May 2024 - openSUSE Security Announce - openSUSE Mailing Lists

SUSE-SU-2024:1806-1: important: Security update for xdg-desktop-portal
by OPENSUSE-SECURITY-UPDATES 29 May '24

29 May '24

# Security update for xdg-desktop-portal Announcement ID: SUSE-SU-2024:1806-1 Rating: important References: * bsc#1223110 Cross-References: * CVE-2024-32462 CVSS scores: * CVE-2024-32462 ( SUSE ): 8.4 CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:N Affected Products: * openSUSE Leap 15.4 * SUSE Linux Enterprise Desktop 15 SP4 LTSS 15-SP4 * SUSE Linux Enterprise High Performance Computing 15 SP4 * SUSE Linux Enterprise High Performance Computing ESPOS 15 SP4 * SUSE Linux Enterprise High Performance Computing LTSS 15 SP4 * SUSE Linux Enterprise Server 15 SP4 * SUSE Linux Enterprise Server 15 SP4 LTSS 15-SP4 * SUSE Linux Enterprise Server for SAP Applications 15 SP4 An update that solves one vulnerability can now be installed. ## Description: This update for xdg-desktop-portal fixes the following issues: * CVE-2024-32462: Fixed sandbox escape via RequestBackground portal (bsc#1223110). ## Patch Instructions: To install this SUSE update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: * openSUSE Leap 15.4 zypper in -t patch SUSE-2024-1806=1 * SUSE Linux Enterprise High Performance Computing ESPOS 15 SP4 zypper in -t patch SUSE-SLE-Product-HPC-15-SP4-ESPOS-2024-1806=1 * SUSE Linux Enterprise High Performance Computing LTSS 15 SP4 zypper in -t patch SUSE-SLE-Product-HPC-15-SP4-LTSS-2024-1806=1 * SUSE Linux Enterprise Desktop 15 SP4 LTSS 15-SP4 zypper in -t patch SUSE-SLE-Product-SLED-15-SP4-LTSS-2024-1806=1 * SUSE Linux Enterprise Server 15 SP4 LTSS 15-SP4 zypper in -t patch SUSE-SLE-Product-SLES-15-SP4-LTSS-2024-1806=1 * SUSE Linux Enterprise Server for SAP Applications 15 SP4 zypper in -t patch SUSE-SLE-Product-SLES_SAP-15-SP4-2024-1806=1 ## Package List: * openSUSE Leap 15.4 (aarch64 ppc64le s390x x86_64 i586) * xdg-desktop-portal-devel-1.10.1-150400.3.6.1 * xdg-desktop-portal-debuginfo-1.10.1-150400.3.6.1 * xdg-desktop-portal-1.10.1-150400.3.6.1 * xdg-desktop-portal-debugsource-1.10.1-150400.3.6.1 * openSUSE Leap 15.4 (noarch) * xdg-desktop-portal-lang-1.10.1-150400.3.6.1 * SUSE Linux Enterprise High Performance Computing ESPOS 15 SP4 (aarch64 x86_64) * xdg-desktop-portal-devel-1.10.1-150400.3.6.1 * xdg-desktop-portal-debuginfo-1.10.1-150400.3.6.1 * xdg-desktop-portal-1.10.1-150400.3.6.1 * xdg-desktop-portal-debugsource-1.10.1-150400.3.6.1 * SUSE Linux Enterprise High Performance Computing ESPOS 15 SP4 (noarch) * xdg-desktop-portal-lang-1.10.1-150400.3.6.1 * SUSE Linux Enterprise High Performance Computing LTSS 15 SP4 (aarch64 x86_64) * xdg-desktop-portal-devel-1.10.1-150400.3.6.1 * xdg-desktop-portal-debuginfo-1.10.1-150400.3.6.1 * xdg-desktop-portal-1.10.1-150400.3.6.1 * xdg-desktop-portal-debugsource-1.10.1-150400.3.6.1 * SUSE Linux Enterprise High Performance Computing LTSS 15 SP4 (noarch) * xdg-desktop-portal-lang-1.10.1-150400.3.6.1 * SUSE Linux Enterprise Desktop 15 SP4 LTSS 15-SP4 (x86_64) * xdg-desktop-portal-devel-1.10.1-150400.3.6.1 * xdg-desktop-portal-debuginfo-1.10.1-150400.3.6.1 * xdg-desktop-portal-1.10.1-150400.3.6.1 * xdg-desktop-portal-debugsource-1.10.1-150400.3.6.1 * SUSE Linux Enterprise Desktop 15 SP4 LTSS 15-SP4 (noarch) * xdg-desktop-portal-lang-1.10.1-150400.3.6.1 * SUSE Linux Enterprise Server 15 SP4 LTSS 15-SP4 (aarch64 ppc64le s390x x86_64) * xdg-desktop-portal-devel-1.10.1-150400.3.6.1 * xdg-desktop-portal-debuginfo-1.10.1-150400.3.6.1 * xdg-desktop-portal-1.10.1-150400.3.6.1 * xdg-desktop-portal-debugsource-1.10.1-150400.3.6.1 * SUSE Linux Enterprise Server 15 SP4 LTSS 15-SP4 (noarch) * xdg-desktop-portal-lang-1.10.1-150400.3.6.1 * SUSE Linux Enterprise Server for SAP Applications 15 SP4 (ppc64le x86_64) * xdg-desktop-portal-devel-1.10.1-150400.3.6.1 * xdg-desktop-portal-debuginfo-1.10.1-150400.3.6.1 * xdg-desktop-portal-1.10.1-150400.3.6.1 * xdg-desktop-portal-debugsource-1.10.1-150400.3.6.1 * SUSE Linux Enterprise Server for SAP Applications 15 SP4 (noarch) * xdg-desktop-portal-lang-1.10.1-150400.3.6.1 ## References: * https://www.suse.com/security/cve/CVE-2024-32462.html * https://bugzilla.suse.com/show_bug.cgi?id=1223110

1 0

SUSE-SU-2024:1807-1: important: Security update for git
by OPENSUSE-SECURITY-UPDATES 29 May '24

29 May '24

# Security update for git Announcement ID: SUSE-SU-2024:1807-1 Rating: important References: * bsc#1224168 * bsc#1224170 * bsc#1224171 * bsc#1224172 * bsc#1224173 Cross-References: * CVE-2024-32002 * CVE-2024-32004 * CVE-2024-32020 * CVE-2024-32021 * CVE-2024-32465 CVSS scores: * CVE-2024-32002 ( SUSE ): 8.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H * CVE-2024-32002 ( NVD ): 9.0 CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:H * CVE-2024-32004 ( SUSE ): 8.1 CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:H * CVE-2024-32020 ( SUSE ): 3.9 CVSS:3.1/AV:L/AC:H/PR:L/UI:R/S:C/C:N/I:L/A:L * CVE-2024-32021 ( SUSE ): 3.9 CVSS:3.1/AV:L/AC:H/PR:L/UI:R/S:C/C:N/I:L/A:L * CVE-2024-32465 ( SUSE ): 8.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H Affected Products: * Basesystem Module 15-SP5 * Development Tools Module 15-SP5 * openSUSE Leap 15.3 * openSUSE Leap 15.5 * SUSE Enterprise Storage 7.1 * SUSE Linux Enterprise Desktop 15 SP4 LTSS 15-SP4 * SUSE Linux Enterprise Desktop 15 SP5 * SUSE Linux Enterprise High Performance Computing 15 SP3 * SUSE Linux Enterprise High Performance Computing 15 SP4 * SUSE Linux Enterprise High Performance Computing 15 SP5 * SUSE Linux Enterprise High Performance Computing ESPOS 15 SP4 * SUSE Linux Enterprise High Performance Computing LTSS 15 SP3 * SUSE Linux Enterprise High Performance Computing LTSS 15 SP4 * SUSE Linux Enterprise Micro 5.5 * SUSE Linux Enterprise Real Time 15 SP5 * SUSE Linux Enterprise Server 15 SP3 * SUSE Linux Enterprise Server 15 SP3 LTSS 15-SP3 * SUSE Linux Enterprise Server 15 SP4 * SUSE Linux Enterprise Server 15 SP4 LTSS 15-SP4 * SUSE Linux Enterprise Server 15 SP5 * SUSE Linux Enterprise Server for SAP Applications 15 SP3 * SUSE Linux Enterprise Server for SAP Applications 15 SP4 * SUSE Linux Enterprise Server for SAP Applications 15 SP5 * SUSE Manager Proxy 4.3 * SUSE Manager Retail Branch Server 4.3 * SUSE Manager Server 4.3 An update that solves five vulnerabilities can now be installed. ## Description: This update for git fixes the following issues: * CVE-2024-32002: Fixed recursive clones on case-insensitive filesystems that support symbolic links are susceptible to case confusion (bsc#1224168). * CVE-2024-32004: Fixed arbitrary code execution during local clones (bsc#1224170). * CVE-2024-32020: Fixed file overwriting vulnerability during local clones (bsc#1224171). * CVE-2024-32021: Fixed git may create hardlinks to arbitrary user-readable files (bsc#1224172). * CVE-2024-32465: Fixed arbitrary code execution during clone operations (bsc#1224173). ## Patch Instructions: To install this SUSE update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: * openSUSE Leap 15.5 zypper in -t patch openSUSE-SLE-15.5-2024-1807=1 * SUSE Linux Enterprise Micro 5.5 zypper in -t patch SUSE-SLE-Micro-5.5-2024-1807=1 * Basesystem Module 15-SP5 zypper in -t patch SUSE-SLE-Module-Basesystem-15-SP5-2024-1807=1 * Development Tools Module 15-SP5 zypper in -t patch SUSE-SLE-Module-Development-Tools-15-SP5-2024-1807=1 * SUSE Linux Enterprise High Performance Computing LTSS 15 SP3 zypper in -t patch SUSE-SLE-Product-HPC-15-SP3-LTSS-2024-1807=1 * SUSE Linux Enterprise High Performance Computing ESPOS 15 SP4 zypper in -t patch SUSE-SLE-Product-HPC-15-SP4-ESPOS-2024-1807=1 * SUSE Linux Enterprise High Performance Computing LTSS 15 SP4 zypper in -t patch SUSE-SLE-Product-HPC-15-SP4-LTSS-2024-1807=1 * SUSE Linux Enterprise Desktop 15 SP4 LTSS 15-SP4 zypper in -t patch SUSE-SLE-Product-SLED-15-SP4-LTSS-2024-1807=1 * SUSE Linux Enterprise Server 15 SP3 LTSS 15-SP3 zypper in -t patch SUSE-SLE-Product-SLES-15-SP3-LTSS-2024-1807=1 * SUSE Linux Enterprise Server 15 SP4 LTSS 15-SP4 zypper in -t patch SUSE-SLE-Product-SLES-15-SP4-LTSS-2024-1807=1 * SUSE Linux Enterprise Server for SAP Applications 15 SP3 zypper in -t patch SUSE-SLE-Product-SLES_SAP-15-SP3-2024-1807=1 * SUSE Linux Enterprise Server for SAP Applications 15 SP4 zypper in -t patch SUSE-SLE-Product-SLES_SAP-15-SP4-2024-1807=1 * SUSE Manager Proxy 4.3 zypper in -t patch SUSE-SLE-Product-SUSE-Manager-Proxy-4.3-2024-1807=1 * SUSE Manager Retail Branch Server 4.3 zypper in -t patch SUSE-SLE-Product-SUSE-Manager-Retail-Branch- Server-4.3-2024-1807=1 * SUSE Manager Server 4.3 zypper in -t patch SUSE-SLE-Product-SUSE-Manager-Server-4.3-2024-1807=1 * SUSE Enterprise Storage 7.1 zypper in -t patch SUSE-Storage-7.1-2024-1807=1 * openSUSE Leap 15.3 zypper in -t patch SUSE-2024-1807=1 ## Package List: * openSUSE Leap 15.5 (aarch64 ppc64le s390x x86_64) * git-credential-libsecret-2.35.3-150300.10.39.1 * git-credential-libsecret-debuginfo-2.35.3-150300.10.39.1 * git-daemon-2.35.3-150300.10.39.1 * git-core-debuginfo-2.35.3-150300.10.39.1 * git-core-2.35.3-150300.10.39.1 * git-cvs-2.35.3-150300.10.39.1 * git-daemon-debuginfo-2.35.3-150300.10.39.1 * git-2.35.3-150300.10.39.1 * git-svn-2.35.3-150300.10.39.1 * gitk-2.35.3-150300.10.39.1 * git-credential-gnome-keyring-debuginfo-2.35.3-150300.10.39.1 * perl-Git-2.35.3-150300.10.39.1 * git-credential-gnome-keyring-2.35.3-150300.10.39.1 * git-email-2.35.3-150300.10.39.1 * git-arch-2.35.3-150300.10.39.1 * git-debugsource-2.35.3-150300.10.39.1 * git-gui-2.35.3-150300.10.39.1 * git-p4-2.35.3-150300.10.39.1 * git-debuginfo-2.35.3-150300.10.39.1 * git-web-2.35.3-150300.10.39.1 * openSUSE Leap 15.5 (noarch) * git-doc-2.35.3-150300.10.39.1 * SUSE Linux Enterprise Micro 5.5 (aarch64 s390x x86_64) * git-core-debuginfo-2.35.3-150300.10.39.1 * git-core-2.35.3-150300.10.39.1 * git-2.35.3-150300.10.39.1 * perl-Git-2.35.3-150300.10.39.1 * git-debugsource-2.35.3-150300.10.39.1 * git-debuginfo-2.35.3-150300.10.39.1 * Basesystem Module 15-SP5 (aarch64 ppc64le s390x x86_64) * git-debuginfo-2.35.3-150300.10.39.1 * git-debugsource-2.35.3-150300.10.39.1 * git-core-debuginfo-2.35.3-150300.10.39.1 * git-core-2.35.3-150300.10.39.1 * Development Tools Module 15-SP5 (aarch64 ppc64le s390x x86_64) * git-daemon-2.35.3-150300.10.39.1 * gitk-2.35.3-150300.10.39.1 * git-cvs-2.35.3-150300.10.39.1 * git-daemon-debuginfo-2.35.3-150300.10.39.1 * git-2.35.3-150300.10.39.1 * git-svn-2.35.3-150300.10.39.1 * perl-Git-2.35.3-150300.10.39.1 * git-email-2.35.3-150300.10.39.1 * git-arch-2.35.3-150300.10.39.1 * git-debugsource-2.35.3-150300.10.39.1 * git-gui-2.35.3-150300.10.39.1 * git-debuginfo-2.35.3-150300.10.39.1 * git-web-2.35.3-150300.10.39.1 * Development Tools Module 15-SP5 (noarch) * git-doc-2.35.3-150300.10.39.1 * SUSE Linux Enterprise High Performance Computing LTSS 15 SP3 (aarch64 x86_64) * git-daemon-2.35.3-150300.10.39.1 * git-core-debuginfo-2.35.3-150300.10.39.1 * git-core-2.35.3-150300.10.39.1 * git-cvs-2.35.3-150300.10.39.1 * git-daemon-debuginfo-2.35.3-150300.10.39.1 * git-2.35.3-150300.10.39.1 * git-svn-2.35.3-150300.10.39.1 * gitk-2.35.3-150300.10.39.1 * perl-Git-2.35.3-150300.10.39.1 * git-email-2.35.3-150300.10.39.1 * git-arch-2.35.3-150300.10.39.1 * git-debugsource-2.35.3-150300.10.39.1 * git-gui-2.35.3-150300.10.39.1 * git-debuginfo-2.35.3-150300.10.39.1 * git-web-2.35.3-150300.10.39.1 * SUSE Linux Enterprise High Performance Computing LTSS 15 SP3 (noarch) * git-doc-2.35.3-150300.10.39.1 * SUSE Linux Enterprise High Performance Computing ESPOS 15 SP4 (aarch64 x86_64) * git-daemon-2.35.3-150300.10.39.1 * git-core-debuginfo-2.35.3-150300.10.39.1 * git-core-2.35.3-150300.10.39.1 * git-cvs-2.35.3-150300.10.39.1 * git-daemon-debuginfo-2.35.3-150300.10.39.1 * git-2.35.3-150300.10.39.1 * git-svn-2.35.3-150300.10.39.1 * gitk-2.35.3-150300.10.39.1 * perl-Git-2.35.3-150300.10.39.1 * git-email-2.35.3-150300.10.39.1 * git-arch-2.35.3-150300.10.39.1 * git-debugsource-2.35.3-150300.10.39.1 * git-gui-2.35.3-150300.10.39.1 * git-debuginfo-2.35.3-150300.10.39.1 * git-web-2.35.3-150300.10.39.1 * SUSE Linux Enterprise High Performance Computing ESPOS 15 SP4 (noarch) * git-doc-2.35.3-150300.10.39.1 * SUSE Linux Enterprise High Performance Computing LTSS 15 SP4 (aarch64 x86_64) * git-daemon-2.35.3-150300.10.39.1 * git-core-debuginfo-2.35.3-150300.10.39.1 * git-core-2.35.3-150300.10.39.1 * git-cvs-2.35.3-150300.10.39.1 * git-daemon-debuginfo-2.35.3-150300.10.39.1 * git-2.35.3-150300.10.39.1 * git-svn-2.35.3-150300.10.39.1 * gitk-2.35.3-150300.10.39.1 * perl-Git-2.35.3-150300.10.39.1 * git-email-2.35.3-150300.10.39.1 * git-arch-2.35.3-150300.10.39.1 * git-debugsource-2.35.3-150300.10.39.1 * git-gui-2.35.3-150300.10.39.1 * git-debuginfo-2.35.3-150300.10.39.1 * git-web-2.35.3-150300.10.39.1 * SUSE Linux Enterprise High Performance Computing LTSS 15 SP4 (noarch) * git-doc-2.35.3-150300.10.39.1 * SUSE Linux Enterprise Desktop 15 SP4 LTSS 15-SP4 (x86_64) * git-daemon-2.35.3-150300.10.39.1 * git-core-debuginfo-2.35.3-150300.10.39.1 * git-core-2.35.3-150300.10.39.1 * git-cvs-2.35.3-150300.10.39.1 * git-daemon-debuginfo-2.35.3-150300.10.39.1 * git-2.35.3-150300.10.39.1 * git-svn-2.35.3-150300.10.39.1 * gitk-2.35.3-150300.10.39.1 * perl-Git-2.35.3-150300.10.39.1 * git-email-2.35.3-150300.10.39.1 * git-arch-2.35.3-150300.10.39.1 * git-debugsource-2.35.3-150300.10.39.1 * git-gui-2.35.3-150300.10.39.1 * git-debuginfo-2.35.3-150300.10.39.1 * git-web-2.35.3-150300.10.39.1 * SUSE Linux Enterprise Desktop 15 SP4 LTSS 15-SP4 (noarch) * git-doc-2.35.3-150300.10.39.1 * SUSE Linux Enterprise Server 15 SP3 LTSS 15-SP3 (aarch64 ppc64le s390x x86_64) * git-daemon-2.35.3-150300.10.39.1 * git-core-debuginfo-2.35.3-150300.10.39.1 * git-core-2.35.3-150300.10.39.1 * git-cvs-2.35.3-150300.10.39.1 * git-daemon-debuginfo-2.35.3-150300.10.39.1 * git-2.35.3-150300.10.39.1 * git-svn-2.35.3-150300.10.39.1 * gitk-2.35.3-150300.10.39.1 * perl-Git-2.35.3-150300.10.39.1 * git-email-2.35.3-150300.10.39.1 * git-arch-2.35.3-150300.10.39.1 * git-debugsource-2.35.3-150300.10.39.1 * git-gui-2.35.3-150300.10.39.1 * git-debuginfo-2.35.3-150300.10.39.1 * git-web-2.35.3-150300.10.39.1 * SUSE Linux Enterprise Server 15 SP3 LTSS 15-SP3 (noarch) * git-doc-2.35.3-150300.10.39.1 * SUSE Linux Enterprise Server 15 SP4 LTSS 15-SP4 (aarch64 ppc64le s390x x86_64) * git-daemon-2.35.3-150300.10.39.1 * git-core-debuginfo-2.35.3-150300.10.39.1 * git-core-2.35.3-150300.10.39.1 * git-cvs-2.35.3-150300.10.39.1 * git-daemon-debuginfo-2.35.3-150300.10.39.1 * git-2.35.3-150300.10.39.1 * git-svn-2.35.3-150300.10.39.1 * gitk-2.35.3-150300.10.39.1 * perl-Git-2.35.3-150300.10.39.1 * git-email-2.35.3-150300.10.39.1 * git-arch-2.35.3-150300.10.39.1 * git-debugsource-2.35.3-150300.10.39.1 * git-gui-2.35.3-150300.10.39.1 * git-debuginfo-2.35.3-150300.10.39.1 * git-web-2.35.3-150300.10.39.1 * SUSE Linux Enterprise Server 15 SP4 LTSS 15-SP4 (noarch) * git-doc-2.35.3-150300.10.39.1 * SUSE Linux Enterprise Server for SAP Applications 15 SP3 (ppc64le x86_64) * git-daemon-2.35.3-150300.10.39.1 * git-core-debuginfo-2.35.3-150300.10.39.1 * git-core-2.35.3-150300.10.39.1 * git-cvs-2.35.3-150300.10.39.1 * git-daemon-debuginfo-2.35.3-150300.10.39.1 * git-2.35.3-150300.10.39.1 * git-svn-2.35.3-150300.10.39.1 * gitk-2.35.3-150300.10.39.1 * perl-Git-2.35.3-150300.10.39.1 * git-email-2.35.3-150300.10.39.1 * git-arch-2.35.3-150300.10.39.1 * git-debugsource-2.35.3-150300.10.39.1 * git-gui-2.35.3-150300.10.39.1 * git-debuginfo-2.35.3-150300.10.39.1 * git-web-2.35.3-150300.10.39.1 * SUSE Linux Enterprise Server for SAP Applications 15 SP3 (noarch) * git-doc-2.35.3-150300.10.39.1 * SUSE Linux Enterprise Server for SAP Applications 15 SP4 (ppc64le x86_64) * git-daemon-2.35.3-150300.10.39.1 * git-core-debuginfo-2.35.3-150300.10.39.1 * git-core-2.35.3-150300.10.39.1 * git-cvs-2.35.3-150300.10.39.1 * git-daemon-debuginfo-2.35.3-150300.10.39.1 * git-2.35.3-150300.10.39.1 * git-svn-2.35.3-150300.10.39.1 * gitk-2.35.3-150300.10.39.1 * perl-Git-2.35.3-150300.10.39.1 * git-email-2.35.3-150300.10.39.1 * git-arch-2.35.3-150300.10.39.1 * git-debugsource-2.35.3-150300.10.39.1 * git-gui-2.35.3-150300.10.39.1 * git-debuginfo-2.35.3-150300.10.39.1 * git-web-2.35.3-150300.10.39.1 * SUSE Linux Enterprise Server for SAP Applications 15 SP4 (noarch) * git-doc-2.35.3-150300.10.39.1 * SUSE Manager Proxy 4.3 (x86_64) * git-debuginfo-2.35.3-150300.10.39.1 * git-debugsource-2.35.3-150300.10.39.1 * git-core-debuginfo-2.35.3-150300.10.39.1 * git-core-2.35.3-150300.10.39.1 * SUSE Manager Retail Branch Server 4.3 (x86_64) * git-debuginfo-2.35.3-150300.10.39.1 * git-debugsource-2.35.3-150300.10.39.1 * git-core-debuginfo-2.35.3-150300.10.39.1 * git-core-2.35.3-150300.10.39.1 * SUSE Manager Server 4.3 (ppc64le s390x x86_64) * git-debuginfo-2.35.3-150300.10.39.1 * git-debugsource-2.35.3-150300.10.39.1 * git-core-debuginfo-2.35.3-150300.10.39.1 * git-core-2.35.3-150300.10.39.1 * SUSE Enterprise Storage 7.1 (aarch64 x86_64) * git-daemon-2.35.3-150300.10.39.1 * git-core-debuginfo-2.35.3-150300.10.39.1 * git-core-2.35.3-150300.10.39.1 * git-cvs-2.35.3-150300.10.39.1 * git-daemon-debuginfo-2.35.3-150300.10.39.1 * git-2.35.3-150300.10.39.1 * git-svn-2.35.3-150300.10.39.1 * gitk-2.35.3-150300.10.39.1 * perl-Git-2.35.3-150300.10.39.1 * git-email-2.35.3-150300.10.39.1 * git-arch-2.35.3-150300.10.39.1 * git-debugsource-2.35.3-150300.10.39.1 * git-gui-2.35.3-150300.10.39.1 * git-debuginfo-2.35.3-150300.10.39.1 * git-web-2.35.3-150300.10.39.1 * SUSE Enterprise Storage 7.1 (noarch) * git-doc-2.35.3-150300.10.39.1 * openSUSE Leap 15.3 (aarch64 ppc64le s390x x86_64 i586) * git-credential-libsecret-2.35.3-150300.10.39.1 * git-credential-libsecret-debuginfo-2.35.3-150300.10.39.1 * git-daemon-2.35.3-150300.10.39.1 * git-core-debuginfo-2.35.3-150300.10.39.1 * git-core-2.35.3-150300.10.39.1 * git-cvs-2.35.3-150300.10.39.1 * git-daemon-debuginfo-2.35.3-150300.10.39.1 * git-2.35.3-150300.10.39.1 * git-svn-2.35.3-150300.10.39.1 * gitk-2.35.3-150300.10.39.1 * git-credential-gnome-keyring-debuginfo-2.35.3-150300.10.39.1 * perl-Git-2.35.3-150300.10.39.1 * git-credential-gnome-keyring-2.35.3-150300.10.39.1 * git-email-2.35.3-150300.10.39.1 * git-arch-2.35.3-150300.10.39.1 * git-debugsource-2.35.3-150300.10.39.1 * git-gui-2.35.3-150300.10.39.1 * git-p4-2.35.3-150300.10.39.1 * git-debuginfo-2.35.3-150300.10.39.1 * git-web-2.35.3-150300.10.39.1 * openSUSE Leap 15.3 (noarch) * git-doc-2.35.3-150300.10.39.1 ## References: * https://www.suse.com/security/cve/CVE-2024-32002.html * https://www.suse.com/security/cve/CVE-2024-32004.html * https://www.suse.com/security/cve/CVE-2024-32020.html * https://www.suse.com/security/cve/CVE-2024-32021.html * https://www.suse.com/security/cve/CVE-2024-32465.html * https://bugzilla.suse.com/show_bug.cgi?id=1224168 * https://bugzilla.suse.com/show_bug.cgi?id=1224170 * https://bugzilla.suse.com/show_bug.cgi?id=1224171 * https://bugzilla.suse.com/show_bug.cgi?id=1224172 * https://bugzilla.suse.com/show_bug.cgi?id=1224173

1 0

SUSE-SU-2024:1808-1: moderate: Security update for openssl-1_1
by OPENSUSE-SECURITY-UPDATES 29 May '24

29 May '24

# Security update for openssl-1_1 Announcement ID: SUSE-SU-2024:1808-1 Rating: moderate References: * bsc#1222548 Cross-References: * CVE-2024-2511 CVSS scores: * CVE-2024-2511 ( SUSE ): 5.9 CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H Affected Products: * Basesystem Module 15-SP5 * openSUSE Leap 15.5 * SUSE Linux Enterprise Desktop 15 SP5 * SUSE Linux Enterprise High Performance Computing 15 SP5 * SUSE Linux Enterprise Micro 5.5 * SUSE Linux Enterprise Real Time 15 SP5 * SUSE Linux Enterprise Server 15 SP5 * SUSE Linux Enterprise Server for SAP Applications 15 SP5 An update that solves one vulnerability can now be installed. ## Description: This update for openssl-1_1 fixes the following issues: * CVE-2024-2511: Fixed unconstrained session cache growth in TLSv1.3 (bsc#1222548). ## Patch Instructions: To install this SUSE update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: * openSUSE Leap 15.5 zypper in -t patch SUSE-2024-1808=1 openSUSE-SLE-15.5-2024-1808=1 * SUSE Linux Enterprise Micro 5.5 zypper in -t patch SUSE-SLE-Micro-5.5-2024-1808=1 * Basesystem Module 15-SP5 zypper in -t patch SUSE-SLE-Module-Basesystem-15-SP5-2024-1808=1 ## Package List: * openSUSE Leap 15.5 (aarch64 ppc64le s390x x86_64 i586) * libopenssl1_1-debuginfo-1.1.1l-150500.17.28.2 * openssl-1_1-debugsource-1.1.1l-150500.17.28.2 * libopenssl1_1-hmac-1.1.1l-150500.17.28.2 * openssl-1_1-1.1.1l-150500.17.28.2 * openssl-1_1-debuginfo-1.1.1l-150500.17.28.2 * libopenssl1_1-1.1.1l-150500.17.28.2 * libopenssl-1_1-devel-1.1.1l-150500.17.28.2 * openSUSE Leap 15.5 (x86_64) * libopenssl1_1-32bit-1.1.1l-150500.17.28.2 * libopenssl1_1-hmac-32bit-1.1.1l-150500.17.28.2 * libopenssl1_1-32bit-debuginfo-1.1.1l-150500.17.28.2 * libopenssl-1_1-devel-32bit-1.1.1l-150500.17.28.2 * openSUSE Leap 15.5 (noarch) * openssl-1_1-doc-1.1.1l-150500.17.28.2 * openSUSE Leap 15.5 (aarch64_ilp32) * libopenssl1_1-64bit-1.1.1l-150500.17.28.2 * libopenssl1_1-64bit-debuginfo-1.1.1l-150500.17.28.2 * libopenssl1_1-hmac-64bit-1.1.1l-150500.17.28.2 * libopenssl-1_1-devel-64bit-1.1.1l-150500.17.28.2 * SUSE Linux Enterprise Micro 5.5 (aarch64 s390x x86_64) * libopenssl1_1-debuginfo-1.1.1l-150500.17.28.2 * openssl-1_1-debugsource-1.1.1l-150500.17.28.2 * libopenssl1_1-hmac-1.1.1l-150500.17.28.2 * openssl-1_1-1.1.1l-150500.17.28.2 * openssl-1_1-debuginfo-1.1.1l-150500.17.28.2 * libopenssl1_1-1.1.1l-150500.17.28.2 * libopenssl-1_1-devel-1.1.1l-150500.17.28.2 * Basesystem Module 15-SP5 (aarch64 ppc64le s390x x86_64) * libopenssl1_1-debuginfo-1.1.1l-150500.17.28.2 * openssl-1_1-debugsource-1.1.1l-150500.17.28.2 * libopenssl1_1-hmac-1.1.1l-150500.17.28.2 * openssl-1_1-1.1.1l-150500.17.28.2 * openssl-1_1-debuginfo-1.1.1l-150500.17.28.2 * libopenssl1_1-1.1.1l-150500.17.28.2 * libopenssl-1_1-devel-1.1.1l-150500.17.28.2 * Basesystem Module 15-SP5 (x86_64) * libopenssl1_1-32bit-1.1.1l-150500.17.28.2 * libopenssl1_1-hmac-32bit-1.1.1l-150500.17.28.2 * libopenssl1_1-32bit-debuginfo-1.1.1l-150500.17.28.2 ## References: * https://www.suse.com/security/cve/CVE-2024-2511.html * https://bugzilla.suse.com/show_bug.cgi?id=1222548

1 0

SUSE-SU-2024:0461-2: important: Security update for libxml2
by OPENSUSE-SECURITY-UPDATES 29 May '24

29 May '24

# Security update for libxml2 Announcement ID: SUSE-SU-2024:0461-2 Rating: important References: * bsc#1219576 Cross-References: * CVE-2024-25062 CVSS scores: * CVE-2024-25062 ( SUSE ): 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H * CVE-2024-25062 ( NVD ): 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H Affected Products: * openSUSE Leap 15.5 * SUSE Enterprise Storage 7.1 * SUSE Linux Enterprise High Performance Computing 15 SP2 * SUSE Linux Enterprise High Performance Computing 15 SP2 LTSS 15-SP2 * SUSE Linux Enterprise High Performance Computing 15 SP3 * SUSE Linux Enterprise High Performance Computing LTSS 15 SP3 * SUSE Linux Enterprise Micro 5.1 * SUSE Linux Enterprise Micro 5.2 * SUSE Linux Enterprise Micro for Rancher 5.2 * SUSE Linux Enterprise Server 15 SP2 * SUSE Linux Enterprise Server 15 SP2 LTSS 15-SP2 * SUSE Linux Enterprise Server 15 SP3 * SUSE Linux Enterprise Server 15 SP3 LTSS 15-SP3 * SUSE Linux Enterprise Server for SAP Applications 15 SP2 * SUSE Linux Enterprise Server for SAP Applications 15 SP3 An update that solves one vulnerability can now be installed. ## Description: This update for libxml2 fixes the following issues: * CVE-2024-25062: Fixed use-after-free in XMLReader (bsc#1219576). ## Patch Instructions: To install this SUSE update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: * SUSE Linux Enterprise Server 15 SP2 LTSS 15-SP2 zypper in -t patch SUSE-SLE-Product-SLES-15-SP2-LTSS-2024-461=1 * SUSE Linux Enterprise Server 15 SP3 LTSS 15-SP3 zypper in -t patch SUSE-SLE-Product-SLES-15-SP3-LTSS-2024-461=1 * SUSE Linux Enterprise Server for SAP Applications 15 SP2 zypper in -t patch SUSE-SLE-Product-SLES_SAP-15-SP2-2024-461=1 * SUSE Linux Enterprise Server for SAP Applications 15 SP3 zypper in -t patch SUSE-SLE-Product-SLES_SAP-15-SP3-2024-461=1 * SUSE Enterprise Storage 7.1 zypper in -t patch SUSE-Storage-7.1-2024-461=1 * openSUSE Leap 15.5 zypper in -t patch openSUSE-SLE-15.5-2024-461=1 * SUSE Linux Enterprise Micro 5.1 zypper in -t patch SUSE-SUSE-MicroOS-5.1-2024-461=1 * SUSE Linux Enterprise Micro 5.2 zypper in -t patch SUSE-SUSE-MicroOS-5.2-2024-461=1 * SUSE Linux Enterprise Micro for Rancher 5.2 zypper in -t patch SUSE-SUSE-MicroOS-5.2-2024-461=1 * SUSE Linux Enterprise High Performance Computing 15 SP2 LTSS 15-SP2 zypper in -t patch SUSE-SLE-Product-HPC-15-SP2-LTSS-2024-461=1 * SUSE Linux Enterprise High Performance Computing LTSS 15 SP3 zypper in -t patch SUSE-SLE-Product-HPC-15-SP3-LTSS-2024-461=1 ## Package List: * SUSE Linux Enterprise Server 15 SP2 LTSS 15-SP2 (aarch64 ppc64le s390x x86_64) * libxml2-tools-debuginfo-2.9.7-150000.3.66.1 * libxml2-2-debuginfo-2.9.7-150000.3.66.1 * python3-libxml2-python-debuginfo-2.9.7-150000.3.66.1 * python3-libxml2-python-2.9.7-150000.3.66.1 * libxml2-devel-2.9.7-150000.3.66.1 * python2-libxml2-python-debuginfo-2.9.7-150000.3.66.1 * libxml2-debugsource-2.9.7-150000.3.66.1 * libxml2-2-2.9.7-150000.3.66.1 * libxml2-tools-2.9.7-150000.3.66.1 * python2-libxml2-python-2.9.7-150000.3.66.1 * python-libxml2-python-debugsource-2.9.7-150000.3.66.1 * SUSE Linux Enterprise Server 15 SP2 LTSS 15-SP2 (x86_64) * libxml2-2-32bit-2.9.7-150000.3.66.1 * libxml2-2-32bit-debuginfo-2.9.7-150000.3.66.1 * SUSE Linux Enterprise Server 15 SP3 LTSS 15-SP3 (aarch64 ppc64le s390x x86_64) * libxml2-tools-debuginfo-2.9.7-150000.3.66.1 * libxml2-2-debuginfo-2.9.7-150000.3.66.1 * python3-libxml2-python-debuginfo-2.9.7-150000.3.66.1 * python3-libxml2-python-2.9.7-150000.3.66.1 * libxml2-devel-2.9.7-150000.3.66.1 * libxml2-debugsource-2.9.7-150000.3.66.1 * libxml2-2-2.9.7-150000.3.66.1 * libxml2-tools-2.9.7-150000.3.66.1 * python-libxml2-python-debugsource-2.9.7-150000.3.66.1 * SUSE Linux Enterprise Server 15 SP3 LTSS 15-SP3 (x86_64) * libxml2-2-32bit-2.9.7-150000.3.66.1 * libxml2-2-32bit-debuginfo-2.9.7-150000.3.66.1 * SUSE Linux Enterprise Server for SAP Applications 15 SP2 (ppc64le x86_64) * libxml2-tools-debuginfo-2.9.7-150000.3.66.1 * libxml2-2-debuginfo-2.9.7-150000.3.66.1 * python3-libxml2-python-debuginfo-2.9.7-150000.3.66.1 * python3-libxml2-python-2.9.7-150000.3.66.1 * libxml2-devel-2.9.7-150000.3.66.1 * python2-libxml2-python-debuginfo-2.9.7-150000.3.66.1 * libxml2-debugsource-2.9.7-150000.3.66.1 * libxml2-2-2.9.7-150000.3.66.1 * libxml2-tools-2.9.7-150000.3.66.1 * python2-libxml2-python-2.9.7-150000.3.66.1 * python-libxml2-python-debugsource-2.9.7-150000.3.66.1 * SUSE Linux Enterprise Server for SAP Applications 15 SP2 (x86_64) * libxml2-2-32bit-2.9.7-150000.3.66.1 * libxml2-2-32bit-debuginfo-2.9.7-150000.3.66.1 * SUSE Linux Enterprise Server for SAP Applications 15 SP3 (ppc64le x86_64) * libxml2-tools-debuginfo-2.9.7-150000.3.66.1 * libxml2-2-debuginfo-2.9.7-150000.3.66.1 * python3-libxml2-python-debuginfo-2.9.7-150000.3.66.1 * python3-libxml2-python-2.9.7-150000.3.66.1 * libxml2-devel-2.9.7-150000.3.66.1 * libxml2-debugsource-2.9.7-150000.3.66.1 * libxml2-2-2.9.7-150000.3.66.1 * libxml2-tools-2.9.7-150000.3.66.1 * python-libxml2-python-debugsource-2.9.7-150000.3.66.1 * SUSE Linux Enterprise Server for SAP Applications 15 SP3 (x86_64) * libxml2-2-32bit-2.9.7-150000.3.66.1 * libxml2-2-32bit-debuginfo-2.9.7-150000.3.66.1 * SUSE Enterprise Storage 7.1 (aarch64 x86_64) * libxml2-tools-debuginfo-2.9.7-150000.3.66.1 * libxml2-2-debuginfo-2.9.7-150000.3.66.1 * python3-libxml2-python-debuginfo-2.9.7-150000.3.66.1 * python3-libxml2-python-2.9.7-150000.3.66.1 * libxml2-devel-2.9.7-150000.3.66.1 * libxml2-debugsource-2.9.7-150000.3.66.1 * libxml2-2-2.9.7-150000.3.66.1 * libxml2-tools-2.9.7-150000.3.66.1 * python-libxml2-python-debugsource-2.9.7-150000.3.66.1 * SUSE Enterprise Storage 7.1 (x86_64) * libxml2-2-32bit-2.9.7-150000.3.66.1 * libxml2-2-32bit-debuginfo-2.9.7-150000.3.66.1 * openSUSE Leap 15.5 (aarch64 ppc64le s390x x86_64) * python3-libxml2-python-debuginfo-2.9.7-150000.3.66.1 * python3-libxml2-python-2.9.7-150000.3.66.1 * python-libxml2-python-debugsource-2.9.7-150000.3.66.1 * SUSE Linux Enterprise Micro 5.1 (aarch64 s390x x86_64) * libxml2-tools-debuginfo-2.9.7-150000.3.66.1 * libxml2-2-debuginfo-2.9.7-150000.3.66.1 * libxml2-debugsource-2.9.7-150000.3.66.1 * libxml2-2-2.9.7-150000.3.66.1 * libxml2-tools-2.9.7-150000.3.66.1 * SUSE Linux Enterprise Micro 5.2 (aarch64 s390x x86_64) * libxml2-tools-debuginfo-2.9.7-150000.3.66.1 * libxml2-2-debuginfo-2.9.7-150000.3.66.1 * python3-libxml2-python-debuginfo-2.9.7-150000.3.66.1 * python3-libxml2-python-2.9.7-150000.3.66.1 * libxml2-debugsource-2.9.7-150000.3.66.1 * libxml2-2-2.9.7-150000.3.66.1 * libxml2-tools-2.9.7-150000.3.66.1 * python-libxml2-python-debugsource-2.9.7-150000.3.66.1 * SUSE Linux Enterprise Micro for Rancher 5.2 (aarch64 s390x x86_64) * libxml2-tools-debuginfo-2.9.7-150000.3.66.1 * libxml2-2-debuginfo-2.9.7-150000.3.66.1 * python3-libxml2-python-debuginfo-2.9.7-150000.3.66.1 * python3-libxml2-python-2.9.7-150000.3.66.1 * libxml2-debugsource-2.9.7-150000.3.66.1 * libxml2-2-2.9.7-150000.3.66.1 * libxml2-tools-2.9.7-150000.3.66.1 * python-libxml2-python-debugsource-2.9.7-150000.3.66.1 * SUSE Linux Enterprise High Performance Computing 15 SP2 LTSS 15-SP2 (aarch64 x86_64) * libxml2-tools-debuginfo-2.9.7-150000.3.66.1 * libxml2-2-debuginfo-2.9.7-150000.3.66.1 * python3-libxml2-python-debuginfo-2.9.7-150000.3.66.1 * python3-libxml2-python-2.9.7-150000.3.66.1 * libxml2-devel-2.9.7-150000.3.66.1 * python2-libxml2-python-debuginfo-2.9.7-150000.3.66.1 * libxml2-debugsource-2.9.7-150000.3.66.1 * libxml2-2-2.9.7-150000.3.66.1 * libxml2-tools-2.9.7-150000.3.66.1 * python2-libxml2-python-2.9.7-150000.3.66.1 * python-libxml2-python-debugsource-2.9.7-150000.3.66.1 * SUSE Linux Enterprise High Performance Computing 15 SP2 LTSS 15-SP2 (x86_64) * libxml2-2-32bit-2.9.7-150000.3.66.1 * libxml2-2-32bit-debuginfo-2.9.7-150000.3.66.1 * SUSE Linux Enterprise High Performance Computing LTSS 15 SP3 (aarch64 x86_64) * libxml2-tools-debuginfo-2.9.7-150000.3.66.1 * libxml2-2-debuginfo-2.9.7-150000.3.66.1 * python3-libxml2-python-debuginfo-2.9.7-150000.3.66.1 * python3-libxml2-python-2.9.7-150000.3.66.1 * libxml2-devel-2.9.7-150000.3.66.1 * libxml2-debugsource-2.9.7-150000.3.66.1 * libxml2-2-2.9.7-150000.3.66.1 * libxml2-tools-2.9.7-150000.3.66.1 * python-libxml2-python-debugsource-2.9.7-150000.3.66.1 * SUSE Linux Enterprise High Performance Computing LTSS 15 SP3 (x86_64) * libxml2-2-32bit-2.9.7-150000.3.66.1 * libxml2-2-32bit-debuginfo-2.9.7-150000.3.66.1 ## References: * https://www.suse.com/security/cve/CVE-2024-25062.html * https://bugzilla.suse.com/show_bug.cgi?id=1219576

1 0

SUSE-SU-2024:1803-1: important: Security update for xdg-desktop-portal
by OPENSUSE-SECURITY-UPDATES 28 May '24

28 May '24

# Security update for xdg-desktop-portal Announcement ID: SUSE-SU-2024:1803-1 Rating: important References: * bsc#1223110 Cross-References: * CVE-2024-32462 CVSS scores: * CVE-2024-32462 ( SUSE ): 8.4 CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:N Affected Products: * Desktop Applications Module 15-SP5 * openSUSE Leap 15.5 * SUSE Linux Enterprise Desktop 15 SP5 * SUSE Linux Enterprise High Performance Computing 15 SP5 * SUSE Linux Enterprise Real Time 15 SP5 * SUSE Linux Enterprise Server 15 SP5 * SUSE Linux Enterprise Server for SAP Applications 15 SP5 An update that solves one vulnerability can now be installed. ## Description: This update for xdg-desktop-portal fixes the following issues: * CVE-2024-32462: Fixed sandbox escape via RequestBackground portal (bsc#1223110). ## Patch Instructions: To install this SUSE update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: * openSUSE Leap 15.5 zypper in -t patch SUSE-2024-1803=1 openSUSE-SLE-15.5-2024-1803=1 * Desktop Applications Module 15-SP5 zypper in -t patch SUSE-SLE-Module-Desktop-Applications-15-SP5-2024-1803=1 ## Package List: * openSUSE Leap 15.5 (aarch64 ppc64le s390x x86_64 i586) * xdg-desktop-portal-1.16.0-150500.3.6.1 * xdg-desktop-portal-devel-1.16.0-150500.3.6.1 * xdg-desktop-portal-debugsource-1.16.0-150500.3.6.1 * xdg-desktop-portal-debuginfo-1.16.0-150500.3.6.1 * openSUSE Leap 15.5 (noarch) * xdg-desktop-portal-lang-1.16.0-150500.3.6.1 * Desktop Applications Module 15-SP5 (aarch64 ppc64le s390x x86_64) * xdg-desktop-portal-1.16.0-150500.3.6.1 * xdg-desktop-portal-devel-1.16.0-150500.3.6.1 * xdg-desktop-portal-debugsource-1.16.0-150500.3.6.1 * xdg-desktop-portal-debuginfo-1.16.0-150500.3.6.1 * Desktop Applications Module 15-SP5 (noarch) * xdg-desktop-portal-lang-1.16.0-150500.3.6.1 ## References: * https://www.suse.com/security/cve/CVE-2024-32462.html * https://bugzilla.suse.com/show_bug.cgi?id=1223110

1 0

SUSE-SU-2024:1793-1: moderate: Security update for java-1_8_0-openj9
by OPENSUSE-SECURITY-UPDATES 27 May '24

27 May '24

# Security update for java-1_8_0-openj9 Announcement ID: SUSE-SU-2024:1793-1 Rating: moderate References: * bsc#1213470 * bsc#1222979 * bsc#1222983 * bsc#1222984 * bsc#1222986 Cross-References: * CVE-2024-21011 * CVE-2024-21068 * CVE-2024-21085 * CVE-2024-21094 CVSS scores: * CVE-2024-21011 ( SUSE ): 3.7 CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:L * CVE-2024-21068 ( SUSE ): 3.7 CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:N * CVE-2024-21085 ( SUSE ): 3.7 CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:L * CVE-2024-21094 ( SUSE ): 3.7 CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:N Affected Products: * openSUSE Leap 15.5 * openSUSE Leap 15.6 * SUSE Linux Enterprise Desktop 15 SP5 * SUSE Linux Enterprise Desktop 15 SP6 * SUSE Linux Enterprise High Performance Computing 15 SP5 * SUSE Linux Enterprise Micro 5.5 * SUSE Linux Enterprise Real Time 15 SP5 * SUSE Linux Enterprise Real Time 15 SP6 * SUSE Linux Enterprise Server 15 SP5 * SUSE Linux Enterprise Server 15 SP6 * SUSE Linux Enterprise Server for SAP Applications 15 SP5 * SUSE Linux Enterprise Server for SAP Applications 15 SP6 * SUSE Package Hub 15 15-SP5 * SUSE Package Hub 15 15-SP6 An update that solves four vulnerabilities and has one security fix can now be installed. ## Description: This update for java-1_8_0-openj9 fixes the following issues: Update to OpenJDK 8u412 build 08 with OpenJ9 0.44.0 virtual machine: * CVE-2024-21094: Fixed C2 compilation failure with "Exceeded _node_regs array" (bsc#1222986). * CVE-2024-21011: Fixed long Exception message leading to crash (bsc#1222979). * CVE-2024-21085: Fixed Pack200 excessive memory allocation (bsc#1222984). * CVE-2024-21068: Fixed integer overflow in C1 compiler address generation (bsc#1222983). ## Patch Instructions: To install this SUSE update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: * openSUSE Leap 15.6 zypper in -t patch openSUSE-SLE-15.6-2024-1793=1 * SUSE Package Hub 15 15-SP5 zypper in -t patch SUSE-SLE-Module-Packagehub-Subpackages-15-SP5-2024-1793=1 * SUSE Package Hub 15 15-SP6 zypper in -t patch SUSE-SLE-Module-Packagehub-Subpackages-15-SP6-2024-1793=1 * openSUSE Leap 15.5 zypper in -t patch openSUSE-SLE-15.5-2024-1793=1 ## Package List: * openSUSE Leap 15.6 (aarch64 ppc64le s390x x86_64) * java-1_8_0-openj9-headless-debuginfo-1.8.0.412-150200.3.45.2 * java-1_8_0-openj9-debuginfo-1.8.0.412-150200.3.45.2 * java-1_8_0-openj9-devel-1.8.0.412-150200.3.45.2 * java-1_8_0-openj9-demo-debuginfo-1.8.0.412-150200.3.45.2 * java-1_8_0-openj9-demo-1.8.0.412-150200.3.45.2 * java-1_8_0-openj9-debugsource-1.8.0.412-150200.3.45.2 * java-1_8_0-openj9-src-1.8.0.412-150200.3.45.2 * java-1_8_0-openj9-1.8.0.412-150200.3.45.2 * java-1_8_0-openj9-accessibility-1.8.0.412-150200.3.45.2 * java-1_8_0-openj9-headless-1.8.0.412-150200.3.45.2 * java-1_8_0-openj9-devel-debuginfo-1.8.0.412-150200.3.45.2 * openSUSE Leap 15.6 (noarch) * java-1_8_0-openj9-javadoc-1.8.0.412-150200.3.45.2 * SUSE Package Hub 15 15-SP5 (ppc64le s390x) * java-1_8_0-openj9-headless-debuginfo-1.8.0.412-150200.3.45.2 * java-1_8_0-openj9-debuginfo-1.8.0.412-150200.3.45.2 * java-1_8_0-openj9-devel-1.8.0.412-150200.3.45.2 * java-1_8_0-openj9-demo-debuginfo-1.8.0.412-150200.3.45.2 * java-1_8_0-openj9-demo-1.8.0.412-150200.3.45.2 * java-1_8_0-openj9-debugsource-1.8.0.412-150200.3.45.2 * java-1_8_0-openj9-src-1.8.0.412-150200.3.45.2 * java-1_8_0-openj9-1.8.0.412-150200.3.45.2 * java-1_8_0-openj9-accessibility-1.8.0.412-150200.3.45.2 * java-1_8_0-openj9-headless-1.8.0.412-150200.3.45.2 * java-1_8_0-openj9-devel-debuginfo-1.8.0.412-150200.3.45.2 * SUSE Package Hub 15 15-SP6 (ppc64le s390x) * java-1_8_0-openj9-headless-debuginfo-1.8.0.412-150200.3.45.2 * java-1_8_0-openj9-debuginfo-1.8.0.412-150200.3.45.2 * java-1_8_0-openj9-devel-1.8.0.412-150200.3.45.2 * java-1_8_0-openj9-demo-debuginfo-1.8.0.412-150200.3.45.2 * java-1_8_0-openj9-demo-1.8.0.412-150200.3.45.2 * java-1_8_0-openj9-debugsource-1.8.0.412-150200.3.45.2 * java-1_8_0-openj9-src-1.8.0.412-150200.3.45.2 * java-1_8_0-openj9-1.8.0.412-150200.3.45.2 * java-1_8_0-openj9-accessibility-1.8.0.412-150200.3.45.2 * java-1_8_0-openj9-headless-1.8.0.412-150200.3.45.2 * java-1_8_0-openj9-devel-debuginfo-1.8.0.412-150200.3.45.2 * openSUSE Leap 15.5 (aarch64 ppc64le s390x x86_64) * java-1_8_0-openj9-headless-debuginfo-1.8.0.412-150200.3.45.2 * java-1_8_0-openj9-debuginfo-1.8.0.412-150200.3.45.2 * java-1_8_0-openj9-devel-1.8.0.412-150200.3.45.2 * java-1_8_0-openj9-demo-debuginfo-1.8.0.412-150200.3.45.2 * java-1_8_0-openj9-demo-1.8.0.412-150200.3.45.2 * java-1_8_0-openj9-debugsource-1.8.0.412-150200.3.45.2 * java-1_8_0-openj9-src-1.8.0.412-150200.3.45.2 * java-1_8_0-openj9-1.8.0.412-150200.3.45.2 * java-1_8_0-openj9-accessibility-1.8.0.412-150200.3.45.2 * java-1_8_0-openj9-headless-1.8.0.412-150200.3.45.2 * java-1_8_0-openj9-devel-debuginfo-1.8.0.412-150200.3.45.2 * openSUSE Leap 15.5 (noarch) * java-1_8_0-openj9-javadoc-1.8.0.412-150200.3.45.2 ## References: * https://www.suse.com/security/cve/CVE-2024-21011.html * https://www.suse.com/security/cve/CVE-2024-21068.html * https://www.suse.com/security/cve/CVE-2024-21085.html * https://www.suse.com/security/cve/CVE-2024-21094.html * https://bugzilla.suse.com/show_bug.cgi?id=1213470 * https://bugzilla.suse.com/show_bug.cgi?id=1222979 * https://bugzilla.suse.com/show_bug.cgi?id=1222983 * https://bugzilla.suse.com/show_bug.cgi?id=1222984 * https://bugzilla.suse.com/show_bug.cgi?id=1222986

1 0

SUSE-SU-2024:1789-1: moderate: Security update for openssl-3
by OPENSUSE-SECURITY-UPDATES 27 May '24

27 May '24

# Security update for openssl-3 Announcement ID: SUSE-SU-2024:1789-1 Rating: moderate References: * bsc#1224388 Cross-References: * CVE-2024-4603 CVSS scores: * CVE-2024-4603 ( SUSE ): 5.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L Affected Products: * Basesystem Module 15-SP5 * openSUSE Leap 15.5 * SUSE Linux Enterprise Desktop 15 SP5 * SUSE Linux Enterprise High Performance Computing 15 SP5 * SUSE Linux Enterprise Real Time 15 SP5 * SUSE Linux Enterprise Server 15 SP5 * SUSE Linux Enterprise Server for SAP Applications 15 SP5 An update that solves one vulnerability can now be installed. ## Description: This update for openssl-3 fixes the following issues: * CVE-2024-4603: Fixed DSA parameter checks for excessive sizes before validating (bsc#1224388). ## Patch Instructions: To install this SUSE update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: * openSUSE Leap 15.5 zypper in -t patch SUSE-2024-1789=1 openSUSE-SLE-15.5-2024-1789=1 * Basesystem Module 15-SP5 zypper in -t patch SUSE-SLE-Module-Basesystem-15-SP5-2024-1789=1 ## Package List: * openSUSE Leap 15.5 (aarch64 ppc64le s390x x86_64 i586) * libopenssl3-3.0.8-150500.5.33.1 * openssl-3-debugsource-3.0.8-150500.5.33.1 * libopenssl-3-devel-3.0.8-150500.5.33.1 * openssl-3-3.0.8-150500.5.33.1 * libopenssl3-debuginfo-3.0.8-150500.5.33.1 * openssl-3-debuginfo-3.0.8-150500.5.33.1 * openSUSE Leap 15.5 (x86_64) * libopenssl-3-devel-32bit-3.0.8-150500.5.33.1 * libopenssl3-32bit-3.0.8-150500.5.33.1 * libopenssl3-32bit-debuginfo-3.0.8-150500.5.33.1 * openSUSE Leap 15.5 (noarch) * openssl-3-doc-3.0.8-150500.5.33.1 * openSUSE Leap 15.5 (aarch64_ilp32) * libopenssl-3-devel-64bit-3.0.8-150500.5.33.1 * libopenssl3-64bit-3.0.8-150500.5.33.1 * libopenssl3-64bit-debuginfo-3.0.8-150500.5.33.1 * Basesystem Module 15-SP5 (aarch64 ppc64le s390x x86_64) * libopenssl3-3.0.8-150500.5.33.1 * openssl-3-debugsource-3.0.8-150500.5.33.1 * libopenssl-3-devel-3.0.8-150500.5.33.1 * openssl-3-3.0.8-150500.5.33.1 * libopenssl3-debuginfo-3.0.8-150500.5.33.1 * openssl-3-debuginfo-3.0.8-150500.5.33.1 ## References: * https://www.suse.com/security/cve/CVE-2024-4603.html * https://bugzilla.suse.com/show_bug.cgi?id=1224388

1 0

openSUSE-SU-2024:0143-1: moderate: Security update for libqt5-qtnetworkauth
by opensuse-security＠opensuse.org 27 May '24

27 May '24

openSUSE Security Update: Security update for libqt5-qtnetworkauth ______________________________________________________________________________ Announcement ID: openSUSE-SU-2024:0143-1 Rating: moderate References: #1224782 Cross-References: CVE-2024-36048 Affected Products: openSUSE Backports SLE-15-SP5 ______________________________________________________________________________ An update that fixes one vulnerability is now available. Description: This update for libqt5-qtnetworkauth fixes the following issues: - CVE-2024-36048: Fixed data race and poor seeding in generateRandomString() (boo#1224782). Patch Instructions: To install this openSUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Backports SLE-15-SP5: zypper in -t patch openSUSE-2024-143=1 Package List: - openSUSE Backports SLE-15-SP5 (aarch64 i586 ppc64le s390x x86_64): libQt5NetworkAuth5-5.15.2+kde2-bp155.3.3.1 libqt5-qtnetworkauth-devel-5.15.2+kde2-bp155.3.3.1 libqt5-qtnetworkauth-examples-5.15.2+kde2-bp155.3.3.1 - openSUSE Backports SLE-15-SP5 (aarch64_ilp32): libQt5NetworkAuth5-64bit-5.15.2+kde2-bp155.3.3.1 libqt5-qtnetworkauth-devel-64bit-5.15.2+kde2-bp155.3.3.1 - openSUSE Backports SLE-15-SP5 (noarch): libqt5-qtnetworkauth-private-headers-devel-5.15.2+kde2-bp155.3.3.1 - openSUSE Backports SLE-15-SP5 (x86_64): libQt5NetworkAuth5-32bit-5.15.2+kde2-bp155.3.3.1 libqt5-qtnetworkauth-devel-32bit-5.15.2+kde2-bp155.3.3.1 References: https://www.suse.com/security/cve/CVE-2024-36048.html https://bugzilla.suse.com/1224782

1 0

openSUSE-SU-2024:0142-1: important: Security update for opera
by opensuse-security＠opensuse.org 27 May '24

27 May '24

openSUSE Security Update: Security update for opera ______________________________________________________________________________ Announcement ID: openSUSE-SU-2024:0142-1 Rating: important References: Cross-References: CVE-2024-4671 CVE-2024-5274 CVSS scores: CVE-2024-4671 (NVD) : 9.6 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H Affected Products: openSUSE Leap 15.5:NonFree ______________________________________________________________________________ An update that fixes two vulnerabilities is now available. Description: This update for opera fixes the following issues: - Update to 110.0.5130.39 * DNA-115603 [Rich Hints] Pass trigger source to the Rich Hint * DNA-116680 Import 0-day fix for CVE-2024-5274 - Update to 110.0.5130.35 * CHR-9721 Update Chromium on desktop-stable-124-5130 to 124.0.6367.202 * DNA-114787 Crash at views::View::DoRemoveChildView(views:: View*, bool, bool, views::View*) * DNA-115640 Tab island is not properly displayed after drag&drop in light theme * DNA-116191 Fix link in RTV Euro CoS * DNA-116218 Crash at SkGpuShaderImageFilter::onFilterImage (skif::Context const&) * DNA-116241 Update affiliation link for media expert "Continue On" * DNA-116256 Crash at TabHoverCardController::UpdateHoverCard (opera::TabDataView*, TabHoverCardController::UpdateType, bool) * DNA-116270 Show 'Suggestions' inside expanding Speed Dial field * DNA-116474 Implement the no dynamic hover approach * DNA-116493 Make sure that additional elements like (Sync your browser) etc. doesn’t shift content down on page * DNA-116515 Import 0-day fix from Chromium "[wasm-gc] Only normalize JSObject targets in SetOrCopyDataProperties" * DNA-116543 Twitter migrate to x.com * DNA-116552 Change max width of the banner * DNA-116569 Twitter in Panel loading for the first time opens two Tabs automatically * DNA-116587 Translate settings strings for every language - The update to chromium 124.0.6367.202 fixes following issues: CVE-2024-4671 Patch Instructions: To install this openSUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 15.5:NonFree: zypper in -t patch openSUSE-2024-142=1 Package List: - openSUSE Leap 15.5:NonFree (x86_64): opera-110.0.5130.39-lp155.3.48.1 References: https://www.suse.com/security/cve/CVE-2024-4671.html https://www.suse.com/security/cve/CVE-2024-5274.html

1 0

openSUSE-SU-2024:0139-1: important: Security update for cJSON
by opensuse-security＠opensuse.org 25 May '24

25 May '24

openSUSE Security Update: Security update for cJSON ______________________________________________________________________________ Announcement ID: openSUSE-SU-2024:0139-1 Rating: important References: #1218098 #1218099 #1223420 Cross-References: CVE-2023-50471 CVE-2023-50472 CVE-2024-31755 CVSS scores: CVE-2023-50471 (NVD) : 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H CVE-2023-50472 (NVD) : 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H CVE-2024-31755 (SUSE): 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H Affected Products: openSUSE Backports SLE-15-SP5 ______________________________________________________________________________ An update that fixes three vulnerabilities is now available. Description: This update for cJSON fixes the following issues: - Update to 1.7.18: * CVE-2024-31755: NULL pointer dereference via cJSON_SetValuestring() (boo#1223420) * Remove non-functional list handling of compiler flags * Fix heap buffer overflow * remove misused optimization flag -01 * Set free'd pointers to NULL whenever they are not reassigned immediately after - Update to version 1.7.17 (boo#1218098, CVE-2023-50472, boo#1218099, CVE-2023-50471): * Fix null reference in cJSON_SetValuestring (CVE-2023-50472). * Fix null reference in cJSON_InsertItemInArray (CVE-2023-50471). - Update to 1.7.16: * Add an option for ENABLE_CJSON_VERSION_SO in CMakeLists.txt * Add cmake_policy to CMakeLists.txt * Add cJSON_SetBoolValue * Add meson documentation * Fix memory leak in merge_patch * Fix conflicting target names 'uninstall' * Bump cmake version to 3.0 and use new version syntax * Print int without decimal places * Fix 'cjson_utils-static' target not exist * Add allocate check for replace_item_in_object * Fix a null pointer crash in cJSON_ReplaceItemViaPointer Patch Instructions: To install this openSUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Backports SLE-15-SP5: zypper in -t patch openSUSE-2024-139=1 Package List: - openSUSE Backports SLE-15-SP5 (aarch64 i586 ppc64le s390x x86_64): cJSON-devel-1.7.18-bp155.3.3.1 libcjson1-1.7.18-bp155.3.3.1 References: https://www.suse.com/security/cve/CVE-2023-50471.html https://www.suse.com/security/cve/CVE-2023-50472.html https://www.suse.com/security/cve/CVE-2024-31755.html https://bugzilla.suse.com/1218098 https://bugzilla.suse.com/1218099 https://bugzilla.suse.com/1223420

1 0