December 2022 - openSUSE Security Announce

openSUSE-SU-2022:10241-1: moderate: Security update for python-slixmpp
by opensuse-security＠opensuse.org 10 Dec '22

10 Dec '22

openSUSE Security Update: Security update for python-slixmpp ______________________________________________________________________________ Announcement ID: openSUSE-SU-2022:10241-1 Rating: moderate References: #1205433 Cross-References: CVE-2022-45197 Affected Products: openSUSE Backports SLE-15-SP3 ______________________________________________________________________________ An update that fixes one vulnerability is now available. Description: This update for python-slixmpp fixes the following issues: - CVE-2022-45197: Fixed certificate hostname validation (boo#1205433) Patch Instructions: To install this openSUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Backports SLE-15-SP3: zypper in -t patch openSUSE-2022-10241=1 Package List: - openSUSE Backports SLE-15-SP3 (aarch64 i586 ppc64le s390x x86_64): python3-slixmpp-1.4.2-bp153.2.3.1 References: https://www.suse.com/security/cve/CVE-2022-45197.html https://bugzilla.suse.com/1205433

1 0

SUSE-SU-2022:4398-1: moderate: Security update for go1.18
by opensuse-security＠opensuse.org 09 Dec '22

09 Dec '22

SUSE Security Update: Security update for go1.18 ______________________________________________________________________________ Announcement ID: SUSE-SU-2022:4398-1 Rating: moderate References: #1193742 #1206134 #1206135 Cross-References: CVE-2022-41717 CVE-2022-41720 Affected Products: SUSE Enterprise Storage 7.1 SUSE Linux Enterprise Desktop 15-SP3 SUSE Linux Enterprise Desktop 15-SP4 SUSE Linux Enterprise High Performance Computing 15-SP3 SUSE Linux Enterprise High Performance Computing 15-SP4 SUSE Linux Enterprise Module for Development Tools 15-SP3 SUSE Linux Enterprise Module for Development Tools 15-SP4 SUSE Linux Enterprise Server 15-SP3 SUSE Linux Enterprise Server 15-SP4 SUSE Linux Enterprise Server for SAP Applications 15-SP3 SUSE Linux Enterprise Server for SAP Applications 15-SP4 SUSE Manager Proxy 4.2 SUSE Manager Proxy 4.3 SUSE Manager Retail Branch Server 4.2 SUSE Manager Retail Branch Server 4.3 SUSE Manager Server 4.2 SUSE Manager Server 4.3 openSUSE Leap 15.3 openSUSE Leap 15.4 ______________________________________________________________________________ An update that solves two vulnerabilities and has one errata is now available. Description: This update for go1.18 fixes the following issues: Update to version 1.18.9, includes the following security fixes: - CVE-2022-41717: net/http: limit canonical header cache by bytes, not entries (bsc#1206135) - CVE-2022-41720: os, net/http: avoid escapes from os.DirFS and http.Dir on Windows (bsc#1206134) Patch Instructions: To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 15.4: zypper in -t patch openSUSE-SLE-15.4-2022-4398=1 - openSUSE Leap 15.3: zypper in -t patch openSUSE-SLE-15.3-2022-4398=1 - SUSE Linux Enterprise Module for Development Tools 15-SP4: zypper in -t patch SUSE-SLE-Module-Development-Tools-15-SP4-2022-4398=1 - SUSE Linux Enterprise Module for Development Tools 15-SP3: zypper in -t patch SUSE-SLE-Module-Development-Tools-15-SP3-2022-4398=1 Package List: - openSUSE Leap 15.4 (aarch64 ppc64le s390x x86_64): go1.18-1.18.9-150000.1.40.1 go1.18-doc-1.18.9-150000.1.40.1 - openSUSE Leap 15.4 (aarch64 x86_64): go1.18-race-1.18.9-150000.1.40.1 - openSUSE Leap 15.3 (aarch64 ppc64le s390x x86_64): go1.18-1.18.9-150000.1.40.1 go1.18-doc-1.18.9-150000.1.40.1 - openSUSE Leap 15.3 (aarch64 x86_64): go1.18-race-1.18.9-150000.1.40.1 - SUSE Linux Enterprise Module for Development Tools 15-SP4 (aarch64 ppc64le s390x x86_64): go1.18-1.18.9-150000.1.40.1 go1.18-doc-1.18.9-150000.1.40.1 - SUSE Linux Enterprise Module for Development Tools 15-SP4 (aarch64 x86_64): go1.18-race-1.18.9-150000.1.40.1 - SUSE Linux Enterprise Module for Development Tools 15-SP3 (aarch64 ppc64le s390x x86_64): go1.18-1.18.9-150000.1.40.1 go1.18-doc-1.18.9-150000.1.40.1 - SUSE Linux Enterprise Module for Development Tools 15-SP3 (aarch64 x86_64): go1.18-race-1.18.9-150000.1.40.1 References: https://www.suse.com/security/cve/CVE-2022-41717.html https://www.suse.com/security/cve/CVE-2022-41720.html https://bugzilla.suse.com/1193742 https://bugzilla.suse.com/1206134 https://bugzilla.suse.com/1206135

1 0

SUSE-SU-2022:4397-1: moderate: Security update for go1.19
by opensuse-security＠opensuse.org 09 Dec '22

09 Dec '22

SUSE Security Update: Security update for go1.19 ______________________________________________________________________________ Announcement ID: SUSE-SU-2022:4397-1 Rating: moderate References: #1200441 #1206134 #1206135 Cross-References: CVE-2022-41717 CVE-2022-41720 Affected Products: SUSE Enterprise Storage 7.1 SUSE Linux Enterprise Desktop 15-SP3 SUSE Linux Enterprise Desktop 15-SP4 SUSE Linux Enterprise High Performance Computing 15-SP3 SUSE Linux Enterprise High Performance Computing 15-SP4 SUSE Linux Enterprise Module for Development Tools 15-SP3 SUSE Linux Enterprise Module for Development Tools 15-SP4 SUSE Linux Enterprise Server 15-SP3 SUSE Linux Enterprise Server 15-SP4 SUSE Linux Enterprise Server for SAP Applications 15-SP3 SUSE Linux Enterprise Server for SAP Applications 15-SP4 SUSE Manager Proxy 4.2 SUSE Manager Proxy 4.3 SUSE Manager Retail Branch Server 4.2 SUSE Manager Retail Branch Server 4.3 SUSE Manager Server 4.2 SUSE Manager Server 4.3 openSUSE Leap 15.3 openSUSE Leap 15.4 ______________________________________________________________________________ An update that solves two vulnerabilities and has one errata is now available. Description: This update for go1.19 fixes the following issues: Update to version 1.19.4, includes the following security fixes: - CVE-2022-41717: net/http: limit canonical header cache by bytes, not entries (bsc#1206135). - CVE-2022-41720: os, net/http: avoid escapes from os.DirFS and http.Dir on Windows (bsc#1206134). Patch Instructions: To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 15.4: zypper in -t patch openSUSE-SLE-15.4-2022-4397=1 - openSUSE Leap 15.3: zypper in -t patch openSUSE-SLE-15.3-2022-4397=1 - SUSE Linux Enterprise Module for Development Tools 15-SP4: zypper in -t patch SUSE-SLE-Module-Development-Tools-15-SP4-2022-4397=1 - SUSE Linux Enterprise Module for Development Tools 15-SP3: zypper in -t patch SUSE-SLE-Module-Development-Tools-15-SP3-2022-4397=1 Package List: - openSUSE Leap 15.4 (aarch64 ppc64le s390x x86_64): go1.19-1.19.4-150000.1.18.1 go1.19-doc-1.19.4-150000.1.18.1 - openSUSE Leap 15.4 (aarch64 x86_64): go1.19-race-1.19.4-150000.1.18.1 - openSUSE Leap 15.3 (aarch64 ppc64le s390x x86_64): go1.19-1.19.4-150000.1.18.1 go1.19-doc-1.19.4-150000.1.18.1 - openSUSE Leap 15.3 (aarch64 x86_64): go1.19-race-1.19.4-150000.1.18.1 - SUSE Linux Enterprise Module for Development Tools 15-SP4 (aarch64 ppc64le s390x x86_64): go1.19-1.19.4-150000.1.18.1 go1.19-doc-1.19.4-150000.1.18.1 - SUSE Linux Enterprise Module for Development Tools 15-SP4 (aarch64 x86_64): go1.19-race-1.19.4-150000.1.18.1 - SUSE Linux Enterprise Module for Development Tools 15-SP3 (aarch64 ppc64le s390x x86_64): go1.19-1.19.4-150000.1.18.1 go1.19-doc-1.19.4-150000.1.18.1 - SUSE Linux Enterprise Module for Development Tools 15-SP3 (aarch64 x86_64): go1.19-race-1.19.4-150000.1.18.1 References: https://www.suse.com/security/cve/CVE-2022-41717.html https://www.suse.com/security/cve/CVE-2022-41720.html https://bugzilla.suse.com/1200441 https://bugzilla.suse.com/1206134 https://bugzilla.suse.com/1206135

1 0

openSUSE-SU-2022:10239-1: important: Security update for opera
by opensuse-security＠opensuse.org 09 Dec '22

09 Dec '22

openSUSE Security Update: Security update for opera ______________________________________________________________________________ Announcement ID: openSUSE-SU-2022:10239-1 Rating: important References: Cross-References: CVE-2022-3885 CVE-2022-3886 CVE-2022-3887 CVE-2022-3888 CVE-2022-3889 CVSS scores: CVE-2022-3885 (NVD) : 8.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H CVE-2022-3886 (NVD) : 8.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H CVE-2022-3887 (NVD) : 8.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H CVE-2022-3888 (NVD) : 8.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H CVE-2022-3889 (NVD) : 8.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H Affected Products: openSUSE Leap 15.4:NonFree ______________________________________________________________________________ An update that fixes 5 vulnerabilities is now available. Description: This update for opera fixes the following issues: Update to 93.0.4585.37 - DNA-102885 Turn on #sidebar-autohide on all streams - DNA-103020 Turn on #start-page-redesign on developer - DNA-103042 Fix import from Firefox - DNA-103222 [Speed Dial Suggestions] All opera.com subpages suggestions lead to the opera.com homepage - DNA-103368 TikTok videos starting to play automaticly - DNA-103535 Startpage preview is not visible - DNA-103665 Reduce Tik Tok pane width Changes in 93.0.4585.21 - CHR-9067 Update chromium on desktop-stable-107-4585 to 107.0.5304.110 - DNA-102365 Turn off opera://dify-cards page - DNA-102689 [GX] Create GX widgets section in Easy Setup - DNA-102768 [Easy setup] Sidebar options not animated - DNA-102872 No animation for opening sidebar while sidebar is closing - DNA-102929 [Weather][Private window] Weather widget appears in private window - DNA-103032 Messenger sidebar icon doesn��t look great - DNA-103046 Opera crash with flag ��with-feature:sidebar-autohide=off - DNA-103107 Automatic video popout for popular sports sites �� World Cup - DNA-103310 hideOperaObject() in browser.js stopped working on public builds - DNA-103320 Crash at chrome::FindBrowserByType(absl::optional) - DNA-103321 Tab preview causes freeze when dragging tabs - DNA-103375 [Workspaces] Crash at absl::raw_log_internal:: RawLog(absl::LogSeverity, char const*, int, char const*, ��) - DNA-103395 Remove unused resources - DNA-103396 Internal translations - The update to chromium 107.0.5304.110 fixes following issues: CVE-2022-3885, CVE-2022-3886, CVE-2022-3887, CVE-2022-3888, CVE-2022-3889, CVE-2022-3889 Patch Instructions: To install this openSUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 15.4:NonFree: zypper in -t patch openSUSE-2022-10239=1 Package List: - openSUSE Leap 15.4:NonFree (x86_64): opera-93.0.4585.37-lp154.2.32.1 References: https://www.suse.com/security/cve/CVE-2022-3885.html https://www.suse.com/security/cve/CVE-2022-3886.html https://www.suse.com/security/cve/CVE-2022-3887.html https://www.suse.com/security/cve/CVE-2022-3888.html https://www.suse.com/security/cve/CVE-2022-3889.html

1 0

SUSE-SU-2022:4395-1: important: Security update for samba
by opensuse-security＠opensuse.org 09 Dec '22

09 Dec '22

SUSE Security Update: Security update for samba ______________________________________________________________________________ Announcement ID: SUSE-SU-2022:4395-1 Rating: important References: #1200102 #1201490 #1201492 #1201493 #1201495 #1201496 #1201689 #1204254 #1205126 Cross-References: CVE-2022-2031 CVE-2022-32742 CVE-2022-32744 CVE-2022-32745 CVE-2022-32746 CVE-2022-3437 CVE-2022-42898 CVSS scores: CVE-2022-2031 (NVD) : 8.8 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H CVE-2022-2031 (SUSE): 8.8 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H CVE-2022-32742 (NVD) : 4.3 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N CVE-2022-32742 (SUSE): 4.3 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N CVE-2022-32744 (NVD) : 8.8 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H CVE-2022-32744 (SUSE): 8.8 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H CVE-2022-32745 (NVD) : 8.1 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:H CVE-2022-32745 (SUSE): 5.4 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:L CVE-2022-32746 (NVD) : 5.4 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:L CVE-2022-32746 (SUSE): 5.4 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:L CVE-2022-3437 (SUSE): 5.9 CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:N/I:H/A:L CVE-2022-42898 (SUSE): 6.4 CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:L/I:H/A:L Affected Products: SUSE Enterprise Storage 7.1 SUSE Linux Enterprise Desktop 15-SP3 SUSE Linux Enterprise High Availability 15-SP3 SUSE Linux Enterprise High Performance Computing 15-SP3 SUSE Linux Enterprise Micro 5.2 SUSE Linux Enterprise Module for Basesystem 15-SP3 SUSE Linux Enterprise Module for Python2 15-SP3 SUSE Linux Enterprise Server 15-SP3 SUSE Linux Enterprise Server for SAP Applications 15-SP3 SUSE Manager Proxy 4.2 SUSE Manager Retail Branch Server 4.2 SUSE Manager Server 4.2 openSUSE Leap 15.3 openSUSE Leap Micro 5.2 ______________________________________________________________________________ An update that solves 7 vulnerabilities and has two fixes is now available. Description: This update for samba fixes the following issues: Version update to 4.15.12. Security issues fixed: - CVE-2022-2031: Fixed AD users that could have bypassed certain restrictions associated with changing passwords (bsc#1201495). - CVE-2022-32742: Fixed SMB1 code that does not correctly verify SMB1write, SMB1write_and_close, SMB1write_and_unlock lengths (bsc#1201496). - CVE-2022-32744: Fixed AD users that could have forged password change requests for any user (bsc#1201493). - CVE-2022-32745: Fixed AD users that could have crashed the server process with an LDAP add or modify request (bsc#1201492). - CVE-2022-32746: Fixed a use-after-free occurring in database audit logging (bsc#1201490). - CVE-2022-3437: Fixed buffer overflow in Heimdal unwrap_des3() (bsc#1204254). - CVE-2022-42898: Fixed Samba buffer overflow vulnerabilities on 32-bit systems (bsc#1205126). Bug fixes: - Install a systemd drop-in file for named service to allow read/write access to the DLZ directory (bsc#1201689). - Possible use after free of connection_struct when iterating smbd_server_connection->connections (bsc#1200102). Patch Instructions: To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap Micro 5.2: zypper in -t patch openSUSE-Leap-Micro-5.2-2022-4395=1 - openSUSE Leap 15.3: zypper in -t patch openSUSE-SLE-15.3-2022-4395=1 - SUSE Linux Enterprise Module for Python2 15-SP3: zypper in -t patch SUSE-SLE-Module-Python2-15-SP3-2022-4395=1 - SUSE Linux Enterprise Module for Basesystem 15-SP3: zypper in -t patch SUSE-SLE-Module-Basesystem-15-SP3-2022-4395=1 - SUSE Linux Enterprise Micro 5.2: zypper in -t patch SUSE-SUSE-MicroOS-5.2-2022-4395=1 - SUSE Linux Enterprise High Availability 15-SP3: zypper in -t patch SUSE-SLE-Product-HA-15-SP3-2022-4395=1 - SUSE Enterprise Storage 7.1: zypper in -t patch SUSE-Storage-7.1-2022-4395=1 Package List: - openSUSE Leap Micro 5.2 (aarch64 x86_64): samba-client-libs-4.15.12+git.535.7750e5c95ef-150300.3.43.1 samba-client-libs-debuginfo-4.15.12+git.535.7750e5c95ef-150300.3.43.1 samba-debuginfo-4.15.12+git.535.7750e5c95ef-150300.3.43.1 samba-debugsource-4.15.12+git.535.7750e5c95ef-150300.3.43.1 - openSUSE Leap 15.3 (aarch64 ppc64le s390x x86_64): ctdb-4.15.12+git.535.7750e5c95ef-150300.3.43.1 ctdb-debuginfo-4.15.12+git.535.7750e5c95ef-150300.3.43.1 ctdb-pcp-pmda-4.15.12+git.535.7750e5c95ef-150300.3.43.1 ctdb-pcp-pmda-debuginfo-4.15.12+git.535.7750e5c95ef-150300.3.43.1 libsamba-policy-devel-4.15.12+git.535.7750e5c95ef-150300.3.43.1 libsamba-policy-python3-devel-4.15.12+git.535.7750e5c95ef-150300.3.43.1 libsamba-policy0-python3-4.15.12+git.535.7750e5c95ef-150300.3.43.1 libsamba-policy0-python3-debuginfo-4.15.12+git.535.7750e5c95ef-150300.3.43.1 samba-4.15.12+git.535.7750e5c95ef-150300.3.43.1 samba-ad-dc-4.15.12+git.535.7750e5c95ef-150300.3.43.1 samba-ad-dc-debuginfo-4.15.12+git.535.7750e5c95ef-150300.3.43.1 samba-ad-dc-libs-4.15.12+git.535.7750e5c95ef-150300.3.43.1 samba-ad-dc-libs-debuginfo-4.15.12+git.535.7750e5c95ef-150300.3.43.1 samba-client-4.15.12+git.535.7750e5c95ef-150300.3.43.1 samba-client-debuginfo-4.15.12+git.535.7750e5c95ef-150300.3.43.1 samba-client-libs-4.15.12+git.535.7750e5c95ef-150300.3.43.1 samba-client-libs-debuginfo-4.15.12+git.535.7750e5c95ef-150300.3.43.1 samba-debuginfo-4.15.12+git.535.7750e5c95ef-150300.3.43.1 samba-debugsource-4.15.12+git.535.7750e5c95ef-150300.3.43.1 samba-devel-4.15.12+git.535.7750e5c95ef-150300.3.43.1 samba-dsdb-modules-4.15.12+git.535.7750e5c95ef-150300.3.43.1 samba-dsdb-modules-debuginfo-4.15.12+git.535.7750e5c95ef-150300.3.43.1 samba-gpupdate-4.15.12+git.535.7750e5c95ef-150300.3.43.1 samba-ldb-ldap-4.15.12+git.535.7750e5c95ef-150300.3.43.1 samba-ldb-ldap-debuginfo-4.15.12+git.535.7750e5c95ef-150300.3.43.1 samba-libs-4.15.12+git.535.7750e5c95ef-150300.3.43.1 samba-libs-debuginfo-4.15.12+git.535.7750e5c95ef-150300.3.43.1 samba-libs-python3-4.15.12+git.535.7750e5c95ef-150300.3.43.1 samba-libs-python3-debuginfo-4.15.12+git.535.7750e5c95ef-150300.3.43.1 samba-python3-4.15.12+git.535.7750e5c95ef-150300.3.43.1 samba-python3-debuginfo-4.15.12+git.535.7750e5c95ef-150300.3.43.1 samba-test-4.15.12+git.535.7750e5c95ef-150300.3.43.1 samba-test-debuginfo-4.15.12+git.535.7750e5c95ef-150300.3.43.1 samba-tool-4.15.12+git.535.7750e5c95ef-150300.3.43.1 samba-winbind-4.15.12+git.535.7750e5c95ef-150300.3.43.1 samba-winbind-debuginfo-4.15.12+git.535.7750e5c95ef-150300.3.43.1 samba-winbind-libs-4.15.12+git.535.7750e5c95ef-150300.3.43.1 samba-winbind-libs-debuginfo-4.15.12+git.535.7750e5c95ef-150300.3.43.1 - openSUSE Leap 15.3 (aarch64 x86_64): samba-ceph-4.15.12+git.535.7750e5c95ef-150300.3.43.1 samba-ceph-debuginfo-4.15.12+git.535.7750e5c95ef-150300.3.43.1 - openSUSE Leap 15.3 (aarch64_ilp32): libsamba-policy0-python3-64bit-4.15.12+git.535.7750e5c95ef-150300.3.43.1 libsamba-policy0-python3-64bit-debuginfo-4.15.12+git.535.7750e5c95ef-150300.3.43.1 samba-client-64bit-4.15.12+git.535.7750e5c95ef-150300.3.43.1 samba-client-64bit-debuginfo-4.15.12+git.535.7750e5c95ef-150300.3.43.1 samba-libs-64bit-4.15.12+git.535.7750e5c95ef-150300.3.43.1 samba-libs-64bit-debuginfo-4.15.12+git.535.7750e5c95ef-150300.3.43.1 samba-libs-python3-64bit-4.15.12+git.535.7750e5c95ef-150300.3.43.1 samba-libs-python3-64bit-debuginfo-4.15.12+git.535.7750e5c95ef-150300.3.43.1 - openSUSE Leap 15.3 (noarch): samba-doc-4.15.12+git.535.7750e5c95ef-150300.3.43.1 - openSUSE Leap 15.3 (x86_64): libsamba-policy0-python3-32bit-4.15.12+git.535.7750e5c95ef-150300.3.43.1 libsamba-policy0-python3-32bit-debuginfo-4.15.12+git.535.7750e5c95ef-150300.3.43.1 samba-ad-dc-libs-32bit-4.15.12+git.535.7750e5c95ef-150300.3.43.1 samba-ad-dc-libs-32bit-debuginfo-4.15.12+git.535.7750e5c95ef-150300.3.43.1 samba-client-32bit-4.15.12+git.535.7750e5c95ef-150300.3.43.1 samba-client-32bit-debuginfo-4.15.12+git.535.7750e5c95ef-150300.3.43.1 samba-client-libs-32bit-4.15.12+git.535.7750e5c95ef-150300.3.43.1 samba-client-libs-32bit-debuginfo-4.15.12+git.535.7750e5c95ef-150300.3.43.1 samba-devel-32bit-4.15.12+git.535.7750e5c95ef-150300.3.43.1 samba-libs-32bit-4.15.12+git.535.7750e5c95ef-150300.3.43.1 samba-libs-32bit-debuginfo-4.15.12+git.535.7750e5c95ef-150300.3.43.1 samba-libs-python3-32bit-4.15.12+git.535.7750e5c95ef-150300.3.43.1 samba-libs-python3-32bit-debuginfo-4.15.12+git.535.7750e5c95ef-150300.3.43.1 samba-winbind-libs-32bit-4.15.12+git.535.7750e5c95ef-150300.3.43.1 samba-winbind-libs-32bit-debuginfo-4.15.12+git.535.7750e5c95ef-150300.3.43.1 - SUSE Linux Enterprise Module for Python2 15-SP3 (aarch64 ppc64le s390x x86_64): samba-ad-dc-4.15.12+git.535.7750e5c95ef-150300.3.43.1 samba-ad-dc-debuginfo-4.15.12+git.535.7750e5c95ef-150300.3.43.1 samba-debuginfo-4.15.12+git.535.7750e5c95ef-150300.3.43.1 samba-debugsource-4.15.12+git.535.7750e5c95ef-150300.3.43.1 - SUSE Linux Enterprise Module for Basesystem 15-SP3 (aarch64 ppc64le s390x x86_64): libsamba-policy-devel-4.15.12+git.535.7750e5c95ef-150300.3.43.1 libsamba-policy-python3-devel-4.15.12+git.535.7750e5c95ef-150300.3.43.1 libsamba-policy0-python3-4.15.12+git.535.7750e5c95ef-150300.3.43.1 libsamba-policy0-python3-debuginfo-4.15.12+git.535.7750e5c95ef-150300.3.43.1 samba-4.15.12+git.535.7750e5c95ef-150300.3.43.1 samba-ad-dc-libs-4.15.12+git.535.7750e5c95ef-150300.3.43.1 samba-ad-dc-libs-debuginfo-4.15.12+git.535.7750e5c95ef-150300.3.43.1 samba-client-4.15.12+git.535.7750e5c95ef-150300.3.43.1 samba-client-debuginfo-4.15.12+git.535.7750e5c95ef-150300.3.43.1 samba-client-libs-4.15.12+git.535.7750e5c95ef-150300.3.43.1 samba-client-libs-debuginfo-4.15.12+git.535.7750e5c95ef-150300.3.43.1 samba-debuginfo-4.15.12+git.535.7750e5c95ef-150300.3.43.1 samba-debugsource-4.15.12+git.535.7750e5c95ef-150300.3.43.1 samba-devel-4.15.12+git.535.7750e5c95ef-150300.3.43.1 samba-dsdb-modules-4.15.12+git.535.7750e5c95ef-150300.3.43.1 samba-dsdb-modules-debuginfo-4.15.12+git.535.7750e5c95ef-150300.3.43.1 samba-gpupdate-4.15.12+git.535.7750e5c95ef-150300.3.43.1 samba-ldb-ldap-4.15.12+git.535.7750e5c95ef-150300.3.43.1 samba-ldb-ldap-debuginfo-4.15.12+git.535.7750e5c95ef-150300.3.43.1 samba-libs-4.15.12+git.535.7750e5c95ef-150300.3.43.1 samba-libs-debuginfo-4.15.12+git.535.7750e5c95ef-150300.3.43.1 samba-libs-python3-4.15.12+git.535.7750e5c95ef-150300.3.43.1 samba-libs-python3-debuginfo-4.15.12+git.535.7750e5c95ef-150300.3.43.1 samba-python3-4.15.12+git.535.7750e5c95ef-150300.3.43.1 samba-python3-debuginfo-4.15.12+git.535.7750e5c95ef-150300.3.43.1 samba-tool-4.15.12+git.535.7750e5c95ef-150300.3.43.1 samba-winbind-4.15.12+git.535.7750e5c95ef-150300.3.43.1 samba-winbind-debuginfo-4.15.12+git.535.7750e5c95ef-150300.3.43.1 samba-winbind-libs-4.15.12+git.535.7750e5c95ef-150300.3.43.1 samba-winbind-libs-debuginfo-4.15.12+git.535.7750e5c95ef-150300.3.43.1 - SUSE Linux Enterprise Module for Basesystem 15-SP3 (aarch64 x86_64): samba-ceph-4.15.12+git.535.7750e5c95ef-150300.3.43.1 samba-ceph-debuginfo-4.15.12+git.535.7750e5c95ef-150300.3.43.1 - SUSE Linux Enterprise Module for Basesystem 15-SP3 (x86_64): samba-ad-dc-libs-32bit-4.15.12+git.535.7750e5c95ef-150300.3.43.1 samba-ad-dc-libs-32bit-debuginfo-4.15.12+git.535.7750e5c95ef-150300.3.43.1 samba-client-32bit-4.15.12+git.535.7750e5c95ef-150300.3.43.1 samba-client-32bit-debuginfo-4.15.12+git.535.7750e5c95ef-150300.3.43.1 samba-client-libs-32bit-4.15.12+git.535.7750e5c95ef-150300.3.43.1 samba-client-libs-32bit-debuginfo-4.15.12+git.535.7750e5c95ef-150300.3.43.1 samba-devel-32bit-4.15.12+git.535.7750e5c95ef-150300.3.43.1 samba-libs-32bit-4.15.12+git.535.7750e5c95ef-150300.3.43.1 samba-libs-32bit-debuginfo-4.15.12+git.535.7750e5c95ef-150300.3.43.1 samba-winbind-libs-32bit-4.15.12+git.535.7750e5c95ef-150300.3.43.1 samba-winbind-libs-32bit-debuginfo-4.15.12+git.535.7750e5c95ef-150300.3.43.1 - SUSE Linux Enterprise Micro 5.2 (aarch64 s390x x86_64): samba-client-libs-4.15.12+git.535.7750e5c95ef-150300.3.43.1 samba-client-libs-debuginfo-4.15.12+git.535.7750e5c95ef-150300.3.43.1 samba-debuginfo-4.15.12+git.535.7750e5c95ef-150300.3.43.1 samba-debugsource-4.15.12+git.535.7750e5c95ef-150300.3.43.1 - SUSE Linux Enterprise High Availability 15-SP3 (aarch64 ppc64le s390x x86_64): ctdb-4.15.12+git.535.7750e5c95ef-150300.3.43.1 ctdb-debuginfo-4.15.12+git.535.7750e5c95ef-150300.3.43.1 samba-debuginfo-4.15.12+git.535.7750e5c95ef-150300.3.43.1 samba-debugsource-4.15.12+git.535.7750e5c95ef-150300.3.43.1 - SUSE Enterprise Storage 7.1 (aarch64 x86_64): ctdb-4.15.12+git.535.7750e5c95ef-150300.3.43.1 ctdb-debuginfo-4.15.12+git.535.7750e5c95ef-150300.3.43.1 samba-4.15.12+git.535.7750e5c95ef-150300.3.43.1 samba-ceph-4.15.12+git.535.7750e5c95ef-150300.3.43.1 samba-ceph-debuginfo-4.15.12+git.535.7750e5c95ef-150300.3.43.1 samba-client-4.15.12+git.535.7750e5c95ef-150300.3.43.1 samba-client-debuginfo-4.15.12+git.535.7750e5c95ef-150300.3.43.1 samba-debuginfo-4.15.12+git.535.7750e5c95ef-150300.3.43.1 samba-debugsource-4.15.12+git.535.7750e5c95ef-150300.3.43.1 samba-libs-4.15.12+git.535.7750e5c95ef-150300.3.43.1 samba-libs-debuginfo-4.15.12+git.535.7750e5c95ef-150300.3.43.1 samba-libs-python3-4.15.12+git.535.7750e5c95ef-150300.3.43.1 samba-libs-python3-debuginfo-4.15.12+git.535.7750e5c95ef-150300.3.43.1 samba-winbind-4.15.12+git.535.7750e5c95ef-150300.3.43.1 samba-winbind-debuginfo-4.15.12+git.535.7750e5c95ef-150300.3.43.1 References: https://www.suse.com/security/cve/CVE-2022-2031.html https://www.suse.com/security/cve/CVE-2022-32742.html https://www.suse.com/security/cve/CVE-2022-32744.html https://www.suse.com/security/cve/CVE-2022-32745.html https://www.suse.com/security/cve/CVE-2022-32746.html https://www.suse.com/security/cve/CVE-2022-3437.html https://www.suse.com/security/cve/CVE-2022-42898.html https://bugzilla.suse.com/1200102 https://bugzilla.suse.com/1201490 https://bugzilla.suse.com/1201492 https://bugzilla.suse.com/1201493 https://bugzilla.suse.com/1201495 https://bugzilla.suse.com/1201496 https://bugzilla.suse.com/1201689 https://bugzilla.suse.com/1204254 https://bugzilla.suse.com/1205126

1 0

SUSE-SU-2022:4393-1: moderate: Security update for nautilus
by opensuse-security＠opensuse.org 09 Dec '22

09 Dec '22

SUSE Security Update: Security update for nautilus ______________________________________________________________________________ Announcement ID: SUSE-SU-2022:4393-1 Rating: moderate References: #1205418 Cross-References: CVE-2022-37290 CVSS scores: CVE-2022-37290 (NVD) : 5.5 CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H CVE-2022-37290 (SUSE): 5.5 CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H Affected Products: SUSE Enterprise Storage 7.1 SUSE Linux Enterprise Desktop 15-SP3 SUSE Linux Enterprise High Performance Computing 15-SP3 SUSE Linux Enterprise Module for Desktop Applications 15-SP3 SUSE Linux Enterprise Server 15-SP3 SUSE Linux Enterprise Server for SAP Applications 15-SP3 SUSE Manager Proxy 4.2 SUSE Manager Retail Branch Server 4.2 SUSE Manager Server 4.2 openSUSE Leap 15.3 openSUSE Leap 15.4 ______________________________________________________________________________ An update that fixes one vulnerability is now available. Description: This update for nautilus fixes the following issues: - CVE-2022-37290: Fixed a denial of service caused by pasted ZIP archives (bsc#1205418). Patch Instructions: To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 15.4: zypper in -t patch openSUSE-SLE-15.4-2022-4393=1 - openSUSE Leap 15.3: zypper in -t patch openSUSE-SLE-15.3-2022-4393=1 - SUSE Linux Enterprise Module for Desktop Applications 15-SP3: zypper in -t patch SUSE-SLE-Module-Desktop-Applications-15-SP3-2022-4393=1 Package List: - openSUSE Leap 15.4 (x86_64): libnautilus-extension1-32bit-3.34.3-150200.4.6.1 libnautilus-extension1-32bit-debuginfo-3.34.3-150200.4.6.1 - openSUSE Leap 15.3 (aarch64 ppc64le s390x x86_64): gnome-shell-search-provider-nautilus-3.34.3-150200.4.6.1 libnautilus-extension1-3.34.3-150200.4.6.1 libnautilus-extension1-debuginfo-3.34.3-150200.4.6.1 nautilus-3.34.3-150200.4.6.1 nautilus-debuginfo-3.34.3-150200.4.6.1 nautilus-debugsource-3.34.3-150200.4.6.1 nautilus-devel-3.34.3-150200.4.6.1 typelib-1_0-Nautilus-3_0-3.34.3-150200.4.6.1 - openSUSE Leap 15.3 (x86_64): libnautilus-extension1-32bit-3.34.3-150200.4.6.1 libnautilus-extension1-32bit-debuginfo-3.34.3-150200.4.6.1 - openSUSE Leap 15.3 (noarch): nautilus-lang-3.34.3-150200.4.6.1 - SUSE Linux Enterprise Module for Desktop Applications 15-SP3 (aarch64 ppc64le s390x x86_64): gnome-shell-search-provider-nautilus-3.34.3-150200.4.6.1 libnautilus-extension1-3.34.3-150200.4.6.1 libnautilus-extension1-debuginfo-3.34.3-150200.4.6.1 nautilus-3.34.3-150200.4.6.1 nautilus-debuginfo-3.34.3-150200.4.6.1 nautilus-debugsource-3.34.3-150200.4.6.1 nautilus-devel-3.34.3-150200.4.6.1 typelib-1_0-Nautilus-3_0-3.34.3-150200.4.6.1 - SUSE Linux Enterprise Module for Desktop Applications 15-SP3 (noarch): nautilus-lang-3.34.3-150200.4.6.1 References: https://www.suse.com/security/cve/CVE-2022-37290.html https://bugzilla.suse.com/1205418

1 0

SUSE-SU-2022:4378-1: moderate: Security update for rabbitmq-server
by opensuse-security＠opensuse.org 08 Dec '22

08 Dec '22

SUSE Security Update: Security update for rabbitmq-server ______________________________________________________________________________ Announcement ID: SUSE-SU-2022:4378-1 Rating: moderate References: #1205267 Cross-References: CVE-2022-31008 CVSS scores: CVE-2022-31008 (NVD) : 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N CVE-2022-31008 (SUSE): 5.5 CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N Affected Products: SUSE Enterprise Storage 7.1 SUSE Linux Enterprise High Performance Computing 15-SP3 SUSE Linux Enterprise High Performance Computing 15-SP4 SUSE Linux Enterprise Module for Server Applications 15-SP3 SUSE Linux Enterprise Module for Server Applications 15-SP4 SUSE Linux Enterprise Server 15-SP3 SUSE Linux Enterprise Server 15-SP4 SUSE Linux Enterprise Server for SAP Applications 15-SP3 SUSE Linux Enterprise Server for SAP Applications 15-SP4 SUSE Manager Proxy 4.2 SUSE Manager Proxy 4.3 SUSE Manager Retail Branch Server 4.2 SUSE Manager Retail Branch Server 4.3 SUSE Manager Server 4.2 SUSE Manager Server 4.3 openSUSE Leap 15.3 openSUSE Leap 15.4 ______________________________________________________________________________ An update that fixes one vulnerability is now available. Description: This update for rabbitmq-server fixes the following issues: - CVE-2022-31008: Fixed predictable secret seed in URI encryption (bsc#1205267). Patch Instructions: To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 15.4: zypper in -t patch openSUSE-SLE-15.4-2022-4378=1 - openSUSE Leap 15.3: zypper in -t patch openSUSE-SLE-15.3-2022-4378=1 - SUSE Linux Enterprise Module for Server Applications 15-SP4: zypper in -t patch SUSE-SLE-Module-Server-Applications-15-SP4-2022-4378=1 - SUSE Linux Enterprise Module for Server Applications 15-SP3: zypper in -t patch SUSE-SLE-Module-Server-Applications-15-SP3-2022-4378=1 Package List: - openSUSE Leap 15.4 (aarch64 ppc64le s390x x86_64): erlang-rabbitmq-client-3.8.11-150300.3.11.1 rabbitmq-server-3.8.11-150300.3.11.1 rabbitmq-server-plugins-3.8.11-150300.3.11.1 - openSUSE Leap 15.3 (aarch64 ppc64le s390x x86_64): erlang-rabbitmq-client-3.8.11-150300.3.11.1 rabbitmq-server-3.8.11-150300.3.11.1 rabbitmq-server-plugins-3.8.11-150300.3.11.1 - SUSE Linux Enterprise Module for Server Applications 15-SP4 (aarch64 ppc64le s390x x86_64): erlang-rabbitmq-client-3.8.11-150300.3.11.1 rabbitmq-server-3.8.11-150300.3.11.1 rabbitmq-server-plugins-3.8.11-150300.3.11.1 - SUSE Linux Enterprise Module for Server Applications 15-SP3 (aarch64 ppc64le s390x x86_64): erlang-rabbitmq-client-3.8.11-150300.3.11.1 rabbitmq-server-3.8.11-150300.3.11.1 rabbitmq-server-plugins-3.8.11-150300.3.11.1 References: https://www.suse.com/security/cve/CVE-2022-31008.html https://bugzilla.suse.com/1205267

1 0

SUSE-SU-2022:4371-1: moderate: Security update for busybox
by opensuse-security＠opensuse.org 08 Dec '22

08 Dec '22

SUSE Security Update: Security update for busybox ______________________________________________________________________________ Announcement ID: SUSE-SU-2022:4371-1 Rating: moderate References: #1199744 #914660 Cross-References: CVE-2014-9645 CVE-2022-30065 CVSS scores: CVE-2014-9645 (NVD) : 5.5 CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N CVE-2022-30065 (NVD) : 7.8 CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H CVE-2022-30065 (SUSE): 5.5 CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H Affected Products: SUSE Linux Enterprise Desktop 15-SP4 SUSE Linux Enterprise High Performance Computing 15-SP4 SUSE Linux Enterprise Module for Basesystem 15-SP4 SUSE Linux Enterprise Server 15-SP4 SUSE Linux Enterprise Server for SAP Applications 15-SP4 SUSE Manager Proxy 4.3 SUSE Manager Retail Branch Server 4.3 SUSE Manager Server 4.3 openSUSE Leap 15.4 ______________________________________________________________________________ An update that fixes two vulnerabilities is now available. Description: This update for busybox fixes the following issues: - CVE-2022-30065: Fixed use-after-free in the AWK applet (bsc#1199744). - CVE-2014-9645: Fixed loading of unwanted module with / in module names (bsc#914660). - Update to 1.35.0 also introduced: - awk: fix printf %%, fix read beyond end of buffer - chrt: silence analyzer warning - libarchive: remove duplicate forward declaration - mount: "mount -o rw ...." should not fall back to RO mount - ps: fix -o pid=PID,args interpreting entire "PID,args" as header - tar: prevent malicious archives with long name sizes causing OOM - udhcpc6: fix udhcp_find_option to actually find DHCP6 options - xxd: fix -p -r - support for new optoins added to basename, cpio, date, find, mktemp, wget and others Patch Instructions: To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 15.4: zypper in -t patch openSUSE-SLE-15.4-2022-4371=1 - SUSE Linux Enterprise Module for Basesystem 15-SP4: zypper in -t patch SUSE-SLE-Module-Basesystem-15-SP4-2022-4371=1 Package List: - openSUSE Leap 15.4 (aarch64 ppc64le s390x x86_64): busybox-1.35.0-150400.3.8.1 busybox-static-1.35.0-150400.3.8.1 busybox-testsuite-1.35.0-150400.3.8.1 - openSUSE Leap 15.4 (aarch64 x86_64): busybox-warewulf3-1.35.0-150400.3.8.1 - openSUSE Leap 15.4 (noarch): busybox-adduser-1.35.0-150400.4.3.14 busybox-attr-1.35.0-150400.4.3.14 busybox-bc-1.35.0-150400.4.3.14 busybox-bind-utils-1.35.0-150400.4.3.14 busybox-bzip2-1.35.0-150400.4.3.14 busybox-coreutils-1.35.0-150400.4.3.14 busybox-cpio-1.35.0-150400.4.3.14 busybox-diffutils-1.35.0-150400.4.3.14 busybox-dos2unix-1.35.0-150400.4.3.14 busybox-ed-1.35.0-150400.4.3.14 busybox-findutils-1.35.0-150400.4.3.14 busybox-gawk-1.35.0-150400.4.3.14 busybox-grep-1.35.0-150400.4.3.14 busybox-gzip-1.35.0-150400.4.3.14 busybox-hostname-1.35.0-150400.4.3.14 busybox-iproute2-1.35.0-150400.4.3.14 busybox-iputils-1.35.0-150400.4.3.14 busybox-kbd-1.35.0-150400.4.3.14 busybox-kmod-1.35.0-150400.4.3.14 busybox-less-1.35.0-150400.4.3.14 busybox-links-1.35.0-150400.4.3.14 busybox-man-1.35.0-150400.4.3.14 busybox-misc-1.35.0-150400.4.3.14 busybox-ncurses-utils-1.35.0-150400.4.3.14 busybox-net-tools-1.35.0-150400.4.3.14 busybox-netcat-1.35.0-150400.4.3.14 busybox-patch-1.35.0-150400.4.3.14 busybox-policycoreutils-1.35.0-150400.4.3.14 busybox-procps-1.35.0-150400.4.3.14 busybox-psmisc-1.35.0-150400.4.3.14 busybox-sed-1.35.0-150400.4.3.14 busybox-selinux-tools-1.35.0-150400.4.3.14 busybox-sendmail-1.35.0-150400.4.3.14 busybox-sh-1.35.0-150400.4.3.14 busybox-sharutils-1.35.0-150400.4.3.14 busybox-syslogd-1.35.0-150400.4.3.14 busybox-sysvinit-tools-1.35.0-150400.4.3.14 busybox-tar-1.35.0-150400.4.3.14 busybox-telnet-1.35.0-150400.4.3.14 busybox-tftp-1.35.0-150400.4.3.14 busybox-time-1.35.0-150400.4.3.14 busybox-traceroute-1.35.0-150400.4.3.14 busybox-tunctl-1.35.0-150400.4.3.14 busybox-unzip-1.35.0-150400.4.3.14 busybox-util-linux-1.35.0-150400.4.3.14 busybox-vi-1.35.0-150400.4.3.14 busybox-vlan-1.35.0-150400.4.3.14 busybox-wget-1.35.0-150400.4.3.14 busybox-which-1.35.0-150400.4.3.14 busybox-whois-1.35.0-150400.4.3.14 busybox-xz-1.35.0-150400.4.3.14 - SUSE Linux Enterprise Module for Basesystem 15-SP4 (aarch64 ppc64le s390x x86_64): busybox-1.35.0-150400.3.8.1 busybox-static-1.35.0-150400.3.8.1 References: https://www.suse.com/security/cve/CVE-2014-9645.html https://www.suse.com/security/cve/CVE-2022-30065.html https://bugzilla.suse.com/1199744 https://bugzilla.suse.com/914660

1 0

openSUSE-SU-2022:10236-1: important: Security update for chromium
by opensuse-security＠opensuse.org 08 Dec '22

08 Dec '22

openSUSE Security Update: Security update for chromium ______________________________________________________________________________ Announcement ID: openSUSE-SU-2022:10236-1 Rating: important References: #1205999 Cross-References: CVE-2022-4262 CVSS scores: CVE-2022-4262 (NVD) : 8.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H Affected Products: openSUSE Backports SLE-15-SP3 openSUSE Backports SLE-15-SP4 ______________________________________________________________________________ An update that fixes one vulnerability is now available. Description: This update for chromium fixes the following issues: Chromium 108.0.5359.94 (boo#1205999) - CVE-2022-4262: Type Confusion in V8 Patch Instructions: To install this openSUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Backports SLE-15-SP4: zypper in -t patch openSUSE-2022-10236=1 - openSUSE Backports SLE-15-SP3: zypper in -t patch openSUSE-2022-10236=1 Package List: - openSUSE Backports SLE-15-SP4 (aarch64 x86_64): chromedriver-108.0.5359.94-bp154.2.52.1 chromedriver-debuginfo-108.0.5359.94-bp154.2.52.1 chromium-108.0.5359.94-bp154.2.52.1 chromium-debuginfo-108.0.5359.94-bp154.2.52.1 - openSUSE Backports SLE-15-SP3 (aarch64 x86_64): chromedriver-108.0.5359.94-bp153.2.145.1 chromium-108.0.5359.94-bp153.2.145.1 References: https://www.suse.com/security/cve/CVE-2022-4262.html https://bugzilla.suse.com/1205999

1 0

openSUSE-SU-2022:10235-1: important: Security update for matio
by opensuse-security＠opensuse.org 08 Dec '22

08 Dec '22

openSUSE Security Update: Security update for matio ______________________________________________________________________________ Announcement ID: openSUSE-SU-2022:10235-1 Rating: important References: #1193873 #1193874 Cross-References: CVE-2020-36428 CVE-2021-36977 CVSS scores: CVE-2020-36428 (NVD) : 8.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H CVE-2021-36977 (NVD) : 6.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H Affected Products: openSUSE Backports SLE-15-SP4 ______________________________________________________________________________ An update that fixes two vulnerabilities is now available. Description: This update for matio fixes the following issues: Update to version 1.5.23: * Fixed testsuite regression from version 1.5.22. Changes from version 1.5.22: * Added support for reading large MAT file. * Updated cmake-conan to version 0.17.0. * Fixed CMake build with Conan (MATIO_USE_CONAN:BOOL=ON). * Fixed data type when reading 16-bit character data from HDF5 MAT file. * Fixed heap-based buffer overflows when reading (crafted) MAT file (CVE-2020-36428, CVE-2021-36977). * Confirmed compatibility with HDF5 v1.13.0 and v1.13.1. * Several other fixes, for example for memory leaks. Patch Instructions: To install this openSUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Backports SLE-15-SP4: zypper in -t patch openSUSE-2022-10235=1 Package List: - openSUSE Backports SLE-15-SP4 (aarch64 i586 ppc64le s390x x86_64): libmatio-devel-1.5.23-bp154.2.3.1 libmatio11-1.5.23-bp154.2.3.1 matio-tools-1.5.23-bp154.2.3.1 References: https://www.suse.com/security/cve/CVE-2020-36428.html https://www.suse.com/security/cve/CVE-2021-36977.html https://bugzilla.suse.com/1193873 https://bugzilla.suse.com/1193874

1 0

SUSE-SU-2022:4350-1: important: Security update for buildah
by opensuse-security＠opensuse.org 07 Dec '22

07 Dec '22

SUSE Security Update: Security update for buildah ______________________________________________________________________________ Announcement ID: SUSE-SU-2022:4350-1 Rating: important References: #1167864 #1202812 Cross-References: CVE-2020-10696 CVE-2022-2990 CVSS scores: CVE-2020-10696 (NVD) : 8.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H CVE-2020-10696 (SUSE): 8.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H CVE-2022-2990 (NVD) : 7.1 CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N CVE-2022-2990 (SUSE): 4.4 CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N Affected Products: SUSE Enterprise Storage 7.1 SUSE Linux Enterprise High Performance Computing 15-SP3 SUSE Linux Enterprise Module for Containers 15-SP3 SUSE Linux Enterprise Server 15-SP3 SUSE Linux Enterprise Server for SAP Applications 15-SP3 SUSE Manager Proxy 4.2 SUSE Manager Retail Branch Server 4.2 SUSE Manager Server 4.2 openSUSE Leap 15.3 ______________________________________________________________________________ An update that fixes two vulnerabilities is now available. Description: This update for buildah fixes the following issues: Version update to 1.28.2. - CVE-2022-2990: Fixed a possible information disclosure and modification vulnerability (bsc#1202812). - CVE-2020-10696: Fixed an issue with a crafted input tar file that may lead to a local file overwriting during image build process (bsc#1167864). Patch Instructions: To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 15.3: zypper in -t patch openSUSE-SLE-15.3-2022-4350=1 - SUSE Linux Enterprise Module for Containers 15-SP3: zypper in -t patch SUSE-SLE-Module-Containers-15-SP3-2022-4350=1 Package List: - openSUSE Leap 15.3 (aarch64 ppc64le s390x x86_64): buildah-1.28.2-150300.8.14.1 - SUSE Linux Enterprise Module for Containers 15-SP3 (aarch64 ppc64le s390x x86_64): buildah-1.28.2-150300.8.14.1 References: https://www.suse.com/security/cve/CVE-2020-10696.html https://www.suse.com/security/cve/CVE-2022-2990.html https://bugzilla.suse.com/1167864 https://bugzilla.suse.com/1202812

1 0

SUSE-SU-2022:4349-1: important: Security update for buildah
by opensuse-security＠opensuse.org 07 Dec '22

07 Dec '22

SUSE Security Update: Security update for buildah ______________________________________________________________________________ Announcement ID: SUSE-SU-2022:4349-1 Rating: important References: #1167864 #1202812 Cross-References: CVE-2020-10696 CVE-2022-2990 CVSS scores: CVE-2020-10696 (NVD) : 8.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H CVE-2020-10696 (SUSE): 8.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H CVE-2022-2990 (NVD) : 7.1 CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N CVE-2022-2990 (SUSE): 4.4 CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N Affected Products: SUSE Linux Enterprise High Performance Computing 15-SP4 SUSE Linux Enterprise Module for Containers 15-SP4 SUSE Linux Enterprise Server 15-SP4 SUSE Linux Enterprise Server for SAP Applications 15-SP4 SUSE Manager Proxy 4.3 SUSE Manager Retail Branch Server 4.3 SUSE Manager Server 4.3 openSUSE Leap 15.4 ______________________________________________________________________________ An update that fixes two vulnerabilities is now available. Description: This update for buildah fixes the following issues: Version update to 1.28.2. - CVE-2022-2990: Fixed a possible information disclosure and modification vulnerability (bsc#1202812). - CVE-2020-10696: Fixed an issue with a crafted input tar file that may lead to a local file overwriting during image build process (bsc#1167864). Patch Instructions: To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 15.4: zypper in -t patch openSUSE-SLE-15.4-2022-4349=1 - SUSE Linux Enterprise Module for Containers 15-SP4: zypper in -t patch SUSE-SLE-Module-Containers-15-SP4-2022-4349=1 Package List: - openSUSE Leap 15.4 (aarch64 ppc64le s390x x86_64): buildah-1.28.2-150400.3.11.1 - SUSE Linux Enterprise Module for Containers 15-SP4 (aarch64 ppc64le s390x x86_64): buildah-1.28.2-150400.3.11.1 References: https://www.suse.com/security/cve/CVE-2020-10696.html https://www.suse.com/security/cve/CVE-2022-2990.html https://bugzilla.suse.com/1167864 https://bugzilla.suse.com/1202812

1 0

SUSE-SU-2022:4334-1: important: Security update for MozillaThunderbird
by opensuse-security＠opensuse.org 06 Dec '22

06 Dec '22

SUSE Security Update: Security update for MozillaThunderbird ______________________________________________________________________________ Announcement ID: SUSE-SU-2022:4334-1 Rating: important References: #1205941 Cross-References: CVE-2022-45414 CVSS scores: CVE-2022-45414 (SUSE): 6.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:L Affected Products: SUSE Enterprise Storage 7.1 SUSE Linux Enterprise Desktop 15-SP3 SUSE Linux Enterprise Desktop 15-SP4 SUSE Linux Enterprise High Performance Computing 15-SP3 SUSE Linux Enterprise High Performance Computing 15-SP4 SUSE Linux Enterprise Module for Packagehub Subpackages 15-SP3 SUSE Linux Enterprise Module for Packagehub Subpackages 15-SP4 SUSE Linux Enterprise Server 15-SP3 SUSE Linux Enterprise Server 15-SP4 SUSE Linux Enterprise Server for SAP Applications 15-SP3 SUSE Linux Enterprise Server for SAP Applications 15-SP4 SUSE Linux Enterprise Workstation Extension 15-SP3 SUSE Linux Enterprise Workstation Extension 15-SP4 SUSE Manager Proxy 4.2 SUSE Manager Proxy 4.3 SUSE Manager Retail Branch Server 4.2 SUSE Manager Retail Branch Server 4.3 SUSE Manager Server 4.2 SUSE Manager Server 4.3 openSUSE Leap 15.3 openSUSE Leap 15.4 ______________________________________________________________________________ An update that fixes one vulnerability is now available. Description: This update for MozillaThunderbird fixes the following issues: Update to version 102.5.1: - CVE-2022-45414: Quoting from an HTML email with certain tags will trigger network requests and load remote content, regardless of a configuration to block remote content (bsc#1205941). Patch Instructions: To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 15.4: zypper in -t patch openSUSE-SLE-15.4-2022-4334=1 - openSUSE Leap 15.3: zypper in -t patch openSUSE-SLE-15.3-2022-4334=1 - SUSE Linux Enterprise Workstation Extension 15-SP4: zypper in -t patch SUSE-SLE-Product-WE-15-SP4-2022-4334=1 - SUSE Linux Enterprise Workstation Extension 15-SP3: zypper in -t patch SUSE-SLE-Product-WE-15-SP3-2022-4334=1 - SUSE Linux Enterprise Module for Packagehub Subpackages 15-SP4: zypper in -t patch SUSE-SLE-Module-Packagehub-Subpackages-15-SP4-2022-4334=1 - SUSE Linux Enterprise Module for Packagehub Subpackages 15-SP3: zypper in -t patch SUSE-SLE-Module-Packagehub-Subpackages-15-SP3-2022-4334=1 Package List: - openSUSE Leap 15.4 (aarch64 ppc64le s390x x86_64): MozillaThunderbird-102.5.1-150200.8.93.1 MozillaThunderbird-debuginfo-102.5.1-150200.8.93.1 MozillaThunderbird-debugsource-102.5.1-150200.8.93.1 MozillaThunderbird-translations-common-102.5.1-150200.8.93.1 MozillaThunderbird-translations-other-102.5.1-150200.8.93.1 - openSUSE Leap 15.3 (aarch64 ppc64le s390x x86_64): MozillaThunderbird-102.5.1-150200.8.93.1 MozillaThunderbird-debuginfo-102.5.1-150200.8.93.1 MozillaThunderbird-debugsource-102.5.1-150200.8.93.1 MozillaThunderbird-translations-common-102.5.1-150200.8.93.1 MozillaThunderbird-translations-other-102.5.1-150200.8.93.1 - SUSE Linux Enterprise Workstation Extension 15-SP4 (x86_64): MozillaThunderbird-102.5.1-150200.8.93.1 MozillaThunderbird-debuginfo-102.5.1-150200.8.93.1 MozillaThunderbird-debugsource-102.5.1-150200.8.93.1 MozillaThunderbird-translations-common-102.5.1-150200.8.93.1 MozillaThunderbird-translations-other-102.5.1-150200.8.93.1 - SUSE Linux Enterprise Workstation Extension 15-SP3 (x86_64): MozillaThunderbird-102.5.1-150200.8.93.1 MozillaThunderbird-debuginfo-102.5.1-150200.8.93.1 MozillaThunderbird-debugsource-102.5.1-150200.8.93.1 MozillaThunderbird-translations-common-102.5.1-150200.8.93.1 MozillaThunderbird-translations-other-102.5.1-150200.8.93.1 - SUSE Linux Enterprise Module for Packagehub Subpackages 15-SP4 (aarch64 ppc64le s390x): MozillaThunderbird-102.5.1-150200.8.93.1 MozillaThunderbird-debuginfo-102.5.1-150200.8.93.1 MozillaThunderbird-debugsource-102.5.1-150200.8.93.1 MozillaThunderbird-translations-common-102.5.1-150200.8.93.1 MozillaThunderbird-translations-other-102.5.1-150200.8.93.1 - SUSE Linux Enterprise Module for Packagehub Subpackages 15-SP3 (aarch64 ppc64le s390x): MozillaThunderbird-102.5.1-150200.8.93.1 MozillaThunderbird-debuginfo-102.5.1-150200.8.93.1 MozillaThunderbird-debugsource-102.5.1-150200.8.93.1 MozillaThunderbird-translations-common-102.5.1-150200.8.93.1 MozillaThunderbird-translations-other-102.5.1-150200.8.93.1 References: https://www.suse.com/security/cve/CVE-2022-45414.html https://bugzilla.suse.com/1205941

1 0

openSUSE-SU-2022:10229-1: important: Security update for chromium
by opensuse-security＠opensuse.org 04 Dec '22

04 Dec '22

openSUSE Security Update: Security update for chromium ______________________________________________________________________________ Announcement ID: openSUSE-SU-2022:10229-1 Rating: important References: #1205871 Cross-References: CVE-2022-4174 CVE-2022-4175 CVE-2022-4176 CVE-2022-4177 CVE-2022-4178 CVE-2022-4179 CVE-2022-4180 CVE-2022-4181 CVE-2022-4182 CVE-2022-4183 CVE-2022-4184 CVE-2022-4185 CVE-2022-4186 CVE-2022-4187 CVE-2022-4188 CVE-2022-4189 CVE-2022-4190 CVE-2022-4191 CVE-2022-4192 CVE-2022-4193 CVE-2022-4194 CVE-2022-4195 CVSS scores: CVE-2022-4174 (NVD) : 8.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H CVE-2022-4175 (NVD) : 8.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H CVE-2022-4176 (NVD) : 8.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H CVE-2022-4177 (NVD) : 8.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H CVE-2022-4178 (NVD) : 8.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H CVE-2022-4179 (NVD) : 8.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H CVE-2022-4180 (NVD) : 8.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H CVE-2022-4181 (NVD) : 8.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H CVE-2022-4182 (NVD) : 4.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N CVE-2022-4183 (NVD) : 4.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N CVE-2022-4184 (NVD) : 4.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N CVE-2022-4185 (NVD) : 4.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N CVE-2022-4186 (NVD) : 4.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N CVE-2022-4187 (NVD) : 6.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N CVE-2022-4188 (NVD) : 4.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N CVE-2022-4189 (NVD) : 4.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N CVE-2022-4190 (NVD) : 8.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H CVE-2022-4191 (NVD) : 8.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H CVE-2022-4192 (NVD) : 8.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H CVE-2022-4193 (NVD) : 8.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H CVE-2022-4194 (NVD) : 8.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H CVE-2022-4195 (NVD) : 4.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N Affected Products: openSUSE Backports SLE-15-SP3 openSUSE Backports SLE-15-SP4 ______________________________________________________________________________ An update that fixes 22 vulnerabilities is now available. Description: This update for chromium fixes the following issues: Chromium 108.0.5359.71 (boo#1205871) - CVE-2022-4174: Type Confusion in V8. - CVE-2022-4175: Use after free in Camera Capture. - CVE-2022-4176: Out of bounds write in Lacros Graphics. - CVE-2022-4177: Use after free in Extensions. - CVE-2022-4178: Use after free in Mojo. - CVE-2022-4179: Use after free in Audio. - CVE-2022-4180: Use after free in Mojo. - CVE-2022-4181: Use after free in Forms. - CVE-2022-4182: Inappropriate implementation in Fenced Frames. - CVE-2022-4183: Insufficient policy enforcement in Popup Blocker. - CVE-2022-4184: Insufficient policy enforcement in Autofill. - CVE-2022-4185: Inappropriate implementation in Navigation. - CVE-2022-4186: Insufficient validation of untrusted input in Downloads. - CVE-2022-4187: Insufficient policy enforcement in DevTools. - CVE-2022-4188: Insufficient validation of untrusted input in CORS. - CVE-2022-4189: Insufficient policy enforcement in DevTools. - CVE-2022-4190: Insufficient data validation in Directory. - CVE-2022-4191: Use after free in Sign-In. - CVE-2022-4192: Use after free in Live Caption. - CVE-2022-4193: Insufficient policy enforcement in File System API. - CVE-2022-4194: Use after free in Accessibility. - CVE-2022-4195: Insufficient policy enforcement in Safe Browsing. Patch Instructions: To install this openSUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Backports SLE-15-SP4: zypper in -t patch openSUSE-2022-10229=1 - openSUSE Backports SLE-15-SP3: zypper in -t patch openSUSE-2022-10229=1 Package List: - openSUSE Backports SLE-15-SP4 (aarch64 x86_64): chromedriver-108.0.5359.71-bp154.2.49.1 chromedriver-debuginfo-108.0.5359.71-bp154.2.49.1 chromium-108.0.5359.71-bp154.2.49.1 chromium-debuginfo-108.0.5359.71-bp154.2.49.1 - openSUSE Backports SLE-15-SP3 (aarch64 x86_64): chromedriver-108.0.5359.71-bp153.2.142.1 chromium-108.0.5359.71-bp153.2.142.1 References: https://www.suse.com/security/cve/CVE-2022-4174.html https://www.suse.com/security/cve/CVE-2022-4175.html https://www.suse.com/security/cve/CVE-2022-4176.html https://www.suse.com/security/cve/CVE-2022-4177.html https://www.suse.com/security/cve/CVE-2022-4178.html https://www.suse.com/security/cve/CVE-2022-4179.html https://www.suse.com/security/cve/CVE-2022-4180.html https://www.suse.com/security/cve/CVE-2022-4181.html https://www.suse.com/security/cve/CVE-2022-4182.html https://www.suse.com/security/cve/CVE-2022-4183.html https://www.suse.com/security/cve/CVE-2022-4184.html https://www.suse.com/security/cve/CVE-2022-4185.html https://www.suse.com/security/cve/CVE-2022-4186.html https://www.suse.com/security/cve/CVE-2022-4187.html https://www.suse.com/security/cve/CVE-2022-4188.html https://www.suse.com/security/cve/CVE-2022-4189.html https://www.suse.com/security/cve/CVE-2022-4190.html https://www.suse.com/security/cve/CVE-2022-4191.html https://www.suse.com/security/cve/CVE-2022-4192.html https://www.suse.com/security/cve/CVE-2022-4193.html https://www.suse.com/security/cve/CVE-2022-4194.html https://www.suse.com/security/cve/CVE-2022-4195.html https://bugzilla.suse.com/1205871

1 0

openSUSE-SU-2022:10230-1: moderate: Security update for cherrytree
by opensuse-security＠opensuse.org 04 Dec '22

04 Dec '22

openSUSE Security Update: Security update for cherrytree ______________________________________________________________________________ Announcement ID: openSUSE-SU-2022:10230-1 Rating: moderate References: #1202513 Cross-References: CVE-2022-35133 CVSS scores: CVE-2022-35133 (NVD) : 6.1 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N Affected Products: openSUSE Backports SLE-15-SP4 ______________________________________________________________________________ An update that fixes one vulnerability is now available. Description: cherrytree was updated to version 0.99.49+3: * Legacy_canonicalize_filename: manage empty filename, (gh#giuspen/cherrytree#2118) * added command line option '--anchor AnchorName' that in addition to existing '--node NodeName' allows to open a document focusing an anchor in a node. * Changed non configurable keyboard shortcuts for codebox width and table column width to use parenthesis open instead of backslash, (gh#giuspen/cherrytree#2113). * Fixed crash on double exit from systray icon right click menu, (gh#giuspen/cherrytree#2114). * Added keyboard shortcuts to toolbar tooltips, (gh#giuspen/cherrytree#2106). * Fixed export to HTML crash, (gh#giuspen/cherrytree#2109). * Force turning off portal usage since it does not work on all distros, (gh#giuspen/cherrytree#2111). * Improved dialog confirmation before executing the code. * Additonal changes for core22, (gh#giuspen/cherrytree#2110). * Allow to disable the dialog asking for confirmation before executing the code. * Fixed bulleted list unindent (Shift+Tab) crash, (gh#giuspen/cherrytree#2103). * Add home plug, (gh#giuspen/cherrytree#2101 and gh#giuspen/cherrytree#2102). * Linux menu launcher run cherrytree in a new instance, (gh#giuspen/cherrytree#2077). * Fixed crash on print/export as pdf of a sequence of characters without spaces longer that the page width, such as a very long URL, (gh#giuspen/cherrytree#2045). * Fixed wrongly entering column mode when using keyboard shortcuts with <Ctrl><Alt> such as insert codebox, (gh#giuspen/cherrytree#2075). * Added syntax highlighting support for GDScript. * Fixed tooltip and cursor not reset after hovering link and then navigating to non rich text node. * Support for accent insensitive search - added letters with subordinate dots, (gh#giuspen/cherrytree#1981). * Translation updates. - Developer advised fixed cross-site scripting (XSS) vulnerability that allows attackers to execute arbitrary web scripts or HTML via a crafted payload injected into the Name text field when creating a node, (boo#1202513, gh#giuspen/cherrytree#2099 and CVE-2022-35133). Update to version 0.99.48: * Added support for right to left languages in export to html and pdf (gh#giuspen/cherrytree#2044, gh#giuspen/cherrytree#1668 and gh#giuspen/cherrytree# #698). * In order to support the right to left languages in export to html, the resulting html text lines are no longer LINE<br/> but <p>LINE</p>. * Fixed in export to pdf the link to node+anchor with non ascii anchor name. * Improved detection of missing executables required for rendering LatexBoxes. These dependencies are no longer mandatory (gh#giuspen/cherrytree#2033). * Added help to the user to show again a hidden menubar (gh#giuspen/cherrytree#1927 and gh#giuspen/cherrytree#2054). * Pressing Tab on the very latest table cell now adds a new table line and moves to its first cell. * Fixed issue with relative links to files and folders and documents moved between linux and windows. * In export to html and txt multiple files, now appending the node id to the file names to support multiple nodes with the same name. * Added syntax highlight support for solidity (gh#giuspen/cherrytree#2030). * After issues with the domain giuspen.com, the domain changed to giuspen.net and giuspen.com will eventually go. Update to version 0.99.47+2: * Added support for latex math equations. * Added copy/paste of tree nodes and subnodes between multiple opened files. * Restored support for drag and drop of text selection. Now rich text content is preserved. * Added syntax highlighting for HCL. * Fixed issue at reset toolbar in preferences dialog when menubar in titlebar. * Added command line option (-S/--secondary_session) to run in isolation from a possibly already running main instance. * Updated flatpak script. Update to version 0.99.46+6: * Fixed time created/modified filter on searches for node name and tags. * Changed default keyboard shortcuts using Ctrl+Period to Ctrl+Backslash for clash with latest linux desktops. * Fixed restore window position on Windows and dual screen. * Added strip trailing spaces action to rich text right click menu. * Fixed issue restoring hpaned tree/text position with tree on the right. * Added command line option to pass the password to open an encrypted document. Update to version 0.99.45+10: * added language Arabic * fixed time created/modified filter on searches for node name and tags * just ninja build debug print * added strip trailing spaces action to rich text right click menu * minor improvement to previous commit * fixed copy fromm codebox and pasting to rich text unwanted additional characters Patch Instructions: To install this openSUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Backports SLE-15-SP4: zypper in -t patch openSUSE-2022-10230=1 Package List: - openSUSE Backports SLE-15-SP4 (aarch64 s390x x86_64): cherrytree-0.99.49+3-bp154.2.3.2 - openSUSE Backports SLE-15-SP4 (noarch): cherrytree-lang-0.99.49+3-bp154.2.3.2 References: https://www.suse.com/security/cve/CVE-2022-35133.html https://bugzilla.suse.com/1202513

1 0

SUSE-SU-2022:4310-1: important: Security update for emacs
by opensuse-security＠opensuse.org 02 Dec '22

02 Dec '22

SUSE Security Update: Security update for emacs ______________________________________________________________________________ Announcement ID: SUSE-SU-2022:4310-1 Rating: important References: #1205822 Cross-References: CVE-2022-45939 CVSS scores: CVE-2022-45939 (NVD) : 7.8 CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H CVE-2022-45939 (SUSE): 7.8 CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H Affected Products: SUSE CaaS Platform 4.0 SUSE Enterprise Storage 6 SUSE Enterprise Storage 7 SUSE Enterprise Storage 7.1 SUSE Linux Enterprise Desktop 15-SP3 SUSE Linux Enterprise High Performance Computing 15-ESPOS SUSE Linux Enterprise High Performance Computing 15-LTSS SUSE Linux Enterprise High Performance Computing 15-SP1-ESPOS SUSE Linux Enterprise High Performance Computing 15-SP1-LTSS SUSE Linux Enterprise High Performance Computing 15-SP2-ESPOS SUSE Linux Enterprise High Performance Computing 15-SP2-LTSS SUSE Linux Enterprise High Performance Computing 15-SP3 SUSE Linux Enterprise Module for Basesystem 15-SP3 SUSE Linux Enterprise Module for Desktop Applications 15-SP3 SUSE Linux Enterprise Server 15-LTSS SUSE Linux Enterprise Server 15-SP1-BCL SUSE Linux Enterprise Server 15-SP1-LTSS SUSE Linux Enterprise Server 15-SP2-BCL SUSE Linux Enterprise Server 15-SP2-LTSS SUSE Linux Enterprise Server 15-SP3 SUSE Linux Enterprise Server for SAP 15 SUSE Linux Enterprise Server for SAP 15-SP1 SUSE Linux Enterprise Server for SAP 15-SP2 SUSE Linux Enterprise Server for SAP Applications 15-SP3 SUSE Manager Proxy 4.1 SUSE Manager Proxy 4.2 SUSE Manager Retail Branch Server 4.1 SUSE Manager Retail Branch Server 4.2 SUSE Manager Server 4.1 SUSE Manager Server 4.2 openSUSE Leap 15.3 ______________________________________________________________________________ An update that fixes one vulnerability is now available. Description: This update for emacs fixes the following issues: - CVE-2022-45939: Fixed shell command injection via source code files when using ctags (bsc#1205822). Patch Instructions: To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 15.3: zypper in -t patch openSUSE-SLE-15.3-2022-4310=1 - SUSE Manager Server 4.1: zypper in -t patch SUSE-SLE-Product-SUSE-Manager-Server-4.1-2022-4310=1 - SUSE Manager Retail Branch Server 4.1: zypper in -t patch SUSE-SLE-Product-SUSE-Manager-Retail-Branch-Server-4.1-2022-4310=1 - SUSE Manager Proxy 4.1: zypper in -t patch SUSE-SLE-Product-SUSE-Manager-Proxy-4.1-2022-4310=1 - SUSE Linux Enterprise Server for SAP 15-SP2: zypper in -t patch SUSE-SLE-Product-SLES_SAP-15-SP2-2022-4310=1 - SUSE Linux Enterprise Server for SAP 15-SP1: zypper in -t patch SUSE-SLE-Product-SLES_SAP-15-SP1-2022-4310=1 - SUSE Linux Enterprise Server for SAP 15: zypper in -t patch SUSE-SLE-Product-SLES_SAP-15-2022-4310=1 - SUSE Linux Enterprise Server 15-SP2-LTSS: zypper in -t patch SUSE-SLE-Product-SLES-15-SP2-LTSS-2022-4310=1 - SUSE Linux Enterprise Server 15-SP2-BCL: zypper in -t patch SUSE-SLE-Product-SLES-15-SP2-BCL-2022-4310=1 - SUSE Linux Enterprise Server 15-SP1-LTSS: zypper in -t patch SUSE-SLE-Product-SLES-15-SP1-LTSS-2022-4310=1 - SUSE Linux Enterprise Server 15-SP1-BCL: zypper in -t patch SUSE-SLE-Product-SLES-15-SP1-BCL-2022-4310=1 - SUSE Linux Enterprise Server 15-LTSS: zypper in -t patch SUSE-SLE-Product-SLES-15-2022-4310=1 - SUSE Linux Enterprise Module for Desktop Applications 15-SP3: zypper in -t patch SUSE-SLE-Module-Desktop-Applications-15-SP3-2022-4310=1 - SUSE Linux Enterprise Module for Basesystem 15-SP3: zypper in -t patch SUSE-SLE-Module-Basesystem-15-SP3-2022-4310=1 - SUSE Linux Enterprise High Performance Computing 15-SP2-LTSS: zypper in -t patch SUSE-SLE-Product-HPC-15-SP2-LTSS-2022-4310=1 - SUSE Linux Enterprise High Performance Computing 15-SP2-ESPOS: zypper in -t patch SUSE-SLE-Product-HPC-15-SP2-ESPOS-2022-4310=1 - SUSE Linux Enterprise High Performance Computing 15-SP1-LTSS: zypper in -t patch SUSE-SLE-Product-HPC-15-SP1-LTSS-2022-4310=1 - SUSE Linux Enterprise High Performance Computing 15-SP1-ESPOS: zypper in -t patch SUSE-SLE-Product-HPC-15-SP1-ESPOS-2022-4310=1 - SUSE Linux Enterprise High Performance Computing 15-LTSS: zypper in -t patch SUSE-SLE-Product-HPC-15-2022-4310=1 - SUSE Linux Enterprise High Performance Computing 15-ESPOS: zypper in -t patch SUSE-SLE-Product-HPC-15-2022-4310=1 - SUSE Enterprise Storage 7: zypper in -t patch SUSE-Storage-7-2022-4310=1 - SUSE Enterprise Storage 6: zypper in -t patch SUSE-Storage-6-2022-4310=1 - SUSE CaaS Platform 4.0: To install this update, use the SUSE CaaS Platform 'skuba' tool. It will inform you if it detects new updates and let you then trigger updating of the complete cluster in a controlled way. Package List: - openSUSE Leap 15.3 (aarch64 ppc64le s390x x86_64): emacs-25.3-150000.3.12.1 emacs-debuginfo-25.3-150000.3.12.1 emacs-debugsource-25.3-150000.3.12.1 emacs-nox-25.3-150000.3.12.1 emacs-nox-debuginfo-25.3-150000.3.12.1 emacs-x11-25.3-150000.3.12.1 emacs-x11-debuginfo-25.3-150000.3.12.1 etags-25.3-150000.3.12.1 etags-debuginfo-25.3-150000.3.12.1 - openSUSE Leap 15.3 (noarch): emacs-el-25.3-150000.3.12.1 emacs-info-25.3-150000.3.12.1 - SUSE Manager Server 4.1 (ppc64le s390x x86_64): emacs-25.3-150000.3.12.1 emacs-debuginfo-25.3-150000.3.12.1 emacs-debugsource-25.3-150000.3.12.1 emacs-nox-25.3-150000.3.12.1 emacs-nox-debuginfo-25.3-150000.3.12.1 emacs-x11-25.3-150000.3.12.1 emacs-x11-debuginfo-25.3-150000.3.12.1 etags-25.3-150000.3.12.1 etags-debuginfo-25.3-150000.3.12.1 - SUSE Manager Server 4.1 (noarch): emacs-el-25.3-150000.3.12.1 emacs-info-25.3-150000.3.12.1 - SUSE Manager Retail Branch Server 4.1 (noarch): emacs-el-25.3-150000.3.12.1 emacs-info-25.3-150000.3.12.1 - SUSE Manager Retail Branch Server 4.1 (x86_64): emacs-25.3-150000.3.12.1 emacs-debuginfo-25.3-150000.3.12.1 emacs-debugsource-25.3-150000.3.12.1 emacs-nox-25.3-150000.3.12.1 emacs-nox-debuginfo-25.3-150000.3.12.1 emacs-x11-25.3-150000.3.12.1 emacs-x11-debuginfo-25.3-150000.3.12.1 etags-25.3-150000.3.12.1 etags-debuginfo-25.3-150000.3.12.1 - SUSE Manager Proxy 4.1 (x86_64): emacs-25.3-150000.3.12.1 emacs-debuginfo-25.3-150000.3.12.1 emacs-debugsource-25.3-150000.3.12.1 emacs-nox-25.3-150000.3.12.1 emacs-nox-debuginfo-25.3-150000.3.12.1 emacs-x11-25.3-150000.3.12.1 emacs-x11-debuginfo-25.3-150000.3.12.1 etags-25.3-150000.3.12.1 etags-debuginfo-25.3-150000.3.12.1 - SUSE Manager Proxy 4.1 (noarch): emacs-el-25.3-150000.3.12.1 emacs-info-25.3-150000.3.12.1 - SUSE Linux Enterprise Server for SAP 15-SP2 (ppc64le x86_64): emacs-25.3-150000.3.12.1 emacs-debuginfo-25.3-150000.3.12.1 emacs-debugsource-25.3-150000.3.12.1 emacs-nox-25.3-150000.3.12.1 emacs-nox-debuginfo-25.3-150000.3.12.1 emacs-x11-25.3-150000.3.12.1 emacs-x11-debuginfo-25.3-150000.3.12.1 etags-25.3-150000.3.12.1 etags-debuginfo-25.3-150000.3.12.1 - SUSE Linux Enterprise Server for SAP 15-SP2 (noarch): emacs-el-25.3-150000.3.12.1 emacs-info-25.3-150000.3.12.1 - SUSE Linux Enterprise Server for SAP 15-SP1 (ppc64le x86_64): emacs-25.3-150000.3.12.1 emacs-debuginfo-25.3-150000.3.12.1 emacs-debugsource-25.3-150000.3.12.1 emacs-nox-25.3-150000.3.12.1 emacs-nox-debuginfo-25.3-150000.3.12.1 emacs-x11-25.3-150000.3.12.1 emacs-x11-debuginfo-25.3-150000.3.12.1 etags-25.3-150000.3.12.1 etags-debuginfo-25.3-150000.3.12.1 - SUSE Linux Enterprise Server for SAP 15-SP1 (noarch): emacs-el-25.3-150000.3.12.1 emacs-info-25.3-150000.3.12.1 - SUSE Linux Enterprise Server for SAP 15 (ppc64le x86_64): emacs-25.3-150000.3.12.1 emacs-debuginfo-25.3-150000.3.12.1 emacs-debugsource-25.3-150000.3.12.1 emacs-nox-25.3-150000.3.12.1 emacs-nox-debuginfo-25.3-150000.3.12.1 emacs-x11-25.3-150000.3.12.1 emacs-x11-debuginfo-25.3-150000.3.12.1 etags-25.3-150000.3.12.1 etags-debuginfo-25.3-150000.3.12.1 - SUSE Linux Enterprise Server for SAP 15 (noarch): emacs-el-25.3-150000.3.12.1 emacs-info-25.3-150000.3.12.1 - SUSE Linux Enterprise Server 15-SP2-LTSS (aarch64 ppc64le s390x x86_64): emacs-25.3-150000.3.12.1 emacs-debuginfo-25.3-150000.3.12.1 emacs-debugsource-25.3-150000.3.12.1 emacs-nox-25.3-150000.3.12.1 emacs-nox-debuginfo-25.3-150000.3.12.1 emacs-x11-25.3-150000.3.12.1 emacs-x11-debuginfo-25.3-150000.3.12.1 etags-25.3-150000.3.12.1 etags-debuginfo-25.3-150000.3.12.1 - SUSE Linux Enterprise Server 15-SP2-LTSS (noarch): emacs-el-25.3-150000.3.12.1 emacs-info-25.3-150000.3.12.1 - SUSE Linux Enterprise Server 15-SP2-BCL (noarch): emacs-el-25.3-150000.3.12.1 emacs-info-25.3-150000.3.12.1 - SUSE Linux Enterprise Server 15-SP2-BCL (x86_64): emacs-25.3-150000.3.12.1 emacs-debuginfo-25.3-150000.3.12.1 emacs-debugsource-25.3-150000.3.12.1 emacs-nox-25.3-150000.3.12.1 emacs-nox-debuginfo-25.3-150000.3.12.1 emacs-x11-25.3-150000.3.12.1 emacs-x11-debuginfo-25.3-150000.3.12.1 etags-25.3-150000.3.12.1 etags-debuginfo-25.3-150000.3.12.1 - SUSE Linux Enterprise Server 15-SP1-LTSS (aarch64 ppc64le s390x x86_64): emacs-25.3-150000.3.12.1 emacs-debuginfo-25.3-150000.3.12.1 emacs-debugsource-25.3-150000.3.12.1 emacs-nox-25.3-150000.3.12.1 emacs-nox-debuginfo-25.3-150000.3.12.1 emacs-x11-25.3-150000.3.12.1 emacs-x11-debuginfo-25.3-150000.3.12.1 etags-25.3-150000.3.12.1 etags-debuginfo-25.3-150000.3.12.1 - SUSE Linux Enterprise Server 15-SP1-LTSS (noarch): emacs-el-25.3-150000.3.12.1 emacs-info-25.3-150000.3.12.1 - SUSE Linux Enterprise Server 15-SP1-BCL (noarch): emacs-el-25.3-150000.3.12.1 emacs-info-25.3-150000.3.12.1 - SUSE Linux Enterprise Server 15-SP1-BCL (x86_64): emacs-25.3-150000.3.12.1 emacs-debuginfo-25.3-150000.3.12.1 emacs-debugsource-25.3-150000.3.12.1 emacs-nox-25.3-150000.3.12.1 emacs-nox-debuginfo-25.3-150000.3.12.1 emacs-x11-25.3-150000.3.12.1 emacs-x11-debuginfo-25.3-150000.3.12.1 etags-25.3-150000.3.12.1 etags-debuginfo-25.3-150000.3.12.1 - SUSE Linux Enterprise Server 15-LTSS (aarch64 s390x): emacs-25.3-150000.3.12.1 emacs-debuginfo-25.3-150000.3.12.1 emacs-debugsource-25.3-150000.3.12.1 emacs-nox-25.3-150000.3.12.1 emacs-nox-debuginfo-25.3-150000.3.12.1 emacs-x11-25.3-150000.3.12.1 emacs-x11-debuginfo-25.3-150000.3.12.1 etags-25.3-150000.3.12.1 etags-debuginfo-25.3-150000.3.12.1 - SUSE Linux Enterprise Server 15-LTSS (noarch): emacs-el-25.3-150000.3.12.1 emacs-info-25.3-150000.3.12.1 - SUSE Linux Enterprise Module for Desktop Applications 15-SP3 (aarch64 ppc64le s390x x86_64): emacs-debuginfo-25.3-150000.3.12.1 emacs-debugsource-25.3-150000.3.12.1 emacs-x11-25.3-150000.3.12.1 emacs-x11-debuginfo-25.3-150000.3.12.1 - SUSE Linux Enterprise Module for Basesystem 15-SP3 (aarch64 ppc64le s390x x86_64): emacs-25.3-150000.3.12.1 emacs-debuginfo-25.3-150000.3.12.1 emacs-debugsource-25.3-150000.3.12.1 emacs-nox-25.3-150000.3.12.1 emacs-nox-debuginfo-25.3-150000.3.12.1 etags-25.3-150000.3.12.1 etags-debuginfo-25.3-150000.3.12.1 - SUSE Linux Enterprise Module for Basesystem 15-SP3 (noarch): emacs-el-25.3-150000.3.12.1 emacs-info-25.3-150000.3.12.1 - SUSE Linux Enterprise High Performance Computing 15-SP2-LTSS (aarch64 x86_64): emacs-25.3-150000.3.12.1 emacs-debuginfo-25.3-150000.3.12.1 emacs-debugsource-25.3-150000.3.12.1 emacs-nox-25.3-150000.3.12.1 emacs-nox-debuginfo-25.3-150000.3.12.1 emacs-x11-25.3-150000.3.12.1 emacs-x11-debuginfo-25.3-150000.3.12.1 etags-25.3-150000.3.12.1 etags-debuginfo-25.3-150000.3.12.1 - SUSE Linux Enterprise High Performance Computing 15-SP2-LTSS (noarch): emacs-el-25.3-150000.3.12.1 emacs-info-25.3-150000.3.12.1 - SUSE Linux Enterprise High Performance Computing 15-SP2-ESPOS (aarch64 x86_64): emacs-25.3-150000.3.12.1 emacs-debuginfo-25.3-150000.3.12.1 emacs-debugsource-25.3-150000.3.12.1 emacs-nox-25.3-150000.3.12.1 emacs-nox-debuginfo-25.3-150000.3.12.1 emacs-x11-25.3-150000.3.12.1 emacs-x11-debuginfo-25.3-150000.3.12.1 etags-25.3-150000.3.12.1 etags-debuginfo-25.3-150000.3.12.1 - SUSE Linux Enterprise High Performance Computing 15-SP2-ESPOS (noarch): emacs-el-25.3-150000.3.12.1 emacs-info-25.3-150000.3.12.1 - SUSE Linux Enterprise High Performance Computing 15-SP1-LTSS (aarch64 x86_64): emacs-25.3-150000.3.12.1 emacs-debuginfo-25.3-150000.3.12.1 emacs-debugsource-25.3-150000.3.12.1 emacs-nox-25.3-150000.3.12.1 emacs-nox-debuginfo-25.3-150000.3.12.1 emacs-x11-25.3-150000.3.12.1 emacs-x11-debuginfo-25.3-150000.3.12.1 etags-25.3-150000.3.12.1 etags-debuginfo-25.3-150000.3.12.1 - SUSE Linux Enterprise High Performance Computing 15-SP1-LTSS (noarch): emacs-el-25.3-150000.3.12.1 emacs-info-25.3-150000.3.12.1 - SUSE Linux Enterprise High Performance Computing 15-SP1-ESPOS (aarch64 x86_64): emacs-25.3-150000.3.12.1 emacs-debuginfo-25.3-150000.3.12.1 emacs-debugsource-25.3-150000.3.12.1 emacs-nox-25.3-150000.3.12.1 emacs-nox-debuginfo-25.3-150000.3.12.1 emacs-x11-25.3-150000.3.12.1 emacs-x11-debuginfo-25.3-150000.3.12.1 etags-25.3-150000.3.12.1 etags-debuginfo-25.3-150000.3.12.1 - SUSE Linux Enterprise High Performance Computing 15-SP1-ESPOS (noarch): emacs-el-25.3-150000.3.12.1 emacs-info-25.3-150000.3.12.1 - SUSE Linux Enterprise High Performance Computing 15-LTSS (aarch64 x86_64): emacs-25.3-150000.3.12.1 emacs-debuginfo-25.3-150000.3.12.1 emacs-debugsource-25.3-150000.3.12.1 emacs-nox-25.3-150000.3.12.1 emacs-nox-debuginfo-25.3-150000.3.12.1 emacs-x11-25.3-150000.3.12.1 emacs-x11-debuginfo-25.3-150000.3.12.1 etags-25.3-150000.3.12.1 etags-debuginfo-25.3-150000.3.12.1 - SUSE Linux Enterprise High Performance Computing 15-LTSS (noarch): emacs-el-25.3-150000.3.12.1 emacs-info-25.3-150000.3.12.1 - SUSE Linux Enterprise High Performance Computing 15-ESPOS (aarch64 x86_64): emacs-25.3-150000.3.12.1 emacs-debuginfo-25.3-150000.3.12.1 emacs-debugsource-25.3-150000.3.12.1 emacs-nox-25.3-150000.3.12.1 emacs-nox-debuginfo-25.3-150000.3.12.1 emacs-x11-25.3-150000.3.12.1 emacs-x11-debuginfo-25.3-150000.3.12.1 etags-25.3-150000.3.12.1 etags-debuginfo-25.3-150000.3.12.1 - SUSE Linux Enterprise High Performance Computing 15-ESPOS (noarch): emacs-el-25.3-150000.3.12.1 emacs-info-25.3-150000.3.12.1 - SUSE Enterprise Storage 7 (aarch64 x86_64): emacs-25.3-150000.3.12.1 emacs-debuginfo-25.3-150000.3.12.1 emacs-debugsource-25.3-150000.3.12.1 emacs-nox-25.3-150000.3.12.1 emacs-nox-debuginfo-25.3-150000.3.12.1 emacs-x11-25.3-150000.3.12.1 emacs-x11-debuginfo-25.3-150000.3.12.1 etags-25.3-150000.3.12.1 etags-debuginfo-25.3-150000.3.12.1 - SUSE Enterprise Storage 7 (noarch): emacs-el-25.3-150000.3.12.1 emacs-info-25.3-150000.3.12.1 - SUSE Enterprise Storage 6 (aarch64 x86_64): emacs-25.3-150000.3.12.1 emacs-debuginfo-25.3-150000.3.12.1 emacs-debugsource-25.3-150000.3.12.1 emacs-nox-25.3-150000.3.12.1 emacs-nox-debuginfo-25.3-150000.3.12.1 emacs-x11-25.3-150000.3.12.1 emacs-x11-debuginfo-25.3-150000.3.12.1 etags-25.3-150000.3.12.1 etags-debuginfo-25.3-150000.3.12.1 - SUSE Enterprise Storage 6 (noarch): emacs-el-25.3-150000.3.12.1 emacs-info-25.3-150000.3.12.1 - SUSE CaaS Platform 4.0 (noarch): emacs-el-25.3-150000.3.12.1 emacs-info-25.3-150000.3.12.1 - SUSE CaaS Platform 4.0 (x86_64): emacs-25.3-150000.3.12.1 emacs-debuginfo-25.3-150000.3.12.1 emacs-debugsource-25.3-150000.3.12.1 emacs-nox-25.3-150000.3.12.1 emacs-nox-debuginfo-25.3-150000.3.12.1 emacs-x11-25.3-150000.3.12.1 emacs-x11-debuginfo-25.3-150000.3.12.1 etags-25.3-150000.3.12.1 etags-debuginfo-25.3-150000.3.12.1 References: https://www.suse.com/security/cve/CVE-2022-45939.html https://bugzilla.suse.com/1205822

1 0

SUSE-SU-2022:4309-1: moderate: Security update for busybox
by opensuse-security＠opensuse.org 01 Dec '22

01 Dec '22

SUSE Security Update: Security update for busybox ______________________________________________________________________________ Announcement ID: SUSE-SU-2022:4309-1 Rating: moderate References: #1199744 Cross-References: CVE-2022-30065 CVSS scores: CVE-2022-30065 (NVD) : 7.8 CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H CVE-2022-30065 (SUSE): 5.5 CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H Affected Products: SUSE Enterprise Storage 7.1 SUSE Linux Enterprise Desktop 15-SP3 SUSE Linux Enterprise High Performance Computing 15-SP3 SUSE Linux Enterprise Module for Basesystem 15-SP3 SUSE Linux Enterprise Server 15-SP3 SUSE Linux Enterprise Server for SAP Applications 15-SP3 SUSE Manager Proxy 4.2 SUSE Manager Retail Branch Server 4.2 SUSE Manager Server 4.2 openSUSE Leap 15.3 ______________________________________________________________________________ An update that fixes one vulnerability is now available. Description: This update for busybox fixes the following issues: - CVE-2022-30065: Fixed use-after-free in the AWK applet (bsc#1199744). Patch Instructions: To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 15.3: zypper in -t patch openSUSE-SLE-15.3-2022-4309=1 - SUSE Linux Enterprise Module for Basesystem 15-SP3: zypper in -t patch SUSE-SLE-Module-Basesystem-15-SP3-2022-4309=1 Package List: - openSUSE Leap 15.3 (aarch64 ppc64le s390x x86_64): busybox-1.35.0-150000.4.17.1 busybox-static-1.35.0-150000.4.17.1 - SUSE Linux Enterprise Module for Basesystem 15-SP3 (aarch64 ppc64le s390x x86_64): busybox-1.35.0-150000.4.17.1 busybox-static-1.35.0-150000.4.17.1 References: https://www.suse.com/security/cve/CVE-2022-30065.html https://bugzilla.suse.com/1199744

1 0

SUSE-SU-2022:4308-1: moderate: Security update for virt-v2v
by opensuse-security＠opensuse.org 01 Dec '22

01 Dec '22

SUSE Security Update: Security update for virt-v2v ______________________________________________________________________________ Announcement ID: SUSE-SU-2022:4308-1 Rating: moderate References: #1201064 Cross-References: CVE-2022-2211 CVSS scores: CVE-2022-2211 (NVD) : 6.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H CVE-2022-2211 (SUSE): 5.5 CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H Affected Products: SUSE Linux Enterprise High Performance Computing 15-SP4 SUSE Linux Enterprise Module for Server Applications 15-SP4 SUSE Linux Enterprise Server 15-SP4 SUSE Linux Enterprise Server for SAP Applications 15-SP4 SUSE Manager Proxy 4.3 SUSE Manager Retail Branch Server 4.3 SUSE Manager Server 4.3 openSUSE Leap 15.4 ______________________________________________________________________________ An update that fixes one vulnerability is now available. Description: This update for virt-v2v fixes the following issues: - CVE-2022-2211: Fixed buffer overflow in get_keys (bsc#1201064). Patch Instructions: To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 15.4: zypper in -t patch openSUSE-SLE-15.4-2022-4308=1 - SUSE Linux Enterprise Module for Server Applications 15-SP4: zypper in -t patch SUSE-SLE-Module-Server-Applications-15-SP4-2022-4308=1 Package List: - openSUSE Leap 15.4 (aarch64 ppc64le s390x x86_64): virt-v2v-1.44.2-150400.3.3.1 virt-v2v-debuginfo-1.44.2-150400.3.3.1 virt-v2v-debugsource-1.44.2-150400.3.3.1 - openSUSE Leap 15.4 (noarch): virt-v2v-bash-completion-1.44.2-150400.3.3.1 virt-v2v-man-pages-ja-1.44.2-150400.3.3.1 virt-v2v-man-pages-uk-1.44.2-150400.3.3.1 - SUSE Linux Enterprise Module for Server Applications 15-SP4 (aarch64 ppc64le s390x x86_64): virt-v2v-1.44.2-150400.3.3.1 virt-v2v-debuginfo-1.44.2-150400.3.3.1 virt-v2v-debugsource-1.44.2-150400.3.3.1 - SUSE Linux Enterprise Module for Server Applications 15-SP4 (noarch): virt-v2v-bash-completion-1.44.2-150400.3.3.1 virt-v2v-man-pages-ja-1.44.2-150400.3.3.1 virt-v2v-man-pages-uk-1.44.2-150400.3.3.1 References: https://www.suse.com/security/cve/CVE-2022-2211.html https://bugzilla.suse.com/1201064

1 0

SUSE-SU-2022:4306-1: moderate: Security update for bcel
by opensuse-security＠opensuse.org 01 Dec '22

01 Dec '22

SUSE Security Update: Security update for bcel ______________________________________________________________________________ Announcement ID: SUSE-SU-2022:4306-1 Rating: moderate References: #1205125 Cross-References: CVE-2022-42920 CVSS scores: CVE-2022-42920 (NVD) : 9.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H CVE-2022-42920 (SUSE): 5.4 CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:N/I:L/A:L Affected Products: SUSE Enterprise Storage 7.1 SUSE Linux Enterprise Desktop 15-SP3 SUSE Linux Enterprise Desktop 15-SP4 SUSE Linux Enterprise High Performance Computing 15-SP3 SUSE Linux Enterprise High Performance Computing 15-SP4 SUSE Linux Enterprise Module for Basesystem 15-SP3 SUSE Linux Enterprise Module for Basesystem 15-SP4 SUSE Linux Enterprise Server 15-SP3 SUSE Linux Enterprise Server 15-SP4 SUSE Linux Enterprise Server for SAP Applications 15-SP3 SUSE Linux Enterprise Server for SAP Applications 15-SP4 SUSE Manager Proxy 4.2 SUSE Manager Proxy 4.3 SUSE Manager Retail Branch Server 4.2 SUSE Manager Retail Branch Server 4.3 SUSE Manager Server 4.2 SUSE Manager Server 4.3 openSUSE Leap 15.3 openSUSE Leap 15.4 ______________________________________________________________________________ An update that fixes one vulnerability is now available. Description: This update for bcel fixes the following issues: - CVE-2022-42920: Fixed producing arbitrary bytecode via out-of-bounds writing (bsc#1205125). Patch Instructions: To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 15.4: zypper in -t patch openSUSE-SLE-15.4-2022-4306=1 - openSUSE Leap 15.3: zypper in -t patch openSUSE-SLE-15.3-2022-4306=1 - SUSE Linux Enterprise Module for Basesystem 15-SP4: zypper in -t patch SUSE-SLE-Module-Basesystem-15-SP4-2022-4306=1 - SUSE Linux Enterprise Module for Basesystem 15-SP3: zypper in -t patch SUSE-SLE-Module-Basesystem-15-SP3-2022-4306=1 Package List: - openSUSE Leap 15.4 (noarch): bcel-5.2-150200.11.3.1 - openSUSE Leap 15.3 (noarch): bcel-5.2-150200.11.3.1 - SUSE Linux Enterprise Module for Basesystem 15-SP4 (noarch): bcel-5.2-150200.11.3.1 - SUSE Linux Enterprise Module for Basesystem 15-SP3 (noarch): bcel-5.2-150200.11.3.1 References: https://www.suse.com/security/cve/CVE-2022-42920.html https://bugzilla.suse.com/1205125

1 0

SUSE-SU-2022:4301-1: important: Security update for nodejs10
by opensuse-security＠opensuse.org 01 Dec '22

01 Dec '22

SUSE Security Update: Security update for nodejs10 ______________________________________________________________________________ Announcement ID: SUSE-SU-2022:4301-1 Rating: important References: #1205119 Cross-References: CVE-2022-43548 CVSS scores: CVE-2022-43548 (SUSE): 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N Affected Products: SUSE CaaS Platform 4.0 SUSE Enterprise Storage 6 SUSE Enterprise Storage 7 SUSE Linux Enterprise High Performance Computing 15-ESPOS SUSE Linux Enterprise High Performance Computing 15-LTSS SUSE Linux Enterprise High Performance Computing 15-SP1-ESPOS SUSE Linux Enterprise High Performance Computing 15-SP1-LTSS SUSE Linux Enterprise High Performance Computing 15-SP2-ESPOS SUSE Linux Enterprise High Performance Computing 15-SP2-LTSS SUSE Linux Enterprise Server 15-LTSS SUSE Linux Enterprise Server 15-SP1-BCL SUSE Linux Enterprise Server 15-SP1-LTSS SUSE Linux Enterprise Server 15-SP2-BCL SUSE Linux Enterprise Server 15-SP2-LTSS SUSE Linux Enterprise Server for SAP 15 SUSE Linux Enterprise Server for SAP 15-SP1 SUSE Linux Enterprise Server for SAP 15-SP2 SUSE Manager Proxy 4.1 SUSE Manager Retail Branch Server 4.1 SUSE Manager Server 4.1 openSUSE Leap 15.3 openSUSE Leap 15.4 ______________________________________________________________________________ An update that fixes one vulnerability is now available. Description: This update for nodejs10 fixes the following issues: - CVE-2022-43548: Fixed DNS rebinding in --inspect via invalid octal IP address (bsc#1205119). Patch Instructions: To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 15.4: zypper in -t patch openSUSE-SLE-15.4-2022-4301=1 - openSUSE Leap 15.3: zypper in -t patch openSUSE-SLE-15.3-2022-4301=1 - SUSE Manager Server 4.1: zypper in -t patch SUSE-SLE-Product-SUSE-Manager-Server-4.1-2022-4301=1 - SUSE Manager Retail Branch Server 4.1: zypper in -t patch SUSE-SLE-Product-SUSE-Manager-Retail-Branch-Server-4.1-2022-4301=1 - SUSE Manager Proxy 4.1: zypper in -t patch SUSE-SLE-Product-SUSE-Manager-Proxy-4.1-2022-4301=1 - SUSE Linux Enterprise Server for SAP 15-SP2: zypper in -t patch SUSE-SLE-Product-SLES_SAP-15-SP2-2022-4301=1 - SUSE Linux Enterprise Server for SAP 15-SP1: zypper in -t patch SUSE-SLE-Product-SLES_SAP-15-SP1-2022-4301=1 - SUSE Linux Enterprise Server for SAP 15: zypper in -t patch SUSE-SLE-Product-SLES_SAP-15-2022-4301=1 - SUSE Linux Enterprise Server 15-SP2-LTSS: zypper in -t patch SUSE-SLE-Product-SLES-15-SP2-LTSS-2022-4301=1 - SUSE Linux Enterprise Server 15-SP2-BCL: zypper in -t patch SUSE-SLE-Product-SLES-15-SP2-BCL-2022-4301=1 - SUSE Linux Enterprise Server 15-SP1-LTSS: zypper in -t patch SUSE-SLE-Product-SLES-15-SP1-LTSS-2022-4301=1 - SUSE Linux Enterprise Server 15-SP1-BCL: zypper in -t patch SUSE-SLE-Product-SLES-15-SP1-BCL-2022-4301=1 - SUSE Linux Enterprise Server 15-LTSS: zypper in -t patch SUSE-SLE-Product-SLES-15-2022-4301=1 - SUSE Linux Enterprise High Performance Computing 15-SP2-LTSS: zypper in -t patch SUSE-SLE-Product-HPC-15-SP2-LTSS-2022-4301=1 - SUSE Linux Enterprise High Performance Computing 15-SP2-ESPOS: zypper in -t patch SUSE-SLE-Product-HPC-15-SP2-ESPOS-2022-4301=1 - SUSE Linux Enterprise High Performance Computing 15-SP1-LTSS: zypper in -t patch SUSE-SLE-Product-HPC-15-SP1-LTSS-2022-4301=1 - SUSE Linux Enterprise High Performance Computing 15-SP1-ESPOS: zypper in -t patch SUSE-SLE-Product-HPC-15-SP1-ESPOS-2022-4301=1 - SUSE Linux Enterprise High Performance Computing 15-LTSS: zypper in -t patch SUSE-SLE-Product-HPC-15-2022-4301=1 - SUSE Linux Enterprise High Performance Computing 15-ESPOS: zypper in -t patch SUSE-SLE-Product-HPC-15-2022-4301=1 - SUSE Enterprise Storage 7: zypper in -t patch SUSE-Storage-7-2022-4301=1 - SUSE Enterprise Storage 6: zypper in -t patch SUSE-Storage-6-2022-4301=1 - SUSE CaaS Platform 4.0: To install this update, use the SUSE CaaS Platform 'skuba' tool. It will inform you if it detects new updates and let you then trigger updating of the complete cluster in a controlled way. Package List: - openSUSE Leap 15.4 (aarch64 ppc64le s390x x86_64): nodejs10-10.24.1-150000.1.53.1 nodejs10-debuginfo-10.24.1-150000.1.53.1 nodejs10-debugsource-10.24.1-150000.1.53.1 nodejs10-devel-10.24.1-150000.1.53.1 npm10-10.24.1-150000.1.53.1 - openSUSE Leap 15.4 (noarch): nodejs10-docs-10.24.1-150000.1.53.1 - openSUSE Leap 15.3 (aarch64 ppc64le s390x x86_64): nodejs10-10.24.1-150000.1.53.1 nodejs10-debuginfo-10.24.1-150000.1.53.1 nodejs10-debugsource-10.24.1-150000.1.53.1 nodejs10-devel-10.24.1-150000.1.53.1 npm10-10.24.1-150000.1.53.1 - openSUSE Leap 15.3 (noarch): nodejs10-docs-10.24.1-150000.1.53.1 - SUSE Manager Server 4.1 (ppc64le s390x x86_64): nodejs10-10.24.1-150000.1.53.1 nodejs10-debuginfo-10.24.1-150000.1.53.1 nodejs10-debugsource-10.24.1-150000.1.53.1 nodejs10-devel-10.24.1-150000.1.53.1 npm10-10.24.1-150000.1.53.1 - SUSE Manager Server 4.1 (noarch): nodejs10-docs-10.24.1-150000.1.53.1 - SUSE Manager Retail Branch Server 4.1 (x86_64): nodejs10-10.24.1-150000.1.53.1 nodejs10-debuginfo-10.24.1-150000.1.53.1 nodejs10-debugsource-10.24.1-150000.1.53.1 nodejs10-devel-10.24.1-150000.1.53.1 npm10-10.24.1-150000.1.53.1 - SUSE Manager Retail Branch Server 4.1 (noarch): nodejs10-docs-10.24.1-150000.1.53.1 - SUSE Manager Proxy 4.1 (noarch): nodejs10-docs-10.24.1-150000.1.53.1 - SUSE Manager Proxy 4.1 (x86_64): nodejs10-10.24.1-150000.1.53.1 nodejs10-debuginfo-10.24.1-150000.1.53.1 nodejs10-debugsource-10.24.1-150000.1.53.1 nodejs10-devel-10.24.1-150000.1.53.1 npm10-10.24.1-150000.1.53.1 - SUSE Linux Enterprise Server for SAP 15-SP2 (ppc64le x86_64): nodejs10-10.24.1-150000.1.53.1 nodejs10-debuginfo-10.24.1-150000.1.53.1 nodejs10-debugsource-10.24.1-150000.1.53.1 nodejs10-devel-10.24.1-150000.1.53.1 npm10-10.24.1-150000.1.53.1 - SUSE Linux Enterprise Server for SAP 15-SP2 (noarch): nodejs10-docs-10.24.1-150000.1.53.1 - SUSE Linux Enterprise Server for SAP 15-SP1 (ppc64le x86_64): nodejs10-10.24.1-150000.1.53.1 nodejs10-debuginfo-10.24.1-150000.1.53.1 nodejs10-debugsource-10.24.1-150000.1.53.1 nodejs10-devel-10.24.1-150000.1.53.1 npm10-10.24.1-150000.1.53.1 - SUSE Linux Enterprise Server for SAP 15-SP1 (noarch): nodejs10-docs-10.24.1-150000.1.53.1 - SUSE Linux Enterprise Server for SAP 15 (ppc64le x86_64): nodejs10-10.24.1-150000.1.53.1 nodejs10-debuginfo-10.24.1-150000.1.53.1 nodejs10-debugsource-10.24.1-150000.1.53.1 nodejs10-devel-10.24.1-150000.1.53.1 npm10-10.24.1-150000.1.53.1 - SUSE Linux Enterprise Server for SAP 15 (noarch): nodejs10-docs-10.24.1-150000.1.53.1 - SUSE Linux Enterprise Server 15-SP2-LTSS (aarch64 ppc64le s390x x86_64): nodejs10-10.24.1-150000.1.53.1 nodejs10-debuginfo-10.24.1-150000.1.53.1 nodejs10-debugsource-10.24.1-150000.1.53.1 nodejs10-devel-10.24.1-150000.1.53.1 npm10-10.24.1-150000.1.53.1 - SUSE Linux Enterprise Server 15-SP2-LTSS (noarch): nodejs10-docs-10.24.1-150000.1.53.1 - SUSE Linux Enterprise Server 15-SP2-BCL (noarch): nodejs10-docs-10.24.1-150000.1.53.1 - SUSE Linux Enterprise Server 15-SP2-BCL (x86_64): nodejs10-10.24.1-150000.1.53.1 nodejs10-debuginfo-10.24.1-150000.1.53.1 nodejs10-debugsource-10.24.1-150000.1.53.1 nodejs10-devel-10.24.1-150000.1.53.1 npm10-10.24.1-150000.1.53.1 - SUSE Linux Enterprise Server 15-SP1-LTSS (aarch64 ppc64le s390x x86_64): nodejs10-10.24.1-150000.1.53.1 nodejs10-debuginfo-10.24.1-150000.1.53.1 nodejs10-debugsource-10.24.1-150000.1.53.1 nodejs10-devel-10.24.1-150000.1.53.1 npm10-10.24.1-150000.1.53.1 - SUSE Linux Enterprise Server 15-SP1-LTSS (noarch): nodejs10-docs-10.24.1-150000.1.53.1 - SUSE Linux Enterprise Server 15-SP1-BCL (x86_64): nodejs10-10.24.1-150000.1.53.1 nodejs10-debuginfo-10.24.1-150000.1.53.1 nodejs10-debugsource-10.24.1-150000.1.53.1 nodejs10-devel-10.24.1-150000.1.53.1 npm10-10.24.1-150000.1.53.1 - SUSE Linux Enterprise Server 15-SP1-BCL (noarch): nodejs10-docs-10.24.1-150000.1.53.1 - SUSE Linux Enterprise Server 15-LTSS (aarch64 s390x): nodejs10-10.24.1-150000.1.53.1 nodejs10-debuginfo-10.24.1-150000.1.53.1 nodejs10-debugsource-10.24.1-150000.1.53.1 nodejs10-devel-10.24.1-150000.1.53.1 npm10-10.24.1-150000.1.53.1 - SUSE Linux Enterprise Server 15-LTSS (noarch): nodejs10-docs-10.24.1-150000.1.53.1 - SUSE Linux Enterprise High Performance Computing 15-SP2-LTSS (aarch64 x86_64): nodejs10-10.24.1-150000.1.53.1 nodejs10-debuginfo-10.24.1-150000.1.53.1 nodejs10-debugsource-10.24.1-150000.1.53.1 nodejs10-devel-10.24.1-150000.1.53.1 npm10-10.24.1-150000.1.53.1 - SUSE Linux Enterprise High Performance Computing 15-SP2-LTSS (noarch): nodejs10-docs-10.24.1-150000.1.53.1 - SUSE Linux Enterprise High Performance Computing 15-SP2-ESPOS (aarch64 x86_64): nodejs10-10.24.1-150000.1.53.1 nodejs10-debuginfo-10.24.1-150000.1.53.1 nodejs10-debugsource-10.24.1-150000.1.53.1 nodejs10-devel-10.24.1-150000.1.53.1 npm10-10.24.1-150000.1.53.1 - SUSE Linux Enterprise High Performance Computing 15-SP2-ESPOS (noarch): nodejs10-docs-10.24.1-150000.1.53.1 - SUSE Linux Enterprise High Performance Computing 15-SP1-LTSS (aarch64 x86_64): nodejs10-10.24.1-150000.1.53.1 nodejs10-debuginfo-10.24.1-150000.1.53.1 nodejs10-debugsource-10.24.1-150000.1.53.1 nodejs10-devel-10.24.1-150000.1.53.1 npm10-10.24.1-150000.1.53.1 - SUSE Linux Enterprise High Performance Computing 15-SP1-LTSS (noarch): nodejs10-docs-10.24.1-150000.1.53.1 - SUSE Linux Enterprise High Performance Computing 15-SP1-ESPOS (aarch64 x86_64): nodejs10-10.24.1-150000.1.53.1 nodejs10-debuginfo-10.24.1-150000.1.53.1 nodejs10-debugsource-10.24.1-150000.1.53.1 nodejs10-devel-10.24.1-150000.1.53.1 npm10-10.24.1-150000.1.53.1 - SUSE Linux Enterprise High Performance Computing 15-SP1-ESPOS (noarch): nodejs10-docs-10.24.1-150000.1.53.1 - SUSE Linux Enterprise High Performance Computing 15-LTSS (aarch64 x86_64): nodejs10-10.24.1-150000.1.53.1 nodejs10-debuginfo-10.24.1-150000.1.53.1 nodejs10-debugsource-10.24.1-150000.1.53.1 nodejs10-devel-10.24.1-150000.1.53.1 npm10-10.24.1-150000.1.53.1 - SUSE Linux Enterprise High Performance Computing 15-LTSS (noarch): nodejs10-docs-10.24.1-150000.1.53.1 - SUSE Linux Enterprise High Performance Computing 15-ESPOS (aarch64 x86_64): nodejs10-10.24.1-150000.1.53.1 nodejs10-debuginfo-10.24.1-150000.1.53.1 nodejs10-debugsource-10.24.1-150000.1.53.1 nodejs10-devel-10.24.1-150000.1.53.1 npm10-10.24.1-150000.1.53.1 - SUSE Linux Enterprise High Performance Computing 15-ESPOS (noarch): nodejs10-docs-10.24.1-150000.1.53.1 - SUSE Enterprise Storage 7 (aarch64 x86_64): nodejs10-10.24.1-150000.1.53.1 nodejs10-debuginfo-10.24.1-150000.1.53.1 nodejs10-debugsource-10.24.1-150000.1.53.1 nodejs10-devel-10.24.1-150000.1.53.1 npm10-10.24.1-150000.1.53.1 - SUSE Enterprise Storage 7 (noarch): nodejs10-docs-10.24.1-150000.1.53.1 - SUSE Enterprise Storage 6 (aarch64 x86_64): nodejs10-10.24.1-150000.1.53.1 nodejs10-debuginfo-10.24.1-150000.1.53.1 nodejs10-debugsource-10.24.1-150000.1.53.1 nodejs10-devel-10.24.1-150000.1.53.1 npm10-10.24.1-150000.1.53.1 - SUSE Enterprise Storage 6 (noarch): nodejs10-docs-10.24.1-150000.1.53.1 - SUSE CaaS Platform 4.0 (x86_64): nodejs10-10.24.1-150000.1.53.1 nodejs10-debuginfo-10.24.1-150000.1.53.1 nodejs10-debugsource-10.24.1-150000.1.53.1 nodejs10-devel-10.24.1-150000.1.53.1 npm10-10.24.1-150000.1.53.1 - SUSE CaaS Platform 4.0 (noarch): nodejs10-docs-10.24.1-150000.1.53.1 References: https://www.suse.com/security/cve/CVE-2022-43548.html https://bugzilla.suse.com/1205119

1 0

SUSE-SU-2022:4304-1: important: Security update for emacs
by opensuse-security＠opensuse.org 01 Dec '22

01 Dec '22

SUSE Security Update: Security update for emacs ______________________________________________________________________________ Announcement ID: SUSE-SU-2022:4304-1 Rating: important References: #1205822 Cross-References: CVE-2022-45939 CVSS scores: CVE-2022-45939 (SUSE): 7.8 CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H Affected Products: SUSE Linux Enterprise Desktop 15-SP4 SUSE Linux Enterprise High Performance Computing 15-SP4 SUSE Linux Enterprise Module for Basesystem 15-SP4 SUSE Linux Enterprise Module for Desktop Applications 15-SP4 SUSE Linux Enterprise Server 15-SP4 SUSE Linux Enterprise Server for SAP Applications 15-SP4 SUSE Manager Proxy 4.3 SUSE Manager Retail Branch Server 4.3 SUSE Manager Server 4.3 openSUSE Leap 15.4 ______________________________________________________________________________ An update that fixes one vulnerability is now available. Description: This update for emacs fixes the following issues: - CVE-2022-45939: Fixed shell command injection via source code files when using ctags (bsc#1205822). Patch Instructions: To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 15.4: zypper in -t patch openSUSE-SLE-15.4-2022-4304=1 - SUSE Linux Enterprise Module for Desktop Applications 15-SP4: zypper in -t patch SUSE-SLE-Module-Desktop-Applications-15-SP4-2022-4304=1 - SUSE Linux Enterprise Module for Basesystem 15-SP4: zypper in -t patch SUSE-SLE-Module-Basesystem-15-SP4-2022-4304=1 Package List: - openSUSE Leap 15.4 (aarch64 ppc64le s390x x86_64): emacs-27.2-150400.3.3.1 emacs-debuginfo-27.2-150400.3.3.1 emacs-debugsource-27.2-150400.3.3.1 emacs-nox-27.2-150400.3.3.1 emacs-nox-debuginfo-27.2-150400.3.3.1 emacs-x11-27.2-150400.3.3.1 emacs-x11-debuginfo-27.2-150400.3.3.1 etags-27.2-150400.3.3.1 etags-debuginfo-27.2-150400.3.3.1 - openSUSE Leap 15.4 (noarch): emacs-el-27.2-150400.3.3.1 emacs-info-27.2-150400.3.3.1 - SUSE Linux Enterprise Module for Desktop Applications 15-SP4 (aarch64 ppc64le s390x x86_64): emacs-debuginfo-27.2-150400.3.3.1 emacs-debugsource-27.2-150400.3.3.1 emacs-x11-27.2-150400.3.3.1 emacs-x11-debuginfo-27.2-150400.3.3.1 - SUSE Linux Enterprise Module for Basesystem 15-SP4 (aarch64 ppc64le s390x x86_64): emacs-27.2-150400.3.3.1 emacs-debuginfo-27.2-150400.3.3.1 emacs-debugsource-27.2-150400.3.3.1 emacs-nox-27.2-150400.3.3.1 emacs-nox-debuginfo-27.2-150400.3.3.1 etags-27.2-150400.3.3.1 etags-debuginfo-27.2-150400.3.3.1 - SUSE Linux Enterprise Module for Basesystem 15-SP4 (noarch): emacs-el-27.2-150400.3.3.1 emacs-info-27.2-150400.3.3.1 References: https://www.suse.com/security/cve/CVE-2022-45939.html https://bugzilla.suse.com/1205822

1 0