November 2022 - openSUSE Security Announce

SUSE-SU-2022:4196-1: moderate: Security update for opensc
by opensuse-security＠opensuse.org 23 Nov '22

23 Nov '22

SUSE Security Update: Security update for opensc ______________________________________________________________________________ Announcement ID: SUSE-SU-2022:4196-1 Rating: moderate References: #1122756 Cross-References: CVE-2019-6502 CVSS scores: CVE-2019-6502 (NVD) : 7.5 CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H CVE-2019-6502 (SUSE): 4 CVSS:3.0/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L Affected Products: SUSE Enterprise Storage 7.1 SUSE Linux Enterprise Desktop 15-SP3 SUSE Linux Enterprise High Performance Computing 15-SP3 SUSE Linux Enterprise Micro 5.1 SUSE Linux Enterprise Micro 5.2 SUSE Linux Enterprise Module for Basesystem 15-SP3 SUSE Linux Enterprise Server 15-SP3 SUSE Linux Enterprise Server for SAP Applications 15-SP3 SUSE Manager Proxy 4.2 SUSE Manager Retail Branch Server 4.2 SUSE Manager Server 4.2 openSUSE Leap 15.3 openSUSE Leap Micro 5.2 ______________________________________________________________________________ An update that fixes one vulnerability is now available. Description: This update for opensc fixes the following issues: - CVE-2019-6502: Fixed memory leak in sc_context_create in ctx.c (bsc#1122756). Patch Instructions: To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap Micro 5.2: zypper in -t patch openSUSE-Leap-Micro-5.2-2022-4196=1 - openSUSE Leap 15.3: zypper in -t patch openSUSE-SLE-15.3-2022-4196=1 - SUSE Linux Enterprise Module for Basesystem 15-SP3: zypper in -t patch SUSE-SLE-Module-Basesystem-15-SP3-2022-4196=1 - SUSE Linux Enterprise Micro 5.2: zypper in -t patch SUSE-SUSE-MicroOS-5.2-2022-4196=1 - SUSE Linux Enterprise Micro 5.1: zypper in -t patch SUSE-SUSE-MicroOS-5.1-2022-4196=1 Package List: - openSUSE Leap Micro 5.2 (aarch64 x86_64): opensc-0.19.0-150100.3.19.1 opensc-debuginfo-0.19.0-150100.3.19.1 opensc-debugsource-0.19.0-150100.3.19.1 - openSUSE Leap 15.3 (aarch64 ppc64le s390x x86_64): opensc-0.19.0-150100.3.19.1 opensc-debuginfo-0.19.0-150100.3.19.1 opensc-debugsource-0.19.0-150100.3.19.1 - openSUSE Leap 15.3 (x86_64): opensc-32bit-0.19.0-150100.3.19.1 opensc-32bit-debuginfo-0.19.0-150100.3.19.1 - SUSE Linux Enterprise Module for Basesystem 15-SP3 (aarch64 ppc64le s390x x86_64): opensc-0.19.0-150100.3.19.1 opensc-debuginfo-0.19.0-150100.3.19.1 opensc-debugsource-0.19.0-150100.3.19.1 - SUSE Linux Enterprise Micro 5.2 (aarch64 s390x x86_64): opensc-0.19.0-150100.3.19.1 opensc-debuginfo-0.19.0-150100.3.19.1 opensc-debugsource-0.19.0-150100.3.19.1 - SUSE Linux Enterprise Micro 5.1 (aarch64 s390x x86_64): opensc-0.19.0-150100.3.19.1 opensc-debuginfo-0.19.0-150100.3.19.1 opensc-debugsource-0.19.0-150100.3.19.1 References: https://www.suse.com/security/cve/CVE-2019-6502.html https://bugzilla.suse.com/1122756

1 0

openSUSE-SU-2022:10211-1: moderate: Security update for Botan
by opensuse-security＠opensuse.org 23 Nov '22

23 Nov '22

openSUSE Security Update: Security update for Botan ______________________________________________________________________________ Announcement ID: openSUSE-SU-2022:10211-1 Rating: moderate References: #1205509 Cross-References: CVE-2022-43705 Affected Products: openSUSE Backports SLE-15-SP4 ______________________________________________________________________________ An update that fixes one vulnerability is now available. Description: This update for Botan fixes the following issues: - CVE-2022-43705: Fixed validation of embedded certificates was when checking OCSP responses (boo#1205509). Patch Instructions: To install this openSUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Backports SLE-15-SP4: zypper in -t patch openSUSE-2022-10211=1 Package List: - openSUSE Backports SLE-15-SP4 (aarch64 i586 s390x x86_64): Botan-2.18.2-bp154.2.3.1 libbotan-2-18-2.18.2-bp154.2.3.1 libbotan-devel-2.18.2-bp154.2.3.1 python3-botan-2.18.2-bp154.2.3.1 - openSUSE Backports SLE-15-SP4 (aarch64_ilp32): libbotan-2-18-64bit-2.18.2-bp154.2.3.1 libbotan-devel-64bit-2.18.2-bp154.2.3.1 - openSUSE Backports SLE-15-SP4 (noarch): Botan-doc-2.18.2-bp154.2.3.1 - openSUSE Backports SLE-15-SP4 (x86_64): libbotan-2-18-32bit-2.18.2-bp154.2.3.1 libbotan-devel-32bit-2.18.2-bp154.2.3.1 References: https://www.suse.com/security/cve/CVE-2022-43705.html https://bugzilla.suse.com/1205509

1 0

openSUSE-SU-2022:10212-1: moderate: Security update for xtrabackup
by opensuse-security＠opensuse.org 23 Nov '22

23 Nov '22

openSUSE Security Update: Security update for xtrabackup ______________________________________________________________________________ Announcement ID: openSUSE-SU-2022:10212-1 Rating: moderate References: #1125418 #1135095 #1170644 #1205581 Cross-References: CVE-2020-10997 CVE-2020-29488 CVSS scores: CVE-2020-10997 (NVD) : 6.5 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N CVE-2020-10997 (SUSE): 4 CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N Affected Products: openSUSE Backports SLE-15-SP4 ______________________________________________________________________________ An update that solves two vulnerabilities and has two fixes is now available. Description: This update for xtrabackup fixes the following issues: Update xtrabackup to version 2.4.26: - CVE-2020-10997: Information exposure via cmd line output and table history (boo#1170644) - CVE-2020-29488: Changes in how absolute paths are handled (boo#1205581) Patch Instructions: To install this openSUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Backports SLE-15-SP4: zypper in -t patch openSUSE-2022-10212=1 Package List: - openSUSE Backports SLE-15-SP4 (aarch64 i586 ppc64le s390x x86_64): xtrabackup-2.4.26-bp154.2.3.1 xtrabackup-test-2.4.26-bp154.2.3.1 References: https://www.suse.com/security/cve/CVE-2020-10997.html https://www.suse.com/security/cve/CVE-2020-29488.html https://bugzilla.suse.com/1125418 https://bugzilla.suse.com/1135095 https://bugzilla.suse.com/1170644 https://bugzilla.suse.com/1205581

1 0

SUSE-SU-2022:4194-1: important: Security update for ffmpeg-4
by opensuse-security＠opensuse.org 23 Nov '22

23 Nov '22

SUSE Security Update: Security update for ffmpeg-4 ______________________________________________________________________________ Announcement ID: SUSE-SU-2022:4194-1 Rating: important References: #1205388 Cross-References: CVE-2022-3964 CVSS scores: CVE-2022-3964 (NVD) : 8.1 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:H CVE-2022-3964 (SUSE): 7.1 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:H Affected Products: SUSE Linux Enterprise Desktop 15-SP4 SUSE Linux Enterprise High Performance Computing 15-SP4 SUSE Linux Enterprise Module for Desktop Applications 15-SP4 SUSE Linux Enterprise Module for Packagehub Subpackages 15-SP4 SUSE Linux Enterprise Server 15-SP4 SUSE Linux Enterprise Server for SAP Applications 15-SP4 SUSE Linux Enterprise Workstation Extension 15-SP4 SUSE Manager Proxy 4.3 SUSE Manager Retail Branch Server 4.3 SUSE Manager Server 4.3 openSUSE Leap 15.4 ______________________________________________________________________________ An update that fixes one vulnerability is now available. Description: This update for ffmpeg-4 fixes the following issues: - CVE-2022-3964: Fixed out of bounds read in update_block_in_prev_frame() (bsc#1205388). Patch Instructions: To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 15.4: zypper in -t patch openSUSE-SLE-15.4-2022-4194=1 - SUSE Linux Enterprise Workstation Extension 15-SP4: zypper in -t patch SUSE-SLE-Product-WE-15-SP4-2022-4194=1 - SUSE Linux Enterprise Module for Packagehub Subpackages 15-SP4: zypper in -t patch SUSE-SLE-Module-Packagehub-Subpackages-15-SP4-2022-4194=1 - SUSE Linux Enterprise Module for Desktop Applications 15-SP4: zypper in -t patch SUSE-SLE-Module-Desktop-Applications-15-SP4-2022-4194=1 Package List: - openSUSE Leap 15.4 (aarch64 ppc64le s390x x86_64): ffmpeg-4-4.4-150400.3.5.1 ffmpeg-4-debuginfo-4.4-150400.3.5.1 ffmpeg-4-debugsource-4.4-150400.3.5.1 ffmpeg-4-libavcodec-devel-4.4-150400.3.5.1 ffmpeg-4-libavdevice-devel-4.4-150400.3.5.1 ffmpeg-4-libavfilter-devel-4.4-150400.3.5.1 ffmpeg-4-libavformat-devel-4.4-150400.3.5.1 ffmpeg-4-libavresample-devel-4.4-150400.3.5.1 ffmpeg-4-libavutil-devel-4.4-150400.3.5.1 ffmpeg-4-libpostproc-devel-4.4-150400.3.5.1 ffmpeg-4-libswresample-devel-4.4-150400.3.5.1 ffmpeg-4-libswscale-devel-4.4-150400.3.5.1 ffmpeg-4-private-devel-4.4-150400.3.5.1 libavcodec58_134-4.4-150400.3.5.1 libavcodec58_134-debuginfo-4.4-150400.3.5.1 libavdevice58_13-4.4-150400.3.5.1 libavdevice58_13-debuginfo-4.4-150400.3.5.1 libavfilter7_110-4.4-150400.3.5.1 libavfilter7_110-debuginfo-4.4-150400.3.5.1 libavformat58_76-4.4-150400.3.5.1 libavformat58_76-debuginfo-4.4-150400.3.5.1 libavresample4_0-4.4-150400.3.5.1 libavresample4_0-debuginfo-4.4-150400.3.5.1 libavutil56_70-4.4-150400.3.5.1 libavutil56_70-debuginfo-4.4-150400.3.5.1 libpostproc55_9-4.4-150400.3.5.1 libpostproc55_9-debuginfo-4.4-150400.3.5.1 libswresample3_9-4.4-150400.3.5.1 libswresample3_9-debuginfo-4.4-150400.3.5.1 libswscale5_9-4.4-150400.3.5.1 libswscale5_9-debuginfo-4.4-150400.3.5.1 - openSUSE Leap 15.4 (x86_64): libavcodec58_134-32bit-4.4-150400.3.5.1 libavcodec58_134-32bit-debuginfo-4.4-150400.3.5.1 libavdevice58_13-32bit-4.4-150400.3.5.1 libavdevice58_13-32bit-debuginfo-4.4-150400.3.5.1 libavfilter7_110-32bit-4.4-150400.3.5.1 libavfilter7_110-32bit-debuginfo-4.4-150400.3.5.1 libavformat58_76-32bit-4.4-150400.3.5.1 libavformat58_76-32bit-debuginfo-4.4-150400.3.5.1 libavresample4_0-32bit-4.4-150400.3.5.1 libavresample4_0-32bit-debuginfo-4.4-150400.3.5.1 libavutil56_70-32bit-4.4-150400.3.5.1 libavutil56_70-32bit-debuginfo-4.4-150400.3.5.1 libpostproc55_9-32bit-4.4-150400.3.5.1 libpostproc55_9-32bit-debuginfo-4.4-150400.3.5.1 libswresample3_9-32bit-4.4-150400.3.5.1 libswresample3_9-32bit-debuginfo-4.4-150400.3.5.1 libswscale5_9-32bit-4.4-150400.3.5.1 libswscale5_9-32bit-debuginfo-4.4-150400.3.5.1 - SUSE Linux Enterprise Workstation Extension 15-SP4 (x86_64): ffmpeg-4-debuginfo-4.4-150400.3.5.1 ffmpeg-4-debugsource-4.4-150400.3.5.1 libavformat58_76-4.4-150400.3.5.1 libavformat58_76-debuginfo-4.4-150400.3.5.1 libswscale5_9-4.4-150400.3.5.1 libswscale5_9-debuginfo-4.4-150400.3.5.1 - SUSE Linux Enterprise Module for Packagehub Subpackages 15-SP4 (aarch64 ppc64le s390x x86_64): ffmpeg-4-debuginfo-4.4-150400.3.5.1 ffmpeg-4-debugsource-4.4-150400.3.5.1 libavformat58_76-4.4-150400.3.5.1 libavformat58_76-debuginfo-4.4-150400.3.5.1 - SUSE Linux Enterprise Module for Desktop Applications 15-SP4 (aarch64 ppc64le s390x x86_64): ffmpeg-4-debuginfo-4.4-150400.3.5.1 ffmpeg-4-debugsource-4.4-150400.3.5.1 libavcodec58_134-4.4-150400.3.5.1 libavcodec58_134-debuginfo-4.4-150400.3.5.1 libavutil56_70-4.4-150400.3.5.1 libavutil56_70-debuginfo-4.4-150400.3.5.1 libswresample3_9-4.4-150400.3.5.1 libswresample3_9-debuginfo-4.4-150400.3.5.1 References: https://www.suse.com/security/cve/CVE-2022-3964.html https://bugzilla.suse.com/1205388

1 0

openSUSE-SU-2022:10210-1: moderate: Security update for Botan
by opensuse-security＠opensuse.org 23 Nov '22

23 Nov '22

openSUSE Security Update: Security update for Botan ______________________________________________________________________________ Announcement ID: openSUSE-SU-2022:10210-1 Rating: moderate References: #1205509 Cross-References: CVE-2022-43705 Affected Products: openSUSE Backports SLE-15-SP3 ______________________________________________________________________________ An update that fixes one vulnerability is now available. Description: This update for Botan fixes the following issues: - CVE-2022-43705: Fixed validation of embedded certificates was when checking OCSP responses (boo#1205509). Patch Instructions: To install this openSUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Backports SLE-15-SP3: zypper in -t patch openSUSE-2022-10210=1 Package List: - openSUSE Backports SLE-15-SP3 (aarch64 i586 ppc64le s390x x86_64): Botan-2.10.0-bp153.3.3.1 libbotan-2-10-2.10.0-bp153.3.3.1 libbotan-devel-2.10.0-bp153.3.3.1 python3-botan-2.10.0-bp153.3.3.1 - openSUSE Backports SLE-15-SP3 (aarch64_ilp32): libbotan-2-10-64bit-2.10.0-bp153.3.3.1 libbotan-devel-64bit-2.10.0-bp153.3.3.1 - openSUSE Backports SLE-15-SP3 (noarch): Botan-doc-2.10.0-bp153.3.3.1 - openSUSE Backports SLE-15-SP3 (x86_64): libbotan-2-10-32bit-2.10.0-bp153.3.3.1 libbotan-devel-32bit-2.10.0-bp153.3.3.1 References: https://www.suse.com/security/cve/CVE-2022-43705.html https://bugzilla.suse.com/1205509

1 0

SUSE-SU-2022:4191-1: important: Security update for containerized-data-importer
by opensuse-security＠opensuse.org 23 Nov '22

23 Nov '22

SUSE Security Update: Security update for containerized-data-importer ______________________________________________________________________________ Announcement ID: SUSE-SU-2022:4191-1 Rating: important References: Affected Products: SUSE Linux Enterprise High Performance Computing 15-SP4 SUSE Linux Enterprise Micro 5.3 SUSE Linux Enterprise Module for Containers 15-SP4 SUSE Linux Enterprise Server 15-SP4 SUSE Linux Enterprise Server for SAP Applications 15-SP4 SUSE Manager Proxy 4.3 SUSE Manager Retail Branch Server 4.3 SUSE Manager Server 4.3 openSUSE Leap 15.4 openSUSE Leap Micro 5.3 ______________________________________________________________________________ An update that contains security fixes can now be installed. Description: This update rebuilds the current containeried data importer images against current base images, to fix security issues. Patch Instructions: To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap Micro 5.3: zypper in -t patch openSUSE-Leap-Micro-5.3-2022-4191=1 - openSUSE Leap 15.4: zypper in -t patch openSUSE-SLE-15.4-2022-4191=1 - SUSE Linux Enterprise Module for Containers 15-SP4: zypper in -t patch SUSE-SLE-Module-Containers-15-SP4-2022-4191=1 - SUSE Linux Enterprise Micro 5.3: zypper in -t patch SUSE-SLE-Micro-5.3-2022-4191=1 Package List: - openSUSE Leap Micro 5.3 (x86_64): containerized-data-importer-manifests-1.51.0-150400.4.7.1 - openSUSE Leap 15.4 (x86_64): containerized-data-importer-api-1.51.0-150400.4.7.1 containerized-data-importer-api-debuginfo-1.51.0-150400.4.7.1 containerized-data-importer-cloner-1.51.0-150400.4.7.1 containerized-data-importer-cloner-debuginfo-1.51.0-150400.4.7.1 containerized-data-importer-controller-1.51.0-150400.4.7.1 containerized-data-importer-controller-debuginfo-1.51.0-150400.4.7.1 containerized-data-importer-importer-1.51.0-150400.4.7.1 containerized-data-importer-importer-debuginfo-1.51.0-150400.4.7.1 containerized-data-importer-manifests-1.51.0-150400.4.7.1 containerized-data-importer-operator-1.51.0-150400.4.7.1 containerized-data-importer-operator-debuginfo-1.51.0-150400.4.7.1 containerized-data-importer-uploadproxy-1.51.0-150400.4.7.1 containerized-data-importer-uploadproxy-debuginfo-1.51.0-150400.4.7.1 containerized-data-importer-uploadserver-1.51.0-150400.4.7.1 containerized-data-importer-uploadserver-debuginfo-1.51.0-150400.4.7.1 obs-service-cdi_containers_meta-1.51.0-150400.4.7.1 - SUSE Linux Enterprise Module for Containers 15-SP4 (x86_64): containerized-data-importer-manifests-1.51.0-150400.4.7.1 - SUSE Linux Enterprise Micro 5.3 (x86_64): containerized-data-importer-manifests-1.51.0-150400.4.7.1 References:

1 0

SUSE-SU-2022:4169-1: Security update for redis
by opensuse-security＠opensuse.org 22 Nov '22

22 Nov '22

SUSE Security Update: Security update for redis ______________________________________________________________________________ Announcement ID: SUSE-SU-2022:4169-1 Rating: low References: #1204633 Cross-References: CVE-2022-3647 CVSS scores: CVE-2022-3647 (NVD) : 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H CVE-2022-3647 (SUSE): 0 CVSS:3.1/AV:L/AC:H/PR:H/UI:N/S:U/C:N/I:N/A:N Affected Products: SUSE Enterprise Storage 7.1 SUSE Linux Enterprise High Performance Computing 15-SP3 SUSE Linux Enterprise Module for Server Applications 15-SP3 SUSE Linux Enterprise Server 15-SP3 SUSE Linux Enterprise Server for SAP Applications 15-SP3 SUSE Manager Proxy 4.2 SUSE Manager Retail Branch Server 4.2 SUSE Manager Server 4.2 openSUSE Leap 15.3 ______________________________________________________________________________ An update that fixes one vulnerability is now available. Description: This update for redis fixes the following issues: - CVE-2022-3647: Fixed crash in sigsegvHandler debug function (bsc#1204633). Patch Instructions: To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 15.3: zypper in -t patch openSUSE-SLE-15.3-2022-4169=1 - SUSE Linux Enterprise Module for Server Applications 15-SP3: zypper in -t patch SUSE-SLE-Module-Server-Applications-15-SP3-2022-4169=1 Package List: - openSUSE Leap 15.3 (aarch64 ppc64le s390x x86_64): redis-6.0.14-150200.6.14.1 redis-debuginfo-6.0.14-150200.6.14.1 redis-debugsource-6.0.14-150200.6.14.1 - SUSE Linux Enterprise Module for Server Applications 15-SP3 (aarch64 ppc64le s390x x86_64): redis-6.0.14-150200.6.14.1 redis-debuginfo-6.0.14-150200.6.14.1 redis-debugsource-6.0.14-150200.6.14.1 References: https://www.suse.com/security/cve/CVE-2022-3647.html https://bugzilla.suse.com/1204633

1 0

SUSE-SU-2022:4168-1: Security update for redis
by opensuse-security＠opensuse.org 22 Nov '22

22 Nov '22

SUSE Security Update: Security update for redis ______________________________________________________________________________ Announcement ID: SUSE-SU-2022:4168-1 Rating: low References: #1204633 Cross-References: CVE-2022-3647 CVSS scores: CVE-2022-3647 (NVD) : 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H CVE-2022-3647 (SUSE): 0 CVSS:3.1/AV:L/AC:H/PR:H/UI:N/S:U/C:N/I:N/A:N Affected Products: SUSE Linux Enterprise High Performance Computing 15-SP4 SUSE Linux Enterprise Module for Server Applications 15-SP4 SUSE Linux Enterprise Server 15-SP4 SUSE Linux Enterprise Server for SAP Applications 15-SP4 SUSE Manager Proxy 4.3 SUSE Manager Retail Branch Server 4.3 SUSE Manager Server 4.3 openSUSE Leap 15.4 ______________________________________________________________________________ An update that fixes one vulnerability is now available. Description: This update for redis fixes the following issues: - CVE-2022-3647: Fixed crash in sigsegvHandler debug function (bsc#1204633). Patch Instructions: To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 15.4: zypper in -t patch openSUSE-SLE-15.4-2022-4168=1 - SUSE Linux Enterprise Module for Server Applications 15-SP4: zypper in -t patch SUSE-SLE-Module-Server-Applications-15-SP4-2022-4168=1 Package List: - openSUSE Leap 15.4 (aarch64 ppc64le s390x x86_64): redis-6.2.6-150400.3.6.1 redis-debuginfo-6.2.6-150400.3.6.1 redis-debugsource-6.2.6-150400.3.6.1 - SUSE Linux Enterprise Module for Server Applications 15-SP4 (aarch64 ppc64le s390x x86_64): redis-6.2.6-150400.3.6.1 redis-debuginfo-6.2.6-150400.3.6.1 redis-debugsource-6.2.6-150400.3.6.1 References: https://www.suse.com/security/cve/CVE-2022-3647.html https://bugzilla.suse.com/1204633

1 0

SUSE-SU-2022:4170-1: Security update for colord
by opensuse-security＠opensuse.org 22 Nov '22

22 Nov '22

SUSE Security Update: Security update for colord ______________________________________________________________________________ Announcement ID: SUSE-SU-2022:4170-1 Rating: low References: #1202802 Cross-References: CVE-2021-42523 CVSS scores: CVE-2021-42523 (NVD) : 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N CVE-2021-42523 (SUSE): 4 CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N Affected Products: SUSE Enterprise Storage 7.1 SUSE Linux Enterprise Desktop 15-SP3 SUSE Linux Enterprise High Performance Computing 15-SP3 SUSE Linux Enterprise Micro 5.2 SUSE Linux Enterprise Module for Basesystem 15-SP3 SUSE Linux Enterprise Module for Desktop Applications 15-SP3 SUSE Linux Enterprise Server 15-SP3 SUSE Linux Enterprise Server for SAP Applications 15-SP3 SUSE Linux Enterprise Workstation Extension 15-SP3 SUSE Manager Proxy 4.2 SUSE Manager Retail Branch Server 4.2 SUSE Manager Server 4.2 openSUSE Leap 15.3 openSUSE Leap Micro 5.2 ______________________________________________________________________________ An update that fixes one vulnerability is now available. Description: This update for colord fixes the following issues: - CVE-2021-42523: Fixed small memory leak in sqlite3_exec (bsc#1202802). Patch Instructions: To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap Micro 5.2: zypper in -t patch openSUSE-Leap-Micro-5.2-2022-4170=1 - openSUSE Leap 15.3: zypper in -t patch openSUSE-SLE-15.3-2022-4170=1 - SUSE Linux Enterprise Workstation Extension 15-SP3: zypper in -t patch SUSE-SLE-Product-WE-15-SP3-2022-4170=1 - SUSE Linux Enterprise Module for Desktop Applications 15-SP3: zypper in -t patch SUSE-SLE-Module-Desktop-Applications-15-SP3-2022-4170=1 - SUSE Linux Enterprise Module for Basesystem 15-SP3: zypper in -t patch SUSE-SLE-Module-Basesystem-15-SP3-2022-4170=1 - SUSE Linux Enterprise Micro 5.2: zypper in -t patch SUSE-SUSE-MicroOS-5.2-2022-4170=1 Package List: - openSUSE Leap Micro 5.2 (aarch64 x86_64): colord-debuginfo-1.4.4-150200.4.6.1 colord-debugsource-1.4.4-150200.4.6.1 libcolord2-1.4.4-150200.4.6.1 libcolord2-debuginfo-1.4.4-150200.4.6.1 - openSUSE Leap 15.3 (aarch64 ppc64le s390x x86_64): colord-1.4.4-150200.4.6.1 colord-color-profiles-1.4.4-150200.4.6.1 colord-debuginfo-1.4.4-150200.4.6.1 colord-debugsource-1.4.4-150200.4.6.1 libcolord-devel-1.4.4-150200.4.6.1 libcolord2-1.4.4-150200.4.6.1 libcolord2-debuginfo-1.4.4-150200.4.6.1 libcolorhug2-1.4.4-150200.4.6.1 libcolorhug2-debuginfo-1.4.4-150200.4.6.1 typelib-1_0-Colord-1_0-1.4.4-150200.4.6.1 typelib-1_0-Colorhug-1_0-1.4.4-150200.4.6.1 - openSUSE Leap 15.3 (x86_64): libcolord2-32bit-1.4.4-150200.4.6.1 libcolord2-32bit-debuginfo-1.4.4-150200.4.6.1 - openSUSE Leap 15.3 (noarch): colord-lang-1.4.4-150200.4.6.1 - SUSE Linux Enterprise Workstation Extension 15-SP3 (x86_64): colord-1.4.4-150200.4.6.1 colord-debuginfo-1.4.4-150200.4.6.1 colord-debugsource-1.4.4-150200.4.6.1 - SUSE Linux Enterprise Workstation Extension 15-SP3 (noarch): colord-lang-1.4.4-150200.4.6.1 - SUSE Linux Enterprise Module for Desktop Applications 15-SP3 (aarch64 ppc64le s390x x86_64): colord-color-profiles-1.4.4-150200.4.6.1 colord-debuginfo-1.4.4-150200.4.6.1 colord-debugsource-1.4.4-150200.4.6.1 libcolord-devel-1.4.4-150200.4.6.1 libcolorhug2-1.4.4-150200.4.6.1 libcolorhug2-debuginfo-1.4.4-150200.4.6.1 typelib-1_0-Colord-1_0-1.4.4-150200.4.6.1 typelib-1_0-Colorhug-1_0-1.4.4-150200.4.6.1 - SUSE Linux Enterprise Module for Basesystem 15-SP3 (aarch64 ppc64le s390x x86_64): colord-debuginfo-1.4.4-150200.4.6.1 colord-debugsource-1.4.4-150200.4.6.1 libcolord2-1.4.4-150200.4.6.1 libcolord2-debuginfo-1.4.4-150200.4.6.1 - SUSE Linux Enterprise Micro 5.2 (aarch64 s390x x86_64): colord-debuginfo-1.4.4-150200.4.6.1 colord-debugsource-1.4.4-150200.4.6.1 libcolord2-1.4.4-150200.4.6.1 libcolord2-debuginfo-1.4.4-150200.4.6.1 References: https://www.suse.com/security/cve/CVE-2021-42523.html https://bugzilla.suse.com/1202802

1 0

SUSE-SU-2022:4159-1: moderate: Security update for strongswan
by opensuse-security＠opensuse.org 22 Nov '22

22 Nov '22

SUSE Security Update: Security update for strongswan ______________________________________________________________________________ Announcement ID: SUSE-SU-2022:4159-1 Rating: moderate References: #1203556 Cross-References: CVE-2022-40617 CVSS scores: CVE-2022-40617 (NVD) : 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H CVE-2022-40617 (SUSE): 6.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H Affected Products: SUSE Enterprise Storage 7.1 SUSE Linux Enterprise Desktop 15-SP3 SUSE Linux Enterprise High Performance Computing 15-SP3 SUSE Linux Enterprise Module for Basesystem 15-SP3 SUSE Linux Enterprise Module for Packagehub Subpackages 15-SP3 SUSE Linux Enterprise Server 15-SP3 SUSE Linux Enterprise Server for SAP Applications 15-SP3 SUSE Linux Enterprise Workstation Extension 15-SP3 SUSE Manager Proxy 4.2 SUSE Manager Retail Branch Server 4.2 SUSE Manager Server 4.2 openSUSE Leap 15.3 ______________________________________________________________________________ An update that fixes one vulnerability is now available. Description: This update for strongswan fixes the following issues: - CVE-2022-40617: Fixed that using untrusted URIs for revocation checking could lead to denial of service (bsc#1203556) Patch Instructions: To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 15.3: zypper in -t patch openSUSE-SLE-15.3-2022-4159=1 - SUSE Linux Enterprise Workstation Extension 15-SP3: zypper in -t patch SUSE-SLE-Product-WE-15-SP3-2022-4159=1 - SUSE Linux Enterprise Module for Packagehub Subpackages 15-SP3: zypper in -t patch SUSE-SLE-Module-Packagehub-Subpackages-15-SP3-2022-4159=1 - SUSE Linux Enterprise Module for Basesystem 15-SP3: zypper in -t patch SUSE-SLE-Module-Basesystem-15-SP3-2022-4159=1 Package List: - openSUSE Leap 15.3 (aarch64 ppc64le s390x x86_64): strongswan-5.8.2-150200.11.30.1 strongswan-debuginfo-5.8.2-150200.11.30.1 strongswan-debugsource-5.8.2-150200.11.30.1 strongswan-hmac-5.8.2-150200.11.30.1 strongswan-ipsec-5.8.2-150200.11.30.1 strongswan-ipsec-debuginfo-5.8.2-150200.11.30.1 strongswan-libs0-5.8.2-150200.11.30.1 strongswan-libs0-debuginfo-5.8.2-150200.11.30.1 strongswan-mysql-5.8.2-150200.11.30.1 strongswan-mysql-debuginfo-5.8.2-150200.11.30.1 strongswan-nm-5.8.2-150200.11.30.1 strongswan-nm-debuginfo-5.8.2-150200.11.30.1 strongswan-sqlite-5.8.2-150200.11.30.1 strongswan-sqlite-debuginfo-5.8.2-150200.11.30.1 - openSUSE Leap 15.3 (noarch): strongswan-doc-5.8.2-150200.11.30.1 - SUSE Linux Enterprise Workstation Extension 15-SP3 (x86_64): strongswan-debuginfo-5.8.2-150200.11.30.1 strongswan-debugsource-5.8.2-150200.11.30.1 strongswan-nm-5.8.2-150200.11.30.1 strongswan-nm-debuginfo-5.8.2-150200.11.30.1 - SUSE Linux Enterprise Module for Packagehub Subpackages 15-SP3 (aarch64 ppc64le s390x x86_64): strongswan-debuginfo-5.8.2-150200.11.30.1 strongswan-debugsource-5.8.2-150200.11.30.1 strongswan-nm-5.8.2-150200.11.30.1 strongswan-nm-debuginfo-5.8.2-150200.11.30.1 - SUSE Linux Enterprise Module for Basesystem 15-SP3 (aarch64 ppc64le s390x x86_64): strongswan-5.8.2-150200.11.30.1 strongswan-debuginfo-5.8.2-150200.11.30.1 strongswan-debugsource-5.8.2-150200.11.30.1 strongswan-hmac-5.8.2-150200.11.30.1 strongswan-ipsec-5.8.2-150200.11.30.1 strongswan-ipsec-debuginfo-5.8.2-150200.11.30.1 strongswan-libs0-5.8.2-150200.11.30.1 strongswan-libs0-debuginfo-5.8.2-150200.11.30.1 - SUSE Linux Enterprise Module for Basesystem 15-SP3 (noarch): strongswan-doc-5.8.2-150200.11.30.1 References: https://www.suse.com/security/cve/CVE-2022-40617.html https://bugzilla.suse.com/1203556

1 0