuginfo-10.3.0+git1587-1.6.3 cross-i386-gcc10-debugsource-10.3.0+git1587-1.6.3 cross-i386-gcc10-icecream-backend-10.3.0+git1587-1.6.3 cross-m68k-gcc10-10.3.0+git1587-1.6.3 cross-m68k-gcc10-debuginfo-10.3.0+git1587-1.6.3 cross-m68k-gcc10-debugsource-10.3.0+git1587-1.6.3 cross-m68k-gcc10-icecream-backend-10.3.0+git1587-1.6.3 cross-mips-gcc10-10.3.0+git1587-1.6.3 cross-mips-gcc10-debuginfo-10.3.0+git1587-1.6.3 cross-mips-gcc10-debugsource-10.3.0+git1587-1.6.3 cross-mips-gcc10-icecream-backend-10.3.0+git1587-1.6.3 cross-ppc64-gcc10-10.3.0+git1587-1.6.3 cross-ppc64-gcc10-debuginfo-10.3.0+git1587-1.6.3 cross-ppc64-gcc10-debugsource-10.3.0+git1587-1.6.3 cross-ppc64-gcc10-icecream-backend-10.3.0+git1587-1.6.3 cross-riscv64-gcc10-10.3.0+git1587-1.6.3 cross-riscv64-gcc10-debuginfo-10.3.0+git1587-1.6.3 cross-riscv64-gcc10-debugsource-10.3.0+git1587-1.6.3 cross-riscv64-gcc10-icecream-backend-10.3.0+git1587-1.6.3 cross-sparc-gcc10-10.3.0+git1587-1.6.3 cross-sparc-gcc10-debuginfo-10.3.0+git1587-1.6.3 cross-sparc-gcc10-debugsource-10.3.0+git1587-1.6.3 cross-sparc64-gcc10-10.3.0+git1587-1.6.3 cross-sparc64-gcc10-debuginfo-10.3.0+git1587-1.6.3 cross-sparc64-gcc10-debugsource-10.3.0+git1587-1.6.3 cross-sparc64-gcc10-icecream-backend-10.3.0+git1587-1.6.3 cross-sparcv9-gcc10-icecream-backend-10.3.0+git1587-1.6.3 gcc10-10.3.0+git1587-1.6.4 gcc10-ada-10.3.0+git1587-1.6.4 gcc10-ada-debuginfo-10.3.0+git1587-1.6.4 gcc10-c++-10.3.0+git1587-1.6.4 gcc10-c++-debuginfo-10.3.0+git1587-1.6.4 gcc10-debuginfo-10.3.0+git1587-1.6.4 gcc10-debugsource-10.3.0+git1587-1.6.4 gcc10-fortran-10.3.0+git1587-1.6.4 gcc10-fortran-debuginfo-10.3.0+git1587-1.6.4 gcc10-go-10.3.0+git1587-1.6.4 gcc10-go-debuginfo-10.3.0+git1587-1.6.4 gcc10-locale-10.3.0+git1587-1.6.4 gcc10-obj-c++-10.3.0+git1587-1.6.4 gcc10-obj-c++-debuginfo-10.3.0+git1587-1.6.4 gcc10-objc-10.3.0+git1587-1.6.4 gcc10-objc-debuginfo-10.3.0+git1587-1.6.4 gcc10-testresults-10.3.0+git1587-1.6.7 libada10-10.3.0+git1587-1.6.4 libada10-debuginfo-10.3.0+git1587-1.6.4 libasan6-10.3.0+git1587-1.6.4 libasan6-debuginfo-10.3.0+git1587-1.6.4 libatomic1-10.3.0+git1587-1.6.4 libatomic1-debuginfo-10.3.0+git1587-1.6.4 libgcc_s1-10.3.0+git1587-1.6.4 libgcc_s1-debuginfo-10.3.0+git1587-1.6.4 libgfortran5-10.3.0+git1587-1.6.4 libgfortran5-debuginfo-10.3.0+git1587-1.6.4 libgo16-10.3.0+git1587-1.6.4 libgo16-debuginfo-10.3.0+git1587-1.6.4 libgomp1-10.3.0+git1587-1.6.4 libgomp1-debuginfo-10.3.0+git1587-1.6.4 libitm1-10.3.0+git1587-1.6.4 libitm1-debuginfo-10.3.0+git1587-1.6.4 libobjc4-10.3.0+git1587-1.6.4 libobjc4-debuginfo-10.3.0+git1587-1.6.4 libstdc++6-10.3.0+git1587-1.6.4 libstdc++6-debuginfo-10.3.0+git1587-1.6.4 libstdc++6-devel-gcc10-10.3.0+git1587-1.6.4 libstdc++6-locale-10.3.0+git1587-1.6.4 libstdc++6-pp-gcc10-10.3.0+git1587-1.6.4 libubsan1-10.3.0+git1587-1.6.4 libubsan1-debuginfo-10.3.0+git1587-1.6.4 - openSUSE Leap 15.3 (aarch64 ppc64le x86_64): cross-s390x-gcc10-10.3.0+git1587-1.6.3 cross-s390x-gcc10-debuginfo-10.3.0+git1587-1.6.3 cross-s390x-gcc10-debugsource-10.3.0+git1587-1.6.3 cross-s390x-gcc10-icecream-backend-10.3.0+git1587-1.6.3 liblsan0-10.3.0+git1587-1.6.4 liblsan0-debuginfo-10.3.0+git1587-1.6.4 libtsan0-10.3.0+git1587-1.6.4 libtsan0-debuginfo-10.3.0+git1587-1.6.4 - openSUSE Leap 15.3 (aarch64 ppc64le s390x): cross-x86_64-gcc10-10.3.0+git1587-1.6.3 cross-x86_64-gcc10-debuginfo-10.3.0+git1587-1.6.3 cross-x86_64-gcc10-debugsource-10.3.0+git1587-1.6.3 cross-x86_64-gcc10-icecream-backend-10.3.0+git1587-1.6.3 - openSUSE Leap 15.3 (ppc64le s390x x86_64): cross-aarch64-gcc10-10.3.0+git1587-1.6.3 cross-aarch64-gcc10-debuginfo-10.3.0+git1587-1.6.3 cross-aarch64-gcc10-debugsource-10.3.0+git1587-1.6.3 cross-aarch64-gcc10-icecream-backend-10.3.0+git1587-1.6.3 - openSUSE Leap 15.3 (aarch64 s390x x86_64): cross-ppc64le-gcc10-10.3.0+git1587-1.6.3 cross-ppc64le-gcc10-debuginfo-10.3.0+git1587-1.6.3 cross-ppc64le-gcc10-debugsource-10.3.0+git1587-1.6.3 cross-ppc64le-gcc10-icecream-backend-10.3.0+git1587-1.6.3 gcc10-d-10.3.0+git1587-1.6.4 gcc10-d-debuginfo-10.3.0+git1587-1.6.4 libgdruntime1-10.3.0+git1587-1.6.4 libgdruntime1-debuginfo-10.3.0+git1587-1.6.4 libgphobos1-10.3.0+git1587-1.6.4 libgphobos1-debuginfo-10.3.0+git1587-1.6.4 - openSUSE Leap 15.3 (ppc64le x86_64): libquadmath0-10.3.0+git1587-1.6.4 libquadmath0-debuginfo-10.3.0+git1587-1.6.4 - openSUSE Leap 15.3 (s390x x86_64): gcc10-32bit-10.3.0+git1587-1.6.4 gcc10-ada-32bit-10.3.0+git1587-1.6.4 gcc10-c++-32bit-10.3.0+git1587-1.6.4 gcc10-d-32bit-10.3.0+git1587-1.6.4 gcc10-fortran-32bit-10.3.0+git1587-1.6.4 gcc10-go-32bit-10.3.0+git1587-1.6.4 gcc10-obj-c++-32bit-10.3.0+git1587-1.6.4 gcc10-objc-32bit-10.3.0+git1587-1.6.4 libada10-32bit-10.3.0+git1587-1.6.4 libada10-32bit-debuginfo-10.3.0+git1587-1.6.4 libasan6-32bit-10.3.0+git1587-1.6.4 libasan6-32bit-debuginfo-10.3.0+git1587-1.6.4 libatomic1-32bit-10.3.0+git1587-1.6.4 libatomic1-32bit-debuginfo-10.3.0+git1587-1.6.4 libgcc_s1-32bit-10.3.0+git1587-1.6.4 libgcc_s1-32bit-debuginfo-10.3.0+git1587-1.6.4 libgdruntime1-32bit-10.3.0+git1587-1.6.4 libgdruntime1-32bit-debuginfo-10.3.0+git1587-1.6.4 libgfortran5-32bit-10.3.0+git1587-1.6.4 libgfortran5-32bit-debuginfo-10.3.0+git1587-1.6.4 libgo16-32bit-10.3.0+git1587-1.6.4 libgo16-32bit-debuginfo-10.3.0+git1587-1.6.4 libgomp1-32bit-10.3.0+git1587-1.6.4 libgomp1-32bit-debuginfo-10.3.0+git1587-1.6.4 libgphobos1-32bit-10.3.0+git1587-1.6.4 libgphobos1-32bit-debuginfo-10.3.0+git1587-1.6.4 libitm1-32bit-10.3.0+git1587-1.6.4 libitm1-32bit-debuginfo-10.3.0+git1587-1.6.4 libobjc4-32bit-10.3.0+git1587-1.6.4 libobjc4-32bit-debuginfo-10.3.0+git1587-1.6.4 libstdc++6-32bit-10.3.0+git1587-1.6.4 libstdc++6-32bit-debuginfo-10.3.0+git1587-1.6.4 libstdc++6-devel-gcc10-32bit-10.3.0+git1587-1.6.4 libstdc++6-pp-gcc10-32bit-10.3.0+git1587-1.6.4 libubsan1-32bit-10.3.0+git1587-1.6.4 libubsan1-32bit-debuginfo-10.3.0+git1587-1.6.4 - openSUSE Leap 15.3 (noarch): gcc10-info-10.3.0+git1587-1.6.4 - openSUSE Leap 15.3 (x86_64): cross-nvptx-gcc10-10.3.0+git1587-1.6.3 cross-nvptx-gcc10-debuginfo-10.3.0+git1587-1.6.3 cross-nvptx-gcc10-debugsource-10.3.0+git1587-1.6.3 cross-nvptx-newlib10-devel-10.3.0+git1587-1.6.3 libquadmath0-32bit-10.3.0+git1587-1.6.4 libquadmath0-32bit-debuginfo-10.3.0+git1587-1.6.4 References: https://bugzilla.suse.com/1029961 https://bugzilla.suse.com/1106014 https://bugzilla.suse.com/1178577 https://bugzilla.suse.com/1178624 https://bugzilla.suse.com/1178675 https://bugzilla.suse.com/1182016

1 0