August 2021 - openSUSE Updates - openSUSE Mailing Lists

openSUSE-RU-2021:1106-1: moderate: Recommended update for osinfo-db
by maintenance＠opensuse.org 10 Aug '21

10 Aug '21

openSUSE Recommended Update: Recommended update for osinfo-db ______________________________________________________________________________ Announcement ID: openSUSE-RU-2021:1106-1 Rating: moderate References: #1182144 #1187106 Affected Products: openSUSE Leap 15.2 ______________________________________________________________________________ An update that has two recommended fixes can now be installed. Description: This update for osinfo-db fixes the following issues: - Update to database version 20210621. (bsc#1187106) - Add support for SUSE Linux Enterprise Micro. - Fix 'AutoYaST' profiles to pass the validation during installation. (bsc#1182144) - Add support for openSUSE Leap 15.3 and SUSE Linux Enterprise 15 SP3 - Ensure 'x86_64' is listed before 'i686', to have 'x86_64' selected by default in GNOME Boxes This update was imported from the SUSE:SLE-15-SP2:Update update project. Patch Instructions: To install this openSUSE Recommended Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 15.2: zypper in -t patch openSUSE-2021-1106=1 Package List: - openSUSE Leap 15.2 (noarch): osinfo-db-20210621-lp152.3.3.1 References: https://bugzilla.suse.com/1182144 https://bugzilla.suse.com/1187106

1 0

openSUSE-RU-2021:1111-1: moderate: Recommended update for sca-appliance-common, supportutils
by maintenance＠opensuse.org 10 Aug '21

10 Aug '21

openSUSE Recommended Update: Recommended update for sca-appliance-common, supportutils ______________________________________________________________________________ Announcement ID: openSUSE-RU-2021:1111-1 Rating: moderate References: #1185991 #1185993 #1186347 #1186397 #1186687 SLE-18240 SLE-18344 Affected Products: openSUSE Leap 15.2 ______________________________________________________________________________ An update that has 5 recommended fixes and contains two features can now be installed. Description: This update for sca-appliance-common, supportutils fixes the following issues: - Adding ethtool options to the supportconfigt. (jsc#SLE-18239, jsc#SLE-18344) - Fixed and issue when 'lsof' causes performance problems. (bsc#1186687) - Exclude 'rhn.conf' from 'etc.txt' to prevent supportconfig capturing passwords in clear text. (bsc#1186347) - Fix 'analyzevmcore' to supports local directories. (bsc#1186397) - Fix for 'getappcore' checking for valid compression binary. (bsc#1185991) - Fixed 'getappcore' to prevent triggering errors with help message. (bsc#1185993) This update was imported from the SUSE:SLE-15:Update update project. Patch Instructions: To install this openSUSE Recommended Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 15.2: zypper in -t patch openSUSE-2021-1111=1 Package List: - openSUSE Leap 15.2 (noarch): supportutils-3.1.17-lp152.2.6.1 References: https://bugzilla.suse.com/1185991 https://bugzilla.suse.com/1185993 https://bugzilla.suse.com/1186347 https://bugzilla.suse.com/1186397 https://bugzilla.suse.com/1186687

1 0

openSUSE-RU-2021:1110-1: moderate: Recommended update for amazon-ecs-init
by maintenance＠opensuse.org 10 Aug '21

10 Aug '21

openSUSE Recommended Update: Recommended update for amazon-ecs-init ______________________________________________________________________________ Announcement ID: openSUSE-RU-2021:1110-1 Rating: moderate References: #1187662 Affected Products: openSUSE Leap 15.2 ______________________________________________________________________________ An update that has one recommended fix can now be installed. Description: This update for amazon-ecs-init fixes the following issues: - Update to version 1.53.0-1 (bsc#1187662) * Cache Agent version 1.53.0 - from version 1.52.2-2 * Cache Agent version 1.52.2 * ecs-anywhere-install: fix incorrect download url when running in cn region - from version 1.52.2-1 * Cache Agent version 1.52.2 * ecs-anywhere-install: remove dependency on gpg key server * ecs-anywhere-install: allow sandboxed apt installations This update was imported from the SUSE:SLE-15-SP1:Update update project. Patch Instructions: To install this openSUSE Recommended Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 15.2: zypper in -t patch openSUSE-2021-1110=1 Package List: - openSUSE Leap 15.2 (x86_64): amazon-ecs-init-1.53.0-lp152.4.9.1 References: https://bugzilla.suse.com/1187662

1 0

openSUSE-RU-2021:1109-1: moderate: Recommended update for lxd
by maintenance＠opensuse.org 10 Aug '21

10 Aug '21

openSUSE Recommended Update: Recommended update for lxd ______________________________________________________________________________ Announcement ID: openSUSE-RU-2021:1109-1 Rating: moderate References: #1102408 #1188946 Affected Products: openSUSE Leap 15.2 ______________________________________________________________________________ An update that has two recommended fixes can now be installed. Description: This update for lxd fixes the following issues: Update to LXD 4.16. (boo#1188946) The full upstream changelog is available from: https://discuss.linuxcontainers.org/t/lxd-4-16-has-been-released/11547 + Cluster certificate update + Copy/move of custom volumes between projects + lxc monitor --pretty now works with all event types + Easier revocation of cluster join tokens + IP filtering on unmanaged bridges + New warnings + New lifecycle events Patch Instructions: To install this openSUSE Recommended Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 15.2: zypper in -t patch openSUSE-2021-1109=1 Package List: - openSUSE Leap 15.2 (x86_64): lxd-4.16-lp152.2.41.1 - openSUSE Leap 15.2 (noarch): lxd-bash-completion-4.16-lp152.2.41.1 References: https://bugzilla.suse.com/1102408 https://bugzilla.suse.com/1188946

1 0

openSUSE-RU-2021:1103-1: important: Recommended update for novnc
by maintenance＠opensuse.org 10 Aug '21

10 Aug '21

openSUSE Recommended Update: Recommended update for novnc ______________________________________________________________________________ Announcement ID: openSUSE-RU-2021:1103-1 Rating: important References: #1183291 SLE-19654 Affected Products: openSUSE Leap 15.2 ______________________________________________________________________________ An update that has one recommended fix and contains one feature can now be installed. Description: This update for novnc fixes the following issues: - Update to 1.2.0: * Quality and compression hints can now be modified dynamically * Added touch gestures to emulate common mouse actions * Support for full Unicode in clipboard * Support for VeNCrypt Plain authentication * Support for TightVNC Unix authentication * Support for alpha cursors * The session name is now updated whilst connected - Update to 1.1.0: Application: * New translations for Russian, Korean, Czech and Chinese (traditional) languages * Fixed an issue where you didn't get scrollbars in your browser on Windows you had a touch screen. * Added the Super/Windows key to the toolbar. * Added an option to show a dot when there otherwise wouldn't be a visible cursor. * View drag is no longer available when in scaling mode. Library: * A large number of coding style changes has been made to make the code easier to read and better to work with. * Many keyboard issues has been fixed. * Local cursor is now available on all platforms. * Fixed a number of crashes related to clipboard. * Fixed issues that occurred if data from the server was being received slowly. * A problem has been fixed where the display module would incorrectly handle high DPI systems causing scrollbars to show when they shouldn't. This update was imported from the SUSE:SLE-15-SP1:Update update project. Patch Instructions: To install this openSUSE Recommended Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 15.2: zypper in -t patch openSUSE-2021-1103=1 Package List: - openSUSE Leap 15.2 (noarch): novnc-1.2.0-lp152.3.3.1 References: https://bugzilla.suse.com/1183291

1 0

openSUSE-RU-2021:1104-1: moderate: Recommended update for crash
by maintenance＠opensuse.org 10 Aug '21

10 Aug '21

openSUSE Recommended Update: Recommended update for crash ______________________________________________________________________________ Announcement ID: openSUSE-RU-2021:1104-1 Rating: moderate References: #1146646 #1162297 #1177050 #1178827 #1179536 #1179970 Affected Products: openSUSE Leap 15.2 ______________________________________________________________________________ An update that has 6 recommended fixes can now be installed. Description: This update for crash fixes the following issues: - Fixed an issue when crash has a read error for physical address. (bsc#1177050) - Fix "kmem -i" option on Linux 5.9-rc1 and later kernels (bsc#1179970 ltc#188981). - Fix crash utility is taking forever to initialize a vmcore from large config system (bsc#1178827 ltc#189279). - Corrected project URL in spec file to match the changed upstream location as-of May 30th 2020. (bsc#1179536) - Fixed an issue when crash utility emitting seek error while analyzing 'vmcore'. (bsc#1162297) - Fix eppic extension build. - Fix memory driver build failure with kernels 5.8+. - Remove bypass 'lto' and add '-mfull-toc' for 'ppc64le' to check. (bsc#1146646) This update was imported from the SUSE:SLE-15-SP2:Update update project. Patch Instructions: To install this openSUSE Recommended Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 15.2: zypper in -t patch openSUSE-2021-1104=1 Package List: - openSUSE Leap 15.2 (x86_64): crash-7.2.8-lp152.3.9.2 crash-debuginfo-7.2.8-lp152.3.9.2 crash-debugsource-7.2.8-lp152.3.9.2 crash-devel-7.2.8-lp152.3.9.2 crash-doc-7.2.8-lp152.3.9.2 crash-eppic-7.2.8-lp152.3.9.2 crash-eppic-debuginfo-7.2.8-lp152.3.9.2 crash-gcore-7.2.8-lp152.3.9.2 crash-gcore-debuginfo-7.2.8-lp152.3.9.2 crash-kmp-default-7.2.8_k5.3.18_lp152.84-lp152.3.9.2 crash-kmp-default-debuginfo-7.2.8_k5.3.18_lp152.84-lp152.3.9.2 crash-kmp-preempt-7.2.8_k5.3.18_lp152.84-lp152.3.9.2 crash-kmp-preempt-debuginfo-7.2.8_k5.3.18_lp152.84-lp152.3.9.2 References: https://bugzilla.suse.com/1146646 https://bugzilla.suse.com/1162297 https://bugzilla.suse.com/1177050 https://bugzilla.suse.com/1178827 https://bugzilla.suse.com/1179536 https://bugzilla.suse.com/1179970

1 0

openSUSE-SU-2021:1101-1: important: Security update for webkit2gtk3
by opensuse-security＠opensuse.org 10 Aug '21

10 Aug '21

openSUSE Security Update: Security update for webkit2gtk3 ______________________________________________________________________________ Announcement ID: openSUSE-SU-2021:1101-1 Rating: important References: #1188697 Cross-References: CVE-2021-21775 CVE-2021-21779 CVE-2021-30663 CVE-2021-30665 CVE-2021-30689 CVE-2021-30720 CVE-2021-30734 CVE-2021-30744 CVE-2021-30749 CVE-2021-30758 CVE-2021-30795 CVE-2021-30797 CVE-2021-30799 CVSS scores: CVE-2021-21775 (NVD) : 8.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H CVE-2021-21775 (SUSE): 8.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H CVE-2021-21779 (NVD) : 8.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H CVE-2021-21779 (SUSE): 8.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H CVE-2021-30749 (SUSE): 8.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H Affected Products: openSUSE Leap 15.2 ______________________________________________________________________________ An update that fixes 13 vulnerabilities is now available. Description: This update for webkit2gtk3 fixes the following issues: - Update to version 2.32.3: - CVE-2021-21775: Fixed a use-after-free vulnerability in the way certain events are processed for ImageLoader objects. A specially crafted web page can lead to a potential information leak and further memory corruption. A victim must be tricked into visiting a malicious web page to trigger this vulnerability. (bsc#1188697) - CVE-2021-21779: Fixed a use-after-free vulnerability in the way that WebKit GraphicsContext handles certain events. A specially crafted web page can lead to a potential information leak and further memory corruption. A victim must be tricked into visiting a malicious web page to trigger this vulnerability. (bsc#1188697) - CVE-2021-30663: An integer overflow was addressed with improved input validation. (bsc#1188697) - CVE-2021-30665: A memory corruption issue was addressed with improved state management. (bsc#1188697) - CVE-2021-30689: A logic issue was addressed with improved state management. (bsc#1188697) - CVE-2021-30720: A logic issue was addressed with improved restrictions. (bsc#1188697) - CVE-2021-30734: Multiple memory corruption issues were addressed with improved memory handling. (bsc#1188697) - CVE-2021-30744: A cross-origin issue with iframe elements was addressed with improved tracking of security origins. (bsc#1188697) - CVE-2021-30749: Multiple memory corruption issues were addressed with improved memory handling. (bsc#1188697) - CVE-2021-30758: A type confusion issue was addressed with improved state handling. (bsc#1188697) - CVE-2021-30795: A use after free issue was addressed with improved memory management. (bsc#1188697) - CVE-2021-30797: This issue was addressed with improved checks. (bsc#1188697) - CVE-2021-30799: Multiple memory corruption issues were addressed with improved memory handling. (bsc#1188697) This update was imported from the SUSE:SLE-15-SP2:Update update project. Patch Instructions: To install this openSUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 15.2: zypper in -t patch openSUSE-2021-1101=1 Package List: - openSUSE Leap 15.2 (i586 x86_64): libjavascriptcoregtk-4_0-18-2.32.3-lp152.2.16.1 libjavascriptcoregtk-4_0-18-debuginfo-2.32.3-lp152.2.16.1 libwebkit2gtk-4_0-37-2.32.3-lp152.2.16.1 libwebkit2gtk-4_0-37-debuginfo-2.32.3-lp152.2.16.1 typelib-1_0-JavaScriptCore-4_0-2.32.3-lp152.2.16.1 typelib-1_0-WebKit2-4_0-2.32.3-lp152.2.16.1 typelib-1_0-WebKit2WebExtension-4_0-2.32.3-lp152.2.16.1 webkit-jsc-4-2.32.3-lp152.2.16.1 webkit-jsc-4-debuginfo-2.32.3-lp152.2.16.1 webkit2gtk-4_0-injected-bundles-2.32.3-lp152.2.16.1 webkit2gtk-4_0-injected-bundles-debuginfo-2.32.3-lp152.2.16.1 webkit2gtk3-debugsource-2.32.3-lp152.2.16.1 webkit2gtk3-devel-2.32.3-lp152.2.16.1 webkit2gtk3-minibrowser-2.32.3-lp152.2.16.1 webkit2gtk3-minibrowser-debuginfo-2.32.3-lp152.2.16.1 - openSUSE Leap 15.2 (noarch): libwebkit2gtk3-lang-2.32.3-lp152.2.16.1 - openSUSE Leap 15.2 (x86_64): libjavascriptcoregtk-4_0-18-32bit-2.32.3-lp152.2.16.1 libjavascriptcoregtk-4_0-18-32bit-debuginfo-2.32.3-lp152.2.16.1 libwebkit2gtk-4_0-37-32bit-2.32.3-lp152.2.16.1 libwebkit2gtk-4_0-37-32bit-debuginfo-2.32.3-lp152.2.16.1 References: https://www.suse.com/security/cve/CVE-2021-21775.html https://www.suse.com/security/cve/CVE-2021-21779.html https://www.suse.com/security/cve/CVE-2021-30663.html https://www.suse.com/security/cve/CVE-2021-30665.html https://www.suse.com/security/cve/CVE-2021-30689.html https://www.suse.com/security/cve/CVE-2021-30720.html https://www.suse.com/security/cve/CVE-2021-30734.html https://www.suse.com/security/cve/CVE-2021-30744.html https://www.suse.com/security/cve/CVE-2021-30749.html https://www.suse.com/security/cve/CVE-2021-30758.html https://www.suse.com/security/cve/CVE-2021-30795.html https://www.suse.com/security/cve/CVE-2021-30797.html https://www.suse.com/security/cve/CVE-2021-30799.html https://bugzilla.suse.com/1188697

1 0

openSUSE-SU-2021:1107-1: Security update for fastjar
by opensuse-security＠opensuse.org 10 Aug '21

10 Aug '21

openSUSE Security Update: Security update for fastjar ______________________________________________________________________________ Announcement ID: openSUSE-SU-2021:1107-1 Rating: low References: #1188517 Cross-References: CVE-2010-2322 CVSS scores: CVE-2010-2322 (SUSE): 3.7 CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:N Affected Products: openSUSE Leap 15.2 ______________________________________________________________________________ An update that fixes one vulnerability is now available. Description: This update for fastjar fixes the following issues: - CVE-2010-2322: Fixed a directory traversal vulnerabilities. (bsc#1188517) This update was imported from the SUSE:SLE-15:Update update project. Patch Instructions: To install this openSUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 15.2: zypper in -t patch openSUSE-2021-1107=1 Package List: - openSUSE Leap 15.2 (i586 x86_64): fastjar-0.98-lp152.4.3.1 fastjar-debuginfo-0.98-lp152.4.3.1 fastjar-debugsource-0.98-lp152.4.3.1 References: https://www.suse.com/security/cve/CVE-2010-2322.html https://bugzilla.suse.com/1188517

1 0

openSUSE-RU-2021:1108-1: moderate: Recommended update for tigervnc
by maintenance＠opensuse.org 10 Aug '21

10 Aug '21

openSUSE Recommended Update: Recommended update for tigervnc ______________________________________________________________________________ Announcement ID: openSUSE-RU-2021:1108-1 Rating: moderate References: #1179809 Affected Products: openSUSE Leap 15.2 ______________________________________________________________________________ An update that has one recommended fix can now be installed. Description: This update for tigervnc fixes the following issues: - TigerVNC now works in FIPS environment (bsc#1179809) This update was imported from the SUSE:SLE-15-SP1:Update update project. Patch Instructions: To install this openSUSE Recommended Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 15.2: zypper in -t patch openSUSE-2021-1108=1 Package List: - openSUSE Leap 15.2 (x86_64): libXvnc-devel-1.9.0-lp152.7.6.1 libXvnc1-1.9.0-lp152.7.6.1 libXvnc1-debuginfo-1.9.0-lp152.7.6.1 tigervnc-1.9.0-lp152.7.6.1 tigervnc-debuginfo-1.9.0-lp152.7.6.1 tigervnc-debugsource-1.9.0-lp152.7.6.1 xorg-x11-Xvnc-1.9.0-lp152.7.6.1 xorg-x11-Xvnc-debuginfo-1.9.0-lp152.7.6.1 xorg-x11-Xvnc-module-1.9.0-lp152.7.6.1 xorg-x11-Xvnc-module-debuginfo-1.9.0-lp152.7.6.1 - openSUSE Leap 15.2 (noarch): tigervnc-x11vnc-1.9.0-lp152.7.6.1 xorg-x11-Xvnc-java-1.9.0-lp152.7.6.1 xorg-x11-Xvnc-novnc-1.9.0-lp152.7.6.1 References: https://bugzilla.suse.com/1179809

1 0

openSUSE-SU-2021:2641-1: moderate: Security update for python-reportlab
by opensuse-security＠opensuse.org 09 Aug '21

09 Aug '21

openSUSE Security Update: Security update for python-reportlab ______________________________________________________________________________ Announcement ID: openSUSE-SU-2021:2641-1 Rating: moderate References: #1182503 Cross-References: CVE-2020-28463 CVSS scores: CVE-2020-28463 (NVD) : 6.5 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N CVE-2020-28463 (SUSE): 5 CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N Affected Products: openSUSE Leap 15.3 ______________________________________________________________________________ An update that fixes one vulnerability is now available. Description: This update for python-reportlab fixes the following issues: - CVE-2020-28463: Fixed Server-side Request Forgery via img tags (bsc#1182503). Patch Instructions: To install this openSUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 15.3: zypper in -t patch openSUSE-SLE-15.3-2021-2641=1 Package List: - openSUSE Leap 15.3 (aarch64 ppc64le s390x x86_64): python-reportlab-debuginfo-3.4.0-3.6.1 python-reportlab-debugsource-3.4.0-3.6.1 python2-reportlab-3.4.0-3.6.1 python2-reportlab-debuginfo-3.4.0-3.6.1 python3-reportlab-3.4.0-3.6.1 python3-reportlab-debuginfo-3.4.0-3.6.1 References: https://www.suse.com/security/cve/CVE-2020-28463.html https://bugzilla.suse.com/1182503

1 0