OPENSUSE-SU-2021:4169-1 Security update for go1.16

This update for go1.16 fixes the following issues: Updated to upstream version 1.16.12 to include security fixes to the compiler, syscall, runtime, the net/http, net/http/httptest, and time packages bsc1182345 - CVE-2021-44717: syscall: don't close fd 0 on ForkExec error bsc1193598. -...

SUSE-SU-2021:4150-1 Security update for MozillaThunderbird

This update for MozillaThunderbird fixes the following issues: - Update to version 91.4 MFSA 2021-54 bsc1193485 - CVE-2021-43536: URL leakage when navigating while executing asynchronous function - CVE-2021-43537: Heap buffer overflow when using structured clone - CVE-2021-43538: Missing fullscre...

Vulnerabilities fixed in Red Hat OpenShift Logging

Red Hat has fixed vulnerabilities in OpenShift Logging. The vulnerabilities potentially allow a malicious party to launch attacks execute attacks that result in the following categories of damage: Denial-of-Service DoS Circumvention of security measure Remote code execution User rights Access to...

Vulnerabilities fixed in Apple macOS

Apple has fixed vulnerabilities in macOS Catalina, Big Sur and Monterey. The vulnerabilities potentially enable a malicious person to able to perform attacks that result in the following categories of damage: Denial-of-Service DoS Manipulation of data Circumvention of security measure Remote code...

SUSE-SU-2021:3993-1 Security update for MozillaFirefox

This update for MozillaFirefox fixes the following issues: Update to Extended Support Release 91.4.0 bsc1193485: - CVE-2021-43536: URL leakage when navigating while executing asynchronous function - CVE-2021-43537: Heap buffer overflow when using structured clone - CVE-2021-43538: Missing...

OPENSUSE-SU-2021:1552-1 Security update for nodejs14

This update for nodejs14 fixes the following issues: nodejs14 was updated to 14.18.1: deps: update llhttp to 2.1.4 - HTTP Request Smuggling due to spaced in headers bsc1191601, CVE-2021-22959 - HTTP Request Smuggling when parsing the body bsc1191602, CVE-2021-22960 Changes in 14.18.0: buffer: +...

Security update for wireshark (moderate)

openSUSE Security Update: Security update for wireshark Announcement ID: openSUSE-SU-2021:1566-1 Rating: moderate References: 1192830 Cross-References: CVE-2021-39920 CVE-2021-39921 CVE-2021-39922 CVE-2021-39924 CVE-2021-39925 CVE-2021-39926 CVE-2021-39928 CVE-2021-39929 CVSS scores: CVE-2021-399...

Vulnerabilities fixed in Bentley View and Microstation

Bentley Systems has fixed several vulnerabilities in Bentley View and Microstation. A malicious party could potentially exploit them to cause a denial-of-service, or to execute arbitrary code with the victim's privileges. The malicious party does not need prior authentication, but must entice the...

Vulnerabilities fixed in SonicWall SMA100 series

Vulnerabilities have been fixed in SonicWall SMA100. The vulnerabilities with the attribute CVE-2021-20038 and CVE-2021-20045 have received a CVSSv3 score of 9.8 and 9.4 and allow an unauthenticated remote malicious person potentially able to execute code execute code on the system. The...

MGASA-2021-0538 Updated kernel packages fix security vulnerabilities

This kernel update is based on upstream 5.15.6 and fixes at least the following security issues: A vulnerability was found in Linux kernel, where a use-after-frees in nouveau's postclose handler could happen if removing device that is not common to remove video card physically without power-off,...

Security update for permissions (moderate)

openSUSE Security Update: Security update for permissions Announcement ID: openSUSE-SU-2021:1520-1 Rating: moderate References: 1028975 1029961 1093414 1133678 1148788 1150345 1150366 1151190 1157498 1160285 1160764 1161335 1161779 1163588 1167163 1169614 1171164 1171173 1171569 1171580 1171686...

SUSE-SU-2021:3772-1 Security update for redis

This update for redis fixes the following issues: - CVE-2021-32627: Fixed integer to heap buffer overflows with streams bsc1191305. - CVE-2021-32628: Fixed integer to heap buffer overflows handling ziplist-encoded data types bsc1191305. - CVE-2021-32687: Fixed integer to heap buffer overflow with...

SUSE-SU-2021:3738-1 Security update for the Linux Kernel (Live Patch 0 for SLE 15 SP3)

This update for the Linux Kernel 5.3.18-57 fixes several issues. The following security issues were fixed: - CVE-2021-3752: Fixed vulnerability in the linux kernel Bluetooth uaf module bsc1190432. - CVE-2021-34866: Fixed possible eBPF Type Confusion privilege escalation vulnerability via eBPF typ...

Important: java-17-openjdk security update

The java-17-openjdk packages provide the OpenJDK 17 Java Runtime Environment and the OpenJDK 17 Java Software Development Kit. Security Fixes: OpenJDK: Incorrect principal selection when using Kerberos Constrained Delegation Libraries, 8266689 CVE-2021-35567 OpenJDK: Excessive memory allocation i...

Vulnerabilities fixed in Microsoft Exchange Server

Microsoft has fixed vulnerabilities in Microsoft Exchange Server. The vulnerabilities potentially enable a malicious person to able to launch attacks that result in the following categories of damage: Impersonating another user Executing arbitrary code Administrator/Root privileges Microsoft...

OPENSUSE-SU-2021:1455-1 Security update for java-1_8_0-openj9

This update for java-180-openj9 fixes the following issues: Update to OpenJDK 8u312 build 07 with OpenJ9 0.29.0 virtual machine including Oracle July 2021 and October 2021 CPU changes - CVE-2021-2161: Fixed incorrect handling of partially quoted arguments in ProcessBuilder on Windows bsc1185056. ...

SUSE-SU-2021:3582-1 Security update for opensc

This update for opensc fixes the following issues: - CVE-2021-42780: Fixed use after return in insertpin bsc1192005. - CVE-2021-42779: Fixed use after free in scfilevalid bsc1191992. - CVE-2021-42781: Fixed multiple heap buffer overflows in pkcs15-oberthur.c bsc1192000. - CVE-2021-42782: Stack...

CLSA-2021-1635459129 Fix CVE(s): CVE-2021-26690, CVE-2021-26691, CVE-2021-30641, CVE-2020-35452

SECURITY UPDATE: Unexpected URL matching with 'MergeSlashes OFF' - debian/patches/CVE-2021-30641.patch: legacy default slash-matching behavior with 'MergeSlashes OFF'. - CVE-2021-30641 SECURITY UPDATE: heap overflow in modsession - debian/patches/CVE-2021-26691.patch: A specially crafted...

SUSE-SU-2021:3531-1 Security update for busybox

This update for busybox fixes the following issues: - CVE-2021-28831: Fixed invalid free or segmentation fault via malformed gzip data bsc1184522. - CVE-2018-20679: Fixed out of bounds read in udhcp bsc1121426. - CVE-2018-1000517: Fixed buffer overflow in the retrievefiledata bsc1099260. -...

Vulnerabilities fixed in Oracle Essbase

Oracle has fixed vulnerabilities in Hyperion Essbase Administration Services. The vulnerabilities allow a malicious potentially be able to launch attacks that result in the following categories of damage: Denial-of-Service DoS Manipulation of data Remote code execution User rights Access to...