November 2022 - openSUSE Bugs - openSUSE Mailing Lists

[Bug 1202432] VUL-0: CVE-2022-24952: EternalTerminal: DoS triggered remotely by invalid sequence numbers
by bugzilla_noreply＠suse.com 02 Nov '22

02 Nov '22

https://bugzilla.suse.com/show_bug.cgi?id=1202432 https://bugzilla.suse.com/show_bug.cgi?id=1202432#c5 --- Comment #5 from Swamp Workflow Management <swamp(a)suse.de> --- openSUSE-SU-2022:10185-1: An update that fixes four vulnerabilities is now available. Category: security (important) Bug References: 1202432,1202433,1202434,1202435 CVE References: CVE-2022-24949,CVE-2022-24950,CVE-2022-24951,CVE-2022-24952 JIRA References: Sources used: openSUSE Backports SLE-15-SP4 (src): EternalTerminal-6.2.1-bp154.2.3.1 -- You are receiving this mail because: You are on the CC list for the bug.

1 0

[Bug 1204538] rsync --delay-updates never updates after interruption
by bugzilla_noreply＠suse.com 02 Nov '22

02 Nov '22

https://bugzilla.suse.com/show_bug.cgi?id=1204538 https://bugzilla.suse.com/show_bug.cgi?id=1204538#c5 --- Comment #5 from Swamp Workflow Management <swamp(a)suse.de> --- SUSE-RU-2022:3851-1: An update that has two recommended fixes can now be installed. Category: recommended (important) Bug References: 1202970,1204538 CVE References: JIRA References: Sources used: openSUSE Leap 15.4 (src): rsync-3.2.3-150400.3.8.1 SUSE Linux Enterprise Module for Basesystem 15-SP4 (src): rsync-3.2.3-150400.3.8.1 SUSE Linux Enterprise Micro 5.3 (src): rsync-3.2.3-150400.3.8.1 NOTE: This line indicates an update has been released for the listed product(s). At times this might be only a partial fix. If you have questions please reach out to maintenance coordination. -- You are receiving this mail because: You are on the CC list for the bug.

1 0

[Bug 1193584] VUL-0: CVE-2021-44540: Multiple issues fixed in Privoxy 3.0.33 stable
by bugzilla_noreply＠suse.com 02 Nov '22

02 Nov '22

https://bugzilla.suse.com/show_bug.cgi?id=1193584 https://bugzilla.suse.com/show_bug.cgi?id=1193584#c8 --- Comment #8 from Swamp Workflow Management <swamp(a)suse.de> --- openSUSE-SU-2022:10186-1: An update that fixes four vulnerabilities is now available. Category: security (important) Bug References: 1193584 CVE References: CVE-2021-44540,CVE-2021-44541,CVE-2021-44542,CVE-2021-44543 JIRA References: Sources used: openSUSE Backports SLE-15-SP4 (src): privoxy-3.0.33-bp154.3.3.1 -- You are receiving this mail because: You are on the CC list for the bug.

1 0

[Bug 1202435] VUL-0: CVE-2022-24949: EternalTerminal: privilege escalation to root
by bugzilla_noreply＠suse.com 02 Nov '22

02 Nov '22

https://bugzilla.suse.com/show_bug.cgi?id=1202435 https://bugzilla.suse.com/show_bug.cgi?id=1202435#c5 --- Comment #5 from Swamp Workflow Management <swamp(a)suse.de> --- openSUSE-SU-2022:10187-1: An update that fixes four vulnerabilities is now available. Category: security (important) Bug References: 1202432,1202433,1202434,1202435 CVE References: CVE-2022-24949,CVE-2022-24950,CVE-2022-24951,CVE-2022-24952 JIRA References: Sources used: openSUSE Backports SLE-15-SP3 (src): EternalTerminal-6.2.1-bp153.2.3.1 -- You are receiving this mail because: You are on the CC list for the bug.

1 0

[Bug 1202434] VUL-0: CVE-2022-24950: EternalTerminal: race condition allows authenticated attacker to hijack other users' SSH authorization socket
by bugzilla_noreply＠suse.com 02 Nov '22

02 Nov '22

https://bugzilla.suse.com/show_bug.cgi?id=1202434 https://bugzilla.suse.com/show_bug.cgi?id=1202434#c4 --- Comment #4 from Swamp Workflow Management <swamp(a)suse.de> --- openSUSE-SU-2022:10187-1: An update that fixes four vulnerabilities is now available. Category: security (important) Bug References: 1202432,1202433,1202434,1202435 CVE References: CVE-2022-24949,CVE-2022-24950,CVE-2022-24951,CVE-2022-24952 JIRA References: Sources used: openSUSE Backports SLE-15-SP3 (src): EternalTerminal-6.2.1-bp153.2.3.1 -- You are receiving this mail because: You are on the CC list for the bug.

1 0

[Bug 1202433] VUL-0: CVE-2022-24951: EternalTerminal: race condition allows local attacker to hijack IPC socket
by bugzilla_noreply＠suse.com 02 Nov '22

02 Nov '22

https://bugzilla.suse.com/show_bug.cgi?id=1202433 https://bugzilla.suse.com/show_bug.cgi?id=1202433#c4 --- Comment #4 from Swamp Workflow Management <swamp(a)suse.de> --- openSUSE-SU-2022:10187-1: An update that fixes four vulnerabilities is now available. Category: security (important) Bug References: 1202432,1202433,1202434,1202435 CVE References: CVE-2022-24949,CVE-2022-24950,CVE-2022-24951,CVE-2022-24952 JIRA References: Sources used: openSUSE Backports SLE-15-SP3 (src): EternalTerminal-6.2.1-bp153.2.3.1 -- You are receiving this mail because: You are on the CC list for the bug.

1 0

[Bug 1202432] VUL-0: CVE-2022-24952: EternalTerminal: DoS triggered remotely by invalid sequence numbers
by bugzilla_noreply＠suse.com 02 Nov '22

02 Nov '22

https://bugzilla.suse.com/show_bug.cgi?id=1202432 https://bugzilla.suse.com/show_bug.cgi?id=1202432#c4 --- Comment #4 from Swamp Workflow Management <swamp(a)suse.de> --- openSUSE-SU-2022:10187-1: An update that fixes four vulnerabilities is now available. Category: security (important) Bug References: 1202432,1202433,1202434,1202435 CVE References: CVE-2022-24949,CVE-2022-24950,CVE-2022-24951,CVE-2022-24952 JIRA References: Sources used: openSUSE Backports SLE-15-SP3 (src): EternalTerminal-6.2.1-bp153.2.3.1 -- You are receiving this mail because: You are on the CC list for the bug.

1 0

[Bug 1204980] VUL-0: CVE-2021-37789: stb: heap out of bounds read due to fractional resampling factors
by bugzilla_noreply＠suse.com 02 Nov '22

02 Nov '22

https://bugzilla.suse.com/show_bug.cgi?id=1204980 Maintenance Automation <maint-coord+maintenance-robot(a)suse.de> changed: What |Removed |Added ---------------------------------------------------------------------------- Priority|P5 - None |P3 - Medium -- You are receiving this mail because: You are on the CC list for the bug.

1 0

[Bug 1204980] New: VUL-0: CVE-2021-37789: stb: heap out of bounds read due to fractional resampling factors
by bugzilla_noreply＠suse.com 02 Nov '22

02 Nov '22

http://bugzilla.opensuse.org/show_bug.cgi?id=1204980 Bug ID: 1204980 Summary: VUL-0: CVE-2021-37789: stb: heap out of bounds read due to fractional resampling factors Classification: openSUSE Product: openSUSE Distribution Version: Leap 15.4 Hardware: Other URL: https://smash.suse.de/issue/346931/ OS: Other Status: NEW Severity: Normal Priority: P5 - None Component: Security Assignee: adrian.schroeter(a)suse.com Reporter: carlos.lopez(a)suse.com QA Contact: security-team(a)suse.de Found By: Security Response Team Blocker: --- CVE-2021-37789 stb_image.h 2.27 has a heap-based buffer over in stbi__jpeg_load, leading to Information Disclosure or Denial of Service. References: http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2021-37789 https://www.cve.org/CVERecord?id=CVE-2021-37789 https://github.com/nothings/stb/issues/1178 -- You are receiving this mail because: You are on the CC list for the bug.

1 1

[Bug 1204931] sypder-lang should be recommended and not required by spyer
by bugzilla_noreply＠suse.com 02 Nov '22

02 Nov '22

https://bugzilla.suse.com/show_bug.cgi?id=1204931 Benjamin Greiner <code(a)bnavigator.de> changed: What |Removed |Added ---------------------------------------------------------------------------- See Also| |https://bugzilla.suse.com/s | |how_bug.cgi?id=1163198 -- You are receiving this mail because: You are on the CC list for the bug.

1 0