December 2022 - openSUSE Security Announce

openSUSE-SU-2022:10241-1: moderate: Security update for python-slixmpp
by opensuse-security＠opensuse.org 10 Dec '22

10 Dec '22

openSUSE Security Update: Security update for python-slixmpp ______________________________________________________________________________ Announcement ID: openSUSE-SU-2022:10241-1 Rating: moderate References: #1205433 Cross-References: CVE-2022-45197 Affected Products: openSUSE Backports SLE-15-SP3 ______________________________________________________________________________ An update that fixes one vulnerability is now available. Description: This update for python-slixmpp fixes the following issues: - CVE-2022-45197: Fixed certificate hostname validation (boo#1205433) Patch Instructions: To install this openSUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Backports SLE-15-SP3: zypper in -t patch openSUSE-2022-10241=1 Package List: - openSUSE Backports SLE-15-SP3 (aarch64 i586 ppc64le s390x x86_64): python3-slixmpp-1.4.2-bp153.2.3.1 References: https://www.suse.com/security/cve/CVE-2022-45197.html https://bugzilla.suse.com/1205433

1 0

SUSE-SU-2022:4398-1: moderate: Security update for go1.18
by opensuse-security＠opensuse.org 09 Dec '22

09 Dec '22

SUSE Security Update: Security update for go1.18 ______________________________________________________________________________ Announcement ID: SUSE-SU-2022:4398-1 Rating: moderate References: #1193742 #1206134 #1206135 Cross-References: CVE-2022-41717 CVE-2022-41720 Affected Products: SUSE Enterprise Storage 7.1 SUSE Linux Enterprise Desktop 15-SP3 SUSE Linux Enterprise Desktop 15-SP4 SUSE Linux Enterprise High Performance Computing 15-SP3 SUSE Linux Enterprise High Performance Computing 15-SP4 SUSE Linux Enterprise Module for Development Tools 15-SP3 SUSE Linux Enterprise Module for Development Tools 15-SP4 SUSE Linux Enterprise Server 15-SP3 SUSE Linux Enterprise Server 15-SP4 SUSE Linux Enterprise Server for SAP Applications 15-SP3 SUSE Linux Enterprise Server for SAP Applications 15-SP4 SUSE Manager Proxy 4.2 SUSE Manager Proxy 4.3 SUSE Manager Retail Branch Server 4.2 SUSE Manager Retail Branch Server 4.3 SUSE Manager Server 4.2 SUSE Manager Server 4.3 openSUSE Leap 15.3 openSUSE Leap 15.4 ______________________________________________________________________________ An update that solves two vulnerabilities and has one errata is now available. Description: This update for go1.18 fixes the following issues: Update to version 1.18.9, includes the following security fixes: - CVE-2022-41717: net/http: limit canonical header cache by bytes, not entries (bsc#1206135) - CVE-2022-41720: os, net/http: avoid escapes from os.DirFS and http.Dir on Windows (bsc#1206134) Patch Instructions: To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 15.4: zypper in -t patch openSUSE-SLE-15.4-2022-4398=1 - openSUSE Leap 15.3: zypper in -t patch openSUSE-SLE-15.3-2022-4398=1 - SUSE Linux Enterprise Module for Development Tools 15-SP4: zypper in -t patch SUSE-SLE-Module-Development-Tools-15-SP4-2022-4398=1 - SUSE Linux Enterprise Module for Development Tools 15-SP3: zypper in -t patch SUSE-SLE-Module-Development-Tools-15-SP3-2022-4398=1 Package List: - openSUSE Leap 15.4 (aarch64 ppc64le s390x x86_64): go1.18-1.18.9-150000.1.40.1 go1.18-doc-1.18.9-150000.1.40.1 - openSUSE Leap 15.4 (aarch64 x86_64): go1.18-race-1.18.9-150000.1.40.1 - openSUSE Leap 15.3 (aarch64 ppc64le s390x x86_64): go1.18-1.18.9-150000.1.40.1 go1.18-doc-1.18.9-150000.1.40.1 - openSUSE Leap 15.3 (aarch64 x86_64): go1.18-race-1.18.9-150000.1.40.1 - SUSE Linux Enterprise Module for Development Tools 15-SP4 (aarch64 ppc64le s390x x86_64): go1.18-1.18.9-150000.1.40.1 go1.18-doc-1.18.9-150000.1.40.1 - SUSE Linux Enterprise Module for Development Tools 15-SP4 (aarch64 x86_64): go1.18-race-1.18.9-150000.1.40.1 - SUSE Linux Enterprise Module for Development Tools 15-SP3 (aarch64 ppc64le s390x x86_64): go1.18-1.18.9-150000.1.40.1 go1.18-doc-1.18.9-150000.1.40.1 - SUSE Linux Enterprise Module for Development Tools 15-SP3 (aarch64 x86_64): go1.18-race-1.18.9-150000.1.40.1 References: https://www.suse.com/security/cve/CVE-2022-41717.html https://www.suse.com/security/cve/CVE-2022-41720.html https://bugzilla.suse.com/1193742 https://bugzilla.suse.com/1206134 https://bugzilla.suse.com/1206135

1 0

SUSE-SU-2022:4397-1: moderate: Security update for go1.19
by opensuse-security＠opensuse.org 09 Dec '22

09 Dec '22

SUSE Security Update: Security update for go1.19 ______________________________________________________________________________ Announcement ID: SUSE-SU-2022:4397-1 Rating: moderate References: #1200441 #1206134 #1206135 Cross-References: CVE-2022-41717 CVE-2022-41720 Affected Products: SUSE Enterprise Storage 7.1 SUSE Linux Enterprise Desktop 15-SP3 SUSE Linux Enterprise Desktop 15-SP4 SUSE Linux Enterprise High Performance Computing 15-SP3 SUSE Linux Enterprise High Performance Computing 15-SP4 SUSE Linux Enterprise Module for Development Tools 15-SP3 SUSE Linux Enterprise Module for Development Tools 15-SP4 SUSE Linux Enterprise Server 15-SP3 SUSE Linux Enterprise Server 15-SP4 SUSE Linux Enterprise Server for SAP Applications 15-SP3 SUSE Linux Enterprise Server for SAP Applications 15-SP4 SUSE Manager Proxy 4.2 SUSE Manager Proxy 4.3 SUSE Manager Retail Branch Server 4.2 SUSE Manager Retail Branch Server 4.3 SUSE Manager Server 4.2 SUSE Manager Server 4.3 openSUSE Leap 15.3 openSUSE Leap 15.4 ______________________________________________________________________________ An update that solves two vulnerabilities and has one errata is now available. Description: This update for go1.19 fixes the following issues: Update to version 1.19.4, includes the following security fixes: - CVE-2022-41717: net/http: limit canonical header cache by bytes, not entries (bsc#1206135). - CVE-2022-41720: os, net/http: avoid escapes from os.DirFS and http.Dir on Windows (bsc#1206134). Patch Instructions: To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 15.4: zypper in -t patch openSUSE-SLE-15.4-2022-4397=1 - openSUSE Leap 15.3: zypper in -t patch openSUSE-SLE-15.3-2022-4397=1 - SUSE Linux Enterprise Module for Development Tools 15-SP4: zypper in -t patch SUSE-SLE-Module-Development-Tools-15-SP4-2022-4397=1 - SUSE Linux Enterprise Module for Development Tools 15-SP3: zypper in -t patch SUSE-SLE-Module-Development-Tools-15-SP3-2022-4397=1 Package List: - openSUSE Leap 15.4 (aarch64 ppc64le s390x x86_64): go1.19-1.19.4-150000.1.18.1 go1.19-doc-1.19.4-150000.1.18.1 - openSUSE Leap 15.4 (aarch64 x86_64): go1.19-race-1.19.4-150000.1.18.1 - openSUSE Leap 15.3 (aarch64 ppc64le s390x x86_64): go1.19-1.19.4-150000.1.18.1 go1.19-doc-1.19.4-150000.1.18.1 - openSUSE Leap 15.3 (aarch64 x86_64): go1.19-race-1.19.4-150000.1.18.1 - SUSE Linux Enterprise Module for Development Tools 15-SP4 (aarch64 ppc64le s390x x86_64): go1.19-1.19.4-150000.1.18.1 go1.19-doc-1.19.4-150000.1.18.1 - SUSE Linux Enterprise Module for Development Tools 15-SP4 (aarch64 x86_64): go1.19-race-1.19.4-150000.1.18.1 - SUSE Linux Enterprise Module for Development Tools 15-SP3 (aarch64 ppc64le s390x x86_64): go1.19-1.19.4-150000.1.18.1 go1.19-doc-1.19.4-150000.1.18.1 - SUSE Linux Enterprise Module for Development Tools 15-SP3 (aarch64 x86_64): go1.19-race-1.19.4-150000.1.18.1 References: https://www.suse.com/security/cve/CVE-2022-41717.html https://www.suse.com/security/cve/CVE-2022-41720.html https://bugzilla.suse.com/1200441 https://bugzilla.suse.com/1206134 https://bugzilla.suse.com/1206135

1 0

openSUSE-SU-2022:10239-1: important: Security update for opera
by opensuse-security＠opensuse.org 09 Dec '22

09 Dec '22

openSUSE Security Update: Security update for opera ______________________________________________________________________________ Announcement ID: openSUSE-SU-2022:10239-1 Rating: important References: Cross-References: CVE-2022-3885 CVE-2022-3886 CVE-2022-3887 CVE-2022-3888 CVE-2022-3889 CVSS scores: CVE-2022-3885 (NVD) : 8.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H CVE-2022-3886 (NVD) : 8.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H CVE-2022-3887 (NVD) : 8.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H CVE-2022-3888 (NVD) : 8.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H CVE-2022-3889 (NVD) : 8.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H Affected Products: openSUSE Leap 15.4:NonFree ______________________________________________________________________________ An update that fixes 5 vulnerabilities is now available. Description: This update for opera fixes the following issues: Update to 93.0.4585.37 - DNA-102885 Turn on #sidebar-autohide on all streams - DNA-103020 Turn on #start-page-redesign on developer - DNA-103042 Fix import from Firefox - DNA-103222 [Speed Dial Suggestions] All opera.com subpages suggestions lead to the opera.com homepage - DNA-103368 TikTok videos starting to play automaticly - DNA-103535 Startpage preview is not visible - DNA-103665 Reduce Tik Tok pane width Changes in 93.0.4585.21 - CHR-9067 Update chromium on desktop-stable-107-4585 to 107.0.5304.110 - DNA-102365 Turn off opera://dify-cards page - DNA-102689 [GX] Create GX widgets section in Easy Setup - DNA-102768 [Easy setup] Sidebar options not animated - DNA-102872 No animation for opening sidebar while sidebar is closing - DNA-102929 [Weather][Private window] Weather widget appears in private window - DNA-103032 Messenger sidebar icon doesn��t look great - DNA-103046 Opera crash with flag ��with-feature:sidebar-autohide=off - DNA-103107 Automatic video popout for popular sports sites �� World Cup - DNA-103310 hideOperaObject() in browser.js stopped working on public builds - DNA-103320 Crash at chrome::FindBrowserByType(absl::optional) - DNA-103321 Tab preview causes freeze when dragging tabs - DNA-103375 [Workspaces] Crash at absl::raw_log_internal:: RawLog(absl::LogSeverity, char const*, int, char const*, ��) - DNA-103395 Remove unused resources - DNA-103396 Internal translations - The update to chromium 107.0.5304.110 fixes following issues: CVE-2022-3885, CVE-2022-3886, CVE-2022-3887, CVE-2022-3888, CVE-2022-3889, CVE-2022-3889 Patch Instructions: To install this openSUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 15.4:NonFree: zypper in -t patch openSUSE-2022-10239=1 Package List: - openSUSE Leap 15.4:NonFree (x86_64): opera-93.0.4585.37-lp154.2.32.1 References: https://www.suse.com/security/cve/CVE-2022-3885.html https://www.suse.com/security/cve/CVE-2022-3886.html https://www.suse.com/security/cve/CVE-2022-3887.html https://www.suse.com/security/cve/CVE-2022-3888.html https://www.suse.com/security/cve/CVE-2022-3889.html

1 0

SUSE-SU-2022:4395-1: important: Security update for samba
by opensuse-security＠opensuse.org 09 Dec '22

09 Dec '22

SUSE Security Update: Security update for samba ______________________________________________________________________________ Announcement ID: SUSE-SU-2022:4395-1 Rating: important References: #1200102 #1201490 #1201492 #1201493 #1201495 #1201496 #1201689 #1204254 #1205126 Cross-References: CVE-2022-2031 CVE-2022-32742 CVE-2022-32744 CVE-2022-32745 CVE-2022-32746 CVE-2022-3437 CVE-2022-42898 CVSS scores: CVE-2022-2031 (NVD) : 8.8 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H CVE-2022-2031 (SUSE): 8.8 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H CVE-2022-32742 (NVD) : 4.3 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N CVE-2022-32742 (SUSE): 4.3 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N CVE-2022-32744 (NVD) : 8.8 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H CVE-2022-32744 (SUSE): 8.8 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H CVE-2022-32745 (NVD) : 8.1 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:H CVE-2022-32745 (SUSE): 5.4 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:L CVE-2022-32746 (NVD) : 5.4 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:L CVE-2022-32746 (SUSE): 5.4 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:L CVE-2022-3437 (SUSE): 5.9 CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:N/I:H/A:L CVE-2022-42898 (SUSE): 6.4 CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:L/I:H/A:L Affected Products: SUSE Enterprise Storage 7.1 SUSE Linux Enterprise Desktop 15-SP3 SUSE Linux Enterprise High Availability 15-SP3 SUSE Linux Enterprise High Performance Computing 15-SP3 SUSE Linux Enterprise Micro 5.2 SUSE Linux Enterprise Module for Basesystem 15-SP3 SUSE Linux Enterprise Module for Python2 15-SP3 SUSE Linux Enterprise Server 15-SP3 SUSE Linux Enterprise Server for SAP Applications 15-SP3 SUSE Manager Proxy 4.2 SUSE Manager Retail Branch Server 4.2 SUSE Manager Server 4.2 openSUSE Leap 15.3 openSUSE Leap Micro 5.2 ______________________________________________________________________________ An update that solves 7 vulnerabilities and has two fixes is now available. Description: This update for samba fixes the following issues: Version update to 4.15.12. Security issues fixed: - CVE-2022-2031: Fixed AD users that could have bypassed certain restrictions associated with changing passwords (bsc#1201495). - CVE-2022-32742: Fixed SMB1 code that does not correctly verify SMB1write, SMB1write_and_close, SMB1write_and_unlock lengths (bsc#1201496). - CVE-2022-32744: Fixed AD users that could have forged password change requests for any user (bsc#1201493). - CVE-2022-32745: Fixed AD users that could have crashed the server process with an LDAP add or modify request (bsc#1201492). - CVE-2022-32746: Fixed a use-after-free occurring in database audit logging (bsc#1201490). - CVE-2022-3437: Fixed buffer overflow in Heimdal unwrap_des3() (bsc#1204254). - CVE-2022-42898: Fixed Samba buffer overflow vulnerabilities on 32-bit systems (bsc#1205126). Bug fixes: - Install a systemd drop-in file for named service to allow read/write access to the DLZ directory (bsc#1201689). - Possible use after free of connection_struct when iterating smbd_server_connection->connections (bsc#1200102). Patch Instructions: To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap Micro 5.2: zypper in -t patch openSUSE-Leap-Micro-5.2-2022-4395=1 - openSUSE Leap 15.3: zypper in -t patch openSUSE-SLE-15.3-2022-4395=1 - SUSE Linux Enterprise Module for Python2 15-SP3: zypper in -t patch SUSE-SLE-Module-Python2-15-SP3-2022-4395=1 - SUSE Linux Enterprise Module for Basesystem 15-SP3: zypper in -t patch SUSE-SLE-Module-Basesystem-15-SP3-2022-4395=1 - SUSE Linux Enterprise Micro 5.2: zypper in -t patch SUSE-SUSE-MicroOS-5.2-2022-4395=1 - SUSE Linux Enterprise High Availability 15-SP3: zypper in -t patch SUSE-SLE-Product-HA-15-SP3-2022-4395=1 - SUSE Enterprise Storage 7.1: zypper in -t patch SUSE-Storage-7.1-2022-4395=1 Package List: - openSUSE Leap Micro 5.2 (aarch64 x86_64): samba-client-libs-4.15.12+git.535.7750e5c95ef-150300.3.43.1 samba-client-libs-debuginfo-4.15.12+git.535.7750e5c95ef-150300.3.43.1 samba-debuginfo-4.15.12+git.535.7750e5c95ef-150300.3.43.1 samba-debugsource-4.15.12+git.535.7750e5c95ef-150300.3.43.1 - openSUSE Leap 15.3 (aarch64 ppc64le s390x x86_64): ctdb-4.15.12+git.535.7750e5c95ef-150300.3.43.1 ctdb-debuginfo-4.15.12+git.535.7750e5c95ef-150300.3.43.1 ctdb-pcp-pmda-4.15.12+git.535.7750e5c95ef-150300.3.43.1 ctdb-pcp-pmda-debuginfo-4.15.12+git.535.7750e5c95ef-150300.3.43.1 libsamba-policy-devel-4.15.12+git.535.7750e5c95ef-150300.3.43.1 libsamba-policy-python3-devel-4.15.12+git.535.7750e5c95ef-150300.3.43.1 libsamba-policy0-python3-4.15.12+git.535.7750e5c95ef-150300.3.43.1 libsamba-policy0-python3-debuginfo-4.15.12+git.535.7750e5c95ef-150300.3.43.1 samba-4.15.12+git.535.7750e5c95ef-150300.3.43.1 samba-ad-dc-4.15.12+git.535.7750e5c95ef-150300.3.43.1 samba-ad-dc-debuginfo-4.15.12+git.535.7750e5c95ef-150300.3.43.1 samba-ad-dc-libs-4.15.12+git.535.7750e5c95ef-150300.3.43.1 samba-ad-dc-libs-debuginfo-4.15.12+git.535.7750e5c95ef-150300.3.43.1 samba-client-4.15.12+git.535.7750e5c95ef-150300.3.43.1 samba-client-debuginfo-4.15.12+git.535.7750e5c95ef-150300.3.43.1 samba-client-libs-4.15.12+git.535.7750e5c95ef-150300.3.43.1 samba-client-libs-debuginfo-4.15.12+git.535.7750e5c95ef-150300.3.43.1 samba-debuginfo-4.15.12+git.535.7750e5c95ef-150300.3.43.1 samba-debugsource-4.15.12+git.535.7750e5c95ef-150300.3.43.1 samba-devel-4.15.12+git.535.7750e5c95ef-150300.3.43.1 samba-dsdb-modules-4.15.12+git.535.7750e5c95ef-150300.3.43.1 samba-dsdb-modules-debuginfo-4.15.12+git.535.7750e5c95ef-150300.3.43.1 samba-gpupdate-4.15.12+git.535.7750e5c95ef-150300.3.43.1 samba-ldb-ldap-4.15.12+git.535.7750e5c95ef-150300.3.43.1 samba-ldb-ldap-debuginfo-4.15.12+git.535.7750e5c95ef-150300.3.43.1 samba-libs-4.15.12+git.535.7750e5c95ef-150300.3.43.1 samba-libs-debuginfo-4.15.12+git.535.7750e5c95ef-150300.3.43.1 samba-libs-python3-4.15.12+git.535.7750e5c95ef-150300.3.43.1 samba-libs-python3-debuginfo-4.15.12+git.535.7750e5c95ef-150300.3.43.1 samba-python3-4.15.12+git.535.7750e5c95ef-150300.3.43.1 samba-python3-debuginfo-4.15.12+git.535.7750e5c95ef-150300.3.43.1 samba-test-4.15.12+git.535.7750e5c95ef-150300.3.43.1 samba-test-debuginfo-4.15.12+git.535.7750e5c95ef-150300.3.43.1 samba-tool-4.15.12+git.535.7750e5c95ef-150300.3.43.1 samba-winbind-4.15.12+git.535.7750e5c95ef-150300.3.43.1 samba-winbind-debuginfo-4.15.12+git.535.7750e5c95ef-150300.3.43.1 samba-winbind-libs-4.15.12+git.535.7750e5c95ef-150300.3.43.1 samba-winbind-libs-debuginfo-4.15.12+git.535.7750e5c95ef-150300.3.43.1 - openSUSE Leap 15.3 (aarch64 x86_64): samba-ceph-4.15.12+git.535.7750e5c95ef-150300.3.43.1 samba-ceph-debuginfo-4.15.12+git.535.7750e5c95ef-150300.3.43.1 - openSUSE Leap 15.3 (aarch64_ilp32): libsamba-policy0-python3-64bit-4.15.12+git.535.7750e5c95ef-150300.3.43.1 libsamba-policy0-python3-64bit-debuginfo-4.15.12+git.535.7750e5c95ef-150300.3.43.1 samba-client-64bit-4.15.12+git.535.7750e5c95ef-150300.3.43.1 samba-client-64bit-debuginfo-4.15.12+git.535.7750e5c95ef-150300.3.43.1 samba-libs-64bit-4.15.12+git.535.7750e5c95ef-150300.3.43.1 samba-libs-64bit-debuginfo-4.15.12+git.535.7750e5c95ef-150300.3.43.1 samba-libs-python3-64bit-4.15.12+git.535.7750e5c95ef-150300.3.43.1 samba-libs-python3-64bit-debuginfo-4.15.12+git.535.7750e5c95ef-150300.3.43.1 - openSUSE Leap 15.3 (noarch): samba-doc-4.15.12+git.535.7750e5c95ef-150300.3.43.1 - openSUSE Leap 15.3 (x86_64): libsamba-policy0-python3-32bit-4.15.12+git.535.7750e5c95ef-150300.3.43.1 libsamba-policy0-python3-32bit-debuginfo-4.15.12+git.535.7750e5c95ef-150300.3.43.1 samba-ad-dc-libs-32bit-4.15.12+git.535.7750e5c95ef-150300.3.43.1 samba-ad-dc-libs-32bit-debuginfo-4.15.12+git.535.7750e5c95ef-150300.3.43.1 samba-client-32bit-4.15.12+git.535.7750e5c95ef-150300.3.43.1 samba-client-32bit-debuginfo-4.15.12+git.535.7750e5c95ef-150300.3.43.1 samba-client-libs-32bit-4.15.12+git.535.7750e5c95ef-150300.3.43.1 samba-client-libs-32bit-debuginfo-4.15.12+git.535.7750e5c95ef-150300.3.43.1 samba-devel-32bit-4.15.12+git.535.7750e5c95ef-150300.3.43.1 samba-libs-32bit-4.15.12+git.535.7750e5c95ef-150300.3.43.1 samba-libs-32bit-debuginfo-4.15.12+git.535.7750e5c95ef-150300.3.43.1 samba-libs-python3-32bit-4.15.12+git.535.7750e5c95ef-150300.3.43.1 samba-libs-python3-32bit-debuginfo-4.15.12+git.535.7750e5c95ef-150300.3.43.1 samba-winbind-libs-32bit-4.15.12+git.535.7750e5c95ef-150300.3.43.1 samba-winbind-libs-32bit-debuginfo-4.15.12+git.535.7750e5c95ef-150300.3.43.1 - SUSE Linux Enterprise Module for Python2 15-SP3 (aarch64 ppc64le s390x x86_64): samba-ad-dc-4.15.12+git.535.7750e5c95ef-150300.3.43.1 samba-ad-dc-debuginfo-4.15.12+git.535.7750e5c95ef-150300.3.43.1 samba-debuginfo-4.15.12+git.535.7750e5c95ef-150300.3.43.1 samba-debugsource-4.15.12+git.535.7750e5c95ef-150300.3.43.1 - SUSE Linux Enterprise Module for Basesystem 15-SP3 (aarch64 ppc64le s390x x86_64): libsamba-policy-devel-4.15.12+git.535.7750e5c95ef-150300.3.43.1 libsamba-policy-python3-devel-4.15.12+git.535.7750e5c95ef-150300.3.43.1 libsamba-policy0-python3-4.15.12+git.535.7750e5c95ef-150300.3.43.1 libsamba-policy0-python3-debuginfo-4.15.12+git.535.7750e5c95ef-150300.3.43.1 samba-4.15.12+git.535.7750e5c95ef-150300.3.43.1 samba-ad-dc-libs-4.15.12+git.535.7750e5c95ef-150300.3.43.1 samba-ad-dc-libs-debuginfo-4.15.12+git.535.7750e5c95ef-150300.3.43.1 samba-client-4.15.12+git.535.7750e5c95ef-150300.3.43.1 samba-client-debuginfo-4.15.12+git.535.7750e5c95ef-150300.3.43.1 samba-client-libs-4.15.12+git.535.7750e5c95ef-150300.3.43.1 samba-client-libs-debuginfo-4.15.12+git.535.7750e5c95ef-150300.3.43.1 samba-debuginfo-4.15.12+git.535.7750e5c95ef-150300.3.43.1 samba-debugsource-4.15.12+git.535.7750e5c95ef-150300.3.43.1 samba-devel-4.15.12+git.535.7750e5c95ef-150300.3.43.1 samba-dsdb-modules-4.15.12+git.535.7750e5c95ef-150300.3.43.1 samba-dsdb-modules-debuginfo-4.15.12+git.535.7750e5c95ef-150300.3.43.1 samba-gpupdate-4.15.12+git.535.7750e5c95ef-150300.3.43.1 samba-ldb-ldap-4.15.12+git.535.7750e5c95ef-150300.3.43.1 samba-ldb-ldap-debuginfo-4.15.12+git.535.7750e5c95ef-150300.3.43.1 samba-libs-4.15.12+git.535.7750e5c95ef-150300.3.43.1 samba-libs-debuginfo-4.15.12+git.535.7750e5c95ef-150300.3.43.1 samba-libs-python3-4.15.12+git.535.7750e5c95ef-150300.3.43.1 samba-libs-python3-debuginfo-4.15.12+git.535.7750e5c95ef-150300.3.43.1 samba-python3-4.15.12+git.535.7750e5c95ef-150300.3.43.1 samba-python3-debuginfo-4.15.12+git.535.7750e5c95ef-150300.3.43.1 samba-tool-4.15.12+git.535.7750e5c95ef-150300.3.43.1 samba-winbind-4.15.12+git.535.7750e5c95ef-150300.3.43.1 samba-winbind-debuginfo-4.15.12+git.535.7750e5c95ef-150300.3.43.1 samba-winbind-libs-4.15.12+git.535.7750e5c95ef-150300.3.43.1 samba-winbind-libs-debuginfo-4.15.12+git.535.7750e5c95ef-150300.3.43.1 - SUSE Linux Enterprise Module for Basesystem 15-SP3 (aarch64 x86_64): samba-ceph-4.15.12+git.535.7750e5c95ef-150300.3.43.1 samba-ceph-debuginfo-4.15.12+git.535.7750e5c95ef-150300.3.43.1 - SUSE Linux Enterprise Module for Basesystem 15-SP3 (x86_64): samba-ad-dc-libs-32bit-4.15.12+git.535.7750e5c95ef-150300.3.43.1 samba-ad-dc-libs-32bit-debuginfo-4.15.12+git.535.7750e5c95ef-150300.3.43.1 samba-client-32bit-4.15.12+git.535.7750e5c95ef-150300.3.43.1 samba-client-32bit-debuginfo-4.15.12+git.535.7750e5c95ef-150300.3.43.1 samba-client-libs-32bit-4.15.12+git.535.7750e5c95ef-150300.3.43.1 samba-client-libs-32bit-debuginfo-4.15.12+git.535.7750e5c95ef-150300.3.43.1 samba-devel-32bit-4.15.12+git.535.7750e5c95ef-150300.3.43.1 samba-libs-32bit-4.15.12+git.535.7750e5c95ef-150300.3.43.1 samba-libs-32bit-debuginfo-4.15.12+git.535.7750e5c95ef-150300.3.43.1 samba-winbind-libs-32bit-4.15.12+git.535.7750e5c95ef-150300.3.43.1 samba-winbind-libs-32bit-debuginfo-4.15.12+git.535.7750e5c95ef-150300.3.43.1 - SUSE Linux Enterprise Micro 5.2 (aarch64 s390x x86_64): samba-client-libs-4.15.12+git.535.7750e5c95ef-150300.3.43.1 samba-client-libs-debuginfo-4.15.12+git.535.7750e5c95ef-150300.3.43.1 samba-debuginfo-4.15.12+git.535.7750e5c95ef-150300.3.43.1 samba-debugsource-4.15.12+git.535.7750e5c95ef-150300.3.43.1 - SUSE Linux Enterprise High Availability 15-SP3 (aarch64 ppc64le s390x x86_64): ctdb-4.15.12+git.535.7750e5c95ef-150300.3.43.1 ctdb-debuginfo-4.15.12+git.535.7750e5c95ef-150300.3.43.1 samba-debuginfo-4.15.12+git.535.7750e5c95ef-150300.3.43.1 samba-debugsource-4.15.12+git.535.7750e5c95ef-150300.3.43.1 - SUSE Enterprise Storage 7.1 (aarch64 x86_64): ctdb-4.15.12+git.535.7750e5c95ef-150300.3.43.1 ctdb-debuginfo-4.15.12+git.535.7750e5c95ef-150300.3.43.1 samba-4.15.12+git.535.7750e5c95ef-150300.3.43.1 samba-ceph-4.15.12+git.535.7750e5c95ef-150300.3.43.1 samba-ceph-debuginfo-4.15.12+git.535.7750e5c95ef-150300.3.43.1 samba-client-4.15.12+git.535.7750e5c95ef-150300.3.43.1 samba-client-debuginfo-4.15.12+git.535.7750e5c95ef-150300.3.43.1 samba-debuginfo-4.15.12+git.535.7750e5c95ef-150300.3.43.1 samba-debugsource-4.15.12+git.535.7750e5c95ef-150300.3.43.1 samba-libs-4.15.12+git.535.7750e5c95ef-150300.3.43.1 samba-libs-debuginfo-4.15.12+git.535.7750e5c95ef-150300.3.43.1 samba-libs-python3-4.15.12+git.535.7750e5c95ef-150300.3.43.1 samba-libs-python3-debuginfo-4.15.12+git.535.7750e5c95ef-150300.3.43.1 samba-winbind-4.15.12+git.535.7750e5c95ef-150300.3.43.1 samba-winbind-debuginfo-4.15.12+git.535.7750e5c95ef-150300.3.43.1 References: https://www.suse.com/security/cve/CVE-2022-2031.html https://www.suse.com/security/cve/CVE-2022-32742.html https://www.suse.com/security/cve/CVE-2022-32744.html https://www.suse.com/security/cve/CVE-2022-32745.html https://www.suse.com/security/cve/CVE-2022-32746.html https://www.suse.com/security/cve/CVE-2022-3437.html https://www.suse.com/security/cve/CVE-2022-42898.html https://bugzilla.suse.com/1200102 https://bugzilla.suse.com/1201490 https://bugzilla.suse.com/1201492 https://bugzilla.suse.com/1201493 https://bugzilla.suse.com/1201495 https://bugzilla.suse.com/1201496 https://bugzilla.suse.com/1201689 https://bugzilla.suse.com/1204254 https://bugzilla.suse.com/1205126

1 0

SUSE-SU-2022:4393-1: moderate: Security update for nautilus
by opensuse-security＠opensuse.org 09 Dec '22

09 Dec '22

SUSE Security Update: Security update for nautilus ______________________________________________________________________________ Announcement ID: SUSE-SU-2022:4393-1 Rating: moderate References: #1205418 Cross-References: CVE-2022-37290 CVSS scores: CVE-2022-37290 (NVD) : 5.5 CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H CVE-2022-37290 (SUSE): 5.5 CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H Affected Products: SUSE Enterprise Storage 7.1 SUSE Linux Enterprise Desktop 15-SP3 SUSE Linux Enterprise High Performance Computing 15-SP3 SUSE Linux Enterprise Module for Desktop Applications 15-SP3 SUSE Linux Enterprise Server 15-SP3 SUSE Linux Enterprise Server for SAP Applications 15-SP3 SUSE Manager Proxy 4.2 SUSE Manager Retail Branch Server 4.2 SUSE Manager Server 4.2 openSUSE Leap 15.3 openSUSE Leap 15.4 ______________________________________________________________________________ An update that fixes one vulnerability is now available. Description: This update for nautilus fixes the following issues: - CVE-2022-37290: Fixed a denial of service caused by pasted ZIP archives (bsc#1205418). Patch Instructions: To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 15.4: zypper in -t patch openSUSE-SLE-15.4-2022-4393=1 - openSUSE Leap 15.3: zypper in -t patch openSUSE-SLE-15.3-2022-4393=1 - SUSE Linux Enterprise Module for Desktop Applications 15-SP3: zypper in -t patch SUSE-SLE-Module-Desktop-Applications-15-SP3-2022-4393=1 Package List: - openSUSE Leap 15.4 (x86_64): libnautilus-extension1-32bit-3.34.3-150200.4.6.1 libnautilus-extension1-32bit-debuginfo-3.34.3-150200.4.6.1 - openSUSE Leap 15.3 (aarch64 ppc64le s390x x86_64): gnome-shell-search-provider-nautilus-3.34.3-150200.4.6.1 libnautilus-extension1-3.34.3-150200.4.6.1 libnautilus-extension1-debuginfo-3.34.3-150200.4.6.1 nautilus-3.34.3-150200.4.6.1 nautilus-debuginfo-3.34.3-150200.4.6.1 nautilus-debugsource-3.34.3-150200.4.6.1 nautilus-devel-3.34.3-150200.4.6.1 typelib-1_0-Nautilus-3_0-3.34.3-150200.4.6.1 - openSUSE Leap 15.3 (x86_64): libnautilus-extension1-32bit-3.34.3-150200.4.6.1 libnautilus-extension1-32bit-debuginfo-3.34.3-150200.4.6.1 - openSUSE Leap 15.3 (noarch): nautilus-lang-3.34.3-150200.4.6.1 - SUSE Linux Enterprise Module for Desktop Applications 15-SP3 (aarch64 ppc64le s390x x86_64): gnome-shell-search-provider-nautilus-3.34.3-150200.4.6.1 libnautilus-extension1-3.34.3-150200.4.6.1 libnautilus-extension1-debuginfo-3.34.3-150200.4.6.1 nautilus-3.34.3-150200.4.6.1 nautilus-debuginfo-3.34.3-150200.4.6.1 nautilus-debugsource-3.34.3-150200.4.6.1 nautilus-devel-3.34.3-150200.4.6.1 typelib-1_0-Nautilus-3_0-3.34.3-150200.4.6.1 - SUSE Linux Enterprise Module for Desktop Applications 15-SP3 (noarch): nautilus-lang-3.34.3-150200.4.6.1 References: https://www.suse.com/security/cve/CVE-2022-37290.html https://bugzilla.suse.com/1205418

1 0

SUSE-SU-2022:4378-1: moderate: Security update for rabbitmq-server
by opensuse-security＠opensuse.org 08 Dec '22

08 Dec '22

SUSE Security Update: Security update for rabbitmq-server ______________________________________________________________________________ Announcement ID: SUSE-SU-2022:4378-1 Rating: moderate References: #1205267 Cross-References: CVE-2022-31008 CVSS scores: CVE-2022-31008 (NVD) : 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N CVE-2022-31008 (SUSE): 5.5 CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N Affected Products: SUSE Enterprise Storage 7.1 SUSE Linux Enterprise High Performance Computing 15-SP3 SUSE Linux Enterprise High Performance Computing 15-SP4 SUSE Linux Enterprise Module for Server Applications 15-SP3 SUSE Linux Enterprise Module for Server Applications 15-SP4 SUSE Linux Enterprise Server 15-SP3 SUSE Linux Enterprise Server 15-SP4 SUSE Linux Enterprise Server for SAP Applications 15-SP3 SUSE Linux Enterprise Server for SAP Applications 15-SP4 SUSE Manager Proxy 4.2 SUSE Manager Proxy 4.3 SUSE Manager Retail Branch Server 4.2 SUSE Manager Retail Branch Server 4.3 SUSE Manager Server 4.2 SUSE Manager Server 4.3 openSUSE Leap 15.3 openSUSE Leap 15.4 ______________________________________________________________________________ An update that fixes one vulnerability is now available. Description: This update for rabbitmq-server fixes the following issues: - CVE-2022-31008: Fixed predictable secret seed in URI encryption (bsc#1205267). Patch Instructions: To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 15.4: zypper in -t patch openSUSE-SLE-15.4-2022-4378=1 - openSUSE Leap 15.3: zypper in -t patch openSUSE-SLE-15.3-2022-4378=1 - SUSE Linux Enterprise Module for Server Applications 15-SP4: zypper in -t patch SUSE-SLE-Module-Server-Applications-15-SP4-2022-4378=1 - SUSE Linux Enterprise Module for Server Applications 15-SP3: zypper in -t patch SUSE-SLE-Module-Server-Applications-15-SP3-2022-4378=1 Package List: - openSUSE Leap 15.4 (aarch64 ppc64le s390x x86_64): erlang-rabbitmq-client-3.8.11-150300.3.11.1 rabbitmq-server-3.8.11-150300.3.11.1 rabbitmq-server-plugins-3.8.11-150300.3.11.1 - openSUSE Leap 15.3 (aarch64 ppc64le s390x x86_64): erlang-rabbitmq-client-3.8.11-150300.3.11.1 rabbitmq-server-3.8.11-150300.3.11.1 rabbitmq-server-plugins-3.8.11-150300.3.11.1 - SUSE Linux Enterprise Module for Server Applications 15-SP4 (aarch64 ppc64le s390x x86_64): erlang-rabbitmq-client-3.8.11-150300.3.11.1 rabbitmq-server-3.8.11-150300.3.11.1 rabbitmq-server-plugins-3.8.11-150300.3.11.1 - SUSE Linux Enterprise Module for Server Applications 15-SP3 (aarch64 ppc64le s390x x86_64): erlang-rabbitmq-client-3.8.11-150300.3.11.1 rabbitmq-server-3.8.11-150300.3.11.1 rabbitmq-server-plugins-3.8.11-150300.3.11.1 References: https://www.suse.com/security/cve/CVE-2022-31008.html https://bugzilla.suse.com/1205267

1 0

SUSE-SU-2022:4371-1: moderate: Security update for busybox
by opensuse-security＠opensuse.org 08 Dec '22

08 Dec '22

SUSE Security Update: Security update for busybox ______________________________________________________________________________ Announcement ID: SUSE-SU-2022:4371-1 Rating: moderate References: #1199744 #914660 Cross-References: CVE-2014-9645 CVE-2022-30065 CVSS scores: CVE-2014-9645 (NVD) : 5.5 CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N CVE-2022-30065 (NVD) : 7.8 CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H CVE-2022-30065 (SUSE): 5.5 CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H Affected Products: SUSE Linux Enterprise Desktop 15-SP4 SUSE Linux Enterprise High Performance Computing 15-SP4 SUSE Linux Enterprise Module for Basesystem 15-SP4 SUSE Linux Enterprise Server 15-SP4 SUSE Linux Enterprise Server for SAP Applications 15-SP4 SUSE Manager Proxy 4.3 SUSE Manager Retail Branch Server 4.3 SUSE Manager Server 4.3 openSUSE Leap 15.4 ______________________________________________________________________________ An update that fixes two vulnerabilities is now available. Description: This update for busybox fixes the following issues: - CVE-2022-30065: Fixed use-after-free in the AWK applet (bsc#1199744). - CVE-2014-9645: Fixed loading of unwanted module with / in module names (bsc#914660). - Update to 1.35.0 also introduced: - awk: fix printf %%, fix read beyond end of buffer - chrt: silence analyzer warning - libarchive: remove duplicate forward declaration - mount: "mount -o rw ...." should not fall back to RO mount - ps: fix -o pid=PID,args interpreting entire "PID,args" as header - tar: prevent malicious archives with long name sizes causing OOM - udhcpc6: fix udhcp_find_option to actually find DHCP6 options - xxd: fix -p -r - support for new optoins added to basename, cpio, date, find, mktemp, wget and others Patch Instructions: To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 15.4: zypper in -t patch openSUSE-SLE-15.4-2022-4371=1 - SUSE Linux Enterprise Module for Basesystem 15-SP4: zypper in -t patch SUSE-SLE-Module-Basesystem-15-SP4-2022-4371=1 Package List: - openSUSE Leap 15.4 (aarch64 ppc64le s390x x86_64): busybox-1.35.0-150400.3.8.1 busybox-static-1.35.0-150400.3.8.1 busybox-testsuite-1.35.0-150400.3.8.1 - openSUSE Leap 15.4 (aarch64 x86_64): busybox-warewulf3-1.35.0-150400.3.8.1 - openSUSE Leap 15.4 (noarch): busybox-adduser-1.35.0-150400.4.3.14 busybox-attr-1.35.0-150400.4.3.14 busybox-bc-1.35.0-150400.4.3.14 busybox-bind-utils-1.35.0-150400.4.3.14 busybox-bzip2-1.35.0-150400.4.3.14 busybox-coreutils-1.35.0-150400.4.3.14 busybox-cpio-1.35.0-150400.4.3.14 busybox-diffutils-1.35.0-150400.4.3.14 busybox-dos2unix-1.35.0-150400.4.3.14 busybox-ed-1.35.0-150400.4.3.14 busybox-findutils-1.35.0-150400.4.3.14 busybox-gawk-1.35.0-150400.4.3.14 busybox-grep-1.35.0-150400.4.3.14 busybox-gzip-1.35.0-150400.4.3.14 busybox-hostname-1.35.0-150400.4.3.14 busybox-iproute2-1.35.0-150400.4.3.14 busybox-iputils-1.35.0-150400.4.3.14 busybox-kbd-1.35.0-150400.4.3.14 busybox-kmod-1.35.0-150400.4.3.14 busybox-less-1.35.0-150400.4.3.14 busybox-links-1.35.0-150400.4.3.14 busybox-man-1.35.0-150400.4.3.14 busybox-misc-1.35.0-150400.4.3.14 busybox-ncurses-utils-1.35.0-150400.4.3.14 busybox-net-tools-1.35.0-150400.4.3.14 busybox-netcat-1.35.0-150400.4.3.14 busybox-patch-1.35.0-150400.4.3.14 busybox-policycoreutils-1.35.0-150400.4.3.14 busybox-procps-1.35.0-150400.4.3.14 busybox-psmisc-1.35.0-150400.4.3.14 busybox-sed-1.35.0-150400.4.3.14 busybox-selinux-tools-1.35.0-150400.4.3.14 busybox-sendmail-1.35.0-150400.4.3.14 busybox-sh-1.35.0-150400.4.3.14 busybox-sharutils-1.35.0-150400.4.3.14 busybox-syslogd-1.35.0-150400.4.3.14 busybox-sysvinit-tools-1.35.0-150400.4.3.14 busybox-tar-1.35.0-150400.4.3.14 busybox-telnet-1.35.0-150400.4.3.14 busybox-tftp-1.35.0-150400.4.3.14 busybox-time-1.35.0-150400.4.3.14 busybox-traceroute-1.35.0-150400.4.3.14 busybox-tunctl-1.35.0-150400.4.3.14 busybox-unzip-1.35.0-150400.4.3.14 busybox-util-linux-1.35.0-150400.4.3.14 busybox-vi-1.35.0-150400.4.3.14 busybox-vlan-1.35.0-150400.4.3.14 busybox-wget-1.35.0-150400.4.3.14 busybox-which-1.35.0-150400.4.3.14 busybox-whois-1.35.0-150400.4.3.14 busybox-xz-1.35.0-150400.4.3.14 - SUSE Linux Enterprise Module for Basesystem 15-SP4 (aarch64 ppc64le s390x x86_64): busybox-1.35.0-150400.3.8.1 busybox-static-1.35.0-150400.3.8.1 References: https://www.suse.com/security/cve/CVE-2014-9645.html https://www.suse.com/security/cve/CVE-2022-30065.html https://bugzilla.suse.com/1199744 https://bugzilla.suse.com/914660

1 0

openSUSE-SU-2022:10236-1: important: Security update for chromium
by opensuse-security＠opensuse.org 08 Dec '22

08 Dec '22

openSUSE Security Update: Security update for chromium ______________________________________________________________________________ Announcement ID: openSUSE-SU-2022:10236-1 Rating: important References: #1205999 Cross-References: CVE-2022-4262 CVSS scores: CVE-2022-4262 (NVD) : 8.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H Affected Products: openSUSE Backports SLE-15-SP3 openSUSE Backports SLE-15-SP4 ______________________________________________________________________________ An update that fixes one vulnerability is now available. Description: This update for chromium fixes the following issues: Chromium 108.0.5359.94 (boo#1205999) - CVE-2022-4262: Type Confusion in V8 Patch Instructions: To install this openSUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Backports SLE-15-SP4: zypper in -t patch openSUSE-2022-10236=1 - openSUSE Backports SLE-15-SP3: zypper in -t patch openSUSE-2022-10236=1 Package List: - openSUSE Backports SLE-15-SP4 (aarch64 x86_64): chromedriver-108.0.5359.94-bp154.2.52.1 chromedriver-debuginfo-108.0.5359.94-bp154.2.52.1 chromium-108.0.5359.94-bp154.2.52.1 chromium-debuginfo-108.0.5359.94-bp154.2.52.1 - openSUSE Backports SLE-15-SP3 (aarch64 x86_64): chromedriver-108.0.5359.94-bp153.2.145.1 chromium-108.0.5359.94-bp153.2.145.1 References: https://www.suse.com/security/cve/CVE-2022-4262.html https://bugzilla.suse.com/1205999

1 0

openSUSE-SU-2022:10235-1: important: Security update for matio
by opensuse-security＠opensuse.org 08 Dec '22

08 Dec '22

openSUSE Security Update: Security update for matio ______________________________________________________________________________ Announcement ID: openSUSE-SU-2022:10235-1 Rating: important References: #1193873 #1193874 Cross-References: CVE-2020-36428 CVE-2021-36977 CVSS scores: CVE-2020-36428 (NVD) : 8.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H CVE-2021-36977 (NVD) : 6.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H Affected Products: openSUSE Backports SLE-15-SP4 ______________________________________________________________________________ An update that fixes two vulnerabilities is now available. Description: This update for matio fixes the following issues: Update to version 1.5.23: * Fixed testsuite regression from version 1.5.22. Changes from version 1.5.22: * Added support for reading large MAT file. * Updated cmake-conan to version 0.17.0. * Fixed CMake build with Conan (MATIO_USE_CONAN:BOOL=ON). * Fixed data type when reading 16-bit character data from HDF5 MAT file. * Fixed heap-based buffer overflows when reading (crafted) MAT file (CVE-2020-36428, CVE-2021-36977). * Confirmed compatibility with HDF5 v1.13.0 and v1.13.1. * Several other fixes, for example for memory leaks. Patch Instructions: To install this openSUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Backports SLE-15-SP4: zypper in -t patch openSUSE-2022-10235=1 Package List: - openSUSE Backports SLE-15-SP4 (aarch64 i586 ppc64le s390x x86_64): libmatio-devel-1.5.23-bp154.2.3.1 libmatio11-1.5.23-bp154.2.3.1 matio-tools-1.5.23-bp154.2.3.1 References: https://www.suse.com/security/cve/CVE-2020-36428.html https://www.suse.com/security/cve/CVE-2021-36977.html https://bugzilla.suse.com/1193873 https://bugzilla.suse.com/1193874

1 0