January 2022 - openSUSE Updates - openSUSE Mailing Lists

openSUSE-RU-2022:0155-1: Recommended update for ibus-table-zhuyin
by maintenance＠opensuse.org 24 Jan '22

24 Jan '22

openSUSE Recommended Update: Recommended update for ibus-table-zhuyin ______________________________________________________________________________ Announcement ID: openSUSE-RU-2022:0155-1 Rating: low References: SLE-3872 Affected Products: openSUSE Leap 15.3 ______________________________________________________________________________ An update that has 0 recommended fixes and contains one feature can now be installed. Description: This update for ibus-table-zhuyin fixes the following issues: - Disable installation by default to allow the end user to choose whether to install or not (jsc#SLE-3872) Patch Instructions: To install this openSUSE Recommended Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 15.3: zypper in -t patch openSUSE-SLE-15.3-2022-155=1 Package List: - openSUSE Leap 15.3 (noarch): ibus-table-zhuyin-1.2.0.20090831-3.3.1 References:

1 0

openSUSE-RU-2022:0153-1: moderate: Recommended update for enchant
by maintenance＠opensuse.org 21 Jan '22

21 Jan '22

openSUSE Recommended Update: Recommended update for enchant ______________________________________________________________________________ Announcement ID: openSUSE-RU-2022:0153-1 Rating: moderate References: #1089434 Affected Products: openSUSE Leap 15.3 ______________________________________________________________________________ An update that has one recommended fix can now be installed. Description: This update for enchant fixes the following issues: - Add missing closing parentheses for packageand Supplements. (bsc#1089434) Patch Instructions: To install this openSUSE Recommended Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 15.3: zypper in -t patch openSUSE-SLE-15.3-2022-153=1 Package List: - openSUSE Leap 15.3 (aarch64 ppc64le s390x x86_64): enchant-2-backend-aspell-2.2.5-4.6.1 enchant-2-backend-aspell-debuginfo-2.2.5-4.6.1 enchant-2-backend-hunspell-2.2.5-4.6.1 enchant-2-backend-hunspell-debuginfo-2.2.5-4.6.1 enchant-2-backend-voikko-2.2.5-4.6.1 enchant-2-backend-voikko-debuginfo-2.2.5-4.6.1 enchant-data-2.2.5-4.6.1 enchant-debugsource-2.2.5-4.6.1 enchant-devel-2.2.5-4.6.1 enchant-tools-2.2.5-4.6.1 enchant-tools-debuginfo-2.2.5-4.6.1 libenchant-2-2-2.2.5-4.6.1 libenchant-2-2-debuginfo-2.2.5-4.6.1 - openSUSE Leap 15.3 (x86_64): enchant-2-backend-voikko-32bit-2.2.5-4.6.1 enchant-2-backend-voikko-32bit-debuginfo-2.2.5-4.6.1 libenchant-2-2-32bit-2.2.5-4.6.1 libenchant-2-2-32bit-debuginfo-2.2.5-4.6.1 References: https://bugzilla.suse.com/1089434

1 0

openSUSE-SU-2022:0151-1: moderate: Security update for bind
by opensuse-security＠opensuse.org 21 Jan '22

21 Jan '22

openSUSE Security Update: Security update for bind ______________________________________________________________________________ Announcement ID: openSUSE-SU-2022:0151-1 Rating: moderate References: #1192146 Cross-References: CVE-2021-25219 CVSS scores: CVE-2021-25219 (NVD) : 5.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L CVE-2021-25219 (SUSE): 5.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L Affected Products: openSUSE Leap 15.3 ______________________________________________________________________________ An update that fixes one vulnerability is now available. Description: This update for bind fixes the following issues: - CVE-2021-25219: Fixed flaw that allowed abusing lame cache to severely degrade resolver performance (bsc#1192146). Patch Instructions: To install this openSUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 15.3: zypper in -t patch openSUSE-SLE-15.3-2022-151=1 Package List: - openSUSE Leap 15.3 (aarch64 ppc64le s390x x86_64): bind-9.16.6-150300.22.13.1 bind-chrootenv-9.16.6-150300.22.13.1 bind-debuginfo-9.16.6-150300.22.13.1 bind-debugsource-9.16.6-150300.22.13.1 bind-devel-9.16.6-150300.22.13.1 bind-utils-9.16.6-150300.22.13.1 bind-utils-debuginfo-9.16.6-150300.22.13.1 libbind9-1600-9.16.6-150300.22.13.1 libbind9-1600-debuginfo-9.16.6-150300.22.13.1 libdns1605-9.16.6-150300.22.13.1 libdns1605-debuginfo-9.16.6-150300.22.13.1 libirs-devel-9.16.6-150300.22.13.1 libirs1601-9.16.6-150300.22.13.1 libirs1601-debuginfo-9.16.6-150300.22.13.1 libisc1606-9.16.6-150300.22.13.1 libisc1606-debuginfo-9.16.6-150300.22.13.1 libisccc1600-9.16.6-150300.22.13.1 libisccc1600-debuginfo-9.16.6-150300.22.13.1 libisccfg1600-9.16.6-150300.22.13.1 libisccfg1600-debuginfo-9.16.6-150300.22.13.1 libns1604-9.16.6-150300.22.13.1 libns1604-debuginfo-9.16.6-150300.22.13.1 - openSUSE Leap 15.3 (noarch): bind-doc-9.16.6-150300.22.13.1 python3-bind-9.16.6-150300.22.13.1 References: https://www.suse.com/security/cve/CVE-2021-25219.html https://bugzilla.suse.com/1192146

1 0

openSUSE-SU-2022:0150-1: important: Security update for aide
by opensuse-security＠opensuse.org 21 Jan '22

21 Jan '22

openSUSE Security Update: Security update for aide ______________________________________________________________________________ Announcement ID: openSUSE-SU-2022:0150-1 Rating: important References: #1194735 Cross-References: CVE-2021-45417 CVSS scores: CVE-2021-45417 (SUSE): 7 CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H Affected Products: openSUSE Leap 15.3 ______________________________________________________________________________ An update that fixes one vulnerability is now available. Description: This update for aide fixes the following issues: - CVE-2021-45417: Fix a bufferoverflow in base64 functions (bsc#1194735) Patch Instructions: To install this openSUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 15.3: zypper in -t patch openSUSE-SLE-15.3-2022-150=1 Package List: - openSUSE Leap 15.3 (aarch64 ppc64le s390x x86_64): aide-0.16-24.1 aide-debuginfo-0.16-24.1 aide-debugsource-0.16-24.1 aide-test-0.16-24.1 References: https://www.suse.com/security/cve/CVE-2021-45417.html https://bugzilla.suse.com/1194735

1 0

openSUSE-SU-2022:0018-1: important: Security update for stb
by opensuse-security＠opensuse.org 21 Jan '22

21 Jan '22

openSUSE Security Update: Security update for stb ______________________________________________________________________________ Announcement ID: openSUSE-SU-2022:0018-1 Rating: important References: #1191743 Cross-References: CVE-2021-42716 CVSS scores: CVE-2021-42716 (NVD) : 9.1 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:H Affected Products: openSUSE Backports SLE-15-SP3 ______________________________________________________________________________ An update that fixes one vulnerability is now available. Description: This update for stb fixes the following issues: - CVE-2021-42716: fixed buffer overflow in stb_image PNM loader (boo#1191743) Patch Instructions: To install this openSUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Backports SLE-15-SP3: zypper in -t patch openSUSE-2022-18=1 Package List: - openSUSE Backports SLE-15-SP3 (noarch): stb-devel-2.32.1549563867.59e9702-bp153.2.3.1 References: https://www.suse.com/security/cve/CVE-2021-42716.html https://bugzilla.suse.com/1191743

1 0

openSUSE-SU-2022:0149-1: moderate: Security update for rust1.56
by opensuse-security＠opensuse.org 21 Jan '22

21 Jan '22

openSUSE Security Update: Security update for rust1.56 ______________________________________________________________________________ Announcement ID: openSUSE-SU-2022:0149-1 Rating: moderate References: #1194767 Cross-References: CVE-2022-21658 CVSS scores: CVE-2022-21658 (SUSE): 6.2 CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N Affected Products: openSUSE Leap 15.3 ______________________________________________________________________________ An update that fixes one vulnerability is now available. Description: This update for rust1.56 fixes the following issues: - CVE-2022-21658: Fixed race condition in std::fs::remove_dir_all (bsc#1194767). Patch Instructions: To install this openSUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 15.3: zypper in -t patch openSUSE-SLE-15.3-2022-149=1 Package List: - openSUSE Leap 15.3 (aarch64 ppc64le s390x x86_64): cargo1.56-1.56.1-150300.7.6.1 cargo1.56-debuginfo-1.56.1-150300.7.6.1 rust1.56-1.56.1-150300.7.6.1 rust1.56-debuginfo-1.56.1-150300.7.6.1 References: https://www.suse.com/security/cve/CVE-2022-21658.html https://bugzilla.suse.com/1194767

1 0

openSUSE-RU-2022:0147-1: moderate: Recommended update for obs-service-format_spec_file
by maintenance＠opensuse.org 20 Jan '22

20 Jan '22

openSUSE Recommended Update: Recommended update for obs-service-format_spec_file ______________________________________________________________________________ Announcement ID: openSUSE-RU-2022:0147-1 Rating: moderate References: SLE-18915 Affected Products: openSUSE Leap 15.3 ______________________________________________________________________________ An update that has 0 recommended fixes and contains one feature can now be installed. Description: This update for obs-service-format_spec_file fixes the following issues: obs-service-format_spec_file: Update obs-service-format_spec_file from version 20191114 to version 20211115: - Sync license identifiers from SPDX (spdx.org). (jsc#SLE-18915) - Be more wary on usage of macros in Tags - Do not Cache Source.* but only Source[0-9]* - Stop pretending we can guess what the spec file is for - Avoid deep recursion in merge_comments - Allow to override date - Split out final comments in description - Make a special exception for short %p* snippets - Also split Conflict headers - Keep the old require sorting - Improve the performance of reorder_tags - Fix merge_comments - Do not split %if and section start - Support multiline copyrights (for Firefox) - Simplify how to calculate the `base_package` - Split tag values of certain tags - Be careful with macros that appear between tags - Replace SPDX mapper with an advanced version - Fix merging empty sections - Allow before lines to commented tags - Keep comments close to the original line - Review some deltas in the test suites that are acceptable for now - Parse more into the description - basically everything for now - Fix Release tag - Add an empty line before each section - Reorder tags that are below each other - Fix whitespace - Add test cases for spec-file cleaner (with current output) - Use perltidy like Cavil - Remove patch_license - old helper script for mass migration - Only parse Provides in Header section - Trim all trailing whitespace - including \r - Fix copyright year to 2012 in the test cases - Fetch licenses from JSON and remove + variants - Fetch exceptions from JSON - prepare_spec handle the case where License/Group are in a if/else/endif rpmlint: - Rebuild rpmlint with the new obs-service-format_spec_file. rpmlint-mini: - BuildRequires `python-rpm-macros` since the `py3_ver` macro is now considered obsolete in `python3-base`. Patch Instructions: To install this openSUSE Recommended Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 15.3: zypper in -t patch openSUSE-SLE-15.3-2022-147=1 Package List: - openSUSE Leap 15.3 (noarch): obs-service-format_spec_file-20211115-3.9.4 rpmlint-1.10-7.32.3 References:

2 1

openSUSE-RU-2022:0146-1: moderate: Recommended update for nodejs16
by maintenance＠opensuse.org 20 Jan '22

20 Jan '22

openSUSE Recommended Update: Recommended update for nodejs16 ______________________________________________________________________________ Announcement ID: openSUSE-RU-2022:0146-1 Rating: moderate References: SLE-21235 Affected Products: openSUSE Leap 15.3 ______________________________________________________________________________ An update that has 0 recommended fixes and contains one feature can now be installed. Description: This update for nodejs16 fixes the following issues: NodeJS 16 is shipped in version 16.13.2. For complete list of changes since 15.x, please see https://github.com/nodejs/node/blob/master/doc/changelogs/CHANGELOG_V16.md# 16.0.0 Patch Instructions: To install this openSUSE Recommended Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 15.3: zypper in -t patch openSUSE-SLE-15.3-2022-146=1 Package List: - openSUSE Leap 15.3 (aarch64 ppc64le s390x x86_64): nodejs16-16.13.2-150300.7.3.1 nodejs16-debuginfo-16.13.2-150300.7.3.1 nodejs16-debugsource-16.13.2-150300.7.3.1 nodejs16-devel-16.13.2-150300.7.3.1 npm16-16.13.2-150300.7.3.1 - openSUSE Leap 15.3 (noarch): nodejs16-docs-16.13.2-150300.7.3.1 References:

1 0

openSUSE-SU-2022:0144-1: moderate: Security update for cryptsetup
by opensuse-security＠opensuse.org 20 Jan '22

20 Jan '22

openSUSE Security Update: Security update for cryptsetup ______________________________________________________________________________ Announcement ID: openSUSE-SU-2022:0144-1 Rating: moderate References: #1194469 Cross-References: CVE-2021-4122 CVSS scores: CVE-2021-4122 (SUSE): 5.9 CVSS:3.1/AV:P/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:N Affected Products: openSUSE Leap 15.3 ______________________________________________________________________________ An update that fixes one vulnerability is now available. Description: This update for cryptsetup fixes the following issues: - CVE-2021-4122: Fixed possible attacks against data confidentiality through LUKS2 online reencryption extension crash recovery (bsc#1194469). Patch Instructions: To install this openSUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 15.3: zypper in -t patch openSUSE-SLE-15.3-2022-144=1 Package List: - openSUSE Leap 15.3 (aarch64 ppc64le s390x x86_64): cryptsetup-2.3.7-150300.3.5.1 cryptsetup-debuginfo-2.3.7-150300.3.5.1 cryptsetup-debugsource-2.3.7-150300.3.5.1 libcryptsetup-devel-2.3.7-150300.3.5.1 libcryptsetup12-2.3.7-150300.3.5.1 libcryptsetup12-debuginfo-2.3.7-150300.3.5.1 libcryptsetup12-hmac-2.3.7-150300.3.5.1 - openSUSE Leap 15.3 (noarch): cryptsetup-lang-2.3.7-150300.3.5.1 - openSUSE Leap 15.3 (x86_64): libcryptsetup12-32bit-2.3.7-150300.3.5.1 libcryptsetup12-32bit-debuginfo-2.3.7-150300.3.5.1 libcryptsetup12-hmac-32bit-2.3.7-150300.3.5.1 References: https://www.suse.com/security/cve/CVE-2021-4122.html https://bugzilla.suse.com/1194469

1 0

openSUSE-SU-2022:0140-1: important: Security update for grafana
by opensuse-security＠opensuse.org 20 Jan '22

20 Jan '22

openSUSE Security Update: Security update for grafana ______________________________________________________________________________ Announcement ID: openSUSE-SU-2022:0140-1 Rating: important References: #1191454 #1193688 Cross-References: CVE-2021-39226 CVE-2021-43813 CVSS scores: CVE-2021-39226 (NVD) : 7.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L CVE-2021-39226 (SUSE): 7.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L CVE-2021-43813 (NVD) : 4.3 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N CVE-2021-43813 (SUSE): 4.3 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N Affected Products: openSUSE Leap 15.3 ______________________________________________________________________________ An update that fixes two vulnerabilities is now available. Description: This update for grafana fixes the following issues: - CVE-2021-39226: Fixed snapshot authentication bypass (bsc#1191454) - CVE-2021-43813: Fixed markdown path traversal (bsc#1193688) Patch Instructions: To install this openSUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 15.3: zypper in -t patch openSUSE-SLE-15.3-2022-140=1 Package List: - openSUSE Leap 15.3 (aarch64 ppc64le s390x x86_64): grafana-7.5.12-3.18.1 References: https://www.suse.com/security/cve/CVE-2021-39226.html https://www.suse.com/security/cve/CVE-2021-43813.html https://bugzilla.suse.com/1191454 https://bugzilla.suse.com/1193688

1 0