August 2021 - openSUSE Updates - openSUSE Mailing Lists

openSUSE-SU-2021:2612-1: important: Security update for apache-commons-compress
by opensuse-security＠opensuse.org 05 Aug '21

05 Aug '21

openSUSE Security Update: Security update for apache-commons-compress ______________________________________________________________________________ Announcement ID: openSUSE-SU-2021:2612-1 Rating: important References: #1188463 #1188464 #1188465 #1188466 Cross-References: CVE-2021-35515 CVE-2021-35516 CVE-2021-35517 CVE-2021-36090 CVSS scores: CVE-2021-35515 (NVD) : 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H CVE-2021-35515 (SUSE): 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H CVE-2021-35516 (SUSE): 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H CVE-2021-35517 (SUSE): 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H CVE-2021-36090 (NVD) : 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H CVE-2021-36090 (SUSE): 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H Affected Products: openSUSE Leap 15.3 ______________________________________________________________________________ An update that fixes four vulnerabilities is now available. Description: This update for apache-commons-compress fixes the following issues: - Updated to 1.21 - CVE-2021-35515: Fixed an infinite loop when reading a specially crafted 7Z archive. (bsc#1188463) - CVE-2021-35516: Fixed an excessive memory allocation when reading a specially crafted 7Z archive. (bsc#1188464) - CVE-2021-35517: Fixed an excessive memory allocation when reading a specially crafted TAR archive. (bsc#1188465) - CVE-2021-36090: Fixed an excessive memory allocation when reading a specially crafted ZIP archive. (bsc#1188466) Patch Instructions: To install this openSUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 15.3: zypper in -t patch openSUSE-SLE-15.3-2021-2612=1 Package List: - openSUSE Leap 15.3 (noarch): apache-commons-compress-1.21-3.3.1 apache-commons-compress-javadoc-1.21-3.3.1 References: https://www.suse.com/security/cve/CVE-2021-35515.html https://www.suse.com/security/cve/CVE-2021-35516.html https://www.suse.com/security/cve/CVE-2021-35517.html https://www.suse.com/security/cve/CVE-2021-36090.html https://bugzilla.suse.com/1188463 https://bugzilla.suse.com/1188464 https://bugzilla.suse.com/1188465 https://bugzilla.suse.com/1188466

1 0

openSUSE-RU-2021:1093-1: moderate: Recommended update for python3-pyside2
by maintenance＠opensuse.org 05 Aug '21

05 Aug '21

openSUSE Recommended Update: Recommended update for python3-pyside2 ______________________________________________________________________________ Announcement ID: openSUSE-RU-2021:1093-1 Rating: moderate References: Affected Products: openSUSE Backports SLE-15-SP3 ______________________________________________________________________________ An update that has 0 recommended fixes can now be installed. Description: This update for python3-pyside2 fixes the following issues: - Backport fix to parse clang versions >= 10 correctly (PYSIDE-1259), add pyside1259.diff Patch Instructions: To install this openSUSE Recommended Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Backports SLE-15-SP3: zypper in -t patch openSUSE-2021-1093=1 Package List: - openSUSE Backports SLE-15-SP3 (aarch64 x86_64): python3-pyside2-5.12.3-bp153.2.3.9 python3-pyside2-devel-5.12.3-bp153.2.3.9 python3-pyside2-examples-5.12.3-bp153.2.3.9 References:

1 0

openSUSE-SU-2021:1094-1: moderate: Security update for balsa
by opensuse-security＠opensuse.org 05 Aug '21

05 Aug '21

openSUSE Security Update: Security update for balsa ______________________________________________________________________________ Announcement ID: openSUSE-SU-2021:1094-1 Rating: moderate References: #1172460 Cross-References: CVE-2020-13645 CVSS scores: CVE-2020-13645 (NVD) : 6.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N CVE-2020-13645 (SUSE): 6.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N Affected Products: openSUSE Leap 15.2 openSUSE Backports SLE-15-SP3 openSUSE Backports SLE-15-SP2 ______________________________________________________________________________ An update that fixes one vulnerability is now available. Description: This update for balsa fixes the following issues: Update to version 2.6.1 - CVE-2020-13645: fix server identity verification (boo#1172460) Patch Instructions: To install this openSUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 15.2: zypper in -t patch openSUSE-2021-1094=1 - openSUSE Backports SLE-15-SP3: zypper in -t patch openSUSE-2021-1094=1 - openSUSE Backports SLE-15-SP2: zypper in -t patch openSUSE-2021-1094=1 Package List: - openSUSE Leap 15.2 (noarch): balsa-lang-2.6.1-lp152.2.3.1 - openSUSE Leap 15.2 (x86_64): balsa-2.6.1-lp152.2.3.1 balsa-debuginfo-2.6.1-lp152.2.3.1 balsa-debugsource-2.6.1-lp152.2.3.1 - openSUSE Backports SLE-15-SP3 (aarch64 ppc64le s390x x86_64): balsa-2.6.1-bp153.2.3.1 balsa-debuginfo-2.6.1-bp153.2.3.1 balsa-debugsource-2.6.1-bp153.2.3.1 - openSUSE Backports SLE-15-SP3 (noarch): balsa-lang-2.6.1-bp153.2.3.1 - openSUSE Backports SLE-15-SP2 (aarch64 ppc64le s390x x86_64): balsa-2.6.1-bp152.2.3.1 - openSUSE Backports SLE-15-SP2 (noarch): balsa-lang-2.6.1-bp152.2.3.1 References: https://www.suse.com/security/cve/CVE-2020-13645.html https://bugzilla.suse.com/1172460

1 0

openSUSE-SU-2021:2614-1: important: Security update for spice-vdagent
by opensuse-security＠opensuse.org 05 Aug '21

05 Aug '21

openSUSE Security Update: Security update for spice-vdagent ______________________________________________________________________________ Announcement ID: openSUSE-SU-2021:2614-1 Rating: important References: #1173749 #1177780 #1177781 #1177782 #1177783 Cross-References: CVE-2020-25650 CVE-2020-25651 CVE-2020-25652 CVE-2020-25653 CVSS scores: CVE-2020-25650 (NVD) : 5.5 CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H CVE-2020-25650 (SUSE): 5.5 CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H CVE-2020-25651 (NVD) : 6.4 CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:C/C:H/I:N/A:L CVE-2020-25651 (SUSE): 6.4 CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:C/C:L/I:N/A:H CVE-2020-25652 (NVD) : 5.5 CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H CVE-2020-25652 (SUSE): 5.5 CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H CVE-2020-25653 (SUSE): 8.8 CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H Affected Products: openSUSE Leap 15.3 ______________________________________________________________________________ An update that solves four vulnerabilities and has one errata is now available. Description: This update for spice-vdagent fixes the following issues: - Update to version 0.21.0 - CVE-2020-25650: memory DoS via arbitrary entries in `active_xfers` hash table (bsc#1177780) - CVE-2020-25651: possible file transfer DoS and information leak via `active_xfers` hash map (bsc#1177781) - CVE-2020-25652: possibility to exhaust file descriptors in `vdagentd` (bsc#1177782) - CVE-2020-25653: UNIX domain socket peer PID retrieved via `SO_PEERCRED` is subject to race condition (bsc#1177783) Patch Instructions: To install this openSUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 15.3: zypper in -t patch openSUSE-SLE-15.3-2021-2614=1 Package List: - openSUSE Leap 15.3 (aarch64 ppc64le s390x x86_64): spice-vdagent-0.21.0-3.3.1 spice-vdagent-debuginfo-0.21.0-3.3.1 spice-vdagent-debugsource-0.21.0-3.3.1 References: https://www.suse.com/security/cve/CVE-2020-25650.html https://www.suse.com/security/cve/CVE-2020-25651.html https://www.suse.com/security/cve/CVE-2020-25652.html https://www.suse.com/security/cve/CVE-2020-25653.html https://bugzilla.suse.com/1173749 https://bugzilla.suse.com/1177780 https://bugzilla.suse.com/1177781 https://bugzilla.suse.com/1177782 https://bugzilla.suse.com/1177783

1 0

openSUSE-SU-2021:1096-1: important: Security update for opera
by opensuse-security＠opensuse.org 05 Aug '21

05 Aug '21

openSUSE Security Update: Security update for opera ______________________________________________________________________________ Announcement ID: openSUSE-SU-2021:1096-1 Rating: important References: Cross-References: CVE-2021-30541 CVE-2021-30560 CVE-2021-30561 CVE-2021-30562 CVE-2021-30563 CVE-2021-30564 Affected Products: openSUSE Leap 15.2:NonFree ______________________________________________________________________________ An update that fixes 6 vulnerabilities is now available. Description: This update for opera fixes the following issues: Update to version 77.0.4054.277: - DNA-94291 Video conference popout doesnt remember its size after resizing - DNA-94399 Incorrect icon for wp.pl in address bar dropdown - DNA-94462 Low quality of default wallpaper on windows - The update to chromium 91.0.4472.164 fixes following issues: CVE-2021-30541, CVE-2021-30560, CVE-2021-30561, CVE-2021-30562, CVE-2021-30563, CVE-2021-30564 Patch Instructions: To install this openSUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 15.2:NonFree: zypper in -t patch openSUSE-2021-1096=1 Package List: - openSUSE Leap 15.2:NonFree (x86_64): opera-77.0.4054.277-lp152.2.55.1 References: https://www.suse.com/security/cve/CVE-2021-30541.html https://www.suse.com/security/cve/CVE-2021-30560.html https://www.suse.com/security/cve/CVE-2021-30561.html https://www.suse.com/security/cve/CVE-2021-30562.html https://www.suse.com/security/cve/CVE-2021-30563.html https://www.suse.com/security/cve/CVE-2021-30564.html

1 0

openSUSE-RU-2021:2610-1: moderate: Recommended update for powerpc-utils
by maintenance＠opensuse.org 05 Aug '21

05 Aug '21

openSUSE Recommended Update: Recommended update for powerpc-utils ______________________________________________________________________________ Announcement ID: openSUSE-RU-2021:2610-1 Rating: moderate References: #1187182 Affected Products: openSUSE Leap 15.3 ______________________________________________________________________________ An update that has one recommended fix can now be installed. Description: This update for powerpc-utils fixes the following issues: - Bring up the members of HNV interface together with the HNV link. (bsc#1187182 ltc#192954) Patch Instructions: To install this openSUSE Recommended Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 15.3: zypper in -t patch openSUSE-SLE-15.3-2021-2610=1 Package List: - openSUSE Leap 15.3 (ppc64le): powerpc-utils-1.3.8-9.6.1 powerpc-utils-debuginfo-1.3.8-9.6.1 powerpc-utils-debugsource-1.3.8-9.6.1 References: https://bugzilla.suse.com/1187182

1 0

openSUSE-SU-2021:2617-1: important: Security update for mariadb
by opensuse-security＠opensuse.org 05 Aug '21

05 Aug '21

openSUSE Security Update: Security update for mariadb ______________________________________________________________________________ Announcement ID: openSUSE-SU-2021:2617-1 Rating: important References: #1182739 #1183770 #1185868 #1185870 #1185872 #1188300 Cross-References: CVE-2021-2154 CVE-2021-2166 CVE-2021-2180 CVE-2021-27928 CVSS scores: CVE-2021-2154 (NVD) : 4.9 CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H CVE-2021-2154 (SUSE): 4.9 CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H CVE-2021-2166 (NVD) : 4.9 CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H CVE-2021-2166 (SUSE): 4.9 CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H CVE-2021-2180 (NVD) : 4.9 CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H CVE-2021-2180 (SUSE): 4.9 CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H CVE-2021-27928 (NVD) : 7.2 CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H CVE-2021-27928 (SUSE): 7.2 CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H Affected Products: openSUSE Leap 15.3 ______________________________________________________________________________ An update that solves four vulnerabilities and has two fixes is now available. Description: This update for mariadb fixes the following issues: - Update to 10.2.39 (bsc#1182739) - CVE-2021-2166: DML unspecified vulnerability lead to complete DOS. (bsc#1185870) - CVE-2021-2154: DML unspecified vulnerability can lead to complete DOS. (bsc#1185872) - CVE-2021-2180: InnoDB unspecified vulnerability lead to complete DOS. (bsc#1185868) - CVE-2021-27928: Fixed a remote code execution issue. (bsc#1183770) Patch Instructions: To install this openSUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 15.3: zypper in -t patch openSUSE-SLE-15.3-2021-2617=1 Package List: - openSUSE Leap 15.3 (aarch64 ppc64le s390x x86_64): libmysqld-devel-10.2.39-3.40.1 libmysqld19-10.2.39-3.40.1 libmysqld19-debuginfo-10.2.39-3.40.1 References: https://www.suse.com/security/cve/CVE-2021-2154.html https://www.suse.com/security/cve/CVE-2021-2166.html https://www.suse.com/security/cve/CVE-2021-2180.html https://www.suse.com/security/cve/CVE-2021-27928.html https://bugzilla.suse.com/1182739 https://bugzilla.suse.com/1183770 https://bugzilla.suse.com/1185868 https://bugzilla.suse.com/1185870 https://bugzilla.suse.com/1185872 https://bugzilla.suse.com/1188300

1 0

openSUSE-SU-2021:2618-1: important: Security update for nodejs8
by opensuse-security＠opensuse.org 05 Aug '21

05 Aug '21

openSUSE Security Update: Security update for nodejs8 ______________________________________________________________________________ Announcement ID: openSUSE-SU-2021:2618-1 Rating: important References: #1184450 #1187976 #1187977 Cross-References: CVE-2020-7774 CVE-2021-23362 CVE-2021-27290 CVSS scores: CVE-2020-7774 (NVD) : 7.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L CVE-2021-23362 (NVD) : 5.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L CVE-2021-23362 (SUSE): 5.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L CVE-2021-27290 (NVD) : 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H CVE-2021-27290 (SUSE): 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H Affected Products: openSUSE Leap 15.3 ______________________________________________________________________________ An update that fixes three vulnerabilities is now available. Description: This update for nodejs8 fixes the following issues: - update to npm 6.14.13 - CVE-2021-27290: Fixed ssri Regular Expression Denial of Service. (bsc#1187976) - CVE-2021-23362: Fixed hosted-git-info Regular Expression Denial of Service. (bsc#1187977) - CVE-2020-7774: fixes y18n Prototype Pollution. (bsc#1184450) Patch Instructions: To install this openSUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 15.3: zypper in -t patch openSUSE-SLE-15.3-2021-2618=1 Package List: - openSUSE Leap 15.3 (aarch64 ppc64le s390x x86_64): nodejs8-8.17.0-10.12.2 nodejs8-debuginfo-8.17.0-10.12.2 nodejs8-debugsource-8.17.0-10.12.2 nodejs8-devel-8.17.0-10.12.2 npm8-8.17.0-10.12.2 - openSUSE Leap 15.3 (noarch): nodejs8-docs-8.17.0-10.12.2 References: https://www.suse.com/security/cve/CVE-2020-7774.html https://www.suse.com/security/cve/CVE-2021-23362.html https://www.suse.com/security/cve/CVE-2021-27290.html https://bugzilla.suse.com/1184450 https://bugzilla.suse.com/1187976 https://bugzilla.suse.com/1187977

1 0

openSUSE-RU-2021:2611-1: moderate: Recommended update for resource-agents
by maintenance＠opensuse.org 05 Aug '21

05 Aug '21

openSUSE Recommended Update: Recommended update for resource-agents ______________________________________________________________________________ Announcement ID: openSUSE-RU-2021:2611-1 Rating: moderate References: #1186652 Affected Products: openSUSE Leap 15.3 ______________________________________________________________________________ An update that has one recommended fix can now be installed. Description: This update for resource-agents fixes the following issues: - Adapt the makefile to the new 'GCP Load Balancer Resource Agent'. (bsc#1186652) Patch Instructions: To install this openSUSE Recommended Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 15.3: zypper in -t patch openSUSE-SLE-15.3-2021-2611=1 Package List: - openSUSE Leap 15.3 (aarch64 ppc64le s390x x86_64): ldirectord-4.8.0+git30.d0077df0-8.8.1 resource-agents-4.8.0+git30.d0077df0-8.8.1 resource-agents-debuginfo-4.8.0+git30.d0077df0-8.8.1 resource-agents-debugsource-4.8.0+git30.d0077df0-8.8.1 - openSUSE Leap 15.3 (noarch): monitoring-plugins-metadata-4.8.0+git30.d0077df0-8.8.1 References: https://bugzilla.suse.com/1186652

1 0

openSUSE-SU-2021:2619-1: important: Security update for djvulibre
by opensuse-security＠opensuse.org 05 Aug '21

05 Aug '21

openSUSE Security Update: Security update for djvulibre ______________________________________________________________________________ Announcement ID: openSUSE-SU-2021:2619-1 Rating: important References: #1187869 Cross-References: CVE-2021-3630 CVSS scores: CVE-2021-3630 (NVD) : 5.5 CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H CVE-2021-3630 (SUSE): 7.3 CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H Affected Products: openSUSE Leap 15.3 ______________________________________________________________________________ An update that fixes one vulnerability is now available. Description: This update for djvulibre fixes the following issues: - CVE-2021-3630: out-of-bounds write in DJVU:DjVuTXT:decode() in DjVuText.cpp (bsc#1187869) Patch Instructions: To install this openSUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 15.3: zypper in -t patch openSUSE-SLE-15.3-2021-2619=1 Package List: - openSUSE Leap 15.3 (aarch64 ppc64le s390x x86_64): djvulibre-3.5.27-11.11.1 djvulibre-debuginfo-3.5.27-11.11.1 djvulibre-debugsource-3.5.27-11.11.1 libdjvulibre-devel-3.5.27-11.11.1 libdjvulibre21-3.5.27-11.11.1 libdjvulibre21-debuginfo-3.5.27-11.11.1 - openSUSE Leap 15.3 (noarch): djvulibre-doc-3.5.27-11.11.1 References: https://www.suse.com/security/cve/CVE-2021-3630.html https://bugzilla.suse.com/1187869

1 0