openSUSE Security Announce
Threads by month
- ----- 2024 -----
- May
- April
- March
- February
- January
- ----- 2023 -----
- December
- November
- October
- September
- August
- July
- June
- May
- April
- March
- February
- January
- ----- 2022 -----
- December
- November
- October
- September
- August
- July
- June
- May
- April
- March
- February
- January
- ----- 2021 -----
- December
- November
- October
- September
- August
- July
- June
- May
- April
- March
- February
- January
- ----- 2020 -----
- December
- November
- October
- September
- August
- July
- June
- May
- April
- March
- February
- January
- ----- 2019 -----
- December
- November
- October
- September
- August
- July
- June
- May
- April
- March
- February
- January
- ----- 2018 -----
- December
- November
- October
- September
- August
- July
- June
- May
- April
- March
- February
- January
- ----- 2017 -----
- December
- November
- October
- September
- August
- July
- June
- May
- April
- March
- February
- January
- ----- 2016 -----
- December
- November
- October
- September
- August
- July
- June
- May
- April
- March
- February
- January
- ----- 2015 -----
- December
- November
- October
- September
- August
- July
- June
- May
- April
- March
- February
- January
- ----- 2014 -----
- December
- November
- October
- September
- August
- July
- June
- May
- April
- March
- February
- January
- ----- 2013 -----
- December
- November
- October
- September
- August
- July
- June
- May
- April
- March
- February
- January
- ----- 2012 -----
- December
- November
- October
- September
- August
- July
- June
- May
- April
- March
- February
- January
- ----- 2011 -----
- December
- November
- October
- September
- August
- July
- June
- May
- April
- March
- February
- January
- ----- 2010 -----
- December
- November
- October
- September
- August
- July
- June
- May
- April
- March
- February
- January
- ----- 2009 -----
- December
- November
- October
- September
- August
- July
- June
- May
- April
- March
- February
- January
- ----- 2008 -----
- December
- November
- October
- September
- August
- July
- June
- May
- April
- March
- February
- January
- ----- 2007 -----
- December
- November
- October
- September
- August
- July
- June
- May
- April
- March
- February
- January
- ----- 2006 -----
- December
- November
- October
- September
- August
- July
- June
- May
- April
- March
- February
- January
- ----- 2005 -----
- December
- November
- October
- September
- August
- July
- June
- May
- April
- March
- February
- January
- ----- 2004 -----
- December
- November
- October
- September
- August
- July
- June
- May
- April
- March
- February
- January
- ----- 2003 -----
- December
- November
- October
- September
- August
- July
- June
- May
- April
- March
- February
- January
- ----- 2002 -----
- December
- November
- October
- September
- August
- July
- June
- May
- April
- March
- February
- January
- ----- 2001 -----
- December
- November
- October
- September
- August
- July
- June
- May
- April
- March
- February
- January
- ----- 2000 -----
- December
- November
- October
- September
- August
- July
- June
- May
- April
- March
- February
- January
- ----- 1999 -----
- December
- November
- October
- September
- August
May 2022
- 1 participants
- 77 discussions
openSUSE-SU-2022:0145-1: moderate: Security update for cacti, cacti-spine
by opensuse-security@opensuse.org 24 May '22
by opensuse-security@opensuse.org 24 May '22
24 May '22
openSUSE Security Update: Security update for cacti, cacti-spine
______________________________________________________________________________
Announcement ID: openSUSE-SU-2022:0145-1
Rating: moderate
References: #1192408 #1196692
Cross-References: CVE-2022-0730
CVSS scores:
CVE-2022-0730 (NVD) : 9.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Affected Products:
openSUSE Backports SLE-15-SP3
______________________________________________________________________________
An update that solves one vulnerability and has one errata
is now available.
Description:
This update for cacti, cacti-spine fixes the following issues:
cacti-spine was updated to 1.2.20:
* Add support for newer versions of MySQL/MariaDB
* When checking for uptime of device, don't assume a non-response is
always fatal
* Fix description and command trunctation issues
* Improve spine performance when only one snmp agent port is in use
cacti-spine 1.2.19:
* Fix 1ssues with polling loop may skip some datasources
* Fix ping no longer works due to hostname changes
* Fix RRD steps are not always calculated correctly
* Fix unable to build when DES no longer supported
* Fix IPv6 devices are not properly parsed
* Reduce a number of compiler warnings
* Fix compiler warnings due to lack of return in thread_mutex_trylock
* Fix Spine will not look at non-timetics uptime when sysUpTimeInstance
overflows
* Improve performance of Cacti poller on heavily loaded systems
cacti-spine 1.2.20:
* Add support for newer versions of MySQL/MariaDB
* When checking for uptime of device, don't assume a non-response is
always fatal
* Fix description and command trunctation issues
* Improve spine performance when only one snmp agent port is in use
cacti was updated to 1.2.20:
* Security fix for CVE-2022-0730, boo#1196692 Under certain ldap
conditions, Cacti authentication can be bypassed with certain
credential types.
* Security fix: Device, Graph, Graph Template, and Graph Items may be
vulnerable to XSS issues
* Security fix: Lockout policies are not properly applied to LDAP and
Domain Users
* Security fix: When using 'remember me' option, incorrect realm may be
selected
* Security fix: User and Group maintenance are vulnerable to SQL attacks
* Security fix: Color Templates are vulnerable to XSS attack
* Features:
* When creating a Data Source Profile, allow additional choices for
Heartbeat
* Change select all options to use Font Awesome icons
* Improve spine performance by storing the total number of system
snmp_ports in use
* Prevent Template User Accounts from being Removed
* When managing by users, allow filtering by Realm
* Allow plugins to supply template account names
* When viewing logs, additional message types should be filterable
* When creating a Graph Template Item, allow filtering by Data Template
* Allow language handler to be selected via UI
* Updated Device packages for Synology, Citrix NetScaler, Cisco
ASA/Cisco
* Add Advanced Ping Graph Template to initial Installable templates
* Add LDAP Debug Mode option
* Allow Reports to include devices not on a Tree
* Allow Basic Authentication to display custom failure message
* Fix: When replicating data during installation/upgrade, system may
appear to hang
* Fix: Graph Template Items may have duplicated entries
* Fix: Unable to Save Graph Settings
* Fix: Script Server may crash if an OID is missing or unavailable
* Fix: When system-wide polling is disabled, remote pollers may fail to
sync changed settings
* Fix: When updating poller name, duplicate name protection may be over
zealous
* Fix: Titles may show "Missing Datasource" incorectly
* Fix: Checking for MIB Cache can cause crashes
* Fix: Polling cycles may not always complete as expected
* Fix: When viewing graph data, non-numeric values may appear
* Fix: Utilities view has calculation errors when there are no data
sources
* Fix: When editing Reports, drag and drop may not function as intended
* Fix: When data drive is full, viewing a Graph can result in errors
* Various other bug fixes
cacti 1.2.19:
* Further fixes for grave character security protection (boo#1192408)
* Fix Over aggressive escaping causing menu visibility issues on Create
Device page
* Add SHA256 and AES256 security levels for SNMP polling
* Import graph template(Preview Only) show color_id new value as a blank
area
* Fix Editing graphs errors due to missing sequence
* Fix 2hen hovering over a Tree Graph, row shows same highlighting as
Graph Edit screen
* Fix 2hen RealTime is not active, console errors may appear
* Fix race conditions may occur when multiple RRDtool processes are
running
* Fix errors creating graphs from templates
* Fix errors when duplicating reports
* Fix Boost may be blocked by overflowing poller_output table
* Fix Template import may be blocked due to unmet dependency warnings
with snmp ports
* Fix Newer MySQL versions may error if committing a transaction when
not in one
* Fix SNMP Agent may not find a cache item
* Fix Correct issues running under PHP 8.x
* Fix When polling is disabled, boost may crash and creates many arch
tables
* Fix When poller runs, memory tables may not always be present
* Fix Timezones may sometimes be incorrectly calculated
* Fix Allow monitoring IPv6 with interface graphs
* Fix When a data source uses a Data Input Method, those without a
mapping should be flagged
* Fix When RRDfile is not yet created, errors may appear when displaying
the graph
* Fix Cacti missing key indexes that result in Preset pages slowdowns
* Fix Data Sources page shows no name when Data Source has no name cache
* Fix db_update_table function can not alter table from signed to
unsigned
* Fix data remains in poller_output table even if it's flushed to rrd
files
* Fix Parameter list for lib/database.php:db_connect_real() is not
correct in 3 places
* Fix Offset is a reserved word in MariaDB 10.6 affecting Report
* Fix Rendering large trees slowed due to lack of permission caching
* Fix Error on interpretation of snmpUtime, when to big
* Fix Applying right axis formatting creates an error-image
* Fix Unable to Save Graph Settings from the Graphs pages
* Fix Graph Template Cache is nullified too often when Graph Automation
is running
* Fix When Adding a Data Query to a Device, no Progress Spinner is shown
* Fix New Browser Breaks Plugins that depend on non UTC date time data
* Fix errors when testing remote poller connectivity
* Fix errors when renaming poller
* Fix Removing spikes by Variance does not appear to be working beyond
the first RRA
* Fix LDAP API lacks timeout options leading to bad login experiences
* Add a normal/wrap class for general use
* Limit File Types available for Template Import operations
* Fix Cacti does not provide an option of providing a client side
certificate for LDAP/AD authentication
* Support Stronger Encryption Available Starting in Net-SNMP v5.8
* Allow Cacti to use multiple possible LDAP servers
* Add a 15 minute polling/sampling interval
* Provide additional admin email notifications
* Add warnings for undesired changes to plugin hook return values
* When creating a Graph, make testing the Data Sources optional by
Template
* Update phpseclib to 2.0.33
* Update jstree.js to 3.3.12
* Improve performance of Cacti poller on heavily loaded systems
* MariaDB recommendations need some tuning for recent updates
Patch Instructions:
To install this openSUSE Security Update use the SUSE recommended installation methods
like YaST online_update or "zypper patch".
Alternatively you can run the command listed for your product:
- openSUSE Backports SLE-15-SP3:
zypper in -t patch openSUSE-2022-145=1
Package List:
- openSUSE Backports SLE-15-SP3 (aarch64 i586 ppc64le s390x x86_64):
cacti-spine-1.2.20-bp153.2.9.1
- openSUSE Backports SLE-15-SP3 (noarch):
cacti-1.2.20-bp153.2.9.1
References:
https://www.suse.com/security/cve/CVE-2022-0730.html
https://bugzilla.suse.com/1192408
https://bugzilla.suse.com/1196692
1
0
SUSE-SU-2022:1803-1: moderate: Security update for libarchive
by opensuse-security@opensuse.org 23 May '22
by opensuse-security@opensuse.org 23 May '22
23 May '22
SUSE Security Update: Security update for libarchive
______________________________________________________________________________
Announcement ID: SUSE-SU-2022:1803-1
Rating: moderate
References: #1197634
Cross-References: CVE-2022-26280
CVSS scores:
CVE-2022-26280 (NVD) : 9.1 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:H
CVE-2022-26280 (SUSE): 7.4 CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:H
Affected Products:
SUSE Linux Enterprise Desktop 15-SP3
SUSE Linux Enterprise High Performance Computing 15-SP3
SUSE Linux Enterprise Module for Basesystem 15-SP3
SUSE Linux Enterprise Module for Development Tools 15-SP3
SUSE Linux Enterprise Server 15-SP3
SUSE Linux Enterprise Server for SAP Applications 15-SP3
SUSE Manager Proxy 4.2
SUSE Manager Server 4.2
openSUSE Leap 15.3
______________________________________________________________________________
An update that fixes one vulnerability is now available.
Description:
This update for libarchive fixes the following issues:
- CVE-2022-26280: Fixed out-of-bounds read via the component
zipx_lzma_alone_init (bsc#1197634).
Patch Instructions:
To install this SUSE Security Update use the SUSE recommended installation methods
like YaST online_update or "zypper patch".
Alternatively you can run the command listed for your product:
- openSUSE Leap 15.3:
zypper in -t patch openSUSE-SLE-15.3-2022-1803=1
- SUSE Linux Enterprise Module for Development Tools 15-SP3:
zypper in -t patch SUSE-SLE-Module-Development-Tools-15-SP3-2022-1803=1
- SUSE Linux Enterprise Module for Basesystem 15-SP3:
zypper in -t patch SUSE-SLE-Module-Basesystem-15-SP3-2022-1803=1
Package List:
- openSUSE Leap 15.3 (aarch64 ppc64le s390x x86_64):
bsdtar-3.4.2-150200.4.6.1
bsdtar-debuginfo-3.4.2-150200.4.6.1
libarchive-debugsource-3.4.2-150200.4.6.1
libarchive-devel-3.4.2-150200.4.6.1
libarchive13-3.4.2-150200.4.6.1
libarchive13-debuginfo-3.4.2-150200.4.6.1
- openSUSE Leap 15.3 (x86_64):
libarchive13-32bit-3.4.2-150200.4.6.1
libarchive13-32bit-debuginfo-3.4.2-150200.4.6.1
- SUSE Linux Enterprise Module for Development Tools 15-SP3 (aarch64 ppc64le s390x x86_64):
bsdtar-3.4.2-150200.4.6.1
bsdtar-debuginfo-3.4.2-150200.4.6.1
libarchive-debugsource-3.4.2-150200.4.6.1
- SUSE Linux Enterprise Module for Basesystem 15-SP3 (aarch64 ppc64le s390x x86_64):
libarchive-debugsource-3.4.2-150200.4.6.1
libarchive-devel-3.4.2-150200.4.6.1
libarchive13-3.4.2-150200.4.6.1
libarchive13-debuginfo-3.4.2-150200.4.6.1
References:
https://www.suse.com/security/cve/CVE-2022-26280.html
https://bugzilla.suse.com/1197634
1
0
openSUSE-SU-2022:0143-1: critical: Security update for librecad
by opensuse-security@opensuse.org 23 May '22
by opensuse-security@opensuse.org 23 May '22
23 May '22
openSUSE Security Update: Security update for librecad
______________________________________________________________________________
Announcement ID: openSUSE-SU-2022:0143-1
Rating: critical
References: #1195105 #1195122
Cross-References: CVE-2021-45341 CVE-2021-45342
CVSS scores:
CVE-2021-45341 (NVD) : 8.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
CVE-2021-45342 (NVD) : 7.8 CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Affected Products:
openSUSE Backports SLE-15-SP3
______________________________________________________________________________
An update that fixes two vulnerabilities is now available.
Description:
This update for librecad fixes the following issues:
- CVE-2021-45341: Fixed a buffer overflow vulnerability in LibreCAD that
allowed an attacker to achieve remote code execution via a crafted JWW
document [boo#1195105]
- CVE-2021-45342: Fixed a buffer overflow vulnerability in jwwlib in
LibreCAD allows an attacker to achieve remote code execution via a
crafted JWW document [boo#1195122]
Patch Instructions:
To install this openSUSE Security Update use the SUSE recommended installation methods
like YaST online_update or "zypper patch".
Alternatively you can run the command listed for your product:
- openSUSE Backports SLE-15-SP3:
zypper in -t patch openSUSE-2022-143=1
Package List:
- openSUSE Backports SLE-15-SP3 (aarch64 ppc64le s390x x86_64):
librecad-2.2.0~rc3-bp153.2.9.1
- openSUSE Backports SLE-15-SP3 (noarch):
librecad-parts-2.2.0~rc3-bp153.2.9.1
References:
https://www.suse.com/security/cve/CVE-2021-45341.html
https://www.suse.com/security/cve/CVE-2021-45342.html
https://bugzilla.suse.com/1195105
https://bugzilla.suse.com/1195122
1
0
openSUSE-SU-2022:0142-1: moderate: Security update for libxls
by opensuse-security@opensuse.org 21 May '22
by opensuse-security@opensuse.org 21 May '22
21 May '22
openSUSE Security Update: Security update for libxls
______________________________________________________________________________
Announcement ID: openSUSE-SU-2022:0142-1
Rating: moderate
References: #1192323
Cross-References: CVE-2021-27836
Affected Products:
openSUSE Backports SLE-15-SP3
______________________________________________________________________________
An update that fixes one vulnerability is now available.
Description:
This update for libxls fixes the following issues:
- CVE-2021-27836: Fixed possible NULL pointer dereference via crafted XLS
(boo#1192323)
Patch Instructions:
To install this openSUSE Security Update use the SUSE recommended installation methods
like YaST online_update or "zypper patch".
Alternatively you can run the command listed for your product:
- openSUSE Backports SLE-15-SP3:
zypper in -t patch openSUSE-2022-142=1
Package List:
- openSUSE Backports SLE-15-SP3 (aarch64 i586 ppc64le s390x x86_64):
libxls-devel-1.6.2-bp153.2.6.1
libxls-tools-1.6.2-bp153.2.6.1
libxlsreader8-1.6.2-bp153.2.6.1
References:
https://www.suse.com/security/cve/CVE-2021-27836.html
https://bugzilla.suse.com/1192323
1
0
20 May '22
SUSE Security Update: Security update for php7
______________________________________________________________________________
Announcement ID: SUSE-SU-2022:1768-1
Rating: low
References: #1197644
Affected Products:
SUSE Linux Enterprise High Performance Computing 15-SP3
SUSE Linux Enterprise Module for Packagehub Subpackages 15-SP3
SUSE Linux Enterprise Module for Web Scripting 15-SP3
SUSE Linux Enterprise Server 15-SP3
SUSE Linux Enterprise Server for SAP Applications 15-SP3
SUSE Manager Proxy 4.2
SUSE Manager Server 4.2
openSUSE Leap 15.3
openSUSE Leap 15.4
______________________________________________________________________________
An update that contains security fixes can now be installed.
Description:
This update for php7 fixes the following issues:
- Fixed filter_var bypass vulnerability (bsc#1197644).
Patch Instructions:
To install this SUSE Security Update use the SUSE recommended installation methods
like YaST online_update or "zypper patch".
Alternatively you can run the command listed for your product:
- openSUSE Leap 15.4:
zypper in -t patch openSUSE-SLE-15.4-2022-1768=1
- openSUSE Leap 15.3:
zypper in -t patch openSUSE-SLE-15.3-2022-1768=1
- SUSE Linux Enterprise Module for Web Scripting 15-SP3:
zypper in -t patch SUSE-SLE-Module-Web-Scripting-15-SP3-2022-1768=1
- SUSE Linux Enterprise Module for Packagehub Subpackages 15-SP3:
zypper in -t patch SUSE-SLE-Module-Packagehub-Subpackages-15-SP3-2022-1768=1
Package List:
- openSUSE Leap 15.4 (aarch64 ppc64le s390x x86_64):
php7-firebird-7.4.6-150200.3.38.2
php7-firebird-debuginfo-7.4.6-150200.3.38.2
- openSUSE Leap 15.3 (aarch64 ppc64le s390x x86_64):
apache2-mod_php7-7.4.6-150200.3.38.2
apache2-mod_php7-debuginfo-7.4.6-150200.3.38.2
php7-7.4.6-150200.3.38.2
php7-bcmath-7.4.6-150200.3.38.2
php7-bcmath-debuginfo-7.4.6-150200.3.38.2
php7-bz2-7.4.6-150200.3.38.2
php7-bz2-debuginfo-7.4.6-150200.3.38.2
php7-calendar-7.4.6-150200.3.38.2
php7-calendar-debuginfo-7.4.6-150200.3.38.2
php7-ctype-7.4.6-150200.3.38.2
php7-ctype-debuginfo-7.4.6-150200.3.38.2
php7-curl-7.4.6-150200.3.38.2
php7-curl-debuginfo-7.4.6-150200.3.38.2
php7-dba-7.4.6-150200.3.38.2
php7-dba-debuginfo-7.4.6-150200.3.38.2
php7-debuginfo-7.4.6-150200.3.38.2
php7-debugsource-7.4.6-150200.3.38.2
php7-devel-7.4.6-150200.3.38.2
php7-dom-7.4.6-150200.3.38.2
php7-dom-debuginfo-7.4.6-150200.3.38.2
php7-embed-7.4.6-150200.3.38.2
php7-embed-debuginfo-7.4.6-150200.3.38.2
php7-enchant-7.4.6-150200.3.38.2
php7-enchant-debuginfo-7.4.6-150200.3.38.2
php7-exif-7.4.6-150200.3.38.2
php7-exif-debuginfo-7.4.6-150200.3.38.2
php7-fastcgi-7.4.6-150200.3.38.2
php7-fastcgi-debuginfo-7.4.6-150200.3.38.2
php7-fileinfo-7.4.6-150200.3.38.2
php7-fileinfo-debuginfo-7.4.6-150200.3.38.2
php7-firebird-7.4.6-150200.3.38.2
php7-firebird-debuginfo-7.4.6-150200.3.38.2
php7-fpm-7.4.6-150200.3.38.2
php7-fpm-debuginfo-7.4.6-150200.3.38.2
php7-ftp-7.4.6-150200.3.38.2
php7-ftp-debuginfo-7.4.6-150200.3.38.2
php7-gd-7.4.6-150200.3.38.2
php7-gd-debuginfo-7.4.6-150200.3.38.2
php7-gettext-7.4.6-150200.3.38.2
php7-gettext-debuginfo-7.4.6-150200.3.38.2
php7-gmp-7.4.6-150200.3.38.2
php7-gmp-debuginfo-7.4.6-150200.3.38.2
php7-iconv-7.4.6-150200.3.38.2
php7-iconv-debuginfo-7.4.6-150200.3.38.2
php7-intl-7.4.6-150200.3.38.2
php7-intl-debuginfo-7.4.6-150200.3.38.2
php7-json-7.4.6-150200.3.38.2
php7-json-debuginfo-7.4.6-150200.3.38.2
php7-ldap-7.4.6-150200.3.38.2
php7-ldap-debuginfo-7.4.6-150200.3.38.2
php7-mbstring-7.4.6-150200.3.38.2
php7-mbstring-debuginfo-7.4.6-150200.3.38.2
php7-mysql-7.4.6-150200.3.38.2
php7-mysql-debuginfo-7.4.6-150200.3.38.2
php7-odbc-7.4.6-150200.3.38.2
php7-odbc-debuginfo-7.4.6-150200.3.38.2
php7-opcache-7.4.6-150200.3.38.2
php7-opcache-debuginfo-7.4.6-150200.3.38.2
php7-openssl-7.4.6-150200.3.38.2
php7-openssl-debuginfo-7.4.6-150200.3.38.2
php7-pcntl-7.4.6-150200.3.38.2
php7-pcntl-debuginfo-7.4.6-150200.3.38.2
php7-pdo-7.4.6-150200.3.38.2
php7-pdo-debuginfo-7.4.6-150200.3.38.2
php7-pgsql-7.4.6-150200.3.38.2
php7-pgsql-debuginfo-7.4.6-150200.3.38.2
php7-phar-7.4.6-150200.3.38.2
php7-phar-debuginfo-7.4.6-150200.3.38.2
php7-posix-7.4.6-150200.3.38.2
php7-posix-debuginfo-7.4.6-150200.3.38.2
php7-readline-7.4.6-150200.3.38.2
php7-readline-debuginfo-7.4.6-150200.3.38.2
php7-shmop-7.4.6-150200.3.38.2
php7-shmop-debuginfo-7.4.6-150200.3.38.2
php7-snmp-7.4.6-150200.3.38.2
php7-snmp-debuginfo-7.4.6-150200.3.38.2
php7-soap-7.4.6-150200.3.38.2
php7-soap-debuginfo-7.4.6-150200.3.38.2
php7-sockets-7.4.6-150200.3.38.2
php7-sockets-debuginfo-7.4.6-150200.3.38.2
php7-sodium-7.4.6-150200.3.38.2
php7-sodium-debuginfo-7.4.6-150200.3.38.2
php7-sqlite-7.4.6-150200.3.38.2
php7-sqlite-debuginfo-7.4.6-150200.3.38.2
php7-sysvmsg-7.4.6-150200.3.38.2
php7-sysvmsg-debuginfo-7.4.6-150200.3.38.2
php7-sysvsem-7.4.6-150200.3.38.2
php7-sysvsem-debuginfo-7.4.6-150200.3.38.2
php7-sysvshm-7.4.6-150200.3.38.2
php7-sysvshm-debuginfo-7.4.6-150200.3.38.2
php7-test-7.4.6-150200.3.38.2
php7-tidy-7.4.6-150200.3.38.2
php7-tidy-debuginfo-7.4.6-150200.3.38.2
php7-tokenizer-7.4.6-150200.3.38.2
php7-tokenizer-debuginfo-7.4.6-150200.3.38.2
php7-xmlreader-7.4.6-150200.3.38.2
php7-xmlreader-debuginfo-7.4.6-150200.3.38.2
php7-xmlrpc-7.4.6-150200.3.38.2
php7-xmlrpc-debuginfo-7.4.6-150200.3.38.2
php7-xmlwriter-7.4.6-150200.3.38.2
php7-xmlwriter-debuginfo-7.4.6-150200.3.38.2
php7-xsl-7.4.6-150200.3.38.2
php7-xsl-debuginfo-7.4.6-150200.3.38.2
php7-zip-7.4.6-150200.3.38.2
php7-zip-debuginfo-7.4.6-150200.3.38.2
php7-zlib-7.4.6-150200.3.38.2
php7-zlib-debuginfo-7.4.6-150200.3.38.2
- SUSE Linux Enterprise Module for Web Scripting 15-SP3 (aarch64 ppc64le s390x x86_64):
apache2-mod_php7-7.4.6-150200.3.38.2
apache2-mod_php7-debuginfo-7.4.6-150200.3.38.2
php7-7.4.6-150200.3.38.2
php7-bcmath-7.4.6-150200.3.38.2
php7-bcmath-debuginfo-7.4.6-150200.3.38.2
php7-bz2-7.4.6-150200.3.38.2
php7-bz2-debuginfo-7.4.6-150200.3.38.2
php7-calendar-7.4.6-150200.3.38.2
php7-calendar-debuginfo-7.4.6-150200.3.38.2
php7-ctype-7.4.6-150200.3.38.2
php7-ctype-debuginfo-7.4.6-150200.3.38.2
php7-curl-7.4.6-150200.3.38.2
php7-curl-debuginfo-7.4.6-150200.3.38.2
php7-dba-7.4.6-150200.3.38.2
php7-dba-debuginfo-7.4.6-150200.3.38.2
php7-debuginfo-7.4.6-150200.3.38.2
php7-debugsource-7.4.6-150200.3.38.2
php7-devel-7.4.6-150200.3.38.2
php7-dom-7.4.6-150200.3.38.2
php7-dom-debuginfo-7.4.6-150200.3.38.2
php7-enchant-7.4.6-150200.3.38.2
php7-enchant-debuginfo-7.4.6-150200.3.38.2
php7-exif-7.4.6-150200.3.38.2
php7-exif-debuginfo-7.4.6-150200.3.38.2
php7-fastcgi-7.4.6-150200.3.38.2
php7-fastcgi-debuginfo-7.4.6-150200.3.38.2
php7-fileinfo-7.4.6-150200.3.38.2
php7-fileinfo-debuginfo-7.4.6-150200.3.38.2
php7-fpm-7.4.6-150200.3.38.2
php7-fpm-debuginfo-7.4.6-150200.3.38.2
php7-ftp-7.4.6-150200.3.38.2
php7-ftp-debuginfo-7.4.6-150200.3.38.2
php7-gd-7.4.6-150200.3.38.2
php7-gd-debuginfo-7.4.6-150200.3.38.2
php7-gettext-7.4.6-150200.3.38.2
php7-gettext-debuginfo-7.4.6-150200.3.38.2
php7-gmp-7.4.6-150200.3.38.2
php7-gmp-debuginfo-7.4.6-150200.3.38.2
php7-iconv-7.4.6-150200.3.38.2
php7-iconv-debuginfo-7.4.6-150200.3.38.2
php7-intl-7.4.6-150200.3.38.2
php7-intl-debuginfo-7.4.6-150200.3.38.2
php7-json-7.4.6-150200.3.38.2
php7-json-debuginfo-7.4.6-150200.3.38.2
php7-ldap-7.4.6-150200.3.38.2
php7-ldap-debuginfo-7.4.6-150200.3.38.2
php7-mbstring-7.4.6-150200.3.38.2
php7-mbstring-debuginfo-7.4.6-150200.3.38.2
php7-mysql-7.4.6-150200.3.38.2
php7-mysql-debuginfo-7.4.6-150200.3.38.2
php7-odbc-7.4.6-150200.3.38.2
php7-odbc-debuginfo-7.4.6-150200.3.38.2
php7-opcache-7.4.6-150200.3.38.2
php7-opcache-debuginfo-7.4.6-150200.3.38.2
php7-openssl-7.4.6-150200.3.38.2
php7-openssl-debuginfo-7.4.6-150200.3.38.2
php7-pcntl-7.4.6-150200.3.38.2
php7-pcntl-debuginfo-7.4.6-150200.3.38.2
php7-pdo-7.4.6-150200.3.38.2
php7-pdo-debuginfo-7.4.6-150200.3.38.2
php7-pgsql-7.4.6-150200.3.38.2
php7-pgsql-debuginfo-7.4.6-150200.3.38.2
php7-phar-7.4.6-150200.3.38.2
php7-phar-debuginfo-7.4.6-150200.3.38.2
php7-posix-7.4.6-150200.3.38.2
php7-posix-debuginfo-7.4.6-150200.3.38.2
php7-readline-7.4.6-150200.3.38.2
php7-readline-debuginfo-7.4.6-150200.3.38.2
php7-shmop-7.4.6-150200.3.38.2
php7-shmop-debuginfo-7.4.6-150200.3.38.2
php7-snmp-7.4.6-150200.3.38.2
php7-snmp-debuginfo-7.4.6-150200.3.38.2
php7-soap-7.4.6-150200.3.38.2
php7-soap-debuginfo-7.4.6-150200.3.38.2
php7-sockets-7.4.6-150200.3.38.2
php7-sockets-debuginfo-7.4.6-150200.3.38.2
php7-sodium-7.4.6-150200.3.38.2
php7-sodium-debuginfo-7.4.6-150200.3.38.2
php7-sqlite-7.4.6-150200.3.38.2
php7-sqlite-debuginfo-7.4.6-150200.3.38.2
php7-sysvmsg-7.4.6-150200.3.38.2
php7-sysvmsg-debuginfo-7.4.6-150200.3.38.2
php7-sysvsem-7.4.6-150200.3.38.2
php7-sysvsem-debuginfo-7.4.6-150200.3.38.2
php7-sysvshm-7.4.6-150200.3.38.2
php7-sysvshm-debuginfo-7.4.6-150200.3.38.2
php7-tidy-7.4.6-150200.3.38.2
php7-tidy-debuginfo-7.4.6-150200.3.38.2
php7-tokenizer-7.4.6-150200.3.38.2
php7-tokenizer-debuginfo-7.4.6-150200.3.38.2
php7-xmlreader-7.4.6-150200.3.38.2
php7-xmlreader-debuginfo-7.4.6-150200.3.38.2
php7-xmlrpc-7.4.6-150200.3.38.2
php7-xmlrpc-debuginfo-7.4.6-150200.3.38.2
php7-xmlwriter-7.4.6-150200.3.38.2
php7-xmlwriter-debuginfo-7.4.6-150200.3.38.2
php7-xsl-7.4.6-150200.3.38.2
php7-xsl-debuginfo-7.4.6-150200.3.38.2
php7-zip-7.4.6-150200.3.38.2
php7-zip-debuginfo-7.4.6-150200.3.38.2
php7-zlib-7.4.6-150200.3.38.2
php7-zlib-debuginfo-7.4.6-150200.3.38.2
- SUSE Linux Enterprise Module for Packagehub Subpackages 15-SP3 (aarch64 ppc64le s390x x86_64):
php7-debuginfo-7.4.6-150200.3.38.2
php7-debugsource-7.4.6-150200.3.38.2
php7-embed-7.4.6-150200.3.38.2
php7-embed-debuginfo-7.4.6-150200.3.38.2
References:
https://bugzilla.suse.com/1197644
1
0
SUSE-SU-2022:1762-1: moderate: Security update for ImageMagick
by opensuse-security@opensuse.org 20 May '22
by opensuse-security@opensuse.org 20 May '22
20 May '22
SUSE Security Update: Security update for ImageMagick
______________________________________________________________________________
Announcement ID: SUSE-SU-2022:1762-1
Rating: moderate
References: #1197147 #1199350
Cross-References: CVE-2022-28463
CVSS scores:
CVE-2022-28463 (NVD) : 7.8 CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
CVE-2022-28463 (SUSE): 5.5 CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N
Affected Products:
SUSE Linux Enterprise Desktop 15-SP3
SUSE Linux Enterprise High Performance Computing 15-SP3
SUSE Linux Enterprise Module for Desktop Applications 15-SP3
SUSE Linux Enterprise Module for Development Tools 15-SP3
SUSE Linux Enterprise Server 15-SP3
SUSE Linux Enterprise Server for SAP Applications 15-SP3
SUSE Manager Proxy 4.2
SUSE Manager Server 4.2
openSUSE Leap 15.3
openSUSE Leap 15.4
______________________________________________________________________________
An update that solves one vulnerability and has one errata
is now available.
Description:
This update for ImageMagick fixes the following issues:
Security issues fixed:
- CVE-2022-28463: Fixed buffer overflow in coders/cin.c (bsc#1199350).
Bugfixes:
- Use png_get_eXIf_1 when available (bsc#1197147).
Patch Instructions:
To install this SUSE Security Update use the SUSE recommended installation methods
like YaST online_update or "zypper patch".
Alternatively you can run the command listed for your product:
- openSUSE Leap 15.4:
zypper in -t patch openSUSE-SLE-15.4-2022-1762=1
- openSUSE Leap 15.3:
zypper in -t patch openSUSE-SLE-15.3-2022-1762=1
- SUSE Linux Enterprise Module for Development Tools 15-SP3:
zypper in -t patch SUSE-SLE-Module-Development-Tools-15-SP3-2022-1762=1
- SUSE Linux Enterprise Module for Desktop Applications 15-SP3:
zypper in -t patch SUSE-SLE-Module-Desktop-Applications-15-SP3-2022-1762=1
Package List:
- openSUSE Leap 15.4 (aarch64 ppc64le s390x x86_64):
libMagick++-7_Q16HDRI4-7.0.7.34-150200.10.26.1
libMagick++-7_Q16HDRI4-debuginfo-7.0.7.34-150200.10.26.1
libMagickCore-7_Q16HDRI6-7.0.7.34-150200.10.26.1
libMagickCore-7_Q16HDRI6-debuginfo-7.0.7.34-150200.10.26.1
libMagickWand-7_Q16HDRI6-7.0.7.34-150200.10.26.1
libMagickWand-7_Q16HDRI6-debuginfo-7.0.7.34-150200.10.26.1
- openSUSE Leap 15.4 (x86_64):
libMagick++-7_Q16HDRI4-32bit-7.0.7.34-150200.10.26.1
libMagick++-7_Q16HDRI4-32bit-debuginfo-7.0.7.34-150200.10.26.1
libMagickCore-7_Q16HDRI6-32bit-7.0.7.34-150200.10.26.1
libMagickCore-7_Q16HDRI6-32bit-debuginfo-7.0.7.34-150200.10.26.1
libMagickWand-7_Q16HDRI6-32bit-7.0.7.34-150200.10.26.1
libMagickWand-7_Q16HDRI6-32bit-debuginfo-7.0.7.34-150200.10.26.1
- openSUSE Leap 15.3 (aarch64 ppc64le s390x x86_64):
ImageMagick-7.0.7.34-150200.10.26.1
ImageMagick-config-7-SUSE-7.0.7.34-150200.10.26.1
ImageMagick-config-7-upstream-7.0.7.34-150200.10.26.1
ImageMagick-debuginfo-7.0.7.34-150200.10.26.1
ImageMagick-debugsource-7.0.7.34-150200.10.26.1
ImageMagick-devel-7.0.7.34-150200.10.26.1
ImageMagick-extra-7.0.7.34-150200.10.26.1
ImageMagick-extra-debuginfo-7.0.7.34-150200.10.26.1
libMagick++-7_Q16HDRI4-7.0.7.34-150200.10.26.1
libMagick++-7_Q16HDRI4-debuginfo-7.0.7.34-150200.10.26.1
libMagick++-devel-7.0.7.34-150200.10.26.1
libMagickCore-7_Q16HDRI6-7.0.7.34-150200.10.26.1
libMagickCore-7_Q16HDRI6-debuginfo-7.0.7.34-150200.10.26.1
libMagickWand-7_Q16HDRI6-7.0.7.34-150200.10.26.1
libMagickWand-7_Q16HDRI6-debuginfo-7.0.7.34-150200.10.26.1
perl-PerlMagick-7.0.7.34-150200.10.26.1
perl-PerlMagick-debuginfo-7.0.7.34-150200.10.26.1
- openSUSE Leap 15.3 (noarch):
ImageMagick-doc-7.0.7.34-150200.10.26.1
- openSUSE Leap 15.3 (x86_64):
ImageMagick-devel-32bit-7.0.7.34-150200.10.26.1
libMagick++-7_Q16HDRI4-32bit-7.0.7.34-150200.10.26.1
libMagick++-7_Q16HDRI4-32bit-debuginfo-7.0.7.34-150200.10.26.1
libMagick++-devel-32bit-7.0.7.34-150200.10.26.1
libMagickCore-7_Q16HDRI6-32bit-7.0.7.34-150200.10.26.1
libMagickCore-7_Q16HDRI6-32bit-debuginfo-7.0.7.34-150200.10.26.1
libMagickWand-7_Q16HDRI6-32bit-7.0.7.34-150200.10.26.1
libMagickWand-7_Q16HDRI6-32bit-debuginfo-7.0.7.34-150200.10.26.1
- SUSE Linux Enterprise Module for Development Tools 15-SP3 (aarch64 ppc64le s390x x86_64):
ImageMagick-debuginfo-7.0.7.34-150200.10.26.1
ImageMagick-debugsource-7.0.7.34-150200.10.26.1
perl-PerlMagick-7.0.7.34-150200.10.26.1
perl-PerlMagick-debuginfo-7.0.7.34-150200.10.26.1
- SUSE Linux Enterprise Module for Desktop Applications 15-SP3 (aarch64 ppc64le s390x x86_64):
ImageMagick-7.0.7.34-150200.10.26.1
ImageMagick-config-7-SUSE-7.0.7.34-150200.10.26.1
ImageMagick-config-7-upstream-7.0.7.34-150200.10.26.1
ImageMagick-debuginfo-7.0.7.34-150200.10.26.1
ImageMagick-debugsource-7.0.7.34-150200.10.26.1
ImageMagick-devel-7.0.7.34-150200.10.26.1
libMagick++-7_Q16HDRI4-7.0.7.34-150200.10.26.1
libMagick++-7_Q16HDRI4-debuginfo-7.0.7.34-150200.10.26.1
libMagick++-devel-7.0.7.34-150200.10.26.1
libMagickCore-7_Q16HDRI6-7.0.7.34-150200.10.26.1
libMagickCore-7_Q16HDRI6-debuginfo-7.0.7.34-150200.10.26.1
libMagickWand-7_Q16HDRI6-7.0.7.34-150200.10.26.1
libMagickWand-7_Q16HDRI6-debuginfo-7.0.7.34-150200.10.26.1
References:
https://www.suse.com/security/cve/CVE-2022-28463.html
https://bugzilla.suse.com/1197147
https://bugzilla.suse.com/1199350
1
0
SUSE-SU-2022:1750-1: important: Security update for libxml2
by opensuse-security@opensuse.org 19 May '22
by opensuse-security@opensuse.org 19 May '22
19 May '22
SUSE Security Update: Security update for libxml2
______________________________________________________________________________
Announcement ID: SUSE-SU-2022:1750-1
Rating: important
References: #1196490 #1199132
Cross-References: CVE-2022-23308 CVE-2022-29824
CVSS scores:
CVE-2022-23308 (NVD) : 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
CVE-2022-23308 (SUSE): 7 CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:H
CVE-2022-29824 (NVD) : 6.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H
CVE-2022-29824 (SUSE): 7.8 CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Affected Products:
SUSE CaaS Platform 4.0
SUSE Enterprise Storage 6
SUSE Enterprise Storage 7
SUSE Linux Enterprise Desktop 15-SP3
SUSE Linux Enterprise High Performance Computing 15-ESPOS
SUSE Linux Enterprise High Performance Computing 15-LTSS
SUSE Linux Enterprise High Performance Computing 15-SP1-ESPOS
SUSE Linux Enterprise High Performance Computing 15-SP1-LTSS
SUSE Linux Enterprise High Performance Computing 15-SP2-ESPOS
SUSE Linux Enterprise High Performance Computing 15-SP2-LTSS
SUSE Linux Enterprise High Performance Computing 15-SP3
SUSE Linux Enterprise Micro 5.1
SUSE Linux Enterprise Micro 5.2
SUSE Linux Enterprise Module for Basesystem 15-SP3
SUSE Linux Enterprise Module for Python2 15-SP3
SUSE Linux Enterprise Server 15-LTSS
SUSE Linux Enterprise Server 15-SP1-BCL
SUSE Linux Enterprise Server 15-SP1-LTSS
SUSE Linux Enterprise Server 15-SP2-BCL
SUSE Linux Enterprise Server 15-SP2-LTSS
SUSE Linux Enterprise Server 15-SP3
SUSE Linux Enterprise Server for SAP 15
SUSE Linux Enterprise Server for SAP 15-SP1
SUSE Linux Enterprise Server for SAP 15-SP2
SUSE Linux Enterprise Server for SAP Applications 15-SP3
SUSE Manager Proxy 4.1
SUSE Manager Proxy 4.2
SUSE Manager Retail Branch Server 4.1
SUSE Manager Server 4.1
SUSE Manager Server 4.2
openSUSE Leap 15.3
openSUSE Leap 15.4
______________________________________________________________________________
An update that fixes two vulnerabilities is now available.
Description:
This update for libxml2 fixes the following issues:
- CVE-2022-23308: Fixed a use-after-free of ID and IDREF attributes
(bsc#1196490).
- CVE-2022-29824: Fixed integer overflow that could have led to an
out-of-bounds write in buf.c (xmlBuf*) and tree.c (xmlBuffer*)
(bsc#1199132).
Patch Instructions:
To install this SUSE Security Update use the SUSE recommended installation methods
like YaST online_update or "zypper patch".
Alternatively you can run the command listed for your product:
- openSUSE Leap 15.4:
zypper in -t patch openSUSE-SLE-15.4-2022-1750=1
- openSUSE Leap 15.3:
zypper in -t patch openSUSE-SLE-15.3-2022-1750=1
- SUSE Manager Server 4.1:
zypper in -t patch SUSE-SLE-Product-SUSE-Manager-Server-4.1-2022-1750=1
- SUSE Manager Retail Branch Server 4.1:
zypper in -t patch SUSE-SLE-Product-SUSE-Manager-Retail-Branch-Server-4.1-2022-1750=1
- SUSE Manager Proxy 4.1:
zypper in -t patch SUSE-SLE-Product-SUSE-Manager-Proxy-4.1-2022-1750=1
- SUSE Linux Enterprise Server for SAP 15-SP2:
zypper in -t patch SUSE-SLE-Product-SLES_SAP-15-SP2-2022-1750=1
- SUSE Linux Enterprise Server for SAP 15-SP1:
zypper in -t patch SUSE-SLE-Product-SLES_SAP-15-SP1-2022-1750=1
- SUSE Linux Enterprise Server for SAP 15:
zypper in -t patch SUSE-SLE-Product-SLES_SAP-15-2022-1750=1
- SUSE Linux Enterprise Server 15-SP2-LTSS:
zypper in -t patch SUSE-SLE-Product-SLES-15-SP2-LTSS-2022-1750=1
- SUSE Linux Enterprise Server 15-SP2-BCL:
zypper in -t patch SUSE-SLE-Product-SLES-15-SP2-BCL-2022-1750=1
- SUSE Linux Enterprise Server 15-SP1-LTSS:
zypper in -t patch SUSE-SLE-Product-SLES-15-SP1-LTSS-2022-1750=1
- SUSE Linux Enterprise Server 15-SP1-BCL:
zypper in -t patch SUSE-SLE-Product-SLES-15-SP1-BCL-2022-1750=1
- SUSE Linux Enterprise Server 15-LTSS:
zypper in -t patch SUSE-SLE-Product-SLES-15-2022-1750=1
- SUSE Linux Enterprise Module for Python2 15-SP3:
zypper in -t patch SUSE-SLE-Module-Python2-15-SP3-2022-1750=1
- SUSE Linux Enterprise Module for Basesystem 15-SP3:
zypper in -t patch SUSE-SLE-Module-Basesystem-15-SP3-2022-1750=1
- SUSE Linux Enterprise Micro 5.2:
zypper in -t patch SUSE-SUSE-MicroOS-5.2-2022-1750=1
- SUSE Linux Enterprise Micro 5.1:
zypper in -t patch SUSE-SUSE-MicroOS-5.1-2022-1750=1
- SUSE Linux Enterprise High Performance Computing 15-SP2-LTSS:
zypper in -t patch SUSE-SLE-Product-HPC-15-SP2-LTSS-2022-1750=1
- SUSE Linux Enterprise High Performance Computing 15-SP2-ESPOS:
zypper in -t patch SUSE-SLE-Product-HPC-15-SP2-ESPOS-2022-1750=1
- SUSE Linux Enterprise High Performance Computing 15-SP1-LTSS:
zypper in -t patch SUSE-SLE-Product-HPC-15-SP1-LTSS-2022-1750=1
- SUSE Linux Enterprise High Performance Computing 15-SP1-ESPOS:
zypper in -t patch SUSE-SLE-Product-HPC-15-SP1-ESPOS-2022-1750=1
- SUSE Linux Enterprise High Performance Computing 15-LTSS:
zypper in -t patch SUSE-SLE-Product-HPC-15-2022-1750=1
- SUSE Linux Enterprise High Performance Computing 15-ESPOS:
zypper in -t patch SUSE-SLE-Product-HPC-15-2022-1750=1
- SUSE Enterprise Storage 7:
zypper in -t patch SUSE-Storage-7-2022-1750=1
- SUSE Enterprise Storage 6:
zypper in -t patch SUSE-Storage-6-2022-1750=1
- SUSE CaaS Platform 4.0:
To install this update, use the SUSE CaaS Platform 'skuba' tool. It
will inform you if it detects new updates and let you then trigger
updating of the complete cluster in a controlled way.
Package List:
- openSUSE Leap 15.4 (aarch64 ppc64le s390x x86_64):
python-libxml2-python-debugsource-2.9.7-150000.3.46.1
python2-libxml2-python-2.9.7-150000.3.46.1
python2-libxml2-python-debuginfo-2.9.7-150000.3.46.1
python3-libxml2-python-2.9.7-150000.3.46.1
python3-libxml2-python-debuginfo-2.9.7-150000.3.46.1
- openSUSE Leap 15.3 (aarch64 ppc64le s390x x86_64):
libxml2-2-2.9.7-150000.3.46.1
libxml2-2-debuginfo-2.9.7-150000.3.46.1
libxml2-debugsource-2.9.7-150000.3.46.1
libxml2-devel-2.9.7-150000.3.46.1
libxml2-tools-2.9.7-150000.3.46.1
libxml2-tools-debuginfo-2.9.7-150000.3.46.1
python-libxml2-python-debugsource-2.9.7-150000.3.46.1
python2-libxml2-python-2.9.7-150000.3.46.1
python2-libxml2-python-debuginfo-2.9.7-150000.3.46.1
python3-libxml2-python-2.9.7-150000.3.46.1
python3-libxml2-python-debuginfo-2.9.7-150000.3.46.1
- openSUSE Leap 15.3 (x86_64):
libxml2-2-32bit-2.9.7-150000.3.46.1
libxml2-2-32bit-debuginfo-2.9.7-150000.3.46.1
libxml2-devel-32bit-2.9.7-150000.3.46.1
- openSUSE Leap 15.3 (noarch):
libxml2-doc-2.9.7-150000.3.46.1
- SUSE Manager Server 4.1 (ppc64le s390x x86_64):
libxml2-2-2.9.7-150000.3.46.1
libxml2-2-debuginfo-2.9.7-150000.3.46.1
libxml2-debugsource-2.9.7-150000.3.46.1
libxml2-devel-2.9.7-150000.3.46.1
libxml2-tools-2.9.7-150000.3.46.1
libxml2-tools-debuginfo-2.9.7-150000.3.46.1
python-libxml2-python-debugsource-2.9.7-150000.3.46.1
python2-libxml2-python-2.9.7-150000.3.46.1
python2-libxml2-python-debuginfo-2.9.7-150000.3.46.1
python3-libxml2-python-2.9.7-150000.3.46.1
python3-libxml2-python-debuginfo-2.9.7-150000.3.46.1
- SUSE Manager Server 4.1 (x86_64):
libxml2-2-32bit-2.9.7-150000.3.46.1
libxml2-2-32bit-debuginfo-2.9.7-150000.3.46.1
- SUSE Manager Retail Branch Server 4.1 (x86_64):
libxml2-2-2.9.7-150000.3.46.1
libxml2-2-32bit-2.9.7-150000.3.46.1
libxml2-2-32bit-debuginfo-2.9.7-150000.3.46.1
libxml2-2-debuginfo-2.9.7-150000.3.46.1
libxml2-debugsource-2.9.7-150000.3.46.1
libxml2-devel-2.9.7-150000.3.46.1
libxml2-tools-2.9.7-150000.3.46.1
libxml2-tools-debuginfo-2.9.7-150000.3.46.1
python-libxml2-python-debugsource-2.9.7-150000.3.46.1
python2-libxml2-python-2.9.7-150000.3.46.1
python2-libxml2-python-debuginfo-2.9.7-150000.3.46.1
python3-libxml2-python-2.9.7-150000.3.46.1
python3-libxml2-python-debuginfo-2.9.7-150000.3.46.1
- SUSE Manager Proxy 4.1 (x86_64):
libxml2-2-2.9.7-150000.3.46.1
libxml2-2-32bit-2.9.7-150000.3.46.1
libxml2-2-32bit-debuginfo-2.9.7-150000.3.46.1
libxml2-2-debuginfo-2.9.7-150000.3.46.1
libxml2-debugsource-2.9.7-150000.3.46.1
libxml2-devel-2.9.7-150000.3.46.1
libxml2-tools-2.9.7-150000.3.46.1
libxml2-tools-debuginfo-2.9.7-150000.3.46.1
python-libxml2-python-debugsource-2.9.7-150000.3.46.1
python2-libxml2-python-2.9.7-150000.3.46.1
python2-libxml2-python-debuginfo-2.9.7-150000.3.46.1
python3-libxml2-python-2.9.7-150000.3.46.1
python3-libxml2-python-debuginfo-2.9.7-150000.3.46.1
- SUSE Linux Enterprise Server for SAP 15-SP2 (ppc64le x86_64):
libxml2-2-2.9.7-150000.3.46.1
libxml2-2-debuginfo-2.9.7-150000.3.46.1
libxml2-debugsource-2.9.7-150000.3.46.1
libxml2-devel-2.9.7-150000.3.46.1
libxml2-tools-2.9.7-150000.3.46.1
libxml2-tools-debuginfo-2.9.7-150000.3.46.1
python-libxml2-python-debugsource-2.9.7-150000.3.46.1
python2-libxml2-python-2.9.7-150000.3.46.1
python2-libxml2-python-debuginfo-2.9.7-150000.3.46.1
python3-libxml2-python-2.9.7-150000.3.46.1
python3-libxml2-python-debuginfo-2.9.7-150000.3.46.1
- SUSE Linux Enterprise Server for SAP 15-SP2 (x86_64):
libxml2-2-32bit-2.9.7-150000.3.46.1
libxml2-2-32bit-debuginfo-2.9.7-150000.3.46.1
- SUSE Linux Enterprise Server for SAP 15-SP1 (ppc64le x86_64):
libxml2-2-2.9.7-150000.3.46.1
libxml2-2-debuginfo-2.9.7-150000.3.46.1
libxml2-debugsource-2.9.7-150000.3.46.1
libxml2-devel-2.9.7-150000.3.46.1
libxml2-tools-2.9.7-150000.3.46.1
libxml2-tools-debuginfo-2.9.7-150000.3.46.1
python-libxml2-python-debugsource-2.9.7-150000.3.46.1
python2-libxml2-python-2.9.7-150000.3.46.1
python2-libxml2-python-debuginfo-2.9.7-150000.3.46.1
python3-libxml2-python-2.9.7-150000.3.46.1
python3-libxml2-python-debuginfo-2.9.7-150000.3.46.1
- SUSE Linux Enterprise Server for SAP 15-SP1 (x86_64):
libxml2-2-32bit-2.9.7-150000.3.46.1
libxml2-2-32bit-debuginfo-2.9.7-150000.3.46.1
- SUSE Linux Enterprise Server for SAP 15 (ppc64le x86_64):
libxml2-2-2.9.7-150000.3.46.1
libxml2-2-debuginfo-2.9.7-150000.3.46.1
libxml2-debugsource-2.9.7-150000.3.46.1
libxml2-devel-2.9.7-150000.3.46.1
libxml2-tools-2.9.7-150000.3.46.1
libxml2-tools-debuginfo-2.9.7-150000.3.46.1
python-libxml2-python-debugsource-2.9.7-150000.3.46.1
python2-libxml2-python-2.9.7-150000.3.46.1
python2-libxml2-python-debuginfo-2.9.7-150000.3.46.1
python3-libxml2-python-2.9.7-150000.3.46.1
python3-libxml2-python-debuginfo-2.9.7-150000.3.46.1
- SUSE Linux Enterprise Server for SAP 15 (x86_64):
libxml2-2-32bit-2.9.7-150000.3.46.1
libxml2-2-32bit-debuginfo-2.9.7-150000.3.46.1
- SUSE Linux Enterprise Server 15-SP2-LTSS (aarch64 ppc64le s390x x86_64):
libxml2-2-2.9.7-150000.3.46.1
libxml2-2-debuginfo-2.9.7-150000.3.46.1
libxml2-debugsource-2.9.7-150000.3.46.1
libxml2-devel-2.9.7-150000.3.46.1
libxml2-tools-2.9.7-150000.3.46.1
libxml2-tools-debuginfo-2.9.7-150000.3.46.1
python-libxml2-python-debugsource-2.9.7-150000.3.46.1
python2-libxml2-python-2.9.7-150000.3.46.1
python2-libxml2-python-debuginfo-2.9.7-150000.3.46.1
python3-libxml2-python-2.9.7-150000.3.46.1
python3-libxml2-python-debuginfo-2.9.7-150000.3.46.1
- SUSE Linux Enterprise Server 15-SP2-LTSS (x86_64):
libxml2-2-32bit-2.9.7-150000.3.46.1
libxml2-2-32bit-debuginfo-2.9.7-150000.3.46.1
- SUSE Linux Enterprise Server 15-SP2-BCL (x86_64):
libxml2-2-2.9.7-150000.3.46.1
libxml2-2-32bit-2.9.7-150000.3.46.1
libxml2-2-32bit-debuginfo-2.9.7-150000.3.46.1
libxml2-2-debuginfo-2.9.7-150000.3.46.1
libxml2-debugsource-2.9.7-150000.3.46.1
libxml2-devel-2.9.7-150000.3.46.1
libxml2-tools-2.9.7-150000.3.46.1
libxml2-tools-debuginfo-2.9.7-150000.3.46.1
python-libxml2-python-debugsource-2.9.7-150000.3.46.1
python3-libxml2-python-2.9.7-150000.3.46.1
python3-libxml2-python-debuginfo-2.9.7-150000.3.46.1
- SUSE Linux Enterprise Server 15-SP1-LTSS (aarch64 ppc64le s390x x86_64):
libxml2-2-2.9.7-150000.3.46.1
libxml2-2-debuginfo-2.9.7-150000.3.46.1
libxml2-debugsource-2.9.7-150000.3.46.1
libxml2-devel-2.9.7-150000.3.46.1
libxml2-tools-2.9.7-150000.3.46.1
libxml2-tools-debuginfo-2.9.7-150000.3.46.1
python-libxml2-python-debugsource-2.9.7-150000.3.46.1
python2-libxml2-python-2.9.7-150000.3.46.1
python2-libxml2-python-debuginfo-2.9.7-150000.3.46.1
python3-libxml2-python-2.9.7-150000.3.46.1
python3-libxml2-python-debuginfo-2.9.7-150000.3.46.1
- SUSE Linux Enterprise Server 15-SP1-LTSS (x86_64):
libxml2-2-32bit-2.9.7-150000.3.46.1
libxml2-2-32bit-debuginfo-2.9.7-150000.3.46.1
- SUSE Linux Enterprise Server 15-SP1-BCL (x86_64):
libxml2-2-2.9.7-150000.3.46.1
libxml2-2-32bit-2.9.7-150000.3.46.1
libxml2-2-32bit-debuginfo-2.9.7-150000.3.46.1
libxml2-2-debuginfo-2.9.7-150000.3.46.1
libxml2-debugsource-2.9.7-150000.3.46.1
libxml2-devel-2.9.7-150000.3.46.1
libxml2-tools-2.9.7-150000.3.46.1
libxml2-tools-debuginfo-2.9.7-150000.3.46.1
python-libxml2-python-debugsource-2.9.7-150000.3.46.1
python2-libxml2-python-2.9.7-150000.3.46.1
python2-libxml2-python-debuginfo-2.9.7-150000.3.46.1
python3-libxml2-python-2.9.7-150000.3.46.1
python3-libxml2-python-debuginfo-2.9.7-150000.3.46.1
- SUSE Linux Enterprise Server 15-LTSS (aarch64 s390x):
libxml2-2-2.9.7-150000.3.46.1
libxml2-2-debuginfo-2.9.7-150000.3.46.1
libxml2-debugsource-2.9.7-150000.3.46.1
libxml2-devel-2.9.7-150000.3.46.1
libxml2-tools-2.9.7-150000.3.46.1
libxml2-tools-debuginfo-2.9.7-150000.3.46.1
python-libxml2-python-debugsource-2.9.7-150000.3.46.1
python2-libxml2-python-2.9.7-150000.3.46.1
python2-libxml2-python-debuginfo-2.9.7-150000.3.46.1
python3-libxml2-python-2.9.7-150000.3.46.1
python3-libxml2-python-debuginfo-2.9.7-150000.3.46.1
- SUSE Linux Enterprise Module for Python2 15-SP3 (aarch64 ppc64le s390x x86_64):
python-libxml2-python-debugsource-2.9.7-150000.3.46.1
python2-libxml2-python-2.9.7-150000.3.46.1
python2-libxml2-python-debuginfo-2.9.7-150000.3.46.1
- SUSE Linux Enterprise Module for Basesystem 15-SP3 (aarch64 ppc64le s390x x86_64):
libxml2-2-2.9.7-150000.3.46.1
libxml2-2-debuginfo-2.9.7-150000.3.46.1
libxml2-debugsource-2.9.7-150000.3.46.1
libxml2-devel-2.9.7-150000.3.46.1
libxml2-tools-2.9.7-150000.3.46.1
libxml2-tools-debuginfo-2.9.7-150000.3.46.1
python-libxml2-python-debugsource-2.9.7-150000.3.46.1
python3-libxml2-python-2.9.7-150000.3.46.1
python3-libxml2-python-debuginfo-2.9.7-150000.3.46.1
- SUSE Linux Enterprise Module for Basesystem 15-SP3 (x86_64):
libxml2-2-32bit-2.9.7-150000.3.46.1
libxml2-2-32bit-debuginfo-2.9.7-150000.3.46.1
- SUSE Linux Enterprise Micro 5.2 (aarch64 s390x x86_64):
libxml2-2-2.9.7-150000.3.46.1
libxml2-2-debuginfo-2.9.7-150000.3.46.1
libxml2-debugsource-2.9.7-150000.3.46.1
libxml2-tools-2.9.7-150000.3.46.1
libxml2-tools-debuginfo-2.9.7-150000.3.46.1
python-libxml2-python-debugsource-2.9.7-150000.3.46.1
python3-libxml2-python-2.9.7-150000.3.46.1
python3-libxml2-python-debuginfo-2.9.7-150000.3.46.1
- SUSE Linux Enterprise Micro 5.1 (aarch64 s390x x86_64):
libxml2-2-2.9.7-150000.3.46.1
libxml2-2-debuginfo-2.9.7-150000.3.46.1
libxml2-debugsource-2.9.7-150000.3.46.1
libxml2-tools-2.9.7-150000.3.46.1
libxml2-tools-debuginfo-2.9.7-150000.3.46.1
- SUSE Linux Enterprise High Performance Computing 15-SP2-LTSS (aarch64 x86_64):
libxml2-2-2.9.7-150000.3.46.1
libxml2-2-debuginfo-2.9.7-150000.3.46.1
libxml2-debugsource-2.9.7-150000.3.46.1
libxml2-devel-2.9.7-150000.3.46.1
libxml2-tools-2.9.7-150000.3.46.1
libxml2-tools-debuginfo-2.9.7-150000.3.46.1
python-libxml2-python-debugsource-2.9.7-150000.3.46.1
python2-libxml2-python-2.9.7-150000.3.46.1
python2-libxml2-python-debuginfo-2.9.7-150000.3.46.1
python3-libxml2-python-2.9.7-150000.3.46.1
python3-libxml2-python-debuginfo-2.9.7-150000.3.46.1
- SUSE Linux Enterprise High Performance Computing 15-SP2-LTSS (x86_64):
libxml2-2-32bit-2.9.7-150000.3.46.1
libxml2-2-32bit-debuginfo-2.9.7-150000.3.46.1
- SUSE Linux Enterprise High Performance Computing 15-SP2-ESPOS (aarch64 x86_64):
libxml2-2-2.9.7-150000.3.46.1
libxml2-2-debuginfo-2.9.7-150000.3.46.1
libxml2-debugsource-2.9.7-150000.3.46.1
libxml2-devel-2.9.7-150000.3.46.1
libxml2-tools-2.9.7-150000.3.46.1
libxml2-tools-debuginfo-2.9.7-150000.3.46.1
python-libxml2-python-debugsource-2.9.7-150000.3.46.1
python2-libxml2-python-2.9.7-150000.3.46.1
python2-libxml2-python-debuginfo-2.9.7-150000.3.46.1
python3-libxml2-python-2.9.7-150000.3.46.1
python3-libxml2-python-debuginfo-2.9.7-150000.3.46.1
- SUSE Linux Enterprise High Performance Computing 15-SP2-ESPOS (x86_64):
libxml2-2-32bit-2.9.7-150000.3.46.1
libxml2-2-32bit-debuginfo-2.9.7-150000.3.46.1
- SUSE Linux Enterprise High Performance Computing 15-SP1-LTSS (aarch64 x86_64):
libxml2-2-2.9.7-150000.3.46.1
libxml2-2-debuginfo-2.9.7-150000.3.46.1
libxml2-debugsource-2.9.7-150000.3.46.1
libxml2-devel-2.9.7-150000.3.46.1
libxml2-tools-2.9.7-150000.3.46.1
libxml2-tools-debuginfo-2.9.7-150000.3.46.1
python-libxml2-python-debugsource-2.9.7-150000.3.46.1
python2-libxml2-python-2.9.7-150000.3.46.1
python2-libxml2-python-debuginfo-2.9.7-150000.3.46.1
python3-libxml2-python-2.9.7-150000.3.46.1
python3-libxml2-python-debuginfo-2.9.7-150000.3.46.1
- SUSE Linux Enterprise High Performance Computing 15-SP1-LTSS (x86_64):
libxml2-2-32bit-2.9.7-150000.3.46.1
libxml2-2-32bit-debuginfo-2.9.7-150000.3.46.1
- SUSE Linux Enterprise High Performance Computing 15-SP1-ESPOS (aarch64 x86_64):
libxml2-2-2.9.7-150000.3.46.1
libxml2-2-debuginfo-2.9.7-150000.3.46.1
libxml2-debugsource-2.9.7-150000.3.46.1
libxml2-devel-2.9.7-150000.3.46.1
libxml2-tools-2.9.7-150000.3.46.1
libxml2-tools-debuginfo-2.9.7-150000.3.46.1
python-libxml2-python-debugsource-2.9.7-150000.3.46.1
python2-libxml2-python-2.9.7-150000.3.46.1
python2-libxml2-python-debuginfo-2.9.7-150000.3.46.1
python3-libxml2-python-2.9.7-150000.3.46.1
python3-libxml2-python-debuginfo-2.9.7-150000.3.46.1
- SUSE Linux Enterprise High Performance Computing 15-SP1-ESPOS (x86_64):
libxml2-2-32bit-2.9.7-150000.3.46.1
libxml2-2-32bit-debuginfo-2.9.7-150000.3.46.1
- SUSE Linux Enterprise High Performance Computing 15-LTSS (aarch64 x86_64):
libxml2-2-2.9.7-150000.3.46.1
libxml2-2-debuginfo-2.9.7-150000.3.46.1
libxml2-debugsource-2.9.7-150000.3.46.1
libxml2-devel-2.9.7-150000.3.46.1
libxml2-tools-2.9.7-150000.3.46.1
libxml2-tools-debuginfo-2.9.7-150000.3.46.1
python-libxml2-python-debugsource-2.9.7-150000.3.46.1
python2-libxml2-python-2.9.7-150000.3.46.1
python2-libxml2-python-debuginfo-2.9.7-150000.3.46.1
python3-libxml2-python-2.9.7-150000.3.46.1
python3-libxml2-python-debuginfo-2.9.7-150000.3.46.1
- SUSE Linux Enterprise High Performance Computing 15-LTSS (x86_64):
libxml2-2-32bit-2.9.7-150000.3.46.1
libxml2-2-32bit-debuginfo-2.9.7-150000.3.46.1
- SUSE Linux Enterprise High Performance Computing 15-ESPOS (aarch64 x86_64):
libxml2-2-2.9.7-150000.3.46.1
libxml2-2-debuginfo-2.9.7-150000.3.46.1
libxml2-debugsource-2.9.7-150000.3.46.1
libxml2-devel-2.9.7-150000.3.46.1
libxml2-tools-2.9.7-150000.3.46.1
libxml2-tools-debuginfo-2.9.7-150000.3.46.1
python-libxml2-python-debugsource-2.9.7-150000.3.46.1
python2-libxml2-python-2.9.7-150000.3.46.1
python2-libxml2-python-debuginfo-2.9.7-150000.3.46.1
python3-libxml2-python-2.9.7-150000.3.46.1
python3-libxml2-python-debuginfo-2.9.7-150000.3.46.1
- SUSE Linux Enterprise High Performance Computing 15-ESPOS (x86_64):
libxml2-2-32bit-2.9.7-150000.3.46.1
libxml2-2-32bit-debuginfo-2.9.7-150000.3.46.1
- SUSE Enterprise Storage 7 (aarch64 x86_64):
libxml2-2-2.9.7-150000.3.46.1
libxml2-2-debuginfo-2.9.7-150000.3.46.1
libxml2-debugsource-2.9.7-150000.3.46.1
libxml2-devel-2.9.7-150000.3.46.1
libxml2-tools-2.9.7-150000.3.46.1
libxml2-tools-debuginfo-2.9.7-150000.3.46.1
python-libxml2-python-debugsource-2.9.7-150000.3.46.1
python2-libxml2-python-2.9.7-150000.3.46.1
python2-libxml2-python-debuginfo-2.9.7-150000.3.46.1
python3-libxml2-python-2.9.7-150000.3.46.1
python3-libxml2-python-debuginfo-2.9.7-150000.3.46.1
- SUSE Enterprise Storage 7 (x86_64):
libxml2-2-32bit-2.9.7-150000.3.46.1
libxml2-2-32bit-debuginfo-2.9.7-150000.3.46.1
- SUSE Enterprise Storage 6 (aarch64 x86_64):
libxml2-2-2.9.7-150000.3.46.1
libxml2-2-debuginfo-2.9.7-150000.3.46.1
libxml2-debugsource-2.9.7-150000.3.46.1
libxml2-devel-2.9.7-150000.3.46.1
libxml2-tools-2.9.7-150000.3.46.1
libxml2-tools-debuginfo-2.9.7-150000.3.46.1
python-libxml2-python-debugsource-2.9.7-150000.3.46.1
python2-libxml2-python-2.9.7-150000.3.46.1
python2-libxml2-python-debuginfo-2.9.7-150000.3.46.1
python3-libxml2-python-2.9.7-150000.3.46.1
python3-libxml2-python-debuginfo-2.9.7-150000.3.46.1
- SUSE Enterprise Storage 6 (x86_64):
libxml2-2-32bit-2.9.7-150000.3.46.1
libxml2-2-32bit-debuginfo-2.9.7-150000.3.46.1
- SUSE CaaS Platform 4.0 (x86_64):
libxml2-2-2.9.7-150000.3.46.1
libxml2-2-32bit-2.9.7-150000.3.46.1
libxml2-2-32bit-debuginfo-2.9.7-150000.3.46.1
libxml2-2-debuginfo-2.9.7-150000.3.46.1
libxml2-debugsource-2.9.7-150000.3.46.1
libxml2-devel-2.9.7-150000.3.46.1
libxml2-tools-2.9.7-150000.3.46.1
libxml2-tools-debuginfo-2.9.7-150000.3.46.1
python-libxml2-python-debugsource-2.9.7-150000.3.46.1
python2-libxml2-python-2.9.7-150000.3.46.1
python2-libxml2-python-debuginfo-2.9.7-150000.3.46.1
python3-libxml2-python-2.9.7-150000.3.46.1
python3-libxml2-python-debuginfo-2.9.7-150000.3.46.1
References:
https://www.suse.com/security/cve/CVE-2022-23308.html
https://www.suse.com/security/cve/CVE-2022-29824.html
https://bugzilla.suse.com/1196490
https://bugzilla.suse.com/1199132
1
0
19 May '22
SUSE Security Update: Security update for php7
______________________________________________________________________________
Announcement ID: SUSE-SU-2022:1755-1
Rating: low
References: #1197644
Affected Products:
SUSE Linux Enterprise High Performance Computing
SUSE Linux Enterprise High Performance Computing 15-SP4
SUSE Linux Enterprise Module for Legacy Software 15-SP4
SUSE Linux Enterprise Module for Packagehub Subpackages 15-SP4
SUSE Linux Enterprise Server
SUSE Linux Enterprise Server 15-SP4
SUSE Linux Enterprise Server for SAP Applications
SUSE Linux Enterprise Server for SAP Applications 15-SP4
openSUSE Leap 15.4
______________________________________________________________________________
An update that contains security fixes can now be installed.
Description:
This update for php7 fixes the following issues:
- Fixed filter_var bypass vulnerability (bsc#1197644).
Patch Instructions:
To install this SUSE Security Update use the SUSE recommended installation methods
like YaST online_update or "zypper patch".
Alternatively you can run the command listed for your product:
- openSUSE Leap 15.4:
zypper in -t patch openSUSE-SLE-15.4-2022-1755=1
- SUSE Linux Enterprise Module for Packagehub Subpackages 15-SP4:
zypper in -t patch SUSE-SLE-Module-Packagehub-Subpackages-15-SP4-2022-1755=1
- SUSE Linux Enterprise Module for Legacy Software 15-SP4:
zypper in -t patch SUSE-SLE-Module-Legacy-15-SP4-2022-1755=1
Package List:
- openSUSE Leap 15.4 (aarch64 ppc64le s390x x86_64):
apache2-mod_php7-7.4.25-150400.4.3.1
apache2-mod_php7-debuginfo-7.4.25-150400.4.3.1
apache2-mod_php7-debugsource-7.4.25-150400.4.3.1
php7-7.4.25-150400.4.3.1
php7-bcmath-7.4.25-150400.4.3.1
php7-bcmath-debuginfo-7.4.25-150400.4.3.1
php7-bz2-7.4.25-150400.4.3.1
php7-bz2-debuginfo-7.4.25-150400.4.3.1
php7-calendar-7.4.25-150400.4.3.1
php7-calendar-debuginfo-7.4.25-150400.4.3.1
php7-cli-7.4.25-150400.4.3.1
php7-cli-debuginfo-7.4.25-150400.4.3.1
php7-ctype-7.4.25-150400.4.3.1
php7-ctype-debuginfo-7.4.25-150400.4.3.1
php7-curl-7.4.25-150400.4.3.1
php7-curl-debuginfo-7.4.25-150400.4.3.1
php7-dba-7.4.25-150400.4.3.1
php7-dba-debuginfo-7.4.25-150400.4.3.1
php7-debuginfo-7.4.25-150400.4.3.1
php7-debugsource-7.4.25-150400.4.3.1
php7-devel-7.4.25-150400.4.3.1
php7-dom-7.4.25-150400.4.3.1
php7-dom-debuginfo-7.4.25-150400.4.3.1
php7-embed-7.4.25-150400.4.3.1
php7-embed-debuginfo-7.4.25-150400.4.3.1
php7-embed-debugsource-7.4.25-150400.4.3.1
php7-enchant-7.4.25-150400.4.3.1
php7-enchant-debuginfo-7.4.25-150400.4.3.1
php7-exif-7.4.25-150400.4.3.1
php7-exif-debuginfo-7.4.25-150400.4.3.1
php7-fastcgi-7.4.25-150400.4.3.1
php7-fastcgi-debuginfo-7.4.25-150400.4.3.1
php7-fastcgi-debugsource-7.4.25-150400.4.3.1
php7-fileinfo-7.4.25-150400.4.3.1
php7-fileinfo-debuginfo-7.4.25-150400.4.3.1
php7-fpm-7.4.25-150400.4.3.1
php7-fpm-debuginfo-7.4.25-150400.4.3.1
php7-fpm-debugsource-7.4.25-150400.4.3.1
php7-ftp-7.4.25-150400.4.3.1
php7-ftp-debuginfo-7.4.25-150400.4.3.1
php7-gd-7.4.25-150400.4.3.1
php7-gd-debuginfo-7.4.25-150400.4.3.1
php7-gettext-7.4.25-150400.4.3.1
php7-gettext-debuginfo-7.4.25-150400.4.3.1
php7-gmp-7.4.25-150400.4.3.1
php7-gmp-debuginfo-7.4.25-150400.4.3.1
php7-iconv-7.4.25-150400.4.3.1
php7-iconv-debuginfo-7.4.25-150400.4.3.1
php7-intl-7.4.25-150400.4.3.1
php7-intl-debuginfo-7.4.25-150400.4.3.1
php7-json-7.4.25-150400.4.3.1
php7-json-debuginfo-7.4.25-150400.4.3.1
php7-ldap-7.4.25-150400.4.3.1
php7-ldap-debuginfo-7.4.25-150400.4.3.1
php7-mbstring-7.4.25-150400.4.3.1
php7-mbstring-debuginfo-7.4.25-150400.4.3.1
php7-mysql-7.4.25-150400.4.3.1
php7-mysql-debuginfo-7.4.25-150400.4.3.1
php7-odbc-7.4.25-150400.4.3.1
php7-odbc-debuginfo-7.4.25-150400.4.3.1
php7-opcache-7.4.25-150400.4.3.1
php7-opcache-debuginfo-7.4.25-150400.4.3.1
php7-openssl-7.4.25-150400.4.3.1
php7-openssl-debuginfo-7.4.25-150400.4.3.1
php7-pcntl-7.4.25-150400.4.3.1
php7-pcntl-debuginfo-7.4.25-150400.4.3.1
php7-pdo-7.4.25-150400.4.3.1
php7-pdo-debuginfo-7.4.25-150400.4.3.1
php7-pgsql-7.4.25-150400.4.3.1
php7-pgsql-debuginfo-7.4.25-150400.4.3.1
php7-phar-7.4.25-150400.4.3.1
php7-phar-debuginfo-7.4.25-150400.4.3.1
php7-posix-7.4.25-150400.4.3.1
php7-posix-debuginfo-7.4.25-150400.4.3.1
php7-readline-7.4.25-150400.4.3.1
php7-readline-debuginfo-7.4.25-150400.4.3.1
php7-shmop-7.4.25-150400.4.3.1
php7-shmop-debuginfo-7.4.25-150400.4.3.1
php7-snmp-7.4.25-150400.4.3.1
php7-snmp-debuginfo-7.4.25-150400.4.3.1
php7-soap-7.4.25-150400.4.3.1
php7-soap-debuginfo-7.4.25-150400.4.3.1
php7-sockets-7.4.25-150400.4.3.1
php7-sockets-debuginfo-7.4.25-150400.4.3.1
php7-sodium-7.4.25-150400.4.3.1
php7-sodium-debuginfo-7.4.25-150400.4.3.1
php7-sqlite-7.4.25-150400.4.3.1
php7-sqlite-debuginfo-7.4.25-150400.4.3.1
php7-sysvmsg-7.4.25-150400.4.3.1
php7-sysvmsg-debuginfo-7.4.25-150400.4.3.1
php7-sysvsem-7.4.25-150400.4.3.1
php7-sysvsem-debuginfo-7.4.25-150400.4.3.1
php7-sysvshm-7.4.25-150400.4.3.1
php7-sysvshm-debuginfo-7.4.25-150400.4.3.1
php7-test-7.4.25-150400.4.3.2
php7-tidy-7.4.25-150400.4.3.1
php7-tidy-debuginfo-7.4.25-150400.4.3.1
php7-tokenizer-7.4.25-150400.4.3.1
php7-tokenizer-debuginfo-7.4.25-150400.4.3.1
php7-xmlreader-7.4.25-150400.4.3.1
php7-xmlreader-debuginfo-7.4.25-150400.4.3.1
php7-xmlrpc-7.4.25-150400.4.3.1
php7-xmlrpc-debuginfo-7.4.25-150400.4.3.1
php7-xmlwriter-7.4.25-150400.4.3.1
php7-xmlwriter-debuginfo-7.4.25-150400.4.3.1
php7-xsl-7.4.25-150400.4.3.1
php7-xsl-debuginfo-7.4.25-150400.4.3.1
php7-zip-7.4.25-150400.4.3.1
php7-zip-debuginfo-7.4.25-150400.4.3.1
php7-zlib-7.4.25-150400.4.3.1
php7-zlib-debuginfo-7.4.25-150400.4.3.1
- SUSE Linux Enterprise Module for Packagehub Subpackages 15-SP4 (aarch64 ppc64le s390x x86_64):
php7-embed-7.4.25-150400.4.3.1
php7-embed-debuginfo-7.4.25-150400.4.3.1
php7-embed-debugsource-7.4.25-150400.4.3.1
- SUSE Linux Enterprise Module for Legacy Software 15-SP4 (aarch64 ppc64le s390x x86_64):
apache2-mod_php7-7.4.25-150400.4.3.1
apache2-mod_php7-debuginfo-7.4.25-150400.4.3.1
apache2-mod_php7-debugsource-7.4.25-150400.4.3.1
php7-7.4.25-150400.4.3.1
php7-bcmath-7.4.25-150400.4.3.1
php7-bcmath-debuginfo-7.4.25-150400.4.3.1
php7-bz2-7.4.25-150400.4.3.1
php7-bz2-debuginfo-7.4.25-150400.4.3.1
php7-calendar-7.4.25-150400.4.3.1
php7-calendar-debuginfo-7.4.25-150400.4.3.1
php7-cli-7.4.25-150400.4.3.1
php7-cli-debuginfo-7.4.25-150400.4.3.1
php7-ctype-7.4.25-150400.4.3.1
php7-ctype-debuginfo-7.4.25-150400.4.3.1
php7-curl-7.4.25-150400.4.3.1
php7-curl-debuginfo-7.4.25-150400.4.3.1
php7-dba-7.4.25-150400.4.3.1
php7-dba-debuginfo-7.4.25-150400.4.3.1
php7-debuginfo-7.4.25-150400.4.3.1
php7-debugsource-7.4.25-150400.4.3.1
php7-devel-7.4.25-150400.4.3.1
php7-dom-7.4.25-150400.4.3.1
php7-dom-debuginfo-7.4.25-150400.4.3.1
php7-enchant-7.4.25-150400.4.3.1
php7-enchant-debuginfo-7.4.25-150400.4.3.1
php7-exif-7.4.25-150400.4.3.1
php7-exif-debuginfo-7.4.25-150400.4.3.1
php7-fastcgi-7.4.25-150400.4.3.1
php7-fastcgi-debuginfo-7.4.25-150400.4.3.1
php7-fastcgi-debugsource-7.4.25-150400.4.3.1
php7-fileinfo-7.4.25-150400.4.3.1
php7-fileinfo-debuginfo-7.4.25-150400.4.3.1
php7-fpm-7.4.25-150400.4.3.1
php7-fpm-debuginfo-7.4.25-150400.4.3.1
php7-fpm-debugsource-7.4.25-150400.4.3.1
php7-ftp-7.4.25-150400.4.3.1
php7-ftp-debuginfo-7.4.25-150400.4.3.1
php7-gd-7.4.25-150400.4.3.1
php7-gd-debuginfo-7.4.25-150400.4.3.1
php7-gettext-7.4.25-150400.4.3.1
php7-gettext-debuginfo-7.4.25-150400.4.3.1
php7-gmp-7.4.25-150400.4.3.1
php7-gmp-debuginfo-7.4.25-150400.4.3.1
php7-iconv-7.4.25-150400.4.3.1
php7-iconv-debuginfo-7.4.25-150400.4.3.1
php7-intl-7.4.25-150400.4.3.1
php7-intl-debuginfo-7.4.25-150400.4.3.1
php7-json-7.4.25-150400.4.3.1
php7-json-debuginfo-7.4.25-150400.4.3.1
php7-ldap-7.4.25-150400.4.3.1
php7-ldap-debuginfo-7.4.25-150400.4.3.1
php7-mbstring-7.4.25-150400.4.3.1
php7-mbstring-debuginfo-7.4.25-150400.4.3.1
php7-mysql-7.4.25-150400.4.3.1
php7-mysql-debuginfo-7.4.25-150400.4.3.1
php7-odbc-7.4.25-150400.4.3.1
php7-odbc-debuginfo-7.4.25-150400.4.3.1
php7-opcache-7.4.25-150400.4.3.1
php7-opcache-debuginfo-7.4.25-150400.4.3.1
php7-openssl-7.4.25-150400.4.3.1
php7-openssl-debuginfo-7.4.25-150400.4.3.1
php7-pcntl-7.4.25-150400.4.3.1
php7-pcntl-debuginfo-7.4.25-150400.4.3.1
php7-pdo-7.4.25-150400.4.3.1
php7-pdo-debuginfo-7.4.25-150400.4.3.1
php7-pgsql-7.4.25-150400.4.3.1
php7-pgsql-debuginfo-7.4.25-150400.4.3.1
php7-phar-7.4.25-150400.4.3.1
php7-phar-debuginfo-7.4.25-150400.4.3.1
php7-posix-7.4.25-150400.4.3.1
php7-posix-debuginfo-7.4.25-150400.4.3.1
php7-readline-7.4.25-150400.4.3.1
php7-readline-debuginfo-7.4.25-150400.4.3.1
php7-shmop-7.4.25-150400.4.3.1
php7-shmop-debuginfo-7.4.25-150400.4.3.1
php7-snmp-7.4.25-150400.4.3.1
php7-snmp-debuginfo-7.4.25-150400.4.3.1
php7-soap-7.4.25-150400.4.3.1
php7-soap-debuginfo-7.4.25-150400.4.3.1
php7-sockets-7.4.25-150400.4.3.1
php7-sockets-debuginfo-7.4.25-150400.4.3.1
php7-sodium-7.4.25-150400.4.3.1
php7-sodium-debuginfo-7.4.25-150400.4.3.1
php7-sqlite-7.4.25-150400.4.3.1
php7-sqlite-debuginfo-7.4.25-150400.4.3.1
php7-sysvmsg-7.4.25-150400.4.3.1
php7-sysvmsg-debuginfo-7.4.25-150400.4.3.1
php7-sysvsem-7.4.25-150400.4.3.1
php7-sysvsem-debuginfo-7.4.25-150400.4.3.1
php7-sysvshm-7.4.25-150400.4.3.1
php7-sysvshm-debuginfo-7.4.25-150400.4.3.1
php7-tidy-7.4.25-150400.4.3.1
php7-tidy-debuginfo-7.4.25-150400.4.3.1
php7-tokenizer-7.4.25-150400.4.3.1
php7-tokenizer-debuginfo-7.4.25-150400.4.3.1
php7-xmlreader-7.4.25-150400.4.3.1
php7-xmlreader-debuginfo-7.4.25-150400.4.3.1
php7-xmlrpc-7.4.25-150400.4.3.1
php7-xmlrpc-debuginfo-7.4.25-150400.4.3.1
php7-xmlwriter-7.4.25-150400.4.3.1
php7-xmlwriter-debuginfo-7.4.25-150400.4.3.1
php7-xsl-7.4.25-150400.4.3.1
php7-xsl-debuginfo-7.4.25-150400.4.3.1
php7-zip-7.4.25-150400.4.3.1
php7-zip-debuginfo-7.4.25-150400.4.3.1
php7-zlib-7.4.25-150400.4.3.1
php7-zlib-debuginfo-7.4.25-150400.4.3.1
References:
https://bugzilla.suse.com/1197644
1
0
SUSE-SU-2022:1748-1: important: Security update for MozillaFirefox
by opensuse-security@opensuse.org 19 May '22
by opensuse-security@opensuse.org 19 May '22
19 May '22
SUSE Security Update: Security update for MozillaFirefox
______________________________________________________________________________
Announcement ID: SUSE-SU-2022:1748-1
Rating: important
References: #1198970
Cross-References: CVE-2022-29909 CVE-2022-29911 CVE-2022-29912
CVE-2022-29914 CVE-2022-29916 CVE-2022-29917
CVSS scores:
CVE-2022-29909 (SUSE): 7.5 CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H
CVE-2022-29911 (SUSE): 7.5 CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H
CVE-2022-29912 (SUSE): 6.1 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
CVE-2022-29914 (SUSE): 7.5 CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H
CVE-2022-29916 (SUSE): 7.5 CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H
CVE-2022-29917 (SUSE): 7.5 CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H
Affected Products:
SUSE Enterprise Storage 7
SUSE Linux Enterprise Desktop 15-SP3
SUSE Linux Enterprise Desktop 15-SP4
SUSE Linux Enterprise High Performance Computing 15-SP2-ESPOS
SUSE Linux Enterprise High Performance Computing 15-SP2-LTSS
SUSE Linux Enterprise High Performance Computing 15-SP3
SUSE Linux Enterprise High Performance Computing 15-SP4
SUSE Linux Enterprise Module for Desktop Applications 15-SP3
SUSE Linux Enterprise Module for Desktop Applications 15-SP4
SUSE Linux Enterprise Server 15-SP2-BCL
SUSE Linux Enterprise Server 15-SP2-LTSS
SUSE Linux Enterprise Server 15-SP3
SUSE Linux Enterprise Server 15-SP4
SUSE Linux Enterprise Server for SAP 15-SP2
SUSE Linux Enterprise Server for SAP Applications 15-SP3
SUSE Linux Enterprise Server for SAP Applications 15-SP4
SUSE Manager Proxy 4.1
SUSE Manager Proxy 4.2
SUSE Manager Retail Branch Server 4.1
SUSE Manager Server 4.1
SUSE Manager Server 4.2
openSUSE Leap 15.3
openSUSE Leap 15.4
______________________________________________________________________________
An update that fixes 6 vulnerabilities is now available.
Description:
This update for MozillaFirefox fixes the following issues:
Firefox Extended Support Release 91.9.0 ESR (MFSA 2022-17)(bsc#1198970):
- CVE-2022-29914: Fullscreen notification bypass using popups
- CVE-2022-29909: Bypassing permission prompt in nested browsing contexts
- CVE-2022-29916: Leaking browser history with CSS variables
- CVE-2022-29911: iframe Sandbox bypass
- CVE-2022-29912: Reader mode bypassed SameSite cookies
- CVE-2022-29917: Memory safety bugs fixed in Firefox 100 and Firefox ESR
91.9
Patch Instructions:
To install this SUSE Security Update use the SUSE recommended installation methods
like YaST online_update or "zypper patch".
Alternatively you can run the command listed for your product:
- openSUSE Leap 15.4:
zypper in -t patch openSUSE-SLE-15.4-2022-1748=1
- openSUSE Leap 15.3:
zypper in -t patch openSUSE-SLE-15.3-2022-1748=1
- SUSE Manager Server 4.1:
zypper in -t patch SUSE-SLE-Product-SUSE-Manager-Server-4.1-2022-1748=1
- SUSE Manager Retail Branch Server 4.1:
zypper in -t patch SUSE-SLE-Product-SUSE-Manager-Retail-Branch-Server-4.1-2022-1748=1
- SUSE Manager Proxy 4.1:
zypper in -t patch SUSE-SLE-Product-SUSE-Manager-Proxy-4.1-2022-1748=1
- SUSE Linux Enterprise Server for SAP 15-SP2:
zypper in -t patch SUSE-SLE-Product-SLES_SAP-15-SP2-2022-1748=1
- SUSE Linux Enterprise Server 15-SP2-LTSS:
zypper in -t patch SUSE-SLE-Product-SLES-15-SP2-LTSS-2022-1748=1
- SUSE Linux Enterprise Server 15-SP2-BCL:
zypper in -t patch SUSE-SLE-Product-SLES-15-SP2-BCL-2022-1748=1
- SUSE Linux Enterprise Module for Desktop Applications 15-SP4:
zypper in -t patch SUSE-SLE-Module-Desktop-Applications-15-SP4-2022-1748=1
- SUSE Linux Enterprise Module for Desktop Applications 15-SP3:
zypper in -t patch SUSE-SLE-Module-Desktop-Applications-15-SP3-2022-1748=1
- SUSE Linux Enterprise High Performance Computing 15-SP2-LTSS:
zypper in -t patch SUSE-SLE-Product-HPC-15-SP2-LTSS-2022-1748=1
- SUSE Linux Enterprise High Performance Computing 15-SP2-ESPOS:
zypper in -t patch SUSE-SLE-Product-HPC-15-SP2-ESPOS-2022-1748=1
- SUSE Enterprise Storage 7:
zypper in -t patch SUSE-Storage-7-2022-1748=1
Package List:
- openSUSE Leap 15.4 (aarch64 ppc64le s390x x86_64):
MozillaFirefox-91.9.0-150200.152.37.3
MozillaFirefox-branding-upstream-91.9.0-150200.152.37.3
MozillaFirefox-debuginfo-91.9.0-150200.152.37.3
MozillaFirefox-debugsource-91.9.0-150200.152.37.3
MozillaFirefox-devel-91.9.0-150200.152.37.3
MozillaFirefox-translations-common-91.9.0-150200.152.37.3
MozillaFirefox-translations-other-91.9.0-150200.152.37.3
- openSUSE Leap 15.3 (aarch64 ppc64le s390x x86_64):
MozillaFirefox-91.9.0-150200.152.37.3
MozillaFirefox-branding-upstream-91.9.0-150200.152.37.3
MozillaFirefox-debuginfo-91.9.0-150200.152.37.3
MozillaFirefox-debugsource-91.9.0-150200.152.37.3
MozillaFirefox-devel-91.9.0-150200.152.37.3
MozillaFirefox-translations-common-91.9.0-150200.152.37.3
MozillaFirefox-translations-other-91.9.0-150200.152.37.3
- SUSE Manager Server 4.1 (ppc64le s390x x86_64):
MozillaFirefox-91.9.0-150200.152.37.3
MozillaFirefox-debuginfo-91.9.0-150200.152.37.3
MozillaFirefox-debugsource-91.9.0-150200.152.37.3
MozillaFirefox-devel-91.9.0-150200.152.37.3
MozillaFirefox-translations-common-91.9.0-150200.152.37.3
MozillaFirefox-translations-other-91.9.0-150200.152.37.3
- SUSE Manager Retail Branch Server 4.1 (x86_64):
MozillaFirefox-91.9.0-150200.152.37.3
MozillaFirefox-debuginfo-91.9.0-150200.152.37.3
MozillaFirefox-debugsource-91.9.0-150200.152.37.3
MozillaFirefox-devel-91.9.0-150200.152.37.3
MozillaFirefox-translations-common-91.9.0-150200.152.37.3
MozillaFirefox-translations-other-91.9.0-150200.152.37.3
- SUSE Manager Proxy 4.1 (x86_64):
MozillaFirefox-91.9.0-150200.152.37.3
MozillaFirefox-debuginfo-91.9.0-150200.152.37.3
MozillaFirefox-debugsource-91.9.0-150200.152.37.3
MozillaFirefox-devel-91.9.0-150200.152.37.3
MozillaFirefox-translations-common-91.9.0-150200.152.37.3
MozillaFirefox-translations-other-91.9.0-150200.152.37.3
- SUSE Linux Enterprise Server for SAP 15-SP2 (ppc64le x86_64):
MozillaFirefox-91.9.0-150200.152.37.3
MozillaFirefox-debuginfo-91.9.0-150200.152.37.3
MozillaFirefox-debugsource-91.9.0-150200.152.37.3
MozillaFirefox-devel-91.9.0-150200.152.37.3
MozillaFirefox-translations-common-91.9.0-150200.152.37.3
MozillaFirefox-translations-other-91.9.0-150200.152.37.3
- SUSE Linux Enterprise Server 15-SP2-LTSS (aarch64 ppc64le s390x x86_64):
MozillaFirefox-91.9.0-150200.152.37.3
MozillaFirefox-debuginfo-91.9.0-150200.152.37.3
MozillaFirefox-debugsource-91.9.0-150200.152.37.3
MozillaFirefox-devel-91.9.0-150200.152.37.3
MozillaFirefox-translations-common-91.9.0-150200.152.37.3
MozillaFirefox-translations-other-91.9.0-150200.152.37.3
- SUSE Linux Enterprise Server 15-SP2-BCL (x86_64):
MozillaFirefox-91.9.0-150200.152.37.3
MozillaFirefox-debuginfo-91.9.0-150200.152.37.3
MozillaFirefox-debugsource-91.9.0-150200.152.37.3
MozillaFirefox-devel-91.9.0-150200.152.37.3
MozillaFirefox-translations-common-91.9.0-150200.152.37.3
MozillaFirefox-translations-other-91.9.0-150200.152.37.3
- SUSE Linux Enterprise Module for Desktop Applications 15-SP4 (aarch64 ppc64le s390x x86_64):
MozillaFirefox-91.9.0-150200.152.37.3
MozillaFirefox-debuginfo-91.9.0-150200.152.37.3
MozillaFirefox-debugsource-91.9.0-150200.152.37.3
MozillaFirefox-translations-common-91.9.0-150200.152.37.3
MozillaFirefox-translations-other-91.9.0-150200.152.37.3
- SUSE Linux Enterprise Module for Desktop Applications 15-SP4 (aarch64 ppc64le x86_64):
MozillaFirefox-devel-91.9.0-150200.152.37.3
- SUSE Linux Enterprise Module for Desktop Applications 15-SP3 (aarch64 ppc64le s390x x86_64):
MozillaFirefox-91.9.0-150200.152.37.3
MozillaFirefox-debuginfo-91.9.0-150200.152.37.3
MozillaFirefox-debugsource-91.9.0-150200.152.37.3
MozillaFirefox-translations-common-91.9.0-150200.152.37.3
MozillaFirefox-translations-other-91.9.0-150200.152.37.3
- SUSE Linux Enterprise Module for Desktop Applications 15-SP3 (aarch64 ppc64le x86_64):
MozillaFirefox-devel-91.9.0-150200.152.37.3
- SUSE Linux Enterprise High Performance Computing 15-SP2-LTSS (aarch64 x86_64):
MozillaFirefox-91.9.0-150200.152.37.3
MozillaFirefox-debuginfo-91.9.0-150200.152.37.3
MozillaFirefox-debugsource-91.9.0-150200.152.37.3
MozillaFirefox-devel-91.9.0-150200.152.37.3
MozillaFirefox-translations-common-91.9.0-150200.152.37.3
MozillaFirefox-translations-other-91.9.0-150200.152.37.3
- SUSE Linux Enterprise High Performance Computing 15-SP2-ESPOS (aarch64 x86_64):
MozillaFirefox-91.9.0-150200.152.37.3
MozillaFirefox-debuginfo-91.9.0-150200.152.37.3
MozillaFirefox-debugsource-91.9.0-150200.152.37.3
MozillaFirefox-devel-91.9.0-150200.152.37.3
MozillaFirefox-translations-common-91.9.0-150200.152.37.3
MozillaFirefox-translations-other-91.9.0-150200.152.37.3
- SUSE Enterprise Storage 7 (aarch64 x86_64):
MozillaFirefox-91.9.0-150200.152.37.3
MozillaFirefox-debuginfo-91.9.0-150200.152.37.3
MozillaFirefox-debugsource-91.9.0-150200.152.37.3
MozillaFirefox-devel-91.9.0-150200.152.37.3
MozillaFirefox-translations-common-91.9.0-150200.152.37.3
MozillaFirefox-translations-other-91.9.0-150200.152.37.3
References:
https://www.suse.com/security/cve/CVE-2022-29909.html
https://www.suse.com/security/cve/CVE-2022-29911.html
https://www.suse.com/security/cve/CVE-2022-29912.html
https://www.suse.com/security/cve/CVE-2022-29914.html
https://www.suse.com/security/cve/CVE-2022-29916.html
https://www.suse.com/security/cve/CVE-2022-29917.html
https://bugzilla.suse.com/1198970
1
0
SUSE-SU-2022:1727-1: moderate: Security update for ucode-intel
by opensuse-security@opensuse.org 18 May '22
by opensuse-security@opensuse.org 18 May '22
18 May '22
SUSE Security Update: Security update for ucode-intel
______________________________________________________________________________
Announcement ID: SUSE-SU-2022:1727-1
Rating: moderate
References: #1198717 #1199423
Cross-References: CVE-2022-21151
CVSS scores:
CVE-2022-21151 (SUSE): 5.3 CVSS:3.1/AV:L/AC:H/PR:H/UI:N/S:C/C:H/I:N/A:N
Affected Products:
SUSE Enterprise Storage 7
SUSE Linux Enterprise Desktop 15-SP3
SUSE Linux Enterprise Desktop 15-SP4
SUSE Linux Enterprise High Performance Computing 15-SP2-ESPOS
SUSE Linux Enterprise High Performance Computing 15-SP2-LTSS
SUSE Linux Enterprise High Performance Computing 15-SP3
SUSE Linux Enterprise High Performance Computing 15-SP4
SUSE Linux Enterprise Micro 5.1
SUSE Linux Enterprise Micro 5.2
SUSE Linux Enterprise Module for Basesystem 15-SP3
SUSE Linux Enterprise Module for Basesystem 15-SP4
SUSE Linux Enterprise Server 15-SP2-BCL
SUSE Linux Enterprise Server 15-SP2-LTSS
SUSE Linux Enterprise Server 15-SP3
SUSE Linux Enterprise Server 15-SP4
SUSE Linux Enterprise Server for SAP 15-SP2
SUSE Linux Enterprise Server for SAP Applications 15-SP3
SUSE Linux Enterprise Server for SAP Applications 15-SP4
SUSE Manager Proxy 4.1
SUSE Manager Proxy 4.2
SUSE Manager Retail Branch Server 4.1
SUSE Manager Server 4.1
SUSE Manager Server 4.2
openSUSE Leap 15.3
openSUSE Leap 15.4
______________________________________________________________________________
An update that solves one vulnerability and has one errata
is now available.
Description:
This update for ucode-intel fixes the following issues:
Updated to Intel CPU Microcode 20220510 release. (bsc#1199423) Updated to
Intel CPU Microcode 20220419 release. (bsc#1198717)
- CVE-2022-21151: Processor optimization removal or modification of
security-critical code for some Intel(R) Processors may allow an
authenticated user to potentially enable information disclosure via
local access (bsc#1199423).
Patch Instructions:
To install this SUSE Security Update use the SUSE recommended installation methods
like YaST online_update or "zypper patch".
Alternatively you can run the command listed for your product:
- openSUSE Leap 15.4:
zypper in -t patch openSUSE-SLE-15.4-2022-1727=1
- openSUSE Leap 15.3:
zypper in -t patch openSUSE-SLE-15.3-2022-1727=1
- SUSE Manager Server 4.1:
zypper in -t patch SUSE-SLE-Product-SUSE-Manager-Server-4.1-2022-1727=1
- SUSE Manager Retail Branch Server 4.1:
zypper in -t patch SUSE-SLE-Product-SUSE-Manager-Retail-Branch-Server-4.1-2022-1727=1
- SUSE Manager Proxy 4.1:
zypper in -t patch SUSE-SLE-Product-SUSE-Manager-Proxy-4.1-2022-1727=1
- SUSE Linux Enterprise Server for SAP 15-SP2:
zypper in -t patch SUSE-SLE-Product-SLES_SAP-15-SP2-2022-1727=1
- SUSE Linux Enterprise Server 15-SP2-LTSS:
zypper in -t patch SUSE-SLE-Product-SLES-15-SP2-LTSS-2022-1727=1
- SUSE Linux Enterprise Server 15-SP2-BCL:
zypper in -t patch SUSE-SLE-Product-SLES-15-SP2-BCL-2022-1727=1
- SUSE Linux Enterprise Module for Basesystem 15-SP4:
zypper in -t patch SUSE-SLE-Module-Basesystem-15-SP4-2022-1727=1
- SUSE Linux Enterprise Module for Basesystem 15-SP3:
zypper in -t patch SUSE-SLE-Module-Basesystem-15-SP3-2022-1727=1
- SUSE Linux Enterprise Micro 5.2:
zypper in -t patch SUSE-SUSE-MicroOS-5.2-2022-1727=1
- SUSE Linux Enterprise Micro 5.1:
zypper in -t patch SUSE-SUSE-MicroOS-5.1-2022-1727=1
- SUSE Linux Enterprise High Performance Computing 15-SP2-LTSS:
zypper in -t patch SUSE-SLE-Product-HPC-15-SP2-LTSS-2022-1727=1
- SUSE Linux Enterprise High Performance Computing 15-SP2-ESPOS:
zypper in -t patch SUSE-SLE-Product-HPC-15-SP2-ESPOS-2022-1727=1
- SUSE Enterprise Storage 7:
zypper in -t patch SUSE-Storage-7-2022-1727=1
Package List:
- openSUSE Leap 15.4 (x86_64):
ucode-intel-20220510-150200.14.1
- openSUSE Leap 15.3 (x86_64):
ucode-intel-20220510-150200.14.1
- SUSE Manager Server 4.1 (x86_64):
ucode-intel-20220510-150200.14.1
- SUSE Manager Retail Branch Server 4.1 (x86_64):
ucode-intel-20220510-150200.14.1
- SUSE Manager Proxy 4.1 (x86_64):
ucode-intel-20220510-150200.14.1
- SUSE Linux Enterprise Server for SAP 15-SP2 (x86_64):
ucode-intel-20220510-150200.14.1
- SUSE Linux Enterprise Server 15-SP2-LTSS (x86_64):
ucode-intel-20220510-150200.14.1
- SUSE Linux Enterprise Server 15-SP2-BCL (x86_64):
ucode-intel-20220510-150200.14.1
- SUSE Linux Enterprise Module for Basesystem 15-SP4 (x86_64):
ucode-intel-20220510-150200.14.1
- SUSE Linux Enterprise Module for Basesystem 15-SP3 (x86_64):
ucode-intel-20220510-150200.14.1
- SUSE Linux Enterprise Micro 5.2 (x86_64):
ucode-intel-20220510-150200.14.1
- SUSE Linux Enterprise Micro 5.1 (x86_64):
ucode-intel-20220510-150200.14.1
- SUSE Linux Enterprise High Performance Computing 15-SP2-LTSS (x86_64):
ucode-intel-20220510-150200.14.1
- SUSE Linux Enterprise High Performance Computing 15-SP2-ESPOS (x86_64):
ucode-intel-20220510-150200.14.1
- SUSE Enterprise Storage 7 (x86_64):
ucode-intel-20220510-150200.14.1
References:
https://www.suse.com/security/cve/CVE-2022-21151.html
https://bugzilla.suse.com/1198717
https://bugzilla.suse.com/1199423
1
0
openSUSE-SU-2022:0141-1: moderate: Security update for autotrace
by opensuse-security@opensuse.org 18 May '22
by opensuse-security@opensuse.org 18 May '22
18 May '22
SUSE Security Update: Security update for autotrace
______________________________________________________________________________
Announcement ID: openSUSE-SU-2022:0141-1
Rating: moderate
References: #1169614 #1182158 #1182159
Cross-References: CVE-2017-9182 CVE-2017-9190 CVE-2019-19004
CVE-2019-19005
CVSS scores:
CVE-2017-9182 (NVD) : 7.5 CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
CVE-2017-9190 (NVD) : 7.5 CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
CVE-2019-19004 (NVD) : 3.3 CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:L
CVE-2019-19005 (NVD) : 7.8 CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Affected Products:
openSUSE Backports SLE-15-SP3
openSUSE Leap 15.3
______________________________________________________________________________
An update that fixes four vulnerabilities is now available.
Description:
This update for autotrace fixes the following issues:
- CVE-2019-19004: Fixed a biWidth*biBitCnt integer overflow fix
(boo#1182158)
- CVE-2019-19005, CVE-2017-9182, CVE-2017-9190: Bitmap double free fix
(boo#1182159)
Patch Instructions:
To install this SUSE Security Update use the SUSE recommended installation methods
like YaST online_update or "zypper patch".
Alternatively you can run the command listed for your product:
- openSUSE Leap 15.3:
zypper in -t patch openSUSE-SLE-15.3-2022-141=1
- openSUSE Backports SLE-15-SP3:
zypper in -t patch openSUSE-2022-141=1
Package List:
- openSUSE Leap 15.3 (aarch64 ppc64le s390x x86_64):
permissions-20181225-23.12.1
permissions-debuginfo-20181225-23.12.1
permissions-debugsource-20181225-23.12.1
- openSUSE Leap 15.3 (noarch):
permissions-zypp-plugin-20181225-23.12.1
- openSUSE Backports SLE-15-SP3 (aarch64 i586 ppc64le s390x x86_64):
autotrace-0.31.1-bp153.2.3.1
autotrace-devel-0.31.1-bp153.2.3.1
libautotrace3-0.31.1-bp153.2.3.1
References:
https://www.suse.com/security/cve/CVE-2017-9182.html
https://www.suse.com/security/cve/CVE-2017-9190.html
https://www.suse.com/security/cve/CVE-2019-19004.html
https://www.suse.com/security/cve/CVE-2019-19005.html
https://bugzilla.suse.com/1169614
https://bugzilla.suse.com/1182158
https://bugzilla.suse.com/1182159
1
0
18 May '22
SUSE Security Update: Security update for php7
______________________________________________________________________________
Announcement ID: SUSE-SU-2022:1725-1
Rating: low
References: #1197644
Affected Products:
openSUSE Leap 15.4
______________________________________________________________________________
An update that contains security fixes can now be installed.
Description:
This update for php7 fixes the following issues:
- Fixed filter_var bypass vulnerability (bsc#1197644).
Patch Instructions:
To install this SUSE Security Update use the SUSE recommended installation methods
like YaST online_update or "zypper patch".
Alternatively you can run the command listed for your product:
- openSUSE Leap 15.4:
zypper in -t patch openSUSE-SLE-15.4-2022-1725=1
Package List:
- openSUSE Leap 15.4 (aarch64 ppc64le s390x x86_64):
php7-wddx-7.2.5-150000.4.92.1
php7-wddx-debuginfo-7.2.5-150000.4.92.1
References:
https://bugzilla.suse.com/1197644
1
0
SUSE-SU-2022:1730-1: important: Security update for libslirp
by opensuse-security@opensuse.org 18 May '22
by opensuse-security@opensuse.org 18 May '22
18 May '22
SUSE Security Update: Security update for libslirp
______________________________________________________________________________
Announcement ID: SUSE-SU-2022:1730-1
Rating: important
References: #1187364 #1187366 #1187367 #1198773
Cross-References: CVE-2021-3592 CVE-2021-3594 CVE-2021-3595
CVSS scores:
CVE-2021-3592 (NVD) : 3.8 CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:L/I:N/A:N
CVE-2021-3592 (SUSE): 3.8 CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:L/I:N/A:N
CVE-2021-3594 (NVD) : 3.8 CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:L/I:N/A:N
CVE-2021-3594 (SUSE): 3.8 CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:L/I:N/A:N
CVE-2021-3595 (NVD) : 3.8 CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:L/I:N/A:N
CVE-2021-3595 (SUSE): 3.8 CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:L/I:N/A:N
Affected Products:
SUSE Linux Enterprise High Performance Computing 15-SP3
SUSE Linux Enterprise High Performance Computing 15-SP4
SUSE Linux Enterprise Micro 5.1
SUSE Linux Enterprise Micro 5.2
SUSE Linux Enterprise Module for Server Applications 15-SP3
SUSE Linux Enterprise Module for Server Applications 15-SP4
SUSE Linux Enterprise Server 15-SP3
SUSE Linux Enterprise Server 15-SP4
SUSE Linux Enterprise Server for SAP Applications 15-SP3
SUSE Linux Enterprise Server for SAP Applications 15-SP4
SUSE Manager Proxy 4.2
SUSE Manager Server 4.2
openSUSE Leap 15.3
openSUSE Leap 15.4
______________________________________________________________________________
An update that solves three vulnerabilities and has one
errata is now available.
Description:
This update for libslirp fixes the following issues:
- CVE-2021-3592: Fixed invalid pointer initialization may lead to
information disclosure (bootp) (bsc#1187364).
- CVE-2021-3594: Fixed invalid pointer initialization may lead to
information disclosure (udp) (bsc#1187367).
- CVE-2021-3595: Fixed invalid pointer initialization may lead to
information disclosure (tftp) (bsc#1187366).
- Fix a dhcp regression [bsc#1198773]
Patch Instructions:
To install this SUSE Security Update use the SUSE recommended installation methods
like YaST online_update or "zypper patch".
Alternatively you can run the command listed for your product:
- openSUSE Leap 15.4:
zypper in -t patch openSUSE-SLE-15.4-2022-1730=1
- openSUSE Leap 15.3:
zypper in -t patch openSUSE-SLE-15.3-2022-1730=1
- SUSE Linux Enterprise Module for Server Applications 15-SP4:
zypper in -t patch SUSE-SLE-Module-Server-Applications-15-SP4-2022-1730=1
- SUSE Linux Enterprise Module for Server Applications 15-SP3:
zypper in -t patch SUSE-SLE-Module-Server-Applications-15-SP3-2022-1730=1
- SUSE Linux Enterprise Micro 5.2:
zypper in -t patch SUSE-SUSE-MicroOS-5.2-2022-1730=1
- SUSE Linux Enterprise Micro 5.1:
zypper in -t patch SUSE-SUSE-MicroOS-5.1-2022-1730=1
Package List:
- openSUSE Leap 15.4 (aarch64 ppc64le s390x x86_64):
libslirp-debugsource-4.3.1-150300.6.2
libslirp-devel-4.3.1-150300.6.2
libslirp0-4.3.1-150300.6.2
libslirp0-debuginfo-4.3.1-150300.6.2
- openSUSE Leap 15.3 (aarch64 ppc64le s390x x86_64):
libslirp-debugsource-4.3.1-150300.6.2
libslirp-devel-4.3.1-150300.6.2
libslirp0-4.3.1-150300.6.2
libslirp0-debuginfo-4.3.1-150300.6.2
- SUSE Linux Enterprise Module for Server Applications 15-SP4 (aarch64 ppc64le s390x x86_64):
libslirp-debugsource-4.3.1-150300.6.2
libslirp-devel-4.3.1-150300.6.2
libslirp0-4.3.1-150300.6.2
libslirp0-debuginfo-4.3.1-150300.6.2
- SUSE Linux Enterprise Module for Server Applications 15-SP3 (aarch64 ppc64le s390x x86_64):
libslirp-debugsource-4.3.1-150300.6.2
libslirp-devel-4.3.1-150300.6.2
libslirp0-4.3.1-150300.6.2
libslirp0-debuginfo-4.3.1-150300.6.2
- SUSE Linux Enterprise Micro 5.2 (aarch64 s390x x86_64):
libslirp-debugsource-4.3.1-150300.6.2
libslirp0-4.3.1-150300.6.2
libslirp0-debuginfo-4.3.1-150300.6.2
- SUSE Linux Enterprise Micro 5.1 (aarch64 s390x x86_64):
libslirp-debugsource-4.3.1-150300.6.2
libslirp0-4.3.1-150300.6.2
libslirp0-debuginfo-4.3.1-150300.6.2
References:
https://www.suse.com/security/cve/CVE-2021-3592.html
https://www.suse.com/security/cve/CVE-2021-3594.html
https://www.suse.com/security/cve/CVE-2021-3595.html
https://bugzilla.suse.com/1187364
https://bugzilla.suse.com/1187366
https://bugzilla.suse.com/1187367
https://bugzilla.suse.com/1198773
1
0
openSUSE-SU-2022:0136-1: moderate: Security update for MozillaFirefox
by opensuse-security@opensuse.org 18 May '22
by opensuse-security@opensuse.org 18 May '22
18 May '22
openSUSE Security Update: Security update for MozillaFirefox
______________________________________________________________________________
Announcement ID: openSUSE-SU-2022:0136-1
Rating: moderate
References: #1191938 #1194547 #1199047
Cross-References: CVE-2020-27304 CVE-2021-4140 CVE-2022-22737
CVE-2022-22738 CVE-2022-22739 CVE-2022-22740
CVE-2022-22741 CVE-2022-22742 CVE-2022-22743
CVE-2022-22744 CVE-2022-22745 CVE-2022-22746
CVE-2022-22747 CVE-2022-22748 CVE-2022-22751
CVSS scores:
CVE-2020-27304 (NVD) : 9.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
CVE-2022-22747 (SUSE): 4.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:L
Affected Products:
openSUSE Leap 15.3
______________________________________________________________________________
An update that fixes 15 vulnerabilities is now available.
Description:
This update for MozillaFirefox fixes the following issues:
- CVE-2021-4140: Fixed iframe sandbox bypass with XSLT (bsc#1194547).
- CVE-2022-22737: Fixed race condition when playing audio files
(bsc#1194547).
- CVE-2022-22738: Fixed heap-buffer-overflow in blendGaussianBlur
(bsc#1194547).
- CVE-2022-22739: Fixed missing throttling on external protocol launch
dialog (bsc#1194547).
- CVE-2022-22740: Fixed use-after-free of ChannelEventQueue::mOwner
(bsc#1194547).
- CVE-2022-22741: Fixed browser window spoof using fullscreen mode
(bsc#1194547).
- CVE-2022-22742: Fixed out-of-bounds memory access when inserting text in
edit mode (bsc#1194547).
- CVE-2022-22743: Fixed browser window spoof using fullscreen mode
(bsc#1194547).
- CVE-2022-22744: Fixed possible command injection via the 'Copy as curl'
feature in DevTools (bsc#1194547).
- CVE-2022-22745: Fixed leaking cross-origin URLs through
securitypolicyviolation event (bsc#1194547).
- CVE-2022-22746: Fixed calling into reportValidity could have lead to
fullscreen window spoof (bsc#1194547).
- CVE-2022-22747: Fixed crash when handling empty pkcs7
sequence(bsc#1194547).
- CVE-2022-22748: Fixed spoofed origin on external protocol launch dialog
(bsc#1194547).
- CVE-2022-22751: Fixed memory safety bugs (bsc#1194547).
Patch Instructions:
To install this openSUSE Security Update use the SUSE recommended installation methods
like YaST online_update or "zypper patch".
Alternatively you can run the command listed for your product:
- openSUSE Leap 15.3:
zypper in -t patch openSUSE-2022-136=1 openSUSE-SLE-15.3-2022-136=1
Package List:
- openSUSE Leap 15.3 (aarch64 i586 ppc64le s390x x86_64):
civetweb-1.15-lp153.2.3.1
civetweb-debuginfo-1.15-lp153.2.3.1
civetweb-debugsource-1.15-lp153.2.3.1
civetweb-devel-1.15-lp153.2.3.1
libcivetweb-cpp1_15_0-1.15-lp153.2.3.1
libcivetweb-cpp1_15_0-debuginfo-1.15-lp153.2.3.1
libcivetweb1_15_0-1.15-lp153.2.3.1
libcivetweb1_15_0-debuginfo-1.15-lp153.2.3.1
- openSUSE Leap 15.3 (aarch64 ppc64le s390x x86_64):
MozillaFirefox-91.5.0-152.12.1
MozillaFirefox-branding-upstream-91.5.0-152.12.1
MozillaFirefox-debuginfo-91.5.0-152.12.1
MozillaFirefox-debugsource-91.5.0-152.12.1
MozillaFirefox-devel-91.5.0-152.12.1
MozillaFirefox-translations-common-91.5.0-152.12.1
MozillaFirefox-translations-other-91.5.0-152.12.1
References:
https://www.suse.com/security/cve/CVE-2020-27304.html
https://www.suse.com/security/cve/CVE-2021-4140.html
https://www.suse.com/security/cve/CVE-2022-22737.html
https://www.suse.com/security/cve/CVE-2022-22738.html
https://www.suse.com/security/cve/CVE-2022-22739.html
https://www.suse.com/security/cve/CVE-2022-22740.html
https://www.suse.com/security/cve/CVE-2022-22741.html
https://www.suse.com/security/cve/CVE-2022-22742.html
https://www.suse.com/security/cve/CVE-2022-22743.html
https://www.suse.com/security/cve/CVE-2022-22744.html
https://www.suse.com/security/cve/CVE-2022-22745.html
https://www.suse.com/security/cve/CVE-2022-22746.html
https://www.suse.com/security/cve/CVE-2022-22747.html
https://www.suse.com/security/cve/CVE-2022-22748.html
https://www.suse.com/security/cve/CVE-2022-22751.html
https://bugzilla.suse.com/1191938
https://bugzilla.suse.com/1194547
https://bugzilla.suse.com/1199047
1
0
openSUSE-SU-2022:0135-1: important: Security update for busybox
by opensuse-security@opensuse.org 18 May '22
by opensuse-security@opensuse.org 18 May '22
18 May '22
SUSE Security Update: Security update for busybox
______________________________________________________________________________
Announcement ID: openSUSE-SU-2022:0135-1
Rating: important
References: #1064976 #1064978 #1069412 #1099260 #1099263
#1102912 #1121426 #1121428 #1184522 #1192869
#1198676 #1198677 #1198678 #1198679 #1198680
#1198703 #951562 #970662 #970663 #991940
Cross-References: CVE-2011-5325 CVE-2015-9261 CVE-2016-2147
CVE-2016-2148 CVE-2016-6301 CVE-2017-15873
CVE-2017-15874 CVE-2017-16544 CVE-2018-1000500
CVE-2018-1000517 CVE-2018-20679 CVE-2019-5747
CVE-2021-28831 CVE-2021-42373 CVE-2021-42374
CVE-2021-42375 CVE-2021-42376 CVE-2021-42377
CVE-2021-42378 CVE-2021-42379 CVE-2021-42380
CVE-2021-42381 CVE-2021-42382 CVE-2021-42383
CVE-2021-42384 CVE-2021-42385 CVE-2021-42386
CVE-2022-21465 CVE-2022-21471 CVE-2022-21487
CVE-2022-21488 CVE-2022-21491
CVSS scores:
CVE-2011-5325 (NVD) : 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N
CVE-2015-9261 (NVD) : 5.5 CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H
CVE-2015-9261 (SUSE): 5.5 CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H
CVE-2016-2147 (NVD) : 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
CVE-2016-2148 (NVD) : 9.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
CVE-2016-6301 (NVD) : 7.5 CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
CVE-2017-15873 (NVD) : 5.5 CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H
CVE-2017-15873 (SUSE): 7.8 CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
CVE-2017-15874 (NVD) : 5.5 CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H
CVE-2017-15874 (SUSE): 3.3 CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:L
CVE-2017-16544 (NVD) : 8.8 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
CVE-2017-16544 (SUSE): 7.8 CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
CVE-2018-1000500 (NVD) : 8.1 CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H
CVE-2018-1000500 (SUSE): 7.5 CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N
CVE-2018-1000517 (NVD) : 9.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
CVE-2018-1000517 (SUSE): 5.6 CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:L
CVE-2018-20679 (NVD) : 7.5 CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
CVE-2018-20679 (SUSE): 5.3 CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
CVE-2019-5747 (NVD) : 7.5 CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
CVE-2021-28831 (NVD) : 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
CVE-2021-28831 (SUSE): 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
CVE-2021-42373 (NVD) : 5.5 CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
CVE-2021-42374 (NVD) : 5.3 CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:L/I:N/A:H
CVE-2021-42375 (NVD) : 5.5 CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
CVE-2021-42376 (NVD) : 5.5 CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
CVE-2021-42377 (NVD) : 9.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
CVE-2021-42378 (NVD) : 7.2 CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H
CVE-2021-42379 (NVD) : 7.2 CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H
CVE-2021-42380 (NVD) : 7.2 CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H
CVE-2021-42381 (NVD) : 7.2 CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H
CVE-2021-42382 (NVD) : 7.2 CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H
CVE-2021-42383 (NVD) : 7.2 CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H
CVE-2021-42384 (NVD) : 7.2 CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H
CVE-2021-42385 (NVD) : 7.2 CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H
CVE-2021-42386 (NVD) : 7.2 CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H
CVE-2022-21465 (NVD) : 6.7 CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:C/C:N/I:L/A:H
CVE-2022-21465 (SUSE): 6.7 CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:C/C:N/I:L/A:H
CVE-2022-21471 (NVD) : 6.5 CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:N/I:N/A:H
CVE-2022-21471 (SUSE): 6.5 CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:N/I:N/A:H
CVE-2022-21487 (NVD) : 3.8 CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:L/I:N/A:N
CVE-2022-21487 (SUSE): 3.8 CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:L/I:N/A:N
CVE-2022-21488 (NVD) : 3.8 CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:N/I:L/A:N
CVE-2022-21488 (SUSE): 3.8 CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:N/I:L/A:N
CVE-2022-21491 (NVD) : 7.8 CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
CVE-2022-21491 (SUSE): 7.8 CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Affected Products:
openSUSE Leap 15.3
______________________________________________________________________________
An update that fixes 32 vulnerabilities is now available.
Description:
This update for busybox fixes the following issues:
- CVE-2011-5325: Fixed tar directory traversal (bsc#951562).
- CVE-2015-9261: Fixed segfalts and application crashes in huft_build
(bsc#1102912).
- CVE-2016-2147: Fixed out of bounds write (heap) due to integer underflow
in udhcpc (bsc#970663).
- CVE-2016-2148: Fixed heap-based buffer overflow in OPTION_6RD parsing
(bsc#970662).
- CVE-2016-6301: Fixed NTP server denial of service flaw (bsc#991940).
- CVE-2017-15873: Fixed integer overflow in get_next_block function in
archival/libarchive/decompress_bunzip2.c (bsc#1064976).
- CVE-2017-15874: Fixed integer underflow in
archival/libarchive/decompress_unlzma.c (bsc#1064978).
- CVE-2017-16544: Fixed Insufficient sanitization of filenames when
autocompleting (bsc#1069412).
- CVE-2018-1000500 : Fixed missing SSL certificate validation in wget
(bsc#1099263).
- CVE-2018-1000517: Fixed heap-based buffer overflow in the
retrieve_file_data() (bsc#1099260).
- CVE-2018-20679: Fixed out of bounds read in udhcp (bsc#1121426).
- CVE-2019-5747: Fixed out of bounds read in udhcp components
(bsc#1121428).
- CVE-2021-28831: Fixed invalid free or segmentation fault via malformed
gzip data (bsc#1184522).
- CVE-2021-42373: Fixed NULL pointer dereference in man leading to DoS
when a section name is supplied but no page argument is given
(bsc#1192869).
- CVE-2021-42374: Fixed out-of-bounds heap read in unlzma leading to
information leak and DoS when crafted LZMA-compressed input is
decompressed (bsc#1192869).
- CVE-2021-42375: Fixed incorrect handling of a special element in ash
leading to DoS when processing a crafted shell command, due to the shell
mistaking specific characters for reserved characters (bsc#1192869).
- CVE-2021-42376: Fixed NULL pointer dereference in hush leading to DoS
when processing a crafted shell command (bsc#1192869).
- CVE-2021-42377: Fixed attacker-controlled pointer free in hush leading
to DoS and possible code execution when processing a crafted shell
command (bsc#1192869).
- CVE-2021-42378: Fixed use-after-free in awk leading to DoS and possibly
code execution when processing a crafted awk pattern in the getvar_i
function (bsc#1192869).
- CVE-2021-42379: Fixed use-after-free in awk leading to DoS and possibly
code execution when processing a crafted awk pattern in the
next_input_file function (bsc#1192869).
- CVE-2021-42380: Fixed use-after-free in awk leading to DoS and possibly
code execution when processing a crafted awk pattern in the clrvar
function (bsc#1192869).
- CVE-2021-42381: Fixed use-after-free in awk leading to DoS and possibly
code execution when processing a crafted awk pattern in the hash_init
function (bsc#1192869).
- CVE-2021-42382: Fixed use-after-free in awk leading to DoS and possibly
code execution when processing a crafted awk pattern in the getvar_s
function (bsc#1192869).
- CVE-2021-42383: Fixed use-after-free in awk leading to DoS and possibly
code execution when processing a crafted awk pattern in the evaluate
function (bsc#1192869).
- CVE-2021-42384: Fixed use-after-free in awk leading to DoS and possibly
code execution when processing a crafted awk pattern in the
handle_special function (bsc#1192869).
- CVE-2021-42385: Fixed use-after-free in awk leading to DoS and possibly
code execution when processing a crafted awk pattern in the evaluate
function (bsc#1192869).
- CVE-2021-42386: Fixed use-after-free in awk leading to DoS and possibly
code execution when processing a crafted awk pattern in the nvalloc
function (bsc#1192869).
Patch Instructions:
To install this SUSE Security Update use the SUSE recommended installation methods
like YaST online_update or "zypper patch".
Alternatively you can run the command listed for your product:
- openSUSE Leap 15.3:
zypper in -t patch openSUSE-2022-135=1 openSUSE-SLE-15.3-2022-135=1
Package List:
- openSUSE Leap 15.3 (aarch64 ppc64le s390x x86_64):
busybox-1.34.1-4.9.1
busybox-static-1.34.1-4.9.1
- openSUSE Leap 15.3 (noarch):
virtualbox-guest-desktop-icons-6.1.34-lp153.2.27.2
virtualbox-guest-source-6.1.34-lp153.2.27.2
virtualbox-host-source-6.1.34-lp153.2.27.2
- openSUSE Leap 15.3 (x86_64):
python3-virtualbox-6.1.34-lp153.2.27.2
python3-virtualbox-debuginfo-6.1.34-lp153.2.27.2
virtualbox-6.1.34-lp153.2.27.2
virtualbox-debuginfo-6.1.34-lp153.2.27.2
virtualbox-debugsource-6.1.34-lp153.2.27.2
virtualbox-devel-6.1.34-lp153.2.27.2
virtualbox-guest-tools-6.1.34-lp153.2.27.2
virtualbox-guest-tools-debuginfo-6.1.34-lp153.2.27.2
virtualbox-guest-x11-6.1.34-lp153.2.27.2
virtualbox-guest-x11-debuginfo-6.1.34-lp153.2.27.2
virtualbox-kmp-debugsource-6.1.34-lp153.2.27.1
virtualbox-kmp-default-6.1.34_k5.3.18_150300.59.63-lp153.2.27.1
virtualbox-kmp-default-debuginfo-6.1.34_k5.3.18_150300.59.63-lp153.2.27.1
virtualbox-kmp-preempt-6.1.34_k5.3.18_150300.59.63-lp153.2.27.1
virtualbox-kmp-preempt-debuginfo-6.1.34_k5.3.18_150300.59.63-lp153.2.27.1
virtualbox-qt-6.1.34-lp153.2.27.2
virtualbox-qt-debuginfo-6.1.34-lp153.2.27.2
virtualbox-vnc-6.1.34-lp153.2.27.2
virtualbox-websrv-6.1.34-lp153.2.27.2
virtualbox-websrv-debuginfo-6.1.34-lp153.2.27.2
References:
https://www.suse.com/security/cve/CVE-2011-5325.html
https://www.suse.com/security/cve/CVE-2015-9261.html
https://www.suse.com/security/cve/CVE-2016-2147.html
https://www.suse.com/security/cve/CVE-2016-2148.html
https://www.suse.com/security/cve/CVE-2016-6301.html
https://www.suse.com/security/cve/CVE-2017-15873.html
https://www.suse.com/security/cve/CVE-2017-15874.html
https://www.suse.com/security/cve/CVE-2017-16544.html
https://www.suse.com/security/cve/CVE-2018-1000500.html
https://www.suse.com/security/cve/CVE-2018-1000517.html
https://www.suse.com/security/cve/CVE-2018-20679.html
https://www.suse.com/security/cve/CVE-2019-5747.html
https://www.suse.com/security/cve/CVE-2021-28831.html
https://www.suse.com/security/cve/CVE-2021-42373.html
https://www.suse.com/security/cve/CVE-2021-42374.html
https://www.suse.com/security/cve/CVE-2021-42375.html
https://www.suse.com/security/cve/CVE-2021-42376.html
https://www.suse.com/security/cve/CVE-2021-42377.html
https://www.suse.com/security/cve/CVE-2021-42378.html
https://www.suse.com/security/cve/CVE-2021-42379.html
https://www.suse.com/security/cve/CVE-2021-42380.html
https://www.suse.com/security/cve/CVE-2021-42381.html
https://www.suse.com/security/cve/CVE-2021-42382.html
https://www.suse.com/security/cve/CVE-2021-42383.html
https://www.suse.com/security/cve/CVE-2021-42384.html
https://www.suse.com/security/cve/CVE-2021-42385.html
https://www.suse.com/security/cve/CVE-2021-42386.html
https://www.suse.com/security/cve/CVE-2022-21465.html
https://www.suse.com/security/cve/CVE-2022-21471.html
https://www.suse.com/security/cve/CVE-2022-21487.html
https://www.suse.com/security/cve/CVE-2022-21488.html
https://www.suse.com/security/cve/CVE-2022-21491.html
https://bugzilla.suse.com/1064976
https://bugzilla.suse.com/1064978
https://bugzilla.suse.com/1069412
https://bugzilla.suse.com/1099260
https://bugzilla.suse.com/1099263
https://bugzilla.suse.com/1102912
https://bugzilla.suse.com/1121426
https://bugzilla.suse.com/1121428
https://bugzilla.suse.com/1184522
https://bugzilla.suse.com/1192869
https://bugzilla.suse.com/1198676
https://bugzilla.suse.com/1198677
https://bugzilla.suse.com/1198678
https://bugzilla.suse.com/1198679
https://bugzilla.suse.com/1198680
https://bugzilla.suse.com/1198703
https://bugzilla.suse.com/951562
https://bugzilla.suse.com/970662
https://bugzilla.suse.com/970663
https://bugzilla.suse.com/991940
1
0
SUSE-SU-2022:1718-1: important: Security update for e2fsprogs
by opensuse-security@opensuse.org 17 May '22
by opensuse-security@opensuse.org 17 May '22
17 May '22
SUSE Security Update: Security update for e2fsprogs
______________________________________________________________________________
Announcement ID: SUSE-SU-2022:1718-1
Rating: important
References: #1198446
Cross-References: CVE-2022-1304
CVSS scores:
CVE-2022-1304 (NVD) : 7.8 CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
CVE-2022-1304 (SUSE): 7 CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:H
Affected Products:
SUSE Linux Enterprise Desktop 15-SP4
SUSE Linux Enterprise High Performance Computing 15-SP4
SUSE Linux Enterprise Module for Basesystem 15-SP4
SUSE Linux Enterprise Server 15-SP4
SUSE Linux Enterprise Server for SAP Applications 15-SP4
openSUSE Leap 15.4
______________________________________________________________________________
An update that fixes one vulnerability is now available.
Description:
This update for e2fsprogs fixes the following issues:
- CVE-2022-1304: Fixed out-of-bounds read/write leading to segmentation
fault and possibly arbitrary code execution. (bsc#1198446)
Patch Instructions:
To install this SUSE Security Update use the SUSE recommended installation methods
like YaST online_update or "zypper patch".
Alternatively you can run the command listed for your product:
- openSUSE Leap 15.4:
zypper in -t patch openSUSE-SLE-15.4-2022-1718=1
- SUSE Linux Enterprise Module for Basesystem 15-SP4:
zypper in -t patch SUSE-SLE-Module-Basesystem-15-SP4-2022-1718=1
Package List:
- openSUSE Leap 15.4 (aarch64 ppc64le s390x x86_64):
e2fsprogs-1.46.4-150400.3.3.1
e2fsprogs-debuginfo-1.46.4-150400.3.3.1
e2fsprogs-debugsource-1.46.4-150400.3.3.1
e2fsprogs-devel-1.46.4-150400.3.3.1
e2fsprogs-scrub-1.46.4-150400.3.3.1
libcom_err-devel-1.46.4-150400.3.3.1
libcom_err-devel-static-1.46.4-150400.3.3.1
libcom_err2-1.46.4-150400.3.3.1
libcom_err2-debuginfo-1.46.4-150400.3.3.1
libext2fs-devel-1.46.4-150400.3.3.1
libext2fs-devel-static-1.46.4-150400.3.3.1
libext2fs2-1.46.4-150400.3.3.1
libext2fs2-debuginfo-1.46.4-150400.3.3.1
- openSUSE Leap 15.4 (x86_64):
e2fsprogs-32bit-debuginfo-1.46.4-150400.3.3.1
libcom_err-devel-32bit-1.46.4-150400.3.3.1
libcom_err2-32bit-1.46.4-150400.3.3.1
libcom_err2-32bit-debuginfo-1.46.4-150400.3.3.1
libext2fs-devel-32bit-1.46.4-150400.3.3.1
libext2fs2-32bit-1.46.4-150400.3.3.1
libext2fs2-32bit-debuginfo-1.46.4-150400.3.3.1
- SUSE Linux Enterprise Module for Basesystem 15-SP4 (aarch64 ppc64le s390x x86_64):
e2fsprogs-1.46.4-150400.3.3.1
e2fsprogs-debuginfo-1.46.4-150400.3.3.1
e2fsprogs-debugsource-1.46.4-150400.3.3.1
e2fsprogs-devel-1.46.4-150400.3.3.1
libcom_err-devel-1.46.4-150400.3.3.1
libcom_err-devel-static-1.46.4-150400.3.3.1
libcom_err2-1.46.4-150400.3.3.1
libcom_err2-debuginfo-1.46.4-150400.3.3.1
libext2fs-devel-1.46.4-150400.3.3.1
libext2fs-devel-static-1.46.4-150400.3.3.1
libext2fs2-1.46.4-150400.3.3.1
libext2fs2-debuginfo-1.46.4-150400.3.3.1
- SUSE Linux Enterprise Module for Basesystem 15-SP4 (x86_64):
e2fsprogs-32bit-debuginfo-1.46.4-150400.3.3.1
libcom_err2-32bit-1.46.4-150400.3.3.1
libcom_err2-32bit-debuginfo-1.46.4-150400.3.3.1
References:
https://www.suse.com/security/cve/CVE-2022-1304.html
https://bugzilla.suse.com/1198446
1
0
SUSE-SU-2022:1719-1: important: Security update for MozillaThunderbird
by opensuse-security@opensuse.org 17 May '22
by opensuse-security@opensuse.org 17 May '22
17 May '22
SUSE Security Update: Security update for MozillaThunderbird
______________________________________________________________________________
Announcement ID: SUSE-SU-2022:1719-1
Rating: important
References: #1198970
Cross-References: CVE-2022-1520 CVE-2022-29909 CVE-2022-29911
CVE-2022-29912 CVE-2022-29913 CVE-2022-29914
CVE-2022-29916 CVE-2022-29917
CVSS scores:
CVE-2022-1520 (SUSE): 4.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:N
CVE-2022-29909 (SUSE): 7.5 CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H
CVE-2022-29911 (SUSE): 7.5 CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H
CVE-2022-29912 (SUSE): 6.1 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
CVE-2022-29913 (SUSE): 6.1 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
CVE-2022-29914 (SUSE): 7.5 CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H
CVE-2022-29916 (SUSE): 7.5 CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H
CVE-2022-29917 (SUSE): 7.5 CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H
Affected Products:
SUSE Linux Enterprise Desktop 15-SP3
SUSE Linux Enterprise Desktop 15-SP4
SUSE Linux Enterprise High Performance Computing 15-SP3
SUSE Linux Enterprise High Performance Computing 15-SP4
SUSE Linux Enterprise Module for Packagehub Subpackages 15-SP3
SUSE Linux Enterprise Module for Packagehub Subpackages 15-SP4
SUSE Linux Enterprise Server 15-SP3
SUSE Linux Enterprise Server 15-SP4
SUSE Linux Enterprise Server for SAP Applications 15-SP3
SUSE Linux Enterprise Server for SAP Applications 15-SP4
SUSE Linux Enterprise Workstation Extension 15-SP3
SUSE Linux Enterprise Workstation Extension 15-SP4
SUSE Manager Proxy 4.2
SUSE Manager Server 4.2
openSUSE Leap 15.3
openSUSE Leap 15.4
______________________________________________________________________________
An update that fixes 8 vulnerabilities is now available.
Description:
This update for MozillaThunderbird fixes the following issues:
Various security fixes MFSA 2022-18 (bsc#1198970):
- CVE-2022-1520: Incorrect security status shown after viewing an attached
email (bmo#1745019).
- CVE-2022-29914: Fullscreen notification bypass using popups
(bmo#1746448).
- CVE-2022-29909: Bypassing permission prompt in nested browsing contexts
(bmo#1755081).
- CVE-2022-29916: Leaking browser history with CSS variables (bmo#1760674).
- CVE-2022-29911: iframe sandbox bypass (bmo#1761981).
- CVE-2022-29912: Reader mode bypassed SameSite cookies (bmo#1692655).
- CVE-2022-29913: Speech Synthesis feature not properly disabled
(bmo#1764778).
- CVE-2022-29917: Memory safety bugs fixed in Thunderbird 91.9
(bmo#1684739, bmo#1706441, bmo#1753298, bmo#1762614, bmo#1762620).
Patch Instructions:
To install this SUSE Security Update use the SUSE recommended installation methods
like YaST online_update or "zypper patch".
Alternatively you can run the command listed for your product:
- openSUSE Leap 15.4:
zypper in -t patch openSUSE-SLE-15.4-2022-1719=1
- openSUSE Leap 15.3:
zypper in -t patch openSUSE-SLE-15.3-2022-1719=1
- SUSE Linux Enterprise Workstation Extension 15-SP4:
zypper in -t patch SUSE-SLE-Product-WE-15-SP4-2022-1719=1
- SUSE Linux Enterprise Workstation Extension 15-SP3:
zypper in -t patch SUSE-SLE-Product-WE-15-SP3-2022-1719=1
- SUSE Linux Enterprise Module for Packagehub Subpackages 15-SP4:
zypper in -t patch SUSE-SLE-Module-Packagehub-Subpackages-15-SP4-2022-1719=1
- SUSE Linux Enterprise Module for Packagehub Subpackages 15-SP3:
zypper in -t patch SUSE-SLE-Module-Packagehub-Subpackages-15-SP3-2022-1719=1
Package List:
- openSUSE Leap 15.4 (aarch64 ppc64le s390x x86_64):
MozillaThunderbird-91.9.0-150200.8.68.2
MozillaThunderbird-debuginfo-91.9.0-150200.8.68.2
MozillaThunderbird-debugsource-91.9.0-150200.8.68.2
MozillaThunderbird-translations-common-91.9.0-150200.8.68.2
MozillaThunderbird-translations-other-91.9.0-150200.8.68.2
- openSUSE Leap 15.3 (aarch64 ppc64le s390x x86_64):
MozillaThunderbird-91.9.0-150200.8.68.2
MozillaThunderbird-debuginfo-91.9.0-150200.8.68.2
MozillaThunderbird-debugsource-91.9.0-150200.8.68.2
MozillaThunderbird-translations-common-91.9.0-150200.8.68.2
MozillaThunderbird-translations-other-91.9.0-150200.8.68.2
- SUSE Linux Enterprise Workstation Extension 15-SP4 (x86_64):
MozillaThunderbird-91.9.0-150200.8.68.2
MozillaThunderbird-debuginfo-91.9.0-150200.8.68.2
MozillaThunderbird-debugsource-91.9.0-150200.8.68.2
MozillaThunderbird-translations-common-91.9.0-150200.8.68.2
MozillaThunderbird-translations-other-91.9.0-150200.8.68.2
- SUSE Linux Enterprise Workstation Extension 15-SP3 (x86_64):
MozillaThunderbird-91.9.0-150200.8.68.2
MozillaThunderbird-debuginfo-91.9.0-150200.8.68.2
MozillaThunderbird-debugsource-91.9.0-150200.8.68.2
MozillaThunderbird-translations-common-91.9.0-150200.8.68.2
MozillaThunderbird-translations-other-91.9.0-150200.8.68.2
- SUSE Linux Enterprise Module for Packagehub Subpackages 15-SP4 (aarch64 ppc64le s390x):
MozillaThunderbird-91.9.0-150200.8.68.2
MozillaThunderbird-debuginfo-91.9.0-150200.8.68.2
MozillaThunderbird-debugsource-91.9.0-150200.8.68.2
MozillaThunderbird-translations-common-91.9.0-150200.8.68.2
MozillaThunderbird-translations-other-91.9.0-150200.8.68.2
- SUSE Linux Enterprise Module for Packagehub Subpackages 15-SP3 (aarch64 ppc64le s390x):
MozillaThunderbird-91.9.0-150200.8.68.2
MozillaThunderbird-debuginfo-91.9.0-150200.8.68.2
MozillaThunderbird-debugsource-91.9.0-150200.8.68.2
MozillaThunderbird-translations-common-91.9.0-150200.8.68.2
MozillaThunderbird-translations-other-91.9.0-150200.8.68.2
References:
https://www.suse.com/security/cve/CVE-2022-1520.html
https://www.suse.com/security/cve/CVE-2022-29909.html
https://www.suse.com/security/cve/CVE-2022-29911.html
https://www.suse.com/security/cve/CVE-2022-29912.html
https://www.suse.com/security/cve/CVE-2022-29913.html
https://www.suse.com/security/cve/CVE-2022-29914.html
https://www.suse.com/security/cve/CVE-2022-29916.html
https://www.suse.com/security/cve/CVE-2022-29917.html
https://bugzilla.suse.com/1198970
1
0
SUSE-SU-2022:1717-1: important: Security update for nodejs10
by opensuse-security@opensuse.org 17 May '22
by opensuse-security@opensuse.org 17 May '22
17 May '22
SUSE Security Update: Security update for nodejs10
______________________________________________________________________________
Announcement ID: SUSE-SU-2022:1717-1
Rating: important
References: #1191962 #1191963 #1192153 #1192154 #1192696
#1194514 #1194819 #1197283 #1198247
Cross-References: CVE-2021-23343 CVE-2021-32803 CVE-2021-32804
CVE-2021-3807 CVE-2021-3918 CVE-2021-44906
CVE-2021-44907 CVE-2022-0235 CVE-2022-21824
CVSS scores:
CVE-2021-23343 (NVD) : 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
CVE-2021-23343 (SUSE): 5.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L
CVE-2021-32803 (NVD) : 8.1 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:H
CVE-2021-32803 (SUSE): 8.1 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:H
CVE-2021-32804 (NVD) : 8.1 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:H
CVE-2021-32804 (SUSE): 8.1 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:H
CVE-2021-3807 (NVD) : 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
CVE-2021-3807 (SUSE): 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
CVE-2021-3918 (NVD) : 9.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
CVE-2021-3918 (SUSE): 8.1 CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H
CVE-2021-44906 (NVD) : 9.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
CVE-2021-44906 (SUSE): 5.6 CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:L
CVE-2021-44907 (NVD) : 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
CVE-2021-44907 (SUSE): 3.1 CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:N/I:L/A:N
CVE-2022-0235 (SUSE): 6.1 CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:H/I:N/A:N
CVE-2022-21824 (NVD) : 8.2 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:H
CVE-2022-21824 (SUSE): 4 CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:L
Affected Products:
SUSE CaaS Platform 4.0
SUSE Enterprise Storage 6
SUSE Enterprise Storage 7
SUSE Linux Enterprise High Performance Computing 15-ESPOS
SUSE Linux Enterprise High Performance Computing 15-LTSS
SUSE Linux Enterprise High Performance Computing 15-SP1-ESPOS
SUSE Linux Enterprise High Performance Computing 15-SP1-LTSS
SUSE Linux Enterprise High Performance Computing 15-SP2-ESPOS
SUSE Linux Enterprise High Performance Computing 15-SP2-LTSS
SUSE Linux Enterprise Server 15-LTSS
SUSE Linux Enterprise Server 15-SP1-BCL
SUSE Linux Enterprise Server 15-SP1-LTSS
SUSE Linux Enterprise Server 15-SP2-BCL
SUSE Linux Enterprise Server 15-SP2-LTSS
SUSE Linux Enterprise Server for SAP 15
SUSE Linux Enterprise Server for SAP 15-SP1
SUSE Linux Enterprise Server for SAP 15-SP2
SUSE Manager Proxy 4.1
SUSE Manager Retail Branch Server 4.1
SUSE Manager Server 4.1
openSUSE Leap 15.3
openSUSE Leap 15.4
______________________________________________________________________________
An update that fixes 9 vulnerabilities is now available.
Description:
This update for nodejs10 fixes the following issues:
- CVE-2021-23343: Fixed ReDoS via splitDeviceRe, splitTailRe and
splitPathRe (bsc#1192153).
- CVE-2021-32803: Fixed insufficient symlink protection in node-tar
allowing arbitrary file creation and overwrite (bsc#1191963).
- CVE-2021-32804: Fixed insufficient absolute path sanitization in
node-tar allowing arbitrary file creation and overwrite (bsc#1191962).
- CVE-2021-3918: Fixed improper controlled modification of object
prototype attributes in json-schema (bsc#1192696).
- CVE-2021-3807: Fixed regular expression denial of service (ReDoS)
matching ANSI escape codes in node-ansi-regex (bsc#1192154).
- CVE-2022-21824: Fixed prototype pollution via console.table
(bsc#1194514).
- CVE-2021-44906: Fixed prototype pollution in npm dependency
(bsc#1198247).
- CVE-2021-44907: Fixed insuficient sanitation in npm dependency
(bsc#1197283).
- CVE-2022-0235: Fixed passing of cookie data and sensitive headers to
different hostnames in node-fetch-npm (bsc#1194819).
Patch Instructions:
To install this SUSE Security Update use the SUSE recommended installation methods
like YaST online_update or "zypper patch".
Alternatively you can run the command listed for your product:
- openSUSE Leap 15.4:
zypper in -t patch openSUSE-SLE-15.4-2022-1717=1
- openSUSE Leap 15.3:
zypper in -t patch openSUSE-SLE-15.3-2022-1717=1
- SUSE Manager Server 4.1:
zypper in -t patch SUSE-SLE-Product-SUSE-Manager-Server-4.1-2022-1717=1
- SUSE Manager Retail Branch Server 4.1:
zypper in -t patch SUSE-SLE-Product-SUSE-Manager-Retail-Branch-Server-4.1-2022-1717=1
- SUSE Manager Proxy 4.1:
zypper in -t patch SUSE-SLE-Product-SUSE-Manager-Proxy-4.1-2022-1717=1
- SUSE Linux Enterprise Server for SAP 15-SP2:
zypper in -t patch SUSE-SLE-Product-SLES_SAP-15-SP2-2022-1717=1
- SUSE Linux Enterprise Server for SAP 15-SP1:
zypper in -t patch SUSE-SLE-Product-SLES_SAP-15-SP1-2022-1717=1
- SUSE Linux Enterprise Server for SAP 15:
zypper in -t patch SUSE-SLE-Product-SLES_SAP-15-2022-1717=1
- SUSE Linux Enterprise Server 15-SP2-LTSS:
zypper in -t patch SUSE-SLE-Product-SLES-15-SP2-LTSS-2022-1717=1
- SUSE Linux Enterprise Server 15-SP2-BCL:
zypper in -t patch SUSE-SLE-Product-SLES-15-SP2-BCL-2022-1717=1
- SUSE Linux Enterprise Server 15-SP1-LTSS:
zypper in -t patch SUSE-SLE-Product-SLES-15-SP1-LTSS-2022-1717=1
- SUSE Linux Enterprise Server 15-SP1-BCL:
zypper in -t patch SUSE-SLE-Product-SLES-15-SP1-BCL-2022-1717=1
- SUSE Linux Enterprise Server 15-LTSS:
zypper in -t patch SUSE-SLE-Product-SLES-15-2022-1717=1
- SUSE Linux Enterprise High Performance Computing 15-SP2-LTSS:
zypper in -t patch SUSE-SLE-Product-HPC-15-SP2-LTSS-2022-1717=1
- SUSE Linux Enterprise High Performance Computing 15-SP2-ESPOS:
zypper in -t patch SUSE-SLE-Product-HPC-15-SP2-ESPOS-2022-1717=1
- SUSE Linux Enterprise High Performance Computing 15-SP1-LTSS:
zypper in -t patch SUSE-SLE-Product-HPC-15-SP1-LTSS-2022-1717=1
- SUSE Linux Enterprise High Performance Computing 15-SP1-ESPOS:
zypper in -t patch SUSE-SLE-Product-HPC-15-SP1-ESPOS-2022-1717=1
- SUSE Linux Enterprise High Performance Computing 15-LTSS:
zypper in -t patch SUSE-SLE-Product-HPC-15-2022-1717=1
- SUSE Linux Enterprise High Performance Computing 15-ESPOS:
zypper in -t patch SUSE-SLE-Product-HPC-15-2022-1717=1
- SUSE Enterprise Storage 7:
zypper in -t patch SUSE-Storage-7-2022-1717=1
- SUSE Enterprise Storage 6:
zypper in -t patch SUSE-Storage-6-2022-1717=1
- SUSE CaaS Platform 4.0:
To install this update, use the SUSE CaaS Platform 'skuba' tool. It
will inform you if it detects new updates and let you then trigger
updating of the complete cluster in a controlled way.
Package List:
- openSUSE Leap 15.4 (aarch64 ppc64le s390x x86_64):
nodejs10-10.24.1-150000.1.44.1
nodejs10-debuginfo-10.24.1-150000.1.44.1
nodejs10-debugsource-10.24.1-150000.1.44.1
nodejs10-devel-10.24.1-150000.1.44.1
npm10-10.24.1-150000.1.44.1
- openSUSE Leap 15.4 (noarch):
nodejs10-docs-10.24.1-150000.1.44.1
- openSUSE Leap 15.3 (aarch64 ppc64le s390x x86_64):
nodejs10-10.24.1-150000.1.44.1
nodejs10-debuginfo-10.24.1-150000.1.44.1
nodejs10-debugsource-10.24.1-150000.1.44.1
nodejs10-devel-10.24.1-150000.1.44.1
npm10-10.24.1-150000.1.44.1
- openSUSE Leap 15.3 (noarch):
nodejs10-docs-10.24.1-150000.1.44.1
- SUSE Manager Server 4.1 (ppc64le s390x x86_64):
nodejs10-10.24.1-150000.1.44.1
nodejs10-debuginfo-10.24.1-150000.1.44.1
nodejs10-debugsource-10.24.1-150000.1.44.1
nodejs10-devel-10.24.1-150000.1.44.1
npm10-10.24.1-150000.1.44.1
- SUSE Manager Server 4.1 (noarch):
nodejs10-docs-10.24.1-150000.1.44.1
- SUSE Manager Retail Branch Server 4.1 (noarch):
nodejs10-docs-10.24.1-150000.1.44.1
- SUSE Manager Retail Branch Server 4.1 (x86_64):
nodejs10-10.24.1-150000.1.44.1
nodejs10-debuginfo-10.24.1-150000.1.44.1
nodejs10-debugsource-10.24.1-150000.1.44.1
nodejs10-devel-10.24.1-150000.1.44.1
npm10-10.24.1-150000.1.44.1
- SUSE Manager Proxy 4.1 (x86_64):
nodejs10-10.24.1-150000.1.44.1
nodejs10-debuginfo-10.24.1-150000.1.44.1
nodejs10-debugsource-10.24.1-150000.1.44.1
nodejs10-devel-10.24.1-150000.1.44.1
npm10-10.24.1-150000.1.44.1
- SUSE Manager Proxy 4.1 (noarch):
nodejs10-docs-10.24.1-150000.1.44.1
- SUSE Linux Enterprise Server for SAP 15-SP2 (ppc64le x86_64):
nodejs10-10.24.1-150000.1.44.1
nodejs10-debuginfo-10.24.1-150000.1.44.1
nodejs10-debugsource-10.24.1-150000.1.44.1
nodejs10-devel-10.24.1-150000.1.44.1
npm10-10.24.1-150000.1.44.1
- SUSE Linux Enterprise Server for SAP 15-SP2 (noarch):
nodejs10-docs-10.24.1-150000.1.44.1
- SUSE Linux Enterprise Server for SAP 15-SP1 (ppc64le x86_64):
nodejs10-10.24.1-150000.1.44.1
nodejs10-debuginfo-10.24.1-150000.1.44.1
nodejs10-debugsource-10.24.1-150000.1.44.1
nodejs10-devel-10.24.1-150000.1.44.1
npm10-10.24.1-150000.1.44.1
- SUSE Linux Enterprise Server for SAP 15-SP1 (noarch):
nodejs10-docs-10.24.1-150000.1.44.1
- SUSE Linux Enterprise Server for SAP 15 (ppc64le x86_64):
nodejs10-10.24.1-150000.1.44.1
nodejs10-debuginfo-10.24.1-150000.1.44.1
nodejs10-debugsource-10.24.1-150000.1.44.1
nodejs10-devel-10.24.1-150000.1.44.1
npm10-10.24.1-150000.1.44.1
- SUSE Linux Enterprise Server for SAP 15 (noarch):
nodejs10-docs-10.24.1-150000.1.44.1
- SUSE Linux Enterprise Server 15-SP2-LTSS (aarch64 ppc64le s390x x86_64):
nodejs10-10.24.1-150000.1.44.1
nodejs10-debuginfo-10.24.1-150000.1.44.1
nodejs10-debugsource-10.24.1-150000.1.44.1
nodejs10-devel-10.24.1-150000.1.44.1
npm10-10.24.1-150000.1.44.1
- SUSE Linux Enterprise Server 15-SP2-LTSS (noarch):
nodejs10-docs-10.24.1-150000.1.44.1
- SUSE Linux Enterprise Server 15-SP2-BCL (x86_64):
nodejs10-10.24.1-150000.1.44.1
nodejs10-debuginfo-10.24.1-150000.1.44.1
nodejs10-debugsource-10.24.1-150000.1.44.1
nodejs10-devel-10.24.1-150000.1.44.1
npm10-10.24.1-150000.1.44.1
- SUSE Linux Enterprise Server 15-SP2-BCL (noarch):
nodejs10-docs-10.24.1-150000.1.44.1
- SUSE Linux Enterprise Server 15-SP1-LTSS (aarch64 ppc64le s390x x86_64):
nodejs10-10.24.1-150000.1.44.1
nodejs10-debuginfo-10.24.1-150000.1.44.1
nodejs10-debugsource-10.24.1-150000.1.44.1
nodejs10-devel-10.24.1-150000.1.44.1
npm10-10.24.1-150000.1.44.1
- SUSE Linux Enterprise Server 15-SP1-LTSS (noarch):
nodejs10-docs-10.24.1-150000.1.44.1
- SUSE Linux Enterprise Server 15-SP1-BCL (noarch):
nodejs10-docs-10.24.1-150000.1.44.1
- SUSE Linux Enterprise Server 15-SP1-BCL (x86_64):
nodejs10-10.24.1-150000.1.44.1
nodejs10-debuginfo-10.24.1-150000.1.44.1
nodejs10-debugsource-10.24.1-150000.1.44.1
nodejs10-devel-10.24.1-150000.1.44.1
npm10-10.24.1-150000.1.44.1
- SUSE Linux Enterprise Server 15-LTSS (aarch64 s390x):
nodejs10-10.24.1-150000.1.44.1
nodejs10-debuginfo-10.24.1-150000.1.44.1
nodejs10-debugsource-10.24.1-150000.1.44.1
nodejs10-devel-10.24.1-150000.1.44.1
npm10-10.24.1-150000.1.44.1
- SUSE Linux Enterprise Server 15-LTSS (noarch):
nodejs10-docs-10.24.1-150000.1.44.1
- SUSE Linux Enterprise High Performance Computing 15-SP2-LTSS (aarch64 x86_64):
nodejs10-10.24.1-150000.1.44.1
nodejs10-debuginfo-10.24.1-150000.1.44.1
nodejs10-debugsource-10.24.1-150000.1.44.1
nodejs10-devel-10.24.1-150000.1.44.1
npm10-10.24.1-150000.1.44.1
- SUSE Linux Enterprise High Performance Computing 15-SP2-LTSS (noarch):
nodejs10-docs-10.24.1-150000.1.44.1
- SUSE Linux Enterprise High Performance Computing 15-SP2-ESPOS (aarch64 x86_64):
nodejs10-10.24.1-150000.1.44.1
nodejs10-debuginfo-10.24.1-150000.1.44.1
nodejs10-debugsource-10.24.1-150000.1.44.1
nodejs10-devel-10.24.1-150000.1.44.1
npm10-10.24.1-150000.1.44.1
- SUSE Linux Enterprise High Performance Computing 15-SP2-ESPOS (noarch):
nodejs10-docs-10.24.1-150000.1.44.1
- SUSE Linux Enterprise High Performance Computing 15-SP1-LTSS (aarch64 x86_64):
nodejs10-10.24.1-150000.1.44.1
nodejs10-debuginfo-10.24.1-150000.1.44.1
nodejs10-debugsource-10.24.1-150000.1.44.1
nodejs10-devel-10.24.1-150000.1.44.1
npm10-10.24.1-150000.1.44.1
- SUSE Linux Enterprise High Performance Computing 15-SP1-LTSS (noarch):
nodejs10-docs-10.24.1-150000.1.44.1
- SUSE Linux Enterprise High Performance Computing 15-SP1-ESPOS (aarch64 x86_64):
nodejs10-10.24.1-150000.1.44.1
nodejs10-debuginfo-10.24.1-150000.1.44.1
nodejs10-debugsource-10.24.1-150000.1.44.1
nodejs10-devel-10.24.1-150000.1.44.1
npm10-10.24.1-150000.1.44.1
- SUSE Linux Enterprise High Performance Computing 15-SP1-ESPOS (noarch):
nodejs10-docs-10.24.1-150000.1.44.1
- SUSE Linux Enterprise High Performance Computing 15-LTSS (aarch64 x86_64):
nodejs10-10.24.1-150000.1.44.1
nodejs10-debuginfo-10.24.1-150000.1.44.1
nodejs10-debugsource-10.24.1-150000.1.44.1
nodejs10-devel-10.24.1-150000.1.44.1
npm10-10.24.1-150000.1.44.1
- SUSE Linux Enterprise High Performance Computing 15-LTSS (noarch):
nodejs10-docs-10.24.1-150000.1.44.1
- SUSE Linux Enterprise High Performance Computing 15-ESPOS (aarch64 x86_64):
nodejs10-10.24.1-150000.1.44.1
nodejs10-debuginfo-10.24.1-150000.1.44.1
nodejs10-debugsource-10.24.1-150000.1.44.1
nodejs10-devel-10.24.1-150000.1.44.1
npm10-10.24.1-150000.1.44.1
- SUSE Linux Enterprise High Performance Computing 15-ESPOS (noarch):
nodejs10-docs-10.24.1-150000.1.44.1
- SUSE Enterprise Storage 7 (aarch64 x86_64):
nodejs10-10.24.1-150000.1.44.1
nodejs10-debuginfo-10.24.1-150000.1.44.1
nodejs10-debugsource-10.24.1-150000.1.44.1
nodejs10-devel-10.24.1-150000.1.44.1
npm10-10.24.1-150000.1.44.1
- SUSE Enterprise Storage 7 (noarch):
nodejs10-docs-10.24.1-150000.1.44.1
- SUSE Enterprise Storage 6 (aarch64 x86_64):
nodejs10-10.24.1-150000.1.44.1
nodejs10-debuginfo-10.24.1-150000.1.44.1
nodejs10-debugsource-10.24.1-150000.1.44.1
nodejs10-devel-10.24.1-150000.1.44.1
npm10-10.24.1-150000.1.44.1
- SUSE Enterprise Storage 6 (noarch):
nodejs10-docs-10.24.1-150000.1.44.1
- SUSE CaaS Platform 4.0 (x86_64):
nodejs10-10.24.1-150000.1.44.1
nodejs10-debuginfo-10.24.1-150000.1.44.1
nodejs10-debugsource-10.24.1-150000.1.44.1
nodejs10-devel-10.24.1-150000.1.44.1
npm10-10.24.1-150000.1.44.1
- SUSE CaaS Platform 4.0 (noarch):
nodejs10-docs-10.24.1-150000.1.44.1
References:
https://www.suse.com/security/cve/CVE-2021-23343.html
https://www.suse.com/security/cve/CVE-2021-32803.html
https://www.suse.com/security/cve/CVE-2021-32804.html
https://www.suse.com/security/cve/CVE-2021-3807.html
https://www.suse.com/security/cve/CVE-2021-3918.html
https://www.suse.com/security/cve/CVE-2021-44906.html
https://www.suse.com/security/cve/CVE-2021-44907.html
https://www.suse.com/security/cve/CVE-2022-0235.html
https://www.suse.com/security/cve/CVE-2022-21824.html
https://bugzilla.suse.com/1191962
https://bugzilla.suse.com/1191963
https://bugzilla.suse.com/1192153
https://bugzilla.suse.com/1192154
https://bugzilla.suse.com/1192696
https://bugzilla.suse.com/1194514
https://bugzilla.suse.com/1194819
https://bugzilla.suse.com/1197283
https://bugzilla.suse.com/1198247
1
0
openSUSE-SU-2022:0134-1: important: Security update for python-numpy
by opensuse-security@opensuse.org 17 May '22
by opensuse-security@opensuse.org 17 May '22
17 May '22
openSUSE Security Update: Security update for python-numpy
______________________________________________________________________________
Announcement ID: openSUSE-SU-2022:0134-1
Rating: important
References: #1190345 #1193907 #1193913
Cross-References: CVE-2021-21897 CVE-2021-33430 CVE-2021-41496
CVSS scores:
CVE-2021-21897 (NVD) : 8.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
CVE-2021-21897 (SUSE): 8.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
CVE-2021-33430 (NVD) : 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
CVE-2021-33430 (SUSE): 5.5 CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H
CVE-2021-41496 (NVD) : 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
CVE-2021-41496 (SUSE): 5.5 CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H
Affected Products:
openSUSE Backports SLE-15-SP3
openSUSE Leap 15.3
______________________________________________________________________________
An update that fixes three vulnerabilities is now available.
Description:
This update for python-numpy fixes the following issues:
- CVE-2021-33430: Fixed buffer overflow that could lead to DoS in
PyArray_NewFromDescr_int function of ctors.c (bsc#1193913).
- CVE-2021-41496: Fixed buffer overflow that could lead to DoS in
array_from_pyobj function of fortranobject.c (bsc#1193907).
Patch Instructions:
To install this openSUSE Security Update use the SUSE recommended installation methods
like YaST online_update or "zypper patch".
Alternatively you can run the command listed for your product:
- openSUSE Leap 15.3:
zypper in -t patch openSUSE-SLE-15.3-2022-134=1
- openSUSE Backports SLE-15-SP3:
zypper in -t patch openSUSE-2022-134=1
Package List:
- openSUSE Leap 15.3 (aarch64 ppc64le s390x x86_64):
python-numpy-debugsource-1.17.3-10.1
python-numpy_1_17_3-gnu-hpc-debugsource-1.17.3-10.1
python3-numpy-1.17.3-10.1
python3-numpy-debuginfo-1.17.3-10.1
python3-numpy-devel-1.17.3-10.1
python3-numpy-gnu-hpc-1.17.3-10.1
python3-numpy-gnu-hpc-devel-1.17.3-10.1
python3-numpy_1_17_3-gnu-hpc-1.17.3-10.1
python3-numpy_1_17_3-gnu-hpc-debuginfo-1.17.3-10.1
python3-numpy_1_17_3-gnu-hpc-devel-1.17.3-10.1
- openSUSE Backports SLE-15-SP3 (aarch64 i586 ppc64le s390x x86_64):
dxflib-devel-3.17.0-bp153.2.3.1
libdxflib-3_17_0-1-3.17.0-bp153.2.3.1
References:
https://www.suse.com/security/cve/CVE-2021-21897.html
https://www.suse.com/security/cve/CVE-2021-33430.html
https://www.suse.com/security/cve/CVE-2021-41496.html
https://bugzilla.suse.com/1190345
https://bugzilla.suse.com/1193907
https://bugzilla.suse.com/1193913
1
0
SUSE-SU-2022:1694-1: moderate: Security update for nodejs8
by opensuse-security@opensuse.org 17 May '22
by opensuse-security@opensuse.org 17 May '22
17 May '22
SUSE Security Update: Security update for nodejs8
______________________________________________________________________________
Announcement ID: SUSE-SU-2022:1694-1
Rating: moderate
References: #1194819 #1197283 #1198247
Cross-References: CVE-2021-44906 CVE-2021-44907 CVE-2022-0235
CVSS scores:
CVE-2021-44906 (NVD) : 9.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
CVE-2021-44906 (SUSE): 5.6 CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:L
CVE-2021-44907 (NVD) : 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
CVE-2021-44907 (SUSE): 3.1 CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:N/I:L/A:N
CVE-2022-0235 (SUSE): 6.1 CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:H/I:N/A:N
Affected Products:
openSUSE Leap 15.3
openSUSE Leap 15.4
______________________________________________________________________________
An update that fixes three vulnerabilities is now available.
Description:
This update for nodejs8 fixes the following issues:
- CVE-2021-44906: Fixed prototype pollution in npm dependency
(bsc#1198247).
- CVE-2021-44907: Fixed insuficient sanitation in npm dependency
(bsc#1197283).
- CVE-2022-0235: Fixed passing of cookie data and sensitive headers to
different hostnames in node-fetch-npm (bsc#1194819).
Patch Instructions:
To install this SUSE Security Update use the SUSE recommended installation methods
like YaST online_update or "zypper patch".
Alternatively you can run the command listed for your product:
- openSUSE Leap 15.4:
zypper in -t patch openSUSE-SLE-15.4-2022-1694=1
- openSUSE Leap 15.3:
zypper in -t patch openSUSE-SLE-15.3-2022-1694=1
Package List:
- openSUSE Leap 15.4 (aarch64 ppc64le s390x x86_64):
nodejs8-8.17.0-150200.10.22.1
nodejs8-debuginfo-8.17.0-150200.10.22.1
nodejs8-debugsource-8.17.0-150200.10.22.1
nodejs8-devel-8.17.0-150200.10.22.1
npm8-8.17.0-150200.10.22.1
- openSUSE Leap 15.4 (noarch):
nodejs8-docs-8.17.0-150200.10.22.1
- openSUSE Leap 15.3 (aarch64 ppc64le s390x x86_64):
nodejs8-8.17.0-150200.10.22.1
nodejs8-debuginfo-8.17.0-150200.10.22.1
nodejs8-debugsource-8.17.0-150200.10.22.1
nodejs8-devel-8.17.0-150200.10.22.1
npm8-8.17.0-150200.10.22.1
- openSUSE Leap 15.3 (noarch):
nodejs8-docs-8.17.0-150200.10.22.1
References:
https://www.suse.com/security/cve/CVE-2021-44906.html
https://www.suse.com/security/cve/CVE-2021-44907.html
https://www.suse.com/security/cve/CVE-2022-0235.html
https://bugzilla.suse.com/1194819
https://bugzilla.suse.com/1197283
https://bugzilla.suse.com/1198247
1
0
openSUSE-SU-2022:0133-1: important: Security update for chromium
by opensuse-security@opensuse.org 16 May '22
by opensuse-security@opensuse.org 16 May '22
16 May '22
openSUSE Security Update: Security update for chromium
______________________________________________________________________________
Announcement ID: openSUSE-SU-2022:0133-1
Rating: important
References: #1199409
Cross-References: CVE-2022-1633 CVE-2022-1634 CVE-2022-1635
CVE-2022-1636 CVE-2022-1637 CVE-2022-1638
CVE-2022-1639 CVE-2022-1640 CVE-2022-1641
Affected Products:
openSUSE Backports SLE-15-SP3
______________________________________________________________________________
An update that fixes 9 vulnerabilities is now available.
Description:
This update for chromium fixes the following issues:
Chromium was updated to 101.0.4951.64 (boo#1199409)
* CVE-2022-1633: Use after free in Sharesheet
* CVE-2022-1634: Use after free in Browser UI
* CVE-2022-1635: Use after free in Permission Prompts
* CVE-2022-1636: Use after free in Performance APIs
* CVE-2022-1637: Inappropriate implementation in Web Contents
* CVE-2022-1638: Heap buffer overflow in V8 Internationalization
* CVE-2022-1639: Use after free in ANGLE
* CVE-2022-1640: Use after free in Sharing
* CVE-2022-1641: Use after free in Web UI Diagnostics
Patch Instructions:
To install this openSUSE Security Update use the SUSE recommended installation methods
like YaST online_update or "zypper patch".
Alternatively you can run the command listed for your product:
- openSUSE Backports SLE-15-SP3:
zypper in -t patch openSUSE-2022-133=1
Package List:
- openSUSE Backports SLE-15-SP3 (aarch64 x86_64):
chromedriver-101.0.4951.64-bp153.2.91.1
chromium-101.0.4951.64-bp153.2.91.1
References:
https://www.suse.com/security/cve/CVE-2022-1633.html
https://www.suse.com/security/cve/CVE-2022-1634.html
https://www.suse.com/security/cve/CVE-2022-1635.html
https://www.suse.com/security/cve/CVE-2022-1636.html
https://www.suse.com/security/cve/CVE-2022-1637.html
https://www.suse.com/security/cve/CVE-2022-1638.html
https://www.suse.com/security/cve/CVE-2022-1639.html
https://www.suse.com/security/cve/CVE-2022-1640.html
https://www.suse.com/security/cve/CVE-2022-1641.html
https://bugzilla.suse.com/1199409
1
0
SUSE-SU-2022:1687-1: important: Security update for the Linux Kernel
by opensuse-security@opensuse.org 16 May '22
by opensuse-security@opensuse.org 16 May '22
16 May '22
SUSE Security Update: Security update for the Linux Kernel
______________________________________________________________________________
Announcement ID: SUSE-SU-2022:1687-1
Rating: important
References: #1028340 #1071995 #1137728 #1152472 #1152489
#1177028 #1179878 #1182073 #1183723 #1187055
#1191647 #1193556 #1193842 #1194625 #1195651
#1195926 #1196018 #1196114 #1196367 #1196514
#1196639 #1196942 #1197157 #1197391 #1197656
#1197660 #1197677 #1197914 #1197926 #1198077
#1198217 #1198330 #1198400 #1198413 #1198437
#1198448 #1198484 #1198515 #1198516 #1198534
#1198742 #1198825 #1198989 #1199012 #1199024
SLE-13208 SLE-13513 SLE-15172 SLE-15175 SLE-18234
SLE-8449
Cross-References: CVE-2020-27835 CVE-2021-0707 CVE-2021-20292
CVE-2021-20321 CVE-2021-38208 CVE-2021-4154
CVE-2022-0812 CVE-2022-1158 CVE-2022-1280
CVE-2022-1353 CVE-2022-1419 CVE-2022-1516
CVE-2022-28356 CVE-2022-28748 CVE-2022-28893
CVE-2022-29156
CVSS scores:
CVE-2020-27835 (SUSE): 6.7 CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H
CVE-2021-0707 (NVD) : 7.8 CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
CVE-2021-0707 (SUSE): 7.8 CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
CVE-2021-20292 (NVD) : 6.7 CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H
CVE-2021-20292 (SUSE): 6.7 CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H
CVE-2021-20321 (NVD) : 4.7 CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:N/I:N/A:H
CVE-2021-20321 (SUSE): 5.5 CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
CVE-2021-38208 (NVD) : 5.5 CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
CVE-2021-38208 (SUSE): 5.5 CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
CVE-2021-4154 (NVD) : 8.8 CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H
CVE-2021-4154 (SUSE): 8.8 CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H
CVE-2022-0812 (SUSE): 6.5 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
CVE-2022-1158 (SUSE): 7.4 CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H
CVE-2022-1280 (NVD) : 6.3 CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:N/A:H
CVE-2022-1280 (SUSE): 7 CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H
CVE-2022-1353 (NVD) : 7.1 CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:H
CVE-2022-1353 (SUSE): 6.1 CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:H
CVE-2022-1419 (SUSE): 6.7 CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H
CVE-2022-1516 (NVD) : 5.5 CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
CVE-2022-1516 (SUSE): 5.5 CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
CVE-2022-28356 (NVD) : 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
CVE-2022-28356 (SUSE): 5.5 CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
CVE-2022-28748 (SUSE): 3.7 CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N
CVE-2022-28893 (NVD) : 7.8 CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
CVE-2022-28893 (SUSE): 6.2 CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
CVE-2022-29156 (NVD) : 7.8 CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
CVE-2022-29156 (SUSE): 6.4 CVSS:3.1/AV:L/AC:H/PR:H/UI:N/S:U/C:H/I:H/A:H
Affected Products:
SUSE Linux Enterprise Desktop 15-SP3
SUSE Linux Enterprise High Availability 15-SP3
SUSE Linux Enterprise High Performance Computing
SUSE Linux Enterprise High Performance Computing 15-SP3
SUSE Linux Enterprise Micro 5.1
SUSE Linux Enterprise Micro 5.2
SUSE Linux Enterprise Module for Basesystem 15-SP3
SUSE Linux Enterprise Module for Development Tools 15-SP3
SUSE Linux Enterprise Module for Legacy Software 15-SP3
SUSE Linux Enterprise Module for Live Patching 15-SP3
SUSE Linux Enterprise Server
SUSE Linux Enterprise Server 15-SP3
SUSE Linux Enterprise Server for SAP Applications
SUSE Linux Enterprise Server for SAP Applications 15-SP3
SUSE Linux Enterprise Workstation Extension 15-SP3
SUSE Manager Proxy 4.2
SUSE Manager Retail Branch Server 4.2
SUSE Manager Server 4.2
openSUSE Leap 15.3
openSUSE Leap 15.4
______________________________________________________________________________
An update that solves 16 vulnerabilities, contains 6
features and has 29 fixes is now available.
Description:
The SUSE Linux Enterprise 15 SP3 kernel was updated to receive various
security and bugfixes.
The following security bugs were fixed:
- CVE-2022-29156: Fixed a double free related to rtrs_clt_dev_release
(bnc#1198515).
- CVE-2022-28893: Ensuring that sockets are in the intended state inside
the SUNRPC subsystem (bnc#1198330).
- CVE-2022-28748: Fixed memory lead over the network by ax88179_178a
devices (bsc#1196018).
- CVE-2022-28356: Fixed a refcount leak bug found in net/llc/af_llc.c
(bnc#1197391).
- CVE-2022-1516: Fixed null-ptr-deref caused by x25_disconnect
(bsc#1199012).
- CVE-2022-1419: Fixed a concurrency use-after-free in
vgem_gem_dumb_create (bsc#1198742).
- CVE-2022-1353: Fixed access controll to kernel memory in the
pfkey_register function in net/key/af_key.c (bnc#1198516).
- CVE-2022-1280: Fixed a use-after-free vulnerability in drm_lease_held in
drivers/gpu/drm/drm_lease.c (bnc#1197914).
- CVE-2022-1158: Fixed KVM x86/mmu compare-and-exchange of gPTE via the
user address (bsc#1197660).
- CVE-2022-0812: Fixed random memory leakage inside NFS/RDMA (bsc#1196639).
- CVE-2021-4154: Fixed a use-after-free flaw inside cgroup1_parse_param in
kernel/cgroup/cgroup-v1.c. A local attacker with a user privilege could
cause a privilege escalation by exploiting the fsconfig syscall
parameter leading to a container breakout and a denial of service on the
system (bnc#1193842).
- CVE-2021-38208: Fixed a denial of service (NULL pointer dereference and
BUG) by making a getsockname call after a certain type of failure of a
bind call (bnc#1187055).
- CVE-2021-20321: Fixed a race condition accessing file object in the
OverlayFS subsystem in the way users do rename in specific way with
OverlayFS. A local user could have used this flaw to crash the system
(bnc#1191647).
- CVE-2021-20292: Fixed object validation prior to performing operations
on the object in nouveau_sgdma_create_ttm in Nouveau DRM subsystem
(bnc#1183723).
- CVE-2021-0707: Fixed possible memory corruption due to a use after free
inside dma_buf_releas e of dma-buf.c (bnc#1198437).
- CVE-2020-27835: Fixed use after free in infiniband hfi1 driver in the
way user calls Ioctl after open dev file and fork. A local user could
use this flaw to crash the system (bnc#1179878).
The following non-security bugs were fixed:
- ACPI: processor idle: Check for architectural support for LPI
(git-fixes).
- ACPI/APEI: Limit printable size of BERT table data (git-fixes).
- ACPICA: Avoid walking the ACPI Namespace if it is not there (git-fixes).
- adm8211: fix error return code in adm8211_probe() (git-fixes).
- ALSA: cs4236: fix an incorrect NULL check on list iterator (git-fixes).
- ALSA: hda/hdmi: fix warning about PCM count when used with SOF
(git-fixes).
- ALSA: hda/realtek: Add alc256-samsung-headphone fixup (git-fixes).
- ALSA: hda/realtek: Add quirk for Clevo PD50PNT (git-fixes).
- ALSA: hda/realtek: Fix audio regression on Mi Notebook Pro 2020
(git-fixes).
- ALSA: pcm: Test for "silence" field in struct "pcm_format_data"
(git-fixes).
- ALSA: usb-audio: Cap upper limits of buffer/period bytes for implicit fb
(git-fixes).
- ALSA: usb-audio: Increase max buffer size (git-fixes).
- ALSA: usb-audio: Limit max buffer and period sizes per time (git-fixes).
- arm64: clear_page() shouldn't use DC ZVA when DCZID_EL0.DZP == 1
(git-fixes)
- arm64: dts: allwinner: h5: NanoPI Neo 2: Fix ethernet node (git-fixes)
- arm64: dts: allwinner: orangepi-zero-plus: fix PHY mode (git-fixes)
- arm64: dts: exynos: correct GIC CPU interfaces address range on
(git-fixes)
- arm64: dts: ls1028a: fix memory node (git-fixes)
- arm64: dts: ls1028a: fix node name for the sysclk (git-fixes)
- arm64: dts: lx2160a: fix scl-gpios property name (git-fixes)
- arm64: dts: marvell: armada-37xx: Extend PCIe MEM space (git-fixes)
- arm64: dts: marvell: armada-37xx: Fix reg for standard variant of
(git-fixes)
- arm64: dts: marvell: armada-37xx: Remap IO space to bus address 0x0
(git-fixes)
- arm64: dts: rockchip: Fix GPU register width for RK3328 (git-fixes)
- arm64: dts: rockchip: remove mmc-hs400-enhanced-strobe from (git-fixes)
- arm64: dts: zii-ultra: fix 12V_MAIN voltage (git-fixes)
- arm64: head: avoid over-mapping in map_memory (git-fixes)
- arm64: Update config files; arm LIBNVDIMM y->m ppc64le ND_BLK ->m
(bsc#1199024).
- arm64/sve: Use correct size when reinitialising SVE state (git-fixes)
- ASoC: atmel: Remove system clock tree configuration for at91sam9g20ek
(git-fixes).
- ASoC: codecs: wcd934x: do not switch off SIDO Buck when codec is in use
(git-fixes).
- ASoC: mediatek: mt6358: add missing EXPORT_SYMBOLs (git-fixes).
- ASoC: msm8916-wcd-digital: Check failure for
devm_snd_soc_register_component (git-fixes).
- ASoC: soc-compress: Change the check for codec_dai (git-fixes).
- ASoC: soc-compress: prevent the potentially use of null pointer
(git-fixes).
- ASoC: soc-core: skip zero num_dai component in searching dai name
(git-fixes).
- ASoC: soc-dapm: fix two incorrect uses of list iterator (git-fixes).
- ata: libata-core: Disable READ LOG DMA EXT for Samsung 840 EVOs
(git-fixes).
- ata: sata_dwc_460ex: Fix crash due to OOB write (git-fixes).
- ath10k: fix memory overwrite of the WoWLAN wakeup packet pattern
(git-fixes).
- ath5k: fix building with LEDS=m (git-fixes).
- ath5k: fix OOB in ath5k_eeprom_read_pcal_info_5111 (git-fixes).
- ath9k_htc: fix uninit value bugs (git-fixes).
- ath9k: Fix usage of driver-private space in tx_info (git-fixes).
- ath9k: Properly clear TX status area before reporting to mac80211
(git-fixes).
- backlight: qcom-wled: Respect enabled-strings in set_brightness
(bsc#1152489)
- bareudp: use ipv6_mod_enabled to check if IPv6 enabled (jsc#SLE-15172).
- bfq: Avoid merging queues with different parents (bsc#1197926).
- bfq: Drop pointless unlock-lock pair (bsc#1197926).
- bfq: Get rid of __bio_blkcg() usage (bsc#1197926).
- bfq: Make sure bfqg for which we are queueing requests is online
(bsc#1197926).
- bfq: Remove pointless bfq_init_rq() calls (bsc#1197926).
- bfq: Split shared queues on move between cgroups (bsc#1197926).
- bfq: Track whether bfq_group is still online (bsc#1197926).
- bfq: Update cgroup information before merging bio (bsc#1197926).
- block: Drop leftover references to RQF_SORTED (bsc#1182073).
- Bluetooth: btmtksdio: Fix kernel oops in btmtksdio_interrupt (git-fixes).
- Bluetooth: Fix use after free in hci_send_acl (git-fixes).
- Bluetooth: hci_serdev: call init_rwsem() before p->open() (git-fixes).
- bnx2x: fix napi API usage sequence (bsc#1198217).
- bpf: Resolve to prog->aux->dst_prog->type only for BPF_PROG_TYPE_EXT
(git-fixes bsc#1177028).
- brcmfmac: firmware: Allocate space for default boardrev in nvram
(git-fixes).
- brcmfmac: pcie: Fix crashes due to early IRQs (git-fixes).
- brcmfmac: pcie: Release firmwares in the brcmf_pcie_setup error path
(git-fixes).
- brcmfmac: pcie: Replace brcmf_pcie_copy_mem_todev with memcpy_toio
(git-fixes).
- carl9170: fix missing bit-wise or operator for tx_params (git-fixes).
- cfg80211: hold bss_lock while updating nontrans_list (git-fixes).
- cifs: do not skip link targets when an I/O fails (bsc#1194625).
- cifs: fix bad fids sent over wire (bsc#1197157).
- clk: Enforce that disjoints limits are invalid (git-fixes).
- clk: si5341: fix reported clk_rate when output divider is 2 (git-fixes).
- direct-io: clean up error paths of do_blockdev_direct_IO (bsc#1197656).
- direct-io: defer alignment check until after the EOF check (bsc#1197656).
- direct-io: do not force writeback for reads beyond EOF (bsc#1197656).
- dma-debug: fix return value of __setup handlers (git-fixes).
- dma: at_xdmac: fix a missing check on list iterator (git-fixes).
- dmaengine: idxd: add RO check for wq max_batch_size write (git-fixes).
- dmaengine: idxd: add RO check for wq max_transfer_size write (git-fixes).
- dmaengine: imx-sdma: Fix error checking in sdma_event_remap (git-fixes).
- dmaengine: mediatek:Fix PM usage reference leak of
mtk_uart_apdma_alloc_chan_resources (git-fixes).
- dmaengine: Revert "dmaengine: shdma: Fix runtime PM imbalance on error"
(git-fixes).
- Documentation: add link to stable release candidate tree (git-fixes).
- drm: add a locked version of drm_is_current_master (bsc#1197914).
- drm: Add orientation quirk for GPD Win Max (git-fixes).
- drm: drm_file struct kABI compatibility workaround (bsc#1197914).
- drm: protect drm_master pointers in drm_lease.c (bsc#1197914).
- drm: serialize drm_file.master with a new spinlock (bsc#1197914).
- drm: use the lookup lock in drm_is_current_master (bsc#1197914).
- drm/amd: Add USBC connector ID (git-fixes).
- drm/amd/amdgpu/amdgpu_cs: fix refcount leak of a dma_fence obj
(git-fixes).
- drm/amd/display: do not ignore alpha property on pre-multiplied mode
(git-fixes).
- drm/amd/display: Fix a NULL pointer dereference in
amdgpu_dm_connector_add_common_modes() (git-fixes).
- drm/amd/display: Fix allocate_mst_payload assert on resume (git-fixes).
- drm/amd/display: Fix memory leak in dcn21_clock_source_create
(bsc#1152472)
- drm/amdgpu: fix amdgpu_ras_block_late_init error handler (bsc#1152489)
- drm/amdgpu: fix off by one in amdgpu_gfx_kiq_acquire() (git-fixes).
- drm/amdgpu: Fix recursive locking warning (git-fixes).
- drm/amdkfd: Check for potential null return of kmalloc_array()
(git-fixes).
- drm/amdkfd: Fix Incorrect VMIDs passed to HWS (git-fixes).
- drm/amdkfd: make CRAT table missing message informational only
(git-fixes).
- drm/bridge: Add missing pm_runtime_disable() in __dw_mipi_dsi_probe
(git-fixes).
- drm/bridge: cdns-dsi: Make sure to to create proper aliases for dt
(git-fixes).
- drm/bridge: Fix free wrong object in sii8620_init_rcp_input_dev
(git-fixes).
- drm/cma-helper: Set VM_DONTEXPAND for mmap (bsc#1152472)
- drm/edid: check basic audio support on CEA extension block (git-fixes).
- drm/edid: Do not clear formats if using deep color (git-fixes).
- drm/fb-helper: Mark screen buffers in system memory with (bsc#1152472)
- drm/i915: Call i915_globals_exit() if pci_register_device() fails
(git-fixes).
- drm/i915: Drop all references to DRM IRQ midlayer (bsc#1152489)
- drm/i915: Keep gem ctx->vm alive until the final put (bsc#1152489)
- drm/i915: s/JSP2/ICP2/ PCH (bsc#1152489)
- drm/i915/gem: Flush coherency domains on first set-domain-ioctl
(git-fixes).
- drm/imx: Fix memory leak in imx_pd_connector_get_modes (git-fixes).
- drm/mediatek: Add AAL output size configuration (git-fixes).
- drm/mediatek: Fix aal size config (git-fixes).
- drm/msm/dsi: Use connector directly in msm_dsi_manager_connector_init()
(git-fixes).
- drm/panel/raspberrypi-touchscreen: Avoid NULL deref if not initialised
(git-fixes).
- drm/panel/raspberrypi-touchscreen: Initialise the bridge in prepare
(git-fixes).
- drm/prime: Fix use after free in mmap with drm_gem_ttm_mmap (bsc#1152472)
- drm/tegra: Fix reference leak in tegra_dsi_ganged_probe (git-fixes).
- drm/vc4: crtc: Lookup the encoder from the register at boot (bsc#1198534)
- drm/vc4: Use pm_runtime_resume_and_get to fix pm_runtime_get_sync()
usage (git-fixes).
- drm/vmwgfx: Remove unused compile options (bsc#1152472)
- e1000e: Fix possible overflow in LTR decoding (git-fixes).
- fibmap: Reject negative block numbers (bsc#1198448).
- fibmap: Use bmap instead of ->bmap method in ioctl_fibmap (bsc#1198448).
- firmware: arm_scmi: Fix sorting of retrieved clock rates (git-fixes).
- gpiolib: acpi: use correct format characters (git-fixes).
- gpu: ipu-v3: Fix dev_dbg frequency output (git-fixes).
- HID: i2c-hid: fix GET/SET_REPORT for unnumbered reports (git-fixes).
- hwrng: cavium - HW_RANDOM_CAVIUM should depend on ARCH_THUNDER
(git-fixes).
- i2c: dev: Force case user pointers in compat_i2cdev_ioctl() (git-fixes).
- IB/hfi1: Allow larger MTU without AIP (jsc#SLE-13208).
- Input: omap4-keypad - fix pm_runtime_get_sync() error checking
(git-fixes).
- ipmi: bail out if init_srcu_struct fails (git-fixes).
- ipmi: Fix UAF when uninstall ipmi_si and ipmi_msghandler module
(git-fixes).
- ipmi: Move remove_work to dedicated workqueue (git-fixes).
- iwlwifi: Fix -EIO error code that is never returned (git-fixes).
- iwlwifi: mvm: Fix an error code in iwl_mvm_up() (git-fixes).
- KEYS: fix length validation in keyctl_pkey_params_get_2() (git-fixes).
- livepatch: Do not block removal of patches that are safe to unload
(bsc#1071995).
- lz4: fix LZ4_decompress_safe_partial read out of bound (git-fixes).
- media: cx88-mpeg: clear interrupt status register before streaming video
(git-fixes).
- media: hdpvr: initialize dev->worker at hdpvr_register_videodev
(git-fixes).
- memory: atmel-ebi: Fix missing of_node_put in atmel_ebi_probe
(git-fixes).
- mfd: asic3: Add missing iounmap() on error asic3_mfd_probe (git-fixes).
- mfd: mc13xxx: Add check for mc13xxx_irq_request (git-fixes).
- mmc: host: Return an error when ->enable_sdio_irq() ops is missing
(git-fixes).
- mmc: mmci_sdmmc: Replace sg_dma_xxx macros (git-fixes).
- mmc: mmci: stm32: correctly check all elements of sg list (git-fixes).
- mmc: renesas_sdhi: do not overwrite TAP settings when HS400 tuning is
complete (git-fixes).
- mtd: onenand: Check for error irq (git-fixes).
- mtd: rawnand: atmel: fix refcount issue in atmel_nand_controller_init
(git-fixes).
- mtd: rawnand: gpmi: fix controller timings setting (git-fixes).
- mwl8k: Fix a double Free in mwl8k_probe_hw (git-fixes).
- net: asix: add proper error handling of usb read errors (git-fixes).
- net: mana: Add counter for packet dropped by XDP (bsc#1195651).
- net: mana: Add counter for XDP_TX (bsc#1195651).
- net: mana: Add handling of CQE_RX_TRUNCATED (bsc#1195651).
- net: mana: Remove unnecessary check of cqe_type in mana_process_rx_cqe()
(bsc#1195651).
- net: mana: Reuse XDP dropped page (bsc#1195651).
- net: mana: Use struct_size() helper in mana_gd_create_dma_region()
(bsc#1195651).
- net: mcs7830: handle usb read errors properly (git-fixes).
- net: usb: aqc111: Fix out-of-bounds accesses in RX fixup (git-fixes).
- nfc: nci: add flush_workqueue to prevent uaf (git-fixes).
- NFSv4: fix open failure with O_ACCMODE flag (git-fixes).
- PCI: aardvark: Fix reading PCI_EXP_RTSTA_PME bit on emulated bridge
(git-fixes).
- PCI: aardvark: Fix support for MSI interrupts (git-fixes).
- PCI: imx6: Allow to probe when dw_pcie_wait_for_link() fails (git-fixes).
- PCI: pciehp: Add Qualcomm quirk for Command Completed erratum
(git-fixes).
- PCI: pciehp: Clear cmd_busy bit in polling mode (git-fixes).
- PM: core: keep irq flags in device_pm_check_callbacks() (git-fixes).
- power: reset: gemini-poweroff: Fix IRQ check in gemini_poweroff_probe
(git-fixes).
- power: supply: ab8500: Fix memory leak in ab8500_fg_sysfs_init
(git-fixes).
- power: supply: axp20x_battery: properly report current when discharging
(git-fixes).
- power: supply: axp288-charger: Set Vhold to 4.4V (git-fixes).
- power: supply: bq24190_charger: Fix bq24190_vbus_is_enabled() wrong
false return (git-fixes).
- power: supply: wm8350-power: Add missing free in free_charger_irq
(git-fixes).
- power: supply: wm8350-power: Handle error for wm8350_register_irq
(git-fixes).
- powerpc/perf: Expose Performance Monitor Counter SPR's as part of
extended regs (bsc#1198077 ltc#197299).
- powerpc/perf: Fix power10 event alternatives (jsc#SLE-13513 git-fixes).
- powerpc/perf: Fix power9 event alternatives (bsc#1137728, LTC#178106,
git-fixes).
- powerpc/perf: Include PMCs as part of per-cpu cpuhw_events struct
(bsc#1198077 ltc#197299).
- ptrace: Check PTRACE_O_SUSPEND_SECCOMP permission on PTRACE_SEIZE
(bsc#1198413).
- random: check for signal_pending() outside of need_resched() check
(git-fixes).
- ray_cs: Check ioremap return value (git-fixes).
- RDMA/core: Set MR type in ib_reg_user_mr (jsc#SLE-8449).
- RDMA/mlx5: Add a missing update of cache->last_add (jsc#SLE-15175).
- RDMA/mlx5: Do not remove cache MRs when a delay is needed
(jsc#SLE-15175).
- RDMA/mlx5: Fix the flow of a miss in the allocation of a cache ODP MR
(jsc#SLE-15175).
- regulator: wm8994: Add an off-on delay for WM8994 variant (git-fixes).
- rpm: Run external scriptlets on uninstall only when available
(bsc#1196514 bsc#1196114 bsc#1196942).
- rpm: Use bash for %() expansion (jsc#SLE-18234).
- rpm/*.spec.in: remove backtick usage
- rpm/constraints.in: skip SLOW_DISK workers for kernel-source
- rpm/kernel-obs-build.spec.in: use default dracut modules (bsc#1195926,
bsc#1198484)
- rtc: check if __rtc_read_time was successful (git-fixes).
- rtc: wm8350: Handle error for wm8350_register_irq (git-fixes).
- s390/tape: fix timer initialization in tape_std_assign() (bsc#1197677
LTC#197378).
- scsi: libsas: Fix sas_ata_qc_issue() handling of NCQ NON DATA commands
(git-fixes).
- scsi: mpt3sas: Fix use after free in _scsih_expander_node_remove()
(git-fixes).
- scsi: mpt3sas: Page fault in reply q processing (git-fixes).
- scsi: scsi_dh_alua: Avoid crash during alua_bus_detach() (bsc#1028340
bsc#1198825).
- spi: atmel-quadspi: Fix the buswidth adjustment between spi-mem and
controller (git-fixes).
- spi: bcm-qspi: fix MSPI only access with bcm_qspi_exec_mem_op()
(git-fixes).
- spi: Fix erroneous sgs value with min_t() (git-fixes).
- spi: Fix invalid sgs value (git-fixes).
- spi: mxic: Fix the transmit path (git-fixes).
- spi: tegra20: Use of_device_get_match_data() (git-fixes).
- staging: mt7621-dts: fix LEDs and pinctrl on GB-PC1 devicetree
(git-fixes).
- SUNRPC: change locking for xs_swap_enable/disable (bsc#1196367).
- SUNRPC: Ensure we flush any closed sockets before xs_xprt_free()
(git-fixes).
- SUNRPC: Fix the svc_deferred_event trace class (git-fixes).
- SUNRPC: Handle ENOMEM in call_transmit_status() (git-fixes).
- SUNRPC: Handle low memory situations in call_status() (git-fixes).
- USB: dwc3: core: Fix tx/rx threshold settings (git-fixes).
- USB: dwc3: core: Only handle soft-reset in DCTL (git-fixes).
- USB: dwc3: gadget: Return proper request status (git-fixes).
- USB: dwc3: omap: fix "unbalanced disables for smps10_out1" on omap5evm
(git-fixes).
- USB: gadget: uvc: Fix crash when encoding data for usb request
(git-fixes).
- USB: hcd-pci: Use PCI_STD_NUM_BARS when checking standard BARs
(bsc#1152489)
- USB: serial: pl2303: add IBM device IDs (git-fixes).
- USB: serial: simple: add Nokia phone driver (git-fixes).
- USB: storage: ums-realtek: fix error code in rts51x_read_mem()
(git-fixes).
- USB: usb-storage: Fix use of bitfields for hardware data in ene_ub6250.c
(git-fixes).
- vgacon: Propagate console boot parameters before calling `vc_resize'
(bsc#1152489)
- video: fbdev: atari: Atari 2 bpp (STe) palette bugfix (git-fixes).
- video: fbdev: cirrusfb: check pixclock to avoid divide by zero
(git-fixes).
- video: fbdev: nvidiafb: Use strscpy() to prevent buffer overflow
(git-fixes).
- video: fbdev: sm712fb: Fix crash in smtcfb_read() (git-fixes).
- video: fbdev: sm712fb: Fix crash in smtcfb_write() (git-fixes).
- video: fbdev: udlfb: properly check endpoint type (bsc#1152489)
- video: fbdev: w100fb: Reset global state (git-fixes).
- virtio_console: break out of buf poll on remove (git-fixes).
- virtio_console: eliminate anonymous module_init & module_exit
(git-fixes).
- w1: w1_therm: fixes w1_seq for ds28ea00 sensors (git-fixes).
- x86/pm: Save the MSR validity status at context setup (bsc#1198400).
- x86/sev: Unroll string mmio with CC_ATTR_GUEST_UNROLL_STRING_IO
(git-fixes).
- x86/speculation: Restore speculation related MSRs during S3 resume
(bsc#1198400).
- xen: fix is_xen_pmu() (git-fixes).
- xen/blkfront: fix comment for need_copy (git-fixes).
- xen/x86: obtain full video frame buffer address for Dom0 also under EFI
(bsc#1193556).
- xen/x86: obtain upper 32 bits of video frame buffer address for Dom0
(bsc#1193556).
- xhci: fix runtime PM imbalance in USB2 resume (git-fixes).
- xhci: fix uninitialized string returned by xhci_decode_ctrl_ctx()
(git-fixes).
Special Instructions and Notes:
Please reboot the system after installing this update.
Patch Instructions:
To install this SUSE Security Update use the SUSE recommended installation methods
like YaST online_update or "zypper patch".
Alternatively you can run the command listed for your product:
- openSUSE Leap 15.4:
zypper in -t patch openSUSE-SLE-15.4-2022-1687=1
- openSUSE Leap 15.3:
zypper in -t patch openSUSE-SLE-15.3-2022-1687=1
- SUSE Linux Enterprise Workstation Extension 15-SP3:
zypper in -t patch SUSE-SLE-Product-WE-15-SP3-2022-1687=1
- SUSE Linux Enterprise Module for Live Patching 15-SP3:
zypper in -t patch SUSE-SLE-Module-Live-Patching-15-SP3-2022-1687=1
- SUSE Linux Enterprise Module for Legacy Software 15-SP3:
zypper in -t patch SUSE-SLE-Module-Legacy-15-SP3-2022-1687=1
- SUSE Linux Enterprise Module for Development Tools 15-SP3:
zypper in -t patch SUSE-SLE-Module-Development-Tools-15-SP3-2022-1687=1
- SUSE Linux Enterprise Module for Basesystem 15-SP3:
zypper in -t patch SUSE-SLE-Module-Basesystem-15-SP3-2022-1687=1
- SUSE Linux Enterprise Micro 5.2:
zypper in -t patch SUSE-SUSE-MicroOS-5.2-2022-1687=1
- SUSE Linux Enterprise Micro 5.1:
zypper in -t patch SUSE-SUSE-MicroOS-5.1-2022-1687=1
- SUSE Linux Enterprise High Availability 15-SP3:
zypper in -t patch SUSE-SLE-Product-HA-15-SP3-2022-1687=1
Package List:
- openSUSE Leap 15.4 (aarch64 x86_64):
cluster-md-kmp-preempt-5.3.18-150300.59.68.1
cluster-md-kmp-preempt-debuginfo-5.3.18-150300.59.68.1
dlm-kmp-preempt-5.3.18-150300.59.68.1
dlm-kmp-preempt-debuginfo-5.3.18-150300.59.68.1
gfs2-kmp-preempt-5.3.18-150300.59.68.1
gfs2-kmp-preempt-debuginfo-5.3.18-150300.59.68.1
kernel-preempt-5.3.18-150300.59.68.1
kernel-preempt-debuginfo-5.3.18-150300.59.68.1
kernel-preempt-debugsource-5.3.18-150300.59.68.1
kernel-preempt-devel-5.3.18-150300.59.68.1
kernel-preempt-devel-debuginfo-5.3.18-150300.59.68.1
kernel-preempt-extra-5.3.18-150300.59.68.1
kernel-preempt-extra-debuginfo-5.3.18-150300.59.68.1
kernel-preempt-livepatch-devel-5.3.18-150300.59.68.1
kernel-preempt-optional-5.3.18-150300.59.68.1
kernel-preempt-optional-debuginfo-5.3.18-150300.59.68.1
kselftests-kmp-preempt-5.3.18-150300.59.68.1
kselftests-kmp-preempt-debuginfo-5.3.18-150300.59.68.1
ocfs2-kmp-preempt-5.3.18-150300.59.68.1
ocfs2-kmp-preempt-debuginfo-5.3.18-150300.59.68.1
reiserfs-kmp-preempt-5.3.18-150300.59.68.1
reiserfs-kmp-preempt-debuginfo-5.3.18-150300.59.68.1
- openSUSE Leap 15.4 (aarch64):
dtb-al-5.3.18-150300.59.68.1
dtb-zte-5.3.18-150300.59.68.1
- openSUSE Leap 15.3 (aarch64 ppc64le s390x x86_64):
cluster-md-kmp-default-5.3.18-150300.59.68.1
cluster-md-kmp-default-debuginfo-5.3.18-150300.59.68.1
dlm-kmp-default-5.3.18-150300.59.68.1
dlm-kmp-default-debuginfo-5.3.18-150300.59.68.1
gfs2-kmp-default-5.3.18-150300.59.68.1
gfs2-kmp-default-debuginfo-5.3.18-150300.59.68.1
kernel-default-5.3.18-150300.59.68.1
kernel-default-base-5.3.18-150300.59.68.1.150300.18.41.3
kernel-default-base-rebuild-5.3.18-150300.59.68.1.150300.18.41.3
kernel-default-debuginfo-5.3.18-150300.59.68.1
kernel-default-debugsource-5.3.18-150300.59.68.1
kernel-default-devel-5.3.18-150300.59.68.1
kernel-default-devel-debuginfo-5.3.18-150300.59.68.1
kernel-default-extra-5.3.18-150300.59.68.1
kernel-default-extra-debuginfo-5.3.18-150300.59.68.1
kernel-default-livepatch-5.3.18-150300.59.68.1
kernel-default-livepatch-devel-5.3.18-150300.59.68.1
kernel-default-optional-5.3.18-150300.59.68.1
kernel-default-optional-debuginfo-5.3.18-150300.59.68.1
kernel-obs-build-5.3.18-150300.59.68.1
kernel-obs-build-debugsource-5.3.18-150300.59.68.1
kernel-obs-qa-5.3.18-150300.59.68.1
kernel-syms-5.3.18-150300.59.68.1
kselftests-kmp-default-5.3.18-150300.59.68.1
kselftests-kmp-default-debuginfo-5.3.18-150300.59.68.1
ocfs2-kmp-default-5.3.18-150300.59.68.1
ocfs2-kmp-default-debuginfo-5.3.18-150300.59.68.1
reiserfs-kmp-default-5.3.18-150300.59.68.1
reiserfs-kmp-default-debuginfo-5.3.18-150300.59.68.1
- openSUSE Leap 15.3 (aarch64 x86_64):
cluster-md-kmp-preempt-5.3.18-150300.59.68.1
cluster-md-kmp-preempt-debuginfo-5.3.18-150300.59.68.1
dlm-kmp-preempt-5.3.18-150300.59.68.1
dlm-kmp-preempt-debuginfo-5.3.18-150300.59.68.1
gfs2-kmp-preempt-5.3.18-150300.59.68.1
gfs2-kmp-preempt-debuginfo-5.3.18-150300.59.68.1
kernel-preempt-5.3.18-150300.59.68.1
kernel-preempt-debuginfo-5.3.18-150300.59.68.1
kernel-preempt-debugsource-5.3.18-150300.59.68.1
kernel-preempt-devel-5.3.18-150300.59.68.1
kernel-preempt-devel-debuginfo-5.3.18-150300.59.68.1
kernel-preempt-extra-5.3.18-150300.59.68.1
kernel-preempt-extra-debuginfo-5.3.18-150300.59.68.1
kernel-preempt-livepatch-devel-5.3.18-150300.59.68.1
kernel-preempt-optional-5.3.18-150300.59.68.1
kernel-preempt-optional-debuginfo-5.3.18-150300.59.68.1
kselftests-kmp-preempt-5.3.18-150300.59.68.1
kselftests-kmp-preempt-debuginfo-5.3.18-150300.59.68.1
ocfs2-kmp-preempt-5.3.18-150300.59.68.1
ocfs2-kmp-preempt-debuginfo-5.3.18-150300.59.68.1
reiserfs-kmp-preempt-5.3.18-150300.59.68.1
reiserfs-kmp-preempt-debuginfo-5.3.18-150300.59.68.1
- openSUSE Leap 15.3 (ppc64le x86_64):
kernel-debug-5.3.18-150300.59.68.1
kernel-debug-debuginfo-5.3.18-150300.59.68.1
kernel-debug-debugsource-5.3.18-150300.59.68.1
kernel-debug-devel-5.3.18-150300.59.68.1
kernel-debug-devel-debuginfo-5.3.18-150300.59.68.1
kernel-debug-livepatch-devel-5.3.18-150300.59.68.1
kernel-kvmsmall-5.3.18-150300.59.68.1
kernel-kvmsmall-debuginfo-5.3.18-150300.59.68.1
kernel-kvmsmall-debugsource-5.3.18-150300.59.68.1
kernel-kvmsmall-devel-5.3.18-150300.59.68.1
kernel-kvmsmall-devel-debuginfo-5.3.18-150300.59.68.1
kernel-kvmsmall-livepatch-devel-5.3.18-150300.59.68.1
- openSUSE Leap 15.3 (aarch64):
cluster-md-kmp-64kb-5.3.18-150300.59.68.1
cluster-md-kmp-64kb-debuginfo-5.3.18-150300.59.68.1
dlm-kmp-64kb-5.3.18-150300.59.68.1
dlm-kmp-64kb-debuginfo-5.3.18-150300.59.68.1
dtb-al-5.3.18-150300.59.68.1
dtb-allwinner-5.3.18-150300.59.68.1
dtb-altera-5.3.18-150300.59.68.1
dtb-amd-5.3.18-150300.59.68.1
dtb-amlogic-5.3.18-150300.59.68.1
dtb-apm-5.3.18-150300.59.68.1
dtb-arm-5.3.18-150300.59.68.1
dtb-broadcom-5.3.18-150300.59.68.1
dtb-cavium-5.3.18-150300.59.68.1
dtb-exynos-5.3.18-150300.59.68.1
dtb-freescale-5.3.18-150300.59.68.1
dtb-hisilicon-5.3.18-150300.59.68.1
dtb-lg-5.3.18-150300.59.68.1
dtb-marvell-5.3.18-150300.59.68.1
dtb-mediatek-5.3.18-150300.59.68.1
dtb-nvidia-5.3.18-150300.59.68.1
dtb-qcom-5.3.18-150300.59.68.1
dtb-renesas-5.3.18-150300.59.68.1
dtb-rockchip-5.3.18-150300.59.68.1
dtb-socionext-5.3.18-150300.59.68.1
dtb-sprd-5.3.18-150300.59.68.1
dtb-xilinx-5.3.18-150300.59.68.1
dtb-zte-5.3.18-150300.59.68.1
gfs2-kmp-64kb-5.3.18-150300.59.68.1
gfs2-kmp-64kb-debuginfo-5.3.18-150300.59.68.1
kernel-64kb-5.3.18-150300.59.68.1
kernel-64kb-debuginfo-5.3.18-150300.59.68.1
kernel-64kb-debugsource-5.3.18-150300.59.68.1
kernel-64kb-devel-5.3.18-150300.59.68.1
kernel-64kb-devel-debuginfo-5.3.18-150300.59.68.1
kernel-64kb-extra-5.3.18-150300.59.68.1
kernel-64kb-extra-debuginfo-5.3.18-150300.59.68.1
kernel-64kb-livepatch-devel-5.3.18-150300.59.68.1
kernel-64kb-optional-5.3.18-150300.59.68.1
kernel-64kb-optional-debuginfo-5.3.18-150300.59.68.1
kselftests-kmp-64kb-5.3.18-150300.59.68.1
kselftests-kmp-64kb-debuginfo-5.3.18-150300.59.68.1
ocfs2-kmp-64kb-5.3.18-150300.59.68.1
ocfs2-kmp-64kb-debuginfo-5.3.18-150300.59.68.1
reiserfs-kmp-64kb-5.3.18-150300.59.68.1
reiserfs-kmp-64kb-debuginfo-5.3.18-150300.59.68.1
- openSUSE Leap 15.3 (noarch):
kernel-devel-5.3.18-150300.59.68.1
kernel-docs-5.3.18-150300.59.68.1
kernel-docs-html-5.3.18-150300.59.68.1
kernel-macros-5.3.18-150300.59.68.1
kernel-source-5.3.18-150300.59.68.1
kernel-source-vanilla-5.3.18-150300.59.68.1
- openSUSE Leap 15.3 (s390x):
kernel-zfcpdump-5.3.18-150300.59.68.1
kernel-zfcpdump-debuginfo-5.3.18-150300.59.68.1
kernel-zfcpdump-debugsource-5.3.18-150300.59.68.1
- SUSE Linux Enterprise Workstation Extension 15-SP3 (x86_64):
kernel-default-debuginfo-5.3.18-150300.59.68.1
kernel-default-debugsource-5.3.18-150300.59.68.1
kernel-default-extra-5.3.18-150300.59.68.1
kernel-default-extra-debuginfo-5.3.18-150300.59.68.1
kernel-preempt-debuginfo-5.3.18-150300.59.68.1
kernel-preempt-debugsource-5.3.18-150300.59.68.1
kernel-preempt-extra-5.3.18-150300.59.68.1
kernel-preempt-extra-debuginfo-5.3.18-150300.59.68.1
- SUSE Linux Enterprise Module for Live Patching 15-SP3 (ppc64le s390x x86_64):
kernel-default-debuginfo-5.3.18-150300.59.68.1
kernel-default-debugsource-5.3.18-150300.59.68.1
kernel-default-livepatch-5.3.18-150300.59.68.1
kernel-default-livepatch-devel-5.3.18-150300.59.68.1
kernel-livepatch-5_3_18-150300_59_68-default-1-150300.7.5.1
- SUSE Linux Enterprise Module for Legacy Software 15-SP3 (aarch64 ppc64le s390x x86_64):
kernel-default-debuginfo-5.3.18-150300.59.68.1
kernel-default-debugsource-5.3.18-150300.59.68.1
reiserfs-kmp-default-5.3.18-150300.59.68.1
reiserfs-kmp-default-debuginfo-5.3.18-150300.59.68.1
- SUSE Linux Enterprise Module for Development Tools 15-SP3 (aarch64 ppc64le s390x x86_64):
kernel-obs-build-5.3.18-150300.59.68.1
kernel-obs-build-debugsource-5.3.18-150300.59.68.1
kernel-syms-5.3.18-150300.59.68.1
- SUSE Linux Enterprise Module for Development Tools 15-SP3 (aarch64 x86_64):
kernel-preempt-debuginfo-5.3.18-150300.59.68.1
kernel-preempt-debugsource-5.3.18-150300.59.68.1
kernel-preempt-devel-5.3.18-150300.59.68.1
kernel-preempt-devel-debuginfo-5.3.18-150300.59.68.1
- SUSE Linux Enterprise Module for Development Tools 15-SP3 (noarch):
kernel-docs-5.3.18-150300.59.68.1
kernel-source-5.3.18-150300.59.68.1
- SUSE Linux Enterprise Module for Basesystem 15-SP3 (aarch64 ppc64le s390x x86_64):
kernel-default-5.3.18-150300.59.68.1
kernel-default-base-5.3.18-150300.59.68.1.150300.18.41.3
kernel-default-debuginfo-5.3.18-150300.59.68.1
kernel-default-debugsource-5.3.18-150300.59.68.1
kernel-default-devel-5.3.18-150300.59.68.1
kernel-default-devel-debuginfo-5.3.18-150300.59.68.1
- SUSE Linux Enterprise Module for Basesystem 15-SP3 (aarch64 x86_64):
kernel-preempt-5.3.18-150300.59.68.1
kernel-preempt-debuginfo-5.3.18-150300.59.68.1
kernel-preempt-debugsource-5.3.18-150300.59.68.1
- SUSE Linux Enterprise Module for Basesystem 15-SP3 (aarch64):
kernel-64kb-5.3.18-150300.59.68.1
kernel-64kb-debuginfo-5.3.18-150300.59.68.1
kernel-64kb-debugsource-5.3.18-150300.59.68.1
kernel-64kb-devel-5.3.18-150300.59.68.1
kernel-64kb-devel-debuginfo-5.3.18-150300.59.68.1
- SUSE Linux Enterprise Module for Basesystem 15-SP3 (noarch):
kernel-devel-5.3.18-150300.59.68.1
kernel-macros-5.3.18-150300.59.68.1
- SUSE Linux Enterprise Module for Basesystem 15-SP3 (s390x):
kernel-zfcpdump-5.3.18-150300.59.68.1
kernel-zfcpdump-debuginfo-5.3.18-150300.59.68.1
kernel-zfcpdump-debugsource-5.3.18-150300.59.68.1
- SUSE Linux Enterprise Micro 5.2 (aarch64 s390x x86_64):
kernel-default-5.3.18-150300.59.68.1
kernel-default-base-5.3.18-150300.59.68.1.150300.18.41.3
kernel-default-debuginfo-5.3.18-150300.59.68.1
kernel-default-debugsource-5.3.18-150300.59.68.1
- SUSE Linux Enterprise Micro 5.1 (aarch64 s390x x86_64):
kernel-default-5.3.18-150300.59.68.1
kernel-default-base-5.3.18-150300.59.68.1.150300.18.41.3
kernel-default-debuginfo-5.3.18-150300.59.68.1
kernel-default-debugsource-5.3.18-150300.59.68.1
- SUSE Linux Enterprise High Availability 15-SP3 (aarch64 ppc64le s390x x86_64):
cluster-md-kmp-default-5.3.18-150300.59.68.1
cluster-md-kmp-default-debuginfo-5.3.18-150300.59.68.1
dlm-kmp-default-5.3.18-150300.59.68.1
dlm-kmp-default-debuginfo-5.3.18-150300.59.68.1
gfs2-kmp-default-5.3.18-150300.59.68.1
gfs2-kmp-default-debuginfo-5.3.18-150300.59.68.1
kernel-default-debuginfo-5.3.18-150300.59.68.1
kernel-default-debugsource-5.3.18-150300.59.68.1
ocfs2-kmp-default-5.3.18-150300.59.68.1
ocfs2-kmp-default-debuginfo-5.3.18-150300.59.68.1
References:
https://www.suse.com/security/cve/CVE-2020-27835.html
https://www.suse.com/security/cve/CVE-2021-0707.html
https://www.suse.com/security/cve/CVE-2021-20292.html
https://www.suse.com/security/cve/CVE-2021-20321.html
https://www.suse.com/security/cve/CVE-2021-38208.html
https://www.suse.com/security/cve/CVE-2021-4154.html
https://www.suse.com/security/cve/CVE-2022-0812.html
https://www.suse.com/security/cve/CVE-2022-1158.html
https://www.suse.com/security/cve/CVE-2022-1280.html
https://www.suse.com/security/cve/CVE-2022-1353.html
https://www.suse.com/security/cve/CVE-2022-1419.html
https://www.suse.com/security/cve/CVE-2022-1516.html
https://www.suse.com/security/cve/CVE-2022-28356.html
https://www.suse.com/security/cve/CVE-2022-28748.html
https://www.suse.com/security/cve/CVE-2022-28893.html
https://www.suse.com/security/cve/CVE-2022-29156.html
https://bugzilla.suse.com/1028340
https://bugzilla.suse.com/1071995
https://bugzilla.suse.com/1137728
https://bugzilla.suse.com/1152472
https://bugzilla.suse.com/1152489
https://bugzilla.suse.com/1177028
https://bugzilla.suse.com/1179878
https://bugzilla.suse.com/1182073
https://bugzilla.suse.com/1183723
https://bugzilla.suse.com/1187055
https://bugzilla.suse.com/1191647
https://bugzilla.suse.com/1193556
https://bugzilla.suse.com/1193842
https://bugzilla.suse.com/1194625
https://bugzilla.suse.com/1195651
https://bugzilla.suse.com/1195926
https://bugzilla.suse.com/1196018
https://bugzilla.suse.com/1196114
https://bugzilla.suse.com/1196367
https://bugzilla.suse.com/1196514
https://bugzilla.suse.com/1196639
https://bugzilla.suse.com/1196942
https://bugzilla.suse.com/1197157
https://bugzilla.suse.com/1197391
https://bugzilla.suse.com/1197656
https://bugzilla.suse.com/1197660
https://bugzilla.suse.com/1197677
https://bugzilla.suse.com/1197914
https://bugzilla.suse.com/1197926
https://bugzilla.suse.com/1198077
https://bugzilla.suse.com/1198217
https://bugzilla.suse.com/1198330
https://bugzilla.suse.com/1198400
https://bugzilla.suse.com/1198413
https://bugzilla.suse.com/1198437
https://bugzilla.suse.com/1198448
https://bugzilla.suse.com/1198484
https://bugzilla.suse.com/1198515
https://bugzilla.suse.com/1198516
https://bugzilla.suse.com/1198534
https://bugzilla.suse.com/1198742
https://bugzilla.suse.com/1198825
https://bugzilla.suse.com/1198989
https://bugzilla.suse.com/1199012
https://bugzilla.suse.com/1199024
1
0
SUSE-SU-2022:1688-1: important: Security update for e2fsprogs
by opensuse-security@opensuse.org 16 May '22
by opensuse-security@opensuse.org 16 May '22
16 May '22
SUSE Security Update: Security update for e2fsprogs
______________________________________________________________________________
Announcement ID: SUSE-SU-2022:1688-1
Rating: important
References: #1198446
Cross-References: CVE-2022-1304
CVSS scores:
CVE-2022-1304 (NVD) : 7.8 CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
CVE-2022-1304 (SUSE): 7 CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:H
Affected Products:
SUSE CaaS Platform 4.0
SUSE Enterprise Storage 6
SUSE Enterprise Storage 7
SUSE Linux Enterprise Desktop 15-SP3
SUSE Linux Enterprise High Performance Computing 15-ESPOS
SUSE Linux Enterprise High Performance Computing 15-LTSS
SUSE Linux Enterprise High Performance Computing 15-SP1-ESPOS
SUSE Linux Enterprise High Performance Computing 15-SP1-LTSS
SUSE Linux Enterprise High Performance Computing 15-SP2-ESPOS
SUSE Linux Enterprise High Performance Computing 15-SP2-LTSS
SUSE Linux Enterprise High Performance Computing 15-SP3
SUSE Linux Enterprise Micro 5.0
SUSE Linux Enterprise Micro 5.1
SUSE Linux Enterprise Micro 5.2
SUSE Linux Enterprise Module for Basesystem 15-SP3
SUSE Linux Enterprise Realtime Extension 15-SP2
SUSE Linux Enterprise Server 15-LTSS
SUSE Linux Enterprise Server 15-SP1-BCL
SUSE Linux Enterprise Server 15-SP1-LTSS
SUSE Linux Enterprise Server 15-SP2-BCL
SUSE Linux Enterprise Server 15-SP2-LTSS
SUSE Linux Enterprise Server 15-SP3
SUSE Linux Enterprise Server for SAP 15
SUSE Linux Enterprise Server for SAP 15-SP1
SUSE Linux Enterprise Server for SAP 15-SP2
SUSE Linux Enterprise Server for SAP Applications 15-SP3
SUSE Manager Proxy 4.1
SUSE Manager Proxy 4.2
SUSE Manager Retail Branch Server 4.1
SUSE Manager Server 4.1
SUSE Manager Server 4.2
openSUSE Leap 15.3
______________________________________________________________________________
An update that fixes one vulnerability is now available.
Description:
This update for e2fsprogs fixes the following issues:
- CVE-2022-1304: Fixed out-of-bounds read/write leading to segmentation
fault and possibly arbitrary code execution. (bsc#1198446)
Patch Instructions:
To install this SUSE Security Update use the SUSE recommended installation methods
like YaST online_update or "zypper patch".
Alternatively you can run the command listed for your product:
- openSUSE Leap 15.3:
zypper in -t patch openSUSE-SLE-15.3-2022-1688=1
- SUSE Manager Server 4.1:
zypper in -t patch SUSE-SLE-Product-SUSE-Manager-Server-4.1-2022-1688=1
- SUSE Manager Retail Branch Server 4.1:
zypper in -t patch SUSE-SLE-Product-SUSE-Manager-Retail-Branch-Server-4.1-2022-1688=1
- SUSE Manager Proxy 4.1:
zypper in -t patch SUSE-SLE-Product-SUSE-Manager-Proxy-4.1-2022-1688=1
- SUSE Linux Enterprise Server for SAP 15-SP2:
zypper in -t patch SUSE-SLE-Product-SLES_SAP-15-SP2-2022-1688=1
- SUSE Linux Enterprise Server for SAP 15-SP1:
zypper in -t patch SUSE-SLE-Product-SLES_SAP-15-SP1-2022-1688=1
- SUSE Linux Enterprise Server for SAP 15:
zypper in -t patch SUSE-SLE-Product-SLES_SAP-15-2022-1688=1
- SUSE Linux Enterprise Server 15-SP2-LTSS:
zypper in -t patch SUSE-SLE-Product-SLES-15-SP2-LTSS-2022-1688=1
- SUSE Linux Enterprise Server 15-SP2-BCL:
zypper in -t patch SUSE-SLE-Product-SLES-15-SP2-BCL-2022-1688=1
- SUSE Linux Enterprise Server 15-SP1-LTSS:
zypper in -t patch SUSE-SLE-Product-SLES-15-SP1-LTSS-2022-1688=1
- SUSE Linux Enterprise Server 15-SP1-BCL:
zypper in -t patch SUSE-SLE-Product-SLES-15-SP1-BCL-2022-1688=1
- SUSE Linux Enterprise Server 15-LTSS:
zypper in -t patch SUSE-SLE-Product-SLES-15-2022-1688=1
- SUSE Linux Enterprise Realtime Extension 15-SP2:
zypper in -t patch SUSE-SLE-Product-RT-15-SP2-2022-1688=1
- SUSE Linux Enterprise Module for Basesystem 15-SP3:
zypper in -t patch SUSE-SLE-Module-Basesystem-15-SP3-2022-1688=1
- SUSE Linux Enterprise Micro 5.2:
zypper in -t patch SUSE-SUSE-MicroOS-5.2-2022-1688=1
- SUSE Linux Enterprise Micro 5.1:
zypper in -t patch SUSE-SUSE-MicroOS-5.1-2022-1688=1
- SUSE Linux Enterprise Micro 5.0:
zypper in -t patch SUSE-SUSE-MicroOS-5.0-2022-1688=1
- SUSE Linux Enterprise High Performance Computing 15-SP2-LTSS:
zypper in -t patch SUSE-SLE-Product-HPC-15-SP2-LTSS-2022-1688=1
- SUSE Linux Enterprise High Performance Computing 15-SP2-ESPOS:
zypper in -t patch SUSE-SLE-Product-HPC-15-SP2-ESPOS-2022-1688=1
- SUSE Linux Enterprise High Performance Computing 15-SP1-LTSS:
zypper in -t patch SUSE-SLE-Product-HPC-15-SP1-LTSS-2022-1688=1
- SUSE Linux Enterprise High Performance Computing 15-SP1-ESPOS:
zypper in -t patch SUSE-SLE-Product-HPC-15-SP1-ESPOS-2022-1688=1
- SUSE Linux Enterprise High Performance Computing 15-LTSS:
zypper in -t patch SUSE-SLE-Product-HPC-15-2022-1688=1
- SUSE Linux Enterprise High Performance Computing 15-ESPOS:
zypper in -t patch SUSE-SLE-Product-HPC-15-2022-1688=1
- SUSE Enterprise Storage 7:
zypper in -t patch SUSE-Storage-7-2022-1688=1
- SUSE Enterprise Storage 6:
zypper in -t patch SUSE-Storage-6-2022-1688=1
- SUSE CaaS Platform 4.0:
To install this update, use the SUSE CaaS Platform 'skuba' tool. It
will inform you if it detects new updates and let you then trigger
updating of the complete cluster in a controlled way.
Package List:
- openSUSE Leap 15.3 (aarch64 ppc64le s390x x86_64):
e2fsprogs-1.43.8-150000.4.33.1
e2fsprogs-debuginfo-1.43.8-150000.4.33.1
e2fsprogs-debugsource-1.43.8-150000.4.33.1
e2fsprogs-devel-1.43.8-150000.4.33.1
libcom_err-devel-1.43.8-150000.4.33.1
libcom_err-devel-static-1.43.8-150000.4.33.1
libcom_err2-1.43.8-150000.4.33.1
libcom_err2-debuginfo-1.43.8-150000.4.33.1
libext2fs-devel-1.43.8-150000.4.33.1
libext2fs-devel-static-1.43.8-150000.4.33.1
libext2fs2-1.43.8-150000.4.33.1
libext2fs2-debuginfo-1.43.8-150000.4.33.1
- openSUSE Leap 15.3 (x86_64):
e2fsprogs-32bit-debuginfo-1.43.8-150000.4.33.1
libcom_err-devel-32bit-1.43.8-150000.4.33.1
libcom_err2-32bit-1.43.8-150000.4.33.1
libcom_err2-32bit-debuginfo-1.43.8-150000.4.33.1
libext2fs-devel-32bit-1.43.8-150000.4.33.1
libext2fs2-32bit-1.43.8-150000.4.33.1
libext2fs2-32bit-debuginfo-1.43.8-150000.4.33.1
- SUSE Manager Server 4.1 (ppc64le s390x x86_64):
e2fsprogs-1.43.8-150000.4.33.1
e2fsprogs-debuginfo-1.43.8-150000.4.33.1
e2fsprogs-debugsource-1.43.8-150000.4.33.1
e2fsprogs-devel-1.43.8-150000.4.33.1
libcom_err-devel-1.43.8-150000.4.33.1
libcom_err-devel-static-1.43.8-150000.4.33.1
libcom_err2-1.43.8-150000.4.33.1
libcom_err2-debuginfo-1.43.8-150000.4.33.1
libext2fs-devel-1.43.8-150000.4.33.1
libext2fs-devel-static-1.43.8-150000.4.33.1
libext2fs2-1.43.8-150000.4.33.1
libext2fs2-debuginfo-1.43.8-150000.4.33.1
- SUSE Manager Server 4.1 (x86_64):
e2fsprogs-32bit-debuginfo-1.43.8-150000.4.33.1
libcom_err2-32bit-1.43.8-150000.4.33.1
libcom_err2-32bit-debuginfo-1.43.8-150000.4.33.1
- SUSE Manager Retail Branch Server 4.1 (x86_64):
e2fsprogs-1.43.8-150000.4.33.1
e2fsprogs-32bit-debuginfo-1.43.8-150000.4.33.1
e2fsprogs-debuginfo-1.43.8-150000.4.33.1
e2fsprogs-debugsource-1.43.8-150000.4.33.1
e2fsprogs-devel-1.43.8-150000.4.33.1
libcom_err-devel-1.43.8-150000.4.33.1
libcom_err-devel-static-1.43.8-150000.4.33.1
libcom_err2-1.43.8-150000.4.33.1
libcom_err2-32bit-1.43.8-150000.4.33.1
libcom_err2-32bit-debuginfo-1.43.8-150000.4.33.1
libcom_err2-debuginfo-1.43.8-150000.4.33.1
libext2fs-devel-1.43.8-150000.4.33.1
libext2fs-devel-static-1.43.8-150000.4.33.1
libext2fs2-1.43.8-150000.4.33.1
libext2fs2-debuginfo-1.43.8-150000.4.33.1
- SUSE Manager Proxy 4.1 (x86_64):
e2fsprogs-1.43.8-150000.4.33.1
e2fsprogs-32bit-debuginfo-1.43.8-150000.4.33.1
e2fsprogs-debuginfo-1.43.8-150000.4.33.1
e2fsprogs-debugsource-1.43.8-150000.4.33.1
e2fsprogs-devel-1.43.8-150000.4.33.1
libcom_err-devel-1.43.8-150000.4.33.1
libcom_err-devel-static-1.43.8-150000.4.33.1
libcom_err2-1.43.8-150000.4.33.1
libcom_err2-32bit-1.43.8-150000.4.33.1
libcom_err2-32bit-debuginfo-1.43.8-150000.4.33.1
libcom_err2-debuginfo-1.43.8-150000.4.33.1
libext2fs-devel-1.43.8-150000.4.33.1
libext2fs-devel-static-1.43.8-150000.4.33.1
libext2fs2-1.43.8-150000.4.33.1
libext2fs2-debuginfo-1.43.8-150000.4.33.1
- SUSE Linux Enterprise Server for SAP 15-SP2 (ppc64le x86_64):
e2fsprogs-1.43.8-150000.4.33.1
e2fsprogs-debuginfo-1.43.8-150000.4.33.1
e2fsprogs-debugsource-1.43.8-150000.4.33.1
e2fsprogs-devel-1.43.8-150000.4.33.1
libcom_err-devel-1.43.8-150000.4.33.1
libcom_err-devel-static-1.43.8-150000.4.33.1
libcom_err2-1.43.8-150000.4.33.1
libcom_err2-debuginfo-1.43.8-150000.4.33.1
libext2fs-devel-1.43.8-150000.4.33.1
libext2fs-devel-static-1.43.8-150000.4.33.1
libext2fs2-1.43.8-150000.4.33.1
libext2fs2-debuginfo-1.43.8-150000.4.33.1
- SUSE Linux Enterprise Server for SAP 15-SP2 (x86_64):
e2fsprogs-32bit-debuginfo-1.43.8-150000.4.33.1
libcom_err2-32bit-1.43.8-150000.4.33.1
libcom_err2-32bit-debuginfo-1.43.8-150000.4.33.1
- SUSE Linux Enterprise Server for SAP 15-SP1 (ppc64le x86_64):
e2fsprogs-1.43.8-150000.4.33.1
e2fsprogs-debuginfo-1.43.8-150000.4.33.1
e2fsprogs-debugsource-1.43.8-150000.4.33.1
e2fsprogs-devel-1.43.8-150000.4.33.1
libcom_err-devel-1.43.8-150000.4.33.1
libcom_err-devel-static-1.43.8-150000.4.33.1
libcom_err2-1.43.8-150000.4.33.1
libcom_err2-debuginfo-1.43.8-150000.4.33.1
libext2fs-devel-1.43.8-150000.4.33.1
libext2fs-devel-static-1.43.8-150000.4.33.1
libext2fs2-1.43.8-150000.4.33.1
libext2fs2-debuginfo-1.43.8-150000.4.33.1
- SUSE Linux Enterprise Server for SAP 15-SP1 (x86_64):
e2fsprogs-32bit-debuginfo-1.43.8-150000.4.33.1
libcom_err2-32bit-1.43.8-150000.4.33.1
libcom_err2-32bit-debuginfo-1.43.8-150000.4.33.1
- SUSE Linux Enterprise Server for SAP 15 (ppc64le x86_64):
e2fsprogs-1.43.8-150000.4.33.1
e2fsprogs-debuginfo-1.43.8-150000.4.33.1
e2fsprogs-debugsource-1.43.8-150000.4.33.1
e2fsprogs-devel-1.43.8-150000.4.33.1
libcom_err-devel-1.43.8-150000.4.33.1
libcom_err-devel-static-1.43.8-150000.4.33.1
libcom_err2-1.43.8-150000.4.33.1
libcom_err2-debuginfo-1.43.8-150000.4.33.1
libext2fs-devel-1.43.8-150000.4.33.1
libext2fs-devel-static-1.43.8-150000.4.33.1
libext2fs2-1.43.8-150000.4.33.1
libext2fs2-debuginfo-1.43.8-150000.4.33.1
- SUSE Linux Enterprise Server for SAP 15 (x86_64):
e2fsprogs-32bit-debuginfo-1.43.8-150000.4.33.1
libcom_err2-32bit-1.43.8-150000.4.33.1
libcom_err2-32bit-debuginfo-1.43.8-150000.4.33.1
- SUSE Linux Enterprise Server 15-SP2-LTSS (aarch64 ppc64le s390x x86_64):
e2fsprogs-1.43.8-150000.4.33.1
e2fsprogs-debuginfo-1.43.8-150000.4.33.1
e2fsprogs-debugsource-1.43.8-150000.4.33.1
e2fsprogs-devel-1.43.8-150000.4.33.1
libcom_err-devel-1.43.8-150000.4.33.1
libcom_err-devel-static-1.43.8-150000.4.33.1
libcom_err2-1.43.8-150000.4.33.1
libcom_err2-debuginfo-1.43.8-150000.4.33.1
libext2fs-devel-1.43.8-150000.4.33.1
libext2fs-devel-static-1.43.8-150000.4.33.1
libext2fs2-1.43.8-150000.4.33.1
libext2fs2-debuginfo-1.43.8-150000.4.33.1
- SUSE Linux Enterprise Server 15-SP2-LTSS (x86_64):
e2fsprogs-32bit-debuginfo-1.43.8-150000.4.33.1
libcom_err2-32bit-1.43.8-150000.4.33.1
libcom_err2-32bit-debuginfo-1.43.8-150000.4.33.1
- SUSE Linux Enterprise Server 15-SP2-BCL (x86_64):
e2fsprogs-1.43.8-150000.4.33.1
e2fsprogs-32bit-debuginfo-1.43.8-150000.4.33.1
e2fsprogs-debuginfo-1.43.8-150000.4.33.1
e2fsprogs-debugsource-1.43.8-150000.4.33.1
e2fsprogs-devel-1.43.8-150000.4.33.1
libcom_err-devel-1.43.8-150000.4.33.1
libcom_err-devel-static-1.43.8-150000.4.33.1
libcom_err2-1.43.8-150000.4.33.1
libcom_err2-32bit-1.43.8-150000.4.33.1
libcom_err2-32bit-debuginfo-1.43.8-150000.4.33.1
libcom_err2-debuginfo-1.43.8-150000.4.33.1
libext2fs-devel-1.43.8-150000.4.33.1
libext2fs-devel-static-1.43.8-150000.4.33.1
libext2fs2-1.43.8-150000.4.33.1
libext2fs2-debuginfo-1.43.8-150000.4.33.1
- SUSE Linux Enterprise Server 15-SP1-LTSS (aarch64 ppc64le s390x x86_64):
e2fsprogs-1.43.8-150000.4.33.1
e2fsprogs-debuginfo-1.43.8-150000.4.33.1
e2fsprogs-debugsource-1.43.8-150000.4.33.1
e2fsprogs-devel-1.43.8-150000.4.33.1
libcom_err-devel-1.43.8-150000.4.33.1
libcom_err-devel-static-1.43.8-150000.4.33.1
libcom_err2-1.43.8-150000.4.33.1
libcom_err2-debuginfo-1.43.8-150000.4.33.1
libext2fs-devel-1.43.8-150000.4.33.1
libext2fs-devel-static-1.43.8-150000.4.33.1
libext2fs2-1.43.8-150000.4.33.1
libext2fs2-debuginfo-1.43.8-150000.4.33.1
- SUSE Linux Enterprise Server 15-SP1-LTSS (x86_64):
e2fsprogs-32bit-debuginfo-1.43.8-150000.4.33.1
libcom_err2-32bit-1.43.8-150000.4.33.1
libcom_err2-32bit-debuginfo-1.43.8-150000.4.33.1
- SUSE Linux Enterprise Server 15-SP1-BCL (x86_64):
e2fsprogs-1.43.8-150000.4.33.1
e2fsprogs-32bit-debuginfo-1.43.8-150000.4.33.1
e2fsprogs-debuginfo-1.43.8-150000.4.33.1
e2fsprogs-debugsource-1.43.8-150000.4.33.1
e2fsprogs-devel-1.43.8-150000.4.33.1
libcom_err-devel-1.43.8-150000.4.33.1
libcom_err-devel-static-1.43.8-150000.4.33.1
libcom_err2-1.43.8-150000.4.33.1
libcom_err2-32bit-1.43.8-150000.4.33.1
libcom_err2-32bit-debuginfo-1.43.8-150000.4.33.1
libcom_err2-debuginfo-1.43.8-150000.4.33.1
libext2fs-devel-1.43.8-150000.4.33.1
libext2fs-devel-static-1.43.8-150000.4.33.1
libext2fs2-1.43.8-150000.4.33.1
libext2fs2-debuginfo-1.43.8-150000.4.33.1
- SUSE Linux Enterprise Server 15-LTSS (aarch64 s390x):
e2fsprogs-1.43.8-150000.4.33.1
e2fsprogs-debuginfo-1.43.8-150000.4.33.1
e2fsprogs-debugsource-1.43.8-150000.4.33.1
e2fsprogs-devel-1.43.8-150000.4.33.1
libcom_err-devel-1.43.8-150000.4.33.1
libcom_err-devel-static-1.43.8-150000.4.33.1
libcom_err2-1.43.8-150000.4.33.1
libcom_err2-debuginfo-1.43.8-150000.4.33.1
libext2fs-devel-1.43.8-150000.4.33.1
libext2fs-devel-static-1.43.8-150000.4.33.1
libext2fs2-1.43.8-150000.4.33.1
libext2fs2-debuginfo-1.43.8-150000.4.33.1
- SUSE Linux Enterprise Realtime Extension 15-SP2 (x86_64):
e2fsprogs-1.43.8-150000.4.33.1
e2fsprogs-32bit-debuginfo-1.43.8-150000.4.33.1
e2fsprogs-debuginfo-1.43.8-150000.4.33.1
e2fsprogs-debugsource-1.43.8-150000.4.33.1
e2fsprogs-devel-1.43.8-150000.4.33.1
libcom_err-devel-1.43.8-150000.4.33.1
libcom_err-devel-static-1.43.8-150000.4.33.1
libcom_err2-1.43.8-150000.4.33.1
libcom_err2-32bit-1.43.8-150000.4.33.1
libcom_err2-32bit-debuginfo-1.43.8-150000.4.33.1
libcom_err2-debuginfo-1.43.8-150000.4.33.1
libext2fs-devel-1.43.8-150000.4.33.1
libext2fs-devel-static-1.43.8-150000.4.33.1
libext2fs2-1.43.8-150000.4.33.1
libext2fs2-debuginfo-1.43.8-150000.4.33.1
- SUSE Linux Enterprise Module for Basesystem 15-SP3 (aarch64 ppc64le s390x x86_64):
e2fsprogs-1.43.8-150000.4.33.1
e2fsprogs-debuginfo-1.43.8-150000.4.33.1
e2fsprogs-debugsource-1.43.8-150000.4.33.1
e2fsprogs-devel-1.43.8-150000.4.33.1
libcom_err-devel-1.43.8-150000.4.33.1
libcom_err-devel-static-1.43.8-150000.4.33.1
libcom_err2-1.43.8-150000.4.33.1
libcom_err2-debuginfo-1.43.8-150000.4.33.1
libext2fs-devel-1.43.8-150000.4.33.1
libext2fs-devel-static-1.43.8-150000.4.33.1
libext2fs2-1.43.8-150000.4.33.1
libext2fs2-debuginfo-1.43.8-150000.4.33.1
- SUSE Linux Enterprise Module for Basesystem 15-SP3 (x86_64):
e2fsprogs-32bit-debuginfo-1.43.8-150000.4.33.1
libcom_err2-32bit-1.43.8-150000.4.33.1
libcom_err2-32bit-debuginfo-1.43.8-150000.4.33.1
- SUSE Linux Enterprise Micro 5.2 (aarch64 s390x x86_64):
e2fsprogs-1.43.8-150000.4.33.1
e2fsprogs-debuginfo-1.43.8-150000.4.33.1
e2fsprogs-debugsource-1.43.8-150000.4.33.1
libcom_err2-1.43.8-150000.4.33.1
libcom_err2-debuginfo-1.43.8-150000.4.33.1
libext2fs2-1.43.8-150000.4.33.1
libext2fs2-debuginfo-1.43.8-150000.4.33.1
- SUSE Linux Enterprise Micro 5.1 (aarch64 s390x x86_64):
e2fsprogs-1.43.8-150000.4.33.1
e2fsprogs-debuginfo-1.43.8-150000.4.33.1
e2fsprogs-debugsource-1.43.8-150000.4.33.1
libcom_err2-1.43.8-150000.4.33.1
libcom_err2-debuginfo-1.43.8-150000.4.33.1
libext2fs2-1.43.8-150000.4.33.1
libext2fs2-debuginfo-1.43.8-150000.4.33.1
- SUSE Linux Enterprise Micro 5.0 (aarch64 x86_64):
e2fsprogs-1.43.8-150000.4.33.1
e2fsprogs-debuginfo-1.43.8-150000.4.33.1
e2fsprogs-debugsource-1.43.8-150000.4.33.1
libcom_err2-1.43.8-150000.4.33.1
libcom_err2-debuginfo-1.43.8-150000.4.33.1
libext2fs2-1.43.8-150000.4.33.1
libext2fs2-debuginfo-1.43.8-150000.4.33.1
- SUSE Linux Enterprise High Performance Computing 15-SP2-LTSS (aarch64 x86_64):
e2fsprogs-1.43.8-150000.4.33.1
e2fsprogs-debuginfo-1.43.8-150000.4.33.1
e2fsprogs-debugsource-1.43.8-150000.4.33.1
e2fsprogs-devel-1.43.8-150000.4.33.1
libcom_err-devel-1.43.8-150000.4.33.1
libcom_err-devel-static-1.43.8-150000.4.33.1
libcom_err2-1.43.8-150000.4.33.1
libcom_err2-debuginfo-1.43.8-150000.4.33.1
libext2fs-devel-1.43.8-150000.4.33.1
libext2fs-devel-static-1.43.8-150000.4.33.1
libext2fs2-1.43.8-150000.4.33.1
libext2fs2-debuginfo-1.43.8-150000.4.33.1
- SUSE Linux Enterprise High Performance Computing 15-SP2-LTSS (x86_64):
e2fsprogs-32bit-debuginfo-1.43.8-150000.4.33.1
libcom_err2-32bit-1.43.8-150000.4.33.1
libcom_err2-32bit-debuginfo-1.43.8-150000.4.33.1
- SUSE Linux Enterprise High Performance Computing 15-SP2-ESPOS (aarch64 x86_64):
e2fsprogs-1.43.8-150000.4.33.1
e2fsprogs-debuginfo-1.43.8-150000.4.33.1
e2fsprogs-debugsource-1.43.8-150000.4.33.1
e2fsprogs-devel-1.43.8-150000.4.33.1
libcom_err-devel-1.43.8-150000.4.33.1
libcom_err-devel-static-1.43.8-150000.4.33.1
libcom_err2-1.43.8-150000.4.33.1
libcom_err2-debuginfo-1.43.8-150000.4.33.1
libext2fs-devel-1.43.8-150000.4.33.1
libext2fs-devel-static-1.43.8-150000.4.33.1
libext2fs2-1.43.8-150000.4.33.1
libext2fs2-debuginfo-1.43.8-150000.4.33.1
- SUSE Linux Enterprise High Performance Computing 15-SP2-ESPOS (x86_64):
e2fsprogs-32bit-debuginfo-1.43.8-150000.4.33.1
libcom_err2-32bit-1.43.8-150000.4.33.1
libcom_err2-32bit-debuginfo-1.43.8-150000.4.33.1
- SUSE Linux Enterprise High Performance Computing 15-SP1-LTSS (aarch64 x86_64):
e2fsprogs-1.43.8-150000.4.33.1
e2fsprogs-debuginfo-1.43.8-150000.4.33.1
e2fsprogs-debugsource-1.43.8-150000.4.33.1
e2fsprogs-devel-1.43.8-150000.4.33.1
libcom_err-devel-1.43.8-150000.4.33.1
libcom_err-devel-static-1.43.8-150000.4.33.1
libcom_err2-1.43.8-150000.4.33.1
libcom_err2-debuginfo-1.43.8-150000.4.33.1
libext2fs-devel-1.43.8-150000.4.33.1
libext2fs-devel-static-1.43.8-150000.4.33.1
libext2fs2-1.43.8-150000.4.33.1
libext2fs2-debuginfo-1.43.8-150000.4.33.1
- SUSE Linux Enterprise High Performance Computing 15-SP1-LTSS (x86_64):
e2fsprogs-32bit-debuginfo-1.43.8-150000.4.33.1
libcom_err2-32bit-1.43.8-150000.4.33.1
libcom_err2-32bit-debuginfo-1.43.8-150000.4.33.1
- SUSE Linux Enterprise High Performance Computing 15-SP1-ESPOS (aarch64 x86_64):
e2fsprogs-1.43.8-150000.4.33.1
e2fsprogs-debuginfo-1.43.8-150000.4.33.1
e2fsprogs-debugsource-1.43.8-150000.4.33.1
e2fsprogs-devel-1.43.8-150000.4.33.1
libcom_err-devel-1.43.8-150000.4.33.1
libcom_err-devel-static-1.43.8-150000.4.33.1
libcom_err2-1.43.8-150000.4.33.1
libcom_err2-debuginfo-1.43.8-150000.4.33.1
libext2fs-devel-1.43.8-150000.4.33.1
libext2fs-devel-static-1.43.8-150000.4.33.1
libext2fs2-1.43.8-150000.4.33.1
libext2fs2-debuginfo-1.43.8-150000.4.33.1
- SUSE Linux Enterprise High Performance Computing 15-SP1-ESPOS (x86_64):
e2fsprogs-32bit-debuginfo-1.43.8-150000.4.33.1
libcom_err2-32bit-1.43.8-150000.4.33.1
libcom_err2-32bit-debuginfo-1.43.8-150000.4.33.1
- SUSE Linux Enterprise High Performance Computing 15-LTSS (aarch64 x86_64):
e2fsprogs-1.43.8-150000.4.33.1
e2fsprogs-debuginfo-1.43.8-150000.4.33.1
e2fsprogs-debugsource-1.43.8-150000.4.33.1
e2fsprogs-devel-1.43.8-150000.4.33.1
libcom_err-devel-1.43.8-150000.4.33.1
libcom_err-devel-static-1.43.8-150000.4.33.1
libcom_err2-1.43.8-150000.4.33.1
libcom_err2-debuginfo-1.43.8-150000.4.33.1
libext2fs-devel-1.43.8-150000.4.33.1
libext2fs-devel-static-1.43.8-150000.4.33.1
libext2fs2-1.43.8-150000.4.33.1
libext2fs2-debuginfo-1.43.8-150000.4.33.1
- SUSE Linux Enterprise High Performance Computing 15-LTSS (x86_64):
e2fsprogs-32bit-debuginfo-1.43.8-150000.4.33.1
libcom_err2-32bit-1.43.8-150000.4.33.1
libcom_err2-32bit-debuginfo-1.43.8-150000.4.33.1
- SUSE Linux Enterprise High Performance Computing 15-ESPOS (aarch64 x86_64):
e2fsprogs-1.43.8-150000.4.33.1
e2fsprogs-debuginfo-1.43.8-150000.4.33.1
e2fsprogs-debugsource-1.43.8-150000.4.33.1
e2fsprogs-devel-1.43.8-150000.4.33.1
libcom_err-devel-1.43.8-150000.4.33.1
libcom_err-devel-static-1.43.8-150000.4.33.1
libcom_err2-1.43.8-150000.4.33.1
libcom_err2-debuginfo-1.43.8-150000.4.33.1
libext2fs-devel-1.43.8-150000.4.33.1
libext2fs-devel-static-1.43.8-150000.4.33.1
libext2fs2-1.43.8-150000.4.33.1
libext2fs2-debuginfo-1.43.8-150000.4.33.1
- SUSE Linux Enterprise High Performance Computing 15-ESPOS (x86_64):
e2fsprogs-32bit-debuginfo-1.43.8-150000.4.33.1
libcom_err2-32bit-1.43.8-150000.4.33.1
libcom_err2-32bit-debuginfo-1.43.8-150000.4.33.1
- SUSE Enterprise Storage 7 (aarch64 x86_64):
e2fsprogs-1.43.8-150000.4.33.1
e2fsprogs-debuginfo-1.43.8-150000.4.33.1
e2fsprogs-debugsource-1.43.8-150000.4.33.1
e2fsprogs-devel-1.43.8-150000.4.33.1
libcom_err-devel-1.43.8-150000.4.33.1
libcom_err-devel-static-1.43.8-150000.4.33.1
libcom_err2-1.43.8-150000.4.33.1
libcom_err2-debuginfo-1.43.8-150000.4.33.1
libext2fs-devel-1.43.8-150000.4.33.1
libext2fs-devel-static-1.43.8-150000.4.33.1
libext2fs2-1.43.8-150000.4.33.1
libext2fs2-debuginfo-1.43.8-150000.4.33.1
- SUSE Enterprise Storage 7 (x86_64):
e2fsprogs-32bit-debuginfo-1.43.8-150000.4.33.1
libcom_err2-32bit-1.43.8-150000.4.33.1
libcom_err2-32bit-debuginfo-1.43.8-150000.4.33.1
- SUSE Enterprise Storage 6 (aarch64 x86_64):
e2fsprogs-1.43.8-150000.4.33.1
e2fsprogs-debuginfo-1.43.8-150000.4.33.1
e2fsprogs-debugsource-1.43.8-150000.4.33.1
e2fsprogs-devel-1.43.8-150000.4.33.1
libcom_err-devel-1.43.8-150000.4.33.1
libcom_err-devel-static-1.43.8-150000.4.33.1
libcom_err2-1.43.8-150000.4.33.1
libcom_err2-debuginfo-1.43.8-150000.4.33.1
libext2fs-devel-1.43.8-150000.4.33.1
libext2fs-devel-static-1.43.8-150000.4.33.1
libext2fs2-1.43.8-150000.4.33.1
libext2fs2-debuginfo-1.43.8-150000.4.33.1
- SUSE Enterprise Storage 6 (x86_64):
e2fsprogs-32bit-debuginfo-1.43.8-150000.4.33.1
libcom_err2-32bit-1.43.8-150000.4.33.1
libcom_err2-32bit-debuginfo-1.43.8-150000.4.33.1
- SUSE CaaS Platform 4.0 (x86_64):
e2fsprogs-1.43.8-150000.4.33.1
e2fsprogs-32bit-debuginfo-1.43.8-150000.4.33.1
e2fsprogs-debuginfo-1.43.8-150000.4.33.1
e2fsprogs-debugsource-1.43.8-150000.4.33.1
e2fsprogs-devel-1.43.8-150000.4.33.1
libcom_err-devel-1.43.8-150000.4.33.1
libcom_err-devel-static-1.43.8-150000.4.33.1
libcom_err2-1.43.8-150000.4.33.1
libcom_err2-32bit-1.43.8-150000.4.33.1
libcom_err2-32bit-debuginfo-1.43.8-150000.4.33.1
libcom_err2-debuginfo-1.43.8-150000.4.33.1
libext2fs-devel-1.43.8-150000.4.33.1
libext2fs-devel-static-1.43.8-150000.4.33.1
libext2fs2-1.43.8-150000.4.33.1
libext2fs2-debuginfo-1.43.8-150000.4.33.1
References:
https://www.suse.com/security/cve/CVE-2022-1304.html
https://bugzilla.suse.com/1198446
1
0
SUSE-SU-2022:1689-1: important: Security update for containerd, docker
by opensuse-security@opensuse.org 16 May '22
by opensuse-security@opensuse.org 16 May '22
16 May '22
SUSE Security Update: Security update for containerd, docker
______________________________________________________________________________
Announcement ID: SUSE-SU-2022:1689-1
Rating: important
References: #1193930 #1196441 #1197284 #1197517
Cross-References: CVE-2021-43565 CVE-2022-23648 CVE-2022-24769
CVE-2022-27191
CVSS scores:
CVE-2021-43565 (SUSE): 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
CVE-2022-23648 (NVD) : 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
CVE-2022-23648 (SUSE): 5.5 CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
CVE-2022-24769 (NVD) : 5.9 CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L
CVE-2022-24769 (SUSE): 5.9 CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L
CVE-2022-27191 (NVD) : 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
CVE-2022-27191 (SUSE): 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Affected Products:
SUSE CaaS Platform 4.0
SUSE Enterprise Storage 6
SUSE Enterprise Storage 7
SUSE Linux Enterprise High Performance Computing 15-ESPOS
SUSE Linux Enterprise High Performance Computing 15-LTSS
SUSE Linux Enterprise High Performance Computing 15-SP1-ESPOS
SUSE Linux Enterprise High Performance Computing 15-SP1-LTSS
SUSE Linux Enterprise High Performance Computing 15-SP2-ESPOS
SUSE Linux Enterprise High Performance Computing 15-SP2-LTSS
SUSE Linux Enterprise High Performance Computing 15-SP3
SUSE Linux Enterprise High Performance Computing 15-SP4
SUSE Linux Enterprise Micro 5.0
SUSE Linux Enterprise Micro 5.1
SUSE Linux Enterprise Micro 5.2
SUSE Linux Enterprise Module for Containers 15-SP3
SUSE Linux Enterprise Module for Containers 15-SP4
SUSE Linux Enterprise Module for Packagehub Subpackages 15-SP3
SUSE Linux Enterprise Server 15-LTSS
SUSE Linux Enterprise Server 15-SP1-BCL
SUSE Linux Enterprise Server 15-SP1-LTSS
SUSE Linux Enterprise Server 15-SP2-BCL
SUSE Linux Enterprise Server 15-SP2-LTSS
SUSE Linux Enterprise Server 15-SP3
SUSE Linux Enterprise Server 15-SP4
SUSE Linux Enterprise Server for SAP 15
SUSE Linux Enterprise Server for SAP 15-SP1
SUSE Linux Enterprise Server for SAP 15-SP2
SUSE Linux Enterprise Server for SAP Applications 15-SP3
SUSE Linux Enterprise Server for SAP Applications 15-SP4
SUSE Manager Proxy 4.1
SUSE Manager Proxy 4.2
SUSE Manager Retail Branch Server 4.1
SUSE Manager Server 4.1
SUSE Manager Server 4.2
openSUSE Leap 15.3
openSUSE Leap 15.4
______________________________________________________________________________
An update that fixes four vulnerabilities is now available.
Description:
This update for containerd, docker fixes the following issues:
- CVE-2022-24769: Fixed incorrect default inheritable capabilities
(bsc#1197517).
- CVE-2022-23648: Fixed directory traversal issue (bsc#1196441).
- CVE-2022-27191: Fixed a crash in a golang.org/x/crypto/ssh server
(bsc#1197284).
- CVE-2021-43565: Fixed a panic in golang.org/x/crypto by empty plaintext
packet (bsc#1193930).
Patch Instructions:
To install this SUSE Security Update use the SUSE recommended installation methods
like YaST online_update or "zypper patch".
Alternatively you can run the command listed for your product:
- openSUSE Leap 15.4:
zypper in -t patch openSUSE-SLE-15.4-2022-1689=1
- openSUSE Leap 15.3:
zypper in -t patch openSUSE-SLE-15.3-2022-1689=1
- SUSE Manager Server 4.1:
zypper in -t patch SUSE-SLE-Product-SUSE-Manager-Server-4.1-2022-1689=1
- SUSE Manager Retail Branch Server 4.1:
zypper in -t patch SUSE-SLE-Product-SUSE-Manager-Retail-Branch-Server-4.1-2022-1689=1
- SUSE Manager Proxy 4.1:
zypper in -t patch SUSE-SLE-Product-SUSE-Manager-Proxy-4.1-2022-1689=1
- SUSE Linux Enterprise Server for SAP 15-SP2:
zypper in -t patch SUSE-SLE-Product-SLES_SAP-15-SP2-2022-1689=1
- SUSE Linux Enterprise Server for SAP 15-SP1:
zypper in -t patch SUSE-SLE-Product-SLES_SAP-15-SP1-2022-1689=1
- SUSE Linux Enterprise Server for SAP 15:
zypper in -t patch SUSE-SLE-Product-SLES_SAP-15-2022-1689=1
- SUSE Linux Enterprise Server 15-SP2-LTSS:
zypper in -t patch SUSE-SLE-Product-SLES-15-SP2-LTSS-2022-1689=1
- SUSE Linux Enterprise Server 15-SP2-BCL:
zypper in -t patch SUSE-SLE-Product-SLES-15-SP2-BCL-2022-1689=1
- SUSE Linux Enterprise Server 15-SP1-LTSS:
zypper in -t patch SUSE-SLE-Product-SLES-15-SP1-LTSS-2022-1689=1
- SUSE Linux Enterprise Server 15-SP1-BCL:
zypper in -t patch SUSE-SLE-Product-SLES-15-SP1-BCL-2022-1689=1
- SUSE Linux Enterprise Server 15-LTSS:
zypper in -t patch SUSE-SLE-Product-SLES-15-2022-1689=1
- SUSE Linux Enterprise Module for Packagehub Subpackages 15-SP3:
zypper in -t patch SUSE-SLE-Module-Packagehub-Subpackages-15-SP3-2022-1689=1
- SUSE Linux Enterprise Module for Containers 15-SP4:
zypper in -t patch SUSE-SLE-Module-Containers-15-SP4-2022-1689=1
- SUSE Linux Enterprise Module for Containers 15-SP3:
zypper in -t patch SUSE-SLE-Module-Containers-15-SP3-2022-1689=1
- SUSE Linux Enterprise Micro 5.2:
zypper in -t patch SUSE-SUSE-MicroOS-5.2-2022-1689=1
- SUSE Linux Enterprise Micro 5.1:
zypper in -t patch SUSE-SUSE-MicroOS-5.1-2022-1689=1
- SUSE Linux Enterprise Micro 5.0:
zypper in -t patch SUSE-SUSE-MicroOS-5.0-2022-1689=1
- SUSE Linux Enterprise High Performance Computing 15-SP2-LTSS:
zypper in -t patch SUSE-SLE-Product-HPC-15-SP2-LTSS-2022-1689=1
- SUSE Linux Enterprise High Performance Computing 15-SP2-ESPOS:
zypper in -t patch SUSE-SLE-Product-HPC-15-SP2-ESPOS-2022-1689=1
- SUSE Linux Enterprise High Performance Computing 15-SP1-LTSS:
zypper in -t patch SUSE-SLE-Product-HPC-15-SP1-LTSS-2022-1689=1
- SUSE Linux Enterprise High Performance Computing 15-SP1-ESPOS:
zypper in -t patch SUSE-SLE-Product-HPC-15-SP1-ESPOS-2022-1689=1
- SUSE Linux Enterprise High Performance Computing 15-LTSS:
zypper in -t patch SUSE-SLE-Product-HPC-15-2022-1689=1
- SUSE Linux Enterprise High Performance Computing 15-ESPOS:
zypper in -t patch SUSE-SLE-Product-HPC-15-2022-1689=1
- SUSE Enterprise Storage 7:
zypper in -t patch SUSE-Storage-7-2022-1689=1
- SUSE Enterprise Storage 6:
zypper in -t patch SUSE-Storage-6-2022-1689=1
- SUSE CaaS Platform 4.0:
To install this update, use the SUSE CaaS Platform 'skuba' tool. It
will inform you if it detects new updates and let you then trigger
updating of the complete cluster in a controlled way.
Package List:
- openSUSE Leap 15.4 (aarch64 ppc64le s390x x86_64):
containerd-1.5.11-150000.68.1
containerd-ctr-1.5.11-150000.68.1
docker-20.10.14_ce-150000.163.1
docker-debuginfo-20.10.14_ce-150000.163.1
docker-kubic-20.10.14_ce-150000.163.1
docker-kubic-debuginfo-20.10.14_ce-150000.163.1
docker-kubic-kubeadm-criconfig-20.10.14_ce-150000.163.1
- openSUSE Leap 15.4 (noarch):
docker-bash-completion-20.10.14_ce-150000.163.1
docker-fish-completion-20.10.14_ce-150000.163.1
docker-kubic-bash-completion-20.10.14_ce-150000.163.1
docker-kubic-fish-completion-20.10.14_ce-150000.163.1
docker-kubic-zsh-completion-20.10.14_ce-150000.163.1
docker-zsh-completion-20.10.14_ce-150000.163.1
- openSUSE Leap 15.3 (aarch64 ppc64le s390x x86_64):
containerd-1.5.11-150000.68.1
containerd-ctr-1.5.11-150000.68.1
docker-20.10.14_ce-150000.163.1
docker-debuginfo-20.10.14_ce-150000.163.1
docker-kubic-20.10.14_ce-150000.163.1
docker-kubic-debuginfo-20.10.14_ce-150000.163.1
docker-kubic-kubeadm-criconfig-20.10.14_ce-150000.163.1
- openSUSE Leap 15.3 (noarch):
docker-bash-completion-20.10.14_ce-150000.163.1
docker-fish-completion-20.10.14_ce-150000.163.1
docker-kubic-bash-completion-20.10.14_ce-150000.163.1
docker-kubic-fish-completion-20.10.14_ce-150000.163.1
docker-kubic-zsh-completion-20.10.14_ce-150000.163.1
docker-zsh-completion-20.10.14_ce-150000.163.1
- SUSE Manager Server 4.1 (ppc64le s390x x86_64):
containerd-1.5.11-150000.68.1
containerd-ctr-1.5.11-150000.68.1
docker-20.10.14_ce-150000.163.1
docker-debuginfo-20.10.14_ce-150000.163.1
- SUSE Manager Server 4.1 (noarch):
docker-bash-completion-20.10.14_ce-150000.163.1
- SUSE Manager Retail Branch Server 4.1 (noarch):
docker-bash-completion-20.10.14_ce-150000.163.1
- SUSE Manager Retail Branch Server 4.1 (x86_64):
containerd-1.5.11-150000.68.1
containerd-ctr-1.5.11-150000.68.1
docker-20.10.14_ce-150000.163.1
docker-debuginfo-20.10.14_ce-150000.163.1
- SUSE Manager Proxy 4.1 (x86_64):
containerd-1.5.11-150000.68.1
containerd-ctr-1.5.11-150000.68.1
docker-20.10.14_ce-150000.163.1
docker-debuginfo-20.10.14_ce-150000.163.1
- SUSE Manager Proxy 4.1 (noarch):
docker-bash-completion-20.10.14_ce-150000.163.1
- SUSE Linux Enterprise Server for SAP 15-SP2 (ppc64le x86_64):
containerd-1.5.11-150000.68.1
containerd-ctr-1.5.11-150000.68.1
docker-20.10.14_ce-150000.163.1
docker-debuginfo-20.10.14_ce-150000.163.1
- SUSE Linux Enterprise Server for SAP 15-SP2 (noarch):
docker-bash-completion-20.10.14_ce-150000.163.1
- SUSE Linux Enterprise Server for SAP 15-SP1 (ppc64le x86_64):
containerd-1.5.11-150000.68.1
containerd-ctr-1.5.11-150000.68.1
docker-20.10.14_ce-150000.163.1
docker-debuginfo-20.10.14_ce-150000.163.1
- SUSE Linux Enterprise Server for SAP 15-SP1 (noarch):
docker-bash-completion-20.10.14_ce-150000.163.1
- SUSE Linux Enterprise Server for SAP 15 (ppc64le x86_64):
containerd-1.5.11-150000.68.1
containerd-ctr-1.5.11-150000.68.1
docker-20.10.14_ce-150000.163.1
docker-debuginfo-20.10.14_ce-150000.163.1
- SUSE Linux Enterprise Server for SAP 15 (noarch):
docker-bash-completion-20.10.14_ce-150000.163.1
- SUSE Linux Enterprise Server 15-SP2-LTSS (aarch64 ppc64le s390x x86_64):
containerd-1.5.11-150000.68.1
containerd-ctr-1.5.11-150000.68.1
docker-20.10.14_ce-150000.163.1
docker-debuginfo-20.10.14_ce-150000.163.1
- SUSE Linux Enterprise Server 15-SP2-LTSS (noarch):
docker-bash-completion-20.10.14_ce-150000.163.1
- SUSE Linux Enterprise Server 15-SP2-BCL (noarch):
docker-bash-completion-20.10.14_ce-150000.163.1
- SUSE Linux Enterprise Server 15-SP2-BCL (x86_64):
containerd-1.5.11-150000.68.1
containerd-ctr-1.5.11-150000.68.1
docker-20.10.14_ce-150000.163.1
docker-debuginfo-20.10.14_ce-150000.163.1
- SUSE Linux Enterprise Server 15-SP1-LTSS (aarch64 ppc64le s390x x86_64):
containerd-1.5.11-150000.68.1
containerd-ctr-1.5.11-150000.68.1
docker-20.10.14_ce-150000.163.1
docker-debuginfo-20.10.14_ce-150000.163.1
- SUSE Linux Enterprise Server 15-SP1-LTSS (noarch):
docker-bash-completion-20.10.14_ce-150000.163.1
- SUSE Linux Enterprise Server 15-SP1-BCL (x86_64):
containerd-1.5.11-150000.68.1
containerd-ctr-1.5.11-150000.68.1
docker-20.10.14_ce-150000.163.1
docker-debuginfo-20.10.14_ce-150000.163.1
- SUSE Linux Enterprise Server 15-SP1-BCL (noarch):
docker-bash-completion-20.10.14_ce-150000.163.1
- SUSE Linux Enterprise Server 15-LTSS (noarch):
docker-bash-completion-20.10.14_ce-150000.163.1
- SUSE Linux Enterprise Server 15-LTSS (s390x):
containerd-1.5.11-150000.68.1
containerd-ctr-1.5.11-150000.68.1
docker-20.10.14_ce-150000.163.1
docker-debuginfo-20.10.14_ce-150000.163.1
- SUSE Linux Enterprise Module for Packagehub Subpackages 15-SP3 (aarch64 ppc64le s390x x86_64):
containerd-ctr-1.5.11-150000.68.1
- SUSE Linux Enterprise Module for Containers 15-SP4 (aarch64 ppc64le s390x x86_64):
containerd-1.5.11-150000.68.1
docker-20.10.14_ce-150000.163.1
docker-debuginfo-20.10.14_ce-150000.163.1
- SUSE Linux Enterprise Module for Containers 15-SP4 (noarch):
docker-bash-completion-20.10.14_ce-150000.163.1
- SUSE Linux Enterprise Module for Containers 15-SP3 (aarch64 ppc64le s390x x86_64):
containerd-1.5.11-150000.68.1
containerd-ctr-1.5.11-150000.68.1
docker-20.10.14_ce-150000.163.1
docker-debuginfo-20.10.14_ce-150000.163.1
- SUSE Linux Enterprise Module for Containers 15-SP3 (noarch):
docker-bash-completion-20.10.14_ce-150000.163.1
docker-fish-completion-20.10.14_ce-150000.163.1
- SUSE Linux Enterprise Micro 5.2 (aarch64 s390x x86_64):
containerd-1.5.11-150000.68.1
docker-20.10.14_ce-150000.163.1
docker-debuginfo-20.10.14_ce-150000.163.1
- SUSE Linux Enterprise Micro 5.1 (aarch64 s390x x86_64):
containerd-1.5.11-150000.68.1
docker-20.10.14_ce-150000.163.1
docker-debuginfo-20.10.14_ce-150000.163.1
- SUSE Linux Enterprise Micro 5.0 (aarch64 x86_64):
containerd-1.5.11-150000.68.1
docker-20.10.14_ce-150000.163.1
docker-debuginfo-20.10.14_ce-150000.163.1
- SUSE Linux Enterprise High Performance Computing 15-SP2-LTSS (aarch64 x86_64):
containerd-1.5.11-150000.68.1
containerd-ctr-1.5.11-150000.68.1
docker-20.10.14_ce-150000.163.1
docker-debuginfo-20.10.14_ce-150000.163.1
- SUSE Linux Enterprise High Performance Computing 15-SP2-LTSS (noarch):
docker-bash-completion-20.10.14_ce-150000.163.1
- SUSE Linux Enterprise High Performance Computing 15-SP2-ESPOS (aarch64 x86_64):
containerd-1.5.11-150000.68.1
containerd-ctr-1.5.11-150000.68.1
docker-20.10.14_ce-150000.163.1
docker-debuginfo-20.10.14_ce-150000.163.1
- SUSE Linux Enterprise High Performance Computing 15-SP2-ESPOS (noarch):
docker-bash-completion-20.10.14_ce-150000.163.1
- SUSE Linux Enterprise High Performance Computing 15-SP1-LTSS (aarch64 x86_64):
containerd-1.5.11-150000.68.1
containerd-ctr-1.5.11-150000.68.1
docker-20.10.14_ce-150000.163.1
docker-debuginfo-20.10.14_ce-150000.163.1
- SUSE Linux Enterprise High Performance Computing 15-SP1-LTSS (noarch):
docker-bash-completion-20.10.14_ce-150000.163.1
- SUSE Linux Enterprise High Performance Computing 15-SP1-ESPOS (aarch64 x86_64):
containerd-1.5.11-150000.68.1
containerd-ctr-1.5.11-150000.68.1
docker-20.10.14_ce-150000.163.1
docker-debuginfo-20.10.14_ce-150000.163.1
- SUSE Linux Enterprise High Performance Computing 15-SP1-ESPOS (noarch):
docker-bash-completion-20.10.14_ce-150000.163.1
- SUSE Linux Enterprise High Performance Computing 15-LTSS (noarch):
docker-bash-completion-20.10.14_ce-150000.163.1
- SUSE Linux Enterprise High Performance Computing 15-LTSS (x86_64):
containerd-1.5.11-150000.68.1
containerd-ctr-1.5.11-150000.68.1
docker-20.10.14_ce-150000.163.1
docker-debuginfo-20.10.14_ce-150000.163.1
- SUSE Linux Enterprise High Performance Computing 15-ESPOS (noarch):
docker-bash-completion-20.10.14_ce-150000.163.1
- SUSE Linux Enterprise High Performance Computing 15-ESPOS (x86_64):
containerd-1.5.11-150000.68.1
containerd-ctr-1.5.11-150000.68.1
docker-20.10.14_ce-150000.163.1
docker-debuginfo-20.10.14_ce-150000.163.1
- SUSE Enterprise Storage 7 (aarch64 x86_64):
containerd-1.5.11-150000.68.1
containerd-ctr-1.5.11-150000.68.1
docker-20.10.14_ce-150000.163.1
docker-debuginfo-20.10.14_ce-150000.163.1
- SUSE Enterprise Storage 7 (noarch):
docker-bash-completion-20.10.14_ce-150000.163.1
- SUSE Enterprise Storage 6 (aarch64 x86_64):
containerd-1.5.11-150000.68.1
containerd-ctr-1.5.11-150000.68.1
docker-20.10.14_ce-150000.163.1
docker-debuginfo-20.10.14_ce-150000.163.1
- SUSE Enterprise Storage 6 (noarch):
docker-bash-completion-20.10.14_ce-150000.163.1
- SUSE CaaS Platform 4.0 (x86_64):
containerd-1.5.11-150000.68.1
containerd-ctr-1.5.11-150000.68.1
docker-20.10.14_ce-150000.163.1
docker-debuginfo-20.10.14_ce-150000.163.1
- SUSE CaaS Platform 4.0 (noarch):
docker-bash-completion-20.10.14_ce-150000.163.1
References:
https://www.suse.com/security/cve/CVE-2021-43565.html
https://www.suse.com/security/cve/CVE-2022-23648.html
https://www.suse.com/security/cve/CVE-2022-24769.html
https://www.suse.com/security/cve/CVE-2022-27191.html
https://bugzilla.suse.com/1193930
https://bugzilla.suse.com/1196441
https://bugzilla.suse.com/1197284
https://bugzilla.suse.com/1197517
1
0
SUSE-SU-2022:1670-1: important: Security update for openldap2
by opensuse-security@opensuse.org 16 May '22
by opensuse-security@opensuse.org 16 May '22
16 May '22
SUSE Security Update: Security update for openldap2
______________________________________________________________________________
Announcement ID: SUSE-SU-2022:1670-1
Rating: important
References: #1199240
Cross-References: CVE-2022-29155
CVSS scores:
CVE-2022-29155 (NVD) : 9.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
CVE-2022-29155 (SUSE): 9.4 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:H/A:H
Affected Products:
SUSE Enterprise Storage 7
SUSE Linux Enterprise Desktop 15-SP3
SUSE Linux Enterprise Desktop 15-SP4
SUSE Linux Enterprise High Performance Computing
SUSE Linux Enterprise High Performance Computing 15-SP2-ESPOS
SUSE Linux Enterprise High Performance Computing 15-SP2-LTSS
SUSE Linux Enterprise High Performance Computing 15-SP3
SUSE Linux Enterprise High Performance Computing 15-SP4
SUSE Linux Enterprise Micro 5.1
SUSE Linux Enterprise Micro 5.2
SUSE Linux Enterprise Module for Basesystem 15-SP3
SUSE Linux Enterprise Module for Basesystem 15-SP4
SUSE Linux Enterprise Module for Development Tools 15-SP3
SUSE Linux Enterprise Module for Development Tools 15-SP4
SUSE Linux Enterprise Module for Legacy Software 15-SP3
SUSE Linux Enterprise Server
SUSE Linux Enterprise Server 15-SP2-BCL
SUSE Linux Enterprise Server 15-SP2-LTSS
SUSE Linux Enterprise Server 15-SP3
SUSE Linux Enterprise Server 15-SP4
SUSE Linux Enterprise Server for SAP 15-SP2
SUSE Linux Enterprise Server for SAP Applications
SUSE Linux Enterprise Server for SAP Applications 15-SP3
SUSE Linux Enterprise Server for SAP Applications 15-SP4
SUSE Manager Proxy 4.1
SUSE Manager Proxy 4.2
SUSE Manager Retail Branch Server 4.1
SUSE Manager Server 4.1
SUSE Manager Server 4.2
openSUSE Leap 15.3
openSUSE Leap 15.4
______________________________________________________________________________
An update that fixes one vulnerability is now available.
Description:
This update for openldap2 fixes the following issues:
- CVE-2022-29155: Fixed SQL injection in back-sql (bsc#1199240).
Patch Instructions:
To install this SUSE Security Update use the SUSE recommended installation methods
like YaST online_update or "zypper patch".
Alternatively you can run the command listed for your product:
- openSUSE Leap 15.4:
zypper in -t patch openSUSE-SLE-15.4-2022-1670=1
- openSUSE Leap 15.3:
zypper in -t patch openSUSE-SLE-15.3-2022-1670=1
- SUSE Manager Server 4.1:
zypper in -t patch SUSE-SLE-Product-SUSE-Manager-Server-4.1-2022-1670=1
- SUSE Manager Retail Branch Server 4.1:
zypper in -t patch SUSE-SLE-Product-SUSE-Manager-Retail-Branch-Server-4.1-2022-1670=1
- SUSE Manager Proxy 4.1:
zypper in -t patch SUSE-SLE-Product-SUSE-Manager-Proxy-4.1-2022-1670=1
- SUSE Linux Enterprise Server for SAP 15-SP2:
zypper in -t patch SUSE-SLE-Product-SLES_SAP-15-SP2-2022-1670=1
- SUSE Linux Enterprise Server 15-SP2-LTSS:
zypper in -t patch SUSE-SLE-Product-SLES-15-SP2-LTSS-2022-1670=1
- SUSE Linux Enterprise Server 15-SP2-BCL:
zypper in -t patch SUSE-SLE-Product-SLES-15-SP2-BCL-2022-1670=1
- SUSE Linux Enterprise Module for Legacy Software 15-SP3:
zypper in -t patch SUSE-SLE-Module-Legacy-15-SP3-2022-1670=1
- SUSE Linux Enterprise Module for Development Tools 15-SP4:
zypper in -t patch SUSE-SLE-Module-Development-Tools-15-SP4-2022-1670=1
- SUSE Linux Enterprise Module for Development Tools 15-SP3:
zypper in -t patch SUSE-SLE-Module-Development-Tools-15-SP3-2022-1670=1
- SUSE Linux Enterprise Module for Basesystem 15-SP4:
zypper in -t patch SUSE-SLE-Module-Basesystem-15-SP4-2022-1670=1
- SUSE Linux Enterprise Module for Basesystem 15-SP3:
zypper in -t patch SUSE-SLE-Module-Basesystem-15-SP3-2022-1670=1
- SUSE Linux Enterprise Micro 5.2:
zypper in -t patch SUSE-SUSE-MicroOS-5.2-2022-1670=1
- SUSE Linux Enterprise Micro 5.1:
zypper in -t patch SUSE-SUSE-MicroOS-5.1-2022-1670=1
- SUSE Linux Enterprise High Performance Computing 15-SP2-LTSS:
zypper in -t patch SUSE-SLE-Product-HPC-15-SP2-LTSS-2022-1670=1
- SUSE Linux Enterprise High Performance Computing 15-SP2-ESPOS:
zypper in -t patch SUSE-SLE-Product-HPC-15-SP2-ESPOS-2022-1670=1
- SUSE Enterprise Storage 7:
zypper in -t patch SUSE-Storage-7-2022-1670=1
Package List:
- openSUSE Leap 15.4 (aarch64 ppc64le s390x x86_64):
libldap-2_4-2-2.4.46-150200.14.8.1
libldap-2_4-2-debuginfo-2.4.46-150200.14.8.1
openldap2-2.4.46-150200.14.8.1
openldap2-back-meta-2.4.46-150200.14.8.1
openldap2-back-meta-debuginfo-2.4.46-150200.14.8.1
openldap2-back-perl-2.4.46-150200.14.8.1
openldap2-back-perl-debuginfo-2.4.46-150200.14.8.1
openldap2-back-sock-2.4.46-150200.14.8.1
openldap2-back-sock-debuginfo-2.4.46-150200.14.8.1
openldap2-back-sql-2.4.46-150200.14.8.1
openldap2-back-sql-debuginfo-2.4.46-150200.14.8.1
openldap2-client-2.4.46-150200.14.8.1
openldap2-client-debuginfo-2.4.46-150200.14.8.1
openldap2-contrib-2.4.46-150200.14.8.1
openldap2-contrib-debuginfo-2.4.46-150200.14.8.1
openldap2-debuginfo-2.4.46-150200.14.8.1
openldap2-debugsource-2.4.46-150200.14.8.1
openldap2-devel-2.4.46-150200.14.8.1
openldap2-devel-static-2.4.46-150200.14.8.1
openldap2-ppolicy-check-password-1.2-150200.14.8.1
openldap2-ppolicy-check-password-debuginfo-1.2-150200.14.8.1
- openSUSE Leap 15.4 (x86_64):
libldap-2_4-2-32bit-2.4.46-150200.14.8.1
libldap-2_4-2-32bit-debuginfo-2.4.46-150200.14.8.1
openldap2-devel-32bit-2.4.46-150200.14.8.1
- openSUSE Leap 15.4 (noarch):
libldap-data-2.4.46-150200.14.8.1
openldap2-doc-2.4.46-150200.14.8.1
- openSUSE Leap 15.3 (aarch64 ppc64le s390x x86_64):
libldap-2_4-2-2.4.46-150200.14.8.1
libldap-2_4-2-debuginfo-2.4.46-150200.14.8.1
openldap2-2.4.46-150200.14.8.1
openldap2-back-meta-2.4.46-150200.14.8.1
openldap2-back-meta-debuginfo-2.4.46-150200.14.8.1
openldap2-back-perl-2.4.46-150200.14.8.1
openldap2-back-perl-debuginfo-2.4.46-150200.14.8.1
openldap2-back-sock-2.4.46-150200.14.8.1
openldap2-back-sock-debuginfo-2.4.46-150200.14.8.1
openldap2-back-sql-2.4.46-150200.14.8.1
openldap2-back-sql-debuginfo-2.4.46-150200.14.8.1
openldap2-client-2.4.46-150200.14.8.1
openldap2-client-debuginfo-2.4.46-150200.14.8.1
openldap2-contrib-2.4.46-150200.14.8.1
openldap2-contrib-debuginfo-2.4.46-150200.14.8.1
openldap2-debuginfo-2.4.46-150200.14.8.1
openldap2-debugsource-2.4.46-150200.14.8.1
openldap2-devel-2.4.46-150200.14.8.1
openldap2-devel-static-2.4.46-150200.14.8.1
openldap2-ppolicy-check-password-1.2-150200.14.8.1
openldap2-ppolicy-check-password-debuginfo-1.2-150200.14.8.1
- openSUSE Leap 15.3 (noarch):
libldap-data-2.4.46-150200.14.8.1
openldap2-doc-2.4.46-150200.14.8.1
- openSUSE Leap 15.3 (x86_64):
libldap-2_4-2-32bit-2.4.46-150200.14.8.1
libldap-2_4-2-32bit-debuginfo-2.4.46-150200.14.8.1
openldap2-devel-32bit-2.4.46-150200.14.8.1
- SUSE Manager Server 4.1 (ppc64le s390x x86_64):
libldap-2_4-2-2.4.46-150200.14.8.1
libldap-2_4-2-debuginfo-2.4.46-150200.14.8.1
openldap2-2.4.46-150200.14.8.1
openldap2-back-meta-2.4.46-150200.14.8.1
openldap2-back-meta-debuginfo-2.4.46-150200.14.8.1
openldap2-back-perl-2.4.46-150200.14.8.1
openldap2-back-perl-debuginfo-2.4.46-150200.14.8.1
openldap2-client-2.4.46-150200.14.8.1
openldap2-client-debuginfo-2.4.46-150200.14.8.1
openldap2-contrib-2.4.46-150200.14.8.1
openldap2-contrib-debuginfo-2.4.46-150200.14.8.1
openldap2-debuginfo-2.4.46-150200.14.8.1
openldap2-debugsource-2.4.46-150200.14.8.1
openldap2-devel-2.4.46-150200.14.8.1
openldap2-devel-static-2.4.46-150200.14.8.1
openldap2-ppolicy-check-password-1.2-150200.14.8.1
openldap2-ppolicy-check-password-debuginfo-1.2-150200.14.8.1
- SUSE Manager Server 4.1 (noarch):
libldap-data-2.4.46-150200.14.8.1
- SUSE Manager Server 4.1 (x86_64):
libldap-2_4-2-32bit-2.4.46-150200.14.8.1
libldap-2_4-2-32bit-debuginfo-2.4.46-150200.14.8.1
openldap2-devel-32bit-2.4.46-150200.14.8.1
- SUSE Manager Retail Branch Server 4.1 (x86_64):
libldap-2_4-2-2.4.46-150200.14.8.1
libldap-2_4-2-32bit-2.4.46-150200.14.8.1
libldap-2_4-2-32bit-debuginfo-2.4.46-150200.14.8.1
libldap-2_4-2-debuginfo-2.4.46-150200.14.8.1
openldap2-2.4.46-150200.14.8.1
openldap2-back-meta-2.4.46-150200.14.8.1
openldap2-back-meta-debuginfo-2.4.46-150200.14.8.1
openldap2-back-perl-2.4.46-150200.14.8.1
openldap2-back-perl-debuginfo-2.4.46-150200.14.8.1
openldap2-client-2.4.46-150200.14.8.1
openldap2-client-debuginfo-2.4.46-150200.14.8.1
openldap2-contrib-2.4.46-150200.14.8.1
openldap2-contrib-debuginfo-2.4.46-150200.14.8.1
openldap2-debuginfo-2.4.46-150200.14.8.1
openldap2-debugsource-2.4.46-150200.14.8.1
openldap2-devel-2.4.46-150200.14.8.1
openldap2-devel-32bit-2.4.46-150200.14.8.1
openldap2-devel-static-2.4.46-150200.14.8.1
openldap2-ppolicy-check-password-1.2-150200.14.8.1
openldap2-ppolicy-check-password-debuginfo-1.2-150200.14.8.1
- SUSE Manager Retail Branch Server 4.1 (noarch):
libldap-data-2.4.46-150200.14.8.1
- SUSE Manager Proxy 4.1 (noarch):
libldap-data-2.4.46-150200.14.8.1
- SUSE Manager Proxy 4.1 (x86_64):
libldap-2_4-2-2.4.46-150200.14.8.1
libldap-2_4-2-32bit-2.4.46-150200.14.8.1
libldap-2_4-2-32bit-debuginfo-2.4.46-150200.14.8.1
libldap-2_4-2-debuginfo-2.4.46-150200.14.8.1
openldap2-2.4.46-150200.14.8.1
openldap2-back-meta-2.4.46-150200.14.8.1
openldap2-back-meta-debuginfo-2.4.46-150200.14.8.1
openldap2-back-perl-2.4.46-150200.14.8.1
openldap2-back-perl-debuginfo-2.4.46-150200.14.8.1
openldap2-client-2.4.46-150200.14.8.1
openldap2-client-debuginfo-2.4.46-150200.14.8.1
openldap2-contrib-2.4.46-150200.14.8.1
openldap2-contrib-debuginfo-2.4.46-150200.14.8.1
openldap2-debuginfo-2.4.46-150200.14.8.1
openldap2-debugsource-2.4.46-150200.14.8.1
openldap2-devel-2.4.46-150200.14.8.1
openldap2-devel-32bit-2.4.46-150200.14.8.1
openldap2-devel-static-2.4.46-150200.14.8.1
openldap2-ppolicy-check-password-1.2-150200.14.8.1
openldap2-ppolicy-check-password-debuginfo-1.2-150200.14.8.1
- SUSE Linux Enterprise Server for SAP 15-SP2 (ppc64le x86_64):
libldap-2_4-2-2.4.46-150200.14.8.1
libldap-2_4-2-debuginfo-2.4.46-150200.14.8.1
openldap2-2.4.46-150200.14.8.1
openldap2-back-meta-2.4.46-150200.14.8.1
openldap2-back-meta-debuginfo-2.4.46-150200.14.8.1
openldap2-back-perl-2.4.46-150200.14.8.1
openldap2-back-perl-debuginfo-2.4.46-150200.14.8.1
openldap2-client-2.4.46-150200.14.8.1
openldap2-client-debuginfo-2.4.46-150200.14.8.1
openldap2-contrib-2.4.46-150200.14.8.1
openldap2-contrib-debuginfo-2.4.46-150200.14.8.1
openldap2-debuginfo-2.4.46-150200.14.8.1
openldap2-debugsource-2.4.46-150200.14.8.1
openldap2-devel-2.4.46-150200.14.8.1
openldap2-devel-static-2.4.46-150200.14.8.1
openldap2-ppolicy-check-password-1.2-150200.14.8.1
openldap2-ppolicy-check-password-debuginfo-1.2-150200.14.8.1
- SUSE Linux Enterprise Server for SAP 15-SP2 (noarch):
libldap-data-2.4.46-150200.14.8.1
- SUSE Linux Enterprise Server for SAP 15-SP2 (x86_64):
libldap-2_4-2-32bit-2.4.46-150200.14.8.1
libldap-2_4-2-32bit-debuginfo-2.4.46-150200.14.8.1
openldap2-devel-32bit-2.4.46-150200.14.8.1
- SUSE Linux Enterprise Server 15-SP2-LTSS (aarch64 ppc64le s390x x86_64):
libldap-2_4-2-2.4.46-150200.14.8.1
libldap-2_4-2-debuginfo-2.4.46-150200.14.8.1
openldap2-2.4.46-150200.14.8.1
openldap2-back-meta-2.4.46-150200.14.8.1
openldap2-back-meta-debuginfo-2.4.46-150200.14.8.1
openldap2-back-perl-2.4.46-150200.14.8.1
openldap2-back-perl-debuginfo-2.4.46-150200.14.8.1
openldap2-client-2.4.46-150200.14.8.1
openldap2-client-debuginfo-2.4.46-150200.14.8.1
openldap2-contrib-2.4.46-150200.14.8.1
openldap2-contrib-debuginfo-2.4.46-150200.14.8.1
openldap2-debuginfo-2.4.46-150200.14.8.1
openldap2-debugsource-2.4.46-150200.14.8.1
openldap2-devel-2.4.46-150200.14.8.1
openldap2-devel-static-2.4.46-150200.14.8.1
openldap2-ppolicy-check-password-1.2-150200.14.8.1
openldap2-ppolicy-check-password-debuginfo-1.2-150200.14.8.1
- SUSE Linux Enterprise Server 15-SP2-LTSS (noarch):
libldap-data-2.4.46-150200.14.8.1
- SUSE Linux Enterprise Server 15-SP2-LTSS (x86_64):
libldap-2_4-2-32bit-2.4.46-150200.14.8.1
libldap-2_4-2-32bit-debuginfo-2.4.46-150200.14.8.1
openldap2-devel-32bit-2.4.46-150200.14.8.1
- SUSE Linux Enterprise Server 15-SP2-BCL (noarch):
libldap-data-2.4.46-150200.14.8.1
- SUSE Linux Enterprise Server 15-SP2-BCL (x86_64):
libldap-2_4-2-2.4.46-150200.14.8.1
libldap-2_4-2-32bit-2.4.46-150200.14.8.1
libldap-2_4-2-32bit-debuginfo-2.4.46-150200.14.8.1
libldap-2_4-2-debuginfo-2.4.46-150200.14.8.1
openldap2-client-2.4.46-150200.14.8.1
openldap2-client-debuginfo-2.4.46-150200.14.8.1
openldap2-debugsource-2.4.46-150200.14.8.1
openldap2-devel-2.4.46-150200.14.8.1
openldap2-devel-32bit-2.4.46-150200.14.8.1
openldap2-devel-static-2.4.46-150200.14.8.1
- SUSE Linux Enterprise Module for Legacy Software 15-SP3 (aarch64 ppc64le s390x x86_64):
openldap2-2.4.46-150200.14.8.1
openldap2-back-meta-2.4.46-150200.14.8.1
openldap2-back-meta-debuginfo-2.4.46-150200.14.8.1
openldap2-back-perl-2.4.46-150200.14.8.1
openldap2-back-perl-debuginfo-2.4.46-150200.14.8.1
openldap2-contrib-2.4.46-150200.14.8.1
openldap2-contrib-debuginfo-2.4.46-150200.14.8.1
openldap2-debuginfo-2.4.46-150200.14.8.1
openldap2-debugsource-2.4.46-150200.14.8.1
openldap2-ppolicy-check-password-1.2-150200.14.8.1
openldap2-ppolicy-check-password-debuginfo-1.2-150200.14.8.1
- SUSE Linux Enterprise Module for Development Tools 15-SP4 (x86_64):
openldap2-debugsource-2.4.46-150200.14.8.1
openldap2-devel-32bit-2.4.46-150200.14.8.1
- SUSE Linux Enterprise Module for Development Tools 15-SP3 (x86_64):
openldap2-debugsource-2.4.46-150200.14.8.1
openldap2-devel-32bit-2.4.46-150200.14.8.1
- SUSE Linux Enterprise Module for Basesystem 15-SP4 (aarch64 ppc64le s390x x86_64):
libldap-2_4-2-2.4.46-150200.14.8.1
libldap-2_4-2-debuginfo-2.4.46-150200.14.8.1
openldap2-client-2.4.46-150200.14.8.1
openldap2-client-debuginfo-2.4.46-150200.14.8.1
openldap2-debuginfo-2.4.46-150200.14.8.1
openldap2-debugsource-2.4.46-150200.14.8.1
openldap2-devel-2.4.46-150200.14.8.1
openldap2-devel-static-2.4.46-150200.14.8.1
- SUSE Linux Enterprise Module for Basesystem 15-SP4 (noarch):
libldap-data-2.4.46-150200.14.8.1
- SUSE Linux Enterprise Module for Basesystem 15-SP4 (x86_64):
libldap-2_4-2-32bit-2.4.46-150200.14.8.1
libldap-2_4-2-32bit-debuginfo-2.4.46-150200.14.8.1
- SUSE Linux Enterprise Module for Basesystem 15-SP3 (aarch64 ppc64le s390x x86_64):
libldap-2_4-2-2.4.46-150200.14.8.1
libldap-2_4-2-debuginfo-2.4.46-150200.14.8.1
openldap2-client-2.4.46-150200.14.8.1
openldap2-client-debuginfo-2.4.46-150200.14.8.1
openldap2-debuginfo-2.4.46-150200.14.8.1
openldap2-debugsource-2.4.46-150200.14.8.1
openldap2-devel-2.4.46-150200.14.8.1
openldap2-devel-static-2.4.46-150200.14.8.1
- SUSE Linux Enterprise Module for Basesystem 15-SP3 (noarch):
libldap-data-2.4.46-150200.14.8.1
- SUSE Linux Enterprise Module for Basesystem 15-SP3 (x86_64):
libldap-2_4-2-32bit-2.4.46-150200.14.8.1
libldap-2_4-2-32bit-debuginfo-2.4.46-150200.14.8.1
- SUSE Linux Enterprise Micro 5.2 (aarch64 s390x x86_64):
libldap-2_4-2-2.4.46-150200.14.8.1
libldap-2_4-2-debuginfo-2.4.46-150200.14.8.1
openldap2-debuginfo-2.4.46-150200.14.8.1
openldap2-debugsource-2.4.46-150200.14.8.1
- SUSE Linux Enterprise Micro 5.2 (noarch):
libldap-data-2.4.46-150200.14.8.1
- SUSE Linux Enterprise Micro 5.1 (aarch64 s390x x86_64):
libldap-2_4-2-2.4.46-150200.14.8.1
libldap-2_4-2-debuginfo-2.4.46-150200.14.8.1
openldap2-debuginfo-2.4.46-150200.14.8.1
openldap2-debugsource-2.4.46-150200.14.8.1
- SUSE Linux Enterprise Micro 5.1 (noarch):
libldap-data-2.4.46-150200.14.8.1
- SUSE Linux Enterprise High Performance Computing 15-SP2-LTSS (aarch64 x86_64):
libldap-2_4-2-2.4.46-150200.14.8.1
libldap-2_4-2-debuginfo-2.4.46-150200.14.8.1
openldap2-client-2.4.46-150200.14.8.1
openldap2-client-debuginfo-2.4.46-150200.14.8.1
openldap2-debugsource-2.4.46-150200.14.8.1
openldap2-devel-2.4.46-150200.14.8.1
openldap2-devel-static-2.4.46-150200.14.8.1
- SUSE Linux Enterprise High Performance Computing 15-SP2-LTSS (noarch):
libldap-data-2.4.46-150200.14.8.1
- SUSE Linux Enterprise High Performance Computing 15-SP2-LTSS (x86_64):
libldap-2_4-2-32bit-2.4.46-150200.14.8.1
libldap-2_4-2-32bit-debuginfo-2.4.46-150200.14.8.1
openldap2-devel-32bit-2.4.46-150200.14.8.1
- SUSE Linux Enterprise High Performance Computing 15-SP2-ESPOS (aarch64 x86_64):
libldap-2_4-2-2.4.46-150200.14.8.1
libldap-2_4-2-debuginfo-2.4.46-150200.14.8.1
openldap2-client-2.4.46-150200.14.8.1
openldap2-client-debuginfo-2.4.46-150200.14.8.1
openldap2-debugsource-2.4.46-150200.14.8.1
openldap2-devel-2.4.46-150200.14.8.1
openldap2-devel-static-2.4.46-150200.14.8.1
- SUSE Linux Enterprise High Performance Computing 15-SP2-ESPOS (x86_64):
libldap-2_4-2-32bit-2.4.46-150200.14.8.1
libldap-2_4-2-32bit-debuginfo-2.4.46-150200.14.8.1
openldap2-devel-32bit-2.4.46-150200.14.8.1
- SUSE Linux Enterprise High Performance Computing 15-SP2-ESPOS (noarch):
libldap-data-2.4.46-150200.14.8.1
- SUSE Enterprise Storage 7 (aarch64 x86_64):
libldap-2_4-2-2.4.46-150200.14.8.1
libldap-2_4-2-debuginfo-2.4.46-150200.14.8.1
openldap2-2.4.46-150200.14.8.1
openldap2-back-meta-2.4.46-150200.14.8.1
openldap2-back-meta-debuginfo-2.4.46-150200.14.8.1
openldap2-back-perl-2.4.46-150200.14.8.1
openldap2-back-perl-debuginfo-2.4.46-150200.14.8.1
openldap2-client-2.4.46-150200.14.8.1
openldap2-client-debuginfo-2.4.46-150200.14.8.1
openldap2-contrib-2.4.46-150200.14.8.1
openldap2-contrib-debuginfo-2.4.46-150200.14.8.1
openldap2-debuginfo-2.4.46-150200.14.8.1
openldap2-debugsource-2.4.46-150200.14.8.1
openldap2-devel-2.4.46-150200.14.8.1
openldap2-devel-static-2.4.46-150200.14.8.1
openldap2-ppolicy-check-password-1.2-150200.14.8.1
openldap2-ppolicy-check-password-debuginfo-1.2-150200.14.8.1
- SUSE Enterprise Storage 7 (x86_64):
libldap-2_4-2-32bit-2.4.46-150200.14.8.1
libldap-2_4-2-32bit-debuginfo-2.4.46-150200.14.8.1
openldap2-devel-32bit-2.4.46-150200.14.8.1
- SUSE Enterprise Storage 7 (noarch):
libldap-data-2.4.46-150200.14.8.1
References:
https://www.suse.com/security/cve/CVE-2022-29155.html
https://bugzilla.suse.com/1199240
1
0