January 2022 - openSUSE Updates - openSUSE Mailing Lists

openSUSE-SU-2022:0091-1: important: Security update for apache2
by opensuse-security＠opensuse.org 17 Jan '22

17 Jan '22

openSUSE Security Update: Security update for apache2 ______________________________________________________________________________ Announcement ID: openSUSE-SU-2022:0091-1 Rating: important References: #1193942 #1193943 SLE-22733 SLE-22849 Cross-References: CVE-2021-44224 CVE-2021-44790 CVSS scores: CVE-2021-44224 (SUSE): 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H CVE-2021-44790 (SUSE): 5.9 CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H Affected Products: openSUSE Leap 15.3 ______________________________________________________________________________ An update that fixes two vulnerabilities, contains two features is now available. Description: This update for apache2 fixes the following issues: Apache2 was updated to the current stable version 2.4.51 (jsc#SLE-22733 jsc#SLE-22849) It fixes all CVEs and selected bugs represented by patches found between 2.4.23 and 2.4.51. See https://downloads.apache.org/httpd/CHANGES_2.4 for a complete change log. Also fixed: - CVE-2021-44224: Fixed NULL dereference or SSRF in forward proxy configurations (bsc#1193943) - CVE-2021-44790: Fixed buffer overflow when parsing multipart content in mod_lua (bsc#1193942) Patch Instructions: To install this openSUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 15.3: zypper in -t patch openSUSE-SLE-15.3-2022-91=1 Package List: - openSUSE Leap 15.3 (aarch64 ppc64le s390x x86_64): apache2-2.4.51-3.37.1 apache2-debuginfo-2.4.51-3.37.1 apache2-debugsource-2.4.51-3.37.1 apache2-devel-2.4.51-3.37.1 apache2-event-2.4.51-3.37.1 apache2-event-debuginfo-2.4.51-3.37.1 apache2-example-pages-2.4.51-3.37.1 apache2-prefork-2.4.51-3.37.1 apache2-prefork-debuginfo-2.4.51-3.37.1 apache2-utils-2.4.51-3.37.1 apache2-utils-debuginfo-2.4.51-3.37.1 apache2-worker-2.4.51-3.37.1 apache2-worker-debuginfo-2.4.51-3.37.1 - openSUSE Leap 15.3 (noarch): apache2-doc-2.4.51-3.37.1 References: https://www.suse.com/security/cve/CVE-2021-44224.html https://www.suse.com/security/cve/CVE-2021-44790.html https://bugzilla.suse.com/1193942 https://bugzilla.suse.com/1193943

1 0

openSUSE-SU-2022:0088-1: moderate: Security update for ghostscript
by opensuse-security＠opensuse.org 17 Jan '22

17 Jan '22

openSUSE Security Update: Security update for ghostscript ______________________________________________________________________________ Announcement ID: openSUSE-SU-2022:0088-1 Rating: moderate References: #1194303 #1194304 Cross-References: CVE-2021-45944 CVE-2021-45949 CVSS scores: CVE-2021-45944 (NVD) : 5.5 CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H CVE-2021-45944 (SUSE): 6.2 CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H CVE-2021-45949 (NVD) : 5.5 CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H CVE-2021-45949 (SUSE): 6.2 CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H Affected Products: openSUSE Leap 15.3 ______________________________________________________________________________ An update that fixes two vulnerabilities is now available. Description: This update for ghostscript fixes the following issues: - CVE-2021-45944: Fixed use-after-free in sampled_data_sample (bsc#1194303) - CVE-2021-45949: Fixed heap-based buffer overflow in sampled_data_finish (bsc#1194304) Patch Instructions: To install this openSUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 15.3: zypper in -t patch openSUSE-SLE-15.3-2022-88=1 Package List: - openSUSE Leap 15.3 (aarch64 ppc64le s390x x86_64): ghostscript-9.52-161.1 ghostscript-debuginfo-9.52-161.1 ghostscript-debugsource-9.52-161.1 ghostscript-devel-9.52-161.1 ghostscript-x11-9.52-161.1 ghostscript-x11-debuginfo-9.52-161.1 References: https://www.suse.com/security/cve/CVE-2021-45944.html https://www.suse.com/security/cve/CVE-2021-45949.html https://bugzilla.suse.com/1194303 https://bugzilla.suse.com/1194304

1 0

openSUSE-RU-2022:0087-1: moderate: Recommended update for go1.16
by maintenance＠opensuse.org 17 Jan '22

17 Jan '22

openSUSE Recommended Update: Recommended update for go1.16 ______________________________________________________________________________ Announcement ID: openSUSE-RU-2022:0087-1 Rating: moderate References: #1182345 Affected Products: openSUSE Leap 15.3 ______________________________________________________________________________ An update that has one recommended fix can now be installed. Description: This update for go1.16 fixes the following issues: Update to go1.16.13 (bsc#1182345) - it includes fixes to the compiler, linker, runtime, and the net/http package. * x/net/http2: `http.Server.WriteTimeout` does not fire if the http2 stream's window is out of space. * runtime/race: building for iOS, but linking in object file built for macOS * runtime: race detector `SIGABRT` or `SIGSEGV` on macOS Monterey * runtime: mallocs cause "base outside usable address space" panic when running on iOS 14 * cmd/link: does not set section type of `.init_array` correctly * cmd/link: support more load commands on `Mach-O` * cmd/compile: internal compiler error: `Op...LECall and OpDereference have mismatched mem` Patch Instructions: To install this openSUSE Recommended Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 15.3: zypper in -t patch openSUSE-SLE-15.3-2022-87=1 Package List: - openSUSE Leap 15.3 (aarch64 ppc64le s390x x86_64): go1.16-1.16.13-1.40.1 go1.16-doc-1.16.13-1.40.1 - openSUSE Leap 15.3 (aarch64 x86_64): go1.16-race-1.16.13-1.40.1 References: https://bugzilla.suse.com/1182345

1 0

openSUSE-SU-2022:0014-1: important: Security update for chromium
by opensuse-security＠opensuse.org 17 Jan '22

17 Jan '22

openSUSE Security Update: Security update for chromium ______________________________________________________________________________ Announcement ID: openSUSE-SU-2022:0014-1 Rating: important References: #1194055 #1194182 #1194331 Cross-References: CVE-2022-0096 CVE-2022-0097 CVE-2022-0098 CVE-2022-0099 CVE-2022-0100 CVE-2022-0101 CVE-2022-0102 CVE-2022-0103 CVE-2022-0104 CVE-2022-0105 CVE-2022-0106 CVE-2022-0107 CVE-2022-0108 CVE-2022-0109 CVE-2022-0110 CVE-2022-0111 CVE-2022-0112 CVE-2022-0113 CVE-2022-0114 CVE-2022-0115 CVE-2022-0116 CVE-2022-0117 CVE-2022-0118 CVE-2022-0120 Affected Products: openSUSE Backports SLE-15-SP3 ______________________________________________________________________________ An update that fixes 24 vulnerabilities is now available. Description: This update for chromium fixes the following issues: Chromium 97.0.4692.71 (boo#1194331): * CVE-2022-0096: Use after free in Storage * CVE-2022-0097: Inappropriate implementation in DevTools * CVE-2022-0098: Use after free in Screen Capture * CVE-2022-0099: Use after free in Sign-in * CVE-2022-0100: Heap buffer overflow in Media streams API * CVE-2022-0101: Heap buffer overflow in Bookmarks * CVE-2022-0102: Type Confusion in V8 * CVE-2022-0103: Use after free in SwiftShader * CVE-2022-0104: Heap buffer overflow in ANGLE * CVE-2022-0105: Use after free in PDF * CVE-2022-0106: Use after free in Autofill * CVE-2022-0107: Use after free in File Manager API * CVE-2022-0108: Inappropriate implementation in Navigation * CVE-2022-0109: Inappropriate implementation in Autofill * CVE-2022-0110: Incorrect security UI in Autofill * CVE-2022-0111: Inappropriate implementation in Navigation * CVE-2022-0112: Incorrect security UI in Browser UI * CVE-2022-0113: Inappropriate implementation in Blink * CVE-2022-0114: Out of bounds memory access in Web Serial * CVE-2022-0115: Uninitialized Use in File API * CVE-2022-0116: Inappropriate implementation in Compositing * CVE-2022-0117: Policy bypass in Service Workers * CVE-2022-0118: Inappropriate implementation in WebShare * CVE-2022-0120: Inappropriate implementation in Passwords - Revert wayland fixes because it doesn't handle GPU correctly (boo#1194182) Patch Instructions: To install this openSUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Backports SLE-15-SP3: zypper in -t patch openSUSE-2022-14=1 Package List: - openSUSE Backports SLE-15-SP3 (aarch64 x86_64): chromedriver-97.0.4692.71-bp153.2.54.1 chromium-97.0.4692.71-bp153.2.54.1 References: https://www.suse.com/security/cve/CVE-2022-0096.html https://www.suse.com/security/cve/CVE-2022-0097.html https://www.suse.com/security/cve/CVE-2022-0098.html https://www.suse.com/security/cve/CVE-2022-0099.html https://www.suse.com/security/cve/CVE-2022-0100.html https://www.suse.com/security/cve/CVE-2022-0101.html https://www.suse.com/security/cve/CVE-2022-0102.html https://www.suse.com/security/cve/CVE-2022-0103.html https://www.suse.com/security/cve/CVE-2022-0104.html https://www.suse.com/security/cve/CVE-2022-0105.html https://www.suse.com/security/cve/CVE-2022-0106.html https://www.suse.com/security/cve/CVE-2022-0107.html https://www.suse.com/security/cve/CVE-2022-0108.html https://www.suse.com/security/cve/CVE-2022-0109.html https://www.suse.com/security/cve/CVE-2022-0110.html https://www.suse.com/security/cve/CVE-2022-0111.html https://www.suse.com/security/cve/CVE-2022-0112.html https://www.suse.com/security/cve/CVE-2022-0113.html https://www.suse.com/security/cve/CVE-2022-0114.html https://www.suse.com/security/cve/CVE-2022-0115.html https://www.suse.com/security/cve/CVE-2022-0116.html https://www.suse.com/security/cve/CVE-2022-0117.html https://www.suse.com/security/cve/CVE-2022-0118.html https://www.suse.com/security/cve/CVE-2022-0120.html https://bugzilla.suse.com/1194055 https://bugzilla.suse.com/1194182 https://bugzilla.suse.com/1194331

1 0

openSUSE-RU-2022:0084-1: moderate: Recommended update for dosfstools
by maintenance＠opensuse.org 17 Jan '22

17 Jan '22

openSUSE Recommended Update: Recommended update for dosfstools ______________________________________________________________________________ Announcement ID: openSUSE-RU-2022:0084-1 Rating: moderate References: #1172863 #1188401 Affected Products: openSUSE Leap 15.3 ______________________________________________________________________________ An update that has two recommended fixes can now be installed. Description: This update for dosfstools fixes the following issues: - To be able to create filesystems compatible with previous version, add -g command line option to mkfs (bsc#1188401) - BREAKING CHANGES: After fixing of bsc#1172863 in the last update, mkfs started to create different images than before. Applications that depend on exact FAT file format (e. g. embedded systems) may be broken in two ways: * The introduction of the alignment may create smaller images than before, with a different positions of important image elements. It can break existing software that expect images in doststools <= 4.1 style. To work around these problems, use "-a" command line argument. * The new image may contain a different geometry values. Geometry sensitive applications expecting doststools <= 4.1 style images can fails to accept different geometry values. There is no direct work around for this problem. But you can take the old image, use "file -s $IMAGE", check its "sectors/track" and "heads", and use them in the newly introduced "-g" command line argument. Patch Instructions: To install this openSUSE Recommended Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 15.3: zypper in -t patch openSUSE-SLE-15.3-2022-84=1 Package List: - openSUSE Leap 15.3 (aarch64 ppc64le s390x x86_64): dosfstools-4.1-3.6.1 dosfstools-debuginfo-4.1-3.6.1 dosfstools-debugsource-4.1-3.6.1 References: https://bugzilla.suse.com/1172863 https://bugzilla.suse.com/1188401

1 0

openSUSE-RU-2022:0013-1: Recommended update for mpop
by maintenance＠opensuse.org 16 Jan '22

16 Jan '22

openSUSE Recommended Update: Recommended update for mpop ______________________________________________________________________________ Announcement ID: openSUSE-RU-2022:0013-1 Rating: low References: Affected Products: SUSE Package Hub for SUSE Linux Enterprise 12 ______________________________________________________________________________ An update that has 0 recommended fixes can now be installed. Description: This update provided mpop to PackageHub SLE 12. Patch Instructions: To install this openSUSE Recommended Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - SUSE Package Hub for SUSE Linux Enterprise 12: zypper in -t patch openSUSE-2022-13=1 Package List: - SUSE Package Hub for SUSE Linux Enterprise 12 (aarch64 ppc64le s390x x86_64): mpop-1.4.14-2.1 mpop-doc-1.4.14-2.1 References:

1 0

openSUSE-SU-2022:0012-1: important: Security update for prosody
by opensuse-security＠opensuse.org 14 Jan '22

14 Jan '22

openSUSE Security Update: Security update for prosody ______________________________________________________________________________ Announcement ID: openSUSE-SU-2022:0012-1 Rating: important References: #1194596 Cross-References: CVE-2022-0217 Affected Products: openSUSE Backports SLE-15-SP3 ______________________________________________________________________________ An update that fixes one vulnerability is now available. Description: This update for prosody fixes the following issues: Update to 0.11.12: * CVE-2022-0217: util.xml: Do not allow doctypes, comments or processing instructions (bsc#1194596) Patch Instructions: To install this openSUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Backports SLE-15-SP3: zypper in -t patch openSUSE-2022-12=1 Package List: - openSUSE Backports SLE-15-SP3 (aarch64 i586 ppc64le s390x x86_64): prosody-0.11.12-bp153.2.12.1 References: https://www.suse.com/security/cve/CVE-2022-0217.html https://bugzilla.suse.com/1194596

1 0

openSUSE-RU-2022:0078-1: moderate: Recommended update for go1.17
by maintenance＠opensuse.org 14 Jan '22

14 Jan '22

openSUSE Recommended Update: Recommended update for go1.17 ______________________________________________________________________________ Announcement ID: openSUSE-RU-2022:0078-1 Rating: moderate References: #1190649 Affected Products: openSUSE Leap 15.3 ______________________________________________________________________________ An update that has one recommended fix can now be installed. Description: This update for go1.17 fixes the following issues: Update to go1.17.6 released 2022-01-06. (bsc#1190649) - It includes fixes to the compiler, linker, runtime, and the crypto/x509, net/http, and reflect packages. * go#50165 crypto/x509: error parsing large ASN.1 identifiers * go#50073 runtime: race detector `SIGABRT` or `SIGSEGV` on macOS Monterey * go#49961 reflect: segmentation violation while using html/template * go#49921 x/net/http2: `http.Server.WriteTimeout` does not fire if the http2 stream's window is out of space. * go#49413 cmd/compile: internal compiler error: `Op...LECall and OpDereference have mismatched mem` * go#48116 runtime: mallocs cause `base outside usable address space` panic when running on iOS 14 Patch Instructions: To install this openSUSE Recommended Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 15.3: zypper in -t patch openSUSE-SLE-15.3-2022-78=1 Package List: - openSUSE Leap 15.3 (aarch64 i586 ppc64le s390x x86_64): go1.17-1.17.6-1.17.1 go1.17-doc-1.17.6-1.17.1 - openSUSE Leap 15.3 (aarch64 x86_64): go1.17-race-1.17.6-1.17.1 References: https://bugzilla.suse.com/1190649

1 0

openSUSE-RU-2022:0071-1: moderate: Recommended update for container-suseconnect
by maintenance＠opensuse.org 13 Jan '22

13 Jan '22

openSUSE Recommended Update: Recommended update for container-suseconnect ______________________________________________________________________________ Announcement ID: openSUSE-RU-2022:0071-1 Rating: moderate References: Affected Products: openSUSE Leap 15.3 ______________________________________________________________________________ An update that has 0 recommended fixes can now be installed. Description: This update for container-suseconnect is a rebuild against updated go toolchain to ensure an up to date GO runtime. Patch Instructions: To install this openSUSE Recommended Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 15.3: zypper in -t patch openSUSE-SLE-15.3-2022-71=1 Package List: - openSUSE Leap 15.3 (aarch64 ppc64le s390x x86_64): container-suseconnect-2.3.0-4.17.1 References:

1 0

openSUSE-RU-2022:0072-1: important: Recommended update for mozilla-nss and MozillaFirefox
by maintenance＠opensuse.org 13 Jan '22

13 Jan '22

openSUSE Recommended Update: Recommended update for mozilla-nss and MozillaFirefox ______________________________________________________________________________ Announcement ID: openSUSE-RU-2022:0072-1 Rating: important References: #1193845 Affected Products: openSUSE Leap 15.3 ______________________________________________________________________________ An update that has one recommended fix can now be installed. Description: This update for mozilla-nss and MozillaFirefox fix the following issues: mozilla-nss: - Update from version 3.68.1 to 3.68.2 (bsc#1193845) - Add SHA-2 support to mozilla::pkix's Online Certificate Status Protocol implementation MozillaFirefox: - Firefox Extended Support Release 91.4.1 ESR (bsc#1193845) - Add SHA-2 support to mozilla::pkix's Online Certificate Status Protocol implementation to fix frequent MOZILLA_PKIX_ERROR_OCSP_RESPONSE_FOR_CERT_MISSING error messages when trying to connect to various microsoft.com domains Patch Instructions: To install this openSUSE Recommended Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 15.3: zypper in -t patch openSUSE-SLE-15.3-2022-72=1 Package List: - openSUSE Leap 15.3 (aarch64 ppc64le s390x x86_64): libfreebl3-3.68.2-3.64.2 libfreebl3-debuginfo-3.68.2-3.64.2 libfreebl3-hmac-3.68.2-3.64.2 libsoftokn3-3.68.2-3.64.2 libsoftokn3-debuginfo-3.68.2-3.64.2 libsoftokn3-hmac-3.68.2-3.64.2 mozilla-nss-3.68.2-3.64.2 mozilla-nss-certs-3.68.2-3.64.2 mozilla-nss-certs-debuginfo-3.68.2-3.64.2 mozilla-nss-debuginfo-3.68.2-3.64.2 mozilla-nss-debugsource-3.68.2-3.64.2 mozilla-nss-devel-3.68.2-3.64.2 mozilla-nss-sysinit-3.68.2-3.64.2 mozilla-nss-sysinit-debuginfo-3.68.2-3.64.2 mozilla-nss-tools-3.68.2-3.64.2 mozilla-nss-tools-debuginfo-3.68.2-3.64.2 - openSUSE Leap 15.3 (x86_64): libfreebl3-32bit-3.68.2-3.64.2 libfreebl3-32bit-debuginfo-3.68.2-3.64.2 libfreebl3-hmac-32bit-3.68.2-3.64.2 libsoftokn3-32bit-3.68.2-3.64.2 libsoftokn3-32bit-debuginfo-3.68.2-3.64.2 libsoftokn3-hmac-32bit-3.68.2-3.64.2 mozilla-nss-32bit-3.68.2-3.64.2 mozilla-nss-32bit-debuginfo-3.68.2-3.64.2 mozilla-nss-certs-32bit-3.68.2-3.64.2 mozilla-nss-certs-32bit-debuginfo-3.68.2-3.64.2 mozilla-nss-sysinit-32bit-3.68.2-3.64.2 mozilla-nss-sysinit-32bit-debuginfo-3.68.2-3.64.2 References: https://bugzilla.suse.com/1193845

1 0