September 2021 - openSUSE Updates - openSUSE Mailing Lists

openSUSE-SU-2021:1221-1: important: Security update for opera
by opensuse-security＠opensuse.org 03 Sep '21

03 Sep '21

openSUSE Security Update: Security update for opera ______________________________________________________________________________ Announcement ID: openSUSE-SU-2021:1221-1 Rating: important References: Cross-References: CVE-2021-30598 CVE-2021-30599 CVE-2021-30600 CVE-2021-30601 CVE-2021-30602 CVE-2021-30603 CVE-2021-30604 Affected Products: openSUSE Leap 15.3:NonFree openSUSE Leap 15.2:NonFree ______________________________________________________________________________ An update that fixes 7 vulnerabilities is now available. Description: This update for opera fixes the following issues: opera was updated to version 78.0.4093.184 - CHR-8533 Update chromium on desktop-stable-92-4093 to 92.0.4515.159 - DNA-93472 Reattaching to other browsers - DNA-93741 Multiple hint slots - DNA-93742 Allow displaying unobtrusive external hints - DNA-93744 Add slots in toolbar action view - DNA-94230 Improve text contrast for Speed Dials - DNA-94724 [Mac] Add macOS dark theme wallpaper with easy setup - DNA-94786 Crash at base::SupportsUserData:: SetUserData(void const*, std::__1::unique_ptr) - DNA-94807 Allow scripts access opera version and product info - DNA-94862 Continue on shopping Amazon doesn��t work correct - DNA-94870 Add an addonsPrivate function to install with permissions dialog first - DNA-95064 Revert DNA-93714 on stable - The update to chromium 92.0.4515.159 fixes following issues: CVE-2021-30598, CVE-2021-30599, CVE-2021-30600, CVE-2021-30601, CVE-2021-30602, CVE-2021-30603, CVE-2021-30604 Patch Instructions: To install this openSUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 15.3:NonFree: zypper in -t patch openSUSE-2021-1221=1 - openSUSE Leap 15.2:NonFree: zypper in -t patch openSUSE-2021-1221=1 Package List: - openSUSE Leap 15.3:NonFree (x86_64): opera-78.0.4093.184-lp153.2.15.1 - openSUSE Leap 15.2:NonFree (x86_64): opera-78.0.4093.184-lp152.2.61.1 References: https://www.suse.com/security/cve/CVE-2021-30598.html https://www.suse.com/security/cve/CVE-2021-30599.html https://www.suse.com/security/cve/CVE-2021-30600.html https://www.suse.com/security/cve/CVE-2021-30601.html https://www.suse.com/security/cve/CVE-2021-30602.html https://www.suse.com/security/cve/CVE-2021-30603.html https://www.suse.com/security/cve/CVE-2021-30604.html

1 0

openSUSE-RU-2021:2935-1: moderate: Recommended update for yast2-saptune
by maintenance＠opensuse.org 02 Sep '21

02 Sep '21

openSUSE Recommended Update: Recommended update for yast2-saptune ______________________________________________________________________________ Announcement ID: openSUSE-RU-2021:2935-1 Rating: moderate References: #1188321 Affected Products: openSUSE Leap 15.3 ______________________________________________________________________________ An update that has one recommended fix can now be installed. Description: This update for yast2-saptune fixes the following issues: - Exchange the tuned daemon handling with the new saptune service. (bsc#1188321) - Add information, if the service is enabled or disabled. Patch Instructions: To install this openSUSE Recommended Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 15.3: zypper in -t patch openSUSE-SLE-15.3-2021-2935=1 Package List: - openSUSE Leap 15.3 (noarch): yast2-saptune-1.4-3.6.1 References: https://bugzilla.suse.com/1188321

1 0

openSUSE-RU-2021:2934-1: important: Recommended update for SAPHanaSR-ScaleOut
by maintenance＠opensuse.org 02 Sep '21

02 Sep '21

openSUSE Recommended Update: Recommended update for SAPHanaSR-ScaleOut ______________________________________________________________________________ Announcement ID: openSUSE-RU-2021:2934-1 Rating: important References: #1144312 #1144442 #1173581 #1182115 #1182545 SLE-17452 SLE-20081 Affected Products: openSUSE Leap 15.3 ______________________________________________________________________________ An update that has 5 recommended fixes and contains two features can now be installed. Description: This update for SAPHanaSR-ScaleOut fixes the following issues: - change version to 0.180.1 - Extent the SAP HANA ressource agents from single replication automation to multi replication automation (jsc#SLE-17452, jsc#SLE-20081) - The resource start and stop timeout is now configurable by increasing the timeout for the action 'start' and/or 'stop' in the cluster. (bsc#1182545) - Improve handling of return codes in 'saphana_stopSystem' and 'saphana_stop' function. (bsc#1182115) - Integrate man pages back to the base package SAPHanaSR-ScaleOut. - Fixed an issue when HANA failover returns and empty site name. (bsc#1173581) - Add SAPHanaSR-call-monitor - Fixed an issue when HANA is configured to have only one master name server, but no additional master name server candidates, there may be the situation, where the master name server died and so the landscape has no active name server anymore. - Manual page updates: SAPHanaSR-ScaleOut.7 (bsc#1144442) SAPHanaSR-showAttr.8 (bsc#1144312) and others Patch Instructions: To install this openSUSE Recommended Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 15.3: zypper in -t patch openSUSE-SLE-15.3-2021-2934=1 Package List: - openSUSE Leap 15.3 (noarch): SAPHanaSR-ScaleOut-0.180.1-3.19.1 SAPHanaSR-ScaleOut-doc-0.180.1-3.19.1 References: https://bugzilla.suse.com/1144312 https://bugzilla.suse.com/1144442 https://bugzilla.suse.com/1173581 https://bugzilla.suse.com/1182115 https://bugzilla.suse.com/1182545

1 0

openSUSE-RU-2021:1219-1: moderate: Recommended update for bind
by maintenance＠opensuse.org 02 Sep '21

02 Sep '21

openSUSE Recommended Update: Recommended update for bind ______________________________________________________________________________ Announcement ID: openSUSE-RU-2021:1219-1 Rating: moderate References: #1187921 #1188763 Affected Products: openSUSE Leap 15.2 ______________________________________________________________________________ An update that has two recommended fixes can now be installed. Description: This update for bind fixes the following issues: - Fix an assertion failure in the 'rehash()' function (bsc#1188763) When calculating the new hashtable bitsize, there was an off-by-one error that would allow the new bitsize to be larger than maximum allowed. - tsig-keygen is now used to generate DDNS keys (bsc#1187921) This update was imported from the SUSE:SLE-15:Update update project. Patch Instructions: To install this openSUSE Recommended Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 15.2: zypper in -t patch openSUSE-2021-1219=1 Package List: - openSUSE Leap 15.2 (i586 x86_64): bind-9.16.6-lp152.14.22.1 bind-chrootenv-9.16.6-lp152.14.22.1 bind-debuginfo-9.16.6-lp152.14.22.1 bind-debugsource-9.16.6-lp152.14.22.1 bind-devel-9.16.6-lp152.14.22.1 bind-utils-9.16.6-lp152.14.22.1 bind-utils-debuginfo-9.16.6-lp152.14.22.1 libbind9-1600-9.16.6-lp152.14.22.1 libbind9-1600-debuginfo-9.16.6-lp152.14.22.1 libdns1605-9.16.6-lp152.14.22.1 libdns1605-debuginfo-9.16.6-lp152.14.22.1 libirs-devel-9.16.6-lp152.14.22.1 libirs1601-9.16.6-lp152.14.22.1 libirs1601-debuginfo-9.16.6-lp152.14.22.1 libisc1606-9.16.6-lp152.14.22.1 libisc1606-debuginfo-9.16.6-lp152.14.22.1 libisccc1600-9.16.6-lp152.14.22.1 libisccc1600-debuginfo-9.16.6-lp152.14.22.1 libisccfg1600-9.16.6-lp152.14.22.1 libisccfg1600-debuginfo-9.16.6-lp152.14.22.1 libns1604-9.16.6-lp152.14.22.1 libns1604-debuginfo-9.16.6-lp152.14.22.1 - openSUSE Leap 15.2 (noarch): bind-doc-9.16.6-lp152.14.22.1 python3-bind-9.16.6-lp152.14.22.1 - openSUSE Leap 15.2 (x86_64): bind-devel-32bit-9.16.6-lp152.14.22.1 libbind9-1600-32bit-9.16.6-lp152.14.22.1 libbind9-1600-32bit-debuginfo-9.16.6-lp152.14.22.1 libdns1605-32bit-9.16.6-lp152.14.22.1 libdns1605-32bit-debuginfo-9.16.6-lp152.14.22.1 libirs1601-32bit-9.16.6-lp152.14.22.1 libirs1601-32bit-debuginfo-9.16.6-lp152.14.22.1 libisc1606-32bit-9.16.6-lp152.14.22.1 libisc1606-32bit-debuginfo-9.16.6-lp152.14.22.1 libisccc1600-32bit-9.16.6-lp152.14.22.1 libisccc1600-32bit-debuginfo-9.16.6-lp152.14.22.1 libisccfg1600-32bit-9.16.6-lp152.14.22.1 libisccfg1600-32bit-debuginfo-9.16.6-lp152.14.22.1 libns1604-32bit-9.16.6-lp152.14.22.1 libns1604-32bit-debuginfo-9.16.6-lp152.14.22.1 References: https://bugzilla.suse.com/1187921 https://bugzilla.suse.com/1188763

1 0

openSUSE-RU-2021:2932-1: critical: Recommended update for suse-migration-services
by maintenance＠opensuse.org 02 Sep '21

02 Sep '21

openSUSE Recommended Update: Recommended update for suse-migration-services ______________________________________________________________________________ Announcement ID: openSUSE-RU-2021:2932-1 Rating: critical References: #1188594 Affected Products: openSUSE Leap 15.3 ______________________________________________________________________________ An update that has one recommended fix can now be installed. Description: This update for suse-migration-services fixes the following issues: - Bump version: 2.0.30 �� 2.0.31 - Remove SMT references (#223) SMT is no longer supported by SUSE and users are encouraged to migrate to RMT. We want users to use RMT servers, or SCC as targets for receiving system updates. Also improve requirements description and make the requirements for the repository server more explicit w.r.t. availability of the proper channels. - Add comment for lower case and reflect that on test - Update env and log it - In case of preserving the proxy file add those settings to the environment before starting the migration - Log environment variables, this information is helpful if a proxy is set (see bsc#1188594) Patch Instructions: To install this openSUSE Recommended Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 15.3: zypper in -t patch openSUSE-SLE-15.3-2021-2932=1 Package List: - openSUSE Leap 15.3 (noarch): suse-migration-services-2.0.31-1.40.1 References: https://bugzilla.suse.com/1188594

1 0

openSUSE-RU-2021:1218-1: moderate: Recommended update for yast2-nfs-server
by maintenance＠opensuse.org 02 Sep '21

02 Sep '21

openSUSE Recommended Update: Recommended update for yast2-nfs-server ______________________________________________________________________________ Announcement ID: openSUSE-RU-2021:1218-1 Rating: moderate References: #1188618 Affected Products: openSUSE Leap 15.2 ______________________________________________________________________________ An update that has one recommended fix can now be installed. Description: This update for yast2-nfs-server fixes the following issues: - Set X-SuSE-YaST-AutoInstClient in the desktop file to properly determine the client name. (bsc#1188618) This update was imported from the SUSE:SLE-15-SP2:Update update project. Patch Instructions: To install this openSUSE Recommended Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 15.2: zypper in -t patch openSUSE-2021-1218=1 Package List: - openSUSE Leap 15.2 (noarch): yast2-nfs-common-4.2.5-lp152.2.3.1 yast2-nfs-server-4.2.5-lp152.2.3.1 References: https://bugzilla.suse.com/1188618

1 0

openSUSE-SU-2021:2923-1: important: Security update for xen
by opensuse-security＠opensuse.org 02 Sep '21

02 Sep '21

openSUSE Security Update: Security update for xen ______________________________________________________________________________ Announcement ID: openSUSE-SU-2021:2923-1 Rating: important References: #1027519 #1176189 #1179246 #1183243 #1183877 #1185682 #1186428 #1186429 #1186433 #1186434 #1187406 #1188050 #1189373 #1189376 #1189378 #1189380 #1189381 #1189882 Cross-References: CVE-2021-0089 CVE-2021-28690 CVE-2021-28692 CVE-2021-28693 CVE-2021-28694 CVE-2021-28695 CVE-2021-28696 CVE-2021-28697 CVE-2021-28698 CVE-2021-28699 CVE-2021-28700 CVSS scores: CVE-2021-0089 (NVD) : 6.5 CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N CVE-2021-28694 (SUSE): 8.4 CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H CVE-2021-28695 (SUSE): 8.4 CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H CVE-2021-28696 (SUSE): 8.4 CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H CVE-2021-28697 (SUSE): 7.4 CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H CVE-2021-28698 (SUSE): 5.5 CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H CVE-2021-28699 (SUSE): 7 CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H CVE-2021-28700 (SUSE): 5.5 CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H Affected Products: openSUSE Leap 15.3 ______________________________________________________________________________ An update that solves 11 vulnerabilities and has 7 fixes is now available. Description: This update for xen fixes the following issues: Update to Xen 4.13.3 general bug fix release (bsc#1027519). Security issues fixed: - CVE-2021-28693: xen/arm: Boot modules are not scrubbed (bsc#1186428) - CVE-2021-28692: xen: inappropriate x86 IOMMU timeout detection / handling (bsc#1186429) - CVE-2021-0089: xen: Speculative Code Store Bypass (bsc#1186433) - CVE-2021-28690: xen: x86: TSX Async Abort protections not restored after S3 (bsc#1186434) - CVE-2021-28694,CVE-2021-28695,CVE-2021-28696: IOMMU page mapping issues on x86 (XSA-378)(bsc#1189373). - CVE-2021-28697: grant table v2 status pages may remain accessible after de-allocation (XSA-379)(bsc#1189376). - CVE-2021-28698: long running loops in grant table handling (XSA-380)(bsc#1189378). - CVE-2021-28699: inadequate grant-v2 status frames array bounds check (XSA-382)(bsc#1189380). - CVE-2021-28700: No memory limit for dom0less domUs (XSA-383)(bsc#1189381). Other issues fixed: - Fixed "Panic on CPU 0: IO-APIC + timer doesn't work!" (bsc#1180491) - Fixed an issue with xencommons, where file format expecations by fillup did not allign (bsc#1185682) - Fixed shell macro expansion in the spec file, so that ExecStart= in xendomains-wait-disks.service is created correctly (bsc#1183877) - Upstream bug fixes (bsc#1027519) - Fixed Xen SLES11SP4 guest hangs on cluster (bsc#1188050). - xl monitoring process exits during xl save -p|-c keep the monitoring process running to cleanup the domU during shutdown (bsc#1176189). - Dom0 hangs when pinning CPUs for dom0 with HVM guest (bsc#1179246). - Some long deprecated commands were finally removed in qemu6. Adjust libxl to use supported commands (bsc#1183243). - Update logrotate.conf, move global options into per-file sections to prevent globbering of global state (bsc#1187406). - Prevent superpage allocation in the LAPIC and ACPI_INFO range (bsc#1189882). Patch Instructions: To install this openSUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 15.3: zypper in -t patch openSUSE-SLE-15.3-2021-2923=1 Package List: - openSUSE Leap 15.3 (aarch64 x86_64): xen-4.14.2_04-3.9.1 xen-debugsource-4.14.2_04-3.9.1 xen-devel-4.14.2_04-3.9.1 xen-doc-html-4.14.2_04-3.9.1 xen-libs-4.14.2_04-3.9.1 xen-libs-debuginfo-4.14.2_04-3.9.1 xen-tools-4.14.2_04-3.9.1 xen-tools-debuginfo-4.14.2_04-3.9.1 xen-tools-domU-4.14.2_04-3.9.1 xen-tools-domU-debuginfo-4.14.2_04-3.9.1 - openSUSE Leap 15.3 (noarch): xen-tools-xendomains-wait-disk-4.14.2_04-3.9.1 - openSUSE Leap 15.3 (x86_64): xen-libs-32bit-4.14.2_04-3.9.1 xen-libs-32bit-debuginfo-4.14.2_04-3.9.1 References: https://www.suse.com/security/cve/CVE-2021-0089.html https://www.suse.com/security/cve/CVE-2021-28690.html https://www.suse.com/security/cve/CVE-2021-28692.html https://www.suse.com/security/cve/CVE-2021-28693.html https://www.suse.com/security/cve/CVE-2021-28694.html https://www.suse.com/security/cve/CVE-2021-28695.html https://www.suse.com/security/cve/CVE-2021-28696.html https://www.suse.com/security/cve/CVE-2021-28697.html https://www.suse.com/security/cve/CVE-2021-28698.html https://www.suse.com/security/cve/CVE-2021-28699.html https://www.suse.com/security/cve/CVE-2021-28700.html https://bugzilla.suse.com/1027519 https://bugzilla.suse.com/1176189 https://bugzilla.suse.com/1179246 https://bugzilla.suse.com/1183243 https://bugzilla.suse.com/1183877 https://bugzilla.suse.com/1185682 https://bugzilla.suse.com/1186428 https://bugzilla.suse.com/1186429 https://bugzilla.suse.com/1186433 https://bugzilla.suse.com/1186434 https://bugzilla.suse.com/1187406 https://bugzilla.suse.com/1188050 https://bugzilla.suse.com/1189373 https://bugzilla.suse.com/1189376 https://bugzilla.suse.com/1189378 https://bugzilla.suse.com/1189380 https://bugzilla.suse.com/1189381 https://bugzilla.suse.com/1189882

1 0

openSUSE-RU-2021:1217-1: moderate: Recommended update for python-dbus-python
by maintenance＠opensuse.org 02 Sep '21

02 Sep '21

openSUSE Recommended Update: Recommended update for python-dbus-python ______________________________________________________________________________ Announcement ID: openSUSE-RU-2021:1217-1 Rating: moderate References: #1183818 ECO-3589 Affected Products: openSUSE Leap 15.2 ______________________________________________________________________________ An update that has one recommended fix and contains one feature can now be installed. Description: This update for python-dbus-python fixes the following issues: - Update to latest version from tumbleweed. (jsc#ECO-3589, bsc#1183818) - update to 1.2.16: * All tests are run even if the 'tap.py' module is not available, althoug diagnostics for failing tests will be better if it is present. - Support builds with more than one python3 flavor - Clean duplicate python flavor variables for configure - Version update to version 1.2.14: * Ensure that the numeric types from dbus.types get the same str() under Python 3.8 that they did under previous versions. * Disable -Winline. * Add clearer license information using SPDX-License-Identifier. * Include inherited methods and properties when documenting objects, which regressed when migrating from epydoc to sphinx. * Add missing variant_level member to UnixFd type, for parity with the other dbus.types types * Don't reply to method calls if they have the NO_REPLY_EXPECTED flag * Silence '-Wcast-function-type' with gcc 8. * Fix distcheck with python3.7 by deleting '__pycache__' during uninstall. * Consistently save and restore the exception indicator when called from C code. - Add missing dependency for pkg-config files - Version update to version 1.2.8: * Python 2.7 required or 3.4 respectively * Upstream dropped epydoc completely - Add dbus-1-python3 package - Make BusConnection.list_activatable_names actually call struct entries than the signature allows with libdbus 1.4 imports dbus, is finalized, is re-initialized, and re-imports - When removing signal matches, clean up internal state, avoiding a memory leak in long-lived Python processes that connect to - When setting the sender of a message, allow it to be org.freedesktop.DBus so you can implement a D-Bus daemon - New package: dbus-1-python-devel This update was imported from the SUSE:SLE-15:Update update project. Patch Instructions: To install this openSUSE Recommended Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 15.2: zypper in -t patch openSUSE-2021-1217=1 Package List: - openSUSE Leap 15.2 (i586 x86_64): python-dbus-python-common-devel-1.2.16-lp152.7.3.1 python-dbus-python-debuginfo-1.2.16-lp152.7.3.1 python-dbus-python-debugsource-1.2.16-lp152.7.3.1 python2-dbus-python-1.2.16-lp152.7.3.1 python2-dbus-python-debuginfo-1.2.16-lp152.7.3.1 python2-dbus-python-devel-1.2.16-lp152.7.3.1 python3-dbus-python-1.2.16-lp152.7.3.1 python3-dbus-python-debuginfo-1.2.16-lp152.7.3.1 python3-dbus-python-devel-1.2.16-lp152.7.3.1 References: https://bugzilla.suse.com/1183818

1 0

openSUSE-SU-2021:2915-1: moderate: Security update for gstreamer-plugins-good
by opensuse-security＠opensuse.org 02 Sep '21

02 Sep '21

openSUSE Security Update: Security update for gstreamer-plugins-good ______________________________________________________________________________ Announcement ID: openSUSE-SU-2021:2915-1 Rating: moderate References: #1184735 #1184739 Cross-References: CVE-2021-3497 CVE-2021-3498 CVSS scores: CVE-2021-3497 (NVD) : 7.8 CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H CVE-2021-3497 (SUSE): 5.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L CVE-2021-3498 (NVD) : 7.8 CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H CVE-2021-3498 (SUSE): 5.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L Affected Products: openSUSE Leap 15.3 ______________________________________________________________________________ An update that fixes two vulnerabilities is now available. Description: This update for gstreamer-plugins-good fixes the following issues: - CVE-2021-3498: Matroskademux: initialize track context out parameter to NULL before parsing (bsc#1184735). - CVE-2021-3497: Matroskademux: Fix extraction of multichannel WavPack (bsc#1184739). Patch Instructions: To install this openSUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 15.3: zypper in -t patch openSUSE-SLE-15.3-2021-2915=1 Package List: - openSUSE Leap 15.3 (aarch64 ppc64le s390x x86_64): gstreamer-plugins-good-1.16.3-3.6.1 gstreamer-plugins-good-debuginfo-1.16.3-3.6.1 gstreamer-plugins-good-debugsource-1.16.3-3.6.1 gstreamer-plugins-good-doc-1.16.3-3.6.1 gstreamer-plugins-good-extra-1.16.3-3.6.1 gstreamer-plugins-good-extra-debuginfo-1.16.3-3.6.1 gstreamer-plugins-good-gtk-1.16.3-3.6.1 gstreamer-plugins-good-gtk-debuginfo-1.16.3-3.6.1 gstreamer-plugins-good-jack-1.16.3-3.6.1 gstreamer-plugins-good-jack-debuginfo-1.16.3-3.6.1 gstreamer-plugins-good-qtqml-1.16.3-3.6.1 gstreamer-plugins-good-qtqml-debuginfo-1.16.3-3.6.1 - openSUSE Leap 15.3 (noarch): gstreamer-plugins-good-lang-1.16.3-3.6.1 - openSUSE Leap 15.3 (x86_64): gstreamer-plugins-good-32bit-1.16.3-3.6.1 gstreamer-plugins-good-32bit-debuginfo-1.16.3-3.6.1 gstreamer-plugins-good-extra-32bit-1.16.3-3.6.1 gstreamer-plugins-good-extra-32bit-debuginfo-1.16.3-3.6.1 gstreamer-plugins-good-jack-32bit-1.16.3-3.6.1 gstreamer-plugins-good-jack-32bit-debuginfo-1.16.3-3.6.1 References: https://www.suse.com/security/cve/CVE-2021-3497.html https://www.suse.com/security/cve/CVE-2021-3498.html https://bugzilla.suse.com/1184735 https://bugzilla.suse.com/1184739

1 0

openSUSE-SU-2021:2919-1: important: Security update for ffmpeg
by opensuse-security＠opensuse.org 02 Sep '21

02 Sep '21

openSUSE Security Update: Security update for ffmpeg ______________________________________________________________________________ Announcement ID: openSUSE-SU-2021:2919-1 Rating: important References: #1129714 #1186849 #1186859 #1186861 #1186863 #1189142 #1189348 #1189350 Cross-References: CVE-2019-9721 CVE-2020-21688 CVE-2020-21697 CVE-2020-22046 CVE-2020-22048 CVE-2020-22049 CVE-2020-22054 CVE-2021-38114 CVSS scores: CVE-2019-9721 (NVD) : 6.5 CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H CVE-2019-9721 (SUSE): 4.3 CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:L CVE-2020-21688 (SUSE): 8.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H CVE-2020-21697 (SUSE): 6.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H CVE-2020-22046 (NVD) : 6.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H CVE-2020-22046 (SUSE): 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H CVE-2020-22048 (NVD) : 6.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H CVE-2020-22048 (SUSE): 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H CVE-2020-22049 (NVD) : 6.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H CVE-2020-22049 (SUSE): 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H CVE-2020-22054 (NVD) : 6.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H CVE-2020-22054 (SUSE): 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H CVE-2021-38114 (SUSE): 6.6 CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:N Affected Products: openSUSE Leap 15.3 ______________________________________________________________________________ An update that fixes 8 vulnerabilities is now available. Description: This update for ffmpeg fixes the following issues: - CVE-2019-9721: Fix denial of service in the subtitle decoder in handle_open_brace from libavcodec/htmlsubtitles.c (bsc#1129714). - CVE-2020-22046: Fix a denial of service vulnerability exists in FFmpeg 4.2 due to a memory leak in the avpriv_float_dsp_allocl function in libavutil/float_dsp.c (bsc#1186849). - CVE-2020-22048: Fix a denial of service vulnerability exists in FFmpeg 4.2 due to a memory leak in the ff_frame_pool_get function in framepool.c (bsc#1186859). - CVE-2020-22049: Fix a denial of service vulnerability exists in FFmpeg 4.2 due to a memory leak in the wtvfile_open_sector function in wtvdec.c (bsc#1186861). - CVE-2020-22054: Fix a denial of service vulnerability exists in FFmpeg 4.2 due to a memory leak in the av_dict_set function in dict.c (bsc#1186863). - CVE-2020-21688: Fixed a heap-use-after-free in the av_freep function in libavutil/mem.c (bsc#1189348). - CVE-2020-21697: Fixed a heap-use-after-free in the mpeg_mux_write_packet function in libavformat/mpegenc.c (bsc#1189350). - CVE-2021-38114: Fixed a not checked return value of the init_vlc function (bsc#1189142). Patch Instructions: To install this openSUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 15.3: zypper in -t patch openSUSE-SLE-15.3-2021-2919=1 Package List: - openSUSE Leap 15.3 (aarch64 ppc64le s390x x86_64): ffmpeg-3.4.2-11.8.2 ffmpeg-debuginfo-3.4.2-11.8.2 ffmpeg-debugsource-3.4.2-11.8.2 ffmpeg-private-devel-3.4.2-11.8.2 libavcodec-devel-3.4.2-11.8.2 libavcodec57-3.4.2-11.8.2 libavcodec57-debuginfo-3.4.2-11.8.2 libavdevice-devel-3.4.2-11.8.2 libavdevice57-3.4.2-11.8.2 libavdevice57-debuginfo-3.4.2-11.8.2 libavfilter-devel-3.4.2-11.8.2 libavfilter6-3.4.2-11.8.2 libavfilter6-debuginfo-3.4.2-11.8.2 libavformat-devel-3.4.2-11.8.2 libavformat57-3.4.2-11.8.2 libavformat57-debuginfo-3.4.2-11.8.2 libavresample-devel-3.4.2-11.8.2 libavresample3-3.4.2-11.8.2 libavresample3-debuginfo-3.4.2-11.8.2 libavutil-devel-3.4.2-11.8.2 libavutil55-3.4.2-11.8.2 libavutil55-debuginfo-3.4.2-11.8.2 libpostproc-devel-3.4.2-11.8.2 libpostproc54-3.4.2-11.8.2 libpostproc54-debuginfo-3.4.2-11.8.2 libswresample-devel-3.4.2-11.8.2 libswresample2-3.4.2-11.8.2 libswresample2-debuginfo-3.4.2-11.8.2 libswscale-devel-3.4.2-11.8.2 libswscale4-3.4.2-11.8.2 libswscale4-debuginfo-3.4.2-11.8.2 - openSUSE Leap 15.3 (x86_64): libavcodec57-32bit-3.4.2-11.8.2 libavcodec57-32bit-debuginfo-3.4.2-11.8.2 libavdevice57-32bit-3.4.2-11.8.2 libavdevice57-32bit-debuginfo-3.4.2-11.8.2 libavfilter6-32bit-3.4.2-11.8.2 libavfilter6-32bit-debuginfo-3.4.2-11.8.2 libavformat57-32bit-3.4.2-11.8.2 libavformat57-32bit-debuginfo-3.4.2-11.8.2 libavresample3-32bit-3.4.2-11.8.2 libavresample3-32bit-debuginfo-3.4.2-11.8.2 libavutil55-32bit-3.4.2-11.8.2 libavutil55-32bit-debuginfo-3.4.2-11.8.2 libpostproc54-32bit-3.4.2-11.8.2 libpostproc54-32bit-debuginfo-3.4.2-11.8.2 libswresample2-32bit-3.4.2-11.8.2 libswresample2-32bit-debuginfo-3.4.2-11.8.2 libswscale4-32bit-3.4.2-11.8.2 libswscale4-32bit-debuginfo-3.4.2-11.8.2 References: https://www.suse.com/security/cve/CVE-2019-9721.html https://www.suse.com/security/cve/CVE-2020-21688.html https://www.suse.com/security/cve/CVE-2020-21697.html https://www.suse.com/security/cve/CVE-2020-22046.html https://www.suse.com/security/cve/CVE-2020-22048.html https://www.suse.com/security/cve/CVE-2020-22049.html https://www.suse.com/security/cve/CVE-2020-22054.html https://www.suse.com/security/cve/CVE-2021-38114.html https://bugzilla.suse.com/1129714 https://bugzilla.suse.com/1186849 https://bugzilla.suse.com/1186859 https://bugzilla.suse.com/1186861 https://bugzilla.suse.com/1186863 https://bugzilla.suse.com/1189142 https://bugzilla.suse.com/1189348 https://bugzilla.suse.com/1189350

1 0