June 2022 - openSUSE Updates - openSUSE Mailing Lists

openSUSE-SU-2022:10010-1: critical: Security update for chromium
by opensuse-security＠opensuse.org 15 Jun '22

15 Jun '22

openSUSE Security Update: Security update for chromium ______________________________________________________________________________ Announcement ID: openSUSE-SU-2022:10010-1 Rating: critical References: #1200139 #1200423 Cross-References: CVE-2022-2007 CVE-2022-2008 CVE-2022-2010 CVE-2022-2011 Affected Products: openSUSE Backports SLE-15-SP4 ______________________________________________________________________________ An update that fixes four vulnerabilities is now available. Description: This update for chromium fixes the following issues: - Chromium 102.0.5005.115 (boo#1200423) * CVE-2022-2007: Use after free in WebGPU * CVE-2022-2008: Out of bounds memory access in WebGL * CVE-2022-2010: Out of bounds read in compositing * CVE-2022-2011: Use after free in ANGLE Patch Instructions: To install this openSUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Backports SLE-15-SP4: zypper in -t patch openSUSE-2022-10010=1 Package List: - openSUSE Backports SLE-15-SP4 (aarch64 x86_64): chromedriver-102.0.5005.115-bp154.2.8.1 chromium-102.0.5005.115-bp154.2.8.1 References: https://www.suse.com/security/cve/CVE-2022-2007.html https://www.suse.com/security/cve/CVE-2022-2008.html https://www.suse.com/security/cve/CVE-2022-2010.html https://www.suse.com/security/cve/CVE-2022-2011.html https://bugzilla.suse.com/1200139 https://bugzilla.suse.com/1200423

1 0

SUSE-RU-2022:2094-1: important: Recommended update for fence-agents
by maintenance＠opensuse.org 15 Jun '22

15 Jun '22

SUSE Recommended Update: Recommended update for fence-agents ______________________________________________________________________________ Announcement ID: SUSE-RU-2022:2094-1 Rating: important References: #1198872 Affected Products: SUSE Linux Enterprise High Availability 15-SP3 SUSE Linux Enterprise High Availability 15-SP4 SUSE Linux Enterprise High Performance Computing 15-SP3 SUSE Linux Enterprise High Performance Computing 15-SP4 SUSE Linux Enterprise Module for SUSE Manager Server 4.2 SUSE Linux Enterprise Module for SUSE Manager Server 4.3 SUSE Linux Enterprise Server 15-SP3 SUSE Linux Enterprise Server 15-SP4 SUSE Linux Enterprise Server for SAP Applications 15-SP3 SUSE Linux Enterprise Server for SAP Applications 15-SP4 SUSE Manager Proxy 4.2 SUSE Manager Retail Branch Server 4.2 SUSE Manager Server 4.2 SUSE Manager Server 4.3 openSUSE Leap 15.3 openSUSE Leap 15.4 ______________________________________________________________________________ An update that has one recommended fix can now be installed. Description: This update for fence-agents fixes the following issues: - Fix and issue where 'fence-agents' is broken in GCP due to missing "--zone" parameter (bsc#1198872) Patch Instructions: To install this SUSE Recommended Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 15.4: zypper in -t patch openSUSE-SLE-15.4-2022-2094=1 - openSUSE Leap 15.3: zypper in -t patch openSUSE-SLE-15.3-2022-2094=1 - SUSE Linux Enterprise Module for SUSE Manager Server 4.3: zypper in -t patch SUSE-SLE-Module-SUSE-Manager-Server-4.3-2022-2094=1 - SUSE Linux Enterprise Module for SUSE Manager Server 4.2: zypper in -t patch SUSE-SLE-Module-SUSE-Manager-Server-4.2-2022-2094=1 - SUSE Linux Enterprise High Availability 15-SP4: zypper in -t patch SUSE-SLE-Product-HA-15-SP4-2022-2094=1 - SUSE Linux Enterprise High Availability 15-SP3: zypper in -t patch SUSE-SLE-Product-HA-15-SP3-2022-2094=1 Package List: - openSUSE Leap 15.4 (aarch64 ppc64le s390x x86_64): fence-agents-4.9.0+git.1624456340.8d746be9-150300.3.11.1 fence-agents-amt_ws-4.9.0+git.1624456340.8d746be9-150300.3.11.1 fence-agents-debuginfo-4.9.0+git.1624456340.8d746be9-150300.3.11.1 fence-agents-debugsource-4.9.0+git.1624456340.8d746be9-150300.3.11.1 fence-agents-devel-4.9.0+git.1624456340.8d746be9-150300.3.11.1 - openSUSE Leap 15.3 (aarch64 ppc64le s390x x86_64): fence-agents-4.9.0+git.1624456340.8d746be9-150300.3.11.1 fence-agents-amt_ws-4.9.0+git.1624456340.8d746be9-150300.3.11.1 fence-agents-debuginfo-4.9.0+git.1624456340.8d746be9-150300.3.11.1 fence-agents-debugsource-4.9.0+git.1624456340.8d746be9-150300.3.11.1 fence-agents-devel-4.9.0+git.1624456340.8d746be9-150300.3.11.1 - SUSE Linux Enterprise Module for SUSE Manager Server 4.3 (aarch64 ppc64le s390x x86_64): fence-agents-4.9.0+git.1624456340.8d746be9-150300.3.11.1 fence-agents-debuginfo-4.9.0+git.1624456340.8d746be9-150300.3.11.1 fence-agents-debugsource-4.9.0+git.1624456340.8d746be9-150300.3.11.1 - SUSE Linux Enterprise Module for SUSE Manager Server 4.2 (aarch64 ppc64le s390x x86_64): fence-agents-4.9.0+git.1624456340.8d746be9-150300.3.11.1 fence-agents-debuginfo-4.9.0+git.1624456340.8d746be9-150300.3.11.1 fence-agents-debugsource-4.9.0+git.1624456340.8d746be9-150300.3.11.1 - SUSE Linux Enterprise High Availability 15-SP4 (aarch64 ppc64le s390x x86_64): fence-agents-4.9.0+git.1624456340.8d746be9-150300.3.11.1 fence-agents-debuginfo-4.9.0+git.1624456340.8d746be9-150300.3.11.1 fence-agents-debugsource-4.9.0+git.1624456340.8d746be9-150300.3.11.1 fence-agents-devel-4.9.0+git.1624456340.8d746be9-150300.3.11.1 - SUSE Linux Enterprise High Availability 15-SP3 (aarch64 ppc64le s390x x86_64): fence-agents-4.9.0+git.1624456340.8d746be9-150300.3.11.1 fence-agents-debuginfo-4.9.0+git.1624456340.8d746be9-150300.3.11.1 fence-agents-debugsource-4.9.0+git.1624456340.8d746be9-150300.3.11.1 fence-agents-devel-4.9.0+git.1624456340.8d746be9-150300.3.11.1 References: https://bugzilla.suse.com/1198872

1 0

SUSE-RU-2022:2093-1: moderate: Recommended update for open-vm-tools
by maintenance＠opensuse.org 15 Jun '22

15 Jun '22

SUSE Recommended Update: Recommended update for open-vm-tools ______________________________________________________________________________ Announcement ID: SUSE-RU-2022:2093-1 Rating: moderate References: #1196803 #1196804 SLE-24097 Affected Products: SUSE Linux Enterprise Desktop 15-SP3 SUSE Linux Enterprise Desktop 15-SP4 SUSE Linux Enterprise High Performance Computing 15-SP3 SUSE Linux Enterprise High Performance Computing 15-SP4 SUSE Linux Enterprise Micro 5.1 SUSE Linux Enterprise Micro 5.2 SUSE Linux Enterprise Module for Basesystem 15-SP3 SUSE Linux Enterprise Module for Basesystem 15-SP4 SUSE Linux Enterprise Module for Desktop Applications 15-SP3 SUSE Linux Enterprise Module for Desktop Applications 15-SP4 SUSE Linux Enterprise Server 15-SP3 SUSE Linux Enterprise Server 15-SP4 SUSE Linux Enterprise Server for SAP Applications 15-SP3 SUSE Linux Enterprise Server for SAP Applications 15-SP4 SUSE Manager Proxy 4.2 SUSE Manager Server 4.2 openSUSE Leap 15.3 openSUSE Leap 15.4 ______________________________________________________________________________ An update that has two recommended fixes and contains one feature can now be installed. Description: This update for open-vm-tools fixes the following issues: - Update to 12.0.0 (build 19345655) (bsc#1196803) - Update open-vm-tools 12.0.0. (jsc#SLE-24097) - Support for managing Salt Minion through guest variables. A new open-vm-tools-salt-minion rpm is added to handle this support. - New ComponentMgr plugin to manage (add, remove, monitor) components on the guest VM. - Patch to fix potential Fail to Build from Source. (bsc#1196804) - Build vmhgfs with either libfuse2 or libfuse3. Patch Instructions: To install this SUSE Recommended Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 15.4: zypper in -t patch openSUSE-SLE-15.4-2022-2093=1 - openSUSE Leap 15.3: zypper in -t patch openSUSE-SLE-15.3-2022-2093=1 - SUSE Linux Enterprise Module for Desktop Applications 15-SP4: zypper in -t patch SUSE-SLE-Module-Desktop-Applications-15-SP4-2022-2093=1 - SUSE Linux Enterprise Module for Desktop Applications 15-SP3: zypper in -t patch SUSE-SLE-Module-Desktop-Applications-15-SP3-2022-2093=1 - SUSE Linux Enterprise Module for Basesystem 15-SP4: zypper in -t patch SUSE-SLE-Module-Basesystem-15-SP4-2022-2093=1 - SUSE Linux Enterprise Module for Basesystem 15-SP3: zypper in -t patch SUSE-SLE-Module-Basesystem-15-SP3-2022-2093=1 - SUSE Linux Enterprise Micro 5.2: zypper in -t patch SUSE-SUSE-MicroOS-5.2-2022-2093=1 - SUSE Linux Enterprise Micro 5.1: zypper in -t patch SUSE-SUSE-MicroOS-5.1-2022-2093=1 Package List: - openSUSE Leap 15.4 (aarch64 x86_64): libvmtools-devel-12.0.0-150300.16.1 libvmtools0-12.0.0-150300.16.1 libvmtools0-debuginfo-12.0.0-150300.16.1 open-vm-tools-12.0.0-150300.16.1 open-vm-tools-debuginfo-12.0.0-150300.16.1 open-vm-tools-debugsource-12.0.0-150300.16.1 open-vm-tools-desktop-12.0.0-150300.16.1 open-vm-tools-desktop-debuginfo-12.0.0-150300.16.1 open-vm-tools-sdmp-12.0.0-150300.16.1 open-vm-tools-sdmp-debuginfo-12.0.0-150300.16.1 - openSUSE Leap 15.3 (aarch64 x86_64): libvmtools-devel-12.0.0-150300.16.1 libvmtools0-12.0.0-150300.16.1 libvmtools0-debuginfo-12.0.0-150300.16.1 open-vm-tools-12.0.0-150300.16.1 open-vm-tools-debuginfo-12.0.0-150300.16.1 open-vm-tools-debugsource-12.0.0-150300.16.1 open-vm-tools-desktop-12.0.0-150300.16.1 open-vm-tools-desktop-debuginfo-12.0.0-150300.16.1 open-vm-tools-sdmp-12.0.0-150300.16.1 open-vm-tools-sdmp-debuginfo-12.0.0-150300.16.1 - SUSE Linux Enterprise Module for Desktop Applications 15-SP4 (x86_64): open-vm-tools-debuginfo-12.0.0-150300.16.1 open-vm-tools-debugsource-12.0.0-150300.16.1 open-vm-tools-desktop-12.0.0-150300.16.1 open-vm-tools-desktop-debuginfo-12.0.0-150300.16.1 - SUSE Linux Enterprise Module for Desktop Applications 15-SP3 (x86_64): open-vm-tools-debuginfo-12.0.0-150300.16.1 open-vm-tools-debugsource-12.0.0-150300.16.1 open-vm-tools-desktop-12.0.0-150300.16.1 open-vm-tools-desktop-debuginfo-12.0.0-150300.16.1 - SUSE Linux Enterprise Module for Basesystem 15-SP4 (x86_64): libvmtools-devel-12.0.0-150300.16.1 libvmtools0-12.0.0-150300.16.1 libvmtools0-debuginfo-12.0.0-150300.16.1 open-vm-tools-12.0.0-150300.16.1 open-vm-tools-debuginfo-12.0.0-150300.16.1 open-vm-tools-debugsource-12.0.0-150300.16.1 open-vm-tools-sdmp-12.0.0-150300.16.1 open-vm-tools-sdmp-debuginfo-12.0.0-150300.16.1 - SUSE Linux Enterprise Module for Basesystem 15-SP3 (x86_64): libvmtools-devel-12.0.0-150300.16.1 libvmtools0-12.0.0-150300.16.1 libvmtools0-debuginfo-12.0.0-150300.16.1 open-vm-tools-12.0.0-150300.16.1 open-vm-tools-debuginfo-12.0.0-150300.16.1 open-vm-tools-debugsource-12.0.0-150300.16.1 open-vm-tools-sdmp-12.0.0-150300.16.1 open-vm-tools-sdmp-debuginfo-12.0.0-150300.16.1 - SUSE Linux Enterprise Micro 5.2 (x86_64): libvmtools0-12.0.0-150300.16.1 libvmtools0-debuginfo-12.0.0-150300.16.1 open-vm-tools-12.0.0-150300.16.1 open-vm-tools-debuginfo-12.0.0-150300.16.1 open-vm-tools-debugsource-12.0.0-150300.16.1 - SUSE Linux Enterprise Micro 5.1 (x86_64): libvmtools0-12.0.0-150300.16.1 libvmtools0-debuginfo-12.0.0-150300.16.1 open-vm-tools-12.0.0-150300.16.1 open-vm-tools-debuginfo-12.0.0-150300.16.1 open-vm-tools-debugsource-12.0.0-150300.16.1 References: https://bugzilla.suse.com/1196803 https://bugzilla.suse.com/1196804

1 0

openSUSE-RU-2022:0146-1: moderate: Recommended update for keepassxc
by maintenance＠opensuse.org 15 Jun '22

15 Jun '22

SUSE Recommended Update: Recommended update for keepassxc ______________________________________________________________________________ Announcement ID: openSUSE-RU-2022:0146-1 Rating: moderate References: SLE-21235 Affected Products: openSUSE Backports SLE-15-SP4 openSUSE Leap 15.3 ______________________________________________________________________________ An update that has 0 recommended fixes and contains one feature can now be installed. Description: This update for keepassxc fixes the following issues: keepassxc was updated to 2.7.1: * Show when tags are changed in entry history * Improve tags editing and allow spaces in tags * Improve layout of entry preview panel * Incorporate patches to support Flatpak distribution * Add expiration presets for 12 and 24 hours * Fix crash when building history change list * Fix hiding password on database unlock * Fix AES KDF slow transform speed * Auto-Type: Correct timing issue on macOS and Linux that prevented typing * Auto-Type: Fix use of Ctrl/Alt/Shift/Win modifiers on Windows * Auto-Type: Reduce/eliminate delay when searching for entries * Auto-Type: Map ASCII dead keys on Linux for international keyboards * CLI: Fix detection of hardware keys (YubiKey) * CLI: Add missing parameter -c to add/edit entries command * Secret Service: Fix crash when multiple prompts are shown * SSH Agent: Fix default agent selection on Windows * Fix database unlock dialog not being the top window on Linux * Fix drag/drop entries between tabs on Wayland * Fix compiling with minizip-ng Update to 2.7.0 - Major Additions - Implement KDBX 4.1 [#7114] - Add direct write save option for cloud storage and GVFS [#6594] - Prevent screen capture on Windows and macOS [#6030] - Support quick unlock using Windows Hello [#7384] - Support quick unlock using Apple Watch [#5526] - Allow specifying database backup paths [#7035] - Add tag functionality [#6487][#7436][#7446] - Add password rating column to entry view [#4797] - Add group clone action [#6124] - Show modifications between entry history items [#6789] - Ability to bulk-delete and purge unused custom icons [#5970] - Support adding custom passphrase wordlists [#6799] - Support passphrase wordlists in numbered and PGP-signed formats [#6791] - Implement support for hardware keys via wireless NFC [#6895] - SSH Agent: Add support for OpenSSH 8.2 FIDO/U2F keys [#6371] - CLI: Implement attachment handling [#5538] - CLI: Add support for okon in offline HIBP checks [#5478] - CLI: Implement search command and remove locate [#6805] - CLI: Add db statistic output to db-info command [#7032] - CLI: Add -i/--include option to generate command. [#7112] - CLI: Add a -n (--notes) option to add and edit commands [#4646] - CLI: Add keyfile option to import command [#5402] - CLI: Adding a best option to clip to copy a password of the best match [#4489] - Browser: Add Microsoft Edge support on Linux [#7100] - Browser: Support native password generator from the extension [#6529] - Browser: Add group settings [#4180] - Browser: Add feature to ignore entries for HTTP-Auth Logins [#5394] - Browser: Support triggering Auto-Type from browser extension [#6272] - Browser: Add delete-entry command to API [#6899] - Browser: Add search 'by-path' url to API [#5535] - Browser: search for entries by UUID to API [#4763] - Browser: Support auto-download of favicon on entry addition [#7179] - Auto-Type: Major improvements to Auto-Type [#5864][#7463][#7435][#7391][#7129][#6400][#6364][#6361][#5283][#7507] - Auto-Type: Fix typing to virtual machines on Windows [#7366] - Auto-Type: Re-implement X11 keysym emulation [#7098] - Auto-Type: Support multiple Xkb layouts [#6247] - Auto-Type: Abort keystroke if modifiers held on X11 [#6351][#6357] - Auto-Type: Add TOTP option to entry level Auto-Type menu [#6675] - FdoSecrets: Major Refactor and Code Consolidation [#5747][#5660][#7043][#6915] - FdoSecrets: Implement unlock before search [#6943] - Reports: Add browser statistics report [#7197] - Major Changes - Port crypto backend to Botan [#6209] - Improve attachment handling and security [#6606][#5034][#7083] - Allow selecting any open database in unlock dialog [#5427] - KeeShare: Remove checking signed container and QuaZip dependency [#7223] - Introduce security option to enable copy on double click (default off) [#6433] - Add 'delete entry without confirm' functionality [#5812] - Improve macOS and Windows platform integration [#5851] - Lock only the current database by default [#6652] - Show expired entries on DB unlock [#7290] - Update D-Bus adaptor interface class name to match definition file [#7523] - Other Changes and Fixes - Add countdown progress bar to TOTP preview [#6930] - Enter favicon url directly on icons page [#6614] - Set C++17 as standard in the build system [#7180] - Internalize ykcore into code base [#6654] - Transition to Visual Studio builds on Windows [#5874] - Ability to delete entries from health check reports [#6537] - Enhance remembering last-used directories [#6711] - Implement org.freedesktop.appearance.color-scheme support on Linux [#7422] - Support sorting HTML export [#7011] - Add display number of characters in passphrases [#5449] - Use Alt+Tab on macOS to switch between databases [#5407] - Add feature to sort groups using shortcut keys [#6999] - Add CTRL+Enter to apply password generator changes [#6414] - Display Database created timestamp on statistics report [#6876] - Browser: Improve best matching credentials setting [#6893] - SSH Agent: Use both Pageant and OpenSSH agent simultaneously on Windows [#6288] - SSH Agent: Allow using database path to resolve keys [#6365] - SSH Agent: Show correct error messages in main window [#7166] - Multiple fixes for MSI installer [#6630] - Fix tab order for CSV import dialog to match screen order [#7315] - Don't mark kdbx:// urls as invalid [#7221] - Make selected text copyable instead of copying password [#7209] - Detect timestamp resolution for CSV files [#7196] - Fix crash while downloading favicon [#7104] - Correct naming of newly generated keyx files [#7010] - Place the 'Recycle Bin' at the bottom of the list when groups are sorted [#7004] - Handle tilde with custom browser paths [#6659] - Don't scroll up when deleting an entry [#6833] - Set the MIME-Type to text/plain when using wl-copy on wayland [#6832] - Fix adaptive icon painting [#5989][#6033] - Fix favicon download from URL with non-standard port [#5509] - Ignore recycle bin on KeePassHTTP migration [#5481] - Fix keepassxc-cr-recovery utility [#7521] - Fix Auto-Type not working when audio recording indicator is active on macOS 12.2+ [#7526] Patch Instructions: To install this SUSE Recommended Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 15.3: zypper in -t patch openSUSE-SLE-15.3-2022-146=1 - openSUSE Backports SLE-15-SP4: zypper in -t patch openSUSE-2022-146=1 Package List: - openSUSE Leap 15.3 (aarch64 ppc64le s390x x86_64): nodejs16-16.13.2-150300.7.3.1 nodejs16-debuginfo-16.13.2-150300.7.3.1 nodejs16-debugsource-16.13.2-150300.7.3.1 nodejs16-devel-16.13.2-150300.7.3.1 npm16-16.13.2-150300.7.3.1 - openSUSE Leap 15.3 (noarch): nodejs16-docs-16.13.2-150300.7.3.1 - openSUSE Backports SLE-15-SP4 (aarch64 s390x x86_64): keepassxc-2.7.1-bp154.3.3.1 - openSUSE Backports SLE-15-SP4 (ppc64le): keepassxc-2.6.6-bp154.3.2.1 - openSUSE Backports SLE-15-SP4 (noarch): keepassxc-lang-2.6.6-bp154.3.2.1 keepassxc-lang-2.7.1-bp154.3.3.1 References:

1 0

SUSE-RU-2022:2096-1: moderate: Recommended update for yast2-online-update-configuration
by maintenance＠opensuse.org 15 Jun '22

15 Jun '22

SUSE Recommended Update: Recommended update for yast2-online-update-configuration ______________________________________________________________________________ Announcement ID: SUSE-RU-2022:2096-1 Rating: moderate References: #1198848 Affected Products: SUSE Linux Enterprise Desktop 15-SP3 SUSE Linux Enterprise High Performance Computing 15-SP3 SUSE Linux Enterprise Module for Basesystem 15-SP3 SUSE Linux Enterprise Server 15-SP3 SUSE Linux Enterprise Server for SAP Applications 15-SP3 SUSE Manager Proxy 4.2 SUSE Manager Server 4.2 openSUSE Leap 15.3 ______________________________________________________________________________ An update that has one recommended fix can now be installed. Description: This update for yast2-online-update-configuration fixes the following issues: - Reduce nesting in the "category_filter" section of the AutoYaST profile. The old (nested) format is still accepted. (bsc#1198848) Patch Instructions: To install this SUSE Recommended Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 15.3: zypper in -t patch openSUSE-SLE-15.3-2022-2096=1 - SUSE Linux Enterprise Module for Basesystem 15-SP3: zypper in -t patch SUSE-SLE-Module-Basesystem-15-SP3-2022-2096=1 Package List: - openSUSE Leap 15.3 (noarch): yast2-online-update-configuration-4.3.3-150300.3.3.1 - SUSE Linux Enterprise Module for Basesystem 15-SP3 (noarch): yast2-online-update-configuration-4.3.3-150300.3.3.1 References: https://bugzilla.suse.com/1198848

1 0

openSUSE-RU-2022:10008-1: moderate: Recommended update for opi
by maintenance＠opensuse.org 15 Jun '22

15 Jun '22

openSUSE Recommended Update: Recommended update for opi ______________________________________________________________________________ Announcement ID: openSUSE-RU-2022:10008-1 Rating: moderate References: Affected Products: openSUSE Backports SLE-15-SP4 ______________________________________________________________________________ An update that has 0 recommended fixes can now be installed. Description: This update for opi fixes the following issues: Version 2.5.0 - Use $releasever in repo creation on Leap Version 2.4.7 - Fix release script - Fix numbering in --help - Update README.md - Add release helper script Version 2.4.6 - Update .NET SDK to 6.0 Version 2.4.5 - Packman codec changes Version 2.5.0 - Run ci for both tumbleweed and leap - Use $releasever in repo creation on Leap Version 2.4.7 - Fix numbering in --help - Add release helper script Version 2.4.6 - Update .NET SDK to 6.0 Version 2.4.5 - Update packman codecs plugin to reflect recent changes that apply to Tumbleweed and releases after 15.4 see https://lists.opensuse.org/archives/list/factory@lists.opensuse.org/thread/ VMXOWQWC4WW3W6PM7WPZDRMNCV26KKGY/ Patch Instructions: To install this openSUSE Recommended Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Backports SLE-15-SP4: zypper in -t patch openSUSE-2022-10008=1 Package List: - openSUSE Backports SLE-15-SP4 (noarch): opi-2.5.0-bp154.2.3.1 References:

1 0

openSUSE-SU-2022:10002-1: important: Security update for librecad
by opensuse-security＠opensuse.org 15 Jun '22

15 Jun '22

openSUSE Security Update: Security update for librecad ______________________________________________________________________________ Announcement ID: openSUSE-SU-2022:10002-1 Rating: important References: #1195105 #1195122 #1197664 Cross-References: CVE-2021-45341 CVE-2021-45342 CVSS scores: CVE-2021-45341 (NVD) : 8.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H CVE-2021-45342 (NVD) : 7.8 CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H Affected Products: openSUSE Backports SLE-15-SP4 ______________________________________________________________________________ An update that solves two vulnerabilities and has one errata is now available. Description: This update for librecad fixes the following issues: - CVE-2021-45341: Fixed a buffer overflow vulnerability in LibreCAD allows an attacker to achieve remote code execution via a crafted JWW document [boo#1195105] - CVE-2021-45342: Fixed a buffer overflow vulnerability in jwwlib in LibreCAD allows an attacker to achieve remote code execution via a crafted JWW document [boo#1195122] - Strip excess blank fields from librecad.desktop:MimeType [boo#1197664] Update to 2.2.0-rc3 * major release * DWG imports are more reliable now * and a lot more of bugfixes and improvements Patch Instructions: To install this openSUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Backports SLE-15-SP4: zypper in -t patch openSUSE-2022-10002=1 Package List: - openSUSE Backports SLE-15-SP4 (aarch64 i586 ppc64le s390x x86_64): libdxfrw-debuginfo-1.0.1+git.20220109-bp154.2.3.1 libdxfrw-debugsource-1.0.1+git.20220109-bp154.2.3.1 libdxfrw-devel-1.0.1+git.20220109-bp154.2.3.1 libdxfrw-tools-1.0.1+git.20220109-bp154.2.3.1 libdxfrw-tools-debuginfo-1.0.1+git.20220109-bp154.2.3.1 libdxfrw1-1.0.1+git.20220109-bp154.2.3.1 libdxfrw1-debuginfo-1.0.1+git.20220109-bp154.2.3.1 - openSUSE Backports SLE-15-SP4 (aarch64 ppc64le s390x x86_64): librecad-2.2.0~rc3-bp154.3.3.1 - openSUSE Backports SLE-15-SP4 (noarch): librecad-parts-2.2.0~rc3-bp154.3.3.1 References: https://www.suse.com/security/cve/CVE-2021-45341.html https://www.suse.com/security/cve/CVE-2021-45342.html https://bugzilla.suse.com/1195105 https://bugzilla.suse.com/1195122 https://bugzilla.suse.com/1197664

1 0

openSUSE-SU-2022:10007-1: moderate: Security update for caddy
by opensuse-security＠opensuse.org 15 Jun '22

15 Jun '22

openSUSE Security Update: Security update for caddy ______________________________________________________________________________ Announcement ID: openSUSE-SU-2022:10007-1 Rating: moderate References: #1200279 Cross-References: CVE-2022-297182 Affected Products: openSUSE Backports SLE-15-SP4 ______________________________________________________________________________ An update that fixes one vulnerability is now available. Description: This update for caddy fixes the following issues: Update to version 2.5.1: * Fixed regression in Unix socket admin endpoints. * Fixed regression in caddy trust commands. * Hash-based load balancing policies (ip_hash, uri_hash, header, and cookie) use an improved highest-random-weight (HRW) algorithm for increased consistency. * Dynamic upstreams, which is the ability to get the list of upstreams at every request (more specifically, every iteration in the proxy loop of every request) rather than just once at config-load time. * Caddy will automatically try to get relevant certificates from the local Tailscale instance. * New OpenTelemetry integration. * Added new endpoints /pki/ca/<id> and /pki/ca/<id>/certificates for getting information about Caddy's managed CAs. * Rename _caddy to zsh-completion * Fix MatchPath sanitizing [bsc#1200279, CVE-2022-29718] Patch Instructions: To install this openSUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Backports SLE-15-SP4: zypper in -t patch openSUSE-2022-10007=1 Package List: - openSUSE Backports SLE-15-SP4 (aarch64 i586 ppc64le s390x x86_64): caddy-2.5.1-bp154.2.5.1 References: https://www.suse.com/security/cve/CVE-2022-297182.html https://bugzilla.suse.com/1200279

1 0

openSUSE-SU-2022:0155-1: moderate: Security update for libredwg
by opensuse-security＠opensuse.org 15 Jun '22

15 Jun '22

openSUSE Security Update: Security update for libredwg ______________________________________________________________________________ Announcement ID: openSUSE-SU-2022:0155-1 Rating: moderate References: #1193372 Cross-References: CVE-2021-28237 Affected Products: openSUSE Backports SLE-15-SP4 ______________________________________________________________________________ An update that fixes one vulnerability is now available. Description: This update for libredwg fixes the following issues: Update to release 0.12.5 [boo#1193372] [CVE-2021-28237] * Restricted accepted DXF objects to all stable and unstable classes, minus MATERIAL, ARC_DIMENSION, SUN, PROXY*. I.e. most unstable objects do not allow unknown DXF codes anymore. This fixed most oss-fuzz errors. Patch Instructions: To install this openSUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Backports SLE-15-SP4: zypper in -t patch openSUSE-2022-155=1 Package List: - openSUSE Backports SLE-15-SP4 (aarch64 i586 ppc64le s390x x86_64): libredwg-devel-0.12.5-bp154.2.3.1 libredwg-tools-0.12.5-bp154.2.3.1 libredwg0-0.12.5-bp154.2.3.1 References: https://www.suse.com/security/cve/CVE-2021-28237.html https://bugzilla.suse.com/1193372

1 0

openSUSE-SU-2022:0144-1: moderate: Security update for varnish
by opensuse-security＠opensuse.org 15 Jun '22

15 Jun '22

SUSE Security Update: Security update for varnish ______________________________________________________________________________ Announcement ID: openSUSE-SU-2022:0144-1 Rating: moderate References: #1194469 #1195188 Cross-References: CVE-2021-4122 CVE-2022-23959 CVSS scores: CVE-2021-4122 (SUSE): 5.9 CVSS:3.1/AV:P/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:N CVE-2022-23959 (NVD) : 9.1 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N CVE-2022-23959 (SUSE): 7.4 CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N Affected Products: openSUSE Backports SLE-15-SP4 openSUSE Leap 15.3 ______________________________________________________________________________ An update that fixes two vulnerabilities is now available. Description: This update for varnish fixes the following issues: varnish was updated to release 7.1.0 [boo#1195188] [CVE-2022-23959] * VCL: It is now possible to assign a BLOB value to a BODY variable, in addition to STRING as before. * VMOD: New STRING strftime(TIME time, STRING format) function for UTC formatting. Patch Instructions: To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 15.3: zypper in -t patch openSUSE-SLE-15.3-2022-144=1 - openSUSE Backports SLE-15-SP4: zypper in -t patch openSUSE-2022-144=1 Package List: - openSUSE Leap 15.3 (aarch64 ppc64le s390x x86_64): cryptsetup-2.3.7-150300.3.5.1 cryptsetup-debuginfo-2.3.7-150300.3.5.1 cryptsetup-debugsource-2.3.7-150300.3.5.1 libcryptsetup-devel-2.3.7-150300.3.5.1 libcryptsetup12-2.3.7-150300.3.5.1 libcryptsetup12-debuginfo-2.3.7-150300.3.5.1 libcryptsetup12-hmac-2.3.7-150300.3.5.1 - openSUSE Leap 15.3 (x86_64): libcryptsetup12-32bit-2.3.7-150300.3.5.1 libcryptsetup12-32bit-debuginfo-2.3.7-150300.3.5.1 libcryptsetup12-hmac-32bit-2.3.7-150300.3.5.1 - openSUSE Leap 15.3 (noarch): cryptsetup-lang-2.3.7-150300.3.5.1 - openSUSE Backports SLE-15-SP4 (aarch64 i586 ppc64le s390x x86_64): libvarnishapi3-7.1.0-bp154.2.3.1 varnish-7.1.0-bp154.2.3.1 varnish-devel-7.1.0-bp154.2.3.1 References: https://www.suse.com/security/cve/CVE-2021-4122.html https://www.suse.com/security/cve/CVE-2022-23959.html https://bugzilla.suse.com/1194469 https://bugzilla.suse.com/1195188

1 0