February 2022 - openSUSE Updates - openSUSE Mailing Lists

openSUSE-RU-2022:0388-1: moderate: Recommended update for python-datrie
by maintenance＠opensuse.org 16 Feb '22

16 Feb '22

openSUSE Recommended Update: Recommended update for python-datrie ______________________________________________________________________________ Announcement ID: openSUSE-RU-2022:0388-1 Rating: moderate References: #1041090 Affected Products: openSUSE Leap 15.3 ______________________________________________________________________________ An update that has one recommended fix can now be installed. Description: This update for python-datrie fixes the following issues: - Make build reproducible. (bsc#1041090) Patch Instructions: To install this openSUSE Recommended Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 15.3: zypper in -t patch openSUSE-SLE-15.3-2022-388=1 Package List: - openSUSE Leap 15.3 (aarch64 ppc64le s390x x86_64): python-datrie-debuginfo-0.7.1-4.3.1 python-datrie-debugsource-0.7.1-4.3.1 python2-datrie-0.7.1-4.3.1 python2-datrie-debuginfo-0.7.1-4.3.1 python3-datrie-0.7.1-4.3.1 python3-datrie-debuginfo-0.7.1-4.3.1 References: https://bugzilla.suse.com/1041090

1 0

openSUSE-SU-2022:0036-1: moderate: Security update for zabbix
by opensuse-security＠opensuse.org 16 Feb '22

16 Feb '22

openSUSE Security Update: Security update for zabbix ______________________________________________________________________________ Announcement ID: openSUSE-SU-2022:0036-1 Rating: moderate References: #1144018 #1174253 #1181400 #1183014 #1194681 Cross-References: CVE-2020-15803 CVE-2021-27927 CVE-2022-23134 CVSS scores: CVE-2020-15803 (NVD) : 6.1 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N CVE-2020-15803 (SUSE): 6.3 CVSS:3.1/AV:L/AC:L/PR:H/UI:R/S:C/C:L/I:H/A:N CVE-2022-23134 (NVD) : 5.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N CVE-2022-23134 (SUSE): 3.7 CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N Affected Products: openSUSE Leap 15.3 ______________________________________________________________________________ An update that solves three vulnerabilities and has two fixes is now available. Description: This update for zabbix fixes the following issues: - Updated to latest realease 4.0.37. Security issues fixed: - CVE-2022-23134: Fixed possible view of the setup pages by unauthenticated users if config file already exists (boo#1194681). - CVE-2021-27927: Fixed CSRF protection mechanism inside CControllerAuthenticationUpdate controller (boo#1183014). - CVE-2020-15803: Fixed stored XSS in the URL Widget (boo#1174253). Bugfixes: - boo#1181400: Added hardening to systemd service(s) - boo#1144018: Restructured for easier maintenance because FATE#324346 Patch Instructions: To install this openSUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 15.3: zypper in -t patch openSUSE-2022-36=1 Package List: - openSUSE Leap 15.3 (aarch64 i586 ppc64le s390x x86_64): zabbix-agent-4.0.37-lp153.2.3.1 zabbix-agent-debuginfo-4.0.37-lp153.2.3.1 zabbix-debuginfo-4.0.37-lp153.2.3.1 zabbix-debugsource-4.0.37-lp153.2.3.1 zabbix-java-gateway-4.0.37-lp153.2.3.1 zabbix-phpfrontend-4.0.37-lp153.2.3.1 zabbix-proxy-4.0.37-lp153.2.3.1 zabbix-proxy-mysql-4.0.37-lp153.2.3.1 zabbix-proxy-mysql-debuginfo-4.0.37-lp153.2.3.1 zabbix-proxy-postgresql-4.0.37-lp153.2.3.1 zabbix-proxy-postgresql-debuginfo-4.0.37-lp153.2.3.1 zabbix-proxy-sqlite-4.0.37-lp153.2.3.1 zabbix-proxy-sqlite-debuginfo-4.0.37-lp153.2.3.1 zabbix-server-4.0.37-lp153.2.3.1 zabbix-server-debuginfo-4.0.37-lp153.2.3.1 zabbix-server-mysql-4.0.37-lp153.2.3.1 zabbix-server-mysql-debuginfo-4.0.37-lp153.2.3.1 zabbix-server-postgresql-4.0.37-lp153.2.3.1 zabbix-server-postgresql-debuginfo-4.0.37-lp153.2.3.1 References: https://www.suse.com/security/cve/CVE-2020-15803.html https://www.suse.com/security/cve/CVE-2021-27927.html https://www.suse.com/security/cve/CVE-2022-23134.html https://bugzilla.suse.com/1144018 https://bugzilla.suse.com/1174253 https://bugzilla.suse.com/1181400 https://bugzilla.suse.com/1183014 https://bugzilla.suse.com/1194681

1 0

openSUSE-RU-2022:0383-1: moderate: Recommended update for cyrus-sasl
by maintenance＠opensuse.org 15 Feb '22

15 Feb '22

openSUSE Recommended Update: Recommended update for cyrus-sasl ______________________________________________________________________________ Announcement ID: openSUSE-RU-2022:0383-1 Rating: moderate References: #1194265 Affected Products: openSUSE Leap 15.3 ______________________________________________________________________________ An update that has one recommended fix can now be installed. Description: This update for cyrus-sasl fixes the following issues: - Fixed an issue when in postfix 'sasl' authentication with password fails. (bsc#1194265) - Add config parameter '--with-dblib=gdbm' - Avoid converting of '/etc/sasldb2 by every update. Convert '/etc/sasldb2' only if it is a Berkeley DB. Patch Instructions: To install this openSUSE Recommended Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 15.3: zypper in -t patch openSUSE-SLE-15.3-2022-383=1 Package List: - openSUSE Leap 15.3 (aarch64 ppc64le s390x x86_64): cyrus-sasl-2.1.27-150300.4.3.1 cyrus-sasl-bdb-2.1.27-150300.4.3.1 cyrus-sasl-bdb-crammd5-2.1.27-150300.4.3.1 cyrus-sasl-bdb-crammd5-debuginfo-2.1.27-150300.4.3.1 cyrus-sasl-bdb-debuginfo-2.1.27-150300.4.3.1 cyrus-sasl-bdb-debugsource-2.1.27-150300.4.3.1 cyrus-sasl-bdb-devel-2.1.27-150300.4.3.1 cyrus-sasl-bdb-digestmd5-2.1.27-150300.4.3.1 cyrus-sasl-bdb-digestmd5-debuginfo-2.1.27-150300.4.3.1 cyrus-sasl-bdb-gs2-2.1.27-150300.4.3.1 cyrus-sasl-bdb-gs2-debuginfo-2.1.27-150300.4.3.1 cyrus-sasl-bdb-gssapi-2.1.27-150300.4.3.1 cyrus-sasl-bdb-gssapi-debuginfo-2.1.27-150300.4.3.1 cyrus-sasl-bdb-ntlm-2.1.27-150300.4.3.1 cyrus-sasl-bdb-ntlm-debuginfo-2.1.27-150300.4.3.1 cyrus-sasl-bdb-otp-2.1.27-150300.4.3.1 cyrus-sasl-bdb-otp-debuginfo-2.1.27-150300.4.3.1 cyrus-sasl-bdb-plain-2.1.27-150300.4.3.1 cyrus-sasl-bdb-plain-debuginfo-2.1.27-150300.4.3.1 cyrus-sasl-bdb-scram-2.1.27-150300.4.3.1 cyrus-sasl-bdb-scram-debuginfo-2.1.27-150300.4.3.1 cyrus-sasl-crammd5-2.1.27-150300.4.3.1 cyrus-sasl-crammd5-debuginfo-2.1.27-150300.4.3.1 cyrus-sasl-debuginfo-2.1.27-150300.4.3.1 cyrus-sasl-debugsource-2.1.27-150300.4.3.1 cyrus-sasl-devel-2.1.27-150300.4.3.1 cyrus-sasl-digestmd5-2.1.27-150300.4.3.1 cyrus-sasl-digestmd5-debuginfo-2.1.27-150300.4.3.1 cyrus-sasl-gs2-2.1.27-150300.4.3.1 cyrus-sasl-gs2-debuginfo-2.1.27-150300.4.3.1 cyrus-sasl-gssapi-2.1.27-150300.4.3.1 cyrus-sasl-gssapi-debuginfo-2.1.27-150300.4.3.1 cyrus-sasl-ldap-auxprop-2.1.27-150300.4.3.1 cyrus-sasl-ldap-auxprop-bdb-2.1.27-150300.4.3.1 cyrus-sasl-ldap-auxprop-bdb-debuginfo-2.1.27-150300.4.3.1 cyrus-sasl-ldap-auxprop-debuginfo-2.1.27-150300.4.3.1 cyrus-sasl-ntlm-2.1.27-150300.4.3.1 cyrus-sasl-ntlm-debuginfo-2.1.27-150300.4.3.1 cyrus-sasl-otp-2.1.27-150300.4.3.1 cyrus-sasl-otp-debuginfo-2.1.27-150300.4.3.1 cyrus-sasl-plain-2.1.27-150300.4.3.1 cyrus-sasl-plain-debuginfo-2.1.27-150300.4.3.1 cyrus-sasl-saslauthd-2.1.27-150300.4.3.1 cyrus-sasl-saslauthd-bdb-2.1.27-150300.4.3.1 cyrus-sasl-saslauthd-bdb-debuginfo-2.1.27-150300.4.3.1 cyrus-sasl-saslauthd-bdb-debugsource-2.1.27-150300.4.3.1 cyrus-sasl-saslauthd-debuginfo-2.1.27-150300.4.3.1 cyrus-sasl-saslauthd-debugsource-2.1.27-150300.4.3.1 cyrus-sasl-scram-2.1.27-150300.4.3.1 cyrus-sasl-scram-debuginfo-2.1.27-150300.4.3.1 cyrus-sasl-sqlauxprop-2.1.27-150300.4.3.1 cyrus-sasl-sqlauxprop-bdb-2.1.27-150300.4.3.1 cyrus-sasl-sqlauxprop-bdb-debuginfo-2.1.27-150300.4.3.1 cyrus-sasl-sqlauxprop-debuginfo-2.1.27-150300.4.3.1 libsasl2-3-2.1.27-150300.4.3.1 libsasl2-3-debuginfo-2.1.27-150300.4.3.1 - openSUSE Leap 15.3 (x86_64): cyrus-sasl-32bit-2.1.27-150300.4.3.1 cyrus-sasl-32bit-debuginfo-2.1.27-150300.4.3.1 cyrus-sasl-crammd5-32bit-2.1.27-150300.4.3.1 cyrus-sasl-crammd5-32bit-debuginfo-2.1.27-150300.4.3.1 cyrus-sasl-devel-32bit-2.1.27-150300.4.3.1 cyrus-sasl-digestmd5-32bit-2.1.27-150300.4.3.1 cyrus-sasl-digestmd5-32bit-debuginfo-2.1.27-150300.4.3.1 cyrus-sasl-gssapi-32bit-2.1.27-150300.4.3.1 cyrus-sasl-gssapi-32bit-debuginfo-2.1.27-150300.4.3.1 cyrus-sasl-ldap-auxprop-32bit-2.1.27-150300.4.3.1 cyrus-sasl-ldap-auxprop-32bit-debuginfo-2.1.27-150300.4.3.1 cyrus-sasl-otp-32bit-2.1.27-150300.4.3.1 cyrus-sasl-otp-32bit-debuginfo-2.1.27-150300.4.3.1 cyrus-sasl-plain-32bit-2.1.27-150300.4.3.1 cyrus-sasl-plain-32bit-debuginfo-2.1.27-150300.4.3.1 cyrus-sasl-sqlauxprop-32bit-2.1.27-150300.4.3.1 cyrus-sasl-sqlauxprop-32bit-debuginfo-2.1.27-150300.4.3.1 libsasl2-3-32bit-2.1.27-150300.4.3.1 libsasl2-3-32bit-debuginfo-2.1.27-150300.4.3.1 References: https://bugzilla.suse.com/1194265

1 0

openSUSE-RU-2022:0384-1: moderate: Recommended update for python-python-docs-theme
by maintenance＠opensuse.org 15 Feb '22

15 Feb '22

openSUSE Recommended Update: Recommended update for python-python-docs-theme ______________________________________________________________________________ Announcement ID: openSUSE-RU-2022:0384-1 Rating: moderate References: Affected Products: openSUSE Leap 15.3 openSUSE Leap 15.4 ______________________________________________________________________________ An update that has 0 recommended fixes can now be installed. Description: This update for python-python-docs-theme fixes the following issues: - Switch to setup.py based installation for compatibility with old SLE distros. - Update to 2022.1: - Add a configuration for license URL. - Exclude the floating navbar from CHM help. - Make sidebar scrollable and sticky (on modern browsers) - Fix monospace again, on buggy Google Chrome - Add the copyright_url variable in the theme - Improve readability - Remove #searchbox on mobile to fix a layout bug - Fix the appearance of version/language selects - Make the theme responsive - Use default pygments theme - Test Github action to validate the theme against docsbuild scripts. - Add the copy button to pycon3 highlighted code blocks. - Updated the readme, to remind user to install the package in a virtual environment. - Updated the package url, using the GitHub repository instead of docs.python.org - Added license information to the footer of the doc - Fixed typo in the footer - Added information on how to use the package - Fixed code formatting - Fixed code bgcolor and codetextcolor for Sphinx 3.1.0+ Patch Instructions: To install this openSUSE Recommended Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 15.4: zypper in -t patch openSUSE-SLE-15.4-2022-384=1 - openSUSE Leap 15.3: zypper in -t patch openSUSE-SLE-15.3-2022-384=1 Package List: - openSUSE Leap 15.4 (noarch): python3-python-docs-theme-2022.1-150300.3.3.1 - openSUSE Leap 15.3 (noarch): python3-python-docs-theme-2022.1-150300.3.3.1 References:

1 0

openSUSE-RU-2022:0378-1: moderate: Recommended update for pacemaker
by maintenance＠opensuse.org 15 Feb '22

15 Feb '22

openSUSE Recommended Update: Recommended update for pacemaker ______________________________________________________________________________ Announcement ID: openSUSE-RU-2022:0378-1 Rating: moderate References: #1191676 Affected Products: openSUSE Leap 15.3 ______________________________________________________________________________ An update that has one recommended fix can now be installed. Description: This update for pacemaker fixes the following issues: - attrd: check election status upon loss of a voter to prevent unexpected pending (bsc#1191676) Patch Instructions: To install this openSUSE Recommended Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 15.3: zypper in -t patch openSUSE-SLE-15.3-2022-378=1 Package List: - openSUSE Leap 15.3 (aarch64 ppc64le s390x x86_64): libpacemaker-devel-2.0.5+20201202.ba59be712-150300.4.16.1 libpacemaker3-2.0.5+20201202.ba59be712-150300.4.16.1 libpacemaker3-debuginfo-2.0.5+20201202.ba59be712-150300.4.16.1 pacemaker-2.0.5+20201202.ba59be712-150300.4.16.1 pacemaker-cli-2.0.5+20201202.ba59be712-150300.4.16.1 pacemaker-cli-debuginfo-2.0.5+20201202.ba59be712-150300.4.16.1 pacemaker-debuginfo-2.0.5+20201202.ba59be712-150300.4.16.1 pacemaker-debugsource-2.0.5+20201202.ba59be712-150300.4.16.1 pacemaker-remote-2.0.5+20201202.ba59be712-150300.4.16.1 pacemaker-remote-debuginfo-2.0.5+20201202.ba59be712-150300.4.16.1 - openSUSE Leap 15.3 (noarch): pacemaker-cts-2.0.5+20201202.ba59be712-150300.4.16.1 References: https://bugzilla.suse.com/1191676

1 0

openSUSE-RU-2022:0033-1: moderate: Recommended update for sqlcipher
by maintenance＠opensuse.org 15 Feb '22

15 Feb '22

openSUSE Recommended Update: Recommended update for sqlcipher ______________________________________________________________________________ Announcement ID: openSUSE-RU-2022:0033-1 Rating: moderate References: #1195711 Affected Products: openSUSE Backports SLE-15-SP3 ______________________________________________________________________________ An update that has one recommended fix can now be installed. Description: This update for sqlcipher fixes the following issues: - More relaxed dependencies on tcl (boo#1195711) - Update to version 4.5.0: * Updates baseline to upstream SQLite 3.36.0 * Changes the enhanced memory security feature to be DISABLED by default; once enabled by PRAGMA cipher_memory_security = ON, it can't be turned off for the lifetime of the process * Changes PRAGMA cipher_migrate to permanently enter an error state if a migration fails * Fixes memory locking/unlocking issue with realloc implementation on hardened runtimes when memory security is enabled * Fixes cipher_migrate to cleanup the temporary database if a migration fails * Removes logging of non-string pointers when compiling with trace level logging - Update to version 4.4.3: * Updates baseline to ustream SQLite 3.34.1 * Fixes sqlcipher_export handling of NULL parameters * Removes randomization of rekey-delete tests to avoid false test failures * Changes internal usage of sqlite_master to sqlite_schema * Omits unusued profiling function under certain defines to avoid compiler warnings - update to 4.4.2: - Improve error handling to resolve potential corruption if an encryption operation failed while operating in WAL mode - Changes to OpenSSL library cryptographic provider to reduce initialization complexity - Adjust cipher_integrity_check to skip locking page to avoid a spurious error report for very large databases - Miscellaneous code and comment cleanup - Updates baseline to upstream SQLite 3.33.0 - Fixes double-free bug in cipher_default_plaintext_header_size - Changes SQLCipher tests to use suite runner - Improvement to cipher_integrity_check tests to minimize false negatives - Deprecates PRAGMA cipher_store_pass - update to 4.4.0: - Updates baseline to upstream SQLite 3.31.0 - Adjusts shell to report SQLCipher version alongside SQLite version - Fixes various build warnings under several compilers - Removes unused id and status functions from provider interface - Update to version 4.3.0: * Updates baseline to upstream SQLite 3.30.1 * PRAGMA key now returns text result value "ok" after execution * Adjusts backup API so that encrypted to encrypted backups are permitted * Adds NSS crypto provider implementation * Fixes OpenSSL provider compatibility with BoringSSL * Separates memory related traces to reduce verbosity of logging * Fixes output of PRAGMA cipher_integrity_check on big endian platforms * Cryptograpic provider interface cleanup * Rework of mutex allocation and management * Resolves miscellaneous build warnings * Force error state at database pager level if SQLCipher initialization fails - Update to version 4.2.0: * Adds PRAGMA cipher_integrity_check to perform independent verification of page HMACs * Updates baseline to upstream SQLite 3.28.0 * Improves PRAGMA cipher_migrate to handle keys containing non-terminating zero bytes - Update to v4.1.0: * Adds PRAGMA cipher_settings to query current database codec settings * Adds PRAGMA cipher_default_settings to query current default SQLCipher options * PRAGMA cipher_hmac_pgno is now deprecated * PRAGMA cipher_hmac_salt_mask is now deprecated * PRAGMA fast_kdf_iter is now deprecated * Disable backup API for encrypted databases (this was previously documented as not-working and non-supported, but will now explicitly error out on initialization) * Default page size for databases increased to 4096 bytes (up from 1024) * Default PBKDF2 iterations increased to 256,000 (up from 64,000) * Default KDF algorithm is now PBKDF2-HMAC-SHA512 (from PBKDF2-HMAC-SHA1) * Default HMAC algorithm is now HMAC-SHA512 (from HMAC-SHA1) * PRAGMA cipher is now disabled and no longer supported (after multi-year deprecation) * PRAGMA rekey_cipher is now disabled and no longer supported * PRAGMA rekey_kdf_iter is now disabled and no longer supported * By default all memory allocated internally by SQLite before the memory is wiped before it is freed * PRAGMA cipher_memory_security: allows full memory wiping to be disabled for performance when the feature is not required * PRAGMA cipher_kdf_algorithm, cipher_default_kdf_algorithm to control KDF algorithm selection between PBKDF2-HMAC-SHA1, PBKDF2-HMAC-SHA256 and PBKDF2-HMAC-SHA512 * PRAGMA cipher_hmac_algorithm, cipher_default_hmac_algorithm to control HMAC algorithm selection between HMAC-SHA1, HMAC-SHA256 and PBKDF2-HMAC-SHA512 * When compiled with readline support, PRAGMA key and rekey lines will no longer be saved to history * Adds second optional parameter to sqlcipher_export to specify source database to support bidirectional exports * PRAGMA cipher_plaintext_header_size and cipher_default_plaintext_header_size: allocates a portion of the database header which will not be encrypted to allow identification as a SQLite database * PRAGMA cipher_salt: retrieve or set the salt value for the database Patch Instructions: To install this openSUSE Recommended Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Backports SLE-15-SP3: zypper in -t patch openSUSE-2022-33=1 Package List: - openSUSE Backports SLE-15-SP3 (aarch64 i586 ppc64le s390x x86_64): libsqlcipher-3_36_0-0-4.5.0-bp153.2.5.1 sqlcipher-4.5.0-bp153.2.5.1 sqlcipher-devel-4.5.0-bp153.2.5.1 tcl-sqlcipher-4.5.0-bp153.2.5.1 References: https://bugzilla.suse.com/1195711

1 0

openSUSE-RU-2022:0376-1: moderate: Recommended update for libqb
by maintenance＠opensuse.org 15 Feb '22

15 Feb '22

openSUSE Recommended Update: Recommended update for libqb ______________________________________________________________________________ Announcement ID: openSUSE-RU-2022:0376-1 Rating: moderate References: #1188212 Affected Products: openSUSE Leap 15.3 ______________________________________________________________________________ An update that has one recommended fix can now be installed. Description: This update for libqb fixes the following issues: - IPC server: avoid temporary channel priority loss (bsc#1188212). Patch Instructions: To install this openSUSE Recommended Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 15.3: zypper in -t patch openSUSE-SLE-15.3-2022-376=1 Package List: - openSUSE Leap 15.3 (aarch64 ppc64le s390x x86_64): libqb20-1.0.3+20190326.a521604-3.6.1 libqb20-debuginfo-1.0.3+20190326.a521604-3.6.1 - openSUSE Leap 15.3 (x86_64): libqb20-32bit-1.0.3+20190326.a521604-3.6.1 libqb20-32bit-debuginfo-1.0.3+20190326.a521604-3.6.1 References: https://bugzilla.suse.com/1188212

1 0

openSUSE-RU-2022:0100-2: moderate: Recommended update for hwdata
by maintenance＠opensuse.org 14 Feb '22

14 Feb '22

openSUSE Recommended Update: Recommended update for hwdata ______________________________________________________________________________ Announcement ID: openSUSE-RU-2022:0100-2 Rating: moderate References: #1194338 Affected Products: openSUSE Leap 15.4 ______________________________________________________________________________ An update that has one recommended fix can now be installed. Description: This update for hwdata fixes the following issues: - Update hwdata from version 0.353 to 0.355 which includes updated pci, usb and vendor ids (bsc#1194338) Patch Instructions: To install this openSUSE Recommended Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 15.4: zypper in -t patch openSUSE-SLE-15.4-2022-100=1 Package List: - openSUSE Leap 15.4 (noarch): hwdata-0.355-3.39.1 References: https://bugzilla.suse.com/1194338

1 0

openSUSE-SU-2022:0088-2: moderate: Security update for ghostscript
by opensuse-security＠opensuse.org 14 Feb '22

14 Feb '22

openSUSE Security Update: Security update for ghostscript ______________________________________________________________________________ Announcement ID: openSUSE-SU-2022:0088-2 Rating: moderate References: #1194303 #1194304 Cross-References: CVE-2021-45944 CVE-2021-45949 CVSS scores: CVE-2021-45944 (NVD) : 5.5 CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H CVE-2021-45944 (SUSE): 6.2 CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H CVE-2021-45949 (NVD) : 5.5 CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H CVE-2021-45949 (SUSE): 6.2 CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H Affected Products: openSUSE Leap 15.4 ______________________________________________________________________________ An update that fixes two vulnerabilities is now available. Description: This update for ghostscript fixes the following issues: - CVE-2021-45944: Fixed use-after-free in sampled_data_sample (bsc#1194303) - CVE-2021-45949: Fixed heap-based buffer overflow in sampled_data_finish (bsc#1194304) Patch Instructions: To install this openSUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 15.4: zypper in -t patch openSUSE-SLE-15.4-2022-88=1 Package List: - openSUSE Leap 15.4 (aarch64 ppc64le s390x x86_64): ghostscript-9.52-161.1 ghostscript-debuginfo-9.52-161.1 ghostscript-debugsource-9.52-161.1 ghostscript-devel-9.52-161.1 ghostscript-x11-9.52-161.1 ghostscript-x11-debuginfo-9.52-161.1 References: https://www.suse.com/security/cve/CVE-2021-45944.html https://www.suse.com/security/cve/CVE-2021-45949.html https://bugzilla.suse.com/1194303 https://bugzilla.suse.com/1194304

1 0

openSUSE-SU-2022:0104-2: important: Security update for SDL2
by opensuse-security＠opensuse.org 14 Feb '22

14 Feb '22

openSUSE Security Update: Security update for SDL2 ______________________________________________________________________________ Announcement ID: openSUSE-SU-2022:0104-2 Rating: important References: #1181201 #1181202 Cross-References: CVE-2020-14409 CVE-2020-14410 CVSS scores: CVE-2020-14409 (NVD) : 7.8 CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H CVE-2020-14409 (SUSE): 7.8 CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H CVE-2020-14410 (NVD) : 5.4 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:L CVE-2020-14410 (SUSE): 7.8 CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H Affected Products: openSUSE Leap 15.4 ______________________________________________________________________________ An update that fixes two vulnerabilities is now available. Description: This update for SDL2 fixes the following issues: - CVE-2020-14409: Fixed Integer Overflow resulting in heap corruption in SDL_BlitCopy in video/SDL_blit_copy.c via a crafted .BMP (bsc#1181202). - CVE-2020-14410: Fixed heap-based buffer over-read in Blit_3or4_to_3or4__inversed_rgb in video/SDL_blit_N.c via a crafted .BMP (bsc#1181201). Patch Instructions: To install this openSUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 15.4: zypper in -t patch openSUSE-SLE-15.4-2022-104=1 Package List: - openSUSE Leap 15.4 (aarch64 ppc64le s390x x86_64): SDL2-debugsource-2.0.8-11.3.1 libSDL2-2_0-0-2.0.8-11.3.1 libSDL2-2_0-0-debuginfo-2.0.8-11.3.1 libSDL2-devel-2.0.8-11.3.1 - openSUSE Leap 15.4 (x86_64): libSDL2-2_0-0-32bit-2.0.8-11.3.1 libSDL2-2_0-0-32bit-debuginfo-2.0.8-11.3.1 libSDL2-devel-32bit-2.0.8-11.3.1 References: https://www.suse.com/security/cve/CVE-2020-14409.html https://www.suse.com/security/cve/CVE-2020-14410.html https://bugzilla.suse.com/1181201 https://bugzilla.suse.com/1181202

1 0