September 2021 - openSUSE Updates - openSUSE Mailing Lists

openSUSE-SU-2021:1233-1: important: Security update for java-11-openjdk
by opensuse-security＠opensuse.org 07 Sep '21

07 Sep '21

openSUSE Security Update: Security update for java-11-openjdk ______________________________________________________________________________ Announcement ID: openSUSE-SU-2021:1233-1 Rating: important References: #1185476 #1188564 #1188565 #1188566 SLE-5715 Cross-References: CVE-2021-2341 CVE-2021-2369 CVE-2021-2388 CVSS scores: CVE-2021-2341 (NVD) : 3.1 CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:L/I:N/A:N CVE-2021-2341 (SUSE): 3.1 CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:L/I:N/A:N CVE-2021-2369 (NVD) : 4.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N CVE-2021-2369 (SUSE): 4.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N CVE-2021-2388 (NVD) : 7.5 CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H CVE-2021-2388 (SUSE): 7.5 CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H Affected Products: openSUSE Leap 15.2 ______________________________________________________________________________ An update that solves three vulnerabilities, contains one feature and has one errata is now available. Description: This update for java-11-openjdk fixes the following issues: - Update to jdk-11.0.12+7 - CVE-2021-2369: Fixed JAR file handling problem containing multiple MANIFEST.MF files. (bsc#1188565) - CVE-2021-2388: Fixed a flaw inside the Hotspot component performed range check elimination. (bsc#1188566) - CVE-2021-2341: Fixed a flaw inside the FtpClient. (bsc#1188564) This update was imported from the SUSE:SLE-15:Update update project. Patch Instructions: To install this openSUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 15.2: zypper in -t patch openSUSE-2021-1233=1 Package List: - openSUSE Leap 15.2 (i586 x86_64): java-11-openjdk-11.0.12.0-lp152.2.15.1 java-11-openjdk-accessibility-11.0.12.0-lp152.2.15.1 java-11-openjdk-accessibility-debuginfo-11.0.12.0-lp152.2.15.1 java-11-openjdk-debuginfo-11.0.12.0-lp152.2.15.1 java-11-openjdk-debugsource-11.0.12.0-lp152.2.15.1 java-11-openjdk-demo-11.0.12.0-lp152.2.15.1 java-11-openjdk-devel-11.0.12.0-lp152.2.15.1 java-11-openjdk-headless-11.0.12.0-lp152.2.15.1 java-11-openjdk-jmods-11.0.12.0-lp152.2.15.1 java-11-openjdk-src-11.0.12.0-lp152.2.15.1 - openSUSE Leap 15.2 (noarch): java-11-openjdk-javadoc-11.0.12.0-lp152.2.15.1 References: https://www.suse.com/security/cve/CVE-2021-2341.html https://www.suse.com/security/cve/CVE-2021-2369.html https://www.suse.com/security/cve/CVE-2021-2388.html https://bugzilla.suse.com/1185476 https://bugzilla.suse.com/1188564 https://bugzilla.suse.com/1188565 https://bugzilla.suse.com/1188566

1 0

openSUSE-RU-2021:1238-1: moderate: Recommended update for pcre2
by maintenance＠opensuse.org 07 Sep '21

07 Sep '21

openSUSE Recommended Update: Recommended update for pcre2 ______________________________________________________________________________ Announcement ID: openSUSE-RU-2021:1238-1 Rating: moderate References: #1187937 Affected Products: openSUSE Leap 15.2 ______________________________________________________________________________ An update that has one recommended fix can now be installed. Description: This update for pcre2 fixes the following issue: - Equalizes the result of a function that may have different output on s390x if compared to older (bsc#1187937) PHP versions. This update was imported from the SUSE:SLE-15:Update update project. Patch Instructions: To install this openSUSE Recommended Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 15.2: zypper in -t patch openSUSE-2021-1238=1 Package List: - openSUSE Leap 15.2 (i586 x86_64): libpcre2-16-0-10.31-lp152.4.3.1 libpcre2-16-0-debuginfo-10.31-lp152.4.3.1 libpcre2-32-0-10.31-lp152.4.3.1 libpcre2-32-0-debuginfo-10.31-lp152.4.3.1 libpcre2-8-0-10.31-lp152.4.3.1 libpcre2-8-0-debuginfo-10.31-lp152.4.3.1 libpcre2-posix2-10.31-lp152.4.3.1 libpcre2-posix2-debuginfo-10.31-lp152.4.3.1 pcre2-debugsource-10.31-lp152.4.3.1 pcre2-devel-10.31-lp152.4.3.1 pcre2-devel-static-10.31-lp152.4.3.1 pcre2-tools-10.31-lp152.4.3.1 pcre2-tools-debuginfo-10.31-lp152.4.3.1 - openSUSE Leap 15.2 (noarch): pcre2-doc-10.31-lp152.4.3.1 - openSUSE Leap 15.2 (x86_64): libpcre2-16-0-32bit-10.31-lp152.4.3.1 libpcre2-16-0-32bit-debuginfo-10.31-lp152.4.3.1 libpcre2-32-0-32bit-10.31-lp152.4.3.1 libpcre2-32-0-32bit-debuginfo-10.31-lp152.4.3.1 libpcre2-8-0-32bit-10.31-lp152.4.3.1 libpcre2-8-0-32bit-debuginfo-10.31-lp152.4.3.1 libpcre2-posix2-32bit-10.31-lp152.4.3.1 libpcre2-posix2-32bit-debuginfo-10.31-lp152.4.3.1 References: https://bugzilla.suse.com/1187937

1 0

openSUSE-SU-2021:2966-1: Security update for openssl-1_1
by opensuse-security＠opensuse.org 07 Sep '21

07 Sep '21

openSUSE Security Update: Security update for openssl-1_1 ______________________________________________________________________________ Announcement ID: openSUSE-SU-2021:2966-1 Rating: low References: #1189521 Cross-References: CVE-2021-3712 CVSS scores: CVE-2021-3712 (SUSE): 5.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L Affected Products: openSUSE Leap 15.3 ______________________________________________________________________________ An update that fixes one vulnerability is now available. Description: This update for openssl-1_1 fixes the following issues: - CVE-2021-3712: This is an update for the incomplete fix for CVE-2021-3712. Read buffer overruns processing ASN.1 strings (bsc#1189521). Patch Instructions: To install this openSUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 15.3: zypper in -t patch openSUSE-SLE-15.3-2021-2966=1 Package List: - openSUSE Leap 15.3 (aarch64 ppc64le s390x x86_64): libopenssl-1_1-devel-1.1.1d-11.30.1 libopenssl1_1-1.1.1d-11.30.1 libopenssl1_1-debuginfo-1.1.1d-11.30.1 libopenssl1_1-hmac-1.1.1d-11.30.1 openssl-1_1-1.1.1d-11.30.1 openssl-1_1-debuginfo-1.1.1d-11.30.1 openssl-1_1-debugsource-1.1.1d-11.30.1 - openSUSE Leap 15.3 (x86_64): libopenssl-1_1-devel-32bit-1.1.1d-11.30.1 libopenssl1_1-32bit-1.1.1d-11.30.1 libopenssl1_1-32bit-debuginfo-1.1.1d-11.30.1 libopenssl1_1-hmac-32bit-1.1.1d-11.30.1 - openSUSE Leap 15.3 (noarch): openssl-1_1-doc-1.1.1d-11.30.1 References: https://www.suse.com/security/cve/CVE-2021-3712.html https://bugzilla.suse.com/1189521

1 0

openSUSE-RU-2021:1232-1: moderate: Recommended update for seamonkey
by maintenance＠opensuse.org 07 Sep '21

07 Sep '21

openSUSE Recommended Update: Recommended update for seamonkey ______________________________________________________________________________ Announcement ID: openSUSE-RU-2021:1232-1 Rating: moderate References: #896624 Affected Products: openSUSE Backports SLE-15-SP2 ______________________________________________________________________________ An update that has one recommended fix can now be installed. Description: This update for seamonkey fixes the following issues: seamonkey is added to Leap 15.2: - https://bugzilla.opensuse.org/show_bug.cgi?id=1185349 update to SeaMonkey 2.53.7.1 * Fix for legacy generators and the deprecated for each statement in add-ons and the Add-on SDK bug 1702903. * Fix for handling of dead keys in text input fields in GTK 3.24.26+ bug 1701288. * SeaMonkey 2.53.7.1 uses the same backend as Firefox and contains the relevant Firefox 60.8 security fixes. * SeaMonkey 2.53.7.1 shares most parts of the mail and news code with Thunderbird. Please read the Thunderbird 60.0 release notes for specific changes and security fixes in this release. * Additional important security fixes up to Current Firefox 78.8 ESR and a few enhancements have been backported. We will continue to enhance SeaMonkey security in subsequent 2.53.x beta and release versions as fast as we are able to. update to SeaMonkey 2.53.7 * Remove Flash and NPAPI support bug 1688415. * Switch packaged extensions to be global bug 1659298. * Add Insert Forms to Composer bug 1684611. * Fix an issue with copying to IMAP sent folder and some reference count leaks in mailnews bug 1689890. * Tailing to delay tracker requests and enhance performance has been enabled bug 1358060. * Fix an issue with favorite and recent folders not showing in macOS bug 1695869. * Various security and general platform fixes. * The ChatZilla source has been integrated into SeaMonkey and no longer needs to be checked out separately if you build your own release bug 1551033. * SeaMonkey 2.53.7 uses the same backend as Firefox and contains the relevant Firefox 60.8 security fixes. * SeaMonkey 2.53.7 shares most parts of the mail and news code with Thunderbird. Please read the Thunderbird 60.0 release notes for specific changes and security fixes in this release. * Additional important security fixes up to Current Firefox 78.8 ESR and a few enhancements have been backported. We will continue to enhance SeaMonkey security in subsequent 2.53.x beta and release versions as fast as we are able to. * provide a way to auto-select es-AR locale on any Spanish one but es-ES - restore Chatzilla and DOM Inspector packages disabled in Revision 333; these extensions were long since re-enabled upstream but apparently we had forgotten to re-enable them in the spec file update to SeaMonkey 2.53.6 * Improve usability of multiple mailboxes/folders selectionbug 1600103. * Add Greek localisation (el). * Remove more RDF from mailnews code. * Switch to mozilla as topsrcdir and component for building is comm/suite now. * Rust support is now up to 1.48 and official build is now using 1.47.0 * Various security and general platform fixes. * SeaMonkey 2.53.6 uses the same backend as Firefox and contains the relevant Firefox 60.8 security fixes. * SeaMonkey 2.53.6 shares most parts of the mail and news code with Thunderbird. Please read the Thunderbird 60.0 release notes for specific changes and security fixes in this release. * Additional important security fixes up to Current Firefox 78.6 ESR and a few enhancements have been backported. We will continue to enhance SeaMonkey security in subsequent 2.53.x beta and release versions as fast as we are able to. - rewrote spec file to account for SeaMonkey's new build system, including a new Makefile from Dmitry Butskoy: #1181525#c3 - merged the translations-common and translations-other subpackages into the main package; it is no longer convenient/consistent to keep these separate because localizations for the integrated IRC and Calendar clients are already merged in the source. This also solves #1181525. - enabled and bundled Calendar (Lightning) extension - cleaned up spec file to remove conditions targeting long-obsolete openSUSE versions - disabled elf-hack on i586 builds, as it was preventing compilation - add patch to enable builds with Rust >= 1.48 on Tumbleweed https://bugzilla.mozilla.org/show_bug.cgi?id=1617782#c22 This update was imported from the openSUSE:Leap:15.2:Update update project. Patch Instructions: To install this openSUSE Recommended Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Backports SLE-15-SP2: zypper in -t patch openSUSE-2021-1232=1 Package List: - openSUSE Backports SLE-15-SP2 (x86_64): seamonkey-2.53.8.1-bp152.4.9.1 seamonkey-dom-inspector-2.53.8.1-bp152.4.9.1 seamonkey-irc-2.53.8.1-bp152.4.9.1 References: https://bugzilla.suse.com/896624

1 0

openSUSE-RU-2021:2962-1: critical: Recommended update for runc
by maintenance＠opensuse.org 06 Sep '21

06 Sep '21

openSUSE Recommended Update: Recommended update for runc ______________________________________________________________________________ Announcement ID: openSUSE-RU-2021:2962-1 Rating: critical References: #1189743 Affected Products: openSUSE Leap 15.3 ______________________________________________________________________________ An update that has one recommended fix can now be installed. Description: This update for runc fixes the following issues: - Fixed an issue when toolbox container fails to start. (bsc#1189743) Patch Instructions: To install this openSUSE Recommended Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 15.3: zypper in -t patch openSUSE-SLE-15.3-2021-2962=1 Package List: - openSUSE Leap 15.3 (aarch64 ppc64le s390x x86_64): runc-1.0.0~rc93-1.17.1 runc-debuginfo-1.0.0~rc93-1.17.1 References: https://bugzilla.suse.com/1189743

1 0

openSUSE-SU-2021:1231-1: important: Security update for xerces-c
by opensuse-security＠opensuse.org 06 Sep '21

06 Sep '21

openSUSE Security Update: Security update for xerces-c ______________________________________________________________________________ Announcement ID: openSUSE-SU-2021:1231-1 Rating: important References: #1159552 Cross-References: CVE-2018-1311 CVSS scores: CVE-2018-1311 (NVD) : 8.1 CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H CVE-2018-1311 (SUSE): 8.1 CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H Affected Products: openSUSE Leap 15.2 ______________________________________________________________________________ An update that fixes one vulnerability is now available. Description: This update for xerces-c fixes the following issues: - CVE-2018-1311: Fixed use-after-free inside XML parser during the scanning of external DTDs (bsc#1159552). This update was imported from the SUSE:SLE-15:Update update project. Patch Instructions: To install this openSUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 15.2: zypper in -t patch openSUSE-2021-1231=1 Package List: - openSUSE Leap 15.2 (i586 x86_64): libxerces-c-3_1-3.1.4-lp152.5.3.1 libxerces-c-3_1-debuginfo-3.1.4-lp152.5.3.1 libxerces-c-devel-3.1.4-lp152.5.3.1 xerces-c-3.1.4-lp152.5.3.1 xerces-c-debuginfo-3.1.4-lp152.5.3.1 xerces-c-debugsource-3.1.4-lp152.5.3.1 xerces-c-doc-3.1.4-lp152.5.3.1 - openSUSE Leap 15.2 (x86_64): libxerces-c-3_1-32bit-3.1.4-lp152.5.3.1 libxerces-c-3_1-32bit-debuginfo-3.1.4-lp152.5.3.1 References: https://www.suse.com/security/cve/CVE-2018-1311.html https://bugzilla.suse.com/1159552

1 0

openSUSE-RU-2021:2956-1: moderate: Recommended update for openCryptoki
by maintenance＠opensuse.org 06 Sep '21

06 Sep '21

openSUSE Recommended Update: Recommended update for openCryptoki ______________________________________________________________________________ Announcement ID: openSUSE-RU-2021:2956-1 Rating: moderate References: #1188879 Affected Products: openSUSE Leap 15.3 ______________________________________________________________________________ An update that has one recommended fix can now be installed. Description: This update for openCryptoki fixes the following issues: - Opencryptoki slot daemon not able to start after migration. (bsc#1188879) Patch Instructions: To install this openSUSE Recommended Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 15.3: zypper in -t patch openSUSE-SLE-15.3-2021-2956=1 Package List: - openSUSE Leap 15.3 (aarch64 ppc64le s390x x86_64): openCryptoki-3.15.1-5.6.1 openCryptoki-64bit-3.15.1-5.6.1 openCryptoki-64bit-debuginfo-3.15.1-5.6.1 openCryptoki-debuginfo-3.15.1-5.6.1 openCryptoki-debugsource-3.15.1-5.6.1 openCryptoki-devel-3.15.1-5.6.1 References: https://bugzilla.suse.com/1188879

1 0

openSUSE-SU-2021:2958-1: important: Security update for xerces-c
by opensuse-security＠opensuse.org 06 Sep '21

06 Sep '21

openSUSE Security Update: Security update for xerces-c ______________________________________________________________________________ Announcement ID: openSUSE-SU-2021:2958-1 Rating: important References: #1159552 Cross-References: CVE-2018-1311 CVSS scores: CVE-2018-1311 (NVD) : 8.1 CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H CVE-2018-1311 (SUSE): 8.1 CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H Affected Products: openSUSE Leap 15.3 ______________________________________________________________________________ An update that fixes one vulnerability is now available. Description: This update for xerces-c fixes the following issues: - CVE-2018-1311: Fixed use-after-free inside XML parser during the scanning of external DTDs (bsc#1159552). Patch Instructions: To install this openSUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 15.3: zypper in -t patch openSUSE-SLE-15.3-2021-2958=1 Package List: - openSUSE Leap 15.3 (aarch64 ppc64le s390x x86_64): libxerces-c-3_1-3.1.4-10.3.1 libxerces-c-3_1-debuginfo-3.1.4-10.3.1 - openSUSE Leap 15.3 (x86_64): libxerces-c-3_1-32bit-3.1.4-10.3.1 libxerces-c-3_1-32bit-debuginfo-3.1.4-10.3.1 References: https://www.suse.com/security/cve/CVE-2018-1311.html https://bugzilla.suse.com/1159552

1 0

openSUSE-SU-2021:1230-1: moderate: Security update for gstreamer-plugins-good
by opensuse-security＠opensuse.org 05 Sep '21

05 Sep '21

openSUSE Security Update: Security update for gstreamer-plugins-good ______________________________________________________________________________ Announcement ID: openSUSE-SU-2021:1230-1 Rating: moderate References: #1184735 #1184739 Cross-References: CVE-2021-3497 CVE-2021-3498 CVSS scores: CVE-2021-3497 (NVD) : 7.8 CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H CVE-2021-3497 (SUSE): 5.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L CVE-2021-3498 (NVD) : 7.8 CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H CVE-2021-3498 (SUSE): 5.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L Affected Products: openSUSE Leap 15.2 ______________________________________________________________________________ An update that fixes two vulnerabilities is now available. Description: This update for gstreamer-plugins-good fixes the following issues: - CVE-2021-3498: Matroskademux: initialize track context out parameter to NULL before parsing (bsc#1184735). - CVE-2021-3497: Matroskademux: Fix extraction of multichannel WavPack (bsc#1184739). This update was imported from the SUSE:SLE-15-SP2:Update update project. Patch Instructions: To install this openSUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 15.2: zypper in -t patch openSUSE-2021-1230=1 Package List: - openSUSE Leap 15.2 (i586 x86_64): gstreamer-plugins-good-1.16.3-lp152.2.6.1 gstreamer-plugins-good-debuginfo-1.16.3-lp152.2.6.1 gstreamer-plugins-good-debugsource-1.16.3-lp152.2.6.1 gstreamer-plugins-good-doc-1.16.3-lp152.2.6.1 gstreamer-plugins-good-extra-1.16.3-lp152.2.6.1 gstreamer-plugins-good-extra-debuginfo-1.16.3-lp152.2.6.1 gstreamer-plugins-good-gtk-1.16.3-lp152.2.6.1 gstreamer-plugins-good-gtk-debuginfo-1.16.3-lp152.2.6.1 gstreamer-plugins-good-jack-1.16.3-lp152.2.6.1 gstreamer-plugins-good-jack-debuginfo-1.16.3-lp152.2.6.1 gstreamer-plugins-good-qtqml-1.16.3-lp152.2.6.1 gstreamer-plugins-good-qtqml-debuginfo-1.16.3-lp152.2.6.1 - openSUSE Leap 15.2 (x86_64): gstreamer-plugins-good-32bit-1.16.3-lp152.2.6.1 gstreamer-plugins-good-32bit-debuginfo-1.16.3-lp152.2.6.1 gstreamer-plugins-good-extra-32bit-1.16.3-lp152.2.6.1 gstreamer-plugins-good-extra-32bit-debuginfo-1.16.3-lp152.2.6.1 gstreamer-plugins-good-jack-32bit-1.16.3-lp152.2.6.1 gstreamer-plugins-good-jack-32bit-debuginfo-1.16.3-lp152.2.6.1 - openSUSE Leap 15.2 (noarch): gstreamer-plugins-good-lang-1.16.3-lp152.2.6.1 References: https://www.suse.com/security/cve/CVE-2021-3497.html https://www.suse.com/security/cve/CVE-2021-3498.html https://bugzilla.suse.com/1184735 https://bugzilla.suse.com/1184739

1 0

openSUSE-RU-2021:1229-1: moderate: Recommended update for habootstrap-formula
by maintenance＠opensuse.org 04 Sep '21

04 Sep '21

openSUSE Recommended Update: Recommended update for habootstrap-formula ______________________________________________________________________________ Announcement ID: openSUSE-RU-2021:1229-1 Rating: moderate References: #1181731 Affected Products: openSUSE Leap 15.2 ______________________________________________________________________________ An update that has one recommended fix can now be installed. Description: This update for habootstrap-formula fixes the following issue: - Fix SUSE Manager integration. (bsc#1181731) This update was imported from the SUSE:SLE-15:Update update project. Patch Instructions: To install this openSUSE Recommended Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 15.2: zypper in -t patch openSUSE-2021-1229=1 Package List: - openSUSE Leap 15.2 (noarch): habootstrap-formula-0.4.2+git.1623406073.ac4a6b1-lp152.2.15.1 References: https://bugzilla.suse.com/1181731

1 0