openSUSE-SU-2021:0300-1

Security update for mumble

No scoreFix available

openSUSE-SU-2021:0300-1 is a vulnerability with no CVSS score yet in mumble, published February 16, 2021. No source lists public exploit code. Fixed in mumble 1.3.4-lp152.2.6.1.

What does this mean?

Severity: UnratedNo CVSS score yet
Exploit chance: UnscoredNo EPSS score yet
Exploitation: None knownNot on CISA’s or ENISA’s lists
Fixed in: 1.3.4-lp152.2.6.1mumble

Description

This update for mumble fixes the following issues:

mumble was updated to 1.3.4:

Fix use of outdated (non-existent) notification icon names
Fix Security vulnerability caused by allowing non http/https URL schemes in public server list (boo#1182123)
Server: Fix Exit status for actions like --version or --supw
Fix packet loss & audio artifacts caused by OCB2 XEX* mitigation

update apparmor profiles to get warning free again on 15.2
- use abstractions for ssl files
- allow inet dgram sockets as mumble can also work via udp
- allow netlink socket (probably for dbus)
- properly allow lsb_release again
- add support for optional local include
start murmurd directly as user mumble-server it gets rid of the dac_override/setgid/setuid/chown permissions

Update to upstream version 1.3.3

Client:

Fixed: Chatbox invisble (zero height) (#4388)
Fixed: Handling of invalid packet sizes (#4394)
Fixed: Race-condition leading to loss of shortcuts (#4430)
Fixed: Link in About dialog is now clickable again (#4454)
Fixed: Sizing issues in ACL-Editor (#4455)
Improved: PulseAudio now always samples at 48 kHz (#4449)

Server:

Fixed: Crash due to problems when using PostgreSQL (#4370)
Fixed: Handling of invalid package sizes (#4392)

Affected packages

Affected packages
Package	Affected	Fixed
`mumble` openSUSE:Leap 15.2	before 1.3.4-lp152.2.6.1	1.3.4-lp152.2.6.1

What each source reports

OSVNo score

Security update for mumble