October 2022 - openSUSE Security Announce

SUSE-SU-2022:3571-1: important: Security update for rubygem-puma
by opensuse-security＠opensuse.org 13 Oct '22

13 Oct '22

SUSE Security Update: Security update for rubygem-puma ______________________________________________________________________________ Announcement ID: SUSE-SU-2022:3571-1 Rating: important References: #1197818 Cross-References: CVE-2022-24790 CVSS scores: CVE-2022-24790 (NVD) : 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N CVE-2022-24790 (SUSE): 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N Affected Products: SUSE Linux Enterprise High Availability 15 SUSE Linux Enterprise High Availability 15-SP1 SUSE Linux Enterprise High Availability 15-SP2 SUSE Linux Enterprise High Availability 15-SP3 SUSE Linux Enterprise High Availability 15-SP4 SUSE Linux Enterprise High Performance Computing 15 SUSE Linux Enterprise High Performance Computing 15-SP1 SUSE Linux Enterprise High Performance Computing 15-SP2 SUSE Linux Enterprise High Performance Computing 15-SP3 SUSE Linux Enterprise High Performance Computing 15-SP4 SUSE Linux Enterprise Server 15 SUSE Linux Enterprise Server 15-SP1 SUSE Linux Enterprise Server 15-SP2 SUSE Linux Enterprise Server 15-SP3 SUSE Linux Enterprise Server 15-SP4 SUSE Linux Enterprise Server for SAP Applications 15 SUSE Linux Enterprise Server for SAP Applications 15-SP1 SUSE Linux Enterprise Server for SAP Applications 15-SP2 SUSE Linux Enterprise Server for SAP Applications 15-SP3 SUSE Linux Enterprise Server for SAP Applications 15-SP4 SUSE Linux Enterprise Storage 6 SUSE Linux Enterprise Storage 7 SUSE Linux Enterprise Storage 7.1 SUSE Manager Proxy 4.0 SUSE Manager Proxy 4.1 SUSE Manager Proxy 4.2 SUSE Manager Proxy 4.3 SUSE Manager Retail Branch Server 4.0 SUSE Manager Retail Branch Server 4.1 SUSE Manager Retail Branch Server 4.2 SUSE Manager Retail Branch Server 4.3 SUSE Manager Server 4.0 SUSE Manager Server 4.1 SUSE Manager Server 4.2 SUSE Manager Server 4.3 openSUSE Leap 15.3 openSUSE Leap 15.4 ______________________________________________________________________________ An update that fixes one vulnerability is now available. Description: This update for rubygem-puma fixes the following issues: Updated to version 4.3.12: - CVE-2022-24790: Fixed HTTP request smuggling if proxy is not RFC7230 compliant (bsc#1197818). Patch Instructions: To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 15.4: zypper in -t patch openSUSE-SLE-15.4-2022-3571=1 - openSUSE Leap 15.3: zypper in -t patch openSUSE-SLE-15.3-2022-3571=1 - SUSE Linux Enterprise High Availability 15-SP4: zypper in -t patch SUSE-SLE-Product-HA-15-SP4-2022-3571=1 - SUSE Linux Enterprise High Availability 15-SP3: zypper in -t patch SUSE-SLE-Product-HA-15-SP3-2022-3571=1 - SUSE Linux Enterprise High Availability 15-SP2: zypper in -t patch SUSE-SLE-Product-HA-15-SP2-2022-3571=1 - SUSE Linux Enterprise High Availability 15-SP1: zypper in -t patch SUSE-SLE-Product-HA-15-SP1-2022-3571=1 - SUSE Linux Enterprise High Availability 15: zypper in -t patch SUSE-SLE-Product-HA-15-2022-3571=1 Package List: - openSUSE Leap 15.4 (aarch64 ppc64le s390x x86_64): ruby2.5-rubygem-puma-4.3.12-150000.3.9.1 ruby2.5-rubygem-puma-debuginfo-4.3.12-150000.3.9.1 ruby2.5-rubygem-puma-doc-4.3.12-150000.3.9.1 rubygem-puma-debugsource-4.3.12-150000.3.9.1 - openSUSE Leap 15.3 (aarch64 ppc64le s390x x86_64): ruby2.5-rubygem-puma-4.3.12-150000.3.9.1 ruby2.5-rubygem-puma-debuginfo-4.3.12-150000.3.9.1 ruby2.5-rubygem-puma-doc-4.3.12-150000.3.9.1 rubygem-puma-debugsource-4.3.12-150000.3.9.1 - SUSE Linux Enterprise High Availability 15-SP4 (aarch64 ppc64le s390x x86_64): ruby2.5-rubygem-puma-4.3.12-150000.3.9.1 ruby2.5-rubygem-puma-debuginfo-4.3.12-150000.3.9.1 rubygem-puma-debugsource-4.3.12-150000.3.9.1 - SUSE Linux Enterprise High Availability 15-SP3 (aarch64 ppc64le s390x x86_64): ruby2.5-rubygem-puma-4.3.12-150000.3.9.1 ruby2.5-rubygem-puma-debuginfo-4.3.12-150000.3.9.1 rubygem-puma-debugsource-4.3.12-150000.3.9.1 - SUSE Linux Enterprise High Availability 15-SP2 (aarch64 ppc64le s390x x86_64): ruby2.5-rubygem-puma-4.3.12-150000.3.9.1 ruby2.5-rubygem-puma-debuginfo-4.3.12-150000.3.9.1 - SUSE Linux Enterprise High Availability 15-SP1 (aarch64 ppc64le s390x x86_64): ruby2.5-rubygem-puma-4.3.12-150000.3.9.1 ruby2.5-rubygem-puma-debuginfo-4.3.12-150000.3.9.1 - SUSE Linux Enterprise High Availability 15 (aarch64 ppc64le s390x x86_64): ruby2.5-rubygem-puma-4.3.12-150000.3.9.1 ruby2.5-rubygem-puma-debuginfo-4.3.12-150000.3.9.1 References: https://www.suse.com/security/cve/CVE-2022-24790.html https://bugzilla.suse.com/1197818

1 0

openSUSE-SU-2022:10144-1: important: Security update for gdcm, orthanc, orthanc-gdcm, orthanc-webviewer
by opensuse-security＠opensuse.org 12 Oct '22

12 Oct '22

openSUSE Security Update: Security update for gdcm, orthanc, orthanc-gdcm, orthanc-webviewer ______________________________________________________________________________ Announcement ID: openSUSE-SU-2022:10144-1 Rating: important References: #1181400 Cross-References: CVE-2022-2119 CVE-2022-2120 CVSS scores: CVE-2022-2119 (NVD) : 9.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H CVE-2022-2120 (NVD) : 9.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H Affected Products: openSUSE Backports SLE-15-SP3 ______________________________________________________________________________ An update that fixes two vulnerabilities is now available. Description: This update for gdcm, orthanc, orthanc-gdcm, orthanc-webviewer fixes the following issues: Changes in gdcm: - Provides/obsoletes moved to lbgdcm-package (Thx DimStar) - rename of gdcm-libgdcm3_0 to libgdcm3_0 (proposal S. Br��ns) - version 3.0.18 no changelog - version 3.0.12 * support for poppler 22.03 added - version 3.0.11 * Fix for a significant issue with JPEG-LS and RGB color space * tons of small bug fixes - version 3.0.10 (no changelog) Changes in orthanc-gdcm: - changed dependency gdcm-libgdcm3_0 -> libgdcm3_0 - Version 1.5 * Take the configuration option "RestrictTransferSyntaxes" into account not only for decoding, but also for transcoding * Upgrade to GDCM 3.0.10 for static builds- Changes in orthanc: - version 1.11.2 * Added support for RGBA64 images in tools/create-dicom and /preview * New configuration "MaximumStorageMode" to choose between recyling of old patients (default behavior) and rejection of new incoming data when the MaximumStorageSize has been reached. * New sample plugin: "DelayedDeletion" that will delete files from disk asynchronously to speed up deletion of large studies. * Lua: new "SetHttpTimeout" function * Lua: new "OnHeartBeat" callback called at regular interval provided that you have configured "LuaHeartBeatPeriod" > 0. * "ExtraMainDicomTags" configuration now accepts Dicom Sequences. Sequences are stored in a dedicated new metadata "MainDicomSequences". This should improve DicomWeb QIDO-RS and avoid warnings like "Accessing Dicom tags from storage when accessing series : 0040,0275". Main dicom sequences can now be returned in "MainDicomTags" and in "RequestedTags". * Fix the "Never" option of the "StorageAccessOnFind" that was sill accessing files (bug introduced in 1.11.0). * Fix the Storage Cache for compressed files (bug introduced in 1.11.1). * Fix the storage cache that was not used by the Plugin SDK. This fixes the DicomWeb plugin "/rendered" route performance issues. * DelayedDeletion plugin: Fix leaking of symbols * SQLite now closes and deletes WAL and SHM files on exit. This should improve handling of SQLite DB over network drives. * Fix static compilation of boost 1.69 on Ubuntu 22.04 * Upgraded dependencies for static builds: - boost 1.80.0 - dcmtk 3.6.7 (fixes CVE-2022-2119 and CVE-2022-2120) - openssl 3.0.5 * Housekeeper plugin: Fix resume of previous processing * Added missing MOVEPatientRootQueryRetrieveInformationModel in DicomControlUserConnection::SetupPresentationContexts() * Improved HttpClient error logging (add method + url) * API version upgraded to 18 * /system is now reporting "DatabaseServerIdentifier" * Added an Asynchronous mode to /modalities/../move. * "RequestedTags" option can now include DICOM sequences. * New function in the SDK: "OrthancPluginGetDatabaseServerIdentifier" * DicomMap::ParseMainDicomTags has been deprecated -> retrieve "full" tags and use DicomMap::FromDicomAsJson instead - version 1.11.0 * new API version 1.7 * new configuration parameter * for detailed changelog see NEWS - version 1.10.1 * for detailed changelog see NEWS - Version 1.9.7 * New configuration option "DicomAlwaysAllowMove" to disable verification of the remote modality in C-MOVE SCP * API version upgraded to 15 * Added "Level" option to POST /tools/bulk-modify * Added missing OpenAPI documentation of "KeepSource" in ".../modify" and ".../anonymize" * Added file CITATION.cff * Linux Standard Base (LSB) builds of Orthanc can load non-LSB builds of plugins * Fix upload of ZIP archives containing a DICOMDIR file * Fix computation of the estimated time of arrival in jobs * Support detection of windowing and rescale in Philips multiframe images Changes in orthanc-webviewer: - version 2.8 * Fix XSS inside DICOM in Orthanc Web Viewer (as reported by Stuart Kurutac, NCC Group) * framework190.diff removed (covered in actual version) Patch Instructions: To install this openSUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Backports SLE-15-SP3: zypper in -t patch openSUSE-2022-10144=1 Package List: - openSUSE Backports SLE-15-SP3 (aarch64 ppc64le s390x x86_64): gdcm-3.0.19-bp153.2.8.1 gdcm-applications-3.0.19-bp153.2.8.1 gdcm-applications-debuginfo-3.0.19-bp153.2.8.1 gdcm-debuginfo-3.0.19-bp153.2.8.1 gdcm-debugsource-3.0.19-bp153.2.8.1 gdcm-devel-3.0.19-bp153.2.8.1 gdcm-examples-3.0.19-bp153.2.8.1 libgdcm3_0-3.0.19-bp153.2.8.1 libgdcm3_0-debuginfo-3.0.19-bp153.2.8.1 libsocketxx1_2-3.0.19-bp153.2.8.1 libsocketxx1_2-debuginfo-3.0.19-bp153.2.8.1 orthanc-gdcm-1.5-bp153.2.6.1 orthanc-gdcm-debuginfo-1.5-bp153.2.6.1 orthanc-gdcm-debugsource-1.5-bp153.2.6.1 orthanc-webviewer-2.8-bp153.2.3.1 orthanc-webviewer-debuginfo-2.8-bp153.2.3.1 orthanc-webviewer-debugsource-2.8-bp153.2.3.1 python3-gdcm-3.0.19-bp153.2.8.1 python3-gdcm-debuginfo-3.0.19-bp153.2.8.1 - openSUSE Backports SLE-15-SP3 (aarch64 ppc64le x86_64): orthanc-1.11.2-bp153.2.13.1 orthanc-debuginfo-1.11.2-bp153.2.13.1 orthanc-debugsource-1.11.2-bp153.2.13.1 orthanc-devel-1.11.2-bp153.2.13.1 orthanc-source-1.11.2-bp153.2.13.1 - openSUSE Backports SLE-15-SP3 (noarch): orthanc-doc-1.11.2-bp153.2.13.1 References: https://www.suse.com/security/cve/CVE-2022-2119.html https://www.suse.com/security/cve/CVE-2022-2120.html https://bugzilla.suse.com/1181400

1 0

openSUSE-SU-2022:10145-1: important: Security update for gdcm, orthanc, orthanc-gdcm, orthanc-webviewer
by opensuse-security＠opensuse.org 12 Oct '22

12 Oct '22

openSUSE Security Update: Security update for gdcm, orthanc, orthanc-gdcm, orthanc-webviewer ______________________________________________________________________________ Announcement ID: openSUSE-SU-2022:10145-1 Rating: important References: Cross-References: CVE-2022-2119 CVE-2022-2120 CVSS scores: CVE-2022-2119 (NVD) : 9.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H CVE-2022-2120 (NVD) : 9.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H Affected Products: openSUSE Backports SLE-15-SP4 ______________________________________________________________________________ An update that fixes two vulnerabilities is now available. Description: This update for gdcm, orthanc, orthanc-gdcm, orthanc-webviewer fixes the following issues: Changes in gdcm: - rename of gdcm-libgdcm3_0 to libgdcm3_0 (proposal S. Br��ns) - version 3.0.18 no changelog - version 3.0.12 * support for poppler 22.03 added Changes in orthanc-gdcm: - changed dependency gdcm-libgdcm3_0 -> libgdcm3_0 Changes in orthanc: - version 1.11.2 * Added support for RGBA64 images in tools/create-dicom and /preview * New configuration "MaximumStorageMode" to choose between recyling of old patients (default behavior) and rejection of new incoming data when the MaximumStorageSize has been reached. * New sample plugin: "DelayedDeletion" that will delete files from disk asynchronously to speed up deletion of large studies. * Lua: new "SetHttpTimeout" function * Lua: new "OnHeartBeat" callback called at regular interval provided that you have configured "LuaHeartBeatPeriod" > 0. * "ExtraMainDicomTags" configuration now accepts Dicom Sequences. Sequences are stored in a dedicated new metadata "MainDicomSequences". This should improve DicomWeb QIDO-RS and avoid warnings like "Accessing Dicom tags from storage when accessing series : 0040,0275". Main dicom sequences can now be returned in "MainDicomTags" and in "RequestedTags". * Fix the "Never" option of the "StorageAccessOnFind" that was sill accessing files (bug introduced in 1.11.0). * Fix the Storage Cache for compressed files (bug introduced in 1.11.1). * Fix the storage cache that was not used by the Plugin SDK. This fixes the DicomWeb plugin "/rendered" route performance issues. * DelayedDeletion plugin: Fix leaking of symbols * SQLite now closes and deletes WAL and SHM files on exit. This should improve handling of SQLite DB over network drives. * Fix static compilation of boost 1.69 on Ubuntu 22.04 * Upgraded dependencies for static builds: - boost 1.80.0 - dcmtk 3.6.7 (fixes CVE-2022-2119 and CVE-2022-2120) - openssl 3.0.5 * Housekeeper plugin: Fix resume of previous processing * Added missing MOVEPatientRootQueryRetrieveInformationModel in DicomControlUserConnection::SetupPresentationContexts() * Improved HttpClient error logging (add method + url) * API version upgraded to 18 * /system is now reporting "DatabaseServerIdentifier" * Added an Asynchronous mode to /modalities/../move. * "RequestedTags" option can now include DICOM sequences. * New function in the SDK: "OrthancPluginGetDatabaseServerIdentifier" * DicomMap::ParseMainDicomTags has been deprecated -> retrieve "full" tags and use DicomMap::FromDicomAsJson instead Changes in orthanc-webviewer: - version 2.8 * Fix XSS inside DICOM in Orthanc Web Viewer (as reported by Stuart Kurutac, NCC Group) * framework190.diff removed (covered in actual version) Patch Instructions: To install this openSUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Backports SLE-15-SP4: zypper in -t patch openSUSE-2022-10145=1 Package List: - openSUSE Backports SLE-15-SP4 (aarch64 ppc64le s390x x86_64): gdcm-3.0.19-bp154.2.5.1 gdcm-applications-3.0.19-bp154.2.5.1 gdcm-applications-debuginfo-3.0.19-bp154.2.5.1 gdcm-debuginfo-3.0.19-bp154.2.5.1 gdcm-debugsource-3.0.19-bp154.2.5.1 gdcm-devel-3.0.19-bp154.2.5.1 gdcm-examples-3.0.19-bp154.2.5.1 libgdcm3_0-3.0.19-bp154.2.5.1 libgdcm3_0-debuginfo-3.0.19-bp154.2.5.1 libsocketxx1_2-3.0.19-bp154.2.5.1 libsocketxx1_2-debuginfo-3.0.19-bp154.2.5.1 orthanc-gdcm-1.5-bp154.2.3.1 orthanc-gdcm-debuginfo-1.5-bp154.2.3.1 orthanc-gdcm-debugsource-1.5-bp154.2.3.1 orthanc-webviewer-2.8-bp154.2.3.1 orthanc-webviewer-debuginfo-2.8-bp154.2.3.1 orthanc-webviewer-debugsource-2.8-bp154.2.3.1 python3-gdcm-3.0.19-bp154.2.5.1 python3-gdcm-debuginfo-3.0.19-bp154.2.5.1 - openSUSE Backports SLE-15-SP4 (aarch64 ppc64le x86_64): orthanc-1.11.2-bp154.2.3.1 orthanc-debuginfo-1.11.2-bp154.2.3.1 orthanc-debugsource-1.11.2-bp154.2.3.1 orthanc-devel-1.11.2-bp154.2.3.1 orthanc-source-1.11.2-bp154.2.3.1 - openSUSE Backports SLE-15-SP4 (noarch): orthanc-doc-1.11.2-bp154.2.3.1 References: https://www.suse.com/security/cve/CVE-2022-2119.html https://www.suse.com/security/cve/CVE-2022-2120.html

1 0

SUSE-SU-2022:3552-1: Security update for ImageMagick
by opensuse-security＠opensuse.org 07 Oct '22

07 Oct '22

SUSE Security Update: Security update for ImageMagick ______________________________________________________________________________ Announcement ID: SUSE-SU-2022:3552-1 Rating: low References: #1203212 Cross-References: CVE-2021-3574 CVSS scores: CVE-2021-3574 (NVD) : 3.3 CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:L CVE-2021-3574 (SUSE): 3.3 CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:L Affected Products: SUSE Linux Enterprise Desktop 15-SP3 SUSE Linux Enterprise High Performance Computing 15-SP3 SUSE Linux Enterprise Module for Desktop Applications 15-SP3 SUSE Linux Enterprise Module for Development Tools 15-SP3 SUSE Linux Enterprise Server 15-SP3 SUSE Linux Enterprise Server for SAP Applications 15-SP3 SUSE Linux Enterprise Storage 7.1 SUSE Manager Proxy 4.2 SUSE Manager Retail Branch Server 4.2 SUSE Manager Server 4.2 openSUSE Leap 15.3 openSUSE Leap 15.4 ______________________________________________________________________________ An update that fixes one vulnerability is now available. Description: This update for ImageMagick fixes the following issues: - CVE-2021-3574: Fixed memory leaks with convert command (bsc#1203212). Patch Instructions: To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 15.4: zypper in -t patch openSUSE-SLE-15.4-2022-3552=1 - openSUSE Leap 15.3: zypper in -t patch openSUSE-SLE-15.3-2022-3552=1 - SUSE Linux Enterprise Module for Development Tools 15-SP3: zypper in -t patch SUSE-SLE-Module-Development-Tools-15-SP3-2022-3552=1 - SUSE Linux Enterprise Module for Desktop Applications 15-SP3: zypper in -t patch SUSE-SLE-Module-Desktop-Applications-15-SP3-2022-3552=1 Package List: - openSUSE Leap 15.4 (aarch64 ppc64le s390x x86_64): libMagick++-7_Q16HDRI4-7.0.7.34-150200.10.39.1 libMagick++-7_Q16HDRI4-debuginfo-7.0.7.34-150200.10.39.1 libMagickCore-7_Q16HDRI6-7.0.7.34-150200.10.39.1 libMagickCore-7_Q16HDRI6-debuginfo-7.0.7.34-150200.10.39.1 libMagickWand-7_Q16HDRI6-7.0.7.34-150200.10.39.1 libMagickWand-7_Q16HDRI6-debuginfo-7.0.7.34-150200.10.39.1 - openSUSE Leap 15.4 (x86_64): libMagick++-7_Q16HDRI4-32bit-7.0.7.34-150200.10.39.1 libMagick++-7_Q16HDRI4-32bit-debuginfo-7.0.7.34-150200.10.39.1 libMagickCore-7_Q16HDRI6-32bit-7.0.7.34-150200.10.39.1 libMagickCore-7_Q16HDRI6-32bit-debuginfo-7.0.7.34-150200.10.39.1 libMagickWand-7_Q16HDRI6-32bit-7.0.7.34-150200.10.39.1 libMagickWand-7_Q16HDRI6-32bit-debuginfo-7.0.7.34-150200.10.39.1 - openSUSE Leap 15.3 (aarch64 ppc64le s390x x86_64): ImageMagick-7.0.7.34-150200.10.39.1 ImageMagick-config-7-SUSE-7.0.7.34-150200.10.39.1 ImageMagick-config-7-upstream-7.0.7.34-150200.10.39.1 ImageMagick-debuginfo-7.0.7.34-150200.10.39.1 ImageMagick-debugsource-7.0.7.34-150200.10.39.1 ImageMagick-devel-7.0.7.34-150200.10.39.1 ImageMagick-extra-7.0.7.34-150200.10.39.1 ImageMagick-extra-debuginfo-7.0.7.34-150200.10.39.1 libMagick++-7_Q16HDRI4-7.0.7.34-150200.10.39.1 libMagick++-7_Q16HDRI4-debuginfo-7.0.7.34-150200.10.39.1 libMagick++-devel-7.0.7.34-150200.10.39.1 libMagickCore-7_Q16HDRI6-7.0.7.34-150200.10.39.1 libMagickCore-7_Q16HDRI6-debuginfo-7.0.7.34-150200.10.39.1 libMagickWand-7_Q16HDRI6-7.0.7.34-150200.10.39.1 libMagickWand-7_Q16HDRI6-debuginfo-7.0.7.34-150200.10.39.1 perl-PerlMagick-7.0.7.34-150200.10.39.1 perl-PerlMagick-debuginfo-7.0.7.34-150200.10.39.1 - openSUSE Leap 15.3 (x86_64): ImageMagick-devel-32bit-7.0.7.34-150200.10.39.1 libMagick++-7_Q16HDRI4-32bit-7.0.7.34-150200.10.39.1 libMagick++-7_Q16HDRI4-32bit-debuginfo-7.0.7.34-150200.10.39.1 libMagick++-devel-32bit-7.0.7.34-150200.10.39.1 libMagickCore-7_Q16HDRI6-32bit-7.0.7.34-150200.10.39.1 libMagickCore-7_Q16HDRI6-32bit-debuginfo-7.0.7.34-150200.10.39.1 libMagickWand-7_Q16HDRI6-32bit-7.0.7.34-150200.10.39.1 libMagickWand-7_Q16HDRI6-32bit-debuginfo-7.0.7.34-150200.10.39.1 - openSUSE Leap 15.3 (noarch): ImageMagick-doc-7.0.7.34-150200.10.39.1 - SUSE Linux Enterprise Module for Development Tools 15-SP3 (aarch64 ppc64le s390x x86_64): ImageMagick-debuginfo-7.0.7.34-150200.10.39.1 ImageMagick-debugsource-7.0.7.34-150200.10.39.1 perl-PerlMagick-7.0.7.34-150200.10.39.1 perl-PerlMagick-debuginfo-7.0.7.34-150200.10.39.1 - SUSE Linux Enterprise Module for Desktop Applications 15-SP3 (aarch64 ppc64le s390x x86_64): ImageMagick-7.0.7.34-150200.10.39.1 ImageMagick-config-7-SUSE-7.0.7.34-150200.10.39.1 ImageMagick-config-7-upstream-7.0.7.34-150200.10.39.1 ImageMagick-debuginfo-7.0.7.34-150200.10.39.1 ImageMagick-debugsource-7.0.7.34-150200.10.39.1 ImageMagick-devel-7.0.7.34-150200.10.39.1 libMagick++-7_Q16HDRI4-7.0.7.34-150200.10.39.1 libMagick++-7_Q16HDRI4-debuginfo-7.0.7.34-150200.10.39.1 libMagick++-devel-7.0.7.34-150200.10.39.1 libMagickCore-7_Q16HDRI6-7.0.7.34-150200.10.39.1 libMagickCore-7_Q16HDRI6-debuginfo-7.0.7.34-150200.10.39.1 libMagickWand-7_Q16HDRI6-7.0.7.34-150200.10.39.1 libMagickWand-7_Q16HDRI6-debuginfo-7.0.7.34-150200.10.39.1 References: https://www.suse.com/security/cve/CVE-2021-3574.html https://bugzilla.suse.com/1203212

1 0

SUSE-SU-2022:3544-1: important: Security update for python3
by opensuse-security＠opensuse.org 06 Oct '22

06 Oct '22

SUSE Security Update: Security update for python3 ______________________________________________________________________________ Announcement ID: SUSE-SU-2022:3544-1 Rating: important References: #1202624 Cross-References: CVE-2021-28861 CVSS scores: CVE-2021-28861 (NVD) : 7.4 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:N/A:N CVE-2021-28861 (SUSE): 7.4 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:N/A:N Affected Products: SUSE Linux Enterprise Desktop 15-SP3 SUSE Linux Enterprise Desktop 15-SP4 SUSE Linux Enterprise High Performance Computing 15-SP3 SUSE Linux Enterprise High Performance Computing 15-SP4 SUSE Linux Enterprise Micro 5.2 SUSE Linux Enterprise Micro 5.3 SUSE Linux Enterprise Module for Basesystem 15-SP3 SUSE Linux Enterprise Module for Basesystem 15-SP4 SUSE Linux Enterprise Module for Development Tools 15-SP3 SUSE Linux Enterprise Module for Development Tools 15-SP4 SUSE Linux Enterprise Server 15-SP3 SUSE Linux Enterprise Server 15-SP4 SUSE Linux Enterprise Server for SAP Applications 15-SP3 SUSE Linux Enterprise Server for SAP Applications 15-SP4 SUSE Linux Enterprise Storage 7.1 SUSE Manager Proxy 4.2 SUSE Manager Proxy 4.3 SUSE Manager Retail Branch Server 4.2 SUSE Manager Retail Branch Server 4.3 SUSE Manager Server 4.2 SUSE Manager Server 4.3 openSUSE Leap 15.3 openSUSE Leap 15.4 openSUSE Leap Micro 5.2 ______________________________________________________________________________ An update that fixes one vulnerability is now available. Description: This update for python3 fixes the following issues: - CVE-2021-28861: Fixed an open redirection vulnerability in the HTTP server when an URI path starts with // (bsc#1202624). Patch Instructions: To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap Micro 5.2: zypper in -t patch openSUSE-Leap-Micro-5.2-2022-3544=1 - openSUSE Leap 15.4: zypper in -t patch openSUSE-SLE-15.4-2022-3544=1 - openSUSE Leap 15.3: zypper in -t patch openSUSE-SLE-15.3-2022-3544=1 - SUSE Linux Enterprise Module for Development Tools 15-SP4: zypper in -t patch SUSE-SLE-Module-Development-Tools-15-SP4-2022-3544=1 - SUSE Linux Enterprise Module for Development Tools 15-SP3: zypper in -t patch SUSE-SLE-Module-Development-Tools-15-SP3-2022-3544=1 - SUSE Linux Enterprise Module for Basesystem 15-SP4: zypper in -t patch SUSE-SLE-Module-Basesystem-15-SP4-2022-3544=1 - SUSE Linux Enterprise Module for Basesystem 15-SP3: zypper in -t patch SUSE-SLE-Module-Basesystem-15-SP3-2022-3544=1 - SUSE Linux Enterprise Micro 5.3: zypper in -t patch SUSE-SLE-Micro-5.3-2022-3544=1 - SUSE Linux Enterprise Micro 5.2: zypper in -t patch SUSE-SUSE-MicroOS-5.2-2022-3544=1 Package List: - openSUSE Leap Micro 5.2 (aarch64 x86_64): libpython3_6m1_0-3.6.15-150300.10.30.1 libpython3_6m1_0-debuginfo-3.6.15-150300.10.30.1 python3-3.6.15-150300.10.30.1 python3-base-3.6.15-150300.10.30.1 python3-base-debuginfo-3.6.15-150300.10.30.1 python3-core-debugsource-3.6.15-150300.10.30.1 python3-debuginfo-3.6.15-150300.10.30.1 python3-debugsource-3.6.15-150300.10.30.1 - openSUSE Leap 15.4 (aarch64 ppc64le s390x x86_64): libpython3_6m1_0-3.6.15-150300.10.30.1 libpython3_6m1_0-debuginfo-3.6.15-150300.10.30.1 python3-3.6.15-150300.10.30.1 python3-base-3.6.15-150300.10.30.1 python3-base-debuginfo-3.6.15-150300.10.30.1 python3-core-debugsource-3.6.15-150300.10.30.1 python3-curses-3.6.15-150300.10.30.1 python3-curses-debuginfo-3.6.15-150300.10.30.1 python3-dbm-3.6.15-150300.10.30.1 python3-dbm-debuginfo-3.6.15-150300.10.30.1 python3-debuginfo-3.6.15-150300.10.30.1 python3-debugsource-3.6.15-150300.10.30.1 python3-devel-3.6.15-150300.10.30.1 python3-devel-debuginfo-3.6.15-150300.10.30.1 python3-doc-3.6.15-150300.10.30.1 python3-doc-devhelp-3.6.15-150300.10.30.1 python3-idle-3.6.15-150300.10.30.1 python3-testsuite-3.6.15-150300.10.30.1 python3-testsuite-debuginfo-3.6.15-150300.10.30.1 python3-tk-3.6.15-150300.10.30.1 python3-tk-debuginfo-3.6.15-150300.10.30.1 python3-tools-3.6.15-150300.10.30.1 - openSUSE Leap 15.4 (x86_64): libpython3_6m1_0-32bit-3.6.15-150300.10.30.1 libpython3_6m1_0-32bit-debuginfo-3.6.15-150300.10.30.1 - openSUSE Leap 15.3 (aarch64 ppc64le s390x x86_64): libpython3_6m1_0-3.6.15-150300.10.30.1 libpython3_6m1_0-debuginfo-3.6.15-150300.10.30.1 python3-3.6.15-150300.10.30.1 python3-base-3.6.15-150300.10.30.1 python3-base-debuginfo-3.6.15-150300.10.30.1 python3-core-debugsource-3.6.15-150300.10.30.1 python3-curses-3.6.15-150300.10.30.1 python3-curses-debuginfo-3.6.15-150300.10.30.1 python3-dbm-3.6.15-150300.10.30.1 python3-dbm-debuginfo-3.6.15-150300.10.30.1 python3-debuginfo-3.6.15-150300.10.30.1 python3-debugsource-3.6.15-150300.10.30.1 python3-devel-3.6.15-150300.10.30.1 python3-devel-debuginfo-3.6.15-150300.10.30.1 python3-doc-3.6.15-150300.10.30.1 python3-doc-devhelp-3.6.15-150300.10.30.1 python3-idle-3.6.15-150300.10.30.1 python3-testsuite-3.6.15-150300.10.30.1 python3-testsuite-debuginfo-3.6.15-150300.10.30.1 python3-tk-3.6.15-150300.10.30.1 python3-tk-debuginfo-3.6.15-150300.10.30.1 python3-tools-3.6.15-150300.10.30.1 - openSUSE Leap 15.3 (x86_64): libpython3_6m1_0-32bit-3.6.15-150300.10.30.1 libpython3_6m1_0-32bit-debuginfo-3.6.15-150300.10.30.1 - SUSE Linux Enterprise Module for Development Tools 15-SP4 (aarch64 ppc64le s390x x86_64): python3-core-debugsource-3.6.15-150300.10.30.1 python3-tools-3.6.15-150300.10.30.1 - SUSE Linux Enterprise Module for Development Tools 15-SP3 (aarch64 ppc64le s390x x86_64): python3-core-debugsource-3.6.15-150300.10.30.1 python3-tools-3.6.15-150300.10.30.1 - SUSE Linux Enterprise Module for Basesystem 15-SP4 (aarch64 ppc64le s390x x86_64): libpython3_6m1_0-3.6.15-150300.10.30.1 libpython3_6m1_0-debuginfo-3.6.15-150300.10.30.1 python3-3.6.15-150300.10.30.1 python3-base-3.6.15-150300.10.30.1 python3-base-debuginfo-3.6.15-150300.10.30.1 python3-core-debugsource-3.6.15-150300.10.30.1 python3-curses-3.6.15-150300.10.30.1 python3-curses-debuginfo-3.6.15-150300.10.30.1 python3-dbm-3.6.15-150300.10.30.1 python3-dbm-debuginfo-3.6.15-150300.10.30.1 python3-debuginfo-3.6.15-150300.10.30.1 python3-debugsource-3.6.15-150300.10.30.1 python3-devel-3.6.15-150300.10.30.1 python3-devel-debuginfo-3.6.15-150300.10.30.1 python3-idle-3.6.15-150300.10.30.1 python3-tk-3.6.15-150300.10.30.1 python3-tk-debuginfo-3.6.15-150300.10.30.1 - SUSE Linux Enterprise Module for Basesystem 15-SP3 (aarch64 ppc64le s390x x86_64): libpython3_6m1_0-3.6.15-150300.10.30.1 libpython3_6m1_0-debuginfo-3.6.15-150300.10.30.1 python3-3.6.15-150300.10.30.1 python3-base-3.6.15-150300.10.30.1 python3-base-debuginfo-3.6.15-150300.10.30.1 python3-core-debugsource-3.6.15-150300.10.30.1 python3-curses-3.6.15-150300.10.30.1 python3-curses-debuginfo-3.6.15-150300.10.30.1 python3-dbm-3.6.15-150300.10.30.1 python3-dbm-debuginfo-3.6.15-150300.10.30.1 python3-debuginfo-3.6.15-150300.10.30.1 python3-debugsource-3.6.15-150300.10.30.1 python3-devel-3.6.15-150300.10.30.1 python3-devel-debuginfo-3.6.15-150300.10.30.1 python3-idle-3.6.15-150300.10.30.1 python3-tk-3.6.15-150300.10.30.1 python3-tk-debuginfo-3.6.15-150300.10.30.1 - SUSE Linux Enterprise Micro 5.3 (aarch64 s390x x86_64): libpython3_6m1_0-3.6.15-150300.10.30.1 libpython3_6m1_0-debuginfo-3.6.15-150300.10.30.1 python3-3.6.15-150300.10.30.1 python3-base-3.6.15-150300.10.30.1 python3-base-debuginfo-3.6.15-150300.10.30.1 python3-core-debugsource-3.6.15-150300.10.30.1 python3-debuginfo-3.6.15-150300.10.30.1 python3-debugsource-3.6.15-150300.10.30.1 - SUSE Linux Enterprise Micro 5.2 (aarch64 s390x x86_64): libpython3_6m1_0-3.6.15-150300.10.30.1 libpython3_6m1_0-debuginfo-3.6.15-150300.10.30.1 python3-3.6.15-150300.10.30.1 python3-base-3.6.15-150300.10.30.1 python3-base-debuginfo-3.6.15-150300.10.30.1 python3-core-debugsource-3.6.15-150300.10.30.1 python3-debuginfo-3.6.15-150300.10.30.1 python3-debugsource-3.6.15-150300.10.30.1 References: https://www.suse.com/security/cve/CVE-2021-28861.html https://bugzilla.suse.com/1202624

1 0

SUSE-SU-2022:3531-1: important: Security update for squid
by opensuse-security＠opensuse.org 06 Oct '22

06 Oct '22

SUSE Security Update: Security update for squid ______________________________________________________________________________ Announcement ID: SUSE-SU-2022:3531-1 Rating: important References: #1203677 #1203680 Cross-References: CVE-2022-41317 CVE-2022-41318 CVSS scores: CVE-2022-41317 (SUSE): 6.5 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N CVE-2022-41318 (SUSE): 8.9 CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:L/A:H Affected Products: SUSE Linux Enterprise High Performance Computing 15-SP4 SUSE Linux Enterprise Module for Server Applications 15-SP4 SUSE Linux Enterprise Server 15-SP4 SUSE Linux Enterprise Server for SAP Applications 15-SP4 SUSE Manager Proxy 4.3 SUSE Manager Retail Branch Server 4.3 SUSE Manager Server 4.3 openSUSE Leap 15.4 ______________________________________________________________________________ An update that fixes two vulnerabilities is now available. Description: This update for squid fixes the following issues: Updated squid to version 5.7: - CVE-2022-41317: Fixed exposure of sensitive information in cache manager (bsc#1203677). - CVE-2022-41318: Fixed buffer overread in SSPI and SMB Authentication (bsc#1203680). Patch Instructions: To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 15.4: zypper in -t patch openSUSE-SLE-15.4-2022-3531=1 - SUSE Linux Enterprise Module for Server Applications 15-SP4: zypper in -t patch SUSE-SLE-Module-Server-Applications-15-SP4-2022-3531=1 Package List: - openSUSE Leap 15.4 (aarch64 ppc64le s390x x86_64): squid-5.7-150400.3.6.1 squid-debuginfo-5.7-150400.3.6.1 squid-debugsource-5.7-150400.3.6.1 - SUSE Linux Enterprise Module for Server Applications 15-SP4 (aarch64 ppc64le s390x x86_64): squid-5.7-150400.3.6.1 squid-debuginfo-5.7-150400.3.6.1 squid-debugsource-5.7-150400.3.6.1 References: https://www.suse.com/security/cve/CVE-2022-41317.html https://www.suse.com/security/cve/CVE-2022-41318.html https://bugzilla.suse.com/1203677 https://bugzilla.suse.com/1203680

1 0

SUSE-SU-2022:3540-1: moderate: Security update for LibVNCServer
by opensuse-security＠opensuse.org 06 Oct '22

06 Oct '22

SUSE Security Update: Security update for LibVNCServer ______________________________________________________________________________ Announcement ID: SUSE-SU-2022:3540-1 Rating: moderate References: #1203106 Cross-References: CVE-2020-29260 CVSS scores: CVE-2020-29260 (NVD) : 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H CVE-2020-29260 (SUSE): 5.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L Affected Products: SUSE Linux Enterprise Desktop 15-SP4 SUSE Linux Enterprise High Performance Computing 15-SP4 SUSE Linux Enterprise Module for Packagehub Subpackages 15-SP4 SUSE Linux Enterprise Server 15-SP4 SUSE Linux Enterprise Server for SAP Applications 15-SP4 SUSE Linux Enterprise Workstation Extension 15-SP4 SUSE Manager Proxy 4.3 SUSE Manager Retail Branch Server 4.3 SUSE Manager Server 4.3 openSUSE Leap 15.4 ______________________________________________________________________________ An update that fixes one vulnerability is now available. Description: This update for LibVNCServer fixes the following issues: - CVE-2020-29260: Fixed memory leakage via rfbClientCleanup() (bsc#1203106). Patch Instructions: To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 15.4: zypper in -t patch openSUSE-SLE-15.4-2022-3540=1 - SUSE Linux Enterprise Workstation Extension 15-SP4: zypper in -t patch SUSE-SLE-Product-WE-15-SP4-2022-3540=1 - SUSE Linux Enterprise Module for Packagehub Subpackages 15-SP4: zypper in -t patch SUSE-SLE-Module-Packagehub-Subpackages-15-SP4-2022-3540=1 Package List: - openSUSE Leap 15.4 (aarch64 ppc64le s390x x86_64): LibVNCServer-debugsource-0.9.13-150400.3.3.1 LibVNCServer-devel-0.9.13-150400.3.3.1 libvncclient1-0.9.13-150400.3.3.1 libvncclient1-debuginfo-0.9.13-150400.3.3.1 libvncserver1-0.9.13-150400.3.3.1 libvncserver1-debuginfo-0.9.13-150400.3.3.1 - SUSE Linux Enterprise Workstation Extension 15-SP4 (x86_64): LibVNCServer-debugsource-0.9.13-150400.3.3.1 libvncclient1-0.9.13-150400.3.3.1 libvncclient1-debuginfo-0.9.13-150400.3.3.1 libvncserver1-0.9.13-150400.3.3.1 libvncserver1-debuginfo-0.9.13-150400.3.3.1 - SUSE Linux Enterprise Module for Packagehub Subpackages 15-SP4 (aarch64 ppc64le s390x): LibVNCServer-debugsource-0.9.13-150400.3.3.1 libvncclient1-0.9.13-150400.3.3.1 libvncclient1-debuginfo-0.9.13-150400.3.3.1 libvncserver1-0.9.13-150400.3.3.1 libvncserver1-debuginfo-0.9.13-150400.3.3.1 References: https://www.suse.com/security/cve/CVE-2020-29260.html https://bugzilla.suse.com/1203106

1 0

SUSE-SU-2022:3535-1: important: Security update for slurm
by opensuse-security＠opensuse.org 06 Oct '22

06 Oct '22

SUSE Security Update: Security update for slurm ______________________________________________________________________________ Announcement ID: SUSE-SU-2022:3535-1 Rating: important References: #1199278 #1199279 #1201674 Cross-References: CVE-2022-29500 CVE-2022-29501 CVE-2022-31251 CVSS scores: CVE-2022-29500 (NVD) : 8.8 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H CVE-2022-29500 (SUSE): 8.8 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H CVE-2022-29501 (NVD) : 8.8 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H CVE-2022-29501 (SUSE): 8.8 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H CVE-2022-31251 (NVD) : 7 CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H Affected Products: SUSE Linux Enterprise High Performance Computing 15-ESPOS SUSE Linux Enterprise High Performance Computing 15-LTSS openSUSE Leap 15.3 openSUSE Leap 15.4 ______________________________________________________________________________ An update that fixes three vulnerabilities is now available. Description: This update for slurm fixes the following issues: - CVE-2022-31251: Fixed a potential security vulnerability in the test package (bsc#1201674). - CVE-2022-29500: Fixed architectural flaw that could have been exploited to allow an unprivileged user to execute arbitrary processes as root (bsc#1199278). - CVE-2022-29501: Fixed a problem that an unprivileged user could have sent data to arbitrary unix socket as root (bsc#1199279). Patch Instructions: To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 15.4: zypper in -t patch openSUSE-SLE-15.4-2022-3535=1 - openSUSE Leap 15.3: zypper in -t patch openSUSE-SLE-15.3-2022-3535=1 - SUSE Linux Enterprise High Performance Computing 15-LTSS: zypper in -t patch SUSE-SLE-Product-HPC-15-2022-3535=1 - SUSE Linux Enterprise High Performance Computing 15-ESPOS: zypper in -t patch SUSE-SLE-Product-HPC-15-2022-3535=1 Package List: - openSUSE Leap 15.4 (aarch64 ppc64le s390x x86_64): libslurm32-17.11.13-150000.6.40.1 libslurm32-debuginfo-17.11.13-150000.6.40.1 - openSUSE Leap 15.3 (aarch64 ppc64le s390x x86_64): libslurm32-17.11.13-150000.6.40.1 libslurm32-debuginfo-17.11.13-150000.6.40.1 - SUSE Linux Enterprise High Performance Computing 15-LTSS (aarch64 x86_64): libpmi0-17.11.13-150000.6.40.1 libpmi0-debuginfo-17.11.13-150000.6.40.1 libslurm32-17.11.13-150000.6.40.1 libslurm32-debuginfo-17.11.13-150000.6.40.1 perl-slurm-17.11.13-150000.6.40.1 perl-slurm-debuginfo-17.11.13-150000.6.40.1 slurm-17.11.13-150000.6.40.1 slurm-auth-none-17.11.13-150000.6.40.1 slurm-auth-none-debuginfo-17.11.13-150000.6.40.1 slurm-config-17.11.13-150000.6.40.1 slurm-debuginfo-17.11.13-150000.6.40.1 slurm-debugsource-17.11.13-150000.6.40.1 slurm-devel-17.11.13-150000.6.40.1 slurm-doc-17.11.13-150000.6.40.1 slurm-lua-17.11.13-150000.6.40.1 slurm-lua-debuginfo-17.11.13-150000.6.40.1 slurm-munge-17.11.13-150000.6.40.1 slurm-munge-debuginfo-17.11.13-150000.6.40.1 slurm-node-17.11.13-150000.6.40.1 slurm-node-debuginfo-17.11.13-150000.6.40.1 slurm-pam_slurm-17.11.13-150000.6.40.1 slurm-pam_slurm-debuginfo-17.11.13-150000.6.40.1 slurm-plugins-17.11.13-150000.6.40.1 slurm-plugins-debuginfo-17.11.13-150000.6.40.1 slurm-slurmdbd-17.11.13-150000.6.40.1 slurm-slurmdbd-debuginfo-17.11.13-150000.6.40.1 slurm-sql-17.11.13-150000.6.40.1 slurm-sql-debuginfo-17.11.13-150000.6.40.1 slurm-torque-17.11.13-150000.6.40.1 slurm-torque-debuginfo-17.11.13-150000.6.40.1 - SUSE Linux Enterprise High Performance Computing 15-ESPOS (aarch64 x86_64): libpmi0-17.11.13-150000.6.40.1 libpmi0-debuginfo-17.11.13-150000.6.40.1 libslurm32-17.11.13-150000.6.40.1 libslurm32-debuginfo-17.11.13-150000.6.40.1 perl-slurm-17.11.13-150000.6.40.1 perl-slurm-debuginfo-17.11.13-150000.6.40.1 slurm-17.11.13-150000.6.40.1 slurm-auth-none-17.11.13-150000.6.40.1 slurm-auth-none-debuginfo-17.11.13-150000.6.40.1 slurm-config-17.11.13-150000.6.40.1 slurm-debuginfo-17.11.13-150000.6.40.1 slurm-debugsource-17.11.13-150000.6.40.1 slurm-devel-17.11.13-150000.6.40.1 slurm-doc-17.11.13-150000.6.40.1 slurm-lua-17.11.13-150000.6.40.1 slurm-lua-debuginfo-17.11.13-150000.6.40.1 slurm-munge-17.11.13-150000.6.40.1 slurm-munge-debuginfo-17.11.13-150000.6.40.1 slurm-node-17.11.13-150000.6.40.1 slurm-node-debuginfo-17.11.13-150000.6.40.1 slurm-pam_slurm-17.11.13-150000.6.40.1 slurm-pam_slurm-debuginfo-17.11.13-150000.6.40.1 slurm-plugins-17.11.13-150000.6.40.1 slurm-plugins-debuginfo-17.11.13-150000.6.40.1 slurm-slurmdbd-17.11.13-150000.6.40.1 slurm-slurmdbd-debuginfo-17.11.13-150000.6.40.1 slurm-sql-17.11.13-150000.6.40.1 slurm-sql-debuginfo-17.11.13-150000.6.40.1 slurm-torque-17.11.13-150000.6.40.1 slurm-torque-debuginfo-17.11.13-150000.6.40.1 References: https://www.suse.com/security/cve/CVE-2022-29500.html https://www.suse.com/security/cve/CVE-2022-29501.html https://www.suse.com/security/cve/CVE-2022-31251.html https://bugzilla.suse.com/1199278 https://bugzilla.suse.com/1199279 https://bugzilla.suse.com/1201674

1 0

SUSE-SU-2022:3537-1: important: Security update for postgresql-jdbc
by opensuse-security＠opensuse.org 06 Oct '22

06 Oct '22

SUSE Security Update: Security update for postgresql-jdbc ______________________________________________________________________________ Announcement ID: SUSE-SU-2022:3537-1 Rating: important References: #1202170 Cross-References: CVE-2022-31197 CVSS scores: CVE-2022-31197 (NVD) : 8 CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H CVE-2022-31197 (SUSE): 8.1 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:N Affected Products: SUSE Linux Enterprise High Performance Computing 15-SP4 SUSE Linux Enterprise Module for Server Applications 15-SP4 SUSE Linux Enterprise Server 15-SP4 SUSE Linux Enterprise Server for SAP Applications 15-SP4 SUSE Manager Proxy 4.3 SUSE Manager Retail Branch Server 4.3 SUSE Manager Server 4.3 openSUSE Leap 15.4 ______________________________________________________________________________ An update that fixes one vulnerability is now available. Description: This update for postgresql-jdbc fixes the following issues: - CVE-2022-31197: Fixed SQL injection vulnerability (bsc#1202170). Patch Instructions: To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 15.4: zypper in -t patch openSUSE-SLE-15.4-2022-3537=1 - SUSE Linux Enterprise Module for Server Applications 15-SP4: zypper in -t patch SUSE-SLE-Module-Server-Applications-15-SP4-2022-3537=1 Package List: - openSUSE Leap 15.4 (noarch): postgresql-jdbc-42.2.25-150400.3.6.1 postgresql-jdbc-javadoc-42.2.25-150400.3.6.1 - SUSE Linux Enterprise Module for Server Applications 15-SP4 (noarch): postgresql-jdbc-42.2.25-150400.3.6.1 References: https://www.suse.com/security/cve/CVE-2022-31197.html https://bugzilla.suse.com/1202170

1 0

SUSE-SU-2022:3538-1: important: Security update for webkit2gtk3
by opensuse-security＠opensuse.org 06 Oct '22

06 Oct '22

SUSE Security Update: Security update for webkit2gtk3 ______________________________________________________________________________ Announcement ID: SUSE-SU-2022:3538-1 Rating: important References: #1203530 Cross-References: CVE-2022-32886 CVE-2022-32912 CVSS scores: CVE-2022-32886 (NVD) : 8.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H CVE-2022-32886 (SUSE): 8.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H CVE-2022-32912 (NVD) : 8.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H CVE-2022-32912 (SUSE): 8.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H Affected Products: SUSE Enterprise Storage 7 SUSE Linux Enterprise Desktop 15-SP3 SUSE Linux Enterprise High Performance Computing 15-SP2-ESPOS SUSE Linux Enterprise High Performance Computing 15-SP2-LTSS SUSE Linux Enterprise High Performance Computing 15-SP3 SUSE Linux Enterprise Module for Basesystem 15-SP3 SUSE Linux Enterprise Module for Desktop Applications 15-SP3 SUSE Linux Enterprise Server 15-SP2-BCL SUSE Linux Enterprise Server 15-SP2-LTSS SUSE Linux Enterprise Server 15-SP3 SUSE Linux Enterprise Server for SAP 15-SP2 SUSE Linux Enterprise Server for SAP Applications 15-SP3 SUSE Linux Enterprise Storage 7.1 SUSE Manager Proxy 4.1 SUSE Manager Proxy 4.2 SUSE Manager Retail Branch Server 4.1 SUSE Manager Retail Branch Server 4.2 SUSE Manager Server 4.1 SUSE Manager Server 4.2 openSUSE Leap 15.3 openSUSE Leap 15.4 ______________________________________________________________________________ An update that fixes two vulnerabilities is now available. Description: This update for webkit2gtk3 fixes the following issues: Updated to version 2.36.8 (bsc#1203530): - CVE-2022-32886: Fixed a buffer overflow issue that could potentially lead to code execution. - CVE-2022-32912: Fixed an out-of-bounds read that could potentially lead to code execution. Patch Instructions: To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 15.4: zypper in -t patch openSUSE-SLE-15.4-2022-3538=1 - openSUSE Leap 15.3: zypper in -t patch openSUSE-SLE-15.3-2022-3538=1 - SUSE Manager Server 4.1: zypper in -t patch SUSE-SLE-Product-SUSE-Manager-Server-4.1-2022-3538=1 - SUSE Manager Retail Branch Server 4.1: zypper in -t patch SUSE-SLE-Product-SUSE-Manager-Retail-Branch-Server-4.1-2022-3538=1 - SUSE Manager Proxy 4.1: zypper in -t patch SUSE-SLE-Product-SUSE-Manager-Proxy-4.1-2022-3538=1 - SUSE Linux Enterprise Server for SAP 15-SP2: zypper in -t patch SUSE-SLE-Product-SLES_SAP-15-SP2-2022-3538=1 - SUSE Linux Enterprise Server 15-SP2-LTSS: zypper in -t patch SUSE-SLE-Product-SLES-15-SP2-LTSS-2022-3538=1 - SUSE Linux Enterprise Server 15-SP2-BCL: zypper in -t patch SUSE-SLE-Product-SLES-15-SP2-BCL-2022-3538=1 - SUSE Linux Enterprise Module for Desktop Applications 15-SP3: zypper in -t patch SUSE-SLE-Module-Desktop-Applications-15-SP3-2022-3538=1 - SUSE Linux Enterprise Module for Basesystem 15-SP3: zypper in -t patch SUSE-SLE-Module-Basesystem-15-SP3-2022-3538=1 - SUSE Linux Enterprise High Performance Computing 15-SP2-LTSS: zypper in -t patch SUSE-SLE-Product-HPC-15-SP2-LTSS-2022-3538=1 - SUSE Linux Enterprise High Performance Computing 15-SP2-ESPOS: zypper in -t patch SUSE-SLE-Product-HPC-15-SP2-ESPOS-2022-3538=1 - SUSE Enterprise Storage 7: zypper in -t patch SUSE-Storage-7-2022-3538=1 Package List: - openSUSE Leap 15.4 (noarch): libwebkit2gtk3-lang-2.36.8-150200.47.1 - openSUSE Leap 15.3 (aarch64 ppc64le s390x x86_64): libjavascriptcoregtk-4_0-18-2.36.8-150200.47.1 libjavascriptcoregtk-4_0-18-debuginfo-2.36.8-150200.47.1 libwebkit2gtk-4_0-37-2.36.8-150200.47.1 libwebkit2gtk-4_0-37-debuginfo-2.36.8-150200.47.1 typelib-1_0-JavaScriptCore-4_0-2.36.8-150200.47.1 typelib-1_0-WebKit2-4_0-2.36.8-150200.47.1 typelib-1_0-WebKit2WebExtension-4_0-2.36.8-150200.47.1 webkit-jsc-4-2.36.8-150200.47.1 webkit-jsc-4-debuginfo-2.36.8-150200.47.1 webkit2gtk-4_0-injected-bundles-2.36.8-150200.47.1 webkit2gtk-4_0-injected-bundles-debuginfo-2.36.8-150200.47.1 webkit2gtk3-debugsource-2.36.8-150200.47.1 webkit2gtk3-devel-2.36.8-150200.47.1 webkit2gtk3-minibrowser-2.36.8-150200.47.1 webkit2gtk3-minibrowser-debuginfo-2.36.8-150200.47.1 - openSUSE Leap 15.3 (noarch): libwebkit2gtk3-lang-2.36.8-150200.47.1 - openSUSE Leap 15.3 (x86_64): libjavascriptcoregtk-4_0-18-32bit-2.36.8-150200.47.1 libjavascriptcoregtk-4_0-18-32bit-debuginfo-2.36.8-150200.47.1 libwebkit2gtk-4_0-37-32bit-2.36.8-150200.47.1 libwebkit2gtk-4_0-37-32bit-debuginfo-2.36.8-150200.47.1 - SUSE Manager Server 4.1 (ppc64le s390x x86_64): libjavascriptcoregtk-4_0-18-2.36.8-150200.47.1 libjavascriptcoregtk-4_0-18-debuginfo-2.36.8-150200.47.1 libwebkit2gtk-4_0-37-2.36.8-150200.47.1 libwebkit2gtk-4_0-37-debuginfo-2.36.8-150200.47.1 typelib-1_0-JavaScriptCore-4_0-2.36.8-150200.47.1 typelib-1_0-WebKit2-4_0-2.36.8-150200.47.1 typelib-1_0-WebKit2WebExtension-4_0-2.36.8-150200.47.1 webkit2gtk-4_0-injected-bundles-2.36.8-150200.47.1 webkit2gtk-4_0-injected-bundles-debuginfo-2.36.8-150200.47.1 webkit2gtk3-debugsource-2.36.8-150200.47.1 webkit2gtk3-devel-2.36.8-150200.47.1 - SUSE Manager Server 4.1 (noarch): libwebkit2gtk3-lang-2.36.8-150200.47.1 - SUSE Manager Retail Branch Server 4.1 (x86_64): libjavascriptcoregtk-4_0-18-2.36.8-150200.47.1 libjavascriptcoregtk-4_0-18-debuginfo-2.36.8-150200.47.1 libwebkit2gtk-4_0-37-2.36.8-150200.47.1 libwebkit2gtk-4_0-37-debuginfo-2.36.8-150200.47.1 typelib-1_0-JavaScriptCore-4_0-2.36.8-150200.47.1 typelib-1_0-WebKit2-4_0-2.36.8-150200.47.1 typelib-1_0-WebKit2WebExtension-4_0-2.36.8-150200.47.1 webkit2gtk-4_0-injected-bundles-2.36.8-150200.47.1 webkit2gtk-4_0-injected-bundles-debuginfo-2.36.8-150200.47.1 webkit2gtk3-debugsource-2.36.8-150200.47.1 webkit2gtk3-devel-2.36.8-150200.47.1 - SUSE Manager Retail Branch Server 4.1 (noarch): libwebkit2gtk3-lang-2.36.8-150200.47.1 - SUSE Manager Proxy 4.1 (x86_64): libjavascriptcoregtk-4_0-18-2.36.8-150200.47.1 libjavascriptcoregtk-4_0-18-debuginfo-2.36.8-150200.47.1 libwebkit2gtk-4_0-37-2.36.8-150200.47.1 libwebkit2gtk-4_0-37-debuginfo-2.36.8-150200.47.1 typelib-1_0-JavaScriptCore-4_0-2.36.8-150200.47.1 typelib-1_0-WebKit2-4_0-2.36.8-150200.47.1 typelib-1_0-WebKit2WebExtension-4_0-2.36.8-150200.47.1 webkit2gtk-4_0-injected-bundles-2.36.8-150200.47.1 webkit2gtk-4_0-injected-bundles-debuginfo-2.36.8-150200.47.1 webkit2gtk3-debugsource-2.36.8-150200.47.1 webkit2gtk3-devel-2.36.8-150200.47.1 - SUSE Manager Proxy 4.1 (noarch): libwebkit2gtk3-lang-2.36.8-150200.47.1 - SUSE Linux Enterprise Server for SAP 15-SP2 (ppc64le x86_64): libjavascriptcoregtk-4_0-18-2.36.8-150200.47.1 libjavascriptcoregtk-4_0-18-debuginfo-2.36.8-150200.47.1 libwebkit2gtk-4_0-37-2.36.8-150200.47.1 libwebkit2gtk-4_0-37-debuginfo-2.36.8-150200.47.1 typelib-1_0-JavaScriptCore-4_0-2.36.8-150200.47.1 typelib-1_0-WebKit2-4_0-2.36.8-150200.47.1 typelib-1_0-WebKit2WebExtension-4_0-2.36.8-150200.47.1 webkit2gtk-4_0-injected-bundles-2.36.8-150200.47.1 webkit2gtk-4_0-injected-bundles-debuginfo-2.36.8-150200.47.1 webkit2gtk3-debugsource-2.36.8-150200.47.1 webkit2gtk3-devel-2.36.8-150200.47.1 - SUSE Linux Enterprise Server for SAP 15-SP2 (noarch): libwebkit2gtk3-lang-2.36.8-150200.47.1 - SUSE Linux Enterprise Server 15-SP2-LTSS (aarch64 ppc64le s390x x86_64): libjavascriptcoregtk-4_0-18-2.36.8-150200.47.1 libjavascriptcoregtk-4_0-18-debuginfo-2.36.8-150200.47.1 libwebkit2gtk-4_0-37-2.36.8-150200.47.1 libwebkit2gtk-4_0-37-debuginfo-2.36.8-150200.47.1 typelib-1_0-JavaScriptCore-4_0-2.36.8-150200.47.1 typelib-1_0-WebKit2-4_0-2.36.8-150200.47.1 typelib-1_0-WebKit2WebExtension-4_0-2.36.8-150200.47.1 webkit2gtk-4_0-injected-bundles-2.36.8-150200.47.1 webkit2gtk-4_0-injected-bundles-debuginfo-2.36.8-150200.47.1 webkit2gtk3-debugsource-2.36.8-150200.47.1 webkit2gtk3-devel-2.36.8-150200.47.1 - SUSE Linux Enterprise Server 15-SP2-LTSS (noarch): libwebkit2gtk3-lang-2.36.8-150200.47.1 - SUSE Linux Enterprise Server 15-SP2-BCL (x86_64): libjavascriptcoregtk-4_0-18-2.36.8-150200.47.1 libjavascriptcoregtk-4_0-18-debuginfo-2.36.8-150200.47.1 libwebkit2gtk-4_0-37-2.36.8-150200.47.1 libwebkit2gtk-4_0-37-debuginfo-2.36.8-150200.47.1 typelib-1_0-JavaScriptCore-4_0-2.36.8-150200.47.1 typelib-1_0-WebKit2-4_0-2.36.8-150200.47.1 typelib-1_0-WebKit2WebExtension-4_0-2.36.8-150200.47.1 webkit2gtk-4_0-injected-bundles-2.36.8-150200.47.1 webkit2gtk-4_0-injected-bundles-debuginfo-2.36.8-150200.47.1 webkit2gtk3-debugsource-2.36.8-150200.47.1 webkit2gtk3-devel-2.36.8-150200.47.1 - SUSE Linux Enterprise Server 15-SP2-BCL (noarch): libwebkit2gtk3-lang-2.36.8-150200.47.1 - SUSE Linux Enterprise Module for Desktop Applications 15-SP3 (aarch64 ppc64le s390x x86_64): typelib-1_0-JavaScriptCore-4_0-2.36.8-150200.47.1 typelib-1_0-WebKit2-4_0-2.36.8-150200.47.1 typelib-1_0-WebKit2WebExtension-4_0-2.36.8-150200.47.1 webkit2gtk3-debugsource-2.36.8-150200.47.1 webkit2gtk3-devel-2.36.8-150200.47.1 - SUSE Linux Enterprise Module for Basesystem 15-SP3 (aarch64 ppc64le s390x x86_64): libjavascriptcoregtk-4_0-18-2.36.8-150200.47.1 libjavascriptcoregtk-4_0-18-debuginfo-2.36.8-150200.47.1 libwebkit2gtk-4_0-37-2.36.8-150200.47.1 libwebkit2gtk-4_0-37-debuginfo-2.36.8-150200.47.1 webkit2gtk-4_0-injected-bundles-2.36.8-150200.47.1 webkit2gtk-4_0-injected-bundles-debuginfo-2.36.8-150200.47.1 webkit2gtk3-debugsource-2.36.8-150200.47.1 - SUSE Linux Enterprise Module for Basesystem 15-SP3 (noarch): libwebkit2gtk3-lang-2.36.8-150200.47.1 - SUSE Linux Enterprise High Performance Computing 15-SP2-LTSS (aarch64 x86_64): libjavascriptcoregtk-4_0-18-2.36.8-150200.47.1 libjavascriptcoregtk-4_0-18-debuginfo-2.36.8-150200.47.1 libwebkit2gtk-4_0-37-2.36.8-150200.47.1 libwebkit2gtk-4_0-37-debuginfo-2.36.8-150200.47.1 typelib-1_0-JavaScriptCore-4_0-2.36.8-150200.47.1 typelib-1_0-WebKit2-4_0-2.36.8-150200.47.1 typelib-1_0-WebKit2WebExtension-4_0-2.36.8-150200.47.1 webkit2gtk-4_0-injected-bundles-2.36.8-150200.47.1 webkit2gtk-4_0-injected-bundles-debuginfo-2.36.8-150200.47.1 webkit2gtk3-debugsource-2.36.8-150200.47.1 webkit2gtk3-devel-2.36.8-150200.47.1 - SUSE Linux Enterprise High Performance Computing 15-SP2-LTSS (noarch): libwebkit2gtk3-lang-2.36.8-150200.47.1 - SUSE Linux Enterprise High Performance Computing 15-SP2-ESPOS (aarch64 x86_64): libjavascriptcoregtk-4_0-18-2.36.8-150200.47.1 libjavascriptcoregtk-4_0-18-debuginfo-2.36.8-150200.47.1 libwebkit2gtk-4_0-37-2.36.8-150200.47.1 libwebkit2gtk-4_0-37-debuginfo-2.36.8-150200.47.1 typelib-1_0-JavaScriptCore-4_0-2.36.8-150200.47.1 typelib-1_0-WebKit2-4_0-2.36.8-150200.47.1 typelib-1_0-WebKit2WebExtension-4_0-2.36.8-150200.47.1 webkit2gtk-4_0-injected-bundles-2.36.8-150200.47.1 webkit2gtk-4_0-injected-bundles-debuginfo-2.36.8-150200.47.1 webkit2gtk3-debugsource-2.36.8-150200.47.1 webkit2gtk3-devel-2.36.8-150200.47.1 - SUSE Linux Enterprise High Performance Computing 15-SP2-ESPOS (noarch): libwebkit2gtk3-lang-2.36.8-150200.47.1 - SUSE Enterprise Storage 7 (aarch64 x86_64): libjavascriptcoregtk-4_0-18-2.36.8-150200.47.1 libjavascriptcoregtk-4_0-18-debuginfo-2.36.8-150200.47.1 libwebkit2gtk-4_0-37-2.36.8-150200.47.1 libwebkit2gtk-4_0-37-debuginfo-2.36.8-150200.47.1 typelib-1_0-JavaScriptCore-4_0-2.36.8-150200.47.1 typelib-1_0-WebKit2-4_0-2.36.8-150200.47.1 typelib-1_0-WebKit2WebExtension-4_0-2.36.8-150200.47.1 webkit2gtk-4_0-injected-bundles-2.36.8-150200.47.1 webkit2gtk-4_0-injected-bundles-debuginfo-2.36.8-150200.47.1 webkit2gtk3-debugsource-2.36.8-150200.47.1 webkit2gtk3-devel-2.36.8-150200.47.1 - SUSE Enterprise Storage 7 (noarch): libwebkit2gtk3-lang-2.36.8-150200.47.1 References: https://www.suse.com/security/cve/CVE-2022-32886.html https://www.suse.com/security/cve/CVE-2022-32912.html https://bugzilla.suse.com/1203530

1 0