April 2022 - openSUSE Security Announce

SUSE-SU-2022:1274-1: important: Security update for GraphicsMagick
by opensuse-security＠opensuse.org 20 Apr '22

20 Apr '22

SUSE Security Update: Security update for GraphicsMagick ______________________________________________________________________________ Announcement ID: SUSE-SU-2022:1274-1 Rating: important References: #1198351 Cross-References: CVE-2022-1270 CVSS scores: CVE-2022-1270 (SUSE): 7.3 CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:L Affected Products: openSUSE Leap 15.3 openSUSE Leap 15.4 ______________________________________________________________________________ An update that fixes one vulnerability is now available. Description: This update for GraphicsMagick fixes the following issues: - CVE-2022-1270: Fixed a heap buffer overflow when parsing MIFF (bsc#1198351). Patch Instructions: To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 15.4: zypper in -t patch openSUSE-SLE-15.4-2022-1274=1 - openSUSE Leap 15.3: zypper in -t patch openSUSE-SLE-15.3-2022-1274=1 Package List: - openSUSE Leap 15.4 (aarch64 ppc64le s390x x86_64): GraphicsMagick-1.3.35-150300.3.3.1 GraphicsMagick-debuginfo-1.3.35-150300.3.3.1 GraphicsMagick-debugsource-1.3.35-150300.3.3.1 GraphicsMagick-devel-1.3.35-150300.3.3.1 libGraphicsMagick++-Q16-12-1.3.35-150300.3.3.1 libGraphicsMagick++-Q16-12-debuginfo-1.3.35-150300.3.3.1 libGraphicsMagick++-devel-1.3.35-150300.3.3.1 libGraphicsMagick-Q16-3-1.3.35-150300.3.3.1 libGraphicsMagick-Q16-3-debuginfo-1.3.35-150300.3.3.1 libGraphicsMagick3-config-1.3.35-150300.3.3.1 libGraphicsMagickWand-Q16-2-1.3.35-150300.3.3.1 libGraphicsMagickWand-Q16-2-debuginfo-1.3.35-150300.3.3.1 perl-GraphicsMagick-1.3.35-150300.3.3.1 perl-GraphicsMagick-debuginfo-1.3.35-150300.3.3.1 - openSUSE Leap 15.3 (aarch64 ppc64le s390x x86_64): GraphicsMagick-1.3.35-150300.3.3.1 GraphicsMagick-debuginfo-1.3.35-150300.3.3.1 GraphicsMagick-debugsource-1.3.35-150300.3.3.1 GraphicsMagick-devel-1.3.35-150300.3.3.1 libGraphicsMagick++-Q16-12-1.3.35-150300.3.3.1 libGraphicsMagick++-Q16-12-debuginfo-1.3.35-150300.3.3.1 libGraphicsMagick++-devel-1.3.35-150300.3.3.1 libGraphicsMagick-Q16-3-1.3.35-150300.3.3.1 libGraphicsMagick-Q16-3-debuginfo-1.3.35-150300.3.3.1 libGraphicsMagick3-config-1.3.35-150300.3.3.1 libGraphicsMagickWand-Q16-2-1.3.35-150300.3.3.1 libGraphicsMagickWand-Q16-2-debuginfo-1.3.35-150300.3.3.1 perl-GraphicsMagick-1.3.35-150300.3.3.1 perl-GraphicsMagick-debuginfo-1.3.35-150300.3.3.1 References: https://www.suse.com/security/cve/CVE-2022-1270.html https://bugzilla.suse.com/1198351

1 0

SUSE-SU-2022:1273-1: important: Security update for SDL
by opensuse-security＠opensuse.org 20 Apr '22

20 Apr '22

SUSE Security Update: Security update for SDL ______________________________________________________________________________ Announcement ID: SUSE-SU-2022:1273-1 Rating: important References: #1181201 #1181202 #1198001 Cross-References: CVE-2020-14409 CVE-2020-14410 CVE-2021-33657 CVSS scores: CVE-2020-14409 (NVD) : 7.8 CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H CVE-2020-14409 (SUSE): 7.8 CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H CVE-2020-14410 (NVD) : 5.4 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:L CVE-2020-14410 (SUSE): 7.8 CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H CVE-2021-33657 (NVD) : 8.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H CVE-2021-33657 (SUSE): 7.8 CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H Affected Products: SUSE CaaS Platform 4.0 SUSE Enterprise Storage 6 SUSE Enterprise Storage 7 SUSE Linux Enterprise Desktop 15-SP3 SUSE Linux Enterprise Desktop 15-SP4 SUSE Linux Enterprise High Performance Computing 15-ESPOS SUSE Linux Enterprise High Performance Computing 15-LTSS SUSE Linux Enterprise High Performance Computing 15-SP1-ESPOS SUSE Linux Enterprise High Performance Computing 15-SP1-LTSS SUSE Linux Enterprise High Performance Computing 15-SP2-ESPOS SUSE Linux Enterprise High Performance Computing 15-SP2-LTSS SUSE Linux Enterprise High Performance Computing 15-SP3 SUSE Linux Enterprise High Performance Computing 15-SP4 SUSE Linux Enterprise Module for Desktop Applications 15-SP3 SUSE Linux Enterprise Module for Desktop Applications 15-SP4 SUSE Linux Enterprise Module for Packagehub Subpackages 15-SP3 SUSE Linux Enterprise Realtime Extension 15-SP2 SUSE Linux Enterprise Server 15-LTSS SUSE Linux Enterprise Server 15-SP1-BCL SUSE Linux Enterprise Server 15-SP1-LTSS SUSE Linux Enterprise Server 15-SP2-BCL SUSE Linux Enterprise Server 15-SP2-LTSS SUSE Linux Enterprise Server 15-SP3 SUSE Linux Enterprise Server 15-SP4 SUSE Linux Enterprise Server for SAP 15 SUSE Linux Enterprise Server for SAP 15-SP1 SUSE Linux Enterprise Server for SAP 15-SP2 SUSE Linux Enterprise Server for SAP Applications 15-SP3 SUSE Linux Enterprise Server for SAP Applications 15-SP4 SUSE Manager Proxy 4.1 SUSE Manager Proxy 4.2 SUSE Manager Retail Branch Server 4.1 SUSE Manager Server 4.1 SUSE Manager Server 4.2 openSUSE Leap 15.3 openSUSE Leap 15.4 ______________________________________________________________________________ An update that fixes three vulnerabilities is now available. Description: This update for SDL fixes the following issues: - CVE-2020-14409: Fixed an integer overflow (and resultant SDL_memcpy heap corruption) in SDL_BlitCopy in video/SDL_blit_copy.c. (bsc#1181202) - CVE-2020-14410: Fixed a heap-based buffer over-read in Blit_3or4_to_3or4__inversed_rgb in video/SDL_blit_N.c. (bsc#1181201) - CVE-2021-33657: Fixed a Heap overflow problem in video/SDL_pixels.c. (bsc#1198001) Patch Instructions: To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 15.4: zypper in -t patch openSUSE-SLE-15.4-2022-1273=1 - openSUSE Leap 15.3: zypper in -t patch openSUSE-SLE-15.3-2022-1273=1 - SUSE Manager Server 4.1: zypper in -t patch SUSE-SLE-Product-SUSE-Manager-Server-4.1-2022-1273=1 - SUSE Manager Retail Branch Server 4.1: zypper in -t patch SUSE-SLE-Product-SUSE-Manager-Retail-Branch-Server-4.1-2022-1273=1 - SUSE Manager Proxy 4.1: zypper in -t patch SUSE-SLE-Product-SUSE-Manager-Proxy-4.1-2022-1273=1 - SUSE Linux Enterprise Server for SAP 15-SP2: zypper in -t patch SUSE-SLE-Product-SLES_SAP-15-SP2-2022-1273=1 - SUSE Linux Enterprise Server for SAP 15-SP1: zypper in -t patch SUSE-SLE-Product-SLES_SAP-15-SP1-2022-1273=1 - SUSE Linux Enterprise Server for SAP 15: zypper in -t patch SUSE-SLE-Product-SLES_SAP-15-2022-1273=1 - SUSE Linux Enterprise Server 15-SP2-LTSS: zypper in -t patch SUSE-SLE-Product-SLES-15-SP2-LTSS-2022-1273=1 - SUSE Linux Enterprise Server 15-SP2-BCL: zypper in -t patch SUSE-SLE-Product-SLES-15-SP2-BCL-2022-1273=1 - SUSE Linux Enterprise Server 15-SP1-LTSS: zypper in -t patch SUSE-SLE-Product-SLES-15-SP1-LTSS-2022-1273=1 - SUSE Linux Enterprise Server 15-SP1-BCL: zypper in -t patch SUSE-SLE-Product-SLES-15-SP1-BCL-2022-1273=1 - SUSE Linux Enterprise Server 15-LTSS: zypper in -t patch SUSE-SLE-Product-SLES-15-2022-1273=1 - SUSE Linux Enterprise Realtime Extension 15-SP2: zypper in -t patch SUSE-SLE-Product-RT-15-SP2-2022-1273=1 - SUSE Linux Enterprise Module for Packagehub Subpackages 15-SP3: zypper in -t patch SUSE-SLE-Module-Packagehub-Subpackages-15-SP3-2022-1273=1 - SUSE Linux Enterprise Module for Desktop Applications 15-SP4: zypper in -t patch SUSE-SLE-Module-Desktop-Applications-15-SP4-2022-1273=1 - SUSE Linux Enterprise Module for Desktop Applications 15-SP3: zypper in -t patch SUSE-SLE-Module-Desktop-Applications-15-SP3-2022-1273=1 - SUSE Linux Enterprise High Performance Computing 15-SP2-LTSS: zypper in -t patch SUSE-SLE-Product-HPC-15-SP2-LTSS-2022-1273=1 - SUSE Linux Enterprise High Performance Computing 15-SP2-ESPOS: zypper in -t patch SUSE-SLE-Product-HPC-15-SP2-ESPOS-2022-1273=1 - SUSE Linux Enterprise High Performance Computing 15-SP1-LTSS: zypper in -t patch SUSE-SLE-Product-HPC-15-SP1-LTSS-2022-1273=1 - SUSE Linux Enterprise High Performance Computing 15-SP1-ESPOS: zypper in -t patch SUSE-SLE-Product-HPC-15-SP1-ESPOS-2022-1273=1 - SUSE Linux Enterprise High Performance Computing 15-LTSS: zypper in -t patch SUSE-SLE-Product-HPC-15-2022-1273=1 - SUSE Linux Enterprise High Performance Computing 15-ESPOS: zypper in -t patch SUSE-SLE-Product-HPC-15-2022-1273=1 - SUSE Enterprise Storage 7: zypper in -t patch SUSE-Storage-7-2022-1273=1 - SUSE Enterprise Storage 6: zypper in -t patch SUSE-Storage-6-2022-1273=1 - SUSE CaaS Platform 4.0: To install this update, use the SUSE CaaS Platform 'skuba' tool. It will inform you if it detects new updates and let you then trigger updating of the complete cluster in a controlled way. Package List: - openSUSE Leap 15.4 (aarch64 ppc64le s390x x86_64): SDL-debugsource-1.2.15-150000.3.19.1 libSDL-1_2-0-1.2.15-150000.3.19.1 libSDL-1_2-0-debuginfo-1.2.15-150000.3.19.1 libSDL-devel-1.2.15-150000.3.19.1 - openSUSE Leap 15.4 (x86_64): libSDL-1_2-0-32bit-1.2.15-150000.3.19.1 libSDL-1_2-0-32bit-debuginfo-1.2.15-150000.3.19.1 libSDL-devel-32bit-1.2.15-150000.3.19.1 - openSUSE Leap 15.3 (aarch64 ppc64le s390x x86_64): SDL-debugsource-1.2.15-150000.3.19.1 libSDL-1_2-0-1.2.15-150000.3.19.1 libSDL-1_2-0-debuginfo-1.2.15-150000.3.19.1 libSDL-devel-1.2.15-150000.3.19.1 - openSUSE Leap 15.3 (x86_64): libSDL-1_2-0-32bit-1.2.15-150000.3.19.1 libSDL-1_2-0-32bit-debuginfo-1.2.15-150000.3.19.1 libSDL-devel-32bit-1.2.15-150000.3.19.1 - SUSE Manager Server 4.1 (ppc64le s390x x86_64): SDL-debugsource-1.2.15-150000.3.19.1 libSDL-1_2-0-1.2.15-150000.3.19.1 libSDL-1_2-0-debuginfo-1.2.15-150000.3.19.1 libSDL-devel-1.2.15-150000.3.19.1 - SUSE Manager Retail Branch Server 4.1 (x86_64): SDL-debugsource-1.2.15-150000.3.19.1 libSDL-1_2-0-1.2.15-150000.3.19.1 libSDL-1_2-0-debuginfo-1.2.15-150000.3.19.1 libSDL-devel-1.2.15-150000.3.19.1 - SUSE Manager Proxy 4.1 (x86_64): SDL-debugsource-1.2.15-150000.3.19.1 libSDL-1_2-0-1.2.15-150000.3.19.1 libSDL-1_2-0-debuginfo-1.2.15-150000.3.19.1 libSDL-devel-1.2.15-150000.3.19.1 - SUSE Linux Enterprise Server for SAP 15-SP2 (ppc64le x86_64): SDL-debugsource-1.2.15-150000.3.19.1 libSDL-1_2-0-1.2.15-150000.3.19.1 libSDL-1_2-0-debuginfo-1.2.15-150000.3.19.1 libSDL-devel-1.2.15-150000.3.19.1 - SUSE Linux Enterprise Server for SAP 15-SP1 (ppc64le x86_64): SDL-debugsource-1.2.15-150000.3.19.1 libSDL-1_2-0-1.2.15-150000.3.19.1 libSDL-1_2-0-debuginfo-1.2.15-150000.3.19.1 libSDL-devel-1.2.15-150000.3.19.1 - SUSE Linux Enterprise Server for SAP 15 (ppc64le x86_64): SDL-debugsource-1.2.15-150000.3.19.1 libSDL-1_2-0-1.2.15-150000.3.19.1 libSDL-1_2-0-debuginfo-1.2.15-150000.3.19.1 libSDL-devel-1.2.15-150000.3.19.1 - SUSE Linux Enterprise Server 15-SP2-LTSS (aarch64 ppc64le s390x x86_64): SDL-debugsource-1.2.15-150000.3.19.1 libSDL-1_2-0-1.2.15-150000.3.19.1 libSDL-1_2-0-debuginfo-1.2.15-150000.3.19.1 libSDL-devel-1.2.15-150000.3.19.1 - SUSE Linux Enterprise Server 15-SP2-BCL (x86_64): SDL-debugsource-1.2.15-150000.3.19.1 libSDL-1_2-0-1.2.15-150000.3.19.1 libSDL-1_2-0-debuginfo-1.2.15-150000.3.19.1 libSDL-devel-1.2.15-150000.3.19.1 - SUSE Linux Enterprise Server 15-SP1-LTSS (aarch64 ppc64le s390x x86_64): SDL-debugsource-1.2.15-150000.3.19.1 libSDL-1_2-0-1.2.15-150000.3.19.1 libSDL-1_2-0-debuginfo-1.2.15-150000.3.19.1 libSDL-devel-1.2.15-150000.3.19.1 - SUSE Linux Enterprise Server 15-SP1-BCL (x86_64): SDL-debugsource-1.2.15-150000.3.19.1 libSDL-1_2-0-1.2.15-150000.3.19.1 libSDL-1_2-0-debuginfo-1.2.15-150000.3.19.1 libSDL-devel-1.2.15-150000.3.19.1 - SUSE Linux Enterprise Server 15-LTSS (aarch64 s390x): SDL-debugsource-1.2.15-150000.3.19.1 libSDL-1_2-0-1.2.15-150000.3.19.1 libSDL-1_2-0-debuginfo-1.2.15-150000.3.19.1 libSDL-devel-1.2.15-150000.3.19.1 - SUSE Linux Enterprise Realtime Extension 15-SP2 (x86_64): SDL-debugsource-1.2.15-150000.3.19.1 libSDL-1_2-0-1.2.15-150000.3.19.1 libSDL-1_2-0-debuginfo-1.2.15-150000.3.19.1 libSDL-devel-1.2.15-150000.3.19.1 - SUSE Linux Enterprise Module for Packagehub Subpackages 15-SP3 (aarch64 ppc64le s390x): libSDL-1_2-0-1.2.15-150000.3.19.1 libSDL-1_2-0-debuginfo-1.2.15-150000.3.19.1 - SUSE Linux Enterprise Module for Desktop Applications 15-SP4 (aarch64 ppc64le s390x x86_64): SDL-debugsource-1.2.15-150000.3.19.1 libSDL-1_2-0-1.2.15-150000.3.19.1 libSDL-1_2-0-debuginfo-1.2.15-150000.3.19.1 libSDL-devel-1.2.15-150000.3.19.1 - SUSE Linux Enterprise Module for Desktop Applications 15-SP3 (aarch64 ppc64le s390x x86_64): SDL-debugsource-1.2.15-150000.3.19.1 libSDL-1_2-0-1.2.15-150000.3.19.1 libSDL-1_2-0-debuginfo-1.2.15-150000.3.19.1 libSDL-devel-1.2.15-150000.3.19.1 - SUSE Linux Enterprise High Performance Computing 15-SP2-LTSS (aarch64 x86_64): SDL-debugsource-1.2.15-150000.3.19.1 libSDL-1_2-0-1.2.15-150000.3.19.1 libSDL-1_2-0-debuginfo-1.2.15-150000.3.19.1 libSDL-devel-1.2.15-150000.3.19.1 - SUSE Linux Enterprise High Performance Computing 15-SP2-ESPOS (aarch64 x86_64): SDL-debugsource-1.2.15-150000.3.19.1 libSDL-1_2-0-1.2.15-150000.3.19.1 libSDL-1_2-0-debuginfo-1.2.15-150000.3.19.1 libSDL-devel-1.2.15-150000.3.19.1 - SUSE Linux Enterprise High Performance Computing 15-SP1-LTSS (aarch64 x86_64): SDL-debugsource-1.2.15-150000.3.19.1 libSDL-1_2-0-1.2.15-150000.3.19.1 libSDL-1_2-0-debuginfo-1.2.15-150000.3.19.1 libSDL-devel-1.2.15-150000.3.19.1 - SUSE Linux Enterprise High Performance Computing 15-SP1-ESPOS (aarch64 x86_64): SDL-debugsource-1.2.15-150000.3.19.1 libSDL-1_2-0-1.2.15-150000.3.19.1 libSDL-1_2-0-debuginfo-1.2.15-150000.3.19.1 libSDL-devel-1.2.15-150000.3.19.1 - SUSE Linux Enterprise High Performance Computing 15-LTSS (aarch64 x86_64): SDL-debugsource-1.2.15-150000.3.19.1 libSDL-1_2-0-1.2.15-150000.3.19.1 libSDL-1_2-0-debuginfo-1.2.15-150000.3.19.1 libSDL-devel-1.2.15-150000.3.19.1 - SUSE Linux Enterprise High Performance Computing 15-ESPOS (aarch64 x86_64): SDL-debugsource-1.2.15-150000.3.19.1 libSDL-1_2-0-1.2.15-150000.3.19.1 libSDL-1_2-0-debuginfo-1.2.15-150000.3.19.1 libSDL-devel-1.2.15-150000.3.19.1 - SUSE Enterprise Storage 7 (aarch64 x86_64): SDL-debugsource-1.2.15-150000.3.19.1 libSDL-1_2-0-1.2.15-150000.3.19.1 libSDL-1_2-0-debuginfo-1.2.15-150000.3.19.1 libSDL-devel-1.2.15-150000.3.19.1 - SUSE Enterprise Storage 6 (aarch64 x86_64): SDL-debugsource-1.2.15-150000.3.19.1 libSDL-1_2-0-1.2.15-150000.3.19.1 libSDL-1_2-0-debuginfo-1.2.15-150000.3.19.1 libSDL-devel-1.2.15-150000.3.19.1 - SUSE CaaS Platform 4.0 (x86_64): SDL-debugsource-1.2.15-150000.3.19.1 libSDL-1_2-0-1.2.15-150000.3.19.1 libSDL-1_2-0-debuginfo-1.2.15-150000.3.19.1 libSDL-devel-1.2.15-150000.3.19.1 References: https://www.suse.com/security/cve/CVE-2020-14409.html https://www.suse.com/security/cve/CVE-2020-14410.html https://www.suse.com/security/cve/CVE-2021-33657.html https://bugzilla.suse.com/1181201 https://bugzilla.suse.com/1181202 https://bugzilla.suse.com/1198001

1 0

SUSE-SU-2022:1276-1: important: Security update for nbd
by opensuse-security＠opensuse.org 20 Apr '22

20 Apr '22

SUSE Security Update: Security update for nbd ______________________________________________________________________________ Announcement ID: SUSE-SU-2022:1276-1 Rating: important References: #1196827 #1196828 Cross-References: CVE-2022-26495 CVE-2022-26496 CVSS scores: CVE-2022-26495 (NVD) : 9.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H CVE-2022-26495 (SUSE): 8.1 CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H CVE-2022-26496 (NVD) : 9.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H CVE-2022-26496 (SUSE): 8.1 CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H Affected Products: openSUSE Leap 15.3 openSUSE Leap 15.4 ______________________________________________________________________________ An update that fixes two vulnerabilities is now available. Description: This update for nbd fixes the following issues: - CVE-2022-26495: Fixed an integer overflow with a resultant heap-based buffer overflow (bsc#1196827). - CVE-2022-26496: Fixed a stack-based buffer overflow when parsing the name field by sending a crafted NBD_OPT_INFO (bsc#1196828). Update to version 3.24 (bsc#1196827, bsc#1196828, CVE-2022-26495, CVE-2022-26496): * https://github.com/advisories/GHSA-q9rw-8758-hccj Update to version 3.23: * Don't overwrite the hostname with the TLS hostname Update to version 3.22: - nbd-server: handle auth for v6-mapped IPv4 addresses - nbd-client.c: parse the next option in all cases - configure.ac: silence a few autoconf 2.71 warnings - spec: Relax NBD_OPT_LIST_META_CONTEXTS - client: Don't confuse Unix socket with TLS hostname - server: Avoid deprecated g_memdup Update to version 3.21: - Fix --disable-manpages build - Fix a bug in whitespace handling regarding authorization files - Support client-side marking of devices as read-only - Support preinitialized NBD connection (i.e., skip the negotiation). - Fix the systemd unit file for nbd-client so it works with netlink (the more common situation nowadays) Update to 3.20.0 (no changelog) Update to version 3.19.0: * Better error messages in case of unexpected disconnects * Better compatibility with non-bash sh implementations (for configure.sh) * Fix for a segfault in NBD_OPT_INFO handling * The ability to specify whether to listen on both TCP and Unix domain sockets, rather than to always do so * Various minor editorial and spelling fixes in the documentation. Update to version 1.18.0: * Client: Add the "-g" option to avoid even trying the NBD_OPT_GO message * Server: fixes to inetd mode * Don't make gnutls and libnl automagic. * Server: bugfixes in handling of some export names during verification. * Server: clean supplementary groups when changing user. * Client: when using the netlink protocol, only set a timeout when there actually is a timeout, rather than defaulting to 0 seconds * Improve documentation on the nbdtab file * Minor improvements to some error messages * Improvements to test suite so it works better on non-GNU userland environments - Update to version 1.17.0: * proto: add xNBD command NBD_CMD_CACHE to the spec * server: do not crash when handling child name * server: Close socket pair when fork fails Patch Instructions: To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 15.4: zypper in -t patch openSUSE-SLE-15.4-2022-1276=1 - openSUSE Leap 15.3: zypper in -t patch openSUSE-SLE-15.3-2022-1276=1 Package List: - openSUSE Leap 15.4 (aarch64 ppc64le s390x x86_64): nbd-3.24-150000.3.3.1 nbd-debuginfo-3.24-150000.3.3.1 nbd-debugsource-3.24-150000.3.3.1 - openSUSE Leap 15.3 (aarch64 ppc64le s390x x86_64): nbd-3.24-150000.3.3.1 nbd-debuginfo-3.24-150000.3.3.1 nbd-debugsource-3.24-150000.3.3.1 References: https://www.suse.com/security/cve/CVE-2022-26495.html https://www.suse.com/security/cve/CVE-2022-26496.html https://bugzilla.suse.com/1196827 https://bugzilla.suse.com/1196828

1 0

SUSE-SU-2022:1265-1: important: Security update for jsoup, jsr-305
by opensuse-security＠opensuse.org 19 Apr '22

19 Apr '22

SUSE Security Update: Security update for jsoup, jsr-305 ______________________________________________________________________________ Announcement ID: SUSE-SU-2022:1265-1 Rating: important References: #1189749 Cross-References: CVE-2021-37714 CVSS scores: CVE-2021-37714 (NVD) : 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H CVE-2021-37714 (SUSE): 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H Affected Products: SUSE Enterprise Storage 7 SUSE Linux Enterprise Desktop 15-SP3 SUSE Linux Enterprise Desktop 15-SP4 SUSE Linux Enterprise High Performance Computing 15-SP2-ESPOS SUSE Linux Enterprise High Performance Computing 15-SP2-LTSS SUSE Linux Enterprise High Performance Computing 15-SP3 SUSE Linux Enterprise High Performance Computing 15-SP4 SUSE Linux Enterprise Module for Development Tools 15-SP3 SUSE Linux Enterprise Module for Development Tools 15-SP4 SUSE Linux Enterprise Realtime Extension 15-SP2 SUSE Linux Enterprise Server 15-SP2-BCL SUSE Linux Enterprise Server 15-SP2-LTSS SUSE Linux Enterprise Server 15-SP3 SUSE Linux Enterprise Server 15-SP4 SUSE Linux Enterprise Server for SAP 15-SP2 SUSE Linux Enterprise Server for SAP Applications 15-SP3 SUSE Linux Enterprise Server for SAP Applications 15-SP4 SUSE Manager Proxy 4.1 SUSE Manager Proxy 4.2 SUSE Manager Retail Branch Server 4.1 SUSE Manager Server 4.1 SUSE Manager Server 4.2 openSUSE Leap 15.3 openSUSE Leap 15.4 ______________________________________________________________________________ An update that fixes one vulnerability is now available. Description: This update for jsoup, jsr-305 fixes the following issues: - CVE-2021-37714: Fixed infinite in untrusted HTML or XML data parsing (bsc#1189749). Changes in jsr-305: - Build with java source and target levels 8 - Upgrade to upstream version 3.0.2 Changes in jsoup: - Upgrade to upstream version 1.14.2 - Generate tarball using source service instead of a script Patch Instructions: To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 15.4: zypper in -t patch openSUSE-SLE-15.4-2022-1265=1 - openSUSE Leap 15.3: zypper in -t patch openSUSE-SLE-15.3-2022-1265=1 - SUSE Manager Server 4.1: zypper in -t patch SUSE-SLE-Product-SUSE-Manager-Server-4.1-2022-1265=1 - SUSE Manager Retail Branch Server 4.1: zypper in -t patch SUSE-SLE-Product-SUSE-Manager-Retail-Branch-Server-4.1-2022-1265=1 - SUSE Manager Proxy 4.1: zypper in -t patch SUSE-SLE-Product-SUSE-Manager-Proxy-4.1-2022-1265=1 - SUSE Linux Enterprise Server for SAP 15-SP2: zypper in -t patch SUSE-SLE-Product-SLES_SAP-15-SP2-2022-1265=1 - SUSE Linux Enterprise Server 15-SP2-LTSS: zypper in -t patch SUSE-SLE-Product-SLES-15-SP2-LTSS-2022-1265=1 - SUSE Linux Enterprise Server 15-SP2-BCL: zypper in -t patch SUSE-SLE-Product-SLES-15-SP2-BCL-2022-1265=1 - SUSE Linux Enterprise Realtime Extension 15-SP2: zypper in -t patch SUSE-SLE-Product-RT-15-SP2-2022-1265=1 - SUSE Linux Enterprise Module for Development Tools 15-SP4: zypper in -t patch SUSE-SLE-Module-Development-Tools-15-SP4-2022-1265=1 - SUSE Linux Enterprise Module for Development Tools 15-SP3: zypper in -t patch SUSE-SLE-Module-Development-Tools-15-SP3-2022-1265=1 - SUSE Linux Enterprise High Performance Computing 15-SP2-LTSS: zypper in -t patch SUSE-SLE-Product-HPC-15-SP2-LTSS-2022-1265=1 - SUSE Linux Enterprise High Performance Computing 15-SP2-ESPOS: zypper in -t patch SUSE-SLE-Product-HPC-15-SP2-ESPOS-2022-1265=1 - SUSE Enterprise Storage 7: zypper in -t patch SUSE-Storage-7-2022-1265=1 Package List: - openSUSE Leap 15.4 (noarch): jsoup-1.14.2-150200.3.3.1 jsoup-javadoc-1.14.2-150200.3.3.1 jsr-305-3.0.2-150200.3.3.1 jsr-305-javadoc-3.0.2-150200.3.3.1 - openSUSE Leap 15.3 (noarch): jsoup-1.14.2-150200.3.3.1 jsoup-javadoc-1.14.2-150200.3.3.1 jsr-305-3.0.2-150200.3.3.1 jsr-305-javadoc-3.0.2-150200.3.3.1 - SUSE Manager Server 4.1 (noarch): jsoup-1.14.2-150200.3.3.1 jsr-305-3.0.2-150200.3.3.1 - SUSE Manager Retail Branch Server 4.1 (noarch): jsoup-1.14.2-150200.3.3.1 jsr-305-3.0.2-150200.3.3.1 - SUSE Manager Proxy 4.1 (noarch): jsoup-1.14.2-150200.3.3.1 jsr-305-3.0.2-150200.3.3.1 - SUSE Linux Enterprise Server for SAP 15-SP2 (noarch): jsoup-1.14.2-150200.3.3.1 jsr-305-3.0.2-150200.3.3.1 - SUSE Linux Enterprise Server 15-SP2-LTSS (noarch): jsoup-1.14.2-150200.3.3.1 jsr-305-3.0.2-150200.3.3.1 - SUSE Linux Enterprise Server 15-SP2-BCL (noarch): jsoup-1.14.2-150200.3.3.1 jsr-305-3.0.2-150200.3.3.1 - SUSE Linux Enterprise Realtime Extension 15-SP2 (noarch): jsoup-1.14.2-150200.3.3.1 jsr-305-3.0.2-150200.3.3.1 - SUSE Linux Enterprise Module for Development Tools 15-SP4 (noarch): jsoup-1.14.2-150200.3.3.1 jsr-305-3.0.2-150200.3.3.1 - SUSE Linux Enterprise Module for Development Tools 15-SP3 (noarch): jsoup-1.14.2-150200.3.3.1 jsr-305-3.0.2-150200.3.3.1 - SUSE Linux Enterprise High Performance Computing 15-SP2-LTSS (noarch): jsoup-1.14.2-150200.3.3.1 jsr-305-3.0.2-150200.3.3.1 - SUSE Linux Enterprise High Performance Computing 15-SP2-ESPOS (noarch): jsoup-1.14.2-150200.3.3.1 jsr-305-3.0.2-150200.3.3.1 - SUSE Enterprise Storage 7 (noarch): jsoup-1.14.2-150200.3.3.1 jsr-305-3.0.2-150200.3.3.1 References: https://www.suse.com/security/cve/CVE-2021-37714.html https://bugzilla.suse.com/1189749

1 0

SUSE-SU-2022:1256-1: important: Security update for the Linux Kernel
by opensuse-security＠opensuse.org 19 Apr '22

19 Apr '22

SUSE Security Update: Security update for the Linux Kernel ______________________________________________________________________________ Announcement ID: SUSE-SU-2022:1256-1 Rating: important References: #1189562 #1193738 #1194943 #1195051 #1195254 #1195353 #1196018 #1196114 #1196433 #1196468 #1196488 #1196514 #1196639 #1196761 #1196830 #1196836 #1196942 #1196973 #1197227 #1197331 #1197366 #1197391 #1198031 #1198032 #1198033 SLE-18234 SLE-23652 Cross-References: CVE-2021-39713 CVE-2021-45868 CVE-2022-0812 CVE-2022-0850 CVE-2022-1016 CVE-2022-1048 CVE-2022-23036 CVE-2022-23037 CVE-2022-23038 CVE-2022-23039 CVE-2022-23040 CVE-2022-23041 CVE-2022-23042 CVE-2022-26490 CVE-2022-26966 CVE-2022-28356 CVE-2022-28388 CVE-2022-28389 CVE-2022-28390 CVSS scores: CVE-2021-39713 (NVD) : 9.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H CVE-2021-39713 (SUSE): 7.4 CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H CVE-2021-45868 (NVD) : 5.5 CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H CVE-2021-45868 (SUSE): 5.1 CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H CVE-2022-0812 (SUSE): 6.5 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N CVE-2022-0850 (SUSE): 4.4 CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:L CVE-2022-1016 (SUSE): 5.5 CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N CVE-2022-1048 (SUSE): 7.4 CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H CVE-2022-23036 (NVD) : 7 CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H CVE-2022-23036 (SUSE): 7.5 CVSS:3.1/AV:L/AC:H/PR:H/UI:N/S:C/C:H/I:H/A:H CVE-2022-23037 (NVD) : 7 CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H CVE-2022-23037 (SUSE): 7.5 CVSS:3.1/AV:L/AC:H/PR:H/UI:N/S:C/C:H/I:H/A:H CVE-2022-23038 (NVD) : 7 CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H CVE-2022-23038 (SUSE): 7.5 CVSS:3.1/AV:L/AC:H/PR:H/UI:N/S:C/C:H/I:H/A:H CVE-2022-23039 (NVD) : 7 CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H CVE-2022-23039 (SUSE): 7.5 CVSS:3.1/AV:L/AC:H/PR:H/UI:N/S:C/C:H/I:H/A:H CVE-2022-23040 (NVD) : 7 CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H CVE-2022-23040 (SUSE): 7.5 CVSS:3.1/AV:L/AC:H/PR:H/UI:N/S:C/C:H/I:H/A:H CVE-2022-23041 (NVD) : 7 CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H CVE-2022-23041 (SUSE): 7.5 CVSS:3.1/AV:L/AC:H/PR:H/UI:N/S:C/C:H/I:H/A:H CVE-2022-23042 (NVD) : 7 CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H CVE-2022-23042 (SUSE): 7.5 CVSS:3.1/AV:L/AC:H/PR:H/UI:N/S:C/C:H/I:H/A:H CVE-2022-26490 (NVD) : 7.8 CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H CVE-2022-26490 (SUSE): 6.8 CVSS:3.1/AV:A/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:H CVE-2022-26966 (NVD) : 5.5 CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N CVE-2022-26966 (SUSE): 4.6 CVSS:3.1/AV:P/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N CVE-2022-28356 (NVD) : 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H CVE-2022-28356 (SUSE): 5.5 CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H CVE-2022-28388 (NVD) : 7.8 CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H CVE-2022-28388 (SUSE): 5.3 CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:L CVE-2022-28389 (NVD) : 7.8 CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H CVE-2022-28389 (SUSE): 5.3 CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:L CVE-2022-28390 (NVD) : 7.8 CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H CVE-2022-28390 (SUSE): 5.3 CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:L Affected Products: SUSE CaaS Platform 4.0 SUSE Enterprise Storage 6 SUSE Linux Enterprise High Availability 15-SP1 SUSE Linux Enterprise High Performance Computing 15-SP1 SUSE Linux Enterprise High Performance Computing 15-SP1-ESPOS SUSE Linux Enterprise High Performance Computing 15-SP1-LTSS SUSE Linux Enterprise Module for Live Patching 15-SP1 SUSE Linux Enterprise Server 15-SP1 SUSE Linux Enterprise Server 15-SP1-BCL SUSE Linux Enterprise Server 15-SP1-LTSS SUSE Linux Enterprise Server for SAP 15-SP1 SUSE Linux Enterprise Server for SAP Applications 15-SP1 SUSE Manager Proxy 4.0 SUSE Manager Retail Branch Server 4.0 SUSE Manager Server 4.0 openSUSE Leap 15.3 openSUSE Leap 15.4 ______________________________________________________________________________ An update that solves 19 vulnerabilities, contains two features and has 6 fixes is now available. Description: The SUSE Linux Enterprise 15 SP1 kernel was updated to receive various security and bugfixes. The following security bugs were fixed: - CVE-2022-28356: Fixed a refcount leak bug in net/llc/af_llc.c (bnc#1197391). - CVE-2022-1016: Fixed a vulnerability in the nf_tables component of the netfilter subsystem. This vulnerability gives an attacker a powerful primitive that can be used to both read from and write to relative stack data, which can lead to arbitrary code execution (bsc#1197227). - CVE-2022-28388: Fixed a double free in drivers/net/can/usb/usb_8dev.c vulnerability in the Linux kernel (bnc#1198032). - CVE-2022-28389: Fixed a double free in drivers/net/can/usb/mcba_usb.c vulnerability in the Linux kernel (bnc#1198033). - CVE-2022-28390: Fixed a double free in drivers/net/can/usb/ems_usb.c vulnerability in the Linux kernel (bnc#1198031). - CVE-2022-0812: Fixed an incorrect header size calculations in xprtrdma (bsc#1196639). - CVE-2022-1048: Fixed a race Condition in snd_pcm_hw_free leading to use-after-free due to the AB/BA lock with buffer_mutex and mmap_lock (bsc#1197331). - CVE-2022-0850: Fixed a kernel information leak vulnerability in iov_iter.c (bsc#1196761). - CVE-2022-26966: Fixed an issue in drivers/net/usb/sr9700.c, which allowed attackers to obtain sensitive information from the memory via crafted frame lengths from a USB device (bsc#1196836). - CVE-2021-45868: Fixed a wrong validation check in fs/quota/quota_tree.c which could lead to an use-after-free if there is a corrupted quota file (bnc#1197366). - CVE-2021-39713: Fixed a race condition in the network scheduling subsystem which could lead to a use-after-free (bsc#1196973). - CVE-2022-23036,CVE-2022-23037,CVE-2022-23038,CVE-2022-23039,CVE-2022-23040, CVE-2022-23041,CVE-2022-23042: Fixed multiple issues which could have lead to read/write access to memory pages or denial of service. These issues are related to the Xen PV device frontend drivers (bsc#1196488). - CVE-2022-26490: Fixed a buffer overflow in the st21nfca driver. An attacker with adjacent NFC access could trigger crash the system or corrupt system memory (bsc#1196830). The following non-security bugs were fixed: - ax88179_178a: Fixed memory issues that could be triggered by malicious USB devices (bsc#1196018). - genirq: Use rcu in kstat_irqs_usr() (bsc#1193738). - gve/net: Fixed multiple bugfixes (jsc#SLE-23652). - net/mlx5e: Fix page DMA map/unmap attributes (bsc#1196468). - net: tipc: validate domain record count on input (bsc#1195254). - powerpc: Fixed issues related to slow I/O on PowerPC (bsc#1196433). Special Instructions and Notes: Please reboot the system after installing this update. Patch Instructions: To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 15.4: zypper in -t patch openSUSE-SLE-15.4-2022-1256=1 - openSUSE Leap 15.3: zypper in -t patch openSUSE-SLE-15.3-2022-1256=1 - SUSE Linux Enterprise Server for SAP 15-SP1: zypper in -t patch SUSE-SLE-Product-SLES_SAP-15-SP1-2022-1256=1 - SUSE Linux Enterprise Server 15-SP1-LTSS: zypper in -t patch SUSE-SLE-Product-SLES-15-SP1-LTSS-2022-1256=1 - SUSE Linux Enterprise Server 15-SP1-BCL: zypper in -t patch SUSE-SLE-Product-SLES-15-SP1-BCL-2022-1256=1 - SUSE Linux Enterprise Module for Live Patching 15-SP1: zypper in -t patch SUSE-SLE-Module-Live-Patching-15-SP1-2022-1256=1 - SUSE Linux Enterprise High Performance Computing 15-SP1-LTSS: zypper in -t patch SUSE-SLE-Product-HPC-15-SP1-LTSS-2022-1256=1 - SUSE Linux Enterprise High Performance Computing 15-SP1-ESPOS: zypper in -t patch SUSE-SLE-Product-HPC-15-SP1-ESPOS-2022-1256=1 - SUSE Linux Enterprise High Availability 15-SP1: zypper in -t patch SUSE-SLE-Product-HA-15-SP1-2022-1256=1 - SUSE Enterprise Storage 6: zypper in -t patch SUSE-Storage-6-2022-1256=1 - SUSE CaaS Platform 4.0: To install this update, use the SUSE CaaS Platform 'skuba' tool. It will inform you if it detects new updates and let you then trigger updating of the complete cluster in a controlled way. Package List: - openSUSE Leap 15.4 (aarch64 ppc64le s390x x86_64): kernel-default-base-debuginfo-4.12.14-150100.197.111.1 kernel-vanilla-4.12.14-150100.197.111.1 kernel-vanilla-base-4.12.14-150100.197.111.1 kernel-vanilla-base-debuginfo-4.12.14-150100.197.111.1 kernel-vanilla-debuginfo-4.12.14-150100.197.111.1 kernel-vanilla-debugsource-4.12.14-150100.197.111.1 kernel-vanilla-devel-4.12.14-150100.197.111.1 kernel-vanilla-devel-debuginfo-4.12.14-150100.197.111.1 kernel-vanilla-livepatch-devel-4.12.14-150100.197.111.1 - openSUSE Leap 15.4 (ppc64le x86_64): kernel-debug-base-4.12.14-150100.197.111.1 kernel-debug-base-debuginfo-4.12.14-150100.197.111.1 - openSUSE Leap 15.4 (x86_64): kernel-kvmsmall-base-4.12.14-150100.197.111.1 kernel-kvmsmall-base-debuginfo-4.12.14-150100.197.111.1 - openSUSE Leap 15.4 (s390x): kernel-default-man-4.12.14-150100.197.111.1 kernel-zfcpdump-man-4.12.14-150100.197.111.1 - openSUSE Leap 15.3 (aarch64 ppc64le s390x x86_64): kernel-default-base-debuginfo-4.12.14-150100.197.111.1 kernel-vanilla-4.12.14-150100.197.111.1 kernel-vanilla-base-4.12.14-150100.197.111.1 kernel-vanilla-base-debuginfo-4.12.14-150100.197.111.1 kernel-vanilla-debuginfo-4.12.14-150100.197.111.1 kernel-vanilla-debugsource-4.12.14-150100.197.111.1 kernel-vanilla-devel-4.12.14-150100.197.111.1 kernel-vanilla-devel-debuginfo-4.12.14-150100.197.111.1 kernel-vanilla-livepatch-devel-4.12.14-150100.197.111.1 - openSUSE Leap 15.3 (ppc64le x86_64): kernel-debug-base-4.12.14-150100.197.111.1 kernel-debug-base-debuginfo-4.12.14-150100.197.111.1 - openSUSE Leap 15.3 (x86_64): kernel-kvmsmall-base-4.12.14-150100.197.111.1 kernel-kvmsmall-base-debuginfo-4.12.14-150100.197.111.1 - openSUSE Leap 15.3 (s390x): kernel-default-man-4.12.14-150100.197.111.1 kernel-zfcpdump-man-4.12.14-150100.197.111.1 - SUSE Linux Enterprise Server for SAP 15-SP1 (ppc64le x86_64): kernel-default-4.12.14-150100.197.111.1 kernel-default-base-4.12.14-150100.197.111.1 kernel-default-base-debuginfo-4.12.14-150100.197.111.1 kernel-default-debuginfo-4.12.14-150100.197.111.1 kernel-default-debugsource-4.12.14-150100.197.111.1 kernel-default-devel-4.12.14-150100.197.111.1 kernel-default-devel-debuginfo-4.12.14-150100.197.111.1 kernel-obs-build-4.12.14-150100.197.111.1 kernel-obs-build-debugsource-4.12.14-150100.197.111.1 kernel-syms-4.12.14-150100.197.111.1 reiserfs-kmp-default-4.12.14-150100.197.111.1 reiserfs-kmp-default-debuginfo-4.12.14-150100.197.111.1 - SUSE Linux Enterprise Server for SAP 15-SP1 (noarch): kernel-devel-4.12.14-150100.197.111.1 kernel-docs-4.12.14-150100.197.111.1 kernel-macros-4.12.14-150100.197.111.1 kernel-source-4.12.14-150100.197.111.1 - SUSE Linux Enterprise Server 15-SP1-LTSS (aarch64 ppc64le s390x x86_64): kernel-default-4.12.14-150100.197.111.1 kernel-default-base-4.12.14-150100.197.111.1 kernel-default-base-debuginfo-4.12.14-150100.197.111.1 kernel-default-debuginfo-4.12.14-150100.197.111.1 kernel-default-debugsource-4.12.14-150100.197.111.1 kernel-default-devel-4.12.14-150100.197.111.1 kernel-default-devel-debuginfo-4.12.14-150100.197.111.1 kernel-obs-build-4.12.14-150100.197.111.1 kernel-obs-build-debugsource-4.12.14-150100.197.111.1 kernel-syms-4.12.14-150100.197.111.1 reiserfs-kmp-default-4.12.14-150100.197.111.1 reiserfs-kmp-default-debuginfo-4.12.14-150100.197.111.1 - SUSE Linux Enterprise Server 15-SP1-LTSS (noarch): kernel-devel-4.12.14-150100.197.111.1 kernel-docs-4.12.14-150100.197.111.1 kernel-macros-4.12.14-150100.197.111.1 kernel-source-4.12.14-150100.197.111.1 - SUSE Linux Enterprise Server 15-SP1-LTSS (s390x): kernel-default-man-4.12.14-150100.197.111.1 kernel-zfcpdump-debuginfo-4.12.14-150100.197.111.1 kernel-zfcpdump-debugsource-4.12.14-150100.197.111.1 - SUSE Linux Enterprise Server 15-SP1-BCL (noarch): kernel-devel-4.12.14-150100.197.111.1 kernel-docs-4.12.14-150100.197.111.1 kernel-macros-4.12.14-150100.197.111.1 kernel-source-4.12.14-150100.197.111.1 - SUSE Linux Enterprise Server 15-SP1-BCL (x86_64): kernel-default-4.12.14-150100.197.111.1 kernel-default-base-4.12.14-150100.197.111.1 kernel-default-base-debuginfo-4.12.14-150100.197.111.1 kernel-default-debuginfo-4.12.14-150100.197.111.1 kernel-default-debugsource-4.12.14-150100.197.111.1 kernel-default-devel-4.12.14-150100.197.111.1 kernel-default-devel-debuginfo-4.12.14-150100.197.111.1 kernel-obs-build-4.12.14-150100.197.111.1 kernel-obs-build-debugsource-4.12.14-150100.197.111.1 kernel-syms-4.12.14-150100.197.111.1 reiserfs-kmp-default-4.12.14-150100.197.111.1 reiserfs-kmp-default-debuginfo-4.12.14-150100.197.111.1 - SUSE Linux Enterprise Module for Live Patching 15-SP1 (ppc64le x86_64): kernel-default-debuginfo-4.12.14-150100.197.111.1 kernel-default-debugsource-4.12.14-150100.197.111.1 kernel-default-livepatch-4.12.14-150100.197.111.1 kernel-default-livepatch-devel-4.12.14-150100.197.111.1 kernel-livepatch-4_12_14-150100_197_111-default-1-150100.3.3.1 - SUSE Linux Enterprise High Performance Computing 15-SP1-LTSS (aarch64 x86_64): kernel-default-4.12.14-150100.197.111.1 kernel-default-base-4.12.14-150100.197.111.1 kernel-default-base-debuginfo-4.12.14-150100.197.111.1 kernel-default-debuginfo-4.12.14-150100.197.111.1 kernel-default-debugsource-4.12.14-150100.197.111.1 kernel-default-devel-4.12.14-150100.197.111.1 kernel-default-devel-debuginfo-4.12.14-150100.197.111.1 kernel-obs-build-4.12.14-150100.197.111.1 kernel-obs-build-debugsource-4.12.14-150100.197.111.1 kernel-syms-4.12.14-150100.197.111.1 - SUSE Linux Enterprise High Performance Computing 15-SP1-LTSS (noarch): kernel-devel-4.12.14-150100.197.111.1 kernel-docs-4.12.14-150100.197.111.1 kernel-macros-4.12.14-150100.197.111.1 kernel-source-4.12.14-150100.197.111.1 - SUSE Linux Enterprise High Performance Computing 15-SP1-ESPOS (aarch64 x86_64): kernel-default-4.12.14-150100.197.111.1 kernel-default-base-4.12.14-150100.197.111.1 kernel-default-base-debuginfo-4.12.14-150100.197.111.1 kernel-default-debuginfo-4.12.14-150100.197.111.1 kernel-default-debugsource-4.12.14-150100.197.111.1 kernel-default-devel-4.12.14-150100.197.111.1 kernel-default-devel-debuginfo-4.12.14-150100.197.111.1 kernel-obs-build-4.12.14-150100.197.111.1 kernel-obs-build-debugsource-4.12.14-150100.197.111.1 kernel-syms-4.12.14-150100.197.111.1 - SUSE Linux Enterprise High Performance Computing 15-SP1-ESPOS (noarch): kernel-devel-4.12.14-150100.197.111.1 kernel-docs-4.12.14-150100.197.111.1 kernel-macros-4.12.14-150100.197.111.1 kernel-source-4.12.14-150100.197.111.1 - SUSE Linux Enterprise High Availability 15-SP1 (aarch64 ppc64le s390x x86_64): cluster-md-kmp-default-4.12.14-150100.197.111.1 cluster-md-kmp-default-debuginfo-4.12.14-150100.197.111.1 dlm-kmp-default-4.12.14-150100.197.111.1 dlm-kmp-default-debuginfo-4.12.14-150100.197.111.1 gfs2-kmp-default-4.12.14-150100.197.111.1 gfs2-kmp-default-debuginfo-4.12.14-150100.197.111.1 kernel-default-debuginfo-4.12.14-150100.197.111.1 kernel-default-debugsource-4.12.14-150100.197.111.1 ocfs2-kmp-default-4.12.14-150100.197.111.1 ocfs2-kmp-default-debuginfo-4.12.14-150100.197.111.1 - SUSE Enterprise Storage 6 (aarch64 x86_64): kernel-default-4.12.14-150100.197.111.1 kernel-default-base-4.12.14-150100.197.111.1 kernel-default-base-debuginfo-4.12.14-150100.197.111.1 kernel-default-debuginfo-4.12.14-150100.197.111.1 kernel-default-debugsource-4.12.14-150100.197.111.1 kernel-default-devel-4.12.14-150100.197.111.1 kernel-default-devel-debuginfo-4.12.14-150100.197.111.1 kernel-obs-build-4.12.14-150100.197.111.1 kernel-obs-build-debugsource-4.12.14-150100.197.111.1 kernel-syms-4.12.14-150100.197.111.1 reiserfs-kmp-default-4.12.14-150100.197.111.1 reiserfs-kmp-default-debuginfo-4.12.14-150100.197.111.1 - SUSE Enterprise Storage 6 (noarch): kernel-devel-4.12.14-150100.197.111.1 kernel-docs-4.12.14-150100.197.111.1 kernel-macros-4.12.14-150100.197.111.1 kernel-source-4.12.14-150100.197.111.1 - SUSE CaaS Platform 4.0 (noarch): kernel-devel-4.12.14-150100.197.111.1 kernel-docs-4.12.14-150100.197.111.1 kernel-macros-4.12.14-150100.197.111.1 kernel-source-4.12.14-150100.197.111.1 - SUSE CaaS Platform 4.0 (x86_64): kernel-default-4.12.14-150100.197.111.1 kernel-default-base-4.12.14-150100.197.111.1 kernel-default-base-debuginfo-4.12.14-150100.197.111.1 kernel-default-debuginfo-4.12.14-150100.197.111.1 kernel-default-debugsource-4.12.14-150100.197.111.1 kernel-default-devel-4.12.14-150100.197.111.1 kernel-default-devel-debuginfo-4.12.14-150100.197.111.1 kernel-obs-build-4.12.14-150100.197.111.1 kernel-obs-build-debugsource-4.12.14-150100.197.111.1 kernel-syms-4.12.14-150100.197.111.1 reiserfs-kmp-default-4.12.14-150100.197.111.1 reiserfs-kmp-default-debuginfo-4.12.14-150100.197.111.1 References: https://www.suse.com/security/cve/CVE-2021-39713.html https://www.suse.com/security/cve/CVE-2021-45868.html https://www.suse.com/security/cve/CVE-2022-0812.html https://www.suse.com/security/cve/CVE-2022-0850.html https://www.suse.com/security/cve/CVE-2022-1016.html https://www.suse.com/security/cve/CVE-2022-1048.html https://www.suse.com/security/cve/CVE-2022-23036.html https://www.suse.com/security/cve/CVE-2022-23037.html https://www.suse.com/security/cve/CVE-2022-23038.html https://www.suse.com/security/cve/CVE-2022-23039.html https://www.suse.com/security/cve/CVE-2022-23040.html https://www.suse.com/security/cve/CVE-2022-23041.html https://www.suse.com/security/cve/CVE-2022-23042.html https://www.suse.com/security/cve/CVE-2022-26490.html https://www.suse.com/security/cve/CVE-2022-26966.html https://www.suse.com/security/cve/CVE-2022-28356.html https://www.suse.com/security/cve/CVE-2022-28388.html https://www.suse.com/security/cve/CVE-2022-28389.html https://www.suse.com/security/cve/CVE-2022-28390.html https://bugzilla.suse.com/1189562 https://bugzilla.suse.com/1193738 https://bugzilla.suse.com/1194943 https://bugzilla.suse.com/1195051 https://bugzilla.suse.com/1195254 https://bugzilla.suse.com/1195353 https://bugzilla.suse.com/1196018 https://bugzilla.suse.com/1196114 https://bugzilla.suse.com/1196433 https://bugzilla.suse.com/1196468 https://bugzilla.suse.com/1196488 https://bugzilla.suse.com/1196514 https://bugzilla.suse.com/1196639 https://bugzilla.suse.com/1196761 https://bugzilla.suse.com/1196830 https://bugzilla.suse.com/1196836 https://bugzilla.suse.com/1196942 https://bugzilla.suse.com/1196973 https://bugzilla.suse.com/1197227 https://bugzilla.suse.com/1197331 https://bugzilla.suse.com/1197366 https://bugzilla.suse.com/1197391 https://bugzilla.suse.com/1198031 https://bugzilla.suse.com/1198032 https://bugzilla.suse.com/1198033

1 0

SUSE-SU-2022:1260-1: important: Security update for git
by opensuse-security＠opensuse.org 19 Apr '22

19 Apr '22

SUSE Security Update: Security update for git ______________________________________________________________________________ Announcement ID: SUSE-SU-2022:1260-1 Rating: important References: #1198234 Cross-References: CVE-2022-24765 CVSS scores: CVE-2022-24765 (SUSE): 7.3 CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H Affected Products: SUSE CaaS Platform 4.0 SUSE Enterprise Storage 6 SUSE Enterprise Storage 7 SUSE Linux Enterprise High Performance Computing 15-ESPOS SUSE Linux Enterprise High Performance Computing 15-LTSS SUSE Linux Enterprise High Performance Computing 15-SP1-ESPOS SUSE Linux Enterprise High Performance Computing 15-SP1-LTSS SUSE Linux Enterprise High Performance Computing 15-SP2-ESPOS SUSE Linux Enterprise High Performance Computing 15-SP2-LTSS SUSE Linux Enterprise Realtime Extension 15-SP2 SUSE Linux Enterprise Server 15-LTSS SUSE Linux Enterprise Server 15-SP1-BCL SUSE Linux Enterprise Server 15-SP1-LTSS SUSE Linux Enterprise Server 15-SP2-BCL SUSE Linux Enterprise Server 15-SP2-LTSS SUSE Linux Enterprise Server for SAP 15 SUSE Linux Enterprise Server for SAP 15-SP1 SUSE Linux Enterprise Server for SAP 15-SP2 SUSE Manager Proxy 4.1 SUSE Manager Retail Branch Server 4.1 SUSE Manager Server 4.1 openSUSE Leap 15.3 openSUSE Leap 15.4 ______________________________________________________________________________ An update that fixes one vulnerability is now available. Description: This update for git fixes the following issues: - CVE-2022-24765: Fixed a potential command injection via git worktree (bsc#1198234). Patch Instructions: To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 15.4: zypper in -t patch openSUSE-SLE-15.4-2022-1260=1 - openSUSE Leap 15.3: zypper in -t patch openSUSE-SLE-15.3-2022-1260=1 - SUSE Manager Server 4.1: zypper in -t patch SUSE-SLE-Product-SUSE-Manager-Server-4.1-2022-1260=1 - SUSE Manager Retail Branch Server 4.1: zypper in -t patch SUSE-SLE-Product-SUSE-Manager-Retail-Branch-Server-4.1-2022-1260=1 - SUSE Manager Proxy 4.1: zypper in -t patch SUSE-SLE-Product-SUSE-Manager-Proxy-4.1-2022-1260=1 - SUSE Linux Enterprise Server for SAP 15-SP2: zypper in -t patch SUSE-SLE-Product-SLES_SAP-15-SP2-2022-1260=1 - SUSE Linux Enterprise Server for SAP 15-SP1: zypper in -t patch SUSE-SLE-Product-SLES_SAP-15-SP1-2022-1260=1 - SUSE Linux Enterprise Server for SAP 15: zypper in -t patch SUSE-SLE-Product-SLES_SAP-15-2022-1260=1 - SUSE Linux Enterprise Server 15-SP2-LTSS: zypper in -t patch SUSE-SLE-Product-SLES-15-SP2-LTSS-2022-1260=1 - SUSE Linux Enterprise Server 15-SP2-BCL: zypper in -t patch SUSE-SLE-Product-SLES-15-SP2-BCL-2022-1260=1 - SUSE Linux Enterprise Server 15-SP1-LTSS: zypper in -t patch SUSE-SLE-Product-SLES-15-SP1-LTSS-2022-1260=1 - SUSE Linux Enterprise Server 15-SP1-BCL: zypper in -t patch SUSE-SLE-Product-SLES-15-SP1-BCL-2022-1260=1 - SUSE Linux Enterprise Server 15-LTSS: zypper in -t patch SUSE-SLE-Product-SLES-15-2022-1260=1 - SUSE Linux Enterprise Realtime Extension 15-SP2: zypper in -t patch SUSE-SLE-Product-RT-15-SP2-2022-1260=1 - SUSE Linux Enterprise High Performance Computing 15-SP2-LTSS: zypper in -t patch SUSE-SLE-Product-HPC-15-SP2-LTSS-2022-1260=1 - SUSE Linux Enterprise High Performance Computing 15-SP2-ESPOS: zypper in -t patch SUSE-SLE-Product-HPC-15-SP2-ESPOS-2022-1260=1 - SUSE Linux Enterprise High Performance Computing 15-SP1-LTSS: zypper in -t patch SUSE-SLE-Product-HPC-15-SP1-LTSS-2022-1260=1 - SUSE Linux Enterprise High Performance Computing 15-SP1-ESPOS: zypper in -t patch SUSE-SLE-Product-HPC-15-SP1-ESPOS-2022-1260=1 - SUSE Linux Enterprise High Performance Computing 15-LTSS: zypper in -t patch SUSE-SLE-Product-HPC-15-2022-1260=1 - SUSE Linux Enterprise High Performance Computing 15-ESPOS: zypper in -t patch SUSE-SLE-Product-HPC-15-2022-1260=1 - SUSE Enterprise Storage 7: zypper in -t patch SUSE-Storage-7-2022-1260=1 - SUSE Enterprise Storage 6: zypper in -t patch SUSE-Storage-6-2022-1260=1 - SUSE CaaS Platform 4.0: To install this update, use the SUSE CaaS Platform 'skuba' tool. It will inform you if it detects new updates and let you then trigger updating of the complete cluster in a controlled way. Package List: - openSUSE Leap 15.4 (aarch64 ppc64le s390x x86_64): git-svn-debuginfo-2.26.2-150000.36.1 - openSUSE Leap 15.3 (aarch64 ppc64le s390x x86_64): git-svn-debuginfo-2.26.2-150000.36.1 - SUSE Manager Server 4.1 (ppc64le s390x x86_64): git-2.26.2-150000.36.1 git-arch-2.26.2-150000.36.1 git-core-2.26.2-150000.36.1 git-core-debuginfo-2.26.2-150000.36.1 git-cvs-2.26.2-150000.36.1 git-daemon-2.26.2-150000.36.1 git-daemon-debuginfo-2.26.2-150000.36.1 git-debuginfo-2.26.2-150000.36.1 git-debugsource-2.26.2-150000.36.1 git-email-2.26.2-150000.36.1 git-gui-2.26.2-150000.36.1 git-svn-2.26.2-150000.36.1 git-svn-debuginfo-2.26.2-150000.36.1 git-web-2.26.2-150000.36.1 gitk-2.26.2-150000.36.1 - SUSE Manager Server 4.1 (noarch): git-doc-2.26.2-150000.36.1 - SUSE Manager Retail Branch Server 4.1 (x86_64): git-2.26.2-150000.36.1 git-arch-2.26.2-150000.36.1 git-core-2.26.2-150000.36.1 git-core-debuginfo-2.26.2-150000.36.1 git-cvs-2.26.2-150000.36.1 git-daemon-2.26.2-150000.36.1 git-daemon-debuginfo-2.26.2-150000.36.1 git-debuginfo-2.26.2-150000.36.1 git-debugsource-2.26.2-150000.36.1 git-email-2.26.2-150000.36.1 git-gui-2.26.2-150000.36.1 git-svn-2.26.2-150000.36.1 git-svn-debuginfo-2.26.2-150000.36.1 git-web-2.26.2-150000.36.1 gitk-2.26.2-150000.36.1 - SUSE Manager Retail Branch Server 4.1 (noarch): git-doc-2.26.2-150000.36.1 - SUSE Manager Proxy 4.1 (noarch): git-doc-2.26.2-150000.36.1 - SUSE Manager Proxy 4.1 (x86_64): git-2.26.2-150000.36.1 git-arch-2.26.2-150000.36.1 git-core-2.26.2-150000.36.1 git-core-debuginfo-2.26.2-150000.36.1 git-cvs-2.26.2-150000.36.1 git-daemon-2.26.2-150000.36.1 git-daemon-debuginfo-2.26.2-150000.36.1 git-debuginfo-2.26.2-150000.36.1 git-debugsource-2.26.2-150000.36.1 git-email-2.26.2-150000.36.1 git-gui-2.26.2-150000.36.1 git-svn-2.26.2-150000.36.1 git-svn-debuginfo-2.26.2-150000.36.1 git-web-2.26.2-150000.36.1 gitk-2.26.2-150000.36.1 - SUSE Linux Enterprise Server for SAP 15-SP2 (ppc64le x86_64): git-2.26.2-150000.36.1 git-arch-2.26.2-150000.36.1 git-core-2.26.2-150000.36.1 git-core-debuginfo-2.26.2-150000.36.1 git-cvs-2.26.2-150000.36.1 git-daemon-2.26.2-150000.36.1 git-daemon-debuginfo-2.26.2-150000.36.1 git-debuginfo-2.26.2-150000.36.1 git-debugsource-2.26.2-150000.36.1 git-email-2.26.2-150000.36.1 git-gui-2.26.2-150000.36.1 git-svn-2.26.2-150000.36.1 git-svn-debuginfo-2.26.2-150000.36.1 git-web-2.26.2-150000.36.1 gitk-2.26.2-150000.36.1 - SUSE Linux Enterprise Server for SAP 15-SP2 (noarch): git-doc-2.26.2-150000.36.1 - SUSE Linux Enterprise Server for SAP 15-SP1 (ppc64le x86_64): git-2.26.2-150000.36.1 git-arch-2.26.2-150000.36.1 git-core-2.26.2-150000.36.1 git-core-debuginfo-2.26.2-150000.36.1 git-cvs-2.26.2-150000.36.1 git-daemon-2.26.2-150000.36.1 git-daemon-debuginfo-2.26.2-150000.36.1 git-debuginfo-2.26.2-150000.36.1 git-debugsource-2.26.2-150000.36.1 git-email-2.26.2-150000.36.1 git-gui-2.26.2-150000.36.1 git-svn-2.26.2-150000.36.1 git-svn-debuginfo-2.26.2-150000.36.1 git-web-2.26.2-150000.36.1 gitk-2.26.2-150000.36.1 - SUSE Linux Enterprise Server for SAP 15-SP1 (noarch): git-doc-2.26.2-150000.36.1 - SUSE Linux Enterprise Server for SAP 15 (ppc64le x86_64): git-2.26.2-150000.36.1 git-arch-2.26.2-150000.36.1 git-core-2.26.2-150000.36.1 git-core-debuginfo-2.26.2-150000.36.1 git-cvs-2.26.2-150000.36.1 git-daemon-2.26.2-150000.36.1 git-daemon-debuginfo-2.26.2-150000.36.1 git-debuginfo-2.26.2-150000.36.1 git-debugsource-2.26.2-150000.36.1 git-email-2.26.2-150000.36.1 git-gui-2.26.2-150000.36.1 git-svn-2.26.2-150000.36.1 git-svn-debuginfo-2.26.2-150000.36.1 git-web-2.26.2-150000.36.1 gitk-2.26.2-150000.36.1 - SUSE Linux Enterprise Server for SAP 15 (noarch): git-doc-2.26.2-150000.36.1 - SUSE Linux Enterprise Server 15-SP2-LTSS (aarch64 ppc64le s390x x86_64): git-2.26.2-150000.36.1 git-arch-2.26.2-150000.36.1 git-core-2.26.2-150000.36.1 git-core-debuginfo-2.26.2-150000.36.1 git-cvs-2.26.2-150000.36.1 git-daemon-2.26.2-150000.36.1 git-daemon-debuginfo-2.26.2-150000.36.1 git-debuginfo-2.26.2-150000.36.1 git-debugsource-2.26.2-150000.36.1 git-email-2.26.2-150000.36.1 git-gui-2.26.2-150000.36.1 git-svn-2.26.2-150000.36.1 git-svn-debuginfo-2.26.2-150000.36.1 git-web-2.26.2-150000.36.1 gitk-2.26.2-150000.36.1 - SUSE Linux Enterprise Server 15-SP2-LTSS (noarch): git-doc-2.26.2-150000.36.1 - SUSE Linux Enterprise Server 15-SP2-BCL (x86_64): git-2.26.2-150000.36.1 git-arch-2.26.2-150000.36.1 git-core-2.26.2-150000.36.1 git-core-debuginfo-2.26.2-150000.36.1 git-cvs-2.26.2-150000.36.1 git-daemon-2.26.2-150000.36.1 git-daemon-debuginfo-2.26.2-150000.36.1 git-debuginfo-2.26.2-150000.36.1 git-debugsource-2.26.2-150000.36.1 git-email-2.26.2-150000.36.1 git-gui-2.26.2-150000.36.1 git-svn-2.26.2-150000.36.1 git-svn-debuginfo-2.26.2-150000.36.1 git-web-2.26.2-150000.36.1 gitk-2.26.2-150000.36.1 - SUSE Linux Enterprise Server 15-SP2-BCL (noarch): git-doc-2.26.2-150000.36.1 - SUSE Linux Enterprise Server 15-SP1-LTSS (aarch64 ppc64le s390x x86_64): git-2.26.2-150000.36.1 git-arch-2.26.2-150000.36.1 git-core-2.26.2-150000.36.1 git-core-debuginfo-2.26.2-150000.36.1 git-cvs-2.26.2-150000.36.1 git-daemon-2.26.2-150000.36.1 git-daemon-debuginfo-2.26.2-150000.36.1 git-debuginfo-2.26.2-150000.36.1 git-debugsource-2.26.2-150000.36.1 git-email-2.26.2-150000.36.1 git-gui-2.26.2-150000.36.1 git-svn-2.26.2-150000.36.1 git-svn-debuginfo-2.26.2-150000.36.1 git-web-2.26.2-150000.36.1 gitk-2.26.2-150000.36.1 - SUSE Linux Enterprise Server 15-SP1-LTSS (noarch): git-doc-2.26.2-150000.36.1 - SUSE Linux Enterprise Server 15-SP1-BCL (x86_64): git-2.26.2-150000.36.1 git-arch-2.26.2-150000.36.1 git-core-2.26.2-150000.36.1 git-core-debuginfo-2.26.2-150000.36.1 git-cvs-2.26.2-150000.36.1 git-daemon-2.26.2-150000.36.1 git-daemon-debuginfo-2.26.2-150000.36.1 git-debuginfo-2.26.2-150000.36.1 git-debugsource-2.26.2-150000.36.1 git-email-2.26.2-150000.36.1 git-gui-2.26.2-150000.36.1 git-svn-2.26.2-150000.36.1 git-svn-debuginfo-2.26.2-150000.36.1 git-web-2.26.2-150000.36.1 gitk-2.26.2-150000.36.1 - SUSE Linux Enterprise Server 15-SP1-BCL (noarch): git-doc-2.26.2-150000.36.1 - SUSE Linux Enterprise Server 15-LTSS (aarch64 s390x): git-2.26.2-150000.36.1 git-arch-2.26.2-150000.36.1 git-core-2.26.2-150000.36.1 git-core-debuginfo-2.26.2-150000.36.1 git-cvs-2.26.2-150000.36.1 git-daemon-2.26.2-150000.36.1 git-daemon-debuginfo-2.26.2-150000.36.1 git-debuginfo-2.26.2-150000.36.1 git-debugsource-2.26.2-150000.36.1 git-email-2.26.2-150000.36.1 git-gui-2.26.2-150000.36.1 git-svn-2.26.2-150000.36.1 git-svn-debuginfo-2.26.2-150000.36.1 git-web-2.26.2-150000.36.1 gitk-2.26.2-150000.36.1 - SUSE Linux Enterprise Server 15-LTSS (noarch): git-doc-2.26.2-150000.36.1 - SUSE Linux Enterprise Realtime Extension 15-SP2 (x86_64): git-2.26.2-150000.36.1 git-arch-2.26.2-150000.36.1 git-core-2.26.2-150000.36.1 git-core-debuginfo-2.26.2-150000.36.1 git-cvs-2.26.2-150000.36.1 git-daemon-2.26.2-150000.36.1 git-daemon-debuginfo-2.26.2-150000.36.1 git-debuginfo-2.26.2-150000.36.1 git-debugsource-2.26.2-150000.36.1 git-email-2.26.2-150000.36.1 git-gui-2.26.2-150000.36.1 git-svn-2.26.2-150000.36.1 git-svn-debuginfo-2.26.2-150000.36.1 git-web-2.26.2-150000.36.1 gitk-2.26.2-150000.36.1 - SUSE Linux Enterprise Realtime Extension 15-SP2 (noarch): git-doc-2.26.2-150000.36.1 - SUSE Linux Enterprise High Performance Computing 15-SP2-LTSS (aarch64 x86_64): git-2.26.2-150000.36.1 git-arch-2.26.2-150000.36.1 git-core-2.26.2-150000.36.1 git-core-debuginfo-2.26.2-150000.36.1 git-cvs-2.26.2-150000.36.1 git-daemon-2.26.2-150000.36.1 git-daemon-debuginfo-2.26.2-150000.36.1 git-debuginfo-2.26.2-150000.36.1 git-debugsource-2.26.2-150000.36.1 git-email-2.26.2-150000.36.1 git-gui-2.26.2-150000.36.1 git-svn-2.26.2-150000.36.1 git-svn-debuginfo-2.26.2-150000.36.1 git-web-2.26.2-150000.36.1 gitk-2.26.2-150000.36.1 - SUSE Linux Enterprise High Performance Computing 15-SP2-LTSS (noarch): git-doc-2.26.2-150000.36.1 - SUSE Linux Enterprise High Performance Computing 15-SP2-ESPOS (aarch64 x86_64): git-2.26.2-150000.36.1 git-arch-2.26.2-150000.36.1 git-core-2.26.2-150000.36.1 git-core-debuginfo-2.26.2-150000.36.1 git-cvs-2.26.2-150000.36.1 git-daemon-2.26.2-150000.36.1 git-daemon-debuginfo-2.26.2-150000.36.1 git-debuginfo-2.26.2-150000.36.1 git-debugsource-2.26.2-150000.36.1 git-email-2.26.2-150000.36.1 git-gui-2.26.2-150000.36.1 git-svn-2.26.2-150000.36.1 git-svn-debuginfo-2.26.2-150000.36.1 git-web-2.26.2-150000.36.1 gitk-2.26.2-150000.36.1 - SUSE Linux Enterprise High Performance Computing 15-SP2-ESPOS (noarch): git-doc-2.26.2-150000.36.1 - SUSE Linux Enterprise High Performance Computing 15-SP1-LTSS (aarch64 x86_64): git-2.26.2-150000.36.1 git-arch-2.26.2-150000.36.1 git-core-2.26.2-150000.36.1 git-core-debuginfo-2.26.2-150000.36.1 git-cvs-2.26.2-150000.36.1 git-daemon-2.26.2-150000.36.1 git-daemon-debuginfo-2.26.2-150000.36.1 git-debuginfo-2.26.2-150000.36.1 git-debugsource-2.26.2-150000.36.1 git-email-2.26.2-150000.36.1 git-gui-2.26.2-150000.36.1 git-svn-2.26.2-150000.36.1 git-svn-debuginfo-2.26.2-150000.36.1 git-web-2.26.2-150000.36.1 gitk-2.26.2-150000.36.1 - SUSE Linux Enterprise High Performance Computing 15-SP1-LTSS (noarch): git-doc-2.26.2-150000.36.1 - SUSE Linux Enterprise High Performance Computing 15-SP1-ESPOS (aarch64 x86_64): git-2.26.2-150000.36.1 git-arch-2.26.2-150000.36.1 git-core-2.26.2-150000.36.1 git-core-debuginfo-2.26.2-150000.36.1 git-cvs-2.26.2-150000.36.1 git-daemon-2.26.2-150000.36.1 git-daemon-debuginfo-2.26.2-150000.36.1 git-debuginfo-2.26.2-150000.36.1 git-debugsource-2.26.2-150000.36.1 git-email-2.26.2-150000.36.1 git-gui-2.26.2-150000.36.1 git-svn-2.26.2-150000.36.1 git-svn-debuginfo-2.26.2-150000.36.1 git-web-2.26.2-150000.36.1 gitk-2.26.2-150000.36.1 - SUSE Linux Enterprise High Performance Computing 15-SP1-ESPOS (noarch): git-doc-2.26.2-150000.36.1 - SUSE Linux Enterprise High Performance Computing 15-LTSS (aarch64 x86_64): git-2.26.2-150000.36.1 git-arch-2.26.2-150000.36.1 git-core-2.26.2-150000.36.1 git-core-debuginfo-2.26.2-150000.36.1 git-cvs-2.26.2-150000.36.1 git-daemon-2.26.2-150000.36.1 git-daemon-debuginfo-2.26.2-150000.36.1 git-debuginfo-2.26.2-150000.36.1 git-debugsource-2.26.2-150000.36.1 git-email-2.26.2-150000.36.1 git-gui-2.26.2-150000.36.1 git-svn-2.26.2-150000.36.1 git-svn-debuginfo-2.26.2-150000.36.1 git-web-2.26.2-150000.36.1 gitk-2.26.2-150000.36.1 - SUSE Linux Enterprise High Performance Computing 15-LTSS (noarch): git-doc-2.26.2-150000.36.1 - SUSE Linux Enterprise High Performance Computing 15-ESPOS (aarch64 x86_64): git-2.26.2-150000.36.1 git-arch-2.26.2-150000.36.1 git-core-2.26.2-150000.36.1 git-core-debuginfo-2.26.2-150000.36.1 git-cvs-2.26.2-150000.36.1 git-daemon-2.26.2-150000.36.1 git-daemon-debuginfo-2.26.2-150000.36.1 git-debuginfo-2.26.2-150000.36.1 git-debugsource-2.26.2-150000.36.1 git-email-2.26.2-150000.36.1 git-gui-2.26.2-150000.36.1 git-svn-2.26.2-150000.36.1 git-svn-debuginfo-2.26.2-150000.36.1 git-web-2.26.2-150000.36.1 gitk-2.26.2-150000.36.1 - SUSE Linux Enterprise High Performance Computing 15-ESPOS (noarch): git-doc-2.26.2-150000.36.1 - SUSE Enterprise Storage 7 (aarch64 x86_64): git-2.26.2-150000.36.1 git-arch-2.26.2-150000.36.1 git-core-2.26.2-150000.36.1 git-core-debuginfo-2.26.2-150000.36.1 git-cvs-2.26.2-150000.36.1 git-daemon-2.26.2-150000.36.1 git-daemon-debuginfo-2.26.2-150000.36.1 git-debuginfo-2.26.2-150000.36.1 git-debugsource-2.26.2-150000.36.1 git-email-2.26.2-150000.36.1 git-gui-2.26.2-150000.36.1 git-svn-2.26.2-150000.36.1 git-svn-debuginfo-2.26.2-150000.36.1 git-web-2.26.2-150000.36.1 gitk-2.26.2-150000.36.1 - SUSE Enterprise Storage 7 (noarch): git-doc-2.26.2-150000.36.1 - SUSE Enterprise Storage 6 (aarch64 x86_64): git-2.26.2-150000.36.1 git-arch-2.26.2-150000.36.1 git-core-2.26.2-150000.36.1 git-core-debuginfo-2.26.2-150000.36.1 git-cvs-2.26.2-150000.36.1 git-daemon-2.26.2-150000.36.1 git-daemon-debuginfo-2.26.2-150000.36.1 git-debuginfo-2.26.2-150000.36.1 git-debugsource-2.26.2-150000.36.1 git-email-2.26.2-150000.36.1 git-gui-2.26.2-150000.36.1 git-svn-2.26.2-150000.36.1 git-svn-debuginfo-2.26.2-150000.36.1 git-web-2.26.2-150000.36.1 gitk-2.26.2-150000.36.1 - SUSE Enterprise Storage 6 (noarch): git-doc-2.26.2-150000.36.1 - SUSE CaaS Platform 4.0 (x86_64): git-2.26.2-150000.36.1 git-arch-2.26.2-150000.36.1 git-core-2.26.2-150000.36.1 git-core-debuginfo-2.26.2-150000.36.1 git-cvs-2.26.2-150000.36.1 git-daemon-2.26.2-150000.36.1 git-daemon-debuginfo-2.26.2-150000.36.1 git-debuginfo-2.26.2-150000.36.1 git-debugsource-2.26.2-150000.36.1 git-email-2.26.2-150000.36.1 git-gui-2.26.2-150000.36.1 git-svn-2.26.2-150000.36.1 git-svn-debuginfo-2.26.2-150000.36.1 git-web-2.26.2-150000.36.1 gitk-2.26.2-150000.36.1 - SUSE CaaS Platform 4.0 (noarch): git-doc-2.26.2-150000.36.1 References: https://www.suse.com/security/cve/CVE-2022-24765.html https://bugzilla.suse.com/1198234

1 0

SUSE-SU-2022:1259-1: important: Security update for icedtea-web
by opensuse-security＠opensuse.org 19 Apr '22

19 Apr '22

SUSE Security Update: Security update for icedtea-web ______________________________________________________________________________ Announcement ID: SUSE-SU-2022:1259-1 Rating: important References: #1142825 #1142832 #1142835 Cross-References: CVE-2019-10181 CVE-2019-10182 CVE-2019-10185 CVSS scores: CVE-2019-10181 (NVD) : 8.1 CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H CVE-2019-10181 (SUSE): 8.8 CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H CVE-2019-10182 (NVD) : 6.5 CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N CVE-2019-10182 (SUSE): 6.8 CVSS:3.0/AV:N/AC:H/PR:N/UI:R/S:U/C:N/I:H/A:H CVE-2019-10185 (SUSE): 8.3 CVSS:3.0/AV:N/AC:H/PR:N/UI:R/S:C/C:H/I:H/A:H Affected Products: SUSE Linux Enterprise Desktop 15-SP3 SUSE Linux Enterprise Desktop 15-SP4 SUSE Linux Enterprise High Performance Computing 15-SP3 SUSE Linux Enterprise High Performance Computing 15-SP4 SUSE Linux Enterprise Module for Packagehub Subpackages 15-SP3 SUSE Linux Enterprise Module for Packagehub Subpackages 15-SP4 SUSE Linux Enterprise Server 15-SP3 SUSE Linux Enterprise Server 15-SP4 SUSE Linux Enterprise Server for SAP Applications 15-SP3 SUSE Linux Enterprise Server for SAP Applications 15-SP4 SUSE Linux Enterprise Workstation Extension 15-SP3 SUSE Linux Enterprise Workstation Extension 15-SP4 SUSE Manager Proxy 4.2 SUSE Manager Server 4.2 openSUSE Leap 15.3 openSUSE Leap 15.4 ______________________________________________________________________________ An update that fixes three vulnerabilities is now available. Description: This update for icedtea-web fixes the following issues: - CVE-2019-10181: Fixed an issue where an attacker could inject unsigned code in a signed JAR file (bsc#1142835). - CVE-2019-10182: Fixed a path traversal issue where an attacker could upload arbritrary files by tricking a victim into running a specially crafted application(bsc#1142825). - CVE-2019-10185: Fixed an issue where an attacker could write files to arbitrary locations during JAR auto-extraction (bsc#1142832). Patch Instructions: To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 15.4: zypper in -t patch openSUSE-SLE-15.4-2022-1259=1 - openSUSE Leap 15.3: zypper in -t patch openSUSE-SLE-15.3-2022-1259=1 - SUSE Linux Enterprise Workstation Extension 15-SP4: zypper in -t patch SUSE-SLE-Product-WE-15-SP4-2022-1259=1 - SUSE Linux Enterprise Workstation Extension 15-SP3: zypper in -t patch SUSE-SLE-Product-WE-15-SP3-2022-1259=1 - SUSE Linux Enterprise Module for Packagehub Subpackages 15-SP4: zypper in -t patch SUSE-SLE-Module-Packagehub-Subpackages-15-SP4-2022-1259=1 - SUSE Linux Enterprise Module for Packagehub Subpackages 15-SP3: zypper in -t patch SUSE-SLE-Module-Packagehub-Subpackages-15-SP3-2022-1259=1 Package List: - openSUSE Leap 15.4 (aarch64 ppc64le s390x x86_64): icedtea-web-1.7.2-150100.7.3.1 - openSUSE Leap 15.4 (noarch): icedtea-web-javadoc-1.7.2-150100.7.3.1 - openSUSE Leap 15.3 (aarch64 ppc64le s390x x86_64): icedtea-web-1.7.2-150100.7.3.1 - openSUSE Leap 15.3 (noarch): icedtea-web-javadoc-1.7.2-150100.7.3.1 - SUSE Linux Enterprise Workstation Extension 15-SP4 (x86_64): icedtea-web-1.7.2-150100.7.3.1 - SUSE Linux Enterprise Workstation Extension 15-SP3 (x86_64): icedtea-web-1.7.2-150100.7.3.1 - SUSE Linux Enterprise Module for Packagehub Subpackages 15-SP4 (aarch64 ppc64le s390x): icedtea-web-1.7.2-150100.7.3.1 - SUSE Linux Enterprise Module for Packagehub Subpackages 15-SP4 (noarch): icedtea-web-javadoc-1.7.2-150100.7.3.1 - SUSE Linux Enterprise Module for Packagehub Subpackages 15-SP3 (aarch64 ppc64le s390x): icedtea-web-1.7.2-150100.7.3.1 - SUSE Linux Enterprise Module for Packagehub Subpackages 15-SP3 (noarch): icedtea-web-javadoc-1.7.2-150100.7.3.1 References: https://www.suse.com/security/cve/CVE-2019-10181.html https://www.suse.com/security/cve/CVE-2019-10182.html https://www.suse.com/security/cve/CVE-2019-10185.html https://bugzilla.suse.com/1142825 https://bugzilla.suse.com/1142832 https://bugzilla.suse.com/1142835

1 0

SUSE-SU-2022:1252-1: important: Security update for openjpeg2
by opensuse-security＠opensuse.org 19 Apr '22

19 Apr '22

SUSE Security Update: Security update for openjpeg2 ______________________________________________________________________________ Announcement ID: SUSE-SU-2022:1252-1 Rating: important References: #1076314 #1076967 #1079845 #1102016 #1106881 #1106882 #1140130 #1160782 #1162090 #1173578 #1180457 #1184774 #1197738 Cross-References: CVE-2018-14423 CVE-2018-16375 CVE-2018-16376 CVE-2018-20845 CVE-2018-5727 CVE-2018-5785 CVE-2018-6616 CVE-2020-15389 CVE-2020-27823 CVE-2020-6851 CVE-2020-8112 CVE-2021-29338 CVE-2022-1122 CVSS scores: CVE-2018-14423 (NVD) : 7.5 CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H CVE-2018-14423 (SUSE): 3.3 CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:L CVE-2018-16375 (NVD) : 8.8 CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H CVE-2018-16375 (SUSE): 4.4 CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:L CVE-2018-16376 (NVD) : 8.8 CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H CVE-2018-16376 (SUSE): 5.3 CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:L CVE-2018-20845 (NVD) : 6.5 CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H CVE-2018-20845 (SUSE): 4 CVSS:3.0/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L CVE-2018-5727 (NVD) : 6.5 CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H CVE-2018-5727 (SUSE): 4.3 CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:L CVE-2018-5785 (NVD) : 6.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H CVE-2018-5785 (SUSE): 4 CVSS:3.0/AV:L/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:L CVE-2018-6616 (NVD) : 5.5 CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H CVE-2018-6616 (SUSE): 4.3 CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:L CVE-2020-15389 (NVD) : 6.5 CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:H CVE-2020-15389 (SUSE): 5.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L CVE-2020-27823 (NVD) : 7.8 CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H CVE-2020-27823 (SUSE): 7.8 CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H CVE-2020-6851 (NVD) : 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H CVE-2020-6851 (SUSE): 7.8 CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H CVE-2020-8112 (NVD) : 8.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H CVE-2020-8112 (SUSE): 7.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L CVE-2021-29338 (NVD) : 5.5 CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H CVE-2021-29338 (SUSE): 3.3 CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:L CVE-2022-1122 (NVD) : 5.5 CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H CVE-2022-1122 (SUSE): 5.5 CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H Affected Products: SUSE CaaS Platform 4.0 SUSE Enterprise Storage 6 SUSE Enterprise Storage 7 SUSE Linux Enterprise Desktop 15-SP3 SUSE Linux Enterprise Desktop 15-SP4 SUSE Linux Enterprise High Performance Computing 15-ESPOS SUSE Linux Enterprise High Performance Computing 15-LTSS SUSE Linux Enterprise High Performance Computing 15-SP1-ESPOS SUSE Linux Enterprise High Performance Computing 15-SP1-LTSS SUSE Linux Enterprise High Performance Computing 15-SP2-ESPOS SUSE Linux Enterprise High Performance Computing 15-SP2-LTSS SUSE Linux Enterprise High Performance Computing 15-SP3 SUSE Linux Enterprise High Performance Computing 15-SP4 SUSE Linux Enterprise Module for Basesystem 15-SP3 SUSE Linux Enterprise Module for Basesystem 15-SP4 SUSE Linux Enterprise Module for Packagehub Subpackages 15-SP3 SUSE Linux Enterprise Realtime Extension 15-SP2 SUSE Linux Enterprise Server 15-LTSS SUSE Linux Enterprise Server 15-SP1-BCL SUSE Linux Enterprise Server 15-SP1-LTSS SUSE Linux Enterprise Server 15-SP2-BCL SUSE Linux Enterprise Server 15-SP2-LTSS SUSE Linux Enterprise Server 15-SP3 SUSE Linux Enterprise Server 15-SP4 SUSE Linux Enterprise Server for SAP 15 SUSE Linux Enterprise Server for SAP 15-SP1 SUSE Linux Enterprise Server for SAP 15-SP2 SUSE Linux Enterprise Server for SAP Applications 15-SP3 SUSE Linux Enterprise Server for SAP Applications 15-SP4 SUSE Manager Proxy 4.1 SUSE Manager Proxy 4.2 SUSE Manager Retail Branch Server 4.1 SUSE Manager Server 4.1 SUSE Manager Server 4.2 openSUSE Leap 15.3 openSUSE Leap 15.4 ______________________________________________________________________________ An update that fixes 13 vulnerabilities is now available. Description: This update for openjpeg2 fixes the following issues: - CVE-2018-5727: Fixed integer overflow vulnerability in theopj_t1_encode_cblks function (bsc#1076314). - CVE-2018-5785: Fixed integer overflow caused by an out-of-bounds leftshift in the opj_j2k_setup_encoder function (bsc#1076967). - CVE-2018-6616: Fixed excessive iteration in the opj_t1_encode_cblks function of openjp2/t1.c (bsc#1079845). - CVE-2018-14423: Fixed division-by-zero vulnerabilities in the functions pi_next_pcrl, pi_next_cprl,and pi_next_rpcl in lib/openjp3d/pi.c (bsc#1102016). - CVE-2018-16375: Fixed missing checks for header_info.height and header_info.width in the function pnmtoimage in bin/jpwl/convert.c (bsc#1106882). - CVE-2018-16376: Fixed heap-based buffer overflow function t2_encode_packet in lib/openmj2/t2.c (bsc#1106881). - CVE-2018-20845: Fixed division-by-zero in the functions pi_next_pcrl, pi_next_cprl, and pi_next_rpcl in openmj2/pi.ci (bsc#1140130). - CVE-2020-6851: Fixed heap-based buffer overflow in opj_t1_clbl_decode_processor (bsc#1160782). - CVE-2020-8112: Fixed heap-based buffer overflow in opj_t1_clbl_decode_processor in openjp2/t1.c (bsc#1162090). - CVE-2020-15389: Fixed use-after-free if t a mix of valid and invalid files in a directory operated on by the decompressor (bsc#1173578). - CVE-2020-27823: Fixed heap buffer over-write in opj_tcd_dc_level_shift_encode() (bsc#1180457). - CVE-2021-29338: Fixed integer overflow that allows remote attackers to crash the application (bsc#1184774). - CVE-2022-1122: Fixed segmentation fault in opj2_decompress due to uninitialized pointer (bsc#1197738). Patch Instructions: To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 15.4: zypper in -t patch openSUSE-SLE-15.4-2022-1252=1 - openSUSE Leap 15.3: zypper in -t patch openSUSE-SLE-15.3-2022-1252=1 - SUSE Manager Server 4.1: zypper in -t patch SUSE-SLE-Product-SUSE-Manager-Server-4.1-2022-1252=1 - SUSE Manager Retail Branch Server 4.1: zypper in -t patch SUSE-SLE-Product-SUSE-Manager-Retail-Branch-Server-4.1-2022-1252=1 - SUSE Manager Proxy 4.1: zypper in -t patch SUSE-SLE-Product-SUSE-Manager-Proxy-4.1-2022-1252=1 - SUSE Linux Enterprise Server for SAP 15-SP2: zypper in -t patch SUSE-SLE-Product-SLES_SAP-15-SP2-2022-1252=1 - SUSE Linux Enterprise Server for SAP 15-SP1: zypper in -t patch SUSE-SLE-Product-SLES_SAP-15-SP1-2022-1252=1 - SUSE Linux Enterprise Server for SAP 15: zypper in -t patch SUSE-SLE-Product-SLES_SAP-15-2022-1252=1 - SUSE Linux Enterprise Server 15-SP2-LTSS: zypper in -t patch SUSE-SLE-Product-SLES-15-SP2-LTSS-2022-1252=1 - SUSE Linux Enterprise Server 15-SP2-BCL: zypper in -t patch SUSE-SLE-Product-SLES-15-SP2-BCL-2022-1252=1 - SUSE Linux Enterprise Server 15-SP1-LTSS: zypper in -t patch SUSE-SLE-Product-SLES-15-SP1-LTSS-2022-1252=1 - SUSE Linux Enterprise Server 15-SP1-BCL: zypper in -t patch SUSE-SLE-Product-SLES-15-SP1-BCL-2022-1252=1 - SUSE Linux Enterprise Server 15-LTSS: zypper in -t patch SUSE-SLE-Product-SLES-15-2022-1252=1 - SUSE Linux Enterprise Realtime Extension 15-SP2: zypper in -t patch SUSE-SLE-Product-RT-15-SP2-2022-1252=1 - SUSE Linux Enterprise Module for Packagehub Subpackages 15-SP3: zypper in -t patch SUSE-SLE-Module-Packagehub-Subpackages-15-SP3-2022-1252=1 - SUSE Linux Enterprise Module for Basesystem 15-SP4: zypper in -t patch SUSE-SLE-Module-Basesystem-15-SP4-2022-1252=1 - SUSE Linux Enterprise Module for Basesystem 15-SP3: zypper in -t patch SUSE-SLE-Module-Basesystem-15-SP3-2022-1252=1 - SUSE Linux Enterprise High Performance Computing 15-SP2-LTSS: zypper in -t patch SUSE-SLE-Product-HPC-15-SP2-LTSS-2022-1252=1 - SUSE Linux Enterprise High Performance Computing 15-SP2-ESPOS: zypper in -t patch SUSE-SLE-Product-HPC-15-SP2-ESPOS-2022-1252=1 - SUSE Linux Enterprise High Performance Computing 15-SP1-LTSS: zypper in -t patch SUSE-SLE-Product-HPC-15-SP1-LTSS-2022-1252=1 - SUSE Linux Enterprise High Performance Computing 15-SP1-ESPOS: zypper in -t patch SUSE-SLE-Product-HPC-15-SP1-ESPOS-2022-1252=1 - SUSE Linux Enterprise High Performance Computing 15-LTSS: zypper in -t patch SUSE-SLE-Product-HPC-15-2022-1252=1 - SUSE Linux Enterprise High Performance Computing 15-ESPOS: zypper in -t patch SUSE-SLE-Product-HPC-15-2022-1252=1 - SUSE Enterprise Storage 7: zypper in -t patch SUSE-Storage-7-2022-1252=1 - SUSE Enterprise Storage 6: zypper in -t patch SUSE-Storage-6-2022-1252=1 - SUSE CaaS Platform 4.0: To install this update, use the SUSE CaaS Platform 'skuba' tool. It will inform you if it detects new updates and let you then trigger updating of the complete cluster in a controlled way. Package List: - openSUSE Leap 15.4 (aarch64 ppc64le s390x x86_64): libopenjp2-7-2.3.0-150000.3.5.1 libopenjp2-7-debuginfo-2.3.0-150000.3.5.1 openjpeg2-2.3.0-150000.3.5.1 openjpeg2-debuginfo-2.3.0-150000.3.5.1 openjpeg2-debugsource-2.3.0-150000.3.5.1 openjpeg2-devel-2.3.0-150000.3.5.1 - openSUSE Leap 15.4 (x86_64): libopenjp2-7-32bit-2.3.0-150000.3.5.1 libopenjp2-7-32bit-debuginfo-2.3.0-150000.3.5.1 - openSUSE Leap 15.3 (aarch64 ppc64le s390x x86_64): libopenjp2-7-2.3.0-150000.3.5.1 libopenjp2-7-debuginfo-2.3.0-150000.3.5.1 openjpeg2-2.3.0-150000.3.5.1 openjpeg2-debuginfo-2.3.0-150000.3.5.1 openjpeg2-debugsource-2.3.0-150000.3.5.1 openjpeg2-devel-2.3.0-150000.3.5.1 - openSUSE Leap 15.3 (x86_64): libopenjp2-7-32bit-2.3.0-150000.3.5.1 libopenjp2-7-32bit-debuginfo-2.3.0-150000.3.5.1 - SUSE Manager Server 4.1 (ppc64le s390x x86_64): libopenjp2-7-2.3.0-150000.3.5.1 libopenjp2-7-debuginfo-2.3.0-150000.3.5.1 openjpeg2-2.3.0-150000.3.5.1 openjpeg2-debuginfo-2.3.0-150000.3.5.1 openjpeg2-debugsource-2.3.0-150000.3.5.1 openjpeg2-devel-2.3.0-150000.3.5.1 - SUSE Manager Retail Branch Server 4.1 (x86_64): libopenjp2-7-2.3.0-150000.3.5.1 libopenjp2-7-debuginfo-2.3.0-150000.3.5.1 openjpeg2-2.3.0-150000.3.5.1 openjpeg2-debuginfo-2.3.0-150000.3.5.1 openjpeg2-debugsource-2.3.0-150000.3.5.1 openjpeg2-devel-2.3.0-150000.3.5.1 - SUSE Manager Proxy 4.1 (x86_64): libopenjp2-7-2.3.0-150000.3.5.1 libopenjp2-7-debuginfo-2.3.0-150000.3.5.1 openjpeg2-2.3.0-150000.3.5.1 openjpeg2-debuginfo-2.3.0-150000.3.5.1 openjpeg2-debugsource-2.3.0-150000.3.5.1 openjpeg2-devel-2.3.0-150000.3.5.1 - SUSE Linux Enterprise Server for SAP 15-SP2 (ppc64le x86_64): libopenjp2-7-2.3.0-150000.3.5.1 libopenjp2-7-debuginfo-2.3.0-150000.3.5.1 openjpeg2-2.3.0-150000.3.5.1 openjpeg2-debuginfo-2.3.0-150000.3.5.1 openjpeg2-debugsource-2.3.0-150000.3.5.1 openjpeg2-devel-2.3.0-150000.3.5.1 - SUSE Linux Enterprise Server for SAP 15-SP1 (ppc64le x86_64): libopenjp2-7-2.3.0-150000.3.5.1 libopenjp2-7-debuginfo-2.3.0-150000.3.5.1 openjpeg2-2.3.0-150000.3.5.1 openjpeg2-debuginfo-2.3.0-150000.3.5.1 openjpeg2-debugsource-2.3.0-150000.3.5.1 openjpeg2-devel-2.3.0-150000.3.5.1 - SUSE Linux Enterprise Server for SAP 15 (ppc64le x86_64): libopenjp2-7-2.3.0-150000.3.5.1 libopenjp2-7-debuginfo-2.3.0-150000.3.5.1 openjpeg2-2.3.0-150000.3.5.1 openjpeg2-debuginfo-2.3.0-150000.3.5.1 openjpeg2-debugsource-2.3.0-150000.3.5.1 openjpeg2-devel-2.3.0-150000.3.5.1 - SUSE Linux Enterprise Server 15-SP2-LTSS (aarch64 ppc64le s390x x86_64): libopenjp2-7-2.3.0-150000.3.5.1 libopenjp2-7-debuginfo-2.3.0-150000.3.5.1 openjpeg2-2.3.0-150000.3.5.1 openjpeg2-debuginfo-2.3.0-150000.3.5.1 openjpeg2-debugsource-2.3.0-150000.3.5.1 openjpeg2-devel-2.3.0-150000.3.5.1 - SUSE Linux Enterprise Server 15-SP2-BCL (x86_64): libopenjp2-7-2.3.0-150000.3.5.1 libopenjp2-7-debuginfo-2.3.0-150000.3.5.1 openjpeg2-2.3.0-150000.3.5.1 openjpeg2-debuginfo-2.3.0-150000.3.5.1 openjpeg2-debugsource-2.3.0-150000.3.5.1 openjpeg2-devel-2.3.0-150000.3.5.1 - SUSE Linux Enterprise Server 15-SP1-LTSS (aarch64 ppc64le s390x x86_64): libopenjp2-7-2.3.0-150000.3.5.1 libopenjp2-7-debuginfo-2.3.0-150000.3.5.1 openjpeg2-2.3.0-150000.3.5.1 openjpeg2-debuginfo-2.3.0-150000.3.5.1 openjpeg2-debugsource-2.3.0-150000.3.5.1 openjpeg2-devel-2.3.0-150000.3.5.1 - SUSE Linux Enterprise Server 15-SP1-BCL (x86_64): libopenjp2-7-2.3.0-150000.3.5.1 libopenjp2-7-debuginfo-2.3.0-150000.3.5.1 openjpeg2-2.3.0-150000.3.5.1 openjpeg2-debuginfo-2.3.0-150000.3.5.1 openjpeg2-debugsource-2.3.0-150000.3.5.1 openjpeg2-devel-2.3.0-150000.3.5.1 - SUSE Linux Enterprise Server 15-LTSS (aarch64 s390x): libopenjp2-7-2.3.0-150000.3.5.1 libopenjp2-7-debuginfo-2.3.0-150000.3.5.1 openjpeg2-2.3.0-150000.3.5.1 openjpeg2-debuginfo-2.3.0-150000.3.5.1 openjpeg2-debugsource-2.3.0-150000.3.5.1 openjpeg2-devel-2.3.0-150000.3.5.1 - SUSE Linux Enterprise Realtime Extension 15-SP2 (x86_64): libopenjp2-7-2.3.0-150000.3.5.1 libopenjp2-7-debuginfo-2.3.0-150000.3.5.1 openjpeg2-2.3.0-150000.3.5.1 openjpeg2-debuginfo-2.3.0-150000.3.5.1 openjpeg2-debugsource-2.3.0-150000.3.5.1 openjpeg2-devel-2.3.0-150000.3.5.1 - SUSE Linux Enterprise Module for Packagehub Subpackages 15-SP3 (x86_64): libopenjp2-7-32bit-2.3.0-150000.3.5.1 libopenjp2-7-32bit-debuginfo-2.3.0-150000.3.5.1 - SUSE Linux Enterprise Module for Basesystem 15-SP4 (aarch64 ppc64le s390x x86_64): libopenjp2-7-2.3.0-150000.3.5.1 libopenjp2-7-debuginfo-2.3.0-150000.3.5.1 openjpeg2-2.3.0-150000.3.5.1 openjpeg2-debuginfo-2.3.0-150000.3.5.1 openjpeg2-debugsource-2.3.0-150000.3.5.1 openjpeg2-devel-2.3.0-150000.3.5.1 - SUSE Linux Enterprise Module for Basesystem 15-SP3 (aarch64 ppc64le s390x x86_64): libopenjp2-7-2.3.0-150000.3.5.1 libopenjp2-7-debuginfo-2.3.0-150000.3.5.1 openjpeg2-2.3.0-150000.3.5.1 openjpeg2-debuginfo-2.3.0-150000.3.5.1 openjpeg2-debugsource-2.3.0-150000.3.5.1 openjpeg2-devel-2.3.0-150000.3.5.1 - SUSE Linux Enterprise High Performance Computing 15-SP2-LTSS (aarch64 x86_64): libopenjp2-7-2.3.0-150000.3.5.1 libopenjp2-7-debuginfo-2.3.0-150000.3.5.1 openjpeg2-2.3.0-150000.3.5.1 openjpeg2-debuginfo-2.3.0-150000.3.5.1 openjpeg2-debugsource-2.3.0-150000.3.5.1 openjpeg2-devel-2.3.0-150000.3.5.1 - SUSE Linux Enterprise High Performance Computing 15-SP2-ESPOS (aarch64 x86_64): libopenjp2-7-2.3.0-150000.3.5.1 libopenjp2-7-debuginfo-2.3.0-150000.3.5.1 openjpeg2-2.3.0-150000.3.5.1 openjpeg2-debuginfo-2.3.0-150000.3.5.1 openjpeg2-debugsource-2.3.0-150000.3.5.1 openjpeg2-devel-2.3.0-150000.3.5.1 - SUSE Linux Enterprise High Performance Computing 15-SP1-LTSS (aarch64 x86_64): libopenjp2-7-2.3.0-150000.3.5.1 libopenjp2-7-debuginfo-2.3.0-150000.3.5.1 openjpeg2-2.3.0-150000.3.5.1 openjpeg2-debuginfo-2.3.0-150000.3.5.1 openjpeg2-debugsource-2.3.0-150000.3.5.1 openjpeg2-devel-2.3.0-150000.3.5.1 - SUSE Linux Enterprise High Performance Computing 15-SP1-ESPOS (aarch64 x86_64): libopenjp2-7-2.3.0-150000.3.5.1 libopenjp2-7-debuginfo-2.3.0-150000.3.5.1 openjpeg2-2.3.0-150000.3.5.1 openjpeg2-debuginfo-2.3.0-150000.3.5.1 openjpeg2-debugsource-2.3.0-150000.3.5.1 openjpeg2-devel-2.3.0-150000.3.5.1 - SUSE Linux Enterprise High Performance Computing 15-LTSS (aarch64 x86_64): libopenjp2-7-2.3.0-150000.3.5.1 libopenjp2-7-debuginfo-2.3.0-150000.3.5.1 openjpeg2-2.3.0-150000.3.5.1 openjpeg2-debuginfo-2.3.0-150000.3.5.1 openjpeg2-debugsource-2.3.0-150000.3.5.1 openjpeg2-devel-2.3.0-150000.3.5.1 - SUSE Linux Enterprise High Performance Computing 15-ESPOS (aarch64 x86_64): libopenjp2-7-2.3.0-150000.3.5.1 libopenjp2-7-debuginfo-2.3.0-150000.3.5.1 openjpeg2-2.3.0-150000.3.5.1 openjpeg2-debuginfo-2.3.0-150000.3.5.1 openjpeg2-debugsource-2.3.0-150000.3.5.1 openjpeg2-devel-2.3.0-150000.3.5.1 - SUSE Enterprise Storage 7 (aarch64 x86_64): libopenjp2-7-2.3.0-150000.3.5.1 libopenjp2-7-debuginfo-2.3.0-150000.3.5.1 openjpeg2-2.3.0-150000.3.5.1 openjpeg2-debuginfo-2.3.0-150000.3.5.1 openjpeg2-debugsource-2.3.0-150000.3.5.1 openjpeg2-devel-2.3.0-150000.3.5.1 - SUSE Enterprise Storage 6 (aarch64 x86_64): libopenjp2-7-2.3.0-150000.3.5.1 libopenjp2-7-debuginfo-2.3.0-150000.3.5.1 openjpeg2-2.3.0-150000.3.5.1 openjpeg2-debuginfo-2.3.0-150000.3.5.1 openjpeg2-debugsource-2.3.0-150000.3.5.1 openjpeg2-devel-2.3.0-150000.3.5.1 - SUSE CaaS Platform 4.0 (x86_64): libopenjp2-7-2.3.0-150000.3.5.1 libopenjp2-7-debuginfo-2.3.0-150000.3.5.1 openjpeg2-2.3.0-150000.3.5.1 openjpeg2-debuginfo-2.3.0-150000.3.5.1 openjpeg2-debugsource-2.3.0-150000.3.5.1 openjpeg2-devel-2.3.0-150000.3.5.1 References: https://www.suse.com/security/cve/CVE-2018-14423.html https://www.suse.com/security/cve/CVE-2018-16375.html https://www.suse.com/security/cve/CVE-2018-16376.html https://www.suse.com/security/cve/CVE-2018-20845.html https://www.suse.com/security/cve/CVE-2018-5727.html https://www.suse.com/security/cve/CVE-2018-5785.html https://www.suse.com/security/cve/CVE-2018-6616.html https://www.suse.com/security/cve/CVE-2020-15389.html https://www.suse.com/security/cve/CVE-2020-27823.html https://www.suse.com/security/cve/CVE-2020-6851.html https://www.suse.com/security/cve/CVE-2020-8112.html https://www.suse.com/security/cve/CVE-2021-29338.html https://www.suse.com/security/cve/CVE-2022-1122.html https://bugzilla.suse.com/1076314 https://bugzilla.suse.com/1076967 https://bugzilla.suse.com/1079845 https://bugzilla.suse.com/1102016 https://bugzilla.suse.com/1106881 https://bugzilla.suse.com/1106882 https://bugzilla.suse.com/1140130 https://bugzilla.suse.com/1160782 https://bugzilla.suse.com/1162090 https://bugzilla.suse.com/1173578 https://bugzilla.suse.com/1180457 https://bugzilla.suse.com/1184774 https://bugzilla.suse.com/1197738

1 0

openSUSE-SU-2022:0114-1: important: Security update for chromium
by opensuse-security＠opensuse.org 19 Apr '22

19 Apr '22

openSUSE Security Update: Security update for chromium ______________________________________________________________________________ Announcement ID: openSUSE-SU-2022:0114-1 Rating: important References: #1198509 Cross-References: CVE-2022-1364 Affected Products: openSUSE Backports SLE-15-SP3 ______________________________________________________________________________ An update that fixes one vulnerability is now available. Description: This update for chromium fixes the following issues: Updated Chromium to 100.0.4896.127 (boo#1198509) - CVE-2022-1364: Type Confusion in V8 - Various fixes from internal audits, fuzzing and other initiatives Patch Instructions: To install this openSUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Backports SLE-15-SP3: zypper in -t patch openSUSE-2022-114=1 Package List: - openSUSE Backports SLE-15-SP3 (aarch64 x86_64): chromedriver-100.0.4896.127-bp153.2.85.1 chromium-100.0.4896.127-bp153.2.85.1 References: https://www.suse.com/security/cve/CVE-2022-1364.html https://bugzilla.suse.com/1198509

1 0

openSUSE-SU-2022:0113-1: moderate: Security update for nodejs12
by opensuse-security＠opensuse.org 17 Apr '22

17 Apr '22

openSUSE Security Update: Security update for nodejs12 ______________________________________________________________________________ Announcement ID: openSUSE-SU-2022:0113-1 Rating: moderate References: #1194511 #1194512 #1194513 #1194514 #1198204 Cross-References: CVE-2021-44531 CVE-2021-44532 CVE-2021-44533 CVE-2022-21824 CVE-2022-24191 CVSS scores: CVE-2021-44531 (NVD) : 7.4 CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N CVE-2021-44531 (SUSE): 5.9 CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N CVE-2021-44532 (NVD) : 5.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N CVE-2021-44532 (SUSE): 5.9 CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N CVE-2021-44533 (NVD) : 5.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N CVE-2021-44533 (SUSE): 5.9 CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N CVE-2022-21824 (NVD) : 8.2 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:H CVE-2022-21824 (SUSE): 4 CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:L CVE-2022-24191 (NVD) : 5.5 CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H Affected Products: openSUSE Backports SLE-15-SP3 openSUSE Leap 15.3 ______________________________________________________________________________ An update that fixes 5 vulnerabilities is now available. Description: This update for nodejs12 fixes the following issues: - CVE-2021-44531: Fixed improper handling of URI Subject Alternative Names (bsc#1194511). - CVE-2021-44532: Fixed certificate Verification Bypass via String Injection (bsc#1194512). - CVE-2021-44533: Fixed incorrect handling of certificate subject and issuer fields (bsc#1194513). - CVE-2022-21824: Fixed prototype pollution via console.table properties (bsc#1194514). Patch Instructions: To install this openSUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 15.3: zypper in -t patch openSUSE-SLE-15.3-2022-113=1 - openSUSE Backports SLE-15-SP3: zypper in -t patch openSUSE-2022-113=1 Package List: - openSUSE Leap 15.3 (aarch64 ppc64le s390x x86_64): nodejs12-12.22.9-4.25.1 nodejs12-debuginfo-12.22.9-4.25.1 nodejs12-debugsource-12.22.9-4.25.1 nodejs12-devel-12.22.9-4.25.1 npm12-12.22.9-4.25.1 - openSUSE Leap 15.3 (noarch): nodejs12-docs-12.22.9-4.25.1 - openSUSE Backports SLE-15-SP3 (aarch64 i586 ppc64le s390x x86_64): htmldoc-1.9.12-bp153.2.9.1 References: https://www.suse.com/security/cve/CVE-2021-44531.html https://www.suse.com/security/cve/CVE-2021-44532.html https://www.suse.com/security/cve/CVE-2021-44533.html https://www.suse.com/security/cve/CVE-2022-21824.html https://www.suse.com/security/cve/CVE-2022-24191.html https://bugzilla.suse.com/1194511 https://bugzilla.suse.com/1194512 https://bugzilla.suse.com/1194513 https://bugzilla.suse.com/1194514 https://bugzilla.suse.com/1198204

1 0