October 2022 - openSUSE Security Announce

SUSE-SU-2022:3711-1: important: Security update for multipath-tools
by opensuse-security＠opensuse.org 24 Oct '22

24 Oct '22

SUSE Security Update: Security update for multipath-tools ______________________________________________________________________________ Announcement ID: SUSE-SU-2022:3711-1 Rating: important References: #1197570 #1199342 #1199345 #1199346 #1199347 #1201483 #1202616 #1202739 Cross-References: CVE-2022-41973 CVE-2022-41974 CVSS scores: CVE-2022-41973 (SUSE): 6.2 CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N CVE-2022-41974 (SUSE): 8.4 CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H Affected Products: SUSE Linux Enterprise Desktop 15-SP4 SUSE Linux Enterprise High Performance Computing 15-SP4 SUSE Linux Enterprise Micro 5.3 SUSE Linux Enterprise Module for Basesystem 15-SP4 SUSE Linux Enterprise Server 15-SP4 SUSE Linux Enterprise Server for SAP Applications 15-SP4 SUSE Manager Proxy 4.3 SUSE Manager Retail Branch Server 4.3 SUSE Manager Server 4.3 openSUSE Leap 15.4 ______________________________________________________________________________ An update that solves two vulnerabilities and has 6 fixes is now available. Description: This update for multipath-tools fixes the following issues: - CVE-2022-41973: Fixed a symlink attack in multipathd. (bsc#1202739) - CVE-2022-41974: Fixed an authorization bypass issue in multipathd. (bsc#1202739) - Avoid linking to libreadline to avoid licensing issue (bsc#1202616) - libmultipath: fix find_multipaths_timeout for unknown hardware (bsc#1201483) - multipath-tools: fix "multipath -ll" for Native NVME Multipath devices (bsc#1201483) - multipathd: don't switch to DAEMON_IDLE during startup (bsc#1199346, bsc#1197570) - multipathd: avoid delays during uevent processing (bsc#1199347) - multipathd: Don't keep starting TUR threads, if they always hang. (bsc#1199345) - Fix busy loop with delayed_reconfigure (bsc#1199342) - multipath.conf: add support for "protocol" subsection in "overrides" section to set certain config options by protocol. - Removed the previously deprecated options getuid_callout, config_dir, multipath_dir, pg_timeout - Add disclaimer about vendor support - Change built-in defaults for NVMe: group by prio, and immediate failback - Fixes for minor issues reported by coverity - Fix for memory leak with uid_attrs - Updates for built in hardware db - Logging improvements - multipathd: use remove_map_callback for delayed reconfigure - Fix handling of path addition in read-only arrays on NVMe - Updates of built-in hardware database - libmultipath: only warn once about unsupported dev_loss_tmo Patch Instructions: To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 15.4: zypper in -t patch openSUSE-SLE-15.4-2022-3711=1 - SUSE Linux Enterprise Module for Basesystem 15-SP4: zypper in -t patch SUSE-SLE-Module-Basesystem-15-SP4-2022-3711=1 - SUSE Linux Enterprise Micro 5.3: zypper in -t patch SUSE-SLE-Micro-5.3-2022-3711=1 Package List: - openSUSE Leap 15.4 (aarch64 ppc64le s390x x86_64): kpartx-0.9.0+62+suse.3e048d4-150400.4.7.1 kpartx-debuginfo-0.9.0+62+suse.3e048d4-150400.4.7.1 libdmmp-devel-0.9.0+62+suse.3e048d4-150400.4.7.1 libdmmp0_2_0-0.9.0+62+suse.3e048d4-150400.4.7.1 libdmmp0_2_0-debuginfo-0.9.0+62+suse.3e048d4-150400.4.7.1 libmpath0-0.9.0+62+suse.3e048d4-150400.4.7.1 libmpath0-debuginfo-0.9.0+62+suse.3e048d4-150400.4.7.1 multipath-tools-0.9.0+62+suse.3e048d4-150400.4.7.1 multipath-tools-debuginfo-0.9.0+62+suse.3e048d4-150400.4.7.1 multipath-tools-debugsource-0.9.0+62+suse.3e048d4-150400.4.7.1 multipath-tools-devel-0.9.0+62+suse.3e048d4-150400.4.7.1 - SUSE Linux Enterprise Module for Basesystem 15-SP4 (aarch64 ppc64le s390x x86_64): kpartx-0.9.0+62+suse.3e048d4-150400.4.7.1 kpartx-debuginfo-0.9.0+62+suse.3e048d4-150400.4.7.1 libdmmp-devel-0.9.0+62+suse.3e048d4-150400.4.7.1 libdmmp0_2_0-0.9.0+62+suse.3e048d4-150400.4.7.1 libdmmp0_2_0-debuginfo-0.9.0+62+suse.3e048d4-150400.4.7.1 libmpath0-0.9.0+62+suse.3e048d4-150400.4.7.1 libmpath0-debuginfo-0.9.0+62+suse.3e048d4-150400.4.7.1 multipath-tools-0.9.0+62+suse.3e048d4-150400.4.7.1 multipath-tools-debuginfo-0.9.0+62+suse.3e048d4-150400.4.7.1 multipath-tools-debugsource-0.9.0+62+suse.3e048d4-150400.4.7.1 multipath-tools-devel-0.9.0+62+suse.3e048d4-150400.4.7.1 - SUSE Linux Enterprise Micro 5.3 (aarch64 s390x x86_64): kpartx-0.9.0+62+suse.3e048d4-150400.4.7.1 kpartx-debuginfo-0.9.0+62+suse.3e048d4-150400.4.7.1 libmpath0-0.9.0+62+suse.3e048d4-150400.4.7.1 libmpath0-debuginfo-0.9.0+62+suse.3e048d4-150400.4.7.1 multipath-tools-0.9.0+62+suse.3e048d4-150400.4.7.1 multipath-tools-debuginfo-0.9.0+62+suse.3e048d4-150400.4.7.1 multipath-tools-debugsource-0.9.0+62+suse.3e048d4-150400.4.7.1 References: https://www.suse.com/security/cve/CVE-2022-41973.html https://www.suse.com/security/cve/CVE-2022-41974.html https://bugzilla.suse.com/1197570 https://bugzilla.suse.com/1199342 https://bugzilla.suse.com/1199345 https://bugzilla.suse.com/1199346 https://bugzilla.suse.com/1199347 https://bugzilla.suse.com/1201483 https://bugzilla.suse.com/1202616 https://bugzilla.suse.com/1202739

1 0

SUSE-SU-2022:3712-1: important: Security update for multipath-tools
by opensuse-security＠opensuse.org 24 Oct '22

24 Oct '22

SUSE Security Update: Security update for multipath-tools ______________________________________________________________________________ Announcement ID: SUSE-SU-2022:3712-1 Rating: important References: #1202616 #1202739 #1204325 Cross-References: CVE-2022-41974 CVSS scores: CVE-2022-41974 (SUSE): 8.4 CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H Affected Products: SUSE Linux Enterprise High Performance Computing 15-ESPOS SUSE Linux Enterprise High Performance Computing 15-LTSS SUSE Linux Enterprise Server 15-LTSS SUSE Linux Enterprise Server for SAP 15 openSUSE Leap 15.3 openSUSE Leap 15.4 ______________________________________________________________________________ An update that solves one vulnerability and has two fixes is now available. Description: This update for multipath-tools fixes the following issues: - CVE-2022-41974: Fixed an authorization bypass issue in multipathd. (bsc#1202739) - Avoid linking to libreadline to avoid licensing issue (bsc#1202616) Patch Instructions: To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 15.4: zypper in -t patch openSUSE-SLE-15.4-2022-3712=1 - openSUSE Leap 15.3: zypper in -t patch openSUSE-SLE-15.3-2022-3712=1 - SUSE Linux Enterprise Server for SAP 15: zypper in -t patch SUSE-SLE-Product-SLES_SAP-15-2022-3712=1 - SUSE Linux Enterprise Server 15-LTSS: zypper in -t patch SUSE-SLE-Product-SLES-15-2022-3712=1 - SUSE Linux Enterprise High Performance Computing 15-LTSS: zypper in -t patch SUSE-SLE-Product-HPC-15-2022-3712=1 - SUSE Linux Enterprise High Performance Computing 15-ESPOS: zypper in -t patch SUSE-SLE-Product-HPC-15-2022-3712=1 Package List: - openSUSE Leap 15.4 (aarch64 ppc64le s390x x86_64): libdmmp0_1_0-0.7.3+173+suse.7dd1b01-150000.3.29.1 libdmmp0_1_0-debuginfo-0.7.3+173+suse.7dd1b01-150000.3.29.1 multipath-tools-rbd-0.7.3+173+suse.7dd1b01-150000.3.29.1 multipath-tools-rbd-debuginfo-0.7.3+173+suse.7dd1b01-150000.3.29.1 - openSUSE Leap 15.3 (aarch64 ppc64le s390x x86_64): libdmmp0_1_0-0.7.3+173+suse.7dd1b01-150000.3.29.1 libdmmp0_1_0-debuginfo-0.7.3+173+suse.7dd1b01-150000.3.29.1 multipath-tools-rbd-0.7.3+173+suse.7dd1b01-150000.3.29.1 multipath-tools-rbd-debuginfo-0.7.3+173+suse.7dd1b01-150000.3.29.1 - SUSE Linux Enterprise Server for SAP 15 (ppc64le x86_64): kpartx-0.7.3+173+suse.7dd1b01-150000.3.29.1 kpartx-debuginfo-0.7.3+173+suse.7dd1b01-150000.3.29.1 libdmmp-devel-0.7.3+173+suse.7dd1b01-150000.3.29.1 libdmmp0_1_0-0.7.3+173+suse.7dd1b01-150000.3.29.1 libdmmp0_1_0-debuginfo-0.7.3+173+suse.7dd1b01-150000.3.29.1 multipath-tools-0.7.3+173+suse.7dd1b01-150000.3.29.1 multipath-tools-debuginfo-0.7.3+173+suse.7dd1b01-150000.3.29.1 multipath-tools-debugsource-0.7.3+173+suse.7dd1b01-150000.3.29.1 multipath-tools-devel-0.7.3+173+suse.7dd1b01-150000.3.29.1 multipath-tools-rbd-0.7.3+173+suse.7dd1b01-150000.3.29.1 multipath-tools-rbd-debuginfo-0.7.3+173+suse.7dd1b01-150000.3.29.1 - SUSE Linux Enterprise Server 15-LTSS (aarch64 s390x): kpartx-0.7.3+173+suse.7dd1b01-150000.3.29.1 kpartx-debuginfo-0.7.3+173+suse.7dd1b01-150000.3.29.1 libdmmp-devel-0.7.3+173+suse.7dd1b01-150000.3.29.1 libdmmp0_1_0-0.7.3+173+suse.7dd1b01-150000.3.29.1 libdmmp0_1_0-debuginfo-0.7.3+173+suse.7dd1b01-150000.3.29.1 multipath-tools-0.7.3+173+suse.7dd1b01-150000.3.29.1 multipath-tools-debuginfo-0.7.3+173+suse.7dd1b01-150000.3.29.1 multipath-tools-debugsource-0.7.3+173+suse.7dd1b01-150000.3.29.1 multipath-tools-devel-0.7.3+173+suse.7dd1b01-150000.3.29.1 multipath-tools-rbd-0.7.3+173+suse.7dd1b01-150000.3.29.1 multipath-tools-rbd-debuginfo-0.7.3+173+suse.7dd1b01-150000.3.29.1 - SUSE Linux Enterprise High Performance Computing 15-LTSS (aarch64 x86_64): kpartx-0.7.3+173+suse.7dd1b01-150000.3.29.1 kpartx-debuginfo-0.7.3+173+suse.7dd1b01-150000.3.29.1 libdmmp-devel-0.7.3+173+suse.7dd1b01-150000.3.29.1 libdmmp0_1_0-0.7.3+173+suse.7dd1b01-150000.3.29.1 libdmmp0_1_0-debuginfo-0.7.3+173+suse.7dd1b01-150000.3.29.1 multipath-tools-0.7.3+173+suse.7dd1b01-150000.3.29.1 multipath-tools-debuginfo-0.7.3+173+suse.7dd1b01-150000.3.29.1 multipath-tools-debugsource-0.7.3+173+suse.7dd1b01-150000.3.29.1 multipath-tools-devel-0.7.3+173+suse.7dd1b01-150000.3.29.1 multipath-tools-rbd-0.7.3+173+suse.7dd1b01-150000.3.29.1 multipath-tools-rbd-debuginfo-0.7.3+173+suse.7dd1b01-150000.3.29.1 - SUSE Linux Enterprise High Performance Computing 15-ESPOS (aarch64 x86_64): kpartx-0.7.3+173+suse.7dd1b01-150000.3.29.1 kpartx-debuginfo-0.7.3+173+suse.7dd1b01-150000.3.29.1 libdmmp-devel-0.7.3+173+suse.7dd1b01-150000.3.29.1 libdmmp0_1_0-0.7.3+173+suse.7dd1b01-150000.3.29.1 libdmmp0_1_0-debuginfo-0.7.3+173+suse.7dd1b01-150000.3.29.1 multipath-tools-0.7.3+173+suse.7dd1b01-150000.3.29.1 multipath-tools-debuginfo-0.7.3+173+suse.7dd1b01-150000.3.29.1 multipath-tools-debugsource-0.7.3+173+suse.7dd1b01-150000.3.29.1 multipath-tools-devel-0.7.3+173+suse.7dd1b01-150000.3.29.1 multipath-tools-rbd-0.7.3+173+suse.7dd1b01-150000.3.29.1 multipath-tools-rbd-debuginfo-0.7.3+173+suse.7dd1b01-150000.3.29.1 References: https://www.suse.com/security/cve/CVE-2022-41974.html https://bugzilla.suse.com/1202616 https://bugzilla.suse.com/1202739 https://bugzilla.suse.com/1204325

1 0

SUSE-SU-2022:3693-1: important: Security update for the Linux Kernel
by opensuse-security＠opensuse.org 22 Oct '22

22 Oct '22

SUSE Security Update: Security update for the Linux Kernel ______________________________________________________________________________ Announcement ID: SUSE-SU-2022:3693-1 Rating: important References: #1199564 #1200288 #1201309 #1202677 #1202960 #1203552 #1203769 #1203987 PED-529 Cross-References: CVE-2022-20008 CVE-2022-2503 CVE-2022-32296 CVE-2022-3239 CVE-2022-3303 CVE-2022-41218 CVE-2022-41848 CVSS scores: CVE-2022-20008 (NVD) : 4.6 CVSS:3.1/AV:P/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N CVE-2022-20008 (SUSE): 6.2 CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N CVE-2022-2503 (NVD) : 6.7 CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H CVE-2022-2503 (SUSE): 6.7 CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H CVE-2022-32296 (NVD) : 3.3 CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N CVE-2022-32296 (SUSE): 5.3 CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:N/A:N CVE-2022-3239 (NVD) : 7.8 CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H CVE-2022-3239 (SUSE): 6.4 CVSS:3.1/AV:L/AC:H/PR:H/UI:N/S:U/C:H/I:H/A:H CVE-2022-3303 (NVD) : 4.7 CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:N/I:N/A:H CVE-2022-3303 (SUSE): 4.4 CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H CVE-2022-41218 (NVD) : 5.5 CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H CVE-2022-41218 (SUSE): 8.4 CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H CVE-2022-41848 (NVD) : 4.2 CVSS:3.1/AV:P/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H CVE-2022-41848 (SUSE): 6.4 CVSS:3.1/AV:P/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H Affected Products: SUSE CaaS Platform 4.0 SUSE Enterprise Storage 6 SUSE Linux Enterprise High Availability 15-SP1 SUSE Linux Enterprise High Performance Computing 15-SP1 SUSE Linux Enterprise High Performance Computing 15-SP1-ESPOS SUSE Linux Enterprise High Performance Computing 15-SP1-LTSS SUSE Linux Enterprise Module for Live Patching 15-SP1 SUSE Linux Enterprise Server 15-SP1 SUSE Linux Enterprise Server 15-SP1-BCL SUSE Linux Enterprise Server 15-SP1-LTSS SUSE Linux Enterprise Server for SAP 15-SP1 SUSE Linux Enterprise Server for SAP Applications 15-SP1 SUSE Linux Enterprise Storage 6 SUSE Manager Proxy 4.0 SUSE Manager Retail Branch Server 4.0 SUSE Manager Server 4.0 openSUSE Leap 15.3 openSUSE Leap 15.4 ______________________________________________________________________________ An update that solves 7 vulnerabilities, contains one feature and has one errata is now available. Description: The SUSE Linux Enterprise 15-SP1 kernel was updated to receive various security and bugfixes. The following security bugs were fixed: - CVE-2022-20008: Fixed local information disclosure due to possibility to read kernel heap memory via mmc_blk_read_single of block.c (bnc#1199564). - CVE-2022-2503: Fixed a vulnerability that allowed root to bypass LoadPin and load untrusted and unverified kernel modules and firmware (bnc#1202677). - CVE-2022-32296: Fixed vulnerability where TCP servers were allowed to identify clients by observing what source ports are used (bnc#1200288). - CVE-2022-3239: Fixed an use-after-free in the video4linux driver that could lead a local user to able to crash the system or escalate their privileges (bnc#1203552). - CVE-2022-3303: Fixed a race condition in the sound subsystem due to improper locking (bnc#1203769). - CVE-2022-41218: Fixed an use-after-free caused by refcount races in drivers/media/dvb-core/dmxdev.c (bnc#1202960). - CVE-2022-41848: Fixed a race condition in drivers/char/pcmcia/synclink_cs.c mgslpc_ioctl and mgslpc_detach (bnc#1203987). The following non-security bugs were fixed: - dtb: Do not include sources in src.rpm - refer to kernel-source Same as other kernel binary packages there is no need to carry duplicate sources in dtb packages. - mkspec: eliminate @NOSOURCE@ macro This should be alsways used with @SOURCES@, just include the content there. - net: mana: Add rmb after checking owner bits (git-fixes). - net: mana: Add the Linux MANA PF driver (bnc#1201309, jsc#PED-529). - x86/bugs: Reenable retbleed=off While for older kernels the return thunks are statically built in and cannot be dynamically patched out, retbleed=off should still be possible to do so that the mitigation can still be disabled on Intel who do not use the return thunks but IBRS. Special Instructions and Notes: Please reboot the system after installing this update. Patch Instructions: To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 15.4: zypper in -t patch openSUSE-SLE-15.4-2022-3693=1 - openSUSE Leap 15.3: zypper in -t patch openSUSE-SLE-15.3-2022-3693=1 - SUSE Linux Enterprise Server for SAP 15-SP1: zypper in -t patch SUSE-SLE-Product-SLES_SAP-15-SP1-2022-3693=1 - SUSE Linux Enterprise Server 15-SP1-LTSS: zypper in -t patch SUSE-SLE-Product-SLES-15-SP1-LTSS-2022-3693=1 - SUSE Linux Enterprise Server 15-SP1-BCL: zypper in -t patch SUSE-SLE-Product-SLES-15-SP1-BCL-2022-3693=1 - SUSE Linux Enterprise Module for Live Patching 15-SP1: zypper in -t patch SUSE-SLE-Module-Live-Patching-15-SP1-2022-3693=1 Please note that this is the initial kernel livepatch without fixes itself, this livepatch package is later updated by seperate standalone livepatch updates. - SUSE Linux Enterprise High Performance Computing 15-SP1-LTSS: zypper in -t patch SUSE-SLE-Product-HPC-15-SP1-LTSS-2022-3693=1 - SUSE Linux Enterprise High Performance Computing 15-SP1-ESPOS: zypper in -t patch SUSE-SLE-Product-HPC-15-SP1-ESPOS-2022-3693=1 - SUSE Linux Enterprise High Availability 15-SP1: zypper in -t patch SUSE-SLE-Product-HA-15-SP1-2022-3693=1 - SUSE Enterprise Storage 6: zypper in -t patch SUSE-Storage-6-2022-3693=1 - SUSE CaaS Platform 4.0: To install this update, use the SUSE CaaS Platform 'skuba' tool. It will inform you if it detects new updates and let you then trigger updating of the complete cluster in a controlled way. Package List: - openSUSE Leap 15.4 (aarch64 ppc64le s390x x86_64): kernel-default-base-debuginfo-4.12.14-150100.197.126.1 kernel-vanilla-4.12.14-150100.197.126.1 kernel-vanilla-base-4.12.14-150100.197.126.1 kernel-vanilla-base-debuginfo-4.12.14-150100.197.126.1 kernel-vanilla-debuginfo-4.12.14-150100.197.126.1 kernel-vanilla-debugsource-4.12.14-150100.197.126.1 kernel-vanilla-devel-4.12.14-150100.197.126.1 kernel-vanilla-devel-debuginfo-4.12.14-150100.197.126.1 kernel-vanilla-livepatch-devel-4.12.14-150100.197.126.1 - openSUSE Leap 15.4 (ppc64le x86_64): kernel-debug-base-4.12.14-150100.197.126.1 kernel-debug-base-debuginfo-4.12.14-150100.197.126.1 - openSUSE Leap 15.4 (x86_64): kernel-kvmsmall-base-4.12.14-150100.197.126.1 kernel-kvmsmall-base-debuginfo-4.12.14-150100.197.126.1 - openSUSE Leap 15.4 (s390x): kernel-default-man-4.12.14-150100.197.126.1 kernel-zfcpdump-man-4.12.14-150100.197.126.1 - openSUSE Leap 15.3 (aarch64 ppc64le s390x x86_64): kernel-default-base-debuginfo-4.12.14-150100.197.126.1 kernel-vanilla-4.12.14-150100.197.126.1 kernel-vanilla-base-4.12.14-150100.197.126.1 kernel-vanilla-base-debuginfo-4.12.14-150100.197.126.1 kernel-vanilla-debuginfo-4.12.14-150100.197.126.1 kernel-vanilla-debugsource-4.12.14-150100.197.126.1 kernel-vanilla-devel-4.12.14-150100.197.126.1 kernel-vanilla-devel-debuginfo-4.12.14-150100.197.126.1 kernel-vanilla-livepatch-devel-4.12.14-150100.197.126.1 - openSUSE Leap 15.3 (ppc64le x86_64): kernel-debug-base-4.12.14-150100.197.126.1 kernel-debug-base-debuginfo-4.12.14-150100.197.126.1 - openSUSE Leap 15.3 (x86_64): kernel-kvmsmall-base-4.12.14-150100.197.126.1 kernel-kvmsmall-base-debuginfo-4.12.14-150100.197.126.1 - openSUSE Leap 15.3 (s390x): kernel-default-man-4.12.14-150100.197.126.1 kernel-zfcpdump-man-4.12.14-150100.197.126.1 - SUSE Linux Enterprise Server for SAP 15-SP1 (ppc64le x86_64): kernel-default-4.12.14-150100.197.126.1 kernel-default-base-4.12.14-150100.197.126.1 kernel-default-base-debuginfo-4.12.14-150100.197.126.1 kernel-default-debuginfo-4.12.14-150100.197.126.1 kernel-default-debugsource-4.12.14-150100.197.126.1 kernel-default-devel-4.12.14-150100.197.126.1 kernel-default-devel-debuginfo-4.12.14-150100.197.126.1 kernel-obs-build-4.12.14-150100.197.126.1 kernel-obs-build-debugsource-4.12.14-150100.197.126.1 kernel-syms-4.12.14-150100.197.126.1 reiserfs-kmp-default-4.12.14-150100.197.126.1 reiserfs-kmp-default-debuginfo-4.12.14-150100.197.126.1 - SUSE Linux Enterprise Server for SAP 15-SP1 (noarch): kernel-devel-4.12.14-150100.197.126.1 kernel-docs-4.12.14-150100.197.126.1 kernel-macros-4.12.14-150100.197.126.1 kernel-source-4.12.14-150100.197.126.1 - SUSE Linux Enterprise Server 15-SP1-LTSS (aarch64 ppc64le s390x x86_64): kernel-default-4.12.14-150100.197.126.1 kernel-default-base-4.12.14-150100.197.126.1 kernel-default-base-debuginfo-4.12.14-150100.197.126.1 kernel-default-debuginfo-4.12.14-150100.197.126.1 kernel-default-debugsource-4.12.14-150100.197.126.1 kernel-default-devel-4.12.14-150100.197.126.1 kernel-default-devel-debuginfo-4.12.14-150100.197.126.1 kernel-obs-build-4.12.14-150100.197.126.1 kernel-obs-build-debugsource-4.12.14-150100.197.126.1 kernel-syms-4.12.14-150100.197.126.1 reiserfs-kmp-default-4.12.14-150100.197.126.1 reiserfs-kmp-default-debuginfo-4.12.14-150100.197.126.1 - SUSE Linux Enterprise Server 15-SP1-LTSS (noarch): kernel-devel-4.12.14-150100.197.126.1 kernel-docs-4.12.14-150100.197.126.1 kernel-macros-4.12.14-150100.197.126.1 kernel-source-4.12.14-150100.197.126.1 - SUSE Linux Enterprise Server 15-SP1-LTSS (s390x): kernel-default-man-4.12.14-150100.197.126.1 kernel-zfcpdump-debuginfo-4.12.14-150100.197.126.1 kernel-zfcpdump-debugsource-4.12.14-150100.197.126.1 - SUSE Linux Enterprise Server 15-SP1-BCL (x86_64): kernel-default-4.12.14-150100.197.126.1 kernel-default-base-4.12.14-150100.197.126.1 kernel-default-base-debuginfo-4.12.14-150100.197.126.1 kernel-default-debuginfo-4.12.14-150100.197.126.1 kernel-default-debugsource-4.12.14-150100.197.126.1 kernel-default-devel-4.12.14-150100.197.126.1 kernel-default-devel-debuginfo-4.12.14-150100.197.126.1 kernel-obs-build-4.12.14-150100.197.126.1 kernel-obs-build-debugsource-4.12.14-150100.197.126.1 kernel-syms-4.12.14-150100.197.126.1 reiserfs-kmp-default-4.12.14-150100.197.126.1 reiserfs-kmp-default-debuginfo-4.12.14-150100.197.126.1 - SUSE Linux Enterprise Server 15-SP1-BCL (noarch): kernel-devel-4.12.14-150100.197.126.1 kernel-docs-4.12.14-150100.197.126.1 kernel-macros-4.12.14-150100.197.126.1 kernel-source-4.12.14-150100.197.126.1 - SUSE Linux Enterprise Module for Live Patching 15-SP1 (ppc64le x86_64): kernel-default-debuginfo-4.12.14-150100.197.126.1 kernel-default-debugsource-4.12.14-150100.197.126.1 kernel-default-livepatch-4.12.14-150100.197.126.1 kernel-default-livepatch-devel-4.12.14-150100.197.126.1 kernel-livepatch-4_12_14-150100_197_126-default-1-150100.3.3.1 - SUSE Linux Enterprise High Performance Computing 15-SP1-LTSS (aarch64 x86_64): kernel-default-4.12.14-150100.197.126.1 kernel-default-base-4.12.14-150100.197.126.1 kernel-default-base-debuginfo-4.12.14-150100.197.126.1 kernel-default-debuginfo-4.12.14-150100.197.126.1 kernel-default-debugsource-4.12.14-150100.197.126.1 kernel-default-devel-4.12.14-150100.197.126.1 kernel-default-devel-debuginfo-4.12.14-150100.197.126.1 kernel-obs-build-4.12.14-150100.197.126.1 kernel-obs-build-debugsource-4.12.14-150100.197.126.1 kernel-syms-4.12.14-150100.197.126.1 - SUSE Linux Enterprise High Performance Computing 15-SP1-LTSS (noarch): kernel-devel-4.12.14-150100.197.126.1 kernel-docs-4.12.14-150100.197.126.1 kernel-macros-4.12.14-150100.197.126.1 kernel-source-4.12.14-150100.197.126.1 - SUSE Linux Enterprise High Performance Computing 15-SP1-ESPOS (aarch64 x86_64): kernel-default-4.12.14-150100.197.126.1 kernel-default-base-4.12.14-150100.197.126.1 kernel-default-base-debuginfo-4.12.14-150100.197.126.1 kernel-default-debuginfo-4.12.14-150100.197.126.1 kernel-default-debugsource-4.12.14-150100.197.126.1 kernel-default-devel-4.12.14-150100.197.126.1 kernel-default-devel-debuginfo-4.12.14-150100.197.126.1 kernel-obs-build-4.12.14-150100.197.126.1 kernel-obs-build-debugsource-4.12.14-150100.197.126.1 kernel-syms-4.12.14-150100.197.126.1 - SUSE Linux Enterprise High Performance Computing 15-SP1-ESPOS (noarch): kernel-devel-4.12.14-150100.197.126.1 kernel-docs-4.12.14-150100.197.126.1 kernel-macros-4.12.14-150100.197.126.1 kernel-source-4.12.14-150100.197.126.1 - SUSE Linux Enterprise High Availability 15-SP1 (aarch64 ppc64le s390x x86_64): cluster-md-kmp-default-4.12.14-150100.197.126.1 cluster-md-kmp-default-debuginfo-4.12.14-150100.197.126.1 dlm-kmp-default-4.12.14-150100.197.126.1 dlm-kmp-default-debuginfo-4.12.14-150100.197.126.1 gfs2-kmp-default-4.12.14-150100.197.126.1 gfs2-kmp-default-debuginfo-4.12.14-150100.197.126.1 kernel-default-debuginfo-4.12.14-150100.197.126.1 kernel-default-debugsource-4.12.14-150100.197.126.1 ocfs2-kmp-default-4.12.14-150100.197.126.1 ocfs2-kmp-default-debuginfo-4.12.14-150100.197.126.1 - SUSE Enterprise Storage 6 (aarch64 x86_64): kernel-default-4.12.14-150100.197.126.1 kernel-default-base-4.12.14-150100.197.126.1 kernel-default-base-debuginfo-4.12.14-150100.197.126.1 kernel-default-debuginfo-4.12.14-150100.197.126.1 kernel-default-debugsource-4.12.14-150100.197.126.1 kernel-default-devel-4.12.14-150100.197.126.1 kernel-default-devel-debuginfo-4.12.14-150100.197.126.1 kernel-obs-build-4.12.14-150100.197.126.1 kernel-obs-build-debugsource-4.12.14-150100.197.126.1 kernel-syms-4.12.14-150100.197.126.1 reiserfs-kmp-default-4.12.14-150100.197.126.1 reiserfs-kmp-default-debuginfo-4.12.14-150100.197.126.1 - SUSE Enterprise Storage 6 (noarch): kernel-devel-4.12.14-150100.197.126.1 kernel-docs-4.12.14-150100.197.126.1 kernel-macros-4.12.14-150100.197.126.1 kernel-source-4.12.14-150100.197.126.1 - SUSE CaaS Platform 4.0 (noarch): kernel-devel-4.12.14-150100.197.126.1 kernel-docs-4.12.14-150100.197.126.1 kernel-macros-4.12.14-150100.197.126.1 kernel-source-4.12.14-150100.197.126.1 - SUSE CaaS Platform 4.0 (x86_64): kernel-default-4.12.14-150100.197.126.1 kernel-default-base-4.12.14-150100.197.126.1 kernel-default-base-debuginfo-4.12.14-150100.197.126.1 kernel-default-debuginfo-4.12.14-150100.197.126.1 kernel-default-debugsource-4.12.14-150100.197.126.1 kernel-default-devel-4.12.14-150100.197.126.1 kernel-default-devel-debuginfo-4.12.14-150100.197.126.1 kernel-obs-build-4.12.14-150100.197.126.1 kernel-obs-build-debugsource-4.12.14-150100.197.126.1 kernel-syms-4.12.14-150100.197.126.1 reiserfs-kmp-default-4.12.14-150100.197.126.1 reiserfs-kmp-default-debuginfo-4.12.14-150100.197.126.1 References: https://www.suse.com/security/cve/CVE-2022-20008.html https://www.suse.com/security/cve/CVE-2022-2503.html https://www.suse.com/security/cve/CVE-2022-32296.html https://www.suse.com/security/cve/CVE-2022-3239.html https://www.suse.com/security/cve/CVE-2022-3303.html https://www.suse.com/security/cve/CVE-2022-41218.html https://www.suse.com/security/cve/CVE-2022-41848.html https://bugzilla.suse.com/1199564 https://bugzilla.suse.com/1200288 https://bugzilla.suse.com/1201309 https://bugzilla.suse.com/1202677 https://bugzilla.suse.com/1202960 https://bugzilla.suse.com/1203552 https://bugzilla.suse.com/1203769 https://bugzilla.suse.com/1203987

1 0

SUSE-SU-2022:3692-1: important: Security update for libxml2
by opensuse-security＠opensuse.org 21 Oct '22

21 Oct '22

SUSE Security Update: Security update for libxml2 ______________________________________________________________________________ Announcement ID: SUSE-SU-2022:3692-1 Rating: important References: #1204366 #1204367 Cross-References: CVE-2022-40303 CVE-2022-40304 CVSS scores: CVE-2022-40303 (SUSE): 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H CVE-2022-40304 (SUSE): 8.1 CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H Affected Products: SUSE Linux Enterprise Desktop 15-SP4 SUSE Linux Enterprise High Performance Computing 15-SP4 SUSE Linux Enterprise Micro 5.3 SUSE Linux Enterprise Module for Basesystem 15-SP4 SUSE Linux Enterprise Server 15-SP4 SUSE Linux Enterprise Server for SAP Applications 15-SP4 SUSE Manager Proxy 4.3 SUSE Manager Retail Branch Server 4.3 SUSE Manager Server 4.3 openSUSE Leap 15.4 ______________________________________________________________________________ An update that fixes two vulnerabilities is now available. Description: This update for libxml2 fixes the following issues: - CVE-2022-40303: Fixed integer overflows with XML_PARSE_HUGE (bsc#1204366). - CVE-2022-40304: Fixed dict corruption caused by entity reference cycles (bsc#1204367). Patch Instructions: To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 15.4: zypper in -t patch openSUSE-SLE-15.4-2022-3692=1 - SUSE Linux Enterprise Module for Basesystem 15-SP4: zypper in -t patch SUSE-SLE-Module-Basesystem-15-SP4-2022-3692=1 - SUSE Linux Enterprise Micro 5.3: zypper in -t patch SUSE-SLE-Micro-5.3-2022-3692=1 Package List: - openSUSE Leap 15.4 (aarch64 ppc64le s390x x86_64): libxml2-2-2.9.14-150400.5.10.1 libxml2-2-debuginfo-2.9.14-150400.5.10.1 libxml2-debugsource-2.9.14-150400.5.10.1 libxml2-devel-2.9.14-150400.5.10.1 libxml2-tools-2.9.14-150400.5.10.1 libxml2-tools-debuginfo-2.9.14-150400.5.10.1 python3-libxml2-2.9.14-150400.5.10.1 python3-libxml2-debuginfo-2.9.14-150400.5.10.1 - openSUSE Leap 15.4 (x86_64): libxml2-2-32bit-2.9.14-150400.5.10.1 libxml2-2-32bit-debuginfo-2.9.14-150400.5.10.1 libxml2-devel-32bit-2.9.14-150400.5.10.1 - openSUSE Leap 15.4 (noarch): libxml2-doc-2.9.14-150400.5.10.1 - SUSE Linux Enterprise Module for Basesystem 15-SP4 (aarch64 ppc64le s390x x86_64): libxml2-2-2.9.14-150400.5.10.1 libxml2-2-debuginfo-2.9.14-150400.5.10.1 libxml2-debugsource-2.9.14-150400.5.10.1 libxml2-devel-2.9.14-150400.5.10.1 libxml2-tools-2.9.14-150400.5.10.1 libxml2-tools-debuginfo-2.9.14-150400.5.10.1 python3-libxml2-2.9.14-150400.5.10.1 python3-libxml2-debuginfo-2.9.14-150400.5.10.1 - SUSE Linux Enterprise Module for Basesystem 15-SP4 (x86_64): libxml2-2-32bit-2.9.14-150400.5.10.1 libxml2-2-32bit-debuginfo-2.9.14-150400.5.10.1 - SUSE Linux Enterprise Micro 5.3 (aarch64 s390x x86_64): libxml2-2-2.9.14-150400.5.10.1 libxml2-2-debuginfo-2.9.14-150400.5.10.1 libxml2-debugsource-2.9.14-150400.5.10.1 libxml2-python-debugsource-2.9.14-150400.5.10.1 libxml2-tools-2.9.14-150400.5.10.1 libxml2-tools-debuginfo-2.9.14-150400.5.10.1 python3-libxml2-2.9.14-150400.5.10.1 python3-libxml2-debuginfo-2.9.14-150400.5.10.1 References: https://www.suse.com/security/cve/CVE-2022-40303.html https://www.suse.com/security/cve/CVE-2022-40304.html https://bugzilla.suse.com/1204366 https://bugzilla.suse.com/1204367

1 0

SUSE-SU-2022:3690-1: important: Security update for tiff
by opensuse-security＠opensuse.org 21 Oct '22

21 Oct '22

SUSE Security Update: Security update for tiff ______________________________________________________________________________ Announcement ID: SUSE-SU-2022:3690-1 Rating: important References: #1201723 #1201971 #1202026 #1202466 #1202467 #1202468 #1202968 #1202971 #1202973 Cross-References: CVE-2022-0561 CVE-2022-2519 CVE-2022-2520 CVE-2022-2521 CVE-2022-2867 CVE-2022-2868 CVE-2022-2869 CVE-2022-34266 CVE-2022-34526 CVSS scores: CVE-2022-0561 (NVD) : 5.5 CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H CVE-2022-0561 (SUSE): 5.5 CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H CVE-2022-2519 (NVD) : 6.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H CVE-2022-2519 (SUSE): 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N CVE-2022-2520 (NVD) : 6.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H CVE-2022-2520 (SUSE): 6.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H CVE-2022-2521 (NVD) : 6.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H CVE-2022-2521 (SUSE): 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H CVE-2022-2867 (NVD) : 8.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H CVE-2022-2867 (SUSE): 3.3 CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:L CVE-2022-2868 (NVD) : 8.1 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:H CVE-2022-2868 (SUSE): 3.3 CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:L CVE-2022-2869 (NVD) : 8.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H CVE-2022-2869 (SUSE): 3.3 CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:L CVE-2022-34266 (NVD) : 5.5 CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H CVE-2022-34266 (SUSE): 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H CVE-2022-34526 (NVD) : 6.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H CVE-2022-34526 (SUSE): 7.8 CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H Affected Products: SUSE CaaS Platform 4.0 SUSE Enterprise Storage 6 SUSE Enterprise Storage 7 SUSE Linux Enterprise Desktop 15-SP3 SUSE Linux Enterprise Desktop 15-SP4 SUSE Linux Enterprise High Performance Computing 15-ESPOS SUSE Linux Enterprise High Performance Computing 15-LTSS SUSE Linux Enterprise High Performance Computing 15-SP1-ESPOS SUSE Linux Enterprise High Performance Computing 15-SP1-LTSS SUSE Linux Enterprise High Performance Computing 15-SP2-ESPOS SUSE Linux Enterprise High Performance Computing 15-SP2-LTSS SUSE Linux Enterprise High Performance Computing 15-SP3 SUSE Linux Enterprise High Performance Computing 15-SP4 SUSE Linux Enterprise Micro 5.2 SUSE Linux Enterprise Micro 5.3 SUSE Linux Enterprise Module for Basesystem 15-SP3 SUSE Linux Enterprise Module for Basesystem 15-SP4 SUSE Linux Enterprise Module for Desktop Applications 15-SP3 SUSE Linux Enterprise Module for Packagehub Subpackages 15-SP3 SUSE Linux Enterprise Module for Packagehub Subpackages 15-SP4 SUSE Linux Enterprise Server 15-LTSS SUSE Linux Enterprise Server 15-SP1-BCL SUSE Linux Enterprise Server 15-SP1-LTSS SUSE Linux Enterprise Server 15-SP2-BCL SUSE Linux Enterprise Server 15-SP2-LTSS SUSE Linux Enterprise Server 15-SP3 SUSE Linux Enterprise Server 15-SP4 SUSE Linux Enterprise Server for SAP 15 SUSE Linux Enterprise Server for SAP 15-SP1 SUSE Linux Enterprise Server for SAP 15-SP2 SUSE Linux Enterprise Server for SAP Applications 15-SP3 SUSE Linux Enterprise Server for SAP Applications 15-SP4 SUSE Linux Enterprise Storage 7.1 SUSE Manager Proxy 4.1 SUSE Manager Proxy 4.2 SUSE Manager Proxy 4.3 SUSE Manager Retail Branch Server 4.1 SUSE Manager Retail Branch Server 4.2 SUSE Manager Retail Branch Server 4.3 SUSE Manager Server 4.1 SUSE Manager Server 4.2 SUSE Manager Server 4.3 openSUSE Leap 15.3 openSUSE Leap 15.4 openSUSE Leap Micro 5.2 ______________________________________________________________________________ An update that fixes 9 vulnerabilities is now available. Description: This update for tiff fixes the following issues: - CVE-2022-2519: Fixed a double free in rotateImage() (bsc#1202968). - CVE-2022-2520: Fixed a assertion failure in rotateImage() (bsc#1202973). - CVE-2022-2521: Fixed invalid free in TIFFClose() (bsc#1202971). - CVE-2022-2867: Fixed out of bounds read and write in tiffcrop.c (bsc#1202466). - CVE-2022-2868: Fixed out of bounds read in reverseSamples16bits() (bsc#1202467). - CVE-2022-2869: Fixed out of bounds read and write in extractContigSamples8bits() (bsc#1202468). - CVE-2022-34526: Fixed stack overflow in the _TIFFVGetField function of Tiffsplit (bsc#1202026). Patch Instructions: To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap Micro 5.2: zypper in -t patch openSUSE-Leap-Micro-5.2-2022-3690=1 - openSUSE Leap 15.4: zypper in -t patch openSUSE-SLE-15.4-2022-3690=1 - openSUSE Leap 15.3: zypper in -t patch openSUSE-SLE-15.3-2022-3690=1 - SUSE Manager Server 4.1: zypper in -t patch SUSE-SLE-Product-SUSE-Manager-Server-4.1-2022-3690=1 - SUSE Manager Retail Branch Server 4.1: zypper in -t patch SUSE-SLE-Product-SUSE-Manager-Retail-Branch-Server-4.1-2022-3690=1 - SUSE Manager Proxy 4.1: zypper in -t patch SUSE-SLE-Product-SUSE-Manager-Proxy-4.1-2022-3690=1 - SUSE Linux Enterprise Server for SAP 15-SP2: zypper in -t patch SUSE-SLE-Product-SLES_SAP-15-SP2-2022-3690=1 - SUSE Linux Enterprise Server for SAP 15-SP1: zypper in -t patch SUSE-SLE-Product-SLES_SAP-15-SP1-2022-3690=1 - SUSE Linux Enterprise Server for SAP 15: zypper in -t patch SUSE-SLE-Product-SLES_SAP-15-2022-3690=1 - SUSE Linux Enterprise Server 15-SP2-LTSS: zypper in -t patch SUSE-SLE-Product-SLES-15-SP2-LTSS-2022-3690=1 - SUSE Linux Enterprise Server 15-SP2-BCL: zypper in -t patch SUSE-SLE-Product-SLES-15-SP2-BCL-2022-3690=1 - SUSE Linux Enterprise Server 15-SP1-LTSS: zypper in -t patch SUSE-SLE-Product-SLES-15-SP1-LTSS-2022-3690=1 - SUSE Linux Enterprise Server 15-SP1-BCL: zypper in -t patch SUSE-SLE-Product-SLES-15-SP1-BCL-2022-3690=1 - SUSE Linux Enterprise Server 15-LTSS: zypper in -t patch SUSE-SLE-Product-SLES-15-2022-3690=1 - SUSE Linux Enterprise Module for Packagehub Subpackages 15-SP4: zypper in -t patch SUSE-SLE-Module-Packagehub-Subpackages-15-SP4-2022-3690=1 - SUSE Linux Enterprise Module for Packagehub Subpackages 15-SP3: zypper in -t patch SUSE-SLE-Module-Packagehub-Subpackages-15-SP3-2022-3690=1 - SUSE Linux Enterprise Module for Desktop Applications 15-SP3: zypper in -t patch SUSE-SLE-Module-Desktop-Applications-15-SP3-2022-3690=1 - SUSE Linux Enterprise Module for Basesystem 15-SP4: zypper in -t patch SUSE-SLE-Module-Basesystem-15-SP4-2022-3690=1 - SUSE Linux Enterprise Module for Basesystem 15-SP3: zypper in -t patch SUSE-SLE-Module-Basesystem-15-SP3-2022-3690=1 - SUSE Linux Enterprise Micro 5.3: zypper in -t patch SUSE-SLE-Micro-5.3-2022-3690=1 - SUSE Linux Enterprise Micro 5.2: zypper in -t patch SUSE-SUSE-MicroOS-5.2-2022-3690=1 - SUSE Linux Enterprise High Performance Computing 15-SP2-LTSS: zypper in -t patch SUSE-SLE-Product-HPC-15-SP2-LTSS-2022-3690=1 - SUSE Linux Enterprise High Performance Computing 15-SP2-ESPOS: zypper in -t patch SUSE-SLE-Product-HPC-15-SP2-ESPOS-2022-3690=1 - SUSE Linux Enterprise High Performance Computing 15-SP1-LTSS: zypper in -t patch SUSE-SLE-Product-HPC-15-SP1-LTSS-2022-3690=1 - SUSE Linux Enterprise High Performance Computing 15-SP1-ESPOS: zypper in -t patch SUSE-SLE-Product-HPC-15-SP1-ESPOS-2022-3690=1 - SUSE Linux Enterprise High Performance Computing 15-LTSS: zypper in -t patch SUSE-SLE-Product-HPC-15-2022-3690=1 - SUSE Linux Enterprise High Performance Computing 15-ESPOS: zypper in -t patch SUSE-SLE-Product-HPC-15-2022-3690=1 - SUSE Enterprise Storage 7: zypper in -t patch SUSE-Storage-7-2022-3690=1 - SUSE Enterprise Storage 6: zypper in -t patch SUSE-Storage-6-2022-3690=1 - SUSE CaaS Platform 4.0: To install this update, use the SUSE CaaS Platform 'skuba' tool. It will inform you if it detects new updates and let you then trigger updating of the complete cluster in a controlled way. Package List: - openSUSE Leap Micro 5.2 (aarch64 x86_64): libtiff5-4.0.9-150000.45.16.1 libtiff5-debuginfo-4.0.9-150000.45.16.1 tiff-debuginfo-4.0.9-150000.45.16.1 tiff-debugsource-4.0.9-150000.45.16.1 - openSUSE Leap 15.4 (aarch64 ppc64le s390x x86_64): libtiff-devel-4.0.9-150000.45.16.1 libtiff5-4.0.9-150000.45.16.1 libtiff5-debuginfo-4.0.9-150000.45.16.1 tiff-4.0.9-150000.45.16.1 tiff-debuginfo-4.0.9-150000.45.16.1 tiff-debugsource-4.0.9-150000.45.16.1 - openSUSE Leap 15.4 (x86_64): libtiff-devel-32bit-4.0.9-150000.45.16.1 libtiff5-32bit-4.0.9-150000.45.16.1 libtiff5-32bit-debuginfo-4.0.9-150000.45.16.1 - openSUSE Leap 15.3 (aarch64 ppc64le s390x x86_64): libtiff-devel-4.0.9-150000.45.16.1 libtiff5-4.0.9-150000.45.16.1 libtiff5-debuginfo-4.0.9-150000.45.16.1 tiff-4.0.9-150000.45.16.1 tiff-debuginfo-4.0.9-150000.45.16.1 tiff-debugsource-4.0.9-150000.45.16.1 - openSUSE Leap 15.3 (x86_64): libtiff-devel-32bit-4.0.9-150000.45.16.1 libtiff5-32bit-4.0.9-150000.45.16.1 libtiff5-32bit-debuginfo-4.0.9-150000.45.16.1 - SUSE Manager Server 4.1 (ppc64le s390x x86_64): libtiff-devel-4.0.9-150000.45.16.1 libtiff5-4.0.9-150000.45.16.1 libtiff5-debuginfo-4.0.9-150000.45.16.1 tiff-debuginfo-4.0.9-150000.45.16.1 tiff-debugsource-4.0.9-150000.45.16.1 - SUSE Manager Server 4.1 (x86_64): libtiff5-32bit-4.0.9-150000.45.16.1 libtiff5-32bit-debuginfo-4.0.9-150000.45.16.1 - SUSE Manager Retail Branch Server 4.1 (x86_64): libtiff-devel-4.0.9-150000.45.16.1 libtiff5-32bit-4.0.9-150000.45.16.1 libtiff5-32bit-debuginfo-4.0.9-150000.45.16.1 libtiff5-4.0.9-150000.45.16.1 libtiff5-debuginfo-4.0.9-150000.45.16.1 tiff-debuginfo-4.0.9-150000.45.16.1 tiff-debugsource-4.0.9-150000.45.16.1 - SUSE Manager Proxy 4.1 (x86_64): libtiff-devel-4.0.9-150000.45.16.1 libtiff5-32bit-4.0.9-150000.45.16.1 libtiff5-32bit-debuginfo-4.0.9-150000.45.16.1 libtiff5-4.0.9-150000.45.16.1 libtiff5-debuginfo-4.0.9-150000.45.16.1 tiff-debuginfo-4.0.9-150000.45.16.1 tiff-debugsource-4.0.9-150000.45.16.1 - SUSE Linux Enterprise Server for SAP 15-SP2 (ppc64le x86_64): libtiff-devel-4.0.9-150000.45.16.1 libtiff5-4.0.9-150000.45.16.1 libtiff5-debuginfo-4.0.9-150000.45.16.1 tiff-debuginfo-4.0.9-150000.45.16.1 tiff-debugsource-4.0.9-150000.45.16.1 - SUSE Linux Enterprise Server for SAP 15-SP2 (x86_64): libtiff5-32bit-4.0.9-150000.45.16.1 libtiff5-32bit-debuginfo-4.0.9-150000.45.16.1 - SUSE Linux Enterprise Server for SAP 15-SP1 (ppc64le x86_64): libtiff-devel-4.0.9-150000.45.16.1 libtiff5-4.0.9-150000.45.16.1 libtiff5-debuginfo-4.0.9-150000.45.16.1 tiff-debuginfo-4.0.9-150000.45.16.1 tiff-debugsource-4.0.9-150000.45.16.1 - SUSE Linux Enterprise Server for SAP 15-SP1 (x86_64): libtiff5-32bit-4.0.9-150000.45.16.1 libtiff5-32bit-debuginfo-4.0.9-150000.45.16.1 - SUSE Linux Enterprise Server for SAP 15 (ppc64le x86_64): libtiff-devel-4.0.9-150000.45.16.1 libtiff5-4.0.9-150000.45.16.1 libtiff5-debuginfo-4.0.9-150000.45.16.1 tiff-debuginfo-4.0.9-150000.45.16.1 tiff-debugsource-4.0.9-150000.45.16.1 - SUSE Linux Enterprise Server for SAP 15 (x86_64): libtiff5-32bit-4.0.9-150000.45.16.1 libtiff5-32bit-debuginfo-4.0.9-150000.45.16.1 - SUSE Linux Enterprise Server 15-SP2-LTSS (aarch64 ppc64le s390x x86_64): libtiff-devel-4.0.9-150000.45.16.1 libtiff5-4.0.9-150000.45.16.1 libtiff5-debuginfo-4.0.9-150000.45.16.1 tiff-debuginfo-4.0.9-150000.45.16.1 tiff-debugsource-4.0.9-150000.45.16.1 - SUSE Linux Enterprise Server 15-SP2-LTSS (x86_64): libtiff5-32bit-4.0.9-150000.45.16.1 libtiff5-32bit-debuginfo-4.0.9-150000.45.16.1 - SUSE Linux Enterprise Server 15-SP2-BCL (x86_64): libtiff-devel-4.0.9-150000.45.16.1 libtiff5-32bit-4.0.9-150000.45.16.1 libtiff5-32bit-debuginfo-4.0.9-150000.45.16.1 libtiff5-4.0.9-150000.45.16.1 libtiff5-debuginfo-4.0.9-150000.45.16.1 tiff-debuginfo-4.0.9-150000.45.16.1 tiff-debugsource-4.0.9-150000.45.16.1 - SUSE Linux Enterprise Server 15-SP1-LTSS (aarch64 ppc64le s390x x86_64): libtiff-devel-4.0.9-150000.45.16.1 libtiff5-4.0.9-150000.45.16.1 libtiff5-debuginfo-4.0.9-150000.45.16.1 tiff-debuginfo-4.0.9-150000.45.16.1 tiff-debugsource-4.0.9-150000.45.16.1 - SUSE Linux Enterprise Server 15-SP1-LTSS (x86_64): libtiff5-32bit-4.0.9-150000.45.16.1 libtiff5-32bit-debuginfo-4.0.9-150000.45.16.1 - SUSE Linux Enterprise Server 15-SP1-BCL (x86_64): libtiff-devel-4.0.9-150000.45.16.1 libtiff5-32bit-4.0.9-150000.45.16.1 libtiff5-32bit-debuginfo-4.0.9-150000.45.16.1 libtiff5-4.0.9-150000.45.16.1 libtiff5-debuginfo-4.0.9-150000.45.16.1 tiff-debuginfo-4.0.9-150000.45.16.1 tiff-debugsource-4.0.9-150000.45.16.1 - SUSE Linux Enterprise Server 15-LTSS (aarch64 s390x): libtiff-devel-4.0.9-150000.45.16.1 libtiff5-4.0.9-150000.45.16.1 libtiff5-debuginfo-4.0.9-150000.45.16.1 tiff-debuginfo-4.0.9-150000.45.16.1 tiff-debugsource-4.0.9-150000.45.16.1 - SUSE Linux Enterprise Module for Packagehub Subpackages 15-SP4 (aarch64 ppc64le s390x x86_64): tiff-4.0.9-150000.45.16.1 tiff-debuginfo-4.0.9-150000.45.16.1 tiff-debugsource-4.0.9-150000.45.16.1 - SUSE Linux Enterprise Module for Packagehub Subpackages 15-SP3 (aarch64 ppc64le s390x x86_64): tiff-4.0.9-150000.45.16.1 tiff-debuginfo-4.0.9-150000.45.16.1 tiff-debugsource-4.0.9-150000.45.16.1 - SUSE Linux Enterprise Module for Packagehub Subpackages 15-SP3 (x86_64): libtiff5-32bit-4.0.9-150000.45.16.1 libtiff5-32bit-debuginfo-4.0.9-150000.45.16.1 - SUSE Linux Enterprise Module for Desktop Applications 15-SP3 (x86_64): libtiff5-32bit-4.0.9-150000.45.16.1 libtiff5-32bit-debuginfo-4.0.9-150000.45.16.1 tiff-debugsource-4.0.9-150000.45.16.1 - SUSE Linux Enterprise Module for Basesystem 15-SP4 (aarch64 ppc64le s390x x86_64): libtiff-devel-4.0.9-150000.45.16.1 libtiff5-4.0.9-150000.45.16.1 libtiff5-debuginfo-4.0.9-150000.45.16.1 tiff-debuginfo-4.0.9-150000.45.16.1 tiff-debugsource-4.0.9-150000.45.16.1 - SUSE Linux Enterprise Module for Basesystem 15-SP4 (x86_64): libtiff5-32bit-4.0.9-150000.45.16.1 libtiff5-32bit-debuginfo-4.0.9-150000.45.16.1 - SUSE Linux Enterprise Module for Basesystem 15-SP3 (aarch64 ppc64le s390x x86_64): libtiff-devel-4.0.9-150000.45.16.1 libtiff5-4.0.9-150000.45.16.1 libtiff5-debuginfo-4.0.9-150000.45.16.1 tiff-debuginfo-4.0.9-150000.45.16.1 tiff-debugsource-4.0.9-150000.45.16.1 - SUSE Linux Enterprise Micro 5.3 (aarch64 s390x x86_64): libtiff5-4.0.9-150000.45.16.1 libtiff5-debuginfo-4.0.9-150000.45.16.1 tiff-debuginfo-4.0.9-150000.45.16.1 tiff-debugsource-4.0.9-150000.45.16.1 - SUSE Linux Enterprise Micro 5.2 (aarch64 s390x x86_64): libtiff5-4.0.9-150000.45.16.1 libtiff5-debuginfo-4.0.9-150000.45.16.1 tiff-debuginfo-4.0.9-150000.45.16.1 tiff-debugsource-4.0.9-150000.45.16.1 - SUSE Linux Enterprise High Performance Computing 15-SP2-LTSS (aarch64 x86_64): libtiff-devel-4.0.9-150000.45.16.1 libtiff5-4.0.9-150000.45.16.1 libtiff5-debuginfo-4.0.9-150000.45.16.1 tiff-debuginfo-4.0.9-150000.45.16.1 tiff-debugsource-4.0.9-150000.45.16.1 - SUSE Linux Enterprise High Performance Computing 15-SP2-LTSS (x86_64): libtiff5-32bit-4.0.9-150000.45.16.1 libtiff5-32bit-debuginfo-4.0.9-150000.45.16.1 - SUSE Linux Enterprise High Performance Computing 15-SP2-ESPOS (aarch64 x86_64): libtiff-devel-4.0.9-150000.45.16.1 libtiff5-4.0.9-150000.45.16.1 libtiff5-debuginfo-4.0.9-150000.45.16.1 tiff-debuginfo-4.0.9-150000.45.16.1 tiff-debugsource-4.0.9-150000.45.16.1 - SUSE Linux Enterprise High Performance Computing 15-SP2-ESPOS (x86_64): libtiff5-32bit-4.0.9-150000.45.16.1 libtiff5-32bit-debuginfo-4.0.9-150000.45.16.1 - SUSE Linux Enterprise High Performance Computing 15-SP1-LTSS (aarch64 x86_64): libtiff-devel-4.0.9-150000.45.16.1 libtiff5-4.0.9-150000.45.16.1 libtiff5-debuginfo-4.0.9-150000.45.16.1 tiff-debuginfo-4.0.9-150000.45.16.1 tiff-debugsource-4.0.9-150000.45.16.1 - SUSE Linux Enterprise High Performance Computing 15-SP1-LTSS (x86_64): libtiff5-32bit-4.0.9-150000.45.16.1 libtiff5-32bit-debuginfo-4.0.9-150000.45.16.1 - SUSE Linux Enterprise High Performance Computing 15-SP1-ESPOS (aarch64 x86_64): libtiff-devel-4.0.9-150000.45.16.1 libtiff5-4.0.9-150000.45.16.1 libtiff5-debuginfo-4.0.9-150000.45.16.1 tiff-debuginfo-4.0.9-150000.45.16.1 tiff-debugsource-4.0.9-150000.45.16.1 - SUSE Linux Enterprise High Performance Computing 15-SP1-ESPOS (x86_64): libtiff5-32bit-4.0.9-150000.45.16.1 libtiff5-32bit-debuginfo-4.0.9-150000.45.16.1 - SUSE Linux Enterprise High Performance Computing 15-LTSS (aarch64 x86_64): libtiff-devel-4.0.9-150000.45.16.1 libtiff5-4.0.9-150000.45.16.1 libtiff5-debuginfo-4.0.9-150000.45.16.1 tiff-debuginfo-4.0.9-150000.45.16.1 tiff-debugsource-4.0.9-150000.45.16.1 - SUSE Linux Enterprise High Performance Computing 15-LTSS (x86_64): libtiff5-32bit-4.0.9-150000.45.16.1 libtiff5-32bit-debuginfo-4.0.9-150000.45.16.1 - SUSE Linux Enterprise High Performance Computing 15-ESPOS (aarch64 x86_64): libtiff-devel-4.0.9-150000.45.16.1 libtiff5-4.0.9-150000.45.16.1 libtiff5-debuginfo-4.0.9-150000.45.16.1 tiff-debuginfo-4.0.9-150000.45.16.1 tiff-debugsource-4.0.9-150000.45.16.1 - SUSE Linux Enterprise High Performance Computing 15-ESPOS (x86_64): libtiff5-32bit-4.0.9-150000.45.16.1 libtiff5-32bit-debuginfo-4.0.9-150000.45.16.1 - SUSE Enterprise Storage 7 (aarch64 x86_64): libtiff-devel-4.0.9-150000.45.16.1 libtiff5-4.0.9-150000.45.16.1 libtiff5-debuginfo-4.0.9-150000.45.16.1 tiff-debuginfo-4.0.9-150000.45.16.1 tiff-debugsource-4.0.9-150000.45.16.1 - SUSE Enterprise Storage 7 (x86_64): libtiff5-32bit-4.0.9-150000.45.16.1 libtiff5-32bit-debuginfo-4.0.9-150000.45.16.1 - SUSE Enterprise Storage 6 (aarch64 x86_64): libtiff-devel-4.0.9-150000.45.16.1 libtiff5-4.0.9-150000.45.16.1 libtiff5-debuginfo-4.0.9-150000.45.16.1 tiff-debuginfo-4.0.9-150000.45.16.1 tiff-debugsource-4.0.9-150000.45.16.1 - SUSE Enterprise Storage 6 (x86_64): libtiff5-32bit-4.0.9-150000.45.16.1 libtiff5-32bit-debuginfo-4.0.9-150000.45.16.1 - SUSE CaaS Platform 4.0 (x86_64): libtiff-devel-4.0.9-150000.45.16.1 libtiff5-32bit-4.0.9-150000.45.16.1 libtiff5-32bit-debuginfo-4.0.9-150000.45.16.1 libtiff5-4.0.9-150000.45.16.1 libtiff5-debuginfo-4.0.9-150000.45.16.1 tiff-debuginfo-4.0.9-150000.45.16.1 tiff-debugsource-4.0.9-150000.45.16.1 References: https://www.suse.com/security/cve/CVE-2022-0561.html https://www.suse.com/security/cve/CVE-2022-2519.html https://www.suse.com/security/cve/CVE-2022-2520.html https://www.suse.com/security/cve/CVE-2022-2521.html https://www.suse.com/security/cve/CVE-2022-2867.html https://www.suse.com/security/cve/CVE-2022-2868.html https://www.suse.com/security/cve/CVE-2022-2869.html https://www.suse.com/security/cve/CVE-2022-34266.html https://www.suse.com/security/cve/CVE-2022-34526.html https://bugzilla.suse.com/1201723 https://bugzilla.suse.com/1201971 https://bugzilla.suse.com/1202026 https://bugzilla.suse.com/1202466 https://bugzilla.suse.com/1202467 https://bugzilla.suse.com/1202468 https://bugzilla.suse.com/1202968 https://bugzilla.suse.com/1202971 https://bugzilla.suse.com/1202973

1 0

SUSE-SU-2022:3682-1: important: Security update for bind
by opensuse-security＠opensuse.org 21 Oct '22

21 Oct '22

SUSE Security Update: Security update for bind ______________________________________________________________________________ Announcement ID: SUSE-SU-2022:3682-1 Rating: important References: #1201247 #1203614 #1203619 #1203620 Cross-References: CVE-2022-2795 CVE-2022-38177 CVE-2022-38178 CVSS scores: CVE-2022-2795 (NVD) : 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H CVE-2022-2795 (SUSE): 5.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L CVE-2022-38177 (NVD) : 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H CVE-2022-38177 (SUSE): 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H CVE-2022-38178 (NVD) : 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H CVE-2022-38178 (SUSE): 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H Affected Products: SUSE Linux Enterprise Desktop 15-SP3 SUSE Linux Enterprise Desktop 15-SP4 SUSE Linux Enterprise High Performance Computing 15-SP3 SUSE Linux Enterprise High Performance Computing 15-SP4 SUSE Linux Enterprise Module for Basesystem 15-SP3 SUSE Linux Enterprise Module for Basesystem 15-SP4 SUSE Linux Enterprise Module for Server Applications 15-SP3 SUSE Linux Enterprise Server 15-SP3 SUSE Linux Enterprise Server 15-SP4 SUSE Linux Enterprise Server for SAP Applications 15-SP3 SUSE Linux Enterprise Server for SAP Applications 15-SP4 SUSE Linux Enterprise Storage 7.1 SUSE Manager Proxy 4.2 SUSE Manager Proxy 4.3 SUSE Manager Retail Branch Server 4.2 SUSE Manager Retail Branch Server 4.3 SUSE Manager Server 4.2 SUSE Manager Server 4.3 openSUSE Leap 15.3 openSUSE Leap 15.4 ______________________________________________________________________________ An update that solves three vulnerabilities and has one errata is now available. Description: This update for bind fixes the following issues: - CVE-2022-2795: Fixed potential performance degredation due to missing database lookup limits when processing large delegations (bsc#1203614). - CVE-2022-38177: Fixed a memory leak that could be externally triggered in the DNSSEC verification code for the ECDSA algorithm (bsc#1203619). - CVE-2022-38178: Fixed memory leaks that could be externally triggered in the DNSSEC verification code for the EdDSA algorithm (bsc#1203620). Bugfixes: - Changed ownership of /var/lib/named/master from named:named to root:root (bsc#1201247) Patch Instructions: To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 15.4: zypper in -t patch openSUSE-SLE-15.4-2022-3682=1 - openSUSE Leap 15.3: zypper in -t patch openSUSE-SLE-15.3-2022-3682=1 - SUSE Linux Enterprise Module for Server Applications 15-SP3: zypper in -t patch SUSE-SLE-Module-Server-Applications-15-SP3-2022-3682=1 - SUSE Linux Enterprise Module for Basesystem 15-SP4: zypper in -t patch SUSE-SLE-Module-Basesystem-15-SP4-2022-3682=1 - SUSE Linux Enterprise Module for Basesystem 15-SP3: zypper in -t patch SUSE-SLE-Module-Basesystem-15-SP3-2022-3682=1 Package List: - openSUSE Leap 15.4 (aarch64 ppc64le s390x x86_64): bind-chrootenv-9.16.6-150300.22.21.2 bind-devel-9.16.6-150300.22.21.2 libbind9-1600-9.16.6-150300.22.21.2 libbind9-1600-debuginfo-9.16.6-150300.22.21.2 libdns1605-9.16.6-150300.22.21.2 libdns1605-debuginfo-9.16.6-150300.22.21.2 libirs-devel-9.16.6-150300.22.21.2 libirs1601-9.16.6-150300.22.21.2 libirs1601-debuginfo-9.16.6-150300.22.21.2 libisc1606-9.16.6-150300.22.21.2 libisc1606-debuginfo-9.16.6-150300.22.21.2 libisccc1600-9.16.6-150300.22.21.2 libisccc1600-debuginfo-9.16.6-150300.22.21.2 libisccfg1600-9.16.6-150300.22.21.2 libisccfg1600-debuginfo-9.16.6-150300.22.21.2 libns1604-9.16.6-150300.22.21.2 libns1604-debuginfo-9.16.6-150300.22.21.2 - openSUSE Leap 15.3 (aarch64 ppc64le s390x x86_64): bind-9.16.6-150300.22.21.2 bind-chrootenv-9.16.6-150300.22.21.2 bind-debuginfo-9.16.6-150300.22.21.2 bind-debugsource-9.16.6-150300.22.21.2 bind-devel-9.16.6-150300.22.21.2 bind-utils-9.16.6-150300.22.21.2 bind-utils-debuginfo-9.16.6-150300.22.21.2 libbind9-1600-9.16.6-150300.22.21.2 libbind9-1600-debuginfo-9.16.6-150300.22.21.2 libdns1605-9.16.6-150300.22.21.2 libdns1605-debuginfo-9.16.6-150300.22.21.2 libirs-devel-9.16.6-150300.22.21.2 libirs1601-9.16.6-150300.22.21.2 libirs1601-debuginfo-9.16.6-150300.22.21.2 libisc1606-9.16.6-150300.22.21.2 libisc1606-debuginfo-9.16.6-150300.22.21.2 libisccc1600-9.16.6-150300.22.21.2 libisccc1600-debuginfo-9.16.6-150300.22.21.2 libisccfg1600-9.16.6-150300.22.21.2 libisccfg1600-debuginfo-9.16.6-150300.22.21.2 libns1604-9.16.6-150300.22.21.2 libns1604-debuginfo-9.16.6-150300.22.21.2 - openSUSE Leap 15.3 (noarch): bind-doc-9.16.6-150300.22.21.2 python3-bind-9.16.6-150300.22.21.2 - SUSE Linux Enterprise Module for Server Applications 15-SP3 (aarch64 ppc64le s390x x86_64): bind-9.16.6-150300.22.21.2 bind-chrootenv-9.16.6-150300.22.21.2 bind-debuginfo-9.16.6-150300.22.21.2 bind-debugsource-9.16.6-150300.22.21.2 - SUSE Linux Enterprise Module for Server Applications 15-SP3 (noarch): bind-doc-9.16.6-150300.22.21.2 - SUSE Linux Enterprise Module for Basesystem 15-SP4 (aarch64 ppc64le s390x x86_64): bind-debuginfo-9.16.6-150300.22.21.2 bind-debugsource-9.16.6-150300.22.21.2 libbind9-1600-9.16.6-150300.22.21.2 libbind9-1600-debuginfo-9.16.6-150300.22.21.2 libdns1605-9.16.6-150300.22.21.2 libdns1605-debuginfo-9.16.6-150300.22.21.2 libirs1601-9.16.6-150300.22.21.2 libirs1601-debuginfo-9.16.6-150300.22.21.2 libisc1606-9.16.6-150300.22.21.2 libisc1606-debuginfo-9.16.6-150300.22.21.2 libisccc1600-9.16.6-150300.22.21.2 libisccc1600-debuginfo-9.16.6-150300.22.21.2 libisccfg1600-9.16.6-150300.22.21.2 libisccfg1600-debuginfo-9.16.6-150300.22.21.2 libns1604-9.16.6-150300.22.21.2 libns1604-debuginfo-9.16.6-150300.22.21.2 - SUSE Linux Enterprise Module for Basesystem 15-SP3 (aarch64 ppc64le s390x x86_64): bind-debuginfo-9.16.6-150300.22.21.2 bind-debugsource-9.16.6-150300.22.21.2 bind-devel-9.16.6-150300.22.21.2 bind-utils-9.16.6-150300.22.21.2 bind-utils-debuginfo-9.16.6-150300.22.21.2 libbind9-1600-9.16.6-150300.22.21.2 libbind9-1600-debuginfo-9.16.6-150300.22.21.2 libdns1605-9.16.6-150300.22.21.2 libdns1605-debuginfo-9.16.6-150300.22.21.2 libirs-devel-9.16.6-150300.22.21.2 libirs1601-9.16.6-150300.22.21.2 libirs1601-debuginfo-9.16.6-150300.22.21.2 libisc1606-9.16.6-150300.22.21.2 libisc1606-debuginfo-9.16.6-150300.22.21.2 libisccc1600-9.16.6-150300.22.21.2 libisccc1600-debuginfo-9.16.6-150300.22.21.2 libisccfg1600-9.16.6-150300.22.21.2 libisccfg1600-debuginfo-9.16.6-150300.22.21.2 libns1604-9.16.6-150300.22.21.2 libns1604-debuginfo-9.16.6-150300.22.21.2 - SUSE Linux Enterprise Module for Basesystem 15-SP3 (noarch): python3-bind-9.16.6-150300.22.21.2 References: https://www.suse.com/security/cve/CVE-2022-2795.html https://www.suse.com/security/cve/CVE-2022-38177.html https://www.suse.com/security/cve/CVE-2022-38178.html https://bugzilla.suse.com/1201247 https://bugzilla.suse.com/1203614 https://bugzilla.suse.com/1203619 https://bugzilla.suse.com/1203620

1 0

SUSE-SU-2022:3683-1: critical: Security update for libksba
by opensuse-security＠opensuse.org 21 Oct '22

21 Oct '22

SUSE Security Update: Security update for libksba ______________________________________________________________________________ Announcement ID: SUSE-SU-2022:3683-1 Rating: critical References: #1204357 Cross-References: CVE-2022-3515 CVSS scores: CVE-2022-3515 (SUSE): 9.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H Affected Products: SUSE CaaS Platform 4.0 SUSE Enterprise Storage 6 SUSE Enterprise Storage 7 SUSE Linux Enterprise Desktop 15-SP3 SUSE Linux Enterprise Desktop 15-SP4 SUSE Linux Enterprise High Performance Computing 15-ESPOS SUSE Linux Enterprise High Performance Computing 15-LTSS SUSE Linux Enterprise High Performance Computing 15-SP1-ESPOS SUSE Linux Enterprise High Performance Computing 15-SP1-LTSS SUSE Linux Enterprise High Performance Computing 15-SP2-ESPOS SUSE Linux Enterprise High Performance Computing 15-SP2-LTSS SUSE Linux Enterprise High Performance Computing 15-SP3 SUSE Linux Enterprise High Performance Computing 15-SP4 SUSE Linux Enterprise Micro 5.1 SUSE Linux Enterprise Micro 5.2 SUSE Linux Enterprise Micro 5.3 SUSE Linux Enterprise Module for Basesystem 15-SP3 SUSE Linux Enterprise Module for Basesystem 15-SP4 SUSE Linux Enterprise Server 15-LTSS SUSE Linux Enterprise Server 15-SP1-BCL SUSE Linux Enterprise Server 15-SP1-LTSS SUSE Linux Enterprise Server 15-SP2-BCL SUSE Linux Enterprise Server 15-SP2-LTSS SUSE Linux Enterprise Server 15-SP3 SUSE Linux Enterprise Server 15-SP4 SUSE Linux Enterprise Server for SAP 15 SUSE Linux Enterprise Server for SAP 15-SP1 SUSE Linux Enterprise Server for SAP 15-SP2 SUSE Linux Enterprise Server for SAP Applications 15-SP3 SUSE Linux Enterprise Server for SAP Applications 15-SP4 SUSE Linux Enterprise Storage 7.1 SUSE Manager Proxy 4.1 SUSE Manager Proxy 4.2 SUSE Manager Proxy 4.3 SUSE Manager Retail Branch Server 4.1 SUSE Manager Retail Branch Server 4.2 SUSE Manager Retail Branch Server 4.3 SUSE Manager Server 4.1 SUSE Manager Server 4.2 SUSE Manager Server 4.3 openSUSE Leap 15.3 openSUSE Leap 15.4 openSUSE Leap Micro 5.2 ______________________________________________________________________________ An update that fixes one vulnerability is now available. Description: This update for libksba fixes the following issues: - CVE-2022-3515: Fixed a possible overflow in the TLV parser (bsc#1204357). Patch Instructions: To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap Micro 5.2: zypper in -t patch openSUSE-Leap-Micro-5.2-2022-3683=1 - openSUSE Leap 15.4: zypper in -t patch openSUSE-SLE-15.4-2022-3683=1 - openSUSE Leap 15.3: zypper in -t patch openSUSE-SLE-15.3-2022-3683=1 - SUSE Manager Server 4.1: zypper in -t patch SUSE-SLE-Product-SUSE-Manager-Server-4.1-2022-3683=1 - SUSE Manager Retail Branch Server 4.1: zypper in -t patch SUSE-SLE-Product-SUSE-Manager-Retail-Branch-Server-4.1-2022-3683=1 - SUSE Manager Proxy 4.1: zypper in -t patch SUSE-SLE-Product-SUSE-Manager-Proxy-4.1-2022-3683=1 - SUSE Linux Enterprise Server for SAP 15-SP2: zypper in -t patch SUSE-SLE-Product-SLES_SAP-15-SP2-2022-3683=1 - SUSE Linux Enterprise Server for SAP 15-SP1: zypper in -t patch SUSE-SLE-Product-SLES_SAP-15-SP1-2022-3683=1 - SUSE Linux Enterprise Server for SAP 15: zypper in -t patch SUSE-SLE-Product-SLES_SAP-15-2022-3683=1 - SUSE Linux Enterprise Server 15-SP2-LTSS: zypper in -t patch SUSE-SLE-Product-SLES-15-SP2-LTSS-2022-3683=1 - SUSE Linux Enterprise Server 15-SP2-BCL: zypper in -t patch SUSE-SLE-Product-SLES-15-SP2-BCL-2022-3683=1 - SUSE Linux Enterprise Server 15-SP1-LTSS: zypper in -t patch SUSE-SLE-Product-SLES-15-SP1-LTSS-2022-3683=1 - SUSE Linux Enterprise Server 15-SP1-BCL: zypper in -t patch SUSE-SLE-Product-SLES-15-SP1-BCL-2022-3683=1 - SUSE Linux Enterprise Server 15-LTSS: zypper in -t patch SUSE-SLE-Product-SLES-15-2022-3683=1 - SUSE Linux Enterprise Module for Basesystem 15-SP4: zypper in -t patch SUSE-SLE-Module-Basesystem-15-SP4-2022-3683=1 - SUSE Linux Enterprise Module for Basesystem 15-SP3: zypper in -t patch SUSE-SLE-Module-Basesystem-15-SP3-2022-3683=1 - SUSE Linux Enterprise Micro 5.3: zypper in -t patch SUSE-SLE-Micro-5.3-2022-3683=1 - SUSE Linux Enterprise Micro 5.2: zypper in -t patch SUSE-SUSE-MicroOS-5.2-2022-3683=1 - SUSE Linux Enterprise Micro 5.1: zypper in -t patch SUSE-SUSE-MicroOS-5.1-2022-3683=1 - SUSE Linux Enterprise High Performance Computing 15-SP2-LTSS: zypper in -t patch SUSE-SLE-Product-HPC-15-SP2-LTSS-2022-3683=1 - SUSE Linux Enterprise High Performance Computing 15-SP2-ESPOS: zypper in -t patch SUSE-SLE-Product-HPC-15-SP2-ESPOS-2022-3683=1 - SUSE Linux Enterprise High Performance Computing 15-SP1-LTSS: zypper in -t patch SUSE-SLE-Product-HPC-15-SP1-LTSS-2022-3683=1 - SUSE Linux Enterprise High Performance Computing 15-SP1-ESPOS: zypper in -t patch SUSE-SLE-Product-HPC-15-SP1-ESPOS-2022-3683=1 - SUSE Linux Enterprise High Performance Computing 15-LTSS: zypper in -t patch SUSE-SLE-Product-HPC-15-2022-3683=1 - SUSE Linux Enterprise High Performance Computing 15-ESPOS: zypper in -t patch SUSE-SLE-Product-HPC-15-2022-3683=1 - SUSE Enterprise Storage 7: zypper in -t patch SUSE-Storage-7-2022-3683=1 - SUSE Enterprise Storage 6: zypper in -t patch SUSE-Storage-6-2022-3683=1 - SUSE CaaS Platform 4.0: To install this update, use the SUSE CaaS Platform 'skuba' tool. It will inform you if it detects new updates and let you then trigger updating of the complete cluster in a controlled way. Package List: - openSUSE Leap Micro 5.2 (aarch64 x86_64): libksba-debugsource-1.3.5-150000.4.3.1 libksba8-1.3.5-150000.4.3.1 libksba8-debuginfo-1.3.5-150000.4.3.1 - openSUSE Leap 15.4 (aarch64 ppc64le s390x x86_64): libksba-debugsource-1.3.5-150000.4.3.1 libksba-devel-1.3.5-150000.4.3.1 libksba8-1.3.5-150000.4.3.1 libksba8-debuginfo-1.3.5-150000.4.3.1 - openSUSE Leap 15.3 (aarch64 ppc64le s390x x86_64): libksba-debugsource-1.3.5-150000.4.3.1 libksba-devel-1.3.5-150000.4.3.1 libksba8-1.3.5-150000.4.3.1 libksba8-debuginfo-1.3.5-150000.4.3.1 - SUSE Manager Server 4.1 (ppc64le s390x x86_64): libksba-debugsource-1.3.5-150000.4.3.1 libksba-devel-1.3.5-150000.4.3.1 libksba8-1.3.5-150000.4.3.1 libksba8-debuginfo-1.3.5-150000.4.3.1 - SUSE Manager Retail Branch Server 4.1 (x86_64): libksba-debugsource-1.3.5-150000.4.3.1 libksba-devel-1.3.5-150000.4.3.1 libksba8-1.3.5-150000.4.3.1 libksba8-debuginfo-1.3.5-150000.4.3.1 - SUSE Manager Proxy 4.1 (x86_64): libksba-debugsource-1.3.5-150000.4.3.1 libksba-devel-1.3.5-150000.4.3.1 libksba8-1.3.5-150000.4.3.1 libksba8-debuginfo-1.3.5-150000.4.3.1 - SUSE Linux Enterprise Server for SAP 15-SP2 (ppc64le x86_64): libksba-debugsource-1.3.5-150000.4.3.1 libksba-devel-1.3.5-150000.4.3.1 libksba8-1.3.5-150000.4.3.1 libksba8-debuginfo-1.3.5-150000.4.3.1 - SUSE Linux Enterprise Server for SAP 15-SP1 (ppc64le x86_64): libksba-debugsource-1.3.5-150000.4.3.1 libksba-devel-1.3.5-150000.4.3.1 libksba8-1.3.5-150000.4.3.1 libksba8-debuginfo-1.3.5-150000.4.3.1 - SUSE Linux Enterprise Server for SAP 15 (ppc64le x86_64): libksba-debugsource-1.3.5-150000.4.3.1 libksba-devel-1.3.5-150000.4.3.1 libksba8-1.3.5-150000.4.3.1 libksba8-debuginfo-1.3.5-150000.4.3.1 - SUSE Linux Enterprise Server 15-SP2-LTSS (aarch64 ppc64le s390x x86_64): libksba-debugsource-1.3.5-150000.4.3.1 libksba-devel-1.3.5-150000.4.3.1 libksba8-1.3.5-150000.4.3.1 libksba8-debuginfo-1.3.5-150000.4.3.1 - SUSE Linux Enterprise Server 15-SP2-BCL (x86_64): libksba-debugsource-1.3.5-150000.4.3.1 libksba-devel-1.3.5-150000.4.3.1 libksba8-1.3.5-150000.4.3.1 libksba8-debuginfo-1.3.5-150000.4.3.1 - SUSE Linux Enterprise Server 15-SP1-LTSS (aarch64 ppc64le s390x x86_64): libksba-debugsource-1.3.5-150000.4.3.1 libksba-devel-1.3.5-150000.4.3.1 libksba8-1.3.5-150000.4.3.1 libksba8-debuginfo-1.3.5-150000.4.3.1 - SUSE Linux Enterprise Server 15-SP1-BCL (x86_64): libksba-debugsource-1.3.5-150000.4.3.1 libksba-devel-1.3.5-150000.4.3.1 libksba8-1.3.5-150000.4.3.1 libksba8-debuginfo-1.3.5-150000.4.3.1 - SUSE Linux Enterprise Server 15-LTSS (aarch64 s390x): libksba-debugsource-1.3.5-150000.4.3.1 libksba-devel-1.3.5-150000.4.3.1 libksba8-1.3.5-150000.4.3.1 libksba8-debuginfo-1.3.5-150000.4.3.1 - SUSE Linux Enterprise Module for Basesystem 15-SP4 (aarch64 ppc64le s390x x86_64): libksba-debugsource-1.3.5-150000.4.3.1 libksba-devel-1.3.5-150000.4.3.1 libksba8-1.3.5-150000.4.3.1 libksba8-debuginfo-1.3.5-150000.4.3.1 - SUSE Linux Enterprise Module for Basesystem 15-SP3 (aarch64 ppc64le s390x x86_64): libksba-debugsource-1.3.5-150000.4.3.1 libksba-devel-1.3.5-150000.4.3.1 libksba8-1.3.5-150000.4.3.1 libksba8-debuginfo-1.3.5-150000.4.3.1 - SUSE Linux Enterprise Micro 5.3 (aarch64 s390x x86_64): libksba-debugsource-1.3.5-150000.4.3.1 libksba8-1.3.5-150000.4.3.1 libksba8-debuginfo-1.3.5-150000.4.3.1 - SUSE Linux Enterprise Micro 5.2 (aarch64 s390x x86_64): libksba-debugsource-1.3.5-150000.4.3.1 libksba8-1.3.5-150000.4.3.1 libksba8-debuginfo-1.3.5-150000.4.3.1 - SUSE Linux Enterprise Micro 5.1 (aarch64 s390x x86_64): libksba-debugsource-1.3.5-150000.4.3.1 libksba8-1.3.5-150000.4.3.1 libksba8-debuginfo-1.3.5-150000.4.3.1 - SUSE Linux Enterprise High Performance Computing 15-SP2-LTSS (aarch64 x86_64): libksba-debugsource-1.3.5-150000.4.3.1 libksba-devel-1.3.5-150000.4.3.1 libksba8-1.3.5-150000.4.3.1 libksba8-debuginfo-1.3.5-150000.4.3.1 - SUSE Linux Enterprise High Performance Computing 15-SP2-ESPOS (aarch64 x86_64): libksba-debugsource-1.3.5-150000.4.3.1 libksba-devel-1.3.5-150000.4.3.1 libksba8-1.3.5-150000.4.3.1 libksba8-debuginfo-1.3.5-150000.4.3.1 - SUSE Linux Enterprise High Performance Computing 15-SP1-LTSS (aarch64 x86_64): libksba-debugsource-1.3.5-150000.4.3.1 libksba-devel-1.3.5-150000.4.3.1 libksba8-1.3.5-150000.4.3.1 libksba8-debuginfo-1.3.5-150000.4.3.1 - SUSE Linux Enterprise High Performance Computing 15-SP1-ESPOS (aarch64 x86_64): libksba-debugsource-1.3.5-150000.4.3.1 libksba-devel-1.3.5-150000.4.3.1 libksba8-1.3.5-150000.4.3.1 libksba8-debuginfo-1.3.5-150000.4.3.1 - SUSE Linux Enterprise High Performance Computing 15-LTSS (aarch64 x86_64): libksba-debugsource-1.3.5-150000.4.3.1 libksba-devel-1.3.5-150000.4.3.1 libksba8-1.3.5-150000.4.3.1 libksba8-debuginfo-1.3.5-150000.4.3.1 - SUSE Linux Enterprise High Performance Computing 15-ESPOS (aarch64 x86_64): libksba-debugsource-1.3.5-150000.4.3.1 libksba-devel-1.3.5-150000.4.3.1 libksba8-1.3.5-150000.4.3.1 libksba8-debuginfo-1.3.5-150000.4.3.1 - SUSE Enterprise Storage 7 (aarch64 x86_64): libksba-debugsource-1.3.5-150000.4.3.1 libksba-devel-1.3.5-150000.4.3.1 libksba8-1.3.5-150000.4.3.1 libksba8-debuginfo-1.3.5-150000.4.3.1 - SUSE Enterprise Storage 6 (aarch64 x86_64): libksba-debugsource-1.3.5-150000.4.3.1 libksba-devel-1.3.5-150000.4.3.1 libksba8-1.3.5-150000.4.3.1 libksba8-debuginfo-1.3.5-150000.4.3.1 - SUSE CaaS Platform 4.0 (x86_64): libksba-debugsource-1.3.5-150000.4.3.1 libksba-devel-1.3.5-150000.4.3.1 libksba8-1.3.5-150000.4.3.1 libksba8-debuginfo-1.3.5-150000.4.3.1 References: https://www.suse.com/security/cve/CVE-2022-3515.html https://bugzilla.suse.com/1204357

1 0

openSUSE-SU-2022:10160-1: moderate: Security update for v4l2loopback
by opensuse-security＠opensuse.org 20 Oct '22

20 Oct '22

openSUSE Security Update: Security update for v4l2loopback ______________________________________________________________________________ Announcement ID: openSUSE-SU-2022:10160-1 Rating: moderate References: #1202156 Cross-References: CVE-2022-2652 CVSS scores: CVE-2022-2652 (NVD) : 6 CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:H CVE-2022-2652 (SUSE): 6 CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:H Affected Products: openSUSE Leap 15.3 ______________________________________________________________________________ An update that fixes one vulnerability is now available. Description: This update for v4l2loopback fixes the following issues: - Fix string format vulnerability (boo#1202156, CVE-2022-2652) Patch Instructions: To install this openSUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 15.3: zypper in -t patch openSUSE-2022-10160=1 Package List: - openSUSE Leap 15.3 (aarch64 x86_64): v4l2loopback-debugsource-0.12.5-lp153.2.5.1 v4l2loopback-kmp-default-0.12.5_k5.3.18_150300.59.93-lp153.2.5.1 v4l2loopback-kmp-default-debuginfo-0.12.5_k5.3.18_150300.59.93-lp153.2.5.1 v4l2loopback-kmp-preempt-0.12.5_k5.3.18_150300.59.93-lp153.2.5.1 v4l2loopback-kmp-preempt-debuginfo-0.12.5_k5.3.18_150300.59.93-lp153.2.5.1 - openSUSE Leap 15.3 (aarch64): v4l2loopback-kmp-64kb-0.12.5_k5.3.18_150300.59.93-lp153.2.5.1 v4l2loopback-kmp-64kb-debuginfo-0.12.5_k5.3.18_150300.59.93-lp153.2.5.1 - openSUSE Leap 15.3 (noarch): v4l2loopback-autoload-0.12.5-lp153.2.5.1 v4l2loopback-utils-0.12.5-lp153.2.5.1 References: https://www.suse.com/security/cve/CVE-2022-2652.html https://bugzilla.suse.com/1202156

1 0

openSUSE-SU-2022:10159-1: moderate: Security update for v4l2loopback
by opensuse-security＠opensuse.org 20 Oct '22

20 Oct '22

openSUSE Security Update: Security update for v4l2loopback ______________________________________________________________________________ Announcement ID: openSUSE-SU-2022:10159-1 Rating: moderate References: #1202156 Cross-References: CVE-2022-2652 CVSS scores: CVE-2022-2652 (NVD) : 6 CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:H CVE-2022-2652 (SUSE): 6 CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:H Affected Products: openSUSE Leap 15.4 ______________________________________________________________________________ An update that fixes one vulnerability is now available. Description: This update for v4l2loopback fixes the following issues: - Fix string format vulnerability (boo#1202156, CVE-2022-2652) Patch Instructions: To install this openSUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 15.4: zypper in -t patch openSUSE-2022-10159=1 Package List: - openSUSE Leap 15.4 (aarch64 x86_64): v4l2loopback-debugsource-0.12.5-lp154.3.3.1 v4l2loopback-kmp-default-0.12.5_k5.14.21_150400.24.21-lp154.3.3.1 v4l2loopback-kmp-default-debuginfo-0.12.5_k5.14.21_150400.24.21-lp154.3.3.1 - openSUSE Leap 15.4 (aarch64): v4l2loopback-kmp-64kb-0.12.5_k5.14.21_150400.24.21-lp154.3.3.1 v4l2loopback-kmp-64kb-debuginfo-0.12.5_k5.14.21_150400.24.21-lp154.3.3.1 - openSUSE Leap 15.4 (noarch): v4l2loopback-autoload-0.12.5-lp154.3.3.1 v4l2loopback-utils-0.12.5-lp154.3.3.1 References: https://www.suse.com/security/cve/CVE-2022-2652.html https://bugzilla.suse.com/1202156

1 0

SUSE-SU-2022:3673-1: moderate: Security update for jasper
by opensuse-security＠opensuse.org 20 Oct '22

20 Oct '22

SUSE Security Update: Security update for jasper ______________________________________________________________________________ Announcement ID: SUSE-SU-2022:3673-1 Rating: moderate References: #1202642 Cross-References: CVE-2022-2963 CVSS scores: CVE-2022-2963 (NVD) : 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H CVE-2022-2963 (SUSE): 6.2 CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H Affected Products: SUSE Linux Enterprise Desktop 15-SP3 SUSE Linux Enterprise Desktop 15-SP4 SUSE Linux Enterprise High Performance Computing 15-SP3 SUSE Linux Enterprise High Performance Computing 15-SP4 SUSE Linux Enterprise Module for Basesystem 15-SP3 SUSE Linux Enterprise Module for Basesystem 15-SP4 SUSE Linux Enterprise Module for Desktop Applications 15-SP3 SUSE Linux Enterprise Module for Desktop Applications 15-SP4 SUSE Linux Enterprise Server 15-SP3 SUSE Linux Enterprise Server 15-SP4 SUSE Linux Enterprise Server for SAP Applications 15-SP3 SUSE Linux Enterprise Server for SAP Applications 15-SP4 SUSE Linux Enterprise Storage 7.1 SUSE Manager Proxy 4.2 SUSE Manager Proxy 4.3 SUSE Manager Retail Branch Server 4.2 SUSE Manager Retail Branch Server 4.3 SUSE Manager Server 4.2 SUSE Manager Server 4.3 openSUSE Leap 15.3 openSUSE Leap 15.4 ______________________________________________________________________________ An update that fixes one vulnerability is now available. Description: This update for jasper fixes the following issues: - CVE-2022-2963: Fixed memory leaks in function cmdopts_parse (bsc#1202642). Patch Instructions: To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 15.4: zypper in -t patch openSUSE-SLE-15.4-2022-3673=1 - openSUSE Leap 15.3: zypper in -t patch openSUSE-SLE-15.3-2022-3673=1 - SUSE Linux Enterprise Module for Desktop Applications 15-SP4: zypper in -t patch SUSE-SLE-Module-Desktop-Applications-15-SP4-2022-3673=1 - SUSE Linux Enterprise Module for Desktop Applications 15-SP3: zypper in -t patch SUSE-SLE-Module-Desktop-Applications-15-SP3-2022-3673=1 - SUSE Linux Enterprise Module for Basesystem 15-SP4: zypper in -t patch SUSE-SLE-Module-Basesystem-15-SP4-2022-3673=1 - SUSE Linux Enterprise Module for Basesystem 15-SP3: zypper in -t patch SUSE-SLE-Module-Basesystem-15-SP3-2022-3673=1 Package List: - openSUSE Leap 15.4 (aarch64 ppc64le s390x x86_64): jasper-2.0.14-150000.3.28.1 jasper-debuginfo-2.0.14-150000.3.28.1 jasper-debugsource-2.0.14-150000.3.28.1 libjasper-devel-2.0.14-150000.3.28.1 libjasper4-2.0.14-150000.3.28.1 libjasper4-debuginfo-2.0.14-150000.3.28.1 - openSUSE Leap 15.4 (x86_64): libjasper4-32bit-2.0.14-150000.3.28.1 libjasper4-32bit-debuginfo-2.0.14-150000.3.28.1 - openSUSE Leap 15.3 (aarch64 ppc64le s390x x86_64): jasper-2.0.14-150000.3.28.1 jasper-debuginfo-2.0.14-150000.3.28.1 jasper-debugsource-2.0.14-150000.3.28.1 libjasper-devel-2.0.14-150000.3.28.1 libjasper4-2.0.14-150000.3.28.1 libjasper4-debuginfo-2.0.14-150000.3.28.1 - openSUSE Leap 15.3 (x86_64): libjasper4-32bit-2.0.14-150000.3.28.1 libjasper4-32bit-debuginfo-2.0.14-150000.3.28.1 - SUSE Linux Enterprise Module for Desktop Applications 15-SP4 (aarch64 ppc64le s390x x86_64): jasper-debuginfo-2.0.14-150000.3.28.1 jasper-debugsource-2.0.14-150000.3.28.1 libjasper-devel-2.0.14-150000.3.28.1 - SUSE Linux Enterprise Module for Desktop Applications 15-SP3 (aarch64 ppc64le s390x x86_64): jasper-debuginfo-2.0.14-150000.3.28.1 jasper-debugsource-2.0.14-150000.3.28.1 libjasper-devel-2.0.14-150000.3.28.1 - SUSE Linux Enterprise Module for Basesystem 15-SP4 (aarch64 ppc64le s390x x86_64): jasper-debuginfo-2.0.14-150000.3.28.1 jasper-debugsource-2.0.14-150000.3.28.1 libjasper4-2.0.14-150000.3.28.1 libjasper4-debuginfo-2.0.14-150000.3.28.1 - SUSE Linux Enterprise Module for Basesystem 15-SP3 (aarch64 ppc64le s390x x86_64): jasper-debuginfo-2.0.14-150000.3.28.1 jasper-debugsource-2.0.14-150000.3.28.1 libjasper4-2.0.14-150000.3.28.1 libjasper4-debuginfo-2.0.14-150000.3.28.1 References: https://www.suse.com/security/cve/CVE-2022-2963.html https://bugzilla.suse.com/1202642

1 0