October 2022 - openSUSE Security Announce

openSUSE-SU-2022:10170-1: moderate: Security update for cacti, cacti-spine
by opensuse-security＠opensuse.org 30 Oct '22

30 Oct '22

openSUSE Security Update: Security update for cacti, cacti-spine ______________________________________________________________________________ Announcement ID: openSUSE-SU-2022:10170-1 Rating: moderate References: #1203952 Affected Products: SUSE Linux Enterprise High Performance Computing 12 SUSE Linux Enterprise Server 12 SUSE Linux Enterprise Server 12-SP3 SUSE Linux Enterprise Server 12-SP4 SUSE Linux Enterprise Server 12-SP5 SUSE Linux Enterprise Server for SAP Applications 12 SUSE Linux Enterprise Server for SAP Applications 12-SP3 SUSE Linux Enterprise Server for SAP Applications 12-SP4 SUSE Linux Enterprise Server for SAP Applications 12-SP5 SUSE Package Hub for SUSE Linux Enterprise 12 openSUSE Backports SLE-15-SP3 openSUSE Backports SLE-15-SP4 ______________________________________________________________________________ An update that contains security fixes can now be installed. Description: This update for cacti, cacti-spine fixes the following issues: cacti-spine 1.2.22, delivering a number of bug fixes: * When polling time is exceed, spine does not always exit as expected * Spine logging at `-V 5` includes an extra line feed * Incorrect SNMP responses can cause spine to crash * Properly handle devices that timeout responding to the Extended Uptime * MariaDB can cause spine to abort prematurely despite error handling * Spine should log the error time when exiting via signal cacti-spine 1.2.21: * Disable DES if Net-SNMP doesn't have it cacti 1.2.22, providing one security fix, a number of bug fixes and a collection of improvements: * When creating new graphs, cross site injection is possible (boo#1203952) * When creating user from template, multiple Domain FullName and Mail are not propagated * Nectar Aggregate 95th emailed report broken * Boost may not find archive tables correctly * Users may be unable to change their password when forced during a login * Net-SNMP Memory Graph Template has Wrong GPRINT * Search in tree view unusable on larger installations * Increased bulk insert size to avoid partial inserts and potential data loss. * Call to undefined function boost_debug in Cacti log * When no guest template is set, login cookies are not properly set * Later RRDtool releases do not need to check last_update time * Regex filters are not always long enough * Domains based LDAP and AD Fullname and Email not auto-populated * Cacti polling and boost report the wrong number of Data Sources when Devices are disabled * When editing Graph Template Items there are cases where VDEF's are hidden when they should be shown * Database SSL setting lacks default value * Update default path cacti under *BSD by xmacan * Web Basic authentication not creating template user * Unable to change the Heartbeat of a Data Source Profile * Tree Search Does Not Properly Search All Trees * When structured paths are setup, RRDfiles may not always be created when possible * When parsing the logs, caching would help speed up processing * Deprecation warnings when attempting real-time Graphs with PHP8.1 * Custom Timespan is lost when clicking other tree branches * Non device based Data Sources not being polled * When Resource XML file inproperly formatted, graph creation can fail with errors * Update code style to support PHP 8 requirements * None" shows all graphs * Realtime popup window experiences issues on some browsers * Auth settings do not always properly reflect the options selected by ddb4github * MySQL can cause cacti to become stalled due to locking issues * Boost process can get hung under rare conditions until the poller times out * Exporting graphs under PHP 8 can cause errors * Host table has wrong default for disabled and deleted columns * RRD storage paths do not scale properly * When importing, make it possible to only import certain components * Update change_device script to include new features by bmfmancini * Make help pages use latest online version wherever possible * Cacti should show PHP INI locations during install * Detect PHP INI values that are different in the INI vs running config * Added Gradient Color support for AREA charts by thurban * Update CDEF functions for RRDtool * When boost is running, it's not clear which processes are running and how long they have to complete cacti 1.2.21: * Add a CLI script to install/enable/disable/uninstall plugins * Add log message when purging DS stats and poller repopulate * A collection of bug fixes Patch Instructions: To install this openSUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Backports SLE-15-SP4: zypper in -t patch openSUSE-2022-10170=1 - openSUSE Backports SLE-15-SP3: zypper in -t patch openSUSE-2022-10170=1 - SUSE Package Hub for SUSE Linux Enterprise 12: zypper in -t patch openSUSE-2022-10170=1 Package List: - openSUSE Backports SLE-15-SP4 (aarch64 i586 ppc64le s390x x86_64): cacti-spine-1.2.22-bp154.2.3.1 cacti-spine-debuginfo-1.2.22-bp154.2.3.1 cacti-spine-debugsource-1.2.22-bp154.2.3.1 - openSUSE Backports SLE-15-SP4 (noarch): cacti-1.2.22-bp154.2.3.1 - openSUSE Backports SLE-15-SP3 (aarch64 i586 ppc64le s390x x86_64): cacti-spine-1.2.22-bp153.2.12.1 - openSUSE Backports SLE-15-SP3 (noarch): cacti-1.2.22-bp153.2.12.1 - SUSE Package Hub for SUSE Linux Enterprise 12 (aarch64 ppc64le s390x x86_64): cacti-spine-1.2.22-23.1 - SUSE Package Hub for SUSE Linux Enterprise 12 (noarch): cacti-1.2.22-29.1 References: https://bugzilla.suse.com/1203952

1 0

openSUSE-SU-2022:10170-1: moderate: Security update for cacti, cacti-spine
by opensuse-security＠opensuse.org 30 Oct '22

30 Oct '22

openSUSE Security Update: Security update for cacti, cacti-spine ______________________________________________________________________________ Announcement ID: openSUSE-SU-2022:10170-1 Rating: moderate References: #1203952 Affected Products: SUSE Linux Enterprise High Performance Computing 12 SUSE Linux Enterprise Server 12 SUSE Linux Enterprise Server 12-SP3 SUSE Linux Enterprise Server 12-SP4 SUSE Linux Enterprise Server 12-SP5 SUSE Linux Enterprise Server for SAP Applications 12 SUSE Linux Enterprise Server for SAP Applications 12-SP3 SUSE Linux Enterprise Server for SAP Applications 12-SP4 SUSE Linux Enterprise Server for SAP Applications 12-SP5 SUSE Package Hub for SUSE Linux Enterprise 12 ______________________________________________________________________________ An update that contains security fixes can now be installed. Description: This update for cacti, cacti-spine fixes the following issues: cacti-spine 1.2.22, delivering a number of bug fixes: * When polling time is exceed, spine does not always exit as expected * Spine logging at `-V 5` includes an extra line feed * Incorrect SNMP responses can cause spine to crash * Properly handle devices that timeout responding to the Extended Uptime * MariaDB can cause spine to abort prematurely despite error handling * Spine should log the error time when exiting via signal cacti-spine 1.2.21: * Disable DES if Net-SNMP doesn't have it cacti 1.2.22, providing one security fix, a number of bug fixes and a collection of improvements: * When creating new graphs, cross site injection is possible (boo#1203952) * When creating user from template, multiple Domain FullName and Mail are not propagated * Nectar Aggregate 95th emailed report broken * Boost may not find archive tables correctly * Users may be unable to change their password when forced during a login * Net-SNMP Memory Graph Template has Wrong GPRINT * Search in tree view unusable on larger installations * Increased bulk insert size to avoid partial inserts and potential data loss. * Call to undefined function boost_debug in Cacti log * When no guest template is set, login cookies are not properly set * Later RRDtool releases do not need to check last_update time * Regex filters are not always long enough * Domains based LDAP and AD Fullname and Email not auto-populated * Cacti polling and boost report the wrong number of Data Sources when Devices are disabled * When editing Graph Template Items there are cases where VDEF's are hidden when they should be shown * Database SSL setting lacks default value * Update default path cacti under *BSD by xmacan * Web Basic authentication not creating template user * Unable to change the Heartbeat of a Data Source Profile * Tree Search Does Not Properly Search All Trees * When structured paths are setup, RRDfiles may not always be created when possible * When parsing the logs, caching would help speed up processing * Deprecation warnings when attempting real-time Graphs with PHP8.1 * Custom Timespan is lost when clicking other tree branches * Non device based Data Sources not being polled * When Resource XML file inproperly formatted, graph creation can fail with errors * Update code style to support PHP 8 requirements * None" shows all graphs * Realtime popup window experiences issues on some browsers * Auth settings do not always properly reflect the options selected by ddb4github * MySQL can cause cacti to become stalled due to locking issues * Boost process can get hung under rare conditions until the poller times out * Exporting graphs under PHP 8 can cause errors * Host table has wrong default for disabled and deleted columns * RRD storage paths do not scale properly * When importing, make it possible to only import certain components * Update change_device script to include new features by bmfmancini * Make help pages use latest online version wherever possible * Cacti should show PHP INI locations during install * Detect PHP INI values that are different in the INI vs running config * Added Gradient Color support for AREA charts by thurban * Update CDEF functions for RRDtool * When boost is running, it's not clear which processes are running and how long they have to complete cacti 1.2.21: * Add a CLI script to install/enable/disable/uninstall plugins * Add log message when purging DS stats and poller repopulate * A collection of bug fixes Patch Instructions: To install this openSUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - SUSE Package Hub for SUSE Linux Enterprise 12: zypper in -t patch openSUSE-2022-10170=1 Package List: - SUSE Package Hub for SUSE Linux Enterprise 12 (aarch64 ppc64le s390x x86_64): cacti-spine-1.2.22-23.1 - SUSE Package Hub for SUSE Linux Enterprise 12 (noarch): cacti-1.2.22-29.1 References: https://bugzilla.suse.com/1203952

1 0

openSUSE-SU-2022:10171-1: important: Security update for pdns-recursor
by opensuse-security＠opensuse.org 30 Oct '22

30 Oct '22

openSUSE Security Update: Security update for pdns-recursor ______________________________________________________________________________ Announcement ID: openSUSE-SU-2022:10171-1 Rating: important References: #1202664 Cross-References: CVE-2022-37428 CVSS scores: CVE-2022-37428 (NVD) : 6.5 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H CVE-2022-37428 (SUSE): 6.5 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H Affected Products: openSUSE Backports SLE-15-SP4 ______________________________________________________________________________ An update that fixes one vulnerability is now available. Description: This update for pdns-recursor fixes the following issues: pdns-recursor was updated to 4.6.3: * fixes incomplete exception handling related to protobuf message generation (boo#1202664, CVE-2022-37428) pdns-recursor was updated to 4.6.2: * Reject non-apex NSEC(3)s that have both the NS and SOA bits set * A CNAME answer on DS query should abort DS retrieval * Allow disabling of processing the root hints * If we get NODATA on an AAAA in followCNAMERecords, try native dns64 Patch Instructions: To install this openSUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Backports SLE-15-SP4: zypper in -t patch openSUSE-2022-10171=1 Package List: - openSUSE Backports SLE-15-SP4 (aarch64 ppc64le x86_64): pdns-recursor-4.6.3-bp154.2.3.1 pdns-recursor-debuginfo-4.6.3-bp154.2.3.1 pdns-recursor-debugsource-4.6.3-bp154.2.3.1 References: https://www.suse.com/security/cve/CVE-2022-37428.html https://bugzilla.suse.com/1202664

1 0

openSUSE-SU-2022:10169-1: important: Security update for libmad
by opensuse-security＠opensuse.org 30 Oct '22

30 Oct '22

openSUSE Security Update: Security update for libmad ______________________________________________________________________________ Announcement ID: openSUSE-SU-2022:10169-1 Rating: important References: #1036968 Cross-References: CVE-2017-8373 CVSS scores: CVE-2017-8373 (NVD) : 7.8 CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H CVE-2017-8373 (SUSE): 7.8 CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H Affected Products: SUSE Linux Enterprise High Performance Computing 12 SUSE Linux Enterprise Server 12 SUSE Linux Enterprise Server 12-SP3 SUSE Linux Enterprise Server 12-SP4 SUSE Linux Enterprise Server 12-SP5 SUSE Linux Enterprise Server for SAP Applications 12 SUSE Linux Enterprise Server for SAP Applications 12-SP3 SUSE Linux Enterprise Server for SAP Applications 12-SP4 SUSE Linux Enterprise Server for SAP Applications 12-SP5 SUSE Package Hub for SUSE Linux Enterprise 12 ______________________________________________________________________________ An update that fixes one vulnerability is now available. Description: This update for libmad fixes the following issues: - CVE-2017-8373: Fixed a heap-based buffer overflow in mad_layer_III (boo#1036968). Patch Instructions: To install this openSUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - SUSE Package Hub for SUSE Linux Enterprise 12: zypper in -t patch openSUSE-2022-10169=1 Package List: - SUSE Package Hub for SUSE Linux Enterprise 12 (aarch64 ppc64le s390x x86_64): libmad-devel-0.15.1b-8.1 libmad0-0.15.1b-8.1 References: https://www.suse.com/security/cve/CVE-2017-8373.html https://bugzilla.suse.com/1036968

1 0

openSUSE-SU-2022:10168-1: important: Security update for exim
by opensuse-security＠opensuse.org 30 Oct '22

30 Oct '22

openSUSE Security Update: Security update for exim ______________________________________________________________________________ Announcement ID: openSUSE-SU-2022:10168-1 Rating: important References: #1204427 Cross-References: CVE-2022-3559 CVSS scores: CVE-2022-3559 (NVD) : 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H Affected Products: openSUSE Backports SLE-15-SP4 ______________________________________________________________________________ An update that fixes one vulnerability is now available. Description: This update for exim fixes the following issues: - CVE-2022-3559: Fixed a use after free in processing of the component Regex Handler (boo#1204427, Bug 2915) Patch Instructions: To install this openSUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Backports SLE-15-SP4: zypper in -t patch openSUSE-2022-10168=1 Package List: - openSUSE Backports SLE-15-SP4 (aarch64 ppc64le s390x x86_64): exim-4.94.2-bp154.2.3.1 eximon-4.94.2-bp154.2.3.1 eximstats-html-4.94.2-bp154.2.3.1 References: https://www.suse.com/security/cve/CVE-2022-3559.html https://bugzilla.suse.com/1204427

1 0

SUSE-SU-2022:3807-1: important: Security update for libconfuse0
by opensuse-security＠opensuse.org 28 Oct '22

28 Oct '22

SUSE Security Update: Security update for libconfuse0 ______________________________________________________________________________ Announcement ID: SUSE-SU-2022:3807-1 Rating: important References: #1203326 Cross-References: CVE-2022-40320 CVSS scores: CVE-2022-40320 (NVD) : 8.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H CVE-2022-40320 (SUSE): 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N Affected Products: SUSE Linux Enterprise High Performance Computing 15-ESPOS SUSE Linux Enterprise High Performance Computing 15-LTSS SUSE Linux Enterprise High Performance Computing 15-SP1-ESPOS SUSE Linux Enterprise High Performance Computing 15-SP1-LTSS SUSE Linux Enterprise High Performance Computing 15-SP2-ESPOS SUSE Linux Enterprise High Performance Computing 15-SP2-LTSS SUSE Linux Enterprise High Performance Computing 15-SP3 SUSE Linux Enterprise High Performance Computing 15-SP4 SUSE Linux Enterprise Module for HPC 15-SP3 SUSE Linux Enterprise Module for Packagehub Subpackages 15-SP3 SUSE Linux Enterprise Module for Packagehub Subpackages 15-SP4 SUSE Linux Enterprise Server 15-SP3 SUSE Linux Enterprise Server 15-SP4 SUSE Linux Enterprise Server for SAP Applications 15-SP3 SUSE Linux Enterprise Server for SAP Applications 15-SP4 SUSE Linux Enterprise Storage 7.1 SUSE Manager Proxy 4.2 SUSE Manager Proxy 4.3 SUSE Manager Retail Branch Server 4.2 SUSE Manager Retail Branch Server 4.3 SUSE Manager Server 4.2 SUSE Manager Server 4.3 openSUSE Leap 15.3 openSUSE Leap 15.4 ______________________________________________________________________________ An update that fixes one vulnerability is now available. Description: This update for libconfuse0 fixes the following issues: - CVE-2022-40320: Fixed a heap-based buffer over-read in cfg_tilde_expand in confuse.c (bsc#1203326). Patch Instructions: To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 15.4: zypper in -t patch openSUSE-SLE-15.4-2022-3807=1 - openSUSE Leap 15.3: zypper in -t patch openSUSE-SLE-15.3-2022-3807=1 - SUSE Linux Enterprise Module for Packagehub Subpackages 15-SP4: zypper in -t patch SUSE-SLE-Module-Packagehub-Subpackages-15-SP4-2022-3807=1 - SUSE Linux Enterprise Module for Packagehub Subpackages 15-SP3: zypper in -t patch SUSE-SLE-Module-Packagehub-Subpackages-15-SP3-2022-3807=1 - SUSE Linux Enterprise Module for HPC 15-SP3: zypper in -t patch SUSE-SLE-Module-HPC-15-SP3-2022-3807=1 - SUSE Linux Enterprise High Performance Computing 15-SP2-LTSS: zypper in -t patch SUSE-SLE-Product-HPC-15-SP2-LTSS-2022-3807=1 - SUSE Linux Enterprise High Performance Computing 15-SP2-ESPOS: zypper in -t patch SUSE-SLE-Product-HPC-15-SP2-ESPOS-2022-3807=1 - SUSE Linux Enterprise High Performance Computing 15-SP1-LTSS: zypper in -t patch SUSE-SLE-Product-HPC-15-SP1-LTSS-2022-3807=1 - SUSE Linux Enterprise High Performance Computing 15-SP1-ESPOS: zypper in -t patch SUSE-SLE-Product-HPC-15-SP1-ESPOS-2022-3807=1 - SUSE Linux Enterprise High Performance Computing 15-LTSS: zypper in -t patch SUSE-SLE-Product-HPC-15-2022-3807=1 - SUSE Linux Enterprise High Performance Computing 15-ESPOS: zypper in -t patch SUSE-SLE-Product-HPC-15-2022-3807=1 Package List: - openSUSE Leap 15.4 (aarch64 ppc64le s390x x86_64): libconfuse-devel-2.8-150000.3.3.1 libconfuse0-2.8-150000.3.3.1 libconfuse0-debuginfo-2.8-150000.3.3.1 libconfuse0-debugsource-2.8-150000.3.3.1 - openSUSE Leap 15.4 (noarch): libconfuse0-lang-2.8-150000.3.3.1 - openSUSE Leap 15.3 (aarch64 ppc64le s390x x86_64): libconfuse-devel-2.8-150000.3.3.1 libconfuse0-2.8-150000.3.3.1 libconfuse0-debuginfo-2.8-150000.3.3.1 libconfuse0-debugsource-2.8-150000.3.3.1 - openSUSE Leap 15.3 (noarch): libconfuse0-lang-2.8-150000.3.3.1 - SUSE Linux Enterprise Module for Packagehub Subpackages 15-SP4 (ppc64le s390x): libconfuse-devel-2.8-150000.3.3.1 libconfuse0-2.8-150000.3.3.1 libconfuse0-debuginfo-2.8-150000.3.3.1 libconfuse0-debugsource-2.8-150000.3.3.1 - SUSE Linux Enterprise Module for Packagehub Subpackages 15-SP4 (noarch): libconfuse0-lang-2.8-150000.3.3.1 - SUSE Linux Enterprise Module for Packagehub Subpackages 15-SP3 (ppc64le s390x): libconfuse-devel-2.8-150000.3.3.1 libconfuse0-2.8-150000.3.3.1 libconfuse0-debuginfo-2.8-150000.3.3.1 libconfuse0-debugsource-2.8-150000.3.3.1 - SUSE Linux Enterprise Module for Packagehub Subpackages 15-SP3 (noarch): libconfuse0-lang-2.8-150000.3.3.1 - SUSE Linux Enterprise Module for HPC 15-SP3 (aarch64 x86_64): libconfuse-devel-2.8-150000.3.3.1 libconfuse0-2.8-150000.3.3.1 libconfuse0-debuginfo-2.8-150000.3.3.1 libconfuse0-debugsource-2.8-150000.3.3.1 - SUSE Linux Enterprise High Performance Computing 15-SP2-LTSS (aarch64 x86_64): libconfuse-devel-2.8-150000.3.3.1 libconfuse0-2.8-150000.3.3.1 libconfuse0-debuginfo-2.8-150000.3.3.1 libconfuse0-debugsource-2.8-150000.3.3.1 - SUSE Linux Enterprise High Performance Computing 15-SP2-ESPOS (aarch64 x86_64): libconfuse-devel-2.8-150000.3.3.1 libconfuse0-2.8-150000.3.3.1 libconfuse0-debuginfo-2.8-150000.3.3.1 libconfuse0-debugsource-2.8-150000.3.3.1 - SUSE Linux Enterprise High Performance Computing 15-SP1-LTSS (aarch64 x86_64): libconfuse-devel-2.8-150000.3.3.1 libconfuse0-2.8-150000.3.3.1 libconfuse0-debuginfo-2.8-150000.3.3.1 libconfuse0-debugsource-2.8-150000.3.3.1 - SUSE Linux Enterprise High Performance Computing 15-SP1-ESPOS (aarch64 x86_64): libconfuse-devel-2.8-150000.3.3.1 libconfuse0-2.8-150000.3.3.1 libconfuse0-debuginfo-2.8-150000.3.3.1 libconfuse0-debugsource-2.8-150000.3.3.1 - SUSE Linux Enterprise High Performance Computing 15-LTSS (aarch64 x86_64): libconfuse-devel-2.8-150000.3.3.1 libconfuse0-2.8-150000.3.3.1 libconfuse0-debuginfo-2.8-150000.3.3.1 libconfuse0-debugsource-2.8-150000.3.3.1 - SUSE Linux Enterprise High Performance Computing 15-ESPOS (aarch64 x86_64): libconfuse-devel-2.8-150000.3.3.1 libconfuse0-2.8-150000.3.3.1 libconfuse0-debuginfo-2.8-150000.3.3.1 libconfuse0-debugsource-2.8-150000.3.3.1 References: https://www.suse.com/security/cve/CVE-2022-40320.html https://bugzilla.suse.com/1203326

1 0

SUSE-SU-2022:3802-1: important: Security update for openjpeg2
by opensuse-security＠opensuse.org 27 Oct '22

27 Oct '22

SUSE Security Update: Security update for openjpeg2 ______________________________________________________________________________ Announcement ID: SUSE-SU-2022:3802-1 Rating: important References: #1140205 #1149789 #1179594 #1179821 #1180042 #1180043 #1180044 #1180046 Cross-References: CVE-2018-20846 CVE-2018-21010 CVE-2020-27814 CVE-2020-27824 CVE-2020-27841 CVE-2020-27842 CVE-2020-27843 CVE-2020-27845 CVSS scores: CVE-2018-20846 (NVD) : 6.5 CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H CVE-2018-20846 (SUSE): 5.5 CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H CVE-2018-21010 (NVD) : 8.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H CVE-2018-21010 (SUSE): 7.8 CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H CVE-2020-27814 (NVD) : 7.8 CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H CVE-2020-27814 (SUSE): 6.8 CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:H CVE-2020-27824 (NVD) : 5.5 CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H CVE-2020-27824 (SUSE): 6.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:L CVE-2020-27841 (NVD) : 5.5 CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H CVE-2020-27841 (SUSE): 4.8 CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:L CVE-2020-27842 (NVD) : 5.5 CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H CVE-2020-27842 (SUSE): 4.8 CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:L CVE-2020-27843 (NVD) : 5.5 CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H CVE-2020-27843 (SUSE): 4.8 CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:L CVE-2020-27845 (NVD) : 5.5 CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H CVE-2020-27845 (SUSE): 4.8 CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:L Affected Products: SUSE CaaS Platform 4.0 SUSE Enterprise Storage 6 SUSE Enterprise Storage 7 SUSE Linux Enterprise Desktop 15-SP3 SUSE Linux Enterprise Desktop 15-SP4 SUSE Linux Enterprise High Performance Computing 15-ESPOS SUSE Linux Enterprise High Performance Computing 15-LTSS SUSE Linux Enterprise High Performance Computing 15-SP1-ESPOS SUSE Linux Enterprise High Performance Computing 15-SP1-LTSS SUSE Linux Enterprise High Performance Computing 15-SP2-ESPOS SUSE Linux Enterprise High Performance Computing 15-SP2-LTSS SUSE Linux Enterprise High Performance Computing 15-SP3 SUSE Linux Enterprise High Performance Computing 15-SP4 SUSE Linux Enterprise Module for Basesystem 15-SP3 SUSE Linux Enterprise Module for Basesystem 15-SP4 SUSE Linux Enterprise Module for Packagehub Subpackages 15-SP3 SUSE Linux Enterprise Server 15-LTSS SUSE Linux Enterprise Server 15-SP1-BCL SUSE Linux Enterprise Server 15-SP1-LTSS SUSE Linux Enterprise Server 15-SP2-BCL SUSE Linux Enterprise Server 15-SP2-LTSS SUSE Linux Enterprise Server 15-SP3 SUSE Linux Enterprise Server 15-SP4 SUSE Linux Enterprise Server for SAP 15 SUSE Linux Enterprise Server for SAP 15-SP1 SUSE Linux Enterprise Server for SAP 15-SP2 SUSE Linux Enterprise Server for SAP Applications 15-SP3 SUSE Linux Enterprise Server for SAP Applications 15-SP4 SUSE Linux Enterprise Storage 7.1 SUSE Manager Proxy 4.1 SUSE Manager Proxy 4.2 SUSE Manager Proxy 4.3 SUSE Manager Retail Branch Server 4.1 SUSE Manager Retail Branch Server 4.2 SUSE Manager Retail Branch Server 4.3 SUSE Manager Server 4.1 SUSE Manager Server 4.2 SUSE Manager Server 4.3 openSUSE Leap 15.3 openSUSE Leap 15.4 ______________________________________________________________________________ An update that fixes 8 vulnerabilities is now available. Description: This update for openjpeg2 fixes the following issues: - CVE-2018-20846: Fixed OOB read in pi_next_lrcp, pi_next_rlcp, pi_next_rpcl, pi_next_pcrl, pi_next_rpcl, and pi_next_cprl in openmj2/pi.c (bsc#1140205). - CVE-2018-21010: Fixed heap buffer overflow in color_apply_icc_profile in bin/common/color.c (bsc#1149789). - CVE-2020-27814: Fixed heap buffer overflow in lib/openjp2/mqc.c (bsc#1179594), - CVE-2020-27824: Fixed OOB read in opj_dwt_calc_explicit_stepsizes() (bsc#1179821). - CVE-2020-27841: Fixed buffer over-read in lib/openjp2/pi.c (bsc#1180042). - CVE-2020-27842: Fixed null pointer dereference in opj_tgt_reset function in lib/openjp2/tgt.c (bsc#1180043). - CVE-2020-27843: Fixed OOB read in opj_t2_encode_packet function in openjp2/t2.c (bsc#1180044). - CVE-2020-27845: Fixed heap-based buffer over-read in functions opj_pi_next_rlcp, opj_pi_next_rpcl and opj_pi_next_lrcp in openjp2/pi.c (bsc#1180046). Patch Instructions: To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 15.4: zypper in -t patch openSUSE-SLE-15.4-2022-3802=1 - openSUSE Leap 15.3: zypper in -t patch openSUSE-SLE-15.3-2022-3802=1 - SUSE Manager Server 4.1: zypper in -t patch SUSE-SLE-Product-SUSE-Manager-Server-4.1-2022-3802=1 - SUSE Manager Retail Branch Server 4.1: zypper in -t patch SUSE-SLE-Product-SUSE-Manager-Retail-Branch-Server-4.1-2022-3802=1 - SUSE Manager Proxy 4.1: zypper in -t patch SUSE-SLE-Product-SUSE-Manager-Proxy-4.1-2022-3802=1 - SUSE Linux Enterprise Server for SAP 15-SP2: zypper in -t patch SUSE-SLE-Product-SLES_SAP-15-SP2-2022-3802=1 - SUSE Linux Enterprise Server for SAP 15-SP1: zypper in -t patch SUSE-SLE-Product-SLES_SAP-15-SP1-2022-3802=1 - SUSE Linux Enterprise Server for SAP 15: zypper in -t patch SUSE-SLE-Product-SLES_SAP-15-2022-3802=1 - SUSE Linux Enterprise Server 15-SP2-LTSS: zypper in -t patch SUSE-SLE-Product-SLES-15-SP2-LTSS-2022-3802=1 - SUSE Linux Enterprise Server 15-SP2-BCL: zypper in -t patch SUSE-SLE-Product-SLES-15-SP2-BCL-2022-3802=1 - SUSE Linux Enterprise Server 15-SP1-LTSS: zypper in -t patch SUSE-SLE-Product-SLES-15-SP1-LTSS-2022-3802=1 - SUSE Linux Enterprise Server 15-SP1-BCL: zypper in -t patch SUSE-SLE-Product-SLES-15-SP1-BCL-2022-3802=1 - SUSE Linux Enterprise Server 15-LTSS: zypper in -t patch SUSE-SLE-Product-SLES-15-2022-3802=1 - SUSE Linux Enterprise Module for Packagehub Subpackages 15-SP3: zypper in -t patch SUSE-SLE-Module-Packagehub-Subpackages-15-SP3-2022-3802=1 - SUSE Linux Enterprise Module for Basesystem 15-SP4: zypper in -t patch SUSE-SLE-Module-Basesystem-15-SP4-2022-3802=1 - SUSE Linux Enterprise Module for Basesystem 15-SP3: zypper in -t patch SUSE-SLE-Module-Basesystem-15-SP3-2022-3802=1 - SUSE Linux Enterprise High Performance Computing 15-SP2-LTSS: zypper in -t patch SUSE-SLE-Product-HPC-15-SP2-LTSS-2022-3802=1 - SUSE Linux Enterprise High Performance Computing 15-SP2-ESPOS: zypper in -t patch SUSE-SLE-Product-HPC-15-SP2-ESPOS-2022-3802=1 - SUSE Linux Enterprise High Performance Computing 15-SP1-LTSS: zypper in -t patch SUSE-SLE-Product-HPC-15-SP1-LTSS-2022-3802=1 - SUSE Linux Enterprise High Performance Computing 15-SP1-ESPOS: zypper in -t patch SUSE-SLE-Product-HPC-15-SP1-ESPOS-2022-3802=1 - SUSE Linux Enterprise High Performance Computing 15-LTSS: zypper in -t patch SUSE-SLE-Product-HPC-15-2022-3802=1 - SUSE Linux Enterprise High Performance Computing 15-ESPOS: zypper in -t patch SUSE-SLE-Product-HPC-15-2022-3802=1 - SUSE Enterprise Storage 7: zypper in -t patch SUSE-Storage-7-2022-3802=1 - SUSE Enterprise Storage 6: zypper in -t patch SUSE-Storage-6-2022-3802=1 - SUSE CaaS Platform 4.0: To install this update, use the SUSE CaaS Platform 'skuba' tool. It will inform you if it detects new updates and let you then trigger updating of the complete cluster in a controlled way. Package List: - openSUSE Leap 15.4 (aarch64 ppc64le s390x x86_64): libopenjp2-7-2.3.0-150000.3.8.1 libopenjp2-7-debuginfo-2.3.0-150000.3.8.1 openjpeg2-2.3.0-150000.3.8.1 openjpeg2-debuginfo-2.3.0-150000.3.8.1 openjpeg2-debugsource-2.3.0-150000.3.8.1 openjpeg2-devel-2.3.0-150000.3.8.1 - openSUSE Leap 15.4 (x86_64): libopenjp2-7-32bit-2.3.0-150000.3.8.1 libopenjp2-7-32bit-debuginfo-2.3.0-150000.3.8.1 - openSUSE Leap 15.3 (aarch64 ppc64le s390x x86_64): libopenjp2-7-2.3.0-150000.3.8.1 libopenjp2-7-debuginfo-2.3.0-150000.3.8.1 openjpeg2-2.3.0-150000.3.8.1 openjpeg2-debuginfo-2.3.0-150000.3.8.1 openjpeg2-debugsource-2.3.0-150000.3.8.1 openjpeg2-devel-2.3.0-150000.3.8.1 - openSUSE Leap 15.3 (x86_64): libopenjp2-7-32bit-2.3.0-150000.3.8.1 libopenjp2-7-32bit-debuginfo-2.3.0-150000.3.8.1 - SUSE Manager Server 4.1 (ppc64le s390x x86_64): libopenjp2-7-2.3.0-150000.3.8.1 libopenjp2-7-debuginfo-2.3.0-150000.3.8.1 openjpeg2-2.3.0-150000.3.8.1 openjpeg2-debuginfo-2.3.0-150000.3.8.1 openjpeg2-debugsource-2.3.0-150000.3.8.1 openjpeg2-devel-2.3.0-150000.3.8.1 - SUSE Manager Retail Branch Server 4.1 (x86_64): libopenjp2-7-2.3.0-150000.3.8.1 libopenjp2-7-debuginfo-2.3.0-150000.3.8.1 openjpeg2-2.3.0-150000.3.8.1 openjpeg2-debuginfo-2.3.0-150000.3.8.1 openjpeg2-debugsource-2.3.0-150000.3.8.1 openjpeg2-devel-2.3.0-150000.3.8.1 - SUSE Manager Proxy 4.1 (x86_64): libopenjp2-7-2.3.0-150000.3.8.1 libopenjp2-7-debuginfo-2.3.0-150000.3.8.1 openjpeg2-2.3.0-150000.3.8.1 openjpeg2-debuginfo-2.3.0-150000.3.8.1 openjpeg2-debugsource-2.3.0-150000.3.8.1 openjpeg2-devel-2.3.0-150000.3.8.1 - SUSE Linux Enterprise Server for SAP 15-SP2 (ppc64le x86_64): libopenjp2-7-2.3.0-150000.3.8.1 libopenjp2-7-debuginfo-2.3.0-150000.3.8.1 openjpeg2-2.3.0-150000.3.8.1 openjpeg2-debuginfo-2.3.0-150000.3.8.1 openjpeg2-debugsource-2.3.0-150000.3.8.1 openjpeg2-devel-2.3.0-150000.3.8.1 - SUSE Linux Enterprise Server for SAP 15-SP1 (ppc64le x86_64): libopenjp2-7-2.3.0-150000.3.8.1 libopenjp2-7-debuginfo-2.3.0-150000.3.8.1 openjpeg2-2.3.0-150000.3.8.1 openjpeg2-debuginfo-2.3.0-150000.3.8.1 openjpeg2-debugsource-2.3.0-150000.3.8.1 openjpeg2-devel-2.3.0-150000.3.8.1 - SUSE Linux Enterprise Server for SAP 15-SP1 (x86_64): libopenjp2-7-32bit-2.3.0-150000.3.8.1 libopenjp2-7-32bit-debuginfo-2.3.0-150000.3.8.1 - SUSE Linux Enterprise Server for SAP 15 (ppc64le x86_64): libopenjp2-7-2.3.0-150000.3.8.1 libopenjp2-7-debuginfo-2.3.0-150000.3.8.1 openjpeg2-2.3.0-150000.3.8.1 openjpeg2-debuginfo-2.3.0-150000.3.8.1 openjpeg2-debugsource-2.3.0-150000.3.8.1 openjpeg2-devel-2.3.0-150000.3.8.1 - SUSE Linux Enterprise Server 15-SP2-LTSS (aarch64 ppc64le s390x x86_64): libopenjp2-7-2.3.0-150000.3.8.1 libopenjp2-7-debuginfo-2.3.0-150000.3.8.1 openjpeg2-2.3.0-150000.3.8.1 openjpeg2-debuginfo-2.3.0-150000.3.8.1 openjpeg2-debugsource-2.3.0-150000.3.8.1 openjpeg2-devel-2.3.0-150000.3.8.1 - SUSE Linux Enterprise Server 15-SP2-BCL (x86_64): libopenjp2-7-2.3.0-150000.3.8.1 libopenjp2-7-debuginfo-2.3.0-150000.3.8.1 openjpeg2-2.3.0-150000.3.8.1 openjpeg2-debuginfo-2.3.0-150000.3.8.1 openjpeg2-debugsource-2.3.0-150000.3.8.1 openjpeg2-devel-2.3.0-150000.3.8.1 - SUSE Linux Enterprise Server 15-SP1-LTSS (aarch64 ppc64le s390x x86_64): libopenjp2-7-2.3.0-150000.3.8.1 libopenjp2-7-debuginfo-2.3.0-150000.3.8.1 openjpeg2-2.3.0-150000.3.8.1 openjpeg2-debuginfo-2.3.0-150000.3.8.1 openjpeg2-debugsource-2.3.0-150000.3.8.1 openjpeg2-devel-2.3.0-150000.3.8.1 - SUSE Linux Enterprise Server 15-SP1-LTSS (x86_64): libopenjp2-7-32bit-2.3.0-150000.3.8.1 libopenjp2-7-32bit-debuginfo-2.3.0-150000.3.8.1 - SUSE Linux Enterprise Server 15-SP1-BCL (x86_64): libopenjp2-7-2.3.0-150000.3.8.1 libopenjp2-7-32bit-2.3.0-150000.3.8.1 libopenjp2-7-32bit-debuginfo-2.3.0-150000.3.8.1 libopenjp2-7-debuginfo-2.3.0-150000.3.8.1 openjpeg2-2.3.0-150000.3.8.1 openjpeg2-debuginfo-2.3.0-150000.3.8.1 openjpeg2-debugsource-2.3.0-150000.3.8.1 openjpeg2-devel-2.3.0-150000.3.8.1 - SUSE Linux Enterprise Server 15-LTSS (aarch64 s390x): libopenjp2-7-2.3.0-150000.3.8.1 libopenjp2-7-debuginfo-2.3.0-150000.3.8.1 openjpeg2-2.3.0-150000.3.8.1 openjpeg2-debuginfo-2.3.0-150000.3.8.1 openjpeg2-debugsource-2.3.0-150000.3.8.1 openjpeg2-devel-2.3.0-150000.3.8.1 - SUSE Linux Enterprise Module for Packagehub Subpackages 15-SP3 (x86_64): libopenjp2-7-32bit-2.3.0-150000.3.8.1 libopenjp2-7-32bit-debuginfo-2.3.0-150000.3.8.1 - SUSE Linux Enterprise Module for Basesystem 15-SP4 (aarch64 ppc64le s390x x86_64): libopenjp2-7-2.3.0-150000.3.8.1 libopenjp2-7-debuginfo-2.3.0-150000.3.8.1 openjpeg2-2.3.0-150000.3.8.1 openjpeg2-debuginfo-2.3.0-150000.3.8.1 openjpeg2-debugsource-2.3.0-150000.3.8.1 openjpeg2-devel-2.3.0-150000.3.8.1 - SUSE Linux Enterprise Module for Basesystem 15-SP3 (aarch64 ppc64le s390x x86_64): libopenjp2-7-2.3.0-150000.3.8.1 libopenjp2-7-debuginfo-2.3.0-150000.3.8.1 openjpeg2-2.3.0-150000.3.8.1 openjpeg2-debuginfo-2.3.0-150000.3.8.1 openjpeg2-debugsource-2.3.0-150000.3.8.1 openjpeg2-devel-2.3.0-150000.3.8.1 - SUSE Linux Enterprise High Performance Computing 15-SP2-LTSS (aarch64 x86_64): libopenjp2-7-2.3.0-150000.3.8.1 libopenjp2-7-debuginfo-2.3.0-150000.3.8.1 openjpeg2-2.3.0-150000.3.8.1 openjpeg2-debuginfo-2.3.0-150000.3.8.1 openjpeg2-debugsource-2.3.0-150000.3.8.1 openjpeg2-devel-2.3.0-150000.3.8.1 - SUSE Linux Enterprise High Performance Computing 15-SP2-ESPOS (aarch64 x86_64): libopenjp2-7-2.3.0-150000.3.8.1 libopenjp2-7-debuginfo-2.3.0-150000.3.8.1 openjpeg2-2.3.0-150000.3.8.1 openjpeg2-debuginfo-2.3.0-150000.3.8.1 openjpeg2-debugsource-2.3.0-150000.3.8.1 openjpeg2-devel-2.3.0-150000.3.8.1 - SUSE Linux Enterprise High Performance Computing 15-SP1-LTSS (aarch64 x86_64): libopenjp2-7-2.3.0-150000.3.8.1 libopenjp2-7-debuginfo-2.3.0-150000.3.8.1 openjpeg2-2.3.0-150000.3.8.1 openjpeg2-debuginfo-2.3.0-150000.3.8.1 openjpeg2-debugsource-2.3.0-150000.3.8.1 openjpeg2-devel-2.3.0-150000.3.8.1 - SUSE Linux Enterprise High Performance Computing 15-SP1-LTSS (x86_64): libopenjp2-7-32bit-2.3.0-150000.3.8.1 libopenjp2-7-32bit-debuginfo-2.3.0-150000.3.8.1 - SUSE Linux Enterprise High Performance Computing 15-SP1-ESPOS (aarch64 x86_64): libopenjp2-7-2.3.0-150000.3.8.1 libopenjp2-7-debuginfo-2.3.0-150000.3.8.1 openjpeg2-2.3.0-150000.3.8.1 openjpeg2-debuginfo-2.3.0-150000.3.8.1 openjpeg2-debugsource-2.3.0-150000.3.8.1 openjpeg2-devel-2.3.0-150000.3.8.1 - SUSE Linux Enterprise High Performance Computing 15-SP1-ESPOS (x86_64): libopenjp2-7-32bit-2.3.0-150000.3.8.1 libopenjp2-7-32bit-debuginfo-2.3.0-150000.3.8.1 - SUSE Linux Enterprise High Performance Computing 15-LTSS (aarch64 x86_64): libopenjp2-7-2.3.0-150000.3.8.1 libopenjp2-7-debuginfo-2.3.0-150000.3.8.1 openjpeg2-2.3.0-150000.3.8.1 openjpeg2-debuginfo-2.3.0-150000.3.8.1 openjpeg2-debugsource-2.3.0-150000.3.8.1 openjpeg2-devel-2.3.0-150000.3.8.1 - SUSE Linux Enterprise High Performance Computing 15-ESPOS (aarch64 x86_64): libopenjp2-7-2.3.0-150000.3.8.1 libopenjp2-7-debuginfo-2.3.0-150000.3.8.1 openjpeg2-2.3.0-150000.3.8.1 openjpeg2-debuginfo-2.3.0-150000.3.8.1 openjpeg2-debugsource-2.3.0-150000.3.8.1 openjpeg2-devel-2.3.0-150000.3.8.1 - SUSE Enterprise Storage 7 (aarch64 x86_64): libopenjp2-7-2.3.0-150000.3.8.1 libopenjp2-7-debuginfo-2.3.0-150000.3.8.1 openjpeg2-2.3.0-150000.3.8.1 openjpeg2-debuginfo-2.3.0-150000.3.8.1 openjpeg2-debugsource-2.3.0-150000.3.8.1 openjpeg2-devel-2.3.0-150000.3.8.1 - SUSE Enterprise Storage 6 (aarch64 x86_64): libopenjp2-7-2.3.0-150000.3.8.1 libopenjp2-7-debuginfo-2.3.0-150000.3.8.1 openjpeg2-2.3.0-150000.3.8.1 openjpeg2-debuginfo-2.3.0-150000.3.8.1 openjpeg2-debugsource-2.3.0-150000.3.8.1 openjpeg2-devel-2.3.0-150000.3.8.1 - SUSE Enterprise Storage 6 (x86_64): libopenjp2-7-32bit-2.3.0-150000.3.8.1 libopenjp2-7-32bit-debuginfo-2.3.0-150000.3.8.1 - SUSE CaaS Platform 4.0 (x86_64): libopenjp2-7-2.3.0-150000.3.8.1 libopenjp2-7-32bit-2.3.0-150000.3.8.1 libopenjp2-7-32bit-debuginfo-2.3.0-150000.3.8.1 libopenjp2-7-debuginfo-2.3.0-150000.3.8.1 openjpeg2-2.3.0-150000.3.8.1 openjpeg2-debuginfo-2.3.0-150000.3.8.1 openjpeg2-debugsource-2.3.0-150000.3.8.1 openjpeg2-devel-2.3.0-150000.3.8.1 References: https://www.suse.com/security/cve/CVE-2018-20846.html https://www.suse.com/security/cve/CVE-2018-21010.html https://www.suse.com/security/cve/CVE-2020-27814.html https://www.suse.com/security/cve/CVE-2020-27824.html https://www.suse.com/security/cve/CVE-2020-27841.html https://www.suse.com/security/cve/CVE-2020-27842.html https://www.suse.com/security/cve/CVE-2020-27843.html https://www.suse.com/security/cve/CVE-2020-27845.html https://bugzilla.suse.com/1140205 https://bugzilla.suse.com/1149789 https://bugzilla.suse.com/1179594 https://bugzilla.suse.com/1179821 https://bugzilla.suse.com/1180042 https://bugzilla.suse.com/1180043 https://bugzilla.suse.com/1180044 https://bugzilla.suse.com/1180046

1 0

SUSE-SU-2022:3806-1: important: Security update for dbus-1
by opensuse-security＠opensuse.org 27 Oct '22

27 Oct '22

SUSE Security Update: Security update for dbus-1 ______________________________________________________________________________ Announcement ID: SUSE-SU-2022:3806-1 Rating: important References: #1087072 #1204111 #1204112 #1204113 Cross-References: CVE-2022-42010 CVE-2022-42011 CVE-2022-42012 CVSS scores: CVE-2022-42010 (NVD) : 6.5 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H CVE-2022-42010 (SUSE): 3.3 CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L CVE-2022-42011 (NVD) : 6.5 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H CVE-2022-42011 (SUSE): 4.4 CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:L CVE-2022-42012 (NVD) : 6.5 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H CVE-2022-42012 (SUSE): 4.4 CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:L Affected Products: SUSE Linux Enterprise Desktop 15-SP4 SUSE Linux Enterprise High Performance Computing 15-SP4 SUSE Linux Enterprise Micro 5.3 SUSE Linux Enterprise Module for Basesystem 15-SP4 SUSE Linux Enterprise Server 15-SP4 SUSE Linux Enterprise Server for SAP Applications 15-SP4 SUSE Manager Proxy 4.3 SUSE Manager Retail Branch Server 4.3 SUSE Manager Server 4.3 openSUSE Leap 15.4 ______________________________________________________________________________ An update that solves three vulnerabilities and has one errata is now available. Description: This update for dbus-1 fixes the following issues: - CVE-2022-42010: Fixed potential crash that could be triggered by an invalid signature (bsc#1204111). - CVE-2022-42011: Fixed an out of bounds read caused by a fixed length array (bsc#1204112). - CVE-2022-42012: Fixed a use-after-free that could be trigged by a message in non-native endianness with out-of-band Unix file descriptor (bsc#1204113). Bugfixes: - Disable asserts (bsc#1087072). Special Instructions and Notes: Please reboot the system after installing this update. Patch Instructions: To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 15.4: zypper in -t patch openSUSE-SLE-15.4-2022-3806=1 - SUSE Linux Enterprise Module for Basesystem 15-SP4: zypper in -t patch SUSE-SLE-Module-Basesystem-15-SP4-2022-3806=1 - SUSE Linux Enterprise Micro 5.3: zypper in -t patch SUSE-SLE-Micro-5.3-2022-3806=1 Package List: - openSUSE Leap 15.4 (aarch64 ppc64le s390x x86_64): dbus-1-1.12.2-150400.18.5.1 dbus-1-debuginfo-1.12.2-150400.18.5.1 dbus-1-debugsource-1.12.2-150400.18.5.1 dbus-1-devel-1.12.2-150400.18.5.1 dbus-1-x11-1.12.2-150400.18.5.1 dbus-1-x11-debuginfo-1.12.2-150400.18.5.1 dbus-1-x11-debugsource-1.12.2-150400.18.5.1 libdbus-1-3-1.12.2-150400.18.5.1 libdbus-1-3-debuginfo-1.12.2-150400.18.5.1 - openSUSE Leap 15.4 (noarch): dbus-1-devel-doc-1.12.2-150400.18.5.1 - openSUSE Leap 15.4 (x86_64): dbus-1-32bit-debuginfo-1.12.2-150400.18.5.1 dbus-1-devel-32bit-1.12.2-150400.18.5.1 libdbus-1-3-32bit-1.12.2-150400.18.5.1 libdbus-1-3-32bit-debuginfo-1.12.2-150400.18.5.1 - SUSE Linux Enterprise Module for Basesystem 15-SP4 (aarch64 ppc64le s390x x86_64): dbus-1-1.12.2-150400.18.5.1 dbus-1-debuginfo-1.12.2-150400.18.5.1 dbus-1-debugsource-1.12.2-150400.18.5.1 dbus-1-devel-1.12.2-150400.18.5.1 dbus-1-x11-1.12.2-150400.18.5.1 dbus-1-x11-debuginfo-1.12.2-150400.18.5.1 dbus-1-x11-debugsource-1.12.2-150400.18.5.1 libdbus-1-3-1.12.2-150400.18.5.1 libdbus-1-3-debuginfo-1.12.2-150400.18.5.1 - SUSE Linux Enterprise Module for Basesystem 15-SP4 (x86_64): dbus-1-32bit-debuginfo-1.12.2-150400.18.5.1 libdbus-1-3-32bit-1.12.2-150400.18.5.1 libdbus-1-3-32bit-debuginfo-1.12.2-150400.18.5.1 - SUSE Linux Enterprise Micro 5.3 (aarch64 s390x x86_64): dbus-1-1.12.2-150400.18.5.1 dbus-1-debuginfo-1.12.2-150400.18.5.1 dbus-1-debugsource-1.12.2-150400.18.5.1 dbus-1-x11-1.12.2-150400.18.5.1 dbus-1-x11-debuginfo-1.12.2-150400.18.5.1 dbus-1-x11-debugsource-1.12.2-150400.18.5.1 libdbus-1-3-1.12.2-150400.18.5.1 libdbus-1-3-debuginfo-1.12.2-150400.18.5.1 References: https://www.suse.com/security/cve/CVE-2022-42010.html https://www.suse.com/security/cve/CVE-2022-42011.html https://www.suse.com/security/cve/CVE-2022-42012.html https://bugzilla.suse.com/1087072 https://bugzilla.suse.com/1204111 https://bugzilla.suse.com/1204112 https://bugzilla.suse.com/1204113

1 0

SUSE-SU-2022:3805-1: important: Security update for dbus-1
by opensuse-security＠opensuse.org 27 Oct '22

27 Oct '22

SUSE Security Update: Security update for dbus-1 ______________________________________________________________________________ Announcement ID: SUSE-SU-2022:3805-1 Rating: important References: #1087072 #1204111 #1204112 #1204113 Cross-References: CVE-2022-42010 CVE-2022-42011 CVE-2022-42012 CVSS scores: CVE-2022-42010 (NVD) : 6.5 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H CVE-2022-42010 (SUSE): 3.3 CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L CVE-2022-42011 (NVD) : 6.5 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H CVE-2022-42011 (SUSE): 4.4 CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:L CVE-2022-42012 (NVD) : 6.5 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H CVE-2022-42012 (SUSE): 4.4 CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:L Affected Products: SUSE CaaS Platform 4.0 SUSE Enterprise Storage 6 SUSE Enterprise Storage 7 SUSE Linux Enterprise Desktop 15-SP3 SUSE Linux Enterprise High Performance Computing 15-SP1-ESPOS SUSE Linux Enterprise High Performance Computing 15-SP1-LTSS SUSE Linux Enterprise High Performance Computing 15-SP2-ESPOS SUSE Linux Enterprise High Performance Computing 15-SP2-LTSS SUSE Linux Enterprise High Performance Computing 15-SP3 SUSE Linux Enterprise Micro 5.1 SUSE Linux Enterprise Micro 5.2 SUSE Linux Enterprise Module for Basesystem 15-SP3 SUSE Linux Enterprise Server 15-SP1-BCL SUSE Linux Enterprise Server 15-SP1-LTSS SUSE Linux Enterprise Server 15-SP2-BCL SUSE Linux Enterprise Server 15-SP2-LTSS SUSE Linux Enterprise Server 15-SP3 SUSE Linux Enterprise Server for SAP 15-SP1 SUSE Linux Enterprise Server for SAP 15-SP2 SUSE Linux Enterprise Server for SAP Applications 15-SP3 SUSE Linux Enterprise Storage 7.1 SUSE Manager Proxy 4.1 SUSE Manager Proxy 4.2 SUSE Manager Retail Branch Server 4.1 SUSE Manager Retail Branch Server 4.2 SUSE Manager Server 4.1 SUSE Manager Server 4.2 openSUSE Leap 15.3 openSUSE Leap Micro 5.2 ______________________________________________________________________________ An update that solves three vulnerabilities and has one errata is now available. Description: This update for dbus-1 fixes the following issues: - CVE-2022-42010: Fixed potential crash that could be triggered by an invalid signature (bsc#1204111). - CVE-2022-42011: Fixed an out of bounds read caused by a fixed length array (bsc#1204112). - CVE-2022-42012: Fixed a use-after-free that could be trigged by a message in non-native endianness with out-of-band Unix file descriptor (bsc#1204113). Bugfixes: - Disable asserts (bsc#1087072). Special Instructions and Notes: Please reboot the system after installing this update. Patch Instructions: To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap Micro 5.2: zypper in -t patch openSUSE-Leap-Micro-5.2-2022-3805=1 - openSUSE Leap 15.3: zypper in -t patch openSUSE-SLE-15.3-2022-3805=1 - SUSE Manager Server 4.1: zypper in -t patch SUSE-SLE-Product-SUSE-Manager-Server-4.1-2022-3805=1 - SUSE Manager Retail Branch Server 4.1: zypper in -t patch SUSE-SLE-Product-SUSE-Manager-Retail-Branch-Server-4.1-2022-3805=1 - SUSE Manager Proxy 4.1: zypper in -t patch SUSE-SLE-Product-SUSE-Manager-Proxy-4.1-2022-3805=1 - SUSE Linux Enterprise Server for SAP 15-SP2: zypper in -t patch SUSE-SLE-Product-SLES_SAP-15-SP2-2022-3805=1 - SUSE Linux Enterprise Server for SAP 15-SP1: zypper in -t patch SUSE-SLE-Product-SLES_SAP-15-SP1-2022-3805=1 - SUSE Linux Enterprise Server 15-SP2-LTSS: zypper in -t patch SUSE-SLE-Product-SLES-15-SP2-LTSS-2022-3805=1 - SUSE Linux Enterprise Server 15-SP2-BCL: zypper in -t patch SUSE-SLE-Product-SLES-15-SP2-BCL-2022-3805=1 - SUSE Linux Enterprise Server 15-SP1-LTSS: zypper in -t patch SUSE-SLE-Product-SLES-15-SP1-LTSS-2022-3805=1 - SUSE Linux Enterprise Server 15-SP1-BCL: zypper in -t patch SUSE-SLE-Product-SLES-15-SP1-BCL-2022-3805=1 - SUSE Linux Enterprise Module for Basesystem 15-SP3: zypper in -t patch SUSE-SLE-Module-Basesystem-15-SP3-2022-3805=1 - SUSE Linux Enterprise Micro 5.2: zypper in -t patch SUSE-SUSE-MicroOS-5.2-2022-3805=1 - SUSE Linux Enterprise Micro 5.1: zypper in -t patch SUSE-SUSE-MicroOS-5.1-2022-3805=1 - SUSE Linux Enterprise High Performance Computing 15-SP2-LTSS: zypper in -t patch SUSE-SLE-Product-HPC-15-SP2-LTSS-2022-3805=1 - SUSE Linux Enterprise High Performance Computing 15-SP2-ESPOS: zypper in -t patch SUSE-SLE-Product-HPC-15-SP2-ESPOS-2022-3805=1 - SUSE Linux Enterprise High Performance Computing 15-SP1-LTSS: zypper in -t patch SUSE-SLE-Product-HPC-15-SP1-LTSS-2022-3805=1 - SUSE Linux Enterprise High Performance Computing 15-SP1-ESPOS: zypper in -t patch SUSE-SLE-Product-HPC-15-SP1-ESPOS-2022-3805=1 - SUSE Enterprise Storage 7: zypper in -t patch SUSE-Storage-7-2022-3805=1 - SUSE Enterprise Storage 6: zypper in -t patch SUSE-Storage-6-2022-3805=1 - SUSE CaaS Platform 4.0: To install this update, use the SUSE CaaS Platform 'skuba' tool. It will inform you if it detects new updates and let you then trigger updating of the complete cluster in a controlled way. Package List: - openSUSE Leap Micro 5.2 (aarch64 x86_64): dbus-1-1.12.2-150100.8.14.1 dbus-1-debuginfo-1.12.2-150100.8.14.1 dbus-1-debugsource-1.12.2-150100.8.14.1 dbus-1-x11-1.12.2-150100.8.14.1 dbus-1-x11-debuginfo-1.12.2-150100.8.14.1 dbus-1-x11-debugsource-1.12.2-150100.8.14.1 libdbus-1-3-1.12.2-150100.8.14.1 libdbus-1-3-debuginfo-1.12.2-150100.8.14.1 - openSUSE Leap 15.3 (aarch64 ppc64le s390x x86_64): dbus-1-1.12.2-150100.8.14.1 dbus-1-debuginfo-1.12.2-150100.8.14.1 dbus-1-debugsource-1.12.2-150100.8.14.1 dbus-1-devel-1.12.2-150100.8.14.1 dbus-1-x11-1.12.2-150100.8.14.1 dbus-1-x11-debuginfo-1.12.2-150100.8.14.1 dbus-1-x11-debugsource-1.12.2-150100.8.14.1 libdbus-1-3-1.12.2-150100.8.14.1 libdbus-1-3-debuginfo-1.12.2-150100.8.14.1 - openSUSE Leap 15.3 (x86_64): dbus-1-32bit-debuginfo-1.12.2-150100.8.14.1 dbus-1-devel-32bit-1.12.2-150100.8.14.1 libdbus-1-3-32bit-1.12.2-150100.8.14.1 libdbus-1-3-32bit-debuginfo-1.12.2-150100.8.14.1 - openSUSE Leap 15.3 (noarch): dbus-1-devel-doc-1.12.2-150100.8.14.1 - SUSE Manager Server 4.1 (ppc64le s390x x86_64): dbus-1-1.12.2-150100.8.14.1 dbus-1-debuginfo-1.12.2-150100.8.14.1 dbus-1-debugsource-1.12.2-150100.8.14.1 dbus-1-devel-1.12.2-150100.8.14.1 dbus-1-x11-1.12.2-150100.8.14.1 dbus-1-x11-debuginfo-1.12.2-150100.8.14.1 dbus-1-x11-debugsource-1.12.2-150100.8.14.1 libdbus-1-3-1.12.2-150100.8.14.1 libdbus-1-3-debuginfo-1.12.2-150100.8.14.1 - SUSE Manager Server 4.1 (x86_64): dbus-1-32bit-debuginfo-1.12.2-150100.8.14.1 libdbus-1-3-32bit-1.12.2-150100.8.14.1 libdbus-1-3-32bit-debuginfo-1.12.2-150100.8.14.1 - SUSE Manager Retail Branch Server 4.1 (x86_64): dbus-1-1.12.2-150100.8.14.1 dbus-1-32bit-debuginfo-1.12.2-150100.8.14.1 dbus-1-debuginfo-1.12.2-150100.8.14.1 dbus-1-debugsource-1.12.2-150100.8.14.1 dbus-1-devel-1.12.2-150100.8.14.1 dbus-1-x11-1.12.2-150100.8.14.1 dbus-1-x11-debuginfo-1.12.2-150100.8.14.1 dbus-1-x11-debugsource-1.12.2-150100.8.14.1 libdbus-1-3-1.12.2-150100.8.14.1 libdbus-1-3-32bit-1.12.2-150100.8.14.1 libdbus-1-3-32bit-debuginfo-1.12.2-150100.8.14.1 libdbus-1-3-debuginfo-1.12.2-150100.8.14.1 - SUSE Manager Proxy 4.1 (x86_64): dbus-1-1.12.2-150100.8.14.1 dbus-1-32bit-debuginfo-1.12.2-150100.8.14.1 dbus-1-debuginfo-1.12.2-150100.8.14.1 dbus-1-debugsource-1.12.2-150100.8.14.1 dbus-1-devel-1.12.2-150100.8.14.1 dbus-1-x11-1.12.2-150100.8.14.1 dbus-1-x11-debuginfo-1.12.2-150100.8.14.1 dbus-1-x11-debugsource-1.12.2-150100.8.14.1 libdbus-1-3-1.12.2-150100.8.14.1 libdbus-1-3-32bit-1.12.2-150100.8.14.1 libdbus-1-3-32bit-debuginfo-1.12.2-150100.8.14.1 libdbus-1-3-debuginfo-1.12.2-150100.8.14.1 - SUSE Linux Enterprise Server for SAP 15-SP2 (ppc64le x86_64): dbus-1-1.12.2-150100.8.14.1 dbus-1-debuginfo-1.12.2-150100.8.14.1 dbus-1-debugsource-1.12.2-150100.8.14.1 dbus-1-devel-1.12.2-150100.8.14.1 dbus-1-x11-1.12.2-150100.8.14.1 dbus-1-x11-debuginfo-1.12.2-150100.8.14.1 dbus-1-x11-debugsource-1.12.2-150100.8.14.1 libdbus-1-3-1.12.2-150100.8.14.1 libdbus-1-3-debuginfo-1.12.2-150100.8.14.1 - SUSE Linux Enterprise Server for SAP 15-SP2 (x86_64): dbus-1-32bit-debuginfo-1.12.2-150100.8.14.1 libdbus-1-3-32bit-1.12.2-150100.8.14.1 libdbus-1-3-32bit-debuginfo-1.12.2-150100.8.14.1 - SUSE Linux Enterprise Server for SAP 15-SP1 (ppc64le x86_64): dbus-1-1.12.2-150100.8.14.1 dbus-1-debuginfo-1.12.2-150100.8.14.1 dbus-1-debugsource-1.12.2-150100.8.14.1 dbus-1-devel-1.12.2-150100.8.14.1 dbus-1-x11-1.12.2-150100.8.14.1 dbus-1-x11-debuginfo-1.12.2-150100.8.14.1 dbus-1-x11-debugsource-1.12.2-150100.8.14.1 libdbus-1-3-1.12.2-150100.8.14.1 libdbus-1-3-debuginfo-1.12.2-150100.8.14.1 - SUSE Linux Enterprise Server for SAP 15-SP1 (x86_64): dbus-1-32bit-debuginfo-1.12.2-150100.8.14.1 libdbus-1-3-32bit-1.12.2-150100.8.14.1 libdbus-1-3-32bit-debuginfo-1.12.2-150100.8.14.1 - SUSE Linux Enterprise Server 15-SP2-LTSS (aarch64 ppc64le s390x x86_64): dbus-1-1.12.2-150100.8.14.1 dbus-1-debuginfo-1.12.2-150100.8.14.1 dbus-1-debugsource-1.12.2-150100.8.14.1 dbus-1-devel-1.12.2-150100.8.14.1 dbus-1-x11-1.12.2-150100.8.14.1 dbus-1-x11-debuginfo-1.12.2-150100.8.14.1 dbus-1-x11-debugsource-1.12.2-150100.8.14.1 libdbus-1-3-1.12.2-150100.8.14.1 libdbus-1-3-debuginfo-1.12.2-150100.8.14.1 - SUSE Linux Enterprise Server 15-SP2-LTSS (x86_64): dbus-1-32bit-debuginfo-1.12.2-150100.8.14.1 libdbus-1-3-32bit-1.12.2-150100.8.14.1 libdbus-1-3-32bit-debuginfo-1.12.2-150100.8.14.1 - SUSE Linux Enterprise Server 15-SP2-BCL (x86_64): dbus-1-1.12.2-150100.8.14.1 dbus-1-32bit-debuginfo-1.12.2-150100.8.14.1 dbus-1-debuginfo-1.12.2-150100.8.14.1 dbus-1-debugsource-1.12.2-150100.8.14.1 dbus-1-devel-1.12.2-150100.8.14.1 dbus-1-x11-1.12.2-150100.8.14.1 dbus-1-x11-debuginfo-1.12.2-150100.8.14.1 dbus-1-x11-debugsource-1.12.2-150100.8.14.1 libdbus-1-3-1.12.2-150100.8.14.1 libdbus-1-3-32bit-1.12.2-150100.8.14.1 libdbus-1-3-32bit-debuginfo-1.12.2-150100.8.14.1 libdbus-1-3-debuginfo-1.12.2-150100.8.14.1 - SUSE Linux Enterprise Server 15-SP1-LTSS (aarch64 ppc64le s390x x86_64): dbus-1-1.12.2-150100.8.14.1 dbus-1-debuginfo-1.12.2-150100.8.14.1 dbus-1-debugsource-1.12.2-150100.8.14.1 dbus-1-devel-1.12.2-150100.8.14.1 dbus-1-x11-1.12.2-150100.8.14.1 dbus-1-x11-debuginfo-1.12.2-150100.8.14.1 dbus-1-x11-debugsource-1.12.2-150100.8.14.1 libdbus-1-3-1.12.2-150100.8.14.1 libdbus-1-3-debuginfo-1.12.2-150100.8.14.1 - SUSE Linux Enterprise Server 15-SP1-LTSS (x86_64): dbus-1-32bit-debuginfo-1.12.2-150100.8.14.1 libdbus-1-3-32bit-1.12.2-150100.8.14.1 libdbus-1-3-32bit-debuginfo-1.12.2-150100.8.14.1 - SUSE Linux Enterprise Server 15-SP1-BCL (x86_64): dbus-1-1.12.2-150100.8.14.1 dbus-1-32bit-debuginfo-1.12.2-150100.8.14.1 dbus-1-debuginfo-1.12.2-150100.8.14.1 dbus-1-debugsource-1.12.2-150100.8.14.1 dbus-1-devel-1.12.2-150100.8.14.1 dbus-1-x11-1.12.2-150100.8.14.1 dbus-1-x11-debuginfo-1.12.2-150100.8.14.1 dbus-1-x11-debugsource-1.12.2-150100.8.14.1 libdbus-1-3-1.12.2-150100.8.14.1 libdbus-1-3-32bit-1.12.2-150100.8.14.1 libdbus-1-3-32bit-debuginfo-1.12.2-150100.8.14.1 libdbus-1-3-debuginfo-1.12.2-150100.8.14.1 - SUSE Linux Enterprise Module for Basesystem 15-SP3 (aarch64 ppc64le s390x x86_64): dbus-1-1.12.2-150100.8.14.1 dbus-1-debuginfo-1.12.2-150100.8.14.1 dbus-1-debugsource-1.12.2-150100.8.14.1 dbus-1-devel-1.12.2-150100.8.14.1 dbus-1-x11-1.12.2-150100.8.14.1 dbus-1-x11-debuginfo-1.12.2-150100.8.14.1 dbus-1-x11-debugsource-1.12.2-150100.8.14.1 libdbus-1-3-1.12.2-150100.8.14.1 libdbus-1-3-debuginfo-1.12.2-150100.8.14.1 - SUSE Linux Enterprise Module for Basesystem 15-SP3 (x86_64): dbus-1-32bit-debuginfo-1.12.2-150100.8.14.1 libdbus-1-3-32bit-1.12.2-150100.8.14.1 libdbus-1-3-32bit-debuginfo-1.12.2-150100.8.14.1 - SUSE Linux Enterprise Micro 5.2 (aarch64 s390x x86_64): dbus-1-1.12.2-150100.8.14.1 dbus-1-debuginfo-1.12.2-150100.8.14.1 dbus-1-debugsource-1.12.2-150100.8.14.1 dbus-1-x11-1.12.2-150100.8.14.1 dbus-1-x11-debuginfo-1.12.2-150100.8.14.1 dbus-1-x11-debugsource-1.12.2-150100.8.14.1 libdbus-1-3-1.12.2-150100.8.14.1 libdbus-1-3-debuginfo-1.12.2-150100.8.14.1 - SUSE Linux Enterprise Micro 5.1 (aarch64 s390x x86_64): dbus-1-1.12.2-150100.8.14.1 dbus-1-debuginfo-1.12.2-150100.8.14.1 dbus-1-debugsource-1.12.2-150100.8.14.1 libdbus-1-3-1.12.2-150100.8.14.1 libdbus-1-3-debuginfo-1.12.2-150100.8.14.1 - SUSE Linux Enterprise High Performance Computing 15-SP2-LTSS (aarch64 x86_64): dbus-1-1.12.2-150100.8.14.1 dbus-1-debuginfo-1.12.2-150100.8.14.1 dbus-1-debugsource-1.12.2-150100.8.14.1 dbus-1-devel-1.12.2-150100.8.14.1 dbus-1-x11-1.12.2-150100.8.14.1 dbus-1-x11-debuginfo-1.12.2-150100.8.14.1 dbus-1-x11-debugsource-1.12.2-150100.8.14.1 libdbus-1-3-1.12.2-150100.8.14.1 libdbus-1-3-debuginfo-1.12.2-150100.8.14.1 - SUSE Linux Enterprise High Performance Computing 15-SP2-LTSS (x86_64): dbus-1-32bit-debuginfo-1.12.2-150100.8.14.1 libdbus-1-3-32bit-1.12.2-150100.8.14.1 libdbus-1-3-32bit-debuginfo-1.12.2-150100.8.14.1 - SUSE Linux Enterprise High Performance Computing 15-SP2-ESPOS (aarch64 x86_64): dbus-1-1.12.2-150100.8.14.1 dbus-1-debuginfo-1.12.2-150100.8.14.1 dbus-1-debugsource-1.12.2-150100.8.14.1 dbus-1-devel-1.12.2-150100.8.14.1 dbus-1-x11-1.12.2-150100.8.14.1 dbus-1-x11-debuginfo-1.12.2-150100.8.14.1 dbus-1-x11-debugsource-1.12.2-150100.8.14.1 libdbus-1-3-1.12.2-150100.8.14.1 libdbus-1-3-debuginfo-1.12.2-150100.8.14.1 - SUSE Linux Enterprise High Performance Computing 15-SP2-ESPOS (x86_64): dbus-1-32bit-debuginfo-1.12.2-150100.8.14.1 libdbus-1-3-32bit-1.12.2-150100.8.14.1 libdbus-1-3-32bit-debuginfo-1.12.2-150100.8.14.1 - SUSE Linux Enterprise High Performance Computing 15-SP1-LTSS (aarch64 x86_64): dbus-1-1.12.2-150100.8.14.1 dbus-1-debuginfo-1.12.2-150100.8.14.1 dbus-1-debugsource-1.12.2-150100.8.14.1 dbus-1-devel-1.12.2-150100.8.14.1 dbus-1-x11-1.12.2-150100.8.14.1 dbus-1-x11-debuginfo-1.12.2-150100.8.14.1 dbus-1-x11-debugsource-1.12.2-150100.8.14.1 libdbus-1-3-1.12.2-150100.8.14.1 libdbus-1-3-debuginfo-1.12.2-150100.8.14.1 - SUSE Linux Enterprise High Performance Computing 15-SP1-LTSS (x86_64): dbus-1-32bit-debuginfo-1.12.2-150100.8.14.1 libdbus-1-3-32bit-1.12.2-150100.8.14.1 libdbus-1-3-32bit-debuginfo-1.12.2-150100.8.14.1 - SUSE Linux Enterprise High Performance Computing 15-SP1-ESPOS (aarch64 x86_64): dbus-1-1.12.2-150100.8.14.1 dbus-1-debuginfo-1.12.2-150100.8.14.1 dbus-1-debugsource-1.12.2-150100.8.14.1 dbus-1-devel-1.12.2-150100.8.14.1 dbus-1-x11-1.12.2-150100.8.14.1 dbus-1-x11-debuginfo-1.12.2-150100.8.14.1 dbus-1-x11-debugsource-1.12.2-150100.8.14.1 libdbus-1-3-1.12.2-150100.8.14.1 libdbus-1-3-debuginfo-1.12.2-150100.8.14.1 - SUSE Linux Enterprise High Performance Computing 15-SP1-ESPOS (x86_64): dbus-1-32bit-debuginfo-1.12.2-150100.8.14.1 libdbus-1-3-32bit-1.12.2-150100.8.14.1 libdbus-1-3-32bit-debuginfo-1.12.2-150100.8.14.1 - SUSE Enterprise Storage 7 (aarch64 x86_64): dbus-1-1.12.2-150100.8.14.1 dbus-1-debuginfo-1.12.2-150100.8.14.1 dbus-1-debugsource-1.12.2-150100.8.14.1 dbus-1-devel-1.12.2-150100.8.14.1 dbus-1-x11-1.12.2-150100.8.14.1 dbus-1-x11-debuginfo-1.12.2-150100.8.14.1 dbus-1-x11-debugsource-1.12.2-150100.8.14.1 libdbus-1-3-1.12.2-150100.8.14.1 libdbus-1-3-debuginfo-1.12.2-150100.8.14.1 - SUSE Enterprise Storage 7 (x86_64): dbus-1-32bit-debuginfo-1.12.2-150100.8.14.1 libdbus-1-3-32bit-1.12.2-150100.8.14.1 libdbus-1-3-32bit-debuginfo-1.12.2-150100.8.14.1 - SUSE Enterprise Storage 6 (aarch64 x86_64): dbus-1-1.12.2-150100.8.14.1 dbus-1-debuginfo-1.12.2-150100.8.14.1 dbus-1-debugsource-1.12.2-150100.8.14.1 dbus-1-devel-1.12.2-150100.8.14.1 dbus-1-x11-1.12.2-150100.8.14.1 dbus-1-x11-debuginfo-1.12.2-150100.8.14.1 dbus-1-x11-debugsource-1.12.2-150100.8.14.1 libdbus-1-3-1.12.2-150100.8.14.1 libdbus-1-3-debuginfo-1.12.2-150100.8.14.1 - SUSE Enterprise Storage 6 (x86_64): dbus-1-32bit-debuginfo-1.12.2-150100.8.14.1 libdbus-1-3-32bit-1.12.2-150100.8.14.1 libdbus-1-3-32bit-debuginfo-1.12.2-150100.8.14.1 - SUSE CaaS Platform 4.0 (x86_64): dbus-1-1.12.2-150100.8.14.1 dbus-1-32bit-debuginfo-1.12.2-150100.8.14.1 dbus-1-debuginfo-1.12.2-150100.8.14.1 dbus-1-debugsource-1.12.2-150100.8.14.1 dbus-1-devel-1.12.2-150100.8.14.1 dbus-1-x11-1.12.2-150100.8.14.1 dbus-1-x11-debuginfo-1.12.2-150100.8.14.1 dbus-1-x11-debugsource-1.12.2-150100.8.14.1 libdbus-1-3-1.12.2-150100.8.14.1 libdbus-1-3-32bit-1.12.2-150100.8.14.1 libdbus-1-3-32bit-debuginfo-1.12.2-150100.8.14.1 libdbus-1-3-debuginfo-1.12.2-150100.8.14.1 References: https://www.suse.com/security/cve/CVE-2022-42010.html https://www.suse.com/security/cve/CVE-2022-42011.html https://www.suse.com/security/cve/CVE-2022-42012.html https://bugzilla.suse.com/1087072 https://bugzilla.suse.com/1204111 https://bugzilla.suse.com/1204112 https://bugzilla.suse.com/1204113

1 0

SUSE-SU-2022:3795-1: moderate: Security update for qemu
by opensuse-security＠opensuse.org 27 Oct '22

27 Oct '22

SUSE Security Update: Security update for qemu ______________________________________________________________________________ Announcement ID: SUSE-SU-2022:3795-1 Rating: moderate References: #1192115 #1198038 #1201367 Cross-References: CVE-2022-0216 CVE-2022-35414 CVSS scores: CVE-2022-0216 (NVD) : 4.4 CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H CVE-2022-0216 (SUSE): 5.3 CVSS:3.1/AV:L/AC:H/PR:H/UI:N/S:C/C:N/I:N/A:H CVE-2022-35414 (NVD) : 8.8 CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H CVE-2022-35414 (SUSE): 6 CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:C/C:N/I:N/A:H Affected Products: SUSE Linux Enterprise Desktop 15-SP4 SUSE Linux Enterprise High Performance Computing 15-SP4 SUSE Linux Enterprise Micro 5.3 SUSE Linux Enterprise Module for Basesystem 15-SP4 SUSE Linux Enterprise Module for Server Applications 15-SP4 SUSE Linux Enterprise Server 15-SP4 SUSE Linux Enterprise Server for SAP Applications 15-SP4 SUSE Manager Proxy 4.3 SUSE Manager Retail Branch Server 4.3 SUSE Manager Server 4.3 openSUSE Leap 15.4 ______________________________________________________________________________ An update that solves two vulnerabilities and has one errata is now available. Description: This update for qemu fixes the following issues: - CVE-2022-0216: Fixed a use after free issue found in hw/scsi/lsi53c895a.c. (bsc#1198038) - CVE-2022-35414: Fixed an uninitialized read during address translation that leads to a crash. (bsc#1201367) Patch Instructions: To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 15.4: zypper in -t patch openSUSE-SLE-15.4-2022-3795=1 - SUSE Linux Enterprise Module for Server Applications 15-SP4: zypper in -t patch SUSE-SLE-Module-Server-Applications-15-SP4-2022-3795=1 - SUSE Linux Enterprise Module for Basesystem 15-SP4: zypper in -t patch SUSE-SLE-Module-Basesystem-15-SP4-2022-3795=1 - SUSE Linux Enterprise Micro 5.3: zypper in -t patch SUSE-SLE-Micro-5.3-2022-3795=1 Package List: - openSUSE Leap 15.4 (aarch64 ppc64le s390x x86_64): qemu-6.2.0-150400.37.8.2 qemu-accel-qtest-6.2.0-150400.37.8.2 qemu-accel-qtest-debuginfo-6.2.0-150400.37.8.2 qemu-accel-tcg-x86-6.2.0-150400.37.8.2 qemu-accel-tcg-x86-debuginfo-6.2.0-150400.37.8.2 qemu-arm-6.2.0-150400.37.8.2 qemu-arm-debuginfo-6.2.0-150400.37.8.2 qemu-audio-alsa-6.2.0-150400.37.8.2 qemu-audio-alsa-debuginfo-6.2.0-150400.37.8.2 qemu-audio-jack-6.2.0-150400.37.8.2 qemu-audio-jack-debuginfo-6.2.0-150400.37.8.2 qemu-audio-oss-debuginfo-6.2.0-150400.37.8.2 qemu-audio-pa-6.2.0-150400.37.8.2 qemu-audio-pa-debuginfo-6.2.0-150400.37.8.2 qemu-audio-spice-6.2.0-150400.37.8.2 qemu-audio-spice-debuginfo-6.2.0-150400.37.8.2 qemu-block-curl-6.2.0-150400.37.8.2 qemu-block-curl-debuginfo-6.2.0-150400.37.8.2 qemu-block-dmg-6.2.0-150400.37.8.2 qemu-block-dmg-debuginfo-6.2.0-150400.37.8.2 qemu-block-gluster-6.2.0-150400.37.8.2 qemu-block-gluster-debuginfo-6.2.0-150400.37.8.2 qemu-block-iscsi-6.2.0-150400.37.8.2 qemu-block-iscsi-debuginfo-6.2.0-150400.37.8.2 qemu-block-nfs-6.2.0-150400.37.8.2 qemu-block-nfs-debuginfo-6.2.0-150400.37.8.2 qemu-block-rbd-6.2.0-150400.37.8.2 qemu-block-rbd-debuginfo-6.2.0-150400.37.8.2 qemu-block-ssh-6.2.0-150400.37.8.2 qemu-block-ssh-debuginfo-6.2.0-150400.37.8.2 qemu-chardev-baum-6.2.0-150400.37.8.2 qemu-chardev-baum-debuginfo-6.2.0-150400.37.8.2 qemu-chardev-spice-6.2.0-150400.37.8.2 qemu-chardev-spice-debuginfo-6.2.0-150400.37.8.2 qemu-debuginfo-6.2.0-150400.37.8.2 qemu-debugsource-6.2.0-150400.37.8.2 qemu-extra-6.2.0-150400.37.8.2 qemu-extra-debuginfo-6.2.0-150400.37.8.2 qemu-guest-agent-6.2.0-150400.37.8.2 qemu-guest-agent-debuginfo-6.2.0-150400.37.8.2 qemu-hw-display-qxl-6.2.0-150400.37.8.2 qemu-hw-display-qxl-debuginfo-6.2.0-150400.37.8.2 qemu-hw-display-virtio-gpu-6.2.0-150400.37.8.2 qemu-hw-display-virtio-gpu-debuginfo-6.2.0-150400.37.8.2 qemu-hw-display-virtio-gpu-pci-6.2.0-150400.37.8.2 qemu-hw-display-virtio-gpu-pci-debuginfo-6.2.0-150400.37.8.2 qemu-hw-display-virtio-vga-6.2.0-150400.37.8.2 qemu-hw-display-virtio-vga-debuginfo-6.2.0-150400.37.8.2 qemu-hw-s390x-virtio-gpu-ccw-6.2.0-150400.37.8.2 qemu-hw-s390x-virtio-gpu-ccw-debuginfo-6.2.0-150400.37.8.2 qemu-hw-usb-host-6.2.0-150400.37.8.2 qemu-hw-usb-host-debuginfo-6.2.0-150400.37.8.2 qemu-hw-usb-redirect-6.2.0-150400.37.8.2 qemu-hw-usb-redirect-debuginfo-6.2.0-150400.37.8.2 qemu-hw-usb-smartcard-6.2.0-150400.37.8.2 qemu-hw-usb-smartcard-debuginfo-6.2.0-150400.37.8.2 qemu-ivshmem-tools-6.2.0-150400.37.8.2 qemu-ivshmem-tools-debuginfo-6.2.0-150400.37.8.2 qemu-ksm-6.2.0-150400.37.8.2 qemu-lang-6.2.0-150400.37.8.2 qemu-linux-user-6.2.0-150400.37.8.1 qemu-linux-user-debuginfo-6.2.0-150400.37.8.1 qemu-linux-user-debugsource-6.2.0-150400.37.8.1 qemu-ppc-6.2.0-150400.37.8.2 qemu-ppc-debuginfo-6.2.0-150400.37.8.2 qemu-s390x-6.2.0-150400.37.8.2 qemu-s390x-debuginfo-6.2.0-150400.37.8.2 qemu-testsuite-6.2.0-150400.37.8.4 qemu-tools-6.2.0-150400.37.8.2 qemu-tools-debuginfo-6.2.0-150400.37.8.2 qemu-ui-curses-6.2.0-150400.37.8.2 qemu-ui-curses-debuginfo-6.2.0-150400.37.8.2 qemu-ui-gtk-6.2.0-150400.37.8.2 qemu-ui-gtk-debuginfo-6.2.0-150400.37.8.2 qemu-ui-opengl-6.2.0-150400.37.8.2 qemu-ui-opengl-debuginfo-6.2.0-150400.37.8.2 qemu-ui-spice-app-6.2.0-150400.37.8.2 qemu-ui-spice-app-debuginfo-6.2.0-150400.37.8.2 qemu-ui-spice-core-6.2.0-150400.37.8.2 qemu-ui-spice-core-debuginfo-6.2.0-150400.37.8.2 qemu-vhost-user-gpu-6.2.0-150400.37.8.2 qemu-vhost-user-gpu-debuginfo-6.2.0-150400.37.8.2 qemu-x86-6.2.0-150400.37.8.2 qemu-x86-debuginfo-6.2.0-150400.37.8.2 - openSUSE Leap 15.4 (s390x x86_64): qemu-kvm-6.2.0-150400.37.8.2 - openSUSE Leap 15.4 (noarch): qemu-SLOF-6.2.0-150400.37.8.2 qemu-ipxe-1.0.0+-150400.37.8.2 qemu-microvm-6.2.0-150400.37.8.2 qemu-seabios-1.15.0_0_g2dd4b9b-150400.37.8.2 qemu-sgabios-8-150400.37.8.2 qemu-skiboot-6.2.0-150400.37.8.2 qemu-vgabios-1.15.0_0_g2dd4b9b-150400.37.8.2 - SUSE Linux Enterprise Module for Server Applications 15-SP4 (aarch64 ppc64le s390x x86_64): qemu-6.2.0-150400.37.8.2 qemu-block-curl-6.2.0-150400.37.8.2 qemu-block-curl-debuginfo-6.2.0-150400.37.8.2 qemu-block-iscsi-6.2.0-150400.37.8.2 qemu-block-iscsi-debuginfo-6.2.0-150400.37.8.2 qemu-block-rbd-6.2.0-150400.37.8.2 qemu-block-rbd-debuginfo-6.2.0-150400.37.8.2 qemu-block-ssh-6.2.0-150400.37.8.2 qemu-block-ssh-debuginfo-6.2.0-150400.37.8.2 qemu-chardev-baum-6.2.0-150400.37.8.2 qemu-chardev-baum-debuginfo-6.2.0-150400.37.8.2 qemu-debuginfo-6.2.0-150400.37.8.2 qemu-debugsource-6.2.0-150400.37.8.2 qemu-guest-agent-6.2.0-150400.37.8.2 qemu-guest-agent-debuginfo-6.2.0-150400.37.8.2 qemu-hw-usb-host-6.2.0-150400.37.8.2 qemu-hw-usb-host-debuginfo-6.2.0-150400.37.8.2 qemu-ksm-6.2.0-150400.37.8.2 qemu-lang-6.2.0-150400.37.8.2 qemu-ui-curses-6.2.0-150400.37.8.2 qemu-ui-curses-debuginfo-6.2.0-150400.37.8.2 - SUSE Linux Enterprise Module for Server Applications 15-SP4 (aarch64 ppc64le x86_64): qemu-audio-spice-6.2.0-150400.37.8.2 qemu-audio-spice-debuginfo-6.2.0-150400.37.8.2 qemu-chardev-spice-6.2.0-150400.37.8.2 qemu-chardev-spice-debuginfo-6.2.0-150400.37.8.2 qemu-hw-display-qxl-6.2.0-150400.37.8.2 qemu-hw-display-qxl-debuginfo-6.2.0-150400.37.8.2 qemu-hw-display-virtio-vga-6.2.0-150400.37.8.2 qemu-hw-display-virtio-vga-debuginfo-6.2.0-150400.37.8.2 qemu-hw-usb-redirect-6.2.0-150400.37.8.2 qemu-hw-usb-redirect-debuginfo-6.2.0-150400.37.8.2 qemu-ui-gtk-6.2.0-150400.37.8.2 qemu-ui-gtk-debuginfo-6.2.0-150400.37.8.2 qemu-ui-opengl-6.2.0-150400.37.8.2 qemu-ui-opengl-debuginfo-6.2.0-150400.37.8.2 qemu-ui-spice-app-6.2.0-150400.37.8.2 qemu-ui-spice-app-debuginfo-6.2.0-150400.37.8.2 qemu-ui-spice-core-6.2.0-150400.37.8.2 qemu-ui-spice-core-debuginfo-6.2.0-150400.37.8.2 - SUSE Linux Enterprise Module for Server Applications 15-SP4 (s390x x86_64): qemu-hw-display-virtio-gpu-6.2.0-150400.37.8.2 qemu-hw-display-virtio-gpu-debuginfo-6.2.0-150400.37.8.2 qemu-hw-display-virtio-gpu-pci-6.2.0-150400.37.8.2 qemu-hw-display-virtio-gpu-pci-debuginfo-6.2.0-150400.37.8.2 qemu-kvm-6.2.0-150400.37.8.2 - SUSE Linux Enterprise Module for Server Applications 15-SP4 (ppc64le): qemu-ppc-6.2.0-150400.37.8.2 qemu-ppc-debuginfo-6.2.0-150400.37.8.2 - SUSE Linux Enterprise Module for Server Applications 15-SP4 (aarch64): qemu-arm-6.2.0-150400.37.8.2 qemu-arm-debuginfo-6.2.0-150400.37.8.2 - SUSE Linux Enterprise Module for Server Applications 15-SP4 (noarch): qemu-SLOF-6.2.0-150400.37.8.2 qemu-ipxe-1.0.0+-150400.37.8.2 qemu-seabios-1.15.0_0_g2dd4b9b-150400.37.8.2 qemu-sgabios-8-150400.37.8.2 qemu-skiboot-6.2.0-150400.37.8.2 qemu-vgabios-1.15.0_0_g2dd4b9b-150400.37.8.2 - SUSE Linux Enterprise Module for Server Applications 15-SP4 (x86_64): qemu-accel-tcg-x86-6.2.0-150400.37.8.2 qemu-accel-tcg-x86-debuginfo-6.2.0-150400.37.8.2 qemu-audio-alsa-6.2.0-150400.37.8.2 qemu-audio-alsa-debuginfo-6.2.0-150400.37.8.2 qemu-audio-pa-6.2.0-150400.37.8.2 qemu-audio-pa-debuginfo-6.2.0-150400.37.8.2 qemu-x86-6.2.0-150400.37.8.2 qemu-x86-debuginfo-6.2.0-150400.37.8.2 - SUSE Linux Enterprise Module for Server Applications 15-SP4 (s390x): qemu-hw-s390x-virtio-gpu-ccw-6.2.0-150400.37.8.2 qemu-hw-s390x-virtio-gpu-ccw-debuginfo-6.2.0-150400.37.8.2 qemu-s390x-6.2.0-150400.37.8.2 qemu-s390x-debuginfo-6.2.0-150400.37.8.2 - SUSE Linux Enterprise Module for Basesystem 15-SP4 (aarch64 ppc64le s390x x86_64): qemu-debuginfo-6.2.0-150400.37.8.2 qemu-debugsource-6.2.0-150400.37.8.2 qemu-tools-6.2.0-150400.37.8.2 qemu-tools-debuginfo-6.2.0-150400.37.8.2 - SUSE Linux Enterprise Micro 5.3 (aarch64 s390x x86_64): qemu-6.2.0-150400.37.8.2 qemu-audio-spice-6.2.0-150400.37.8.2 qemu-audio-spice-debuginfo-6.2.0-150400.37.8.2 qemu-chardev-spice-6.2.0-150400.37.8.2 qemu-chardev-spice-debuginfo-6.2.0-150400.37.8.2 qemu-debuginfo-6.2.0-150400.37.8.2 qemu-debugsource-6.2.0-150400.37.8.2 qemu-guest-agent-6.2.0-150400.37.8.2 qemu-guest-agent-debuginfo-6.2.0-150400.37.8.2 qemu-hw-display-qxl-6.2.0-150400.37.8.2 qemu-hw-display-qxl-debuginfo-6.2.0-150400.37.8.2 qemu-hw-display-virtio-gpu-6.2.0-150400.37.8.2 qemu-hw-display-virtio-gpu-debuginfo-6.2.0-150400.37.8.2 qemu-hw-display-virtio-vga-6.2.0-150400.37.8.2 qemu-hw-display-virtio-vga-debuginfo-6.2.0-150400.37.8.2 qemu-hw-usb-redirect-6.2.0-150400.37.8.2 qemu-hw-usb-redirect-debuginfo-6.2.0-150400.37.8.2 qemu-tools-6.2.0-150400.37.8.2 qemu-tools-debuginfo-6.2.0-150400.37.8.2 qemu-ui-opengl-6.2.0-150400.37.8.2 qemu-ui-opengl-debuginfo-6.2.0-150400.37.8.2 qemu-ui-spice-core-6.2.0-150400.37.8.2 qemu-ui-spice-core-debuginfo-6.2.0-150400.37.8.2 - SUSE Linux Enterprise Micro 5.3 (aarch64): qemu-arm-6.2.0-150400.37.8.2 qemu-arm-debuginfo-6.2.0-150400.37.8.2 - SUSE Linux Enterprise Micro 5.3 (x86_64): qemu-accel-tcg-x86-6.2.0-150400.37.8.2 qemu-accel-tcg-x86-debuginfo-6.2.0-150400.37.8.2 qemu-x86-6.2.0-150400.37.8.2 qemu-x86-debuginfo-6.2.0-150400.37.8.2 - SUSE Linux Enterprise Micro 5.3 (noarch): qemu-ipxe-1.0.0+-150400.37.8.2 qemu-seabios-1.15.0_0_g2dd4b9b-150400.37.8.2 qemu-sgabios-8-150400.37.8.2 qemu-vgabios-1.15.0_0_g2dd4b9b-150400.37.8.2 - SUSE Linux Enterprise Micro 5.3 (s390x): qemu-s390x-6.2.0-150400.37.8.2 qemu-s390x-debuginfo-6.2.0-150400.37.8.2 References: https://www.suse.com/security/cve/CVE-2022-0216.html https://www.suse.com/security/cve/CVE-2022-35414.html https://bugzilla.suse.com/1192115 https://bugzilla.suse.com/1198038 https://bugzilla.suse.com/1201367

1 0