July 2021 - openSUSE Updates - openSUSE Mailing Lists

openSUSE-RU-2021:1075-1: important: Recommended update for libgweather
by maintenance＠opensuse.org 22 Jul '21

22 Jul '21

openSUSE Recommended Update: Recommended update for libgweather ______________________________________________________________________________ Announcement ID: openSUSE-RU-2021:1075-1 Rating: important References: #1185651 Affected Products: openSUSE Leap 15.2 ______________________________________________________________________________ An update that has one recommended fix can now be installed. Description: This update for libgweather fixes the following issues: - Fix memory issues backported from "gnome-3-34". - Use new 'metno' 2.0 API. The version 1.9 was deprecated and will be removed soon. (bsc#1185651) This update was imported from the SUSE:SLE-15-SP2:Update update project. Patch Instructions: To install this openSUSE Recommended Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 15.2: zypper in -t patch openSUSE-2021-1075=1 Package List: - openSUSE Leap 15.2 (i586 x86_64): libgweather-3-16-3.34.0-lp152.3.3.1 libgweather-3-16-debuginfo-3.34.0-lp152.3.3.1 libgweather-debugsource-3.34.0-lp152.3.3.1 libgweather-devel-3.34.0-lp152.3.3.1 typelib-1_0-GWeather-3_0-3.34.0-lp152.3.3.1 - openSUSE Leap 15.2 (noarch): gweather-data-3.34.0-lp152.3.3.1 libgweather-lang-3.34.0-lp152.3.3.1 - openSUSE Leap 15.2 (x86_64): libgweather-3-16-32bit-3.34.0-lp152.3.3.1 libgweather-3-16-32bit-debuginfo-3.34.0-lp152.3.3.1 References: https://bugzilla.suse.com/1185651

1 0

openSUSE-SU-2021:1073-1: important: Security update for chromium
by opensuse-security＠opensuse.org 21 Jul '21

21 Jul '21

openSUSE Security Update: Security update for chromium ______________________________________________________________________________ Announcement ID: openSUSE-SU-2021:1073-1 Rating: important References: #1188373 Cross-References: CVE-2021-30541 CVE-2021-30559 CVE-2021-30560 CVE-2021-30561 CVE-2021-30562 CVE-2021-30563 CVE-2021-30564 Affected Products: openSUSE Leap 15.2 ______________________________________________________________________________ An update that fixes 7 vulnerabilities is now available. Description: This update for chromium fixes the following issues: Chromium 91.0.4472.164 (boo#1188373) * CVE-2021-30559: Out of bounds write in ANGLE * CVE-2021-30541: Use after free in V8 * CVE-2021-30560: Use after free in Blink XSLT * CVE-2021-30561: Type Confusion in V8 * CVE-2021-30562: Use after free in WebSerial * CVE-2021-30563: Type Confusion in V8 * CVE-2021-30564: Heap buffer overflow in WebXR * Various fixes from internal audits, fuzzing and other initiatives Patch Instructions: To install this openSUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 15.2: zypper in -t patch openSUSE-2021-1073=1 Package List: - openSUSE Leap 15.2 (x86_64): chromedriver-91.0.4472.164-lp152.2.113.2 chromedriver-debuginfo-91.0.4472.164-lp152.2.113.2 chromium-91.0.4472.164-lp152.2.113.2 chromium-debuginfo-91.0.4472.164-lp152.2.113.2 References: https://www.suse.com/security/cve/CVE-2021-30541.html https://www.suse.com/security/cve/CVE-2021-30559.html https://www.suse.com/security/cve/CVE-2021-30560.html https://www.suse.com/security/cve/CVE-2021-30561.html https://www.suse.com/security/cve/CVE-2021-30562.html https://www.suse.com/security/cve/CVE-2021-30563.html https://www.suse.com/security/cve/CVE-2021-30564.html https://bugzilla.suse.com/1188373

1 0

openSUSE-SU-2021:1074-1: important: Security update for chromium
by opensuse-security＠opensuse.org 21 Jul '21

21 Jul '21

openSUSE Security Update: Security update for chromium ______________________________________________________________________________ Announcement ID: openSUSE-SU-2021:1074-1 Rating: important References: #1188373 Cross-References: CVE-2021-30541 CVE-2021-30559 CVE-2021-30560 CVE-2021-30561 CVE-2021-30562 CVE-2021-30563 CVE-2021-30564 Affected Products: openSUSE Backports SLE-15-SP3 ______________________________________________________________________________ An update that fixes 7 vulnerabilities is now available. Description: This update for chromium fixes the following issues: Chromium 91.0.4472.164 (boo#1188373) * CVE-2021-30559: Out of bounds write in ANGLE * CVE-2021-30541: Use after free in V8 * CVE-2021-30560: Use after free in Blink XSLT * CVE-2021-30561: Type Confusion in V8 * CVE-2021-30562: Use after free in WebSerial * CVE-2021-30563: Type Confusion in V8 * CVE-2021-30564: Heap buffer overflow in WebXR * Various fixes from internal audits, fuzzing and other initiatives Patch Instructions: To install this openSUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Backports SLE-15-SP3: zypper in -t patch openSUSE-2021-1074=1 Package List: - openSUSE Backports SLE-15-SP3 (aarch64 x86_64): chromedriver-91.0.4472.164-bp153.2.16.1 chromium-91.0.4472.164-bp153.2.16.1 References: https://www.suse.com/security/cve/CVE-2021-30541.html https://www.suse.com/security/cve/CVE-2021-30559.html https://www.suse.com/security/cve/CVE-2021-30560.html https://www.suse.com/security/cve/CVE-2021-30561.html https://www.suse.com/security/cve/CVE-2021-30562.html https://www.suse.com/security/cve/CVE-2021-30563.html https://www.suse.com/security/cve/CVE-2021-30564.html https://bugzilla.suse.com/1188373

1 0

openSUSE-RU-2021:2444-1: Recommended update for autogen
by maintenance＠opensuse.org 21 Jul '21

21 Jul '21

openSUSE Recommended Update: Recommended update for autogen ______________________________________________________________________________ Announcement ID: openSUSE-RU-2021:2444-1 Rating: low References: #1047218 Affected Products: openSUSE Leap 15.3 ______________________________________________________________________________ An update that has one recommended fix can now be installed. Description: This update for autogen fixes the following issue: This update doesn't solve any visible issue to final users but it makes the builds reproducible. (bsc#1047218) In particular: - it normalize 'tar' - it normalize date in 'man-pages' Patch Instructions: To install this openSUSE Recommended Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 15.3: zypper in -t patch openSUSE-SLE-15.3-2021-2444=1 Package List: - openSUSE Leap 15.3 (aarch64 ppc64le s390x x86_64): autogen-5.18.12-3.3.1 autogen-debuginfo-5.18.12-3.3.1 autogen-debugsource-5.18.12-3.3.1 libopts-devel-5.18.12-3.3.1 libopts25-5.18.12-3.3.1 libopts25-debuginfo-5.18.12-3.3.1 References: https://bugzilla.suse.com/1047218

1 0

openSUSE-RU-2021:2374-1: moderate: Recommended update for yast2-auth-client
by maintenance＠opensuse.org 21 Jul '21

21 Jul '21

openSUSE Recommended Update: Recommended update for yast2-auth-client ______________________________________________________________________________ Announcement ID: openSUSE-RU-2021:2374-1 Rating: moderate References: #1172340 #1184630 #1185499 Affected Products: openSUSE Leap 15.3 ______________________________________________________________________________ An update that has three recommended fixes can now be installed. Description: This update for yast2-auth-client fixes the following issues: - Fix an error importing the configuration when the json does not contain all keys. (bsc#1184630) - Fix 'nss_ldap' package unnecessarily installed. (bsc#1185499) - Fix cli 'help' handling for 'auth-client' and 'ldapkrb'. (bsc#1172340)2 Patch Instructions: To install this openSUSE Recommended Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 15.3: zypper in -t patch openSUSE-SLE-15.3-2021-2374=1 Package List: - openSUSE Leap 15.3 (noarch): yast2-auth-client-4.3.3-3.3.1 References: https://bugzilla.suse.com/1172340 https://bugzilla.suse.com/1184630 https://bugzilla.suse.com/1185499

1 0

openSUSE-RU-2021:2418-1: Recommended update for mstflint
by maintenance＠opensuse.org 21 Jul '21

21 Jul '21

openSUSE Recommended Update: Recommended update for mstflint ______________________________________________________________________________ Announcement ID: openSUSE-RU-2021:2418-1 Rating: low References: #1184124 Affected Products: openSUSE Leap 15.3 ______________________________________________________________________________ An update that has one recommended fix can now be installed. Description: This update for mstflint fixes the following issues: - Link as position independent executables. (bsc#1184124) Patch Instructions: To install this openSUSE Recommended Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 15.3: zypper in -t patch openSUSE-SLE-15.3-2021-2418=1 Package List: - openSUSE Leap 15.3 (aarch64 ppc64le s390x x86_64): mstflint-4.15.0-3.3.1 mstflint-debuginfo-4.15.0-3.3.1 mstflint-debugsource-4.15.0-3.3.1 References: https://bugzilla.suse.com/1184124

1 0

openSUSE-RU-2021:2436-1: important: Recommended update for libgweather
by maintenance＠opensuse.org 21 Jul '21

21 Jul '21

openSUSE Recommended Update: Recommended update for libgweather ______________________________________________________________________________ Announcement ID: openSUSE-RU-2021:2436-1 Rating: important References: #1185651 Affected Products: openSUSE Leap 15.3 ______________________________________________________________________________ An update that has one recommended fix can now be installed. Description: This update for libgweather fixes the following issues: - Fix memory issues backported from "gnome-3-34". - Use new 'metno' 2.0 API. The version 1.9 was deprecated and will be removed soon. (bsc#1185651) Patch Instructions: To install this openSUSE Recommended Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 15.3: zypper in -t patch openSUSE-SLE-15.3-2021-2436=1 Package List: - openSUSE Leap 15.3 (aarch64 ppc64le s390x x86_64): libgweather-3-16-3.34.0-4.3.1 libgweather-3-16-debuginfo-3.34.0-4.3.1 libgweather-debugsource-3.34.0-4.3.1 libgweather-devel-3.34.0-4.3.1 typelib-1_0-GWeather-3_0-3.34.0-4.3.1 - openSUSE Leap 15.3 (x86_64): libgweather-3-16-32bit-3.34.0-4.3.1 libgweather-3-16-32bit-debuginfo-3.34.0-4.3.1 - openSUSE Leap 15.3 (noarch): gweather-data-3.34.0-4.3.1 libgweather-lang-3.34.0-4.3.1 References: https://bugzilla.suse.com/1185651

1 0

openSUSE-SU-2021:2442-1: important: Security update for qemu
by opensuse-security＠opensuse.org 21 Jul '21

21 Jul '21

openSUSE Security Update: Security update for qemu ______________________________________________________________________________ Announcement ID: openSUSE-SU-2021:2442-1 Rating: important References: #1187499 #1187529 #1187538 #1187539 Cross-References: CVE-2021-3582 CVE-2021-3607 CVE-2021-3608 CVE-2021-3611 CVSS scores: CVE-2021-3582 (SUSE): 3.2 CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:C/C:N/I:N/A:L CVE-2021-3607 (SUSE): 3.2 CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:C/C:N/I:N/A:L CVE-2021-3608 (SUSE): 3.2 CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:C/C:N/I:N/A:L CVE-2021-3611 (SUSE): 5 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:N/I:N/A:L Affected Products: openSUSE Leap 15.3 ______________________________________________________________________________ An update that fixes four vulnerabilities is now available. Description: This update for qemu fixes the following issues: - CVE-2021-3582: Fix possible mremap overflow in the pvrdma (bsc#1187499) - CVE-2021-3607: Ensure correct input on ring init (bsc#1187539) - CVE-2021-3608: Fix the ring init error flow (bsc#1187538) - CVE-2021-3611: Fix intel-hda segmentation fault due to stack overflow (bsc#1187529) Patch Instructions: To install this openSUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 15.3: zypper in -t patch openSUSE-SLE-15.3-2021-2442=1 Package List: - openSUSE Leap 15.3 (aarch64 ppc64le s390x x86_64): qemu-5.2.0-23.1 qemu-arm-5.2.0-23.1 qemu-arm-debuginfo-5.2.0-23.1 qemu-audio-alsa-5.2.0-23.1 qemu-audio-alsa-debuginfo-5.2.0-23.1 qemu-audio-pa-5.2.0-23.1 qemu-audio-pa-debuginfo-5.2.0-23.1 qemu-audio-spice-5.2.0-23.1 qemu-audio-spice-debuginfo-5.2.0-23.1 qemu-block-curl-5.2.0-23.1 qemu-block-curl-debuginfo-5.2.0-23.1 qemu-block-dmg-5.2.0-23.1 qemu-block-dmg-debuginfo-5.2.0-23.1 qemu-block-gluster-5.2.0-23.1 qemu-block-gluster-debuginfo-5.2.0-23.1 qemu-block-iscsi-5.2.0-23.1 qemu-block-iscsi-debuginfo-5.2.0-23.1 qemu-block-nfs-5.2.0-23.1 qemu-block-nfs-debuginfo-5.2.0-23.1 qemu-block-rbd-5.2.0-23.1 qemu-block-rbd-debuginfo-5.2.0-23.1 qemu-block-ssh-5.2.0-23.1 qemu-block-ssh-debuginfo-5.2.0-23.1 qemu-chardev-baum-5.2.0-23.1 qemu-chardev-baum-debuginfo-5.2.0-23.1 qemu-chardev-spice-5.2.0-23.1 qemu-chardev-spice-debuginfo-5.2.0-23.1 qemu-debuginfo-5.2.0-23.1 qemu-debugsource-5.2.0-23.1 qemu-extra-5.2.0-23.1 qemu-extra-debuginfo-5.2.0-23.1 qemu-guest-agent-5.2.0-23.1 qemu-guest-agent-debuginfo-5.2.0-23.1 qemu-hw-display-qxl-5.2.0-23.1 qemu-hw-display-qxl-debuginfo-5.2.0-23.1 qemu-hw-display-virtio-gpu-5.2.0-23.1 qemu-hw-display-virtio-gpu-debuginfo-5.2.0-23.1 qemu-hw-display-virtio-gpu-pci-5.2.0-23.1 qemu-hw-display-virtio-gpu-pci-debuginfo-5.2.0-23.1 qemu-hw-display-virtio-vga-5.2.0-23.1 qemu-hw-display-virtio-vga-debuginfo-5.2.0-23.1 qemu-hw-s390x-virtio-gpu-ccw-5.2.0-23.1 qemu-hw-s390x-virtio-gpu-ccw-debuginfo-5.2.0-23.1 qemu-hw-usb-redirect-5.2.0-23.1 qemu-hw-usb-redirect-debuginfo-5.2.0-23.1 qemu-hw-usb-smartcard-5.2.0-23.1 qemu-hw-usb-smartcard-debuginfo-5.2.0-23.1 qemu-ivshmem-tools-5.2.0-23.1 qemu-ivshmem-tools-debuginfo-5.2.0-23.1 qemu-ksm-5.2.0-23.1 qemu-lang-5.2.0-23.1 qemu-ppc-5.2.0-23.1 qemu-ppc-debuginfo-5.2.0-23.1 qemu-s390x-5.2.0-23.1 qemu-s390x-debuginfo-5.2.0-23.1 qemu-tools-5.2.0-23.1 qemu-tools-debuginfo-5.2.0-23.1 qemu-ui-curses-5.2.0-23.1 qemu-ui-curses-debuginfo-5.2.0-23.1 qemu-ui-gtk-5.2.0-23.1 qemu-ui-gtk-debuginfo-5.2.0-23.1 qemu-ui-opengl-5.2.0-23.1 qemu-ui-opengl-debuginfo-5.2.0-23.1 qemu-ui-spice-app-5.2.0-23.1 qemu-ui-spice-app-debuginfo-5.2.0-23.1 qemu-ui-spice-core-5.2.0-23.1 qemu-ui-spice-core-debuginfo-5.2.0-23.1 qemu-vhost-user-gpu-5.2.0-23.1 qemu-vhost-user-gpu-debuginfo-5.2.0-23.1 qemu-x86-5.2.0-23.1 qemu-x86-debuginfo-5.2.0-23.1 - openSUSE Leap 15.3 (s390x x86_64): qemu-kvm-5.2.0-23.1 - openSUSE Leap 15.3 (noarch): qemu-ipxe-1.0.0+-23.1 qemu-microvm-5.2.0-23.1 qemu-seabios-1.14.0_0_g155821a-23.1 qemu-sgabios-8-23.1 qemu-skiboot-5.2.0-23.1 qemu-vgabios-1.14.0_0_g155821a-23.1 References: https://www.suse.com/security/cve/CVE-2021-3582.html https://www.suse.com/security/cve/CVE-2021-3607.html https://www.suse.com/security/cve/CVE-2021-3608.html https://www.suse.com/security/cve/CVE-2021-3611.html https://bugzilla.suse.com/1187499 https://bugzilla.suse.com/1187529 https://bugzilla.suse.com/1187538 https://bugzilla.suse.com/1187539

1 0

openSUSE-SU-2021:2439-1: moderate: Security update for curl
by opensuse-security＠opensuse.org 21 Jul '21

21 Jul '21

openSUSE Security Update: Security update for curl ______________________________________________________________________________ Announcement ID: openSUSE-SU-2021:2439-1 Rating: moderate References: #1188217 #1188218 #1188219 #1188220 Cross-References: CVE-2021-22922 CVE-2021-22923 CVE-2021-22924 CVE-2021-22925 CVSS scores: CVE-2021-22922 (SUSE): 6.5 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N CVE-2021-22923 (SUSE): 5.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N CVE-2021-22924 (SUSE): 5.4 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N CVE-2021-22925 (SUSE): 4.3 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N Affected Products: openSUSE Leap 15.3 ______________________________________________________________________________ An update that fixes four vulnerabilities is now available. Description: This update for curl fixes the following issues: - CVE-2021-22925: TELNET stack contents disclosure again. (bsc#1188220) - CVE-2021-22924: Bad connection reuse due to flawed path name checks. (bsc#1188219) - CVE-2021-22923: Insufficiently Protected Credentials. (bsc#1188218) - CVE-2021-22922: Wrong content via metalink not discarded. (bsc#1188217) Patch Instructions: To install this openSUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 15.3: zypper in -t patch openSUSE-SLE-15.3-2021-2439=1 Package List: - openSUSE Leap 15.3 (aarch64 ppc64le s390x x86_64): curl-7.66.0-4.22.1 curl-debuginfo-7.66.0-4.22.1 curl-debugsource-7.66.0-4.22.1 libcurl-devel-7.66.0-4.22.1 libcurl4-7.66.0-4.22.1 libcurl4-debuginfo-7.66.0-4.22.1 - openSUSE Leap 15.3 (x86_64): libcurl-devel-32bit-7.66.0-4.22.1 libcurl4-32bit-7.66.0-4.22.1 libcurl4-32bit-debuginfo-7.66.0-4.22.1 References: https://www.suse.com/security/cve/CVE-2021-22922.html https://www.suse.com/security/cve/CVE-2021-22923.html https://www.suse.com/security/cve/CVE-2021-22924.html https://www.suse.com/security/cve/CVE-2021-22925.html https://bugzilla.suse.com/1188217 https://bugzilla.suse.com/1188218 https://bugzilla.suse.com/1188219 https://bugzilla.suse.com/1188220

1 0

openSUSE-RU-2021:1072-1: moderate: Recommended update for openQA, perl-Cpanel-JSON-XS, perl-Mojolicious, perl-Mojolicious-Plugin-AssetPack
by maintenance＠opensuse.org 21 Jul '21

21 Jul '21

openSUSE Recommended Update: Recommended update for openQA, perl-Cpanel-JSON-XS, perl-Mojolicious, perl-Mojolicious-Plugin-AssetPack ______________________________________________________________________________ Announcement ID: openSUSE-RU-2021:1072-1 Rating: moderate References: #1187425 Affected Products: openSUSE Backports SLE-15-SP3 ______________________________________________________________________________ An update that has one recommended fix can now be installed. Description: This update for openQA, perl-Cpanel-JSON-XS, perl-Mojolicious, perl-Mojolicious-Plugin-AssetPack fixes the following issues: openQA was updated to version 4.6.1624280432.2ce59c621. Lots of changes, see RPM changelog or git. Changes in dependend perl modules: perl-Cpanel-JSON-XS, perl-Mojolicious-Plugin-AssetPack, perl-Mojolicious: perl-Cpanel-JSON-XS was updated to 4.26: See /usr/share/doc/packages/perl-Cpanel-JSON-XS/Changes perl-Mojolicious-Plugin-AssetPack was updated to 2.13: See /usr/share/doc/packages/perl-Mojolicious-Plugin-AssetPack/Changes perl-Mojolicious was updated to 9.19: See /usr/share/doc/packages/perl-Mojolicious/Changes Patch Instructions: To install this openSUSE Recommended Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Backports SLE-15-SP3: zypper in -t patch openSUSE-2021-1072=1 Package List: - openSUSE Backports SLE-15-SP3 (aarch64 ppc64le s390x x86_64): perl-Cpanel-JSON-XS-4.26-bp153.2.3.2 perl-Cpanel-JSON-XS-debuginfo-4.26-bp153.2.3.2 perl-Cpanel-JSON-XS-debugsource-4.26-bp153.2.3.2 - openSUSE Backports SLE-15-SP3 (noarch): openQA-4.6.1624280432.2ce59c621-bp153.2.3.3 openQA-auto-update-4.6.1624280432.2ce59c621-bp153.2.3.3 openQA-bootstrap-4.6.1624280432.2ce59c621-bp153.2.3.3 openQA-client-4.6.1624280432.2ce59c621-bp153.2.3.3 openQA-common-4.6.1624280432.2ce59c621-bp153.2.3.3 openQA-devel-4.6.1624280432.2ce59c621-bp153.2.3.3 openQA-doc-4.6.1624280432.2ce59c621-bp153.2.3.3 openQA-local-db-4.6.1624280432.2ce59c621-bp153.2.3.3 openQA-python-scripts-4.6.1624280432.2ce59c621-bp153.2.3.3 openQA-single-instance-4.6.1624280432.2ce59c621-bp153.2.3.3 openQA-worker-4.6.1624280432.2ce59c621-bp153.2.3.3 perl-Devel-Cover-Report-Codecovbash-0.03-bp153.2.1 perl-Mojolicious-9.19-bp153.2.3.2 perl-Mojolicious-Plugin-AssetPack-2.13-bp153.2.3.2 References: https://bugzilla.suse.com/1187425

1 0