November 2022 - openSUSE Security Announce

SUSE-SU-2022:4255-1: important: Security update for nodejs14
by opensuse-security＠opensuse.org 28 Nov '22

28 Nov '22

SUSE Security Update: Security update for nodejs14 ______________________________________________________________________________ Announcement ID: SUSE-SU-2022:4255-1 Rating: important References: #1205119 Cross-References: CVE-2022-43548 CVSS scores: CVE-2022-43548 (SUSE): 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N Affected Products: SUSE Enterprise Storage 7 SUSE Enterprise Storage 7.1 SUSE Linux Enterprise High Performance Computing 15-SP2-ESPOS SUSE Linux Enterprise High Performance Computing 15-SP2-LTSS SUSE Linux Enterprise High Performance Computing 15-SP3 SUSE Linux Enterprise Module for Web Scripting 15-SP3 SUSE Linux Enterprise Server 15-SP2-BCL SUSE Linux Enterprise Server 15-SP2-LTSS SUSE Linux Enterprise Server 15-SP3 SUSE Linux Enterprise Server for SAP 15-SP2 SUSE Linux Enterprise Server for SAP Applications 15-SP3 SUSE Manager Proxy 4.1 SUSE Manager Proxy 4.2 SUSE Manager Retail Branch Server 4.1 SUSE Manager Retail Branch Server 4.2 SUSE Manager Server 4.1 SUSE Manager Server 4.2 openSUSE Leap 15.3 openSUSE Leap 15.4 ______________________________________________________________________________ An update that fixes one vulnerability is now available. Description: This update for nodejs14 fixes the following issues: - Update to 14.21.1: - CVE-2022-43548: Fixed DNS rebinding in --inspect via invalid octal IP address (bsc#1205119). - Update to 14.21.0: - src: add --openssl-shared-config option Patch Instructions: To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 15.4: zypper in -t patch openSUSE-SLE-15.4-2022-4255=1 - openSUSE Leap 15.3: zypper in -t patch openSUSE-SLE-15.3-2022-4255=1 - SUSE Manager Server 4.1: zypper in -t patch SUSE-SLE-Product-SUSE-Manager-Server-4.1-2022-4255=1 - SUSE Manager Retail Branch Server 4.1: zypper in -t patch SUSE-SLE-Product-SUSE-Manager-Retail-Branch-Server-4.1-2022-4255=1 - SUSE Manager Proxy 4.1: zypper in -t patch SUSE-SLE-Product-SUSE-Manager-Proxy-4.1-2022-4255=1 - SUSE Linux Enterprise Server for SAP 15-SP2: zypper in -t patch SUSE-SLE-Product-SLES_SAP-15-SP2-2022-4255=1 - SUSE Linux Enterprise Server 15-SP2-LTSS: zypper in -t patch SUSE-SLE-Product-SLES-15-SP2-LTSS-2022-4255=1 - SUSE Linux Enterprise Server 15-SP2-BCL: zypper in -t patch SUSE-SLE-Product-SLES-15-SP2-BCL-2022-4255=1 - SUSE Linux Enterprise Module for Web Scripting 15-SP3: zypper in -t patch SUSE-SLE-Module-Web-Scripting-15-SP3-2022-4255=1 - SUSE Linux Enterprise High Performance Computing 15-SP2-LTSS: zypper in -t patch SUSE-SLE-Product-HPC-15-SP2-LTSS-2022-4255=1 - SUSE Linux Enterprise High Performance Computing 15-SP2-ESPOS: zypper in -t patch SUSE-SLE-Product-HPC-15-SP2-ESPOS-2022-4255=1 - SUSE Enterprise Storage 7: zypper in -t patch SUSE-Storage-7-2022-4255=1 Package List: - openSUSE Leap 15.4 (aarch64 ppc64le s390x x86_64): corepack14-14.21.1-150200.15.40.2 nodejs14-14.21.1-150200.15.40.2 nodejs14-debuginfo-14.21.1-150200.15.40.2 nodejs14-debugsource-14.21.1-150200.15.40.2 nodejs14-devel-14.21.1-150200.15.40.2 npm14-14.21.1-150200.15.40.2 - openSUSE Leap 15.4 (noarch): nodejs14-docs-14.21.1-150200.15.40.2 - openSUSE Leap 15.3 (aarch64 ppc64le s390x x86_64): nodejs14-14.21.1-150200.15.40.2 nodejs14-debuginfo-14.21.1-150200.15.40.2 nodejs14-debugsource-14.21.1-150200.15.40.2 nodejs14-devel-14.21.1-150200.15.40.2 npm14-14.21.1-150200.15.40.2 - openSUSE Leap 15.3 (noarch): nodejs14-docs-14.21.1-150200.15.40.2 - SUSE Manager Server 4.1 (ppc64le s390x x86_64): nodejs14-14.21.1-150200.15.40.2 nodejs14-debuginfo-14.21.1-150200.15.40.2 nodejs14-debugsource-14.21.1-150200.15.40.2 nodejs14-devel-14.21.1-150200.15.40.2 npm14-14.21.1-150200.15.40.2 - SUSE Manager Server 4.1 (noarch): nodejs14-docs-14.21.1-150200.15.40.2 - SUSE Manager Retail Branch Server 4.1 (noarch): nodejs14-docs-14.21.1-150200.15.40.2 - SUSE Manager Retail Branch Server 4.1 (x86_64): nodejs14-14.21.1-150200.15.40.2 nodejs14-debuginfo-14.21.1-150200.15.40.2 nodejs14-debugsource-14.21.1-150200.15.40.2 nodejs14-devel-14.21.1-150200.15.40.2 npm14-14.21.1-150200.15.40.2 - SUSE Manager Proxy 4.1 (x86_64): nodejs14-14.21.1-150200.15.40.2 nodejs14-debuginfo-14.21.1-150200.15.40.2 nodejs14-debugsource-14.21.1-150200.15.40.2 nodejs14-devel-14.21.1-150200.15.40.2 npm14-14.21.1-150200.15.40.2 - SUSE Manager Proxy 4.1 (noarch): nodejs14-docs-14.21.1-150200.15.40.2 - SUSE Linux Enterprise Server for SAP 15-SP2 (ppc64le x86_64): nodejs14-14.21.1-150200.15.40.2 nodejs14-debuginfo-14.21.1-150200.15.40.2 nodejs14-debugsource-14.21.1-150200.15.40.2 nodejs14-devel-14.21.1-150200.15.40.2 npm14-14.21.1-150200.15.40.2 - SUSE Linux Enterprise Server for SAP 15-SP2 (noarch): nodejs14-docs-14.21.1-150200.15.40.2 - SUSE Linux Enterprise Server 15-SP2-LTSS (aarch64 ppc64le s390x x86_64): nodejs14-14.21.1-150200.15.40.2 nodejs14-debuginfo-14.21.1-150200.15.40.2 nodejs14-debugsource-14.21.1-150200.15.40.2 nodejs14-devel-14.21.1-150200.15.40.2 npm14-14.21.1-150200.15.40.2 - SUSE Linux Enterprise Server 15-SP2-LTSS (noarch): nodejs14-docs-14.21.1-150200.15.40.2 - SUSE Linux Enterprise Server 15-SP2-BCL (noarch): nodejs14-docs-14.21.1-150200.15.40.2 - SUSE Linux Enterprise Server 15-SP2-BCL (x86_64): nodejs14-14.21.1-150200.15.40.2 nodejs14-debuginfo-14.21.1-150200.15.40.2 nodejs14-debugsource-14.21.1-150200.15.40.2 nodejs14-devel-14.21.1-150200.15.40.2 npm14-14.21.1-150200.15.40.2 - SUSE Linux Enterprise Module for Web Scripting 15-SP3 (aarch64 ppc64le s390x x86_64): nodejs14-14.21.1-150200.15.40.2 nodejs14-debuginfo-14.21.1-150200.15.40.2 nodejs14-debugsource-14.21.1-150200.15.40.2 nodejs14-devel-14.21.1-150200.15.40.2 npm14-14.21.1-150200.15.40.2 - SUSE Linux Enterprise Module for Web Scripting 15-SP3 (noarch): nodejs14-docs-14.21.1-150200.15.40.2 - SUSE Linux Enterprise High Performance Computing 15-SP2-LTSS (aarch64 x86_64): nodejs14-14.21.1-150200.15.40.2 nodejs14-debuginfo-14.21.1-150200.15.40.2 nodejs14-debugsource-14.21.1-150200.15.40.2 nodejs14-devel-14.21.1-150200.15.40.2 npm14-14.21.1-150200.15.40.2 - SUSE Linux Enterprise High Performance Computing 15-SP2-LTSS (noarch): nodejs14-docs-14.21.1-150200.15.40.2 - SUSE Linux Enterprise High Performance Computing 15-SP2-ESPOS (aarch64 x86_64): nodejs14-14.21.1-150200.15.40.2 nodejs14-debuginfo-14.21.1-150200.15.40.2 nodejs14-debugsource-14.21.1-150200.15.40.2 nodejs14-devel-14.21.1-150200.15.40.2 npm14-14.21.1-150200.15.40.2 - SUSE Linux Enterprise High Performance Computing 15-SP2-ESPOS (noarch): nodejs14-docs-14.21.1-150200.15.40.2 - SUSE Enterprise Storage 7 (aarch64 x86_64): nodejs14-14.21.1-150200.15.40.2 nodejs14-debuginfo-14.21.1-150200.15.40.2 nodejs14-debugsource-14.21.1-150200.15.40.2 nodejs14-devel-14.21.1-150200.15.40.2 npm14-14.21.1-150200.15.40.2 - SUSE Enterprise Storage 7 (noarch): nodejs14-docs-14.21.1-150200.15.40.2 References: https://www.suse.com/security/cve/CVE-2022-43548.html https://bugzilla.suse.com/1205119

1 0

SUSE-SU-2022:4250-1: important: Security update for java-1_8_0-openj9
by opensuse-security＠opensuse.org 28 Nov '22

28 Nov '22

SUSE Security Update: Security update for java-1_8_0-openj9 ______________________________________________________________________________ Announcement ID: SUSE-SU-2022:4250-1 Rating: important References: #1204471 #1204472 #1204473 #1204475 #1204703 Cross-References: CVE-2022-21619 CVE-2022-21624 CVE-2022-21626 CVE-2022-21628 CVE-2022-3676 CVSS scores: CVE-2022-21619 (NVD) : 3.7 CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:N CVE-2022-21619 (SUSE): 3.7 CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:N CVE-2022-21624 (NVD) : 3.7 CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:N CVE-2022-21624 (SUSE): 3.7 CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:N CVE-2022-21626 (NVD) : 5.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L CVE-2022-21626 (SUSE): 5.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L CVE-2022-21628 (NVD) : 5.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L CVE-2022-21628 (SUSE): 5.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L CVE-2022-3676 (NVD) : 6.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N CVE-2022-3676 (SUSE): 6.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N Affected Products: openSUSE Leap 15.3 openSUSE Leap 15.4 ______________________________________________________________________________ An update that fixes 5 vulnerabilities is now available. Description: This update for java-1_8_0-openj9 fixes the following issues: - Update to OpenJDK 8u352 build 08 with OpenJ9 0.35.0 virtual machine, including Oracle October 2022 CPU changes. - CVE-2022-21619: An unauthenticated attacker with network access via multiple protocols to compromise Oracle Java SE (bsc#1204473). - CVE-2022-21626: An unauthenticated attacker with network access via HTTPS can compromise Oracle Java SE, Oracle GraalVM Enterprise Edition (bsc#1204471). - CVE-2022-21624: An unauthenticated attacker with network access via multiple protocols to compromise Oracle Java SE, Oracle GraalVM Enterprise (bsc#1204475). - CVE-2022-21628: An unauthenticated attacker with network access via HTTP can compromise Oracle Java SE, Oracle GraalVM Enterprise Edition (bsc#1204472). - CVE-2022-3676: Fixed interface than calls can be inlined without a runtime type check (bsc#1204703). Patch Instructions: To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 15.4: zypper in -t patch openSUSE-SLE-15.4-2022-4250=1 - openSUSE Leap 15.3: zypper in -t patch openSUSE-SLE-15.3-2022-4250=1 Package List: - openSUSE Leap 15.4 (aarch64 ppc64le s390x x86_64): java-1_8_0-openj9-1.8.0.352-150200.3.27.1 java-1_8_0-openj9-accessibility-1.8.0.352-150200.3.27.1 java-1_8_0-openj9-debuginfo-1.8.0.352-150200.3.27.1 java-1_8_0-openj9-debugsource-1.8.0.352-150200.3.27.1 java-1_8_0-openj9-demo-1.8.0.352-150200.3.27.1 java-1_8_0-openj9-demo-debuginfo-1.8.0.352-150200.3.27.1 java-1_8_0-openj9-devel-1.8.0.352-150200.3.27.1 java-1_8_0-openj9-devel-debuginfo-1.8.0.352-150200.3.27.1 java-1_8_0-openj9-headless-1.8.0.352-150200.3.27.1 java-1_8_0-openj9-headless-debuginfo-1.8.0.352-150200.3.27.1 java-1_8_0-openj9-src-1.8.0.352-150200.3.27.1 - openSUSE Leap 15.4 (noarch): java-1_8_0-openj9-javadoc-1.8.0.352-150200.3.27.1 - openSUSE Leap 15.3 (ppc64le s390x x86_64): java-1_8_0-openj9-1.8.0.352-150200.3.27.1 java-1_8_0-openj9-accessibility-1.8.0.352-150200.3.27.1 java-1_8_0-openj9-debuginfo-1.8.0.352-150200.3.27.1 java-1_8_0-openj9-debugsource-1.8.0.352-150200.3.27.1 java-1_8_0-openj9-demo-1.8.0.352-150200.3.27.1 java-1_8_0-openj9-demo-debuginfo-1.8.0.352-150200.3.27.1 java-1_8_0-openj9-devel-1.8.0.352-150200.3.27.1 java-1_8_0-openj9-headless-1.8.0.352-150200.3.27.1 java-1_8_0-openj9-src-1.8.0.352-150200.3.27.1 - openSUSE Leap 15.3 (noarch): java-1_8_0-openj9-javadoc-1.8.0.352-150200.3.27.1 References: https://www.suse.com/security/cve/CVE-2022-21619.html https://www.suse.com/security/cve/CVE-2022-21624.html https://www.suse.com/security/cve/CVE-2022-21626.html https://www.suse.com/security/cve/CVE-2022-21628.html https://www.suse.com/security/cve/CVE-2022-3676.html https://bugzilla.suse.com/1204471 https://bugzilla.suse.com/1204472 https://bugzilla.suse.com/1204473 https://bugzilla.suse.com/1204475 https://bugzilla.suse.com/1204703

1 0

SUSE-SU-2022:4254-1: important: Security update for nodejs12
by opensuse-security＠opensuse.org 28 Nov '22

28 Nov '22

SUSE Security Update: Security update for nodejs12 ______________________________________________________________________________ Announcement ID: SUSE-SU-2022:4254-1 Rating: important References: #1205119 Cross-References: CVE-2022-43548 CVSS scores: CVE-2022-43548 (SUSE): 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N Affected Products: SUSE Enterprise Storage 7 SUSE Enterprise Storage 7.1 SUSE Linux Enterprise High Performance Computing 15-SP2-ESPOS SUSE Linux Enterprise High Performance Computing 15-SP2-LTSS SUSE Linux Enterprise High Performance Computing 15-SP3 SUSE Linux Enterprise Module for Web Scripting 15-SP3 SUSE Linux Enterprise Server 15-SP2-BCL SUSE Linux Enterprise Server 15-SP2-LTSS SUSE Linux Enterprise Server 15-SP3 SUSE Linux Enterprise Server for SAP 15-SP2 SUSE Linux Enterprise Server for SAP Applications 15-SP3 SUSE Manager Proxy 4.1 SUSE Manager Proxy 4.2 SUSE Manager Retail Branch Server 4.1 SUSE Manager Retail Branch Server 4.2 SUSE Manager Server 4.1 SUSE Manager Server 4.2 openSUSE Leap 15.3 openSUSE Leap 15.4 ______________________________________________________________________________ An update that fixes one vulnerability is now available. Description: This update for nodejs12 fixes the following issues: - CVE-2022-43548: Fixed DNS rebinding in --inspect via invalid octal IP address (bsc#1205119). Patch Instructions: To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 15.4: zypper in -t patch openSUSE-SLE-15.4-2022-4254=1 - openSUSE Leap 15.3: zypper in -t patch openSUSE-SLE-15.3-2022-4254=1 - SUSE Manager Server 4.1: zypper in -t patch SUSE-SLE-Product-SUSE-Manager-Server-4.1-2022-4254=1 - SUSE Manager Retail Branch Server 4.1: zypper in -t patch SUSE-SLE-Product-SUSE-Manager-Retail-Branch-Server-4.1-2022-4254=1 - SUSE Manager Proxy 4.1: zypper in -t patch SUSE-SLE-Product-SUSE-Manager-Proxy-4.1-2022-4254=1 - SUSE Linux Enterprise Server for SAP 15-SP2: zypper in -t patch SUSE-SLE-Product-SLES_SAP-15-SP2-2022-4254=1 - SUSE Linux Enterprise Server 15-SP2-LTSS: zypper in -t patch SUSE-SLE-Product-SLES-15-SP2-LTSS-2022-4254=1 - SUSE Linux Enterprise Server 15-SP2-BCL: zypper in -t patch SUSE-SLE-Product-SLES-15-SP2-BCL-2022-4254=1 - SUSE Linux Enterprise Module for Web Scripting 15-SP3: zypper in -t patch SUSE-SLE-Module-Web-Scripting-15-SP3-2022-4254=1 - SUSE Linux Enterprise High Performance Computing 15-SP2-LTSS: zypper in -t patch SUSE-SLE-Product-HPC-15-SP2-LTSS-2022-4254=1 - SUSE Linux Enterprise High Performance Computing 15-SP2-ESPOS: zypper in -t patch SUSE-SLE-Product-HPC-15-SP2-ESPOS-2022-4254=1 - SUSE Enterprise Storage 7: zypper in -t patch SUSE-Storage-7-2022-4254=1 Package List: - openSUSE Leap 15.4 (aarch64 ppc64le s390x x86_64): nodejs12-12.22.12-150200.4.41.2 nodejs12-debuginfo-12.22.12-150200.4.41.2 nodejs12-debugsource-12.22.12-150200.4.41.2 nodejs12-devel-12.22.12-150200.4.41.2 npm12-12.22.12-150200.4.41.2 - openSUSE Leap 15.4 (noarch): nodejs12-docs-12.22.12-150200.4.41.2 - openSUSE Leap 15.3 (aarch64 ppc64le s390x x86_64): nodejs12-12.22.12-150200.4.41.2 nodejs12-debuginfo-12.22.12-150200.4.41.2 nodejs12-debugsource-12.22.12-150200.4.41.2 nodejs12-devel-12.22.12-150200.4.41.2 npm12-12.22.12-150200.4.41.2 - openSUSE Leap 15.3 (noarch): nodejs12-docs-12.22.12-150200.4.41.2 - SUSE Manager Server 4.1 (ppc64le s390x x86_64): nodejs12-12.22.12-150200.4.41.2 nodejs12-debuginfo-12.22.12-150200.4.41.2 nodejs12-debugsource-12.22.12-150200.4.41.2 nodejs12-devel-12.22.12-150200.4.41.2 npm12-12.22.12-150200.4.41.2 - SUSE Manager Server 4.1 (noarch): nodejs12-docs-12.22.12-150200.4.41.2 - SUSE Manager Retail Branch Server 4.1 (x86_64): nodejs12-12.22.12-150200.4.41.2 nodejs12-debuginfo-12.22.12-150200.4.41.2 nodejs12-debugsource-12.22.12-150200.4.41.2 nodejs12-devel-12.22.12-150200.4.41.2 npm12-12.22.12-150200.4.41.2 - SUSE Manager Retail Branch Server 4.1 (noarch): nodejs12-docs-12.22.12-150200.4.41.2 - SUSE Manager Proxy 4.1 (x86_64): nodejs12-12.22.12-150200.4.41.2 nodejs12-debuginfo-12.22.12-150200.4.41.2 nodejs12-debugsource-12.22.12-150200.4.41.2 nodejs12-devel-12.22.12-150200.4.41.2 npm12-12.22.12-150200.4.41.2 - SUSE Manager Proxy 4.1 (noarch): nodejs12-docs-12.22.12-150200.4.41.2 - SUSE Linux Enterprise Server for SAP 15-SP2 (ppc64le x86_64): nodejs12-12.22.12-150200.4.41.2 nodejs12-debuginfo-12.22.12-150200.4.41.2 nodejs12-debugsource-12.22.12-150200.4.41.2 nodejs12-devel-12.22.12-150200.4.41.2 npm12-12.22.12-150200.4.41.2 - SUSE Linux Enterprise Server for SAP 15-SP2 (noarch): nodejs12-docs-12.22.12-150200.4.41.2 - SUSE Linux Enterprise Server 15-SP2-LTSS (aarch64 ppc64le s390x x86_64): nodejs12-12.22.12-150200.4.41.2 nodejs12-debuginfo-12.22.12-150200.4.41.2 nodejs12-debugsource-12.22.12-150200.4.41.2 nodejs12-devel-12.22.12-150200.4.41.2 npm12-12.22.12-150200.4.41.2 - SUSE Linux Enterprise Server 15-SP2-LTSS (noarch): nodejs12-docs-12.22.12-150200.4.41.2 - SUSE Linux Enterprise Server 15-SP2-BCL (x86_64): nodejs12-12.22.12-150200.4.41.2 nodejs12-debuginfo-12.22.12-150200.4.41.2 nodejs12-debugsource-12.22.12-150200.4.41.2 nodejs12-devel-12.22.12-150200.4.41.2 npm12-12.22.12-150200.4.41.2 - SUSE Linux Enterprise Server 15-SP2-BCL (noarch): nodejs12-docs-12.22.12-150200.4.41.2 - SUSE Linux Enterprise Module for Web Scripting 15-SP3 (aarch64 ppc64le s390x x86_64): nodejs12-12.22.12-150200.4.41.2 nodejs12-debuginfo-12.22.12-150200.4.41.2 nodejs12-debugsource-12.22.12-150200.4.41.2 nodejs12-devel-12.22.12-150200.4.41.2 npm12-12.22.12-150200.4.41.2 - SUSE Linux Enterprise Module for Web Scripting 15-SP3 (noarch): nodejs12-docs-12.22.12-150200.4.41.2 - SUSE Linux Enterprise High Performance Computing 15-SP2-LTSS (aarch64 x86_64): nodejs12-12.22.12-150200.4.41.2 nodejs12-debuginfo-12.22.12-150200.4.41.2 nodejs12-debugsource-12.22.12-150200.4.41.2 nodejs12-devel-12.22.12-150200.4.41.2 npm12-12.22.12-150200.4.41.2 - SUSE Linux Enterprise High Performance Computing 15-SP2-LTSS (noarch): nodejs12-docs-12.22.12-150200.4.41.2 - SUSE Linux Enterprise High Performance Computing 15-SP2-ESPOS (aarch64 x86_64): nodejs12-12.22.12-150200.4.41.2 nodejs12-debuginfo-12.22.12-150200.4.41.2 nodejs12-debugsource-12.22.12-150200.4.41.2 nodejs12-devel-12.22.12-150200.4.41.2 npm12-12.22.12-150200.4.41.2 - SUSE Linux Enterprise High Performance Computing 15-SP2-ESPOS (noarch): nodejs12-docs-12.22.12-150200.4.41.2 - SUSE Enterprise Storage 7 (aarch64 x86_64): nodejs12-12.22.12-150200.4.41.2 nodejs12-debuginfo-12.22.12-150200.4.41.2 nodejs12-debugsource-12.22.12-150200.4.41.2 nodejs12-devel-12.22.12-150200.4.41.2 npm12-12.22.12-150200.4.41.2 - SUSE Enterprise Storage 7 (noarch): nodejs12-docs-12.22.12-150200.4.41.2 References: https://www.suse.com/security/cve/CVE-2022-43548.html https://bugzilla.suse.com/1205119

1 0

openSUSE-SU-2022:10221-1: important: Security update for chromium
by opensuse-security＠opensuse.org 28 Nov '22

28 Nov '22

openSUSE Security Update: Security update for chromium ______________________________________________________________________________ Announcement ID: openSUSE-SU-2022:10221-1 Rating: important References: #1205736 Cross-References: CVE-2022-4135 Affected Products: openSUSE Backports SLE-15-SP3 openSUSE Backports SLE-15-SP4 ______________________________________________________________________________ An update that fixes one vulnerability is now available. Description: This update for chromium fixes the following issues: Chromium 107.0.5304.121 (boo#1205736) * CVE-2022-4135: Heap buffer overflow in GPU Patch Instructions: To install this openSUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Backports SLE-15-SP4: zypper in -t patch openSUSE-2022-10221=1 - openSUSE Backports SLE-15-SP3: zypper in -t patch openSUSE-2022-10221=1 Package List: - openSUSE Backports SLE-15-SP4 (aarch64 x86_64): chromedriver-107.0.5304.121-bp154.2.46.1 chromedriver-debuginfo-107.0.5304.121-bp154.2.46.1 chromium-107.0.5304.121-bp154.2.46.1 chromium-debuginfo-107.0.5304.121-bp154.2.46.1 - openSUSE Backports SLE-15-SP3 (aarch64 x86_64): chromedriver-107.0.5304.121-bp153.2.139.1 chromium-107.0.5304.121-bp153.2.139.1 References: https://www.suse.com/security/cve/CVE-2022-4135.html https://bugzilla.suse.com/1205736

1 0

openSUSE-SU-2022:10218-1: important: Security update for opera
by opensuse-security＠opensuse.org 26 Nov '22

26 Nov '22

openSUSE Security Update: Security update for opera ______________________________________________________________________________ Announcement ID: openSUSE-SU-2022:10218-1 Rating: important References: Cross-References: CVE-2022-3723 CVSS scores: CVE-2022-3723 (NVD) : 8.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H Affected Products: openSUSE Leap 15.3:NonFree ______________________________________________________________________________ An update that fixes one vulnerability is now available. Description: This update for opera fixes the following issues: Update to 93.0.4585.11: - CHR-9051 Update chromium on desktop-stable-107-4585 to 107.0.5304.88 - DNA-95965 Add support for more UD TLDs - DNA-102960 Replace messengers icons - DNA-102964 Crash at -[FramedBrowserWindow sendEvent:] - DNA-103125 Translations for O93 - DNA-103287 Bump O93 to stable Patch Instructions: To install this openSUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 15.3:NonFree: zypper in -t patch openSUSE-2022-10218=1 Package List: - openSUSE Leap 15.3:NonFree (x86_64): opera-93.0.4585.11-lp153.2.69.1 References: https://www.suse.com/security/cve/CVE-2022-3723.html

1 0

openSUSE-SU-2022:10219-1: important: Security update for opera
by opensuse-security＠opensuse.org 26 Nov '22

26 Nov '22

openSUSE Security Update: Security update for opera ______________________________________________________________________________ Announcement ID: openSUSE-SU-2022:10219-1 Rating: important References: Cross-References: CVE-2022-3723 CVSS scores: CVE-2022-3723 (NVD) : 8.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H Affected Products: openSUSE Leap 15.4:NonFree ______________________________________________________________________________ An update that fixes one vulnerability is now available. Description: This update for opera fixes the following issues: Update to 93.0.4585.11 - CHR-9051 Update chromium on desktop-stable-107-4585 to 107.0.5304.88 - DNA-95965 Add support for more UD TLDs - DNA-102960 Replace messengers icons - DNA-102964 Crash at -[FramedBrowserWindow sendEvent:] - DNA-103125 Translations for O93 - DNA-103287 Bump O93 to stable Patch Instructions: To install this openSUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 15.4:NonFree: zypper in -t patch openSUSE-2022-10219=1 Package List: - openSUSE Leap 15.4:NonFree (x86_64): opera-93.0.4585.11-lp154.2.29.1 References: https://www.suse.com/security/cve/CVE-2022-3723.html

1 0

SUSE-SU-2022:4224-1: moderate: Security update for freerdp
by opensuse-security＠opensuse.org 25 Nov '22

25 Nov '22

SUSE Security Update: Security update for freerdp ______________________________________________________________________________ Announcement ID: SUSE-SU-2022:4224-1 Rating: moderate References: #1205563 #1205564 Cross-References: CVE-2022-39318 CVE-2022-39319 CVSS scores: CVE-2022-39318 (NVD) : 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H CVE-2022-39318 (SUSE): 4.5 CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:U/C:N/I:N/A:H CVE-2022-39319 (NVD) : 9.1 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:H CVE-2022-39319 (SUSE): 6.1 CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:U/C:H/I:N/A:H Affected Products: SUSE Linux Enterprise Desktop 15-SP4 SUSE Linux Enterprise High Performance Computing 15-SP4 SUSE Linux Enterprise Module for Packagehub Subpackages 15-SP4 SUSE Linux Enterprise Server 15-SP4 SUSE Linux Enterprise Server for SAP Applications 15-SP4 SUSE Linux Enterprise Workstation Extension 15-SP4 SUSE Manager Proxy 4.3 SUSE Manager Retail Branch Server 4.3 SUSE Manager Server 4.3 openSUSE Leap 15.4 ______________________________________________________________________________ An update that fixes two vulnerabilities is now available. Description: This update for freerdp fixes the following issues: - CVE-2022-39318: Fixed division by zero in urbdrc (bsc#1205563). - CVE-2022-39319: Fixed missing input buffer length check in urbdrc (bsc#1205564). Patch Instructions: To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 15.4: zypper in -t patch openSUSE-SLE-15.4-2022-4224=1 - SUSE Linux Enterprise Workstation Extension 15-SP4: zypper in -t patch SUSE-SLE-Product-WE-15-SP4-2022-4224=1 - SUSE Linux Enterprise Module for Packagehub Subpackages 15-SP4: zypper in -t patch SUSE-SLE-Module-Packagehub-Subpackages-15-SP4-2022-4224=1 Package List: - openSUSE Leap 15.4 (aarch64 ppc64le s390x x86_64): freerdp-2.4.0-150400.3.12.1 freerdp-debuginfo-2.4.0-150400.3.12.1 freerdp-debugsource-2.4.0-150400.3.12.1 freerdp-devel-2.4.0-150400.3.12.1 freerdp-proxy-2.4.0-150400.3.12.1 freerdp-proxy-debuginfo-2.4.0-150400.3.12.1 freerdp-server-2.4.0-150400.3.12.1 freerdp-server-debuginfo-2.4.0-150400.3.12.1 freerdp-wayland-2.4.0-150400.3.12.1 freerdp-wayland-debuginfo-2.4.0-150400.3.12.1 libfreerdp2-2.4.0-150400.3.12.1 libfreerdp2-debuginfo-2.4.0-150400.3.12.1 libuwac0-0-2.4.0-150400.3.12.1 libuwac0-0-debuginfo-2.4.0-150400.3.12.1 libwinpr2-2.4.0-150400.3.12.1 libwinpr2-debuginfo-2.4.0-150400.3.12.1 uwac0-0-devel-2.4.0-150400.3.12.1 winpr2-devel-2.4.0-150400.3.12.1 - SUSE Linux Enterprise Workstation Extension 15-SP4 (x86_64): freerdp-2.4.0-150400.3.12.1 freerdp-debuginfo-2.4.0-150400.3.12.1 freerdp-debugsource-2.4.0-150400.3.12.1 freerdp-devel-2.4.0-150400.3.12.1 freerdp-proxy-2.4.0-150400.3.12.1 freerdp-proxy-debuginfo-2.4.0-150400.3.12.1 libfreerdp2-2.4.0-150400.3.12.1 libfreerdp2-debuginfo-2.4.0-150400.3.12.1 libwinpr2-2.4.0-150400.3.12.1 libwinpr2-debuginfo-2.4.0-150400.3.12.1 winpr2-devel-2.4.0-150400.3.12.1 - SUSE Linux Enterprise Module for Packagehub Subpackages 15-SP4 (aarch64 ppc64le s390x): freerdp-2.4.0-150400.3.12.1 freerdp-debuginfo-2.4.0-150400.3.12.1 freerdp-debugsource-2.4.0-150400.3.12.1 freerdp-devel-2.4.0-150400.3.12.1 freerdp-proxy-2.4.0-150400.3.12.1 freerdp-proxy-debuginfo-2.4.0-150400.3.12.1 libfreerdp2-2.4.0-150400.3.12.1 libfreerdp2-debuginfo-2.4.0-150400.3.12.1 libwinpr2-2.4.0-150400.3.12.1 libwinpr2-debuginfo-2.4.0-150400.3.12.1 winpr2-devel-2.4.0-150400.3.12.1 References: https://www.suse.com/security/cve/CVE-2022-39318.html https://www.suse.com/security/cve/CVE-2022-39319.html https://bugzilla.suse.com/1205563 https://bugzilla.suse.com/1205564

1 0

SUSE-SU-2022:4219-1: important: Security update for grub2
by opensuse-security＠opensuse.org 25 Nov '22

25 Nov '22

SUSE Security Update: Security update for grub2 ______________________________________________________________________________ Announcement ID: SUSE-SU-2022:4219-1 Rating: important References: #1205178 #1205182 Cross-References: CVE-2022-2601 CVE-2022-3775 CVSS scores: CVE-2022-2601 (SUSE): 6.4 CVSS:3.1/AV:L/AC:H/PR:H/UI:N/S:U/C:H/I:H/A:H CVE-2022-3775 (SUSE): 6.4 CVSS:3.1/AV:L/AC:H/PR:H/UI:N/S:U/C:H/I:H/A:H Affected Products: SUSE Enterprise Storage 7.1 SUSE Linux Enterprise Desktop 15-SP3 SUSE Linux Enterprise High Performance Computing 15-SP3 SUSE Linux Enterprise Micro 5.2 SUSE Linux Enterprise Module for Basesystem 15-SP3 SUSE Linux Enterprise Module for SUSE Manager Proxy 4.2 SUSE Linux Enterprise Module for Server Applications 15-SP3 SUSE Linux Enterprise Server 15-SP3 SUSE Linux Enterprise Server for SAP Applications 15-SP3 SUSE Manager Proxy 4.2 SUSE Manager Retail Branch Server 4.2 SUSE Manager Server 4.2 openSUSE Leap 15.3 openSUSE Leap Micro 5.2 ______________________________________________________________________________ An update that fixes two vulnerabilities is now available. Description: This update for grub2 fixes the following issues: - CVE-2022-2601: Fixed buffer overflow in grub_font_construct_glyph (bsc#1205178). - CVE-2022-3775: Fixed integer underflow in blit_comb() (bsc#1205182). Other: - Bump upstream SBAT generation to 3 Patch Instructions: To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap Micro 5.2: zypper in -t patch openSUSE-Leap-Micro-5.2-2022-4219=1 - openSUSE Leap 15.3: zypper in -t patch openSUSE-SLE-15.3-2022-4219=1 - SUSE Linux Enterprise Module for Server Applications 15-SP3: zypper in -t patch SUSE-SLE-Module-Server-Applications-15-SP3-2022-4219=1 - SUSE Linux Enterprise Module for SUSE Manager Proxy 4.2: zypper in -t patch SUSE-SLE-Module-SUSE-Manager-Proxy-4.2-2022-4219=1 - SUSE Linux Enterprise Module for Basesystem 15-SP3: zypper in -t patch SUSE-SLE-Module-Basesystem-15-SP3-2022-4219=1 - SUSE Linux Enterprise Micro 5.2: zypper in -t patch SUSE-SUSE-MicroOS-5.2-2022-4219=1 Package List: - openSUSE Leap Micro 5.2 (aarch64 x86_64): grub2-2.04-150300.22.25.1 grub2-debuginfo-2.04-150300.22.25.1 grub2-debugsource-2.04-150300.22.25.1 - openSUSE Leap Micro 5.2 (noarch): grub2-arm64-efi-2.04-150300.22.25.1 grub2-i386-pc-2.04-150300.22.25.1 grub2-snapper-plugin-2.04-150300.22.25.1 grub2-x86_64-efi-2.04-150300.22.25.1 grub2-x86_64-xen-2.04-150300.22.25.1 - openSUSE Leap 15.3 (aarch64 ppc64le s390x x86_64): grub2-2.04-150300.22.25.1 grub2-branding-upstream-2.04-150300.22.25.1 grub2-debuginfo-2.04-150300.22.25.1 - openSUSE Leap 15.3 (aarch64 s390x x86_64): grub2-debugsource-2.04-150300.22.25.1 - openSUSE Leap 15.3 (noarch): grub2-arm64-efi-2.04-150300.22.25.1 grub2-arm64-efi-debug-2.04-150300.22.25.1 grub2-i386-pc-2.04-150300.22.25.1 grub2-i386-pc-debug-2.04-150300.22.25.1 grub2-powerpc-ieee1275-2.04-150300.22.25.1 grub2-powerpc-ieee1275-debug-2.04-150300.22.25.1 grub2-snapper-plugin-2.04-150300.22.25.1 grub2-systemd-sleep-plugin-2.04-150300.22.25.1 grub2-x86_64-efi-2.04-150300.22.25.1 grub2-x86_64-efi-debug-2.04-150300.22.25.1 grub2-x86_64-xen-2.04-150300.22.25.1 - openSUSE Leap 15.3 (s390x): grub2-s390x-emu-2.04-150300.22.25.1 grub2-s390x-emu-debug-2.04-150300.22.25.1 - SUSE Linux Enterprise Module for Server Applications 15-SP3 (noarch): grub2-x86_64-xen-2.04-150300.22.25.1 - SUSE Linux Enterprise Module for SUSE Manager Proxy 4.2 (noarch): grub2-arm64-efi-2.04-150300.22.25.1 - SUSE Linux Enterprise Module for Basesystem 15-SP3 (aarch64 ppc64le s390x x86_64): grub2-2.04-150300.22.25.1 grub2-debuginfo-2.04-150300.22.25.1 - SUSE Linux Enterprise Module for Basesystem 15-SP3 (aarch64 s390x x86_64): grub2-debugsource-2.04-150300.22.25.1 - SUSE Linux Enterprise Module for Basesystem 15-SP3 (noarch): grub2-arm64-efi-2.04-150300.22.25.1 grub2-i386-pc-2.04-150300.22.25.1 grub2-powerpc-ieee1275-2.04-150300.22.25.1 grub2-snapper-plugin-2.04-150300.22.25.1 grub2-systemd-sleep-plugin-2.04-150300.22.25.1 grub2-x86_64-efi-2.04-150300.22.25.1 - SUSE Linux Enterprise Module for Basesystem 15-SP3 (s390x): grub2-s390x-emu-2.04-150300.22.25.1 - SUSE Linux Enterprise Micro 5.2 (aarch64 s390x x86_64): grub2-2.04-150300.22.25.1 grub2-debuginfo-2.04-150300.22.25.1 grub2-debugsource-2.04-150300.22.25.1 - SUSE Linux Enterprise Micro 5.2 (noarch): grub2-arm64-efi-2.04-150300.22.25.1 grub2-i386-pc-2.04-150300.22.25.1 grub2-snapper-plugin-2.04-150300.22.25.1 grub2-x86_64-efi-2.04-150300.22.25.1 grub2-x86_64-xen-2.04-150300.22.25.1 - SUSE Linux Enterprise Micro 5.2 (s390x): grub2-s390x-emu-2.04-150300.22.25.1 References: https://www.suse.com/security/cve/CVE-2022-2601.html https://www.suse.com/security/cve/CVE-2022-3775.html https://bugzilla.suse.com/1205178 https://bugzilla.suse.com/1205182

1 0

SUSE-SU-2022:4215-1: important: Security update for erlang
by opensuse-security＠opensuse.org 24 Nov '22

24 Nov '22

SUSE Security Update: Security update for erlang ______________________________________________________________________________ Announcement ID: SUSE-SU-2022:4215-1 Rating: important References: #1205318 Cross-References: CVE-2022-37026 CVSS scores: CVE-2022-37026 (NVD) : 9.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H CVE-2022-37026 (SUSE): 9.4 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:L Affected Products: SUSE Enterprise Storage 7.1 SUSE Linux Enterprise High Performance Computing 15-SP3 SUSE Linux Enterprise High Performance Computing 15-SP4 SUSE Linux Enterprise Module for Server Applications 15-SP3 SUSE Linux Enterprise Module for Server Applications 15-SP4 SUSE Linux Enterprise Server 15-SP3 SUSE Linux Enterprise Server 15-SP4 SUSE Linux Enterprise Server for SAP Applications 15-SP3 SUSE Linux Enterprise Server for SAP Applications 15-SP4 SUSE Manager Proxy 4.2 SUSE Manager Proxy 4.3 SUSE Manager Retail Branch Server 4.2 SUSE Manager Retail Branch Server 4.3 SUSE Manager Server 4.2 SUSE Manager Server 4.3 openSUSE Leap 15.3 openSUSE Leap 15.4 ______________________________________________________________________________ An update that fixes one vulnerability is now available. Description: This update for erlang fixes the following issues: - CVE-2022-37026: fixed a client authorization bypass vulnerability for SSL, TLS, and DTLS in Erlang/OTP. [bsc#1205318] Patch Instructions: To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 15.4: zypper in -t patch openSUSE-SLE-15.4-2022-4215=1 - openSUSE Leap 15.3: zypper in -t patch openSUSE-SLE-15.3-2022-4215=1 - SUSE Linux Enterprise Module for Server Applications 15-SP4: zypper in -t patch SUSE-SLE-Module-Server-Applications-15-SP4-2022-4215=1 - SUSE Linux Enterprise Module for Server Applications 15-SP3: zypper in -t patch SUSE-SLE-Module-Server-Applications-15-SP3-2022-4215=1 Package List: - openSUSE Leap 15.4 (aarch64 ppc64le s390x x86_64): erlang-22.3-150300.3.3.1 erlang-debugger-22.3-150300.3.3.1 erlang-debugger-src-22.3-150300.3.3.1 erlang-debuginfo-22.3-150300.3.3.1 erlang-debugsource-22.3-150300.3.3.1 erlang-dialyzer-22.3-150300.3.3.1 erlang-dialyzer-debuginfo-22.3-150300.3.3.1 erlang-dialyzer-src-22.3-150300.3.3.1 erlang-diameter-22.3-150300.3.3.1 erlang-diameter-src-22.3-150300.3.3.1 erlang-doc-22.3-150300.3.3.1 erlang-epmd-22.3-150300.3.3.1 erlang-epmd-debuginfo-22.3-150300.3.3.1 erlang-et-22.3-150300.3.3.1 erlang-et-src-22.3-150300.3.3.1 erlang-jinterface-22.3-150300.3.3.1 erlang-jinterface-src-22.3-150300.3.3.1 erlang-observer-22.3-150300.3.3.1 erlang-observer-src-22.3-150300.3.3.1 erlang-reltool-22.3-150300.3.3.1 erlang-reltool-src-22.3-150300.3.3.1 erlang-src-22.3-150300.3.3.1 erlang-wx-22.3-150300.3.3.1 erlang-wx-debuginfo-22.3-150300.3.3.1 erlang-wx-src-22.3-150300.3.3.1 - openSUSE Leap 15.3 (aarch64 ppc64le s390x x86_64): erlang-22.3-150300.3.3.1 erlang-debugger-22.3-150300.3.3.1 erlang-debugger-src-22.3-150300.3.3.1 erlang-debuginfo-22.3-150300.3.3.1 erlang-debugsource-22.3-150300.3.3.1 erlang-dialyzer-22.3-150300.3.3.1 erlang-dialyzer-debuginfo-22.3-150300.3.3.1 erlang-dialyzer-src-22.3-150300.3.3.1 erlang-diameter-22.3-150300.3.3.1 erlang-diameter-src-22.3-150300.3.3.1 erlang-doc-22.3-150300.3.3.1 erlang-epmd-22.3-150300.3.3.1 erlang-epmd-debuginfo-22.3-150300.3.3.1 erlang-et-22.3-150300.3.3.1 erlang-et-src-22.3-150300.3.3.1 erlang-jinterface-22.3-150300.3.3.1 erlang-jinterface-src-22.3-150300.3.3.1 erlang-observer-22.3-150300.3.3.1 erlang-observer-src-22.3-150300.3.3.1 erlang-reltool-22.3-150300.3.3.1 erlang-reltool-src-22.3-150300.3.3.1 erlang-src-22.3-150300.3.3.1 erlang-wx-22.3-150300.3.3.1 erlang-wx-debuginfo-22.3-150300.3.3.1 erlang-wx-src-22.3-150300.3.3.1 - SUSE Linux Enterprise Module for Server Applications 15-SP4 (aarch64 ppc64le s390x x86_64): erlang-22.3-150300.3.3.1 erlang-debuginfo-22.3-150300.3.3.1 erlang-debugsource-22.3-150300.3.3.1 erlang-epmd-22.3-150300.3.3.1 erlang-epmd-debuginfo-22.3-150300.3.3.1 - SUSE Linux Enterprise Module for Server Applications 15-SP3 (aarch64 ppc64le s390x x86_64): erlang-22.3-150300.3.3.1 erlang-debuginfo-22.3-150300.3.3.1 erlang-debugsource-22.3-150300.3.3.1 erlang-epmd-22.3-150300.3.3.1 erlang-epmd-debuginfo-22.3-150300.3.3.1 References: https://www.suse.com/security/cve/CVE-2022-37026.html https://bugzilla.suse.com/1205318

1 0

SUSE-SU-2022:4214-1: Security update for libdb-4_8
by opensuse-security＠opensuse.org 24 Nov '22

24 Nov '22

SUSE Security Update: Security update for libdb-4_8 ______________________________________________________________________________ Announcement ID: SUSE-SU-2022:4214-1 Rating: low References: #1174414 Cross-References: CVE-2019-2708 CVSS scores: CVE-2019-2708 (NVD) : 3.3 CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L CVE-2019-2708 (SUSE): 3.3 CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L Affected Products: SUSE Enterprise Storage 7.1 SUSE Linux Enterprise Desktop 15-SP3 SUSE Linux Enterprise Desktop 15-SP4 SUSE Linux Enterprise High Performance Computing 15-SP3 SUSE Linux Enterprise High Performance Computing 15-SP4 SUSE Linux Enterprise Micro 5.1 SUSE Linux Enterprise Micro 5.2 SUSE Linux Enterprise Micro 5.3 SUSE Linux Enterprise Module for Basesystem 15-SP3 SUSE Linux Enterprise Module for Basesystem 15-SP4 SUSE Linux Enterprise Server 15-SP3 SUSE Linux Enterprise Server 15-SP4 SUSE Linux Enterprise Server for SAP Applications 15-SP3 SUSE Linux Enterprise Server for SAP Applications 15-SP4 SUSE Manager Proxy 4.2 SUSE Manager Proxy 4.3 SUSE Manager Retail Branch Server 4.2 SUSE Manager Retail Branch Server 4.3 SUSE Manager Server 4.2 SUSE Manager Server 4.3 openSUSE Leap 15.3 openSUSE Leap 15.4 openSUSE Leap Micro 5.2 openSUSE Leap Micro 5.3 ______________________________________________________________________________ An update that fixes one vulnerability is now available. Description: This update for libdb-4_8 fixes the following issues: - CVE-2019-2708: Fixed partial DoS due to data store execution (bsc#1174414). Patch Instructions: To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap Micro 5.3: zypper in -t patch openSUSE-Leap-Micro-5.3-2022-4214=1 - openSUSE Leap Micro 5.2: zypper in -t patch openSUSE-Leap-Micro-5.2-2022-4214=1 - openSUSE Leap 15.4: zypper in -t patch openSUSE-SLE-15.4-2022-4214=1 - openSUSE Leap 15.3: zypper in -t patch openSUSE-SLE-15.3-2022-4214=1 - SUSE Linux Enterprise Module for Basesystem 15-SP4: zypper in -t patch SUSE-SLE-Module-Basesystem-15-SP4-2022-4214=1 - SUSE Linux Enterprise Module for Basesystem 15-SP3: zypper in -t patch SUSE-SLE-Module-Basesystem-15-SP3-2022-4214=1 - SUSE Linux Enterprise Micro 5.3: zypper in -t patch SUSE-SLE-Micro-5.3-2022-4214=1 - SUSE Linux Enterprise Micro 5.2: zypper in -t patch SUSE-SUSE-MicroOS-5.2-2022-4214=1 - SUSE Linux Enterprise Micro 5.1: zypper in -t patch SUSE-SUSE-MicroOS-5.1-2022-4214=1 Package List: - openSUSE Leap Micro 5.3 (aarch64 x86_64): db48-utils-4.8.30-150000.7.6.1 db48-utils-debuginfo-4.8.30-150000.7.6.1 libdb-4_8-4.8.30-150000.7.6.1 libdb-4_8-debuginfo-4.8.30-150000.7.6.1 libdb-4_8-debugsource-4.8.30-150000.7.6.1 - openSUSE Leap Micro 5.2 (aarch64 x86_64): db48-utils-4.8.30-150000.7.6.1 db48-utils-debuginfo-4.8.30-150000.7.6.1 libdb-4_8-4.8.30-150000.7.6.1 libdb-4_8-debuginfo-4.8.30-150000.7.6.1 libdb-4_8-debugsource-4.8.30-150000.7.6.1 - openSUSE Leap 15.4 (aarch64 ppc64le s390x x86_64): db48-utils-4.8.30-150000.7.6.1 db48-utils-debuginfo-4.8.30-150000.7.6.1 libdb-4_8-4.8.30-150000.7.6.1 libdb-4_8-debuginfo-4.8.30-150000.7.6.1 libdb-4_8-debugsource-4.8.30-150000.7.6.1 libdb-4_8-devel-4.8.30-150000.7.6.1 libdb_java-4_8-4.8.30-150000.7.6.1 libdb_java-4_8-debuginfo-4.8.30-150000.7.6.1 libdb_java-4_8-debugsource-4.8.30-150000.7.6.1 libdb_java-4_8-devel-4.8.30-150000.7.6.1 - openSUSE Leap 15.4 (x86_64): libdb-4_8-32bit-4.8.30-150000.7.6.1 libdb-4_8-32bit-debuginfo-4.8.30-150000.7.6.1 libdb-4_8-devel-32bit-4.8.30-150000.7.6.1 - openSUSE Leap 15.4 (noarch): db48-doc-4.8.30-150000.7.6.1 - openSUSE Leap 15.3 (aarch64 ppc64le s390x x86_64): db48-utils-4.8.30-150000.7.6.1 db48-utils-debuginfo-4.8.30-150000.7.6.1 libdb-4_8-4.8.30-150000.7.6.1 libdb-4_8-debuginfo-4.8.30-150000.7.6.1 libdb-4_8-debugsource-4.8.30-150000.7.6.1 libdb-4_8-devel-4.8.30-150000.7.6.1 libdb_java-4_8-4.8.30-150000.7.6.1 libdb_java-4_8-debuginfo-4.8.30-150000.7.6.1 libdb_java-4_8-debugsource-4.8.30-150000.7.6.1 libdb_java-4_8-devel-4.8.30-150000.7.6.1 - openSUSE Leap 15.3 (x86_64): libdb-4_8-32bit-4.8.30-150000.7.6.1 libdb-4_8-32bit-debuginfo-4.8.30-150000.7.6.1 libdb-4_8-devel-32bit-4.8.30-150000.7.6.1 - openSUSE Leap 15.3 (noarch): db48-doc-4.8.30-150000.7.6.1 - SUSE Linux Enterprise Module for Basesystem 15-SP4 (aarch64 ppc64le s390x x86_64): db48-utils-4.8.30-150000.7.6.1 db48-utils-debuginfo-4.8.30-150000.7.6.1 libdb-4_8-4.8.30-150000.7.6.1 libdb-4_8-debuginfo-4.8.30-150000.7.6.1 libdb-4_8-debugsource-4.8.30-150000.7.6.1 libdb-4_8-devel-4.8.30-150000.7.6.1 - SUSE Linux Enterprise Module for Basesystem 15-SP4 (x86_64): libdb-4_8-32bit-4.8.30-150000.7.6.1 libdb-4_8-32bit-debuginfo-4.8.30-150000.7.6.1 - SUSE Linux Enterprise Module for Basesystem 15-SP3 (aarch64 ppc64le s390x x86_64): db48-utils-4.8.30-150000.7.6.1 db48-utils-debuginfo-4.8.30-150000.7.6.1 libdb-4_8-4.8.30-150000.7.6.1 libdb-4_8-debuginfo-4.8.30-150000.7.6.1 libdb-4_8-debugsource-4.8.30-150000.7.6.1 libdb-4_8-devel-4.8.30-150000.7.6.1 - SUSE Linux Enterprise Module for Basesystem 15-SP3 (x86_64): libdb-4_8-32bit-4.8.30-150000.7.6.1 libdb-4_8-32bit-debuginfo-4.8.30-150000.7.6.1 - SUSE Linux Enterprise Micro 5.3 (aarch64 s390x x86_64): db48-utils-4.8.30-150000.7.6.1 db48-utils-debuginfo-4.8.30-150000.7.6.1 libdb-4_8-4.8.30-150000.7.6.1 libdb-4_8-debuginfo-4.8.30-150000.7.6.1 libdb-4_8-debugsource-4.8.30-150000.7.6.1 - SUSE Linux Enterprise Micro 5.2 (aarch64 s390x x86_64): db48-utils-4.8.30-150000.7.6.1 db48-utils-debuginfo-4.8.30-150000.7.6.1 libdb-4_8-4.8.30-150000.7.6.1 libdb-4_8-debuginfo-4.8.30-150000.7.6.1 libdb-4_8-debugsource-4.8.30-150000.7.6.1 - SUSE Linux Enterprise Micro 5.1 (aarch64 s390x x86_64): db48-utils-4.8.30-150000.7.6.1 db48-utils-debuginfo-4.8.30-150000.7.6.1 libdb-4_8-4.8.30-150000.7.6.1 libdb-4_8-debuginfo-4.8.30-150000.7.6.1 libdb-4_8-debugsource-4.8.30-150000.7.6.1 References: https://www.suse.com/security/cve/CVE-2019-2708.html https://bugzilla.suse.com/1174414

1 0