October 2022 - openSUSE Security Announce

SUSE-SU-2022:3667-1: moderate: Security update for clone-master-clean-up
by opensuse-security＠opensuse.org 20 Oct '22

20 Oct '22

SUSE Security Update: Security update for clone-master-clean-up ______________________________________________________________________________ Announcement ID: SUSE-SU-2022:3667-1 Rating: moderate References: #1181050 #1203651 Cross-References: CVE-2021-32000 CVSS scores: CVE-2021-32000 (NVD) : 7.1 CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:H CVE-2021-32000 (SUSE): 5 CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:N/I:N/A:H Affected Products: SUSE Linux Enterprise High Performance Computing 15-SP3 SUSE Linux Enterprise High Performance Computing 15-SP4 SUSE Linux Enterprise Module for Server Applications 15-SP3 SUSE Linux Enterprise Module for Server Applications 15-SP4 SUSE Linux Enterprise Server 15-SP3 SUSE Linux Enterprise Server 15-SP4 SUSE Linux Enterprise Server for SAP Applications 15-SP3 SUSE Linux Enterprise Server for SAP Applications 15-SP4 SUSE Linux Enterprise Storage 7.1 SUSE Manager Proxy 4.2 SUSE Manager Proxy 4.3 SUSE Manager Retail Branch Server 4.2 SUSE Manager Retail Branch Server 4.3 SUSE Manager Server 4.2 SUSE Manager Server 4.3 openSUSE Leap 15.3 openSUSE Leap 15.4 ______________________________________________________________________________ An update that solves one vulnerability and has one errata is now available. Description: This update for clone-master-clean-up fixes the following issues: - CVE-2021-32000: Fixed some potentially dangerous file system operations (bsc#1181050). Bugfixes: - Fixed clone-master-clean-up failing to remove btrfs snapshots (bsc#1203651). Patch Instructions: To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 15.4: zypper in -t patch openSUSE-SLE-15.4-2022-3667=1 - openSUSE Leap 15.3: zypper in -t patch openSUSE-SLE-15.3-2022-3667=1 - SUSE Linux Enterprise Module for Server Applications 15-SP4: zypper in -t patch SUSE-SLE-Module-Server-Applications-15-SP4-2022-3667=1 - SUSE Linux Enterprise Module for Server Applications 15-SP3: zypper in -t patch SUSE-SLE-Module-Server-Applications-15-SP3-2022-3667=1 Package List: - openSUSE Leap 15.4 (noarch): clone-master-clean-up-1.8-150100.3.14.1 - openSUSE Leap 15.3 (noarch): clone-master-clean-up-1.8-150100.3.14.1 - SUSE Linux Enterprise Module for Server Applications 15-SP4 (noarch): clone-master-clean-up-1.8-150100.3.14.1 - SUSE Linux Enterprise Module for Server Applications 15-SP3 (noarch): clone-master-clean-up-1.8-150100.3.14.1 References: https://www.suse.com/security/cve/CVE-2021-32000.html https://bugzilla.suse.com/1181050 https://bugzilla.suse.com/1203651

1 0

SUSE-SU-2022:3668-1: important: Security update for go1.18
by opensuse-security＠opensuse.org 20 Oct '22

20 Oct '22

SUSE Security Update: Security update for go1.18 ______________________________________________________________________________ Announcement ID: SUSE-SU-2022:3668-1 Rating: important References: #1193742 #1204023 #1204024 #1204025 Cross-References: CVE-2022-2879 CVE-2022-2880 CVE-2022-41715 CVSS scores: CVE-2022-2879 (NVD) : 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H CVE-2022-2879 (SUSE): 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H CVE-2022-2880 (NVD) : 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N CVE-2022-2880 (SUSE): 7.5 CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H CVE-2022-41715 (NVD) : 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H CVE-2022-41715 (SUSE): 6.2 CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H Affected Products: SUSE Linux Enterprise Desktop 15-SP3 SUSE Linux Enterprise Desktop 15-SP4 SUSE Linux Enterprise High Performance Computing 15-SP3 SUSE Linux Enterprise High Performance Computing 15-SP4 SUSE Linux Enterprise Module for Development Tools 15-SP3 SUSE Linux Enterprise Module for Development Tools 15-SP4 SUSE Linux Enterprise Server 15-SP3 SUSE Linux Enterprise Server 15-SP4 SUSE Linux Enterprise Server for SAP Applications 15-SP3 SUSE Linux Enterprise Server for SAP Applications 15-SP4 SUSE Linux Enterprise Storage 7.1 SUSE Manager Proxy 4.2 SUSE Manager Proxy 4.3 SUSE Manager Retail Branch Server 4.2 SUSE Manager Retail Branch Server 4.3 SUSE Manager Server 4.2 SUSE Manager Server 4.3 openSUSE Leap 15.3 openSUSE Leap 15.4 ______________________________________________________________________________ An update that solves three vulnerabilities and has one errata is now available. Description: This update for go1.18 fixes the following issues: Updated to version 1.18.7 (bsc#1193742): - CVE-2022-41715: Fixed memory exhaustion in regexp/syntax (bsc#1204023). - CVE-2022-2879: Fixed unbounded memory consumption when reading headers in archive/tar (bsc#1204024). - CVE-2022-2880: Fixed ReverseProxy forwarding unparseable query parameters (bsc#1204025). Patch Instructions: To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 15.4: zypper in -t patch openSUSE-SLE-15.4-2022-3668=1 - openSUSE Leap 15.3: zypper in -t patch openSUSE-SLE-15.3-2022-3668=1 - SUSE Linux Enterprise Module for Development Tools 15-SP4: zypper in -t patch SUSE-SLE-Module-Development-Tools-15-SP4-2022-3668=1 - SUSE Linux Enterprise Module for Development Tools 15-SP3: zypper in -t patch SUSE-SLE-Module-Development-Tools-15-SP3-2022-3668=1 Package List: - openSUSE Leap 15.4 (aarch64 ppc64le s390x x86_64): go1.18-1.18.7-150000.1.34.1 go1.18-doc-1.18.7-150000.1.34.1 - openSUSE Leap 15.4 (aarch64 x86_64): go1.18-race-1.18.7-150000.1.34.1 - openSUSE Leap 15.3 (aarch64 ppc64le s390x x86_64): go1.18-1.18.7-150000.1.34.1 go1.18-doc-1.18.7-150000.1.34.1 - openSUSE Leap 15.3 (aarch64 x86_64): go1.18-race-1.18.7-150000.1.34.1 - SUSE Linux Enterprise Module for Development Tools 15-SP4 (aarch64 ppc64le s390x x86_64): go1.18-1.18.7-150000.1.34.1 go1.18-doc-1.18.7-150000.1.34.1 - SUSE Linux Enterprise Module for Development Tools 15-SP4 (aarch64 x86_64): go1.18-race-1.18.7-150000.1.34.1 - SUSE Linux Enterprise Module for Development Tools 15-SP3 (aarch64 ppc64le s390x x86_64): go1.18-1.18.7-150000.1.34.1 go1.18-doc-1.18.7-150000.1.34.1 - SUSE Linux Enterprise Module for Development Tools 15-SP3 (aarch64 x86_64): go1.18-race-1.18.7-150000.1.34.1 References: https://www.suse.com/security/cve/CVE-2022-2879.html https://www.suse.com/security/cve/CVE-2022-2880.html https://www.suse.com/security/cve/CVE-2022-41715.html https://bugzilla.suse.com/1193742 https://bugzilla.suse.com/1204023 https://bugzilla.suse.com/1204024 https://bugzilla.suse.com/1204025

1 0

SUSE-SU-2022:3669-1: important: Security update for go1.19
by opensuse-security＠opensuse.org 20 Oct '22

20 Oct '22

SUSE Security Update: Security update for go1.19 ______________________________________________________________________________ Announcement ID: SUSE-SU-2022:3669-1 Rating: important References: #1200441 #1204023 #1204024 #1204025 Cross-References: CVE-2022-2879 CVE-2022-2880 CVE-2022-41715 CVSS scores: CVE-2022-2879 (NVD) : 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H CVE-2022-2879 (SUSE): 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H CVE-2022-2880 (NVD) : 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N CVE-2022-2880 (SUSE): 7.5 CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H CVE-2022-41715 (NVD) : 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H CVE-2022-41715 (SUSE): 6.2 CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H Affected Products: SUSE Linux Enterprise Desktop 15-SP3 SUSE Linux Enterprise Desktop 15-SP4 SUSE Linux Enterprise High Performance Computing 15-SP3 SUSE Linux Enterprise High Performance Computing 15-SP4 SUSE Linux Enterprise Module for Development Tools 15-SP3 SUSE Linux Enterprise Module for Development Tools 15-SP4 SUSE Linux Enterprise Server 15-SP3 SUSE Linux Enterprise Server 15-SP4 SUSE Linux Enterprise Server for SAP Applications 15-SP3 SUSE Linux Enterprise Server for SAP Applications 15-SP4 SUSE Linux Enterprise Storage 7.1 SUSE Manager Proxy 4.2 SUSE Manager Proxy 4.3 SUSE Manager Retail Branch Server 4.2 SUSE Manager Retail Branch Server 4.3 SUSE Manager Server 4.2 SUSE Manager Server 4.3 openSUSE Leap 15.3 openSUSE Leap 15.4 ______________________________________________________________________________ An update that solves three vulnerabilities and has one errata is now available. Description: This update for go1.19 fixes the following issues: Updated to version 1.19.2 (bsc#1200441): - CVE-2022-41715: Fixed memory exhaustion in regexp/syntax (bsc#1204023). - CVE-2022-2879: Fixed unbounded memory consumption when reading headers in archive/tar (bsc#1204024). - CVE-2022-2880: Fixed ReverseProxy forwarding unparseable query parameters (bsc#1204025). Patch Instructions: To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 15.4: zypper in -t patch openSUSE-SLE-15.4-2022-3669=1 - openSUSE Leap 15.3: zypper in -t patch openSUSE-SLE-15.3-2022-3669=1 - SUSE Linux Enterprise Module for Development Tools 15-SP4: zypper in -t patch SUSE-SLE-Module-Development-Tools-15-SP4-2022-3669=1 - SUSE Linux Enterprise Module for Development Tools 15-SP3: zypper in -t patch SUSE-SLE-Module-Development-Tools-15-SP3-2022-3669=1 Package List: - openSUSE Leap 15.4 (aarch64 ppc64le s390x x86_64): go1.19-1.19.2-150000.1.12.1 go1.19-doc-1.19.2-150000.1.12.1 - openSUSE Leap 15.4 (aarch64 x86_64): go1.19-race-1.19.2-150000.1.12.1 - openSUSE Leap 15.3 (aarch64 ppc64le s390x x86_64): go1.19-1.19.2-150000.1.12.1 go1.19-doc-1.19.2-150000.1.12.1 - openSUSE Leap 15.3 (aarch64 x86_64): go1.19-race-1.19.2-150000.1.12.1 - SUSE Linux Enterprise Module for Development Tools 15-SP4 (aarch64 ppc64le s390x x86_64): go1.19-1.19.2-150000.1.12.1 go1.19-doc-1.19.2-150000.1.12.1 - SUSE Linux Enterprise Module for Development Tools 15-SP4 (aarch64 x86_64): go1.19-race-1.19.2-150000.1.12.1 - SUSE Linux Enterprise Module for Development Tools 15-SP3 (aarch64 ppc64le s390x x86_64): go1.19-1.19.2-150000.1.12.1 go1.19-doc-1.19.2-150000.1.12.1 - SUSE Linux Enterprise Module for Development Tools 15-SP3 (aarch64 x86_64): go1.19-race-1.19.2-150000.1.12.1 References: https://www.suse.com/security/cve/CVE-2022-2879.html https://www.suse.com/security/cve/CVE-2022-2880.html https://www.suse.com/security/cve/CVE-2022-41715.html https://bugzilla.suse.com/1200441 https://bugzilla.suse.com/1204023 https://bugzilla.suse.com/1204024 https://bugzilla.suse.com/1204025

1 0

SUSE-SU-2022:3666-1: important: Security update for helm
by opensuse-security＠opensuse.org 19 Oct '22

19 Oct '22

SUSE Security Update: Security update for helm ______________________________________________________________________________ Announcement ID: SUSE-SU-2022:3666-1 Rating: important References: #1200528 #1203054 Cross-References: CVE-2022-1996 CVE-2022-36055 CVSS scores: CVE-2022-1996 (NVD) : 9.1 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N CVE-2022-1996 (SUSE): 7.5 CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H CVE-2022-36055 (NVD) : 6.5 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H CVE-2022-36055 (SUSE): 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H Affected Products: SUSE Linux Enterprise High Performance Computing 15-SP3 SUSE Linux Enterprise High Performance Computing 15-SP4 SUSE Linux Enterprise Module for Containers 15-SP3 SUSE Linux Enterprise Module for Containers 15-SP4 SUSE Linux Enterprise Module for Packagehub Subpackages 15-SP3 SUSE Linux Enterprise Module for Packagehub Subpackages 15-SP4 SUSE Linux Enterprise Server 15-SP3 SUSE Linux Enterprise Server 15-SP4 SUSE Linux Enterprise Server for SAP Applications 15-SP3 SUSE Linux Enterprise Server for SAP Applications 15-SP4 SUSE Linux Enterprise Storage 7.1 SUSE Manager Proxy 4.2 SUSE Manager Proxy 4.3 SUSE Manager Retail Branch Server 4.2 SUSE Manager Retail Branch Server 4.3 SUSE Manager Server 4.2 SUSE Manager Server 4.3 openSUSE Leap 15.3 openSUSE Leap 15.4 ______________________________________________________________________________ An update that fixes two vulnerabilities is now available. Description: This update for helm fixes the following issues: helm was updated to version 3.9.4: * CVE-2022-36055: Fixed denial of service through string value parsing (bsc#1203054). * Updating the certificates used for testing * Updating index handling helm was updated to version 3.9.3: - CVE-2022-1996: Updated kube-openapi to fix an issue that could result in a CORS protection bypass (bsc#1200528). * Fix missing array length check on release helm was updated to version 3.9.2: * Update of the circleci image helm was updated to version 3.9.1: * Update to support Kubernetes 1.24.2 * Improve logging and safety of statefulSetReady * Make token caching an opt-in feature * Bump github.com/lib/pq from 1.10.5 to 1.10.6 * Bump github.com/Masterminds/squirrel from 1.5.2 to 1.5.3 helm was updated to version 3.9.0: * Added a --quiet flag to helm lint * Added a --post-renderer-args flag to support arguments being passed to the post renderer * Added more checks during the signing process * Updated to add Kubernetes 1.24 support helm was updated to version 3.8.2: * Bump oras.land/oras-go from 1.1.0 to 1.1.1 * Fixing downloader plugin error handling * Simplify testdata charts * Simplify testdata charts * Add tests for multi-level dependencies. * Fix value precedence * Bumping Kubernetes package versions * Updating vcs to latest version * Dont modify provided transport * Pass http getter as pointer in tests * Add docs block * Add transport option and tests * Reuse http transport * Updating Kubernetes libs to 0.23.4 (latest) * fix: remove deadcode * fix: helm package tests * fix: helm package with dependency update for charts with OCI dependencies * Fix typo Unset the env var before func return in Unit Test * add legal name check * maint: fix syntax error in deploy.sh * linting issue fixed * only apply overwrite if version is canary * overwrite flag added to az storage blob upload-batch * Avoid querying for OCI tags can explicit version provided in chart dependencies * Management of bearer tokens for tag listing * Updating Kubernetes packages to 1.23.3 * refactor: use `os.ReadDir` for lightweight directory reading * Add IngressClass to manifests to be (un)installed * feat(comp): Shell completion for OCI * Fix install memory/goroutine leak Patch Instructions: To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 15.4: zypper in -t patch openSUSE-SLE-15.4-2022-3666=1 - openSUSE Leap 15.3: zypper in -t patch openSUSE-SLE-15.3-2022-3666=1 - SUSE Linux Enterprise Module for Packagehub Subpackages 15-SP4: zypper in -t patch SUSE-SLE-Module-Packagehub-Subpackages-15-SP4-2022-3666=1 - SUSE Linux Enterprise Module for Packagehub Subpackages 15-SP3: zypper in -t patch SUSE-SLE-Module-Packagehub-Subpackages-15-SP3-2022-3666=1 - SUSE Linux Enterprise Module for Containers 15-SP4: zypper in -t patch SUSE-SLE-Module-Containers-15-SP4-2022-3666=1 - SUSE Linux Enterprise Module for Containers 15-SP3: zypper in -t patch SUSE-SLE-Module-Containers-15-SP3-2022-3666=1 Package List: - openSUSE Leap 15.4 (aarch64 ppc64le s390x x86_64): helm-3.9.4-150000.1.10.3 helm-debuginfo-3.9.4-150000.1.10.3 - openSUSE Leap 15.4 (noarch): helm-bash-completion-3.9.4-150000.1.10.3 helm-fish-completion-3.9.4-150000.1.10.3 helm-zsh-completion-3.9.4-150000.1.10.3 - openSUSE Leap 15.3 (aarch64 ppc64le s390x x86_64): helm-3.9.4-150000.1.10.3 helm-debuginfo-3.9.4-150000.1.10.3 - openSUSE Leap 15.3 (noarch): helm-bash-completion-3.9.4-150000.1.10.3 helm-zsh-completion-3.9.4-150000.1.10.3 - SUSE Linux Enterprise Module for Packagehub Subpackages 15-SP4 (noarch): helm-fish-completion-3.9.4-150000.1.10.3 - SUSE Linux Enterprise Module for Packagehub Subpackages 15-SP3 (noarch): helm-fish-completion-3.9.4-150000.1.10.3 - SUSE Linux Enterprise Module for Containers 15-SP4 (aarch64 ppc64le s390x x86_64): helm-3.9.4-150000.1.10.3 helm-debuginfo-3.9.4-150000.1.10.3 - SUSE Linux Enterprise Module for Containers 15-SP4 (noarch): helm-bash-completion-3.9.4-150000.1.10.3 helm-zsh-completion-3.9.4-150000.1.10.3 - SUSE Linux Enterprise Module for Containers 15-SP3 (aarch64 ppc64le s390x x86_64): helm-3.9.4-150000.1.10.3 helm-debuginfo-3.9.4-150000.1.10.3 - SUSE Linux Enterprise Module for Containers 15-SP3 (noarch): helm-bash-completion-3.9.4-150000.1.10.3 helm-zsh-completion-3.9.4-150000.1.10.3 References: https://www.suse.com/security/cve/CVE-2022-1996.html https://www.suse.com/security/cve/CVE-2022-36055.html https://bugzilla.suse.com/1200528 https://bugzilla.suse.com/1203054

1 0

SUSE-SU-2022:3665-1: important: Security update for xen
by opensuse-security＠opensuse.org 19 Oct '22

19 Oct '22

SUSE Security Update: Security update for xen ______________________________________________________________________________ Announcement ID: SUSE-SU-2022:3665-1 Rating: important References: #1027519 #1167608 #1185104 #1197081 #1200762 #1201394 #1201631 #1203806 #1203807 Cross-References: CVE-2021-28689 CVE-2022-26365 CVE-2022-33740 CVE-2022-33741 CVE-2022-33742 CVE-2022-33745 CVE-2022-33746 CVE-2022-33748 CVSS scores: CVE-2021-28689 (NVD) : 5.5 CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N CVE-2021-28689 (SUSE): 5.5 CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N CVE-2022-26365 (NVD) : 7.1 CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:H CVE-2022-26365 (SUSE): 6.6 CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:H CVE-2022-33740 (NVD) : 7.1 CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:H CVE-2022-33740 (SUSE): 6.6 CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:H CVE-2022-33741 (NVD) : 7.1 CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:H CVE-2022-33741 (SUSE): 6.6 CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:H CVE-2022-33742 (NVD) : 7.1 CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:H CVE-2022-33742 (SUSE): 6.6 CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:H CVE-2022-33745 (NVD) : 8.8 CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H CVE-2022-33745 (SUSE): 7.5 CVSS:3.1/AV:L/AC:H/PR:H/UI:N/S:C/C:H/I:H/A:H CVE-2022-33746 (NVD) : 6.5 CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:N/I:N/A:H CVE-2022-33746 (SUSE): 5.3 CVSS:3.1/AV:L/AC:H/PR:H/UI:N/S:C/C:N/I:N/A:H CVE-2022-33748 (NVD) : 5.6 CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:C/C:N/I:N/A:H CVE-2022-33748 (SUSE): 5.3 CVSS:3.1/AV:L/AC:H/PR:H/UI:N/S:C/C:N/I:N/A:H Affected Products: SUSE Linux Enterprise Desktop 15-SP3 SUSE Linux Enterprise High Performance Computing 15-SP3 SUSE Linux Enterprise Micro 5.1 SUSE Linux Enterprise Micro 5.2 SUSE Linux Enterprise Module for Basesystem 15-SP3 SUSE Linux Enterprise Module for Server Applications 15-SP3 SUSE Linux Enterprise Server 15-SP3 SUSE Linux Enterprise Server for SAP Applications 15-SP3 SUSE Linux Enterprise Storage 7.1 SUSE Manager Proxy 4.2 SUSE Manager Retail Branch Server 4.2 SUSE Manager Server 4.2 openSUSE Leap 15.3 openSUSE Leap Micro 5.2 ______________________________________________________________________________ An update that solves 8 vulnerabilities and has one errata is now available. Description: This update for xen fixes the following issues: - CVE-2022-33746: Fixed DoS due to excessively long P2M pool freeing (bsc#1203806). - CVE-2022-33748: Fixed DoS due to race in locking (bsc#1203807). - CVE-2022-26365: Fixed issue where Linux Block and Network PV device frontends don't zero memory regions before sharing them with the backend (bsc#1200762). - CVE-2022-33740: Fixed issue where Linux Block and Network PV device frontends don't zero memory regions before sharing them with the backend (bsc#1200762). - CVE-2022-33741: Fixed issue where data residing in the same 4K page as data shared with a backend was being accessible by such backend (bsc#1200762). - CVE-2022-33742: Fixed issue where data residing in the same 4K page as data shared with a backend was being accessible by such backend (bsc#1200762). - CVE-2022-33745: Fixed an insufficient TLB flush for x86 PV guests in shadow mode (bsc#1201394). - CVE-2021-28689: Fixed speculative vulnerabilities with bare (non-shim) 32-bit PV guests (bsc#1185104). Bugfixes: - Fixed logic error in built-in default of max_event_channels (bsc#1167608, bsc#1201631). - Fixed issue where dom0 fails to boot with constrained vcpus and nodes (bsc#1197081). - Included upstream bugfixes (bsc#1027519). Patch Instructions: To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap Micro 5.2: zypper in -t patch openSUSE-Leap-Micro-5.2-2022-3665=1 - openSUSE Leap 15.3: zypper in -t patch openSUSE-SLE-15.3-2022-3665=1 - SUSE Linux Enterprise Module for Server Applications 15-SP3: zypper in -t patch SUSE-SLE-Module-Server-Applications-15-SP3-2022-3665=1 - SUSE Linux Enterprise Module for Basesystem 15-SP3: zypper in -t patch SUSE-SLE-Module-Basesystem-15-SP3-2022-3665=1 - SUSE Linux Enterprise Micro 5.2: zypper in -t patch SUSE-SUSE-MicroOS-5.2-2022-3665=1 - SUSE Linux Enterprise Micro 5.1: zypper in -t patch SUSE-SUSE-MicroOS-5.1-2022-3665=1 Package List: - openSUSE Leap Micro 5.2 (x86_64): xen-debugsource-4.14.5_06-150300.3.35.1 xen-libs-4.14.5_06-150300.3.35.1 xen-libs-debuginfo-4.14.5_06-150300.3.35.1 - openSUSE Leap 15.3 (aarch64 x86_64): xen-4.14.5_06-150300.3.35.1 xen-debugsource-4.14.5_06-150300.3.35.1 xen-devel-4.14.5_06-150300.3.35.1 xen-doc-html-4.14.5_06-150300.3.35.1 xen-libs-4.14.5_06-150300.3.35.1 xen-libs-debuginfo-4.14.5_06-150300.3.35.1 xen-tools-4.14.5_06-150300.3.35.1 xen-tools-debuginfo-4.14.5_06-150300.3.35.1 xen-tools-domU-4.14.5_06-150300.3.35.1 xen-tools-domU-debuginfo-4.14.5_06-150300.3.35.1 - openSUSE Leap 15.3 (x86_64): xen-libs-32bit-4.14.5_06-150300.3.35.1 xen-libs-32bit-debuginfo-4.14.5_06-150300.3.35.1 - openSUSE Leap 15.3 (noarch): xen-tools-xendomains-wait-disk-4.14.5_06-150300.3.35.1 - SUSE Linux Enterprise Module for Server Applications 15-SP3 (x86_64): xen-4.14.5_06-150300.3.35.1 xen-debugsource-4.14.5_06-150300.3.35.1 xen-devel-4.14.5_06-150300.3.35.1 xen-tools-4.14.5_06-150300.3.35.1 xen-tools-debuginfo-4.14.5_06-150300.3.35.1 - SUSE Linux Enterprise Module for Server Applications 15-SP3 (noarch): xen-tools-xendomains-wait-disk-4.14.5_06-150300.3.35.1 - SUSE Linux Enterprise Module for Basesystem 15-SP3 (x86_64): xen-debugsource-4.14.5_06-150300.3.35.1 xen-libs-4.14.5_06-150300.3.35.1 xen-libs-debuginfo-4.14.5_06-150300.3.35.1 xen-tools-domU-4.14.5_06-150300.3.35.1 xen-tools-domU-debuginfo-4.14.5_06-150300.3.35.1 - SUSE Linux Enterprise Micro 5.2 (x86_64): xen-debugsource-4.14.5_06-150300.3.35.1 xen-libs-4.14.5_06-150300.3.35.1 xen-libs-debuginfo-4.14.5_06-150300.3.35.1 - SUSE Linux Enterprise Micro 5.1 (x86_64): xen-debugsource-4.14.5_06-150300.3.35.1 xen-libs-4.14.5_06-150300.3.35.1 xen-libs-debuginfo-4.14.5_06-150300.3.35.1 References: https://www.suse.com/security/cve/CVE-2021-28689.html https://www.suse.com/security/cve/CVE-2022-26365.html https://www.suse.com/security/cve/CVE-2022-33740.html https://www.suse.com/security/cve/CVE-2022-33741.html https://www.suse.com/security/cve/CVE-2022-33742.html https://www.suse.com/security/cve/CVE-2022-33745.html https://www.suse.com/security/cve/CVE-2022-33746.html https://www.suse.com/security/cve/CVE-2022-33748.html https://bugzilla.suse.com/1027519 https://bugzilla.suse.com/1167608 https://bugzilla.suse.com/1185104 https://bugzilla.suse.com/1197081 https://bugzilla.suse.com/1200762 https://bugzilla.suse.com/1201394 https://bugzilla.suse.com/1201631 https://bugzilla.suse.com/1203806 https://bugzilla.suse.com/1203807

1 0

SUSE-SU-2022:3656-1: important: Security update for nodejs16
by opensuse-security＠opensuse.org 19 Oct '22

19 Oct '22

SUSE Security Update: Security update for nodejs16 ______________________________________________________________________________ Announcement ID: SUSE-SU-2022:3656-1 Rating: important References: #1201325 #1201327 #1203831 #1203832 Cross-References: CVE-2022-32213 CVE-2022-32215 CVE-2022-35255 CVE-2022-35256 CVSS scores: CVE-2022-32213 (NVD) : 9.1 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N CVE-2022-32213 (SUSE): 6.8 CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:N/I:H/A:H CVE-2022-32215 (NVD) : 9.1 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N CVE-2022-32215 (SUSE): 6.8 CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:N CVE-2022-35255 (SUSE): 8.2 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:N CVE-2022-35256 (SUSE): 6.5 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N Affected Products: SUSE Linux Enterprise High Performance Computing 15-SP4 SUSE Linux Enterprise Module for Web Scripting 15-SP4 SUSE Linux Enterprise Server 15-SP4 SUSE Linux Enterprise Server for SAP Applications 15-SP4 SUSE Manager Proxy 4.3 SUSE Manager Retail Branch Server 4.3 SUSE Manager Server 4.3 openSUSE Leap 15.4 ______________________________________________________________________________ An update that fixes four vulnerabilities is now available. Description: This update for nodejs16 fixes the following issues: Updated to version 16.17.1: - CVE-2022-32213: Fixed bypass via obs-fold mechanic (bsc#1201325). - CVE-2022-32215: Fixed incorrect Parsing of Multi-line Transfer-Encoding (bsc#1201327). - CVE-2022-35256: Fixed incorrect Parsing of Header Fields (bsc#1203832). - CVE-2022-35255: FIxed weak randomness in WebCrypto keygen (bsc#1203831). Patch Instructions: To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 15.4: zypper in -t patch openSUSE-SLE-15.4-2022-3656=1 - SUSE Linux Enterprise Module for Web Scripting 15-SP4: zypper in -t patch SUSE-SLE-Module-Web-Scripting-15-SP4-2022-3656=1 Package List: - openSUSE Leap 15.4 (aarch64 ppc64le s390x x86_64): corepack16-16.17.1-150400.3.9.1 nodejs16-16.17.1-150400.3.9.1 nodejs16-debuginfo-16.17.1-150400.3.9.1 nodejs16-debugsource-16.17.1-150400.3.9.1 nodejs16-devel-16.17.1-150400.3.9.1 npm16-16.17.1-150400.3.9.1 - openSUSE Leap 15.4 (noarch): nodejs16-docs-16.17.1-150400.3.9.1 - SUSE Linux Enterprise Module for Web Scripting 15-SP4 (aarch64 ppc64le s390x x86_64): nodejs16-16.17.1-150400.3.9.1 nodejs16-debuginfo-16.17.1-150400.3.9.1 nodejs16-debugsource-16.17.1-150400.3.9.1 nodejs16-devel-16.17.1-150400.3.9.1 npm16-16.17.1-150400.3.9.1 - SUSE Linux Enterprise Module for Web Scripting 15-SP4 (noarch): nodejs16-docs-16.17.1-150400.3.9.1 References: https://www.suse.com/security/cve/CVE-2022-32213.html https://www.suse.com/security/cve/CVE-2022-32215.html https://www.suse.com/security/cve/CVE-2022-35255.html https://www.suse.com/security/cve/CVE-2022-35256.html https://bugzilla.suse.com/1201325 https://bugzilla.suse.com/1201327 https://bugzilla.suse.com/1203831 https://bugzilla.suse.com/1203832

1 0

SUSE-SU-2022:3655-1: important: Security update for buildah
by opensuse-security＠opensuse.org 19 Oct '22

19 Oct '22

SUSE Security Update: Security update for buildah ______________________________________________________________________________ Announcement ID: SUSE-SU-2022:3655-1 Rating: important References: #1167864 #1181961 #1202812 Cross-References: CVE-2020-10696 CVE-2021-20206 CVE-2022-2990 CVSS scores: CVE-2020-10696 (NVD) : 8.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H CVE-2020-10696 (SUSE): 8.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H CVE-2021-20206 (NVD) : 7.2 CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H CVE-2021-20206 (SUSE): 7.2 CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H CVE-2022-2990 (NVD) : 7.1 CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N CVE-2022-2990 (SUSE): 4.4 CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N Affected Products: SUSE Linux Enterprise High Performance Computing 15-SP4 SUSE Linux Enterprise Module for Containers 15-SP4 SUSE Linux Enterprise Server 15-SP4 SUSE Linux Enterprise Server for SAP Applications 15-SP4 SUSE Manager Proxy 4.3 SUSE Manager Retail Branch Server 4.3 SUSE Manager Server 4.3 openSUSE Leap 15.4 ______________________________________________________________________________ An update that fixes three vulnerabilities is now available. Description: This update for buildah fixes the following issues: Buildah was updated to version 1.27.1: - CVE-2021-20206: Fixed an issue in libcni that could allow an attacker to execute arbitrary binaries on the host (bsc#1181961). - CVE-2020-10696: Fixed an issue that could lead to files being overwritten during the image building process (bsc#1167864). - CVE-2022-2990: Fixed a possible information disclosure and modification (bsc#1202812). Patch Instructions: To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 15.4: zypper in -t patch openSUSE-SLE-15.4-2022-3655=1 - SUSE Linux Enterprise Module for Containers 15-SP4: zypper in -t patch SUSE-SLE-Module-Containers-15-SP4-2022-3655=1 Package List: - openSUSE Leap 15.4 (aarch64 ppc64le s390x x86_64): buildah-1.27.1-150400.3.8.1 - SUSE Linux Enterprise Module for Containers 15-SP4 (aarch64 ppc64le s390x x86_64): buildah-1.27.1-150400.3.8.1 References: https://www.suse.com/security/cve/CVE-2020-10696.html https://www.suse.com/security/cve/CVE-2021-20206.html https://www.suse.com/security/cve/CVE-2022-2990.html https://bugzilla.suse.com/1167864 https://bugzilla.suse.com/1181961 https://bugzilla.suse.com/1202812

1 0

SUSE-SU-2022:3660-1: moderate: Security update for qemu
by opensuse-security＠opensuse.org 19 Oct '22

19 Oct '22

SUSE Security Update: Security update for qemu ______________________________________________________________________________ Announcement ID: SUSE-SU-2022:3660-1 Rating: moderate References: #1192115 #1198038 #1201367 Cross-References: CVE-2022-0216 CVE-2022-35414 CVSS scores: CVE-2022-0216 (NVD) : 4.4 CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H CVE-2022-0216 (SUSE): 5.3 CVSS:3.1/AV:L/AC:H/PR:H/UI:N/S:C/C:N/I:N/A:H CVE-2022-35414 (NVD) : 8.8 CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H CVE-2022-35414 (SUSE): 6 CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:C/C:N/I:N/A:H Affected Products: SUSE Linux Enterprise Desktop 15-SP3 SUSE Linux Enterprise High Performance Computing 15-SP3 SUSE Linux Enterprise Micro 5.1 SUSE Linux Enterprise Micro 5.2 SUSE Linux Enterprise Module for Basesystem 15-SP3 SUSE Linux Enterprise Module for Server Applications 15-SP3 SUSE Linux Enterprise Server 15-SP3 SUSE Linux Enterprise Server for SAP Applications 15-SP3 SUSE Linux Enterprise Storage 7.1 SUSE Manager Proxy 4.2 SUSE Manager Retail Branch Server 4.2 SUSE Manager Server 4.2 openSUSE Leap 15.3 openSUSE Leap Micro 5.2 ______________________________________________________________________________ An update that solves two vulnerabilities and has one errata is now available. Description: This update for qemu fixes the following issues: - CVE-2022-0216: Fixed a use after free issue found in hw/scsi/lsi53c895a.c. (bsc#1198038) - CVE-2022-35414: Fixed an uninitialized read during address translation that leads to a crash. (bsc#1201367) Patch Instructions: To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap Micro 5.2: zypper in -t patch openSUSE-Leap-Micro-5.2-2022-3660=1 - openSUSE Leap 15.3: zypper in -t patch openSUSE-SLE-15.3-2022-3660=1 - SUSE Linux Enterprise Module for Server Applications 15-SP3: zypper in -t patch SUSE-SLE-Module-Server-Applications-15-SP3-2022-3660=1 - SUSE Linux Enterprise Module for Basesystem 15-SP3: zypper in -t patch SUSE-SLE-Module-Basesystem-15-SP3-2022-3660=1 - SUSE Linux Enterprise Micro 5.2: zypper in -t patch SUSE-SUSE-MicroOS-5.2-2022-3660=1 - SUSE Linux Enterprise Micro 5.1: zypper in -t patch SUSE-SUSE-MicroOS-5.1-2022-3660=1 Package List: - openSUSE Leap Micro 5.2 (aarch64 x86_64): qemu-5.2.0-150300.118.3 qemu-audio-spice-5.2.0-150300.118.3 qemu-audio-spice-debuginfo-5.2.0-150300.118.3 qemu-chardev-spice-5.2.0-150300.118.3 qemu-chardev-spice-debuginfo-5.2.0-150300.118.3 qemu-debuginfo-5.2.0-150300.118.3 qemu-debugsource-5.2.0-150300.118.3 qemu-guest-agent-5.2.0-150300.118.3 qemu-guest-agent-debuginfo-5.2.0-150300.118.3 qemu-hw-display-qxl-5.2.0-150300.118.3 qemu-hw-display-qxl-debuginfo-5.2.0-150300.118.3 qemu-hw-display-virtio-gpu-5.2.0-150300.118.3 qemu-hw-display-virtio-gpu-debuginfo-5.2.0-150300.118.3 qemu-hw-display-virtio-vga-5.2.0-150300.118.3 qemu-hw-display-virtio-vga-debuginfo-5.2.0-150300.118.3 qemu-hw-usb-redirect-5.2.0-150300.118.3 qemu-hw-usb-redirect-debuginfo-5.2.0-150300.118.3 qemu-tools-5.2.0-150300.118.3 qemu-tools-debuginfo-5.2.0-150300.118.3 qemu-ui-opengl-5.2.0-150300.118.3 qemu-ui-opengl-debuginfo-5.2.0-150300.118.3 qemu-ui-spice-core-5.2.0-150300.118.3 qemu-ui-spice-core-debuginfo-5.2.0-150300.118.3 - openSUSE Leap Micro 5.2 (aarch64): qemu-arm-5.2.0-150300.118.3 qemu-arm-debuginfo-5.2.0-150300.118.3 - openSUSE Leap Micro 5.2 (noarch): qemu-ipxe-1.0.0+-150300.118.3 qemu-seabios-1.14.0_0_g155821a-150300.118.3 qemu-sgabios-8-150300.118.3 qemu-vgabios-1.14.0_0_g155821a-150300.118.3 - openSUSE Leap Micro 5.2 (x86_64): qemu-x86-5.2.0-150300.118.3 qemu-x86-debuginfo-5.2.0-150300.118.3 - openSUSE Leap 15.3 (aarch64 ppc64le s390x x86_64): qemu-5.2.0-150300.118.3 qemu-arm-5.2.0-150300.118.3 qemu-arm-debuginfo-5.2.0-150300.118.3 qemu-audio-alsa-5.2.0-150300.118.3 qemu-audio-alsa-debuginfo-5.2.0-150300.118.3 qemu-audio-pa-5.2.0-150300.118.3 qemu-audio-pa-debuginfo-5.2.0-150300.118.3 qemu-audio-spice-5.2.0-150300.118.3 qemu-audio-spice-debuginfo-5.2.0-150300.118.3 qemu-block-curl-5.2.0-150300.118.3 qemu-block-curl-debuginfo-5.2.0-150300.118.3 qemu-block-dmg-5.2.0-150300.118.3 qemu-block-dmg-debuginfo-5.2.0-150300.118.3 qemu-block-gluster-5.2.0-150300.118.3 qemu-block-gluster-debuginfo-5.2.0-150300.118.3 qemu-block-iscsi-5.2.0-150300.118.3 qemu-block-iscsi-debuginfo-5.2.0-150300.118.3 qemu-block-nfs-5.2.0-150300.118.3 qemu-block-nfs-debuginfo-5.2.0-150300.118.3 qemu-block-rbd-5.2.0-150300.118.3 qemu-block-rbd-debuginfo-5.2.0-150300.118.3 qemu-block-ssh-5.2.0-150300.118.3 qemu-block-ssh-debuginfo-5.2.0-150300.118.3 qemu-chardev-baum-5.2.0-150300.118.3 qemu-chardev-baum-debuginfo-5.2.0-150300.118.3 qemu-chardev-spice-5.2.0-150300.118.3 qemu-chardev-spice-debuginfo-5.2.0-150300.118.3 qemu-debuginfo-5.2.0-150300.118.3 qemu-debugsource-5.2.0-150300.118.3 qemu-extra-5.2.0-150300.118.3 qemu-extra-debuginfo-5.2.0-150300.118.3 qemu-guest-agent-5.2.0-150300.118.3 qemu-guest-agent-debuginfo-5.2.0-150300.118.3 qemu-hw-display-qxl-5.2.0-150300.118.3 qemu-hw-display-qxl-debuginfo-5.2.0-150300.118.3 qemu-hw-display-virtio-gpu-5.2.0-150300.118.3 qemu-hw-display-virtio-gpu-debuginfo-5.2.0-150300.118.3 qemu-hw-display-virtio-gpu-pci-5.2.0-150300.118.3 qemu-hw-display-virtio-gpu-pci-debuginfo-5.2.0-150300.118.3 qemu-hw-display-virtio-vga-5.2.0-150300.118.3 qemu-hw-display-virtio-vga-debuginfo-5.2.0-150300.118.3 qemu-hw-s390x-virtio-gpu-ccw-5.2.0-150300.118.3 qemu-hw-s390x-virtio-gpu-ccw-debuginfo-5.2.0-150300.118.3 qemu-hw-usb-redirect-5.2.0-150300.118.3 qemu-hw-usb-redirect-debuginfo-5.2.0-150300.118.3 qemu-hw-usb-smartcard-5.2.0-150300.118.3 qemu-hw-usb-smartcard-debuginfo-5.2.0-150300.118.3 qemu-ivshmem-tools-5.2.0-150300.118.3 qemu-ivshmem-tools-debuginfo-5.2.0-150300.118.3 qemu-ksm-5.2.0-150300.118.3 qemu-lang-5.2.0-150300.118.3 qemu-linux-user-5.2.0-150300.118.2 qemu-linux-user-debuginfo-5.2.0-150300.118.2 qemu-linux-user-debugsource-5.2.0-150300.118.2 qemu-ppc-5.2.0-150300.118.3 qemu-ppc-debuginfo-5.2.0-150300.118.3 qemu-s390x-5.2.0-150300.118.3 qemu-s390x-debuginfo-5.2.0-150300.118.3 qemu-testsuite-5.2.0-150300.118.5 qemu-tools-5.2.0-150300.118.3 qemu-tools-debuginfo-5.2.0-150300.118.3 qemu-ui-curses-5.2.0-150300.118.3 qemu-ui-curses-debuginfo-5.2.0-150300.118.3 qemu-ui-gtk-5.2.0-150300.118.3 qemu-ui-gtk-debuginfo-5.2.0-150300.118.3 qemu-ui-opengl-5.2.0-150300.118.3 qemu-ui-opengl-debuginfo-5.2.0-150300.118.3 qemu-ui-spice-app-5.2.0-150300.118.3 qemu-ui-spice-app-debuginfo-5.2.0-150300.118.3 qemu-ui-spice-core-5.2.0-150300.118.3 qemu-ui-spice-core-debuginfo-5.2.0-150300.118.3 qemu-vhost-user-gpu-5.2.0-150300.118.3 qemu-vhost-user-gpu-debuginfo-5.2.0-150300.118.3 qemu-x86-5.2.0-150300.118.3 qemu-x86-debuginfo-5.2.0-150300.118.3 - openSUSE Leap 15.3 (s390x x86_64): qemu-kvm-5.2.0-150300.118.3 - openSUSE Leap 15.3 (noarch): qemu-SLOF-5.2.0-150300.118.3 qemu-ipxe-1.0.0+-150300.118.3 qemu-microvm-5.2.0-150300.118.3 qemu-seabios-1.14.0_0_g155821a-150300.118.3 qemu-sgabios-8-150300.118.3 qemu-skiboot-5.2.0-150300.118.3 qemu-vgabios-1.14.0_0_g155821a-150300.118.3 - SUSE Linux Enterprise Module for Server Applications 15-SP3 (aarch64 ppc64le s390x x86_64): qemu-5.2.0-150300.118.3 qemu-block-curl-5.2.0-150300.118.3 qemu-block-curl-debuginfo-5.2.0-150300.118.3 qemu-block-iscsi-5.2.0-150300.118.3 qemu-block-iscsi-debuginfo-5.2.0-150300.118.3 qemu-block-rbd-5.2.0-150300.118.3 qemu-block-rbd-debuginfo-5.2.0-150300.118.3 qemu-block-ssh-5.2.0-150300.118.3 qemu-block-ssh-debuginfo-5.2.0-150300.118.3 qemu-chardev-baum-5.2.0-150300.118.3 qemu-chardev-baum-debuginfo-5.2.0-150300.118.3 qemu-debuginfo-5.2.0-150300.118.3 qemu-debugsource-5.2.0-150300.118.3 qemu-guest-agent-5.2.0-150300.118.3 qemu-guest-agent-debuginfo-5.2.0-150300.118.3 qemu-ksm-5.2.0-150300.118.3 qemu-lang-5.2.0-150300.118.3 qemu-ui-curses-5.2.0-150300.118.3 qemu-ui-curses-debuginfo-5.2.0-150300.118.3 - SUSE Linux Enterprise Module for Server Applications 15-SP3 (aarch64 ppc64le x86_64): qemu-audio-spice-5.2.0-150300.118.3 qemu-audio-spice-debuginfo-5.2.0-150300.118.3 qemu-chardev-spice-5.2.0-150300.118.3 qemu-chardev-spice-debuginfo-5.2.0-150300.118.3 qemu-hw-display-qxl-5.2.0-150300.118.3 qemu-hw-display-qxl-debuginfo-5.2.0-150300.118.3 qemu-hw-display-virtio-vga-5.2.0-150300.118.3 qemu-hw-display-virtio-vga-debuginfo-5.2.0-150300.118.3 qemu-hw-usb-redirect-5.2.0-150300.118.3 qemu-hw-usb-redirect-debuginfo-5.2.0-150300.118.3 qemu-ui-gtk-5.2.0-150300.118.3 qemu-ui-gtk-debuginfo-5.2.0-150300.118.3 qemu-ui-opengl-5.2.0-150300.118.3 qemu-ui-opengl-debuginfo-5.2.0-150300.118.3 qemu-ui-spice-app-5.2.0-150300.118.3 qemu-ui-spice-app-debuginfo-5.2.0-150300.118.3 qemu-ui-spice-core-5.2.0-150300.118.3 qemu-ui-spice-core-debuginfo-5.2.0-150300.118.3 - SUSE Linux Enterprise Module for Server Applications 15-SP3 (s390x x86_64): qemu-hw-display-virtio-gpu-5.2.0-150300.118.3 qemu-hw-display-virtio-gpu-debuginfo-5.2.0-150300.118.3 qemu-hw-display-virtio-gpu-pci-5.2.0-150300.118.3 qemu-hw-display-virtio-gpu-pci-debuginfo-5.2.0-150300.118.3 qemu-kvm-5.2.0-150300.118.3 - SUSE Linux Enterprise Module for Server Applications 15-SP3 (aarch64): qemu-arm-5.2.0-150300.118.3 qemu-arm-debuginfo-5.2.0-150300.118.3 - SUSE Linux Enterprise Module for Server Applications 15-SP3 (ppc64le): qemu-ppc-5.2.0-150300.118.3 qemu-ppc-debuginfo-5.2.0-150300.118.3 - SUSE Linux Enterprise Module for Server Applications 15-SP3 (noarch): qemu-SLOF-5.2.0-150300.118.3 qemu-ipxe-1.0.0+-150300.118.3 qemu-seabios-1.14.0_0_g155821a-150300.118.3 qemu-sgabios-8-150300.118.3 qemu-skiboot-5.2.0-150300.118.3 qemu-vgabios-1.14.0_0_g155821a-150300.118.3 - SUSE Linux Enterprise Module for Server Applications 15-SP3 (x86_64): qemu-audio-alsa-5.2.0-150300.118.3 qemu-audio-alsa-debuginfo-5.2.0-150300.118.3 qemu-audio-pa-5.2.0-150300.118.3 qemu-audio-pa-debuginfo-5.2.0-150300.118.3 qemu-x86-5.2.0-150300.118.3 qemu-x86-debuginfo-5.2.0-150300.118.3 - SUSE Linux Enterprise Module for Server Applications 15-SP3 (s390x): qemu-hw-s390x-virtio-gpu-ccw-5.2.0-150300.118.3 qemu-hw-s390x-virtio-gpu-ccw-debuginfo-5.2.0-150300.118.3 qemu-s390x-5.2.0-150300.118.3 qemu-s390x-debuginfo-5.2.0-150300.118.3 - SUSE Linux Enterprise Module for Basesystem 15-SP3 (aarch64 ppc64le s390x x86_64): qemu-debuginfo-5.2.0-150300.118.3 qemu-debugsource-5.2.0-150300.118.3 qemu-tools-5.2.0-150300.118.3 qemu-tools-debuginfo-5.2.0-150300.118.3 - SUSE Linux Enterprise Micro 5.2 (aarch64 s390x x86_64): qemu-5.2.0-150300.118.3 qemu-audio-spice-5.2.0-150300.118.3 qemu-audio-spice-debuginfo-5.2.0-150300.118.3 qemu-chardev-spice-5.2.0-150300.118.3 qemu-chardev-spice-debuginfo-5.2.0-150300.118.3 qemu-debuginfo-5.2.0-150300.118.3 qemu-debugsource-5.2.0-150300.118.3 qemu-guest-agent-5.2.0-150300.118.3 qemu-guest-agent-debuginfo-5.2.0-150300.118.3 qemu-hw-display-qxl-5.2.0-150300.118.3 qemu-hw-display-qxl-debuginfo-5.2.0-150300.118.3 qemu-hw-display-virtio-gpu-5.2.0-150300.118.3 qemu-hw-display-virtio-gpu-debuginfo-5.2.0-150300.118.3 qemu-hw-display-virtio-vga-5.2.0-150300.118.3 qemu-hw-display-virtio-vga-debuginfo-5.2.0-150300.118.3 qemu-hw-usb-redirect-5.2.0-150300.118.3 qemu-hw-usb-redirect-debuginfo-5.2.0-150300.118.3 qemu-tools-5.2.0-150300.118.3 qemu-tools-debuginfo-5.2.0-150300.118.3 qemu-ui-opengl-5.2.0-150300.118.3 qemu-ui-opengl-debuginfo-5.2.0-150300.118.3 qemu-ui-spice-core-5.2.0-150300.118.3 qemu-ui-spice-core-debuginfo-5.2.0-150300.118.3 - SUSE Linux Enterprise Micro 5.2 (aarch64): qemu-arm-5.2.0-150300.118.3 qemu-arm-debuginfo-5.2.0-150300.118.3 - SUSE Linux Enterprise Micro 5.2 (noarch): qemu-ipxe-1.0.0+-150300.118.3 qemu-seabios-1.14.0_0_g155821a-150300.118.3 qemu-sgabios-8-150300.118.3 qemu-vgabios-1.14.0_0_g155821a-150300.118.3 - SUSE Linux Enterprise Micro 5.2 (x86_64): qemu-x86-5.2.0-150300.118.3 qemu-x86-debuginfo-5.2.0-150300.118.3 - SUSE Linux Enterprise Micro 5.2 (s390x): qemu-s390x-5.2.0-150300.118.3 qemu-s390x-debuginfo-5.2.0-150300.118.3 - SUSE Linux Enterprise Micro 5.1 (aarch64 s390x x86_64): qemu-5.2.0-150300.118.3 qemu-debuginfo-5.2.0-150300.118.3 qemu-debugsource-5.2.0-150300.118.3 qemu-tools-5.2.0-150300.118.3 qemu-tools-debuginfo-5.2.0-150300.118.3 - SUSE Linux Enterprise Micro 5.1 (aarch64): qemu-arm-5.2.0-150300.118.3 qemu-arm-debuginfo-5.2.0-150300.118.3 - SUSE Linux Enterprise Micro 5.1 (x86_64): qemu-x86-5.2.0-150300.118.3 qemu-x86-debuginfo-5.2.0-150300.118.3 - SUSE Linux Enterprise Micro 5.1 (noarch): qemu-ipxe-1.0.0+-150300.118.3 qemu-seabios-1.14.0_0_g155821a-150300.118.3 qemu-sgabios-8-150300.118.3 qemu-vgabios-1.14.0_0_g155821a-150300.118.3 - SUSE Linux Enterprise Micro 5.1 (s390x): qemu-s390x-5.2.0-150300.118.3 qemu-s390x-debuginfo-5.2.0-150300.118.3 References: https://www.suse.com/security/cve/CVE-2022-0216.html https://www.suse.com/security/cve/CVE-2022-35414.html https://bugzilla.suse.com/1192115 https://bugzilla.suse.com/1198038 https://bugzilla.suse.com/1201367

1 0

SUSE-SU-2022:3661-1: important: Security update for php8
by opensuse-security＠opensuse.org 19 Oct '22

19 Oct '22

SUSE Security Update: Security update for php8 ______________________________________________________________________________ Announcement ID: SUSE-SU-2022:3661-1 Rating: important References: #1192050 #1200772 #1203867 #1203870 SLE-23639 SLE-24723 Cross-References: CVE-2021-21703 CVE-2022-31628 CVE-2022-31629 CVSS scores: CVE-2021-21703 (NVD) : 7 CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H CVE-2021-21703 (SUSE): 6.4 CVSS:3.1/AV:L/AC:H/PR:H/UI:N/S:U/C:H/I:H/A:H CVE-2022-31628 (NVD) : 5.5 CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H CVE-2022-31629 (NVD) : 6.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N Affected Products: SUSE Linux Enterprise High Performance Computing 15-SP4 SUSE Linux Enterprise Module for Web Scripting 15-SP4 SUSE Linux Enterprise Server 15-SP4 SUSE Linux Enterprise Server for SAP Applications 15-SP4 SUSE Manager Proxy 4.3 SUSE Manager Retail Branch Server 4.3 SUSE Manager Server 4.3 openSUSE Leap 15.4 ______________________________________________________________________________ An update that solves three vulnerabilities, contains two features and has one errata is now available. Description: This update for php8 fixes the following issues: - php8 was updated to version 8.0.24 - php8 was updated to version 8.0.23 (jsc#SLE-23639). - CVE-2021-21703: Fixed a local privilege escalation via PHP-FPM. (bsc#1192050) - CVE-2022-31628: Fixed an uncontrolled recursion in the phar uncompressor while decompressing "quines" gzip files. (bsc#1203867) - CVE-2022-31629: Fixed a bug which could lead an attacker to set an insecure cookie that will treated as secure in the victim's browser. (bsc#1203870) - Fixed missing devel package requires pear and pecl extensions (jsc#SLE-24723, bsc#1200772). Patch Instructions: To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 15.4: zypper in -t patch openSUSE-SLE-15.4-2022-3661=1 - SUSE Linux Enterprise Module for Web Scripting 15-SP4: zypper in -t patch SUSE-SLE-Module-Web-Scripting-15-SP4-2022-3661=1 Package List: - openSUSE Leap 15.4 (aarch64 ppc64le s390x x86_64): apache2-mod_php8-8.0.24-150400.4.14.1 apache2-mod_php8-debuginfo-8.0.24-150400.4.14.1 apache2-mod_php8-debugsource-8.0.24-150400.4.14.1 php8-8.0.24-150400.4.14.1 php8-bcmath-8.0.24-150400.4.14.1 php8-bcmath-debuginfo-8.0.24-150400.4.14.1 php8-bz2-8.0.24-150400.4.14.1 php8-bz2-debuginfo-8.0.24-150400.4.14.1 php8-calendar-8.0.24-150400.4.14.1 php8-calendar-debuginfo-8.0.24-150400.4.14.1 php8-cli-8.0.24-150400.4.14.1 php8-cli-debuginfo-8.0.24-150400.4.14.1 php8-ctype-8.0.24-150400.4.14.1 php8-ctype-debuginfo-8.0.24-150400.4.14.1 php8-curl-8.0.24-150400.4.14.1 php8-curl-debuginfo-8.0.24-150400.4.14.1 php8-dba-8.0.24-150400.4.14.1 php8-dba-debuginfo-8.0.24-150400.4.14.1 php8-debuginfo-8.0.24-150400.4.14.1 php8-debugsource-8.0.24-150400.4.14.1 php8-devel-8.0.24-150400.4.14.1 php8-dom-8.0.24-150400.4.14.1 php8-dom-debuginfo-8.0.24-150400.4.14.1 php8-embed-8.0.24-150400.4.14.1 php8-embed-debuginfo-8.0.24-150400.4.14.1 php8-embed-debugsource-8.0.24-150400.4.14.1 php8-enchant-8.0.24-150400.4.14.1 php8-enchant-debuginfo-8.0.24-150400.4.14.1 php8-exif-8.0.24-150400.4.14.1 php8-exif-debuginfo-8.0.24-150400.4.14.1 php8-fastcgi-8.0.24-150400.4.14.1 php8-fastcgi-debuginfo-8.0.24-150400.4.14.1 php8-fastcgi-debugsource-8.0.24-150400.4.14.1 php8-fileinfo-8.0.24-150400.4.14.1 php8-fileinfo-debuginfo-8.0.24-150400.4.14.1 php8-fpm-8.0.24-150400.4.14.1 php8-fpm-debuginfo-8.0.24-150400.4.14.1 php8-fpm-debugsource-8.0.24-150400.4.14.1 php8-ftp-8.0.24-150400.4.14.1 php8-ftp-debuginfo-8.0.24-150400.4.14.1 php8-gd-8.0.24-150400.4.14.1 php8-gd-debuginfo-8.0.24-150400.4.14.1 php8-gettext-8.0.24-150400.4.14.1 php8-gettext-debuginfo-8.0.24-150400.4.14.1 php8-gmp-8.0.24-150400.4.14.1 php8-gmp-debuginfo-8.0.24-150400.4.14.1 php8-iconv-8.0.24-150400.4.14.1 php8-iconv-debuginfo-8.0.24-150400.4.14.1 php8-intl-8.0.24-150400.4.14.1 php8-intl-debuginfo-8.0.24-150400.4.14.1 php8-ldap-8.0.24-150400.4.14.1 php8-ldap-debuginfo-8.0.24-150400.4.14.1 php8-mbstring-8.0.24-150400.4.14.1 php8-mbstring-debuginfo-8.0.24-150400.4.14.1 php8-mysql-8.0.24-150400.4.14.1 php8-mysql-debuginfo-8.0.24-150400.4.14.1 php8-odbc-8.0.24-150400.4.14.1 php8-odbc-debuginfo-8.0.24-150400.4.14.1 php8-opcache-8.0.24-150400.4.14.1 php8-opcache-debuginfo-8.0.24-150400.4.14.1 php8-openssl-8.0.24-150400.4.14.1 php8-openssl-debuginfo-8.0.24-150400.4.14.1 php8-pcntl-8.0.24-150400.4.14.1 php8-pcntl-debuginfo-8.0.24-150400.4.14.1 php8-pdo-8.0.24-150400.4.14.1 php8-pdo-debuginfo-8.0.24-150400.4.14.1 php8-pgsql-8.0.24-150400.4.14.1 php8-pgsql-debuginfo-8.0.24-150400.4.14.1 php8-phar-8.0.24-150400.4.14.1 php8-phar-debuginfo-8.0.24-150400.4.14.1 php8-posix-8.0.24-150400.4.14.1 php8-posix-debuginfo-8.0.24-150400.4.14.1 php8-readline-8.0.24-150400.4.14.1 php8-readline-debuginfo-8.0.24-150400.4.14.1 php8-shmop-8.0.24-150400.4.14.1 php8-shmop-debuginfo-8.0.24-150400.4.14.1 php8-snmp-8.0.24-150400.4.14.1 php8-snmp-debuginfo-8.0.24-150400.4.14.1 php8-soap-8.0.24-150400.4.14.1 php8-soap-debuginfo-8.0.24-150400.4.14.1 php8-sockets-8.0.24-150400.4.14.1 php8-sockets-debuginfo-8.0.24-150400.4.14.1 php8-sodium-8.0.24-150400.4.14.1 php8-sodium-debuginfo-8.0.24-150400.4.14.1 php8-sqlite-8.0.24-150400.4.14.1 php8-sqlite-debuginfo-8.0.24-150400.4.14.1 php8-sysvmsg-8.0.24-150400.4.14.1 php8-sysvmsg-debuginfo-8.0.24-150400.4.14.1 php8-sysvsem-8.0.24-150400.4.14.1 php8-sysvsem-debuginfo-8.0.24-150400.4.14.1 php8-sysvshm-8.0.24-150400.4.14.1 php8-sysvshm-debuginfo-8.0.24-150400.4.14.1 php8-test-8.0.24-150400.4.14.1 php8-tidy-8.0.24-150400.4.14.1 php8-tidy-debuginfo-8.0.24-150400.4.14.1 php8-tokenizer-8.0.24-150400.4.14.1 php8-tokenizer-debuginfo-8.0.24-150400.4.14.1 php8-xmlreader-8.0.24-150400.4.14.1 php8-xmlreader-debuginfo-8.0.24-150400.4.14.1 php8-xmlwriter-8.0.24-150400.4.14.1 php8-xmlwriter-debuginfo-8.0.24-150400.4.14.1 php8-xsl-8.0.24-150400.4.14.1 php8-xsl-debuginfo-8.0.24-150400.4.14.1 php8-zip-8.0.24-150400.4.14.1 php8-zip-debuginfo-8.0.24-150400.4.14.1 php8-zlib-8.0.24-150400.4.14.1 php8-zlib-debuginfo-8.0.24-150400.4.14.1 - SUSE Linux Enterprise Module for Web Scripting 15-SP4 (aarch64 ppc64le s390x x86_64): apache2-mod_php8-8.0.24-150400.4.14.1 apache2-mod_php8-debuginfo-8.0.24-150400.4.14.1 apache2-mod_php8-debugsource-8.0.24-150400.4.14.1 php8-8.0.24-150400.4.14.1 php8-bcmath-8.0.24-150400.4.14.1 php8-bcmath-debuginfo-8.0.24-150400.4.14.1 php8-bz2-8.0.24-150400.4.14.1 php8-bz2-debuginfo-8.0.24-150400.4.14.1 php8-calendar-8.0.24-150400.4.14.1 php8-calendar-debuginfo-8.0.24-150400.4.14.1 php8-cli-8.0.24-150400.4.14.1 php8-cli-debuginfo-8.0.24-150400.4.14.1 php8-ctype-8.0.24-150400.4.14.1 php8-ctype-debuginfo-8.0.24-150400.4.14.1 php8-curl-8.0.24-150400.4.14.1 php8-curl-debuginfo-8.0.24-150400.4.14.1 php8-dba-8.0.24-150400.4.14.1 php8-dba-debuginfo-8.0.24-150400.4.14.1 php8-debuginfo-8.0.24-150400.4.14.1 php8-debugsource-8.0.24-150400.4.14.1 php8-devel-8.0.24-150400.4.14.1 php8-dom-8.0.24-150400.4.14.1 php8-dom-debuginfo-8.0.24-150400.4.14.1 php8-embed-8.0.24-150400.4.14.1 php8-embed-debuginfo-8.0.24-150400.4.14.1 php8-embed-debugsource-8.0.24-150400.4.14.1 php8-enchant-8.0.24-150400.4.14.1 php8-enchant-debuginfo-8.0.24-150400.4.14.1 php8-exif-8.0.24-150400.4.14.1 php8-exif-debuginfo-8.0.24-150400.4.14.1 php8-fastcgi-8.0.24-150400.4.14.1 php8-fastcgi-debuginfo-8.0.24-150400.4.14.1 php8-fastcgi-debugsource-8.0.24-150400.4.14.1 php8-fileinfo-8.0.24-150400.4.14.1 php8-fileinfo-debuginfo-8.0.24-150400.4.14.1 php8-fpm-8.0.24-150400.4.14.1 php8-fpm-debuginfo-8.0.24-150400.4.14.1 php8-fpm-debugsource-8.0.24-150400.4.14.1 php8-ftp-8.0.24-150400.4.14.1 php8-ftp-debuginfo-8.0.24-150400.4.14.1 php8-gd-8.0.24-150400.4.14.1 php8-gd-debuginfo-8.0.24-150400.4.14.1 php8-gettext-8.0.24-150400.4.14.1 php8-gettext-debuginfo-8.0.24-150400.4.14.1 php8-gmp-8.0.24-150400.4.14.1 php8-gmp-debuginfo-8.0.24-150400.4.14.1 php8-iconv-8.0.24-150400.4.14.1 php8-iconv-debuginfo-8.0.24-150400.4.14.1 php8-intl-8.0.24-150400.4.14.1 php8-intl-debuginfo-8.0.24-150400.4.14.1 php8-ldap-8.0.24-150400.4.14.1 php8-ldap-debuginfo-8.0.24-150400.4.14.1 php8-mbstring-8.0.24-150400.4.14.1 php8-mbstring-debuginfo-8.0.24-150400.4.14.1 php8-mysql-8.0.24-150400.4.14.1 php8-mysql-debuginfo-8.0.24-150400.4.14.1 php8-odbc-8.0.24-150400.4.14.1 php8-odbc-debuginfo-8.0.24-150400.4.14.1 php8-opcache-8.0.24-150400.4.14.1 php8-opcache-debuginfo-8.0.24-150400.4.14.1 php8-openssl-8.0.24-150400.4.14.1 php8-openssl-debuginfo-8.0.24-150400.4.14.1 php8-pcntl-8.0.24-150400.4.14.1 php8-pcntl-debuginfo-8.0.24-150400.4.14.1 php8-pdo-8.0.24-150400.4.14.1 php8-pdo-debuginfo-8.0.24-150400.4.14.1 php8-pgsql-8.0.24-150400.4.14.1 php8-pgsql-debuginfo-8.0.24-150400.4.14.1 php8-phar-8.0.24-150400.4.14.1 php8-phar-debuginfo-8.0.24-150400.4.14.1 php8-posix-8.0.24-150400.4.14.1 php8-posix-debuginfo-8.0.24-150400.4.14.1 php8-readline-8.0.24-150400.4.14.1 php8-readline-debuginfo-8.0.24-150400.4.14.1 php8-shmop-8.0.24-150400.4.14.1 php8-shmop-debuginfo-8.0.24-150400.4.14.1 php8-snmp-8.0.24-150400.4.14.1 php8-snmp-debuginfo-8.0.24-150400.4.14.1 php8-soap-8.0.24-150400.4.14.1 php8-soap-debuginfo-8.0.24-150400.4.14.1 php8-sockets-8.0.24-150400.4.14.1 php8-sockets-debuginfo-8.0.24-150400.4.14.1 php8-sodium-8.0.24-150400.4.14.1 php8-sodium-debuginfo-8.0.24-150400.4.14.1 php8-sqlite-8.0.24-150400.4.14.1 php8-sqlite-debuginfo-8.0.24-150400.4.14.1 php8-sysvmsg-8.0.24-150400.4.14.1 php8-sysvmsg-debuginfo-8.0.24-150400.4.14.1 php8-sysvsem-8.0.24-150400.4.14.1 php8-sysvsem-debuginfo-8.0.24-150400.4.14.1 php8-sysvshm-8.0.24-150400.4.14.1 php8-sysvshm-debuginfo-8.0.24-150400.4.14.1 php8-test-8.0.24-150400.4.14.1 php8-tidy-8.0.24-150400.4.14.1 php8-tidy-debuginfo-8.0.24-150400.4.14.1 php8-tokenizer-8.0.24-150400.4.14.1 php8-tokenizer-debuginfo-8.0.24-150400.4.14.1 php8-xmlreader-8.0.24-150400.4.14.1 php8-xmlreader-debuginfo-8.0.24-150400.4.14.1 php8-xmlwriter-8.0.24-150400.4.14.1 php8-xmlwriter-debuginfo-8.0.24-150400.4.14.1 php8-xsl-8.0.24-150400.4.14.1 php8-xsl-debuginfo-8.0.24-150400.4.14.1 php8-zip-8.0.24-150400.4.14.1 php8-zip-debuginfo-8.0.24-150400.4.14.1 php8-zlib-8.0.24-150400.4.14.1 php8-zlib-debuginfo-8.0.24-150400.4.14.1 References: https://www.suse.com/security/cve/CVE-2021-21703.html https://www.suse.com/security/cve/CVE-2022-31628.html https://www.suse.com/security/cve/CVE-2022-31629.html https://bugzilla.suse.com/1192050 https://bugzilla.suse.com/1200772 https://bugzilla.suse.com/1203867 https://bugzilla.suse.com/1203870

1 0

openSUSE-SU-2022:10154-1: moderate: Security update for pngcheck
by opensuse-security＠opensuse.org 19 Oct '22

19 Oct '22

openSUSE Security Update: Security update for pngcheck ______________________________________________________________________________ Announcement ID: openSUSE-SU-2022:10154-1 Rating: moderate References: Affected Products: openSUSE Backports SLE-15-SP4 ______________________________________________________________________________ An update that contains security fixes can now be installed. Description: This update for pngcheck fixes the following issues: pngcheck was updated to 3.0.3: Version 3.0.1: * fixed a crash bug (and probable vulnerability) in large (MNG) LOOP chunks Version 3.0.2: * fixed a divide-by-zero crash bug (and probable vulnerability) in interlaced images with extra compressed data beyond the nominal end of the image data (found by "chiba of topsec alpha lab") Patch Instructions: To install this openSUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Backports SLE-15-SP4: zypper in -t patch openSUSE-2022-10154=1 Package List: - openSUSE Backports SLE-15-SP4 (aarch64 i586 ppc64le s390x x86_64): pngcheck-3.0.3-bp154.2.3.1 References:

1 0