openSUSE-SU-2021:0300-1

See a problem?
Import Source
https://ftp.suse.com/pub/projects/security/osv/openSUSE-SU-2021:0300-1.json
JSON Data
https://api.osv.dev/v1/vulns/openSUSE-SU-2021:0300-1
Published
2021-02-16T11:04:47Z
Modified
2021-02-16T11:04:47Z
Summary
Security update for mumble
Details

This update for mumble fixes the following issues:

mumble was updated to 1.3.4:

  • Fix use of outdated (non-existent) notification icon names
  • Fix Security vulnerability caused by allowing non http/https URL schemes in public server list (boo#1182123)
  • Server: Fix Exit status for actions like --version or --supw
  • Fix packet loss & audio artifacts caused by OCB2 XEX* mitigation
  • update apparmor profiles to get warning free again on 15.2
    • use abstractions for ssl files
    • allow inet dgram sockets as mumble can also work via udp
    • allow netlink socket (probably for dbus)
    • properly allow lsb_release again
    • add support for optional local include
  • start murmurd directly as user mumble-server it gets rid of the dac_override/setgid/setuid/chown permissions

Update to upstream version 1.3.3

Client:

  • Fixed: Chatbox invisble (zero height) (#4388)
  • Fixed: Handling of invalid packet sizes (#4394)
  • Fixed: Race-condition leading to loss of shortcuts (#4430)
  • Fixed: Link in About dialog is now clickable again (#4454)
  • Fixed: Sizing issues in ACL-Editor (#4455)
  • Improved: PulseAudio now always samples at 48 kHz (#4449)

Server:

  • Fixed: Crash due to problems when using PostgreSQL (#4370)
  • Fixed: Handling of invalid package sizes (#4392)
References

Affected packages

openSUSE:Leap 15.2 / mumble

Package

Name
mumble
Purl
pkg:rpm/opensuse/mumble&distro=openSUSE%20Leap%2015.2

Affected ranges

Type
ECOSYSTEM
Events
Introduced
0 Unknown introduced version / All previous versions are affected
Fixed
1.3.4-lp152.2.6.1

Ecosystem specific 

{
    "binaries":  [
        {
            "mumble":  "1.3.4-lp152.2.6.1",
            "mumble-32bit":  "1.3.4-lp152.2.6.1",
            "mumble-server":  "1.3.4-lp152.2.6.1"
        }
    ]
}

Database specific

source 
"https://ftp.suse.com/pub/projects/security/osv/openSUSE-SU-2021:0300-1.json"