December 2022 - openSUSE Security Announce

SUSE-SU-2022:4350-1: important: Security update for buildah
by opensuse-security＠opensuse.org 07 Dec '22

07 Dec '22

SUSE Security Update: Security update for buildah ______________________________________________________________________________ Announcement ID: SUSE-SU-2022:4350-1 Rating: important References: #1167864 #1202812 Cross-References: CVE-2020-10696 CVE-2022-2990 CVSS scores: CVE-2020-10696 (NVD) : 8.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H CVE-2020-10696 (SUSE): 8.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H CVE-2022-2990 (NVD) : 7.1 CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N CVE-2022-2990 (SUSE): 4.4 CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N Affected Products: SUSE Enterprise Storage 7.1 SUSE Linux Enterprise High Performance Computing 15-SP3 SUSE Linux Enterprise Module for Containers 15-SP3 SUSE Linux Enterprise Server 15-SP3 SUSE Linux Enterprise Server for SAP Applications 15-SP3 SUSE Manager Proxy 4.2 SUSE Manager Retail Branch Server 4.2 SUSE Manager Server 4.2 openSUSE Leap 15.3 ______________________________________________________________________________ An update that fixes two vulnerabilities is now available. Description: This update for buildah fixes the following issues: Version update to 1.28.2. - CVE-2022-2990: Fixed a possible information disclosure and modification vulnerability (bsc#1202812). - CVE-2020-10696: Fixed an issue with a crafted input tar file that may lead to a local file overwriting during image build process (bsc#1167864). Patch Instructions: To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 15.3: zypper in -t patch openSUSE-SLE-15.3-2022-4350=1 - SUSE Linux Enterprise Module for Containers 15-SP3: zypper in -t patch SUSE-SLE-Module-Containers-15-SP3-2022-4350=1 Package List: - openSUSE Leap 15.3 (aarch64 ppc64le s390x x86_64): buildah-1.28.2-150300.8.14.1 - SUSE Linux Enterprise Module for Containers 15-SP3 (aarch64 ppc64le s390x x86_64): buildah-1.28.2-150300.8.14.1 References: https://www.suse.com/security/cve/CVE-2020-10696.html https://www.suse.com/security/cve/CVE-2022-2990.html https://bugzilla.suse.com/1167864 https://bugzilla.suse.com/1202812

1 0

SUSE-SU-2022:4349-1: important: Security update for buildah
by opensuse-security＠opensuse.org 07 Dec '22

07 Dec '22

SUSE Security Update: Security update for buildah ______________________________________________________________________________ Announcement ID: SUSE-SU-2022:4349-1 Rating: important References: #1167864 #1202812 Cross-References: CVE-2020-10696 CVE-2022-2990 CVSS scores: CVE-2020-10696 (NVD) : 8.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H CVE-2020-10696 (SUSE): 8.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H CVE-2022-2990 (NVD) : 7.1 CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N CVE-2022-2990 (SUSE): 4.4 CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N Affected Products: SUSE Linux Enterprise High Performance Computing 15-SP4 SUSE Linux Enterprise Module for Containers 15-SP4 SUSE Linux Enterprise Server 15-SP4 SUSE Linux Enterprise Server for SAP Applications 15-SP4 SUSE Manager Proxy 4.3 SUSE Manager Retail Branch Server 4.3 SUSE Manager Server 4.3 openSUSE Leap 15.4 ______________________________________________________________________________ An update that fixes two vulnerabilities is now available. Description: This update for buildah fixes the following issues: Version update to 1.28.2. - CVE-2022-2990: Fixed a possible information disclosure and modification vulnerability (bsc#1202812). - CVE-2020-10696: Fixed an issue with a crafted input tar file that may lead to a local file overwriting during image build process (bsc#1167864). Patch Instructions: To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 15.4: zypper in -t patch openSUSE-SLE-15.4-2022-4349=1 - SUSE Linux Enterprise Module for Containers 15-SP4: zypper in -t patch SUSE-SLE-Module-Containers-15-SP4-2022-4349=1 Package List: - openSUSE Leap 15.4 (aarch64 ppc64le s390x x86_64): buildah-1.28.2-150400.3.11.1 - SUSE Linux Enterprise Module for Containers 15-SP4 (aarch64 ppc64le s390x x86_64): buildah-1.28.2-150400.3.11.1 References: https://www.suse.com/security/cve/CVE-2020-10696.html https://www.suse.com/security/cve/CVE-2022-2990.html https://bugzilla.suse.com/1167864 https://bugzilla.suse.com/1202812

1 0

SUSE-SU-2022:4334-1: important: Security update for MozillaThunderbird
by opensuse-security＠opensuse.org 06 Dec '22

06 Dec '22

SUSE Security Update: Security update for MozillaThunderbird ______________________________________________________________________________ Announcement ID: SUSE-SU-2022:4334-1 Rating: important References: #1205941 Cross-References: CVE-2022-45414 CVSS scores: CVE-2022-45414 (SUSE): 6.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:L Affected Products: SUSE Enterprise Storage 7.1 SUSE Linux Enterprise Desktop 15-SP3 SUSE Linux Enterprise Desktop 15-SP4 SUSE Linux Enterprise High Performance Computing 15-SP3 SUSE Linux Enterprise High Performance Computing 15-SP4 SUSE Linux Enterprise Module for Packagehub Subpackages 15-SP3 SUSE Linux Enterprise Module for Packagehub Subpackages 15-SP4 SUSE Linux Enterprise Server 15-SP3 SUSE Linux Enterprise Server 15-SP4 SUSE Linux Enterprise Server for SAP Applications 15-SP3 SUSE Linux Enterprise Server for SAP Applications 15-SP4 SUSE Linux Enterprise Workstation Extension 15-SP3 SUSE Linux Enterprise Workstation Extension 15-SP4 SUSE Manager Proxy 4.2 SUSE Manager Proxy 4.3 SUSE Manager Retail Branch Server 4.2 SUSE Manager Retail Branch Server 4.3 SUSE Manager Server 4.2 SUSE Manager Server 4.3 openSUSE Leap 15.3 openSUSE Leap 15.4 ______________________________________________________________________________ An update that fixes one vulnerability is now available. Description: This update for MozillaThunderbird fixes the following issues: Update to version 102.5.1: - CVE-2022-45414: Quoting from an HTML email with certain tags will trigger network requests and load remote content, regardless of a configuration to block remote content (bsc#1205941). Patch Instructions: To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 15.4: zypper in -t patch openSUSE-SLE-15.4-2022-4334=1 - openSUSE Leap 15.3: zypper in -t patch openSUSE-SLE-15.3-2022-4334=1 - SUSE Linux Enterprise Workstation Extension 15-SP4: zypper in -t patch SUSE-SLE-Product-WE-15-SP4-2022-4334=1 - SUSE Linux Enterprise Workstation Extension 15-SP3: zypper in -t patch SUSE-SLE-Product-WE-15-SP3-2022-4334=1 - SUSE Linux Enterprise Module for Packagehub Subpackages 15-SP4: zypper in -t patch SUSE-SLE-Module-Packagehub-Subpackages-15-SP4-2022-4334=1 - SUSE Linux Enterprise Module for Packagehub Subpackages 15-SP3: zypper in -t patch SUSE-SLE-Module-Packagehub-Subpackages-15-SP3-2022-4334=1 Package List: - openSUSE Leap 15.4 (aarch64 ppc64le s390x x86_64): MozillaThunderbird-102.5.1-150200.8.93.1 MozillaThunderbird-debuginfo-102.5.1-150200.8.93.1 MozillaThunderbird-debugsource-102.5.1-150200.8.93.1 MozillaThunderbird-translations-common-102.5.1-150200.8.93.1 MozillaThunderbird-translations-other-102.5.1-150200.8.93.1 - openSUSE Leap 15.3 (aarch64 ppc64le s390x x86_64): MozillaThunderbird-102.5.1-150200.8.93.1 MozillaThunderbird-debuginfo-102.5.1-150200.8.93.1 MozillaThunderbird-debugsource-102.5.1-150200.8.93.1 MozillaThunderbird-translations-common-102.5.1-150200.8.93.1 MozillaThunderbird-translations-other-102.5.1-150200.8.93.1 - SUSE Linux Enterprise Workstation Extension 15-SP4 (x86_64): MozillaThunderbird-102.5.1-150200.8.93.1 MozillaThunderbird-debuginfo-102.5.1-150200.8.93.1 MozillaThunderbird-debugsource-102.5.1-150200.8.93.1 MozillaThunderbird-translations-common-102.5.1-150200.8.93.1 MozillaThunderbird-translations-other-102.5.1-150200.8.93.1 - SUSE Linux Enterprise Workstation Extension 15-SP3 (x86_64): MozillaThunderbird-102.5.1-150200.8.93.1 MozillaThunderbird-debuginfo-102.5.1-150200.8.93.1 MozillaThunderbird-debugsource-102.5.1-150200.8.93.1 MozillaThunderbird-translations-common-102.5.1-150200.8.93.1 MozillaThunderbird-translations-other-102.5.1-150200.8.93.1 - SUSE Linux Enterprise Module for Packagehub Subpackages 15-SP4 (aarch64 ppc64le s390x): MozillaThunderbird-102.5.1-150200.8.93.1 MozillaThunderbird-debuginfo-102.5.1-150200.8.93.1 MozillaThunderbird-debugsource-102.5.1-150200.8.93.1 MozillaThunderbird-translations-common-102.5.1-150200.8.93.1 MozillaThunderbird-translations-other-102.5.1-150200.8.93.1 - SUSE Linux Enterprise Module for Packagehub Subpackages 15-SP3 (aarch64 ppc64le s390x): MozillaThunderbird-102.5.1-150200.8.93.1 MozillaThunderbird-debuginfo-102.5.1-150200.8.93.1 MozillaThunderbird-debugsource-102.5.1-150200.8.93.1 MozillaThunderbird-translations-common-102.5.1-150200.8.93.1 MozillaThunderbird-translations-other-102.5.1-150200.8.93.1 References: https://www.suse.com/security/cve/CVE-2022-45414.html https://bugzilla.suse.com/1205941

1 0

openSUSE-SU-2022:10229-1: important: Security update for chromium
by opensuse-security＠opensuse.org 04 Dec '22

04 Dec '22

openSUSE Security Update: Security update for chromium ______________________________________________________________________________ Announcement ID: openSUSE-SU-2022:10229-1 Rating: important References: #1205871 Cross-References: CVE-2022-4174 CVE-2022-4175 CVE-2022-4176 CVE-2022-4177 CVE-2022-4178 CVE-2022-4179 CVE-2022-4180 CVE-2022-4181 CVE-2022-4182 CVE-2022-4183 CVE-2022-4184 CVE-2022-4185 CVE-2022-4186 CVE-2022-4187 CVE-2022-4188 CVE-2022-4189 CVE-2022-4190 CVE-2022-4191 CVE-2022-4192 CVE-2022-4193 CVE-2022-4194 CVE-2022-4195 CVSS scores: CVE-2022-4174 (NVD) : 8.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H CVE-2022-4175 (NVD) : 8.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H CVE-2022-4176 (NVD) : 8.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H CVE-2022-4177 (NVD) : 8.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H CVE-2022-4178 (NVD) : 8.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H CVE-2022-4179 (NVD) : 8.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H CVE-2022-4180 (NVD) : 8.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H CVE-2022-4181 (NVD) : 8.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H CVE-2022-4182 (NVD) : 4.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N CVE-2022-4183 (NVD) : 4.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N CVE-2022-4184 (NVD) : 4.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N CVE-2022-4185 (NVD) : 4.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N CVE-2022-4186 (NVD) : 4.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N CVE-2022-4187 (NVD) : 6.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N CVE-2022-4188 (NVD) : 4.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N CVE-2022-4189 (NVD) : 4.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N CVE-2022-4190 (NVD) : 8.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H CVE-2022-4191 (NVD) : 8.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H CVE-2022-4192 (NVD) : 8.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H CVE-2022-4193 (NVD) : 8.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H CVE-2022-4194 (NVD) : 8.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H CVE-2022-4195 (NVD) : 4.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N Affected Products: openSUSE Backports SLE-15-SP3 openSUSE Backports SLE-15-SP4 ______________________________________________________________________________ An update that fixes 22 vulnerabilities is now available. Description: This update for chromium fixes the following issues: Chromium 108.0.5359.71 (boo#1205871) - CVE-2022-4174: Type Confusion in V8. - CVE-2022-4175: Use after free in Camera Capture. - CVE-2022-4176: Out of bounds write in Lacros Graphics. - CVE-2022-4177: Use after free in Extensions. - CVE-2022-4178: Use after free in Mojo. - CVE-2022-4179: Use after free in Audio. - CVE-2022-4180: Use after free in Mojo. - CVE-2022-4181: Use after free in Forms. - CVE-2022-4182: Inappropriate implementation in Fenced Frames. - CVE-2022-4183: Insufficient policy enforcement in Popup Blocker. - CVE-2022-4184: Insufficient policy enforcement in Autofill. - CVE-2022-4185: Inappropriate implementation in Navigation. - CVE-2022-4186: Insufficient validation of untrusted input in Downloads. - CVE-2022-4187: Insufficient policy enforcement in DevTools. - CVE-2022-4188: Insufficient validation of untrusted input in CORS. - CVE-2022-4189: Insufficient policy enforcement in DevTools. - CVE-2022-4190: Insufficient data validation in Directory. - CVE-2022-4191: Use after free in Sign-In. - CVE-2022-4192: Use after free in Live Caption. - CVE-2022-4193: Insufficient policy enforcement in File System API. - CVE-2022-4194: Use after free in Accessibility. - CVE-2022-4195: Insufficient policy enforcement in Safe Browsing. Patch Instructions: To install this openSUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Backports SLE-15-SP4: zypper in -t patch openSUSE-2022-10229=1 - openSUSE Backports SLE-15-SP3: zypper in -t patch openSUSE-2022-10229=1 Package List: - openSUSE Backports SLE-15-SP4 (aarch64 x86_64): chromedriver-108.0.5359.71-bp154.2.49.1 chromedriver-debuginfo-108.0.5359.71-bp154.2.49.1 chromium-108.0.5359.71-bp154.2.49.1 chromium-debuginfo-108.0.5359.71-bp154.2.49.1 - openSUSE Backports SLE-15-SP3 (aarch64 x86_64): chromedriver-108.0.5359.71-bp153.2.142.1 chromium-108.0.5359.71-bp153.2.142.1 References: https://www.suse.com/security/cve/CVE-2022-4174.html https://www.suse.com/security/cve/CVE-2022-4175.html https://www.suse.com/security/cve/CVE-2022-4176.html https://www.suse.com/security/cve/CVE-2022-4177.html https://www.suse.com/security/cve/CVE-2022-4178.html https://www.suse.com/security/cve/CVE-2022-4179.html https://www.suse.com/security/cve/CVE-2022-4180.html https://www.suse.com/security/cve/CVE-2022-4181.html https://www.suse.com/security/cve/CVE-2022-4182.html https://www.suse.com/security/cve/CVE-2022-4183.html https://www.suse.com/security/cve/CVE-2022-4184.html https://www.suse.com/security/cve/CVE-2022-4185.html https://www.suse.com/security/cve/CVE-2022-4186.html https://www.suse.com/security/cve/CVE-2022-4187.html https://www.suse.com/security/cve/CVE-2022-4188.html https://www.suse.com/security/cve/CVE-2022-4189.html https://www.suse.com/security/cve/CVE-2022-4190.html https://www.suse.com/security/cve/CVE-2022-4191.html https://www.suse.com/security/cve/CVE-2022-4192.html https://www.suse.com/security/cve/CVE-2022-4193.html https://www.suse.com/security/cve/CVE-2022-4194.html https://www.suse.com/security/cve/CVE-2022-4195.html https://bugzilla.suse.com/1205871

1 0

openSUSE-SU-2022:10230-1: moderate: Security update for cherrytree
by opensuse-security＠opensuse.org 04 Dec '22

04 Dec '22

openSUSE Security Update: Security update for cherrytree ______________________________________________________________________________ Announcement ID: openSUSE-SU-2022:10230-1 Rating: moderate References: #1202513 Cross-References: CVE-2022-35133 CVSS scores: CVE-2022-35133 (NVD) : 6.1 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N Affected Products: openSUSE Backports SLE-15-SP4 ______________________________________________________________________________ An update that fixes one vulnerability is now available. Description: cherrytree was updated to version 0.99.49+3: * Legacy_canonicalize_filename: manage empty filename, (gh#giuspen/cherrytree#2118) * added command line option '--anchor AnchorName' that in addition to existing '--node NodeName' allows to open a document focusing an anchor in a node. * Changed non configurable keyboard shortcuts for codebox width and table column width to use parenthesis open instead of backslash, (gh#giuspen/cherrytree#2113). * Fixed crash on double exit from systray icon right click menu, (gh#giuspen/cherrytree#2114). * Added keyboard shortcuts to toolbar tooltips, (gh#giuspen/cherrytree#2106). * Fixed export to HTML crash, (gh#giuspen/cherrytree#2109). * Force turning off portal usage since it does not work on all distros, (gh#giuspen/cherrytree#2111). * Improved dialog confirmation before executing the code. * Additonal changes for core22, (gh#giuspen/cherrytree#2110). * Allow to disable the dialog asking for confirmation before executing the code. * Fixed bulleted list unindent (Shift+Tab) crash, (gh#giuspen/cherrytree#2103). * Add home plug, (gh#giuspen/cherrytree#2101 and gh#giuspen/cherrytree#2102). * Linux menu launcher run cherrytree in a new instance, (gh#giuspen/cherrytree#2077). * Fixed crash on print/export as pdf of a sequence of characters without spaces longer that the page width, such as a very long URL, (gh#giuspen/cherrytree#2045). * Fixed wrongly entering column mode when using keyboard shortcuts with <Ctrl><Alt> such as insert codebox, (gh#giuspen/cherrytree#2075). * Added syntax highlighting support for GDScript. * Fixed tooltip and cursor not reset after hovering link and then navigating to non rich text node. * Support for accent insensitive search - added letters with subordinate dots, (gh#giuspen/cherrytree#1981). * Translation updates. - Developer advised fixed cross-site scripting (XSS) vulnerability that allows attackers to execute arbitrary web scripts or HTML via a crafted payload injected into the Name text field when creating a node, (boo#1202513, gh#giuspen/cherrytree#2099 and CVE-2022-35133). Update to version 0.99.48: * Added support for right to left languages in export to html and pdf (gh#giuspen/cherrytree#2044, gh#giuspen/cherrytree#1668 and gh#giuspen/cherrytree# #698). * In order to support the right to left languages in export to html, the resulting html text lines are no longer LINE<br/> but <p>LINE</p>. * Fixed in export to pdf the link to node+anchor with non ascii anchor name. * Improved detection of missing executables required for rendering LatexBoxes. These dependencies are no longer mandatory (gh#giuspen/cherrytree#2033). * Added help to the user to show again a hidden menubar (gh#giuspen/cherrytree#1927 and gh#giuspen/cherrytree#2054). * Pressing Tab on the very latest table cell now adds a new table line and moves to its first cell. * Fixed issue with relative links to files and folders and documents moved between linux and windows. * In export to html and txt multiple files, now appending the node id to the file names to support multiple nodes with the same name. * Added syntax highlight support for solidity (gh#giuspen/cherrytree#2030). * After issues with the domain giuspen.com, the domain changed to giuspen.net and giuspen.com will eventually go. Update to version 0.99.47+2: * Added support for latex math equations. * Added copy/paste of tree nodes and subnodes between multiple opened files. * Restored support for drag and drop of text selection. Now rich text content is preserved. * Added syntax highlighting for HCL. * Fixed issue at reset toolbar in preferences dialog when menubar in titlebar. * Added command line option (-S/--secondary_session) to run in isolation from a possibly already running main instance. * Updated flatpak script. Update to version 0.99.46+6: * Fixed time created/modified filter on searches for node name and tags. * Changed default keyboard shortcuts using Ctrl+Period to Ctrl+Backslash for clash with latest linux desktops. * Fixed restore window position on Windows and dual screen. * Added strip trailing spaces action to rich text right click menu. * Fixed issue restoring hpaned tree/text position with tree on the right. * Added command line option to pass the password to open an encrypted document. Update to version 0.99.45+10: * added language Arabic * fixed time created/modified filter on searches for node name and tags * just ninja build debug print * added strip trailing spaces action to rich text right click menu * minor improvement to previous commit * fixed copy fromm codebox and pasting to rich text unwanted additional characters Patch Instructions: To install this openSUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Backports SLE-15-SP4: zypper in -t patch openSUSE-2022-10230=1 Package List: - openSUSE Backports SLE-15-SP4 (aarch64 s390x x86_64): cherrytree-0.99.49+3-bp154.2.3.2 - openSUSE Backports SLE-15-SP4 (noarch): cherrytree-lang-0.99.49+3-bp154.2.3.2 References: https://www.suse.com/security/cve/CVE-2022-35133.html https://bugzilla.suse.com/1202513

1 0

SUSE-SU-2022:4310-1: important: Security update for emacs
by opensuse-security＠opensuse.org 02 Dec '22

02 Dec '22

SUSE Security Update: Security update for emacs ______________________________________________________________________________ Announcement ID: SUSE-SU-2022:4310-1 Rating: important References: #1205822 Cross-References: CVE-2022-45939 CVSS scores: CVE-2022-45939 (NVD) : 7.8 CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H CVE-2022-45939 (SUSE): 7.8 CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H Affected Products: SUSE CaaS Platform 4.0 SUSE Enterprise Storage 6 SUSE Enterprise Storage 7 SUSE Enterprise Storage 7.1 SUSE Linux Enterprise Desktop 15-SP3 SUSE Linux Enterprise High Performance Computing 15-ESPOS SUSE Linux Enterprise High Performance Computing 15-LTSS SUSE Linux Enterprise High Performance Computing 15-SP1-ESPOS SUSE Linux Enterprise High Performance Computing 15-SP1-LTSS SUSE Linux Enterprise High Performance Computing 15-SP2-ESPOS SUSE Linux Enterprise High Performance Computing 15-SP2-LTSS SUSE Linux Enterprise High Performance Computing 15-SP3 SUSE Linux Enterprise Module for Basesystem 15-SP3 SUSE Linux Enterprise Module for Desktop Applications 15-SP3 SUSE Linux Enterprise Server 15-LTSS SUSE Linux Enterprise Server 15-SP1-BCL SUSE Linux Enterprise Server 15-SP1-LTSS SUSE Linux Enterprise Server 15-SP2-BCL SUSE Linux Enterprise Server 15-SP2-LTSS SUSE Linux Enterprise Server 15-SP3 SUSE Linux Enterprise Server for SAP 15 SUSE Linux Enterprise Server for SAP 15-SP1 SUSE Linux Enterprise Server for SAP 15-SP2 SUSE Linux Enterprise Server for SAP Applications 15-SP3 SUSE Manager Proxy 4.1 SUSE Manager Proxy 4.2 SUSE Manager Retail Branch Server 4.1 SUSE Manager Retail Branch Server 4.2 SUSE Manager Server 4.1 SUSE Manager Server 4.2 openSUSE Leap 15.3 ______________________________________________________________________________ An update that fixes one vulnerability is now available. Description: This update for emacs fixes the following issues: - CVE-2022-45939: Fixed shell command injection via source code files when using ctags (bsc#1205822). Patch Instructions: To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 15.3: zypper in -t patch openSUSE-SLE-15.3-2022-4310=1 - SUSE Manager Server 4.1: zypper in -t patch SUSE-SLE-Product-SUSE-Manager-Server-4.1-2022-4310=1 - SUSE Manager Retail Branch Server 4.1: zypper in -t patch SUSE-SLE-Product-SUSE-Manager-Retail-Branch-Server-4.1-2022-4310=1 - SUSE Manager Proxy 4.1: zypper in -t patch SUSE-SLE-Product-SUSE-Manager-Proxy-4.1-2022-4310=1 - SUSE Linux Enterprise Server for SAP 15-SP2: zypper in -t patch SUSE-SLE-Product-SLES_SAP-15-SP2-2022-4310=1 - SUSE Linux Enterprise Server for SAP 15-SP1: zypper in -t patch SUSE-SLE-Product-SLES_SAP-15-SP1-2022-4310=1 - SUSE Linux Enterprise Server for SAP 15: zypper in -t patch SUSE-SLE-Product-SLES_SAP-15-2022-4310=1 - SUSE Linux Enterprise Server 15-SP2-LTSS: zypper in -t patch SUSE-SLE-Product-SLES-15-SP2-LTSS-2022-4310=1 - SUSE Linux Enterprise Server 15-SP2-BCL: zypper in -t patch SUSE-SLE-Product-SLES-15-SP2-BCL-2022-4310=1 - SUSE Linux Enterprise Server 15-SP1-LTSS: zypper in -t patch SUSE-SLE-Product-SLES-15-SP1-LTSS-2022-4310=1 - SUSE Linux Enterprise Server 15-SP1-BCL: zypper in -t patch SUSE-SLE-Product-SLES-15-SP1-BCL-2022-4310=1 - SUSE Linux Enterprise Server 15-LTSS: zypper in -t patch SUSE-SLE-Product-SLES-15-2022-4310=1 - SUSE Linux Enterprise Module for Desktop Applications 15-SP3: zypper in -t patch SUSE-SLE-Module-Desktop-Applications-15-SP3-2022-4310=1 - SUSE Linux Enterprise Module for Basesystem 15-SP3: zypper in -t patch SUSE-SLE-Module-Basesystem-15-SP3-2022-4310=1 - SUSE Linux Enterprise High Performance Computing 15-SP2-LTSS: zypper in -t patch SUSE-SLE-Product-HPC-15-SP2-LTSS-2022-4310=1 - SUSE Linux Enterprise High Performance Computing 15-SP2-ESPOS: zypper in -t patch SUSE-SLE-Product-HPC-15-SP2-ESPOS-2022-4310=1 - SUSE Linux Enterprise High Performance Computing 15-SP1-LTSS: zypper in -t patch SUSE-SLE-Product-HPC-15-SP1-LTSS-2022-4310=1 - SUSE Linux Enterprise High Performance Computing 15-SP1-ESPOS: zypper in -t patch SUSE-SLE-Product-HPC-15-SP1-ESPOS-2022-4310=1 - SUSE Linux Enterprise High Performance Computing 15-LTSS: zypper in -t patch SUSE-SLE-Product-HPC-15-2022-4310=1 - SUSE Linux Enterprise High Performance Computing 15-ESPOS: zypper in -t patch SUSE-SLE-Product-HPC-15-2022-4310=1 - SUSE Enterprise Storage 7: zypper in -t patch SUSE-Storage-7-2022-4310=1 - SUSE Enterprise Storage 6: zypper in -t patch SUSE-Storage-6-2022-4310=1 - SUSE CaaS Platform 4.0: To install this update, use the SUSE CaaS Platform 'skuba' tool. It will inform you if it detects new updates and let you then trigger updating of the complete cluster in a controlled way. Package List: - openSUSE Leap 15.3 (aarch64 ppc64le s390x x86_64): emacs-25.3-150000.3.12.1 emacs-debuginfo-25.3-150000.3.12.1 emacs-debugsource-25.3-150000.3.12.1 emacs-nox-25.3-150000.3.12.1 emacs-nox-debuginfo-25.3-150000.3.12.1 emacs-x11-25.3-150000.3.12.1 emacs-x11-debuginfo-25.3-150000.3.12.1 etags-25.3-150000.3.12.1 etags-debuginfo-25.3-150000.3.12.1 - openSUSE Leap 15.3 (noarch): emacs-el-25.3-150000.3.12.1 emacs-info-25.3-150000.3.12.1 - SUSE Manager Server 4.1 (ppc64le s390x x86_64): emacs-25.3-150000.3.12.1 emacs-debuginfo-25.3-150000.3.12.1 emacs-debugsource-25.3-150000.3.12.1 emacs-nox-25.3-150000.3.12.1 emacs-nox-debuginfo-25.3-150000.3.12.1 emacs-x11-25.3-150000.3.12.1 emacs-x11-debuginfo-25.3-150000.3.12.1 etags-25.3-150000.3.12.1 etags-debuginfo-25.3-150000.3.12.1 - SUSE Manager Server 4.1 (noarch): emacs-el-25.3-150000.3.12.1 emacs-info-25.3-150000.3.12.1 - SUSE Manager Retail Branch Server 4.1 (noarch): emacs-el-25.3-150000.3.12.1 emacs-info-25.3-150000.3.12.1 - SUSE Manager Retail Branch Server 4.1 (x86_64): emacs-25.3-150000.3.12.1 emacs-debuginfo-25.3-150000.3.12.1 emacs-debugsource-25.3-150000.3.12.1 emacs-nox-25.3-150000.3.12.1 emacs-nox-debuginfo-25.3-150000.3.12.1 emacs-x11-25.3-150000.3.12.1 emacs-x11-debuginfo-25.3-150000.3.12.1 etags-25.3-150000.3.12.1 etags-debuginfo-25.3-150000.3.12.1 - SUSE Manager Proxy 4.1 (x86_64): emacs-25.3-150000.3.12.1 emacs-debuginfo-25.3-150000.3.12.1 emacs-debugsource-25.3-150000.3.12.1 emacs-nox-25.3-150000.3.12.1 emacs-nox-debuginfo-25.3-150000.3.12.1 emacs-x11-25.3-150000.3.12.1 emacs-x11-debuginfo-25.3-150000.3.12.1 etags-25.3-150000.3.12.1 etags-debuginfo-25.3-150000.3.12.1 - SUSE Manager Proxy 4.1 (noarch): emacs-el-25.3-150000.3.12.1 emacs-info-25.3-150000.3.12.1 - SUSE Linux Enterprise Server for SAP 15-SP2 (ppc64le x86_64): emacs-25.3-150000.3.12.1 emacs-debuginfo-25.3-150000.3.12.1 emacs-debugsource-25.3-150000.3.12.1 emacs-nox-25.3-150000.3.12.1 emacs-nox-debuginfo-25.3-150000.3.12.1 emacs-x11-25.3-150000.3.12.1 emacs-x11-debuginfo-25.3-150000.3.12.1 etags-25.3-150000.3.12.1 etags-debuginfo-25.3-150000.3.12.1 - SUSE Linux Enterprise Server for SAP 15-SP2 (noarch): emacs-el-25.3-150000.3.12.1 emacs-info-25.3-150000.3.12.1 - SUSE Linux Enterprise Server for SAP 15-SP1 (ppc64le x86_64): emacs-25.3-150000.3.12.1 emacs-debuginfo-25.3-150000.3.12.1 emacs-debugsource-25.3-150000.3.12.1 emacs-nox-25.3-150000.3.12.1 emacs-nox-debuginfo-25.3-150000.3.12.1 emacs-x11-25.3-150000.3.12.1 emacs-x11-debuginfo-25.3-150000.3.12.1 etags-25.3-150000.3.12.1 etags-debuginfo-25.3-150000.3.12.1 - SUSE Linux Enterprise Server for SAP 15-SP1 (noarch): emacs-el-25.3-150000.3.12.1 emacs-info-25.3-150000.3.12.1 - SUSE Linux Enterprise Server for SAP 15 (ppc64le x86_64): emacs-25.3-150000.3.12.1 emacs-debuginfo-25.3-150000.3.12.1 emacs-debugsource-25.3-150000.3.12.1 emacs-nox-25.3-150000.3.12.1 emacs-nox-debuginfo-25.3-150000.3.12.1 emacs-x11-25.3-150000.3.12.1 emacs-x11-debuginfo-25.3-150000.3.12.1 etags-25.3-150000.3.12.1 etags-debuginfo-25.3-150000.3.12.1 - SUSE Linux Enterprise Server for SAP 15 (noarch): emacs-el-25.3-150000.3.12.1 emacs-info-25.3-150000.3.12.1 - SUSE Linux Enterprise Server 15-SP2-LTSS (aarch64 ppc64le s390x x86_64): emacs-25.3-150000.3.12.1 emacs-debuginfo-25.3-150000.3.12.1 emacs-debugsource-25.3-150000.3.12.1 emacs-nox-25.3-150000.3.12.1 emacs-nox-debuginfo-25.3-150000.3.12.1 emacs-x11-25.3-150000.3.12.1 emacs-x11-debuginfo-25.3-150000.3.12.1 etags-25.3-150000.3.12.1 etags-debuginfo-25.3-150000.3.12.1 - SUSE Linux Enterprise Server 15-SP2-LTSS (noarch): emacs-el-25.3-150000.3.12.1 emacs-info-25.3-150000.3.12.1 - SUSE Linux Enterprise Server 15-SP2-BCL (noarch): emacs-el-25.3-150000.3.12.1 emacs-info-25.3-150000.3.12.1 - SUSE Linux Enterprise Server 15-SP2-BCL (x86_64): emacs-25.3-150000.3.12.1 emacs-debuginfo-25.3-150000.3.12.1 emacs-debugsource-25.3-150000.3.12.1 emacs-nox-25.3-150000.3.12.1 emacs-nox-debuginfo-25.3-150000.3.12.1 emacs-x11-25.3-150000.3.12.1 emacs-x11-debuginfo-25.3-150000.3.12.1 etags-25.3-150000.3.12.1 etags-debuginfo-25.3-150000.3.12.1 - SUSE Linux Enterprise Server 15-SP1-LTSS (aarch64 ppc64le s390x x86_64): emacs-25.3-150000.3.12.1 emacs-debuginfo-25.3-150000.3.12.1 emacs-debugsource-25.3-150000.3.12.1 emacs-nox-25.3-150000.3.12.1 emacs-nox-debuginfo-25.3-150000.3.12.1 emacs-x11-25.3-150000.3.12.1 emacs-x11-debuginfo-25.3-150000.3.12.1 etags-25.3-150000.3.12.1 etags-debuginfo-25.3-150000.3.12.1 - SUSE Linux Enterprise Server 15-SP1-LTSS (noarch): emacs-el-25.3-150000.3.12.1 emacs-info-25.3-150000.3.12.1 - SUSE Linux Enterprise Server 15-SP1-BCL (noarch): emacs-el-25.3-150000.3.12.1 emacs-info-25.3-150000.3.12.1 - SUSE Linux Enterprise Server 15-SP1-BCL (x86_64): emacs-25.3-150000.3.12.1 emacs-debuginfo-25.3-150000.3.12.1 emacs-debugsource-25.3-150000.3.12.1 emacs-nox-25.3-150000.3.12.1 emacs-nox-debuginfo-25.3-150000.3.12.1 emacs-x11-25.3-150000.3.12.1 emacs-x11-debuginfo-25.3-150000.3.12.1 etags-25.3-150000.3.12.1 etags-debuginfo-25.3-150000.3.12.1 - SUSE Linux Enterprise Server 15-LTSS (aarch64 s390x): emacs-25.3-150000.3.12.1 emacs-debuginfo-25.3-150000.3.12.1 emacs-debugsource-25.3-150000.3.12.1 emacs-nox-25.3-150000.3.12.1 emacs-nox-debuginfo-25.3-150000.3.12.1 emacs-x11-25.3-150000.3.12.1 emacs-x11-debuginfo-25.3-150000.3.12.1 etags-25.3-150000.3.12.1 etags-debuginfo-25.3-150000.3.12.1 - SUSE Linux Enterprise Server 15-LTSS (noarch): emacs-el-25.3-150000.3.12.1 emacs-info-25.3-150000.3.12.1 - SUSE Linux Enterprise Module for Desktop Applications 15-SP3 (aarch64 ppc64le s390x x86_64): emacs-debuginfo-25.3-150000.3.12.1 emacs-debugsource-25.3-150000.3.12.1 emacs-x11-25.3-150000.3.12.1 emacs-x11-debuginfo-25.3-150000.3.12.1 - SUSE Linux Enterprise Module for Basesystem 15-SP3 (aarch64 ppc64le s390x x86_64): emacs-25.3-150000.3.12.1 emacs-debuginfo-25.3-150000.3.12.1 emacs-debugsource-25.3-150000.3.12.1 emacs-nox-25.3-150000.3.12.1 emacs-nox-debuginfo-25.3-150000.3.12.1 etags-25.3-150000.3.12.1 etags-debuginfo-25.3-150000.3.12.1 - SUSE Linux Enterprise Module for Basesystem 15-SP3 (noarch): emacs-el-25.3-150000.3.12.1 emacs-info-25.3-150000.3.12.1 - SUSE Linux Enterprise High Performance Computing 15-SP2-LTSS (aarch64 x86_64): emacs-25.3-150000.3.12.1 emacs-debuginfo-25.3-150000.3.12.1 emacs-debugsource-25.3-150000.3.12.1 emacs-nox-25.3-150000.3.12.1 emacs-nox-debuginfo-25.3-150000.3.12.1 emacs-x11-25.3-150000.3.12.1 emacs-x11-debuginfo-25.3-150000.3.12.1 etags-25.3-150000.3.12.1 etags-debuginfo-25.3-150000.3.12.1 - SUSE Linux Enterprise High Performance Computing 15-SP2-LTSS (noarch): emacs-el-25.3-150000.3.12.1 emacs-info-25.3-150000.3.12.1 - SUSE Linux Enterprise High Performance Computing 15-SP2-ESPOS (aarch64 x86_64): emacs-25.3-150000.3.12.1 emacs-debuginfo-25.3-150000.3.12.1 emacs-debugsource-25.3-150000.3.12.1 emacs-nox-25.3-150000.3.12.1 emacs-nox-debuginfo-25.3-150000.3.12.1 emacs-x11-25.3-150000.3.12.1 emacs-x11-debuginfo-25.3-150000.3.12.1 etags-25.3-150000.3.12.1 etags-debuginfo-25.3-150000.3.12.1 - SUSE Linux Enterprise High Performance Computing 15-SP2-ESPOS (noarch): emacs-el-25.3-150000.3.12.1 emacs-info-25.3-150000.3.12.1 - SUSE Linux Enterprise High Performance Computing 15-SP1-LTSS (aarch64 x86_64): emacs-25.3-150000.3.12.1 emacs-debuginfo-25.3-150000.3.12.1 emacs-debugsource-25.3-150000.3.12.1 emacs-nox-25.3-150000.3.12.1 emacs-nox-debuginfo-25.3-150000.3.12.1 emacs-x11-25.3-150000.3.12.1 emacs-x11-debuginfo-25.3-150000.3.12.1 etags-25.3-150000.3.12.1 etags-debuginfo-25.3-150000.3.12.1 - SUSE Linux Enterprise High Performance Computing 15-SP1-LTSS (noarch): emacs-el-25.3-150000.3.12.1 emacs-info-25.3-150000.3.12.1 - SUSE Linux Enterprise High Performance Computing 15-SP1-ESPOS (aarch64 x86_64): emacs-25.3-150000.3.12.1 emacs-debuginfo-25.3-150000.3.12.1 emacs-debugsource-25.3-150000.3.12.1 emacs-nox-25.3-150000.3.12.1 emacs-nox-debuginfo-25.3-150000.3.12.1 emacs-x11-25.3-150000.3.12.1 emacs-x11-debuginfo-25.3-150000.3.12.1 etags-25.3-150000.3.12.1 etags-debuginfo-25.3-150000.3.12.1 - SUSE Linux Enterprise High Performance Computing 15-SP1-ESPOS (noarch): emacs-el-25.3-150000.3.12.1 emacs-info-25.3-150000.3.12.1 - SUSE Linux Enterprise High Performance Computing 15-LTSS (aarch64 x86_64): emacs-25.3-150000.3.12.1 emacs-debuginfo-25.3-150000.3.12.1 emacs-debugsource-25.3-150000.3.12.1 emacs-nox-25.3-150000.3.12.1 emacs-nox-debuginfo-25.3-150000.3.12.1 emacs-x11-25.3-150000.3.12.1 emacs-x11-debuginfo-25.3-150000.3.12.1 etags-25.3-150000.3.12.1 etags-debuginfo-25.3-150000.3.12.1 - SUSE Linux Enterprise High Performance Computing 15-LTSS (noarch): emacs-el-25.3-150000.3.12.1 emacs-info-25.3-150000.3.12.1 - SUSE Linux Enterprise High Performance Computing 15-ESPOS (aarch64 x86_64): emacs-25.3-150000.3.12.1 emacs-debuginfo-25.3-150000.3.12.1 emacs-debugsource-25.3-150000.3.12.1 emacs-nox-25.3-150000.3.12.1 emacs-nox-debuginfo-25.3-150000.3.12.1 emacs-x11-25.3-150000.3.12.1 emacs-x11-debuginfo-25.3-150000.3.12.1 etags-25.3-150000.3.12.1 etags-debuginfo-25.3-150000.3.12.1 - SUSE Linux Enterprise High Performance Computing 15-ESPOS (noarch): emacs-el-25.3-150000.3.12.1 emacs-info-25.3-150000.3.12.1 - SUSE Enterprise Storage 7 (aarch64 x86_64): emacs-25.3-150000.3.12.1 emacs-debuginfo-25.3-150000.3.12.1 emacs-debugsource-25.3-150000.3.12.1 emacs-nox-25.3-150000.3.12.1 emacs-nox-debuginfo-25.3-150000.3.12.1 emacs-x11-25.3-150000.3.12.1 emacs-x11-debuginfo-25.3-150000.3.12.1 etags-25.3-150000.3.12.1 etags-debuginfo-25.3-150000.3.12.1 - SUSE Enterprise Storage 7 (noarch): emacs-el-25.3-150000.3.12.1 emacs-info-25.3-150000.3.12.1 - SUSE Enterprise Storage 6 (aarch64 x86_64): emacs-25.3-150000.3.12.1 emacs-debuginfo-25.3-150000.3.12.1 emacs-debugsource-25.3-150000.3.12.1 emacs-nox-25.3-150000.3.12.1 emacs-nox-debuginfo-25.3-150000.3.12.1 emacs-x11-25.3-150000.3.12.1 emacs-x11-debuginfo-25.3-150000.3.12.1 etags-25.3-150000.3.12.1 etags-debuginfo-25.3-150000.3.12.1 - SUSE Enterprise Storage 6 (noarch): emacs-el-25.3-150000.3.12.1 emacs-info-25.3-150000.3.12.1 - SUSE CaaS Platform 4.0 (noarch): emacs-el-25.3-150000.3.12.1 emacs-info-25.3-150000.3.12.1 - SUSE CaaS Platform 4.0 (x86_64): emacs-25.3-150000.3.12.1 emacs-debuginfo-25.3-150000.3.12.1 emacs-debugsource-25.3-150000.3.12.1 emacs-nox-25.3-150000.3.12.1 emacs-nox-debuginfo-25.3-150000.3.12.1 emacs-x11-25.3-150000.3.12.1 emacs-x11-debuginfo-25.3-150000.3.12.1 etags-25.3-150000.3.12.1 etags-debuginfo-25.3-150000.3.12.1 References: https://www.suse.com/security/cve/CVE-2022-45939.html https://bugzilla.suse.com/1205822

1 0

SUSE-SU-2022:4309-1: moderate: Security update for busybox
by opensuse-security＠opensuse.org 01 Dec '22

01 Dec '22

SUSE Security Update: Security update for busybox ______________________________________________________________________________ Announcement ID: SUSE-SU-2022:4309-1 Rating: moderate References: #1199744 Cross-References: CVE-2022-30065 CVSS scores: CVE-2022-30065 (NVD) : 7.8 CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H CVE-2022-30065 (SUSE): 5.5 CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H Affected Products: SUSE Enterprise Storage 7.1 SUSE Linux Enterprise Desktop 15-SP3 SUSE Linux Enterprise High Performance Computing 15-SP3 SUSE Linux Enterprise Module for Basesystem 15-SP3 SUSE Linux Enterprise Server 15-SP3 SUSE Linux Enterprise Server for SAP Applications 15-SP3 SUSE Manager Proxy 4.2 SUSE Manager Retail Branch Server 4.2 SUSE Manager Server 4.2 openSUSE Leap 15.3 ______________________________________________________________________________ An update that fixes one vulnerability is now available. Description: This update for busybox fixes the following issues: - CVE-2022-30065: Fixed use-after-free in the AWK applet (bsc#1199744). Patch Instructions: To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 15.3: zypper in -t patch openSUSE-SLE-15.3-2022-4309=1 - SUSE Linux Enterprise Module for Basesystem 15-SP3: zypper in -t patch SUSE-SLE-Module-Basesystem-15-SP3-2022-4309=1 Package List: - openSUSE Leap 15.3 (aarch64 ppc64le s390x x86_64): busybox-1.35.0-150000.4.17.1 busybox-static-1.35.0-150000.4.17.1 - SUSE Linux Enterprise Module for Basesystem 15-SP3 (aarch64 ppc64le s390x x86_64): busybox-1.35.0-150000.4.17.1 busybox-static-1.35.0-150000.4.17.1 References: https://www.suse.com/security/cve/CVE-2022-30065.html https://bugzilla.suse.com/1199744

1 0

SUSE-SU-2022:4308-1: moderate: Security update for virt-v2v
by opensuse-security＠opensuse.org 01 Dec '22

01 Dec '22

SUSE Security Update: Security update for virt-v2v ______________________________________________________________________________ Announcement ID: SUSE-SU-2022:4308-1 Rating: moderate References: #1201064 Cross-References: CVE-2022-2211 CVSS scores: CVE-2022-2211 (NVD) : 6.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H CVE-2022-2211 (SUSE): 5.5 CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H Affected Products: SUSE Linux Enterprise High Performance Computing 15-SP4 SUSE Linux Enterprise Module for Server Applications 15-SP4 SUSE Linux Enterprise Server 15-SP4 SUSE Linux Enterprise Server for SAP Applications 15-SP4 SUSE Manager Proxy 4.3 SUSE Manager Retail Branch Server 4.3 SUSE Manager Server 4.3 openSUSE Leap 15.4 ______________________________________________________________________________ An update that fixes one vulnerability is now available. Description: This update for virt-v2v fixes the following issues: - CVE-2022-2211: Fixed buffer overflow in get_keys (bsc#1201064). Patch Instructions: To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 15.4: zypper in -t patch openSUSE-SLE-15.4-2022-4308=1 - SUSE Linux Enterprise Module for Server Applications 15-SP4: zypper in -t patch SUSE-SLE-Module-Server-Applications-15-SP4-2022-4308=1 Package List: - openSUSE Leap 15.4 (aarch64 ppc64le s390x x86_64): virt-v2v-1.44.2-150400.3.3.1 virt-v2v-debuginfo-1.44.2-150400.3.3.1 virt-v2v-debugsource-1.44.2-150400.3.3.1 - openSUSE Leap 15.4 (noarch): virt-v2v-bash-completion-1.44.2-150400.3.3.1 virt-v2v-man-pages-ja-1.44.2-150400.3.3.1 virt-v2v-man-pages-uk-1.44.2-150400.3.3.1 - SUSE Linux Enterprise Module for Server Applications 15-SP4 (aarch64 ppc64le s390x x86_64): virt-v2v-1.44.2-150400.3.3.1 virt-v2v-debuginfo-1.44.2-150400.3.3.1 virt-v2v-debugsource-1.44.2-150400.3.3.1 - SUSE Linux Enterprise Module for Server Applications 15-SP4 (noarch): virt-v2v-bash-completion-1.44.2-150400.3.3.1 virt-v2v-man-pages-ja-1.44.2-150400.3.3.1 virt-v2v-man-pages-uk-1.44.2-150400.3.3.1 References: https://www.suse.com/security/cve/CVE-2022-2211.html https://bugzilla.suse.com/1201064

1 0

SUSE-SU-2022:4306-1: moderate: Security update for bcel
by opensuse-security＠opensuse.org 01 Dec '22

01 Dec '22

SUSE Security Update: Security update for bcel ______________________________________________________________________________ Announcement ID: SUSE-SU-2022:4306-1 Rating: moderate References: #1205125 Cross-References: CVE-2022-42920 CVSS scores: CVE-2022-42920 (NVD) : 9.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H CVE-2022-42920 (SUSE): 5.4 CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:N/I:L/A:L Affected Products: SUSE Enterprise Storage 7.1 SUSE Linux Enterprise Desktop 15-SP3 SUSE Linux Enterprise Desktop 15-SP4 SUSE Linux Enterprise High Performance Computing 15-SP3 SUSE Linux Enterprise High Performance Computing 15-SP4 SUSE Linux Enterprise Module for Basesystem 15-SP3 SUSE Linux Enterprise Module for Basesystem 15-SP4 SUSE Linux Enterprise Server 15-SP3 SUSE Linux Enterprise Server 15-SP4 SUSE Linux Enterprise Server for SAP Applications 15-SP3 SUSE Linux Enterprise Server for SAP Applications 15-SP4 SUSE Manager Proxy 4.2 SUSE Manager Proxy 4.3 SUSE Manager Retail Branch Server 4.2 SUSE Manager Retail Branch Server 4.3 SUSE Manager Server 4.2 SUSE Manager Server 4.3 openSUSE Leap 15.3 openSUSE Leap 15.4 ______________________________________________________________________________ An update that fixes one vulnerability is now available. Description: This update for bcel fixes the following issues: - CVE-2022-42920: Fixed producing arbitrary bytecode via out-of-bounds writing (bsc#1205125). Patch Instructions: To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 15.4: zypper in -t patch openSUSE-SLE-15.4-2022-4306=1 - openSUSE Leap 15.3: zypper in -t patch openSUSE-SLE-15.3-2022-4306=1 - SUSE Linux Enterprise Module for Basesystem 15-SP4: zypper in -t patch SUSE-SLE-Module-Basesystem-15-SP4-2022-4306=1 - SUSE Linux Enterprise Module for Basesystem 15-SP3: zypper in -t patch SUSE-SLE-Module-Basesystem-15-SP3-2022-4306=1 Package List: - openSUSE Leap 15.4 (noarch): bcel-5.2-150200.11.3.1 - openSUSE Leap 15.3 (noarch): bcel-5.2-150200.11.3.1 - SUSE Linux Enterprise Module for Basesystem 15-SP4 (noarch): bcel-5.2-150200.11.3.1 - SUSE Linux Enterprise Module for Basesystem 15-SP3 (noarch): bcel-5.2-150200.11.3.1 References: https://www.suse.com/security/cve/CVE-2022-42920.html https://bugzilla.suse.com/1205125

1 0

SUSE-SU-2022:4301-1: important: Security update for nodejs10
by opensuse-security＠opensuse.org 01 Dec '22

01 Dec '22

SUSE Security Update: Security update for nodejs10 ______________________________________________________________________________ Announcement ID: SUSE-SU-2022:4301-1 Rating: important References: #1205119 Cross-References: CVE-2022-43548 CVSS scores: CVE-2022-43548 (SUSE): 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N Affected Products: SUSE CaaS Platform 4.0 SUSE Enterprise Storage 6 SUSE Enterprise Storage 7 SUSE Linux Enterprise High Performance Computing 15-ESPOS SUSE Linux Enterprise High Performance Computing 15-LTSS SUSE Linux Enterprise High Performance Computing 15-SP1-ESPOS SUSE Linux Enterprise High Performance Computing 15-SP1-LTSS SUSE Linux Enterprise High Performance Computing 15-SP2-ESPOS SUSE Linux Enterprise High Performance Computing 15-SP2-LTSS SUSE Linux Enterprise Server 15-LTSS SUSE Linux Enterprise Server 15-SP1-BCL SUSE Linux Enterprise Server 15-SP1-LTSS SUSE Linux Enterprise Server 15-SP2-BCL SUSE Linux Enterprise Server 15-SP2-LTSS SUSE Linux Enterprise Server for SAP 15 SUSE Linux Enterprise Server for SAP 15-SP1 SUSE Linux Enterprise Server for SAP 15-SP2 SUSE Manager Proxy 4.1 SUSE Manager Retail Branch Server 4.1 SUSE Manager Server 4.1 openSUSE Leap 15.3 openSUSE Leap 15.4 ______________________________________________________________________________ An update that fixes one vulnerability is now available. Description: This update for nodejs10 fixes the following issues: - CVE-2022-43548: Fixed DNS rebinding in --inspect via invalid octal IP address (bsc#1205119). Patch Instructions: To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 15.4: zypper in -t patch openSUSE-SLE-15.4-2022-4301=1 - openSUSE Leap 15.3: zypper in -t patch openSUSE-SLE-15.3-2022-4301=1 - SUSE Manager Server 4.1: zypper in -t patch SUSE-SLE-Product-SUSE-Manager-Server-4.1-2022-4301=1 - SUSE Manager Retail Branch Server 4.1: zypper in -t patch SUSE-SLE-Product-SUSE-Manager-Retail-Branch-Server-4.1-2022-4301=1 - SUSE Manager Proxy 4.1: zypper in -t patch SUSE-SLE-Product-SUSE-Manager-Proxy-4.1-2022-4301=1 - SUSE Linux Enterprise Server for SAP 15-SP2: zypper in -t patch SUSE-SLE-Product-SLES_SAP-15-SP2-2022-4301=1 - SUSE Linux Enterprise Server for SAP 15-SP1: zypper in -t patch SUSE-SLE-Product-SLES_SAP-15-SP1-2022-4301=1 - SUSE Linux Enterprise Server for SAP 15: zypper in -t patch SUSE-SLE-Product-SLES_SAP-15-2022-4301=1 - SUSE Linux Enterprise Server 15-SP2-LTSS: zypper in -t patch SUSE-SLE-Product-SLES-15-SP2-LTSS-2022-4301=1 - SUSE Linux Enterprise Server 15-SP2-BCL: zypper in -t patch SUSE-SLE-Product-SLES-15-SP2-BCL-2022-4301=1 - SUSE Linux Enterprise Server 15-SP1-LTSS: zypper in -t patch SUSE-SLE-Product-SLES-15-SP1-LTSS-2022-4301=1 - SUSE Linux Enterprise Server 15-SP1-BCL: zypper in -t patch SUSE-SLE-Product-SLES-15-SP1-BCL-2022-4301=1 - SUSE Linux Enterprise Server 15-LTSS: zypper in -t patch SUSE-SLE-Product-SLES-15-2022-4301=1 - SUSE Linux Enterprise High Performance Computing 15-SP2-LTSS: zypper in -t patch SUSE-SLE-Product-HPC-15-SP2-LTSS-2022-4301=1 - SUSE Linux Enterprise High Performance Computing 15-SP2-ESPOS: zypper in -t patch SUSE-SLE-Product-HPC-15-SP2-ESPOS-2022-4301=1 - SUSE Linux Enterprise High Performance Computing 15-SP1-LTSS: zypper in -t patch SUSE-SLE-Product-HPC-15-SP1-LTSS-2022-4301=1 - SUSE Linux Enterprise High Performance Computing 15-SP1-ESPOS: zypper in -t patch SUSE-SLE-Product-HPC-15-SP1-ESPOS-2022-4301=1 - SUSE Linux Enterprise High Performance Computing 15-LTSS: zypper in -t patch SUSE-SLE-Product-HPC-15-2022-4301=1 - SUSE Linux Enterprise High Performance Computing 15-ESPOS: zypper in -t patch SUSE-SLE-Product-HPC-15-2022-4301=1 - SUSE Enterprise Storage 7: zypper in -t patch SUSE-Storage-7-2022-4301=1 - SUSE Enterprise Storage 6: zypper in -t patch SUSE-Storage-6-2022-4301=1 - SUSE CaaS Platform 4.0: To install this update, use the SUSE CaaS Platform 'skuba' tool. It will inform you if it detects new updates and let you then trigger updating of the complete cluster in a controlled way. Package List: - openSUSE Leap 15.4 (aarch64 ppc64le s390x x86_64): nodejs10-10.24.1-150000.1.53.1 nodejs10-debuginfo-10.24.1-150000.1.53.1 nodejs10-debugsource-10.24.1-150000.1.53.1 nodejs10-devel-10.24.1-150000.1.53.1 npm10-10.24.1-150000.1.53.1 - openSUSE Leap 15.4 (noarch): nodejs10-docs-10.24.1-150000.1.53.1 - openSUSE Leap 15.3 (aarch64 ppc64le s390x x86_64): nodejs10-10.24.1-150000.1.53.1 nodejs10-debuginfo-10.24.1-150000.1.53.1 nodejs10-debugsource-10.24.1-150000.1.53.1 nodejs10-devel-10.24.1-150000.1.53.1 npm10-10.24.1-150000.1.53.1 - openSUSE Leap 15.3 (noarch): nodejs10-docs-10.24.1-150000.1.53.1 - SUSE Manager Server 4.1 (ppc64le s390x x86_64): nodejs10-10.24.1-150000.1.53.1 nodejs10-debuginfo-10.24.1-150000.1.53.1 nodejs10-debugsource-10.24.1-150000.1.53.1 nodejs10-devel-10.24.1-150000.1.53.1 npm10-10.24.1-150000.1.53.1 - SUSE Manager Server 4.1 (noarch): nodejs10-docs-10.24.1-150000.1.53.1 - SUSE Manager Retail Branch Server 4.1 (x86_64): nodejs10-10.24.1-150000.1.53.1 nodejs10-debuginfo-10.24.1-150000.1.53.1 nodejs10-debugsource-10.24.1-150000.1.53.1 nodejs10-devel-10.24.1-150000.1.53.1 npm10-10.24.1-150000.1.53.1 - SUSE Manager Retail Branch Server 4.1 (noarch): nodejs10-docs-10.24.1-150000.1.53.1 - SUSE Manager Proxy 4.1 (noarch): nodejs10-docs-10.24.1-150000.1.53.1 - SUSE Manager Proxy 4.1 (x86_64): nodejs10-10.24.1-150000.1.53.1 nodejs10-debuginfo-10.24.1-150000.1.53.1 nodejs10-debugsource-10.24.1-150000.1.53.1 nodejs10-devel-10.24.1-150000.1.53.1 npm10-10.24.1-150000.1.53.1 - SUSE Linux Enterprise Server for SAP 15-SP2 (ppc64le x86_64): nodejs10-10.24.1-150000.1.53.1 nodejs10-debuginfo-10.24.1-150000.1.53.1 nodejs10-debugsource-10.24.1-150000.1.53.1 nodejs10-devel-10.24.1-150000.1.53.1 npm10-10.24.1-150000.1.53.1 - SUSE Linux Enterprise Server for SAP 15-SP2 (noarch): nodejs10-docs-10.24.1-150000.1.53.1 - SUSE Linux Enterprise Server for SAP 15-SP1 (ppc64le x86_64): nodejs10-10.24.1-150000.1.53.1 nodejs10-debuginfo-10.24.1-150000.1.53.1 nodejs10-debugsource-10.24.1-150000.1.53.1 nodejs10-devel-10.24.1-150000.1.53.1 npm10-10.24.1-150000.1.53.1 - SUSE Linux Enterprise Server for SAP 15-SP1 (noarch): nodejs10-docs-10.24.1-150000.1.53.1 - SUSE Linux Enterprise Server for SAP 15 (ppc64le x86_64): nodejs10-10.24.1-150000.1.53.1 nodejs10-debuginfo-10.24.1-150000.1.53.1 nodejs10-debugsource-10.24.1-150000.1.53.1 nodejs10-devel-10.24.1-150000.1.53.1 npm10-10.24.1-150000.1.53.1 - SUSE Linux Enterprise Server for SAP 15 (noarch): nodejs10-docs-10.24.1-150000.1.53.1 - SUSE Linux Enterprise Server 15-SP2-LTSS (aarch64 ppc64le s390x x86_64): nodejs10-10.24.1-150000.1.53.1 nodejs10-debuginfo-10.24.1-150000.1.53.1 nodejs10-debugsource-10.24.1-150000.1.53.1 nodejs10-devel-10.24.1-150000.1.53.1 npm10-10.24.1-150000.1.53.1 - SUSE Linux Enterprise Server 15-SP2-LTSS (noarch): nodejs10-docs-10.24.1-150000.1.53.1 - SUSE Linux Enterprise Server 15-SP2-BCL (noarch): nodejs10-docs-10.24.1-150000.1.53.1 - SUSE Linux Enterprise Server 15-SP2-BCL (x86_64): nodejs10-10.24.1-150000.1.53.1 nodejs10-debuginfo-10.24.1-150000.1.53.1 nodejs10-debugsource-10.24.1-150000.1.53.1 nodejs10-devel-10.24.1-150000.1.53.1 npm10-10.24.1-150000.1.53.1 - SUSE Linux Enterprise Server 15-SP1-LTSS (aarch64 ppc64le s390x x86_64): nodejs10-10.24.1-150000.1.53.1 nodejs10-debuginfo-10.24.1-150000.1.53.1 nodejs10-debugsource-10.24.1-150000.1.53.1 nodejs10-devel-10.24.1-150000.1.53.1 npm10-10.24.1-150000.1.53.1 - SUSE Linux Enterprise Server 15-SP1-LTSS (noarch): nodejs10-docs-10.24.1-150000.1.53.1 - SUSE Linux Enterprise Server 15-SP1-BCL (x86_64): nodejs10-10.24.1-150000.1.53.1 nodejs10-debuginfo-10.24.1-150000.1.53.1 nodejs10-debugsource-10.24.1-150000.1.53.1 nodejs10-devel-10.24.1-150000.1.53.1 npm10-10.24.1-150000.1.53.1 - SUSE Linux Enterprise Server 15-SP1-BCL (noarch): nodejs10-docs-10.24.1-150000.1.53.1 - SUSE Linux Enterprise Server 15-LTSS (aarch64 s390x): nodejs10-10.24.1-150000.1.53.1 nodejs10-debuginfo-10.24.1-150000.1.53.1 nodejs10-debugsource-10.24.1-150000.1.53.1 nodejs10-devel-10.24.1-150000.1.53.1 npm10-10.24.1-150000.1.53.1 - SUSE Linux Enterprise Server 15-LTSS (noarch): nodejs10-docs-10.24.1-150000.1.53.1 - SUSE Linux Enterprise High Performance Computing 15-SP2-LTSS (aarch64 x86_64): nodejs10-10.24.1-150000.1.53.1 nodejs10-debuginfo-10.24.1-150000.1.53.1 nodejs10-debugsource-10.24.1-150000.1.53.1 nodejs10-devel-10.24.1-150000.1.53.1 npm10-10.24.1-150000.1.53.1 - SUSE Linux Enterprise High Performance Computing 15-SP2-LTSS (noarch): nodejs10-docs-10.24.1-150000.1.53.1 - SUSE Linux Enterprise High Performance Computing 15-SP2-ESPOS (aarch64 x86_64): nodejs10-10.24.1-150000.1.53.1 nodejs10-debuginfo-10.24.1-150000.1.53.1 nodejs10-debugsource-10.24.1-150000.1.53.1 nodejs10-devel-10.24.1-150000.1.53.1 npm10-10.24.1-150000.1.53.1 - SUSE Linux Enterprise High Performance Computing 15-SP2-ESPOS (noarch): nodejs10-docs-10.24.1-150000.1.53.1 - SUSE Linux Enterprise High Performance Computing 15-SP1-LTSS (aarch64 x86_64): nodejs10-10.24.1-150000.1.53.1 nodejs10-debuginfo-10.24.1-150000.1.53.1 nodejs10-debugsource-10.24.1-150000.1.53.1 nodejs10-devel-10.24.1-150000.1.53.1 npm10-10.24.1-150000.1.53.1 - SUSE Linux Enterprise High Performance Computing 15-SP1-LTSS (noarch): nodejs10-docs-10.24.1-150000.1.53.1 - SUSE Linux Enterprise High Performance Computing 15-SP1-ESPOS (aarch64 x86_64): nodejs10-10.24.1-150000.1.53.1 nodejs10-debuginfo-10.24.1-150000.1.53.1 nodejs10-debugsource-10.24.1-150000.1.53.1 nodejs10-devel-10.24.1-150000.1.53.1 npm10-10.24.1-150000.1.53.1 - SUSE Linux Enterprise High Performance Computing 15-SP1-ESPOS (noarch): nodejs10-docs-10.24.1-150000.1.53.1 - SUSE Linux Enterprise High Performance Computing 15-LTSS (aarch64 x86_64): nodejs10-10.24.1-150000.1.53.1 nodejs10-debuginfo-10.24.1-150000.1.53.1 nodejs10-debugsource-10.24.1-150000.1.53.1 nodejs10-devel-10.24.1-150000.1.53.1 npm10-10.24.1-150000.1.53.1 - SUSE Linux Enterprise High Performance Computing 15-LTSS (noarch): nodejs10-docs-10.24.1-150000.1.53.1 - SUSE Linux Enterprise High Performance Computing 15-ESPOS (aarch64 x86_64): nodejs10-10.24.1-150000.1.53.1 nodejs10-debuginfo-10.24.1-150000.1.53.1 nodejs10-debugsource-10.24.1-150000.1.53.1 nodejs10-devel-10.24.1-150000.1.53.1 npm10-10.24.1-150000.1.53.1 - SUSE Linux Enterprise High Performance Computing 15-ESPOS (noarch): nodejs10-docs-10.24.1-150000.1.53.1 - SUSE Enterprise Storage 7 (aarch64 x86_64): nodejs10-10.24.1-150000.1.53.1 nodejs10-debuginfo-10.24.1-150000.1.53.1 nodejs10-debugsource-10.24.1-150000.1.53.1 nodejs10-devel-10.24.1-150000.1.53.1 npm10-10.24.1-150000.1.53.1 - SUSE Enterprise Storage 7 (noarch): nodejs10-docs-10.24.1-150000.1.53.1 - SUSE Enterprise Storage 6 (aarch64 x86_64): nodejs10-10.24.1-150000.1.53.1 nodejs10-debuginfo-10.24.1-150000.1.53.1 nodejs10-debugsource-10.24.1-150000.1.53.1 nodejs10-devel-10.24.1-150000.1.53.1 npm10-10.24.1-150000.1.53.1 - SUSE Enterprise Storage 6 (noarch): nodejs10-docs-10.24.1-150000.1.53.1 - SUSE CaaS Platform 4.0 (x86_64): nodejs10-10.24.1-150000.1.53.1 nodejs10-debuginfo-10.24.1-150000.1.53.1 nodejs10-debugsource-10.24.1-150000.1.53.1 nodejs10-devel-10.24.1-150000.1.53.1 npm10-10.24.1-150000.1.53.1 - SUSE CaaS Platform 4.0 (noarch): nodejs10-docs-10.24.1-150000.1.53.1 References: https://www.suse.com/security/cve/CVE-2022-43548.html https://bugzilla.suse.com/1205119

1 0