November 2022 - openSUSE Security Announce

SUSE-SU-2022:3947-1: important: Security update for xen
by opensuse-security＠opensuse.org 11 Nov '22

11 Nov '22

SUSE Security Update: Security update for xen ______________________________________________________________________________ Announcement ID: SUSE-SU-2022:3947-1 Rating: important References: #1027519 #1193923 #1203806 #1203807 #1204482 #1204485 #1204487 #1204488 #1204489 #1204490 #1204494 #1204496 Cross-References: CVE-2022-33746 CVE-2022-33747 CVE-2022-33748 CVE-2022-42309 CVE-2022-42310 CVE-2022-42311 CVE-2022-42312 CVE-2022-42313 CVE-2022-42314 CVE-2022-42315 CVE-2022-42316 CVE-2022-42317 CVE-2022-42318 CVE-2022-42319 CVE-2022-42320 CVE-2022-42321 CVE-2022-42322 CVE-2022-42323 CVE-2022-42325 CVE-2022-42326 CVSS scores: CVE-2022-33746 (NVD) : 6.5 CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:N/I:N/A:H CVE-2022-33746 (SUSE): 5.3 CVSS:3.1/AV:L/AC:H/PR:H/UI:N/S:C/C:N/I:N/A:H CVE-2022-33747 (NVD) : 3.8 CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:N/I:N/A:L CVE-2022-33748 (NVD) : 5.6 CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:C/C:N/I:N/A:H CVE-2022-33748 (SUSE): 5.3 CVSS:3.1/AV:L/AC:H/PR:H/UI:N/S:C/C:N/I:N/A:H CVE-2022-42309 (NVD) : 8.8 CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H CVE-2022-42309 (SUSE): 7.5 CVSS:3.1/AV:L/AC:H/PR:H/UI:N/S:C/C:H/I:H/A:H CVE-2022-42310 (NVD) : 5.5 CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H CVE-2022-42310 (SUSE): 6 CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:C/C:N/I:N/A:H CVE-2022-42311 (NVD) : 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H CVE-2022-42311 (SUSE): 6 CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:C/C:N/I:N/A:H CVE-2022-42312 (NVD) : 6.5 CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:N/I:N/A:H CVE-2022-42312 (SUSE): 6 CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:C/C:N/I:N/A:H CVE-2022-42313 (NVD) : 6.5 CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:N/I:N/A:H CVE-2022-42313 (SUSE): 6 CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:C/C:N/I:N/A:H CVE-2022-42314 (NVD) : 6.5 CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:N/I:N/A:H CVE-2022-42314 (SUSE): 6 CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:C/C:N/I:N/A:H CVE-2022-42315 (NVD) : 6.5 CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:N/I:N/A:H CVE-2022-42315 (SUSE): 6 CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:C/C:N/I:N/A:H CVE-2022-42316 (NVD) : 6.5 CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:N/I:N/A:H CVE-2022-42316 (SUSE): 6 CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:C/C:N/I:N/A:H CVE-2022-42317 (NVD) : 6.5 CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:N/I:N/A:H CVE-2022-42317 (SUSE): 6 CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:C/C:N/I:N/A:H CVE-2022-42318 (NVD) : 6.5 CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:N/I:N/A:H CVE-2022-42318 (SUSE): 6 CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:C/C:N/I:N/A:H CVE-2022-42319 (NVD) : 6.5 CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:N/I:N/A:H CVE-2022-42319 (SUSE): 6 CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:C/C:N/I:N/A:H CVE-2022-42320 (NVD) : 7 CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H CVE-2022-42320 (SUSE): 7.5 CVSS:3.1/AV:L/AC:H/PR:H/UI:N/S:C/C:H/I:H/A:H CVE-2022-42321 (NVD) : 6.5 CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:N/I:N/A:H CVE-2022-42321 (SUSE): 6 CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:C/C:N/I:N/A:H CVE-2022-42322 (NVD) : 5.5 CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H CVE-2022-42322 (SUSE): 5.3 CVSS:3.1/AV:L/AC:H/PR:H/UI:N/S:C/C:N/I:N/A:H CVE-2022-42323 (NVD) : 5.5 CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H CVE-2022-42323 (SUSE): 5.3 CVSS:3.1/AV:L/AC:H/PR:H/UI:N/S:C/C:N/I:N/A:H CVE-2022-42325 (NVD) : 5.5 CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H CVE-2022-42325 (SUSE): 6 CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:C/C:N/I:N/A:H CVE-2022-42326 (NVD) : 5.5 CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H CVE-2022-42326 (SUSE): 6 CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:C/C:N/I:N/A:H Affected Products: SUSE Enterprise Storage 7.1 SUSE Linux Enterprise Desktop 15-SP3 SUSE Linux Enterprise High Performance Computing 15-SP3 SUSE Linux Enterprise Micro 5.1 SUSE Linux Enterprise Micro 5.2 SUSE Linux Enterprise Module for Basesystem 15-SP3 SUSE Linux Enterprise Module for Server Applications 15-SP3 SUSE Linux Enterprise Server 15-SP3 SUSE Linux Enterprise Server for SAP Applications 15-SP3 SUSE Manager Proxy 4.2 SUSE Manager Retail Branch Server 4.2 SUSE Manager Server 4.2 openSUSE Leap 15.3 openSUSE Leap Micro 5.2 ______________________________________________________________________________ An update that fixes 20 vulnerabilities is now available. Description: This update for xen fixes the following issues: - CVE-2022-33746: Fixed DoS due to excessively long P2M pool freeing (bsc#1203806) - CVE-2022-33748: Fixed DoS due to race in locking (bsc#1203807) - CVE-2022-42311, CVE-2022-42312, CVE-2022-42313, CVE-2022-42314, CVE-2022-42315, CVE-2022-42316, CVE-2022-42317, CVE-2022-42318: xen: Xenstore: Guests can let xenstored run out of memory (bsc#1204482) - CVE-2022-42309: xen: Xenstore: Guests can crash xenstored (bsc#1204485) - CVE-2022-42310: xen: Xenstore: Guests can create orphaned Xenstore nodes (bsc#1204487) - CVE-2022-42319: xen: Xenstore: Guests can cause Xenstore to not free temporary memory (bsc#1204488) - CVE-2022-42320: xen: Xenstore: Guests can get access to Xenstore nodes of deleted domains (bsc#1204489) - CVE-2022-42321: xen: Xenstore: Guests can crash xenstored via exhausting the stack (bsc#1204490) - CVE-2022-42322,CVE-2022-42323: xen: Xenstore: cooperating guests can create arbitrary numbers of nodes (bsc#1204494) - CVE-2022-42325,CVE-2022-42326: xen: Xenstore: Guests can create arbitrary number of nodes via transactions (bsc#1204496) - xen: Frontends vulnerable to backends (bsc#1193923) Special Instructions and Notes: Please reboot the system after installing this update. Patch Instructions: To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap Micro 5.2: zypper in -t patch openSUSE-Leap-Micro-5.2-2022-3947=1 - openSUSE Leap 15.3: zypper in -t patch openSUSE-SLE-15.3-2022-3947=1 - SUSE Linux Enterprise Module for Server Applications 15-SP3: zypper in -t patch SUSE-SLE-Module-Server-Applications-15-SP3-2022-3947=1 - SUSE Linux Enterprise Module for Basesystem 15-SP3: zypper in -t patch SUSE-SLE-Module-Basesystem-15-SP3-2022-3947=1 - SUSE Linux Enterprise Micro 5.2: zypper in -t patch SUSE-SUSE-MicroOS-5.2-2022-3947=1 - SUSE Linux Enterprise Micro 5.1: zypper in -t patch SUSE-SUSE-MicroOS-5.1-2022-3947=1 Package List: - openSUSE Leap Micro 5.2 (x86_64): xen-debugsource-4.14.5_08-150300.3.40.1 xen-libs-4.14.5_08-150300.3.40.1 xen-libs-debuginfo-4.14.5_08-150300.3.40.1 - openSUSE Leap 15.3 (aarch64 x86_64): xen-4.14.5_08-150300.3.40.1 xen-debugsource-4.14.5_08-150300.3.40.1 xen-devel-4.14.5_08-150300.3.40.1 xen-doc-html-4.14.5_08-150300.3.40.1 xen-libs-4.14.5_08-150300.3.40.1 xen-libs-debuginfo-4.14.5_08-150300.3.40.1 xen-tools-4.14.5_08-150300.3.40.1 xen-tools-debuginfo-4.14.5_08-150300.3.40.1 xen-tools-domU-4.14.5_08-150300.3.40.1 xen-tools-domU-debuginfo-4.14.5_08-150300.3.40.1 - openSUSE Leap 15.3 (x86_64): xen-libs-32bit-4.14.5_08-150300.3.40.1 xen-libs-32bit-debuginfo-4.14.5_08-150300.3.40.1 - openSUSE Leap 15.3 (noarch): xen-tools-xendomains-wait-disk-4.14.5_08-150300.3.40.1 - SUSE Linux Enterprise Module for Server Applications 15-SP3 (noarch): xen-tools-xendomains-wait-disk-4.14.5_08-150300.3.40.1 - SUSE Linux Enterprise Module for Server Applications 15-SP3 (x86_64): xen-4.14.5_08-150300.3.40.1 xen-debugsource-4.14.5_08-150300.3.40.1 xen-devel-4.14.5_08-150300.3.40.1 xen-tools-4.14.5_08-150300.3.40.1 xen-tools-debuginfo-4.14.5_08-150300.3.40.1 - SUSE Linux Enterprise Module for Basesystem 15-SP3 (x86_64): xen-debugsource-4.14.5_08-150300.3.40.1 xen-libs-4.14.5_08-150300.3.40.1 xen-libs-debuginfo-4.14.5_08-150300.3.40.1 xen-tools-domU-4.14.5_08-150300.3.40.1 xen-tools-domU-debuginfo-4.14.5_08-150300.3.40.1 - SUSE Linux Enterprise Micro 5.2 (x86_64): xen-debugsource-4.14.5_08-150300.3.40.1 xen-libs-4.14.5_08-150300.3.40.1 xen-libs-debuginfo-4.14.5_08-150300.3.40.1 - SUSE Linux Enterprise Micro 5.1 (x86_64): xen-debugsource-4.14.5_08-150300.3.40.1 xen-libs-4.14.5_08-150300.3.40.1 xen-libs-debuginfo-4.14.5_08-150300.3.40.1 References: https://www.suse.com/security/cve/CVE-2022-33746.html https://www.suse.com/security/cve/CVE-2022-33747.html https://www.suse.com/security/cve/CVE-2022-33748.html https://www.suse.com/security/cve/CVE-2022-42309.html https://www.suse.com/security/cve/CVE-2022-42310.html https://www.suse.com/security/cve/CVE-2022-42311.html https://www.suse.com/security/cve/CVE-2022-42312.html https://www.suse.com/security/cve/CVE-2022-42313.html https://www.suse.com/security/cve/CVE-2022-42314.html https://www.suse.com/security/cve/CVE-2022-42315.html https://www.suse.com/security/cve/CVE-2022-42316.html https://www.suse.com/security/cve/CVE-2022-42317.html https://www.suse.com/security/cve/CVE-2022-42318.html https://www.suse.com/security/cve/CVE-2022-42319.html https://www.suse.com/security/cve/CVE-2022-42320.html https://www.suse.com/security/cve/CVE-2022-42321.html https://www.suse.com/security/cve/CVE-2022-42322.html https://www.suse.com/security/cve/CVE-2022-42323.html https://www.suse.com/security/cve/CVE-2022-42325.html https://www.suse.com/security/cve/CVE-2022-42326.html https://bugzilla.suse.com/1027519 https://bugzilla.suse.com/1193923 https://bugzilla.suse.com/1203806 https://bugzilla.suse.com/1203807 https://bugzilla.suse.com/1204482 https://bugzilla.suse.com/1204485 https://bugzilla.suse.com/1204487 https://bugzilla.suse.com/1204488 https://bugzilla.suse.com/1204489 https://bugzilla.suse.com/1204490 https://bugzilla.suse.com/1204494 https://bugzilla.suse.com/1204496

1 0

SUSE-SU-2022:3955-1: important: Security update for samba
by opensuse-security＠opensuse.org 11 Nov '22

11 Nov '22

SUSE Security Update: Security update for samba ______________________________________________________________________________ Announcement ID: SUSE-SU-2022:3955-1 Rating: important References: #1200102 #1202803 #1202976 Cross-References: CVE-2022-1615 CVE-2022-32743 CVSS scores: CVE-2022-1615 (NVD) : 5.5 CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N CVE-2022-1615 (SUSE): 7.5 CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H CVE-2022-32743 (NVD) : 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N CVE-2022-32743 (SUSE): 4.3 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N Affected Products: SUSE Enterprise Storage 7.1 SUSE Linux Enterprise Desktop 15-SP3 SUSE Linux Enterprise High Availability 15-SP3 SUSE Linux Enterprise High Performance Computing 15-SP3 SUSE Linux Enterprise Micro 5.2 SUSE Linux Enterprise Module for Basesystem 15-SP3 SUSE Linux Enterprise Module for Python2 15-SP3 SUSE Linux Enterprise Server 15-SP3 SUSE Linux Enterprise Server for SAP Applications 15-SP3 SUSE Manager Proxy 4.2 SUSE Manager Retail Branch Server 4.2 SUSE Manager Server 4.2 openSUSE Leap 15.3 openSUSE Leap Micro 5.2 ______________________________________________________________________________ An update that solves two vulnerabilities and has one errata is now available. Description: This update for samba fixes the following issues: - CVE-2022-1615: Fixed error handling in random number generation (bso#15103)(bsc#1202976). - CVE-2022-32743: Implement validated dnsHostName write rights (bso#14833)(bsc#1202803). Bugfixes: - Fixed use after free when iterating smbd_server_connection->connections after tree disconnect failure (bso#15128)(bsc#1200102). Patch Instructions: To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap Micro 5.2: zypper in -t patch openSUSE-Leap-Micro-5.2-2022-3955=1 - openSUSE Leap 15.3: zypper in -t patch openSUSE-SLE-15.3-2022-3955=1 - SUSE Linux Enterprise Module for Python2 15-SP3: zypper in -t patch SUSE-SLE-Module-Python2-15-SP3-2022-3955=1 - SUSE Linux Enterprise Module for Basesystem 15-SP3: zypper in -t patch SUSE-SLE-Module-Basesystem-15-SP3-2022-3955=1 - SUSE Linux Enterprise Micro 5.2: zypper in -t patch SUSE-SUSE-MicroOS-5.2-2022-3955=1 - SUSE Linux Enterprise High Availability 15-SP3: zypper in -t patch SUSE-SLE-Product-HA-15-SP3-2022-3955=1 - SUSE Enterprise Storage 7.1: zypper in -t patch SUSE-Storage-7.1-2022-3955=1 Package List: - openSUSE Leap Micro 5.2 (aarch64 x86_64): samba-client-libs-4.15.8+git.527.8d0c05d313e-150300.3.40.2 samba-client-libs-debuginfo-4.15.8+git.527.8d0c05d313e-150300.3.40.2 samba-debuginfo-4.15.8+git.527.8d0c05d313e-150300.3.40.2 samba-debugsource-4.15.8+git.527.8d0c05d313e-150300.3.40.2 - openSUSE Leap 15.3 (aarch64 ppc64le s390x x86_64): ctdb-4.15.8+git.527.8d0c05d313e-150300.3.40.2 ctdb-debuginfo-4.15.8+git.527.8d0c05d313e-150300.3.40.2 ctdb-pcp-pmda-4.15.8+git.527.8d0c05d313e-150300.3.40.2 ctdb-pcp-pmda-debuginfo-4.15.8+git.527.8d0c05d313e-150300.3.40.2 libsamba-policy-devel-4.15.8+git.527.8d0c05d313e-150300.3.40.2 libsamba-policy-python3-devel-4.15.8+git.527.8d0c05d313e-150300.3.40.2 libsamba-policy0-python3-4.15.8+git.527.8d0c05d313e-150300.3.40.2 libsamba-policy0-python3-debuginfo-4.15.8+git.527.8d0c05d313e-150300.3.40.2 samba-4.15.8+git.527.8d0c05d313e-150300.3.40.2 samba-ad-dc-4.15.8+git.527.8d0c05d313e-150300.3.40.2 samba-ad-dc-debuginfo-4.15.8+git.527.8d0c05d313e-150300.3.40.2 samba-ad-dc-libs-4.15.8+git.527.8d0c05d313e-150300.3.40.2 samba-ad-dc-libs-debuginfo-4.15.8+git.527.8d0c05d313e-150300.3.40.2 samba-client-4.15.8+git.527.8d0c05d313e-150300.3.40.2 samba-client-debuginfo-4.15.8+git.527.8d0c05d313e-150300.3.40.2 samba-client-libs-4.15.8+git.527.8d0c05d313e-150300.3.40.2 samba-client-libs-debuginfo-4.15.8+git.527.8d0c05d313e-150300.3.40.2 samba-debuginfo-4.15.8+git.527.8d0c05d313e-150300.3.40.2 samba-debugsource-4.15.8+git.527.8d0c05d313e-150300.3.40.2 samba-devel-4.15.8+git.527.8d0c05d313e-150300.3.40.2 samba-dsdb-modules-4.15.8+git.527.8d0c05d313e-150300.3.40.2 samba-dsdb-modules-debuginfo-4.15.8+git.527.8d0c05d313e-150300.3.40.2 samba-gpupdate-4.15.8+git.527.8d0c05d313e-150300.3.40.2 samba-ldb-ldap-4.15.8+git.527.8d0c05d313e-150300.3.40.2 samba-ldb-ldap-debuginfo-4.15.8+git.527.8d0c05d313e-150300.3.40.2 samba-libs-4.15.8+git.527.8d0c05d313e-150300.3.40.2 samba-libs-debuginfo-4.15.8+git.527.8d0c05d313e-150300.3.40.2 samba-libs-python3-4.15.8+git.527.8d0c05d313e-150300.3.40.2 samba-libs-python3-debuginfo-4.15.8+git.527.8d0c05d313e-150300.3.40.2 samba-python3-4.15.8+git.527.8d0c05d313e-150300.3.40.2 samba-python3-debuginfo-4.15.8+git.527.8d0c05d313e-150300.3.40.2 samba-test-4.15.8+git.527.8d0c05d313e-150300.3.40.2 samba-test-debuginfo-4.15.8+git.527.8d0c05d313e-150300.3.40.2 samba-tool-4.15.8+git.527.8d0c05d313e-150300.3.40.2 samba-winbind-4.15.8+git.527.8d0c05d313e-150300.3.40.2 samba-winbind-debuginfo-4.15.8+git.527.8d0c05d313e-150300.3.40.2 samba-winbind-libs-4.15.8+git.527.8d0c05d313e-150300.3.40.2 samba-winbind-libs-debuginfo-4.15.8+git.527.8d0c05d313e-150300.3.40.2 - openSUSE Leap 15.3 (aarch64 x86_64): samba-ceph-4.15.8+git.527.8d0c05d313e-150300.3.40.2 samba-ceph-debuginfo-4.15.8+git.527.8d0c05d313e-150300.3.40.2 - openSUSE Leap 15.3 (aarch64_ilp32): libsamba-policy0-python3-64bit-4.15.8+git.527.8d0c05d313e-150300.3.40.2 libsamba-policy0-python3-64bit-debuginfo-4.15.8+git.527.8d0c05d313e-150300.3.40.2 samba-client-64bit-4.15.8+git.527.8d0c05d313e-150300.3.40.2 samba-client-64bit-debuginfo-4.15.8+git.527.8d0c05d313e-150300.3.40.2 samba-libs-64bit-4.15.8+git.527.8d0c05d313e-150300.3.40.2 samba-libs-64bit-debuginfo-4.15.8+git.527.8d0c05d313e-150300.3.40.2 samba-libs-python3-64bit-4.15.8+git.527.8d0c05d313e-150300.3.40.2 samba-libs-python3-64bit-debuginfo-4.15.8+git.527.8d0c05d313e-150300.3.40.2 - openSUSE Leap 15.3 (x86_64): libsamba-policy0-python3-32bit-4.15.8+git.527.8d0c05d313e-150300.3.40.2 libsamba-policy0-python3-32bit-debuginfo-4.15.8+git.527.8d0c05d313e-150300.3.40.2 samba-ad-dc-libs-32bit-4.15.8+git.527.8d0c05d313e-150300.3.40.2 samba-ad-dc-libs-32bit-debuginfo-4.15.8+git.527.8d0c05d313e-150300.3.40.2 samba-client-32bit-4.15.8+git.527.8d0c05d313e-150300.3.40.2 samba-client-32bit-debuginfo-4.15.8+git.527.8d0c05d313e-150300.3.40.2 samba-client-libs-32bit-4.15.8+git.527.8d0c05d313e-150300.3.40.2 samba-client-libs-32bit-debuginfo-4.15.8+git.527.8d0c05d313e-150300.3.40.2 samba-devel-32bit-4.15.8+git.527.8d0c05d313e-150300.3.40.2 samba-libs-32bit-4.15.8+git.527.8d0c05d313e-150300.3.40.2 samba-libs-32bit-debuginfo-4.15.8+git.527.8d0c05d313e-150300.3.40.2 samba-libs-python3-32bit-4.15.8+git.527.8d0c05d313e-150300.3.40.2 samba-libs-python3-32bit-debuginfo-4.15.8+git.527.8d0c05d313e-150300.3.40.2 samba-winbind-libs-32bit-4.15.8+git.527.8d0c05d313e-150300.3.40.2 samba-winbind-libs-32bit-debuginfo-4.15.8+git.527.8d0c05d313e-150300.3.40.2 - openSUSE Leap 15.3 (noarch): samba-doc-4.15.8+git.527.8d0c05d313e-150300.3.40.2 - SUSE Linux Enterprise Module for Python2 15-SP3 (aarch64 ppc64le s390x x86_64): samba-ad-dc-4.15.8+git.527.8d0c05d313e-150300.3.40.2 samba-ad-dc-debuginfo-4.15.8+git.527.8d0c05d313e-150300.3.40.2 samba-debuginfo-4.15.8+git.527.8d0c05d313e-150300.3.40.2 samba-debugsource-4.15.8+git.527.8d0c05d313e-150300.3.40.2 - SUSE Linux Enterprise Module for Basesystem 15-SP3 (aarch64 ppc64le s390x x86_64): libsamba-policy-devel-4.15.8+git.527.8d0c05d313e-150300.3.40.2 libsamba-policy-python3-devel-4.15.8+git.527.8d0c05d313e-150300.3.40.2 libsamba-policy0-python3-4.15.8+git.527.8d0c05d313e-150300.3.40.2 libsamba-policy0-python3-debuginfo-4.15.8+git.527.8d0c05d313e-150300.3.40.2 samba-4.15.8+git.527.8d0c05d313e-150300.3.40.2 samba-ad-dc-libs-4.15.8+git.527.8d0c05d313e-150300.3.40.2 samba-ad-dc-libs-debuginfo-4.15.8+git.527.8d0c05d313e-150300.3.40.2 samba-client-4.15.8+git.527.8d0c05d313e-150300.3.40.2 samba-client-debuginfo-4.15.8+git.527.8d0c05d313e-150300.3.40.2 samba-client-libs-4.15.8+git.527.8d0c05d313e-150300.3.40.2 samba-client-libs-debuginfo-4.15.8+git.527.8d0c05d313e-150300.3.40.2 samba-debuginfo-4.15.8+git.527.8d0c05d313e-150300.3.40.2 samba-debugsource-4.15.8+git.527.8d0c05d313e-150300.3.40.2 samba-devel-4.15.8+git.527.8d0c05d313e-150300.3.40.2 samba-dsdb-modules-4.15.8+git.527.8d0c05d313e-150300.3.40.2 samba-dsdb-modules-debuginfo-4.15.8+git.527.8d0c05d313e-150300.3.40.2 samba-gpupdate-4.15.8+git.527.8d0c05d313e-150300.3.40.2 samba-ldb-ldap-4.15.8+git.527.8d0c05d313e-150300.3.40.2 samba-ldb-ldap-debuginfo-4.15.8+git.527.8d0c05d313e-150300.3.40.2 samba-libs-4.15.8+git.527.8d0c05d313e-150300.3.40.2 samba-libs-debuginfo-4.15.8+git.527.8d0c05d313e-150300.3.40.2 samba-libs-python3-4.15.8+git.527.8d0c05d313e-150300.3.40.2 samba-libs-python3-debuginfo-4.15.8+git.527.8d0c05d313e-150300.3.40.2 samba-python3-4.15.8+git.527.8d0c05d313e-150300.3.40.2 samba-python3-debuginfo-4.15.8+git.527.8d0c05d313e-150300.3.40.2 samba-tool-4.15.8+git.527.8d0c05d313e-150300.3.40.2 samba-winbind-4.15.8+git.527.8d0c05d313e-150300.3.40.2 samba-winbind-debuginfo-4.15.8+git.527.8d0c05d313e-150300.3.40.2 samba-winbind-libs-4.15.8+git.527.8d0c05d313e-150300.3.40.2 samba-winbind-libs-debuginfo-4.15.8+git.527.8d0c05d313e-150300.3.40.2 - SUSE Linux Enterprise Module for Basesystem 15-SP3 (aarch64 x86_64): samba-ceph-4.15.8+git.527.8d0c05d313e-150300.3.40.2 samba-ceph-debuginfo-4.15.8+git.527.8d0c05d313e-150300.3.40.2 - SUSE Linux Enterprise Module for Basesystem 15-SP3 (x86_64): samba-ad-dc-libs-32bit-4.15.8+git.527.8d0c05d313e-150300.3.40.2 samba-ad-dc-libs-32bit-debuginfo-4.15.8+git.527.8d0c05d313e-150300.3.40.2 samba-client-32bit-4.15.8+git.527.8d0c05d313e-150300.3.40.2 samba-client-32bit-debuginfo-4.15.8+git.527.8d0c05d313e-150300.3.40.2 samba-client-libs-32bit-4.15.8+git.527.8d0c05d313e-150300.3.40.2 samba-client-libs-32bit-debuginfo-4.15.8+git.527.8d0c05d313e-150300.3.40.2 samba-devel-32bit-4.15.8+git.527.8d0c05d313e-150300.3.40.2 samba-libs-32bit-4.15.8+git.527.8d0c05d313e-150300.3.40.2 samba-libs-32bit-debuginfo-4.15.8+git.527.8d0c05d313e-150300.3.40.2 samba-winbind-libs-32bit-4.15.8+git.527.8d0c05d313e-150300.3.40.2 samba-winbind-libs-32bit-debuginfo-4.15.8+git.527.8d0c05d313e-150300.3.40.2 - SUSE Linux Enterprise Micro 5.2 (aarch64 s390x x86_64): samba-client-libs-4.15.8+git.527.8d0c05d313e-150300.3.40.2 samba-client-libs-debuginfo-4.15.8+git.527.8d0c05d313e-150300.3.40.2 samba-debuginfo-4.15.8+git.527.8d0c05d313e-150300.3.40.2 samba-debugsource-4.15.8+git.527.8d0c05d313e-150300.3.40.2 - SUSE Linux Enterprise High Availability 15-SP3 (aarch64 ppc64le s390x x86_64): ctdb-4.15.8+git.527.8d0c05d313e-150300.3.40.2 ctdb-debuginfo-4.15.8+git.527.8d0c05d313e-150300.3.40.2 samba-debuginfo-4.15.8+git.527.8d0c05d313e-150300.3.40.2 samba-debugsource-4.15.8+git.527.8d0c05d313e-150300.3.40.2 - SUSE Enterprise Storage 7.1 (aarch64 x86_64): ctdb-4.15.8+git.527.8d0c05d313e-150300.3.40.2 ctdb-debuginfo-4.15.8+git.527.8d0c05d313e-150300.3.40.2 samba-4.15.8+git.527.8d0c05d313e-150300.3.40.2 samba-ceph-4.15.8+git.527.8d0c05d313e-150300.3.40.2 samba-ceph-debuginfo-4.15.8+git.527.8d0c05d313e-150300.3.40.2 samba-client-4.15.8+git.527.8d0c05d313e-150300.3.40.2 samba-client-debuginfo-4.15.8+git.527.8d0c05d313e-150300.3.40.2 samba-debuginfo-4.15.8+git.527.8d0c05d313e-150300.3.40.2 samba-debugsource-4.15.8+git.527.8d0c05d313e-150300.3.40.2 samba-libs-4.15.8+git.527.8d0c05d313e-150300.3.40.2 samba-libs-debuginfo-4.15.8+git.527.8d0c05d313e-150300.3.40.2 samba-libs-python3-4.15.8+git.527.8d0c05d313e-150300.3.40.2 samba-libs-python3-debuginfo-4.15.8+git.527.8d0c05d313e-150300.3.40.2 samba-winbind-4.15.8+git.527.8d0c05d313e-150300.3.40.2 samba-winbind-debuginfo-4.15.8+git.527.8d0c05d313e-150300.3.40.2 References: https://www.suse.com/security/cve/CVE-2022-1615.html https://www.suse.com/security/cve/CVE-2022-32743.html https://bugzilla.suse.com/1200102 https://bugzilla.suse.com/1202803 https://bugzilla.suse.com/1202976

1 0

SUSE-SU-2022:3959-1: important: Security update for busybox
by opensuse-security＠opensuse.org 11 Nov '22

11 Nov '22

SUSE Security Update: Security update for busybox ______________________________________________________________________________ Announcement ID: SUSE-SU-2022:3959-1 Rating: important References: #1064976 #1064978 #1069412 #1099260 #1099263 #1102912 #1121426 #1121428 #1184522 #1192869 #951562 #970662 #970663 #991940 Cross-References: CVE-2011-5325 CVE-2015-9261 CVE-2016-2147 CVE-2016-2148 CVE-2016-6301 CVE-2017-15873 CVE-2017-15874 CVE-2017-16544 CVE-2018-1000500 CVE-2018-1000517 CVE-2018-20679 CVE-2019-5747 CVE-2021-28831 CVE-2021-42373 CVE-2021-42374 CVE-2021-42375 CVE-2021-42376 CVE-2021-42377 CVE-2021-42378 CVE-2021-42379 CVE-2021-42380 CVE-2021-42381 CVE-2021-42382 CVE-2021-42383 CVE-2021-42384 CVE-2021-42385 CVE-2021-42386 CVSS scores: CVE-2011-5325 (NVD) : 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N CVE-2015-9261 (NVD) : 5.5 CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H CVE-2015-9261 (SUSE): 5.5 CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H CVE-2016-2147 (NVD) : 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H CVE-2016-2148 (NVD) : 9.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H CVE-2016-6301 (NVD) : 7.5 CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H CVE-2017-15873 (NVD) : 5.5 CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H CVE-2017-15873 (SUSE): 7.8 CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H CVE-2017-15874 (NVD) : 5.5 CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H CVE-2017-15874 (SUSE): 3.3 CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:L CVE-2017-16544 (NVD) : 8.8 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H CVE-2017-16544 (SUSE): 7.8 CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H CVE-2018-1000500 (NVD) : 8.1 CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H CVE-2018-1000500 (SUSE): 7.5 CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N CVE-2018-1000517 (NVD) : 9.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H CVE-2018-1000517 (SUSE): 5.6 CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:L CVE-2018-20679 (NVD) : 7.5 CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N CVE-2018-20679 (SUSE): 5.3 CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N CVE-2019-5747 (NVD) : 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N CVE-2019-5747 (SUSE): 3.5 CVSS:3.1/AV:A/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:N CVE-2021-28831 (NVD) : 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H CVE-2021-28831 (SUSE): 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H CVE-2021-42373 (NVD) : 5.5 CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H CVE-2021-42373 (SUSE): 5.5 CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H CVE-2021-42374 (NVD) : 5.3 CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:L/I:N/A:H CVE-2021-42374 (SUSE): 5.7 CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:H CVE-2021-42375 (NVD) : 5.5 CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H CVE-2021-42375 (SUSE): 4.1 CVSS:3.1/AV:L/AC:H/PR:H/UI:N/S:U/C:N/I:N/A:H CVE-2021-42376 (NVD) : 5.5 CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H CVE-2021-42376 (SUSE): 4.1 CVSS:3.1/AV:L/AC:H/PR:H/UI:N/S:U/C:N/I:N/A:H CVE-2021-42377 (NVD) : 9.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H CVE-2021-42377 (SUSE): 6.4 CVSS:3.1/AV:L/AC:H/PR:H/UI:N/S:U/C:H/I:H/A:H CVE-2021-42378 (NVD) : 7.2 CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H CVE-2021-42378 (SUSE): 6.6 CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:H/I:H/A:H CVE-2021-42379 (NVD) : 7.2 CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H CVE-2021-42379 (SUSE): 6.6 CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:H/I:H/A:H CVE-2021-42380 (NVD) : 7.2 CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H CVE-2021-42380 (SUSE): 6.6 CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:H/I:H/A:H CVE-2021-42381 (NVD) : 7.2 CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H CVE-2021-42381 (SUSE): 6.6 CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:H/I:H/A:H CVE-2021-42382 (NVD) : 7.2 CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H CVE-2021-42382 (SUSE): 6.6 CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:H/I:H/A:H CVE-2021-42383 (NVD) : 7.2 CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H CVE-2021-42383 (SUSE): 6.6 CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:H/I:H/A:H CVE-2021-42384 (NVD) : 7.2 CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H CVE-2021-42384 (SUSE): 6.6 CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:H/I:H/A:H CVE-2021-42385 (NVD) : 7.2 CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H CVE-2021-42385 (SUSE): 6.6 CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:H/I:H/A:H CVE-2021-42386 (NVD) : 7.2 CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H CVE-2021-42386 (SUSE): 6.6 CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:H/I:H/A:H Affected Products: SUSE Linux Enterprise Desktop 15-SP4 SUSE Linux Enterprise High Performance Computing 15-SP4 SUSE Linux Enterprise Module for Basesystem 15-SP4 SUSE Linux Enterprise Server 15-SP4 SUSE Linux Enterprise Server for SAP Applications 15-SP4 SUSE Manager Proxy 4.3 SUSE Manager Retail Branch Server 4.3 SUSE Manager Server 4.3 openSUSE Leap 15.4 ______________________________________________________________________________ An update that fixes 27 vulnerabilities is now available. Description: This update for busybox fixes the following issues: - Enable switch_root With this change virtme --force-initramfs works as expected. - Enable udhcpc busybox was updated to 1.35.0 - Adjust busybox.config for new features in find, date and cpio - Annotate CVEs already fixed in upstream, but not mentioned in .changes yet: * CVE-2017-16544 (bsc#1069412): Insufficient sanitization of filenames when autocompleting * CVE-2015-9261 (bsc#1102912): huft_build misuses a pointer, causing segfaults * CVE-2016-2147 (bsc#970663): out of bounds write (heap) due to integer underflow in udhcpc * CVE-2016-2148 (bsc#970662): heap-based buffer overflow in OPTION_6RD parsing * CVE-2016-6301 (bsc#991940): NTP server denial of service flaw * CVE-2017-15873 (bsc#1064976): The get_next_block function in archival/libarchive/decompress_bunzip2.c has an Integer Overflow * CVE-2017-15874 (bsc#1064978): archival/libarchive/decompress_unlzma.c has an Integer Underflow * CVE-2019-5747 (bsc#1121428): out of bounds read in udhcp components * CVE-2021-42373, CVE-2021-42374, CVE-2021-42375, CVE-2021-42376, CVE-2021-42377, CVE-2021-42378, CVE-2021-42379, CVE-2021-42380, CVE-2021-42381, CVE-2021-42382, CVE-2021-42383, CVE-2021-42384, CVE-2021-42385, CVE-2021-42386 (bsc#1192869) : v1.34.0 bugfixes * CVE-2021-28831 (bsc#1184522): invalid free or segmentation fault via malformed gzip data * CVE-2018-20679 (bsc#1121426): out of bounds read in udhcp * CVE-2018-1000517 (bsc#1099260): Heap-based buffer overflow in the retrieve_file_data() * CVE-2011-5325 (bsc#951562): tar directory traversal * CVE-2018-1000500 (bsc#1099263): wget: Missing SSL certificate validation Patch Instructions: To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 15.4: zypper in -t patch openSUSE-SLE-15.4-2022-3959=1 - SUSE Linux Enterprise Module for Basesystem 15-SP4: zypper in -t patch SUSE-SLE-Module-Basesystem-15-SP4-2022-3959=1 Package List: - openSUSE Leap 15.4 (aarch64 ppc64le s390x x86_64): busybox-1.35.0-150400.3.3.1 busybox-static-1.35.0-150400.3.3.1 busybox-testsuite-1.35.0-150400.3.3.1 - openSUSE Leap 15.4 (aarch64 x86_64): busybox-warewulf3-1.35.0-150400.3.3.1 - SUSE Linux Enterprise Module for Basesystem 15-SP4 (aarch64 ppc64le s390x x86_64): busybox-1.35.0-150400.3.3.1 busybox-static-1.35.0-150400.3.3.1 References: https://www.suse.com/security/cve/CVE-2011-5325.html https://www.suse.com/security/cve/CVE-2015-9261.html https://www.suse.com/security/cve/CVE-2016-2147.html https://www.suse.com/security/cve/CVE-2016-2148.html https://www.suse.com/security/cve/CVE-2016-6301.html https://www.suse.com/security/cve/CVE-2017-15873.html https://www.suse.com/security/cve/CVE-2017-15874.html https://www.suse.com/security/cve/CVE-2017-16544.html https://www.suse.com/security/cve/CVE-2018-1000500.html https://www.suse.com/security/cve/CVE-2018-1000517.html https://www.suse.com/security/cve/CVE-2018-20679.html https://www.suse.com/security/cve/CVE-2019-5747.html https://www.suse.com/security/cve/CVE-2021-28831.html https://www.suse.com/security/cve/CVE-2021-42373.html https://www.suse.com/security/cve/CVE-2021-42374.html https://www.suse.com/security/cve/CVE-2021-42375.html https://www.suse.com/security/cve/CVE-2021-42376.html https://www.suse.com/security/cve/CVE-2021-42377.html https://www.suse.com/security/cve/CVE-2021-42378.html https://www.suse.com/security/cve/CVE-2021-42379.html https://www.suse.com/security/cve/CVE-2021-42380.html https://www.suse.com/security/cve/CVE-2021-42381.html https://www.suse.com/security/cve/CVE-2021-42382.html https://www.suse.com/security/cve/CVE-2021-42383.html https://www.suse.com/security/cve/CVE-2021-42384.html https://www.suse.com/security/cve/CVE-2021-42385.html https://www.suse.com/security/cve/CVE-2021-42386.html https://bugzilla.suse.com/1064976 https://bugzilla.suse.com/1064978 https://bugzilla.suse.com/1069412 https://bugzilla.suse.com/1099260 https://bugzilla.suse.com/1099263 https://bugzilla.suse.com/1102912 https://bugzilla.suse.com/1121426 https://bugzilla.suse.com/1121428 https://bugzilla.suse.com/1184522 https://bugzilla.suse.com/1192869 https://bugzilla.suse.com/951562 https://bugzilla.suse.com/970662 https://bugzilla.suse.com/970663 https://bugzilla.suse.com/991940

1 0

openSUSE-SU-2022:10196-1: important: Security update for libmodbus
by opensuse-security＠opensuse.org 11 Nov '22

11 Nov '22

openSUSE Security Update: Security update for libmodbus ______________________________________________________________________________ Announcement ID: openSUSE-SU-2022:10196-1 Rating: important References: #1195124 Cross-References: CVE-2022-0367 CVSS scores: CVE-2022-0367 (NVD) : 7.8 CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H Affected Products: openSUSE Backports SLE-15-SP4 ______________________________________________________________________________ An update that fixes one vulnerability is now available. Description: This update for libmodbus fixes the following issues: - CVE-2022-0367: Fixed heap-based Buffer Overflow in modbus_reply (boo#1195124). Patch Instructions: To install this openSUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Backports SLE-15-SP4: zypper in -t patch openSUSE-2022-10196=1 Package List: - openSUSE Backports SLE-15-SP4 (aarch64 i586 ppc64le s390x x86_64): libmodbus-devel-3.1.6-bp154.2.3.1 libmodbus5-3.1.6-bp154.2.3.1 References: https://www.suse.com/security/cve/CVE-2022-0367.html https://bugzilla.suse.com/1195124

1 0

openSUSE-SU-2022:10197-1: important: Security update for autotrace
by opensuse-security＠opensuse.org 11 Nov '22

11 Nov '22

openSUSE Security Update: Security update for autotrace ______________________________________________________________________________ Announcement ID: openSUSE-SU-2022:10197-1 Rating: important References: #1201529 Cross-References: CVE-2022-32323 CVSS scores: CVE-2022-32323 (NVD) : 7.3 CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:L Affected Products: openSUSE Backports SLE-15-SP4 ______________________________________________________________________________ An update that fixes one vulnerability is now available. Description: This update for autotrace fixes the following issues: - CVE-2022-32323: Fixed Heap overflow in ReadImage() (boo#1201529). Patch Instructions: To install this openSUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Backports SLE-15-SP4: zypper in -t patch openSUSE-2022-10197=1 Package List: - openSUSE Backports SLE-15-SP4 (aarch64 i586 ppc64le s390x x86_64): autotrace-0.31.1-bp154.3.3.1 autotrace-devel-0.31.1-bp154.3.3.1 libautotrace3-0.31.1-bp154.3.3.1 References: https://www.suse.com/security/cve/CVE-2022-32323.html https://bugzilla.suse.com/1201529

1 0

SUSE-SU-2022:3953-1: moderate: Security update for xterm
by opensuse-security＠opensuse.org 11 Nov '22

11 Nov '22

SUSE Security Update: Security update for xterm ______________________________________________________________________________ Announcement ID: SUSE-SU-2022:3953-1 Rating: moderate References: #1195387 Cross-References: CVE-2022-24130 CVSS scores: CVE-2022-24130 (NVD) : 5.5 CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H CVE-2022-24130 (SUSE): 5.5 CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H Affected Products: SUSE Enterprise Storage 7.1 SUSE Linux Enterprise Desktop 15-SP3 SUSE Linux Enterprise Desktop 15-SP4 SUSE Linux Enterprise High Performance Computing 15-SP3 SUSE Linux Enterprise High Performance Computing 15-SP4 SUSE Linux Enterprise Module for Basesystem 15-SP3 SUSE Linux Enterprise Module for Basesystem 15-SP4 SUSE Linux Enterprise Server 15-SP3 SUSE Linux Enterprise Server 15-SP4 SUSE Linux Enterprise Server for SAP Applications 15-SP3 SUSE Linux Enterprise Server for SAP Applications 15-SP4 SUSE Manager Proxy 4.2 SUSE Manager Proxy 4.3 SUSE Manager Retail Branch Server 4.2 SUSE Manager Retail Branch Server 4.3 SUSE Manager Server 4.2 SUSE Manager Server 4.3 openSUSE Leap 15.3 openSUSE Leap 15.4 ______________________________________________________________________________ An update that fixes one vulnerability is now available. Description: This update for xterm fixes the following issues: - CVE-2022-24130: Fixed buffer overflow in set_sixel when Sixel support is enabled (bsc#1195387). Patch Instructions: To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 15.4: zypper in -t patch openSUSE-SLE-15.4-2022-3953=1 - openSUSE Leap 15.3: zypper in -t patch openSUSE-SLE-15.3-2022-3953=1 - SUSE Linux Enterprise Module for Basesystem 15-SP4: zypper in -t patch SUSE-SLE-Module-Basesystem-15-SP4-2022-3953=1 - SUSE Linux Enterprise Module for Basesystem 15-SP3: zypper in -t patch SUSE-SLE-Module-Basesystem-15-SP3-2022-3953=1 Package List: - openSUSE Leap 15.4 (aarch64 ppc64le s390x x86_64): xterm-330-150200.11.6.1 xterm-bin-330-150200.11.6.1 xterm-bin-debuginfo-330-150200.11.6.1 xterm-debugsource-330-150200.11.6.1 - openSUSE Leap 15.3 (aarch64 ppc64le s390x x86_64): xterm-330-150200.11.6.1 xterm-bin-330-150200.11.6.1 xterm-bin-debuginfo-330-150200.11.6.1 xterm-debugsource-330-150200.11.6.1 - SUSE Linux Enterprise Module for Basesystem 15-SP4 (aarch64 ppc64le s390x x86_64): xterm-330-150200.11.6.1 xterm-bin-330-150200.11.6.1 xterm-bin-debuginfo-330-150200.11.6.1 xterm-debugsource-330-150200.11.6.1 - SUSE Linux Enterprise Module for Basesystem 15-SP3 (aarch64 ppc64le s390x x86_64): xterm-330-150200.11.6.1 xterm-bin-330-150200.11.6.1 xterm-bin-debuginfo-330-150200.11.6.1 xterm-debugsource-330-150200.11.6.1 References: https://www.suse.com/security/cve/CVE-2022-24130.html https://bugzilla.suse.com/1195387

1 0

openSUSE-SU-2022:10199-1: important: Security update for autotrace
by opensuse-security＠opensuse.org 11 Nov '22

11 Nov '22

openSUSE Security Update: Security update for autotrace ______________________________________________________________________________ Announcement ID: openSUSE-SU-2022:10199-1 Rating: important References: #1201529 Cross-References: CVE-2022-32323 CVSS scores: CVE-2022-32323 (NVD) : 7.3 CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:L Affected Products: openSUSE Backports SLE-15-SP3 ______________________________________________________________________________ An update that fixes one vulnerability is now available. Description: This update for autotrace fixes the following issues: - CVE-2022-32323: Fixed Heap overflow in ReadImage() (boo#1201529). Patch Instructions: To install this openSUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Backports SLE-15-SP3: zypper in -t patch openSUSE-2022-10199=1 Package List: - openSUSE Backports SLE-15-SP3 (aarch64 i586 ppc64le s390x x86_64): autotrace-0.31.1-bp153.2.6.1 autotrace-devel-0.31.1-bp153.2.6.1 libautotrace3-0.31.1-bp153.2.6.1 References: https://www.suse.com/security/cve/CVE-2022-32323.html https://bugzilla.suse.com/1201529

1 0

SUSE-SU-2022:3949-1: moderate: Security update for rustup
by opensuse-security＠opensuse.org 11 Nov '22

11 Nov '22

SUSE Security Update: Security update for rustup ______________________________________________________________________________ Announcement ID: SUSE-SU-2022:3949-1 Rating: moderate References: #1194119 #1196972 Cross-References: CVE-2021-45710 CVE-2022-24713 CVSS scores: CVE-2021-45710 (NVD) : 8.1 CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H CVE-2021-45710 (SUSE): 3.3 CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:L CVE-2022-24713 (NVD) : 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H CVE-2022-24713 (SUSE): 4.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:L Affected Products: SUSE Enterprise Storage 7.1 SUSE Linux Enterprise Desktop 15-SP3 SUSE Linux Enterprise High Performance Computing 15-SP3 SUSE Linux Enterprise Module for Development Tools 15-SP3 SUSE Linux Enterprise Server 15-SP3 SUSE Linux Enterprise Server for SAP Applications 15-SP3 SUSE Manager Proxy 4.2 SUSE Manager Retail Branch Server 4.2 SUSE Manager Server 4.2 openSUSE Leap 15.3 ______________________________________________________________________________ An update that fixes two vulnerabilities is now available. Description: This update for rustup fixes the following issues: Updated to version 1.25.1~0: - CVE-2022-24713: Fixed Regex denial of service (bsc#1196972). - CVE-2021-45710: Fixed tokio data race with memory corruption (bsc#1194119). Patch Instructions: To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 15.3: zypper in -t patch openSUSE-SLE-15.3-2022-3949=1 - SUSE Linux Enterprise Module for Development Tools 15-SP3: zypper in -t patch SUSE-SLE-Module-Development-Tools-15-SP3-2022-3949=1 Package List: - openSUSE Leap 15.3 (aarch64 x86_64): rustup-1.25.1~0-150300.7.13.2 rustup-debuginfo-1.25.1~0-150300.7.13.2 rustup-debugsource-1.25.1~0-150300.7.13.2 - SUSE Linux Enterprise Module for Development Tools 15-SP3 (aarch64 x86_64): rustup-1.25.1~0-150300.7.13.2 rustup-debuginfo-1.25.1~0-150300.7.13.2 rustup-debugsource-1.25.1~0-150300.7.13.2 References: https://www.suse.com/security/cve/CVE-2021-45710.html https://www.suse.com/security/cve/CVE-2022-24713.html https://bugzilla.suse.com/1194119 https://bugzilla.suse.com/1196972

1 0

SUSE-SU-2022:3935-1: moderate: Security update for libarchive
by opensuse-security＠opensuse.org 10 Nov '22

10 Nov '22

SUSE Security Update: Security update for libarchive ______________________________________________________________________________ Announcement ID: SUSE-SU-2022:3935-1 Rating: moderate References: #1192426 #1192427 Cross-References: CVE-2021-31566 CVSS scores: CVE-2021-31566 (NVD) : 7.8 CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H CVE-2021-31566 (SUSE): 4.4 CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:L Affected Products: SUSE Enterprise Storage 7.1 SUSE Linux Enterprise Desktop 15-SP3 SUSE Linux Enterprise High Performance Computing 15-SP3 SUSE Linux Enterprise Module for Basesystem 15-SP3 SUSE Linux Enterprise Module for Development Tools 15-SP3 SUSE Linux Enterprise Server 15-SP3 SUSE Linux Enterprise Server for SAP Applications 15-SP3 SUSE Manager Proxy 4.2 SUSE Manager Retail Branch Server 4.2 SUSE Manager Server 4.2 openSUSE Leap 15.3 ______________________________________________________________________________ An update that solves one vulnerability and has one errata is now available. Description: This update for libarchive fixes the following issues: - CVE-2021-31566: Fixed incorrect usage of file flags (bsc#1192426). - Fixed issues where postprocessing alters symlink targets instead of actual file (bsc#1192427). Patch Instructions: To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 15.3: zypper in -t patch openSUSE-SLE-15.3-2022-3935=1 - SUSE Linux Enterprise Module for Development Tools 15-SP3: zypper in -t patch SUSE-SLE-Module-Development-Tools-15-SP3-2022-3935=1 - SUSE Linux Enterprise Module for Basesystem 15-SP3: zypper in -t patch SUSE-SLE-Module-Basesystem-15-SP3-2022-3935=1 Package List: - openSUSE Leap 15.3 (aarch64 ppc64le s390x x86_64): bsdtar-3.4.2-150200.4.12.1 bsdtar-debuginfo-3.4.2-150200.4.12.1 libarchive-debugsource-3.4.2-150200.4.12.1 libarchive-devel-3.4.2-150200.4.12.1 libarchive13-3.4.2-150200.4.12.1 libarchive13-debuginfo-3.4.2-150200.4.12.1 - openSUSE Leap 15.3 (x86_64): libarchive13-32bit-3.4.2-150200.4.12.1 libarchive13-32bit-debuginfo-3.4.2-150200.4.12.1 - SUSE Linux Enterprise Module for Development Tools 15-SP3 (aarch64 ppc64le s390x x86_64): bsdtar-3.4.2-150200.4.12.1 bsdtar-debuginfo-3.4.2-150200.4.12.1 libarchive-debugsource-3.4.2-150200.4.12.1 - SUSE Linux Enterprise Module for Basesystem 15-SP3 (aarch64 ppc64le s390x x86_64): libarchive-debugsource-3.4.2-150200.4.12.1 libarchive-devel-3.4.2-150200.4.12.1 libarchive13-3.4.2-150200.4.12.1 libarchive13-debuginfo-3.4.2-150200.4.12.1 References: https://www.suse.com/security/cve/CVE-2021-31566.html https://bugzilla.suse.com/1192426 https://bugzilla.suse.com/1192427

1 0

SUSE-SU-2022:3936-1: moderate: Security update for libarchive
by opensuse-security＠opensuse.org 10 Nov '22

10 Nov '22

SUSE Security Update: Security update for libarchive ______________________________________________________________________________ Announcement ID: SUSE-SU-2022:3936-1 Rating: moderate References: #1192426 #1192427 Cross-References: CVE-2021-31566 CVSS scores: CVE-2021-31566 (NVD) : 7.8 CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H CVE-2021-31566 (SUSE): 4.4 CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:L Affected Products: SUSE Linux Enterprise Desktop 15-SP4 SUSE Linux Enterprise High Performance Computing 15-SP4 SUSE Linux Enterprise Micro 5.3 SUSE Linux Enterprise Module for Basesystem 15-SP4 SUSE Linux Enterprise Module for Development Tools 15-SP4 SUSE Linux Enterprise Server 15-SP4 SUSE Linux Enterprise Server for SAP Applications 15-SP4 SUSE Manager Proxy 4.3 SUSE Manager Retail Branch Server 4.3 SUSE Manager Server 4.3 openSUSE Leap 15.4 ______________________________________________________________________________ An update that solves one vulnerability and has one errata is now available. Description: This update for libarchive fixes the following issues: - CVE-2021-31566: Fixed vulnerability where libarchive modifies file flags of symlink target (bsc#1192426) - Fixed issue where processing fixup entries may follow symbolic links (bsc#1192427). Patch Instructions: To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 15.4: zypper in -t patch openSUSE-SLE-15.4-2022-3936=1 - SUSE Linux Enterprise Module for Development Tools 15-SP4: zypper in -t patch SUSE-SLE-Module-Development-Tools-15-SP4-2022-3936=1 - SUSE Linux Enterprise Module for Basesystem 15-SP4: zypper in -t patch SUSE-SLE-Module-Basesystem-15-SP4-2022-3936=1 - SUSE Linux Enterprise Micro 5.3: zypper in -t patch SUSE-SLE-Micro-5.3-2022-3936=1 Package List: - openSUSE Leap 15.4 (aarch64 ppc64le s390x x86_64): bsdtar-3.5.1-150400.3.9.1 bsdtar-debuginfo-3.5.1-150400.3.9.1 libarchive-debugsource-3.5.1-150400.3.9.1 libarchive-devel-3.5.1-150400.3.9.1 libarchive13-3.5.1-150400.3.9.1 libarchive13-debuginfo-3.5.1-150400.3.9.1 - openSUSE Leap 15.4 (x86_64): libarchive13-32bit-3.5.1-150400.3.9.1 libarchive13-32bit-debuginfo-3.5.1-150400.3.9.1 - SUSE Linux Enterprise Module for Development Tools 15-SP4 (aarch64 ppc64le s390x x86_64): bsdtar-3.5.1-150400.3.9.1 bsdtar-debuginfo-3.5.1-150400.3.9.1 libarchive-debugsource-3.5.1-150400.3.9.1 - SUSE Linux Enterprise Module for Basesystem 15-SP4 (aarch64 ppc64le s390x x86_64): libarchive-debugsource-3.5.1-150400.3.9.1 libarchive-devel-3.5.1-150400.3.9.1 libarchive13-3.5.1-150400.3.9.1 libarchive13-debuginfo-3.5.1-150400.3.9.1 - SUSE Linux Enterprise Micro 5.3 (aarch64 s390x x86_64): libarchive-debugsource-3.5.1-150400.3.9.1 libarchive13-3.5.1-150400.3.9.1 libarchive13-debuginfo-3.5.1-150400.3.9.1 References: https://www.suse.com/security/cve/CVE-2021-31566.html https://bugzilla.suse.com/1192426 https://bugzilla.suse.com/1192427

1 0