September 2021 - openSUSE Updates - openSUSE Mailing Lists

openSUSE-RU-2021:1325-1: moderate: Recommended update for xfsprogs
by maintenance＠opensuse.org 30 Sep '21

30 Sep '21

openSUSE Recommended Update: Recommended update for xfsprogs ______________________________________________________________________________ Announcement ID: openSUSE-RU-2021:1325-1 Rating: moderate References: #1085917 #1181299 #1181306 #1181309 #1181535 #1181536 #1188651 #1189552 SLE-20360 Affected Products: openSUSE Leap 15.2 ______________________________________________________________________________ An update that has 8 recommended fixes and contains one feature can now be installed. Description: This update for xfsprogs fixes the following issues: - Fixes an issue when 'fstests' with 'xfs' fail. (bsc#1181309, bsc#1181299) - xfsprogs: Split 'libhandle1' into a separate package, since nothing within xfsprogs dynamically links against it. The shared library is still required by xfsdump as a runtime dependency. - mkfs.xfs: Fix 'ASSERT' on too-small device with stripe geometry. (bsc#1181536) - mkfs.xfs: If either 'sunit' or 'swidth' is not zero, the other must be as well. (bsc#1085917, bsc#1181535) - xfs_growfs: Refactor geometry reporting. (bsc#1181306) - xfs_growfs: Allow mounted device node as argument. (bsc#1181299) - xfs_repair: Rebuild directory when non-root leafn blocks claim block 0. (bsc#1181309) - xfs_repair: Check plausibility of root dir pointer before trashing it. (bsc#1188651) - xfs_bmap: Remove '-c' from manpage. (bsc#1189552) - xfs_bmap: Do not reject '-e'. (bsc#1189552) - Implement 'libhandle1' through ECO. (jsc#SLE-20360) This update was imported from the SUSE:SLE-15:Update update project. Patch Instructions: To install this openSUSE Recommended Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 15.2: zypper in -t patch openSUSE-2021-1325=1 Package List: - openSUSE Leap 15.2 (i586 x86_64): libhandle1-4.15.0-lp152.12.3.1 libhandle1-debuginfo-4.15.0-lp152.12.3.1 xfsprogs-4.15.0-lp152.12.3.1 xfsprogs-debuginfo-4.15.0-lp152.12.3.1 xfsprogs-debugsource-4.15.0-lp152.12.3.1 xfsprogs-devel-4.15.0-lp152.12.3.1 References: https://bugzilla.suse.com/1085917 https://bugzilla.suse.com/1181299 https://bugzilla.suse.com/1181306 https://bugzilla.suse.com/1181309 https://bugzilla.suse.com/1181535 https://bugzilla.suse.com/1181536 https://bugzilla.suse.com/1188651 https://bugzilla.suse.com/1189552

1 0

openSUSE-FU-2021:3262-1: moderate: Feature update for SUSE Manager 4.1.11 Proxy
by maintenance＠opensuse.org 30 Sep '21

30 Sep '21

openSUSE Feature Update: Feature update for SUSE Manager 4.1.11 Proxy ______________________________________________________________________________ Announcement ID: openSUSE-FU-2021:3262-1 Rating: moderate References: Affected Products: openSUSE Leap 15.3 ______________________________________________________________________________ An update that has 0 feature fixes can now be installed. Description: This update provides the following packages to SUSE Manager 4.1.11 Proxy golang-github-prometheus-prometheus: - golang-github-prometheus-prometheus is added to SUSE Manager Proxy as L3 supported Patch Instructions: To install this openSUSE Feature Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 15.3: zypper in -t patch openSUSE-SLE-15.3-2021-3262=1 Package List: - openSUSE Leap 15.3 (aarch64 ppc64le s390x x86_64): golang-github-prometheus-prometheus-2.27.1-3.12.1 References:

1 0

openSUSE-FU-2021:3263-1: moderate: Feature update for SUSE Manager 4.1.11 Proxy
by maintenance＠opensuse.org 30 Sep '21

30 Sep '21

openSUSE Feature Update: Feature update for SUSE Manager 4.1.11 Proxy ______________________________________________________________________________ Announcement ID: openSUSE-FU-2021:3263-1 Rating: moderate References: Affected Products: openSUSE Leap 15.3 ______________________________________________________________________________ An update that has 0 feature fixes can now be installed. Description: This update provides the following packages to SUSE Manager 4.1.11 Proxy golang-github-prometheus-alertmanager: - golang-github-prometheus-alertmanager is added to SUSE Manager Proxy as L3 supported system-user-prometheus: - system-user-prometheus is added to SUSE Manager Proxy as L3 supported Patch Instructions: To install this openSUSE Feature Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 15.3: zypper in -t patch openSUSE-SLE-15.3-2021-3263=1 Package List: - openSUSE Leap 15.3 (noarch): system-user-prometheus-1.0.0-6.1 References:

1 0

openSUSE-RU-2021:1324-1: important: Recommended update for docker
by maintenance＠opensuse.org 30 Sep '21

30 Sep '21

openSUSE Recommended Update: Recommended update for docker ______________________________________________________________________________ Announcement ID: openSUSE-RU-2021:1324-1 Rating: important References: #1190670 Affected Products: openSUSE Leap 15.2 ______________________________________________________________________________ An update that has one recommended fix can now be installed. Description: This update for docker fixes the following issues: - Return ENOSYS for clone3 in the seccomp profile to avoid breaking containers using glibc 2.34. - Add shell requires for the *-completion subpackages. This update was imported from SUSE:SLE-15:Update. Patch Instructions: To install this openSUSE Recommended Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 15.2: zypper in -t patch openSUSE-2021-1324=1 Package List: - openSUSE Leap 15.2 (noarch): docker-bash-completion-20.10.6_ce-lp152.2.15.1 docker-fish-completion-20.10.6_ce-lp152.2.15.1 docker-zsh-completion-20.10.6_ce-lp152.2.15.1 - openSUSE Leap 15.2 (x86_64): docker-20.10.6_ce-lp152.2.15.1 docker-debuginfo-20.10.6_ce-lp152.2.15.1 References: https://bugzilla.suse.com/1190670

1 0

openSUSE-SU-2021:3255-1: moderate: Security update for postgresql13
by opensuse-security＠opensuse.org 29 Sep '21

29 Sep '21

openSUSE Security Update: Security update for postgresql13 ______________________________________________________________________________ Announcement ID: openSUSE-SU-2021:3255-1 Rating: moderate References: #1179945 #1185952 #1187751 #1189748 Cross-References: CVE-2021-3677 CVSS scores: CVE-2021-3677 (SUSE): 6.5 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N Affected Products: openSUSE Leap 15.3 ______________________________________________________________________________ An update that solves one vulnerability and has three fixes is now available. Description: This update for postgresql13 fixes the following issues: - CVE-2021-3677: Fixed memory disclosure in certain queries (bsc#1189748). - Fixed build with llvm12 on s390x (bsc#1185952). - Re-enabled icu for PostgreSQL 10 (bsc#1179945). - Made the dependency of postgresqlXX-server-devel on llvm and clang optional (bsc#1187751). - llvm12 breaks PostgreSQL 11 and 12 on s390x. Use llvm11 as a workaround (bsc#1185952). Patch Instructions: To install this openSUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 15.3: zypper in -t patch openSUSE-SLE-15.3-2021-3255=1 Package List: - openSUSE Leap 15.3 (aarch64 ppc64le s390x x86_64): libecpg6-13.4-5.16.2 libecpg6-debuginfo-13.4-5.16.2 libpq5-13.4-5.16.2 libpq5-debuginfo-13.4-5.16.2 postgresql13-13.4-5.16.2 postgresql13-contrib-13.4-5.16.2 postgresql13-contrib-debuginfo-13.4-5.16.2 postgresql13-debuginfo-13.4-5.16.2 postgresql13-debugsource-13.4-5.16.1 postgresql13-debugsource-13.4-5.16.2 postgresql13-devel-13.4-5.16.2 postgresql13-devel-debuginfo-13.4-5.16.2 postgresql13-llvmjit-13.4-5.16.2 postgresql13-llvmjit-debuginfo-13.4-5.16.2 postgresql13-plperl-13.4-5.16.2 postgresql13-plperl-debuginfo-13.4-5.16.2 postgresql13-plpython-13.4-5.16.2 postgresql13-plpython-debuginfo-13.4-5.16.2 postgresql13-pltcl-13.4-5.16.2 postgresql13-pltcl-debuginfo-13.4-5.16.2 postgresql13-server-13.4-5.16.2 postgresql13-server-debuginfo-13.4-5.16.2 postgresql13-server-devel-13.4-5.16.2 postgresql13-server-devel-debuginfo-13.4-5.16.2 postgresql13-test-13.4-5.16.2 - openSUSE Leap 15.3 (noarch): postgresql13-docs-13.4-5.16.2 - openSUSE Leap 15.3 (x86_64): libecpg6-32bit-13.4-5.16.2 libecpg6-32bit-debuginfo-13.4-5.16.2 libpq5-32bit-13.4-5.16.2 libpq5-32bit-debuginfo-13.4-5.16.2 References: https://www.suse.com/security/cve/CVE-2021-3677.html https://bugzilla.suse.com/1179945 https://bugzilla.suse.com/1185952 https://bugzilla.suse.com/1187751 https://bugzilla.suse.com/1189748

1 0

openSUSE-SU-2021:3256-1: moderate: Security update for postgresql12
by opensuse-security＠opensuse.org 29 Sep '21

29 Sep '21

openSUSE Security Update: Security update for postgresql12 ______________________________________________________________________________ Announcement ID: openSUSE-SU-2021:3256-1 Rating: moderate References: #1179945 #1185952 #1187751 #1189748 Cross-References: CVE-2021-3677 CVSS scores: CVE-2021-3677 (SUSE): 6.5 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N Affected Products: openSUSE Leap 15.3 ______________________________________________________________________________ An update that solves one vulnerability and has three fixes is now available. Description: This update for postgresql12 fixes the following issues: - CVE-2021-3677: Fixed memory disclosure in certain queries (bsc#1189748). - Fixed build with llvm12 on s390x (bsc#1185952). - Re-enabled icu for PostgreSQL 10 (bsc#1179945). - Made the dependency of postgresqlXX-server-devel on llvm and clang optional (bsc#1187751). - llvm12 breaks PostgreSQL 11 and 12 on s390x. Use llvm11 as a workaround (bsc#1185952). Patch Instructions: To install this openSUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 15.3: zypper in -t patch openSUSE-SLE-15.3-2021-3256=1 Package List: - openSUSE Leap 15.3 (aarch64 ppc64le s390x x86_64): postgresql12-12.8-8.23.2 postgresql12-contrib-12.8-8.23.2 postgresql12-contrib-debuginfo-12.8-8.23.2 postgresql12-debuginfo-12.8-8.23.2 postgresql12-debugsource-12.8-8.23.2 postgresql12-devel-12.8-8.23.2 postgresql12-devel-debuginfo-12.8-8.23.2 postgresql12-llvmjit-12.8-8.23.2 postgresql12-llvmjit-debuginfo-12.8-8.23.2 postgresql12-plperl-12.8-8.23.2 postgresql12-plperl-debuginfo-12.8-8.23.2 postgresql12-plpython-12.8-8.23.2 postgresql12-plpython-debuginfo-12.8-8.23.2 postgresql12-pltcl-12.8-8.23.2 postgresql12-pltcl-debuginfo-12.8-8.23.2 postgresql12-server-12.8-8.23.2 postgresql12-server-debuginfo-12.8-8.23.2 postgresql12-server-devel-12.8-8.23.2 postgresql12-server-devel-debuginfo-12.8-8.23.2 postgresql12-test-12.8-8.23.2 - openSUSE Leap 15.3 (noarch): postgresql12-docs-12.8-8.23.2 References: https://www.suse.com/security/cve/CVE-2021-3677.html https://bugzilla.suse.com/1179945 https://bugzilla.suse.com/1185952 https://bugzilla.suse.com/1187751 https://bugzilla.suse.com/1189748

1 0

openSUSE-RU-2021:1323-1: moderate: Recommended update for ServiceReport
by maintenance＠opensuse.org 29 Sep '21

29 Sep '21

openSUSE Recommended Update: Recommended update for ServiceReport ______________________________________________________________________________ Announcement ID: openSUSE-RU-2021:1323-1 Rating: moderate References: SLE-18193 Affected Products: openSUSE Leap 15.2 ______________________________________________________________________________ An update that has 0 recommended fixes and contains one feature can now be installed. Description: This update for ServiceReport fixes the following issues: Update to version 2.2.3+git1.55a13db1c256: * [fadump] Update crashkernel recommendation (tid#7023277). Added hardening to systemd service(s). Update to version 2.2.3 (jsc#SLE-18193): * ServiceReport v2.2.3 release * [Daemon] check active status along with enabled * Run-on supported architectures only * Take crashkernel recommendation from kdump-lib.sh scripts Patch Instructions: To install this openSUSE Recommended Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 15.2: zypper in -t patch openSUSE-2021-1323=1 Package List: - openSUSE Leap 15.2 (noarch): ServiceReport-2.2.3+git1.55a13db1c256-lp152.8.1 References:

1 0

openSUSE-RU-2021:1321-1: Recommended update for Leap-release
by maintenance＠opensuse.org 29 Sep '21

29 Sep '21

openSUSE Recommended Update: Recommended update for Leap-release ______________________________________________________________________________ Announcement ID: openSUSE-RU-2021:1321-1 Rating: low References: #1187214 Affected Products: openSUSE Leap 15.3 ______________________________________________________________________________ An update that has one recommended fix can now be installed. Description: Leap-release was updated to fix: - Add %sle_version rpm macro as is in SUSE Linux Enterprise (bsc#1187214). Patch Instructions: To install this openSUSE Recommended Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 15.3: zypper in -t patch openSUSE-2021-1321=1 Package List: - openSUSE Leap 15.3 (aarch64 i586 ppc64le s390x x86_64): openSUSE-Addon-NonOss-release-15.3-lp153.149.1 - openSUSE Leap 15.3 (aarch64 ppc64le s390x x86_64): openSUSE-release-15.3-lp153.149.1 openSUSE-release-appliance-custom-15.3-lp153.149.1 openSUSE-release-appliance-docker-15.3-lp153.149.1 openSUSE-release-appliance-hyperv-15.3-lp153.149.1 openSUSE-release-appliance-kvm-15.3-lp153.149.1 openSUSE-release-appliance-openstack-15.3-lp153.149.1 openSUSE-release-appliance-vmware-15.3-lp153.149.1 openSUSE-release-appliance-wsl-15.3-lp153.149.1 openSUSE-release-dvd-15.3-lp153.149.1 openSUSE-release-ftp-15.3-lp153.149.1 openSUSE-release-livecd-gnome-15.3-lp153.149.1 openSUSE-release-livecd-kde-15.3-lp153.149.1 openSUSE-release-livecd-x11-15.3-lp153.149.1 openSUSE-release-livecd-xfce-15.3-lp153.149.1 openSUSE-release-mini-15.3-lp153.149.1 openSUSE-release-usb-gnome-15.3-lp153.149.1 openSUSE-release-usb-kde-15.3-lp153.149.1 openSUSE-release-usb-x11-15.3-lp153.149.1 openSUSE-release-usb-xfce-15.3-lp153.149.1 References: https://bugzilla.suse.com/1187214

1 0

openSUSE-RU-2021:1322-1: moderate: Recommended update for rpm-repos-openSUSE
by maintenance＠opensuse.org 29 Sep '21

29 Sep '21

openSUSE Recommended Update: Recommended update for rpm-repos-openSUSE ______________________________________________________________________________ Announcement ID: openSUSE-RU-2021:1322-1 Rating: moderate References: #1189892 Affected Products: openSUSE Leap 15.3 ______________________________________________________________________________ An update that has one recommended fix can now be installed. Description: This update for rpm-repos-openSUSE fixes the following issues: - Fix GPG key references for updates from openSUSE backports (boo#1189892) Patch Instructions: To install this openSUSE Recommended Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 15.3: zypper in -t patch openSUSE-2021-1322=1 Package List: - openSUSE Leap 15.3 (aarch64 i586 ppc64le s390x x86_64): rpm-repos-openSUSE-Leap-1500-lp153.2.6.2 rpm-repos-openSUSE-Tumbleweed-1500-lp153.2.6.2 - openSUSE Leap 15.3 (noarch): openSUSE-build-key-1.0-lp153.4.2.1 rpm-repo-keys-openSUSE-0-lp153.2.6.2 References: https://bugzilla.suse.com/1189892

1 0

openSUSE-SU-2021:1319-1: moderate: Security update for hivex
by opensuse-security＠opensuse.org 29 Sep '21

29 Sep '21

openSUSE Security Update: Security update for hivex ______________________________________________________________________________ Announcement ID: openSUSE-SU-2021:1319-1 Rating: moderate References: #1189060 Cross-References: CVE-2021-3622 CVSS scores: CVE-2021-3622 (SUSE): 4.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:L Affected Products: openSUSE Leap 15.2 ______________________________________________________________________________ An update that fixes one vulnerability is now available. Description: This update for hivex fixes the following issues: - CVE-2021-3622: Fixed stack overflow due to recursive call of _get_children() (bsc#1189060). This update was imported from the SUSE:SLE-15:Update update project. Patch Instructions: To install this openSUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 15.2: zypper in -t patch openSUSE-2021-1319=1 Package List: - openSUSE Leap 15.2 (x86_64): hivex-1.3.14-lp152.4.6.1 hivex-debuginfo-1.3.14-lp152.4.6.1 hivex-debugsource-1.3.14-lp152.4.6.1 hivex-devel-1.3.14-lp152.4.6.1 libhivex0-1.3.14-lp152.4.6.1 libhivex0-debuginfo-1.3.14-lp152.4.6.1 ocaml-hivex-1.3.14-lp152.4.6.1 ocaml-hivex-debuginfo-1.3.14-lp152.4.6.1 ocaml-hivex-devel-1.3.14-lp152.4.6.1 perl-Win-Hivex-1.3.14-lp152.4.6.1 perl-Win-Hivex-debuginfo-1.3.14-lp152.4.6.1 python-hivex-1.3.14-lp152.4.6.1 python-hivex-debuginfo-1.3.14-lp152.4.6.1 - openSUSE Leap 15.2 (noarch): hivex-lang-1.3.14-lp152.4.6.1 References: https://www.suse.com/security/cve/CVE-2021-3622.html https://bugzilla.suse.com/1189060

1 0

openSUSE-RU-2021:1320-1: moderate: Recommended update for crmsh
by maintenance＠opensuse.org 29 Sep '21

29 Sep '21

openSUSE Recommended Update: Recommended update for crmsh ______________________________________________________________________________ Announcement ID: openSUSE-RU-2021:1320-1 Rating: moderate References: #1188971 #1189641 Affected Products: openSUSE Leap 15.2 ______________________________________________________________________________ An update that has two recommended fixes can now be installed. Description: This update for crmsh fixes the following issues: - Fix for 'hb_report': Using python way to collect ra trace files. (bsc#1189641) - Fix for 'bootstrap': Adjust host list for parallax to get and copy 'known_hosts' file. (bsc#1188971) This update was imported from the SUSE:SLE-15-SP2:Update update project. Patch Instructions: To install this openSUSE Recommended Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 15.2: zypper in -t patch openSUSE-2021-1320=1 Package List: - openSUSE Leap 15.2 (noarch): crmsh-4.3.1+20210827.4fb174c4-lp152.4.67.1 crmsh-scripts-4.3.1+20210827.4fb174c4-lp152.4.67.1 crmsh-test-4.3.1+20210827.4fb174c4-lp152.4.67.1 References: https://bugzilla.suse.com/1188971 https://bugzilla.suse.com/1189641

1 0

openSUSE-RU-2021:3245-1: important: Recommended update for docker
by maintenance＠opensuse.org 28 Sep '21

28 Sep '21

openSUSE Recommended Update: Recommended update for docker ______________________________________________________________________________ Announcement ID: openSUSE-RU-2021:3245-1 Rating: important References: #1190670 Affected Products: openSUSE Leap 15.3 ______________________________________________________________________________ An update that has one recommended fix can now be installed. Description: This update for docker fixes the following issues: - Return ENOSYS for clone3 in the seccomp profile to avoid breaking containers using glibc 2.34. - Add shell requires for the *-completion subpackages. Patch Instructions: To install this openSUSE Recommended Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 15.3: zypper in -t patch openSUSE-SLE-15.3-2021-3245=1 Package List: - openSUSE Leap 15.3 (aarch64 ppc64le s390x x86_64): docker-20.10.6_ce-153.1 docker-debuginfo-20.10.6_ce-153.1 docker-kubic-20.10.6_ce-6.52.1 docker-kubic-debuginfo-20.10.6_ce-6.52.1 docker-kubic-kubeadm-criconfig-20.10.6_ce-6.52.1 - openSUSE Leap 15.3 (noarch): docker-bash-completion-20.10.6_ce-153.1 docker-fish-completion-20.10.6_ce-153.1 docker-kubic-bash-completion-20.10.6_ce-6.52.1 docker-kubic-fish-completion-20.10.6_ce-6.52.1 docker-kubic-zsh-completion-20.10.6_ce-6.52.1 docker-zsh-completion-20.10.6_ce-153.1 References: https://bugzilla.suse.com/1190670

1 0

openSUSE-SU-2021:1318-1: moderate: Security update for transfig
by opensuse-security＠opensuse.org 28 Sep '21

28 Sep '21

openSUSE Security Update: Security update for transfig ______________________________________________________________________________ Announcement ID: openSUSE-SU-2021:1318-1 Rating: moderate References: #1143650 #1159130 #1159293 #1161698 #1186329 Cross-References: CVE-2019-14275 CVE-2019-19555 CVE-2019-19746 CVE-2019-19797 CVE-2021-3561 CVSS scores: CVE-2019-14275 (NVD) : 5.5 CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H CVE-2019-14275 (SUSE): 4.4 CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:L CVE-2019-19555 (NVD) : 5.5 CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H CVE-2019-19555 (SUSE): 4.3 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L CVE-2019-19746 (NVD) : 5.5 CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H CVE-2019-19746 (SUSE): 4.3 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L CVE-2019-19797 (NVD) : 5.5 CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H CVE-2019-19797 (SUSE): 5.4 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:L CVE-2021-3561 (NVD) : 7.1 CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:H CVE-2021-3561 (SUSE): 5.3 CVSS:3.1/AV:L/AC:H/PR:N/UI:R/S:U/C:N/I:H/A:L Affected Products: openSUSE Backports SLE-15-SP3 ______________________________________________________________________________ An update that fixes 5 vulnerabilities is now available. Description: This update for transfig fixes the following issues: Update to version 3.2.8, including fixes for - CVE-2021-3561: overflow in fig2dev/read.c in function read_colordef() (bsc#1186329). - CVE-2019-19797: out-of-bounds write in read_colordef in read.c (bsc#1159293). - CVE-2019-19555: stack-based buffer overflow because of an incorrect sscanf (bsc#1161698). - CVE-2019-19746: segmentation fault and out-of-bounds write because of an integer overflow via a large arrow type (bsc#1159130). - CVE-2019-14275: stack-based buffer overflow in the calc_arrow function in bound.c (bsc#1143650). This update was imported from the SUSE:SLE-15:Update update project. Patch Instructions: To install this openSUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Backports SLE-15-SP3: zypper in -t patch openSUSE-2021-1318=1 Package List: - openSUSE Backports SLE-15-SP3 (aarch64 i586 ppc64le s390x): transfig-3.2.8a-bp153.3.3.2 References: https://www.suse.com/security/cve/CVE-2019-14275.html https://www.suse.com/security/cve/CVE-2019-19555.html https://www.suse.com/security/cve/CVE-2019-19746.html https://www.suse.com/security/cve/CVE-2019-19797.html https://www.suse.com/security/cve/CVE-2021-3561.html https://bugzilla.suse.com/1143650 https://bugzilla.suse.com/1159130 https://bugzilla.suse.com/1159293 https://bugzilla.suse.com/1161698 https://bugzilla.suse.com/1186329

1 0

openSUSE-SU-2021:3244-1: Security update for shibboleth-sp
by opensuse-security＠opensuse.org 28 Sep '21

28 Sep '21

openSUSE Security Update: Security update for shibboleth-sp ______________________________________________________________________________ Announcement ID: openSUSE-SU-2021:3244-1 Rating: low References: #1184222 Affected Products: openSUSE Leap 15.3 ______________________________________________________________________________ An update that contains security fixes can now be installed. Description: This update for shibboleth-sp fixes the following issues: - Template generation allows external parameters to override placeholders (bsc#1184222) Patch Instructions: To install this openSUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 15.3: zypper in -t patch openSUSE-SLE-15.3-2021-3244=1 Package List: - openSUSE Leap 15.3 (aarch64 ppc64le s390x x86_64): libshibsp-lite8-3.1.0-3.3.1 libshibsp-lite8-debuginfo-3.1.0-3.3.1 libshibsp9-3.1.0-3.3.1 libshibsp9-debuginfo-3.1.0-3.3.1 shibboleth-sp-3.1.0-3.3.1 shibboleth-sp-debuginfo-3.1.0-3.3.1 shibboleth-sp-debugsource-3.1.0-3.3.1 shibboleth-sp-devel-3.1.0-3.3.1 References: https://bugzilla.suse.com/1184222

1 0

openSUSE-RU-2021:1315-1: moderate: Recommended update for sssd
by maintenance＠opensuse.org 28 Sep '21

28 Sep '21

openSUSE Recommended Update: Recommended update for sssd ______________________________________________________________________________ Announcement ID: openSUSE-RU-2021:1315-1 Rating: moderate References: #1182058 #1182637 #1184289 #1187120 #1189492 #1190021 ECO-3493 Affected Products: openSUSE Leap 15.2 ______________________________________________________________________________ An update that solves one vulnerability, contains one feature and has 5 fixes is now available. Description: This update for sssd fixes the following issues: - Fix a dependency loop by moving internal libraries to sssd-common package. (bsc#1182058) - Moved sssctl command from sssd to sssd-tools package. (bsc#1184289) - Create timestamp attribute in cache objects if missing. (bsc#1182637) - Fix watchdog not terminating tasks. (bsc#1187120) - Improve logs to record the reason why internal watchdog terminates. - Fixed security issue with sssd: shell command injection in sssctl. (CVE-2021-3621, bsc#1189492) - Fixes a segfault with newer libcares2 versions when the library fails to parse a dns name. (bsc#1190021) This update was imported from the SUSE:SLE-15-SP2:Update update project. Patch Instructions: To install this openSUSE Recommended Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 15.2: zypper in -t patch openSUSE-2021-1315=1 Package List: - openSUSE Leap 15.2 (i586 x86_64): libipa_hbac-devel-1.16.1-lp152.16.3.1 libipa_hbac0-1.16.1-lp152.16.3.1 libipa_hbac0-debuginfo-1.16.1-lp152.16.3.1 libnfsidmap-sss-1.16.1-lp152.16.3.1 libnfsidmap-sss-debuginfo-1.16.1-lp152.16.3.1 libsss_certmap-devel-1.16.1-lp152.16.3.1 libsss_certmap0-1.16.1-lp152.16.3.1 libsss_certmap0-debuginfo-1.16.1-lp152.16.3.1 libsss_idmap-devel-1.16.1-lp152.16.3.1 libsss_idmap0-1.16.1-lp152.16.3.1 libsss_idmap0-debuginfo-1.16.1-lp152.16.3.1 libsss_nss_idmap-devel-1.16.1-lp152.16.3.1 libsss_nss_idmap0-1.16.1-lp152.16.3.1 libsss_nss_idmap0-debuginfo-1.16.1-lp152.16.3.1 libsss_simpleifp-devel-1.16.1-lp152.16.3.1 libsss_simpleifp0-1.16.1-lp152.16.3.1 libsss_simpleifp0-debuginfo-1.16.1-lp152.16.3.1 python3-ipa_hbac-1.16.1-lp152.16.3.1 python3-ipa_hbac-debuginfo-1.16.1-lp152.16.3.1 python3-sss-murmur-1.16.1-lp152.16.3.1 python3-sss-murmur-debuginfo-1.16.1-lp152.16.3.1 python3-sss_nss_idmap-1.16.1-lp152.16.3.1 python3-sss_nss_idmap-debuginfo-1.16.1-lp152.16.3.1 python3-sssd-config-1.16.1-lp152.16.3.1 python3-sssd-config-debuginfo-1.16.1-lp152.16.3.1 sssd-1.16.1-lp152.16.3.1 sssd-ad-1.16.1-lp152.16.3.1 sssd-ad-debuginfo-1.16.1-lp152.16.3.1 sssd-common-1.16.1-lp152.16.3.1 sssd-common-debuginfo-1.16.1-lp152.16.3.1 sssd-dbus-1.16.1-lp152.16.3.1 sssd-dbus-debuginfo-1.16.1-lp152.16.3.1 sssd-debugsource-1.16.1-lp152.16.3.1 sssd-ipa-1.16.1-lp152.16.3.1 sssd-ipa-debuginfo-1.16.1-lp152.16.3.1 sssd-krb5-1.16.1-lp152.16.3.1 sssd-krb5-common-1.16.1-lp152.16.3.1 sssd-krb5-common-debuginfo-1.16.1-lp152.16.3.1 sssd-krb5-debuginfo-1.16.1-lp152.16.3.1 sssd-ldap-1.16.1-lp152.16.3.1 sssd-ldap-debuginfo-1.16.1-lp152.16.3.1 sssd-proxy-1.16.1-lp152.16.3.1 sssd-proxy-debuginfo-1.16.1-lp152.16.3.1 sssd-tools-1.16.1-lp152.16.3.1 sssd-tools-debuginfo-1.16.1-lp152.16.3.1 sssd-wbclient-1.16.1-lp152.16.3.1 sssd-wbclient-debuginfo-1.16.1-lp152.16.3.1 sssd-wbclient-devel-1.16.1-lp152.16.3.1 sssd-winbind-idmap-1.16.1-lp152.16.3.1 sssd-winbind-idmap-debuginfo-1.16.1-lp152.16.3.1 References: https://www.suse.com/security/cve/CVE-2021-3621.html https://bugzilla.suse.com/1182058 https://bugzilla.suse.com/1182637 https://bugzilla.suse.com/1184289 https://bugzilla.suse.com/1187120 https://bugzilla.suse.com/1189492 https://bugzilla.suse.com/1190021

1 0

openSUSE-RU-2021:1316-1: moderate: Recommended update for sapnwbootstrap-formula
by maintenance＠opensuse.org 28 Sep '21

28 Sep '21

openSUSE Recommended Update: Recommended update for sapnwbootstrap-formula ______________________________________________________________________________ Announcement ID: openSUSE-RU-2021:1316-1 Rating: moderate References: #1181541 #1185093 #1185627 #1186236 Affected Products: openSUSE Leap 15.2 ______________________________________________________________________________ An update that has four recommended fixes can now be installed. Description: This update for sapnwbootstrap-formula fixes the following issues: Update to version 0.6.4+git.1621842068.a86c37c: - Set the default empty dictionary for 'virtual_addresses'. (bsc#1185627) - This also ensures that a dictionary is obtained if the value is None (needed by SUSE Manager) - Fix issue when 'azure-lb' resource for 'ASCS/ERS' is not added in the corresponding Resource Group (bsc#1186236) - Set the virtual ip addresses as permanent, except for HA scenarios, to have them even after a reboot of the machine. (bsc#1185093) - Give the option to mount '/sapmnt' folder locally without using a 'NFS' share. - Make '/sapmnt' path configurable using 'sapmnt_path' pillar variable - Update PAS and AAS templates to use HANA sid and instance number to create the configuration file - Fix error about missing instance installation requisite when monitoring is enabled. (bsc#1181541) Patch Instructions: To install this openSUSE Recommended Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 15.2: zypper in -t patch openSUSE-2021-1316=1 Package List: - openSUSE Leap 15.2 (noarch): sapnwbootstrap-formula-0.6.4+git.1621842068.a86c37c-lp152.2.17.1 References: https://bugzilla.suse.com/1181541 https://bugzilla.suse.com/1185093 https://bugzilla.suse.com/1185627 https://bugzilla.suse.com/1186236

1 0

openSUSE-RU-2021:3242-1: moderate: Recommended update for apache2-mod_auth_mellon, lasso
by maintenance＠opensuse.org 28 Sep '21

28 Sep '21

openSUSE Recommended Update: Recommended update for apache2-mod_auth_mellon, lasso ______________________________________________________________________________ Announcement ID: openSUSE-RU-2021:3242-1 Rating: moderate References: ECO-1309 SLE-8958 Affected Products: openSUSE Leap 15.3 ______________________________________________________________________________ An update that has 0 recommended fixes and contains two features can now be installed. Description: This update for lasso fixes the following issues: - Implement package 'apache2-mod_auth_mellon' along with its dependency 'lasso' in SLE-15-SP2. (jsc#SLE-8958, jsc#ECO-1309) Patch Instructions: To install this openSUSE Recommended Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 15.3: zypper in -t patch openSUSE-SLE-15.3-2021-3242=1 Package List: - openSUSE Leap 15.3 (aarch64 ppc64le s390x x86_64): lasso-debuginfo-2.6.1-16.2 lasso-debugsource-2.6.1-16.2 liblasso-devel-2.6.1-16.2 liblasso3-2.6.1-16.2 liblasso3-debuginfo-2.6.1-16.2 python3-lasso-2.6.1-16.2 python3-lasso-debuginfo-2.6.1-16.2 - openSUSE Leap 15.3 (aarch64 s390x x86_64): apache2-mod_auth_mellon-0.17.0-5.4.1 apache2-mod_auth_mellon-debuginfo-0.17.0-5.4.1 apache2-mod_auth_mellon-debugsource-0.17.0-5.4.1 apache2-mod_auth_mellon-diagnostics-0.17.0-5.4.1 apache2-mod_auth_mellon-diagnostics-debuginfo-0.17.0-5.4.1 apache2-mod_auth_mellon-doc-0.17.0-5.4.1 References:

1 0

openSUSE-RU-2021:1314-1: moderate: Recommended update for gtk3
by maintenance＠opensuse.org 28 Sep '21

28 Sep '21

openSUSE Recommended Update: Recommended update for gtk3 ______________________________________________________________________________ Announcement ID: openSUSE-RU-2021:1314-1 Rating: moderate References: #1094486 #1189238 Affected Products: openSUSE Leap 15.2 ______________________________________________________________________________ An update that has two recommended fixes can now be installed. Description: This update for gtk3 fixes the following issue: - Ensure printer entries from Avahi are usable (bsc#1094486, bsc#1189238). This update was imported from the SUSE:SLE-15-SP2:Update update project. Patch Instructions: To install this openSUSE Recommended Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 15.2: zypper in -t patch openSUSE-2021-1314=1 Package List: - openSUSE Leap 15.2 (i586 x86_64): gettext-its-gtk3-3.24.20-lp152.2.6.1 gtk3-debugsource-3.24.20-lp152.2.6.1 gtk3-devel-3.24.20-lp152.2.6.1 gtk3-devel-debuginfo-3.24.20-lp152.2.6.1 gtk3-devel-doc-3.24.20-lp152.2.6.1 gtk3-immodule-amharic-3.24.20-lp152.2.6.1 gtk3-immodule-amharic-debuginfo-3.24.20-lp152.2.6.1 gtk3-immodule-broadway-3.24.20-lp152.2.6.1 gtk3-immodule-broadway-debuginfo-3.24.20-lp152.2.6.1 gtk3-immodule-inuktitut-3.24.20-lp152.2.6.1 gtk3-immodule-inuktitut-debuginfo-3.24.20-lp152.2.6.1 gtk3-immodule-multipress-3.24.20-lp152.2.6.1 gtk3-immodule-multipress-debuginfo-3.24.20-lp152.2.6.1 gtk3-immodule-thai-3.24.20-lp152.2.6.1 gtk3-immodule-thai-debuginfo-3.24.20-lp152.2.6.1 gtk3-immodule-tigrigna-3.24.20-lp152.2.6.1 gtk3-immodule-tigrigna-debuginfo-3.24.20-lp152.2.6.1 gtk3-immodule-vietnamese-3.24.20-lp152.2.6.1 gtk3-immodule-vietnamese-debuginfo-3.24.20-lp152.2.6.1 gtk3-immodule-wayland-3.24.20-lp152.2.6.1 gtk3-immodule-wayland-debuginfo-3.24.20-lp152.2.6.1 gtk3-immodule-xim-3.24.20-lp152.2.6.1 gtk3-immodule-xim-debuginfo-3.24.20-lp152.2.6.1 gtk3-tools-3.24.20-lp152.2.6.1 gtk3-tools-debuginfo-3.24.20-lp152.2.6.1 libgtk-3-0-3.24.20-lp152.2.6.1 libgtk-3-0-debuginfo-3.24.20-lp152.2.6.1 typelib-1_0-Gtk-3_0-3.24.20-lp152.2.6.1 - openSUSE Leap 15.2 (x86_64): gtk3-devel-32bit-3.24.20-lp152.2.6.1 gtk3-devel-32bit-debuginfo-3.24.20-lp152.2.6.1 gtk3-immodule-amharic-32bit-3.24.20-lp152.2.6.1 gtk3-immodule-amharic-32bit-debuginfo-3.24.20-lp152.2.6.1 gtk3-immodule-inuktitut-32bit-3.24.20-lp152.2.6.1 gtk3-immodule-inuktitut-32bit-debuginfo-3.24.20-lp152.2.6.1 gtk3-immodule-multipress-32bit-3.24.20-lp152.2.6.1 gtk3-immodule-multipress-32bit-debuginfo-3.24.20-lp152.2.6.1 gtk3-immodule-thai-32bit-3.24.20-lp152.2.6.1 gtk3-immodule-thai-32bit-debuginfo-3.24.20-lp152.2.6.1 gtk3-immodule-tigrigna-32bit-3.24.20-lp152.2.6.1 gtk3-immodule-tigrigna-32bit-debuginfo-3.24.20-lp152.2.6.1 gtk3-immodule-vietnamese-32bit-3.24.20-lp152.2.6.1 gtk3-immodule-vietnamese-32bit-debuginfo-3.24.20-lp152.2.6.1 gtk3-immodule-wayland-32bit-3.24.20-lp152.2.6.1 gtk3-immodule-wayland-32bit-debuginfo-3.24.20-lp152.2.6.1 gtk3-immodule-xim-32bit-3.24.20-lp152.2.6.1 gtk3-immodule-xim-32bit-debuginfo-3.24.20-lp152.2.6.1 gtk3-tools-32bit-3.24.20-lp152.2.6.1 gtk3-tools-32bit-debuginfo-3.24.20-lp152.2.6.1 libgtk-3-0-32bit-3.24.20-lp152.2.6.1 libgtk-3-0-32bit-debuginfo-3.24.20-lp152.2.6.1 - openSUSE Leap 15.2 (noarch): gtk3-branding-upstream-3.24.20-lp152.2.6.1 gtk3-data-3.24.20-lp152.2.6.1 gtk3-lang-3.24.20-lp152.2.6.1 gtk3-schema-3.24.20-lp152.2.6.1 References: https://bugzilla.suse.com/1094486 https://bugzilla.suse.com/1189238

1 0

openSUSE-RU-2021:1317-1: moderate: Recommended update for gnome-shell-extensions
by maintenance＠opensuse.org 28 Sep '21

28 Sep '21

openSUSE Recommended Update: Recommended update for gnome-shell-extensions ______________________________________________________________________________ Announcement ID: openSUSE-RU-2021:1317-1 Rating: moderate References: #1190016 SLE-20311 Affected Products: openSUSE Leap 15.2 ______________________________________________________________________________ An update that has one recommended fix and contains one feature can now be installed. Description: This update for gnome-shell-extensions fixes the following issues: - Add gnome-shell-extensions-common as dependency (bsc#1190016 jsc#SLE-20311). This update was imported from the SUSE:SLE-15-SP2:Update update project. Patch Instructions: To install this openSUSE Recommended Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 15.2: zypper in -t patch openSUSE-2021-1317=1 Package List: - openSUSE Leap 15.2 (noarch): gnome-shell-classic-3.34.2-lp152.4.16.1 gnome-shell-extensions-common-3.34.2-lp152.4.16.1 gnome-shell-extensions-common-lang-3.34.2-lp152.4.16.1 - openSUSE Leap 15.2 (x86_64): gnome-shell-classic-session-3.34.2-lp152.4.16.1 gnome-shell-extension-user-theme-3.34.2-lp152.4.16.1 References: https://bugzilla.suse.com/1190016

1 0

openSUSE-SU-2021:1313-1: important: Security update for nodejs14
by opensuse-security＠opensuse.org 28 Sep '21

28 Sep '21

openSUSE Security Update: Security update for nodejs14 ______________________________________________________________________________ Announcement ID: openSUSE-SU-2021:1313-1 Rating: important References: #1188881 #1188917 #1189368 #1189369 #1189370 Cross-References: CVE-2021-22930 CVE-2021-22931 CVE-2021-22939 CVE-2021-22940 CVE-2021-3672 CVSS scores: CVE-2021-22930 (SUSE): 9.1 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N CVE-2021-22931 (SUSE): 8.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H CVE-2021-22939 (SUSE): 4.3 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N CVE-2021-22940 (SUSE): 9.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H CVE-2021-3672 (SUSE): 8.1 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:N Affected Products: openSUSE Leap 15.2 ______________________________________________________________________________ An update that fixes 5 vulnerabilities is now available. Description: This update for nodejs14 fixes the following issues: - CVE-2021-3672: Fixed missing input validation on hostnames (bsc#1188881). - CVE-2021-22931: Fixed improper handling of untypical characters in domain names (bsc#1189370). - CVE-2021-22940: Use after free on close http2 on stream canceling (bsc#1189368) - CVE-2021-22939: Incomplete validation of rejectUnauthorized parameter (bsc#1189369) - CVE-2021-22930: Fixed use after free on close http2 on stream canceling (bsc#1188917). This update was imported from the SUSE:SLE-15-SP2:Update update project. Patch Instructions: To install this openSUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 15.2: zypper in -t patch openSUSE-2021-1313=1 Package List: - openSUSE Leap 15.2 (noarch): nodejs14-docs-14.17.5-lp152.14.1 - openSUSE Leap 15.2 (x86_64): nodejs14-14.17.5-lp152.14.1 nodejs14-debuginfo-14.17.5-lp152.14.1 nodejs14-debugsource-14.17.5-lp152.14.1 nodejs14-devel-14.17.5-lp152.14.1 npm14-14.17.5-lp152.14.1 References: https://www.suse.com/security/cve/CVE-2021-22930.html https://www.suse.com/security/cve/CVE-2021-22931.html https://www.suse.com/security/cve/CVE-2021-22939.html https://www.suse.com/security/cve/CVE-2021-22940.html https://www.suse.com/security/cve/CVE-2021-3672.html https://bugzilla.suse.com/1188881 https://bugzilla.suse.com/1188917 https://bugzilla.suse.com/1189368 https://bugzilla.suse.com/1189369 https://bugzilla.suse.com/1189370

1 0

openSUSE-SU-2021:1312-1: important: Security update for grilo
by opensuse-security＠opensuse.org 28 Sep '21

28 Sep '21

openSUSE Security Update: Security update for grilo ______________________________________________________________________________ Announcement ID: openSUSE-SU-2021:1312-1 Rating: important References: #1189839 Cross-References: CVE-2021-39365 CVSS scores: CVE-2021-39365 (SUSE): 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N Affected Products: openSUSE Leap 15.2 ______________________________________________________________________________ An update that fixes one vulnerability is now available. Description: This update for grilo fixes the following issues: - CVE-2021-39365: Fixed missing TLS certificate verification (bsc#1189839). This update was imported from the SUSE:SLE-15-SP2:Update update project. Patch Instructions: To install this openSUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 15.2: zypper in -t patch openSUSE-2021-1312=1 Package List: - openSUSE Leap 15.2 (noarch): grilo-lang-0.3.12-lp152.2.3.1 - openSUSE Leap 15.2 (x86_64): grilo-debuginfo-0.3.12-lp152.2.3.1 grilo-debugsource-0.3.12-lp152.2.3.1 grilo-devel-0.3.12-lp152.2.3.1 grilo-tools-0.3.12-lp152.2.3.1 grilo-tools-debuginfo-0.3.12-lp152.2.3.1 libgrilo-0_3-0-0.3.12-lp152.2.3.1 libgrilo-0_3-0-debuginfo-0.3.12-lp152.2.3.1 libgrlnet-0_3-0-0.3.12-lp152.2.3.1 libgrlnet-0_3-0-debuginfo-0.3.12-lp152.2.3.1 libgrlpls-0_3-0-0.3.12-lp152.2.3.1 libgrlpls-0_3-0-debuginfo-0.3.12-lp152.2.3.1 typelib-1_0-Grl-0_3-0.3.12-lp152.2.3.1 typelib-1_0-GrlNet-0_3-0.3.12-lp152.2.3.1 typelib-1_0-GrlPls-0_3-0.3.12-lp152.2.3.1 References: https://www.suse.com/security/cve/CVE-2021-39365.html https://bugzilla.suse.com/1189839

1 0

openSUSE-RU-2021:3241-1: important: Recommended update for multipath-tools
by maintenance＠opensuse.org 28 Sep '21

28 Sep '21

openSUSE Recommended Update: Recommended update for multipath-tools ______________________________________________________________________________ Announcement ID: openSUSE-RU-2021:3241-1 Rating: important References: #1189176 #1190622 Affected Products: openSUSE Leap 15.3 ______________________________________________________________________________ An update that has two recommended fixes can now be installed. Description: This update for multipath-tools provides the following fixes: - Update to version 0.8.5+82+suse.746b76e: * libmultipath: avoid buffer size warning with systemd 240+. (bsc#1189176) - Add a versioned dependency of multipath-tools on libmpath0. (bsc#1190622) Patch Instructions: To install this openSUSE Recommended Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 15.3: zypper in -t patch openSUSE-SLE-15.3-2021-3241=1 Package List: - openSUSE Leap 15.3 (aarch64 ppc64le s390x x86_64): kpartx-0.8.5+82+suse.746b76e-2.7.1 kpartx-debuginfo-0.8.5+82+suse.746b76e-2.7.1 libdmmp-devel-0.8.5+82+suse.746b76e-2.7.1 libdmmp0_2_0-0.8.5+82+suse.746b76e-2.7.1 libdmmp0_2_0-debuginfo-0.8.5+82+suse.746b76e-2.7.1 libmpath0-0.8.5+82+suse.746b76e-2.7.1 libmpath0-debuginfo-0.8.5+82+suse.746b76e-2.7.1 multipath-tools-0.8.5+82+suse.746b76e-2.7.1 multipath-tools-debuginfo-0.8.5+82+suse.746b76e-2.7.1 multipath-tools-debugsource-0.8.5+82+suse.746b76e-2.7.1 multipath-tools-devel-0.8.5+82+suse.746b76e-2.7.1 References: https://bugzilla.suse.com/1189176 https://bugzilla.suse.com/1190622

1 0

openSUSE-SU-2021:3236-1: moderate: Security update for gd
by opensuse-security＠opensuse.org 27 Sep '21

27 Sep '21

openSUSE Security Update: Security update for gd ______________________________________________________________________________ Announcement ID: openSUSE-SU-2021:3236-1 Rating: moderate References: #1190400 Cross-References: CVE-2021-40812 CVSS scores: CVE-2021-40812 (SUSE): 4 CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N Affected Products: openSUSE Leap 15.3 ______________________________________________________________________________ An update that fixes one vulnerability is now available. Description: This update for gd fixes the following issues: - CVE-2021-40812: Fixed out-of-bounds read caused by the lack of certain gdGetBuf and gdPutBuf return value checks (bsc#1190400). Patch Instructions: To install this openSUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 15.3: zypper in -t patch openSUSE-SLE-15.3-2021-3236=1 Package List: - openSUSE Leap 15.3 (aarch64 ppc64le s390x x86_64): gd-2.2.5-11.3.1 gd-debuginfo-2.2.5-11.3.1 gd-debugsource-2.2.5-11.3.1 gd-devel-2.2.5-11.3.1 libgd3-2.2.5-11.3.1 libgd3-debuginfo-2.2.5-11.3.1 - openSUSE Leap 15.3 (x86_64): libgd3-32bit-2.2.5-11.3.1 libgd3-32bit-debuginfo-2.2.5-11.3.1 References: https://www.suse.com/security/cve/CVE-2021-40812.html https://bugzilla.suse.com/1190400

1 0

openSUSE-SU-2021:1311-1: moderate: Security update for transfig
by opensuse-security＠opensuse.org 27 Sep '21

27 Sep '21

openSUSE Security Update: Security update for transfig ______________________________________________________________________________ Announcement ID: openSUSE-SU-2021:1311-1 Rating: moderate References: #1143650 #1159130 #1159293 #1161698 #1186329 Cross-References: CVE-2019-14275 CVE-2019-19555 CVE-2019-19746 CVE-2019-19797 CVE-2021-3561 CVSS scores: CVE-2019-14275 (NVD) : 5.5 CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H CVE-2019-14275 (SUSE): 4.4 CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:L CVE-2019-19555 (NVD) : 5.5 CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H CVE-2019-19555 (SUSE): 4.3 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L CVE-2019-19746 (NVD) : 5.5 CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H CVE-2019-19746 (SUSE): 4.3 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L CVE-2019-19797 (NVD) : 5.5 CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H CVE-2019-19797 (SUSE): 5.4 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:L CVE-2021-3561 (NVD) : 7.1 CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:H CVE-2021-3561 (SUSE): 5.3 CVSS:3.1/AV:L/AC:H/PR:N/UI:R/S:U/C:N/I:H/A:L Affected Products: openSUSE Backports SLE-15-SP2 ______________________________________________________________________________ An update that fixes 5 vulnerabilities is now available. Description: This update for transfig fixes the following issues: Update to version 3.2.8, including fixes for - CVE-2021-3561: overflow in fig2dev/read.c in function read_colordef() (bsc#1186329). - CVE-2019-19797: out-of-bounds write in read_colordef in read.c (bsc#1159293). - CVE-2019-19555: stack-based buffer overflow because of an incorrect sscanf (bsc#1161698). - CVE-2019-19746: segmentation fault and out-of-bounds write because of an integer overflow via a large arrow type (bsc#1159130). - CVE-2019-14275: stack-based buffer overflow in the calc_arrow function in bound.c (bsc#1143650). This update was imported from the SUSE:SLE-15:Update update project. This update was imported from the openSUSE:Leap:15.2:Update update project. Patch Instructions: To install this openSUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Backports SLE-15-SP2: zypper in -t patch openSUSE-2021-1311=1 Package List: - openSUSE Backports SLE-15-SP2 (aarch64 ppc64le s390x): transfig-3.2.8a-bp152.3.3.2 References: https://www.suse.com/security/cve/CVE-2019-14275.html https://www.suse.com/security/cve/CVE-2019-19555.html https://www.suse.com/security/cve/CVE-2019-19746.html https://www.suse.com/security/cve/CVE-2019-19797.html https://www.suse.com/security/cve/CVE-2021-3561.html https://bugzilla.suse.com/1143650 https://bugzilla.suse.com/1159130 https://bugzilla.suse.com/1159293 https://bugzilla.suse.com/1161698 https://bugzilla.suse.com/1186329

1 0

openSUSE-RU-2021:3233-1: moderate: Recommended update for xfsprogs
by maintenance＠opensuse.org 27 Sep '21

27 Sep '21

openSUSE Recommended Update: Recommended update for xfsprogs ______________________________________________________________________________ Announcement ID: openSUSE-RU-2021:3233-1 Rating: moderate References: #1085917 #1181299 #1181306 #1181309 #1181535 #1181536 #1188651 #1189552 SLE-20360 Affected Products: openSUSE Leap 15.3 ______________________________________________________________________________ An update that has 8 recommended fixes and contains one feature can now be installed. Description: This update for xfsprogs fixes the following issues: - Fixes an issue when 'fstests' with 'xfs' fail. (bsc#1181309, bsc#1181299) - xfsprogs: Split 'libhandle1' into a separate package, since nothing within xfsprogs dynamically links against it. The shared library is still required by xfsdump as a runtime dependency. - mkfs.xfs: Fix 'ASSERT' on too-small device with stripe geometry. (bsc#1181536) - mkfs.xfs: If either 'sunit' or 'swidth' is not zero, the other must be as well. (bsc#1085917, bsc#1181535) - xfs_growfs: Refactor geometry reporting. (bsc#1181306) - xfs_growfs: Allow mounted device node as argument. (bsc#1181299) - xfs_repair: Rebuild directory when non-root leafn blocks claim block 0. (bsc#1181309) - xfs_repair: Check plausibility of root dir pointer before trashing it. (bsc#1188651) - xfs_bmap: Remove '-c' from manpage. (bsc#1189552) - xfs_bmap: Do not reject '-e'. (bsc#1189552) - Implement 'libhandle1' through ECO. (jsc#SLE-20360) Patch Instructions: To install this openSUSE Recommended Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 15.3: zypper in -t patch openSUSE-SLE-15.3-2021-3233=1 Package List: - openSUSE Leap 15.3 (aarch64 ppc64le s390x x86_64): libhandle1-4.15.0-4.40.1 libhandle1-debuginfo-4.15.0-4.40.1 xfsprogs-4.15.0-4.40.1 xfsprogs-debuginfo-4.15.0-4.40.1 xfsprogs-debugsource-4.15.0-4.40.1 xfsprogs-devel-4.15.0-4.40.1 References: https://bugzilla.suse.com/1085917 https://bugzilla.suse.com/1181299 https://bugzilla.suse.com/1181306 https://bugzilla.suse.com/1181309 https://bugzilla.suse.com/1181535 https://bugzilla.suse.com/1181536 https://bugzilla.suse.com/1188651 https://bugzilla.suse.com/1189552

1 0

openSUSE-RU-2021:3227-1: moderate: Recommended update for createrepo_c, libmodulemd, and zchunk
by maintenance＠opensuse.org 27 Sep '21

27 Sep '21

openSUSE Recommended Update: Recommended update for createrepo_c, libmodulemd, and zchunk ______________________________________________________________________________ Announcement ID: openSUSE-RU-2021:3227-1 Rating: moderate References: ECO-2036 SLE-12328 Affected Products: openSUSE Leap 15.3 ______________________________________________________________________________ An update that has 0 recommended fixes and contains two features can now be installed. Description: This update for createrepo_c fixes the following issues: createrepo_c: - Does no longer perform a dir walk when --recycle-pkglist is specified - Added automatic module metadata handling for repos - Fixed a couple of memory leaks - Added --arch-expand option - Added --recycle-pkglist option - Set global_exit_status on sigint so that .repodata are cleaned up - Enhance error handling when locating repositories libmodulemd: - Just a rebuild of the package, no source changes zchunk: - Initial shipment of zchunk to SUSE Linux Enterprise Patch Instructions: To install this openSUSE Recommended Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 15.3: zypper in -t patch openSUSE-SLE-15.3-2021-3227=1 Package List: - openSUSE Leap 15.3 (aarch64 ppc64le s390x x86_64): createrepo_c-0.16.0-3.3.1 createrepo_c-debuginfo-0.16.0-3.3.1 createrepo_c-debugsource-0.16.0-3.3.1 libcreaterepo_c-devel-0.16.0-3.3.1 libcreaterepo_c0-0.16.0-3.3.1 libcreaterepo_c0-debuginfo-0.16.0-3.3.1 libmodulemd-debuginfo-2.12.0-3.10.1 libmodulemd-debugsource-2.12.0-3.10.1 libmodulemd-devel-2.12.0-3.10.1 libmodulemd2-2.12.0-3.10.1 libmodulemd2-debuginfo-2.12.0-3.10.1 libzck-devel-1.1.5-3.2.1 libzck1-1.1.5-3.2.1 libzck1-debuginfo-1.1.5-3.2.1 modulemd-validator-2.12.0-3.10.1 modulemd-validator-debuginfo-2.12.0-3.10.1 python3-createrepo_c-0.16.0-3.3.1 python3-createrepo_c-debuginfo-0.16.0-3.3.1 python3-libmodulemd-2.12.0-3.10.1 typelib-1_0-Modulemd-2_0-2.12.0-3.10.1 zchunk-1.1.5-3.2.1 zchunk-debuginfo-1.1.5-3.2.1 zchunk-debugsource-1.1.5-3.2.1 References:

1 0

openSUSE-RU-2021:3229-1: moderate: Recommended update for autoyast2
by maintenance＠opensuse.org 27 Sep '21

27 Sep '21

openSUSE Recommended Update: Recommended update for autoyast2 ______________________________________________________________________________ Announcement ID: openSUSE-RU-2021:3229-1 Rating: moderate References: #1188356 #1188360 #1188716 #1188930 Affected Products: openSUSE Leap 15.3 ______________________________________________________________________________ An update that has four recommended fixes can now be installed. Description: This update for autoyast2 fixes the following issues: - Fixed handling of the "final_reboot" and "final_halt" options, add the custom scripts only once and avoid displaying a warning popup during installation. (bsc#1188356) - Copy the init-scripts to the right location during 1st stage. (bsc#1188360) - Ensure closing notification pop-ups even if a user script was not executed to prevent "No widget with ID ..." error pop-up. (bsc#1188930, bsc#1188716) Patch Instructions: To install this openSUSE Recommended Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 15.3: zypper in -t patch openSUSE-SLE-15.3-2021-3229=1 Package List: - openSUSE Leap 15.3 (noarch): autoyast2-4.3.89-3.22.1 autoyast2-installation-4.3.89-3.22.1 References: https://bugzilla.suse.com/1188356 https://bugzilla.suse.com/1188360 https://bugzilla.suse.com/1188716 https://bugzilla.suse.com/1188930

1 0

openSUSE-SU-2021:1310-1: important: Security update for opera
by opensuse-security＠opensuse.org 25 Sep '21

25 Sep '21

openSUSE Security Update: Security update for opera ______________________________________________________________________________ Announcement ID: openSUSE-SU-2021:1310-1 Rating: important References: Cross-References: CVE-2021-30606 CVE-2021-30607 CVE-2021-30608 CVE-2021-30609 CVE-2021-30610 CVE-2021-30611 CVE-2021-30612 CVE-2021-30613 CVE-2021-30614 CVE-2021-30615 CVE-2021-30616 CVE-2021-30617 CVE-2021-30618 CVE-2021-30619 CVE-2021-30620 CVE-2021-30621 CVE-2021-30622 CVE-2021-30623 CVE-2021-30624 Affected Products: openSUSE Leap 15.3:NonFree openSUSE Leap 15.2:NonFree ______________________________________________________________________________ An update that fixes 19 vulnerabilities is now available. Description: This update for opera fixes the following issues: opera was updated to version 79.0.4143.22 - CHR-8550 Update chromium on desktop-stable-93-4143 to 93.0.4577.58 - CHR-8557 Update chromium on desktop-stable-93-4143 to 93.0.4577.63 - DNA-94641 [Linux] Proprietary media codecs not working in snap builds - DNA-95076 [Linux] Page crash with media content - DNA-95084 [Mac] Cannot quit through menu with snapshot editor open - DNA-95138 Add setting to synchronize Pinboards - DNA-95157 Crash at -[OperaCrApplication sendEvent:] - DNA-95204 Opera 79 translations - DNA-95240 The pinboard thumbnail cannot be generated anymore - DNA-95278 Existing Pinboards might be missing - DNA-95292 Enable #bookmarks-trash-cleaner on all streams - DNA-95293 Enable #easy-files-downloads-folder on all streams - DNA-95383 Promote O79 to stable - Complete Opera 79.0 changelog at: https://blogs.opera.com/desktop/changelog-for-79/ - The update to chromium 93.0.4577.58 fixes following issues: CVE-2021-30606, CVE-2021-30607, CVE-2021-30608, CVE-2021-30609, CVE-2021-30610, CVE-2021-30611, CVE-2021-30612, CVE-2021-30613, CVE-2021-30614, CVE-2021-30615, CVE-2021-30616, CVE-2021-30617, CVE-2021-30618, CVE-2021-30619, CVE-2021-30620, CVE-2021-30621, CVE-2021-30622, CVE-2021-30623, CVE-2021-30624 Patch Instructions: To install this openSUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 15.3:NonFree: zypper in -t patch openSUSE-2021-1310=1 - openSUSE Leap 15.2:NonFree: zypper in -t patch openSUSE-2021-1310=1 Package List: - openSUSE Leap 15.3:NonFree (x86_64): opera-79.0.4143.22-lp153.2.18.1 - openSUSE Leap 15.2:NonFree (x86_64): opera-79.0.4143.22-lp152.2.64.1 References: https://www.suse.com/security/cve/CVE-2021-30606.html https://www.suse.com/security/cve/CVE-2021-30607.html https://www.suse.com/security/cve/CVE-2021-30608.html https://www.suse.com/security/cve/CVE-2021-30609.html https://www.suse.com/security/cve/CVE-2021-30610.html https://www.suse.com/security/cve/CVE-2021-30611.html https://www.suse.com/security/cve/CVE-2021-30612.html https://www.suse.com/security/cve/CVE-2021-30613.html https://www.suse.com/security/cve/CVE-2021-30614.html https://www.suse.com/security/cve/CVE-2021-30615.html https://www.suse.com/security/cve/CVE-2021-30616.html https://www.suse.com/security/cve/CVE-2021-30617.html https://www.suse.com/security/cve/CVE-2021-30618.html https://www.suse.com/security/cve/CVE-2021-30619.html https://www.suse.com/security/cve/CVE-2021-30620.html https://www.suse.com/security/cve/CVE-2021-30621.html https://www.suse.com/security/cve/CVE-2021-30622.html https://www.suse.com/security/cve/CVE-2021-30623.html https://www.suse.com/security/cve/CVE-2021-30624.html

1 0

openSUSE-RU-2021:1309-1: moderate: Recommended update for gedit-plugins
by maintenance＠opensuse.org 25 Sep '21

25 Sep '21

openSUSE Recommended Update: Recommended update for gedit-plugins ______________________________________________________________________________ Announcement ID: openSUSE-RU-2021:1309-1 Rating: moderate References: #1174749 Affected Products: openSUSE Backports SLE-15-SP2 ______________________________________________________________________________ An update that has one recommended fix can now be installed. Description: This update for gedit-plugins fixes the following issues: - VTE changed its API which makes change directory of terminal failed, this patch updates arguments to match VTE's API (boo#1174749, glgo#GNOME/gedit-plugins#1). This update was imported from the openSUSE:Leap:15.2:Update update project. Patch Instructions: To install this openSUSE Recommended Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Backports SLE-15-SP2: zypper in -t patch openSUSE-2021-1309=1 Package List: - openSUSE Backports SLE-15-SP2 (aarch64 ppc64le s390x x86_64): gedit-plugin-bookmarks-3.28.1-bp152.4.3.1 gedit-plugin-bracketcompletion-3.28.1-bp152.4.3.1 gedit-plugin-charmap-3.28.1-bp152.4.3.1 gedit-plugin-codecomment-3.28.1-bp152.4.3.1 gedit-plugin-colorpicker-3.28.1-bp152.4.3.1 gedit-plugin-colorschemer-3.28.1-bp152.4.3.1 gedit-plugin-commander-3.28.1-bp152.4.3.1 gedit-plugin-dashboard-3.28.1-bp152.4.3.1 gedit-plugin-drawspaces-3.28.1-bp152.4.3.1 gedit-plugin-findinfiles-3.28.1-bp152.4.3.1 gedit-plugin-git-3.28.1-bp152.4.3.1 gedit-plugin-joinlines-3.28.1-bp152.4.3.1 gedit-plugin-multiedit-3.28.1-bp152.4.3.1 gedit-plugin-smartspaces-3.28.1-bp152.4.3.1 gedit-plugin-synctex-3.28.1-bp152.4.3.1 gedit-plugin-terminal-3.28.1-bp152.4.3.1 gedit-plugin-textsize-3.28.1-bp152.4.3.1 gedit-plugin-translate-3.28.1-bp152.4.3.1 gedit-plugin-wordcompletion-3.28.1-bp152.4.3.1 gedit-plugin-zeitgeist-3.28.1-bp152.4.3.1 gedit-plugins-3.28.1-bp152.4.3.1 gedit-plugins-data-3.28.1-bp152.4.3.1 - openSUSE Backports SLE-15-SP2 (noarch): gedit-plugins-lang-3.28.1-bp152.4.3.1 References: https://bugzilla.suse.com/1174749

1 0

openSUSE-RU-2021:1306-1: moderate: Recommended update for rpmlint
by maintenance＠opensuse.org 25 Sep '21

25 Sep '21

openSUSE Recommended Update: Recommended update for rpmlint ______________________________________________________________________________ Announcement ID: openSUSE-RU-2021:1306-1 Rating: moderate References: #1169494 #1189106 Affected Products: openSUSE Backports SLE-15-SP2 ______________________________________________________________________________ An update that has two recommended fixes can now be installed. Description: This update for rpmlint fixes the following issues: - Backport whitelisting of oddjob (bsc#1189106, bsc#1169494). This update was imported from the SUSE:SLE-15:Update update project. This update was imported from the openSUSE:Leap:15.2:Update update project. Patch Instructions: To install this openSUSE Recommended Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Backports SLE-15-SP2: zypper in -t patch openSUSE-2021-1306=1 Package List: - openSUSE Backports SLE-15-SP2 (noarch): rpmlint-1.10-bp152.4.12.1 References: https://bugzilla.suse.com/1169494 https://bugzilla.suse.com/1189106

1 0

openSUSE-SU-2021:1308-1: moderate: Security update for grafana-piechart-panel
by opensuse-security＠opensuse.org 25 Sep '21

25 Sep '21

openSUSE Security Update: Security update for grafana-piechart-panel ______________________________________________________________________________ Announcement ID: openSUSE-SU-2021:1308-1 Rating: moderate References: #1172125 Cross-References: CVE-2020-13429 CVSS scores: CVE-2020-13429 (NVD) : 5.4 CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N CVE-2020-13429 (SUSE): 6.4 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N Affected Products: openSUSE Leap 15.2 ______________________________________________________________________________ An update that fixes one vulnerability is now available. Description: This update for grafana-piechart-panel fixes the following issues: - CVE-2020-13429: Fixed XSS via the Values Header option in the piechart-panel (bsc#1172125). This update was imported from the SUSE:SLE-15-SP2:Update update project. Patch Instructions: To install this openSUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 15.2: zypper in -t patch openSUSE-2021-1308=1 Package List: - openSUSE Leap 15.2 (noarch): grafana-piechart-panel-1.6.1-lp152.2.6.1 References: https://www.suse.com/security/cve/CVE-2020-13429.html https://bugzilla.suse.com/1172125

1 0

openSUSE-RU-2021:1307-1: moderate: Recommended update for file
by maintenance＠opensuse.org 25 Sep '21

25 Sep '21

openSUSE Recommended Update: Recommended update for file ______________________________________________________________________________ Announcement ID: openSUSE-RU-2021:1307-1 Rating: moderate References: #1189996 Affected Products: openSUSE Leap 15.2 ______________________________________________________________________________ An update that has one recommended fix can now be installed. Description: This update for file fixes the following issues: - Fixes exception thrown by memory allocation problem (bsc#1189996) This update was imported from the SUSE:SLE-15:Update update project. Patch Instructions: To install this openSUSE Recommended Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 15.2: zypper in -t patch openSUSE-2021-1307=1 Package List: - openSUSE Leap 15.2 (i586 x86_64): file-5.32-lp152.10.6.1 file-debuginfo-5.32-lp152.10.6.1 file-debugsource-5.32-lp152.10.6.1 file-devel-5.32-lp152.10.6.1 libmagic1-5.32-lp152.10.6.1 libmagic1-debuginfo-5.32-lp152.10.6.1 python2-magic-5.32-lp152.10.6.1 python3-magic-5.32-lp152.10.6.1 - openSUSE Leap 15.2 (x86_64): file-devel-32bit-5.32-lp152.10.6.1 libmagic1-32bit-5.32-lp152.10.6.1 libmagic1-32bit-debuginfo-5.32-lp152.10.6.1 - openSUSE Leap 15.2 (noarch): file-magic-5.32-lp152.10.6.1 References: https://bugzilla.suse.com/1189996

1 0

openSUSE-RU-2021:3226-1: moderate: Recommended update for crmsh
by maintenance＠opensuse.org 24 Sep '21

24 Sep '21

openSUSE Recommended Update: Recommended update for crmsh ______________________________________________________________________________ Announcement ID: openSUSE-RU-2021:3226-1 Rating: moderate References: #1188971 #1189641 Affected Products: openSUSE Leap 15.3 ______________________________________________________________________________ An update that has two recommended fixes can now be installed. Description: This update for crmsh fixes the following issues: - Fix for 'hb_report': Using python way to collect ra trace files. (bsc#1189641) - Fix for 'bootstrap': Adjust host list for parallax to get and copy 'known_hosts' file. (bsc#1188971) Patch Instructions: To install this openSUSE Recommended Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 15.3: zypper in -t patch openSUSE-SLE-15.3-2021-3226=1 Package List: - openSUSE Leap 15.3 (noarch): crmsh-4.3.1+20210827.4fb174c4-5.65.1 crmsh-scripts-4.3.1+20210827.4fb174c4-5.65.1 crmsh-test-4.3.1+20210827.4fb174c4-5.65.1 References: https://bugzilla.suse.com/1188971 https://bugzilla.suse.com/1189641

1 0

openSUSE-RU-2021:3221-1: moderate: Recommended update for apache2-mod_wsgi
by maintenance＠opensuse.org 24 Sep '21

24 Sep '21

openSUSE Recommended Update: Recommended update for apache2-mod_wsgi ______________________________________________________________________________ Announcement ID: openSUSE-RU-2021:3221-1 Rating: moderate References: #1189467 Affected Products: openSUSE Leap 15.3 ______________________________________________________________________________ An update that has one recommended fix can now be installed. Description: This update for apache2-mod_wsgi fixes the following issue: - Enable installation of Python 'sitelib' wrapper. (bsc#1189467) - This update will solve a 'DistributionNotFound' error providing the Python metadata and wrapper for 'mod_wsgi'. Patch Instructions: To install this openSUSE Recommended Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 15.3: zypper in -t patch openSUSE-SLE-15.3-2021-3221=1 Package List: - openSUSE Leap 15.3 (aarch64 ppc64le s390x x86_64): apache2-mod_wsgi-4.5.18-4.3.1 apache2-mod_wsgi-debuginfo-4.5.18-4.3.1 apache2-mod_wsgi-debugsource-4.5.18-4.3.1 apache2-mod_wsgi-python3-4.5.18-4.3.1 apache2-mod_wsgi-python3-debuginfo-4.5.18-4.3.1 apache2-mod_wsgi-python3-debugsource-4.5.18-4.3.1 References: https://bugzilla.suse.com/1189467

1 0

openSUSE-RU-2021:3224-1: moderate: Recommended update for shim-susesigned
by maintenance＠opensuse.org 24 Sep '21

24 Sep '21

openSUSE Recommended Update: Recommended update for shim-susesigned ______________________________________________________________________________ Announcement ID: openSUSE-RU-2021:3224-1 Rating: moderate References: #1177315 #1177789 #1182057 #1184454 #1185232 #1185261 #1185441 #1185464 #1185621 #1185961 #1187260 #1187696 Affected Products: openSUSE Leap 15.3 ______________________________________________________________________________ An update that has 12 recommended fixes can now be installed. Description: This update for shim-susesigned fixes the following issues: Sync with Microsoft signed shim to Thu Jul 15 08:13:26 UTC 2021. This update addresses the "susesigned" shim component. shim was updated to 15.4 (bsc#1182057) - console: Move the countdown function to console.c - fallback: show a countdown menu before reset - MOK: Fix the missing vendor cert in MokListRT - mok: fix the mirroring of RT variables - Add the license change statement for errlog.c and mok.c - Remove a couple of incorrect license claims. - MokManager: Use CompareMem on MokListNode.Type instead of CompareGuid - Make EFI variable copying fatal only on secureboot enabled systems - Remove call to TPM2 get_event_log - tpm: Fix off-by-one error when calculating event size - tpm: Define EFI_VARIABLE_DATA_TREE as packed - tpm: Don't log duplicate identical events - VLogError(): Avoid NULL pointer dereferences in (V)Sprint calls - OpenSSL: always provide OBJ_create() with name strings. - translate_slashes(): don't write to string literals - Fix a use of strlen() instead of Strlen() - shim: Update EFI_LOADED_IMAGE with the second stage loader file path - tpm: Include information about PE/COFF images in the TPM Event Log - Fix a broken tpm type - All newly released openSUSE kernels enable kernel lockdown and signature verification, so there is no need to add the prompt anymore. - Fix the NULL pointer dereference in AuthenticodeVerify() - Remove the build ID to make the binary reproducible when building with AArch64 container - Prevent the build id being added to the binary. That can cause issues with the signature - Allocate MOK config table as BootServicesData to avoid the error message from linux kernel - Handle ignore_db and user_insecure_mode correctly (bsc#1185441) - Relax the maximum variable size check for u-boot - Relax the check for import_mok_state() when Secure Boot is off - Relax the check for the LoadOptions length - Fix the size of rela* sections for AArch64 - Disable exporting vendor-dbx to MokListXRT - Don't call QueryVariableInfo() on EFI 1.10 machines - Avoid buffer overflow when copying the MOK config table - Avoid deleting the mirrored RT variables - Update to 15.3 for SBAT support (bsc#1182057) - Generate vender-specific SBAT metadata - Rename the SBAT variable and fix the self-check of SBAT - Split the keys in vendor-dbx.bin to vendor-dbx-sles and vendor-dbx-opensuse for shim-sles and shim-opensuse to reduce the size of MokListXRT (bsc#1185261) - shim-install: reset def_shim_efi to "shim.efi" if the given file doesn't exist - shim-install: instead of assuming "removable" for Azure, remove fallback.efi from \EFI\Boot and copy grub.efi/cfg to \EFI\Boot to make \EFI\Boot bootable and keep the boot option created by efibootmgr (bsc#1185464, bsc#1185961) - shim-install: always assume "removable" for Azure to avoid the endless reset loop (bsc#1185464) - shim-install: Support changing default shim efi binary in /usr/etc/default/shim and /etc/default/shim (bsc#1177315) - Update dbx-cert.tar.xz and vendor-dbx.bin to block the following sign keys: + SLES-UEFI-SIGN-Certificate-2020-07.crt + openSUSE-UEFI-SIGN-Certificate-2020-07.crt Patch Instructions: To install this openSUSE Recommended Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 15.3: zypper in -t patch openSUSE-SLE-15.3-2021-3224=1 Package List: - openSUSE Leap 15.3 (x86_64): shim-susesigned-15.4-3.10.1 References: https://bugzilla.suse.com/1177315 https://bugzilla.suse.com/1177789 https://bugzilla.suse.com/1182057 https://bugzilla.suse.com/1184454 https://bugzilla.suse.com/1185232 https://bugzilla.suse.com/1185261 https://bugzilla.suse.com/1185441 https://bugzilla.suse.com/1185464 https://bugzilla.suse.com/1185621 https://bugzilla.suse.com/1185961 https://bugzilla.suse.com/1187260 https://bugzilla.suse.com/1187696

1 0

openSUSE-RU-2021:3223-1: moderate: Recommended update for gnome-shell-extensions
by maintenance＠opensuse.org 24 Sep '21

24 Sep '21

openSUSE Recommended Update: Recommended update for gnome-shell-extensions ______________________________________________________________________________ Announcement ID: openSUSE-RU-2021:3223-1 Rating: moderate References: #1190016 SLE-20311 Affected Products: openSUSE Leap 15.3 ______________________________________________________________________________ An update that has one recommended fix and contains one feature can now be installed. Description: This update for gnome-shell-extensions fixes the following issues: - Add gnome-shell-extensions-common as dependency (bsc#1190016 jsc#SLE-20311). Patch Instructions: To install this openSUSE Recommended Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 15.3: zypper in -t patch openSUSE-SLE-15.3-2021-3223=1 Package List: - openSUSE Leap 15.3 (aarch64 ppc64le s390x x86_64): gnome-shell-classic-session-3.34.2-5.12.1 gnome-shell-extension-user-theme-3.34.2-5.12.1 - openSUSE Leap 15.3 (noarch): gnome-shell-classic-3.34.2-5.12.1 gnome-shell-extensions-common-3.34.2-5.12.1 gnome-shell-extensions-common-lang-3.34.2-5.12.1 References: https://bugzilla.suse.com/1190016

1 0

openSUSE-RU-2021:3220-1: moderate: Recommended update for kglobalaccel
by maintenance＠opensuse.org 24 Sep '21

24 Sep '21

openSUSE Recommended Update: Recommended update for kglobalaccel ______________________________________________________________________________ Announcement ID: openSUSE-RU-2021:3220-1 Rating: moderate References: #1178488 Affected Products: openSUSE Leap 15.3 ______________________________________________________________________________ An update that has one recommended fix can now be installed. Description: This update for kglobalaccel fixes the following issues: - Refuse app. to start with wrong uid (bsc#1178488). Patch Instructions: To install this openSUSE Recommended Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 15.3: zypper in -t patch openSUSE-SLE-15.3-2021-3220=1 Package List: - openSUSE Leap 15.3 (aarch64 ppc64le s390x x86_64): kglobalaccel-debugsource-5.76.0-3.6.1 kglobalaccel-devel-5.76.0-3.6.1 kglobalaccel5-5.76.0-3.6.1 kglobalaccel5-debuginfo-5.76.0-3.6.1 libKF5GlobalAccel5-5.76.0-3.6.1 libKF5GlobalAccel5-debuginfo-5.76.0-3.6.1 libKF5GlobalAccelPrivate5-5.76.0-3.6.1 libKF5GlobalAccelPrivate5-debuginfo-5.76.0-3.6.1 - openSUSE Leap 15.3 (x86_64): kglobalaccel-devel-32bit-5.76.0-3.6.1 libKF5GlobalAccel5-32bit-5.76.0-3.6.1 libKF5GlobalAccel5-32bit-debuginfo-5.76.0-3.6.1 - openSUSE Leap 15.3 (noarch): libKF5GlobalAccel5-lang-5.76.0-3.6.1 References: https://bugzilla.suse.com/1178488

1 0

openSUSE-RU-2021:1304-1: moderate: Recommended update for SUSE Manager Client Tools
by maintenance＠opensuse.org 24 Sep '21

24 Sep '21

openSUSE Recommended Update: Recommended update for SUSE Manager Client Tools ______________________________________________________________________________ Announcement ID: openSUSE-RU-2021:1304-1 Rating: moderate References: #1170823 #1181223 #1188042 #1188846 Affected Products: openSUSE Leap 15.2 ______________________________________________________________________________ An update that has four recommended fixes can now be installed. Description: This update fixes the following issues: dracut-saltboot: - Fix dependencies of python libs (bsc#1188846) koan: - Only recommend 'virt-install' to unbreak scenarios where it is not available in the enabled modules of the system - The xend functionality is not expected to work since this the underlying tool was removed - Python 2 compatibility was fully removed - Add support for EFI reinstallation of a client (bsc#1170823) mgr-daemon: - Update translation strings spacecmd: - Update translation strings - Make schedule_deletearchived to get all actions without display limit - Allow passing a date limit for 'schedule_deletearchived' on 'spacecmd' (bsc#1181223) - Use correct API endpoint in 'list_proxies' (bsc#1188042) - Add schedule_deletearchived to bulk delete archived actions (bsc#1181223) spacewalk-client-tools: - Update translation strings This update was imported from the SUSE:SLE-15:Update update project. Patch Instructions: To install this openSUSE Recommended Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 15.2: zypper in -t patch openSUSE-2021-1304=1 Package List: - openSUSE Leap 15.2 (noarch): dracut-saltboot-0.1.1628156312.dbd0dec-lp152.2.29.1 References: https://bugzilla.suse.com/1170823 https://bugzilla.suse.com/1181223 https://bugzilla.suse.com/1188042 https://bugzilla.suse.com/1188846

1 0

openSUSE-SU-2021:3205-1: important: Security update for the Linux Kernel
by opensuse-security＠opensuse.org 23 Sep '21

23 Sep '21

openSUSE Security Update: Security update for the Linux Kernel ______________________________________________________________________________ Announcement ID: openSUSE-SU-2021:3205-1 Rating: important References: #1040364 #1127650 #1135481 #1152489 #1160010 #1168202 #1171420 #1174969 #1175052 #1175543 #1177399 #1180100 #1180141 #1180347 #1181006 #1181148 #1181972 #1184180 #1185902 #1186264 #1186731 #1187211 #1187455 #1187468 #1187483 #1187619 #1187959 #1188067 #1188172 #1188231 #1188270 #1188412 #1188418 #1188616 #1188700 #1188780 #1188781 #1188782 #1188783 #1188784 #1188786 #1188787 #1188788 #1188790 #1188878 #1188885 #1188924 #1188982 #1188983 #1188985 #1189021 #1189057 #1189077 #1189153 #1189197 #1189209 #1189210 #1189212 #1189213 #1189214 #1189215 #1189216 #1189217 #1189218 #1189219 #1189220 #1189221 #1189222 #1189225 #1189229 #1189233 #1189262 #1189291 #1189292 #1189296 #1189298 #1189301 #1189305 #1189323 #1189384 #1189385 #1189392 #1189393 #1189399 #1189400 #1189427 #1189503 #1189504 #1189505 #1189506 #1189507 #1189562 #1189563 #1189564 #1189565 #1189566 #1189567 #1189568 #1189569 #1189573 #1189574 #1189575 #1189576 #1189577 #1189579 #1189581 #1189582 #1189583 #1189585 #1189586 #1189587 #1189706 #1189760 #1189762 #1189832 #1189841 #1189870 #1189872 #1189883 #1190022 #1190025 #1190115 #1190117 #1190412 #1190413 #1190428 Cross-References: CVE-2020-12770 CVE-2021-34556 CVE-2021-35477 CVE-2021-3640 CVE-2021-3653 CVE-2021-3656 CVE-2021-3679 CVE-2021-3732 CVE-2021-3739 CVE-2021-3743 CVE-2021-3753 CVE-2021-3759 CVE-2021-38160 CVE-2021-38166 CVE-2021-38198 CVE-2021-38204 CVE-2021-38205 CVE-2021-38206 CVE-2021-38207 CVE-2021-38209 CVSS scores: CVE-2020-12770 (NVD) : 6.7 CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H CVE-2020-12770 (SUSE): 6.1 CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:H CVE-2021-34556 (SUSE): 5.5 CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N CVE-2021-35477 (SUSE): 6.5 CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N CVE-2021-3640 (SUSE): 7.4 CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H CVE-2021-3653 (SUSE): 7.8 CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H CVE-2021-3656 (SUSE): 7.8 CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H CVE-2021-3679 (SUSE): 5.5 CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H CVE-2021-3732 (SUSE): 3.3 CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N CVE-2021-3739 (SUSE): 4.4 CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H CVE-2021-3743 (SUSE): 6.2 CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H CVE-2021-3753 (SUSE): 2.9 CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N CVE-2021-3759 (SUSE): 6.2 CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H CVE-2021-38160 (SUSE): 7 CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H CVE-2021-38166 (SUSE): 6.7 CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H CVE-2021-38198 (SUSE): 7.8 CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H CVE-2021-38204 (SUSE): 4.2 CVSS:3.1/AV:P/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H CVE-2021-38205 (SUSE): 3.3 CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N CVE-2021-38206 (NVD) : 5.5 CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H CVE-2021-38206 (SUSE): 6.5 CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H CVE-2021-38207 (SUSE): 5.9 CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H CVE-2021-38209 (SUSE): 3.3 CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N Affected Products: openSUSE Leap 15.3 ______________________________________________________________________________ An update that solves 20 vulnerabilities and has 106 fixes is now available. Description: The SUSE Linux Enterprise 15 SP3 kernel was updated to receive various security and bugfixes. The following security bugs were fixed: - CVE-2021-3640: Fixed a Use-After-Free vulnerability in function sco_sock_sendmsg() in the bluetooth stack (bsc#1188172). - CVE-2021-3653: Missing validation of the `int_ctl` VMCB field and allows a malicious L1 guest to enable AVIC support for the L2 guest. (bsc#1189399). - CVE-2021-3656: Missing validation of the the `virt_ext` VMCB field and allows a malicious L1 guest to disable both VMLOAD/VMSAVE intercepts and VLS for the L2 guest (bsc#1189400). - CVE-2021-3679: A lack of CPU resource in tracing module functionality was found in the way user uses trace ring buffer in a specific way. Only privileged local users (with CAP_SYS_ADMIN capability) could use this flaw to starve the resources causing denial of service (bnc#1189057). - CVE-2021-3732: Mounting overlayfs inside an unprivileged user namespace can reveal files (bsc#1189706). - CVE-2021-3739: Fixed a NULL pointer dereference when deleting device by invalid id (bsc#1189832 ). - CVE-2021-3743: Fixed OOB Read in qrtr_endpoint_post (bsc#1189883). - CVE-2021-3753: Fixed race out-of-bounds in virtual terminal handling (bsc#1190025). - CVE-2021-38160: Data corruption or loss could be triggered by an untrusted device that supplies a buf->len value exceeding the buffer size in drivers/char/virtio_console.c (bsc#1190117) - CVE-2021-38198: arch/x86/kvm/mmu/paging_tmpl.h incorrectly computes the access permissions of a shadow page, leading to a missing guest protection page fault (bnc#1189262). - CVE-2021-38204: drivers/usb/host/max3421-hcd.c allowed physically proximate attackers to cause a denial of service (use-after-free and panic) by removing a MAX-3421 USB device in certain situations (bnc#1189291). - CVE-2021-38205: drivers/net/ethernet/xilinx/xilinx_emaclite.c made it easier for attackers to defeat an ASLR protection mechanism because it prints a kernel pointer (i.e., the real IOMEM pointer) (bnc#1189292). - CVE-2021-38207: drivers/net/ethernet/xilinx/ll_temac_main.c allowed remote attackers to cause a denial of service (buffer overflow and lockup) by sending heavy network traffic for about ten minutes (bnc#1189298). - CVE-2021-38166: Fixed an integer overflow and out-of-bounds write when many elements are placed in a single bucket in kernel/bpf/hashtab.c (bnc#1189233 ). - CVE-2021-38209: Fixed allowed observation of changes in any net namespace via net/netfilter/nf_conntrack_standalone.c (bnc#1189393). - CVE-2021-38206: Fixed NULL pointer dereference in the radiotap parser inside the mac80211 subsystem (bnc#1189296). - CVE-2021-34556: Fixed side-channel attack via a Speculative Store Bypass via unprivileged BPF program that could have obtain sensitive information from kernel memory (bsc#1188983). - CVE-2021-35477: Fixed BPF stack frame pointer which could have been abused to disclose content of arbitrary kernel memory (bsc#1188985). - CVE-2021-3759: Unaccounted ipc objects in Linux kernel could have lead to breaking memcg limits and DoS attacks (bsc#1190115). - CVE-2020-12770: Fixed sg_remove_request call in a certain failure cases (bsc#1171420). The following non-security bugs were fixed: - ACPI: NFIT: Fix support for virtual SPA ranges (git-fixes). - ACPI: processor: Clean up acpi_processor_evaluate_cst() (bsc#1175543) - ACPI: processor: Export acpi_processor_evaluate_cst() (bsc#1175543) - ACPI: processor: Export function to claim _CST control (bsc#1175543) - ACPI: processor: Introduce acpi_processor_evaluate_cst() (bsc#1175543) - ACPI: processor: Make ACPI_PROCESSOR_CSTATE depend on ACPI_PROCESSOR (bsc#1175543) - ALSA: hda - fix the 'Capture Switch' value change notifications (git-fixes). - ALSA: hda/hdmi: Add quirk to force pin connectivity on NUC10 (git-fixes). - ALSA: hda/hdmi: fix max DP-MST dev_num for Intel TGL+ platforms (git-fixes). - ALSA: hda/hdmi: let new platforms assign the pcm slot dynamically (git-fixes). - ALSA: hda/realtek - Add ALC285 HP init procedure (git-fixes). - ALSA: hda/realtek - Add type for ALC287 (git-fixes). - ALSA: hda/realtek: Change device names for quirks to barebone names (git-fixes). - ALSA: hda/realtek: Enable 4-speaker output for Dell XPS 15 9510 laptop (git-fixes). - ALSA: hda/realtek: Fix headset mic for Acer SWIFT SF314-56 (ALC256) (git-fixes). - ALSA: hda/realtek: Limit mic boost on HP ProBook 445 G8 (git-fixes). - ALSA: hda/realtek: add mic quirk for Acer SF314-42 (git-fixes). - ALSA: hda/realtek: fix mute led of the HP Pavilion 15-eh1xxx series (git-fixes). - ALSA: hda/realtek: fix mute/micmute LEDs for HP ProBook 650 G8 Notebook PC (git-fixes). - ALSA: hda/via: Apply runtime PM workaround for ASUS B23E (git-fixes). - ALSA: hda: Add quirk for ASUS Flow x13 (git-fixes). - ALSA: hda: Fix hang during shutdown due to link reset (git-fixes). - ALSA: hda: Release controller display power during shutdown/reboot (git-fixes). - ALSA: pcm: Fix mmap breakage without explicit buffer setup (git-fixes). - ALSA: pcm: fix divide error in snd_pcm_lib_ioctl (git-fixes). - ALSA: seq: Fix racy deletion of subscriber (git-fixes). - ALSA: usb-audio: Add registration quirk for JBL Quantum 600 (git-fixes). - ALSA: usb-audio: Avoid unnecessary or invalid connector selection at resume (git-fixes). - ALSA: usb-audio: Fix regression on Sony WALKMAN NW-A45 DAC (git-fixes). - ALSA: usb-audio: Fix superfluous autosuspend recovery (git-fixes). - ALSA: usb-audio: fix incorrect clock source setting (git-fixes). - ASoC: Intel: Skylake: Fix module resource and format selection (git-fixes). - ASoC: Intel: Skylake: Leave data as is when invoking TLV IPCs (git-fixes). - ASoC: Intel: kbl_da7219_max98927: Fix format selection for max98373 (git-fixes). - ASoC: SOF: Intel: hda-ipc: fix reply size checking (git-fixes). - ASoC: amd: Fix reference to PCM buffer address (git-fixes). - ASoC: component: Remove misplaced prefix handling in pin control functions (git-fixes). - ASoC: cs42l42: Correct definition of ADC Volume control (git-fixes). - ASoC: cs42l42: Do not allow SND_SOC_DAIFMT_LEFT_J (git-fixes). - ASoC: cs42l42: Fix LRCLK frame start edge (git-fixes). - ASoC: cs42l42: Fix inversion of ADC Notch Switch control (git-fixes). - ASoC: cs42l42: Remove duplicate control for WNF filter frequency (git-fixes). - ASoC: intel: atom: Fix breakage for PCM buffer address setup (git-fixes). - ASoC: intel: atom: Fix reference to PCM buffer address (git-fixes). - ASoC: mediatek: mt8183: Fix Unbalanced pm_runtime_enable in mt8183_afe_pcm_dev_probe (git-fixes). - ASoC: rt5682: Adjust headset volume button threshold (git-fixes). - ASoC: rt5682: Adjust headset volume button threshold again (git-fixes). - ASoC: rt5682: Fix the issue of garbled recording after powerd_dbus_suspend (git-fixes). - ASoC: ti: j721e-evm: Check for not initialized parent_clk_id (git-fixes). - ASoC: ti: j721e-evm: Fix unbalanced domain activity tracking during startup (git-fixes). - ASoC: tlv320aic31xx: Fix jack detection after suspend (git-fixes). - ASoC: tlv320aic31xx: fix reversed bclk/wclk master bits (git-fixes). - ASoC: uniphier: Fix reference to PCM buffer address (git-fixes). - ASoC: wcd9335: Disable irq on slave ports in the remove function (git-fixes). - ASoC: wcd9335: Fix a double irq free in the remove function (git-fixes). - ASoC: wcd9335: Fix a memory leak in the error handling path of the probe function (git-fixes). - ASoC: xilinx: Fix reference to PCM buffer address (git-fixes). - Avoid double printing SUSE specific flags in mod->taint (bsc#1190413). - Bluetooth: add timeout sanity check to hci_inquiry (git-fixes). - Bluetooth: btusb: Fix a unspported condition to set available debug features (git-fixes). - Bluetooth: btusb: check conditions before enabling USB ALT 3 for WBS (git-fixes). - Bluetooth: defer cleanup of resources in hci_unregister_dev() (git-fixes). - Bluetooth: fix repeated calls to sco_sock_kill (git-fixes). - Bluetooth: hidp: use correct wait queue when removing ctrl_wait (git-fixes). - Bluetooth: increase BTNAMSIZ to 21 chars to fix potential buffer overflow (git-fixes). - Bluetooth: mgmt: Fix wrong opcode in the response for add_adv cmd (git-fixes). - Bluetooth: sco: prevent information leak in sco_conn_defer_accept() (git-fixes). - Drop two intel_int0002_vgpio patches that cause Oops (bsc#1190412) - KVM: VMX: Drop guest CPUID check for VMXE in vmx_set_cr4() (bsc#1188786). - KVM: VMX: Enable machine check support for 32bit targets (bsc#1188787). - KVM: VMX: Explicitly clear RFLAGS.CF and RFLAGS.ZF in VM-Exit RSB path (bsc#1188788). - KVM: VMX: Extend VMXs #AC interceptor to handle split lock #AC in guest (bsc#1187959). - KVM: nVMX: Handle split-lock #AC exceptions that happen in L2 (bsc#1187959). - KVM: nVMX: Really make emulated nested preemption timer pinned (bsc#1188780). - KVM: nVMX: Reset the segment cache when stuffing guest segs (bsc#1188781). - KVM: nVMX: Skip IBPB when switching between vmcs01 and vmcs02 (bsc#1188782). - KVM: nVMX: Sync unsync'd vmcs02 state to vmcs12 on migration (bsc#1188783). - KVM: nVMX: Truncate bits 63:32 of VMCS field on nested check in !64-bit (bsc#1188784). - KVM: x86: Emulate split-lock access as a write in emulator (bsc#1187959). - KVM: x86: bit 8 of non-leaf PDPEs is not reserved (bsc#1188790). - NFS: Correct size calculation for create reply length (bsc#1189870). - NFSv4.1: Do not rebind to the same source port when (bnc#1186264 bnc#1189021) - NFSv4/pNFS: Do not call _nfs4_pnfs_v3_ds_connect multiple times (git-fixes). - NFSv4: Initialise connection to the server in nfs4_alloc_client() (bsc#1040364). - PCI/MSI: Correct misleading comments (git-fixes). - PCI/MSI: Do not set invalid bits in MSI mask (git-fixes). - PCI/MSI: Enable and mask MSI-X early (git-fixes). - PCI/MSI: Enforce MSI[X] entry updates to be visible (git-fixes). - PCI/MSI: Enforce that MSI-X table entry is masked for update (git-fixes). - PCI/MSI: Mask all unused MSI-X entries (git-fixes). - PCI/MSI: Skip masking MSI-X on Xen PV (git-fixes). - PCI/MSI: Use msi_mask_irq() in pci_msi_shutdown() (git-fixes). - PCI: Increase D3 delay for AMD Renoir/Cezanne XHCI (git-fixes). - PCI: PM: Avoid forcing PCI_D0 for wakeup reasons inconsistently (git-fixes). - PCI: PM: Enable PME if it can be signaled from D3cold (git-fixes). - RDMA/bnxt_re: Fix stats counters (bsc#1188231). - SUNRPC: 'Directory with parent 'rpc_clnt' already present!' (bsc#1168202 bsc#1188924). - SUNRPC: Fix the batch tasks count wraparound (git-fixes). - SUNRPC: Should wake up the privileged task firstly (git-fixes). - SUNRPC: defer slow parts of rpc_free_client() to a workqueue (bsc#1168202 bsc#1188924). - SUNRPC: fix use-after-free in rpc_free_client_work() (bsc#1168202 bsc#1188924). - SUNRPC: improve error response to over-size gss credential (bsc#1190022). - SUNRPC: prevent port reuse on transports which do not request it (bnc#1186264 bnc#1189021). - USB: core: Avoid WARNings for 0-length descriptor requests (git-fixes). - USB: serial: ch341: fix character loss at high transfer rates (git-fixes). - USB: serial: ftdi_sio: add device ID for Auto-M3 OP-COM v2 (git-fixes). - USB: serial: option: add Telit FD980 composition 0x1056 (git-fixes). - USB: usbtmc: Fix RCU stall warning (git-fixes). - USB:ehci:fix Kunpeng920 ehci hardware problem (git-fixes). - VMCI: fix NULL pointer dereference when unmapping queue pair (git-fixes). - ath6kl: wmi: fix an error code in ath6kl_wmi_sync_point() (git-fixes). - ath9k: Clear key cache explicitly on disabling hardware (git-fixes). - ath: Use safer key clearing with key cache entries (git-fixes). - bcma: Fix memory leak for internally-handled cores (git-fixes). - bdi: Do not use freezable workqueue (bsc#1189573). - blk-iolatency: error out if blk_get_queue() failed in iolatency_set_limit() (bsc#1189507). - blk-mq-sched: Fix blk_mq_sched_alloc_tags() error handling (bsc#1189506). - blk-wbt: introduce a new disable state to prevent false positive by rwb_enabled() (bsc#1189503). - blk-wbt: make sure throttle is enabled properly (bsc#1189504). - block: fix trace completion for chained bio (bsc#1189505). - bnxt_en: Validate vlan protocol ID on RX packets (jsc#SLE-15075). - brcmfmac: pcie: fix oops on failure to resume and reprobe (git-fixes). - btrfs: Rename __btrfs_alloc_chunk to btrfs_alloc_chunk (bsc#1189077). - btrfs: add a trace class for dumping the current ENOSPC state (bsc#1135481). - btrfs: add a trace point for reserve tickets (bsc#1135481). - btrfs: adjust the flush trace point to include the source (bsc#1135481). - btrfs: check reclaim_size in need_preemptive_reclaim (bsc#1135481). - btrfs: factor out create_chunk() (bsc#1189077). - btrfs: factor out decide_stripe_size() (bsc#1189077). - btrfs: factor out gather_device_info() (bsc#1189077). - btrfs: factor out init_alloc_chunk_ctl (bsc#1189077). - btrfs: fix btrfs_calc_reclaim_metadata_size calculation (bsc#1135481). - btrfs: fix deadlock with concurrent chunk allocations involving system chunks (bsc#1189077). - btrfs: handle invalid profile in chunk allocation (bsc#1189077). - btrfs: implement space clamping for preemptive flushing (bsc#1135481). - btrfs: improve preemptive background space flushing (bsc#1135481). - btrfs: introduce a FORCE_COMMIT_TRANS flush operation (bsc#1135481). - btrfs: introduce alloc_chunk_ctl (bsc#1189077). - btrfs: introduce chunk allocation policy (bsc#1189077). - btrfs: make flush_space take a enum btrfs_flush_state instead of int (bsc#1135481). - btrfs: move the chunk_mutex in btrfs_read_chunk_tree (bsc#1189077). - btrfs: parameterize dev_extent_min for chunk allocation (bsc#1189077). - btrfs: refactor find_free_dev_extent_start() (bsc#1189077). - btrfs: remove FLUSH_DELAYED_REFS from data ENOSPC flushing (bsc#1135481). - btrfs: rename need_do_async_reclaim (bsc#1135481). - btrfs: rework btrfs_calc_reclaim_metadata_size (bsc#1135481). - btrfs: rework chunk allocation to avoid exhaustion of the system chunk array (bsc#1189077). - btrfs: rip out btrfs_space_info::total_bytes_pinned (bsc#1135481). - btrfs: rip the first_ticket_bytes logic from fail_all_tickets (bsc#1135481). - btrfs: simplify the logic in need_preemptive_flushing (bsc#1135481). - btrfs: tracepoints: convert flush states to using EM macros (bsc#1135481). - btrfs: tracepoints: fix btrfs_trigger_flush symbolic string for flags (bsc#1135481). - can: ti_hecc: Fix memleak in ti_hecc_probe (git-fixes). - can: usb: esd_usb2: esd_usb2_rx_event(): fix the interchange of the CAN RX and TX error counters (git-fixes). - ceph: clean up and optimize ceph_check_delayed_caps() (bsc#1187468). - ceph: reduce contention in ceph_check_delayed_caps() (bsc#1187468). - ceph: take snap_empty_lock atomically with snaprealm refcount change (bsc#1189427). - cfg80211: Fix possible memory leak in function cfg80211_bss_update (git-fixes). - cifs: Remove unused inline function is_sysvol_or_netlogon() (bsc#1185902). - cifs: avoid starvation when refreshing dfs cache (bsc#1185902). - cifs: constify get_normalized_path() properly (bsc#1185902). - cifs: do not cargo-cult strndup() (bsc#1185902). - cifs: do not send tree disconnect to ipc shares (bsc#1185902). - cifs: do not share tcp servers with dfs mounts (bsc#1185902). - cifs: do not share tcp sessions of dfs connections (bsc#1185902). - cifs: fix check of dfs interlinks (bsc#1185902). - cifs: fix path comparison and hash calc (bsc#1185902). - cifs: get rid of @noreq param in __dfs_cache_find() (bsc#1185902). - cifs: handle different charsets in dfs cache (bsc#1185902). - cifs: keep referral server sessions alive (bsc#1185902). - cifs: missing null pointer check in cifs_mount (bsc#1185902). - cifs: prevent NULL deref in cifs_compose_mount_options() (bsc#1185902). - cifs: set a minimum of 2 minutes for refreshing dfs cache (bsc#1185902). - clk: fix leak on devm_clk_bulk_get_all() unwind (git-fixes). - clk: stm32f4: fix post divisor setup for I2S/SAI PLLs (git-fixes). - cpuidle: Allow idle states to be disabled by default (bsc#1175543) - cpuidle: Consolidate disabled state checks (bsc#1175543) - cpuidle: Drop disabled field from struct cpuidle_state (bsc#1175543) - cpuidle: Fix cpuidle_driver_state_disabled() (bsc#1175543) - cpuidle: Introduce cpuidle_driver_state_disabled() for driver quirks (bsc#1175543) - crypto: ccp - Annotate SEV Firmware file names (bsc#1189212). - crypto: qat - use proper type for vf_mask (git-fixes). - crypto: x86/curve25519 - fix cpu feature checking logic in mod_exit (git-fixes). - device-dax: Fix default return code of range_parse() (git-fixes). - dm integrity: fix missing goto in bitmap_flush_interval error handling (git-fixes). - dm rq: fix double free of blk_mq_tag_set in dev remove after table load fails (git-fixes). - dm verity: fix DM_VERITY_OPTS_MAX value (git-fixes). - dmaengine: idxd: fix setup sequence for MSIXPERM table (git-fixes). - dmaengine: imx-dma: configure the generic DMA type to make it work (git-fixes). - dmaengine: imx-dma: configure the generic DMA type to make it work (git-fixes). - dmaengine: imx-sdma: remove duplicated sdma_load_context (git-fixes). - dmaengine: of-dma: router_xlate to return -EPROBE_DEFER if controller is not yet available (git-fixes). - dmaengine: usb-dmac: Fix PM reference leak in usb_dmac_probe() (git-fixes). - dmaengine: xilinx_dma: Fix read-after-free bug when terminating transfers (git-fixes). - drivers/block/null_blk/main: Fix a double free in null_init (git-fixes). - drm/amd/display: Fix Dynamic bpp issue with 8K30 with Navi 1X (git-fixes). - drm/amd/display: Fix comparison error in dcn21 DML (git-fixes). - drm/amd/display: Fix max vstartup calculation for modes with borders (git-fixes). - drm/amd/display: Remove invalid assert for ODM + MPC case (git-fixes). - drm/amd/display: use GFP_ATOMIC in amdgpu_dm_irq_schedule_work (git-fixes). - drm/amd/display: workaround for hard hang on HPD on native DP (git-fixes). - drm/amdgpu/acp: Make PM domain really work (git-fixes). - drm/amdgpu/display: fix DMUB firmware version info (git-fixes). - drm/amdgpu/display: only enable aux backlight control for OLED panels (git-fixes). - drm/amdgpu: do not enable baco on boco platforms in runpm (git-fixes). - drm/amdgpu: fix the doorbell missing when in CGPG issue for renoir (git-fixes). - drm/dp_mst: Fix return code on sideband message failure (git-fixes). - drm/i915/dg1: gmbus pin mapping (bsc#1188700). - drm/i915/dg1: provide port/phy mapping for vbt (bsc#1188700). - drm/i915/gen9_bc: Add W/A for missing STRAP config on TGP PCH + CML combos (bsc#1188700). - drm/i915/gen9_bc: Introduce HPD pin mappings for TGP PCH + CML combos (bsc#1188700). - drm/i915/gen9_bc: Introduce TGP PCH DDC pin mappings (bsc#1188700). - drm/i915/gen9_bc: Recognize TGP PCH + CML combos (bsc#1188700). - drm/i915/rkl: new rkl ddc map for different PCH (bsc#1188700). - drm/i915: Add VBT AUX CH H and I (bsc#1188700). - drm/i915: Add VBT DVO ports H and I (bsc#1188700). - drm/i915: Add more AUX CHs to the enum (bsc#1188700). - drm/i915: Configure GEN11_{TBT,TC}_HOTPLUG_CTL for ports TC5/6 (bsc#1188700). - drm/i915: Correct SFC_DONE register offset (git-fixes). - drm/i915: Introduce HPD_PORT_TC<n> (bsc#1188700). - drm/i915: Move hpd_pin setup to encoder init (bsc#1188700). - drm/i915: Nuke the redundant TC/TBT HPD bit defines (bsc#1188700). - drm/i915: Only access SFC_DONE when media domain is not fused off (git-fixes). - drm/meson: fix colour distortion from HDR set during vendor u-boot (git-fixes). - drm/msi/mdp4: populate priv->kms in mdp4_kms_init (git-fixes). - drm/msm/dpu: make dpu_hw_ctl_clear_all_blendstages clear necessary LMs (git-fixes). - drm/msm/dsi: Fix some reference counted resource leaks (git-fixes). - drm/msm: Fix error return code in msm_drm_init() (git-fixes). - drm/nouveau/kms/nv50: workaround EFI GOP window channel format differences (git-fixes). - drm/of: free the iterator object on failure (git-fixes). - drm/of: free the right object (git-fixes). - drm/panfrost: Fix missing clk_disable_unprepare() on error in panfrost_clk_init() (git-fixes). - drm/prime: fix comment on PRIME Helpers (git-fixes). - ext4: cleanup in-core orphan list if ext4_truncate() failed to get a transaction handle (bsc#1189568). - ext4: correct the cache_nr in tracepoint ext4_es_shrink_exit (bsc#1189564). - ext4: fix avefreec in find_group_orlov (bsc#1189566). - ext4: fix kernel infoleak via ext4_extent_header (bsc#1189562). - ext4: fix potential htree corruption when growing large_dir directories (bsc#1189576). - ext4: remove check for zero nr_to_scan in ext4_es_scan() (bsc#1189565). - ext4: return error code when ext4_fill_flex_info() fails (bsc#1189563). - ext4: use ext4_grp_locked_error in mb_find_extent (bsc#1189567). - fanotify: fix copy_event_to_user() fid error clean up (bsc#1189574). - firmware_loader: fix use-after-free in firmware_fallback_sysfs (git-fixes). - firmware_loader: use -ETIMEDOUT instead of -EAGAIN in fw_load_sysfs_fallback (git-fixes). - fixup "rpm: support gz and zst compression methods" (bsc#1190358, bsc#1190428). - fpga: altera-freeze-bridge: Address warning about unused variable (git-fixes). - fpga: dfl: fme: Fix cpu hotplug issue in performance reporting (git-fixes). - fpga: dfl: fme: Fix cpu hotplug issue in performance reporting (git-fixes). - fpga: xiilnx-spi: Address warning about unused variable (git-fixes). - fpga: zynqmp-fpga: Address warning about unused variable (git-fixes). - gpio: eic-sprd: break loop when getting NULL device resource (git-fixes). - gpio: tqmx86: really make IRQ optional (git-fixes). - i2c: dev: zero out array used for i2c reads from userspace (git-fixes). - i2c: highlander: add IRQ check (git-fixes). - i2c: iop3xx: fix deferred probing (git-fixes). - i2c: mt65xx: fix IRQ check (git-fixes). - i2c: s3c2410: fix IRQ check (git-fixes). - iio: adc: Fix incorrect exit of for-loop (git-fixes). - iio: adc: ti-ads7950: Ensure CS is deasserted after reading channels (git-fixes). - iio: humidity: hdc100x: Add margin to the conversion time (git-fixes). - intel_idle: Add module parameter to prevent ACPI _CST from being used (bsc#1175543) - intel_idle: Allow ACPI _CST to be used for selected known processors (bsc#1175543) - intel_idle: Annotate init time data structures (bsc#1175543) - intel_idle: Customize IceLake server support (bsc#1175543) - intel_idle: Disable ACPI _CST on Haswell (bsc#1175543, bsc#1177399, bsc#1180347, bsc#1180141) - intel_idle: Fix max_cstate for processor models without C-state tables (bsc#1175543) - intel_idle: Ignore _CST if control cannot be taken from the platform (bsc#1175543) - intel_idle: Refactor intel_idle_cpuidle_driver_init() (bsc#1175543) - intel_idle: Use ACPI _CST for processor models without C-state tables (bsc#1175543) - iommu/amd: Fix extended features logging (bsc#1189213). - iommu/amd: Move Stoney Ridge check to detect_ivrs() (bsc#1189762). - iommu/arm-smmu-v3: Decrease the queue size of evtq and priq (bsc#1189210). - iommu/arm-smmu-v3: add bit field SFM into GERROR_ERR_MASK (bsc#1189209). - iommu/dma: Fix IOVA reserve dma ranges (bsc#1189214). - iommu/dma: Fix compile warning in 32-bit builds (bsc#1189229). - iommu/vt-d: Check for allocation failure in aux_detach_device() (bsc#1189215). - iommu/vt-d: Define counter explicitly as unsigned int (bsc#1189216). - iommu/vt-d: Do not set then clear private data in prq_event_thread() (bsc#1189217). - iommu/vt-d: Fix sysfs leak in alloc_iommu() (bsc#1189218). - iommu/vt-d: Force to flush iotlb before creating superpage (bsc#1189219). - iommu/vt-d: Global devTLB flush when present context entry changed (bsc#1189220). - iommu/vt-d: Invalidate PASID cache when root/context entry changed (bsc#1189221). - iommu/vt-d: Reject unsupported page request modes (bsc#1189222). - ionic: add handling of larger descriptors (jsc#SLE-16649). - ionic: add new queue features to interface (jsc#SLE-16649). - ionic: aggregate Tx byte counting calls (jsc#SLE-16649). - ionic: block actions during fw reset (jsc#SLE-16649). - ionic: change mtu after queues are stopped (jsc#SLE-16649). - ionic: check for link after netdev registration (jsc#SLE-16649). - ionic: code cleanup details (jsc#SLE-16649). - ionic: fix sizeof usage (jsc#SLE-16649). - ionic: fix unchecked reference (jsc#SLE-16649). - ionic: fix up dim accounting for tx and rx (jsc#SLE-16649). - ionic: generic tx skb mapping (jsc#SLE-16649). - ionic: implement Rx page reuse (jsc#SLE-16649). - ionic: make all rx_mode work threadsafe (jsc#SLE-16649). - ionic: move rx_page_alloc and free (jsc#SLE-16649). - ionic: optimize fastpath struct usage (jsc#SLE-16649). - ionic: protect adminq from early destroy (jsc#SLE-16649). - ionic: rebuild debugfs on qcq swap (jsc#SLE-16649). - ionic: remove intr coalesce update from napi (jsc#SLE-16649). - ionic: remove some unnecessary oom messages (jsc#SLE-16649). - ionic: simplify TSO descriptor mapping (jsc#SLE-16649). - ionic: simplify rx skb alloc (jsc#SLE-16649). - ionic: simplify the intr_index use in txq_init (jsc#SLE-16649). - ionic: simplify tx clean (jsc#SLE-16649). - ionic: simplify use of completion types (jsc#SLE-16649). - ionic: start queues before announcing link up (jsc#SLE-16649). - ionic: stop watchdog when in broken state (jsc#SLE-16649). - ionic: useful names for booleans (jsc#SLE-16649). - iwlwifi: pnvm: accept multiple HW-type TLVs (git-fixes). - iwlwifi: rs-fw: do not support stbc for HE 160 (git-fixes). - iwlwifi: skip first element in the WTAS ACPI table (git-fixes). - kABI fix of usb_dcd_config_params (git-fixes). - kABI: Fix kABI after fixing vcpu-id indexed arrays (git-fixes). - kabi fix for NFSv4.1: Do not rebind to the same source port when reconnecting to the server (bnc#1186264 bnc#1189021) - kabi fix for SUNRPC: defer slow parts of rpc_free_client() to a workqueue (bsc#1168202 bsc#1188924). - kernel, fs: Introduce and use set_restart_fn() and arch_set_restart_data() (bsc#1189153). - kernel-cert-subpackage: Fix certificate location in scriptlets (bsc#1189841). - leds: trigger: audio: Add an activate callback to ensure the initial brightness is set (git-fixes). - lib/mpi: use kcalloc in mpi_resize (git-fixes). - lib: Add zstd support to decompress (bsc#1187483, jsc#SLE-18766). - libata: fix ata_pio_sector for CONFIG_HIGHMEM (git-fixes). - mac80211: Fix insufficient headroom issue for AMSDU (git-fixes). - md/raid10: properly indicate failure when ending a failed write request (git-fixes). - md: revert io stats accounting (git-fixes). - media: TDA1997x: enable EDID support (git-fixes). - media: cxd2880-spi: Fix an error handling path (git-fixes). - media: drivers/media/usb: fix memory leak in zr364xx_probe (git-fixes). - media: dvb-usb: Fix error handling in dvb_usb_i2c_init (git-fixes). - media: dvb-usb: fix uninit-value in dvb_usb_adapter_dvb_init (git-fixes). - media: dvb-usb: fix uninit-value in vp702x_read_mac_addr (git-fixes). - media: em28xx-input: fix refcount bug in em28xx_usb_disconnect (git-fixes). - media: go7007: fix memory leak in go7007_usb_probe (git-fixes). - media: go7007: remove redundant initialization (git-fixes). - media: rtl28xxu: fix zero-length control request (git-fixes). - media: stkwebcam: fix memory leak in stk_camera_probe (git-fixes). - media: venus: venc: Fix potential null pointer dereference on pointer fmt (git-fixes). - media: videobuf2-core: dequeue if start_streaming fails (git-fixes). - media: zr364xx: fix memory leaks in probe() (git-fixes). - media: zr364xx: propagate errors from zr364xx_start_readpipe() (git-fixes). - misc: atmel-ssc: lock with mutex instead of spinlock (git-fixes). - misc: rtsx: do not setting OC_POWER_DOWN reg in rtsx_pci_init_ocp() (git-fixes). - mm/thp: unmap_mapping_page() to fix THP truncate_cleanup_page() (bsc#1189569). - mm/vmscan: fix infinite loop in drop_slab_node (VM Functionality, bsc#1189301). - mm: fix memory_failure() handling of dax-namespace metadata (bsc#1189872). - mm: swap: properly update readahead statistics in unuse_pte_range() (bsc#1187619). - mmc: dw_mmc: Fix hang on data CRC error (git-fixes). - mmc: dw_mmc: Fix issue with uninitialized dma_slave_config (git-fixes). - mmc: moxart: Fix issue with uninitialized dma_slave_config (git-fixes). - mmc: sdhci-iproc: Cap min clock frequency on BCM2711 (git-fixes). - mmc: sdhci-iproc: Set SDHCI_QUIRK_CAP_CLOCK_BASE_BROKEN on BCM2711 (git-fixes). - mtd: cfi_cmdset_0002: fix crash when erasing/writing AMD cards (git-fixes). - nbd: Aovid double completion of a request (git-fixes). - nbd: Fix NULL pointer in flush_workqueue (git-fixes). - net/mlx5: Add ts_cqe_to_dest_cqn related bits (bsc#1188412) - net/mlx5: Properly convey driver version to firmware (git-fixes). - net/mlx5e: Add missing capability check for uplink follow (bsc#1188412) - net: dsa: mv88e6xxx: Avoid VTU corruption on 6097 (git-fixes). - net: dsa: mv88e6xxx: also read STU state in mv88e6250_g1_vtu_getnext (git-fixes). - net: stmmac: free tx skb buffer in stmmac_resume() (git-fixes). - net: usb: lan78xx: do not modify phy_device state concurrently (bsc#1188270) - nfs: fix acl memory leak of posix_acl_create() (git-fixes). - nvme-multipath: revalidate paths during rescan (bsc#1187211) - nvme-pci: Use u32 for nvme_dev.q_depth and nvme_queue.q_depth (bsc#1181972). - nvme-pci: fix NULL req in completion handler (bsc#1181972). - nvme-pci: limit maximum queue depth to 4095 (bsc#1181972). - nvme-pci: use unsigned for io queue depth (bsc#1181972). - nvme-tcp: Do not reset transport on data digest errors (bsc#1188418). - nvme-tcp: do not check blk_mq_tag_to_rq when receiving pdu data (bsc#1181972). - nvme: avoid possible double fetch in handling CQE (bsc#1181972). - nvme: code command_id with a genctr for use-after-free validation (bsc#1181972). - nvme: only call synchronize_srcu when clearing current path (bsc#1188067). - nvmet: use NVMET_MAX_NAMESPACES to set nn value (bsc#1189384). - ocfs2: fix snprintf() checking (bsc#1189581). - ocfs2: fix zero out valid data (bsc#1189579). - ocfs2: initialize ip_next_orphan (bsc#1186731). - ocfs2: issue zeroout to EOF blocks (bsc#1189582). - ovl: allow upperdir inside lowerdir (bsc#1189323). - ovl: expand warning in ovl_d_real() (bsc#1189323). - ovl: fix missing revert_creds() on error path (bsc#1189323). - ovl: perform vfs_getxattr() with mounter creds (bsc#1189323). - ovl: skip getxattr of security labels (bsc#1189323). - params: lift param_set_uint_minmax to common code (bsc#1181972). - pcmcia: i82092: fix a null pointer dereference bug (git-fixes). - perf/x86/amd: Do not touch the AMD64_EVENTSEL_HOSTONLY bit inside the guest (bsc#1189225). - pinctrl: tigerlake: Fix GPIO mapping for newer version of software (git-fixes). - platform/x86: pcengines-apuv2: Add missing terminating entries to gpio-lookup tables (git-fixes). - post.sh: detect /usr mountpoint too - power: supply: max17042: handle fails of reading status register (git-fixes). - powerpc/cacheinfo: Improve diagnostics about malformed cache lists (jsc#SLE-13615 bsc#1180100 ltc#190257 git-fixes). - powerpc/cacheinfo: Lookup cache by dt node and thread-group id (jsc#SLE-13615 bsc#1180100 ltc#190257 git-fixes). - powerpc/cacheinfo: Remove the redundant get_shared_cpu_map() (jsc#SLE-13615 bsc#1180100 ltc#190257 git-fixes). - powerpc/cacheinfo: Use name@unit instead of full DT path in debug messages (jsc#SLE-13615 bsc#1180100 ltc#190257 git-fixes). - powerpc/papr_scm: Make 'perf_stats' invisible if perf-stats unavailable (bsc#1175052 jsc#SLE-13823 bsc#1174969 jsc#SLE-12769 git-fixes). - powerpc/papr_scm: Reduce error severity if nvdimm stats inaccessible (bsc#1189197 ltc#193906). - powerpc/pseries: Fix regression while building external modules (bsc#1160010 ltc#183046 git-fixes). This changes a GPL symbol to general symbol which is kABI change but not kABI break. - powerpc/pseries: Fix update of LPAR security flavor after LPM (bsc#1188885 ltc#193722 git-fixes). - powerpc/smp: Make some symbols static (jsc#SLE-13615 bsc#1180100 ltc#190257 git-fixes). - powerpc/smp: Use existing L2 cache_map cpumask to find L3 cache siblings (jsc#SLE-13615 bsc#1180100 ltc#190257 git-fixes). - powerpc: Fix is_kvm_guest() / kvm_para_available() (bsc#1181148 ltc#190702 git-fixes). - regulator: rt5033: Fix n_voltages settings for BUCK and LDO (git-fixes). - regulator: vctrl: Avoid lockdep warning in enable/disable ops (git-fixes). - regulator: vctrl: Use locked regulator_get_voltage in probe path (git-fixes). - rpm/kernel-binary.spec.in: Use kmod-zstd provide. This makes it possible to use kmod with ZSTD support on non-Tumbleweed. - rpm/kernel-obs-build.spec.in: make builds reproducible (bsc#1189305) - rpm/kernel-source.rpmlintrc: ignore new include/config files In 5.13, since 0e0345b77ac4, config files have no longer .h suffix. Adapt the zero-length check. Based on Martin Liska's change. - rq-qos: fix missed wake-ups in rq_qos_throttle try two (bsc#1189575). - rsi: fix an error code in rsi_probe() (git-fixes). - rsi: fix error code in rsi_load_9116_firmware() (git-fixes). - s390/ap: Fix hanging ioctl caused by wrong msg counter (bsc#1188982 LTC#193817). - s390/boot: fix use of expolines in the DMA code (bsc#1188878 ltc#193771). - scsi: blkcg: Add app identifier support for blkcg (bsc#1189385 jsc#SLE-18970). - scsi: blkcg: Fix application ID config options (bsc#1189385 jsc#SLE-18970). - scsi: cgroup: Add cgroup_get_from_id() (bsc#1189385 jsc#SLE-18970). - scsi: core: Add scsi_prot_ref_tag() helper (bsc#1189392). - scsi: ibmvfc: Do not wait for initial device scan (bsc#1127650). - scsi: libfc: Fix array index out of bound exception (bsc#1188616). - scsi: lpfc: Add 256 Gb link speed support (bsc#1189385). - scsi: lpfc: Add PCI ID support for LPe37000/LPe38000 series adapters (bsc#1189385). - scsi: lpfc: Call discovery state machine when handling PLOGI/ADISC completions (bsc#1189385). - scsi: lpfc: Clear outstanding active mailbox during PCI function reset (bsc#1189385). - scsi: lpfc: Copyright updates for 12.8.0.11 patches (bsc#1189385). - scsi: lpfc: Copyright updates for 14.0.0.0 patches (bsc#1189385). - scsi: lpfc: Delay unregistering from transport until GIDFT or ADISC completes (bsc#1189385). - scsi: lpfc: Discovery state machine fixes for LOGO handling (bsc#1189385). - scsi: lpfc: Enable adisc discovery after RSCN by default (bsc#1189385). - scsi: lpfc: Fix KASAN slab-out-of-bounds in lpfc_unreg_rpi() routine (bsc#1189385). - scsi: lpfc: Fix NULL ptr dereference with NPIV ports for RDF handling (bsc#1189385). - scsi: lpfc: Fix NVMe support reporting in log message (bsc#1189385). - scsi: lpfc: Fix build error in lpfc_scsi.c (bsc#1189385). - scsi: lpfc: Fix cq_id truncation in rq create (bsc#1189385). - scsi: lpfc: Fix function description comments for vmid routines (bsc#1189385). - scsi: lpfc: Fix memory leaks in error paths while issuing ELS RDF/SCR request (bsc#1189385). - scsi: lpfc: Fix possible ABBA deadlock in nvmet_xri_aborted() (bsc#1189385). - scsi: lpfc: Fix target reset handler from falsely returning FAILURE (bsc#1189385). - scsi: lpfc: Improve firmware download logging (bsc#1189385). - scsi: lpfc: Keep NDLP reference until after freeing the IOCB after ELS handling (bsc#1189385). - scsi: lpfc: Move initialization of phba->poll_list earlier to avoid crash (git-fixes). - scsi: lpfc: Remove REG_LOGIN check requirement to issue an ELS RDF (bsc#1189385). - scsi: lpfc: Remove redundant assignment to pointer pcmd (bsc#1189385). - scsi: lpfc: Remove redundant assignment to pointer temp_hdr (bsc#1189385). - scsi: lpfc: Remove use of kmalloc() in trace event logging (bsc#1189385). - scsi: lpfc: Revise Topology and RAS support checks for new adapters (bsc#1189385). - scsi: lpfc: Skip issuing ADISC when node is in NPR state (bsc#1189385). - scsi: lpfc: Skip reg_vpi when link is down for SLI3 in ADISC cmpl path (bsc#1189385). - scsi: lpfc: Update lpfc version to 12.8.0.11 (bsc#1189385). - scsi: lpfc: Update lpfc version to 14.0.0.0 (bsc#1189385). - scsi: lpfc: Use PBDE feature enabled bit to determine PBDE support (bsc#1189385). - scsi: lpfc: Use list_move_tail() instead of list_del()/list_add_tail() (bsc#1189385). - scsi: lpfc: vmid: Add QFPA and VMID timeout check in worker thread (bsc#1189385 jsc#SLE-18970). - scsi: lpfc: vmid: Add datastructure for supporting VMID in lpfc (bsc#1189385 jsc#SLE-18970). - scsi: lpfc: vmid: Add support for VMID in mailbox command (bsc#1189385 jsc#SLE-18970). - scsi: lpfc: vmid: Append the VMID to the wqe before sending (bsc#1189385 jsc#SLE-18970). - scsi: lpfc: vmid: Functions to manage VMIDs (bsc#1189385 jsc#SLE-18970). - scsi: lpfc: vmid: Implement CT commands for appid (bsc#1189385 jsc#SLE-18970). - scsi: lpfc: vmid: Implement ELS commands for appid (bsc#1189385 jsc#SLE-18970). - scsi: lpfc: vmid: Introduce VMID in I/O path (bsc#1189385 jsc#SLE-18970). - scsi: lpfc: vmid: Timeout implementation for VMID (bsc#1189385 jsc#SLE-18970). - scsi: lpfc: vmid: VMID parameter initialization (bsc#1189385 jsc#SLE-18970). - scsi: mpt3sas: Fix ReplyPostFree pool allocation (bsc#1181006). - scsi: qla2xxx: Add heartbeat check (bsc#1189392). - scsi: qla2xxx: Fix error return code in qla82xx_write_flash_dword() (bsc#1189392). - scsi: qla2xxx: Fix spelling mistakes "allloc" -> "alloc" (bsc#1189392). - scsi: qla2xxx: Fix use after free in debug code (bsc#1189392). - scsi: qla2xxx: Log PCI address in qla_nvme_unregister_remote_port() (bsc#1189392). - scsi: qla2xxx: Remove duplicate declarations (bsc#1189392). - scsi: qla2xxx: Remove redundant assignment to rval (bsc#1189392). - scsi: qla2xxx: Remove redundant continue statement in a for-loop (bsc#1189392). - scsi: qla2xxx: Remove redundant initialization of variable num_cnt (bsc#1189392). - scsi: qla2xxx: Remove unused variable 'status' (bsc#1189392). - scsi: qla2xxx: Update version to 10.02.00.107-k (bsc#1189392). - scsi: qla2xxx: Use list_move_tail() instead of list_del()/list_add_tail() (bsc#1189392). - scsi: qla2xxx: Use the proper SCSI midlayer interfaces for PI (bsc#1189392). - scsi: qla2xxx: edif: Add authentication pass + fail bsgs (bsc#1189392). - scsi: qla2xxx: edif: Add detection of secure device (bsc#1189392). - scsi: qla2xxx: edif: Add doorbell notification for app (bsc#1189392). - scsi: qla2xxx: edif: Add encryption to I/O path (bsc#1189392). - scsi: qla2xxx: edif: Add extraction of auth_els from the wire (bsc#1189392). - scsi: qla2xxx: edif: Add getfcinfo and statistic bsgs (bsc#1189392). - scsi: qla2xxx: edif: Add key update (bsc#1189392). - scsi: qla2xxx: edif: Add send, receive, and accept for auth_els (bsc#1189392). - scsi: qla2xxx: edif: Add start + stop bsgs (bsc#1189392). - scsi: qla2xxx: edif: Increment command and completion counts (bsc#1189392). - scsi: scsi_transport_srp: Do not block target in SRP_PORT_LOST state (bsc#1184180). - scsi: target: qla2xxx: Wait for stop_phase1 at WWN removal (bsc#1189392). - scsi: zfcp: Report port fc_security as unknown early during remote cable pull (git-fixes). - serial: 8250: Mask out floating 16/32-bit bus bits (git-fixes). - serial: 8250_mtk: fix uart corruption issue when rx power off (git-fixes). - serial: 8250_pci: Avoid irq sharing for MSI(-X) interrupts (git-fixes). - serial: 8250_pci: Enumerate Elkhart Lake UARTs via dedicated driver (git-fixes). - serial: tegra: Only print FIFO error message when an error occurs (git-fixes). - slimbus: messaging: check for valid transaction id (git-fixes). - slimbus: messaging: start transaction ids from 1 instead of zero (git-fixes). - slimbus: ngd: reset dma setup during runtime pm (git-fixes). - soc: aspeed: lpc-ctrl: Fix boundary check for mmap (git-fixes). - soc: aspeed: p2a-ctrl: Fix boundary check for mmap (git-fixes). - soc: ixp4xx/qmgr: fix invalid __iomem access (git-fixes). - soc: ixp4xx/qmgr: fix invalid __iomem access (git-fixes). - soc: ixp4xx: fix printing resources (git-fixes). - soc: ixp4xx: fix printing resources (git-fixes). - soc: qcom: rpmhpd: Use corner in power_off (git-fixes). - soc: qcom: smsm: Fix missed interrupts if state changes while masked (git-fixes). - spi: imx: mx51-ecspi: Fix CONFIGREG delay comment (git-fixes). - spi: imx: mx51-ecspi: Fix low-speed CONFIGREG delay calculation (git-fixes). - spi: imx: mx51-ecspi: Reinstate low-speed CONFIGREG delay (git-fixes). - spi: mediatek: Fix fifo transfer (git-fixes). - spi: meson-spicc: fix memory leak in meson_spicc_remove (git-fixes). - spi: spi-fsl-dspi: Fix issue with uninitialized dma_slave_config (git-fixes). - spi: spi-pic32: Fix issue with uninitialized dma_slave_config (git-fixes). - spi: sprd: Fix the wrong WDG_LOAD_VAL (git-fixes). - spi: stm32h7: fix full duplex irq handler handling (git-fixes). - staging: rtl8192u: Fix bitwise vs logical operator in TranslateRxSignalStuff819xUsb() (git-fixes). - staging: rtl8712: get rid of flush_scheduled_work (git-fixes). - staging: rtl8723bs: Fix a resource leak in sd_int_dpc (git-fixes). - staging: rtl8723bs: Fix a resource leak in sd_int_dpc (git-fixes). - tracing / histogram: Fix NULL pointer dereference on strcmp() on NULL event name (git-fixes). - tracing / histogram: Give calculation hist_fields a size (git-fixes). - tracing: Reject string operand in the histogram expression (git-fixes). - tty: serial: fsl_lpuart: fix the wrong mapbase value (git-fixes). - ubifs: Fix error return code in alloc_wbufs() (bsc#1189585). - ubifs: Fix memleak in ubifs_init_authentication (bsc#1189583). - ubifs: Only check replay with inode type to judge if inode linked (bsc#1187455). - ubifs: Set/Clear I_LINKABLE under i_lock for whiteout inode (bsc#1189587). - ubifs: journal: Fix error return code in ubifs_jnl_write_inode() (bsc#1189586). - usb: bdc: Fix an error handling path in 'bdc_probe()' when no suitable DMA config is available (git-fixes). - usb: dwc3: Disable phy suspend after power-on reset (git-fixes). - usb: dwc3: Separate field holding multiple properties (git-fixes). - usb: dwc3: Stop active transfers before halting the controller (git-fixes). - usb: dwc3: Use clk_bulk_prepare_enable() (git-fixes). - usb: dwc3: Use devres to get clocks (git-fixes). - usb: dwc3: core: do not do suspend for device mode if already suspended (git-fixes). - usb: dwc3: debug: Remove newline printout (git-fixes). - usb: dwc3: gadget: Check MPS of the request length (git-fixes). - usb: dwc3: gadget: Clear DCTL.ULSTCHNGREQ before set (git-fixes). - usb: dwc3: gadget: Clear DEP flags after stop transfers in ep disable (git-fixes). - usb: dwc3: gadget: Disable gadget IRQ during pullup disable (git-fixes). - usb: dwc3: gadget: Do not send unintended link state change (git-fixes). - usb: dwc3: gadget: Do not setup more than requested (git-fixes). - usb: dwc3: gadget: Fix dwc3_calc_trbs_left() (git-fixes). - usb: dwc3: gadget: Fix handling ZLP (git-fixes). - usb: dwc3: gadget: Give back staled requests (git-fixes). - usb: dwc3: gadget: Handle ZLP for sg requests (git-fixes). - usb: dwc3: gadget: Prevent EP queuing while stopping transfers (git-fixes). - usb: dwc3: gadget: Properly track pending and queued SG (git-fixes). - usb: dwc3: gadget: Restart DWC3 gadget when enabling pullup (git-fixes). - usb: dwc3: gadget: Set BESL config parameter (git-fixes). - usb: dwc3: gadget: Set link state to RX_Detect on disconnect (git-fixes). - usb: dwc3: gadget: Stop EP0 transfers during pullup disable (git-fixes). - usb: dwc3: gadget: Workaround Mirosoft's BESL check (git-fixes). - usb: dwc3: meson-g12a: add IRQ check (git-fixes). - usb: dwc3: meson-g12a: check return of dwc3_meson_g12a_usb_init (git-fixes). - usb: dwc3: of-simple: add a shutdown (git-fixes). - usb: dwc3: st: Add of_dev_put() in probe function (git-fixes). - usb: dwc3: st: Add of_node_put() before return in probe function (git-fixes). - usb: dwc3: support continuous runtime PM with dual role (git-fixes). - usb: ehci-orion: Handle errors of clk_prepare_enable() in probe (git-fixes). - usb: gadget: Export recommended BESL values (git-fixes). - usb: gadget: f_hid: added GET_IDLE and SET_IDLE handlers (git-fixes). - usb: gadget: f_hid: fixed NULL pointer dereference (git-fixes). - usb: gadget: f_hid: idle uses the highest byte for duration (git-fixes). - usb: gadget: mv_u3d: request_irq() after initializing UDC (git-fixes). - usb: gadget: udc: at91: add IRQ check (git-fixes). - usb: gadget: udc: renesas_usb3: Fix soc_device_match() abuse (git-fixes). - usb: host: ohci-tmio: add IRQ check (git-fixes). - usb: host: xhci-rcar: Do not reload firmware after the completion (git-fixes). - usb: mtu3: fix the wrong HS mult value (git-fixes). - usb: mtu3: use @mult for HS isoc or intr (git-fixes). - usb: phy: fsl-usb: add IRQ check (git-fixes). - usb: phy: tahvo: add IRQ check (git-fixes). - usb: phy: twl6030: add IRQ checks (git-fixes). - usr: Add support for zstd compressed initramfs (bsc#1187483, jsc#SLE-18766). - virt_wifi: fix error on connect (git-fixes). - wireguard: allowedips: allocate nodes in kmem_cache (git-fixes). - wireguard: allowedips: free empty intermediate nodes when removing single node (git-fixes). - wireguard: allowedips: remove nodes in O(1) (git-fixes). - writeback: fix obtain a reference to a freeing memcg css (bsc#1189577). - x86/fpu: Limit xstate copy size in xstateregs_set() (bsc#1152489). - x86/fpu: Make init_fpstate correct with optimized XSAVE (bsc#1152489). - x86/fpu: Reset state for all signal restore failures (bsc#1152489). - x86/kvm: fix vcpu-id indexed array sizes (git-fixes). - x86/sev: Make sure IRQs are disabled while GHCB is active (jsc#SLE-14337). - x86/sev: Split up runtime #VC handler for correct state tracking (jsc#SLE-14337). - x86/sev: Use "SEV: " prefix for messages from sev.c (jsc#SLE-14337). - x86/signal: Detect and prevent an alternate signal stack overflow (bsc#1152489). - x86/split_lock: Provide handle_guest_split_lock() (bsc#1187959). - xen/events: Fix race in set_evtchn_to_irq (git-fixes). - xprtrdma: Pad optimization, revisited (bsc#1189760). Special Instructions and Notes: Please reboot the system after installing this update. Patch Instructions: To install this openSUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 15.3: zypper in -t patch openSUSE-SLE-15.3-2021-3205=1 Package List: - openSUSE Leap 15.3 (aarch64 ppc64le s390x x86_64): cluster-md-kmp-default-5.3.18-59.24.1 cluster-md-kmp-default-debuginfo-5.3.18-59.24.1 dlm-kmp-default-5.3.18-59.24.1 dlm-kmp-default-debuginfo-5.3.18-59.24.1 gfs2-kmp-default-5.3.18-59.24.1 gfs2-kmp-default-debuginfo-5.3.18-59.24.1 kernel-default-5.3.18-59.24.1 kernel-default-base-5.3.18-59.24.1.18.12.1 kernel-default-base-rebuild-5.3.18-59.24.1.18.12.1 kernel-default-debuginfo-5.3.18-59.24.1 kernel-default-debugsource-5.3.18-59.24.1 kernel-default-devel-5.3.18-59.24.1 kernel-default-devel-debuginfo-5.3.18-59.24.1 kernel-default-extra-5.3.18-59.24.1 kernel-default-extra-debuginfo-5.3.18-59.24.1 kernel-default-livepatch-5.3.18-59.24.1 kernel-default-livepatch-devel-5.3.18-59.24.1 kernel-default-optional-5.3.18-59.24.1 kernel-default-optional-debuginfo-5.3.18-59.24.1 kernel-obs-build-5.3.18-59.24.1 kernel-obs-build-debugsource-5.3.18-59.24.1 kernel-obs-qa-5.3.18-59.24.1 kernel-syms-5.3.18-59.24.1 kselftests-kmp-default-5.3.18-59.24.1 kselftests-kmp-default-debuginfo-5.3.18-59.24.1 ocfs2-kmp-default-5.3.18-59.24.1 ocfs2-kmp-default-debuginfo-5.3.18-59.24.1 reiserfs-kmp-default-5.3.18-59.24.1 reiserfs-kmp-default-debuginfo-5.3.18-59.24.1 - openSUSE Leap 15.3 (ppc64le x86_64): kernel-debug-5.3.18-59.24.1 kernel-debug-debuginfo-5.3.18-59.24.1 kernel-debug-debugsource-5.3.18-59.24.1 kernel-debug-devel-5.3.18-59.24.1 kernel-debug-devel-debuginfo-5.3.18-59.24.1 kernel-debug-livepatch-devel-5.3.18-59.24.1 kernel-kvmsmall-5.3.18-59.24.1 kernel-kvmsmall-debuginfo-5.3.18-59.24.1 kernel-kvmsmall-debugsource-5.3.18-59.24.1 kernel-kvmsmall-devel-5.3.18-59.24.1 kernel-kvmsmall-devel-debuginfo-5.3.18-59.24.1 kernel-kvmsmall-livepatch-devel-5.3.18-59.24.1 - openSUSE Leap 15.3 (aarch64 x86_64): cluster-md-kmp-preempt-5.3.18-59.24.1 cluster-md-kmp-preempt-debuginfo-5.3.18-59.24.1 dlm-kmp-preempt-5.3.18-59.24.1 dlm-kmp-preempt-debuginfo-5.3.18-59.24.1 gfs2-kmp-preempt-5.3.18-59.24.1 gfs2-kmp-preempt-debuginfo-5.3.18-59.24.1 kernel-preempt-5.3.18-59.24.1 kernel-preempt-debuginfo-5.3.18-59.24.1 kernel-preempt-debugsource-5.3.18-59.24.1 kernel-preempt-devel-5.3.18-59.24.1 kernel-preempt-devel-debuginfo-5.3.18-59.24.1 kernel-preempt-extra-5.3.18-59.24.1 kernel-preempt-extra-debuginfo-5.3.18-59.24.1 kernel-preempt-livepatch-devel-5.3.18-59.24.1 kernel-preempt-optional-5.3.18-59.24.1 kernel-preempt-optional-debuginfo-5.3.18-59.24.1 kselftests-kmp-preempt-5.3.18-59.24.1 kselftests-kmp-preempt-debuginfo-5.3.18-59.24.1 ocfs2-kmp-preempt-5.3.18-59.24.1 ocfs2-kmp-preempt-debuginfo-5.3.18-59.24.1 reiserfs-kmp-preempt-5.3.18-59.24.1 reiserfs-kmp-preempt-debuginfo-5.3.18-59.24.1 - openSUSE Leap 15.3 (aarch64): cluster-md-kmp-64kb-5.3.18-59.24.1 cluster-md-kmp-64kb-debuginfo-5.3.18-59.24.1 dlm-kmp-64kb-5.3.18-59.24.1 dlm-kmp-64kb-debuginfo-5.3.18-59.24.1 dtb-al-5.3.18-59.24.1 dtb-allwinner-5.3.18-59.24.1 dtb-altera-5.3.18-59.24.1 dtb-amd-5.3.18-59.24.1 dtb-amlogic-5.3.18-59.24.1 dtb-apm-5.3.18-59.24.1 dtb-arm-5.3.18-59.24.1 dtb-broadcom-5.3.18-59.24.1 dtb-cavium-5.3.18-59.24.1 dtb-exynos-5.3.18-59.24.1 dtb-freescale-5.3.18-59.24.1 dtb-hisilicon-5.3.18-59.24.1 dtb-lg-5.3.18-59.24.1 dtb-marvell-5.3.18-59.24.1 dtb-mediatek-5.3.18-59.24.1 dtb-nvidia-5.3.18-59.24.1 dtb-qcom-5.3.18-59.24.1 dtb-renesas-5.3.18-59.24.1 dtb-rockchip-5.3.18-59.24.1 dtb-socionext-5.3.18-59.24.1 dtb-sprd-5.3.18-59.24.1 dtb-xilinx-5.3.18-59.24.1 dtb-zte-5.3.18-59.24.1 gfs2-kmp-64kb-5.3.18-59.24.1 gfs2-kmp-64kb-debuginfo-5.3.18-59.24.1 kernel-64kb-5.3.18-59.24.1 kernel-64kb-debuginfo-5.3.18-59.24.1 kernel-64kb-debugsource-5.3.18-59.24.1 kernel-64kb-devel-5.3.18-59.24.1 kernel-64kb-devel-debuginfo-5.3.18-59.24.1 kernel-64kb-extra-5.3.18-59.24.1 kernel-64kb-extra-debuginfo-5.3.18-59.24.1 kernel-64kb-livepatch-devel-5.3.18-59.24.1 kernel-64kb-optional-5.3.18-59.24.1 kernel-64kb-optional-debuginfo-5.3.18-59.24.1 kselftests-kmp-64kb-5.3.18-59.24.1 kselftests-kmp-64kb-debuginfo-5.3.18-59.24.1 ocfs2-kmp-64kb-5.3.18-59.24.1 ocfs2-kmp-64kb-debuginfo-5.3.18-59.24.1 reiserfs-kmp-64kb-5.3.18-59.24.1 reiserfs-kmp-64kb-debuginfo-5.3.18-59.24.1 - openSUSE Leap 15.3 (noarch): kernel-devel-5.3.18-59.24.1 kernel-docs-5.3.18-59.24.1 kernel-docs-html-5.3.18-59.24.1 kernel-macros-5.3.18-59.24.1 kernel-source-5.3.18-59.24.1 kernel-source-vanilla-5.3.18-59.24.1 - openSUSE Leap 15.3 (s390x): kernel-zfcpdump-5.3.18-59.24.1 kernel-zfcpdump-debuginfo-5.3.18-59.24.1 kernel-zfcpdump-debugsource-5.3.18-59.24.1 References: https://www.suse.com/security/cve/CVE-2020-12770.html https://www.suse.com/security/cve/CVE-2021-34556.html https://www.suse.com/security/cve/CVE-2021-35477.html https://www.suse.com/security/cve/CVE-2021-3640.html https://www.suse.com/security/cve/CVE-2021-3653.html https://www.suse.com/security/cve/CVE-2021-3656.html https://www.suse.com/security/cve/CVE-2021-3679.html https://www.suse.com/security/cve/CVE-2021-3732.html https://www.suse.com/security/cve/CVE-2021-3739.html https://www.suse.com/security/cve/CVE-2021-3743.html https://www.suse.com/security/cve/CVE-2021-3753.html https://www.suse.com/security/cve/CVE-2021-3759.html https://www.suse.com/security/cve/CVE-2021-38160.html https://www.suse.com/security/cve/CVE-2021-38166.html https://www.suse.com/security/cve/CVE-2021-38198.html https://www.suse.com/security/cve/CVE-2021-38204.html https://www.suse.com/security/cve/CVE-2021-38205.html https://www.suse.com/security/cve/CVE-2021-38206.html https://www.suse.com/security/cve/CVE-2021-38207.html https://www.suse.com/security/cve/CVE-2021-38209.html https://bugzilla.suse.com/1040364 https://bugzilla.suse.com/1127650 https://bugzilla.suse.com/1135481 https://bugzilla.suse.com/1152489 https://bugzilla.suse.com/1160010 https://bugzilla.suse.com/1168202 https://bugzilla.suse.com/1171420 https://bugzilla.suse.com/1174969 https://bugzilla.suse.com/1175052 https://bugzilla.suse.com/1175543 https://bugzilla.suse.com/1177399 https://bugzilla.suse.com/1180100 https://bugzilla.suse.com/1180141 https://bugzilla.suse.com/1180347 https://bugzilla.suse.com/1181006 https://bugzilla.suse.com/1181148 https://bugzilla.suse.com/1181972 https://bugzilla.suse.com/1184180 https://bugzilla.suse.com/1185902 https://bugzilla.suse.com/1186264 https://bugzilla.suse.com/1186731 https://bugzilla.suse.com/1187211 https://bugzilla.suse.com/1187455 https://bugzilla.suse.com/1187468 https://bugzilla.suse.com/1187483 https://bugzilla.suse.com/1187619 https://bugzilla.suse.com/1187959 https://bugzilla.suse.com/1188067 https://bugzilla.suse.com/1188172 https://bugzilla.suse.com/1188231 https://bugzilla.suse.com/1188270 https://bugzilla.suse.com/1188412 https://bugzilla.suse.com/1188418 https://bugzilla.suse.com/1188616 https://bugzilla.suse.com/1188700 https://bugzilla.suse.com/1188780 https://bugzilla.suse.com/1188781 https://bugzilla.suse.com/1188782 https://bugzilla.suse.com/1188783 https://bugzilla.suse.com/1188784 https://bugzilla.suse.com/1188786 https://bugzilla.suse.com/1188787 https://bugzilla.suse.com/1188788 https://bugzilla.suse.com/1188790 https://bugzilla.suse.com/1188878 https://bugzilla.suse.com/1188885 https://bugzilla.suse.com/1188924 https://bugzilla.suse.com/1188982 https://bugzilla.suse.com/1188983 https://bugzilla.suse.com/1188985 https://bugzilla.suse.com/1189021 https://bugzilla.suse.com/1189057 https://bugzilla.suse.com/1189077 https://bugzilla.suse.com/1189153 https://bugzilla.suse.com/1189197 https://bugzilla.suse.com/1189209 https://bugzilla.suse.com/1189210 https://bugzilla.suse.com/1189212 https://bugzilla.suse.com/1189213 https://bugzilla.suse.com/1189214 https://bugzilla.suse.com/1189215 https://bugzilla.suse.com/1189216 https://bugzilla.suse.com/1189217 https://bugzilla.suse.com/1189218 https://bugzilla.suse.com/1189219 https://bugzilla.suse.com/1189220 https://bugzilla.suse.com/1189221 https://bugzilla.suse.com/1189222 https://bugzilla.suse.com/1189225 https://bugzilla.suse.com/1189229 https://bugzilla.suse.com/1189233 https://bugzilla.suse.com/1189262 https://bugzilla.suse.com/1189291 https://bugzilla.suse.com/1189292 https://bugzilla.suse.com/1189296 https://bugzilla.suse.com/1189298 https://bugzilla.suse.com/1189301 https://bugzilla.suse.com/1189305 https://bugzilla.suse.com/1189323 https://bugzilla.suse.com/1189384 https://bugzilla.suse.com/1189385 https://bugzilla.suse.com/1189392 https://bugzilla.suse.com/1189393 https://bugzilla.suse.com/1189399 https://bugzilla.suse.com/1189400 https://bugzilla.suse.com/1189427 https://bugzilla.suse.com/1189503 https://bugzilla.suse.com/1189504 https://bugzilla.suse.com/1189505 https://bugzilla.suse.com/1189506 https://bugzilla.suse.com/1189507 https://bugzilla.suse.com/1189562 https://bugzilla.suse.com/1189563 https://bugzilla.suse.com/1189564 https://bugzilla.suse.com/1189565 https://bugzilla.suse.com/1189566 https://bugzilla.suse.com/1189567 https://bugzilla.suse.com/1189568 https://bugzilla.suse.com/1189569 https://bugzilla.suse.com/1189573 https://bugzilla.suse.com/1189574 https://bugzilla.suse.com/1189575 https://bugzilla.suse.com/1189576 https://bugzilla.suse.com/1189577 https://bugzilla.suse.com/1189579 https://bugzilla.suse.com/1189581 https://bugzilla.suse.com/1189582 https://bugzilla.suse.com/1189583 https://bugzilla.suse.com/1189585 https://bugzilla.suse.com/1189586 https://bugzilla.suse.com/1189587 https://bugzilla.suse.com/1189706 https://bugzilla.suse.com/1189760 https://bugzilla.suse.com/1189762 https://bugzilla.suse.com/1189832 https://bugzilla.suse.com/1189841 https://bugzilla.suse.com/1189870 https://bugzilla.suse.com/1189872 https://bugzilla.suse.com/1189883 https://bugzilla.suse.com/1190022 https://bugzilla.suse.com/1190025 https://bugzilla.suse.com/1190115 https://bugzilla.suse.com/1190117 https://bugzilla.suse.com/1190412 https://bugzilla.suse.com/1190413 https://bugzilla.suse.com/1190428

1 0

openSUSE-SU-2021:3211-1: important: Security update for nodejs14
by opensuse-security＠opensuse.org 23 Sep '21

23 Sep '21

openSUSE Security Update: Security update for nodejs14 ______________________________________________________________________________ Announcement ID: openSUSE-SU-2021:3211-1 Rating: important References: #1188881 #1188917 #1189368 #1189369 #1189370 Cross-References: CVE-2021-22930 CVE-2021-22931 CVE-2021-22939 CVE-2021-22940 CVE-2021-3672 CVSS scores: CVE-2021-22930 (SUSE): 9.1 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N CVE-2021-22931 (SUSE): 8.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H CVE-2021-22939 (SUSE): 4.3 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N CVE-2021-22940 (SUSE): 9.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H CVE-2021-3672 (SUSE): 8.1 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:N Affected Products: openSUSE Leap 15.3 ______________________________________________________________________________ An update that fixes 5 vulnerabilities is now available. Description: This update for nodejs14 fixes the following issues: - CVE-2021-3672: Fixed missing input validation on hostnames (bsc#1188881). - CVE-2021-22931: Fixed improper handling of untypical characters in domain names (bsc#1189370). - CVE-2021-22940: Use after free on close http2 on stream canceling (bsc#1189368) - CVE-2021-22939: Incomplete validation of rejectUnauthorized parameter (bsc#1189369) - CVE-2021-22930: Fixed use after free on close http2 on stream canceling (bsc#1188917). Patch Instructions: To install this openSUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 15.3: zypper in -t patch openSUSE-SLE-15.3-2021-3211=1 Package List: - openSUSE Leap 15.3 (aarch64 ppc64le s390x x86_64): nodejs14-14.17.5-5.15.5 nodejs14-debuginfo-14.17.5-5.15.5 nodejs14-debugsource-14.17.5-5.15.5 nodejs14-devel-14.17.5-5.15.5 npm14-14.17.5-5.15.5 - openSUSE Leap 15.3 (noarch): nodejs14-docs-14.17.5-5.15.5 References: https://www.suse.com/security/cve/CVE-2021-22930.html https://www.suse.com/security/cve/CVE-2021-22931.html https://www.suse.com/security/cve/CVE-2021-22939.html https://www.suse.com/security/cve/CVE-2021-22940.html https://www.suse.com/security/cve/CVE-2021-3672.html https://bugzilla.suse.com/1188881 https://bugzilla.suse.com/1188917 https://bugzilla.suse.com/1189368 https://bugzilla.suse.com/1189369 https://bugzilla.suse.com/1189370

1 0

openSUSE-RU-2021:3203-1: moderate: Recommended update for kmod
by maintenance＠opensuse.org 23 Sep '21

23 Sep '21

openSUSE Recommended Update: Recommended update for kmod ______________________________________________________________________________ Announcement ID: openSUSE-RU-2021:3203-1 Rating: moderate References: #1189537 #1190190 Affected Products: openSUSE Leap 15.3 ______________________________________________________________________________ An update that has two recommended fixes can now be installed. Description: This update for kmod fixes the following issues: - Use docbook 4 rather than docbook 5 for building man pages (bsc#1190190). - Enable support for ZSTD compressed modules - Display module information even for modules built into the running kernel (bsc#1189537) - '/usr/lib' should override '/lib' where both are available. Support '/usr/lib' for depmod.d as well. - Remove test patches included in release 29 - Update to release 29 * Fix `modinfo -F` not working for built-in modules and certain fields. * Fix a memory leak, overflow and double free on error path. Patch Instructions: To install this openSUSE Recommended Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 15.3: zypper in -t patch openSUSE-SLE-15.3-2021-3203=1 Package List: - openSUSE Leap 15.3 (aarch64 ppc64le s390x x86_64): kmod-29-4.9.1 kmod-debuginfo-29-4.9.1 kmod-debugsource-29-4.9.1 libkmod-devel-29-4.9.1 libkmod2-29-4.9.1 libkmod2-debuginfo-29-4.9.1 - openSUSE Leap 15.3 (noarch): kmod-bash-completion-29-4.9.1 References: https://bugzilla.suse.com/1189537 https://bugzilla.suse.com/1190190

1 0

openSUSE-SU-2021:3193-1: important: Security update for ffmpeg
by opensuse-security＠opensuse.org 23 Sep '21

23 Sep '21

openSUSE Security Update: Security update for ffmpeg ______________________________________________________________________________ Announcement ID: openSUSE-SU-2021:3193-1 Rating: important References: #1189724 Cross-References: CVE-2021-38171 CVSS scores: CVE-2021-38171 (SUSE): 7.3 CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H Affected Products: openSUSE Leap 15.3 ______________________________________________________________________________ An update that fixes one vulnerability is now available. Description: This update for ffmpeg fixes the following issues: - CVE-2021-38171: Fixed adts_decode_extradata in libavformat/adtsenc.c to check the init_get_bits return value (bsc#1189724). Patch Instructions: To install this openSUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 15.3: zypper in -t patch openSUSE-SLE-15.3-2021-3193=1 Package List: - openSUSE Leap 15.3 (aarch64 ppc64le s390x x86_64): ffmpeg-3.4.2-11.11.1 ffmpeg-debuginfo-3.4.2-11.11.1 ffmpeg-debugsource-3.4.2-11.11.1 ffmpeg-private-devel-3.4.2-11.11.1 libavcodec-devel-3.4.2-11.11.1 libavcodec57-3.4.2-11.11.1 libavcodec57-debuginfo-3.4.2-11.11.1 libavdevice-devel-3.4.2-11.11.1 libavdevice57-3.4.2-11.11.1 libavdevice57-debuginfo-3.4.2-11.11.1 libavfilter-devel-3.4.2-11.11.1 libavfilter6-3.4.2-11.11.1 libavfilter6-debuginfo-3.4.2-11.11.1 libavformat-devel-3.4.2-11.11.1 libavformat57-3.4.2-11.11.1 libavformat57-debuginfo-3.4.2-11.11.1 libavresample-devel-3.4.2-11.11.1 libavresample3-3.4.2-11.11.1 libavresample3-debuginfo-3.4.2-11.11.1 libavutil-devel-3.4.2-11.11.1 libavutil55-3.4.2-11.11.1 libavutil55-debuginfo-3.4.2-11.11.1 libpostproc-devel-3.4.2-11.11.1 libpostproc54-3.4.2-11.11.1 libpostproc54-debuginfo-3.4.2-11.11.1 libswresample-devel-3.4.2-11.11.1 libswresample2-3.4.2-11.11.1 libswresample2-debuginfo-3.4.2-11.11.1 libswscale-devel-3.4.2-11.11.1 libswscale4-3.4.2-11.11.1 libswscale4-debuginfo-3.4.2-11.11.1 - openSUSE Leap 15.3 (x86_64): libavcodec57-32bit-3.4.2-11.11.1 libavcodec57-32bit-debuginfo-3.4.2-11.11.1 libavdevice57-32bit-3.4.2-11.11.1 libavdevice57-32bit-debuginfo-3.4.2-11.11.1 libavfilter6-32bit-3.4.2-11.11.1 libavfilter6-32bit-debuginfo-3.4.2-11.11.1 libavformat57-32bit-3.4.2-11.11.1 libavformat57-32bit-debuginfo-3.4.2-11.11.1 libavresample3-32bit-3.4.2-11.11.1 libavresample3-32bit-debuginfo-3.4.2-11.11.1 libavutil55-32bit-3.4.2-11.11.1 libavutil55-32bit-debuginfo-3.4.2-11.11.1 libpostproc54-32bit-3.4.2-11.11.1 libpostproc54-32bit-debuginfo-3.4.2-11.11.1 libswresample2-32bit-3.4.2-11.11.1 libswresample2-32bit-debuginfo-3.4.2-11.11.1 libswscale4-32bit-3.4.2-11.11.1 libswscale4-32bit-debuginfo-3.4.2-11.11.1 References: https://www.suse.com/security/cve/CVE-2021-38171.html https://bugzilla.suse.com/1189724

1 0

openSUSE-SU-2021:3202-1: moderate: Security update for linuxptp
by opensuse-security＠opensuse.org 23 Sep '21

23 Sep '21

openSUSE Security Update: Security update for linuxptp ______________________________________________________________________________ Announcement ID: openSUSE-SU-2021:3202-1 Rating: moderate References: #1187646 Cross-References: CVE-2021-3570 CVSS scores: CVE-2021-3570 (NVD) : 8.8 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H CVE-2021-3570 (SUSE): 8.8 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H Affected Products: openSUSE Leap 15.3 ______________________________________________________________________________ An update that fixes one vulnerability is now available. Description: This update for linuxptp fixes the following issues: - CVE-2021-3570: Fixed messageLength validation field of incoming messages (bsc#1187646). Patch Instructions: To install this openSUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 15.3: zypper in -t patch openSUSE-SLE-15.3-2021-3202=1 Package List: - openSUSE Leap 15.3 (aarch64 ppc64le s390x x86_64): linuxptp-3.1.1-3.3.1 linuxptp-debuginfo-3.1.1-3.3.1 linuxptp-debugsource-3.1.1-3.3.1 References: https://www.suse.com/security/cve/CVE-2021-3570.html https://bugzilla.suse.com/1187646

1 0

openSUSE-SU-2021:3194-1: important: Security update for grilo
by opensuse-security＠opensuse.org 23 Sep '21

23 Sep '21

openSUSE Security Update: Security update for grilo ______________________________________________________________________________ Announcement ID: openSUSE-SU-2021:3194-1 Rating: important References: #1189839 Cross-References: CVE-2021-39365 CVSS scores: CVE-2021-39365 (SUSE): 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N Affected Products: openSUSE Leap 15.3 ______________________________________________________________________________ An update that fixes one vulnerability is now available. Description: This update for grilo fixes the following issues: - CVE-2021-39365: Fixed missing TLS certificate verification (bsc#1189839). Patch Instructions: To install this openSUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 15.3: zypper in -t patch openSUSE-SLE-15.3-2021-3194=1 Package List: - openSUSE Leap 15.3 (aarch64 ppc64le s390x x86_64): grilo-debuginfo-0.3.12-3.3.1 grilo-debugsource-0.3.12-3.3.1 grilo-devel-0.3.12-3.3.1 grilo-tools-0.3.12-3.3.1 grilo-tools-debuginfo-0.3.12-3.3.1 libgrilo-0_3-0-0.3.12-3.3.1 libgrilo-0_3-0-debuginfo-0.3.12-3.3.1 libgrlnet-0_3-0-0.3.12-3.3.1 libgrlnet-0_3-0-debuginfo-0.3.12-3.3.1 libgrlpls-0_3-0-0.3.12-3.3.1 libgrlpls-0_3-0-debuginfo-0.3.12-3.3.1 typelib-1_0-Grl-0_3-0.3.12-3.3.1 typelib-1_0-GrlNet-0_3-0.3.12-3.3.1 typelib-1_0-GrlPls-0_3-0.3.12-3.3.1 - openSUSE Leap 15.3 (noarch): grilo-lang-0.3.12-3.3.1 References: https://www.suse.com/security/cve/CVE-2021-39365.html https://bugzilla.suse.com/1189839

1 0

openSUSE-SU-2021:3201-1: moderate: Security update for hivex
by opensuse-security＠opensuse.org 23 Sep '21

23 Sep '21

openSUSE Security Update: Security update for hivex ______________________________________________________________________________ Announcement ID: openSUSE-SU-2021:3201-1 Rating: moderate References: #1189060 Cross-References: CVE-2021-3622 CVSS scores: CVE-2021-3622 (SUSE): 4.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:L Affected Products: openSUSE Leap 15.3 ______________________________________________________________________________ An update that fixes one vulnerability is now available. Description: This update for hivex fixes the following issues: - CVE-2021-3622: Fixed stack overflow due to recursive call of _get_children() (bsc#1189060). Patch Instructions: To install this openSUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 15.3: zypper in -t patch openSUSE-SLE-15.3-2021-3201=1 Package List: - openSUSE Leap 15.3 (aarch64 ppc64le s390x x86_64): hivex-1.3.14-5.6.1 hivex-debuginfo-1.3.14-5.6.1 hivex-debugsource-1.3.14-5.6.1 hivex-devel-1.3.14-5.6.1 libhivex0-1.3.14-5.6.1 libhivex0-debuginfo-1.3.14-5.6.1 ocaml-hivex-1.3.14-5.6.1 ocaml-hivex-debuginfo-1.3.14-5.6.1 ocaml-hivex-devel-1.3.14-5.6.1 perl-Win-Hivex-1.3.14-5.6.1 perl-Win-Hivex-debuginfo-1.3.14-5.6.1 python-hivex-1.3.14-5.6.1 python-hivex-debuginfo-1.3.14-5.6.1 - openSUSE Leap 15.3 (noarch): hivex-lang-1.3.14-5.6.1 References: https://www.suse.com/security/cve/CVE-2021-3622.html https://bugzilla.suse.com/1189060

1 0

openSUSE-SU-2021:1303-1: important: Security update for chromium
by opensuse-security＠opensuse.org 22 Sep '21

22 Sep '21

openSUSE Security Update: Security update for chromium ______________________________________________________________________________ Announcement ID: openSUSE-SU-2021:1303-1 Rating: important References: #1190096 #1190476 Cross-References: CVE-2021-30606 CVE-2021-30607 CVE-2021-30608 CVE-2021-30609 CVE-2021-30610 CVE-2021-30611 CVE-2021-30612 CVE-2021-30613 CVE-2021-30614 CVE-2021-30615 CVE-2021-30616 CVE-2021-30617 CVE-2021-30618 CVE-2021-30619 CVE-2021-30620 CVE-2021-30621 CVE-2021-30622 CVE-2021-30623 CVE-2021-30624 CVE-2021-30625 CVE-2021-30626 CVE-2021-30627 CVE-2021-30628 CVE-2021-30629 CVE-2021-30630 CVE-2021-30631 CVE-2021-30632 CVE-2021-30633 Affected Products: openSUSE Leap 15.2 ______________________________________________________________________________ An update that fixes 28 vulnerabilities is now available. Description: This update for chromium fixes the following issues: Chromium 93.0.4577.63 (boo#1190096): * CVE-2021-30606: Use after free in Blink * CVE-2021-30607: Use after free in Permissions * CVE-2021-30608: Use after free in Web Share * CVE-2021-30609: Use after free in Sign-In * CVE-2021-30610: Use after free in Extensions API * CVE-2021-30611: Use after free in WebRTC * CVE-2021-30612: Use after free in WebRTC * CVE-2021-30613: Use after free in Base internals * CVE-2021-30614: Heap buffer overflow in TabStrip * CVE-2021-30615: Cross-origin data leak in Navigation * CVE-2021-30616: Use after free in Media * CVE-2021-30617: Policy bypass in Blink * CVE-2021-30618: Inappropriate implementation in DevTools * CVE-2021-30619: UI Spoofing in Autofill * CVE-2021-30620: Insufficient policy enforcement in Blink * CVE-2021-30621: UI Spoofing in Autofill * CVE-2021-30622: Use after free in WebApp Installs * CVE-2021-30623: Use after free in Bookmarks * CVE-2021-30624: Use after free in Autofill Chromium 93.0.4577.82 (boo#1190476): * CVE-2021-30625: Use after free in Selection API * CVE-2021-30626: Out of bounds memory access in ANGLE * CVE-2021-30627: Type Confusion in Blink layout * CVE-2021-30628: Stack buffer overflow in ANGLE * CVE-2021-30629: Use after free in Permissions * CVE-2021-30630: Inappropriate implementation in Blink * CVE-2021-30631: Type Confusion in Blink layout * CVE-2021-30632: Out of bounds write in V8 * CVE-2021-30633: Use after free in Indexed DB API Patch Instructions: To install this openSUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 15.2: zypper in -t patch openSUSE-2021-1303=1 Package List: - openSUSE Leap 15.2 (x86_64): chromedriver-93.0.4577.82-lp152.2.125.1 chromedriver-debuginfo-93.0.4577.82-lp152.2.125.1 chromium-93.0.4577.82-lp152.2.125.1 chromium-debuginfo-93.0.4577.82-lp152.2.125.1 References: https://www.suse.com/security/cve/CVE-2021-30606.html https://www.suse.com/security/cve/CVE-2021-30607.html https://www.suse.com/security/cve/CVE-2021-30608.html https://www.suse.com/security/cve/CVE-2021-30609.html https://www.suse.com/security/cve/CVE-2021-30610.html https://www.suse.com/security/cve/CVE-2021-30611.html https://www.suse.com/security/cve/CVE-2021-30612.html https://www.suse.com/security/cve/CVE-2021-30613.html https://www.suse.com/security/cve/CVE-2021-30614.html https://www.suse.com/security/cve/CVE-2021-30615.html https://www.suse.com/security/cve/CVE-2021-30616.html https://www.suse.com/security/cve/CVE-2021-30617.html https://www.suse.com/security/cve/CVE-2021-30618.html https://www.suse.com/security/cve/CVE-2021-30619.html https://www.suse.com/security/cve/CVE-2021-30620.html https://www.suse.com/security/cve/CVE-2021-30621.html https://www.suse.com/security/cve/CVE-2021-30622.html https://www.suse.com/security/cve/CVE-2021-30623.html https://www.suse.com/security/cve/CVE-2021-30624.html https://www.suse.com/security/cve/CVE-2021-30625.html https://www.suse.com/security/cve/CVE-2021-30626.html https://www.suse.com/security/cve/CVE-2021-30627.html https://www.suse.com/security/cve/CVE-2021-30628.html https://www.suse.com/security/cve/CVE-2021-30629.html https://www.suse.com/security/cve/CVE-2021-30630.html https://www.suse.com/security/cve/CVE-2021-30631.html https://www.suse.com/security/cve/CVE-2021-30632.html https://www.suse.com/security/cve/CVE-2021-30633.html https://bugzilla.suse.com/1190096 https://bugzilla.suse.com/1190476

1 0

openSUSE-RU-2021:3188-1: moderate: Recommended update for sapnwbootstrap-formula
by maintenance＠opensuse.org 22 Sep '21

22 Sep '21

openSUSE Recommended Update: Recommended update for sapnwbootstrap-formula ______________________________________________________________________________ Announcement ID: openSUSE-RU-2021:3188-1 Rating: moderate References: #1181541 #1185093 #1185627 #1186236 Affected Products: openSUSE Leap 15.3 ______________________________________________________________________________ An update that has four recommended fixes can now be installed. Description: This update for sapnwbootstrap-formula fixes the following issues: Update to version 0.6.4+git.1621842068.a86c37c: - Set the default empty dictionary for 'virtual_addresses'. (bsc#1185627) - This also ensures that a dictionary is obtained if the value is None (needed by SUSE Manager) - Fix issue when 'azure-lb' resource for 'ASCS/ERS' is not added in the corresponding Resource Group (bsc#1186236) - Set the virtual ip addresses as permanent, except for HA scenarios, to have them even after a reboot of the machine. (bsc#1185093) - Give the option to mount '/sapmnt' folder locally without using a 'NFS' share. - Make '/sapmnt' path configurable using 'sapmnt_path' pillar variable - Update PAS and AAS templates to use HANA sid and instance number to create the configuration file - Fix error about missing instance installation requisite when monitoring is enabled. (bsc#1181541) Patch Instructions: To install this openSUSE Recommended Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 15.3: zypper in -t patch openSUSE-SLE-15.3-2021-3188=1 Package List: - openSUSE Leap 15.3 (noarch): sapnwbootstrap-formula-0.6.4+git.1621842068.a86c37c-10.1 References: https://bugzilla.suse.com/1181541 https://bugzilla.suse.com/1185093 https://bugzilla.suse.com/1185627 https://bugzilla.suse.com/1186236

1 0

openSUSE-SU-2021:3187-1: important: Security update for samba
by opensuse-security＠opensuse.org 22 Sep '21

22 Sep '21

openSUSE Security Update: Security update for samba ______________________________________________________________________________ Announcement ID: openSUSE-SU-2021:3187-1 Rating: important References: #1182830 #1183572 #1183574 #1184677 #1189875 Cross-References: CVE-2020-27840 CVE-2021-20254 CVE-2021-20277 CVSS scores: CVE-2020-27840 (NVD) : 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H CVE-2020-27840 (SUSE): 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H CVE-2021-20254 (NVD) : 8.1 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N CVE-2021-20254 (SUSE): 7.1 CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:L CVE-2021-20277 (NVD) : 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H CVE-2021-20277 (SUSE): 7.1 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:H Affected Products: openSUSE Leap 15.3 ______________________________________________________________________________ An update that solves three vulnerabilities and has two fixes is now available. Description: This update for samba fixes the following issues: - CVE-2021-20277: Fixed an out of bounds read in ldb_handler_fold (bsc#1183574). - CVE-2021-20254: Fixed a buffer overrun in sids_to_unixids() (bsc#1184677). - CVE-2020-27840: Fixed an unauthenticated remote heap corruption via bad DNs (bsc#1183572). - Spec file fixes around systemd and requires (bsc#1182830) - Fix dependency problem upgrading from libndr0 to libndr1 (bsc#1189875) - Fix dependency problem upgrading from libsmbldap0 to libsmbldap2 (bsc#1189875) Patch Instructions: To install this openSUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 15.3: zypper in -t patch openSUSE-SLE-15.3-2021-3187=1 Package List: - openSUSE Leap 15.3 (aarch64 ppc64le s390x x86_64): ctdb-4.13.6+git.211.555d60b24ba-3.7.1 ctdb-debuginfo-4.13.6+git.211.555d60b24ba-3.7.1 ctdb-pcp-pmda-4.13.6+git.211.555d60b24ba-3.7.1 ctdb-pcp-pmda-debuginfo-4.13.6+git.211.555d60b24ba-3.7.1 ctdb-tests-4.13.6+git.211.555d60b24ba-3.7.1 ctdb-tests-debuginfo-4.13.6+git.211.555d60b24ba-3.7.1 libdcerpc-binding0-4.13.6+git.211.555d60b24ba-3.7.1 libdcerpc-binding0-debuginfo-4.13.6+git.211.555d60b24ba-3.7.1 libdcerpc-devel-4.13.6+git.211.555d60b24ba-3.7.1 libdcerpc-samr-devel-4.13.6+git.211.555d60b24ba-3.7.1 libdcerpc-samr0-4.13.6+git.211.555d60b24ba-3.7.1 libdcerpc-samr0-debuginfo-4.13.6+git.211.555d60b24ba-3.7.1 libdcerpc0-4.13.6+git.211.555d60b24ba-3.7.1 libdcerpc0-debuginfo-4.13.6+git.211.555d60b24ba-3.7.1 libndr-devel-4.13.6+git.211.555d60b24ba-3.7.1 libndr-krb5pac-devel-4.13.6+git.211.555d60b24ba-3.7.1 libndr-krb5pac0-4.13.6+git.211.555d60b24ba-3.7.1 libndr-krb5pac0-debuginfo-4.13.6+git.211.555d60b24ba-3.7.1 libndr-nbt-devel-4.13.6+git.211.555d60b24ba-3.7.1 libndr-nbt0-4.13.6+git.211.555d60b24ba-3.7.1 libndr-nbt0-debuginfo-4.13.6+git.211.555d60b24ba-3.7.1 libndr-standard-devel-4.13.6+git.211.555d60b24ba-3.7.1 libndr-standard0-4.13.6+git.211.555d60b24ba-3.7.1 libndr-standard0-debuginfo-4.13.6+git.211.555d60b24ba-3.7.1 libndr1-4.13.6+git.211.555d60b24ba-3.7.1 libndr1-debuginfo-4.13.6+git.211.555d60b24ba-3.7.1 libnetapi-devel-4.13.6+git.211.555d60b24ba-3.7.1 libnetapi0-4.13.6+git.211.555d60b24ba-3.7.1 libnetapi0-debuginfo-4.13.6+git.211.555d60b24ba-3.7.1 libsamba-credentials-devel-4.13.6+git.211.555d60b24ba-3.7.1 libsamba-credentials0-4.13.6+git.211.555d60b24ba-3.7.1 libsamba-credentials0-debuginfo-4.13.6+git.211.555d60b24ba-3.7.1 libsamba-errors-devel-4.13.6+git.211.555d60b24ba-3.7.1 libsamba-errors0-4.13.6+git.211.555d60b24ba-3.7.1 libsamba-errors0-debuginfo-4.13.6+git.211.555d60b24ba-3.7.1 libsamba-hostconfig-devel-4.13.6+git.211.555d60b24ba-3.7.1 libsamba-hostconfig0-4.13.6+git.211.555d60b24ba-3.7.1 libsamba-hostconfig0-debuginfo-4.13.6+git.211.555d60b24ba-3.7.1 libsamba-passdb-devel-4.13.6+git.211.555d60b24ba-3.7.1 libsamba-passdb0-4.13.6+git.211.555d60b24ba-3.7.1 libsamba-passdb0-debuginfo-4.13.6+git.211.555d60b24ba-3.7.1 libsamba-policy-devel-4.13.6+git.211.555d60b24ba-3.7.1 libsamba-policy-python3-devel-4.13.6+git.211.555d60b24ba-3.7.1 libsamba-policy0-python3-4.13.6+git.211.555d60b24ba-3.7.1 libsamba-policy0-python3-debuginfo-4.13.6+git.211.555d60b24ba-3.7.1 libsamba-util-devel-4.13.6+git.211.555d60b24ba-3.7.1 libsamba-util0-4.13.6+git.211.555d60b24ba-3.7.1 libsamba-util0-debuginfo-4.13.6+git.211.555d60b24ba-3.7.1 libsamdb-devel-4.13.6+git.211.555d60b24ba-3.7.1 libsamdb0-4.13.6+git.211.555d60b24ba-3.7.1 libsamdb0-debuginfo-4.13.6+git.211.555d60b24ba-3.7.1 libsmbclient-devel-4.13.6+git.211.555d60b24ba-3.7.1 libsmbclient0-4.13.6+git.211.555d60b24ba-3.7.1 libsmbclient0-debuginfo-4.13.6+git.211.555d60b24ba-3.7.1 libsmbconf-devel-4.13.6+git.211.555d60b24ba-3.7.1 libsmbconf0-4.13.6+git.211.555d60b24ba-3.7.1 libsmbconf0-debuginfo-4.13.6+git.211.555d60b24ba-3.7.1 libsmbldap-devel-4.13.6+git.211.555d60b24ba-3.7.1 libsmbldap2-4.13.6+git.211.555d60b24ba-3.7.1 libsmbldap2-debuginfo-4.13.6+git.211.555d60b24ba-3.7.1 libtevent-util-devel-4.13.6+git.211.555d60b24ba-3.7.1 libtevent-util0-4.13.6+git.211.555d60b24ba-3.7.1 libtevent-util0-debuginfo-4.13.6+git.211.555d60b24ba-3.7.1 libwbclient-devel-4.13.6+git.211.555d60b24ba-3.7.1 libwbclient0-4.13.6+git.211.555d60b24ba-3.7.1 libwbclient0-debuginfo-4.13.6+git.211.555d60b24ba-3.7.1 samba-4.13.6+git.211.555d60b24ba-3.7.1 samba-ad-dc-4.13.6+git.211.555d60b24ba-3.7.1 samba-ad-dc-debuginfo-4.13.6+git.211.555d60b24ba-3.7.1 samba-client-4.13.6+git.211.555d60b24ba-3.7.1 samba-client-debuginfo-4.13.6+git.211.555d60b24ba-3.7.1 samba-core-devel-4.13.6+git.211.555d60b24ba-3.7.1 samba-debuginfo-4.13.6+git.211.555d60b24ba-3.7.1 samba-debugsource-4.13.6+git.211.555d60b24ba-3.7.1 samba-dsdb-modules-4.13.6+git.211.555d60b24ba-3.7.1 samba-dsdb-modules-debuginfo-4.13.6+git.211.555d60b24ba-3.7.1 samba-libs-4.13.6+git.211.555d60b24ba-3.7.1 samba-libs-debuginfo-4.13.6+git.211.555d60b24ba-3.7.1 samba-libs-python3-4.13.6+git.211.555d60b24ba-3.7.1 samba-libs-python3-debuginfo-4.13.6+git.211.555d60b24ba-3.7.1 samba-python3-4.13.6+git.211.555d60b24ba-3.7.1 samba-python3-debuginfo-4.13.6+git.211.555d60b24ba-3.7.1 samba-test-4.13.6+git.211.555d60b24ba-3.7.1 samba-test-debuginfo-4.13.6+git.211.555d60b24ba-3.7.1 samba-winbind-4.13.6+git.211.555d60b24ba-3.7.1 samba-winbind-debuginfo-4.13.6+git.211.555d60b24ba-3.7.1 - openSUSE Leap 15.3 (aarch64 x86_64): samba-ceph-4.13.6+git.211.555d60b24ba-3.7.1 samba-ceph-debuginfo-4.13.6+git.211.555d60b24ba-3.7.1 - openSUSE Leap 15.3 (x86_64): libdcerpc-binding0-32bit-4.13.6+git.211.555d60b24ba-3.7.1 libdcerpc-binding0-32bit-debuginfo-4.13.6+git.211.555d60b24ba-3.7.1 libdcerpc-samr0-32bit-4.13.6+git.211.555d60b24ba-3.7.1 libdcerpc-samr0-32bit-debuginfo-4.13.6+git.211.555d60b24ba-3.7.1 libdcerpc0-32bit-4.13.6+git.211.555d60b24ba-3.7.1 libdcerpc0-32bit-debuginfo-4.13.6+git.211.555d60b24ba-3.7.1 libndr-krb5pac0-32bit-4.13.6+git.211.555d60b24ba-3.7.1 libndr-krb5pac0-32bit-debuginfo-4.13.6+git.211.555d60b24ba-3.7.1 libndr-nbt0-32bit-4.13.6+git.211.555d60b24ba-3.7.1 libndr-nbt0-32bit-debuginfo-4.13.6+git.211.555d60b24ba-3.7.1 libndr-standard0-32bit-4.13.6+git.211.555d60b24ba-3.7.1 libndr-standard0-32bit-debuginfo-4.13.6+git.211.555d60b24ba-3.7.1 libndr1-32bit-4.13.6+git.211.555d60b24ba-3.7.1 libndr1-32bit-debuginfo-4.13.6+git.211.555d60b24ba-3.7.1 libnetapi-devel-32bit-4.13.6+git.211.555d60b24ba-3.7.1 libnetapi0-32bit-4.13.6+git.211.555d60b24ba-3.7.1 libnetapi0-32bit-debuginfo-4.13.6+git.211.555d60b24ba-3.7.1 libsamba-credentials0-32bit-4.13.6+git.211.555d60b24ba-3.7.1 libsamba-credentials0-32bit-debuginfo-4.13.6+git.211.555d60b24ba-3.7.1 libsamba-errors0-32bit-4.13.6+git.211.555d60b24ba-3.7.1 libsamba-errors0-32bit-debuginfo-4.13.6+git.211.555d60b24ba-3.7.1 libsamba-hostconfig0-32bit-4.13.6+git.211.555d60b24ba-3.7.1 libsamba-hostconfig0-32bit-debuginfo-4.13.6+git.211.555d60b24ba-3.7.1 libsamba-passdb0-32bit-4.13.6+git.211.555d60b24ba-3.7.1 libsamba-passdb0-32bit-debuginfo-4.13.6+git.211.555d60b24ba-3.7.1 libsamba-policy0-python3-32bit-4.13.6+git.211.555d60b24ba-3.7.1 libsamba-policy0-python3-32bit-debuginfo-4.13.6+git.211.555d60b24ba-3.7.1 libsamba-util0-32bit-4.13.6+git.211.555d60b24ba-3.7.1 libsamba-util0-32bit-debuginfo-4.13.6+git.211.555d60b24ba-3.7.1 libsamdb0-32bit-4.13.6+git.211.555d60b24ba-3.7.1 libsamdb0-32bit-debuginfo-4.13.6+git.211.555d60b24ba-3.7.1 libsmbclient0-32bit-4.13.6+git.211.555d60b24ba-3.7.1 libsmbclient0-32bit-debuginfo-4.13.6+git.211.555d60b24ba-3.7.1 libsmbconf0-32bit-4.13.6+git.211.555d60b24ba-3.7.1 libsmbconf0-32bit-debuginfo-4.13.6+git.211.555d60b24ba-3.7.1 libsmbldap2-32bit-4.13.6+git.211.555d60b24ba-3.7.1 libsmbldap2-32bit-debuginfo-4.13.6+git.211.555d60b24ba-3.7.1 libtevent-util0-32bit-4.13.6+git.211.555d60b24ba-3.7.1 libtevent-util0-32bit-debuginfo-4.13.6+git.211.555d60b24ba-3.7.1 libwbclient0-32bit-4.13.6+git.211.555d60b24ba-3.7.1 libwbclient0-32bit-debuginfo-4.13.6+git.211.555d60b24ba-3.7.1 samba-ad-dc-32bit-4.13.6+git.211.555d60b24ba-3.7.1 samba-ad-dc-32bit-debuginfo-4.13.6+git.211.555d60b24ba-3.7.1 samba-client-32bit-4.13.6+git.211.555d60b24ba-3.7.1 samba-client-32bit-debuginfo-4.13.6+git.211.555d60b24ba-3.7.1 samba-libs-32bit-4.13.6+git.211.555d60b24ba-3.7.1 samba-libs-32bit-debuginfo-4.13.6+git.211.555d60b24ba-3.7.1 samba-libs-python3-32bit-4.13.6+git.211.555d60b24ba-3.7.1 samba-libs-python3-32bit-debuginfo-4.13.6+git.211.555d60b24ba-3.7.1 samba-winbind-32bit-4.13.6+git.211.555d60b24ba-3.7.1 samba-winbind-32bit-debuginfo-4.13.6+git.211.555d60b24ba-3.7.1 - openSUSE Leap 15.3 (noarch): samba-doc-4.13.6+git.211.555d60b24ba-3.7.1 References: https://www.suse.com/security/cve/CVE-2020-27840.html https://www.suse.com/security/cve/CVE-2021-20254.html https://www.suse.com/security/cve/CVE-2021-20277.html https://bugzilla.suse.com/1182830 https://bugzilla.suse.com/1183572 https://bugzilla.suse.com/1183574 https://bugzilla.suse.com/1184677 https://bugzilla.suse.com/1189875

1 0

openSUSE-RU-2021:3186-1: moderate: Recommended update for gtk3
by maintenance＠opensuse.org 22 Sep '21

22 Sep '21

openSUSE Recommended Update: Recommended update for gtk3 ______________________________________________________________________________ Announcement ID: openSUSE-RU-2021:3186-1 Rating: moderate References: #1094486 #1189238 Affected Products: openSUSE Leap 15.3 ______________________________________________________________________________ An update that has two recommended fixes can now be installed. Description: This update for gtk3 fixes the following issue: - Ensure printer entries from Avahi are usable (bsc#1094486, bsc#1189238). Patch Instructions: To install this openSUSE Recommended Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 15.3: zypper in -t patch openSUSE-SLE-15.3-2021-3186=1 Package List: - openSUSE Leap 15.3 (aarch64 ppc64le s390x x86_64): gettext-its-gtk3-3.24.20-3.6.1 gtk3-debugsource-3.24.20-3.6.1 gtk3-devel-3.24.20-3.6.1 gtk3-devel-debuginfo-3.24.20-3.6.1 gtk3-devel-doc-3.24.20-3.6.1 gtk3-immodule-amharic-3.24.20-3.6.1 gtk3-immodule-amharic-debuginfo-3.24.20-3.6.1 gtk3-immodule-broadway-3.24.20-3.6.1 gtk3-immodule-broadway-debuginfo-3.24.20-3.6.1 gtk3-immodule-inuktitut-3.24.20-3.6.1 gtk3-immodule-inuktitut-debuginfo-3.24.20-3.6.1 gtk3-immodule-multipress-3.24.20-3.6.1 gtk3-immodule-multipress-debuginfo-3.24.20-3.6.1 gtk3-immodule-thai-3.24.20-3.6.1 gtk3-immodule-thai-debuginfo-3.24.20-3.6.1 gtk3-immodule-tigrigna-3.24.20-3.6.1 gtk3-immodule-tigrigna-debuginfo-3.24.20-3.6.1 gtk3-immodule-vietnamese-3.24.20-3.6.1 gtk3-immodule-vietnamese-debuginfo-3.24.20-3.6.1 gtk3-immodule-wayland-3.24.20-3.6.1 gtk3-immodule-wayland-debuginfo-3.24.20-3.6.1 gtk3-immodule-xim-3.24.20-3.6.1 gtk3-immodule-xim-debuginfo-3.24.20-3.6.1 gtk3-tools-3.24.20-3.6.1 gtk3-tools-debuginfo-3.24.20-3.6.1 libgtk-3-0-3.24.20-3.6.1 libgtk-3-0-debuginfo-3.24.20-3.6.1 typelib-1_0-Gtk-3_0-3.24.20-3.6.1 - openSUSE Leap 15.3 (x86_64): gtk3-devel-32bit-3.24.20-3.6.1 gtk3-devel-32bit-debuginfo-3.24.20-3.6.1 gtk3-immodule-amharic-32bit-3.24.20-3.6.1 gtk3-immodule-amharic-32bit-debuginfo-3.24.20-3.6.1 gtk3-immodule-inuktitut-32bit-3.24.20-3.6.1 gtk3-immodule-inuktitut-32bit-debuginfo-3.24.20-3.6.1 gtk3-immodule-multipress-32bit-3.24.20-3.6.1 gtk3-immodule-multipress-32bit-debuginfo-3.24.20-3.6.1 gtk3-immodule-thai-32bit-3.24.20-3.6.1 gtk3-immodule-thai-32bit-debuginfo-3.24.20-3.6.1 gtk3-immodule-tigrigna-32bit-3.24.20-3.6.1 gtk3-immodule-tigrigna-32bit-debuginfo-3.24.20-3.6.1 gtk3-immodule-vietnamese-32bit-3.24.20-3.6.1 gtk3-immodule-vietnamese-32bit-debuginfo-3.24.20-3.6.1 gtk3-immodule-wayland-32bit-3.24.20-3.6.1 gtk3-immodule-wayland-32bit-debuginfo-3.24.20-3.6.1 gtk3-immodule-xim-32bit-3.24.20-3.6.1 gtk3-immodule-xim-32bit-debuginfo-3.24.20-3.6.1 gtk3-tools-32bit-3.24.20-3.6.1 gtk3-tools-32bit-debuginfo-3.24.20-3.6.1 libgtk-3-0-32bit-3.24.20-3.6.1 libgtk-3-0-32bit-debuginfo-3.24.20-3.6.1 - openSUSE Leap 15.3 (noarch): gtk3-branding-upstream-3.24.20-3.6.1 gtk3-data-3.24.20-3.6.1 gtk3-lang-3.24.20-3.6.1 gtk3-schema-3.24.20-3.6.1 References: https://bugzilla.suse.com/1094486 https://bugzilla.suse.com/1189238

1 0

openSUSE-RU-2021:3183-1: Recommended update for lsvpd
by maintenance＠opensuse.org 22 Sep '21

22 Sep '21

openSUSE Recommended Update: Recommended update for lsvpd ______________________________________________________________________________ Announcement ID: openSUSE-RU-2021:3183-1 Rating: low References: Affected Products: openSUSE Leap 15.3 ______________________________________________________________________________ An update that has 0 recommended fixes can now be installed. Description: This update for lsvpd fixes the following issues: - Drop upstreamed patches that are already fixed in the sources itself. Patch Instructions: To install this openSUSE Recommended Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 15.3: zypper in -t patch openSUSE-SLE-15.3-2021-3183=1 Package List: - openSUSE Leap 15.3 (ppc64le): lsvpd-1.7.12-3.12.1 lsvpd-debuginfo-1.7.12-3.12.1 lsvpd-debugsource-1.7.12-3.12.1 References:

1 0

openSUSE-SU-2021:1300-1: important: Security update for chromium
by opensuse-security＠opensuse.org 22 Sep '21

22 Sep '21

openSUSE Security Update: Security update for chromium ______________________________________________________________________________ Announcement ID: openSUSE-SU-2021:1300-1 Rating: important References: #1190096 #1190476 Cross-References: CVE-2021-30606 CVE-2021-30607 CVE-2021-30608 CVE-2021-30609 CVE-2021-30610 CVE-2021-30611 CVE-2021-30612 CVE-2021-30613 CVE-2021-30614 CVE-2021-30615 CVE-2021-30616 CVE-2021-30617 CVE-2021-30618 CVE-2021-30619 CVE-2021-30620 CVE-2021-30621 CVE-2021-30622 CVE-2021-30623 CVE-2021-30624 CVE-2021-30625 CVE-2021-30626 CVE-2021-30627 CVE-2021-30628 CVE-2021-30629 CVE-2021-30630 CVE-2021-30631 CVE-2021-30632 CVE-2021-30633 Affected Products: openSUSE Backports SLE-15-SP3 ______________________________________________________________________________ An update that fixes 28 vulnerabilities is now available. Description: This update for chromium fixes the following issues: Chromium 93.0.4577.63 (boo#1190096): * CVE-2021-30606: Use after free in Blink * CVE-2021-30607: Use after free in Permissions * CVE-2021-30608: Use after free in Web Share * CVE-2021-30609: Use after free in Sign-In * CVE-2021-30610: Use after free in Extensions API * CVE-2021-30611: Use after free in WebRTC * CVE-2021-30612: Use after free in WebRTC * CVE-2021-30613: Use after free in Base internals * CVE-2021-30614: Heap buffer overflow in TabStrip * CVE-2021-30615: Cross-origin data leak in Navigation * CVE-2021-30616: Use after free in Media * CVE-2021-30617: Policy bypass in Blink * CVE-2021-30618: Inappropriate implementation in DevTools * CVE-2021-30619: UI Spoofing in Autofill * CVE-2021-30620: Insufficient policy enforcement in Blink * CVE-2021-30621: UI Spoofing in Autofill * CVE-2021-30622: Use after free in WebApp Installs * CVE-2021-30623: Use after free in Bookmarks * CVE-2021-30624: Use after free in Autofill Chromium 93.0.4577.82 (boo#1190476): * CVE-2021-30625: Use after free in Selection API * CVE-2021-30626: Out of bounds memory access in ANGLE * CVE-2021-30627: Type Confusion in Blink layout * CVE-2021-30628: Stack buffer overflow in ANGLE * CVE-2021-30629: Use after free in Permissions * CVE-2021-30630: Inappropriate implementation in Blink * CVE-2021-30631: Type Confusion in Blink layout * CVE-2021-30632: Out of bounds write in V8 * CVE-2021-30633: Use after free in Indexed DB API Patch Instructions: To install this openSUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Backports SLE-15-SP3: zypper in -t patch openSUSE-2021-1300=1 Package List: - openSUSE Backports SLE-15-SP3 (aarch64 x86_64): chromedriver-93.0.4577.82-bp153.2.28.1 chromium-93.0.4577.82-bp153.2.28.1 References: https://www.suse.com/security/cve/CVE-2021-30606.html https://www.suse.com/security/cve/CVE-2021-30607.html https://www.suse.com/security/cve/CVE-2021-30608.html https://www.suse.com/security/cve/CVE-2021-30609.html https://www.suse.com/security/cve/CVE-2021-30610.html https://www.suse.com/security/cve/CVE-2021-30611.html https://www.suse.com/security/cve/CVE-2021-30612.html https://www.suse.com/security/cve/CVE-2021-30613.html https://www.suse.com/security/cve/CVE-2021-30614.html https://www.suse.com/security/cve/CVE-2021-30615.html https://www.suse.com/security/cve/CVE-2021-30616.html https://www.suse.com/security/cve/CVE-2021-30617.html https://www.suse.com/security/cve/CVE-2021-30618.html https://www.suse.com/security/cve/CVE-2021-30619.html https://www.suse.com/security/cve/CVE-2021-30620.html https://www.suse.com/security/cve/CVE-2021-30621.html https://www.suse.com/security/cve/CVE-2021-30622.html https://www.suse.com/security/cve/CVE-2021-30623.html https://www.suse.com/security/cve/CVE-2021-30624.html https://www.suse.com/security/cve/CVE-2021-30625.html https://www.suse.com/security/cve/CVE-2021-30626.html https://www.suse.com/security/cve/CVE-2021-30627.html https://www.suse.com/security/cve/CVE-2021-30628.html https://www.suse.com/security/cve/CVE-2021-30629.html https://www.suse.com/security/cve/CVE-2021-30630.html https://www.suse.com/security/cve/CVE-2021-30631.html https://www.suse.com/security/cve/CVE-2021-30632.html https://www.suse.com/security/cve/CVE-2021-30633.html https://bugzilla.suse.com/1190096 https://bugzilla.suse.com/1190476

1 0

openSUSE-RU-2021:1302-1: moderate: Recommended update for gedit-plugins
by maintenance＠opensuse.org 22 Sep '21

22 Sep '21

openSUSE Recommended Update: Recommended update for gedit-plugins ______________________________________________________________________________ Announcement ID: openSUSE-RU-2021:1302-1 Rating: moderate References: #1174749 Affected Products: openSUSE Leap 15.2 ______________________________________________________________________________ An update that has one recommended fix can now be installed. Description: This update for gedit-plugins fixes the following issues: - VTE changed its API which makes change directory of terminal failed, this patch updates arguments to match VTE's API (boo#1174749, glgo#GNOME/gedit-plugins#1). Patch Instructions: To install this openSUSE Recommended Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 15.2: zypper in -t patch openSUSE-2021-1302=1 Package List: - openSUSE Leap 15.2 (x86_64): gedit-plugin-bookmarks-3.28.1-lp152.4.3.1 gedit-plugin-bookmarks-debuginfo-3.28.1-lp152.4.3.1 gedit-plugin-bracketcompletion-3.28.1-lp152.4.3.1 gedit-plugin-charmap-3.28.1-lp152.4.3.1 gedit-plugin-codecomment-3.28.1-lp152.4.3.1 gedit-plugin-colorpicker-3.28.1-lp152.4.3.1 gedit-plugin-colorschemer-3.28.1-lp152.4.3.1 gedit-plugin-commander-3.28.1-lp152.4.3.1 gedit-plugin-dashboard-3.28.1-lp152.4.3.1 gedit-plugin-drawspaces-3.28.1-lp152.4.3.1 gedit-plugin-drawspaces-debuginfo-3.28.1-lp152.4.3.1 gedit-plugin-findinfiles-3.28.1-lp152.4.3.1 gedit-plugin-findinfiles-debuginfo-3.28.1-lp152.4.3.1 gedit-plugin-git-3.28.1-lp152.4.3.1 gedit-plugin-joinlines-3.28.1-lp152.4.3.1 gedit-plugin-multiedit-3.28.1-lp152.4.3.1 gedit-plugin-smartspaces-3.28.1-lp152.4.3.1 gedit-plugin-synctex-3.28.1-lp152.4.3.1 gedit-plugin-terminal-3.28.1-lp152.4.3.1 gedit-plugin-textsize-3.28.1-lp152.4.3.1 gedit-plugin-translate-3.28.1-lp152.4.3.1 gedit-plugin-wordcompletion-3.28.1-lp152.4.3.1 gedit-plugin-wordcompletion-debuginfo-3.28.1-lp152.4.3.1 gedit-plugin-zeitgeist-3.28.1-lp152.4.3.1 gedit-plugin-zeitgeist-debuginfo-3.28.1-lp152.4.3.1 gedit-plugins-3.28.1-lp152.4.3.1 gedit-plugins-data-3.28.1-lp152.4.3.1 gedit-plugins-debuginfo-3.28.1-lp152.4.3.1 gedit-plugins-debugsource-3.28.1-lp152.4.3.1 - openSUSE Leap 15.2 (noarch): gedit-plugins-lang-3.28.1-lp152.4.3.1 References: https://bugzilla.suse.com/1174749

1 0

openSUSE-SU-2021:1301-1: moderate: Security update for xen
by opensuse-security＠opensuse.org 22 Sep '21

22 Sep '21

openSUSE Security Update: Security update for xen ______________________________________________________________________________ Announcement ID: openSUSE-SU-2021:1301-1 Rating: moderate References: #1027519 #1189632 Cross-References: CVE-2021-28701 CVSS scores: CVE-2021-28701 (SUSE): 7.4 CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H Affected Products: openSUSE Leap 15.2 ______________________________________________________________________________ An update that solves one vulnerability and has one errata is now available. Description: This update for xen fixes the following issues: - CVE-2021-28701: Fixed race condition in XENMAPSPACE_grant_table handling (XSA-384) (bsc#1189632). - Upstream bug fixes (bsc#1027519) This update was imported from the SUSE:SLE-15-SP2:Update update project. Patch Instructions: To install this openSUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 15.2: zypper in -t patch openSUSE-2021-1301=1 Package List: - openSUSE Leap 15.2 (i586 x86_64): xen-debugsource-4.13.3_04-lp152.2.30.1 xen-devel-4.13.3_04-lp152.2.30.1 xen-libs-4.13.3_04-lp152.2.30.1 xen-libs-debuginfo-4.13.3_04-lp152.2.30.1 xen-tools-domU-4.13.3_04-lp152.2.30.1 xen-tools-domU-debuginfo-4.13.3_04-lp152.2.30.1 - openSUSE Leap 15.2 (noarch): xen-tools-xendomains-wait-disk-4.13.3_04-lp152.2.30.1 - openSUSE Leap 15.2 (x86_64): xen-4.13.3_04-lp152.2.30.1 xen-doc-html-4.13.3_04-lp152.2.30.1 xen-libs-32bit-4.13.3_04-lp152.2.30.1 xen-libs-32bit-debuginfo-4.13.3_04-lp152.2.30.1 xen-tools-4.13.3_04-lp152.2.30.1 xen-tools-debuginfo-4.13.3_04-lp152.2.30.1 References: https://www.suse.com/security/cve/CVE-2021-28701.html https://bugzilla.suse.com/1027519 https://bugzilla.suse.com/1189632

1 0

openSUSE-RU-2021:1298-1: moderate: Recommended update for salt
by maintenance＠opensuse.org 21 Sep '21

21 Sep '21

openSUSE Recommended Update: Recommended update for salt ______________________________________________________________________________ Announcement ID: openSUSE-RU-2021:1298-1 Rating: moderate References: #1168327 #1188259 #1188647 #1189040 Affected Products: openSUSE Leap 15.2 ______________________________________________________________________________ An update that has four recommended fixes can now be installed. Description: This update for salt fixes the following issues: - Fix wrong relative paths resolution with Jinja renderer when importing subdirectories - Don't pass 'shell="/sbin/nologin"' to 'onlyif/unless' checks (bsc#1188259) - Add missing 'aarch64' to rpm package architectures - Fix failing tests for 'CMDRunRedirect' - Fix failing unit test for systemd - Fix error handling in openscap module (bsc#1188647) - Better handling of bad public keys from minions (bsc#1189040) - Add standalone formulas configuration for salt minion and remove salt-master requirement (bsc#1168327) This update was imported from the SUSE:SLE-15-SP2:Update update project. Patch Instructions: To install this openSUSE Recommended Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 15.2: zypper in -t patch openSUSE-2021-1298=1 Package List: - openSUSE Leap 15.2 (noarch): salt-bash-completion-3002.2-lp152.3.42.1 salt-fish-completion-3002.2-lp152.3.42.1 salt-zsh-completion-3002.2-lp152.3.42.1 - openSUSE Leap 15.2 (x86_64): python3-salt-3002.2-lp152.3.42.1 salt-3002.2-lp152.3.42.1 salt-api-3002.2-lp152.3.42.1 salt-cloud-3002.2-lp152.3.42.1 salt-doc-3002.2-lp152.3.42.1 salt-master-3002.2-lp152.3.42.1 salt-minion-3002.2-lp152.3.42.1 salt-proxy-3002.2-lp152.3.42.1 salt-ssh-3002.2-lp152.3.42.1 salt-standalone-formulas-configuration-3002.2-lp152.3.42.1 salt-syndic-3002.2-lp152.3.42.1 salt-transactional-update-3002.2-lp152.3.42.1 References: https://bugzilla.suse.com/1168327 https://bugzilla.suse.com/1188259 https://bugzilla.suse.com/1188647 https://bugzilla.suse.com/1189040

1 0

openSUSE-SU-2021:1294-1: moderate: Security update for libcroco
by opensuse-security＠opensuse.org 21 Sep '21

21 Sep '21

openSUSE Security Update: Security update for libcroco ______________________________________________________________________________ Announcement ID: openSUSE-SU-2021:1294-1 Rating: moderate References: #1171685 Cross-References: CVE-2020-12825 CVSS scores: CVE-2020-12825 (NVD) : 7.1 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:H CVE-2020-12825 (SUSE): 2.8 CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:N/I:N/A:L Affected Products: openSUSE Leap 15.2 ______________________________________________________________________________ An update that fixes one vulnerability is now available. Description: This update for libcroco fixes the following issues: - CVE-2020-12825: Fixed recursion issue in block and any productions (bsc#1171685). This update was imported from the SUSE:SLE-15-SP2:Update update project. Patch Instructions: To install this openSUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 15.2: zypper in -t patch openSUSE-2021-1294=1 Package List: - openSUSE Leap 15.2 (i586 x86_64): libcroco-0.6.13-lp152.2.3.1 libcroco-0_6-3-0.6.13-lp152.2.3.1 libcroco-0_6-3-debuginfo-0.6.13-lp152.2.3.1 libcroco-debuginfo-0.6.13-lp152.2.3.1 libcroco-debugsource-0.6.13-lp152.2.3.1 libcroco-devel-0.6.13-lp152.2.3.1 - openSUSE Leap 15.2 (x86_64): libcroco-0_6-3-32bit-0.6.13-lp152.2.3.1 libcroco-0_6-3-32bit-debuginfo-0.6.13-lp152.2.3.1 References: https://www.suse.com/security/cve/CVE-2020-12825.html https://bugzilla.suse.com/1171685

1 0

openSUSE-RU-2021:1297-1: moderate: Recommended update for rpmlint
by maintenance＠opensuse.org 21 Sep '21

21 Sep '21

openSUSE Recommended Update: Recommended update for rpmlint ______________________________________________________________________________ Announcement ID: openSUSE-RU-2021:1297-1 Rating: moderate References: #1169494 #1189106 Affected Products: openSUSE Leap 15.2 ______________________________________________________________________________ An update that has two recommended fixes can now be installed. Description: This update for rpmlint fixes the following issues: - Backport whitelisting of oddjob (bsc#1189106, bsc#1169494). This update was imported from the SUSE:SLE-15:Update update project. Patch Instructions: To install this openSUSE Recommended Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 15.2: zypper in -t patch openSUSE-2021-1297=1 Package List: - openSUSE Leap 15.2 (x86_64): rpmlint-tests-debugsource-84.87+git20181018.60e0249-lp152.12.9.1 - openSUSE Leap 15.2 (noarch): rpmlint-1.10-lp152.12.9.1 References: https://bugzilla.suse.com/1169494 https://bugzilla.suse.com/1189106

1 0

openSUSE-RU-2021:1296-1: moderate: Recommended update for xorg-x11-fonts
by maintenance＠opensuse.org 21 Sep '21

21 Sep '21

openSUSE Recommended Update: Recommended update for xorg-x11-fonts ______________________________________________________________________________ Announcement ID: openSUSE-RU-2021:1296-1 Rating: moderate References: #1174895 Affected Products: openSUSE Leap 15.2 ______________________________________________________________________________ An update that has one recommended fix can now be installed. Description: This update for xorg-x11-fonts fixes the following issues: - Convert the 'helv*.otb' and 'cour*.otb' files in a different way, generating all available font sizes. (bsc#1174895) - As part of the above fix, don't remove the "Regular" suffix from the full name of fonts in 'convertfont.py' This update for fonttosfnt fixes the following issues: - Fix more metric calculations (bsc#1174895): This update was imported from the SUSE:SLE-15-SP2:Update update project. Patch Instructions: To install this openSUSE Recommended Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 15.2: zypper in -t patch openSUSE-2021-1296=1 Package List: - openSUSE Leap 15.2 (i586 x86_64): fonttosfnt-1.1.0-lp152.2.5.1 fonttosfnt-debuginfo-1.1.0-lp152.2.5.1 fonttosfnt-debugsource-1.1.0-lp152.2.5.1 - openSUSE Leap 15.2 (noarch): xorg-x11-fonts-7.6-lp152.7.6.1 xorg-x11-fonts-converted-7.6-lp152.7.6.1 xorg-x11-fonts-core-7.6-lp152.7.6.1 xorg-x11-fonts-legacy-7.6-lp152.7.6.1 References: https://bugzilla.suse.com/1174895

1 0

openSUSE-RU-2021:1295-1: moderate: Recommended update for gimp
by maintenance＠opensuse.org 21 Sep '21

21 Sep '21

openSUSE Recommended Update: Recommended update for gimp ______________________________________________________________________________ Announcement ID: openSUSE-RU-2021:1295-1 Rating: moderate References: #1178726 #1180362 #1180770 Affected Products: openSUSE Leap 15.2 ______________________________________________________________________________ An update that has three recommended fixes can now be installed. Description: This update for gimp fixes the following issues: - Recurse directories when looking for python plugins (bsc#1180362) This update was imported from the SUSE:SLE-15-SP2:Update update project. Patch Instructions: To install this openSUSE Recommended Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 15.2: zypper in -t patch openSUSE-2021-1295=1 Package List: - openSUSE Leap 15.2 (i586 x86_64): gimp-2.10.12-lp152.2.6.1 gimp-debuginfo-2.10.12-lp152.2.6.1 gimp-debugsource-2.10.12-lp152.2.6.1 gimp-devel-2.10.12-lp152.2.6.1 gimp-devel-debuginfo-2.10.12-lp152.2.6.1 gimp-plugin-aa-2.10.12-lp152.2.6.1 gimp-plugin-aa-debuginfo-2.10.12-lp152.2.6.1 gimp-plugins-python-2.10.12-lp152.2.6.1 gimp-plugins-python-debuginfo-2.10.12-lp152.2.6.1 libgimp-2_0-0-2.10.12-lp152.2.6.1 libgimp-2_0-0-debuginfo-2.10.12-lp152.2.6.1 libgimpui-2_0-0-2.10.12-lp152.2.6.1 libgimpui-2_0-0-debuginfo-2.10.12-lp152.2.6.1 - openSUSE Leap 15.2 (noarch): gimp-lang-2.10.12-lp152.2.6.1 - openSUSE Leap 15.2 (x86_64): libgimp-2_0-0-32bit-2.10.12-lp152.2.6.1 libgimp-2_0-0-32bit-debuginfo-2.10.12-lp152.2.6.1 libgimpui-2_0-0-32bit-2.10.12-lp152.2.6.1 libgimpui-2_0-0-32bit-debuginfo-2.10.12-lp152.2.6.1 References: https://bugzilla.suse.com/1178726 https://bugzilla.suse.com/1180362 https://bugzilla.suse.com/1180770

1 0

openSUSE-RU-2021:1291-1: important: Recommended update for java-11-openjdk
by maintenance＠opensuse.org 21 Sep '21

21 Sep '21

openSUSE Recommended Update: Recommended update for java-11-openjdk ______________________________________________________________________________ Announcement ID: openSUSE-RU-2021:1291-1 Rating: important References: #1189201 #1190252 Affected Products: openSUSE Leap 15.2 ______________________________________________________________________________ An update that has two recommended fixes can now be installed. Description: This update for java-11-openjdk fixes the following issues: - Implement FIPS support in OpenJDK - Fix build with 'glibc-2.34' (bsc#1189201) - Add support for 'riscv64' (zero VM) - Make NSS the default security provider. (bsc#1190252) This update was imported from the SUSE:SLE-15:Update update project. Patch Instructions: To install this openSUSE Recommended Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 15.2: zypper in -t patch openSUSE-2021-1291=1 Package List: - openSUSE Leap 15.2 (i586 x86_64): java-11-openjdk-11.0.12.0-lp152.2.18.1 java-11-openjdk-accessibility-11.0.12.0-lp152.2.18.1 java-11-openjdk-accessibility-debuginfo-11.0.12.0-lp152.2.18.1 java-11-openjdk-debuginfo-11.0.12.0-lp152.2.18.1 java-11-openjdk-debugsource-11.0.12.0-lp152.2.18.1 java-11-openjdk-demo-11.0.12.0-lp152.2.18.1 java-11-openjdk-devel-11.0.12.0-lp152.2.18.1 java-11-openjdk-headless-11.0.12.0-lp152.2.18.1 java-11-openjdk-jmods-11.0.12.0-lp152.2.18.1 java-11-openjdk-src-11.0.12.0-lp152.2.18.1 - openSUSE Leap 15.2 (noarch): java-11-openjdk-javadoc-11.0.12.0-lp152.2.18.1 References: https://bugzilla.suse.com/1189201 https://bugzilla.suse.com/1190252

1 0

openSUSE-RU-2021:1293-1: moderate: Recommended update for mozilla-nspr, mozilla-nss
by maintenance＠opensuse.org 21 Sep '21

21 Sep '21

openSUSE Recommended Update: Recommended update for mozilla-nspr, mozilla-nss ______________________________________________________________________________ Announcement ID: openSUSE-RU-2021:1293-1 Rating: moderate References: #1029961 #1174697 #1176206 #1176934 #1179382 #1188891 Affected Products: openSUSE Leap 15.2 ______________________________________________________________________________ An update that has 6 recommended fixes can now be installed. Description: This update for mozilla-nspr fixes the following issues: mozilla-nspr was updated to version 4.32: * implement new socket option PR_SockOpt_DontFrag * support larger DNS records by increasing the default buffer size for DNS queries * Lock access to PRCallOnceType members in PR_CallOnce* for thread safety bmo#1686138 * PR_GetSystemInfo supports a new flag PR_SI_RELEASE_BUILD to get information about the operating system build version. Mozilla NSS was updated to version 3.68: * bmo#1713562 - Fix test leak. * bmo#1717452 - NSS 3.68 should depend on NSPR 4.32. * bmo#1693206 - Implement PKCS8 export of ECDSA keys. * bmo#1712883 - DTLS 1.3 draft-43. * bmo#1655493 - Support SHA2 HW acceleration using Intel SHA Extension. * bmo#1713562 - Validate ECH public names. * bmo#1717610 - Add function to get seconds from epoch from pkix::Time. update to NSS 3.67 * bmo#1683710 - Add a means to disable ALPN. * bmo#1715720 - Fix nssckbi version number in NSS 3.67 (was supposed to be incremented in 3.66). * bmo#1714719 - Set NSS_USE_64 on riscv64 target when using GYP/Ninja. * bmo#1566124 - Fix counter increase in ppc-gcm-wrap.c. * bmo#1566124 - Fix AES_GCM mode on ppc64le for messages of length more than 255-byte. update to NSS 3.66 * bmo#1710716 - Remove Expired Sonera Class2 CA from NSS. * bmo#1710716 - Remove Expired Root Certificates from NSS - QuoVadis Root Certification Authority. * bmo#1708307 - Remove Trustis FPS Root CA from NSS. * bmo#1707097 - Add Certum Trusted Root CA to NSS. * bmo#1707097 - Add Certum EC-384 CA to NSS. * bmo#1703942 - Add ANF Secure Server Root CA to NSS. * bmo#1697071 - Add GLOBALTRUST 2020 root cert to NSS. * bmo#1712184 - NSS tools manpages need to be updated to reflect that sqlite is the default database. * bmo#1712230 - Don't build ppc-gcm.s with clang integrated assembler. * bmo#1712211 - Strict prototype error when trying to compile nss code that includes blapi.h. * bmo#1710773 - NSS needs FIPS 180-3 FIPS indicators. * bmo#1709291 - Add VerifyCodeSigningCertificateChain. update to NSS 3.65 * bmo#1709654 - Update for NetBSD configuration. * bmo#1709750 - Disable HPKE test when fuzzing. * bmo#1566124 - Optimize AES-GCM for ppc64le. * bmo#1699021 - Add AES-256-GCM to HPKE. * bmo#1698419 - ECH -10 updates. * bmo#1692930 - Update HPKE to final version. * bmo#1707130 - NSS should use modern algorithms in PKCS#12 files by default. * bmo#1703936 - New coverity/cpp scanner errors. * bmo#1697303 - NSS needs to update it's csp clearing to FIPS 180-3 standards. * bmo#1702663 - Need to support RSA PSS with Hashing PKCS #11 Mechanisms. * bmo#1705119 - Deadlock when using GCM and non-thread safe tokens. update to NSS 3.64 * bmo#1705286 - Properly detect mips64. * bmo#1687164 - Introduce NSS_DISABLE_CRYPTO_VSX and disable_crypto_vsx. * bmo#1698320 - replace __builtin_cpu_supports("vsx") with ppc_crypto_support() for clang. * bmo#1613235 - Add POWER ChaCha20 stream cipher vector acceleration. Fixed in 3.63 * bmo#1697380 - Make a clang-format run on top of helpful contributions. * bmo#1683520 - ECCKiila P384, change syntax of nested structs initialization to prevent build isses with GCC 4.8. * bmo#1683520 - [lib/freebl/ecl] P-384: allow zero scalars in dual scalar multiplication. * bmo#1683520 - ECCKiila P521, change syntax of nested structs initialization to prevent build isses with GCC 4.8. * bmo#1683520 - [lib/freebl/ecl] P-521: allow zero scalars in dual scalar multiplication. * bmo#1696800 - HACL* update March 2021 - c95ab70fcb2bc21025d8845281bc4bc8987ca683. * bmo#1694214 - tstclnt can't enable middlebox compat mode. * bmo#1694392 - NSS does not work with PKCS #11 modules not supporting profiles. * bmo#1685880 - Minor fix to prevent unused variable on early return. * bmo#1685880 - Fix for the gcc compiler version 7 to support setenv with nss build. * bmo#1693217 - Increase nssckbi.h version number for March 2021 batch of root CA changes, CA list version 2.48. * bmo#1692094 - Set email distrust after to 21-03-01 for Camerfirma's 'Chambers of Commerce' and 'Global Chambersign' roots. * bmo#1618407 - Symantec root certs - Set CKA_NSS_EMAIL_DISTRUST_AFTER. * bmo#1693173 - Add GlobalSign R45, E45, R46, and E46 root certs to NSS. * bmo#1683738 - Add AC RAIZ FNMT-RCM SERVIDORES SEGUROS root cert to NSS. * bmo#1686854 - Remove GeoTrust PCA-G2 and VeriSign Universal root certs from NSS. * bmo#1687822 - Turn off Websites trust bit for the ��Staat der Nederlanden Root CA - G3�� root cert in NSS. * bmo#1692094 - Turn off Websites Trust Bit for 'Chambers of Commerce Root - 2008' and 'Global Chambersign Root - 2008��. * bmo#1694291 - Tracing fixes for ECH. update to NSS 3.62 * bmo#1688374 - Fix parallel build NSS-3.61 with make * bmo#1682044 - pkix_Build_GatherCerts() + pkix_CacheCert_Add() can corrupt "cachedCertTable" * bmo#1690583 - Fix CH padding extension size calculation * bmo#1690421 - Adjust 3.62 ABI report formatting for new libabigail * bmo#1690421 - Install packaged libabigail in docker-builds image * bmo#1689228 - Minor ECH -09 fixes for interop testing, fuzzing * bmo#1674819 - Fixup a51fae403328, enum type may be signed * bmo#1681585 - Add ECH support to selfserv * bmo#1681585 - Update ECH to Draft-09 * bmo#1678398 - Add Export/Import functions for HPKE context * bmo#1678398 - Update HPKE to draft-07 update to NSS 3.61 * bmo#1682071 - Fix issue with IKE Quick mode deriving incorrect key values under certain conditions. * bmo#1684300 - Fix default PBE iteration count when NSS is compiled with NSS_DISABLE_DBM. * bmo#1651411 - Improve constant-timeness in RSA operations. * bmo#1677207 - Upgrade Google Test version to latest release. * bmo#1654332 - Add aarch64-make target to nss-try. Update to NSS 3.60.1: Notable changes in NSS 3.60: * TLS 1.3 Encrypted Client Hello (draft-ietf-tls-esni-08) support has been added, replacing the previous ESNI (draft-ietf-tls-esni-01) implementation. See bmo#1654332 for more information. * December 2020 batch of Root CA changes, builtins library updated to version 2.46. See bmo#1678189, bmo#1678166, and bmo#1670769 for more information. Update to NSS 3.59.1: * bmo#1679290 - Fix potential deadlock with certain third-party PKCS11 modules Update to NSS 3.59: Notable changes: * Exported two existing functions from libnss: CERT_AddCertToListHeadWithData and CERT_AddCertToListTailWithData Bugfixes * bmo#1607449 - Lock cert->nssCertificate to prevent a potential data race * bmo#1672823 - Add Wycheproof test cases for HMAC, HKDF, and DSA * bmo#1663661 - Guard against NULL token in nssSlot_IsTokenPresent * bmo#1670835 - Support enabling and disabling signatures via Crypto Policy * bmo#1672291 - Resolve libpkix OCSP failures on SHA1 self-signed root certs when SHA1 signatures are disabled. * bmo#1644209 - Fix broken SelectedCipherSuiteReplacer filter to solve some test intermittents * bmo#1672703 - Tolerate the first CCS in TLS 1.3 to fix a regression in our CVE-2020-25648 fix that broke purple-discord (boo#1179382) * bmo#1666891 - Support key wrap/unwrap with RSA-OAEP * bmo#1667989 - Fix gyp linking on Solaris * bmo#1668123 - Export CERT_AddCertToListHeadWithData and CERT_AddCertToListTailWithData from libnss * bmo#1634584 - Set CKA_NSS_SERVER_DISTRUST_AFTER for Trustis FPS Root CA * bmo#1663091 - Remove unnecessary assertions in the streaming ASN.1 decoder that affected decoding certain PKCS8 private keys when using NSS debug builds * bmo#670839 - Use ARM crypto extension for AES, SHA1 and SHA2 on MacOS. update to NSS 3.58 Bugs fixed: * bmo#1641480 (CVE-2020-25648) Tighten CCS handling for middlebox compatibility mode. * bmo#1631890 - Add support for Hybrid Public Key Encryption (draft-irtf-cfrg-hpke) support for TLS Encrypted Client Hello (draft-ietf-tls-esni). * bmo#1657255 - Add CI tests that disable SHA1/SHA2 ARM crypto extensions. * bmo#1668328 - Handle spaces in the Python path name when using gyp on Windows. * bmo#1667153 - Add PK11_ImportDataKey for data object import. * bmo#1665715 - Pass the embedded SCT list extension (if present) to TrustDomain::CheckRevocation instead of the notBefore value. update to NSS 3.57 * The following CA certificates were Added: bmo#1663049 - CN=Trustwave Global Certification Authority SHA-256 Fingerprint: 97552015F5DDFC3C8788C006944555408894450084F100867086BC1A2BB58DC8 bmo#1663049 - CN=Trustwave Global ECC P256 Certification Authority SHA-256 Fingerprint: 945BBC825EA554F489D1FD51A73DDF2EA624AC7019A05205225C22A78CCFA8B4 bmo#1663049 - CN=Trustwave Global ECC P384 Certification Authority SHA-256 Fingerprint: 55903859C8C0C3EBB8759ECE4E2557225FF5758BBD38EBD48276601E1BD58097 * The following CA certificates were Removed: bmo#1651211 - CN=EE Certification Centre Root CA SHA-256 Fingerprint: 3E84BA4342908516E77573C0992F0979CA084E4685681FF195CCBA8A229B8A76 bmo#1656077 - O=Government Root Certification Authority; C=TW SHA-256 Fingerprint: 7600295EEFE85B9E1FD624DB76062AAAAE59818A54D2774CD4C0B2C01131E1B3 * Trust settings for the following CA certificates were Modified: bmo#1653092 - CN=OISTE WISeKey Global Root GA CA Websites (server authentication) trust bit removed. * https://developer.mozilla.org/en-US/docs/Mozilla/Projects/NSS/NSS_3.57_rele ase_notes update to NSS 3.56 Notable changes * bmo#1650702 - Support SHA-1 HW acceleration on ARMv8 * bmo#1656981 - Use MPI comba and mulq optimizations on x86-64 MacOS. * bmo#1654142 - Add CPU feature detection for Intel SHA extension. * bmo#1648822 - Add stricter validation of DH keys in FIPS mode. * bmo#1656986 - Properly detect arm64 during GYP build architecture detection. * bmo#1652729 - Add build flag to disable RC2 and relocate to lib/freebl/deprecated. * bmo#1656429 - Correct RTT estimate used in 0-RTT anti-replay. * bmo#1588941 - Send empty certificate message when scheme selection fails. * bmo#1652032 - Fix failure to build in Windows arm64 makefile cross-compilation. * bmo#1625791 - Fix deadlock issue in nssSlot_IsTokenPresent. * bmo#1653975 - Fix 3.53 regression by setting "all" as the default makefile target. * bmo#1659792 - Fix broken libpkix tests with unexpired PayPal cert. * bmo#1659814 - Fix interop.sh failures with newer tls-interop commit and dependencies. * bmo#1656519 - NSPR dependency updated to 4.28 update to NSS 3.55 Notable changes * P384 and P521 elliptic curve implementations are replaced with verifiable implementations from Fiat-Crypto [0] and ECCKiila [1]. * PK11_FindCertInSlot is added. With this function, a given slot can be queried with a DER-Encoded certificate, providing performance and usability improvements over other mechanisms. (bmo#1649633) * DTLS 1.3 implementation is updated to draft-38. (bmo#1647752) Relevant Bugfixes * bmo#1631583 (CVE-2020-6829, CVE-2020-12400) - Replace P384 and P521 with new, verifiable implementations from Fiat-Crypto and ECCKiila. * bmo#1649487 - Move overzealous assertion in VFY_EndWithSignature. * bmo#1631573 (CVE-2020-12401) - Remove unnecessary scalar padding. * bmo#1636771 (CVE-2020-12403) - Explicitly disable multi-part ChaCha20 (which was not functioning correctly) and more strictly enforce tag length. * bmo#1649648 - Don't memcpy zero bytes (sanitizer fix). * bmo#1649316 - Don't memcpy zero bytes (sanitizer fix). * bmo#1649322 - Don't memcpy zero bytes (sanitizer fix). * bmo#1653202 - Fix initialization bug in blapitest when compiled with NSS_DISABLE_DEPRECATED_SEED. * bmo#1646594 - Fix AVX2 detection in makefile builds. * bmo#1649633 - Add PK11_FindCertInSlot to search a given slot for a DER-encoded certificate. * bmo#1651520 - Fix slotLock race in NSC_GetTokenInfo. * bmo#1647752 - Update DTLS 1.3 implementation to draft-38. * bmo#1649190 - Run cipher, sdr, and ocsp tests under standard test cycle in CI. * bmo#1649226 - Add Wycheproof ECDSA tests. * bmo#1637222 - Consistently enforce IV requirements for DES and 3DES. * bmo#1067214 - Enforce minimum PKCS#1 v1.5 padding length in RSA_CheckSignRecover. * bmo#1646324 - Advertise PKCS#1 schemes for certificates in the signature_algorithms extension. update to NSS 3.54 Notable changes * Support for TLS 1.3 external pre-shared keys (bmo#1603042). * Use ARM Cryptography Extension for SHA256, when available (bmo#1528113) * The following CA certificates were Added: bmo#1645186 - certSIGN Root CA G2. bmo#1645174 - e-Szigno Root CA 2017. bmo#1641716 - Microsoft ECC Root Certificate Authority 2017. bmo#1641716 - Microsoft RSA Root Certificate Authority 2017. * The following CA certificates were Removed: bmo#1645199 - AddTrust Class 1 CA Root. bmo#1645199 - AddTrust External CA Root. bmo#1641718 - LuxTrust Global Root 2. bmo#1639987 - Staat der Nederlanden Root CA - G2. bmo#1618402 - Symantec Class 2 Public Primary Certification Authority - G4. bmo#1618402 - Symantec Class 1 Public Primary Certification Authority - G4. bmo#1618402 - VeriSign Class 3 Public Primary Certification Authority - G3. * A number of certificates had their Email trust bit disabled. See bmo#1618402 for a complete list. Bugs fixed * bmo#1528113 - Use ARM Cryptography Extension for SHA256. * bmo#1603042 - Add TLS 1.3 external PSK support. * bmo#1642802 - Add uint128 support for HACL* curve25519 on Windows. * bmo#1645186 - Add "certSIGN Root CA G2" root certificate. * bmo#1645174 - Add Microsec's "e-Szigno Root CA 2017" root certificate. * bmo#1641716 - Add Microsoft's non-EV root certificates. * bmo1621151 - Disable email trust bit for "O=Government Root Certification Authority; C=TW" root. * bmo#1645199 - Remove AddTrust root certificates. * bmo#1641718 - Remove "LuxTrust Global Root 2" root certificate. * bmo#1639987 - Remove "Staat der Nederlanden Root CA - G2" root certificate. * bmo#1618402 - Remove Symantec root certificates and disable email trust bit. * bmo#1640516 - NSS 3.54 should depend on NSPR 4.26. * bmo#1642146 - Fix undefined reference to `PORT_ZAlloc_stub' in seed.c. * bmo#1642153 - Fix infinite recursion building NSS. * bmo#1642638 - Fix fuzzing assertion crash. * bmo#1642871 - Enable SSL_SendSessionTicket after resumption. * bmo#1643123 - Support SSL_ExportEarlyKeyingMaterial with External PSKs. * bmo#1643557 - Fix numerous compile warnings in NSS. * bmo#1644774 - SSL gtests to use ClearServerCache when resetting self-encrypt keys. * bmo#1645479 - Don't use SECITEM_MakeItem in secutil.c. * bmo#1646520 - Stricter enforcement of ASN.1 INTEGER encoding. This update was imported from the SUSE:SLE-15:Update update project. Patch Instructions: To install this openSUSE Recommended Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 15.2: zypper in -t patch openSUSE-2021-1293=1 Package List: - openSUSE Leap 15.2 (i586 x86_64): libfreebl3-3.68-lp152.2.10.1 libfreebl3-debuginfo-3.68-lp152.2.10.1 libfreebl3-hmac-3.68-lp152.2.10.1 libsoftokn3-3.68-lp152.2.10.1 libsoftokn3-debuginfo-3.68-lp152.2.10.1 libsoftokn3-hmac-3.68-lp152.2.10.1 mozilla-nspr-4.32-lp152.2.6.1 mozilla-nspr-debuginfo-4.32-lp152.2.6.1 mozilla-nspr-debugsource-4.32-lp152.2.6.1 mozilla-nspr-devel-4.32-lp152.2.6.1 mozilla-nss-3.68-lp152.2.10.1 mozilla-nss-certs-3.68-lp152.2.10.1 mozilla-nss-certs-debuginfo-3.68-lp152.2.10.1 mozilla-nss-debuginfo-3.68-lp152.2.10.1 mozilla-nss-debugsource-3.68-lp152.2.10.1 mozilla-nss-devel-3.68-lp152.2.10.1 mozilla-nss-sysinit-3.68-lp152.2.10.1 mozilla-nss-sysinit-debuginfo-3.68-lp152.2.10.1 mozilla-nss-tools-3.68-lp152.2.10.1 mozilla-nss-tools-debuginfo-3.68-lp152.2.10.1 - openSUSE Leap 15.2 (x86_64): libfreebl3-32bit-3.68-lp152.2.10.1 libfreebl3-32bit-debuginfo-3.68-lp152.2.10.1 libfreebl3-hmac-32bit-3.68-lp152.2.10.1 libsoftokn3-32bit-3.68-lp152.2.10.1 libsoftokn3-32bit-debuginfo-3.68-lp152.2.10.1 libsoftokn3-hmac-32bit-3.68-lp152.2.10.1 mozilla-nspr-32bit-4.32-lp152.2.6.1 mozilla-nspr-32bit-debuginfo-4.32-lp152.2.6.1 mozilla-nss-32bit-3.68-lp152.2.10.1 mozilla-nss-32bit-debuginfo-3.68-lp152.2.10.1 mozilla-nss-certs-32bit-3.68-lp152.2.10.1 mozilla-nss-certs-32bit-debuginfo-3.68-lp152.2.10.1 mozilla-nss-sysinit-32bit-3.68-lp152.2.10.1 mozilla-nss-sysinit-32bit-debuginfo-3.68-lp152.2.10.1 References: https://bugzilla.suse.com/1029961 https://bugzilla.suse.com/1174697 https://bugzilla.suse.com/1176206 https://bugzilla.suse.com/1176934 https://bugzilla.suse.com/1179382 https://bugzilla.suse.com/1188891

1 0

openSUSE-SU-2021:3179-1: important: Security update for the Linux Kernel
by opensuse-security＠opensuse.org 21 Sep '21

21 Sep '21

openSUSE Security Update: Security update for the Linux Kernel ______________________________________________________________________________ Announcement ID: openSUSE-SU-2021:3179-1 Rating: important References: #1040364 #1127650 #1135481 #1152489 #1160010 #1168202 #1171420 #1174969 #1175052 #1175543 #1177399 #1180100 #1180141 #1180347 #1181006 #1181148 #1181972 #1184180 #1185902 #1186264 #1186731 #1187211 #1187455 #1187468 #1187483 #1187619 #1187959 #1188067 #1188172 #1188231 #1188270 #1188412 #1188418 #1188616 #1188700 #1188780 #1188781 #1188782 #1188783 #1188784 #1188786 #1188787 #1188788 #1188790 #1188878 #1188885 #1188924 #1188982 #1188983 #1188985 #1189021 #1189057 #1189077 #1189153 #1189197 #1189209 #1189210 #1189212 #1189213 #1189214 #1189215 #1189216 #1189217 #1189218 #1189219 #1189220 #1189221 #1189222 #1189225 #1189229 #1189233 #1189262 #1189291 #1189292 #1189296 #1189298 #1189301 #1189305 #1189323 #1189384 #1189385 #1189392 #1189393 #1189399 #1189400 #1189427 #1189503 #1189504 #1189505 #1189506 #1189507 #1189562 #1189563 #1189564 #1189565 #1189566 #1189567 #1189568 #1189569 #1189573 #1189574 #1189575 #1189576 #1189577 #1189579 #1189581 #1189582 #1189583 #1189585 #1189586 #1189587 #1189696 #1189706 #1189760 #1189762 #1189832 #1189841 #1189870 #1189872 #1189883 #1190022 #1190025 #1190115 #1190117 #1190412 #1190413 #1190428 Cross-References: CVE-2020-12770 CVE-2021-34556 CVE-2021-35477 CVE-2021-3640 CVE-2021-3653 CVE-2021-3656 CVE-2021-3679 CVE-2021-3732 CVE-2021-3739 CVE-2021-3743 CVE-2021-3753 CVE-2021-3759 CVE-2021-38160 CVE-2021-38166 CVE-2021-38198 CVE-2021-38204 CVE-2021-38205 CVE-2021-38206 CVE-2021-38207 CVE-2021-38209 CVSS scores: CVE-2020-12770 (NVD) : 6.7 CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H CVE-2020-12770 (SUSE): 6.1 CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:H CVE-2021-34556 (SUSE): 5.5 CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N CVE-2021-35477 (SUSE): 6.5 CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N CVE-2021-3640 (SUSE): 7.4 CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H CVE-2021-3653 (SUSE): 7.8 CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H CVE-2021-3656 (SUSE): 7.8 CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H CVE-2021-3679 (SUSE): 5.5 CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H CVE-2021-3732 (SUSE): 3.3 CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N CVE-2021-3739 (SUSE): 4.4 CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H CVE-2021-3743 (SUSE): 6.2 CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H CVE-2021-3753 (SUSE): 2.9 CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N CVE-2021-3759 (SUSE): 6.2 CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H CVE-2021-38160 (SUSE): 7 CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H CVE-2021-38166 (SUSE): 6.7 CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H CVE-2021-38198 (SUSE): 7.8 CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H CVE-2021-38204 (SUSE): 4.2 CVSS:3.1/AV:P/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H CVE-2021-38205 (SUSE): 3.3 CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N CVE-2021-38206 (NVD) : 5.5 CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H CVE-2021-38206 (SUSE): 6.5 CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H CVE-2021-38207 (SUSE): 5.9 CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H CVE-2021-38209 (SUSE): 3.3 CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N Affected Products: openSUSE Leap 15.3 ______________________________________________________________________________ An update that solves 20 vulnerabilities and has 107 fixes is now available. Description: The SUSE Linux Enterprise 15 SP3 Azure kernel was updated to receive various security and bugfixes. The following security bugs were fixed: - CVE-2021-3640: Fixed a Use-After-Free vulnerability in function sco_sock_sendmsg() in the bluetooth stack (bsc#1188172). - CVE-2021-3653: Missing validation of the `int_ctl` VMCB field and allows a malicious L1 guest to enable AVIC support for the L2 guest. (bsc#1189399). - CVE-2021-3656: Missing validation of the the `virt_ext` VMCB field and allows a malicious L1 guest to disable both VMLOAD/VMSAVE intercepts and VLS for the L2 guest (bsc#1189400). - CVE-2021-3679: A lack of CPU resource in tracing module functionality was found in the way user uses trace ring buffer in a specific way. Only privileged local users (with CAP_SYS_ADMIN capability) could use this flaw to starve the resources causing denial of service (bnc#1189057). - CVE-2021-3732: Mounting overlayfs inside an unprivileged user namespace can reveal files (bsc#1189706). - CVE-2021-3739: Fixed a NULL pointer dereference when deleting device by invalid id (bsc#1189832 ). - CVE-2021-3743: Fixed OOB Read in qrtr_endpoint_post (bsc#1189883). - CVE-2021-3753: Fixed race out-of-bounds in virtual terminal handling (bsc#1190025). - CVE-2021-38160: Data corruption or loss could be triggered by an untrusted device that supplies a buf->len value exceeding the buffer size in drivers/char/virtio_console.c (bsc#1190117) - CVE-2021-38198: arch/x86/kvm/mmu/paging_tmpl.h incorrectly computes the access permissions of a shadow page, leading to a missing guest protection page fault (bnc#1189262). - CVE-2021-38204: drivers/usb/host/max3421-hcd.c allowed physically proximate attackers to cause a denial of service (use-after-free and panic) by removing a MAX-3421 USB device in certain situations (bnc#1189291). - CVE-2021-38205: drivers/net/ethernet/xilinx/xilinx_emaclite.c made it easier for attackers to defeat an ASLR protection mechanism because it prints a kernel pointer (i.e., the real IOMEM pointer) (bnc#1189292). - CVE-2021-38207: drivers/net/ethernet/xilinx/ll_temac_main.c allowed remote attackers to cause a denial of service (buffer overflow and lockup) by sending heavy network traffic for about ten minutes (bnc#1189298). - CVE-2021-38166: Fixed an integer overflow and out-of-bounds write when many elements are placed in a single bucket in kernel/bpf/hashtab.c (bnc#1189233 ). - CVE-2021-38209: Fixed allowed observation of changes in any net namespace via net/netfilter/nf_conntrack_standalone.c (bnc#1189393). - CVE-2021-38206: Fixed NULL pointer dereference in the radiotap parser inside the mac80211 subsystem (bnc#1189296). - CVE-2021-34556: Fixed side-channel attack via a Speculative Store Bypass via unprivileged BPF program that could have obtain sensitive information from kernel memory (bsc#1188983). - CVE-2021-35477: Fixed BPF stack frame pointer which could have been abused to disclose content of arbitrary kernel memory (bsc#1188985). - CVE-2021-3759: Unaccounted ipc objects in Linux kernel could have lead to breaking memcg limits and DoS attacks (bsc#1190115). - CVE-2020-12770: Fixed sg_remove_request call in a certain failure cases (bsc#1171420). The following non-security bugs were fixed: - ACPI: NFIT: Fix support for virtual SPA ranges (git-fixes). - ACPI: processor: Clean up acpi_processor_evaluate_cst() (bsc#1175543) - ACPI: processor: Export acpi_processor_evaluate_cst() (bsc#1175543) - ACPI: processor: Export function to claim _CST control (bsc#1175543) - ACPI: processor: Introduce acpi_processor_evaluate_cst() (bsc#1175543) - ACPI: processor: Make ACPI_PROCESSOR_CSTATE depend on ACPI_PROCESSOR (bsc#1175543) - ALSA: hda - fix the 'Capture Switch' value change notifications (git-fixes). - ALSA: hda/hdmi: Add quirk to force pin connectivity on NUC10 (git-fixes). - ALSA: hda/hdmi: fix max DP-MST dev_num for Intel TGL+ platforms (git-fixes). - ALSA: hda/hdmi: let new platforms assign the pcm slot dynamically (git-fixes). - ALSA: hda/realtek - Add ALC285 HP init procedure (git-fixes). - ALSA: hda/realtek - Add type for ALC287 (git-fixes). - ALSA: hda/realtek: Change device names for quirks to barebone names (git-fixes). - ALSA: hda/realtek: Enable 4-speaker output for Dell XPS 15 9510 laptop (git-fixes). - ALSA: hda/realtek: Fix headset mic for Acer SWIFT SF314-56 (ALC256) (git-fixes). - ALSA: hda/realtek: Limit mic boost on HP ProBook 445 G8 (git-fixes). - ALSA: hda/realtek: add mic quirk for Acer SF314-42 (git-fixes). - ALSA: hda/realtek: fix mute led of the HP Pavilion 15-eh1xxx series (git-fixes). - ALSA: hda/realtek: fix mute/micmute LEDs for HP ProBook 650 G8 Notebook PC (git-fixes). - ALSA: hda/via: Apply runtime PM workaround for ASUS B23E (git-fixes). - ALSA: hda: Add quirk for ASUS Flow x13 (git-fixes). - ALSA: hda: Fix hang during shutdown due to link reset (git-fixes). - ALSA: hda: Release controller display power during shutdown/reboot (git-fixes). - ALSA: pcm: Fix mmap breakage without explicit buffer setup (git-fixes). - ALSA: pcm: fix divide error in snd_pcm_lib_ioctl (git-fixes). - ALSA: seq: Fix racy deletion of subscriber (git-fixes). - ALSA: usb-audio: Add registration quirk for JBL Quantum 600 (git-fixes). - ALSA: usb-audio: Avoid unnecessary or invalid connector selection at resume (git-fixes). - ALSA: usb-audio: Fix regression on Sony WALKMAN NW-A45 DAC (git-fixes). - ALSA: usb-audio: Fix superfluous autosuspend recovery (git-fixes). - ALSA: usb-audio: fix incorrect clock source setting (git-fixes). - ASoC: Intel: Skylake: Fix module resource and format selection (git-fixes). - ASoC: Intel: Skylake: Leave data as is when invoking TLV IPCs (git-fixes). - ASoC: Intel: kbl_da7219_max98927: Fix format selection for max98373 (git-fixes). - ASoC: SOF: Intel: hda-ipc: fix reply size checking (git-fixes). - ASoC: amd: Fix reference to PCM buffer address (git-fixes). - ASoC: component: Remove misplaced prefix handling in pin control functions (git-fixes). - ASoC: cs42l42: Correct definition of ADC Volume control (git-fixes). - ASoC: cs42l42: Do not allow SND_SOC_DAIFMT_LEFT_J (git-fixes). - ASoC: cs42l42: Fix LRCLK frame start edge (git-fixes). - ASoC: cs42l42: Fix inversion of ADC Notch Switch control (git-fixes). - ASoC: cs42l42: Remove duplicate control for WNF filter frequency (git-fixes). - ASoC: intel: atom: Fix breakage for PCM buffer address setup (git-fixes). - ASoC: intel: atom: Fix reference to PCM buffer address (git-fixes). - ASoC: mediatek: mt8183: Fix Unbalanced pm_runtime_enable in mt8183_afe_pcm_dev_probe (git-fixes). - ASoC: rt5682: Adjust headset volume button threshold (git-fixes). - ASoC: rt5682: Adjust headset volume button threshold again (git-fixes). - ASoC: rt5682: Fix the issue of garbled recording after powerd_dbus_suspend (git-fixes). - ASoC: ti: j721e-evm: Check for not initialized parent_clk_id (git-fixes). - ASoC: ti: j721e-evm: Fix unbalanced domain activity tracking during startup (git-fixes). - ASoC: tlv320aic31xx: Fix jack detection after suspend (git-fixes). - ASoC: tlv320aic31xx: fix reversed bclk/wclk master bits (git-fixes). - ASoC: uniphier: Fix reference to PCM buffer address (git-fixes). - ASoC: wcd9335: Disable irq on slave ports in the remove function (git-fixes). - ASoC: wcd9335: Fix a double irq free in the remove function (git-fixes). - ASoC: wcd9335: Fix a memory leak in the error handling path of the probe function (git-fixes). - ASoC: xilinx: Fix reference to PCM buffer address (git-fixes). - Avoid double printing SUSE specific flags in mod->taint (bsc#1190413). - Bluetooth: add timeout sanity check to hci_inquiry (git-fixes). - Bluetooth: btusb: Fix a unspported condition to set available debug features (git-fixes). - Bluetooth: btusb: check conditions before enabling USB ALT 3 for WBS (git-fixes). - Bluetooth: defer cleanup of resources in hci_unregister_dev() (git-fixes). - Bluetooth: fix repeated calls to sco_sock_kill (git-fixes). - Bluetooth: hidp: use correct wait queue when removing ctrl_wait (git-fixes). - Bluetooth: increase BTNAMSIZ to 21 chars to fix potential buffer overflow (git-fixes). - Bluetooth: mgmt: Fix wrong opcode in the response for add_adv cmd (git-fixes). - Bluetooth: sco: prevent information leak in sco_conn_defer_accept() (git-fixes). - Documentation: admin-guide: PM: Add intel_idle document (bsc#1175543) - KVM: VMX: Drop guest CPUID check for VMXE in vmx_set_cr4() (bsc#1188786). - KVM: VMX: Enable machine check support for 32bit targets (bsc#1188787). - KVM: VMX: Explicitly clear RFLAGS.CF and RFLAGS.ZF in VM-Exit RSB path (bsc#1188788). - KVM: VMX: Extend VMXs #AC interceptor to handle split lock #AC in guest (bsc#1187959). - KVM: nVMX: Handle split-lock #AC exceptions that happen in L2 (bsc#1187959). - KVM: nVMX: Really make emulated nested preemption timer pinned (bsc#1188780). - KVM: nVMX: Reset the segment cache when stuffing guest segs (bsc#1188781). - KVM: nVMX: Skip IBPB when switching between vmcs01 and vmcs02 (bsc#1188782). - KVM: nVMX: Sync unsync'd vmcs02 state to vmcs12 on migration (bsc#1188783). - KVM: nVMX: Truncate bits 63:32 of VMCS field on nested check in !64-bit (bsc#1188784). - KVM: x86: Emulate split-lock access as a write in emulator (bsc#1187959). - KVM: x86: bit 8 of non-leaf PDPEs is not reserved (bsc#1188790). - NFS: Correct size calculation for create reply length (bsc#1189870). - NFSv4.1: Do not rebind to the same source port when (bnc#1186264 bnc#1189021) - NFSv4/pNFS: Do not call _nfs4_pnfs_v3_ds_connect multiple times (git-fixes). - NFSv4: Initialise connection to the server in nfs4_alloc_client() (bsc#1040364). - PCI/MSI: Correct misleading comments (git-fixes). - PCI/MSI: Do not set invalid bits in MSI mask (git-fixes). - PCI/MSI: Enable and mask MSI-X early (git-fixes). - PCI/MSI: Mask all unused MSI-X entries (git-fixes). - PCI/MSI: Skip masking MSI-X on Xen PV (git-fixes). - PCI/MSI: Use msi_mask_irq() in pci_msi_shutdown() (git-fixes). - PCI: Increase D3 delay for AMD Renoir/Cezanne XHCI (git-fixes). - PCI: PM: Avoid forcing PCI_D0 for wakeup reasons inconsistently (git-fixes). - PCI: PM: Enable PME if it can be signaled from D3cold (git-fixes). - RDMA/bnxt_re: Fix stats counters (bsc#1188231). - SUNRPC: 'Directory with parent 'rpc_clnt' already present!' (bsc#1168202 bsc#1188924). - SUNRPC: Fix the batch tasks count wraparound (git-fixes). - SUNRPC: Should wake up the privileged task firstly (git-fixes). - SUNRPC: defer slow parts of rpc_free_client() to a workqueue (bsc#1168202 bsc#1188924). - SUNRPC: fix use-after-free in rpc_free_client_work() (bsc#1168202 bsc#1188924). - SUNRPC: improve error response to over-size gss credential (bsc#1190022). - SUNRPC: prevent port reuse on transports which do not request it (bnc#1186264 bnc#1189021). - USB: core: Avoid WARNings for 0-length descriptor requests (git-fixes). - USB: serial: ch341: fix character loss at high transfer rates (git-fixes). - USB: serial: ftdi_sio: add device ID for Auto-M3 OP-COM v2 (git-fixes). - USB: serial: option: add Telit FD980 composition 0x1056 (git-fixes). - USB: usbtmc: Fix RCU stall warning (git-fixes). - USB:ehci:fix Kunpeng920 ehci hardware problem (git-fixes). - VMCI: fix NULL pointer dereference when unmapping queue pair (git-fixes). - ath6kl: wmi: fix an error code in ath6kl_wmi_sync_point() (git-fixes). - ath9k: Clear key cache explicitly on disabling hardware (git-fixes). - ath: Use safer key clearing with key cache entries (git-fixes). - bcma: Fix memory leak for internally-handled cores (git-fixes). - bdi: Do not use freezable workqueue (bsc#1189573). - blk-iolatency: error out if blk_get_queue() failed in iolatency_set_limit() (bsc#1189507). - blk-mq-sched: Fix blk_mq_sched_alloc_tags() error handling (bsc#1189506). - blk-wbt: introduce a new disable state to prevent false positive by rwb_enabled() (bsc#1189503). - blk-wbt: make sure throttle is enabled properly (bsc#1189504). - block: fix trace completion for chained bio (bsc#1189505). - bnxt_en: Validate vlan protocol ID on RX packets (jsc#SLE-15075). - brcmfmac: pcie: fix oops on failure to resume and reprobe (git-fixes). - btrfs: Rename __btrfs_alloc_chunk to btrfs_alloc_chunk (bsc#1189079). - btrfs: add a trace class for dumping the current ENOSPC state (bsc#1135481). - btrfs: add a trace point for reserve tickets (bsc#1135481). - btrfs: adjust the flush trace point to include the source (bsc#1135481). - btrfs: check reclaim_size in need_preemptive_reclaim (bsc#1135481). - btrfs: factor out create_chunk() (bsc#1189077). - btrfs: factor out decide_stripe_size() (bsc#1189077). - btrfs: factor out gather_device_info() (bsc#1189077). - btrfs: factor out init_alloc_chunk_ctl (bsc#1189077). - btrfs: fix btrfs_calc_reclaim_metadata_size calculation (bsc#1135481). - btrfs: fix deadlock with concurrent chunk allocations involving system chunks (bsc#1189077). - btrfs: handle invalid profile in chunk allocation (bsc#1189077). - btrfs: implement space clamping for preemptive flushing (bsc#1135481). - btrfs: improve preemptive background space flushing (bsc#1135481). - btrfs: introduce a FORCE_COMMIT_TRANS flush operation (bsc#1135481). - btrfs: introduce alloc_chunk_ctl (bsc#1189077). - btrfs: introduce chunk allocation policy (bsc#1189077). - btrfs: make flush_space take a enum btrfs_flush_state instead of int (bsc#1135481). - btrfs: move the chunk_mutex in btrfs_read_chunk_tree (bsc#1189077). - btrfs: parameterize dev_extent_min for chunk allocation (bsc#1189077). - btrfs: refactor find_free_dev_extent_start() (bsc#1189077). - btrfs: remove FLUSH_DELAYED_REFS from data ENOSPC flushing (bsc#1135481). - btrfs: rename need_do_async_reclaim (bsc#1135481). - btrfs: rework btrfs_calc_reclaim_metadata_size (bsc#1135481). - btrfs: rework chunk allocation to avoid exhaustion of the system chunk array (bsc#1189077). - btrfs: rip out btrfs_space_info::total_bytes_pinned (bsc#1135481). - btrfs: rip the first_ticket_bytes logic from fail_all_tickets (bsc#1135481). - btrfs: simplify the logic in need_preemptive_flushing (bsc#1135481). - btrfs: tracepoints: convert flush states to using EM macros (bsc#1135481). - btrfs: tracepoints: fix btrfs_trigger_flush symbolic string for flags (bsc#1135481). - can: ti_hecc: Fix memleak in ti_hecc_probe (git-fixes). - can: usb: esd_usb2: esd_usb2_rx_event(): fix the interchange of the CAN RX and TX error counters (git-fixes). - ceph: clean up and optimize ceph_check_delayed_caps() (bsc#1187468). - ceph: reduce contention in ceph_check_delayed_caps() (bsc#1187468). - ceph: take snap_empty_lock atomically with snaprealm refcount change (bsc#1189427). - cifs: Remove unused inline function is_sysvol_or_netlogon() (bsc#1185902). - cifs: avoid starvation when refreshing dfs cache (bsc#1185902). - cifs: constify get_normalized_path() properly (bsc#1185902). - cifs: do not cargo-cult strndup() (bsc#1185902). - cifs: do not send tree disconnect to ipc shares (bsc#1185902). - cifs: do not share tcp servers with dfs mounts (bsc#1185902). - cifs: do not share tcp sessions of dfs connections (bsc#1185902). - cifs: fix check of dfs interlinks (bsc#1185902). - cifs: fix path comparison and hash calc (bsc#1185902). - cifs: get rid of @noreq param in __dfs_cache_find() (bsc#1185902). - cifs: handle different charsets in dfs cache (bsc#1185902). - cifs: keep referral server sessions alive (bsc#1185902). - cifs: missing null pointer check in cifs_mount (bsc#1185902). - cifs: prevent NULL deref in cifs_compose_mount_options() (bsc#1185902). - cifs: set a minimum of 2 minutes for refreshing dfs cache (bsc#1185902). - clk: fix leak on devm_clk_bulk_get_all() unwind (git-fixes). - clk: stm32f4: fix post divisor setup for I2S/SAI PLLs (git-fixes). - cpuidle: Allow idle states to be disabled by default (bsc#1175543) - cpuidle: Consolidate disabled state checks (bsc#1175543) - cpuidle: Drop disabled field from struct cpuidle_state (bsc#1175543) - cpuidle: Fix cpuidle_driver_state_disabled() (bsc#1175543) - cpuidle: Introduce cpuidle_driver_state_disabled() for driver quirks (bsc#1175543) - crypto: ccp - Annotate SEV Firmware file names (bsc#1189212). - crypto: qat - use proper type for vf_mask (git-fixes). - crypto: x86/curve25519 - fix cpu feature checking logic in mod_exit (git-fixes). - device-dax: Fix default return code of range_parse() (git-fixes). - dm integrity: fix missing goto in bitmap_flush_interval error handling (git-fixes). - dm rq: fix double free of blk_mq_tag_set in dev remove after table load fails (git-fixes). - dm verity: fix DM_VERITY_OPTS_MAX value (git-fixes). - dmaengine: idxd: fix setup sequence for MSIXPERM table (git-fixes). - dmaengine: imx-dma: configure the generic DMA type to make it work (git-fixes). - dmaengine: imx-dma: configure the generic DMA type to make it work (git-fixes). - dmaengine: imx-sdma: remove duplicated sdma_load_context (git-fixes). - dmaengine: of-dma: router_xlate to return -EPROBE_DEFER if controller is not yet available (git-fixes). - dmaengine: usb-dmac: Fix PM reference leak in usb_dmac_probe() (git-fixes). - dmaengine: xilinx_dma: Fix read-after-free bug when terminating transfers (git-fixes). - drivers/block/null_blk/main: Fix a double free in null_init (git-fixes). - drm/amd/display: Fix Dynamic bpp issue with 8K30 with Navi 1X (git-fixes). - drm/amd/display: Fix comparison error in dcn21 DML (git-fixes). - drm/amd/display: Fix max vstartup calculation for modes with borders (git-fixes). - drm/amd/display: Remove invalid assert for ODM + MPC case (git-fixes). - drm/amd/display: use GFP_ATOMIC in amdgpu_dm_irq_schedule_work (git-fixes). - drm/amd/display: workaround for hard hang on HPD on native DP (git-fixes). - drm/amdgpu/acp: Make PM domain really work (git-fixes). - drm/amdgpu/display: fix DMUB firmware version info (git-fixes). - drm/amdgpu/display: only enable aux backlight control for OLED panels (git-fixes). - drm/amdgpu: do not enable baco on boco platforms in runpm (git-fixes). - drm/amdgpu: fix the doorbell missing when in CGPG issue for renoir (git-fixes). - drm/dp_mst: Fix return code on sideband message failure (git-fixes). - drm/i915/dg1: gmbus pin mapping (bsc#1188700). - drm/i915/dg1: provide port/phy mapping for vbt (bsc#1188700). - drm/i915/gen9_bc: Add W/A for missing STRAP config on TGP PCH + CML combos (bsc#1188700). - drm/i915/gen9_bc: Introduce HPD pin mappings for TGP PCH + CML combos (bsc#1188700). - drm/i915/gen9_bc: Introduce TGP PCH DDC pin mappings (bsc#1188700). - drm/i915/gen9_bc: Recognize TGP PCH + CML combos (bsc#1188700). - drm/i915/rkl: new rkl ddc map for different PCH (bsc#1188700). - drm/i915: Add VBT AUX CH H and I (bsc#1188700). - drm/i915: Add VBT DVO ports H and I (bsc#1188700). - drm/i915: Add more AUX CHs to the enum (bsc#1188700). - drm/i915: Configure GEN11_{TBT,TC}_HOTPLUG_CTL for ports TC5/6 (bsc#1188700). - drm/i915: Correct SFC_DONE register offset (git-fixes). - drm/i915: Introduce HPD_PORT_TC<n> (bsc#1188700). - drm/i915: Move hpd_pin setup to encoder init (bsc#1188700). - drm/i915: Nuke the redundant TC/TBT HPD bit defines (bsc#1188700). - drm/i915: Only access SFC_DONE when media domain is not fused off (git-fixes). - drm/meson: fix colour distortion from HDR set during vendor u-boot (git-fixes). - drm/msi/mdp4: populate priv->kms in mdp4_kms_init (git-fixes). - drm/msm/dpu: make dpu_hw_ctl_clear_all_blendstages clear necessary LMs (git-fixes). - drm/msm/dsi: Fix some reference counted resource leaks (git-fixes). - drm/msm: Fix error return code in msm_drm_init() (git-fixes). - drm/nouveau/kms/nv50: workaround EFI GOP window channel format differences (git-fixes). - drm/of: free the iterator object on failure (git-fixes). - drm/of: free the right object (git-fixes). - drm/panfrost: Fix missing clk_disable_unprepare() on error in panfrost_clk_init() (git-fixes). - drm/prime: fix comment on PRIME Helpers (git-fixes). - ext4: cleanup in-core orphan list if ext4_truncate() failed to get a transaction handle (bsc#1189568). - ext4: correct the cache_nr in tracepoint ext4_es_shrink_exit (bsc#1189564). - ext4: fix avefreec in find_group_orlov (bsc#1189566). - ext4: fix kernel infoleak via ext4_extent_header (bsc#1189562). - ext4: fix potential htree corruption when growing large_dir directories (bsc#1189576). - ext4: remove check for zero nr_to_scan in ext4_es_scan() (bsc#1189565). - ext4: return error code when ext4_fill_flex_info() fails (bsc#1189563). - ext4: use ext4_grp_locked_error in mb_find_extent (bsc#1189567). - fanotify: fix copy_event_to_user() fid error clean up (bsc#1189574). - firmware_loader: fix use-after-free in firmware_fallback_sysfs (git-fixes). - firmware_loader: use -ETIMEDOUT instead of -EAGAIN in fw_load_sysfs_fallback (git-fixes). - fixup "rpm: support gz and zst compression methods" (bsc#1190358, bsc#1190428). - fpga: altera-freeze-bridge: Address warning about unused variable (git-fixes). - fpga: dfl: fme: Fix cpu hotplug issue in performance reporting (git-fixes). - fpga: dfl: fme: Fix cpu hotplug issue in performance reporting (git-fixes). - fpga: xiilnx-spi: Address warning about unused variable (git-fixes). - fpga: zynqmp-fpga: Address warning about unused variable (git-fixes). - gpio: eic-sprd: break loop when getting NULL device resource (git-fixes). - gpio: tqmx86: really make IRQ optional (git-fixes). - i2c: dev: zero out array used for i2c reads from userspace (git-fixes). - i2c: highlander: add IRQ check (git-fixes). - i2c: iop3xx: fix deferred probing (git-fixes). - i2c: mt65xx: fix IRQ check (git-fixes). - i2c: s3c2410: fix IRQ check (git-fixes). - iio: adc: Fix incorrect exit of for-loop (git-fixes). - iio: adc: ti-ads7950: Ensure CS is deasserted after reading channels (git-fixes). - iio: humidity: hdc100x: Add margin to the conversion time (git-fixes). - intel_idle: Add module parameter to prevent ACPI _CST from being used (bsc#1175543) - intel_idle: Allow ACPI _CST to be used for selected known processors (bsc#1175543) - intel_idle: Annotate init time data structures (bsc#1175543) - intel_idle: Customize IceLake server support (bsc#1175543) - intel_idle: Disable ACPI _CST on Haswell (bsc#1175543, bsc#1177399, bsc#1180347, bsc#1180141) - intel_idle: Fix max_cstate for processor models without C-state tables (bsc#1175543) - intel_idle: Ignore _CST if control cannot be taken from the platform (bsc#1175543) - intel_idle: Refactor intel_idle_cpuidle_driver_init() (bsc#1175543) - intel_idle: Use ACPI _CST for processor models without C-state tables (bsc#1175543) - iommu/amd: Fix extended features logging (bsc#1189213). - iommu/amd: Move Stoney Ridge check to detect_ivrs() (bsc#1189762). - iommu/arm-smmu-v3: Decrease the queue size of evtq and priq (bsc#1189210). - iommu/arm-smmu-v3: add bit field SFM into GERROR_ERR_MASK (bsc#1189209). - iommu/dma: Fix IOVA reserve dma ranges (bsc#1189214). - iommu/dma: Fix compile warning in 32-bit builds (bsc#1189229). - iommu/vt-d: Check for allocation failure in aux_detach_device() (bsc#1189215). - iommu/vt-d: Define counter explicitly as unsigned int (bsc#1189216). - iommu/vt-d: Do not set then clear private data in prq_event_thread() (bsc#1189217). - iommu/vt-d: Fix sysfs leak in alloc_iommu() (bsc#1189218). - iommu/vt-d: Force to flush iotlb before creating superpage (bsc#1189219). - iommu/vt-d: Global devTLB flush when present context entry changed (bsc#1189220). - iommu/vt-d: Invalidate PASID cache when root/context entry changed (bsc#1189221). - iommu/vt-d: Reject unsupported page request modes (bsc#1189222). - ionic: add handling of larger descriptors (jsc#SLE-16649). - ionic: add new queue features to interface (jsc#SLE-16649). - ionic: aggregate Tx byte counting calls (jsc#SLE-16649). - ionic: block actions during fw reset (jsc#SLE-16649). - ionic: change mtu after queues are stopped (jsc#SLE-16649). - ionic: check for link after netdev registration (jsc#SLE-16649). - ionic: code cleanup details (jsc#SLE-16649). - ionic: fix sizeof usage (jsc#SLE-16649). - ionic: fix unchecked reference (jsc#SLE-16649). - ionic: fix up dim accounting for tx and rx (jsc#SLE-16649). - ionic: generic tx skb mapping (jsc#SLE-16649). - ionic: implement Rx page reuse (jsc#SLE-16649). - ionic: make all rx_mode work threadsafe (jsc#SLE-16649). - ionic: move rx_page_alloc and free (jsc#SLE-16649). - ionic: optimize fastpath struct usage (jsc#SLE-16649). - ionic: protect adminq from early destroy (jsc#SLE-16649). - ionic: rebuild debugfs on qcq swap (jsc#SLE-16649). - ionic: remove intr coalesce update from napi (jsc#SLE-16649). - ionic: remove some unnecessary oom messages (jsc#SLE-16649). - ionic: simplify TSO descriptor mapping (jsc#SLE-16649). - ionic: simplify rx skb alloc (jsc#SLE-16649). - ionic: simplify the intr_index use in txq_init (jsc#SLE-16649). - ionic: simplify tx clean (jsc#SLE-16649). - ionic: simplify use of completion types (jsc#SLE-16649). - ionic: start queues before announcing link up (jsc#SLE-16649). - ionic: stop watchdog when in broken state (jsc#SLE-16649). - ionic: useful names for booleans (jsc#SLE-16649). - iwlwifi: pnvm: accept multiple HW-type TLVs (git-fixes). - iwlwifi: rs-fw: do not support stbc for HE 160 (git-fixes). - iwlwifi: skip first element in the WTAS ACPI table (git-fixes). - kABI fix of usb_dcd_config_params (git-fixes). - kABI: Fix kABI after fixing vcpu-id indexed arrays (git-fixes). - kabi fix for NFSv4.1: Do not rebind to the same source port when reconnecting to the server (bnc#1186264 bnc#1189021) - kabi fix for SUNRPC: defer slow parts of rpc_free_client() to a workqueue (bsc#1168202 bsc#1188924). - kernel, fs: Introduce and use set_restart_fn() and arch_set_restart_data() (bsc#1189153). - kernel-cert-subpackage: Fix certificate location in scriptlets (bsc#1189841). - leds: trigger: audio: Add an activate callback to ensure the initial brightness is set (git-fixes). - lib/mpi: use kcalloc in mpi_resize (git-fixes). - lib: Add zstd support to decompress (bsc#1187483, jsc#SLE-18766). - libata: fix ata_pio_sector for CONFIG_HIGHMEM (git-fixes). - mac80211: Fix insufficient headroom issue for AMSDU (git-fixes). - md/raid10: properly indicate failure when ending a failed write request (git-fixes). - md: revert io stats accounting (git-fixes). - media: TDA1997x: enable EDID support (git-fixes). - media: cxd2880-spi: Fix an error handling path (git-fixes). - media: drivers/media/usb: fix memory leak in zr364xx_probe (git-fixes). - media: dvb-usb: Fix error handling in dvb_usb_i2c_init (git-fixes). - media: dvb-usb: fix uninit-value in dvb_usb_adapter_dvb_init (git-fixes). - media: dvb-usb: fix uninit-value in vp702x_read_mac_addr (git-fixes). - media: em28xx-input: fix refcount bug in em28xx_usb_disconnect (git-fixes). - media: go7007: fix memory leak in go7007_usb_probe (git-fixes). - media: go7007: remove redundant initialization (git-fixes). - media: rtl28xxu: fix zero-length control request (git-fixes). - media: stkwebcam: fix memory leak in stk_camera_probe (git-fixes). - media: venus: venc: Fix potential null pointer dereference on pointer fmt (git-fixes). - media: videobuf2-core: dequeue if start_streaming fails (git-fixes). - media: zr364xx: fix memory leaks in probe() (git-fixes). - media: zr364xx: propagate errors from zr364xx_start_readpipe() (git-fixes). - misc: atmel-ssc: lock with mutex instead of spinlock (git-fixes). - misc: rtsx: do not setting OC_POWER_DOWN reg in rtsx_pci_init_ocp() (git-fixes). - mm/thp: unmap_mapping_page() to fix THP truncate_cleanup_page() (bsc#1189569). - mm/vmscan: fix infinite loop in drop_slab_node (VM Functionality, bsc#1189301). - mm: fix memory_failure() handling of dax-namespace metadata (bsc#1189872). - mm: swap: properly update readahead statistics in unuse_pte_range() (bsc#1187619). - mmc: dw_mmc: Fix hang on data CRC error (git-fixes). - mmc: dw_mmc: Fix issue with uninitialized dma_slave_config (git-fixes). - mmc: moxart: Fix issue with uninitialized dma_slave_config (git-fixes). - mmc: sdhci-iproc: Cap min clock frequency on BCM2711 (git-fixes). - mmc: sdhci-iproc: Set SDHCI_QUIRK_CAP_CLOCK_BASE_BROKEN on BCM2711 (git-fixes). - mtd: cfi_cmdset_0002: fix crash when erasing/writing AMD cards (git-fixes). - nbd: Aovid double completion of a request (git-fixes). - nbd: Fix NULL pointer in flush_workqueue (git-fixes). - net/mlx5: Add ts_cqe_to_dest_cqn related bits (bsc#1188412) - net/mlx5: Properly convey driver version to firmware (git-fixes). - net/mlx5e: Add missing capability check for uplink follow (bsc#1188412) - net: dsa: mv88e6xxx: Avoid VTU corruption on 6097 (git-fixes). - net: dsa: mv88e6xxx: also read STU state in mv88e6250_g1_vtu_getnext (git-fixes). - net: stmmac: free tx skb buffer in stmmac_resume() (git-fixes). - net: usb: lan78xx: do not modify phy_device state concurrently (bsc#1188270) - nfs: fix acl memory leak of posix_acl_create() (git-fixes). - nvme-multipath: revalidate paths during rescan (bsc#1187211) - nvme-pci: Use u32 for nvme_dev.q_depth and nvme_queue.q_depth (bsc#1181972). - nvme-pci: fix NULL req in completion handler (bsc#1181972). - nvme-pci: limit maximum queue depth to 4095 (bsc#1181972). - nvme-pci: use unsigned for io queue depth (bsc#1181972). - nvme-tcp: Do not reset transport on data digest errors (bsc#1188418). - nvme-tcp: do not check blk_mq_tag_to_rq when receiving pdu data (bsc#1181972). - nvme: avoid possible double fetch in handling CQE (bsc#1181972). - nvme: code command_id with a genctr for use-after-free validation (bsc#1181972). - nvme: only call synchronize_srcu when clearing current path (bsc#1188067). - nvmet: use NVMET_MAX_NAMESPACES to set nn value (bsc#1189384). - ocfs2: fix snprintf() checking (bsc#1189581). - ocfs2: fix zero out valid data (bsc#1189579). - ocfs2: initialize ip_next_orphan (bsc#1186731). - ocfs2: issue zeroout to EOF blocks (bsc#1189582). - ovl: allow upperdir inside lowerdir (bsc#1189323). - ovl: expand warning in ovl_d_real() (bsc#1189323). - ovl: fix missing revert_creds() on error path (bsc#1189323). - ovl: perform vfs_getxattr() with mounter creds (bsc#1189323). - ovl: skip getxattr of security labels (bsc#1189323). - params: lift param_set_uint_minmax to common code (bsc#1181972). - pcmcia: i82092: fix a null pointer dereference bug (git-fixes). - perf/x86/amd: Do not touch the AMD64_EVENTSEL_HOSTONLY bit inside the guest (bsc#1189225). - pinctrl: tigerlake: Fix GPIO mapping for newer version of software (git-fixes). - platform/x86: pcengines-apuv2: Add missing terminating entries to gpio-lookup tables (git-fixes). - post.sh: detect /usr mountpoint too - power: supply: max17042: handle fails of reading status register (git-fixes). - powerpc/cacheinfo: Improve diagnostics about malformed cache lists (jsc#SLE-13615 bsc#1180100 ltc#190257 git-fixes). - powerpc/cacheinfo: Lookup cache by dt node and thread-group id (jsc#SLE-13615 bsc#1180100 ltc#190257 git-fixes). - powerpc/cacheinfo: Remove the redundant get_shared_cpu_map() (jsc#SLE-13615 bsc#1180100 ltc#190257 git-fixes). - powerpc/cacheinfo: Use name@unit instead of full DT path in debug messages (jsc#SLE-13615 bsc#1180100 ltc#190257 git-fixes). - powerpc/papr_scm: Make 'perf_stats' invisible if perf-stats unavailable (bsc#1175052 jsc#SLE-13823 bsc#1174969 jsc#SLE-12769 git-fixes). - powerpc/papr_scm: Reduce error severity if nvdimm stats inaccessible (bsc#1189197 ltc#193906). - powerpc/pseries: Fix regression while building external modules (bsc#1160010 ltc#183046 git-fixes). - powerpc/pseries: Fix update of LPAR security flavor after LPM (bsc#1188885 ltc#193722 git-fixes). - powerpc/smp: Make some symbols static (jsc#SLE-13615 bsc#1180100 ltc#190257 git-fixes). - powerpc/smp: Use existing L2 cache_map cpumask to find L3 cache siblings (jsc#SLE-13615 bsc#1180100 ltc#190257 git-fixes). - powerpc: Fix is_kvm_guest() / kvm_para_available() (bsc#1181148 ltc#190702 git-fixes). - regulator: rt5033: Fix n_voltages settings for BUCK and LDO (git-fixes). - regulator: vctrl: Avoid lockdep warning in enable/disable ops (git-fixes). - regulator: vctrl: Use locked regulator_get_voltage in probe path (git-fixes). - rpm/kernel-binary.spec.in: Use kmod-zstd provide. This makes it possible to use kmod with ZSTD support on non-Tumbleweed. - rpm/kernel-obs-build.spec.in: make builds reproducible (bsc#1189305) - rpm/kernel-source.rpmlintrc: ignore new include/config files In 5.13, since 0e0345b77ac4, config files have no longer .h suffix. Adapt the zero-length check. Based on Martin Liska's change. - rq-qos: fix missed wake-ups in rq_qos_throttle try two (bsc#1189575). - rsi: fix an error code in rsi_probe() (git-fixes). - rsi: fix error code in rsi_load_9116_firmware() (git-fixes). - s390/ap: Fix hanging ioctl caused by wrong msg counter (bsc#1188982 LTC#193817). - s390/boot: fix use of expolines in the DMA code (bsc#1188878 ltc#193771). - scsi: blkcg: Add app identifier support for blkcg (bsc#1189385 jsc#SLE-18970). - scsi: blkcg: Fix application ID config options (bsc#1189385 jsc#SLE-18970). - scsi: cgroup: Add cgroup_get_from_id() (bsc#1189385 jsc#SLE-18970). - scsi: core: Add scsi_prot_ref_tag() helper (bsc#1189392). - scsi: ibmvfc: Do not wait for initial device scan (bsc#1127650). - scsi: libfc: Fix array index out of bound exception (bsc#1188616). - scsi: lpfc: Add 256 Gb link speed support (bsc#1189385). - scsi: lpfc: Add PCI ID support for LPe37000/LPe38000 series adapters (bsc#1189385). - scsi: lpfc: Call discovery state machine when handling PLOGI/ADISC completions (bsc#1189385). - scsi: lpfc: Clear outstanding active mailbox during PCI function reset (bsc#1189385). - scsi: lpfc: Copyright updates for 12.8.0.11 patches (bsc#1189385). - scsi: lpfc: Copyright updates for 14.0.0.0 patches (bsc#1189385). - scsi: lpfc: Delay unregistering from transport until GIDFT or ADISC completes (bsc#1189385). - scsi: lpfc: Discovery state machine fixes for LOGO handling (bsc#1189385). - scsi: lpfc: Enable adisc discovery after RSCN by default (bsc#1189385). - scsi: lpfc: Fix KASAN slab-out-of-bounds in lpfc_unreg_rpi() routine (bsc#1189385). - scsi: lpfc: Fix NULL ptr dereference with NPIV ports for RDF handling (bsc#1189385). - scsi: lpfc: Fix NVMe support reporting in log message (bsc#1189385). - scsi: lpfc: Fix build error in lpfc_scsi.c (bsc#1189385). - scsi: lpfc: Fix cq_id truncation in rq create (bsc#1189385). - scsi: lpfc: Fix function description comments for vmid routines (bsc#1189385). - scsi: lpfc: Fix memory leaks in error paths while issuing ELS RDF/SCR request (bsc#1189385). - scsi: lpfc: Fix possible ABBA deadlock in nvmet_xri_aborted() (bsc#1189385). - scsi: lpfc: Fix target reset handler from falsely returning FAILURE (bsc#1189385). - scsi: lpfc: Improve firmware download logging (bsc#1189385). - scsi: lpfc: Keep NDLP reference until after freeing the IOCB after ELS handling (bsc#1189385). - scsi: lpfc: Move initialization of phba->poll_list earlier to avoid crash (git-fixes). - scsi: lpfc: Remove REG_LOGIN check requirement to issue an ELS RDF (bsc#1189385). - scsi: lpfc: Remove redundant assignment to pointer pcmd (bsc#1189385). - scsi: lpfc: Remove redundant assignment to pointer temp_hdr (bsc#1189385). - scsi: lpfc: Remove use of kmalloc() in trace event logging (bsc#1189385). - scsi: lpfc: Revise Topology and RAS support checks for new adapters (bsc#1189385). - scsi: lpfc: Skip issuing ADISC when node is in NPR state (bsc#1189385). - scsi: lpfc: Skip reg_vpi when link is down for SLI3 in ADISC cmpl path (bsc#1189385). - scsi: lpfc: Update lpfc version to 12.8.0.11 (bsc#1189385). - scsi: lpfc: Update lpfc version to 14.0.0.0 (bsc#1189385). - scsi: lpfc: Use PBDE feature enabled bit to determine PBDE support (bsc#1189385). - scsi: lpfc: Use list_move_tail() instead of list_del()/list_add_tail() (bsc#1189385). - scsi: lpfc: vmid: Add QFPA and VMID timeout check in worker thread (bsc#1189385 jsc#SLE-18970). - scsi: lpfc: vmid: Add datastructure for supporting VMID in lpfc (bsc#1189385 jsc#SLE-18970). - scsi: lpfc: vmid: Add support for VMID in mailbox command (bsc#1189385 jsc#SLE-18970). - scsi: lpfc: vmid: Append the VMID to the wqe before sending (bsc#1189385 jsc#SLE-18970). - scsi: lpfc: vmid: Functions to manage VMIDs (bsc#1189385 jsc#SLE-18970). - scsi: lpfc: vmid: Implement CT commands for appid (bsc#1189385 jsc#SLE-18970). - scsi: lpfc: vmid: Implement ELS commands for appid (bsc#1189385 jsc#SLE-18970). - scsi: lpfc: vmid: Introduce VMID in I/O path (bsc#1189385 jsc#SLE-18970). - scsi: lpfc: vmid: Timeout implementation for VMID (bsc#1189385 jsc#SLE-18970). - scsi: lpfc: vmid: VMID parameter initialization (bsc#1189385 jsc#SLE-18970). - scsi: mpt3sas: Fix ReplyPostFree pool allocation (bsc#1181006). - scsi: qla2xxx: Add heartbeat check (bsc#1189392). - scsi: qla2xxx: Fix error return code in qla82xx_write_flash_dword() (bsc#1189392). - scsi: qla2xxx: Fix spelling mistakes "allloc" -> "alloc" (bsc#1189392). - scsi: qla2xxx: Fix use after free in debug code (bsc#1189392). - scsi: qla2xxx: Log PCI address in qla_nvme_unregister_remote_port() (bsc#1189392). - scsi: qla2xxx: Remove duplicate declarations (bsc#1189392). - scsi: qla2xxx: Remove redundant assignment to rval (bsc#1189392). - scsi: qla2xxx: Remove redundant continue statement in a for-loop (bsc#1189392). - scsi: qla2xxx: Remove redundant initialization of variable num_cnt (bsc#1189392). - scsi: qla2xxx: Remove unused variable 'status' (bsc#1189392). - scsi: qla2xxx: Update version to 10.02.00.107-k (bsc#1189392). - scsi: qla2xxx: Use list_move_tail() instead of list_del()/list_add_tail() (bsc#1189392). - scsi: qla2xxx: Use the proper SCSI midlayer interfaces for PI (bsc#1189392). - scsi: qla2xxx: edif: Add authentication pass + fail bsgs (bsc#1189392). - scsi: qla2xxx: edif: Add detection of secure device (bsc#1189392). - scsi: qla2xxx: edif: Add doorbell notification for app (bsc#1189392). - scsi: qla2xxx: edif: Add encryption to I/O path (bsc#1189392). - scsi: qla2xxx: edif: Add extraction of auth_els from the wire (bsc#1189392). - scsi: qla2xxx: edif: Add getfcinfo and statistic bsgs (bsc#1189392). - scsi: qla2xxx: edif: Add key update (bsc#1189392). - scsi: qla2xxx: edif: Add send, receive, and accept for auth_els (bsc#1189392). - scsi: qla2xxx: edif: Add start + stop bsgs (bsc#1189392). - scsi: qla2xxx: edif: Increment command and completion counts (bsc#1189392). - scsi: scsi_transport_srp: Do not block target in SRP_PORT_LOST state (bsc#1184180). - scsi: target: qla2xxx: Wait for stop_phase1 at WWN removal (bsc#1189392). - scsi: zfcp: Report port fc_security as unknown early during remote cable pull (git-fixes). - serial: 8250: Mask out floating 16/32-bit bus bits (git-fixes). - serial: 8250_mtk: fix uart corruption issue when rx power off (git-fixes). - serial: 8250_pci: Avoid irq sharing for MSI(-X) interrupts (git-fixes). - serial: 8250_pci: Enumerate Elkhart Lake UARTs via dedicated driver (git-fixes). - serial: tegra: Only print FIFO error message when an error occurs (git-fixes). - slimbus: messaging: check for valid transaction id (git-fixes). - slimbus: messaging: start transaction ids from 1 instead of zero (git-fixes). - slimbus: ngd: reset dma setup during runtime pm (git-fixes). - soc: aspeed: lpc-ctrl: Fix boundary check for mmap (git-fixes). - soc: aspeed: p2a-ctrl: Fix boundary check for mmap (git-fixes). - soc: ixp4xx/qmgr: fix invalid __iomem access (git-fixes). - soc: ixp4xx/qmgr: fix invalid __iomem access (git-fixes). - soc: ixp4xx: fix printing resources (git-fixes). - soc: ixp4xx: fix printing resources (git-fixes). - soc: qcom: rpmhpd: Use corner in power_off (git-fixes). - soc: qcom: smsm: Fix missed interrupts if state changes while masked (git-fixes). - spi: imx: mx51-ecspi: Fix CONFIGREG delay comment (git-fixes). - spi: imx: mx51-ecspi: Fix low-speed CONFIGREG delay calculation (git-fixes). - spi: imx: mx51-ecspi: Reinstate low-speed CONFIGREG delay (git-fixes). - spi: mediatek: Fix fifo transfer (git-fixes). - spi: meson-spicc: fix memory leak in meson_spicc_remove (git-fixes). - spi: spi-fsl-dspi: Fix issue with uninitialized dma_slave_config (git-fixes). - spi: spi-pic32: Fix issue with uninitialized dma_slave_config (git-fixes). - spi: sprd: Fix the wrong WDG_LOAD_VAL (git-fixes). - spi: stm32h7: fix full duplex irq handler handling (git-fixes). - staging: rtl8192u: Fix bitwise vs logical operator in TranslateRxSignalStuff819xUsb() (git-fixes). - staging: rtl8712: get rid of flush_scheduled_work (git-fixes). - staging: rtl8723bs: Fix a resource leak in sd_int_dpc (git-fixes). - staging: rtl8723bs: Fix a resource leak in sd_int_dpc (git-fixes). - tracing / histogram: Fix NULL pointer dereference on strcmp() on NULL event name (git-fixes). - tracing / histogram: Give calculation hist_fields a size (git-fixes). - tracing: Reject string operand in the histogram expression (git-fixes). - tty: serial: fsl_lpuart: fix the wrong mapbase value (git-fixes). - ubifs: Fix error return code in alloc_wbufs() (bsc#1189585). - ubifs: Fix memleak in ubifs_init_authentication (bsc#1189583). - ubifs: Only check replay with inode type to judge if inode linked (bsc#1187455). - ubifs: Set/Clear I_LINKABLE under i_lock for whiteout inode (bsc#1189587). - ubifs: journal: Fix error return code in ubifs_jnl_write_inode() (bsc#1189586). - usb: bdc: Fix an error handling path in 'bdc_probe()' when no suitable DMA config is available (git-fixes). - usb: dwc3: Disable phy suspend after power-on reset (git-fixes). - usb: dwc3: Separate field holding multiple properties (git-fixes). - usb: dwc3: Stop active transfers before halting the controller (git-fixes). - usb: dwc3: Use clk_bulk_prepare_enable() (git-fixes). - usb: dwc3: Use devres to get clocks (git-fixes). - usb: dwc3: core: do not do suspend for device mode if already suspended (git-fixes). - usb: dwc3: debug: Remove newline printout (git-fixes). - usb: dwc3: gadget: Check MPS of the request length (git-fixes). - usb: dwc3: gadget: Clear DCTL.ULSTCHNGREQ before set (git-fixes). - usb: dwc3: gadget: Clear DEP flags after stop transfers in ep disable (git-fixes). - usb: dwc3: gadget: Disable gadget IRQ during pullup disable (git-fixes). - usb: dwc3: gadget: Do not send unintended link state change (git-fixes). - usb: dwc3: gadget: Do not setup more than requested (git-fixes). - usb: dwc3: gadget: Fix dwc3_calc_trbs_left() (git-fixes). - usb: dwc3: gadget: Fix handling ZLP (git-fixes). - usb: dwc3: gadget: Give back staled requests (git-fixes). - usb: dwc3: gadget: Handle ZLP for sg requests (git-fixes). - usb: dwc3: gadget: Prevent EP queuing while stopping transfers (git-fixes). - usb: dwc3: gadget: Properly track pending and queued SG (git-fixes). - usb: dwc3: gadget: Restart DWC3 gadget when enabling pullup (git-fixes). - usb: dwc3: gadget: Set BESL config parameter (git-fixes). - usb: dwc3: gadget: Set link state to RX_Detect on disconnect (git-fixes). - usb: dwc3: gadget: Stop EP0 transfers during pullup disable (git-fixes). - usb: dwc3: gadget: Workaround Mirosoft's BESL check (git-fixes). - usb: dwc3: meson-g12a: add IRQ check (git-fixes). - usb: dwc3: meson-g12a: check return of dwc3_meson_g12a_usb_init (git-fixes). - usb: dwc3: of-simple: add a shutdown (git-fixes). - usb: dwc3: st: Add of_dev_put() in probe function (git-fixes). - usb: dwc3: st: Add of_node_put() before return in probe function (git-fixes). - usb: dwc3: support continuous runtime PM with dual role (git-fixes). - usb: ehci-orion: Handle errors of clk_prepare_enable() in probe (git-fixes). - usb: gadget: Export recommended BESL values (git-fixes). - usb: gadget: f_hid: added GET_IDLE and SET_IDLE handlers (git-fixes). - usb: gadget: f_hid: fixed NULL pointer dereference (git-fixes). - usb: gadget: f_hid: idle uses the highest byte for duration (git-fixes). - usb: gadget: mv_u3d: request_irq() after initializing UDC (git-fixes). - usb: gadget: udc: at91: add IRQ check (git-fixes). - usb: gadget: udc: renesas_usb3: Fix soc_device_match() abuse (git-fixes). - usb: host: ohci-tmio: add IRQ check (git-fixes). - usb: host: xhci-rcar: Do not reload firmware after the completion (git-fixes). - usb: mtu3: fix the wrong HS mult value (git-fixes). - usb: mtu3: use @mult for HS isoc or intr (git-fixes). - usb: phy: fsl-usb: add IRQ check (git-fixes). - usb: phy: tahvo: add IRQ check (git-fixes). - usb: phy: twl6030: add IRQ checks (git-fixes). - usr: Add support for zstd compressed initramfs (bsc#1187483, jsc#SLE-18766). - virt_wifi: fix error on connect (git-fixes). - wireguard: allowedips: allocate nodes in kmem_cache (git-fixes). - wireguard: allowedips: free empty intermediate nodes when removing single node (git-fixes). - wireguard: allowedips: remove nodes in O(1) (git-fixes). - writeback: fix obtain a reference to a freeing memcg css (bsc#1189577). - x86/fpu: Limit xstate copy size in xstateregs_set() (bsc#1152489). - x86/fpu: Make init_fpstate correct with optimized XSAVE (bsc#1152489). - x86/fpu: Reset state for all signal restore failures (bsc#1152489). - x86/kvm: fix vcpu-id indexed array sizes (git-fixes). - x86/sev: Make sure IRQs are disabled while GHCB is active (jsc#SLE-14337). - x86/sev: Split up runtime #VC handler for correct state tracking (jsc#SLE-14337). - x86/sev: Use "SEV: " prefix for messages from sev.c (jsc#SLE-14337). - x86/signal: Detect and prevent an alternate signal stack overflow (bsc#1152489). - x86/split_lock: Provide handle_guest_split_lock() (bsc#1187959). - xen/events: Fix race in set_evtchn_to_irq (git-fixes). - xprtrdma: Pad optimization, revisited (bsc#1189760). Special Instructions and Notes: Please reboot the system after installing this update. Patch Instructions: To install this openSUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 15.3: zypper in -t patch openSUSE-SLE-15.3-2021-3179=1 Package List: - openSUSE Leap 15.3 (noarch): kernel-devel-azure-5.3.18-38.22.1 kernel-source-azure-5.3.18-38.22.1 - openSUSE Leap 15.3 (x86_64): cluster-md-kmp-azure-5.3.18-38.22.2 cluster-md-kmp-azure-debuginfo-5.3.18-38.22.2 dlm-kmp-azure-5.3.18-38.22.2 dlm-kmp-azure-debuginfo-5.3.18-38.22.2 gfs2-kmp-azure-5.3.18-38.22.2 gfs2-kmp-azure-debuginfo-5.3.18-38.22.2 kernel-azure-5.3.18-38.22.2 kernel-azure-debuginfo-5.3.18-38.22.2 kernel-azure-debugsource-5.3.18-38.22.2 kernel-azure-devel-5.3.18-38.22.2 kernel-azure-devel-debuginfo-5.3.18-38.22.2 kernel-azure-extra-5.3.18-38.22.2 kernel-azure-extra-debuginfo-5.3.18-38.22.2 kernel-azure-livepatch-devel-5.3.18-38.22.2 kernel-azure-optional-5.3.18-38.22.2 kernel-azure-optional-debuginfo-5.3.18-38.22.2 kernel-syms-azure-5.3.18-38.22.1 kselftests-kmp-azure-5.3.18-38.22.2 kselftests-kmp-azure-debuginfo-5.3.18-38.22.2 ocfs2-kmp-azure-5.3.18-38.22.2 ocfs2-kmp-azure-debuginfo-5.3.18-38.22.2 reiserfs-kmp-azure-5.3.18-38.22.2 reiserfs-kmp-azure-debuginfo-5.3.18-38.22.2 References: https://www.suse.com/security/cve/CVE-2020-12770.html https://www.suse.com/security/cve/CVE-2021-34556.html https://www.suse.com/security/cve/CVE-2021-35477.html https://www.suse.com/security/cve/CVE-2021-3640.html https://www.suse.com/security/cve/CVE-2021-3653.html https://www.suse.com/security/cve/CVE-2021-3656.html https://www.suse.com/security/cve/CVE-2021-3679.html https://www.suse.com/security/cve/CVE-2021-3732.html https://www.suse.com/security/cve/CVE-2021-3739.html https://www.suse.com/security/cve/CVE-2021-3743.html https://www.suse.com/security/cve/CVE-2021-3753.html https://www.suse.com/security/cve/CVE-2021-3759.html https://www.suse.com/security/cve/CVE-2021-38160.html https://www.suse.com/security/cve/CVE-2021-38166.html https://www.suse.com/security/cve/CVE-2021-38198.html https://www.suse.com/security/cve/CVE-2021-38204.html https://www.suse.com/security/cve/CVE-2021-38205.html https://www.suse.com/security/cve/CVE-2021-38206.html https://www.suse.com/security/cve/CVE-2021-38207.html https://www.suse.com/security/cve/CVE-2021-38209.html https://bugzilla.suse.com/1040364 https://bugzilla.suse.com/1127650 https://bugzilla.suse.com/1135481 https://bugzilla.suse.com/1152489 https://bugzilla.suse.com/1160010 https://bugzilla.suse.com/1168202 https://bugzilla.suse.com/1171420 https://bugzilla.suse.com/1174969 https://bugzilla.suse.com/1175052 https://bugzilla.suse.com/1175543 https://bugzilla.suse.com/1177399 https://bugzilla.suse.com/1180100 https://bugzilla.suse.com/1180141 https://bugzilla.suse.com/1180347 https://bugzilla.suse.com/1181006 https://bugzilla.suse.com/1181148 https://bugzilla.suse.com/1181972 https://bugzilla.suse.com/1184180 https://bugzilla.suse.com/1185902 https://bugzilla.suse.com/1186264 https://bugzilla.suse.com/1186731 https://bugzilla.suse.com/1187211 https://bugzilla.suse.com/1187455 https://bugzilla.suse.com/1187468 https://bugzilla.suse.com/1187483 https://bugzilla.suse.com/1187619 https://bugzilla.suse.com/1187959 https://bugzilla.suse.com/1188067 https://bugzilla.suse.com/1188172 https://bugzilla.suse.com/1188231 https://bugzilla.suse.com/1188270 https://bugzilla.suse.com/1188412 https://bugzilla.suse.com/1188418 https://bugzilla.suse.com/1188616 https://bugzilla.suse.com/1188700 https://bugzilla.suse.com/1188780 https://bugzilla.suse.com/1188781 https://bugzilla.suse.com/1188782 https://bugzilla.suse.com/1188783 https://bugzilla.suse.com/1188784 https://bugzilla.suse.com/1188786 https://bugzilla.suse.com/1188787 https://bugzilla.suse.com/1188788 https://bugzilla.suse.com/1188790 https://bugzilla.suse.com/1188878 https://bugzilla.suse.com/1188885 https://bugzilla.suse.com/1188924 https://bugzilla.suse.com/1188982 https://bugzilla.suse.com/1188983 https://bugzilla.suse.com/1188985 https://bugzilla.suse.com/1189021 https://bugzilla.suse.com/1189057 https://bugzilla.suse.com/1189077 https://bugzilla.suse.com/1189153 https://bugzilla.suse.com/1189197 https://bugzilla.suse.com/1189209 https://bugzilla.suse.com/1189210 https://bugzilla.suse.com/1189212 https://bugzilla.suse.com/1189213 https://bugzilla.suse.com/1189214 https://bugzilla.suse.com/1189215 https://bugzilla.suse.com/1189216 https://bugzilla.suse.com/1189217 https://bugzilla.suse.com/1189218 https://bugzilla.suse.com/1189219 https://bugzilla.suse.com/1189220 https://bugzilla.suse.com/1189221 https://bugzilla.suse.com/1189222 https://bugzilla.suse.com/1189225 https://bugzilla.suse.com/1189229 https://bugzilla.suse.com/1189233 https://bugzilla.suse.com/1189262 https://bugzilla.suse.com/1189291 https://bugzilla.suse.com/1189292 https://bugzilla.suse.com/1189296 https://bugzilla.suse.com/1189298 https://bugzilla.suse.com/1189301 https://bugzilla.suse.com/1189305 https://bugzilla.suse.com/1189323 https://bugzilla.suse.com/1189384 https://bugzilla.suse.com/1189385 https://bugzilla.suse.com/1189392 https://bugzilla.suse.com/1189393 https://bugzilla.suse.com/1189399 https://bugzilla.suse.com/1189400 https://bugzilla.suse.com/1189427 https://bugzilla.suse.com/1189503 https://bugzilla.suse.com/1189504 https://bugzilla.suse.com/1189505 https://bugzilla.suse.com/1189506 https://bugzilla.suse.com/1189507 https://bugzilla.suse.com/1189562 https://bugzilla.suse.com/1189563 https://bugzilla.suse.com/1189564 https://bugzilla.suse.com/1189565 https://bugzilla.suse.com/1189566 https://bugzilla.suse.com/1189567 https://bugzilla.suse.com/1189568 https://bugzilla.suse.com/1189569 https://bugzilla.suse.com/1189573 https://bugzilla.suse.com/1189574 https://bugzilla.suse.com/1189575 https://bugzilla.suse.com/1189576 https://bugzilla.suse.com/1189577 https://bugzilla.suse.com/1189579 https://bugzilla.suse.com/1189581 https://bugzilla.suse.com/1189582 https://bugzilla.suse.com/1189583 https://bugzilla.suse.com/1189585 https://bugzilla.suse.com/1189586 https://bugzilla.suse.com/1189587 https://bugzilla.suse.com/1189696 https://bugzilla.suse.com/1189706 https://bugzilla.suse.com/1189760 https://bugzilla.suse.com/1189762 https://bugzilla.suse.com/1189832 https://bugzilla.suse.com/1189841 https://bugzilla.suse.com/1189870 https://bugzilla.suse.com/1189872 https://bugzilla.suse.com/1189883 https://bugzilla.suse.com/1190022 https://bugzilla.suse.com/1190025 https://bugzilla.suse.com/1190115 https://bugzilla.suse.com/1190117 https://bugzilla.suse.com/1190412 https://bugzilla.suse.com/1190413 https://bugzilla.suse.com/1190428

1 0

openSUSE-RU-2021:3182-1: moderate: Recommended update for file
by maintenance＠opensuse.org 21 Sep '21

21 Sep '21

openSUSE Recommended Update: Recommended update for file ______________________________________________________________________________ Announcement ID: openSUSE-RU-2021:3182-1 Rating: moderate References: #1189996 Affected Products: openSUSE Leap 15.3 ______________________________________________________________________________ An update that has one recommended fix can now be installed. Description: This update for file fixes the following issues: - Fixes exception thrown by memory allocation problem (bsc#1189996) Patch Instructions: To install this openSUSE Recommended Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 15.3: zypper in -t patch openSUSE-SLE-15.3-2021-3182=1 Package List: - openSUSE Leap 15.3 (aarch64 ppc64le s390x x86_64): file-5.32-7.14.1 file-debuginfo-5.32-7.14.1 file-debugsource-5.32-7.14.1 file-devel-5.32-7.14.1 libmagic1-5.32-7.14.1 libmagic1-debuginfo-5.32-7.14.1 python2-magic-5.32-7.14.1 python3-magic-5.32-7.14.1 - openSUSE Leap 15.3 (noarch): file-magic-5.32-7.14.1 - openSUSE Leap 15.3 (x86_64): file-devel-32bit-5.32-7.14.1 libmagic1-32bit-5.32-7.14.1 libmagic1-32bit-debuginfo-5.32-7.14.1 References: https://bugzilla.suse.com/1189996

1 0

openSUSE-RU-2021:1292-1: moderate: Recommended update for lshw
by maintenance＠opensuse.org 21 Sep '21

21 Sep '21

openSUSE Recommended Update: Recommended update for lshw ______________________________________________________________________________ Announcement ID: openSUSE-RU-2021:1292-1 Rating: moderate References: SLE-19399 Affected Products: openSUSE Leap 15.2 ______________________________________________________________________________ An update that has 0 recommended fixes and contains one feature can now be installed. Description: This update for lshw fixes the following issues: - Update to version B.02.19.2+git.20210619 (jsc#SLE-19399) This update was imported from the SUSE:SLE-15-SP2:Update update project. Patch Instructions: To install this openSUSE Recommended Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 15.2: zypper in -t patch openSUSE-2021-1292=1 Package List: - openSUSE Leap 15.2 (noarch): lshw-lang-B.02.19.2+git.20210619-lp152.2.9.1 - openSUSE Leap 15.2 (x86_64): lshw-B.02.19.2+git.20210619-lp152.2.9.1 lshw-debuginfo-B.02.19.2+git.20210619-lp152.2.9.1 lshw-debugsource-B.02.19.2+git.20210619-lp152.2.9.1 lshw-gui-B.02.19.2+git.20210619-lp152.2.9.1 lshw-gui-debuginfo-B.02.19.2+git.20210619-lp152.2.9.1 References:

1 0

openSUSE-RU-2021:1299-1: moderate: Recommended update for openhpi
by maintenance＠opensuse.org 21 Sep '21

21 Sep '21

openSUSE Recommended Update: Recommended update for openhpi ______________________________________________________________________________ Announcement ID: openSUSE-RU-2021:1299-1 Rating: moderate References: #1185173 #1190042 Affected Products: openSUSE Leap 15.2 ______________________________________________________________________________ An update that has two recommended fixes can now be installed. Description: This update for openhpi fixes the following issues: - Use /run not /var/run for PID file creation (bsc#1185173) - Remove group rights on config file (bsc#1190042) This update was imported from the SUSE:SLE-15-SP1:Update update project. Patch Instructions: To install this openSUSE Recommended Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 15.2: zypper in -t patch openSUSE-2021-1299=1 Package List: - openSUSE Leap 15.2 (x86_64): libopenhpi4-3.8.0-lp152.3.3.1 libopenhpi4-debuginfo-3.8.0-lp152.3.3.1 openhpi-3.8.0-lp152.3.3.1 openhpi-clients-3.8.0-lp152.3.3.1 openhpi-clients-debuginfo-3.8.0-lp152.3.3.1 openhpi-daemon-3.8.0-lp152.3.3.1 openhpi-daemon-debuginfo-3.8.0-lp152.3.3.1 openhpi-debuginfo-3.8.0-lp152.3.3.1 openhpi-debugsource-3.8.0-lp152.3.3.1 openhpi-devel-3.8.0-lp152.3.3.1 References: https://bugzilla.suse.com/1185173 https://bugzilla.suse.com/1190042

1 0

openSUSE-SU-2021:3175-1: moderate: Security update for grafana-piechart-panel
by opensuse-security＠opensuse.org 21 Sep '21

21 Sep '21

openSUSE Security Update: Security update for grafana-piechart-panel ______________________________________________________________________________ Announcement ID: openSUSE-SU-2021:3175-1 Rating: moderate References: #1172125 Cross-References: CVE-2020-13429 CVSS scores: CVE-2020-13429 (NVD) : 5.4 CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N CVE-2020-13429 (SUSE): 6.4 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N Affected Products: openSUSE Leap 15.3 ______________________________________________________________________________ An update that fixes one vulnerability is now available. Description: This update for grafana-piechart-panel fixes the following issues: - CVE-2020-13429: Fixed XSS via the Values Header option in the piechart-panel (bsc#1172125). Patch Instructions: To install this openSUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 15.3: zypper in -t patch openSUSE-SLE-15.3-2021-3175=1 Package List: - openSUSE Leap 15.3 (noarch): grafana-piechart-panel-1.6.1-3.6.1 References: https://www.suse.com/security/cve/CVE-2020-13429.html https://bugzilla.suse.com/1172125

1 0

openSUSE-SU-2021:1289-1: important: Security update for php-composer
by opensuse-security＠opensuse.org 21 Sep '21

21 Sep '21

openSUSE Security Update: Security update for php-composer ______________________________________________________________________________ Announcement ID: openSUSE-SU-2021:1289-1 Rating: important References: #1185376 #1187416 Cross-References: CVE-2021-29472 CVSS scores: CVE-2021-29472 (NVD) : 8.8 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H Affected Products: openSUSE Leap 15.2 openSUSE Backports SLE-15-SP3 openSUSE Backports SLE-15-SP2 openSUSE Backports SLE-15-SP1 ______________________________________________________________________________ An update that solves one vulnerability and has one errata is now available. Description: This update for php-composer fixes the following issues: - Require php-mbstring as requested in boo#1187416 - Version 1.10.22 * Security: Fixed command injection vulnerability in HgDriver/HgDownloader and hardened other VCS drivers and downloaders (GHSA-h5h8-pc6h-jvvx / CVE-2021-29472), boo#1185376 - Version 1.10.21 * Fixed support for new GitHub OAuth token format * Fixed processes silently ignoring the CWD when it does not exist - Version 1.10.20 * Fixed exclude-from-classmap causing regex issues when having too many paths * Fixed compatibility issue with Symfony 4/5 - Version 1.10.17 * Fixed Bitbucket API authentication issue * Fixed parsing of Composer 2 lock files breaking in some rare conditions - Version 1.10.16 * Added warning to validate command for cases where packages provide/ replace a package that they also require * Fixed JSON schema validation issue with PHPStorm * Fixed symlink handling in archive command - Version 1.10.15 * Fixed path repo version guessing issue - Version 1.10.14 * Fixed version guesser to look at remote branches as well as local ones * Fixed path repositories version guessing to handle edge cases where version is different from the VCS-guessed version * Fixed COMPOSER env var causing issues when combined with the global command * Fixed a few issues dealing with PHP without openssl extension (not recommended at all but sometimes needed for testing) - Version 1.10.13 * Fixed regressions with old version validation * Fixed invalid root aliases not being reported - Version 1.10.12 * Fixed regressions with old version validation - Version 1.10.11 * Fixed more PHP 8 compatibility issues * Fixed regression in handling of CTRL-C when xdebug is loaded * Fixed status handling of broken symlinks - Version 1.10.10 * Fixed create-project not triggering events while installing the root package * Fixed PHP 8 compatibility issue * Fixed self-update to avoid automatically upgrading to the next major version once it becomes stable - Version 1.10.9 * Fixed Bitbucket redirect loop when credentials are outdated * Fixed GitLab auth prompt wording * Fixed self-update handling of files requiring admin permissions to write to on Windows (it now does a UAC prompt) * Fixed parsing issues in funding.yml files - Version 1.10.8 * Fixed compatibility issue with git being configured to show signatures by default * Fixed discarding of local changes when updating packages to include untracked files * Several minor fixes - Version 1.10.7 * Fixed PHP 8 deprecations * Fixed detection of pcntl_signal being in disabled_functions when pcntl_async_signal is allowed - Version 1.10.6 * Fixed version guessing to take composer-runtime-api and composer-plugin-api requirements into account to avoid selecting packages which require Composer 2 * Fixed package name validation to allow several dashes following each other * Fixed post-status-cmd script not firing when there were no changes to be displayed * Fixed composer-runtime-api support on Composer 1.x, the package is now present as 1.0.0 * Fixed support for composer show --name-only --self * Fixed detection of GitLab URLs when handling authentication in some cases - Version 1.10.5 * Fixed self-update on PHP <5.6, seriously please upgrade * Fixed 1.10.2 regression with PATH resolution in scripts - Version 1.10.4 * Fixed 1.10.2 regression in path symlinking with absolute path repos - Version 1.10.3 * Fixed invalid --2 flag warning in self-update when no channel is requested - Version 1.10.2 * Added --1 flag to self-update command which can be added to automated self-update runs to make sure it won't automatically jump to 2.0 once that is released * Fixed path repository symlinks being made relative when the repo url is defined as absolute paths * Fixed potential issues when using "composer ..." in scripts and composer/composer was also required in the project * Fixed 1.10.0 regression when downloading GitHub archives from non-API URLs * Fixed handling of malformed info in fund command * Fixed Symfony5 compatibility issues in a few commands - Version 1.10.1 * Fixed path repository warning on empty path when using wildcards * Fixed superfluous warnings when generating optimized autoloaders - Version 1.10.0 * Breaking: composer global exec ... now executes the process in the current working directory instead of executing it in the global directory. * Warning: Added a warning when class names are being loaded by a PSR-4 or PSR-0 rule only due to classmap optimization, but would not otherwise be autoloadable. Composer 2.0 will stop autoloading these classes so make sure you fix your autoload configs. * Added new funding key to composer.json to describe ways your package's maintenance can be funded. This reads info from GitHub's FUNDING.yml by default so better configure it there so it shows on GitHub and Composer/Packagist * Added composer fund command to show funding info of your dependencies * Added bearer auth config to authenticate using Authorization: Bearer <token> headers * Added plugin-api-version in composer.lock so third-party tools can know which Composer version was used to generate a lock file * Added support for --format=json output for show command when showing a single package * Added support for configuring suggestions using config command, e.g. composer config suggest.foo/bar some text * Added support for configuring fine-grained preferred-install using config command, e.g. composer config preferred-install.foo/* dist * Added @putenv script handler to set environment variables from composer.json for following scripts * Added lock option that can be set to false, in which case no composer.lock file will be generated * Added --add-repository flag to create-project command which will persist the repo given in --repository into the composer.json of the package being installed * Fixed issue where --no-dev autoload generation was excluding some packages which should not have been excluded * Added support for IPv6 addresses in NO_PROXY * Added package homepage display in the show command * Added debug info about HTTP authentications * Added Symfony 5 compatibility * Added --fixed flag to require command to make it use a fixed constraint instead of a ^x.y constraint when adding the requirement * Fixed exclude-from-classmap matching subsets of directories e.g. foo/ was excluding foobar/ * Fixed archive command to persist file permissions inside the zip files * Fixed init/require command to avoid suggesting packages which are already selected in the search results * Fixed create-project UX issues * Fixed filemtime for vendor/composer/* files is now only changing when the files actually change * Fixed issues detecting docker environment with an active open_basedir - Version 1.9.3 * Fixed GitHub deprecation of access_token query parameter, now using Authorization header - Version 1.9.2 * Fixed minor git driver bugs * Fixed schema validation for version field to allow dev-* versions too * Fixed external processes' output being formatted even though it should not * Fixed issue with path repositories when trying to install feature branches - Version 1.9.1 * Fixed various credential handling issues with gitlab and github * Fixed credentials being present in git remotes in Composer cache and vendor directory when not using SSH keys * Fixed composer why not listing replacers as a reason something is present * Fixed various PHP 7.4 compatibility issues * Fixed root warnings always present in Docker containers, setting COMPOSER_ALLOW_SUPERUSER is not necessary anymore * Fixed GitHub access tokens leaking into debug-verbosity output * Fixed several edge case issues detecting GitHub, Bitbucket and GitLab repository types * Fixed Composer asking if you want to use a composer.json in a parent directory when ran in non-interactive mode * Fixed classmap autoloading issue finding classes located within a few non-PHP context blocks (?>...<?php) - Version 1.9.0 * Added a --no-cache flag available on all commands to run with the cache disabled * Added PHP_BINARY as env var pointing to the PHP process when executing Composer scripts as shell scripts * Added a use-github-api config option which can set the no-api flag on all GitHub VCS repositories declared * Added a static helper you can preprend to a script to avoid process timeouts, "Composer\\Config::disableProcessTimeout" * Added Event::getOriginatingEvent to retrieve an event's original event when a script handler forwards to another one * Added support for autoloading directly from a phar file * Fixed loading order of plugins to always initialize them in order of dependencies * Fixed various network-mount related issues * Fixed --ignore-platform-reqs not ignoring conflict rules against platform packages - Version 1.8.6 * Fixed handling of backslash-escapes handling in compoesr.json when using the require command * Fixed create-project not following classmap-authoritative and apcu-autoloader config values * Fixed HHVM version warning showing up in some cases when it was not in use Patch Instructions: To install this openSUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 15.2: zypper in -t patch openSUSE-2021-1289=1 - openSUSE Backports SLE-15-SP3: zypper in -t patch openSUSE-2021-1289=1 - openSUSE Backports SLE-15-SP2: zypper in -t patch openSUSE-2021-1289=1 - openSUSE Backports SLE-15-SP1: zypper in -t patch openSUSE-2021-1289=1 Package List: - openSUSE Leap 15.2 (noarch): php-composer-1.10.22-lp152.2.3.1 - openSUSE Backports SLE-15-SP3 (noarch): php-composer-1.10.22-bp153.2.3.1 - openSUSE Backports SLE-15-SP2 (noarch): php-composer-1.10.22-bp152.2.3.1 - openSUSE Backports SLE-15-SP1 (noarch): php-composer-1.10.22-bp151.3.3.1 References: https://www.suse.com/security/cve/CVE-2021-29472.html https://bugzilla.suse.com/1185376 https://bugzilla.suse.com/1187416

1 0

openSUSE-RU-2021:3173-1: Recommended update for release-notes-sles
by maintenance＠opensuse.org 21 Sep '21

21 Sep '21

openSUSE Recommended Update: Recommended update for release-notes-sles ______________________________________________________________________________ Announcement ID: openSUSE-RU-2021:3173-1 Rating: low References: #1187693 #1188305 #1188511 #1189786 #933411 SLE-13565 SLE-17703 SLE-17881 Affected Products: openSUSE Leap 15.3 ______________________________________________________________________________ An update that has 5 recommended fixes and contains three features can now be installed. Description: This update for release-notes-sles fixes the following issues: - Added note about NVIDIA vGPU support (jsc#SLE-17881) - Added note about Intel technologies (bsc#1189786) - Added note about ODBC drivers (jsc#SLE-17703) - Added note about NVIDIA BlueField-2 tech preview (jsc#SLE-13565) - Added note about kubevirt-virt-* (bsc#1187693) - Fixed typo in note about compat-libpthread-nonshared (bsc#1188511) - Removed mention of SES (bsc#1188305) Patch Instructions: To install this openSUSE Recommended Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 15.3: zypper in -t patch openSUSE-SLE-15.3-2021-3173=1 Package List: - openSUSE Leap 15.3 (noarch): release-notes-sles-15.3.20210903-3.9.1 References: https://bugzilla.suse.com/1187693 https://bugzilla.suse.com/1188305 https://bugzilla.suse.com/1188511 https://bugzilla.suse.com/1189786 https://bugzilla.suse.com/933411

1 0

openSUSE-RU-2021:1290-1: important: Recommended update for yast2-country
by maintenance＠opensuse.org 21 Sep '21

21 Sep '21

openSUSE Recommended Update: Recommended update for yast2-country ______________________________________________________________________________ Announcement ID: openSUSE-RU-2021:1290-1 Rating: important References: #1188406 #1189461 Affected Products: openSUSE Leap 15.2 ______________________________________________________________________________ An update that has two recommended fixes can now be installed. Description: This update for yast2-country fixes the following issues: - AutoYaST: allow empty /profile/timezone/timezone setting meaning to keep the UTC default. (bsc#1188406) - Move the keyboards database to 'lib/' to make the module compatible with the 'self-update' mechanism. (bsc#1189461) This update was imported from the SUSE:SLE-15-SP2:Update update project. Patch Instructions: To install this openSUSE Recommended Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 15.2: zypper in -t patch openSUSE-2021-1290=1 Package List: - openSUSE Leap 15.2 (i586 x86_64): yast2-country-4.2.23-lp152.2.9.1 yast2-country-data-4.2.23-lp152.2.9.1 References: https://bugzilla.suse.com/1188406 https://bugzilla.suse.com/1189461

1 0

openSUSE-RU-2021:3161-1: moderate: Recommended update for salt
by maintenance＠opensuse.org 20 Sep '21

20 Sep '21

openSUSE Recommended Update: Recommended update for salt ______________________________________________________________________________ Announcement ID: openSUSE-RU-2021:3161-1 Rating: moderate References: #1168327 #1188259 #1188647 #1189040 Affected Products: openSUSE Leap 15.3 ______________________________________________________________________________ An update that has four recommended fixes can now be installed. Description: This update for salt fixes the following issues: - Fix wrong relative paths resolution with Jinja renderer when importing subdirectories - Don't pass 'shell="/sbin/nologin"' to 'onlyif/unless' checks (bsc#1188259) - Add missing 'aarch64' to rpm package architectures - Fix failing tests for 'CMDRunRedirect' - Fix failing unit test for systemd - Fix error handling in openscap module (bsc#1188647) - Better handling of bad public keys from minions (bsc#1189040) - Add standalone formulas configuration for salt minion and remove salt-master requirement (bsc#1168327) Patch Instructions: To install this openSUSE Recommended Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 15.3: zypper in -t patch openSUSE-SLE-15.3-2021-3161=1 Package List: - openSUSE Leap 15.3 (aarch64 ppc64le s390x x86_64): python3-salt-3002.2-50.1.12.1 salt-3002.2-50.1.12.1 salt-api-3002.2-50.1.12.1 salt-cloud-3002.2-50.1.12.1 salt-doc-3002.2-50.1.12.1 salt-master-3002.2-50.1.12.1 salt-minion-3002.2-50.1.12.1 salt-proxy-3002.2-50.1.12.1 salt-ssh-3002.2-50.1.12.1 salt-standalone-formulas-configuration-3002.2-50.1.12.1 salt-syndic-3002.2-50.1.12.1 salt-transactional-update-3002.2-50.1.12.1 - openSUSE Leap 15.3 (noarch): salt-bash-completion-3002.2-50.1.12.1 salt-fish-completion-3002.2-50.1.12.1 salt-zsh-completion-3002.2-50.1.12.1 References: https://bugzilla.suse.com/1168327 https://bugzilla.suse.com/1188259 https://bugzilla.suse.com/1188647 https://bugzilla.suse.com/1189040

1 0

openSUSE-FU-2021:3166-1: moderate: Feature update for SUSE Manager 4.2.2 Proxy
by maintenance＠opensuse.org 20 Sep '21

20 Sep '21

openSUSE Feature Update: Feature update for SUSE Manager 4.2.2 Proxy ______________________________________________________________________________ Announcement ID: openSUSE-FU-2021:3166-1 Rating: moderate References: Affected Products: openSUSE Leap 15.3 ______________________________________________________________________________ An update that has 0 feature fixes can now be installed. Description: This update provides the following package to SUSE Manager 4.2.2 Proxy golang-github-prometheus-prometheus: - golang-github-prometheus-prometheus is added to SUSE Manager Proxy as L3 supported. Patch Instructions: To install this openSUSE Feature Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 15.3: zypper in -t patch openSUSE-SLE-15.3-2021-3166=1 Package List: - openSUSE Leap 15.3 (aarch64 ppc64le s390x x86_64): golang-github-prometheus-prometheus-2.27.1-3.10.1 References:

1 0

openSUSE-RU-2021:3167-1: moderate: Recommended update for SUSE Manager Client Tools
by maintenance＠opensuse.org 20 Sep '21

20 Sep '21

openSUSE Recommended Update: Recommended update for SUSE Manager Client Tools ______________________________________________________________________________ Announcement ID: openSUSE-RU-2021:3167-1 Rating: moderate References: #1170823 #1181223 #1188042 #1188846 Affected Products: openSUSE Leap 15.3 ______________________________________________________________________________ An update that has four recommended fixes can now be installed. Description: This update fixes the following issues: dracut-saltboot: - Fix dependencies of python libs (bsc#1188846) koan: - Only recommend 'virt-install' to unbreak scenarios where it is not available in the enabled modules of the system - The xend functionality is not expected to work since this the underlying tool was removed - Python 2 compatibility was fully removed - Add support for EFI reinstallation of a client (bsc#1170823) mgr-daemon: - Update translation strings spacecmd: - Update translation strings - Make schedule_deletearchived to get all actions without display limit - Allow passing a date limit for 'schedule_deletearchived' on 'spacecmd' (bsc#1181223) - Use correct API endpoint in 'list_proxies' (bsc#1188042) - Add schedule_deletearchived to bulk delete archived actions (bsc#1181223) spacewalk-client-tools: - Update translation strings Patch Instructions: To install this openSUSE Recommended Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 15.3: zypper in -t patch openSUSE-SLE-15.3-2021-3167=1 Package List: - openSUSE Leap 15.3 (noarch): dracut-saltboot-0.1.1628156312.dbd0dec-1.30.1 koan-3.0.1-4.20.1 mgr-daemon-4.2.8-1.29.1 python2-spacewalk-check-4.2.13-3.47.2 python2-spacewalk-client-setup-4.2.13-3.47.2 python2-spacewalk-client-tools-4.2.13-3.47.2 python3-spacewalk-check-4.2.13-3.47.2 python3-spacewalk-client-setup-4.2.13-3.47.2 python3-spacewalk-client-tools-4.2.13-3.47.2 spacecmd-4.2.12-3.65.1 spacewalk-check-4.2.13-3.47.2 spacewalk-client-setup-4.2.13-3.47.2 spacewalk-client-tools-4.2.13-3.47.2 References: https://bugzilla.suse.com/1170823 https://bugzilla.suse.com/1181223 https://bugzilla.suse.com/1188042 https://bugzilla.suse.com/1188846

1 0

openSUSE-RU-2021:3171-1: important: Recommended update for java-11-openjdk
by maintenance＠opensuse.org 20 Sep '21

20 Sep '21

openSUSE Recommended Update: Recommended update for java-11-openjdk ______________________________________________________________________________ Announcement ID: openSUSE-RU-2021:3171-1 Rating: important References: #1189201 #1190252 Affected Products: openSUSE Leap 15.3 ______________________________________________________________________________ An update that has two recommended fixes can now be installed. Description: This update for java-11-openjdk fixes the following issues: - Implement FIPS support in OpenJDK - Fix build with 'glibc-2.34' (bsc#1189201) - Add support for 'riscv64' (zero VM) - Make NSS the default security provider. (bsc#1190252) Patch Instructions: To install this openSUSE Recommended Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 15.3: zypper in -t patch openSUSE-SLE-15.3-2021-3171=1 Package List: - openSUSE Leap 15.3 (aarch64 ppc64le s390x x86_64): java-11-openjdk-11.0.12.0-3.62.1 java-11-openjdk-accessibility-11.0.12.0-3.62.1 java-11-openjdk-accessibility-debuginfo-11.0.12.0-3.62.1 java-11-openjdk-debuginfo-11.0.12.0-3.62.1 java-11-openjdk-debugsource-11.0.12.0-3.62.1 java-11-openjdk-demo-11.0.12.0-3.62.1 java-11-openjdk-devel-11.0.12.0-3.62.1 java-11-openjdk-headless-11.0.12.0-3.62.1 java-11-openjdk-jmods-11.0.12.0-3.62.1 java-11-openjdk-src-11.0.12.0-3.62.1 - openSUSE Leap 15.3 (noarch): java-11-openjdk-javadoc-11.0.12.0-3.62.1 References: https://bugzilla.suse.com/1189201 https://bugzilla.suse.com/1190252

1 0

openSUSE-FU-2021:3169-1: moderate: Feature update for SUSE Manager 4.2.2 Proxy and Server
by maintenance＠opensuse.org 20 Sep '21

20 Sep '21

openSUSE Feature Update: Feature update for SUSE Manager 4.2.2 Proxy and Server ______________________________________________________________________________ Announcement ID: openSUSE-FU-2021:3169-1 Rating: moderate References: Affected Products: openSUSE Leap 15.3 ______________________________________________________________________________ An update that has 0 feature fixes can now be installed. Description: This update provides the following packages to SUSE Manager 4.2.2 Proxy and Server: ansible: - ansible and ansible-doc are added to SUSE Manager Proxy as L2 supported golang-github-prometheus-alertmanager: - golang-github-prometheus-alertmanager is added to SUSE Manager Proxy as L3 supported python-python-memcached: - python-python-memcached is added to SUSE Manager Proxy as L3 supported python-redis: - python-redis is added to SUSE Manager Proxy as L3 supported system-user-prometheus: - system-user-prometheus is added to SUSE Manager Proxy as L3 supported Patch Instructions: To install this openSUSE Feature Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 15.3: zypper in -t patch openSUSE-SLE-15.3-2021-3169=1 Package List: - openSUSE Leap 15.3 (noarch): ansible-2.9.21-1.7.1 ansible-doc-2.9.21-1.7.1 ansible-test-2.9.21-1.7.1 python2-python-memcached-1.59-3.7.1 python2-redis-3.4.1-3.5.1 python3-python-memcached-1.59-3.7.1 python3-redis-3.4.1-3.5.1 system-user-prometheus-1.0.0-3.10.1 References:

1 0

openSUSE-FU-2021:3168-1: moderate: Feature update for SUSE Manager 4.2.2 Proxy and Server
by maintenance＠opensuse.org 20 Sep '21

20 Sep '21

openSUSE Feature Update: Feature update for SUSE Manager 4.2.2 Proxy and Server ______________________________________________________________________________ Announcement ID: openSUSE-FU-2021:3168-1 Rating: moderate References: Affected Products: openSUSE Leap 15.3 ______________________________________________________________________________ An update that has 0 feature fixes can now be installed. Description: This update provides the following package to SUSE Manager 4.2.2 Proxy python-pyvmomi: - python-pyvmomi is added to SUSE Manager Proxy as L3 supported. Patch Instructions: To install this openSUSE Feature Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 15.3: zypper in -t patch openSUSE-SLE-15.3-2021-3168=1 Package List: - openSUSE Leap 15.3 (noarch): python2-pyvmomi-6.7.3-3.2.1 python3-pyvmomi-6.7.3-3.2.1 References:

1 0

openSUSE-OU-2021:3146-1: Optional update for kubevirt
by maintenance＠opensuse.org 20 Sep '21

20 Sep '21

openSUSE Optional Update: Optional update for kubevirt ______________________________________________________________________________ Announcement ID: openSUSE-OU-2021:3146-1 Rating: low References: MSC-204 Affected Products: openSUSE Leap 15.3 ______________________________________________________________________________ An update that has 0 optional fixes and contains one feature can now be installed. Description: Initial release of Kubevirt for SUSE Linux Enterprise 15 SP3. Patch Instructions: To install this openSUSE Optional Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 15.3: zypper in -t patch openSUSE-SLE-15.3-2021-3146=1 Package List: - openSUSE Leap 15.3 (x86_64): kubevirt-container-disk-0.45.0-8.4.3 kubevirt-container-disk-debuginfo-0.45.0-8.4.3 kubevirt-manifests-0.45.0-8.4.3 kubevirt-tests-0.45.0-8.4.3 kubevirt-tests-debuginfo-0.45.0-8.4.3 kubevirt-virt-api-0.45.0-8.4.3 kubevirt-virt-api-debuginfo-0.45.0-8.4.3 kubevirt-virt-controller-0.45.0-8.4.3 kubevirt-virt-controller-debuginfo-0.45.0-8.4.3 kubevirt-virt-handler-0.45.0-8.4.3 kubevirt-virt-handler-debuginfo-0.45.0-8.4.3 kubevirt-virt-launcher-0.45.0-8.4.3 kubevirt-virt-launcher-debuginfo-0.45.0-8.4.3 kubevirt-virt-operator-0.45.0-8.4.3 kubevirt-virt-operator-debuginfo-0.45.0-8.4.3 kubevirt-virtctl-0.45.0-8.4.3 kubevirt-virtctl-debuginfo-0.45.0-8.4.3 References:

1 0

openSUSE-RU-2021:1288-1: moderate: Recommended update for nvme-cli
by maintenance＠opensuse.org 18 Sep '21

18 Sep '21

openSUSE Recommended Update: Recommended update for nvme-cli ______________________________________________________________________________ Announcement ID: openSUSE-RU-2021:1288-1 Rating: moderate References: #1186719 #1187287 #1187858 #1187860 #1187890 #1189046 #1189195 Affected Products: openSUSE Leap 15.2 ______________________________________________________________________________ An update that has 7 recommended fixes can now be installed. Description: nvme-cli was updated to fix the following issues: - Do not print error message when opening controller (bsc#1186719) - Fix failures during 'nvme list' (bsc#1186719) - Only connect to matching controllers (bsc#1186719) - Skip connect if transport type doesn't match (bsc#1187287 bsc#1187860) - Ignore non live controllers when scanning subsystems (bsc#1186719 bsc#1187287) - Remove UUID validation heuristic (bsc#1187890) - Do not segfault when controller is not available (bsc#1189046) - Use correct default port for discovery (bsc#1189195 bsc#1187858) This update was imported from the SUSE:SLE-15-SP2:Update update project. Patch Instructions: To install this openSUSE Recommended Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 15.2: zypper in -t patch openSUSE-2021-1288=1 Package List: - openSUSE Leap 15.2 (x86_64): nvme-cli-1.10-lp152.2.18.1 nvme-cli-debuginfo-1.10-lp152.2.18.1 nvme-cli-debugsource-1.10-lp152.2.18.1 nvme-cli-regress-script-1.10-lp152.2.18.1 References: https://bugzilla.suse.com/1186719 https://bugzilla.suse.com/1187287 https://bugzilla.suse.com/1187858 https://bugzilla.suse.com/1187860 https://bugzilla.suse.com/1187890 https://bugzilla.suse.com/1189046 https://bugzilla.suse.com/1189195

1 0

openSUSE-SU-2021:3140-1: moderate: Security update for xen
by opensuse-security＠opensuse.org 18 Sep '21

18 Sep '21

openSUSE Security Update: Security update for xen ______________________________________________________________________________ Announcement ID: openSUSE-SU-2021:3140-1 Rating: moderate References: #1027519 #1189632 Cross-References: CVE-2021-28701 CVSS scores: CVE-2021-28701 (SUSE): 7.4 CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H Affected Products: openSUSE Leap 15.3 ______________________________________________________________________________ An update that solves one vulnerability and has one errata is now available. Description: This update for xen fixes the following issues: - CVE-2021-28701: Fixed race condition in XENMAPSPACE_grant_table handling (XSA-384) (bsc#1189632). - Upstream bug fixes (bsc#1027519) Patch Instructions: To install this openSUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 15.3: zypper in -t patch openSUSE-SLE-15.3-2021-3140=1 Package List: - openSUSE Leap 15.3 (aarch64 x86_64): xen-4.14.2_06-3.12.1 xen-debugsource-4.14.2_06-3.12.1 xen-devel-4.14.2_06-3.12.1 xen-doc-html-4.14.2_06-3.12.1 xen-libs-4.14.2_06-3.12.1 xen-libs-debuginfo-4.14.2_06-3.12.1 xen-tools-4.14.2_06-3.12.1 xen-tools-debuginfo-4.14.2_06-3.12.1 xen-tools-domU-4.14.2_06-3.12.1 xen-tools-domU-debuginfo-4.14.2_06-3.12.1 - openSUSE Leap 15.3 (x86_64): xen-libs-32bit-4.14.2_06-3.12.1 xen-libs-32bit-debuginfo-4.14.2_06-3.12.1 - openSUSE Leap 15.3 (noarch): xen-tools-xendomains-wait-disk-4.14.2_06-3.12.1 References: https://www.suse.com/security/cve/CVE-2021-28701.html https://bugzilla.suse.com/1027519 https://bugzilla.suse.com/1189632

1 0

openSUSE-RU-2021:3139-1: moderate: Recommended update for openhpi
by maintenance＠opensuse.org 18 Sep '21

18 Sep '21

openSUSE Recommended Update: Recommended update for openhpi ______________________________________________________________________________ Announcement ID: openSUSE-RU-2021:3139-1 Rating: moderate References: #1185173 #1190042 Affected Products: openSUSE Leap 15.3 ______________________________________________________________________________ An update that has two recommended fixes can now be installed. Description: This update for openhpi fixes the following issues: - Use /run not /var/run for PID file creation (bsc#1185173) - Remove group rights on config file (bsc#1190042) Patch Instructions: To install this openSUSE Recommended Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 15.3: zypper in -t patch openSUSE-SLE-15.3-2021-3139=1 Package List: - openSUSE Leap 15.3 (aarch64 ppc64le s390x x86_64): libopenhpi4-3.8.0-3.6.1 libopenhpi4-debuginfo-3.8.0-3.6.1 openhpi-3.8.0-3.6.1 openhpi-clients-3.8.0-3.6.1 openhpi-clients-debuginfo-3.8.0-3.6.1 openhpi-daemon-3.8.0-3.6.1 openhpi-daemon-debuginfo-3.8.0-3.6.1 openhpi-debuginfo-3.8.0-3.6.1 openhpi-debugsource-3.8.0-3.6.1 openhpi-devel-3.8.0-3.6.1 References: https://bugzilla.suse.com/1185173 https://bugzilla.suse.com/1190042

1 0

openSUSE-RU-2021:1287-1: moderate: Recommended update for fwts
by maintenance＠opensuse.org 18 Sep '21

18 Sep '21

openSUSE Recommended Update: Recommended update for fwts ______________________________________________________________________________ Announcement ID: openSUSE-RU-2021:1287-1 Rating: moderate References: Affected Products: openSUSE Leap 15.2 openSUSE Backports SLE-15-SP3 openSUSE Backports SLE-15-SP2 openSUSE Backports SLE-15-SP1 ______________________________________________________________________________ An update that has 0 recommended fixes can now be installed. Description: This update for fwts fixes the following issues: Update to version 21.08.00: * lib: fwts_version.h - update to V21.08.00 * debian: update changelog * ARM64 SMCCC firmware API tests * bios: smm: fix indentation * acpi: sbbr: refactor by fwts_get_fadt_version * lib: fwts_acpi_tables: add a function to get FADT versions * acpi: fadt: remove hard-coded FADT version * acpi: fadt: clarify comments of FACS and HW-reduced mode * acpi: dmar: add a warning when PCI device is not found Patch Instructions: To install this openSUSE Recommended Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 15.2: zypper in -t patch openSUSE-2021-1287=1 - openSUSE Backports SLE-15-SP3: zypper in -t patch openSUSE-2021-1287=1 - openSUSE Backports SLE-15-SP2: zypper in -t patch openSUSE-2021-1287=1 - openSUSE Backports SLE-15-SP1: zypper in -t patch openSUSE-2021-1287=1 Package List: - openSUSE Leap 15.2 (x86_64): fwts-21.08.00-lp152.3.18.1 fwts-debuginfo-21.08.00-lp152.3.18.1 fwts-debugsource-21.08.00-lp152.3.18.1 - openSUSE Backports SLE-15-SP3 (aarch64 i586 x86_64): fwts-21.08.00-bp153.2.6.1 fwts-debuginfo-21.08.00-bp153.2.6.1 fwts-debugsource-21.08.00-bp153.2.6.1 - openSUSE Backports SLE-15-SP2 (aarch64 x86_64): fwts-21.08.00-bp152.4.18.1 fwts-debuginfo-21.08.00-bp152.4.18.1 fwts-debugsource-21.08.00-bp152.4.18.1 - openSUSE Backports SLE-15-SP1 (aarch64 x86_64): fwts-21.08.00-bp151.4.18.1 References:

1 0

openSUSE-RU-2021:1285-1: Recommened update for opencl
by maintenance＠opensuse.org 17 Sep '21

17 Sep '21

openSUSE Recommended Update: Recommened update for opencl ______________________________________________________________________________ Announcement ID: openSUSE-RU-2021:1285-1 Rating: low References: #1172303 Affected Products: openSUSE Leap 15.2 ______________________________________________________________________________ An update that has one recommended fix can now be installed. Description: This update provides OpenCL 32bit packages for Wine usage. (bsc#1172303) This update was imported from the openSUSE:Leap:15.1:Update update project. Patch Instructions: To install this openSUSE Recommended Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 15.2: zypper in -t patch openSUSE-2021-1285=1 Package List: - openSUSE Leap 15.2 (i586 x86_64): libOpenCL1-2.2.11-lp152.5.12.1 libOpenCL1-debuginfo-2.2.11-lp152.5.12.1 ocl-icd-debugsource-2.2.11-lp152.5.12.1 ocl-icd-devel-2.2.11-lp152.5.12.1 - openSUSE Leap 15.2 (noarch): opencl-headers-2.2+git.20170617-lp152.4.3.1 - openSUSE Leap 15.2 (x86_64): libOpenCL1-32bit-2.2.11-lp152.5.12.1 libOpenCL1-32bit-debuginfo-2.2.11-lp152.5.12.1 ocl-icd-devel-32bit-2.2.11-lp152.5.12.1 References: https://bugzilla.suse.com/1172303

1 0

openSUSE-RU-2021:1286-1: moderate: Recommended update for PackageKit
by maintenance＠opensuse.org 17 Sep '21

17 Sep '21

openSUSE Recommended Update: Recommended update for PackageKit ______________________________________________________________________________ Announcement ID: openSUSE-RU-2021:1286-1 Rating: moderate References: #1179287 Affected Products: openSUSE Leap 15.2 ______________________________________________________________________________ An update that has one recommended fix can now be installed. Description: This update for PackageKit fixes the following issues: - Fix crash when search string is NULL (bsc#1179287). - Fix hang in packagekit-glib2 client if daemon crashes. This update was imported from the SUSE:SLE-15-SP2:Update update project. Patch Instructions: To install this openSUSE Recommended Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 15.2: zypper in -t patch openSUSE-2021-1286=1 Package List: - openSUSE Leap 15.2 (i586 x86_64): PackageKit-1.1.13-lp152.3.27.1 PackageKit-backend-dnf-1.1.13-lp152.3.27.1 PackageKit-backend-dnf-debuginfo-1.1.13-lp152.3.27.1 PackageKit-backend-zypp-1.1.13-lp152.3.27.1 PackageKit-backend-zypp-debuginfo-1.1.13-lp152.3.27.1 PackageKit-debuginfo-1.1.13-lp152.3.27.1 PackageKit-debugsource-1.1.13-lp152.3.27.1 PackageKit-devel-1.1.13-lp152.3.27.1 PackageKit-devel-debuginfo-1.1.13-lp152.3.27.1 PackageKit-gstreamer-plugin-1.1.13-lp152.3.27.1 PackageKit-gstreamer-plugin-debuginfo-1.1.13-lp152.3.27.1 PackageKit-gtk3-module-1.1.13-lp152.3.27.1 PackageKit-gtk3-module-debuginfo-1.1.13-lp152.3.27.1 libpackagekit-glib2-18-1.1.13-lp152.3.27.1 libpackagekit-glib2-18-debuginfo-1.1.13-lp152.3.27.1 libpackagekit-glib2-devel-1.1.13-lp152.3.27.1 typelib-1_0-PackageKitGlib-1_0-1.1.13-lp152.3.27.1 - openSUSE Leap 15.2 (x86_64): libpackagekit-glib2-18-32bit-1.1.13-lp152.3.27.1 libpackagekit-glib2-18-32bit-debuginfo-1.1.13-lp152.3.27.1 libpackagekit-glib2-devel-32bit-1.1.13-lp152.3.27.1 - openSUSE Leap 15.2 (noarch): PackageKit-branding-upstream-1.1.13-lp152.3.27.1 PackageKit-lang-1.1.13-lp152.3.27.1 References: https://bugzilla.suse.com/1179287

1 0

openSUSE-RU-2021:3130-1: moderate: Recommended update for sssd
by maintenance＠opensuse.org 17 Sep '21

17 Sep '21

openSUSE Recommended Update: Recommended update for sssd ______________________________________________________________________________ Announcement ID: openSUSE-RU-2021:3130-1 Rating: moderate References: #1190021 Affected Products: openSUSE Leap 15.3 ______________________________________________________________________________ An update that has one recommended fix can now be installed. Description: This update for sssd fixes the following issues: - Fixes a segfault with newer libcares2 versions when the library fails to parse a dns name. (bsc#1190021) Patch Instructions: To install this openSUSE Recommended Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 15.3: zypper in -t patch openSUSE-SLE-15.3-2021-3130=1 Package List: - openSUSE Leap 15.3 (aarch64 ppc64le s390x x86_64): libipa_hbac-devel-1.16.1-23.14.1 libipa_hbac0-1.16.1-23.14.1 libipa_hbac0-debuginfo-1.16.1-23.14.1 libnfsidmap-sss-1.16.1-23.14.1 libnfsidmap-sss-debuginfo-1.16.1-23.14.1 libsss_certmap-devel-1.16.1-23.14.1 libsss_certmap0-1.16.1-23.14.1 libsss_certmap0-debuginfo-1.16.1-23.14.1 libsss_idmap-devel-1.16.1-23.14.1 libsss_idmap0-1.16.1-23.14.1 libsss_idmap0-debuginfo-1.16.1-23.14.1 libsss_nss_idmap-devel-1.16.1-23.14.1 libsss_nss_idmap0-1.16.1-23.14.1 libsss_nss_idmap0-debuginfo-1.16.1-23.14.1 libsss_simpleifp-devel-1.16.1-23.14.1 libsss_simpleifp0-1.16.1-23.14.1 libsss_simpleifp0-debuginfo-1.16.1-23.14.1 python3-ipa_hbac-1.16.1-23.14.1 python3-ipa_hbac-debuginfo-1.16.1-23.14.1 python3-sss-murmur-1.16.1-23.14.1 python3-sss-murmur-debuginfo-1.16.1-23.14.1 python3-sss_nss_idmap-1.16.1-23.14.1 python3-sss_nss_idmap-debuginfo-1.16.1-23.14.1 python3-sssd-config-1.16.1-23.14.1 python3-sssd-config-debuginfo-1.16.1-23.14.1 sssd-1.16.1-23.14.1 sssd-ad-1.16.1-23.14.1 sssd-ad-debuginfo-1.16.1-23.14.1 sssd-common-1.16.1-23.14.1 sssd-common-debuginfo-1.16.1-23.14.1 sssd-dbus-1.16.1-23.14.1 sssd-dbus-debuginfo-1.16.1-23.14.1 sssd-debugsource-1.16.1-23.14.1 sssd-ipa-1.16.1-23.14.1 sssd-ipa-debuginfo-1.16.1-23.14.1 sssd-krb5-1.16.1-23.14.1 sssd-krb5-common-1.16.1-23.14.1 sssd-krb5-common-debuginfo-1.16.1-23.14.1 sssd-krb5-debuginfo-1.16.1-23.14.1 sssd-ldap-1.16.1-23.14.1 sssd-ldap-debuginfo-1.16.1-23.14.1 sssd-proxy-1.16.1-23.14.1 sssd-proxy-debuginfo-1.16.1-23.14.1 sssd-tools-1.16.1-23.14.1 sssd-tools-debuginfo-1.16.1-23.14.1 sssd-wbclient-1.16.1-23.14.1 sssd-wbclient-debuginfo-1.16.1-23.14.1 sssd-wbclient-devel-1.16.1-23.14.1 sssd-winbind-idmap-1.16.1-23.14.1 sssd-winbind-idmap-debuginfo-1.16.1-23.14.1 References: https://bugzilla.suse.com/1190021

1 0

openSUSE-RU-2021:3133-1: moderate: Recommended update for grub2, efibootmgr
by maintenance＠opensuse.org 17 Sep '21

17 Sep '21

openSUSE Recommended Update: Recommended update for grub2, efibootmgr ______________________________________________________________________________ Announcement ID: openSUSE-RU-2021:3133-1 Rating: moderate References: #1186565 #1186975 #1187565 Affected Products: openSUSE Leap 15.3 ______________________________________________________________________________ An update that has three recommended fixes can now be installed. Description: This update for grub2, efibootmgr provides the following fixes: - Ship package grub2-arm64-efi and the required efibootmgr also to ppc64le, s390x and x86_64 (bsc#1186565) - Fix error gfxterm isn't found with multiple terminals (bsc#1187565) - Fix ocasional boot failure after kdump procedure when using XFS (bsc#1186975) Patch Instructions: To install this openSUSE Recommended Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 15.3: zypper in -t patch openSUSE-SLE-15.3-2021-3133=1 Package List: - openSUSE Leap 15.3 (aarch64 ppc64le s390x x86_64): efibootmgr-14-4.3.2 efibootmgr-debuginfo-14-4.3.2 efibootmgr-debugsource-14-4.3.2 References: https://bugzilla.suse.com/1186565 https://bugzilla.suse.com/1186975 https://bugzilla.suse.com/1187565

1 0

openSUSE-RU-2021:3136-1: moderate: Recommended update for SUSEConnect
by maintenance＠opensuse.org 17 Sep '21

17 Sep '21

openSUSE Recommended Update: Recommended update for SUSEConnect ______________________________________________________________________________ Announcement ID: openSUSE-RU-2021:3136-1 Rating: moderate References: #1185611 Affected Products: openSUSE Leap 15.3 ______________________________________________________________________________ An update that has one recommended fix can now be installed. Description: This update for SUSEConnect fixes the following issues: - Disallow registering via SUSEConnect if the system is managed by SUSE Manager. - Add subscription name to output of 'SUSEConnect --status'. - Send payload of GET requests as part of the url, not in the body. (bsc#1185611) Patch Instructions: To install this openSUSE Recommended Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 15.3: zypper in -t patch openSUSE-SLE-15.3-2021-3136=1 Package List: - openSUSE Leap 15.3 (aarch64 ppc64le s390x x86_64): SUSEConnect-0.3.31-13.1 References: https://bugzilla.suse.com/1185611

1 0

openSUSE-RU-2021:3129-1: moderate: Recommended update for polkit-default-privs
by maintenance＠opensuse.org 17 Sep '21

17 Sep '21

openSUSE Recommended Update: Recommended update for polkit-default-privs ______________________________________________________________________________ Announcement ID: openSUSE-RU-2021:3129-1 Rating: moderate References: #1177974 Affected Products: openSUSE Leap 15.3 ______________________________________________________________________________ An update that has one recommended fix can now be installed. Description: This update for polkit-default-privs fixes the following issues: - malcontent: loosen restrictive ReadOwn actions to prevent spurious auth requests - whitelisting of GNOME malcontent parental controls (bsc#1177974) Patch Instructions: To install this openSUSE Recommended Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 15.3: zypper in -t patch openSUSE-SLE-15.3-2021-3129=1 Package List: - openSUSE Leap 15.3 (noarch): polkit-default-privs-13.2+20210813.1c5fb05-3.3.1 polkit-whitelisting-13.2+20210813.1c5fb05-3.3.1 References: https://bugzilla.suse.com/1177974

1 0

openSUSE-RU-2021:3132-1: moderate: Recommended update for google-guest-oslogin
by maintenance＠opensuse.org 17 Sep '21

17 Sep '21

openSUSE Recommended Update: Recommended update for google-guest-oslogin ______________________________________________________________________________ Announcement ID: openSUSE-RU-2021:3132-1 Rating: moderate References: #1188992 #1189041 Affected Products: openSUSE Leap 15.3 ______________________________________________________________________________ An update that has two recommended fixes can now be installed. Description: This update for google-guest-oslogin contains the following fixes: - Update to version 20210728.00 (bsc#1188992, bsc#1189041) * JSON object cleanup (#65) - Update to version 20210707.00 * throw exceptions in cache_refresh (#64) - from version 20210702.00 * Use IP address for calling the metadata server. (#63) - Update to version 20210618.00 * flush each group member write (#62) Patch Instructions: To install this openSUSE Recommended Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 15.3: zypper in -t patch openSUSE-SLE-15.3-2021-3132=1 Package List: - openSUSE Leap 15.3 (aarch64 ppc64le s390x x86_64): google-guest-oslogin-20210728.00-1.21.1 google-guest-oslogin-debuginfo-20210728.00-1.21.1 google-guest-oslogin-debugsource-20210728.00-1.21.1 References: https://bugzilla.suse.com/1188992 https://bugzilla.suse.com/1189041

1 0

openSUSE-RU-2021:1282-1: moderate: Recommended update for aria2
by maintenance＠opensuse.org 17 Sep '21

17 Sep '21

openSUSE Recommended Update: Recommended update for aria2 ______________________________________________________________________________ Announcement ID: openSUSE-RU-2021:1282-1 Rating: moderate References: Affected Products: openSUSE Leap 15.2 openSUSE Backports SLE-15-SP3 openSUSE Backports SLE-15-SP2 openSUSE Backports SLE-15-SP1 ______________________________________________________________________________ An update that has 0 recommended fixes can now be installed. Description: This update for aria2 fixes the following issues: Update to version 1.36.0 * Update wslay * Fix segfault when time_t is 64bit on 32bit arch * Updates the make_bash_completion script to Python3 * Prevent corrupt downloads after app and/or system crash * Reset sessionDownloadLength and sessionUploadLength on download start Patch Instructions: To install this openSUSE Recommended Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 15.2: zypper in -t patch openSUSE-2021-1282=1 - openSUSE Backports SLE-15-SP3: zypper in -t patch openSUSE-2021-1282=1 - openSUSE Backports SLE-15-SP2: zypper in -t patch openSUSE-2021-1282=1 - openSUSE Backports SLE-15-SP1: zypper in -t patch openSUSE-2021-1282=1 Package List: - openSUSE Leap 15.2 (x86_64): aria2-1.36.0-lp152.5.6.1 aria2-debuginfo-1.36.0-lp152.5.6.1 aria2-debugsource-1.36.0-lp152.5.6.1 aria2-devel-1.36.0-lp152.5.6.1 libaria2-0-1.36.0-lp152.5.6.1 libaria2-0-debuginfo-1.36.0-lp152.5.6.1 - openSUSE Leap 15.2 (noarch): aria2-lang-1.36.0-lp152.5.6.1 - openSUSE Backports SLE-15-SP3 (aarch64 i586 ppc64le s390x x86_64): aria2-1.36.0-bp153.2.6.1 aria2-debuginfo-1.36.0-bp153.2.6.1 aria2-debugsource-1.36.0-bp153.2.6.1 aria2-devel-1.36.0-bp153.2.6.1 libaria2-0-1.36.0-bp153.2.6.1 libaria2-0-debuginfo-1.36.0-bp153.2.6.1 - openSUSE Backports SLE-15-SP3 (noarch): aria2-lang-1.36.0-bp153.2.6.1 - openSUSE Backports SLE-15-SP2 (aarch64 ppc64le s390x x86_64): aria2-1.36.0-bp152.4.6.1 aria2-debuginfo-1.36.0-bp152.4.6.1 aria2-debugsource-1.36.0-bp152.4.6.1 aria2-devel-1.36.0-bp152.4.6.1 libaria2-0-1.36.0-bp152.4.6.1 libaria2-0-debuginfo-1.36.0-bp152.4.6.1 - openSUSE Backports SLE-15-SP2 (noarch): aria2-lang-1.36.0-bp152.4.6.1 - openSUSE Backports SLE-15-SP1 (aarch64 ppc64le s390x x86_64): aria2-1.36.0-bp151.5.6.1 aria2-devel-1.36.0-bp151.5.6.1 libaria2-0-1.36.0-bp151.5.6.1 - openSUSE Backports SLE-15-SP1 (noarch): aria2-lang-1.36.0-bp151.5.6.1 References:

1 0

openSUSE-RU-2021:1284-1: moderate: Recommended update for python-pytz
by maintenance＠opensuse.org 17 Sep '21

17 Sep '21

openSUSE Recommended Update: Recommended update for python-pytz ______________________________________________________________________________ Announcement ID: openSUSE-RU-2021:1284-1 Rating: moderate References: #1185748 Affected Products: openSUSE Leap 15.2 ______________________________________________________________________________ An update that has one recommended fix can now be installed. Description: This update for python-pytz fixes the following issues: - Add %pyunittest shim for platforms where it is missing. - Remove real directory of %{python_sitelib}/pytz/zoneinfo when upgrading, before it is replaced by a symlink. (bsc#1185748) - update to 2021.1: * update to IANA 2021a timezone release - update to 2020.5: * update to IANA 2020e timezone release - update to 2020.4: * update to IANA 2020d timezone release - update to version 2020.1: * Test against Python 3.8 and Python 3.9 * Bump version numbers to 2020.1/2020a * use .rst extension name * Make FixedOffset part of public API - Update to 2019.3 * IANA 2019c - Add versioned dependency on timezone database to ensure the correct data is installed - Add a symlink to the system timezone database - update to 2019.2 * IANA 2019b * Defer generating case-insensitive lookups This update was imported from the SUSE:SLE-15-SP1:Update update project. Patch Instructions: To install this openSUSE Recommended Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 15.2: zypper in -t patch openSUSE-2021-1284=1 Package List: - openSUSE Leap 15.2 (noarch): python2-pytz-2021.1-lp152.3.6.1 python3-pytz-2021.1-lp152.3.6.1 References: https://bugzilla.suse.com/1185748

1 0

openSUSE-RU-2021:3131-1: moderate: Recommended update for xorg-x11-fonts
by maintenance＠opensuse.org 17 Sep '21

17 Sep '21

openSUSE Recommended Update: Recommended update for xorg-x11-fonts ______________________________________________________________________________ Announcement ID: openSUSE-RU-2021:3131-1 Rating: moderate References: #1174895 Affected Products: openSUSE Leap 15.3 ______________________________________________________________________________ An update that has one recommended fix can now be installed. Description: This update for xorg-x11-fonts fixes the following issues: - Convert the 'helv*.otb' and 'cour*.otb' files in a different way, generating all available font sizes. (bsc#1174895) - As part of the above fix, don't remove the "Regular" suffix from the full name of fonts in 'convertfont.py' This update for fonttosfnt fixes the following issues: - Fix more metric calculations (bsc#1174895): Patch Instructions: To install this openSUSE Recommended Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 15.3: zypper in -t patch openSUSE-SLE-15.3-2021-3131=1 Package List: - openSUSE Leap 15.3 (aarch64 ppc64le s390x x86_64): fonttosfnt-1.1.0-3.3.1 fonttosfnt-debuginfo-1.1.0-3.3.1 fonttosfnt-debugsource-1.1.0-3.3.1 - openSUSE Leap 15.3 (noarch): xorg-x11-fonts-7.6-13.6.1 xorg-x11-fonts-converted-7.6-13.6.5 xorg-x11-fonts-core-7.6-13.6.1 xorg-x11-fonts-legacy-7.6-13.6.1 References: https://bugzilla.suse.com/1174895

1 0

openSUSE-RU-2021:3128-1: moderate: Recommended update for rpmlint
by maintenance＠opensuse.org 17 Sep '21

17 Sep '21

openSUSE Recommended Update: Recommended update for rpmlint ______________________________________________________________________________ Announcement ID: openSUSE-RU-2021:3128-1 Rating: moderate References: #1169494 #1189106 Affected Products: openSUSE Leap 15.3 ______________________________________________________________________________ An update that has two recommended fixes can now be installed. Description: This update for rpmlint fixes the following issues: - Backport whitelisting of oddjob (bsc#1189106, bsc#1169494). Patch Instructions: To install this openSUSE Recommended Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 15.3: zypper in -t patch openSUSE-SLE-15.3-2021-3128=1 Package List: - openSUSE Leap 15.3 (noarch): rpmlint-1.10-7.25.1 References: https://bugzilla.suse.com/1169494 https://bugzilla.suse.com/1189106

1 0

openSUSE-RU-2021:1283-1: moderate: Recommended update for glmark2
by maintenance＠opensuse.org 17 Sep '21

17 Sep '21

openSUSE Recommended Update: Recommended update for glmark2 ______________________________________________________________________________ Announcement ID: openSUSE-RU-2021:1283-1 Rating: moderate References: Affected Products: openSUSE Leap 15.2 openSUSE Backports SLE-15-SP3 openSUSE Backports SLE-15-SP2 openSUSE Backports SLE-15-SP1 ______________________________________________________________________________ An update that has 0 recommended fixes can now be installed. Description: This update for glmark2 fixes the following issues: glmark2 was updated to version 20210830: * GLStateEGL: Support EGL versions < 1.4 * Fix model loading on big endian. * Fix -Wunreachable-code-aggressive. Update to version 20210521: * glad: Update for GL 2.1 + GL_EXT_framebuffer_object * Gracefully handle missing GL features * NativeStateWayland: Improve surface configuration handling Update to version 20210224: * SceneRefract: Fix incorrect generation of mipmap * NativeStateWayland: Don't assume order of globals * GLStateEGL: Avoid creating two EGLDisplay instances * Build,Doc: Update files for 2021.02 release * Build: Remove invalid build flavors for meson * NativeStateWayland: Support quitting with ESC or Q key * NativeStateWayland: Add basic pointer support * CanvasGeneric: avoid undefined behavior constructing a std::string with NULL * libmatrix: declare Shader::Shader(Shader&&) as noexcept * libmatrix: add move constructor to class Shader for v.push_back opt * build: glmark2 does not really require libpng version 16 * SceneBump: Fix precision bug in height rendering * SceneDesktop: Draw to correct FBO in off-screen mode * SceneShadow: Draw to correct FBO in off-screen mode * SceneRefract: Draw to correct FBO in off-screen mode * SceneTerrain: Draw to correct FBO in off-screen mode * CanvasGeneric: End the frame with glFinish when validating * Build: Use the build system wayland-scanner on meson * Build: Fix drm-only and wayland-only builds on meson * loop,function,conditionals: Fix mediump overflow * terrain: Fix precision handling in noise shader * terrain: Fix precision bug in light rendering * Doc: Document that the -b flag can pass common opts * Doc: Update files for meson build system * ci: Add build github workflow * Build: Meson build system support * Build: Use python3 in waf * NativeStateWayland: Fix no response to wayland server ping event. * Check for proper initialization of native_window and MVC matrix * egl: Ensure eglReleaseThread is valid before calling it * drm: Don't prefer RGBA component widths larger than 8 Update to version 20200503: * Build: Fix Python 3 incompatibility * Build,Doc: Update files for 2020.04 release * doc: Update --data-path documentation entry * Build: Improve configure error message when no flavors are selected * Android: Add fastlane metadata for F-Droid release * Android: Add unofficial adaptive icon for the android 8+ release * Android: Add unofficial icon for the android release * Android: Remove old drawables with non standard names * Android: Add different resolution of drawable and use sdk name for it * Fix UTF-8 in copyright headers * Allow version string suffix * Port Wayland to xdg-shell window management * Allow flavours to generate their own source files * Add support for Wayland display-scale events * glad: Update to latest upstream version * glad: Add README Patch Instructions: To install this openSUSE Recommended Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 15.2: zypper in -t patch openSUSE-2021-1283=1 - openSUSE Backports SLE-15-SP3: zypper in -t patch openSUSE-2021-1283=1 - openSUSE Backports SLE-15-SP2: zypper in -t patch openSUSE-2021-1283=1 - openSUSE Backports SLE-15-SP1: zypper in -t patch openSUSE-2021-1283=1 Package List: - openSUSE Leap 15.2 (x86_64): glmark2-20210830-lp152.4.3.1 glmark2-debuginfo-20210830-lp152.4.3.1 glmark2-debugsource-20210830-lp152.4.3.1 - openSUSE Backports SLE-15-SP3 (aarch64 i586 ppc64le s390x x86_64): glmark2-20210830-bp153.2.3.1 glmark2-debuginfo-20210830-bp153.2.3.1 glmark2-debugsource-20210830-bp153.2.3.1 - openSUSE Backports SLE-15-SP2 (aarch64 ppc64le s390x x86_64): glmark2-20210830-bp152.4.3.1 glmark2-debuginfo-20210830-bp152.4.3.1 glmark2-debugsource-20210830-bp152.4.3.1 - openSUSE Backports SLE-15-SP1 (aarch64 ppc64le s390x x86_64): glmark2-20210830-bp151.4.3.1 References:

1 0

openSUSE-RU-2021:3138-1: moderate: Recommended update for mdadm
by maintenance＠opensuse.org 17 Sep '21

17 Sep '21

openSUSE Recommended Update: Recommended update for mdadm ______________________________________________________________________________ Announcement ID: openSUSE-RU-2021:3138-1 Rating: moderate References: #1180661 #1182642 Affected Products: openSUSE Leap 15.3 ______________________________________________________________________________ An update that has two recommended fixes can now be installed. Description: This update for mdadm fixes the following issues: - Remove Spare drives line from details for external metadata. (bsc#1180661, bsc#1182642) - Arrays with external metadata do not have spare disks directly assigned to volumes; spare disks belong to containers and are moved to arrays when the array is degraded/reshaping. Thus, the display of zero spare disks in volume details is incorrect and can be confusing. - Don't associate spares with other arrays during RAID Examine. (bsc#1180661, bsc#1182642) - Spares in imsm belong to containers, not volumes, and must go into a separate container when assembling the RAID. Remove association spares with other arrays and make Examine print separate containers for spares. Auto assemble without config file already works like this. So make creating a config file and assembling from it consistent with auto assemble. With this change, 'mdadm -Es' will add this line to output if spares are found: 'ARRAY metadata=imsm UUID=00000000:00000000:00000000:00000000' Patch Instructions: To install this openSUSE Recommended Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 15.3: zypper in -t patch openSUSE-SLE-15.3-2021-3138=1 Package List: - openSUSE Leap 15.3 (aarch64 ppc64le s390x x86_64): mdadm-4.1-24.6.1 mdadm-debuginfo-4.1-24.6.1 mdadm-debugsource-4.1-24.6.1 References: https://bugzilla.suse.com/1180661 https://bugzilla.suse.com/1182642

1 0

openSUSE-RU-2021:3127-1: moderate: Recommended update for gimp
by maintenance＠opensuse.org 17 Sep '21

17 Sep '21

openSUSE Recommended Update: Recommended update for gimp ______________________________________________________________________________ Announcement ID: openSUSE-RU-2021:3127-1 Rating: moderate References: #1178726 #1180362 #1180770 Affected Products: openSUSE Leap 15.3 ______________________________________________________________________________ An update that has three recommended fixes can now be installed. Description: This update for gimp fixes the following issues: - Recurse directories when looking for python plugins (bsc#1180362) Patch Instructions: To install this openSUSE Recommended Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 15.3: zypper in -t patch openSUSE-SLE-15.3-2021-3127=1 Package List: - openSUSE Leap 15.3 (aarch64 ppc64le s390x x86_64): gimp-plugins-python-2.10.12-3.6.2 gimp-plugins-python-debuginfo-2.10.12-3.6.2 References: https://bugzilla.suse.com/1178726 https://bugzilla.suse.com/1180362 https://bugzilla.suse.com/1180770

1 0

openSUSE-RU-2021:1281-1: moderate: Recommended update for plasma5-integration
by maintenance＠opensuse.org 17 Sep '21

17 Sep '21

openSUSE Recommended Update: Recommended update for plasma5-integration ______________________________________________________________________________ Announcement ID: openSUSE-RU-2021:1281-1 Rating: moderate References: Affected Products: openSUSE Backports SLE-15-SP3 ______________________________________________________________________________ An update that has 0 recommended fixes can now be installed. Description: This update for plasma5-integration fixes the following issues: Update to 5.18.7 * For more details please see: * https://kde.org/announcements/plasma/5/5.18.7 * https://kde.org/announcements/plasma-5.18.6 * Use KDE shortcuts for "move to trash" action coming from QStandardKey (kde#426573) Patch Instructions: To install this openSUSE Recommended Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Backports SLE-15-SP3: zypper in -t patch openSUSE-2021-1281=1 Package List: - openSUSE Backports SLE-15-SP3 (aarch64 i586 ppc64le s390x x86_64): plasma5-integration-plugin-5.18.7-bp153.2.5.1 - openSUSE Backports SLE-15-SP3 (noarch): plasma5-integration-plugin-lang-5.18.7-bp153.2.5.1 References:

1 0

openSUSE-RU-2021:1280-1: moderate: Recommended update for yast2-users
by maintenance＠opensuse.org 16 Sep '21

16 Sep '21

openSUSE Recommended Update: Recommended update for yast2-users ______________________________________________________________________________ Announcement ID: openSUSE-RU-2021:1280-1 Rating: moderate References: #1188361 Affected Products: openSUSE Leap 15.2 ______________________________________________________________________________ An update that has one recommended fix can now be installed. Description: This update for yast2-users fixes the following issues: - Do not rewrite authorized_keys unless it is needed (bsc#1188361). This update was imported from the SUSE:SLE-15-SP2:Update update project. Patch Instructions: To install this openSUSE Recommended Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 15.2: zypper in -t patch openSUSE-2021-1280=1 Package List: - openSUSE Leap 15.2 (x86_64): yast2-users-4.2.13-lp152.2.6.1 yast2-users-debuginfo-4.2.13-lp152.2.6.1 yast2-users-debugsource-4.2.13-lp152.2.6.1 References: https://bugzilla.suse.com/1188361

1 0

openSUSE-SU-2021:3123-1: moderate: Security update for libcroco
by opensuse-security＠opensuse.org 16 Sep '21

16 Sep '21

openSUSE Security Update: Security update for libcroco ______________________________________________________________________________ Announcement ID: openSUSE-SU-2021:3123-1 Rating: moderate References: #1171685 Cross-References: CVE-2020-12825 CVSS scores: CVE-2020-12825 (NVD) : 7.1 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:H CVE-2020-12825 (SUSE): 2.8 CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:N/I:N/A:L Affected Products: openSUSE Leap 15.3 ______________________________________________________________________________ An update that fixes one vulnerability is now available. Description: This update for libcroco fixes the following issues: - CVE-2020-12825: Fixed recursion issue in block and any productions (bsc#1171685). Patch Instructions: To install this openSUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 15.3: zypper in -t patch openSUSE-SLE-15.3-2021-3123=1 Package List: - openSUSE Leap 15.3 (aarch64 ppc64le s390x x86_64): libcroco-0.6.13-3.3.1 libcroco-0_6-3-0.6.13-3.3.1 libcroco-0_6-3-debuginfo-0.6.13-3.3.1 libcroco-debuginfo-0.6.13-3.3.1 libcroco-debugsource-0.6.13-3.3.1 libcroco-devel-0.6.13-3.3.1 - openSUSE Leap 15.3 (x86_64): libcroco-0_6-3-32bit-0.6.13-3.3.1 libcroco-0_6-3-32bit-debuginfo-0.6.13-3.3.1 References: https://www.suse.com/security/cve/CVE-2020-12825.html https://bugzilla.suse.com/1171685

1 0

openSUSE-SU-2021:1279-1: moderate: Security update for haserl
by opensuse-security＠opensuse.org 16 Sep '21

16 Sep '21

openSUSE Security Update: Security update for haserl ______________________________________________________________________________ Announcement ID: openSUSE-SU-2021:1279-1 Rating: moderate References: #1187671 Cross-References: CVE-2021-29133 Affected Products: openSUSE Leap 15.2 openSUSE Backports SLE-15-SP3 openSUSE Backports SLE-15-SP2 openSUSE Backports SLE-15-SP1 ______________________________________________________________________________ An update that fixes one vulnerability is now available. Description: This update for haserl fixes the following issues: Update to version 0.9.36: * Fixed: Its possible to issue a PUT request without a CONTENT-TYPE. Assume an octet-stream in that case. This is CVE-2021-29133 and boo#1187671 * Change the Prefix for variables to be the REQUEST_METHOD (PUT/DELETE/GET/POST) THIS IS A BREAKING CHANGE * Mitigations vs running haserl to get access to files not available to the user. Patch Instructions: To install this openSUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 15.2: zypper in -t patch openSUSE-2021-1279=1 - openSUSE Backports SLE-15-SP3: zypper in -t patch openSUSE-2021-1279=1 - openSUSE Backports SLE-15-SP2: zypper in -t patch openSUSE-2021-1279=1 - openSUSE Backports SLE-15-SP1: zypper in -t patch openSUSE-2021-1279=1 Package List: - openSUSE Leap 15.2 (x86_64): haserl-0.9.36-lp152.4.3.1 haserl-debuginfo-0.9.36-lp152.4.3.1 haserl-debugsource-0.9.36-lp152.4.3.1 - openSUSE Backports SLE-15-SP3 (aarch64 i586 ppc64le s390x x86_64): haserl-0.9.36-bp153.2.3.1 haserl-debuginfo-0.9.36-bp153.2.3.1 haserl-debugsource-0.9.36-bp153.2.3.1 - openSUSE Backports SLE-15-SP2 (aarch64 ppc64le s390x x86_64): haserl-0.9.36-bp152.4.3.1 haserl-debuginfo-0.9.36-bp152.4.3.1 haserl-debugsource-0.9.36-bp152.4.3.1 - openSUSE Backports SLE-15-SP1 (aarch64 ppc64le s390x x86_64): haserl-0.9.36-bp151.4.3.1 References: https://www.suse.com/security/cve/CVE-2021-29133.html https://bugzilla.suse.com/1187671

1 0

openSUSE-RU-2021:1278-1: moderate: Recommended update for pidgin
by maintenance＠opensuse.org 16 Sep '21

16 Sep '21

openSUSE Recommended Update: Recommended update for pidgin ______________________________________________________________________________ Announcement ID: openSUSE-RU-2021:1278-1 Rating: moderate References: SLE-17111 Affected Products: openSUSE Leap 15.2 ______________________________________________________________________________ An update that has 0 recommended fixes and contains one feature can now be installed. Description: This update for pidgin fixes the following issue: - Add support for the 'no_proxy' environment variable. (jsc#SLE-17111) This update was imported from the SUSE:SLE-15-SP2:Update update project. Patch Instructions: To install this openSUSE Recommended Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 15.2: zypper in -t patch openSUSE-2021-1278=1 Package List: - openSUSE Leap 15.2 (x86_64): finch-2.13.0-lp152.7.3.1 finch-debuginfo-2.13.0-lp152.7.3.1 finch-devel-2.13.0-lp152.7.3.1 libpurple-2.13.0-lp152.7.3.1 libpurple-debuginfo-2.13.0-lp152.7.3.1 libpurple-devel-2.13.0-lp152.7.3.1 libpurple-plugin-sametime-2.13.0-lp152.7.3.1 libpurple-plugin-sametime-debuginfo-2.13.0-lp152.7.3.1 libpurple-tcl-2.13.0-lp152.7.3.1 libpurple-tcl-debuginfo-2.13.0-lp152.7.3.1 pidgin-2.13.0-lp152.7.3.1 pidgin-debuginfo-2.13.0-lp152.7.3.1 pidgin-debugsource-2.13.0-lp152.7.3.1 pidgin-devel-2.13.0-lp152.7.3.1 - openSUSE Leap 15.2 (noarch): libpurple-branding-upstream-2.13.0-lp152.7.3.1 libpurple-lang-2.13.0-lp152.7.3.1 References:

1 0

openSUSE-RU-2021:3115-1: moderate: Recommended update for mozilla-nspr, mozilla-nss
by maintenance＠opensuse.org 16 Sep '21

16 Sep '21

openSUSE Recommended Update: Recommended update for mozilla-nspr, mozilla-nss ______________________________________________________________________________ Announcement ID: openSUSE-RU-2021:3115-1 Rating: moderate References: #1029961 #1174697 #1176206 #1176934 #1179382 #1188891 Affected Products: openSUSE Leap 15.3 ______________________________________________________________________________ An update that has 6 recommended fixes can now be installed. Description: This update for mozilla-nspr fixes the following issues: mozilla-nspr was updated to version 4.32: * implement new socket option PR_SockOpt_DontFrag * support larger DNS records by increasing the default buffer size for DNS queries * Lock access to PRCallOnceType members in PR_CallOnce* for thread safety bmo#1686138 * PR_GetSystemInfo supports a new flag PR_SI_RELEASE_BUILD to get information about the operating system build version. Mozilla NSS was updated to version 3.68: * bmo#1713562 - Fix test leak. * bmo#1717452 - NSS 3.68 should depend on NSPR 4.32. * bmo#1693206 - Implement PKCS8 export of ECDSA keys. * bmo#1712883 - DTLS 1.3 draft-43. * bmo#1655493 - Support SHA2 HW acceleration using Intel SHA Extension. * bmo#1713562 - Validate ECH public names. * bmo#1717610 - Add function to get seconds from epoch from pkix::Time. update to NSS 3.67 * bmo#1683710 - Add a means to disable ALPN. * bmo#1715720 - Fix nssckbi version number in NSS 3.67 (was supposed to be incremented in 3.66). * bmo#1714719 - Set NSS_USE_64 on riscv64 target when using GYP/Ninja. * bmo#1566124 - Fix counter increase in ppc-gcm-wrap.c. * bmo#1566124 - Fix AES_GCM mode on ppc64le for messages of length more than 255-byte. update to NSS 3.66 * bmo#1710716 - Remove Expired Sonera Class2 CA from NSS. * bmo#1710716 - Remove Expired Root Certificates from NSS - QuoVadis Root Certification Authority. * bmo#1708307 - Remove Trustis FPS Root CA from NSS. * bmo#1707097 - Add Certum Trusted Root CA to NSS. * bmo#1707097 - Add Certum EC-384 CA to NSS. * bmo#1703942 - Add ANF Secure Server Root CA to NSS. * bmo#1697071 - Add GLOBALTRUST 2020 root cert to NSS. * bmo#1712184 - NSS tools manpages need to be updated to reflect that sqlite is the default database. * bmo#1712230 - Don't build ppc-gcm.s with clang integrated assembler. * bmo#1712211 - Strict prototype error when trying to compile nss code that includes blapi.h. * bmo#1710773 - NSS needs FIPS 180-3 FIPS indicators. * bmo#1709291 - Add VerifyCodeSigningCertificateChain. update to NSS 3.65 * bmo#1709654 - Update for NetBSD configuration. * bmo#1709750 - Disable HPKE test when fuzzing. * bmo#1566124 - Optimize AES-GCM for ppc64le. * bmo#1699021 - Add AES-256-GCM to HPKE. * bmo#1698419 - ECH -10 updates. * bmo#1692930 - Update HPKE to final version. * bmo#1707130 - NSS should use modern algorithms in PKCS#12 files by default. * bmo#1703936 - New coverity/cpp scanner errors. * bmo#1697303 - NSS needs to update it's csp clearing to FIPS 180-3 standards. * bmo#1702663 - Need to support RSA PSS with Hashing PKCS #11 Mechanisms. * bmo#1705119 - Deadlock when using GCM and non-thread safe tokens. update to NSS 3.64 * bmo#1705286 - Properly detect mips64. * bmo#1687164 - Introduce NSS_DISABLE_CRYPTO_VSX and disable_crypto_vsx. * bmo#1698320 - replace __builtin_cpu_supports("vsx") with ppc_crypto_support() for clang. * bmo#1613235 - Add POWER ChaCha20 stream cipher vector acceleration. Fixed in 3.63 * bmo#1697380 - Make a clang-format run on top of helpful contributions. * bmo#1683520 - ECCKiila P384, change syntax of nested structs initialization to prevent build isses with GCC 4.8. * bmo#1683520 - [lib/freebl/ecl] P-384: allow zero scalars in dual scalar multiplication. * bmo#1683520 - ECCKiila P521, change syntax of nested structs initialization to prevent build isses with GCC 4.8. * bmo#1683520 - [lib/freebl/ecl] P-521: allow zero scalars in dual scalar multiplication. * bmo#1696800 - HACL* update March 2021 - c95ab70fcb2bc21025d8845281bc4bc8987ca683. * bmo#1694214 - tstclnt can't enable middlebox compat mode. * bmo#1694392 - NSS does not work with PKCS #11 modules not supporting profiles. * bmo#1685880 - Minor fix to prevent unused variable on early return. * bmo#1685880 - Fix for the gcc compiler version 7 to support setenv with nss build. * bmo#1693217 - Increase nssckbi.h version number for March 2021 batch of root CA changes, CA list version 2.48. * bmo#1692094 - Set email distrust after to 21-03-01 for Camerfirma's 'Chambers of Commerce' and 'Global Chambersign' roots. * bmo#1618407 - Symantec root certs - Set CKA_NSS_EMAIL_DISTRUST_AFTER. * bmo#1693173 - Add GlobalSign R45, E45, R46, and E46 root certs to NSS. * bmo#1683738 - Add AC RAIZ FNMT-RCM SERVIDORES SEGUROS root cert to NSS. * bmo#1686854 - Remove GeoTrust PCA-G2 and VeriSign Universal root certs from NSS. * bmo#1687822 - Turn off Websites trust bit for the ��Staat der Nederlanden Root CA - G3�� root cert in NSS. * bmo#1692094 - Turn off Websites Trust Bit for 'Chambers of Commerce Root - 2008' and 'Global Chambersign Root - 2008��. * bmo#1694291 - Tracing fixes for ECH. update to NSS 3.62 * bmo#1688374 - Fix parallel build NSS-3.61 with make * bmo#1682044 - pkix_Build_GatherCerts() + pkix_CacheCert_Add() can corrupt "cachedCertTable" * bmo#1690583 - Fix CH padding extension size calculation * bmo#1690421 - Adjust 3.62 ABI report formatting for new libabigail * bmo#1690421 - Install packaged libabigail in docker-builds image * bmo#1689228 - Minor ECH -09 fixes for interop testing, fuzzing * bmo#1674819 - Fixup a51fae403328, enum type may be signed * bmo#1681585 - Add ECH support to selfserv * bmo#1681585 - Update ECH to Draft-09 * bmo#1678398 - Add Export/Import functions for HPKE context * bmo#1678398 - Update HPKE to draft-07 update to NSS 3.61 * bmo#1682071 - Fix issue with IKE Quick mode deriving incorrect key values under certain conditions. * bmo#1684300 - Fix default PBE iteration count when NSS is compiled with NSS_DISABLE_DBM. * bmo#1651411 - Improve constant-timeness in RSA operations. * bmo#1677207 - Upgrade Google Test version to latest release. * bmo#1654332 - Add aarch64-make target to nss-try. Update to NSS 3.60.1: Notable changes in NSS 3.60: * TLS 1.3 Encrypted Client Hello (draft-ietf-tls-esni-08) support has been added, replacing the previous ESNI (draft-ietf-tls-esni-01) implementation. See bmo#1654332 for more information. * December 2020 batch of Root CA changes, builtins library updated to version 2.46. See bmo#1678189, bmo#1678166, and bmo#1670769 for more information. Update to NSS 3.59.1: * bmo#1679290 - Fix potential deadlock with certain third-party PKCS11 modules Update to NSS 3.59: Notable changes: * Exported two existing functions from libnss: CERT_AddCertToListHeadWithData and CERT_AddCertToListTailWithData Bugfixes * bmo#1607449 - Lock cert->nssCertificate to prevent a potential data race * bmo#1672823 - Add Wycheproof test cases for HMAC, HKDF, and DSA * bmo#1663661 - Guard against NULL token in nssSlot_IsTokenPresent * bmo#1670835 - Support enabling and disabling signatures via Crypto Policy * bmo#1672291 - Resolve libpkix OCSP failures on SHA1 self-signed root certs when SHA1 signatures are disabled. * bmo#1644209 - Fix broken SelectedCipherSuiteReplacer filter to solve some test intermittents * bmo#1672703 - Tolerate the first CCS in TLS 1.3 to fix a regression in our CVE-2020-25648 fix that broke purple-discord (boo#1179382) * bmo#1666891 - Support key wrap/unwrap with RSA-OAEP * bmo#1667989 - Fix gyp linking on Solaris * bmo#1668123 - Export CERT_AddCertToListHeadWithData and CERT_AddCertToListTailWithData from libnss * bmo#1634584 - Set CKA_NSS_SERVER_DISTRUST_AFTER for Trustis FPS Root CA * bmo#1663091 - Remove unnecessary assertions in the streaming ASN.1 decoder that affected decoding certain PKCS8 private keys when using NSS debug builds * bmo#670839 - Use ARM crypto extension for AES, SHA1 and SHA2 on MacOS. update to NSS 3.58 Bugs fixed: * bmo#1641480 (CVE-2020-25648) Tighten CCS handling for middlebox compatibility mode. * bmo#1631890 - Add support for Hybrid Public Key Encryption (draft-irtf-cfrg-hpke) support for TLS Encrypted Client Hello (draft-ietf-tls-esni). * bmo#1657255 - Add CI tests that disable SHA1/SHA2 ARM crypto extensions. * bmo#1668328 - Handle spaces in the Python path name when using gyp on Windows. * bmo#1667153 - Add PK11_ImportDataKey for data object import. * bmo#1665715 - Pass the embedded SCT list extension (if present) to TrustDomain::CheckRevocation instead of the notBefore value. update to NSS 3.57 * The following CA certificates were Added: bmo#1663049 - CN=Trustwave Global Certification Authority SHA-256 Fingerprint: 97552015F5DDFC3C8788C006944555408894450084F100867086BC1A2BB58DC8 bmo#1663049 - CN=Trustwave Global ECC P256 Certification Authority SHA-256 Fingerprint: 945BBC825EA554F489D1FD51A73DDF2EA624AC7019A05205225C22A78CCFA8B4 bmo#1663049 - CN=Trustwave Global ECC P384 Certification Authority SHA-256 Fingerprint: 55903859C8C0C3EBB8759ECE4E2557225FF5758BBD38EBD48276601E1BD58097 * The following CA certificates were Removed: bmo#1651211 - CN=EE Certification Centre Root CA SHA-256 Fingerprint: 3E84BA4342908516E77573C0992F0979CA084E4685681FF195CCBA8A229B8A76 bmo#1656077 - O=Government Root Certification Authority; C=TW SHA-256 Fingerprint: 7600295EEFE85B9E1FD624DB76062AAAAE59818A54D2774CD4C0B2C01131E1B3 * Trust settings for the following CA certificates were Modified: bmo#1653092 - CN=OISTE WISeKey Global Root GA CA Websites (server authentication) trust bit removed. * https://developer.mozilla.org/en-US/docs/Mozilla/Projects/NSS/NSS_3.57_rele ase_notes update to NSS 3.56 Notable changes * bmo#1650702 - Support SHA-1 HW acceleration on ARMv8 * bmo#1656981 - Use MPI comba and mulq optimizations on x86-64 MacOS. * bmo#1654142 - Add CPU feature detection for Intel SHA extension. * bmo#1648822 - Add stricter validation of DH keys in FIPS mode. * bmo#1656986 - Properly detect arm64 during GYP build architecture detection. * bmo#1652729 - Add build flag to disable RC2 and relocate to lib/freebl/deprecated. * bmo#1656429 - Correct RTT estimate used in 0-RTT anti-replay. * bmo#1588941 - Send empty certificate message when scheme selection fails. * bmo#1652032 - Fix failure to build in Windows arm64 makefile cross-compilation. * bmo#1625791 - Fix deadlock issue in nssSlot_IsTokenPresent. * bmo#1653975 - Fix 3.53 regression by setting "all" as the default makefile target. * bmo#1659792 - Fix broken libpkix tests with unexpired PayPal cert. * bmo#1659814 - Fix interop.sh failures with newer tls-interop commit and dependencies. * bmo#1656519 - NSPR dependency updated to 4.28 update to NSS 3.55 Notable changes * P384 and P521 elliptic curve implementations are replaced with verifiable implementations from Fiat-Crypto [0] and ECCKiila [1]. * PK11_FindCertInSlot is added. With this function, a given slot can be queried with a DER-Encoded certificate, providing performance and usability improvements over other mechanisms. (bmo#1649633) * DTLS 1.3 implementation is updated to draft-38. (bmo#1647752) Relevant Bugfixes * bmo#1631583 (CVE-2020-6829, CVE-2020-12400) - Replace P384 and P521 with new, verifiable implementations from Fiat-Crypto and ECCKiila. * bmo#1649487 - Move overzealous assertion in VFY_EndWithSignature. * bmo#1631573 (CVE-2020-12401) - Remove unnecessary scalar padding. * bmo#1636771 (CVE-2020-12403) - Explicitly disable multi-part ChaCha20 (which was not functioning correctly) and more strictly enforce tag length. * bmo#1649648 - Don't memcpy zero bytes (sanitizer fix). * bmo#1649316 - Don't memcpy zero bytes (sanitizer fix). * bmo#1649322 - Don't memcpy zero bytes (sanitizer fix). * bmo#1653202 - Fix initialization bug in blapitest when compiled with NSS_DISABLE_DEPRECATED_SEED. * bmo#1646594 - Fix AVX2 detection in makefile builds. * bmo#1649633 - Add PK11_FindCertInSlot to search a given slot for a DER-encoded certificate. * bmo#1651520 - Fix slotLock race in NSC_GetTokenInfo. * bmo#1647752 - Update DTLS 1.3 implementation to draft-38. * bmo#1649190 - Run cipher, sdr, and ocsp tests under standard test cycle in CI. * bmo#1649226 - Add Wycheproof ECDSA tests. * bmo#1637222 - Consistently enforce IV requirements for DES and 3DES. * bmo#1067214 - Enforce minimum PKCS#1 v1.5 padding length in RSA_CheckSignRecover. * bmo#1646324 - Advertise PKCS#1 schemes for certificates in the signature_algorithms extension. update to NSS 3.54 Notable changes * Support for TLS 1.3 external pre-shared keys (bmo#1603042). * Use ARM Cryptography Extension for SHA256, when available (bmo#1528113) * The following CA certificates were Added: bmo#1645186 - certSIGN Root CA G2. bmo#1645174 - e-Szigno Root CA 2017. bmo#1641716 - Microsoft ECC Root Certificate Authority 2017. bmo#1641716 - Microsoft RSA Root Certificate Authority 2017. * The following CA certificates were Removed: bmo#1645199 - AddTrust Class 1 CA Root. bmo#1645199 - AddTrust External CA Root. bmo#1641718 - LuxTrust Global Root 2. bmo#1639987 - Staat der Nederlanden Root CA - G2. bmo#1618402 - Symantec Class 2 Public Primary Certification Authority - G4. bmo#1618402 - Symantec Class 1 Public Primary Certification Authority - G4. bmo#1618402 - VeriSign Class 3 Public Primary Certification Authority - G3. * A number of certificates had their Email trust bit disabled. See bmo#1618402 for a complete list. Bugs fixed * bmo#1528113 - Use ARM Cryptography Extension for SHA256. * bmo#1603042 - Add TLS 1.3 external PSK support. * bmo#1642802 - Add uint128 support for HACL* curve25519 on Windows. * bmo#1645186 - Add "certSIGN Root CA G2" root certificate. * bmo#1645174 - Add Microsec's "e-Szigno Root CA 2017" root certificate. * bmo#1641716 - Add Microsoft's non-EV root certificates. * bmo1621151 - Disable email trust bit for "O=Government Root Certification Authority; C=TW" root. * bmo#1645199 - Remove AddTrust root certificates. * bmo#1641718 - Remove "LuxTrust Global Root 2" root certificate. * bmo#1639987 - Remove "Staat der Nederlanden Root CA - G2" root certificate. * bmo#1618402 - Remove Symantec root certificates and disable email trust bit. * bmo#1640516 - NSS 3.54 should depend on NSPR 4.26. * bmo#1642146 - Fix undefined reference to `PORT_ZAlloc_stub' in seed.c. * bmo#1642153 - Fix infinite recursion building NSS. * bmo#1642638 - Fix fuzzing assertion crash. * bmo#1642871 - Enable SSL_SendSessionTicket after resumption. * bmo#1643123 - Support SSL_ExportEarlyKeyingMaterial with External PSKs. * bmo#1643557 - Fix numerous compile warnings in NSS. * bmo#1644774 - SSL gtests to use ClearServerCache when resetting self-encrypt keys. * bmo#1645479 - Don't use SECITEM_MakeItem in secutil.c. * bmo#1646520 - Stricter enforcement of ASN.1 INTEGER encoding. Patch Instructions: To install this openSUSE Recommended Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 15.3: zypper in -t patch openSUSE-SLE-15.3-2021-3115=1 Package List: - openSUSE Leap 15.3 (aarch64 ppc64le s390x x86_64): libfreebl3-3.68-3.56.1 libfreebl3-debuginfo-3.68-3.56.1 libfreebl3-hmac-3.68-3.56.1 libsoftokn3-3.68-3.56.1 libsoftokn3-debuginfo-3.68-3.56.1 libsoftokn3-hmac-3.68-3.56.1 mozilla-nspr-4.32-3.20.1 mozilla-nspr-debuginfo-4.32-3.20.1 mozilla-nspr-debugsource-4.32-3.20.1 mozilla-nspr-devel-4.32-3.20.1 mozilla-nss-3.68-3.56.1 mozilla-nss-certs-3.68-3.56.1 mozilla-nss-certs-debuginfo-3.68-3.56.1 mozilla-nss-debuginfo-3.68-3.56.1 mozilla-nss-debugsource-3.68-3.56.1 mozilla-nss-devel-3.68-3.56.1 mozilla-nss-sysinit-3.68-3.56.1 mozilla-nss-sysinit-debuginfo-3.68-3.56.1 mozilla-nss-tools-3.68-3.56.1 mozilla-nss-tools-debuginfo-3.68-3.56.1 - openSUSE Leap 15.3 (x86_64): libfreebl3-32bit-3.68-3.56.1 libfreebl3-32bit-debuginfo-3.68-3.56.1 libfreebl3-hmac-32bit-3.68-3.56.1 libsoftokn3-32bit-3.68-3.56.1 libsoftokn3-32bit-debuginfo-3.68-3.56.1 libsoftokn3-hmac-32bit-3.68-3.56.1 mozilla-nspr-32bit-4.32-3.20.1 mozilla-nspr-32bit-debuginfo-4.32-3.20.1 mozilla-nss-32bit-3.68-3.56.1 mozilla-nss-32bit-debuginfo-3.68-3.56.1 mozilla-nss-certs-32bit-3.68-3.56.1 mozilla-nss-certs-32bit-debuginfo-3.68-3.56.1 mozilla-nss-sysinit-32bit-3.68-3.56.1 mozilla-nss-sysinit-32bit-debuginfo-3.68-3.56.1 References: https://bugzilla.suse.com/1029961 https://bugzilla.suse.com/1174697 https://bugzilla.suse.com/1176206 https://bugzilla.suse.com/1176934 https://bugzilla.suse.com/1179382 https://bugzilla.suse.com/1188891

1 0

openSUSE-SU-2021:1274-1: important: Security update for fail2ban
by opensuse-security＠opensuse.org 16 Sep '21

16 Sep '21

openSUSE Security Update: Security update for fail2ban ______________________________________________________________________________ Announcement ID: openSUSE-SU-2021:1274-1 Rating: important References: #1145181 #1146856 #1180738 #1188610 Cross-References: CVE-2021-32749 CVSS scores: CVE-2021-32749 (NVD) : 8.1 CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H Affected Products: openSUSE Leap 15.2 openSUSE Backports SLE-15-SP3 openSUSE Backports SLE-15-SP2 openSUSE Backports SLE-15-SP1 ______________________________________________________________________________ An update that solves one vulnerability and has three fixes is now available. Description: This update for fail2ban fixes the following issues: - CVE-2021-32749: prevent a command injection via mail command (boo#1188610) - Integrate change to resolve boo#1146856 and boo#1180738 Update to 0.11.2 - increased stability, filter and action updates New Features and Enhancements * fail2ban-regex: - speedup formatted output (bypass unneeded stats creation) - extended with prefregex statistic - more informative output for `datepattern` (e. g. set from filter) - pattern : description * parsing of action in jail-configs considers space between action-names as separator also (previously only new-line was allowed), for example `action = a b` would specify 2 actions `a` and `b` * new filter and jail for GitLab recognizing failed application logins (gh#fail2ban/fail2ban#2689) * new filter and jail for Grafana recognizing failed application logins (gh#fail2ban/fail2ban#2855) * new filter and jail for SoftEtherVPN recognizing failed application logins (gh#fail2ban/fail2ban#2723) * `filter.d/guacamole.conf` extended with `logging` parameter to follow webapp-logging if it's configured (gh#fail2ban/fail2ban#2631) * `filter.d/bitwarden.conf` enhanced to support syslog (gh#fail2ban/fail2ban#2778) * introduced new prefix `{UNB}` for `datepattern` to disable word boundaries in regex; * datetemplate: improved anchor detection for capturing groups `(^...)`; * datepattern: improved handling with wrong recognized timestamps (timezones, no datepattern, etc) as well as some warnings signaling user about invalid pattern or zone (gh#fail2ban/fail2ban#2814): - filter gets mode in-operation, which gets activated if filter starts processing of new messages; in this mode a timestamp read from log-line that appeared recently (not an old line), deviating too much from now (up too 24h), will be considered as now (assuming a timezone issue), so could avoid unexpected bypass of failure (previously exceeding `findtime`); - better interaction with non-matching optional datepattern or invalid timestamps; - implements special datepattern `{NONE}` - allow to find failures totally without date-time in log messages, whereas filter will use now as timestamp (gh#fail2ban/fail2ban#2802) * performance optimization of `datepattern` (better search algorithm in datedetector, especially for single template); * fail2ban-client: extended to unban IP range(s) by subnet (CIDR/mask) or hostname (DNS), gh#fail2ban/fail2ban#2791; * extended capturing of alternate tags in filter, allowing combine of multiple groups to single tuple token with new tag prefix `<F-TUPLE_`, that would combine value of `<F-V>` with all value of `<F-TUPLE_V?_n?>` tags (gh#fail2ban/fail2ban#2755) - Fixes * [stability] prevent race condition - no ban if filter (backend) is continuously busy if too many messages will be found in log, e. g. initial scan of large log-file or journal (gh#fail2ban/fail2ban#2660) * pyinotify-backend sporadically avoided initial scanning of log-file by start * python 3.9 compatibility (and Travis CI support) * restoring a large number (500+ depending on files ulimit) of current bans when using PyPy fixed * manual ban is written to database, so can be restored by restart (gh#fail2ban/fail2ban#2647) * `jail.conf`: don't specify `action` directly in jails (use `action_` or `banaction` instead) * no mails-action added per default anymore (e. g. to allow that `action = %(action_mw)s` should be specified per jail or in default section in jail.local), closes gh#fail2ban/fail2ban#2357 * ensure we've unique action name per jail (also if parameter `actname` is not set but name deviates from standard name, gh#fail2ban/fail2ban#2686) * don't use `%(banaction)s` interpolation because it can be complex value (containing `[...]` and/or quotes), so would bother the action interpolation * fixed type conversion in config readers (take place after all interpolations get ready), that allows to specify typed parameters variable (as substitutions) as well as to supply it in other sections or as init parameters. * `action.d/*-ipset*.conf`: several ipset actions fixed (no timeout per default anymore), so no discrepancy between ipset and fail2ban (removal from ipset will be managed by fail2ban only, gh#fail2ban/fail2ban#2703) * `action.d/cloudflare.conf`: fixed `actionunban` (considering new-line chars and optionally real json-parsing with `jq`, gh#fail2ban/fail2ban#2140, gh#fail2ban/fail2ban#2656) * `action.d/nftables.conf` (type=multiport only): fixed port range selector, replacing `:` with `-` (gh#fail2ban/fail2ban#2763) * `action.d/firewallcmd-*.conf` (multiport only): fixed port range selector, replacing `:` with `-` (gh#fail2ban/fail2ban#2821) * `action.d/bsd-ipfw.conf`: fixed selection of rule-no by large list or initial `lowest_rule_num` (gh#fail2ban/fail2ban#2836) * `filter.d/common.conf`: avoid substitute of default values in related `lt_*` section, `__prefix_line` should be interpolated in definition section (inside the filter-config, gh#fail2ban/fail2ban#2650) * `filter.d/dovecot.conf`: - add managesieve and submission support (gh#fail2ban/fail2ban#2795); - accept messages with more verbose logging (gh#fail2ban/fail2ban#2573); * `filter.d/courier-smtp.conf`: prefregex extended to consider port in log-message (gh#fail2ban/fail2ban#2697) * `filter.d/traefik-auth.conf`: filter extended with parameter mode (`normal`, `ddos`, `aggressive`) to handle the match of username differently (gh#fail2ban/fail2ban#2693): - `normal`: matches 401 with supplied username only - `ddos`: matches 401 without supplied username only - `aggressive`: matches 401 and any variant (with and without username) * `filter.d/sshd.conf`: normalizing of user pattern in all RE's, allowing empty user (gh#fail2ban/fail2ban#2749) Update to 0.11.1: * Increment ban time (+ observer) functionality introduced. * Database functionality extended with bad ips. * New tags (usable in actions): - `<bancount>` - ban count of this offender if known as bad (started by 1 for unknown) - `<bantime>` - current ban-time of the ticket (prolongation can be retarded up to 10 sec.) * Introduced new action command `actionprolong` to prolong ban-time (e. g. set new timeout if expected); * algorithm of restore current bans after restart changed: update the restored ban-time (and therefore end of ban) of the ticket with ban-time of jail (as maximum), for all tickets with ban-time greater (or persistent) * added new setup-option `--without-tests` to skip building and installing of tests files (gh-2287). * added new command `fail2ban-client get <JAIL> banip ?sep-char|--with-time?` to get the banned ip addresses (gh-1916). * purge database will be executed now (within observer). restoring currently banned ip after service restart fixed (now < timeofban + bantime), ignore old log failures (already banned) * upgrade database: update new created table `bips` with entries from table `bans` (allows restore current bans after upgrade from version <= 0.10) - removal of SuSEfirewall2-fail2ban for factory versions since SuSEfirewall2 will be removed from Factory (see sr#713247): * removed references to SuSEfirewall2 service * use references to SuSEfirewall2 only for older distributions * Removed installation recommendation of the fail2ban-SuSEfirewall2 package for all distributions as it is deprecated. - changed fail2ban unit file location (boo#1145181, gh#fail2ban/fail2ban#2474) Patch Instructions: To install this openSUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 15.2: zypper in -t patch openSUSE-2021-1274=1 - openSUSE Backports SLE-15-SP3: zypper in -t patch openSUSE-2021-1274=1 - openSUSE Backports SLE-15-SP2: zypper in -t patch openSUSE-2021-1274=1 - openSUSE Backports SLE-15-SP1: zypper in -t patch openSUSE-2021-1274=1 Package List: - openSUSE Leap 15.2 (noarch): fail2ban-0.11.2-lp152.3.3.1 monitoring-plugins-fail2ban-0.11.2-lp152.3.3.1 - openSUSE Backports SLE-15-SP3 (noarch): fail2ban-0.11.2-bp153.2.3.1 monitoring-plugins-fail2ban-0.11.2-bp153.2.3.1 - openSUSE Backports SLE-15-SP2 (noarch): fail2ban-0.11.2-bp152.4.3.1 monitoring-plugins-fail2ban-0.11.2-bp152.4.3.1 - openSUSE Backports SLE-15-SP1 (noarch): fail2ban-0.11.2-bp151.3.3.1 monitoring-plugins-fail2ban-0.11.2-bp151.3.3.1 References: https://www.suse.com/security/cve/CVE-2021-32749.html https://bugzilla.suse.com/1145181 https://bugzilla.suse.com/1146856 https://bugzilla.suse.com/1180738 https://bugzilla.suse.com/1188610

1 0