March 2022 - openSUSE Updates - openSUSE Mailing Lists

openSUSE-SU-2022:0089-1: moderate: Security update for nextcloud
by opensuse-security＠opensuse.org 23 Mar '22

23 Mar '22

openSUSE Security Update: Security update for nextcloud ______________________________________________________________________________ Announcement ID: openSUSE-SU-2022:0089-1 Rating: moderate References: #1196905 #1196908 #1196952 Cross-References: CVE-2021-41239 CVE-2021-41241 CVE-2021-41741 CVSS scores: CVE-2021-41239 (NVD) : 5.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N CVE-2021-41239 (SUSE): 4.3 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N CVE-2021-41241 (NVD) : 4.3 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N CVE-2021-41241 (SUSE): 6.3 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L Affected Products: SUSE Linux Enterprise High Performance Computing 12 SUSE Linux Enterprise Server 12 SUSE Linux Enterprise Server 12-SP3 SUSE Linux Enterprise Server 12-SP4 SUSE Linux Enterprise Server 12-SP5 SUSE Linux Enterprise Server for SAP Applications 12 SUSE Linux Enterprise Server for SAP Applications 12-SP3 SUSE Linux Enterprise Server for SAP Applications 12-SP4 SUSE Linux Enterprise Server for SAP Applications 12-SP5 SUSE Package Hub for SUSE Linux Enterprise 12 ______________________________________________________________________________ An update that fixes three vulnerabilities is now available. Description: This update for nextcloud fixes the following issues: nextcloud was updated to 21.0.9: - CVE-2021-41239 (CWE-200): user enumeration setting not obeyed in User Status API (boo#1196905) - CVE-2021-41241 (CWE-863): groupfolders advanced permissions is not obeyed for subfolders (boo#1196908) - CVE-2021-41741 (CWE-400): High memory usage for generating preview of broken image (boo#1196952) - For more changes see https://nextcloud.com/changelog/#21-0-9 Patch Instructions: To install this openSUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - SUSE Package Hub for SUSE Linux Enterprise 12: zypper in -t patch openSUSE-2022-89=1 Package List: - SUSE Package Hub for SUSE Linux Enterprise 12 (noarch): nextcloud-21.0.9-37.1 nextcloud-apache-21.0.9-37.1 References: https://www.suse.com/security/cve/CVE-2021-41239.html https://www.suse.com/security/cve/CVE-2021-41241.html https://www.suse.com/security/cve/CVE-2021-41741.html https://bugzilla.suse.com/1196905 https://bugzilla.suse.com/1196908 https://bugzilla.suse.com/1196952

1 0

openSUSE-SU-2022:0940-1: important: Security update for xen
by opensuse-security＠opensuse.org 23 Mar '22

23 Mar '22

openSUSE Security Update: Security update for xen ______________________________________________________________________________ Announcement ID: openSUSE-SU-2022:0940-1 Rating: important References: #1027519 #1191668 #1194267 #1196915 Cross-References: CVE-2021-26401 CVE-2022-0001 CVE-2022-0002 CVSS scores: CVE-2021-26401 (NVD) : 5.6 CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:C/C:H/I:N/A:N CVE-2021-26401 (SUSE): 5.6 CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:C/C:H/I:N/A:N CVE-2022-0001 (NVD) : 6.5 CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N CVE-2022-0001 (SUSE): 5.6 CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:C/C:H/I:N/A:N CVE-2022-0002 (NVD) : 6.5 CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N CVE-2022-0002 (SUSE): 5.6 CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:C/C:H/I:N/A:N Affected Products: openSUSE Leap 15.3 ______________________________________________________________________________ An update that solves three vulnerabilities and has one errata is now available. Description: This update for xen fixes the following issues: Update Xen to version 4.14.4 (bsc#1027519) Transient execution side-channel attacks attacking the Branch History Buffer (BHB), named "Branch Target Injection" and "Intra-Mode Branch History Injection" are now mitigated. Security issues fixed: - CVE-2022-0001, CVE-2022-0002, CVE-2021-26401: BHB speculation issues (bsc#1196915). Non-security issues fixed: - Fixed issue around xl and virsh operation - virsh list not giving any output (bsc#1191668). Special Instructions and Notes: Please reboot the system after installing this update. Patch Instructions: To install this openSUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 15.3: zypper in -t patch openSUSE-SLE-15.3-2022-940=1 Package List: - openSUSE Leap 15.3 (aarch64 x86_64): xen-4.14.4_02-150300.3.21.1 xen-debugsource-4.14.4_02-150300.3.21.1 xen-devel-4.14.4_02-150300.3.21.1 xen-doc-html-4.14.4_02-150300.3.21.1 xen-libs-4.14.4_02-150300.3.21.1 xen-libs-debuginfo-4.14.4_02-150300.3.21.1 xen-tools-4.14.4_02-150300.3.21.1 xen-tools-debuginfo-4.14.4_02-150300.3.21.1 xen-tools-domU-4.14.4_02-150300.3.21.1 xen-tools-domU-debuginfo-4.14.4_02-150300.3.21.1 - openSUSE Leap 15.3 (x86_64): xen-libs-32bit-4.14.4_02-150300.3.21.1 xen-libs-32bit-debuginfo-4.14.4_02-150300.3.21.1 - openSUSE Leap 15.3 (noarch): xen-tools-xendomains-wait-disk-4.14.4_02-150300.3.21.1 References: https://www.suse.com/security/cve/CVE-2021-26401.html https://www.suse.com/security/cve/CVE-2022-0001.html https://www.suse.com/security/cve/CVE-2022-0002.html https://bugzilla.suse.com/1027519 https://bugzilla.suse.com/1191668 https://bugzilla.suse.com/1194267 https://bugzilla.suse.com/1196915

1 0

openSUSE-RU-2022:0936-1: moderate: Recommended update for filesystem and systemd-rpm-macros
by maintenance＠opensuse.org 22 Mar '22

22 Mar '22

openSUSE Recommended Update: Recommended update for filesystem and systemd-rpm-macros ______________________________________________________________________________ Announcement ID: openSUSE-RU-2022:0936-1 Rating: moderate References: #1196275 #1196406 SLE-20639 Affected Products: openSUSE Leap 15.3 openSUSE Leap 15.4 ______________________________________________________________________________ An update that has two recommended fixes and contains one feature can now be installed. Description: This update for filesystem and systemd-rpm-macros fixes the following issues: filesystem: - Add path /lib/modprobe.d (bsc#1196275, jsc#SLE-20639) systemd-rpm-macros: - Make %_modprobedir point to /lib/modprobe.d (bsc#1196275, bsc#1196406) Patch Instructions: To install this openSUSE Recommended Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 15.4: zypper in -t patch openSUSE-SLE-15.4-2022-936=1 - openSUSE Leap 15.3: zypper in -t patch openSUSE-SLE-15.3-2022-936=1 Package List: - openSUSE Leap 15.4 (aarch64 ppc64le s390x x86_64): filesystem-15.0-11.8.1 - openSUSE Leap 15.4 (noarch): systemd-rpm-macros-11-7.27.1 - openSUSE Leap 15.3 (aarch64 ppc64le s390x x86_64): filesystem-15.0-11.8.1 - openSUSE Leap 15.3 (noarch): systemd-rpm-macros-11-7.27.1 References: https://bugzilla.suse.com/1196275 https://bugzilla.suse.com/1196406

1 0

openSUSE-SU-2022:0930-1: important: Security update for qemu
by opensuse-security＠opensuse.org 22 Mar '22

22 Mar '22

openSUSE Security Update: Security update for qemu ______________________________________________________________________________ Announcement ID: openSUSE-SU-2022:0930-1 Rating: important References: #1178049 #1192525 #1193364 #1193545 #1194938 #1195161 #1196087 #1196737 Cross-References: CVE-2021-3930 CVE-2022-0358 CVSS scores: CVE-2021-3930 (NVD) : 6.5 CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:N/I:N/A:H CVE-2021-3930 (SUSE): 3.2 CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:C/C:N/I:N/A:L CVE-2022-0358 (SUSE): 7 CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H Affected Products: openSUSE Leap 15.3 ______________________________________________________________________________ An update that solves two vulnerabilities and has 6 fixes is now available. Description: This update for qemu fixes the following issues: - CVE-2022-0358: Fixed a potential privilege escalation via virtiofsd (bsc#1195161). - CVE-2021-3930: Fixed a potential denial of service in the emulated SCSI device (bsc#1192525). Non-security fixes: - Fixed a kernel data corruption via a long kernel boot cmdline (bsc#1196737). - Included vmxcap in the qemu-tools package (bsc#1193364). - Fixed package dependencies (bsc#1196087). - Fixed an issue were PowerPC firmwares would not be built for non-PowerPC builds (bsc#1193545). - Fixed multiple issues in I/O (bsc#1178049 bsc#1194938). Patch Instructions: To install this openSUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 15.3: zypper in -t patch openSUSE-SLE-15.3-2022-930=1 Package List: - openSUSE Leap 15.3 (aarch64 ppc64le s390x x86_64): qemu-5.2.0-150300.112.4 qemu-arm-5.2.0-150300.112.4 qemu-arm-debuginfo-5.2.0-150300.112.4 qemu-audio-alsa-5.2.0-150300.112.4 qemu-audio-alsa-debuginfo-5.2.0-150300.112.4 qemu-audio-pa-5.2.0-150300.112.4 qemu-audio-pa-debuginfo-5.2.0-150300.112.4 qemu-audio-spice-5.2.0-150300.112.4 qemu-audio-spice-debuginfo-5.2.0-150300.112.4 qemu-block-curl-5.2.0-150300.112.4 qemu-block-curl-debuginfo-5.2.0-150300.112.4 qemu-block-dmg-5.2.0-150300.112.4 qemu-block-dmg-debuginfo-5.2.0-150300.112.4 qemu-block-gluster-5.2.0-150300.112.4 qemu-block-gluster-debuginfo-5.2.0-150300.112.4 qemu-block-iscsi-5.2.0-150300.112.4 qemu-block-iscsi-debuginfo-5.2.0-150300.112.4 qemu-block-nfs-5.2.0-150300.112.4 qemu-block-nfs-debuginfo-5.2.0-150300.112.4 qemu-block-rbd-5.2.0-150300.112.4 qemu-block-rbd-debuginfo-5.2.0-150300.112.4 qemu-block-ssh-5.2.0-150300.112.4 qemu-block-ssh-debuginfo-5.2.0-150300.112.4 qemu-chardev-baum-5.2.0-150300.112.4 qemu-chardev-baum-debuginfo-5.2.0-150300.112.4 qemu-chardev-spice-5.2.0-150300.112.4 qemu-chardev-spice-debuginfo-5.2.0-150300.112.4 qemu-debuginfo-5.2.0-150300.112.4 qemu-debugsource-5.2.0-150300.112.4 qemu-extra-5.2.0-150300.112.4 qemu-extra-debuginfo-5.2.0-150300.112.4 qemu-guest-agent-5.2.0-150300.112.4 qemu-guest-agent-debuginfo-5.2.0-150300.112.4 qemu-hw-display-qxl-5.2.0-150300.112.4 qemu-hw-display-qxl-debuginfo-5.2.0-150300.112.4 qemu-hw-display-virtio-gpu-5.2.0-150300.112.4 qemu-hw-display-virtio-gpu-debuginfo-5.2.0-150300.112.4 qemu-hw-display-virtio-gpu-pci-5.2.0-150300.112.4 qemu-hw-display-virtio-gpu-pci-debuginfo-5.2.0-150300.112.4 qemu-hw-display-virtio-vga-5.2.0-150300.112.4 qemu-hw-display-virtio-vga-debuginfo-5.2.0-150300.112.4 qemu-hw-s390x-virtio-gpu-ccw-5.2.0-150300.112.4 qemu-hw-s390x-virtio-gpu-ccw-debuginfo-5.2.0-150300.112.4 qemu-hw-usb-redirect-5.2.0-150300.112.4 qemu-hw-usb-redirect-debuginfo-5.2.0-150300.112.4 qemu-hw-usb-smartcard-5.2.0-150300.112.4 qemu-hw-usb-smartcard-debuginfo-5.2.0-150300.112.4 qemu-ivshmem-tools-5.2.0-150300.112.4 qemu-ivshmem-tools-debuginfo-5.2.0-150300.112.4 qemu-ksm-5.2.0-150300.112.4 qemu-lang-5.2.0-150300.112.4 qemu-linux-user-5.2.0-150300.112.3 qemu-linux-user-debuginfo-5.2.0-150300.112.3 qemu-linux-user-debugsource-5.2.0-150300.112.3 qemu-ppc-5.2.0-150300.112.4 qemu-ppc-debuginfo-5.2.0-150300.112.4 qemu-s390x-5.2.0-150300.112.4 qemu-s390x-debuginfo-5.2.0-150300.112.4 qemu-testsuite-5.2.0-150300.112.7 qemu-tools-5.2.0-150300.112.4 qemu-tools-debuginfo-5.2.0-150300.112.4 qemu-ui-curses-5.2.0-150300.112.4 qemu-ui-curses-debuginfo-5.2.0-150300.112.4 qemu-ui-gtk-5.2.0-150300.112.4 qemu-ui-gtk-debuginfo-5.2.0-150300.112.4 qemu-ui-opengl-5.2.0-150300.112.4 qemu-ui-opengl-debuginfo-5.2.0-150300.112.4 qemu-ui-spice-app-5.2.0-150300.112.4 qemu-ui-spice-app-debuginfo-5.2.0-150300.112.4 qemu-ui-spice-core-5.2.0-150300.112.4 qemu-ui-spice-core-debuginfo-5.2.0-150300.112.4 qemu-vhost-user-gpu-5.2.0-150300.112.4 qemu-vhost-user-gpu-debuginfo-5.2.0-150300.112.4 qemu-x86-5.2.0-150300.112.4 qemu-x86-debuginfo-5.2.0-150300.112.4 - openSUSE Leap 15.3 (s390x x86_64): qemu-kvm-5.2.0-150300.112.4 - openSUSE Leap 15.3 (noarch): qemu-SLOF-5.2.0-150300.112.4 qemu-ipxe-1.0.0+-150300.112.4 qemu-microvm-5.2.0-150300.112.4 qemu-seabios-1.14.0_0_g155821a-150300.112.4 qemu-sgabios-8-150300.112.4 qemu-skiboot-5.2.0-150300.112.4 qemu-vgabios-1.14.0_0_g155821a-150300.112.4 References: https://www.suse.com/security/cve/CVE-2021-3930.html https://www.suse.com/security/cve/CVE-2022-0358.html https://bugzilla.suse.com/1178049 https://bugzilla.suse.com/1192525 https://bugzilla.suse.com/1193364 https://bugzilla.suse.com/1193545 https://bugzilla.suse.com/1194938 https://bugzilla.suse.com/1195161 https://bugzilla.suse.com/1196087 https://bugzilla.suse.com/1196737

1 0

openSUSE-FU-2022:0925-1: Test update for SUSE:SLE-15-SP4:Update (feature)
by maintenance＠opensuse.org 21 Mar '22

21 Mar '22

openSUSE Feature Update: Test update for SUSE:SLE-15-SP4:Update (feature) ______________________________________________________________________________ Announcement ID: openSUSE-FU-2022:0925-1 Rating: low References: #1194507 Affected Products: openSUSE Leap 15.3 openSUSE Leap 15.4 ______________________________________________________________________________ An update that has one feature fix can now be installed. Description: This is a feature test update for SUSE:SLE-15-SP4:Update Patch Instructions: To install this openSUSE Feature Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 15.4: zypper in -t patch openSUSE-SLE-15.4-2022-925=1 - openSUSE Leap 15.3: zypper in -t patch openSUSE-SLE-15.3-2022-925=1 Package List: - openSUSE Leap 15.4 (aarch64 ppc64le s390x x86_64): update-test-feature-5.1-150200.35.1 - openSUSE Leap 15.3 (aarch64 ppc64le s390x x86_64): update-test-feature-5.1-150200.35.1 References: https://bugzilla.suse.com/1194507

1 0

openSUSE-RU-2022:0919-1: Test update for SUSE:SLE-15-SP4:Update (relogin-suggested)
by maintenance＠opensuse.org 21 Mar '22

21 Mar '22

openSUSE Recommended Update: Test update for SUSE:SLE-15-SP4:Update (relogin-suggested) ______________________________________________________________________________ Announcement ID: openSUSE-RU-2022:0919-1 Rating: low References: #1194507 Affected Products: openSUSE Leap 15.3 openSUSE Leap 15.4 ______________________________________________________________________________ An update that has one recommended fix can now be installed. Description: This is a relogin-suggested test update for SUSE:SLE-15-SP4:Update Patch Instructions: To install this openSUSE Recommended Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 15.4: zypper in -t patch openSUSE-SLE-15.4-2022-919=1 - openSUSE Leap 15.3: zypper in -t patch openSUSE-SLE-15.3-2022-919=1 Package List: - openSUSE Leap 15.4 (aarch64 ppc64le s390x x86_64): update-test-relogin-suggested-5.1-150200.35.1 - openSUSE Leap 15.3 (aarch64 ppc64le s390x x86_64): update-test-relogin-suggested-5.1-150200.35.1 References: https://bugzilla.suse.com/1194507

1 0

openSUSE-OU-2022:0922-1: Test update for SUSE:SLE-15-SP4:Update (optional)
by maintenance＠opensuse.org 21 Mar '22

21 Mar '22

openSUSE Optional Update: Test update for SUSE:SLE-15-SP4:Update (optional) ______________________________________________________________________________ Announcement ID: openSUSE-OU-2022:0922-1 Rating: low References: #1194507 Affected Products: openSUSE Leap 15.3 openSUSE Leap 15.4 ______________________________________________________________________________ An update that has one optional fix can now be installed. Description: This is a optional test update for SUSE:SLE-15-SP4:Update Patch Instructions: To install this openSUSE Optional Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 15.4: zypper in -t patch openSUSE-SLE-15.4-2022-922=1 - openSUSE Leap 15.3: zypper in -t patch openSUSE-SLE-15.3-2022-922=1 Package List: - openSUSE Leap 15.4 (aarch64 ppc64le s390x x86_64): update-test-optional-5.1-150200.35.1 - openSUSE Leap 15.3 (aarch64 ppc64le s390x x86_64): update-test-optional-5.1-150200.35.1 References: https://bugzilla.suse.com/1194507

1 0

openSUSE-RU-2022:0920-1: Test update for SUSE:SLE-15-SP4:Update (affects-package-manager)
by maintenance＠opensuse.org 21 Mar '22

21 Mar '22

openSUSE Recommended Update: Test update for SUSE:SLE-15-SP4:Update (affects-package-manager) ______________________________________________________________________________ Announcement ID: openSUSE-RU-2022:0920-1 Rating: low References: #1194507 Affected Products: openSUSE Leap 15.3 openSUSE Leap 15.4 ______________________________________________________________________________ An update that has one recommended fix can now be installed. Description: This is a affects-package-manager test update for SUSE:SLE-15-SP4:Update Patch Instructions: To install this openSUSE Recommended Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 15.4: zypper in -t patch openSUSE-SLE-15.4-2022-920=1 - openSUSE Leap 15.3: zypper in -t patch openSUSE-SLE-15.3-2022-920=1 Package List: - openSUSE Leap 15.4 (aarch64 ppc64le s390x x86_64): update-test-affects-package-manager-5.1-150200.35.1 - openSUSE Leap 15.3 (aarch64 ppc64le s390x x86_64): update-test-affects-package-manager-5.1-150200.35.1 References: https://bugzilla.suse.com/1194507

1 0

openSUSE-RU-2022:0927-1: Test update for SUSE:SLE-15-SP4:Update (interactive)
by maintenance＠opensuse.org 21 Mar '22

21 Mar '22

openSUSE Recommended Update: Test update for SUSE:SLE-15-SP4:Update (interactive) ______________________________________________________________________________ Announcement ID: openSUSE-RU-2022:0927-1 Rating: low References: #1194507 Affected Products: openSUSE Leap 15.3 openSUSE Leap 15.4 ______________________________________________________________________________ An update that has one recommended fix can now be installed. Description: This is a interactive test update for SUSE:SLE-15-SP4:Update Patch Instructions: To install this openSUSE Recommended Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 15.4: zypper in -t patch openSUSE-SLE-15.4-2022-927=1 - openSUSE Leap 15.3: zypper in -t patch openSUSE-SLE-15.3-2022-927=1 Package List: - openSUSE Leap 15.4 (aarch64 ppc64le s390x x86_64): update-test-interactive-5.1-150200.35.1 - openSUSE Leap 15.3 (aarch64 ppc64le s390x x86_64): update-test-interactive-5.1-150200.35.1 References: https://bugzilla.suse.com/1194507

1 0

openSUSE-RU-2022:0926-1: Test update for SUSE:SLE-15-SP4:Update (reboot-needed)
by maintenance＠opensuse.org 21 Mar '22

21 Mar '22

openSUSE Recommended Update: Test update for SUSE:SLE-15-SP4:Update (reboot-needed) ______________________________________________________________________________ Announcement ID: openSUSE-RU-2022:0926-1 Rating: low References: #1194507 Affected Products: openSUSE Leap 15.3 openSUSE Leap 15.4 ______________________________________________________________________________ An update that has one recommended fix can now be installed. Description: This is a reboot-needed test update for SUSE:SLE-15-SP4:Update Special Instructions and Notes: Please reboot the system after installing this update. Patch Instructions: To install this openSUSE Recommended Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 15.4: zypper in -t patch openSUSE-SLE-15.4-2022-926=1 - openSUSE Leap 15.3: zypper in -t patch openSUSE-SLE-15.3-2022-926=1 Package List: - openSUSE Leap 15.4 (aarch64 ppc64le s390x x86_64): update-test-reboot-needed-5.1-150200.35.1 - openSUSE Leap 15.3 (aarch64 ppc64le s390x x86_64): update-test-reboot-needed-5.1-150200.35.1 References: https://bugzilla.suse.com/1194507

1 0