July 2021 - openSUSE Updates - openSUSE Mailing Lists

openSUSE-RU-2021:0963-1: moderate: Recommended update for automake
by maintenance＠opensuse.org 03 Jul '21

03 Jul '21

openSUSE Recommended Update: Recommended update for automake ______________________________________________________________________________ Announcement ID: openSUSE-RU-2021:0963-1 Rating: moderate References: #1040589 #1047218 #1182604 #1185540 #1186049 SLE-17848 Affected Products: openSUSE Leap 15.2 ______________________________________________________________________________ An update that has 5 recommended fixes and contains one feature can now be installed. Description: This update for automake fixes the following issues: - Implement generated autoconf makefiles reproducible (bsc#1182604) - Add fix to avoid date variations in docs. (bsc#1047218, jsc#SLE-17848) - Avoid bashisms in test-driver script. (bsc#1185540) This update for pcre fixes the following issues: - Do not run profiling 'check' in parallel to make package build reproducible. (bsc#1040589) This update for brp-check-suse fixes the following issues: - Add fixes to support reproducible builds. (bsc#1186049) This update was imported from the SUSE:SLE-15:Update update project. Patch Instructions: To install this openSUSE Recommended Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 15.2: zypper in -t patch openSUSE-2021-963=1 Package List: - openSUSE Leap 15.2 (i586 x86_64): brp-check-suse-84.87+git20181106.224b37d-lp152.2.12.1 libpcre1-8.41-lp152.7.3.1 libpcre1-debuginfo-8.41-lp152.7.3.1 libpcre16-0-8.41-lp152.7.3.1 libpcre16-0-debuginfo-8.41-lp152.7.3.1 libpcrecpp0-8.41-lp152.7.3.1 libpcrecpp0-debuginfo-8.41-lp152.7.3.1 libpcreposix0-8.41-lp152.7.3.1 libpcreposix0-debuginfo-8.41-lp152.7.3.1 pcre-debugsource-8.41-lp152.7.3.1 pcre-devel-8.41-lp152.7.3.1 pcre-devel-static-8.41-lp152.7.3.1 pcre-tools-8.41-lp152.7.3.1 pcre-tools-debuginfo-8.41-lp152.7.3.1 - openSUSE Leap 15.2 (noarch): automake-1.15.1-lp152.5.3.1 pcre-doc-8.41-lp152.7.3.1 - openSUSE Leap 15.2 (x86_64): libpcre1-32bit-8.41-lp152.7.3.1 libpcre1-32bit-debuginfo-8.41-lp152.7.3.1 libpcre16-0-32bit-8.41-lp152.7.3.1 libpcre16-0-32bit-debuginfo-8.41-lp152.7.3.1 libpcrecpp0-32bit-8.41-lp152.7.3.1 libpcrecpp0-32bit-debuginfo-8.41-lp152.7.3.1 libpcreposix0-32bit-8.41-lp152.7.3.1 libpcreposix0-32bit-debuginfo-8.41-lp152.7.3.1 References: https://bugzilla.suse.com/1040589 https://bugzilla.suse.com/1047218 https://bugzilla.suse.com/1182604 https://bugzilla.suse.com/1185540 https://bugzilla.suse.com/1186049

1 0

openSUSE-SU-2021:0959-1: important: Security update for roundcubemail
by opensuse-security＠opensuse.org 02 Jul '21

02 Jul '21

openSUSE Security Update: Security update for roundcubemail ______________________________________________________________________________ Announcement ID: openSUSE-SU-2021:0959-1 Rating: important References: #1180399 #1187706 #1187707 Cross-References: CVE-2020-18670 CVE-2020-18671 CVE-2020-35730 CVSS scores: CVE-2020-18670 (NVD) : 5.4 CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N CVE-2020-18671 (NVD) : 5.4 CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N CVE-2020-35730 (NVD) : 6.1 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N Affected Products: openSUSE Backports SLE-15-SP2 ______________________________________________________________________________ An update that fixes three vulnerabilities is now available. Description: This update for roundcubemail fixes the following issues: Upgrade to version 1.3.16 This is a security update to the LTS version 1.3. It fixes a recently reported stored cross-site scripting (XSS) vulnerability via HTML or plain text messages with malicious content. References: - CVE-2020-18670: Cross Site Scripting (XSS) vulneraibility via database host and user in /installer/test.php (boo#1187707) - CVE-2020-18671: Cross Site Scripting (XSS) vulnerability via smtp config in /installer/test.php (boo#1187706) - CVE-2020-35730: cross-site scripting (XSS) vulnerability via HTML or plain text messages with malicious content (boo#1180399) This update was imported from the openSUSE:Leap:15.2:Update update project. Patch Instructions: To install this openSUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Backports SLE-15-SP2: zypper in -t patch openSUSE-2021-959=1 Package List: - openSUSE Backports SLE-15-SP2 (noarch): roundcubemail-1.3.16-bp152.4.10.1 References: https://www.suse.com/security/cve/CVE-2020-18670.html https://www.suse.com/security/cve/CVE-2020-18671.html https://www.suse.com/security/cve/CVE-2020-35730.html https://bugzilla.suse.com/1180399 https://bugzilla.suse.com/1187706 https://bugzilla.suse.com/1187707

1 0

openSUSE-RU-2021:0961-1: moderate: Recommended update for alsa-oss
by maintenance＠opensuse.org 02 Jul '21

02 Jul '21

openSUSE Recommended Update: Recommended update for alsa-oss ______________________________________________________________________________ Announcement ID: openSUSE-RU-2021:0961-1 Rating: moderate References: #1181571 Affected Products: openSUSE Leap 15.2 ______________________________________________________________________________ An update that has one recommended fix can now be installed. Description: This update for alsa-oss fixes the following issues: Update from version 1.0.28 to version 1.1.8 (bsc#1181571) - Drop the superfluous build requires `alsa-topology-devel`. It is no longer mandatory. - Avoid repetition of name in package summary and updated description. - Fix build issues with the recent `glibc` (bsc#1181571) - Update the Free Software Foundation, Inc. address This update was imported from the SUSE:SLE-15:Update update project. Patch Instructions: To install this openSUSE Recommended Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 15.2: zypper in -t patch openSUSE-2021-961=1 Package List: - openSUSE Leap 15.2 (i586 x86_64): alsa-oss-1.1.8-lp152.4.3.1 alsa-oss-debuginfo-1.1.8-lp152.4.3.1 alsa-oss-debugsource-1.1.8-lp152.4.3.1 - openSUSE Leap 15.2 (x86_64): alsa-oss-32bit-1.1.8-lp152.4.3.1 alsa-oss-32bit-debuginfo-1.1.8-lp152.4.3.1 References: https://bugzilla.suse.com/1181571

1 0

openSUSE-SU-2021:0962-1: moderate: Security update for lua53
by opensuse-security＠opensuse.org 02 Jul '21

02 Jul '21

openSUSE Security Update: Security update for lua53 ______________________________________________________________________________ Announcement ID: openSUSE-SU-2021:0962-1 Rating: moderate References: #1175448 #1175449 Cross-References: CVE-2020-24370 CVE-2020-24371 CVSS scores: CVE-2020-24370 (NVD) : 5.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L CVE-2020-24370 (SUSE): 4 CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L CVE-2020-24371 (NVD) : 5.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L CVE-2020-24371 (SUSE): 5.1 CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H Affected Products: openSUSE Leap 15.2 ______________________________________________________________________________ An update that fixes two vulnerabilities is now available. Description: This update for lua53 fixes the following issues: Update to version 5.3.6: - CVE-2020-24371: lgc.c mishandles the interaction between barriers and the sweep phase, leading to a memory access violation involving collectgarbage (bsc#1175449) - CVE-2020-24370: ldebug.c allows a negation overflow and segmentation fault in getlocal and setlocal (bsc#1175448) - Long brackets with a huge number of '=' overflow some internal buffer arithmetic. This update was imported from the SUSE:SLE-15:Update update project. Patch Instructions: To install this openSUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 15.2: zypper in -t patch openSUSE-2021-962=1 Package List: - openSUSE Leap 15.2 (i586 x86_64): liblua5_3-5-5.3.6-lp152.5.3.1 liblua5_3-5-debuginfo-5.3.6-lp152.5.3.1 lua53-5.3.6-lp152.5.3.1 lua53-debuginfo-5.3.6-lp152.5.3.1 lua53-debugsource-5.3.6-lp152.5.3.1 lua53-devel-5.3.6-lp152.5.3.1 - openSUSE Leap 15.2 (noarch): lua53-doc-5.3.6-lp152.5.3.1 - openSUSE Leap 15.2 (x86_64): liblua5_3-5-32bit-5.3.6-lp152.5.3.1 liblua5_3-5-32bit-debuginfo-5.3.6-lp152.5.3.1 References: https://www.suse.com/security/cve/CVE-2020-24370.html https://www.suse.com/security/cve/CVE-2020-24371.html https://bugzilla.suse.com/1175448 https://bugzilla.suse.com/1175449

1 0

openSUSE-RU-2021:0960-1: moderate: Recommended update for thin-provisioning-tools
by maintenance＠opensuse.org 02 Jul '21

02 Jul '21

openSUSE Recommended Update: Recommended update for thin-provisioning-tools ______________________________________________________________________________ Announcement ID: openSUSE-RU-2021:0960-1 Rating: moderate References: #1184124 Affected Products: openSUSE Leap 15.2 ______________________________________________________________________________ An update that has one recommended fix can now be installed. Description: This update for thin-provisioning-tools fixes the following issues: - Link as position-independent executable (bsc#1184124) This update was imported from the SUSE:SLE-15:Update update project. Patch Instructions: To install this openSUSE Recommended Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 15.2: zypper in -t patch openSUSE-2021-960=1 Package List: - openSUSE Leap 15.2 (i586 x86_64): thin-provisioning-tools-0.7.5-lp152.4.3.1 thin-provisioning-tools-debuginfo-0.7.5-lp152.4.3.1 thin-provisioning-tools-debugsource-0.7.5-lp152.4.3.1 References: https://bugzilla.suse.com/1184124

1 0

openSUSE-RU-2021:0958-1: important: Recommended update for psmisc
by maintenance＠opensuse.org 02 Jul '21

02 Jul '21

openSUSE Recommended Update: Recommended update for psmisc ______________________________________________________________________________ Announcement ID: openSUSE-RU-2021:0958-1 Rating: important References: #1185208 Affected Products: openSUSE Leap 15.2 ______________________________________________________________________________ An update that has one recommended fix can now be installed. Description: This update for psmisc fixes the following issues: - It does no longer list all processes from different private namespaces when fuser is run on an NFS mount. This led to an issue where the wrong processes were terminated in an SAP application cluster environment (bsc#1185208) This update was imported from the SUSE:SLE-15:Update update project. Patch Instructions: To install this openSUSE Recommended Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 15.2: zypper in -t patch openSUSE-2021-958=1 Package List: - openSUSE Leap 15.2 (i586 x86_64): psmisc-23.0-lp152.9.6.1 psmisc-debuginfo-23.0-lp152.9.6.1 psmisc-debugsource-23.0-lp152.9.6.1 - openSUSE Leap 15.2 (noarch): psmisc-lang-23.0-lp152.9.6.1 References: https://bugzilla.suse.com/1185208

1 0

openSUSE-RU-2021:0957-1: moderate: Recommended update for lxd
by maintenance＠opensuse.org 02 Jul '21

02 Jul '21

openSUSE Recommended Update: Recommended update for lxd ______________________________________________________________________________ Announcement ID: openSUSE-RU-2021:0957-1 Rating: moderate References: #1186786 #1186906 Affected Products: openSUSE Leap 15.2 ______________________________________________________________________________ An update that has two recommended fixes can now be installed. Description: This update for lxd fixes the following issues: - Add backport for <https://github.com/lxc/lxd/pull/8908> which fixes a Leap-specific kernel backport bug (close_range(2) was backported but not the flags that it supported in the first version). boo#1186786 - Build lxd-agent and lxd-p2c statically to match upstream LXD build scripts (and to make VMs work properly -- lxd-agent is injected into the VM). Update to LXD 4.15. (boo#1186906) The full upstream changelog is available from: https://discuss.linuxcontainers.org/t/lxd-4-15-has-been-released/11252 + Network interface hotplug in VMs + Configurable shutdown timeout + New persistent warnings (time skew, apparmor and virtiofsd) + Location field in /dev/lxd API + New type and name columns in lxc config trust list + Cluster members acting as database stand-by now visible + lxc monitor --pretty now supported with lifecycle events + New --expire flag for lxc publish + Requestor now recorded in lifecyle events + Proxy header support on main API endpoint + Full swagger coverage of REST API Patch Instructions: To install this openSUSE Recommended Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 15.2: zypper in -t patch openSUSE-2021-957=1 Package List: - openSUSE Leap 15.2 (noarch): lxd-bash-completion-4.15-lp152.2.38.1 - openSUSE Leap 15.2 (x86_64): lxd-4.15-lp152.2.38.1 References: https://bugzilla.suse.com/1186786 https://bugzilla.suse.com/1186906

1 0

openSUSE-RU-2021:0956-1: moderate: Recommended update for libstorage-ng
by maintenance＠opensuse.org 02 Jul '21

02 Jul '21

openSUSE Recommended Update: Recommended update for libstorage-ng ______________________________________________________________________________ Announcement ID: openSUSE-RU-2021:0956-1 Rating: moderate References: #1186298 Affected Products: openSUSE Leap 15.2 ______________________________________________________________________________ An update that has one recommended fix can now be installed. Description: This update for libstorage-ng fixes the following issues: - Remove double mount options to fix partition setup in AutoYaST. (bsc#1186298) This update was imported from the SUSE:SLE-15-SP2:Update update project. Patch Instructions: To install this openSUSE Recommended Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 15.2: zypper in -t patch openSUSE-2021-956=1 Package List: - openSUSE Leap 15.2 (i586 x86_64): libstorage-ng-debuginfo-4.2.77-lp152.2.12.1 libstorage-ng-debugsource-4.2.77-lp152.2.12.1 libstorage-ng-devel-4.2.77-lp152.2.12.1 libstorage-ng-integration-tests-4.2.77-lp152.2.12.1 libstorage-ng-python3-4.2.77-lp152.2.12.1 libstorage-ng-python3-debuginfo-4.2.77-lp152.2.12.1 libstorage-ng-ruby-4.2.77-lp152.2.12.1 libstorage-ng-ruby-debuginfo-4.2.77-lp152.2.12.1 libstorage-ng-utils-4.2.77-lp152.2.12.1 libstorage-ng-utils-debuginfo-4.2.77-lp152.2.12.1 libstorage-ng1-4.2.77-lp152.2.12.1 libstorage-ng1-debuginfo-4.2.77-lp152.2.12.1 - openSUSE Leap 15.2 (noarch): libstorage-ng-lang-4.2.77-lp152.2.12.1 References: https://bugzilla.suse.com/1186298

1 0

openSUSE-RU-2021:0954-1: moderate: Recommended update for postfix
by maintenance＠opensuse.org 02 Jul '21

02 Jul '21

openSUSE Recommended Update: Recommended update for postfix ______________________________________________________________________________ Announcement ID: openSUSE-RU-2021:0954-1 Rating: moderate References: #1186669 Affected Products: openSUSE Leap 15.2 ______________________________________________________________________________ An update that has one recommended fix can now be installed. Description: This update for postfix fixes the following issues: - Remove incorrect requirements from the postfix service configuration. (bsc#1186669) This update was imported from the SUSE:SLE-15-SP2:Update update project. Patch Instructions: To install this openSUSE Recommended Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 15.2: zypper in -t patch openSUSE-2021-954=1 Package List: - openSUSE Leap 15.2 (i586 x86_64): postfix-3.4.7-lp152.2.9.1 postfix-debuginfo-3.4.7-lp152.2.9.1 postfix-debugsource-3.4.7-lp152.2.9.1 postfix-devel-3.4.7-lp152.2.9.1 postfix-lmdb-3.4.7-lp152.2.9.1 postfix-lmdb-debuginfo-3.4.7-lp152.2.9.1 postfix-mysql-3.4.7-lp152.2.9.1 postfix-mysql-debuginfo-3.4.7-lp152.2.9.1 postfix-postgresql-3.4.7-lp152.2.9.1 postfix-postgresql-debuginfo-3.4.7-lp152.2.9.1 - openSUSE Leap 15.2 (noarch): postfix-doc-3.4.7-lp152.2.9.1 References: https://bugzilla.suse.com/1186669

1 0

openSUSE-RU-2021:0955-1: moderate: Recommended update for yast2-country
by maintenance＠opensuse.org 02 Jul '21

02 Jul '21

openSUSE Recommended Update: Recommended update for yast2-country ______________________________________________________________________________ Announcement ID: openSUSE-RU-2021:0955-1 Rating: moderate References: #1187270 Affected Products: openSUSE Leap 15.2 ______________________________________________________________________________ An update that has one recommended fix can now be installed. Description: This update for yast2-country fixes the following issues: - Fix the comment entry in the desktop file so the tooltip in the control center is properly translated. (bsc#1187270) This update was imported from the SUSE:SLE-15-SP2:Update update project. Patch Instructions: To install this openSUSE Recommended Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 15.2: zypper in -t patch openSUSE-2021-955=1 Package List: - openSUSE Leap 15.2 (i586 x86_64): yast2-country-4.2.21-lp152.2.6.1 yast2-country-data-4.2.21-lp152.2.6.1 References: https://bugzilla.suse.com/1187270

1 0