June 2022 - openSUSE Security Announce

SUSE-SU-2022:2035-1: important: Security update for grub2
by opensuse-security＠opensuse.org 10 Jun '22

10 Jun '22

SUSE Security Update: Security update for grub2 ______________________________________________________________________________ Announcement ID: SUSE-SU-2022:2035-1 Rating: important References: #1191184 #1191185 #1191186 #1193282 #1197948 #1198460 #1198493 #1198495 #1198496 #1198581 Cross-References: CVE-2021-3695 CVE-2021-3696 CVE-2021-3697 CVE-2022-28733 CVE-2022-28734 CVE-2022-28735 CVE-2022-28736 CVSS scores: CVE-2021-3695 (SUSE): 7.5 CVSS:3.1/AV:L/AC:H/PR:H/UI:N/S:C/C:H/I:H/A:H CVE-2021-3696 (SUSE): 5 CVSS:3.1/AV:L/AC:H/PR:H/UI:N/S:C/C:L/I:L/A:L CVE-2021-3697 (SUSE): 7.5 CVSS:3.1/AV:L/AC:H/PR:H/UI:N/S:C/C:H/I:H/A:H CVE-2022-28733 (SUSE): 8.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H CVE-2022-28735 (SUSE): 8.4 CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H CVE-2022-28736 (SUSE): 8.4 CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H Affected Products: SUSE Linux Enterprise Desktop 15-SP4 SUSE Linux Enterprise High Performance Computing 15-SP4 SUSE Linux Enterprise Module for Basesystem 15-SP4 SUSE Linux Enterprise Module for SUSE Manager Proxy 4.3 SUSE Linux Enterprise Module for Server Applications 15-SP4 SUSE Linux Enterprise Server 15-SP4 SUSE Linux Enterprise Server for SAP Applications 15-SP4 SUSE Manager Proxy 4.3 openSUSE Leap 15.4 ______________________________________________________________________________ An update that solves 7 vulnerabilities and has three fixes is now available. Description: This update for grub2 fixes the following issues: This update provides security fixes and hardenings for Boothole 3 / Boothole 2022 (bsc#1198581) - CVE-2021-3695: Fixed that a crafted PNG grayscale image could lead to out-of-bounds write in heap (bsc#1191184) - CVE-2021-3696: Fixed that a crafted PNG image could lead to out-of-bound write during huffman table handling (bsc#1191185) - CVE-2021-3697: Fixed that a crafted JPEG image could lead to buffer underflow write in the heap (bsc#1191186) - CVE-2022-28733: Fixed fragmentation math in net/ip (bsc#1198460) - CVE-2022-28734: Fixed an out-of-bound write for split http headers (bsc#1198493) - CVE-2022-28735: Fixed some verifier framework changes (bsc#1198495) - CVE-2022-28736: Fixed a use-after-free in chainloader command (bsc#1198496) - Update SBAT security contact (bsc#1193282) - Bump grub's SBAT generation to 2 - Use boot disks in OpenFirmware, fixing regression caused when the root LV is completely in the boot LUN (bsc#1197948) Patch Instructions: To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 15.4: zypper in -t patch openSUSE-SLE-15.4-2022-2035=1 - SUSE Linux Enterprise Module for Server Applications 15-SP4: zypper in -t patch SUSE-SLE-Module-Server-Applications-15-SP4-2022-2035=1 - SUSE Linux Enterprise Module for SUSE Manager Proxy 4.3: zypper in -t patch SUSE-SLE-Module-SUSE-Manager-Proxy-4.3-2022-2035=1 - SUSE Linux Enterprise Module for Basesystem 15-SP4: zypper in -t patch SUSE-SLE-Module-Basesystem-15-SP4-2022-2035=1 Package List: - openSUSE Leap 15.4 (aarch64 ppc64le s390x x86_64): grub2-2.06-150400.11.5.2 grub2-branding-upstream-2.06-150400.11.5.2 grub2-debuginfo-2.06-150400.11.5.2 - openSUSE Leap 15.4 (aarch64 s390x x86_64): grub2-debugsource-2.06-150400.11.5.2 - openSUSE Leap 15.4 (noarch): grub2-arm64-efi-2.06-150400.11.5.2 grub2-arm64-efi-debug-2.06-150400.11.5.2 grub2-i386-pc-2.06-150400.11.5.2 grub2-i386-pc-debug-2.06-150400.11.5.2 grub2-powerpc-ieee1275-2.06-150400.11.5.2 grub2-powerpc-ieee1275-debug-2.06-150400.11.5.2 grub2-snapper-plugin-2.06-150400.11.5.2 grub2-systemd-sleep-plugin-2.06-150400.11.5.2 grub2-x86_64-efi-2.06-150400.11.5.2 grub2-x86_64-efi-debug-2.06-150400.11.5.2 grub2-x86_64-xen-2.06-150400.11.5.2 - openSUSE Leap 15.4 (s390x): grub2-s390x-emu-2.06-150400.11.5.2 grub2-s390x-emu-debug-2.06-150400.11.5.2 - SUSE Linux Enterprise Module for Server Applications 15-SP4 (noarch): grub2-x86_64-xen-2.06-150400.11.5.2 - SUSE Linux Enterprise Module for SUSE Manager Proxy 4.3 (noarch): grub2-arm64-efi-2.06-150400.11.5.2 - SUSE Linux Enterprise Module for Basesystem 15-SP4 (aarch64 ppc64le s390x x86_64): grub2-2.06-150400.11.5.2 grub2-debuginfo-2.06-150400.11.5.2 - SUSE Linux Enterprise Module for Basesystem 15-SP4 (aarch64 s390x x86_64): grub2-debugsource-2.06-150400.11.5.2 - SUSE Linux Enterprise Module for Basesystem 15-SP4 (noarch): grub2-arm64-efi-2.06-150400.11.5.2 grub2-i386-pc-2.06-150400.11.5.2 grub2-powerpc-ieee1275-2.06-150400.11.5.2 grub2-snapper-plugin-2.06-150400.11.5.2 grub2-systemd-sleep-plugin-2.06-150400.11.5.2 grub2-x86_64-efi-2.06-150400.11.5.2 - SUSE Linux Enterprise Module for Basesystem 15-SP4 (s390x): grub2-s390x-emu-2.06-150400.11.5.2 References: https://www.suse.com/security/cve/CVE-2021-3695.html https://www.suse.com/security/cve/CVE-2021-3696.html https://www.suse.com/security/cve/CVE-2021-3697.html https://www.suse.com/security/cve/CVE-2022-28733.html https://www.suse.com/security/cve/CVE-2022-28734.html https://www.suse.com/security/cve/CVE-2022-28735.html https://www.suse.com/security/cve/CVE-2022-28736.html https://bugzilla.suse.com/1191184 https://bugzilla.suse.com/1191185 https://bugzilla.suse.com/1191186 https://bugzilla.suse.com/1193282 https://bugzilla.suse.com/1197948 https://bugzilla.suse.com/1198460 https://bugzilla.suse.com/1198493 https://bugzilla.suse.com/1198495 https://bugzilla.suse.com/1198496 https://bugzilla.suse.com/1198581

1 0

SUSE-SU-2022:2004-1: important: Security update for go1.17
by opensuse-security＠opensuse.org 07 Jun '22

07 Jun '22

SUSE Security Update: Security update for go1.17 ______________________________________________________________________________ Announcement ID: SUSE-SU-2022:2004-1 Rating: important References: #1190649 #1200134 #1200135 #1200136 #1200137 Cross-References: CVE-2022-29804 CVE-2022-30580 CVE-2022-30629 CVE-2022-30634 Affected Products: SUSE Linux Enterprise Desktop 15-SP3 SUSE Linux Enterprise Desktop 15-SP4 SUSE Linux Enterprise High Performance Computing 15-SP3 SUSE Linux Enterprise High Performance Computing 15-SP4 SUSE Linux Enterprise Module for Development Tools 15-SP3 SUSE Linux Enterprise Module for Development Tools 15-SP4 SUSE Linux Enterprise Server 15-SP3 SUSE Linux Enterprise Server 15-SP4 SUSE Linux Enterprise Server for SAP Applications 15-SP3 SUSE Linux Enterprise Server for SAP Applications 15-SP4 SUSE Manager Proxy 4.2 SUSE Manager Server 4.2 openSUSE Leap 15.3 openSUSE Leap 15.4 ______________________________________________________________________________ An update that solves four vulnerabilities and has one errata is now available. Description: This update for go1.17 fixes the following issues: Update to go1.17.11 (released 2022-06-01) (bsc#1190649): - CVE-2022-30634: Fixed crypto/rand rand.Read hangs with extremely large buffers (bsc#1200134). - CVE-2022-30629: Fixed crypto/tls session tickets lack random ticket_age_add (bsc#1200135). - CVE-2022-29804: Fixed path/filepath Clean(`.\c:`) returns `c:` on Windows (bsc#1200137). - CVE-2022-30580: Fixed os/exec empty Cmd.Path can result in running unintended binary on Windows (bsc#1200136). Patch Instructions: To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 15.4: zypper in -t patch openSUSE-SLE-15.4-2022-2004=1 - openSUSE Leap 15.3: zypper in -t patch openSUSE-SLE-15.3-2022-2004=1 - SUSE Linux Enterprise Module for Development Tools 15-SP4: zypper in -t patch SUSE-SLE-Module-Development-Tools-15-SP4-2022-2004=1 - SUSE Linux Enterprise Module for Development Tools 15-SP3: zypper in -t patch SUSE-SLE-Module-Development-Tools-15-SP3-2022-2004=1 Package List: - openSUSE Leap 15.4 (aarch64 ppc64le s390x x86_64): go1.17-1.17.11-150000.1.37.1 go1.17-doc-1.17.11-150000.1.37.1 - openSUSE Leap 15.4 (aarch64 x86_64): go1.17-race-1.17.11-150000.1.37.1 - openSUSE Leap 15.3 (aarch64 i586 ppc64le s390x x86_64): go1.17-1.17.11-150000.1.37.1 go1.17-doc-1.17.11-150000.1.37.1 - openSUSE Leap 15.3 (aarch64 x86_64): go1.17-race-1.17.11-150000.1.37.1 - SUSE Linux Enterprise Module for Development Tools 15-SP4 (aarch64 ppc64le s390x x86_64): go1.17-1.17.11-150000.1.37.1 go1.17-doc-1.17.11-150000.1.37.1 - SUSE Linux Enterprise Module for Development Tools 15-SP4 (aarch64 x86_64): go1.17-race-1.17.11-150000.1.37.1 - SUSE Linux Enterprise Module for Development Tools 15-SP3 (aarch64 ppc64le s390x x86_64): go1.17-1.17.11-150000.1.37.1 go1.17-doc-1.17.11-150000.1.37.1 - SUSE Linux Enterprise Module for Development Tools 15-SP3 (aarch64 x86_64): go1.17-race-1.17.11-150000.1.37.1 References: https://www.suse.com/security/cve/CVE-2022-29804.html https://www.suse.com/security/cve/CVE-2022-30580.html https://www.suse.com/security/cve/CVE-2022-30629.html https://www.suse.com/security/cve/CVE-2022-30634.html https://bugzilla.suse.com/1190649 https://bugzilla.suse.com/1200134 https://bugzilla.suse.com/1200135 https://bugzilla.suse.com/1200136 https://bugzilla.suse.com/1200137

1 0

SUSE-SU-2022:2005-1: important: Security update for go1.18
by opensuse-security＠opensuse.org 07 Jun '22

07 Jun '22

SUSE Security Update: Security update for go1.18 ______________________________________________________________________________ Announcement ID: SUSE-SU-2022:2005-1 Rating: important References: #1193742 #1200134 #1200135 #1200136 #1200137 Cross-References: CVE-2022-29804 CVE-2022-30580 CVE-2022-30629 CVE-2022-30634 Affected Products: SUSE Linux Enterprise Desktop 15-SP3 SUSE Linux Enterprise Desktop 15-SP4 SUSE Linux Enterprise High Performance Computing 15-SP3 SUSE Linux Enterprise High Performance Computing 15-SP4 SUSE Linux Enterprise Module for Development Tools 15-SP3 SUSE Linux Enterprise Module for Development Tools 15-SP4 SUSE Linux Enterprise Server 15-SP3 SUSE Linux Enterprise Server 15-SP4 SUSE Linux Enterprise Server for SAP Applications 15-SP3 SUSE Linux Enterprise Server for SAP Applications 15-SP4 SUSE Manager Proxy 4.2 SUSE Manager Server 4.2 openSUSE Leap 15.3 openSUSE Leap 15.4 ______________________________________________________________________________ An update that solves four vulnerabilities and has one errata is now available. Description: This update for go1.18 fixes the following issues: Update to go1.18.3 (released 2022-06-01) (bsc#1193742): - CVE-2022-30634: Fixed crypto/rand rand.Read hangs with extremely large buffers (bsc#1200134). - CVE-2022-30629: Fixed crypto/tls session tickets lack random ticket_age_add (bsc#1200135). - CVE-2022-29804: Fixed path/filepath Clean(`.\c:`) returns `c:` on Windows (bsc#1200137). - CVE-2022-30580: Fixed os/exec empty Cmd.Path can result in running unintended binary on Windows (bsc#1200136). Patch Instructions: To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 15.4: zypper in -t patch openSUSE-SLE-15.4-2022-2005=1 - openSUSE Leap 15.3: zypper in -t patch openSUSE-SLE-15.3-2022-2005=1 - SUSE Linux Enterprise Module for Development Tools 15-SP4: zypper in -t patch SUSE-SLE-Module-Development-Tools-15-SP4-2022-2005=1 - SUSE Linux Enterprise Module for Development Tools 15-SP3: zypper in -t patch SUSE-SLE-Module-Development-Tools-15-SP3-2022-2005=1 Package List: - openSUSE Leap 15.4 (aarch64 ppc64le s390x x86_64): go1.18-1.18.3-150000.1.20.1 go1.18-doc-1.18.3-150000.1.20.1 - openSUSE Leap 15.4 (aarch64 x86_64): go1.18-race-1.18.3-150000.1.20.1 - openSUSE Leap 15.3 (aarch64 ppc64le s390x x86_64): go1.18-1.18.3-150000.1.20.1 go1.18-doc-1.18.3-150000.1.20.1 - openSUSE Leap 15.3 (aarch64 x86_64): go1.18-race-1.18.3-150000.1.20.1 - SUSE Linux Enterprise Module for Development Tools 15-SP4 (aarch64 ppc64le s390x x86_64): go1.18-1.18.3-150000.1.20.1 go1.18-doc-1.18.3-150000.1.20.1 - SUSE Linux Enterprise Module for Development Tools 15-SP4 (aarch64 x86_64): go1.18-race-1.18.3-150000.1.20.1 - SUSE Linux Enterprise Module for Development Tools 15-SP3 (aarch64 ppc64le s390x x86_64): go1.18-1.18.3-150000.1.20.1 go1.18-doc-1.18.3-150000.1.20.1 - SUSE Linux Enterprise Module for Development Tools 15-SP3 (aarch64 x86_64): go1.18-race-1.18.3-150000.1.20.1 References: https://www.suse.com/security/cve/CVE-2022-29804.html https://www.suse.com/security/cve/CVE-2022-30580.html https://www.suse.com/security/cve/CVE-2022-30629.html https://www.suse.com/security/cve/CVE-2022-30634.html https://bugzilla.suse.com/1193742 https://bugzilla.suse.com/1200134 https://bugzilla.suse.com/1200135 https://bugzilla.suse.com/1200136 https://bugzilla.suse.com/1200137

1 0

SUSE-SU-2022:2003-1: important: Security update for mariadb
by opensuse-security＠opensuse.org 07 Jun '22

07 Jun '22

SUSE Security Update: Security update for mariadb ______________________________________________________________________________ Announcement ID: SUSE-SU-2022:2003-1 Rating: important References: #1198603 #1198604 #1198605 #1198606 #1198607 #1198609 #1198610 #1198611 #1198612 #1198613 #1198628 #1198629 #1198630 #1198631 #1198632 #1198633 #1198634 #1198635 #1198636 #1198637 #1198638 #1198639 #1198640 #1199928 Cross-References: CVE-2021-46669 CVE-2022-21427 CVE-2022-27376 CVE-2022-27377 CVE-2022-27378 CVE-2022-27379 CVE-2022-27380 CVE-2022-27381 CVE-2022-27382 CVE-2022-27383 CVE-2022-27384 CVE-2022-27386 CVE-2022-27387 CVE-2022-27444 CVE-2022-27445 CVE-2022-27446 CVE-2022-27447 CVE-2022-27448 CVE-2022-27449 CVE-2022-27451 CVE-2022-27452 CVE-2022-27455 CVE-2022-27456 CVE-2022-27457 CVE-2022-27458 CVSS scores: CVE-2021-46669 (NVD) : 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H CVE-2022-21427 (NVD) : 4.9 CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H CVE-2022-27376 (NVD) : 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H CVE-2022-27376 (SUSE): 7.1 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:H CVE-2022-27377 (NVD) : 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H CVE-2022-27377 (SUSE): 7.1 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:H CVE-2022-27378 (NVD) : 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H CVE-2022-27378 (SUSE): 7.1 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:H CVE-2022-27379 (NVD) : 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H CVE-2022-27379 (SUSE): 7.1 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:H CVE-2022-27380 (NVD) : 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H CVE-2022-27380 (SUSE): 7.1 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:H CVE-2022-27381 (NVD) : 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H CVE-2022-27381 (SUSE): 7.1 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:H CVE-2022-27382 (NVD) : 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H CVE-2022-27382 (SUSE): 7.1 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:H CVE-2022-27383 (NVD) : 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H CVE-2022-27383 (SUSE): 7.1 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:H CVE-2022-27384 (NVD) : 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H CVE-2022-27384 (SUSE): 7.1 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:H CVE-2022-27386 (NVD) : 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H CVE-2022-27386 (SUSE): 7.1 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:H CVE-2022-27387 (NVD) : 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H CVE-2022-27387 (SUSE): 7 CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H CVE-2022-27444 (NVD) : 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H CVE-2022-27444 (SUSE): 7.1 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:H CVE-2022-27445 (NVD) : 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H CVE-2022-27445 (SUSE): 7.1 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:H CVE-2022-27446 (NVD) : 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H CVE-2022-27446 (SUSE): 7.1 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:H CVE-2022-27447 (NVD) : 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H CVE-2022-27447 (SUSE): 7.1 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:H CVE-2022-27448 (NVD) : 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H CVE-2022-27448 (SUSE): 7.1 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:H CVE-2022-27449 (NVD) : 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H CVE-2022-27449 (SUSE): 7.1 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:H CVE-2022-27451 (NVD) : 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H CVE-2022-27451 (SUSE): 7.1 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:H CVE-2022-27452 (NVD) : 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H CVE-2022-27452 (SUSE): 7.1 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:H CVE-2022-27455 (NVD) : 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H CVE-2022-27455 (SUSE): 7.1 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:H CVE-2022-27456 (NVD) : 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H CVE-2022-27456 (SUSE): 7.1 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:H CVE-2022-27457 (NVD) : 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H CVE-2022-27457 (SUSE): 7.1 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:H CVE-2022-27458 (NVD) : 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H CVE-2022-27458 (SUSE): 7.1 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:H Affected Products: SUSE Linux Enterprise High Performance Computing 15-SP3 SUSE Linux Enterprise Module for Packagehub Subpackages 15-SP3 SUSE Linux Enterprise Module for Server Applications 15-SP3 SUSE Linux Enterprise Server 15-SP3 SUSE Linux Enterprise Server for SAP Applications 15-SP3 SUSE Manager Proxy 4.2 SUSE Manager Server 4.2 openSUSE Leap 15.3 ______________________________________________________________________________ An update that fixes 25 vulnerabilities is now available. Description: This update for mariadb fixes the following issues: Update to 10.5.16 (bsc#1199928): - CVE-2021-46669 (bsc#1199928) - CVE-2022-27376 (bsc#1198628) - CVE-2022-27377 (bsc#1198603) - CVE-2022-27378 (bsc#1198604) - CVE-2022-27379 (bsc#1198605) - CVE-2022-27380 (bsc#1198606) - CVE-2022-27381 (bsc#1198607) - CVE-2022-27382 (bsc#1198609) - CVE-2022-27383 (bsc#1198610) - CVE-2022-27384 (bsc#1198611) - CVE-2022-27386 (bsc#1198612) - CVE-2022-27387 (bsc#1198613) - CVE-2022-27444 (bsc#1198634) - CVE-2022-27445 (bsc#1198629) - CVE-2022-27446 (bsc#1198630) - CVE-2022-27447 (bsc#1198631) - CVE-2022-27448 (bsc#1198632) - CVE-2022-27449 (bsc#1198633) - CVE-2022-27451 (bsc#1198639) - CVE-2022-27452 (bsc#1198640) - CVE-2022-27455 (bsc#1198638) - CVE-2022-27456 (bsc#1198635) - CVE-2022-27457 (bsc#1198636) - CVE-2022-27458 (bsc#1198637) - The following issue is not affecting this package: CVE-2022-21427 External refernences: - https://mariadb.com/kb/en/library/mariadb-10516-release-notes - https://mariadb.com/kb/en/library/mariadb-10516-changelog Patch Instructions: To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 15.3: zypper in -t patch openSUSE-SLE-15.3-2022-2003=1 - SUSE Linux Enterprise Module for Server Applications 15-SP3: zypper in -t patch SUSE-SLE-Module-Server-Applications-15-SP3-2022-2003=1 - SUSE Linux Enterprise Module for Packagehub Subpackages 15-SP3: zypper in -t patch SUSE-SLE-Module-Packagehub-Subpackages-15-SP3-2022-2003=1 Package List: - openSUSE Leap 15.3 (aarch64 ppc64le s390x x86_64): libmariadbd-devel-10.5.16-150300.3.18.1 libmariadbd19-10.5.16-150300.3.18.1 libmariadbd19-debuginfo-10.5.16-150300.3.18.1 mariadb-10.5.16-150300.3.18.1 mariadb-bench-10.5.16-150300.3.18.1 mariadb-bench-debuginfo-10.5.16-150300.3.18.1 mariadb-client-10.5.16-150300.3.18.1 mariadb-client-debuginfo-10.5.16-150300.3.18.1 mariadb-debuginfo-10.5.16-150300.3.18.1 mariadb-debugsource-10.5.16-150300.3.18.1 mariadb-rpm-macros-10.5.16-150300.3.18.1 mariadb-test-10.5.16-150300.3.18.1 mariadb-test-debuginfo-10.5.16-150300.3.18.1 mariadb-tools-10.5.16-150300.3.18.1 mariadb-tools-debuginfo-10.5.16-150300.3.18.1 - openSUSE Leap 15.3 (noarch): mariadb-errormessages-10.5.16-150300.3.18.1 - SUSE Linux Enterprise Module for Server Applications 15-SP3 (aarch64 ppc64le s390x x86_64): libmariadbd-devel-10.5.16-150300.3.18.1 libmariadbd19-10.5.16-150300.3.18.1 libmariadbd19-debuginfo-10.5.16-150300.3.18.1 mariadb-10.5.16-150300.3.18.1 mariadb-client-10.5.16-150300.3.18.1 mariadb-client-debuginfo-10.5.16-150300.3.18.1 mariadb-debuginfo-10.5.16-150300.3.18.1 mariadb-debugsource-10.5.16-150300.3.18.1 mariadb-tools-10.5.16-150300.3.18.1 mariadb-tools-debuginfo-10.5.16-150300.3.18.1 - SUSE Linux Enterprise Module for Server Applications 15-SP3 (noarch): mariadb-errormessages-10.5.16-150300.3.18.1 - SUSE Linux Enterprise Module for Packagehub Subpackages 15-SP3 (aarch64 ppc64le s390x x86_64): mariadb-galera-10.5.16-150300.3.18.1 References: https://www.suse.com/security/cve/CVE-2021-46669.html https://www.suse.com/security/cve/CVE-2022-21427.html https://www.suse.com/security/cve/CVE-2022-27376.html https://www.suse.com/security/cve/CVE-2022-27377.html https://www.suse.com/security/cve/CVE-2022-27378.html https://www.suse.com/security/cve/CVE-2022-27379.html https://www.suse.com/security/cve/CVE-2022-27380.html https://www.suse.com/security/cve/CVE-2022-27381.html https://www.suse.com/security/cve/CVE-2022-27382.html https://www.suse.com/security/cve/CVE-2022-27383.html https://www.suse.com/security/cve/CVE-2022-27384.html https://www.suse.com/security/cve/CVE-2022-27386.html https://www.suse.com/security/cve/CVE-2022-27387.html https://www.suse.com/security/cve/CVE-2022-27444.html https://www.suse.com/security/cve/CVE-2022-27445.html https://www.suse.com/security/cve/CVE-2022-27446.html https://www.suse.com/security/cve/CVE-2022-27447.html https://www.suse.com/security/cve/CVE-2022-27448.html https://www.suse.com/security/cve/CVE-2022-27449.html https://www.suse.com/security/cve/CVE-2022-27451.html https://www.suse.com/security/cve/CVE-2022-27452.html https://www.suse.com/security/cve/CVE-2022-27455.html https://www.suse.com/security/cve/CVE-2022-27456.html https://www.suse.com/security/cve/CVE-2022-27457.html https://www.suse.com/security/cve/CVE-2022-27458.html https://bugzilla.suse.com/1198603 https://bugzilla.suse.com/1198604 https://bugzilla.suse.com/1198605 https://bugzilla.suse.com/1198606 https://bugzilla.suse.com/1198607 https://bugzilla.suse.com/1198609 https://bugzilla.suse.com/1198610 https://bugzilla.suse.com/1198611 https://bugzilla.suse.com/1198612 https://bugzilla.suse.com/1198613 https://bugzilla.suse.com/1198628 https://bugzilla.suse.com/1198629 https://bugzilla.suse.com/1198630 https://bugzilla.suse.com/1198631 https://bugzilla.suse.com/1198632 https://bugzilla.suse.com/1198633 https://bugzilla.suse.com/1198634 https://bugzilla.suse.com/1198635 https://bugzilla.suse.com/1198636 https://bugzilla.suse.com/1198637 https://bugzilla.suse.com/1198638 https://bugzilla.suse.com/1198639 https://bugzilla.suse.com/1198640 https://bugzilla.suse.com/1199928

1 0

SUSE-SU-2022:1934-1: moderate: Security update for openvpn
by opensuse-security＠opensuse.org 03 Jun '22

03 Jun '22

SUSE Security Update: Security update for openvpn ______________________________________________________________________________ Announcement ID: SUSE-SU-2022:1934-1 Rating: moderate References: #1123557 #1197341 Cross-References: CVE-2022-0547 CVSS scores: CVE-2022-0547 (NVD) : 9.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H CVE-2022-0547 (SUSE): 7.4 CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N Affected Products: SUSE Linux Enterprise Desktop 15-SP4 SUSE Linux Enterprise High Performance Computing 15-SP4 SUSE Linux Enterprise Module for Basesystem 15-SP4 SUSE Linux Enterprise Server 15-SP4 SUSE Linux Enterprise Server for SAP Applications 15-SP4 openSUSE Leap 15.4 ______________________________________________________________________________ An update that solves one vulnerability and has one errata is now available. Description: This update for openvpn fixes the following issues: - CVE-2022-0547: Fixed possible authentication bypass in external authentication plug-in (bsc#1197341). - By default the --suppress-timestamps flag is not needed (bsc#1123557). Patch Instructions: To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 15.4: zypper in -t patch openSUSE-SLE-15.4-2022-1934=1 - SUSE Linux Enterprise Module for Basesystem 15-SP4: zypper in -t patch SUSE-SLE-Module-Basesystem-15-SP4-2022-1934=1 Package List: - openSUSE Leap 15.4 (aarch64 ppc64le s390x x86_64): openvpn-2.5.6-150400.3.3.1 openvpn-auth-pam-plugin-2.5.6-150400.3.3.1 openvpn-auth-pam-plugin-debuginfo-2.5.6-150400.3.3.1 openvpn-debuginfo-2.5.6-150400.3.3.1 openvpn-debugsource-2.5.6-150400.3.3.1 openvpn-devel-2.5.6-150400.3.3.1 openvpn-down-root-plugin-2.5.6-150400.3.3.1 openvpn-down-root-plugin-debuginfo-2.5.6-150400.3.3.1 - SUSE Linux Enterprise Module for Basesystem 15-SP4 (aarch64 ppc64le s390x x86_64): openvpn-2.5.6-150400.3.3.1 openvpn-auth-pam-plugin-2.5.6-150400.3.3.1 openvpn-auth-pam-plugin-debuginfo-2.5.6-150400.3.3.1 openvpn-debuginfo-2.5.6-150400.3.3.1 openvpn-debugsource-2.5.6-150400.3.3.1 openvpn-devel-2.5.6-150400.3.3.1 References: https://www.suse.com/security/cve/CVE-2022-0547.html https://bugzilla.suse.com/1123557 https://bugzilla.suse.com/1197341

1 0

SUSE-SU-2022:1929-1: moderate: Security update for redis
by opensuse-security＠opensuse.org 02 Jun '22

02 Jun '22

SUSE Security Update: Security update for redis ______________________________________________________________________________ Announcement ID: SUSE-SU-2022:1929-1 Rating: moderate References: #1198952 #1198953 Cross-References: CVE-2022-24735 CVE-2022-24736 CVSS scores: CVE-2022-24735 (NVD) : 7.8 CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H CVE-2022-24735 (SUSE): 3.9 CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:L/I:L/A:N CVE-2022-24736 (NVD) : 5.5 CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H CVE-2022-24736 (SUSE): 3.3 CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L Affected Products: SUSE Linux Enterprise High Performance Computing 15-SP4 SUSE Linux Enterprise Module for Server Applications 15-SP4 SUSE Linux Enterprise Server 15-SP4 SUSE Linux Enterprise Server for SAP Applications 15-SP4 openSUSE Leap 15.4 ______________________________________________________________________________ An update that fixes two vulnerabilities is now available. Description: This update for redis fixes the following issues: - CVE-2022-24735: Fixed Lua code injection (bsc#1198952). - CVE-2022-24736: Fixed Lua NULL pointer dereference (bsc#1198953). Patch Instructions: To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 15.4: zypper in -t patch openSUSE-SLE-15.4-2022-1929=1 - SUSE Linux Enterprise Module for Server Applications 15-SP4: zypper in -t patch SUSE-SLE-Module-Server-Applications-15-SP4-2022-1929=1 Package List: - openSUSE Leap 15.4 (aarch64 ppc64le s390x x86_64): redis-6.2.6-150400.3.3.7 redis-debuginfo-6.2.6-150400.3.3.7 redis-debugsource-6.2.6-150400.3.3.7 - SUSE Linux Enterprise Module for Server Applications 15-SP4 (aarch64 ppc64le s390x x86_64): redis-6.2.6-150400.3.3.7 redis-debuginfo-6.2.6-150400.3.3.7 redis-debugsource-6.2.6-150400.3.3.7 References: https://www.suse.com/security/cve/CVE-2022-24735.html https://www.suse.com/security/cve/CVE-2022-24736.html https://bugzilla.suse.com/1198952 https://bugzilla.suse.com/1198953

1 0

SUSE-SU-2022:1928-1: Security update for php8
by opensuse-security＠opensuse.org 02 Jun '22

02 Jun '22

SUSE Security Update: Security update for php8 ______________________________________________________________________________ Announcement ID: SUSE-SU-2022:1928-1 Rating: low References: #1197644 Affected Products: SUSE Linux Enterprise High Performance Computing 15-SP4 SUSE Linux Enterprise Module for Web Scripting 15-SP4 SUSE Linux Enterprise Server 15-SP4 SUSE Linux Enterprise Server for SAP Applications 15-SP4 openSUSE Leap 15.4 ______________________________________________________________________________ An update that contains security fixes can now be installed. Description: This update for php8 fixes the following issues: - Fixed filter_var bypass vulnerability (bsc#1197644). Patch Instructions: To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 15.4: zypper in -t patch openSUSE-SLE-15.4-2022-1928=1 - SUSE Linux Enterprise Module for Web Scripting 15-SP4: zypper in -t patch SUSE-SLE-Module-Web-Scripting-15-SP4-2022-1928=1 Package List: - openSUSE Leap 15.4 (aarch64 ppc64le s390x x86_64): apache2-mod_php8-8.0.10-150400.4.3.1 apache2-mod_php8-debuginfo-8.0.10-150400.4.3.1 apache2-mod_php8-debugsource-8.0.10-150400.4.3.1 php8-8.0.10-150400.4.3.1 php8-bcmath-8.0.10-150400.4.3.1 php8-bcmath-debuginfo-8.0.10-150400.4.3.1 php8-bz2-8.0.10-150400.4.3.1 php8-bz2-debuginfo-8.0.10-150400.4.3.1 php8-calendar-8.0.10-150400.4.3.1 php8-calendar-debuginfo-8.0.10-150400.4.3.1 php8-cli-8.0.10-150400.4.3.1 php8-cli-debuginfo-8.0.10-150400.4.3.1 php8-ctype-8.0.10-150400.4.3.1 php8-ctype-debuginfo-8.0.10-150400.4.3.1 php8-curl-8.0.10-150400.4.3.1 php8-curl-debuginfo-8.0.10-150400.4.3.1 php8-dba-8.0.10-150400.4.3.1 php8-dba-debuginfo-8.0.10-150400.4.3.1 php8-debuginfo-8.0.10-150400.4.3.1 php8-debugsource-8.0.10-150400.4.3.1 php8-devel-8.0.10-150400.4.3.1 php8-dom-8.0.10-150400.4.3.1 php8-dom-debuginfo-8.0.10-150400.4.3.1 php8-embed-8.0.10-150400.4.3.1 php8-embed-debuginfo-8.0.10-150400.4.3.1 php8-embed-debugsource-8.0.10-150400.4.3.1 php8-enchant-8.0.10-150400.4.3.1 php8-enchant-debuginfo-8.0.10-150400.4.3.1 php8-exif-8.0.10-150400.4.3.1 php8-exif-debuginfo-8.0.10-150400.4.3.1 php8-fastcgi-8.0.10-150400.4.3.1 php8-fastcgi-debuginfo-8.0.10-150400.4.3.1 php8-fastcgi-debugsource-8.0.10-150400.4.3.1 php8-fileinfo-8.0.10-150400.4.3.1 php8-fileinfo-debuginfo-8.0.10-150400.4.3.1 php8-fpm-8.0.10-150400.4.3.1 php8-fpm-debuginfo-8.0.10-150400.4.3.1 php8-fpm-debugsource-8.0.10-150400.4.3.1 php8-ftp-8.0.10-150400.4.3.1 php8-ftp-debuginfo-8.0.10-150400.4.3.1 php8-gd-8.0.10-150400.4.3.1 php8-gd-debuginfo-8.0.10-150400.4.3.1 php8-gettext-8.0.10-150400.4.3.1 php8-gettext-debuginfo-8.0.10-150400.4.3.1 php8-gmp-8.0.10-150400.4.3.1 php8-gmp-debuginfo-8.0.10-150400.4.3.1 php8-iconv-8.0.10-150400.4.3.1 php8-iconv-debuginfo-8.0.10-150400.4.3.1 php8-intl-8.0.10-150400.4.3.1 php8-intl-debuginfo-8.0.10-150400.4.3.1 php8-ldap-8.0.10-150400.4.3.1 php8-ldap-debuginfo-8.0.10-150400.4.3.1 php8-mbstring-8.0.10-150400.4.3.1 php8-mbstring-debuginfo-8.0.10-150400.4.3.1 php8-mysql-8.0.10-150400.4.3.1 php8-mysql-debuginfo-8.0.10-150400.4.3.1 php8-odbc-8.0.10-150400.4.3.1 php8-odbc-debuginfo-8.0.10-150400.4.3.1 php8-opcache-8.0.10-150400.4.3.1 php8-opcache-debuginfo-8.0.10-150400.4.3.1 php8-openssl-8.0.10-150400.4.3.1 php8-openssl-debuginfo-8.0.10-150400.4.3.1 php8-pcntl-8.0.10-150400.4.3.1 php8-pcntl-debuginfo-8.0.10-150400.4.3.1 php8-pdo-8.0.10-150400.4.3.1 php8-pdo-debuginfo-8.0.10-150400.4.3.1 php8-pgsql-8.0.10-150400.4.3.1 php8-pgsql-debuginfo-8.0.10-150400.4.3.1 php8-phar-8.0.10-150400.4.3.1 php8-phar-debuginfo-8.0.10-150400.4.3.1 php8-posix-8.0.10-150400.4.3.1 php8-posix-debuginfo-8.0.10-150400.4.3.1 php8-readline-8.0.10-150400.4.3.1 php8-readline-debuginfo-8.0.10-150400.4.3.1 php8-shmop-8.0.10-150400.4.3.1 php8-shmop-debuginfo-8.0.10-150400.4.3.1 php8-snmp-8.0.10-150400.4.3.1 php8-snmp-debuginfo-8.0.10-150400.4.3.1 php8-soap-8.0.10-150400.4.3.1 php8-soap-debuginfo-8.0.10-150400.4.3.1 php8-sockets-8.0.10-150400.4.3.1 php8-sockets-debuginfo-8.0.10-150400.4.3.1 php8-sodium-8.0.10-150400.4.3.1 php8-sodium-debuginfo-8.0.10-150400.4.3.1 php8-sqlite-8.0.10-150400.4.3.1 php8-sqlite-debuginfo-8.0.10-150400.4.3.1 php8-sysvmsg-8.0.10-150400.4.3.1 php8-sysvmsg-debuginfo-8.0.10-150400.4.3.1 php8-sysvsem-8.0.10-150400.4.3.1 php8-sysvsem-debuginfo-8.0.10-150400.4.3.1 php8-sysvshm-8.0.10-150400.4.3.1 php8-sysvshm-debuginfo-8.0.10-150400.4.3.1 php8-test-8.0.10-150400.4.3.2 php8-tidy-8.0.10-150400.4.3.1 php8-tidy-debuginfo-8.0.10-150400.4.3.1 php8-tokenizer-8.0.10-150400.4.3.1 php8-tokenizer-debuginfo-8.0.10-150400.4.3.1 php8-xmlreader-8.0.10-150400.4.3.1 php8-xmlreader-debuginfo-8.0.10-150400.4.3.1 php8-xmlwriter-8.0.10-150400.4.3.1 php8-xmlwriter-debuginfo-8.0.10-150400.4.3.1 php8-xsl-8.0.10-150400.4.3.1 php8-xsl-debuginfo-8.0.10-150400.4.3.1 php8-zip-8.0.10-150400.4.3.1 php8-zip-debuginfo-8.0.10-150400.4.3.1 php8-zlib-8.0.10-150400.4.3.1 php8-zlib-debuginfo-8.0.10-150400.4.3.1 - SUSE Linux Enterprise Module for Web Scripting 15-SP4 (aarch64 ppc64le s390x x86_64): apache2-mod_php8-8.0.10-150400.4.3.1 apache2-mod_php8-debuginfo-8.0.10-150400.4.3.1 apache2-mod_php8-debugsource-8.0.10-150400.4.3.1 php8-8.0.10-150400.4.3.1 php8-bcmath-8.0.10-150400.4.3.1 php8-bcmath-debuginfo-8.0.10-150400.4.3.1 php8-bz2-8.0.10-150400.4.3.1 php8-bz2-debuginfo-8.0.10-150400.4.3.1 php8-calendar-8.0.10-150400.4.3.1 php8-calendar-debuginfo-8.0.10-150400.4.3.1 php8-cli-8.0.10-150400.4.3.1 php8-cli-debuginfo-8.0.10-150400.4.3.1 php8-ctype-8.0.10-150400.4.3.1 php8-ctype-debuginfo-8.0.10-150400.4.3.1 php8-curl-8.0.10-150400.4.3.1 php8-curl-debuginfo-8.0.10-150400.4.3.1 php8-dba-8.0.10-150400.4.3.1 php8-dba-debuginfo-8.0.10-150400.4.3.1 php8-debuginfo-8.0.10-150400.4.3.1 php8-debugsource-8.0.10-150400.4.3.1 php8-devel-8.0.10-150400.4.3.1 php8-dom-8.0.10-150400.4.3.1 php8-dom-debuginfo-8.0.10-150400.4.3.1 php8-embed-8.0.10-150400.4.3.1 php8-embed-debuginfo-8.0.10-150400.4.3.1 php8-embed-debugsource-8.0.10-150400.4.3.1 php8-enchant-8.0.10-150400.4.3.1 php8-enchant-debuginfo-8.0.10-150400.4.3.1 php8-exif-8.0.10-150400.4.3.1 php8-exif-debuginfo-8.0.10-150400.4.3.1 php8-fastcgi-8.0.10-150400.4.3.1 php8-fastcgi-debuginfo-8.0.10-150400.4.3.1 php8-fastcgi-debugsource-8.0.10-150400.4.3.1 php8-fileinfo-8.0.10-150400.4.3.1 php8-fileinfo-debuginfo-8.0.10-150400.4.3.1 php8-fpm-8.0.10-150400.4.3.1 php8-fpm-debuginfo-8.0.10-150400.4.3.1 php8-fpm-debugsource-8.0.10-150400.4.3.1 php8-ftp-8.0.10-150400.4.3.1 php8-ftp-debuginfo-8.0.10-150400.4.3.1 php8-gd-8.0.10-150400.4.3.1 php8-gd-debuginfo-8.0.10-150400.4.3.1 php8-gettext-8.0.10-150400.4.3.1 php8-gettext-debuginfo-8.0.10-150400.4.3.1 php8-gmp-8.0.10-150400.4.3.1 php8-gmp-debuginfo-8.0.10-150400.4.3.1 php8-iconv-8.0.10-150400.4.3.1 php8-iconv-debuginfo-8.0.10-150400.4.3.1 php8-intl-8.0.10-150400.4.3.1 php8-intl-debuginfo-8.0.10-150400.4.3.1 php8-ldap-8.0.10-150400.4.3.1 php8-ldap-debuginfo-8.0.10-150400.4.3.1 php8-mbstring-8.0.10-150400.4.3.1 php8-mbstring-debuginfo-8.0.10-150400.4.3.1 php8-mysql-8.0.10-150400.4.3.1 php8-mysql-debuginfo-8.0.10-150400.4.3.1 php8-odbc-8.0.10-150400.4.3.1 php8-odbc-debuginfo-8.0.10-150400.4.3.1 php8-opcache-8.0.10-150400.4.3.1 php8-opcache-debuginfo-8.0.10-150400.4.3.1 php8-openssl-8.0.10-150400.4.3.1 php8-openssl-debuginfo-8.0.10-150400.4.3.1 php8-pcntl-8.0.10-150400.4.3.1 php8-pcntl-debuginfo-8.0.10-150400.4.3.1 php8-pdo-8.0.10-150400.4.3.1 php8-pdo-debuginfo-8.0.10-150400.4.3.1 php8-pgsql-8.0.10-150400.4.3.1 php8-pgsql-debuginfo-8.0.10-150400.4.3.1 php8-phar-8.0.10-150400.4.3.1 php8-phar-debuginfo-8.0.10-150400.4.3.1 php8-posix-8.0.10-150400.4.3.1 php8-posix-debuginfo-8.0.10-150400.4.3.1 php8-readline-8.0.10-150400.4.3.1 php8-readline-debuginfo-8.0.10-150400.4.3.1 php8-shmop-8.0.10-150400.4.3.1 php8-shmop-debuginfo-8.0.10-150400.4.3.1 php8-snmp-8.0.10-150400.4.3.1 php8-snmp-debuginfo-8.0.10-150400.4.3.1 php8-soap-8.0.10-150400.4.3.1 php8-soap-debuginfo-8.0.10-150400.4.3.1 php8-sockets-8.0.10-150400.4.3.1 php8-sockets-debuginfo-8.0.10-150400.4.3.1 php8-sodium-8.0.10-150400.4.3.1 php8-sodium-debuginfo-8.0.10-150400.4.3.1 php8-sqlite-8.0.10-150400.4.3.1 php8-sqlite-debuginfo-8.0.10-150400.4.3.1 php8-sysvmsg-8.0.10-150400.4.3.1 php8-sysvmsg-debuginfo-8.0.10-150400.4.3.1 php8-sysvsem-8.0.10-150400.4.3.1 php8-sysvsem-debuginfo-8.0.10-150400.4.3.1 php8-sysvshm-8.0.10-150400.4.3.1 php8-sysvshm-debuginfo-8.0.10-150400.4.3.1 php8-test-8.0.10-150400.4.3.2 php8-tidy-8.0.10-150400.4.3.1 php8-tidy-debuginfo-8.0.10-150400.4.3.1 php8-tokenizer-8.0.10-150400.4.3.1 php8-tokenizer-debuginfo-8.0.10-150400.4.3.1 php8-xmlreader-8.0.10-150400.4.3.1 php8-xmlreader-debuginfo-8.0.10-150400.4.3.1 php8-xmlwriter-8.0.10-150400.4.3.1 php8-xmlwriter-debuginfo-8.0.10-150400.4.3.1 php8-xsl-8.0.10-150400.4.3.1 php8-xsl-debuginfo-8.0.10-150400.4.3.1 php8-zip-8.0.10-150400.4.3.1 php8-zip-debuginfo-8.0.10-150400.4.3.1 php8-zlib-8.0.10-150400.4.3.1 php8-zlib-debuginfo-8.0.10-150400.4.3.1 References: https://bugzilla.suse.com/1197644

1 0

SUSE-SU-2022:1930-1: moderate: Security update for libarchive
by opensuse-security＠opensuse.org 02 Jun '22

02 Jun '22

SUSE Security Update: Security update for libarchive ______________________________________________________________________________ Announcement ID: SUSE-SU-2022:1930-1 Rating: moderate References: #1022528 #1188572 #1189528 #1197634 Cross-References: CVE-2017-5601 CVE-2021-36976 CVE-2022-26280 CVSS scores: CVE-2017-5601 (NVD) : 7.5 CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H CVE-2017-5601 (SUSE): 4.8 CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:L CVE-2021-36976 (NVD) : 6.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H CVE-2021-36976 (SUSE): 6.2 CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H CVE-2022-26280 (NVD) : 9.1 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:H CVE-2022-26280 (SUSE): 7.4 CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:H Affected Products: SUSE Linux Enterprise Desktop 15-SP4 SUSE Linux Enterprise High Performance Computing 15-SP4 SUSE Linux Enterprise Module for Basesystem 15-SP4 SUSE Linux Enterprise Module for Development Tools 15-SP4 SUSE Linux Enterprise Server 15-SP4 SUSE Linux Enterprise Server for SAP Applications 15-SP4 openSUSE Leap 15.4 ______________________________________________________________________________ An update that solves three vulnerabilities and has one errata is now available. Description: This update for libarchive fixes the following issues: - CVE-2022-26280: Fixed out-of-bounds read via the component zipx_lzma_alone_init (bsc#1197634). - CVE-2021-36976: Fixed use-after-free in copy_string (called from do_uncompress_block and process_block) (bsc#1188572). - CVE-2017-5601: Fixed out-of-bounds memory access preventing denial-of-service (bsc#1197634, bsc#1189528). Patch Instructions: To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 15.4: zypper in -t patch openSUSE-SLE-15.4-2022-1930=1 - SUSE Linux Enterprise Module for Development Tools 15-SP4: zypper in -t patch SUSE-SLE-Module-Development-Tools-15-SP4-2022-1930=1 - SUSE Linux Enterprise Module for Basesystem 15-SP4: zypper in -t patch SUSE-SLE-Module-Basesystem-15-SP4-2022-1930=1 Package List: - openSUSE Leap 15.4 (aarch64 ppc64le s390x x86_64): bsdtar-3.5.1-150400.3.3.1 bsdtar-debuginfo-3.5.1-150400.3.3.1 libarchive-debugsource-3.5.1-150400.3.3.1 libarchive-devel-3.5.1-150400.3.3.1 libarchive13-3.5.1-150400.3.3.1 libarchive13-debuginfo-3.5.1-150400.3.3.1 - openSUSE Leap 15.4 (x86_64): libarchive13-32bit-3.5.1-150400.3.3.1 libarchive13-32bit-debuginfo-3.5.1-150400.3.3.1 - SUSE Linux Enterprise Module for Development Tools 15-SP4 (aarch64 ppc64le s390x x86_64): bsdtar-3.5.1-150400.3.3.1 bsdtar-debuginfo-3.5.1-150400.3.3.1 libarchive-debugsource-3.5.1-150400.3.3.1 - SUSE Linux Enterprise Module for Basesystem 15-SP4 (aarch64 ppc64le s390x x86_64): libarchive-debugsource-3.5.1-150400.3.3.1 libarchive-devel-3.5.1-150400.3.3.1 libarchive13-3.5.1-150400.3.3.1 libarchive13-debuginfo-3.5.1-150400.3.3.1 References: https://www.suse.com/security/cve/CVE-2017-5601.html https://www.suse.com/security/cve/CVE-2021-36976.html https://www.suse.com/security/cve/CVE-2022-26280.html https://bugzilla.suse.com/1022528 https://bugzilla.suse.com/1188572 https://bugzilla.suse.com/1189528 https://bugzilla.suse.com/1197634

1 0

SUSE-SU-2022:1923-1: important: Security update for kernel-firmware
by opensuse-security＠opensuse.org 02 Jun '22

02 Jun '22

SUSE Security Update: Security update for kernel-firmware ______________________________________________________________________________ Announcement ID: SUSE-SU-2022:1923-1 Rating: important References: #1195786 #1199459 #1199470 Cross-References: CVE-2021-26312 CVE-2021-26339 CVE-2021-26342 CVE-2021-26347 CVE-2021-26348 CVE-2021-26349 CVE-2021-26350 CVE-2021-26364 CVE-2021-26372 CVE-2021-26373 CVE-2021-26375 CVE-2021-26376 CVE-2021-26378 CVE-2021-26388 CVE-2021-33139 CVE-2021-33155 CVE-2021-46744 CVSS scores: CVE-2021-26312 (NVD) : 5.5 CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N CVE-2021-26339 (NVD) : 5.5 CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H CVE-2021-26339 (SUSE): 5.5 CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H CVE-2021-26342 (NVD) : 3.3 CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N CVE-2021-26342 (SUSE): 4.4 CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N CVE-2021-26347 (NVD) : 4.7 CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:N/I:N/A:H CVE-2021-26348 (NVD) : 5.5 CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N CVE-2021-26349 (NVD) : 5.5 CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N CVE-2021-26350 (NVD) : 4.7 CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:N/I:N/A:H CVE-2021-26364 (NVD) : 5.5 CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H CVE-2021-26372 (NVD) : 5.5 CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H CVE-2021-26373 (NVD) : 5.5 CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H CVE-2021-26375 (NVD) : 5.5 CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H CVE-2021-26376 (NVD) : 5.5 CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H CVE-2021-26378 (NVD) : 5.5 CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H CVE-2021-26388 (NVD) : 5.5 CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H CVE-2021-33139 (NVD) : 5.7 CVSS:3.1/AV:A/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H CVE-2021-33139 (SUSE): 5.7 CVSS:3.1/AV:A/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H CVE-2021-33155 (NVD) : 5.7 CVSS:3.1/AV:A/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H CVE-2021-33155 (SUSE): 5.7 CVSS:3.1/AV:A/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H CVE-2021-46744 (NVD) : 6.5 CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N CVE-2021-46744 (SUSE): 6.2 CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N Affected Products: SUSE Linux Enterprise Desktop 15-SP4 SUSE Linux Enterprise High Performance Computing 15-SP4 SUSE Linux Enterprise Module for Basesystem 15-SP4 SUSE Linux Enterprise Server 15-SP4 SUSE Linux Enterprise Server for SAP Applications 15-SP4 openSUSE Leap 15.4 ______________________________________________________________________________ An update that fixes 17 vulnerabilities is now available. Description: This update for kernel-firmware fixes the following issues: Update to version 20220411 (git commit f219d616f42b, bsc#1199459): - CVE-2021-26373, CVE-2021-26347, CVE-2021-26376, CVE-2021-26350, CVE-2021-26375, CVE-2021-26378, CVE-2021-26372, CVE-2021-26339, CVE-2021-26348, CVE-2021-26342, CVE-2021-26388, CVE-2021-26349, CVE-2021-26364, CVE-2021-26312: Update AMD cpu microcode Update to version 20220309 (git commit cd01f857da28, bsc#1199470): - CVE-2021-46744: Ciphertext Side Channels on AMD SEV Update Intel Bluetooth firmware (INTEL-SA-00604, bsc#1195786): - CVE-2021-33139, CVE-2021-33155: Improper conditions check in the firmware for some Intel Wireless Bluetooth and Killer Bluetooth products may allow an authenticated user to potentially cause denial of service via adjacent access. Special Instructions and Notes: Please reboot the system after installing this update. Patch Instructions: To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 15.4: zypper in -t patch openSUSE-SLE-15.4-2022-1923=1 - SUSE Linux Enterprise Module for Basesystem 15-SP4: zypper in -t patch SUSE-SLE-Module-Basesystem-15-SP4-2022-1923=1 Package List: - openSUSE Leap 15.4 (noarch): kernel-firmware-20220509-150400.4.5.1 kernel-firmware-all-20220509-150400.4.5.1 kernel-firmware-amdgpu-20220509-150400.4.5.1 kernel-firmware-ath10k-20220509-150400.4.5.1 kernel-firmware-ath11k-20220509-150400.4.5.1 kernel-firmware-atheros-20220509-150400.4.5.1 kernel-firmware-bluetooth-20220509-150400.4.5.1 kernel-firmware-bnx2-20220509-150400.4.5.1 kernel-firmware-brcm-20220509-150400.4.5.1 kernel-firmware-chelsio-20220509-150400.4.5.1 kernel-firmware-dpaa2-20220509-150400.4.5.1 kernel-firmware-i915-20220509-150400.4.5.1 kernel-firmware-intel-20220509-150400.4.5.1 kernel-firmware-iwlwifi-20220509-150400.4.5.1 kernel-firmware-liquidio-20220509-150400.4.5.1 kernel-firmware-marvell-20220509-150400.4.5.1 kernel-firmware-media-20220509-150400.4.5.1 kernel-firmware-mediatek-20220509-150400.4.5.1 kernel-firmware-mellanox-20220509-150400.4.5.1 kernel-firmware-mwifiex-20220509-150400.4.5.1 kernel-firmware-network-20220509-150400.4.5.1 kernel-firmware-nfp-20220509-150400.4.5.1 kernel-firmware-nvidia-20220509-150400.4.5.1 kernel-firmware-platform-20220509-150400.4.5.1 kernel-firmware-prestera-20220509-150400.4.5.1 kernel-firmware-qcom-20220509-150400.4.5.1 kernel-firmware-qlogic-20220509-150400.4.5.1 kernel-firmware-radeon-20220509-150400.4.5.1 kernel-firmware-realtek-20220509-150400.4.5.1 kernel-firmware-serial-20220509-150400.4.5.1 kernel-firmware-sound-20220509-150400.4.5.1 kernel-firmware-ti-20220509-150400.4.5.1 kernel-firmware-ueagle-20220509-150400.4.5.1 kernel-firmware-usb-network-20220509-150400.4.5.1 ucode-amd-20220509-150400.4.5.1 - SUSE Linux Enterprise Module for Basesystem 15-SP4 (noarch): kernel-firmware-all-20220509-150400.4.5.1 kernel-firmware-amdgpu-20220509-150400.4.5.1 kernel-firmware-ath10k-20220509-150400.4.5.1 kernel-firmware-ath11k-20220509-150400.4.5.1 kernel-firmware-atheros-20220509-150400.4.5.1 kernel-firmware-bluetooth-20220509-150400.4.5.1 kernel-firmware-bnx2-20220509-150400.4.5.1 kernel-firmware-brcm-20220509-150400.4.5.1 kernel-firmware-chelsio-20220509-150400.4.5.1 kernel-firmware-dpaa2-20220509-150400.4.5.1 kernel-firmware-i915-20220509-150400.4.5.1 kernel-firmware-intel-20220509-150400.4.5.1 kernel-firmware-iwlwifi-20220509-150400.4.5.1 kernel-firmware-liquidio-20220509-150400.4.5.1 kernel-firmware-marvell-20220509-150400.4.5.1 kernel-firmware-media-20220509-150400.4.5.1 kernel-firmware-mediatek-20220509-150400.4.5.1 kernel-firmware-mellanox-20220509-150400.4.5.1 kernel-firmware-mwifiex-20220509-150400.4.5.1 kernel-firmware-network-20220509-150400.4.5.1 kernel-firmware-nfp-20220509-150400.4.5.1 kernel-firmware-nvidia-20220509-150400.4.5.1 kernel-firmware-platform-20220509-150400.4.5.1 kernel-firmware-prestera-20220509-150400.4.5.1 kernel-firmware-qcom-20220509-150400.4.5.1 kernel-firmware-qlogic-20220509-150400.4.5.1 kernel-firmware-radeon-20220509-150400.4.5.1 kernel-firmware-realtek-20220509-150400.4.5.1 kernel-firmware-serial-20220509-150400.4.5.1 kernel-firmware-sound-20220509-150400.4.5.1 kernel-firmware-ti-20220509-150400.4.5.1 kernel-firmware-ueagle-20220509-150400.4.5.1 kernel-firmware-usb-network-20220509-150400.4.5.1 ucode-amd-20220509-150400.4.5.1 References: https://www.suse.com/security/cve/CVE-2021-26312.html https://www.suse.com/security/cve/CVE-2021-26339.html https://www.suse.com/security/cve/CVE-2021-26342.html https://www.suse.com/security/cve/CVE-2021-26347.html https://www.suse.com/security/cve/CVE-2021-26348.html https://www.suse.com/security/cve/CVE-2021-26349.html https://www.suse.com/security/cve/CVE-2021-26350.html https://www.suse.com/security/cve/CVE-2021-26364.html https://www.suse.com/security/cve/CVE-2021-26372.html https://www.suse.com/security/cve/CVE-2021-26373.html https://www.suse.com/security/cve/CVE-2021-26375.html https://www.suse.com/security/cve/CVE-2021-26376.html https://www.suse.com/security/cve/CVE-2021-26378.html https://www.suse.com/security/cve/CVE-2021-26388.html https://www.suse.com/security/cve/CVE-2021-33139.html https://www.suse.com/security/cve/CVE-2021-33155.html https://www.suse.com/security/cve/CVE-2021-46744.html https://bugzilla.suse.com/1195786 https://bugzilla.suse.com/1199459 https://bugzilla.suse.com/1199470

1 0

SUSE-SU-2022:1925-1: moderate: Security update for patch
by opensuse-security＠opensuse.org 02 Jun '22

02 Jun '22

SUSE Security Update: Security update for patch ______________________________________________________________________________ Announcement ID: SUSE-SU-2022:1925-1 Rating: moderate References: #1080985 #1111572 #1142041 #1198106 Cross-References: CVE-2018-6952 CVE-2019-13636 CVSS scores: CVE-2018-6952 (NVD) : 7.5 CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H CVE-2018-6952 (SUSE): 3.3 CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:L CVE-2019-13636 (NVD) : 5.9 CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:N CVE-2019-13636 (SUSE): 5.9 CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:N Affected Products: SUSE Linux Enterprise Desktop 15-SP3 SUSE Linux Enterprise Desktop 15-SP4 SUSE Linux Enterprise High Performance Computing 15-SP3 SUSE Linux Enterprise High Performance Computing 15-SP4 SUSE Linux Enterprise Module for Basesystem 15-SP3 SUSE Linux Enterprise Module for Basesystem 15-SP4 SUSE Linux Enterprise Server 15-SP3 SUSE Linux Enterprise Server 15-SP4 SUSE Linux Enterprise Server for SAP Applications 15-SP3 SUSE Linux Enterprise Server for SAP Applications 15-SP4 SUSE Manager Proxy 4.2 SUSE Manager Server 4.2 openSUSE Leap 15.3 openSUSE Leap 15.4 ______________________________________________________________________________ An update that solves two vulnerabilities and has two fixes is now available. Description: This update for patch fixes the following issues: Security issues fixed: - CVE-2019-13636: Fixed follow symlinks unless --follow-symlinks is given. This increases the security against malicious patches (bsc#1142041). - CVE-2018-6952: Fixed swapping fakelines in pch_swap. This bug was causing a double free leading to a crash (bsc#1080985). Bugfixes: - Abort when cleaning up fails. This bug could cause an infinite loop when a patch wouldn't apply, leading to a segmentation fault (bsc#1111572). - Pass the correct stat to backup files. This bug would occasionally cause backup files to be missing when all hunks failed to apply (bsc#1198106). Patch Instructions: To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 15.4: zypper in -t patch openSUSE-SLE-15.4-2022-1925=1 - openSUSE Leap 15.3: zypper in -t patch openSUSE-SLE-15.3-2022-1925=1 - SUSE Linux Enterprise Module for Basesystem 15-SP4: zypper in -t patch SUSE-SLE-Module-Basesystem-15-SP4-2022-1925=1 - SUSE Linux Enterprise Module for Basesystem 15-SP3: zypper in -t patch SUSE-SLE-Module-Basesystem-15-SP3-2022-1925=1 Package List: - openSUSE Leap 15.4 (aarch64 ppc64le s390x x86_64): patch-2.7.6-150000.5.3.1 patch-debuginfo-2.7.6-150000.5.3.1 patch-debugsource-2.7.6-150000.5.3.1 - openSUSE Leap 15.3 (aarch64 ppc64le s390x x86_64): patch-2.7.6-150000.5.3.1 patch-debuginfo-2.7.6-150000.5.3.1 patch-debugsource-2.7.6-150000.5.3.1 - SUSE Linux Enterprise Module for Basesystem 15-SP4 (aarch64 ppc64le s390x x86_64): patch-2.7.6-150000.5.3.1 patch-debuginfo-2.7.6-150000.5.3.1 patch-debugsource-2.7.6-150000.5.3.1 - SUSE Linux Enterprise Module for Basesystem 15-SP3 (aarch64 ppc64le s390x x86_64): patch-2.7.6-150000.5.3.1 patch-debuginfo-2.7.6-150000.5.3.1 patch-debugsource-2.7.6-150000.5.3.1 References: https://www.suse.com/security/cve/CVE-2018-6952.html https://www.suse.com/security/cve/CVE-2019-13636.html https://bugzilla.suse.com/1080985 https://bugzilla.suse.com/1111572 https://bugzilla.suse.com/1142041 https://bugzilla.suse.com/1198106

1 0