Security update for lapack SUSE Patch security@suse.de SUSE Security Team openSUSE-SU-2022:0915-1 Final 1 1 2022-03-21T15:51:03Z current 2022-03-21T15:51:03Z 2022-03-21T15:51:03Z cve-database/bin/generate-cvrf.pl 2017-02-24T01:00:00Z Security update for lapack This update for lapack fixes the following issues: - CVE-2021-4048: Fixed an out of bounds read when user input was not validated properly (bsc#1193562). The CVRF data is provided by SUSE under the Creative Commons License 4.0 with Attribution (CC-BY-4.0). openSUSE-SLE-15.3-2022-915,openSUSE-SLE-15.4-2022-915 Copyright SUSE LLC under the Creative Commons License 4.0 with Attribution (CC-BY-4.0) https://lists.opensuse.org/archives/list/security-announce@lists.opensuse.org/thread/6Y4WJU3KSP5LSKZL7KZ3ZTSCG3EWFTGE/ E-Mail link for openSUSE-SU-2022:0915-1 https://www.suse.com/support/security/rating/ SUSE Security Ratings https://bugzilla.suse.com/1193562 SUSE Bug 1193562 https://www.suse.com/security/cve/CVE-2021-4048/ SUSE CVE CVE-2021-4048 page openSUSE Leap 15.3 blas-devel-3.5.0-4.6.1 blas-devel-32bit-3.5.0-4.6.1 blas-devel-static-3.5.0-4.6.1 blas-man-3.5.0-4.6.1 lapack-devel-3.5.0-4.6.1 lapack-devel-32bit-3.5.0-4.6.1 lapack-devel-static-3.5.0-4.6.1 lapack-man-3.5.0-4.6.1 lapacke-devel-3.5.0-4.6.1 lapacke-devel-32bit-3.5.0-4.6.1 lapacke-devel-static-3.5.0-4.6.1 libblas3-3.5.0-4.6.1 libblas3-32bit-3.5.0-4.6.1 liblapack3-3.5.0-4.6.1 liblapack3-32bit-3.5.0-4.6.1 liblapacke3-3.5.0-4.6.1 liblapacke3-32bit-3.5.0-4.6.1 blas-devel-3.5.0-4.6.1 as a component of openSUSE Leap 15.3 blas-devel-32bit-3.5.0-4.6.1 as a component of openSUSE Leap 15.3 blas-devel-static-3.5.0-4.6.1 as a component of openSUSE Leap 15.3 blas-man-3.5.0-4.6.1 as a component of openSUSE Leap 15.3 lapack-devel-3.5.0-4.6.1 as a component of openSUSE Leap 15.3 lapack-devel-32bit-3.5.0-4.6.1 as a component of openSUSE Leap 15.3 lapack-devel-static-3.5.0-4.6.1 as a component of openSUSE Leap 15.3 lapack-man-3.5.0-4.6.1 as a component of openSUSE Leap 15.3 lapacke-devel-3.5.0-4.6.1 as a component of openSUSE Leap 15.3 lapacke-devel-32bit-3.5.0-4.6.1 as a component of openSUSE Leap 15.3 lapacke-devel-static-3.5.0-4.6.1 as a component of openSUSE Leap 15.3 libblas3-3.5.0-4.6.1 as a component of openSUSE Leap 15.3 libblas3-32bit-3.5.0-4.6.1 as a component of openSUSE Leap 15.3 liblapack3-3.5.0-4.6.1 as a component of openSUSE Leap 15.3 liblapack3-32bit-3.5.0-4.6.1 as a component of openSUSE Leap 15.3 liblapacke3-3.5.0-4.6.1 as a component of openSUSE Leap 15.3 liblapacke3-32bit-3.5.0-4.6.1 as a component of openSUSE Leap 15.3 An out-of-bounds read flaw was found in the CLARRV, DLARRV, SLARRV, and ZLARRV functions in lapack through version 3.10.0, as also used in OpenBLAS before version 0.3.18. Specially crafted inputs passed to these functions could cause an application using lapack to crash or possibly disclose portions of its memory. CVE-2021-4048 openSUSE Leap 15.3:blas-devel-3.5.0-4.6.1 openSUSE Leap 15.3:blas-devel-32bit-3.5.0-4.6.1 openSUSE Leap 15.3:blas-devel-static-3.5.0-4.6.1 openSUSE Leap 15.3:blas-man-3.5.0-4.6.1 openSUSE Leap 15.3:lapack-devel-3.5.0-4.6.1 openSUSE Leap 15.3:lapack-devel-32bit-3.5.0-4.6.1 openSUSE Leap 15.3:lapack-devel-static-3.5.0-4.6.1 openSUSE Leap 15.3:lapack-man-3.5.0-4.6.1 openSUSE Leap 15.3:lapacke-devel-3.5.0-4.6.1 openSUSE Leap 15.3:lapacke-devel-32bit-3.5.0-4.6.1 openSUSE Leap 15.3:lapacke-devel-static-3.5.0-4.6.1 openSUSE Leap 15.3:libblas3-3.5.0-4.6.1 openSUSE Leap 15.3:libblas3-32bit-3.5.0-4.6.1 openSUSE Leap 15.3:liblapack3-3.5.0-4.6.1 openSUSE Leap 15.3:liblapack3-32bit-3.5.0-4.6.1 openSUSE Leap 15.3:liblapacke3-3.5.0-4.6.1 openSUSE Leap 15.3:liblapacke3-32bit-3.5.0-4.6.1 moderate 6.4 AV:N/AC:L/Au:N/C:P/I:N/A:P 4.7 CVSS:3.1/AV:L/AC:H/PR:N/UI:R/S:U/C:N/I:N/A:H To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://lists.opensuse.org/archives/list/security-announce@lists.opensuse.org/thread/6Y4WJU3KSP5LSKZL7KZ3ZTSCG3EWFTGE/ https://www.suse.com/security/cve/CVE-2021-4048.html CVE-2021-4048 https://bugzilla.suse.com/1193562 SUSE Bug 1193562