January 2024 - openSUSE Updates - openSUSE Mailing Lists

SUSE-RU-2024:0218-1: moderate: Recommended update for yast2-samba-client
by OPENSUSE-UPDATES 25 Jan '24

25 Jan '24

# Recommended update for yast2-samba-client Announcement ID: SUSE-RU-2024:0218-1 Rating: moderate References: * bsc#1197936 Affected Products: * openSUSE Leap 15.4 * SUSE Linux Enterprise Desktop 15 SP4 LTSS 15-SP4 * SUSE Linux Enterprise High Performance Computing 15 SP4 * SUSE Linux Enterprise High Performance Computing ESPOS 15 SP4 * SUSE Linux Enterprise High Performance Computing LTSS 15 SP4 * SUSE Linux Enterprise Server 15 SP4 * SUSE Linux Enterprise Server 15 SP4 LTSS 15-SP4 * SUSE Linux Enterprise Server for SAP Applications 15 SP4 * SUSE Manager Proxy 4.3 * SUSE Manager Retail Branch Server 4.3 * SUSE Manager Server 4.3 An update that has one fix can now be installed. ## Description: This update for yast2-samba-client fixes the following issues: - Fixed an issue when untranslated text appears in Windows Domain Membership Expert settings dialog. (bsc#1197936) ## Patch Instructions: To install this SUSE update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: * openSUSE Leap 15.4 zypper in -t patch SUSE-2024-218=1 * SUSE Linux Enterprise High Performance Computing ESPOS 15 SP4 zypper in -t patch SUSE-SLE-Product-HPC-15-SP4-ESPOS-2024-218=1 * SUSE Linux Enterprise High Performance Computing LTSS 15 SP4 zypper in -t patch SUSE-SLE-Product-HPC-15-SP4-LTSS-2024-218=1 * SUSE Linux Enterprise Desktop 15 SP4 LTSS 15-SP4 zypper in -t patch SUSE-SLE-Product-SLED-15-SP4-LTSS-2024-218=1 * SUSE Linux Enterprise Server 15 SP4 LTSS 15-SP4 zypper in -t patch SUSE-SLE-Product-SLES-15-SP4-LTSS-2024-218=1 * SUSE Linux Enterprise Server for SAP Applications 15 SP4 zypper in -t patch SUSE-SLE-Product-SLES_SAP-15-SP4-2024-218=1 * SUSE Manager Proxy 4.3 zypper in -t patch SUSE-SLE-Product-SUSE-Manager-Proxy-4.3-2024-218=1 * SUSE Manager Retail Branch Server 4.3 zypper in -t patch SUSE-SLE-Product-SUSE-Manager-Retail-Branch- Server-4.3-2024-218=1 * SUSE Manager Server 4.3 zypper in -t patch SUSE-SLE-Product-SUSE-Manager-Server-4.3-2024-218=1 ## Package List: * openSUSE Leap 15.4 (noarch) * yast2-samba-client-4.4.4-150400.3.3.1 * SUSE Linux Enterprise High Performance Computing ESPOS 15 SP4 (noarch) * yast2-samba-client-4.4.4-150400.3.3.1 * SUSE Linux Enterprise High Performance Computing LTSS 15 SP4 (noarch) * yast2-samba-client-4.4.4-150400.3.3.1 * SUSE Linux Enterprise Desktop 15 SP4 LTSS 15-SP4 (noarch) * yast2-samba-client-4.4.4-150400.3.3.1 * SUSE Linux Enterprise Server 15 SP4 LTSS 15-SP4 (noarch) * yast2-samba-client-4.4.4-150400.3.3.1 * SUSE Linux Enterprise Server for SAP Applications 15 SP4 (noarch) * yast2-samba-client-4.4.4-150400.3.3.1 * SUSE Manager Proxy 4.3 (noarch) * yast2-samba-client-4.4.4-150400.3.3.1 * SUSE Manager Retail Branch Server 4.3 (noarch) * yast2-samba-client-4.4.4-150400.3.3.1 * SUSE Manager Server 4.3 (noarch) * yast2-samba-client-4.4.4-150400.3.3.1 ## References: * https://bugzilla.suse.com/show_bug.cgi?id=1197936

1 0

openSUSE-SU-2024:0033-1: important: Security update for opera
by opensuse-security＠opensuse.org 24 Jan '24

24 Jan '24

openSUSE Security Update: Security update for opera ______________________________________________________________________________ Announcement ID: openSUSE-SU-2024:0033-1 Rating: important References: Cross-References: CVE-2024-0517 CVE-2024-0518 CVE-2024-0519 CVSS scores: CVE-2024-0517 (NVD) : 8.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H CVE-2024-0518 (NVD) : 8.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H CVE-2024-0519 (NVD) : 8.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H Affected Products: openSUSE Leap 15.5:NonFree ______________________________________________________________________________ An update that fixes three vulnerabilities is now available. Description: This update for opera fixes the following issues: Update to 106.0.4998.52 * CHR-9580 Update Chromium on desktop-stable-120-4998 to 120.0.6099.234 * DNA-113175 Can not merge folders on start page * DNA-113341 Implement 'special' menus * DNA-113811 Removing icons in sidepanel heading * DNA-114059 [Move to context menu] Workspaces icons always displayed in 1 line * DNA-114361 "Move to workspace" submenu shows icons vertically * The update to chromium 120.0.6099.234 fixes following issues: CVE-2024-0517, CVE-2024-0518, CVE-2024-0519 Patch Instructions: To install this openSUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 15.5:NonFree: zypper in -t patch openSUSE-2024-33=1 Package List: - openSUSE Leap 15.5:NonFree (x86_64): opera-106.0.4998.52-lp155.3.33.1 References: https://www.suse.com/security/cve/CVE-2024-0517.html https://www.suse.com/security/cve/CVE-2024-0518.html https://www.suse.com/security/cve/CVE-2024-0519.html

1 0

SUSE-RU-2024:0220-1: moderate: Recommended update for yast2-pkg-bindings
by OPENSUSE-UPDATES 24 Jan '24

24 Jan '24

# Recommended update for yast2-pkg-bindings Announcement ID: SUSE-RU-2024:0220-1 Rating: moderate References: * bsc#1218399 * bsc#1218977 Affected Products: * Basesystem Module 15-SP5 * openSUSE Leap 15.5 * SUSE Linux Enterprise Desktop 15 SP5 * SUSE Linux Enterprise High Performance Computing 15 SP5 * SUSE Linux Enterprise Real Time 15 SP5 * SUSE Linux Enterprise Server 15 SP5 * SUSE Linux Enterprise Server for SAP Applications 15 SP5 An update that has two fixes can now be installed. ## Description: This update for yast2-pkg-bindings fixes the following issues: * Fixed repository and service probing with libzypp 7.31.26 and newer, fixes broken repository handling (bsc#1218977, bsc#1218399) * 4.5.3 ## Patch Instructions: To install this SUSE update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: * openSUSE Leap 15.5 zypper in -t patch SUSE-2024-220=1 openSUSE-SLE-15.5-2024-220=1 * SUSE Linux Enterprise High Performance Computing 15 SP5 zypper in -t patch SUSE-SLE-INSTALLER-15-SP5-2024-220=1 * SUSE Linux Enterprise Server 15 SP5 zypper in -t patch SUSE-SLE-INSTALLER-15-SP5-2024-220=1 * SUSE Linux Enterprise Server for SAP Applications 15 SP5 zypper in -t patch SUSE-SLE-INSTALLER-15-SP5-2024-220=1 * SUSE Linux Enterprise Desktop 15 SP5 zypper in -t patch SUSE-SLE-INSTALLER-15-SP5-2024-220=1 * Basesystem Module 15-SP5 zypper in -t patch SUSE-SLE-Module-Basesystem-15-SP5-2024-220=1 ## Package List: * openSUSE Leap 15.5 (noarch) * yast2-pkg-bindings-devel-doc-4.5.3-150500.3.3.1 * openSUSE Leap 15.5 (aarch64 ppc64le s390x x86_64 i586) * yast2-pkg-bindings-debuginfo-4.5.3-150500.3.3.1 * yast2-pkg-bindings-debugsource-4.5.3-150500.3.3.1 * yast2-pkg-bindings-4.5.3-150500.3.3.1 * SUSE Linux Enterprise High Performance Computing 15 SP5 (aarch64 x86_64) * yast2-pkg-bindings-4.5.3-150500.3.3.1 * SUSE Linux Enterprise Server 15 SP5 (aarch64 ppc64le s390x x86_64) * yast2-pkg-bindings-4.5.3-150500.3.3.1 * SUSE Linux Enterprise Server for SAP Applications 15 SP5 (ppc64le x86_64) * yast2-pkg-bindings-4.5.3-150500.3.3.1 * SUSE Linux Enterprise Desktop 15 SP5 (x86_64) * yast2-pkg-bindings-4.5.3-150500.3.3.1 * Basesystem Module 15-SP5 (aarch64 ppc64le s390x x86_64) * yast2-pkg-bindings-debuginfo-4.5.3-150500.3.3.1 * yast2-pkg-bindings-debugsource-4.5.3-150500.3.3.1 * yast2-pkg-bindings-4.5.3-150500.3.3.1 ## References: * https://bugzilla.suse.com/show_bug.cgi?id=1218399 * https://bugzilla.suse.com/show_bug.cgi?id=1218977

1 0

openSUSE-RU-2024:0032-1: moderate: Recommended update for kanidm
by maintenance＠opensuse.org 24 Jan '24

24 Jan '24

openSUSE Recommended Update: Recommended update for kanidm ______________________________________________________________________________ Announcement ID: openSUSE-RU-2024:0032-1 Rating: moderate References: Affected Products: openSUSE Backports SLE-15-SP5 ______________________________________________________________________________ An update that has 0 recommended fixes can now be installed. Description: This update for kanidm fixes the following issues: kanidm is shipped in version 1.1.0~rc15~git2.74f5c0f. Patch Instructions: To install this openSUSE Recommended Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Backports SLE-15-SP5: zypper in -t patch openSUSE-2024-32=1 Package List: - openSUSE Backports SLE-15-SP5 (aarch64 x86_64): kanidm-1.1.0~rc15~git2.74f5c0f-bp155.2.1 kanidm-clients-1.1.0~rc15~git2.74f5c0f-bp155.2.1 kanidm-docs-1.1.0~rc15~git2.74f5c0f-bp155.2.1 kanidm-server-1.1.0~rc15~git2.74f5c0f-bp155.2.1 kanidm-unixd-clients-1.1.0~rc15~git2.74f5c0f-bp155.2.1 References:

1 0

openSUSE-SU-2024:0031-1: important: Security update for cacti, cacti-spine
by opensuse-security＠opensuse.org 24 Jan '24

24 Jan '24

openSUSE Security Update: Security update for cacti, cacti-spine ______________________________________________________________________________ Announcement ID: openSUSE-SU-2024:0031-1 Rating: important References: #1218360 #1218366 #1218378 #1218379 #1218380 #1218381 Cross-References: CVE-2023-49084 CVE-2023-49085 CVE-2023-49086 CVE-2023-49088 CVE-2023-50250 CVE-2023-51448 CVSS scores: CVE-2023-49084 (NVD) : 8.8 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H CVE-2023-49085 (NVD) : 8.8 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H CVE-2023-49086 (NVD) : 5.4 CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N CVE-2023-49088 (NVD) : 4.8 CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:N CVE-2023-50250 (NVD) : 6.1 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N CVE-2023-51448 (NVD) : 8.8 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H Affected Products: SUSE Linux Enterprise High Performance Computing 12 SUSE Linux Enterprise Server 12 SUSE Linux Enterprise Server 12-SP3 SUSE Linux Enterprise Server 12-SP4 SUSE Linux Enterprise Server 12-SP5 SUSE Linux Enterprise Server for SAP Applications 12 SUSE Linux Enterprise Server for SAP Applications 12-SP3 SUSE Linux Enterprise Server for SAP Applications 12-SP4 SUSE Linux Enterprise Server for SAP Applications 12-SP5 SUSE Package Hub for SUSE Linux Enterprise 12 openSUSE Backports SLE-15-SP5 ______________________________________________________________________________ An update that fixes 6 vulnerabilities is now available. Description: This update for cacti, cacti-spine fixes the following issues: cacti-spine 1.2.26: * Fix: Errors when uptime OID is not present * Fix: MySQL reconnect option is depreciated * Fix: Spine does not check a host with no poller items * Fix: Poller may report the wrong number of devices polled * Feature: Allow users to override the threads setting at the command line * Feature: Allow spine to run in ping-only mode cacti 1.2.26: * CVE-2023-50250: XSS vulnerability when importing a template file (boo#1218380) * CVE-2023-49084: RCE vulnerability when managing links (boo#1218360) * CVE-2023-49085: SQL Injection vulnerability when managing poller devices (boo#1218378) * CVE-2023-49086: XSS vulnerability when adding new devices (boo#1218366) * CVE-2023-49088: XSS vulnerability when viewing data sources in debug mode (boo#1218379) * CVE-2023-51448: SQL Injection vulnerability when managing SNMP Notification Receivers (boo#1218381) * When viewing data sources, an undefined variable error may be seen * Improvements for Poller Last Run Date * Attempting to edit a Data Query that does not exist throws warnings and not an GUI error * Improve PHP 8.1 support when adding devices * Viewing Data Query Cache can cause errors to be logged * Preserve option is not properly honoured when removing devices at command line * Infinite recursion is possible during a database failure * Monitoring Host CPU's does not always work on Windows endpoints * Multi select drop down list box not rendered correctly in Chrome and Edge * Selective Plugin Debugging may not always work as intended * During upgrades, Plugins may be falsely reported as incompatible * Plugin management at command line does not work with multiple plugins * Improve PHP 8.1 support for incrementing only numbers * Allow the renaming of guest and template accounts * DS Stats issues warnings when the RRDfile has not been initialized * When upgrading, missing data source profile can cause errors to be logged * When deleting a single Data Source, purge historical debug data * Improvements to form element warnings * Some interface aliases do not appear correctly * Aggregate graph does not show other percentiles * Settings table updates for large values reverted by database repair * When obtaining graph records, error messages may be recorded * Unable to change a device's community at command line * Increase timeout for RRDChecker * When viewing a graph, option to edit template may lead to incorrect URL * When upgrading, failures may occur due to missing color table keys * On installation, allow a more appropriate template to be used as the default * When data input parameters are allowed to be null, allow null * CSV Exports may not always output data correctly * When debugging a graph, long CDEF's can cause undesirable scrolling * Secondary LDAP server not evaluated when the first one has failed * When adding a device, using the bulk walk option can make version information appear * When parsing a Data Query resource, an error can be reported if no direction is specified * Database reconnection can cause errors to be reported incorrectly * fix returned value if $sau is empty * Add Aruba switch, Aruba controller and HPE iLO templates * Add OSCX 6x00 templates Patch Instructions: To install this openSUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Backports SLE-15-SP5: zypper in -t patch openSUSE-2024-31=1 - SUSE Package Hub for SUSE Linux Enterprise 12: zypper in -t patch openSUSE-2024-31=1 Package List: - openSUSE Backports SLE-15-SP5 (aarch64 i586 ppc64le s390x x86_64): cacti-spine-1.2.26-bp155.2.6.1 - openSUSE Backports SLE-15-SP5 (noarch): cacti-1.2.26-bp155.2.6.1 - SUSE Package Hub for SUSE Linux Enterprise 12 (aarch64 ppc64le s390x x86_64): cacti-spine-1.2.26-32.1 - SUSE Package Hub for SUSE Linux Enterprise 12 (noarch): cacti-1.2.26-38.1 References: https://www.suse.com/security/cve/CVE-2023-49084.html https://www.suse.com/security/cve/CVE-2023-49085.html https://www.suse.com/security/cve/CVE-2023-49086.html https://www.suse.com/security/cve/CVE-2023-49088.html https://www.suse.com/security/cve/CVE-2023-50250.html https://www.suse.com/security/cve/CVE-2023-51448.html https://bugzilla.suse.com/1218360 https://bugzilla.suse.com/1218366 https://bugzilla.suse.com/1218378 https://bugzilla.suse.com/1218379 https://bugzilla.suse.com/1218380 https://bugzilla.suse.com/1218381

1 0

openSUSE-SU-2024:0031-1: important: Security update for cacti, cacti-spine
by opensuse-security＠opensuse.org 24 Jan '24

24 Jan '24

openSUSE Security Update: Security update for cacti, cacti-spine ______________________________________________________________________________ Announcement ID: openSUSE-SU-2024:0031-1 Rating: important References: #1218360 #1218366 #1218378 #1218379 #1218380 #1218381 Cross-References: CVE-2023-49084 CVE-2023-49085 CVE-2023-49086 CVE-2023-49088 CVE-2023-50250 CVE-2023-51448 CVSS scores: CVE-2023-49084 (NVD) : 8.8 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H CVE-2023-49085 (NVD) : 8.8 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H CVE-2023-49086 (NVD) : 5.4 CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N CVE-2023-49088 (NVD) : 4.8 CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:N CVE-2023-50250 (NVD) : 6.1 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N CVE-2023-51448 (NVD) : 8.8 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H Affected Products: SUSE Linux Enterprise High Performance Computing 12 SUSE Linux Enterprise Server 12 SUSE Linux Enterprise Server 12-SP3 SUSE Linux Enterprise Server 12-SP4 SUSE Linux Enterprise Server 12-SP5 SUSE Linux Enterprise Server for SAP Applications 12 SUSE Linux Enterprise Server for SAP Applications 12-SP3 SUSE Linux Enterprise Server for SAP Applications 12-SP4 SUSE Linux Enterprise Server for SAP Applications 12-SP5 SUSE Package Hub for SUSE Linux Enterprise 12 ______________________________________________________________________________ An update that fixes 6 vulnerabilities is now available. Description: This update for cacti, cacti-spine fixes the following issues: cacti-spine 1.2.26: * Fix: Errors when uptime OID is not present * Fix: MySQL reconnect option is depreciated * Fix: Spine does not check a host with no poller items * Fix: Poller may report the wrong number of devices polled * Feature: Allow users to override the threads setting at the command line * Feature: Allow spine to run in ping-only mode cacti 1.2.26: * CVE-2023-50250: XSS vulnerability when importing a template file (boo#1218380) * CVE-2023-49084: RCE vulnerability when managing links (boo#1218360) * CVE-2023-49085: SQL Injection vulnerability when managing poller devices (boo#1218378) * CVE-2023-49086: XSS vulnerability when adding new devices (boo#1218366) * CVE-2023-49088: XSS vulnerability when viewing data sources in debug mode (boo#1218379) * CVE-2023-51448: SQL Injection vulnerability when managing SNMP Notification Receivers (boo#1218381) * When viewing data sources, an undefined variable error may be seen * Improvements for Poller Last Run Date * Attempting to edit a Data Query that does not exist throws warnings and not an GUI error * Improve PHP 8.1 support when adding devices * Viewing Data Query Cache can cause errors to be logged * Preserve option is not properly honoured when removing devices at command line * Infinite recursion is possible during a database failure * Monitoring Host CPU's does not always work on Windows endpoints * Multi select drop down list box not rendered correctly in Chrome and Edge * Selective Plugin Debugging may not always work as intended * During upgrades, Plugins may be falsely reported as incompatible * Plugin management at command line does not work with multiple plugins * Improve PHP 8.1 support for incrementing only numbers * Allow the renaming of guest and template accounts * DS Stats issues warnings when the RRDfile has not been initialized * When upgrading, missing data source profile can cause errors to be logged * When deleting a single Data Source, purge historical debug data * Improvements to form element warnings * Some interface aliases do not appear correctly * Aggregate graph does not show other percentiles * Settings table updates for large values reverted by database repair * When obtaining graph records, error messages may be recorded * Unable to change a device's community at command line * Increase timeout for RRDChecker * When viewing a graph, option to edit template may lead to incorrect URL * When upgrading, failures may occur due to missing color table keys * On installation, allow a more appropriate template to be used as the default * When data input parameters are allowed to be null, allow null * CSV Exports may not always output data correctly * When debugging a graph, long CDEF's can cause undesirable scrolling * Secondary LDAP server not evaluated when the first one has failed * When adding a device, using the bulk walk option can make version information appear * When parsing a Data Query resource, an error can be reported if no direction is specified * Database reconnection can cause errors to be reported incorrectly * fix returned value if $sau is empty * Add Aruba switch, Aruba controller and HPE iLO templates * Add OSCX 6x00 templates Patch Instructions: To install this openSUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - SUSE Package Hub for SUSE Linux Enterprise 12: zypper in -t patch openSUSE-2024-31=1 Package List: - SUSE Package Hub for SUSE Linux Enterprise 12 (aarch64 ppc64le s390x x86_64): cacti-spine-1.2.26-32.1 - SUSE Package Hub for SUSE Linux Enterprise 12 (noarch): cacti-1.2.26-38.1 References: https://www.suse.com/security/cve/CVE-2023-49084.html https://www.suse.com/security/cve/CVE-2023-49085.html https://www.suse.com/security/cve/CVE-2023-49086.html https://www.suse.com/security/cve/CVE-2023-49088.html https://www.suse.com/security/cve/CVE-2023-50250.html https://www.suse.com/security/cve/CVE-2023-51448.html https://bugzilla.suse.com/1218360 https://bugzilla.suse.com/1218366 https://bugzilla.suse.com/1218378 https://bugzilla.suse.com/1218379 https://bugzilla.suse.com/1218380 https://bugzilla.suse.com/1218381

1 0

SUSE-SU-2024:0204-1: important: Security update for bluez
by OPENSUSE-UPDATES 24 Jan '24

24 Jan '24

# Security update for bluez Announcement ID: SUSE-SU-2024:0204-1 Rating: important References: * bsc#1218300 * bsc#1218301 Cross-References: * CVE-2023-50229 * CVE-2023-50230 CVSS scores: * CVE-2023-50229 ( SUSE ): 7.1 CVSS:3.1/AV:A/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H * CVE-2023-50230 ( SUSE ): 7.1 CVSS:3.1/AV:A/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H Affected Products: * openSUSE Leap 15.4 * openSUSE Leap Micro 5.3 * openSUSE Leap Micro 5.4 * SUSE Linux Enterprise Desktop 15 SP4 LTSS 15-SP4 * SUSE Linux Enterprise High Performance Computing 15 SP4 * SUSE Linux Enterprise High Performance Computing ESPOS 15 SP4 * SUSE Linux Enterprise High Performance Computing LTSS 15 SP4 * SUSE Linux Enterprise Micro 5.3 * SUSE Linux Enterprise Micro 5.4 * SUSE Linux Enterprise Micro for Rancher 5.3 * SUSE Linux Enterprise Micro for Rancher 5.4 * SUSE Linux Enterprise Server 15 SP4 * SUSE Linux Enterprise Server 15 SP4 LTSS 15-SP4 * SUSE Linux Enterprise Server for SAP Applications 15 SP4 * SUSE Manager Proxy 4.3 * SUSE Manager Retail Branch Server 4.3 * SUSE Manager Server 4.3 An update that solves two vulnerabilities can now be installed. ## Description: This update for bluez fixes the following issues: * CVE-2023-50229: Fixed an out of bounds write in the primary version counter for the Phone Book Access Profile implementation (bsc#1218300). * CVE-2023-50230: Fixed an out of bounds write in the secondary version counter for the Phone Book Access Profile implementation (bsc#1218301). ## Patch Instructions: To install this SUSE update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: * openSUSE Leap 15.4 zypper in -t patch SUSE-2024-204=1 * openSUSE Leap Micro 5.3 zypper in -t patch openSUSE-Leap-Micro-5.3-2024-204=1 * openSUSE Leap Micro 5.4 zypper in -t patch openSUSE-Leap-Micro-5.4-2024-204=1 * SUSE Linux Enterprise Micro for Rancher 5.3 zypper in -t patch SUSE-SLE-Micro-5.3-2024-204=1 * SUSE Linux Enterprise Micro 5.3 zypper in -t patch SUSE-SLE-Micro-5.3-2024-204=1 * SUSE Linux Enterprise Micro for Rancher 5.4 zypper in -t patch SUSE-SLE-Micro-5.4-2024-204=1 * SUSE Linux Enterprise Micro 5.4 zypper in -t patch SUSE-SLE-Micro-5.4-2024-204=1 * SUSE Linux Enterprise High Performance Computing ESPOS 15 SP4 zypper in -t patch SUSE-SLE-Product-HPC-15-SP4-ESPOS-2024-204=1 * SUSE Linux Enterprise High Performance Computing LTSS 15 SP4 zypper in -t patch SUSE-SLE-Product-HPC-15-SP4-LTSS-2024-204=1 * SUSE Linux Enterprise Desktop 15 SP4 LTSS 15-SP4 zypper in -t patch SUSE-SLE-Product-SLED-15-SP4-LTSS-2024-204=1 * SUSE Linux Enterprise Server 15 SP4 LTSS 15-SP4 zypper in -t patch SUSE-SLE-Product-SLES-15-SP4-LTSS-2024-204=1 * SUSE Linux Enterprise Server for SAP Applications 15 SP4 zypper in -t patch SUSE-SLE-Product-SLES_SAP-15-SP4-2024-204=1 * SUSE Manager Proxy 4.3 zypper in -t patch SUSE-SLE-Product-SUSE-Manager-Proxy-4.3-2024-204=1 * SUSE Manager Retail Branch Server 4.3 zypper in -t patch SUSE-SLE-Product-SUSE-Manager-Retail-Branch- Server-4.3-2024-204=1 * SUSE Manager Server 4.3 zypper in -t patch SUSE-SLE-Product-SUSE-Manager-Server-4.3-2024-204=1 ## Package List: * openSUSE Leap 15.4 (aarch64 ppc64le s390x x86_64 i586) * libbluetooth3-5.62-150400.4.19.1 * bluez-test-debuginfo-5.62-150400.4.19.1 * bluez-cups-5.62-150400.4.19.1 * bluez-devel-5.62-150400.4.19.1 * bluez-deprecated-5.62-150400.4.19.1 * bluez-cups-debuginfo-5.62-150400.4.19.1 * bluez-debuginfo-5.62-150400.4.19.1 * bluez-test-5.62-150400.4.19.1 * bluez-debugsource-5.62-150400.4.19.1 * libbluetooth3-debuginfo-5.62-150400.4.19.1 * bluez-deprecated-debuginfo-5.62-150400.4.19.1 * bluez-5.62-150400.4.19.1 * openSUSE Leap 15.4 (noarch) * bluez-auto-enable-devices-5.62-150400.4.19.1 * openSUSE Leap 15.4 (x86_64) * libbluetooth3-32bit-debuginfo-5.62-150400.4.19.1 * bluez-devel-32bit-5.62-150400.4.19.1 * libbluetooth3-32bit-5.62-150400.4.19.1 * openSUSE Leap 15.4 (aarch64_ilp32) * libbluetooth3-64bit-debuginfo-5.62-150400.4.19.1 * bluez-devel-64bit-5.62-150400.4.19.1 * libbluetooth3-64bit-5.62-150400.4.19.1 * openSUSE Leap Micro 5.3 (aarch64 s390x x86_64) * libbluetooth3-5.62-150400.4.19.1 * libbluetooth3-debuginfo-5.62-150400.4.19.1 * openSUSE Leap Micro 5.4 (aarch64 s390x x86_64) * libbluetooth3-5.62-150400.4.19.1 * bluez-debuginfo-5.62-150400.4.19.1 * libbluetooth3-debuginfo-5.62-150400.4.19.1 * bluez-debugsource-5.62-150400.4.19.1 * SUSE Linux Enterprise Micro for Rancher 5.3 (aarch64 s390x x86_64) * libbluetooth3-5.62-150400.4.19.1 * libbluetooth3-debuginfo-5.62-150400.4.19.1 * SUSE Linux Enterprise Micro 5.3 (aarch64 s390x x86_64) * libbluetooth3-5.62-150400.4.19.1 * libbluetooth3-debuginfo-5.62-150400.4.19.1 * SUSE Linux Enterprise Micro for Rancher 5.4 (aarch64 s390x x86_64) * libbluetooth3-5.62-150400.4.19.1 * bluez-debuginfo-5.62-150400.4.19.1 * libbluetooth3-debuginfo-5.62-150400.4.19.1 * bluez-debugsource-5.62-150400.4.19.1 * SUSE Linux Enterprise Micro 5.4 (aarch64 s390x x86_64) * libbluetooth3-5.62-150400.4.19.1 * bluez-debuginfo-5.62-150400.4.19.1 * libbluetooth3-debuginfo-5.62-150400.4.19.1 * bluez-debugsource-5.62-150400.4.19.1 * SUSE Linux Enterprise High Performance Computing ESPOS 15 SP4 (aarch64 x86_64) * libbluetooth3-5.62-150400.4.19.1 * bluez-devel-5.62-150400.4.19.1 * bluez-deprecated-5.62-150400.4.19.1 * bluez-debuginfo-5.62-150400.4.19.1 * bluez-debugsource-5.62-150400.4.19.1 * libbluetooth3-debuginfo-5.62-150400.4.19.1 * bluez-deprecated-debuginfo-5.62-150400.4.19.1 * bluez-5.62-150400.4.19.1 * SUSE Linux Enterprise High Performance Computing LTSS 15 SP4 (aarch64 x86_64) * libbluetooth3-5.62-150400.4.19.1 * bluez-devel-5.62-150400.4.19.1 * bluez-deprecated-5.62-150400.4.19.1 * bluez-debuginfo-5.62-150400.4.19.1 * bluez-debugsource-5.62-150400.4.19.1 * libbluetooth3-debuginfo-5.62-150400.4.19.1 * bluez-deprecated-debuginfo-5.62-150400.4.19.1 * bluez-5.62-150400.4.19.1 * SUSE Linux Enterprise Desktop 15 SP4 LTSS 15-SP4 (x86_64) * libbluetooth3-5.62-150400.4.19.1 * bluez-cups-5.62-150400.4.19.1 * bluez-devel-5.62-150400.4.19.1 * bluez-deprecated-5.62-150400.4.19.1 * bluez-cups-debuginfo-5.62-150400.4.19.1 * bluez-debuginfo-5.62-150400.4.19.1 * bluez-debugsource-5.62-150400.4.19.1 * libbluetooth3-debuginfo-5.62-150400.4.19.1 * bluez-deprecated-debuginfo-5.62-150400.4.19.1 * bluez-5.62-150400.4.19.1 * SUSE Linux Enterprise Server 15 SP4 LTSS 15-SP4 (aarch64 ppc64le s390x x86_64) * libbluetooth3-5.62-150400.4.19.1 * bluez-devel-5.62-150400.4.19.1 * bluez-deprecated-5.62-150400.4.19.1 * bluez-debuginfo-5.62-150400.4.19.1 * bluez-debugsource-5.62-150400.4.19.1 * libbluetooth3-debuginfo-5.62-150400.4.19.1 * bluez-deprecated-debuginfo-5.62-150400.4.19.1 * bluez-5.62-150400.4.19.1 * SUSE Linux Enterprise Server for SAP Applications 15 SP4 (ppc64le x86_64) * libbluetooth3-5.62-150400.4.19.1 * bluez-devel-5.62-150400.4.19.1 * bluez-deprecated-5.62-150400.4.19.1 * bluez-debuginfo-5.62-150400.4.19.1 * bluez-debugsource-5.62-150400.4.19.1 * libbluetooth3-debuginfo-5.62-150400.4.19.1 * bluez-deprecated-debuginfo-5.62-150400.4.19.1 * bluez-5.62-150400.4.19.1 * SUSE Manager Proxy 4.3 (x86_64) * libbluetooth3-5.62-150400.4.19.1 * bluez-deprecated-5.62-150400.4.19.1 * bluez-debuginfo-5.62-150400.4.19.1 * bluez-debugsource-5.62-150400.4.19.1 * libbluetooth3-debuginfo-5.62-150400.4.19.1 * bluez-deprecated-debuginfo-5.62-150400.4.19.1 * bluez-5.62-150400.4.19.1 * SUSE Manager Retail Branch Server 4.3 (x86_64) * libbluetooth3-5.62-150400.4.19.1 * bluez-deprecated-5.62-150400.4.19.1 * bluez-debuginfo-5.62-150400.4.19.1 * bluez-debugsource-5.62-150400.4.19.1 * libbluetooth3-debuginfo-5.62-150400.4.19.1 * bluez-deprecated-debuginfo-5.62-150400.4.19.1 * bluez-5.62-150400.4.19.1 * SUSE Manager Server 4.3 (ppc64le s390x x86_64) * libbluetooth3-5.62-150400.4.19.1 * bluez-deprecated-5.62-150400.4.19.1 * bluez-debuginfo-5.62-150400.4.19.1 * bluez-debugsource-5.62-150400.4.19.1 * libbluetooth3-debuginfo-5.62-150400.4.19.1 * bluez-deprecated-debuginfo-5.62-150400.4.19.1 * bluez-5.62-150400.4.19.1 ## References: * https://www.suse.com/security/cve/CVE-2023-50229.html * https://www.suse.com/security/cve/CVE-2023-50230.html * https://bugzilla.suse.com/show_bug.cgi?id=1218300 * https://bugzilla.suse.com/show_bug.cgi?id=1218301

1 0

SUSE-SU-2024:0208-1: moderate: Security update for tomcat10
by OPENSUSE-UPDATES 24 Jan '24

24 Jan '24

# Security update for tomcat10 Announcement ID: SUSE-SU-2024:0208-1 Rating: moderate References: * bsc#1217649 Cross-References: * CVE-2023-46589 CVSS scores: * CVE-2023-46589 ( SUSE ): 5.9 CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:N * CVE-2023-46589 ( NVD ): 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N Affected Products: * openSUSE Leap 15.5 * SUSE Linux Enterprise High Performance Computing 15 SP5 * SUSE Linux Enterprise Server 15 SP5 * SUSE Linux Enterprise Server for SAP Applications 15 SP5 * Web and Scripting Module 15-SP5 An update that solves one vulnerability can now be installed. ## Description: This update for tomcat10 fixes the following issues: Updated to Tomcat 10.1.18 * CVE-2023-46589: Fixed HTTP request smuggling due to incorrect headers parsing (bsc#1217649) Find the full release notes at: https://tomcat.apache.org/tomcat-9.0-doc/changelog.html ## Patch Instructions: To install this SUSE update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: * openSUSE Leap 15.5 zypper in -t patch openSUSE-SLE-15.5-2024-208=1 * Web and Scripting Module 15-SP5 zypper in -t patch SUSE-SLE-Module-Web-Scripting-15-SP5-2024-208=1 ## Package List: * openSUSE Leap 15.5 (noarch) * tomcat10-el-5_0-api-10.1.18-150200.5.8.1 * tomcat10-jsp-3_1-api-10.1.18-150200.5.8.1 * tomcat10-servlet-6_0-api-10.1.18-150200.5.8.1 * tomcat10-embed-10.1.18-150200.5.8.1 * tomcat10-admin-webapps-10.1.18-150200.5.8.1 * tomcat10-docs-webapp-10.1.18-150200.5.8.1 * tomcat10-10.1.18-150200.5.8.1 * tomcat10-jsvc-10.1.18-150200.5.8.1 * tomcat10-lib-10.1.18-150200.5.8.1 * tomcat10-webapps-10.1.18-150200.5.8.1 * Web and Scripting Module 15-SP5 (noarch) * tomcat10-el-5_0-api-10.1.18-150200.5.8.1 * tomcat10-jsp-3_1-api-10.1.18-150200.5.8.1 * tomcat10-servlet-6_0-api-10.1.18-150200.5.8.1 * tomcat10-admin-webapps-10.1.18-150200.5.8.1 * tomcat10-10.1.18-150200.5.8.1 * tomcat10-lib-10.1.18-150200.5.8.1 * tomcat10-webapps-10.1.18-150200.5.8.1 ## References: * https://www.suse.com/security/cve/CVE-2023-46589.html * https://bugzilla.suse.com/show_bug.cgi?id=1217649

1 0

SUSE-SU-2024:0212-1: moderate: Security update for xwayland
by OPENSUSE-UPDATES 24 Jan '24

24 Jan '24

# Security update for xwayland Announcement ID: SUSE-SU-2024:0212-1 Rating: moderate References: * bsc#1218845 * bsc#1218846 Cross-References: * CVE-2024-0408 * CVE-2024-0409 CVSS scores: * CVE-2024-0408 ( SUSE ): 5.5 CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N * CVE-2024-0409 ( SUSE ): 5.5 CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N Affected Products: * openSUSE Leap 15.5 * SUSE Linux Enterprise Desktop 15 SP5 * SUSE Linux Enterprise Server 15 SP5 * SUSE Linux Enterprise Server for SAP Applications 15 SP5 * SUSE Linux Enterprise Workstation Extension 15 SP5 An update that solves two vulnerabilities can now be installed. ## Description: This update for xwayland fixes the following issues: * CVE-2024-0408: Fixed SELinux unlabeled GLX PBuffer. (bsc#1218845) * CVE-2024-0409: Fixed SELinux context corruption. (bsc#1218846) ## Patch Instructions: To install this SUSE update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: * openSUSE Leap 15.5 zypper in -t patch SUSE-2024-212=1 openSUSE-SLE-15.5-2024-212=1 * SUSE Linux Enterprise Workstation Extension 15 SP5 zypper in -t patch SUSE-SLE-Product-WE-15-SP5-2024-212=1 ## Package List: * openSUSE Leap 15.5 (aarch64 ppc64le s390x x86_64 i586) * xwayland-devel-22.1.5-150500.7.17.1 * xwayland-22.1.5-150500.7.17.1 * xwayland-debuginfo-22.1.5-150500.7.17.1 * xwayland-debugsource-22.1.5-150500.7.17.1 * SUSE Linux Enterprise Workstation Extension 15 SP5 (x86_64) * xwayland-22.1.5-150500.7.17.1 * xwayland-debuginfo-22.1.5-150500.7.17.1 * xwayland-debugsource-22.1.5-150500.7.17.1 ## References: * https://www.suse.com/security/cve/CVE-2024-0408.html * https://www.suse.com/security/cve/CVE-2024-0409.html * https://bugzilla.suse.com/show_bug.cgi?id=1218845 * https://bugzilla.suse.com/show_bug.cgi?id=1218846

1 0

SUSE-RU-2024:0213-1: moderate: Recommended update for ghostscript
by OPENSUSE-UPDATES 24 Jan '24

24 Jan '24

# Recommended update for ghostscript Announcement ID: SUSE-RU-2024:0213-1 Rating: moderate References: * bsc#1191841 Affected Products: * Basesystem Module 15-SP5 * openSUSE Leap 15.5 * SUSE Linux Enterprise Desktop 15 SP5 * SUSE Linux Enterprise High Performance Computing 15 SP5 * SUSE Linux Enterprise Real Time 15 SP5 * SUSE Linux Enterprise Server 15 SP5 * SUSE Linux Enterprise Server for SAP Applications 15 SP5 An update that has one fix can now be installed. ## Description: This update for ghostscript fixes the following issues: * Fix memory corruption while providing PDF with non-ASCII characters as input (bsc#1191841) ## Patch Instructions: To install this SUSE update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: * openSUSE Leap 15.5 zypper in -t patch openSUSE-SLE-15.5-2024-213=1 * Basesystem Module 15-SP5 zypper in -t patch SUSE-SLE-Module-Basesystem-15-SP5-2024-213=1 ## Package List: * openSUSE Leap 15.5 (aarch64 ppc64le s390x x86_64) * ghostscript-debugsource-9.52-150000.180.1 * ghostscript-x11-debuginfo-9.52-150000.180.1 * ghostscript-x11-9.52-150000.180.1 * ghostscript-debuginfo-9.52-150000.180.1 * ghostscript-devel-9.52-150000.180.1 * ghostscript-9.52-150000.180.1 * Basesystem Module 15-SP5 (aarch64 ppc64le s390x x86_64) * ghostscript-debugsource-9.52-150000.180.1 * ghostscript-x11-debuginfo-9.52-150000.180.1 * ghostscript-x11-9.52-150000.180.1 * ghostscript-debuginfo-9.52-150000.180.1 * ghostscript-devel-9.52-150000.180.1 * ghostscript-9.52-150000.180.1 ## References: * https://bugzilla.suse.com/show_bug.cgi?id=1191841

1 0