OPENSUSE-SU-2021:0943-1 Security update for roundcubemail

This update for roundcubemail fixes the following issues: Upgrade to version 1.3.16 This is a security update to the LTS version 1.3. It fixes a recently reported stored cross-site scripting XSS vulnerability via HTML or plain text messages with malicious content. References: - CVE-2020-18670:...

OPENSUSE-SU-2021:0934-1 Security update for tpm2.0-tools

This update for tpm2.0-tools fixes the following issues: - CVE-2021-3565: Fixed issue when no encrypted session with the TPM is used bsc1186490. This update was imported from the SUSE:SLE-15-SP2:Update update project...

OPENSUSE-SU-2021:0925-1 Security update for openexr

This update for openexr fixes the following issues: - Fixed CVE-2021-3605 bsc1187395: Heap buffer overflow in the rleUncompress function - Fixed CVE-2021-3598 bsc1187310: Heap buffer overflow in Imf31:CharPtrIO:readChars This update was imported from the SUSE:SLE-15:Update update project...

OPENSUSE-SU-2021:0895-1 Security update for htmldoc

This update for htmldoc fixes the following issues: Update to version 1.9.12 Fixed buffer-overflow CVE-2021-20308 boo1184424 Fixed a crash bug with 'data:' URIs and EPUB output Fixed several other crash bugs Fixed JPEG error handling Fixed some minor issues Removed the bundled libjpeg, libpng, an...

OPENSUSE-SU-2021:0881-1 Security update for chromium

This update for chromium fixes the following issues: Chromium 91.0.4472.101 boo1187141 CVE-2021-30544: Use after free in BFCache CVE-2021-30545: Use after free in Extensions CVE-2021-30546: Use after free in Autofill CVE-2021-30547: Out of bounds write in ANGLE CVE-2021-30548: Use after free in...

OPENSUSE-SU-2021:0878-1 Security update for containerd, docker, runc

This update for containerd, docker, runc fixes the following issues: Docker was updated to 20.10.6-ce bsc1184768, bsc1182947, bsc1181594 Switch version to use -ce suffix rather than ce to avoid confusing other tools bsc1182476. CVE-2021-21284: Fixed a potential privilege escalation when the root...

OPENSUSE-SU-2021:0868-1 Security update for 389-ds

This update for 389-ds fixes the following issues: - CVE-2021-3514: Fixed a syncrepl NULL pointer dereference in synccreatestatecontrol bsc1185356 389-ds was updated to version 1.4.3.23git0.f53d0132b: Bump version to 1.4.3.23: Issue 4725 - RFE DS - Update the password policy to support a Temporar...

OPENSUSE-SU-2021:0855-1 Security update for snakeyaml

This update for snakeyaml fixes the following issues: - Upgrade to 1.28 - CVE-2017-18640: The Alias feature allows entity expansion during a load operation bsc1159488, bsc1186088 This update was imported from the SUSE:SLE-15-SP2:Update update project...

OPENSUSE-SU-2021:0833-1 Security update for ceph

This update for ceph fixes the following issues: - Update to 15.2.12-83-g528da226523: - CVE-2021-3509 fix cookie injection issue bsc1186021 - CVE-2021-3531 RGWSwiftWebsiteHandler::iswebdir checks empty subdirname bsc1186020 - CVE-2021-3524 sanitize \r in s3 CORSConfiguration’s ExposeHeader...

OPENSUSE-SU-2021:0832-1 Security update for xstream

This update for xstream fixes the following issues: - Upgrade to 1.4.16 - CVE-2021-21351: remote attacker to load and execute arbitrary code bsc1184796 - CVE-2021-21349: SSRF can lead to a remote attacker to request data from internal resources bsc1184797 - CVE-2021-21350: arbitrary code executio...

OPENSUSE-SU-2021:0825-1 Security update for chromium

This update for chromium fixes the following issues: Chromium 91.0.4472.77 boo1186458: Support Managed configuration API for Web Applications WebOTP API: cross-origin iframe support CSS custom counter styles Support JSON Modules Clipboard: read-only files support Remove webkitBeforeTextInserted &...

OPENSUSE-SU-2021:0753-1 Security update for exim

This update for exim fixes the following issues: exim was updated to 4.94.2: security update boo1185631 CVE-2020-28007: Link attack in Exim's log directory CVE-2020-28008: Assorted attacks in Exim's spool directory CVE-2020-28014: Arbitrary PID file creation CVE-2020-28011: Heap buffer overflow i...

OPENSUSE-SU-2021:0712-1 Security update for opera

This update for opera fixes the following issues: Update to version 76.0.4017.94 - released on the stable branch Update to version 76.0.4017.88 - CHR-8404 Update chromium on desktop-stable-90-4017 to 90.0.4430.85 - DNA-92219 Add bookmark API supports to the front-end - DNA-92409 MAC ‘Present now’...

OPENSUSE-SU-2021:0682-1 Security update for redis

This update for redis fixes the following issues: redis 6.0.13 CVE-2021-29477: Integer overflow in STRALGO LCS command boo1185729 CVE-2021-29478: Integer overflow in COPY command for large intsets boo1185730 Cluster: Skip unnecessary check which may prevent failure detection Fix performance...

OPENSUSE-SU-2021:0668-1 Security update for bind

This update for bind fixes the following issues: - CVE-2021-25214: Fixed a broken inbound incremental zone update IXFR which could have caused named to terminate unexpectedly bsc1185345. - CVE-2021-25215: Fixed an assertion check which could have failed while answering queries for DNAME records...

OPENSUSE-SU-2021:0650-1 Security update for giflib

This update for giflib fixes the following issues: - Enable Position Independent Code and inherit CFLAGS from the build system bsc1184123. This update was imported from the SUSE:SLE-15:Update update project...

OPENSUSE-SU-2021:0630-1 Security update for virtualbox

This update for virtualbox fixes the following issues: - Version bump to 6.1.20 released April 20 2021 by Oracle Fixes boo1183329 'virtualbox 6.1.18 crashes when it runs nested VM' Fixes boo1183125 'Leap 15.3 installation in Virtualbox without VBox integration' Fixes CVE-2021-2264 and boo1184542...

OPENSUSE-SU-2021:0600-1 Security update for qemu

This update for qemu fixes the following issues: - CVE-2020-12829: Fix OOB access in sm501 device emulation bsc1172385 - CVE-2020-25723: Fix use-after-free in usb xhci packet handling bsc1178934 - CVE-2020-25084: Fix use-after-free in usb ehci packet handling bsc1176673 - CVE-2020-25625: Fix...

OPENSUSE-SU-2021:0592-1 Security update for opera

This update for opera fixes the following issues: - Opera was updated to version 75.0.3969.171 boo1184256 CVE-2021-21194, CVE-2021-21195, CVE-2021-21196, CVE-2021-21197, CVE-2021-21198, CVE-2021-21199, CVE-2021-21191, CVE-2021-21192, CVE-2021-21193...

OPENSUSE-SU-2021:0571-1 Security update for python-bleach

This update for python-bleach fixes the following issues: - CVE-2021-23980: Fixed mutation XSS on bleach.clean with specific combinations of allowed tags boo1184547 Update to 3.1.5: replace missing setuptools dependency with packaging. Thank you Benjamin Peterson. Update to 3.1.4 boo1168280,...

OPENSUSE-SU-2021:0563-1 Security update for wpa_supplicant

This update for wpasupplicant fixes the following issues: - CVE-2021-30004: Fixed an issue where forging attacks might have occured because AlgorithmIdentifier parameters are mishandled in tls/pkcs1.c and tls/x509v3.c bsc1184348. This update was imported from the SUSE:SLE-15:Update update project...

OPENSUSE-SU-2021:0552-1 Security update for python-bleach

This update for python-bleach fixes the following issues: - CVE-2021-23980: Fixed mutation XSS on bleach.clean with specific combinations of allowed tags boo1184547 Update to 3.1.5: replace missing setuptools dependency with packaging. Thank you Benjamin Peterson. Update to 3.1.4 boo1168280,...

OPENSUSE-SU-2021:0545-1 Security update for hostapd

This update for hostapd fixes the following issues: - CVE-2021-30004: forging attacks may occur because AlgorithmIdentifier parameters are mishandled in tls/pkcs1.c and tls/x509v3.c boo1184348 - CVE-2020-12695: UPnP SUBSCRIBE misbehavior in hostapd WPS AP boo1172700 - CVE-2019-16275: AP mode PMF...

OPENSUSE-SU-2021:0471-1 Security update for ruby2.5

This update for ruby2.5 fixes the following issues: - CVE-2020-25613: Fixed a potential HTTP Request Smuggling in WEBrick bsc1177125. - Enable optimizations also on ARM64 bsc1177222 This update was imported from the SUSE:SLE-15:Update update project...

OPENSUSE-SU-2021:0401-1 Security update for chromium

This update for chromium fixes the following issues: Update to 89.0.4389.72 boo1182358, boo1182960: - CVE-2021-21159: Heap buffer overflow in TabStrip. - CVE-2021-21160: Heap buffer overflow in WebAudio. - CVE-2021-21161: Heap buffer overflow in TabStrip. - CVE-2021-21162: Use after free in WebRT...

OPENSUSE-SU-2021:0387-1 Security update for MozillaThunderbird

This update for MozillaThunderbird fixes the following issues: - Mozilla Thunderbird 78.8 fixed: Importing an address book from a CSV file always reported an error fixed: Security information for S/MIME messages was not displayed correctly prior to a draft being saved fixed: Calendar: FileLink UI...

OPENSUSE-SU-2021:0330-1 Security update for tomcat

This update for tomcat fixes the following issues: - CVE-2021-24122: Fixed an information disclosure if resources are served from the NTFS file system bsc1180947. This update was imported from the SUSE:SLE-15-SP2:Update update project...

OPENSUSE-SU-2021:0262-1 Security update for nextcloud

This update for nextcloud fixes the following issues: - nextcloud was upgraded to version 20.0.7 - CVE-2020-8294: Fixed a missing link validation boo1181803 - CVE-2020-8295: Fixed a denial of service attack boo1181804 - CVE-2020-8293: Fixed an input validation issue boo1181445...

OPENSUSE-SU-2021:0241-1 Security update for the Linux Kernel

The openSUSE Leap 15.2 kernel was updated to receive various security and bugfixes. The following security bugs were fixed: - CVE-2021-3347: A use-after-free was discovered in the PI futexes during fault handling, allowing local users to execute code in the kernel bnc1181349. - CVE-2021-3348: Fix...

OPENSUSE-SU-2021:0190-1 Security update for go1.14

This update for go1.14 fixes the following issues: Go was updated to version 1.14.14 bsc1164903. Security issues fixed: - CVE-2021-3114: Fixed incorrect operations on the P-224 curve in crypto/elliptic bsc1181145. - CVE-2021-3115: Fixed a potential arbitrary code execution in the build process...

OPENSUSE-SU-2021:0186-1 Security update for chromium

This update for chromium fixes the following issues: chromium was updated to 88.0.4324.96 boo1181137 - CVE-2021-21117: Insufficient policy enforcement in Cryptohome - CVE-2021-21118: Insufficient data validation in V8 - CVE-2021-21119: Use after free in Media - CVE-2021-21120: Use after free in...

OPENSUSE-SU-2021:0165-1 Security update for virtualbox

This update for virtualbox fixes the following issues: Version update to 6.1.18 released January 19 2021 This is a maintenance release. The following items were fixed and/or added: - Nested VM: Fixed hangs when executing SMP nested-guests under certain conditions on Intel hosts bug 19315, 19561 -...

OPENSUSE-SU-2021:0152-1 Security update for python-autobahn

This update for python-autobahn fixes the following issue: - CVE-2020-35678: Fixed a redirect header injection boo1180570. This update was imported from the openSUSE:Leap:15.1:Update update project...

OPENSUSE-SU-2021:0124-1 Security update for dnsmasq

This update for dnsmasq fixes the following issues: - bsc1177077: Fixed DNSpooq vulnerabilities - CVE-2020-25684, CVE-2020-25685, CVE-2020-25686: Fixed multiple Cache Poisoning attacks. - CVE-2020-25681, CVE-2020-25682, CVE-2020-25683, CVE-2020-25687: Fixed multiple potential Heap-based overflows...

OPENSUSE-SU-2021:0075-1 Security update for the Linux Kernel

The openSUSE Leap 15.1 kernel was updated to receive various security and bugfixes. The following security bugs were fixed: - CVE-2020-29568: An issue was discovered in Xen through 4.14.x. Some OSes such as Linux, FreeBSD, and NetBSD are processing watch events using a single thread. If the event...

OPENSUSE-SU-2021:0065-1 Security update for nodejs10

This update for nodejs10 fixes the following issues: - New upstream LTS version 10.23.1: CVE-2020-8265: use-after-free in TLSWrap High bug in TLS implementation. When writing to a TLS enabled socket, node::StreamBase::Write calls node::TLSWrap::DoWrite with a freshly allocated WriteWrap object as...

OPENSUSE-SU-2021:0058-1 Security update for cobbler

This update for cobbler fixes the following issues: - Add cobbler-tests subpackage for unit testing for openSUSE/SLE - Adds LoadModule definitions for openSUSE/SLE - Switch to new refactored auth module. - use systemctl to restart cobblerd on logfile rotation boo1169207 Mainline logrotate conf fi...

OPENSUSE-SU-2021:0041-1 Security update for chromium

This update for chromium fixes the following issues: - Update to 87.0.4280.141 boo1180645 - CVE-2021-21106: Use after free in autofill - CVE-2021-21107: Use after free in drag and drop - CVE-2021-21108: Use after free in media - CVE-2021-21109: Use after free in payments - CVE-2021-21110: Use aft...

OPENSUSE-SU-2020:2333-1 Security update for python3

This update for python3 fixes the following issues: - Fixed CVE-2020-27619 bsc1178009, where Lib/test/multibytecodecsupport calls eval on content retrieved via HTTP. - Change setuptools and pip version numbers according to new wheels - Handful of changes to make python36 compatible with SLE15 and...

OPENSUSE-SU-2020:2324-1 Security update for MozillaThunderbird

This update for MozillaThunderbird fixes the following issues: - Mozilla Thunderbird 78.6 new: MailExtensions: Added browser.windows.openDefaultBrowser bmo1664708 changed: Thunderbird now only shows quota exceeded indications on the main window bmo1671748 changed: MailExtensions: menus API enable...

OPENSUSE-SU-2020:2249-1 Security update for curl

This update for curl fixes the following issues: - CVE-2020-8286: Fixed improper OSCP verification in the client side bsc1179593. - CVE-2020-8285: Fixed a stack overflow due to FTP wildcard bsc1179399. - CVE-2020-8284: Fixed an issue where a malicius FTP server could make curl connect to a...

OPENSUSE-SU-2020:2204-1 Security update for minidlna

This update for minidlna fixes the following issues: minidlna was updated to version 1.3.0 boo1179447 - Fixed some build warnings when building with musl. - Use $USER instead of $LOGNAME for the default friendly name. - Fixed build with GCC 10 - Fixed some warnings from newer compilers - Disallow...

OPENSUSE-SU-2020:2076-1 Security update for wireshark

This update for wireshark fixes the following issues: - wireshark was updated to 3.2.8: - CVE-2020-26575: Fixed an issue where FBZERO dissector was entering in infinite loop bsc1177406 - CVE-2020-28030: Fixed an issue where GQUIC dissector was crashing bsc1178291 Infinite memory allocation while...

OPENSUSE-SU-2020:2059-1 Security update for wpa_supplicant

This update for wpasupplicant fixes the following issues: Security issue fixed: - CVE-2019-16275: Fixed an AP mode PMF disconnection protection bypass bsc1150934. Non-security issues fixed: - Enable SAE support jscSLE-14992. - Limit P2PDEVICE name to appropriate ifname size. - Fix wicked wlan...

OPENSUSE-SU-2020:2039-1 Security update for podman

This update for podman fixes the following issues: Security issue fixed: - This release resolves CVE-2020-14370, in which environment variables could be leaked between containers created using the Varlink API bsc1176804. Non-security issues fixed: - add dependency to timezone package or podman...

OPENSUSE-SU-2020:2032-1 Security update for chromium

This update for chromium fixes the following issues: - Update to 87.0.4280.66 boo1178923 - Wayland support by default - CVE-2020-16018: Use after free in payments. - CVE-2020-16019: Inappropriate implementation in filesystem. - CVE-2020-16020: Inappropriate implementation in cryptohome. -...

OPENSUSE-SU-2020:2031-1 Security update for MozillaFirefox

This update for MozillaFirefox fixes the following issues: - Firefox Extended Support Release 78.5.0 ESR bsc1178824 CVE-2020-26951: Parsing mismatches could confuse and bypass security sanitizer for chrome privileged code CVE-2020-16012: Variable time processing of cross-origin images during...

OPENSUSE-SU-2020:1997-1 Security update for blueman

This update for blueman fixes the following issues: - Update to version 2.1.4 CVE-2020-15238: Fixed a local denial-of-service in the D-Bus interface boo1178196...

OPENSUSE-SU-2020:1943-1 Security update for chromium

This update for chromium fixes the following issues: Update to 86.0.4240.198 boo1178703 - CVE-2020-16013: Inappropriate implementation in V8 - CVE-2020-16017: Use after free in site isolation Update to 86.0.4240.193 boo1178630 - CVE-2020-16016: Inappropriate implementation in base. This update wa...

OPENSUSE-SU-2020:1893-1 Security update for java-1_8_0-openj9

This update for java-180-openj9 fixes the following issues: -OpenJDK was updated to 8u2732 build 10 with OpenJ9 0.23.0 virtual machine -includes Oracle July 2020 bsc1174157 and October 2020 CPU bsc1177943 - CVE-2020-14556, CVE-2020-14577, CVE-2020-14578, CVE-2020-14579, CVE-2020-14581,...