SUSE SLED15 / SLES15 Security Update : curl (SUSE-SU-2021:1006-1)

This update for curl fixes the following issues : CVE-2021-22890: TLS 1.3 session ticket proxy host mixup bsc1183934 CVE-2021-22876: Automatic referer leaks credentials bsc1183933 Note that Tenable Network Security has extracted the preceding description block directly from the SUSE security...

SUSE SLES15 Security Update : ovmf (SUSE-SU-2021:0972-1)

This update for ovmf fixes the following issues : CVE-2021-28211: ovmf: edk2: possible heap corruption with LzmaUefiDecompressGetInfo bsc1183578 CVE-2021-28210: ovmf: unlimited FV recursion, round 2 bsc1183579 Note that Tenable Network Security has extracted the preceding description block direct...

SUSE SLED15 / SLES15 Security Update : MozillaFirefox (SUSE-SU-2021:0966-1)

This update for MozillaFirefox fixes the following issues : Firefox was updated to 78.9.0 ESR MFSA 2021-11, bsc1183942 - CVE-2021-23981: Texture upload into an unbound backing buffer resulted in an out-of-bound read - CVE-2021-23982: Internal network hosts could have been probed by a malicious...

SUSE SLED15 / SLES15 Security Update : tar (SUSE-SU-2021:0974-1)

This update for tar fixes the following issues : - CVE-2021-20193: Memory leak in readheader in list.c bsc1181131 Note that Tenable Network Security has extracted the preceding description block directly from the SUSE security advisory. Tenable has attempted to automatically clean and format it a...

SUSE SLES15 Security Update : nghttp2 (SUSE-SU-2021:0931-1)

This update for nghttp2 fixes the following issues : CVE-2020-11080: HTTP/2 Large Settings Frame DoS bsc1181358 Note that Tenable Network Security has extracted the preceding description block directly from the SUSE security advisory. Tenable has attempted to automatically clean and format it as...

SUSE SLED15 / SLES15 Security Update : nghttp2 (SUSE-SU-2021:0930-1)

This update for nghttp2 fixes the following issues : CVE-2020-11080: HTTP/2 Large Settings Frame DoS bsc1181358 Note that Tenable Network Security has extracted the preceding description block directly from the SUSE security advisory. Tenable has attempted to automatically clean and format it as...

SUSE SLED15 / SLES15 Security Update : zstd (SUSE-SU-2021:0948-1)

This update for zstd fixes the following issues : CVE-2021-24031: Added read permissions to files while being compressed or uncompressed bsc1183371. CVE-2021-24032: Fixed a race condition which could have allowed an attacker to access world-readable destination file bsc1183370. Note that Tenable...

SUSE SLED15 / SLES15 Security Update : ldb (SUSE-SU-2021:0945-1)

This update for ldb fixes the following issues : CVE-2020-27840: Fixed an unauthenticated remote heap corruption via bad DNs bsc1183572. CVE-2021-20277: Fixed an out of bounds read in ldbhandlerfold bsc1183574. Note that Tenable Network Security has extracted the preceding description block...

SUSE SLES15 Security Update : libzypp, zypper (SUSE-SU-2021:0956-1)

This update for libzypp, zypper fixes the following issues : Update zypper to version 1.14.43 : doc: give more details about creating versioned package locks bsc1181622 man: Document synonymously used patch categories bsc1179847 Fix source-download commands help bsc1180663 man: Recommend to use t...

SUSE SLED15 / SLES15 Security Update : ruby2.5 (SUSE-SU-2021:0933-1)

This update for ruby2.5 fixes the following issues : CVE-2020-25613: Fixed a potential HTTP Request Smuggling in WEBrick bsc1177125. Enable optimizations also on ARM64 bsc1177222 Note that Tenable Network Security has extracted the preceding description block directly from the SUSE security...

SUSE SLED15 / SLES15 Security Update : ldb (SUSE-SU-2021:0944-1)

This update for ldb fixes the following issues : CVE-2020-27840: Fixed an unauthenticated remote heap corruption via bad DNs bsc1183572. CVE-2021-20277: Fixed an out of bounds read in ldbhandlerfold bsc1183574. Note that Tenable Network Security has extracted the preceding description block...

SUSE SLED15 / SLES15 Security Update : python3 (SUSE-SU-2021:0947-1)

This update for python3 fixes the following issues : python36 was updated to 3.6.13 CVE-2021-23336: Fixed a potential web cache poisoning by using a semicolon in query parameters use of semicolon as a query string separator bsc1182379. Note that Tenable Network Security has extracted the precedin...

SUSE SLED15 / SLES15 Security Update : libass (SUSE-SU-2021:0936-1)

This update for libass fixes the following issues : CVE-2020-26682: Fixed a signed integer overflow in the call to outlinestroke bsc1177862. Note that Tenable Network Security has extracted the preceding description block directly from the SUSE security advisory. Tenable has attempted to...

SUSE SLED15 / SLES15 Security Update : go1.15 (SUSE-SU-2021:0938-1)

This update for go1.15 fixes the following issues : go1.15.10 released 2021-03-11 bsc1175132 go1.15.9 released 2021-03-10 bsc1175132 - CVE-2021-27918: Fixed an infinite loop when using xml.NewTokenDecoder with a custom TokenReader bsc1183333. Note that Tenable Network Security has extracted the...

SUSE SLES15 Security Update : gnutls (SUSE-SU-2021:0934-1)

This update for gnutls fixes the following issues : CVE-2021-20232: Fixed a use after free issue which could have led to memory corruption and other potential consequences bsc1183456. CVE-2021-20231: Fixed a use after free issue which could have led to memory corruption and other potential...

SUSE SLED15 / SLES15 Security Update : openssl-1_1 (SUSE-SU-2021:0955-1)

This update for openssl-11 fixes the security issue : CVE-2021-3449: An OpenSSL TLS server may crash if sent a maliciously crafted renegotiation ClientHello message from a client. If a TLSv1.2 renegotiation ClientHello omits the signaturealgorithms extension but includes a signaturealgorithmscert...

SUSE SLED15 / SLES15 Security Update : go1.16 (SUSE-SU-2021:0937-1)

This update for go1.16 fixes the following issues : go1.16.2 released 2021-03-11 bsc1182345 go1.16.1 released 2021-03-10 bsc1182345 - CVE-2021-27918: Fixed an infinite loop when using xml.NewTokenDecoder with a custom TokenReader bsc1183333. - CVE-2021-27919: Fixed an issue where archive/zip: can...

SUSE SLED15 / SLES15 Security Update : gnutls (SUSE-SU-2021:0935-1)

This update for gnutls fixes the following issues : CVE-2021-20232: Fixed a use after free issue which could have led to memory corruption and other potential consequences bsc1183456. CVE-2021-20231: Fixed a use after free issue which could have led to memory corruption and other potential...

SUSE SLES15 Security Update : glib2 (SUSE-SU-2021:0890-1)

This update for glib2 fixes the following issues : CVE-2021-27218: gbytearraynewtake takes a gsize as length but stores in a guint, this patch will refuse if the length is larger than guint. bsc1182328 CVE-2021-27219: gmemdup takes a guint as parameter and sometimes leads into an integer overflow...

SUSE SLES15 Security Update : stunnel (SUSE-SU-2021:0772-1)

This update for stunnel fixes the following issues : Security fix: bsc1177580, bsc1182529, CVE-2021-20230 - 'redirect' option does not properly handle 'verifyChain = yes' Note that Tenable Network Security has extracted the preceding description block directly from the SUSE security advisory...