July 2022 - openSUSE Security Announce

SUSE-SU-2022:2327-1: important: Security update for curl
by opensuse-security＠opensuse.org 07 Jul '22

07 Jul '22

SUSE Security Update: Security update for curl ______________________________________________________________________________ Announcement ID: SUSE-SU-2022:2327-1 Rating: important References: #1200735 #1200737 Cross-References: CVE-2022-32206 CVE-2022-32208 CVSS scores: CVE-2022-32206 (SUSE): 4.9 CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H CVE-2022-32208 (SUSE): 6.6 CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:H/I:H/A:H Affected Products: SUSE Enterprise Storage 7 SUSE Linux Enterprise Desktop 15-SP3 SUSE Linux Enterprise High Performance Computing 15-SP2-ESPOS SUSE Linux Enterprise High Performance Computing 15-SP2-LTSS SUSE Linux Enterprise High Performance Computing 15-SP3 SUSE Linux Enterprise Micro 5.1 SUSE Linux Enterprise Micro 5.2 SUSE Linux Enterprise Module for Basesystem 15-SP3 SUSE Linux Enterprise Server 15-SP2-BCL SUSE Linux Enterprise Server 15-SP2-LTSS SUSE Linux Enterprise Server 15-SP3 SUSE Linux Enterprise Server for SAP 15-SP2 SUSE Linux Enterprise Server for SAP Applications 15-SP3 SUSE Linux Enterprise Storage 7.1 SUSE Manager Proxy 4.1 SUSE Manager Proxy 4.2 SUSE Manager Retail Branch Server 4.1 SUSE Manager Retail Branch Server 4.2 SUSE Manager Server 4.1 SUSE Manager Server 4.2 openSUSE Leap 15.3 ______________________________________________________________________________ An update that fixes two vulnerabilities is now available. Description: This update for curl fixes the following issues: - CVE-2022-32206: HTTP compression denial of service (bsc#1200735) - CVE-2022-32208: FTP-KRB bad message verification (bsc#1200737) Patch Instructions: To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 15.3: zypper in -t patch openSUSE-SLE-15.3-2022-2327=1 - SUSE Manager Server 4.1: zypper in -t patch SUSE-SLE-Product-SUSE-Manager-Server-4.1-2022-2327=1 - SUSE Manager Retail Branch Server 4.1: zypper in -t patch SUSE-SLE-Product-SUSE-Manager-Retail-Branch-Server-4.1-2022-2327=1 - SUSE Manager Proxy 4.1: zypper in -t patch SUSE-SLE-Product-SUSE-Manager-Proxy-4.1-2022-2327=1 - SUSE Linux Enterprise Server for SAP 15-SP2: zypper in -t patch SUSE-SLE-Product-SLES_SAP-15-SP2-2022-2327=1 - SUSE Linux Enterprise Server 15-SP2-LTSS: zypper in -t patch SUSE-SLE-Product-SLES-15-SP2-LTSS-2022-2327=1 - SUSE Linux Enterprise Server 15-SP2-BCL: zypper in -t patch SUSE-SLE-Product-SLES-15-SP2-BCL-2022-2327=1 - SUSE Linux Enterprise Module for Basesystem 15-SP3: zypper in -t patch SUSE-SLE-Module-Basesystem-15-SP3-2022-2327=1 - SUSE Linux Enterprise Micro 5.2: zypper in -t patch SUSE-SUSE-MicroOS-5.2-2022-2327=1 - SUSE Linux Enterprise Micro 5.1: zypper in -t patch SUSE-SUSE-MicroOS-5.1-2022-2327=1 - SUSE Linux Enterprise High Performance Computing 15-SP2-LTSS: zypper in -t patch SUSE-SLE-Product-HPC-15-SP2-LTSS-2022-2327=1 - SUSE Linux Enterprise High Performance Computing 15-SP2-ESPOS: zypper in -t patch SUSE-SLE-Product-HPC-15-SP2-ESPOS-2022-2327=1 - SUSE Enterprise Storage 7: zypper in -t patch SUSE-Storage-7-2022-2327=1 Package List: - openSUSE Leap 15.3 (aarch64 ppc64le s390x x86_64): curl-7.66.0-150200.4.36.1 curl-debuginfo-7.66.0-150200.4.36.1 curl-debugsource-7.66.0-150200.4.36.1 libcurl-devel-7.66.0-150200.4.36.1 libcurl4-7.66.0-150200.4.36.1 libcurl4-debuginfo-7.66.0-150200.4.36.1 - openSUSE Leap 15.3 (x86_64): libcurl-devel-32bit-7.66.0-150200.4.36.1 libcurl4-32bit-7.66.0-150200.4.36.1 libcurl4-32bit-debuginfo-7.66.0-150200.4.36.1 - SUSE Manager Server 4.1 (ppc64le s390x x86_64): curl-7.66.0-150200.4.36.1 curl-debuginfo-7.66.0-150200.4.36.1 curl-debugsource-7.66.0-150200.4.36.1 libcurl-devel-7.66.0-150200.4.36.1 libcurl4-7.66.0-150200.4.36.1 libcurl4-debuginfo-7.66.0-150200.4.36.1 - SUSE Manager Server 4.1 (x86_64): libcurl4-32bit-7.66.0-150200.4.36.1 libcurl4-32bit-debuginfo-7.66.0-150200.4.36.1 - SUSE Manager Retail Branch Server 4.1 (x86_64): curl-7.66.0-150200.4.36.1 curl-debuginfo-7.66.0-150200.4.36.1 curl-debugsource-7.66.0-150200.4.36.1 libcurl-devel-7.66.0-150200.4.36.1 libcurl4-32bit-7.66.0-150200.4.36.1 libcurl4-32bit-debuginfo-7.66.0-150200.4.36.1 libcurl4-7.66.0-150200.4.36.1 libcurl4-debuginfo-7.66.0-150200.4.36.1 - SUSE Manager Proxy 4.1 (x86_64): curl-7.66.0-150200.4.36.1 curl-debuginfo-7.66.0-150200.4.36.1 curl-debugsource-7.66.0-150200.4.36.1 libcurl-devel-7.66.0-150200.4.36.1 libcurl4-32bit-7.66.0-150200.4.36.1 libcurl4-32bit-debuginfo-7.66.0-150200.4.36.1 libcurl4-7.66.0-150200.4.36.1 libcurl4-debuginfo-7.66.0-150200.4.36.1 - SUSE Linux Enterprise Server for SAP 15-SP2 (ppc64le x86_64): curl-7.66.0-150200.4.36.1 curl-debuginfo-7.66.0-150200.4.36.1 curl-debugsource-7.66.0-150200.4.36.1 libcurl-devel-7.66.0-150200.4.36.1 libcurl4-7.66.0-150200.4.36.1 libcurl4-debuginfo-7.66.0-150200.4.36.1 - SUSE Linux Enterprise Server for SAP 15-SP2 (x86_64): libcurl4-32bit-7.66.0-150200.4.36.1 libcurl4-32bit-debuginfo-7.66.0-150200.4.36.1 - SUSE Linux Enterprise Server 15-SP2-LTSS (aarch64 ppc64le s390x x86_64): curl-7.66.0-150200.4.36.1 curl-debuginfo-7.66.0-150200.4.36.1 curl-debugsource-7.66.0-150200.4.36.1 libcurl-devel-7.66.0-150200.4.36.1 libcurl4-7.66.0-150200.4.36.1 libcurl4-debuginfo-7.66.0-150200.4.36.1 - SUSE Linux Enterprise Server 15-SP2-LTSS (x86_64): libcurl4-32bit-7.66.0-150200.4.36.1 libcurl4-32bit-debuginfo-7.66.0-150200.4.36.1 - SUSE Linux Enterprise Server 15-SP2-BCL (x86_64): curl-7.66.0-150200.4.36.1 curl-debuginfo-7.66.0-150200.4.36.1 curl-debugsource-7.66.0-150200.4.36.1 libcurl-devel-7.66.0-150200.4.36.1 libcurl4-32bit-7.66.0-150200.4.36.1 libcurl4-32bit-debuginfo-7.66.0-150200.4.36.1 libcurl4-7.66.0-150200.4.36.1 libcurl4-debuginfo-7.66.0-150200.4.36.1 - SUSE Linux Enterprise Module for Basesystem 15-SP3 (aarch64 ppc64le s390x x86_64): curl-7.66.0-150200.4.36.1 curl-debuginfo-7.66.0-150200.4.36.1 curl-debugsource-7.66.0-150200.4.36.1 libcurl-devel-7.66.0-150200.4.36.1 libcurl4-7.66.0-150200.4.36.1 libcurl4-debuginfo-7.66.0-150200.4.36.1 - SUSE Linux Enterprise Module for Basesystem 15-SP3 (x86_64): libcurl4-32bit-7.66.0-150200.4.36.1 libcurl4-32bit-debuginfo-7.66.0-150200.4.36.1 - SUSE Linux Enterprise Micro 5.2 (aarch64 s390x x86_64): curl-7.66.0-150200.4.36.1 curl-debuginfo-7.66.0-150200.4.36.1 curl-debugsource-7.66.0-150200.4.36.1 libcurl4-7.66.0-150200.4.36.1 libcurl4-debuginfo-7.66.0-150200.4.36.1 - SUSE Linux Enterprise Micro 5.1 (aarch64 s390x x86_64): curl-7.66.0-150200.4.36.1 curl-debuginfo-7.66.0-150200.4.36.1 curl-debugsource-7.66.0-150200.4.36.1 libcurl4-7.66.0-150200.4.36.1 libcurl4-debuginfo-7.66.0-150200.4.36.1 - SUSE Linux Enterprise High Performance Computing 15-SP2-LTSS (aarch64 x86_64): curl-7.66.0-150200.4.36.1 curl-debuginfo-7.66.0-150200.4.36.1 curl-debugsource-7.66.0-150200.4.36.1 libcurl-devel-7.66.0-150200.4.36.1 libcurl4-7.66.0-150200.4.36.1 libcurl4-debuginfo-7.66.0-150200.4.36.1 - SUSE Linux Enterprise High Performance Computing 15-SP2-LTSS (x86_64): libcurl4-32bit-7.66.0-150200.4.36.1 libcurl4-32bit-debuginfo-7.66.0-150200.4.36.1 - SUSE Linux Enterprise High Performance Computing 15-SP2-ESPOS (aarch64 x86_64): curl-7.66.0-150200.4.36.1 curl-debuginfo-7.66.0-150200.4.36.1 curl-debugsource-7.66.0-150200.4.36.1 libcurl-devel-7.66.0-150200.4.36.1 libcurl4-7.66.0-150200.4.36.1 libcurl4-debuginfo-7.66.0-150200.4.36.1 - SUSE Linux Enterprise High Performance Computing 15-SP2-ESPOS (x86_64): libcurl4-32bit-7.66.0-150200.4.36.1 libcurl4-32bit-debuginfo-7.66.0-150200.4.36.1 - SUSE Enterprise Storage 7 (aarch64 x86_64): curl-7.66.0-150200.4.36.1 curl-debuginfo-7.66.0-150200.4.36.1 curl-debugsource-7.66.0-150200.4.36.1 libcurl-devel-7.66.0-150200.4.36.1 libcurl4-7.66.0-150200.4.36.1 libcurl4-debuginfo-7.66.0-150200.4.36.1 - SUSE Enterprise Storage 7 (x86_64): libcurl4-32bit-7.66.0-150200.4.36.1 libcurl4-32bit-debuginfo-7.66.0-150200.4.36.1 References: https://www.suse.com/security/cve/CVE-2022-32206.html https://www.suse.com/security/cve/CVE-2022-32208.html https://bugzilla.suse.com/1200735 https://bugzilla.suse.com/1200737

1 0

SUSE-SU-2022:2328-1: important: Security update for openssl-1_1
by opensuse-security＠opensuse.org 07 Jul '22

07 Jul '22

SUSE Security Update: Security update for openssl-1_1 ______________________________________________________________________________ Announcement ID: SUSE-SU-2022:2328-1 Rating: important References: #1201099 Cross-References: CVE-2022-2097 CVSS scores: CVE-2022-2097 (SUSE): 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N Affected Products: SUSE Enterprise Storage 7 SUSE Linux Enterprise Desktop 15-SP3 SUSE Linux Enterprise High Performance Computing 15-SP2-ESPOS SUSE Linux Enterprise High Performance Computing 15-SP2-LTSS SUSE Linux Enterprise High Performance Computing 15-SP3 SUSE Linux Enterprise Micro 5.1 SUSE Linux Enterprise Micro 5.2 SUSE Linux Enterprise Module for Basesystem 15-SP3 SUSE Linux Enterprise Server 15-SP2-BCL SUSE Linux Enterprise Server 15-SP2-LTSS SUSE Linux Enterprise Server 15-SP3 SUSE Linux Enterprise Server for SAP 15-SP2 SUSE Linux Enterprise Server for SAP Applications 15-SP3 SUSE Linux Enterprise Storage 7.1 SUSE Manager Proxy 4.1 SUSE Manager Proxy 4.2 SUSE Manager Retail Branch Server 4.1 SUSE Manager Retail Branch Server 4.2 SUSE Manager Server 4.1 SUSE Manager Server 4.2 openSUSE Leap 15.3 ______________________________________________________________________________ An update that fixes one vulnerability is now available. Description: This update for openssl-1_1 fixes the following issues: - CVE-2022-2097: Fixed partial missing encryption in AES OCB mode (bsc#1201099). Patch Instructions: To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 15.3: zypper in -t patch openSUSE-SLE-15.3-2022-2328=1 - SUSE Manager Server 4.1: zypper in -t patch SUSE-SLE-Product-SUSE-Manager-Server-4.1-2022-2328=1 - SUSE Manager Retail Branch Server 4.1: zypper in -t patch SUSE-SLE-Product-SUSE-Manager-Retail-Branch-Server-4.1-2022-2328=1 - SUSE Manager Proxy 4.1: zypper in -t patch SUSE-SLE-Product-SUSE-Manager-Proxy-4.1-2022-2328=1 - SUSE Linux Enterprise Server for SAP 15-SP2: zypper in -t patch SUSE-SLE-Product-SLES_SAP-15-SP2-2022-2328=1 - SUSE Linux Enterprise Server 15-SP2-LTSS: zypper in -t patch SUSE-SLE-Product-SLES-15-SP2-LTSS-2022-2328=1 - SUSE Linux Enterprise Server 15-SP2-BCL: zypper in -t patch SUSE-SLE-Product-SLES-15-SP2-BCL-2022-2328=1 - SUSE Linux Enterprise Module for Basesystem 15-SP3: zypper in -t patch SUSE-SLE-Module-Basesystem-15-SP3-2022-2328=1 - SUSE Linux Enterprise Micro 5.2: zypper in -t patch SUSE-SUSE-MicroOS-5.2-2022-2328=1 - SUSE Linux Enterprise Micro 5.1: zypper in -t patch SUSE-SUSE-MicroOS-5.1-2022-2328=1 - SUSE Linux Enterprise High Performance Computing 15-SP2-LTSS: zypper in -t patch SUSE-SLE-Product-HPC-15-SP2-LTSS-2022-2328=1 - SUSE Linux Enterprise High Performance Computing 15-SP2-ESPOS: zypper in -t patch SUSE-SLE-Product-HPC-15-SP2-ESPOS-2022-2328=1 - SUSE Enterprise Storage 7: zypper in -t patch SUSE-Storage-7-2022-2328=1 Package List: - openSUSE Leap 15.3 (aarch64 ppc64le s390x x86_64): libopenssl-1_1-devel-1.1.1d-150200.11.51.1 libopenssl1_1-1.1.1d-150200.11.51.1 libopenssl1_1-debuginfo-1.1.1d-150200.11.51.1 libopenssl1_1-hmac-1.1.1d-150200.11.51.1 openssl-1_1-1.1.1d-150200.11.51.1 openssl-1_1-debuginfo-1.1.1d-150200.11.51.1 openssl-1_1-debugsource-1.1.1d-150200.11.51.1 - openSUSE Leap 15.3 (noarch): openssl-1_1-doc-1.1.1d-150200.11.51.1 - openSUSE Leap 15.3 (x86_64): libopenssl-1_1-devel-32bit-1.1.1d-150200.11.51.1 libopenssl1_1-32bit-1.1.1d-150200.11.51.1 libopenssl1_1-32bit-debuginfo-1.1.1d-150200.11.51.1 libopenssl1_1-hmac-32bit-1.1.1d-150200.11.51.1 - SUSE Manager Server 4.1 (ppc64le s390x x86_64): libopenssl-1_1-devel-1.1.1d-150200.11.51.1 libopenssl1_1-1.1.1d-150200.11.51.1 libopenssl1_1-debuginfo-1.1.1d-150200.11.51.1 libopenssl1_1-hmac-1.1.1d-150200.11.51.1 openssl-1_1-1.1.1d-150200.11.51.1 openssl-1_1-debuginfo-1.1.1d-150200.11.51.1 openssl-1_1-debugsource-1.1.1d-150200.11.51.1 - SUSE Manager Server 4.1 (x86_64): libopenssl1_1-32bit-1.1.1d-150200.11.51.1 libopenssl1_1-32bit-debuginfo-1.1.1d-150200.11.51.1 libopenssl1_1-hmac-32bit-1.1.1d-150200.11.51.1 - SUSE Manager Retail Branch Server 4.1 (x86_64): libopenssl-1_1-devel-1.1.1d-150200.11.51.1 libopenssl1_1-1.1.1d-150200.11.51.1 libopenssl1_1-32bit-1.1.1d-150200.11.51.1 libopenssl1_1-32bit-debuginfo-1.1.1d-150200.11.51.1 libopenssl1_1-debuginfo-1.1.1d-150200.11.51.1 libopenssl1_1-hmac-1.1.1d-150200.11.51.1 libopenssl1_1-hmac-32bit-1.1.1d-150200.11.51.1 openssl-1_1-1.1.1d-150200.11.51.1 openssl-1_1-debuginfo-1.1.1d-150200.11.51.1 openssl-1_1-debugsource-1.1.1d-150200.11.51.1 - SUSE Manager Proxy 4.1 (x86_64): libopenssl-1_1-devel-1.1.1d-150200.11.51.1 libopenssl1_1-1.1.1d-150200.11.51.1 libopenssl1_1-32bit-1.1.1d-150200.11.51.1 libopenssl1_1-32bit-debuginfo-1.1.1d-150200.11.51.1 libopenssl1_1-debuginfo-1.1.1d-150200.11.51.1 libopenssl1_1-hmac-1.1.1d-150200.11.51.1 libopenssl1_1-hmac-32bit-1.1.1d-150200.11.51.1 openssl-1_1-1.1.1d-150200.11.51.1 openssl-1_1-debuginfo-1.1.1d-150200.11.51.1 openssl-1_1-debugsource-1.1.1d-150200.11.51.1 - SUSE Linux Enterprise Server for SAP 15-SP2 (ppc64le x86_64): libopenssl-1_1-devel-1.1.1d-150200.11.51.1 libopenssl1_1-1.1.1d-150200.11.51.1 libopenssl1_1-debuginfo-1.1.1d-150200.11.51.1 libopenssl1_1-hmac-1.1.1d-150200.11.51.1 openssl-1_1-1.1.1d-150200.11.51.1 openssl-1_1-debuginfo-1.1.1d-150200.11.51.1 openssl-1_1-debugsource-1.1.1d-150200.11.51.1 - SUSE Linux Enterprise Server for SAP 15-SP2 (x86_64): libopenssl1_1-32bit-1.1.1d-150200.11.51.1 libopenssl1_1-32bit-debuginfo-1.1.1d-150200.11.51.1 libopenssl1_1-hmac-32bit-1.1.1d-150200.11.51.1 - SUSE Linux Enterprise Server 15-SP2-LTSS (aarch64 ppc64le s390x x86_64): libopenssl-1_1-devel-1.1.1d-150200.11.51.1 libopenssl1_1-1.1.1d-150200.11.51.1 libopenssl1_1-debuginfo-1.1.1d-150200.11.51.1 libopenssl1_1-hmac-1.1.1d-150200.11.51.1 openssl-1_1-1.1.1d-150200.11.51.1 openssl-1_1-debuginfo-1.1.1d-150200.11.51.1 openssl-1_1-debugsource-1.1.1d-150200.11.51.1 - SUSE Linux Enterprise Server 15-SP2-LTSS (x86_64): libopenssl1_1-32bit-1.1.1d-150200.11.51.1 libopenssl1_1-32bit-debuginfo-1.1.1d-150200.11.51.1 libopenssl1_1-hmac-32bit-1.1.1d-150200.11.51.1 - SUSE Linux Enterprise Server 15-SP2-BCL (x86_64): libopenssl-1_1-devel-1.1.1d-150200.11.51.1 libopenssl1_1-1.1.1d-150200.11.51.1 libopenssl1_1-32bit-1.1.1d-150200.11.51.1 libopenssl1_1-32bit-debuginfo-1.1.1d-150200.11.51.1 libopenssl1_1-debuginfo-1.1.1d-150200.11.51.1 libopenssl1_1-hmac-1.1.1d-150200.11.51.1 libopenssl1_1-hmac-32bit-1.1.1d-150200.11.51.1 openssl-1_1-1.1.1d-150200.11.51.1 openssl-1_1-debuginfo-1.1.1d-150200.11.51.1 openssl-1_1-debugsource-1.1.1d-150200.11.51.1 - SUSE Linux Enterprise Module for Basesystem 15-SP3 (aarch64 ppc64le s390x x86_64): libopenssl-1_1-devel-1.1.1d-150200.11.51.1 libopenssl1_1-1.1.1d-150200.11.51.1 libopenssl1_1-debuginfo-1.1.1d-150200.11.51.1 libopenssl1_1-hmac-1.1.1d-150200.11.51.1 openssl-1_1-1.1.1d-150200.11.51.1 openssl-1_1-debuginfo-1.1.1d-150200.11.51.1 openssl-1_1-debugsource-1.1.1d-150200.11.51.1 - SUSE Linux Enterprise Module for Basesystem 15-SP3 (x86_64): libopenssl1_1-32bit-1.1.1d-150200.11.51.1 libopenssl1_1-32bit-debuginfo-1.1.1d-150200.11.51.1 libopenssl1_1-hmac-32bit-1.1.1d-150200.11.51.1 - SUSE Linux Enterprise Micro 5.2 (aarch64 s390x x86_64): libopenssl-1_1-devel-1.1.1d-150200.11.51.1 libopenssl1_1-1.1.1d-150200.11.51.1 libopenssl1_1-debuginfo-1.1.1d-150200.11.51.1 libopenssl1_1-hmac-1.1.1d-150200.11.51.1 openssl-1_1-1.1.1d-150200.11.51.1 openssl-1_1-debuginfo-1.1.1d-150200.11.51.1 openssl-1_1-debugsource-1.1.1d-150200.11.51.1 - SUSE Linux Enterprise Micro 5.1 (aarch64 s390x x86_64): libopenssl-1_1-devel-1.1.1d-150200.11.51.1 libopenssl1_1-1.1.1d-150200.11.51.1 libopenssl1_1-debuginfo-1.1.1d-150200.11.51.1 libopenssl1_1-hmac-1.1.1d-150200.11.51.1 openssl-1_1-1.1.1d-150200.11.51.1 openssl-1_1-debuginfo-1.1.1d-150200.11.51.1 openssl-1_1-debugsource-1.1.1d-150200.11.51.1 - SUSE Linux Enterprise High Performance Computing 15-SP2-LTSS (aarch64 x86_64): libopenssl-1_1-devel-1.1.1d-150200.11.51.1 libopenssl1_1-1.1.1d-150200.11.51.1 libopenssl1_1-debuginfo-1.1.1d-150200.11.51.1 libopenssl1_1-hmac-1.1.1d-150200.11.51.1 openssl-1_1-1.1.1d-150200.11.51.1 openssl-1_1-debuginfo-1.1.1d-150200.11.51.1 openssl-1_1-debugsource-1.1.1d-150200.11.51.1 - SUSE Linux Enterprise High Performance Computing 15-SP2-LTSS (x86_64): libopenssl1_1-32bit-1.1.1d-150200.11.51.1 libopenssl1_1-32bit-debuginfo-1.1.1d-150200.11.51.1 libopenssl1_1-hmac-32bit-1.1.1d-150200.11.51.1 - SUSE Linux Enterprise High Performance Computing 15-SP2-ESPOS (aarch64 x86_64): libopenssl-1_1-devel-1.1.1d-150200.11.51.1 libopenssl1_1-1.1.1d-150200.11.51.1 libopenssl1_1-debuginfo-1.1.1d-150200.11.51.1 libopenssl1_1-hmac-1.1.1d-150200.11.51.1 openssl-1_1-1.1.1d-150200.11.51.1 openssl-1_1-debuginfo-1.1.1d-150200.11.51.1 openssl-1_1-debugsource-1.1.1d-150200.11.51.1 - SUSE Linux Enterprise High Performance Computing 15-SP2-ESPOS (x86_64): libopenssl1_1-32bit-1.1.1d-150200.11.51.1 libopenssl1_1-32bit-debuginfo-1.1.1d-150200.11.51.1 libopenssl1_1-hmac-32bit-1.1.1d-150200.11.51.1 - SUSE Enterprise Storage 7 (aarch64 x86_64): libopenssl-1_1-devel-1.1.1d-150200.11.51.1 libopenssl1_1-1.1.1d-150200.11.51.1 libopenssl1_1-debuginfo-1.1.1d-150200.11.51.1 libopenssl1_1-hmac-1.1.1d-150200.11.51.1 openssl-1_1-1.1.1d-150200.11.51.1 openssl-1_1-debuginfo-1.1.1d-150200.11.51.1 openssl-1_1-debugsource-1.1.1d-150200.11.51.1 - SUSE Enterprise Storage 7 (x86_64): libopenssl1_1-32bit-1.1.1d-150200.11.51.1 libopenssl1_1-32bit-debuginfo-1.1.1d-150200.11.51.1 libopenssl1_1-hmac-32bit-1.1.1d-150200.11.51.1 References: https://www.suse.com/security/cve/CVE-2022-2097.html https://bugzilla.suse.com/1201099

1 0

SUSE-SU-2022:2326-1: important: Security update for resource-agents
by opensuse-security＠opensuse.org 07 Jul '22

07 Jul '22

SUSE Security Update: Security update for resource-agents ______________________________________________________________________________ Announcement ID: SUSE-SU-2022:2326-1 Rating: important References: #1146691 #1196164 #1199766 Affected Products: SUSE Linux Enterprise High Availability 15-SP3 SUSE Linux Enterprise High Performance Computing 15-SP3 SUSE Linux Enterprise Server 15-SP3 SUSE Linux Enterprise Server for SAP Applications 15-SP3 SUSE Linux Enterprise Storage 7.1 SUSE Manager Proxy 4.2 SUSE Manager Retail Branch Server 4.2 SUSE Manager Server 4.2 openSUSE Leap 15.3 ______________________________________________________________________________ An update that contains security fixes can now be installed. Description: This update for resource-agents fixes the following issues: - Predictable log file in /tmp in mariadb.in (bsc#1146691). - Allow aws-vpc-move-ip to specify an interface label to distinguish the IP address (bsc#1199766) - Implement options to disable DAD and to allow sending NA in the background (bsc#1196164) Patch Instructions: To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 15.3: zypper in -t patch openSUSE-SLE-15.3-2022-2326=1 - SUSE Linux Enterprise High Availability 15-SP3: zypper in -t patch SUSE-SLE-Product-HA-15-SP3-2022-2326=1 Package List: - openSUSE Leap 15.3 (aarch64 ppc64le s390x x86_64): ldirectord-4.8.0+git30.d0077df0-150300.8.28.1 resource-agents-4.8.0+git30.d0077df0-150300.8.28.1 resource-agents-debuginfo-4.8.0+git30.d0077df0-150300.8.28.1 resource-agents-debugsource-4.8.0+git30.d0077df0-150300.8.28.1 - openSUSE Leap 15.3 (noarch): monitoring-plugins-metadata-4.8.0+git30.d0077df0-150300.8.28.1 - SUSE Linux Enterprise High Availability 15-SP3 (aarch64 ppc64le s390x x86_64): ldirectord-4.8.0+git30.d0077df0-150300.8.28.1 resource-agents-4.8.0+git30.d0077df0-150300.8.28.1 resource-agents-debuginfo-4.8.0+git30.d0077df0-150300.8.28.1 resource-agents-debugsource-4.8.0+git30.d0077df0-150300.8.28.1 - SUSE Linux Enterprise High Availability 15-SP3 (noarch): monitoring-plugins-metadata-4.8.0+git30.d0077df0-150300.8.28.1 References: https://bugzilla.suse.com/1146691 https://bugzilla.suse.com/1196164 https://bugzilla.suse.com/1199766

1 0

SUSE-SU-2022:2325-1: important: Security update for resource-agents
by opensuse-security＠opensuse.org 07 Jul '22

07 Jul '22

SUSE Security Update: Security update for resource-agents ______________________________________________________________________________ Announcement ID: SUSE-SU-2022:2325-1 Rating: important References: #1146691 #1196164 #1197956 #1199766 Affected Products: SUSE Linux Enterprise High Availability 15-SP4 SUSE Linux Enterprise High Performance Computing 15-SP4 SUSE Linux Enterprise Server 15-SP4 SUSE Linux Enterprise Server for SAP Applications 15-SP4 SUSE Manager Proxy 4.3 SUSE Manager Retail Branch Server 4.3 SUSE Manager Server 4.3 openSUSE Leap 15.4 ______________________________________________________________________________ An update that contains security fixes can now be installed. Description: This update for resource-agents fixes the following issues: - Fixed predictable log file in /tmp in mariadb.in (bsc#1146691). - Allow aws-vpc-move-ip to specify an interface label to distinguish the IP address (bsc#1199766) - Implement options to disable DAD and to allow sending NA in the background (bsc#1196164) - Imporove error message if monpassword was not set (bsc#1197956) Patch Instructions: To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 15.4: zypper in -t patch openSUSE-SLE-15.4-2022-2325=1 - SUSE Linux Enterprise High Availability 15-SP4: zypper in -t patch SUSE-SLE-Product-HA-15-SP4-2022-2325=1 Package List: - openSUSE Leap 15.4 (aarch64 ppc64le s390x x86_64): ldirectord-4.10.0+git40.0f4de473-150400.3.7.1 resource-agents-4.10.0+git40.0f4de473-150400.3.7.1 resource-agents-debuginfo-4.10.0+git40.0f4de473-150400.3.7.1 resource-agents-debugsource-4.10.0+git40.0f4de473-150400.3.7.1 - openSUSE Leap 15.4 (noarch): monitoring-plugins-metadata-4.10.0+git40.0f4de473-150400.3.7.1 - SUSE Linux Enterprise High Availability 15-SP4 (aarch64 ppc64le s390x x86_64): ldirectord-4.10.0+git40.0f4de473-150400.3.7.1 resource-agents-4.10.0+git40.0f4de473-150400.3.7.1 resource-agents-debuginfo-4.10.0+git40.0f4de473-150400.3.7.1 resource-agents-debugsource-4.10.0+git40.0f4de473-150400.3.7.1 - SUSE Linux Enterprise High Availability 15-SP4 (noarch): monitoring-plugins-metadata-4.10.0+git40.0f4de473-150400.3.7.1 References: https://bugzilla.suse.com/1146691 https://bugzilla.suse.com/1196164 https://bugzilla.suse.com/1197956 https://bugzilla.suse.com/1199766

1 0

SUSE-SU-2022:2322-1: important: Security update for fwupd
by opensuse-security＠opensuse.org 07 Jul '22

07 Jul '22

SUSE Security Update: Security update for fwupd ______________________________________________________________________________ Announcement ID: SUSE-SU-2022:2322-1 Rating: important References: #1198581 Affected Products: SUSE Linux Enterprise Desktop 15-SP3 SUSE Linux Enterprise Desktop 15-SP4 SUSE Linux Enterprise High Performance Computing 15-SP3 SUSE Linux Enterprise High Performance Computing 15-SP4 SUSE Linux Enterprise Module for Desktop Applications 15-SP3 SUSE Linux Enterprise Module for Desktop Applications 15-SP4 SUSE Linux Enterprise Server 15-SP3 SUSE Linux Enterprise Server 15-SP4 SUSE Linux Enterprise Server for SAP Applications 15-SP3 SUSE Linux Enterprise Server for SAP Applications 15-SP4 SUSE Linux Enterprise Storage 7.1 SUSE Manager Proxy 4.2 SUSE Manager Proxy 4.3 SUSE Manager Retail Branch Server 4.2 SUSE Manager Retail Branch Server 4.3 SUSE Manager Server 4.2 SUSE Manager Server 4.3 openSUSE Leap 15.3 openSUSE Leap 15.4 ______________________________________________________________________________ An update that contains security fixes can now be installed. Description: This update of fwupd fixes the following issue: - rebuild with new secure boot key due to grub2 boothole 3 issues (bsc#1198581) Patch Instructions: To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 15.4: zypper in -t patch openSUSE-SLE-15.4-2022-2322=1 - openSUSE Leap 15.3: zypper in -t patch openSUSE-SLE-15.3-2022-2322=1 - SUSE Linux Enterprise Module for Desktop Applications 15-SP4: zypper in -t patch SUSE-SLE-Module-Desktop-Applications-15-SP4-2022-2322=1 - SUSE Linux Enterprise Module for Desktop Applications 15-SP3: zypper in -t patch SUSE-SLE-Module-Desktop-Applications-15-SP3-2022-2322=1 Package List: - openSUSE Leap 15.4 (aarch64 ppc64le s390x x86_64): fwupdtpmevlog-1.5.8-150300.3.5.1 fwupdtpmevlog-debuginfo-1.5.8-150300.3.5.1 libfwupdplugin1-1.5.8-150300.3.5.1 libfwupdplugin1-debuginfo-1.5.8-150300.3.5.1 - openSUSE Leap 15.3 (aarch64 ppc64le s390x x86_64): dfu-tool-1.5.8-150300.3.5.1 dfu-tool-debuginfo-1.5.8-150300.3.5.1 fwupd-1.5.8-150300.3.5.1 fwupd-debuginfo-1.5.8-150300.3.5.1 fwupd-debugsource-1.5.8-150300.3.5.1 fwupd-devel-1.5.8-150300.3.5.1 fwupdtpmevlog-1.5.8-150300.3.5.1 fwupdtpmevlog-debuginfo-1.5.8-150300.3.5.1 libfwupd2-1.5.8-150300.3.5.1 libfwupd2-debuginfo-1.5.8-150300.3.5.1 libfwupdplugin1-1.5.8-150300.3.5.1 libfwupdplugin1-debuginfo-1.5.8-150300.3.5.1 typelib-1_0-Fwupd-2_0-1.5.8-150300.3.5.1 typelib-1_0-FwupdPlugin-1_0-1.5.8-150300.3.5.1 - openSUSE Leap 15.3 (noarch): fwupd-lang-1.5.8-150300.3.5.1 - SUSE Linux Enterprise Module for Desktop Applications 15-SP4 (aarch64 ppc64le s390x x86_64): fwupd-debuginfo-1.5.8-150300.3.5.1 fwupd-debugsource-1.5.8-150300.3.5.1 fwupdtpmevlog-1.5.8-150300.3.5.1 fwupdtpmevlog-debuginfo-1.5.8-150300.3.5.1 libfwupdplugin1-1.5.8-150300.3.5.1 libfwupdplugin1-debuginfo-1.5.8-150300.3.5.1 - SUSE Linux Enterprise Module for Desktop Applications 15-SP3 (aarch64 ppc64le s390x x86_64): fwupd-1.5.8-150300.3.5.1 fwupd-debuginfo-1.5.8-150300.3.5.1 fwupd-debugsource-1.5.8-150300.3.5.1 fwupd-devel-1.5.8-150300.3.5.1 fwupdtpmevlog-1.5.8-150300.3.5.1 fwupdtpmevlog-debuginfo-1.5.8-150300.3.5.1 libfwupd2-1.5.8-150300.3.5.1 libfwupd2-debuginfo-1.5.8-150300.3.5.1 libfwupdplugin1-1.5.8-150300.3.5.1 libfwupdplugin1-debuginfo-1.5.8-150300.3.5.1 typelib-1_0-Fwupd-2_0-1.5.8-150300.3.5.1 typelib-1_0-FwupdPlugin-1_0-1.5.8-150300.3.5.1 - SUSE Linux Enterprise Module for Desktop Applications 15-SP3 (noarch): fwupd-lang-1.5.8-150300.3.5.1 References: https://bugzilla.suse.com/1198581

1 0

SUSE-SU-2022:2321-1: moderate: Security update for openssl-1_0_0
by opensuse-security＠opensuse.org 07 Jul '22

07 Jul '22

SUSE Security Update: Security update for openssl-1_0_0 ______________________________________________________________________________ Announcement ID: SUSE-SU-2022:2321-1 Rating: moderate References: #1199166 #1200550 Cross-References: CVE-2022-1292 CVE-2022-2068 CVSS scores: CVE-2022-1292 (NVD) : 9.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H CVE-2022-1292 (SUSE): 6.7 CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H CVE-2022-2068 (NVD) : 9.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H CVE-2022-2068 (SUSE): 6.7 CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H Affected Products: SUSE CaaS Platform 4.0 SUSE Enterprise Storage 6 SUSE Enterprise Storage 7 SUSE Linux Enterprise High Performance Computing SUSE Linux Enterprise Module for Legacy Software 15-SP3 SUSE Linux Enterprise Module for Legacy Software 15-SP4 SUSE Linux Enterprise Server SUSE Linux Enterprise Server 15-LTSS SUSE Linux Enterprise Server 15-SP1-BCL SUSE Linux Enterprise Server 15-SP1-LTSS SUSE Linux Enterprise Server 15-SP2-LTSS SUSE Linux Enterprise Server for SAP 15 SUSE Linux Enterprise Server for SAP 15-SP1 SUSE Linux Enterprise Server for SAP 15-SP2 SUSE Linux Enterprise Server for SAP Applications SUSE Linux Enterprise Storage 7.1 SUSE Manager Proxy 4.1 SUSE Manager Proxy 4.2 SUSE Manager Proxy 4.3 SUSE Manager Retail Branch Server 4.1 SUSE Manager Retail Branch Server 4.2 SUSE Manager Retail Branch Server 4.3 SUSE Manager Server 4.1 SUSE Manager Server 4.2 SUSE Manager Server 4.3 openSUSE Leap 15.3 openSUSE Leap 15.4 ______________________________________________________________________________ An update that fixes two vulnerabilities is now available. Description: This update for openssl-1_0_0 fixes the following issues: - CVE-2022-1292: Fixed command injection in c_rehash (bsc#1199166). - CVE-2022-2068: Fixed more shell code injection issues in c_rehash. (bsc#1200550) Patch Instructions: To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 15.4: zypper in -t patch openSUSE-SLE-15.4-2022-2321=1 - openSUSE Leap 15.3: zypper in -t patch openSUSE-SLE-15.3-2022-2321=1 - SUSE Manager Server 4.1: zypper in -t patch SUSE-SLE-Product-SUSE-Manager-Server-4.1-2022-2321=1 - SUSE Manager Retail Branch Server 4.1: zypper in -t patch SUSE-SLE-Product-SUSE-Manager-Retail-Branch-Server-4.1-2022-2321=1 - SUSE Manager Proxy 4.1: zypper in -t patch SUSE-SLE-Product-SUSE-Manager-Proxy-4.1-2022-2321=1 - SUSE Linux Enterprise Server for SAP 15-SP2: zypper in -t patch SUSE-SLE-Product-SLES_SAP-15-SP2-2022-2321=1 - SUSE Linux Enterprise Server for SAP 15-SP1: zypper in -t patch SUSE-SLE-Product-SLES_SAP-15-SP1-2022-2321=1 - SUSE Linux Enterprise Server for SAP 15: zypper in -t patch SUSE-SLE-Product-SLES_SAP-15-2022-2321=1 - SUSE Linux Enterprise Server 15-SP2-LTSS: zypper in -t patch SUSE-SLE-Product-SLES-15-SP2-LTSS-2022-2321=1 - SUSE Linux Enterprise Server 15-SP1-LTSS: zypper in -t patch SUSE-SLE-Product-SLES-15-SP1-LTSS-2022-2321=1 - SUSE Linux Enterprise Server 15-SP1-BCL: zypper in -t patch SUSE-SLE-Product-SLES-15-SP1-BCL-2022-2321=1 - SUSE Linux Enterprise Server 15-LTSS: zypper in -t patch SUSE-SLE-Product-SLES-15-2022-2321=1 - SUSE Linux Enterprise Module for Legacy Software 15-SP4: zypper in -t patch SUSE-SLE-Module-Legacy-15-SP4-2022-2321=1 - SUSE Linux Enterprise Module for Legacy Software 15-SP3: zypper in -t patch SUSE-SLE-Module-Legacy-15-SP3-2022-2321=1 - SUSE Enterprise Storage 7: zypper in -t patch SUSE-Storage-7-2022-2321=1 - SUSE Enterprise Storage 6: zypper in -t patch SUSE-Storage-6-2022-2321=1 - SUSE CaaS Platform 4.0: To install this update, use the SUSE CaaS Platform 'skuba' tool. It will inform you if it detects new updates and let you then trigger updating of the complete cluster in a controlled way. Package List: - openSUSE Leap 15.4 (aarch64 ppc64le s390x x86_64): libopenssl-1_0_0-devel-1.0.2p-150000.3.56.1 libopenssl10-1.0.2p-150000.3.56.1 libopenssl10-debuginfo-1.0.2p-150000.3.56.1 libopenssl1_0_0-1.0.2p-150000.3.56.1 libopenssl1_0_0-debuginfo-1.0.2p-150000.3.56.1 libopenssl1_0_0-hmac-1.0.2p-150000.3.56.1 libopenssl1_0_0-steam-1.0.2p-150000.3.56.1 libopenssl1_0_0-steam-debuginfo-1.0.2p-150000.3.56.1 openssl-1_0_0-1.0.2p-150000.3.56.1 openssl-1_0_0-cavs-1.0.2p-150000.3.56.1 openssl-1_0_0-cavs-debuginfo-1.0.2p-150000.3.56.1 openssl-1_0_0-debuginfo-1.0.2p-150000.3.56.1 openssl-1_0_0-debugsource-1.0.2p-150000.3.56.1 - openSUSE Leap 15.4 (noarch): openssl-1_0_0-doc-1.0.2p-150000.3.56.1 - openSUSE Leap 15.4 (x86_64): libopenssl-1_0_0-devel-32bit-1.0.2p-150000.3.56.1 libopenssl1_0_0-32bit-1.0.2p-150000.3.56.1 libopenssl1_0_0-32bit-debuginfo-1.0.2p-150000.3.56.1 libopenssl1_0_0-hmac-32bit-1.0.2p-150000.3.56.1 libopenssl1_0_0-steam-32bit-1.0.2p-150000.3.56.1 libopenssl1_0_0-steam-32bit-debuginfo-1.0.2p-150000.3.56.1 - openSUSE Leap 15.3 (aarch64 ppc64le s390x x86_64): libopenssl-1_0_0-devel-1.0.2p-150000.3.56.1 libopenssl10-1.0.2p-150000.3.56.1 libopenssl10-debuginfo-1.0.2p-150000.3.56.1 libopenssl1_0_0-1.0.2p-150000.3.56.1 libopenssl1_0_0-debuginfo-1.0.2p-150000.3.56.1 libopenssl1_0_0-hmac-1.0.2p-150000.3.56.1 libopenssl1_0_0-steam-1.0.2p-150000.3.56.1 libopenssl1_0_0-steam-debuginfo-1.0.2p-150000.3.56.1 openssl-1_0_0-1.0.2p-150000.3.56.1 openssl-1_0_0-cavs-1.0.2p-150000.3.56.1 openssl-1_0_0-cavs-debuginfo-1.0.2p-150000.3.56.1 openssl-1_0_0-debuginfo-1.0.2p-150000.3.56.1 openssl-1_0_0-debugsource-1.0.2p-150000.3.56.1 - openSUSE Leap 15.3 (noarch): openssl-1_0_0-doc-1.0.2p-150000.3.56.1 - openSUSE Leap 15.3 (x86_64): libopenssl-1_0_0-devel-32bit-1.0.2p-150000.3.56.1 libopenssl1_0_0-32bit-1.0.2p-150000.3.56.1 libopenssl1_0_0-32bit-debuginfo-1.0.2p-150000.3.56.1 libopenssl1_0_0-hmac-32bit-1.0.2p-150000.3.56.1 libopenssl1_0_0-steam-32bit-1.0.2p-150000.3.56.1 libopenssl1_0_0-steam-32bit-debuginfo-1.0.2p-150000.3.56.1 - SUSE Manager Server 4.1 (ppc64le s390x x86_64): libopenssl-1_0_0-devel-1.0.2p-150000.3.56.1 libopenssl1_0_0-1.0.2p-150000.3.56.1 libopenssl1_0_0-debuginfo-1.0.2p-150000.3.56.1 openssl-1_0_0-1.0.2p-150000.3.56.1 openssl-1_0_0-debuginfo-1.0.2p-150000.3.56.1 openssl-1_0_0-debugsource-1.0.2p-150000.3.56.1 - SUSE Manager Retail Branch Server 4.1 (x86_64): libopenssl-1_0_0-devel-1.0.2p-150000.3.56.1 libopenssl1_0_0-1.0.2p-150000.3.56.1 libopenssl1_0_0-debuginfo-1.0.2p-150000.3.56.1 openssl-1_0_0-1.0.2p-150000.3.56.1 openssl-1_0_0-debuginfo-1.0.2p-150000.3.56.1 openssl-1_0_0-debugsource-1.0.2p-150000.3.56.1 - SUSE Manager Proxy 4.1 (x86_64): libopenssl-1_0_0-devel-1.0.2p-150000.3.56.1 libopenssl1_0_0-1.0.2p-150000.3.56.1 libopenssl1_0_0-debuginfo-1.0.2p-150000.3.56.1 openssl-1_0_0-1.0.2p-150000.3.56.1 openssl-1_0_0-debuginfo-1.0.2p-150000.3.56.1 openssl-1_0_0-debugsource-1.0.2p-150000.3.56.1 - SUSE Linux Enterprise Server for SAP 15-SP2 (ppc64le x86_64): libopenssl-1_0_0-devel-1.0.2p-150000.3.56.1 libopenssl1_0_0-1.0.2p-150000.3.56.1 libopenssl1_0_0-debuginfo-1.0.2p-150000.3.56.1 openssl-1_0_0-1.0.2p-150000.3.56.1 openssl-1_0_0-debuginfo-1.0.2p-150000.3.56.1 openssl-1_0_0-debugsource-1.0.2p-150000.3.56.1 - SUSE Linux Enterprise Server for SAP 15-SP1 (ppc64le x86_64): libopenssl-1_0_0-devel-1.0.2p-150000.3.56.1 libopenssl1_0_0-1.0.2p-150000.3.56.1 libopenssl1_0_0-debuginfo-1.0.2p-150000.3.56.1 openssl-1_0_0-1.0.2p-150000.3.56.1 openssl-1_0_0-debuginfo-1.0.2p-150000.3.56.1 openssl-1_0_0-debugsource-1.0.2p-150000.3.56.1 - SUSE Linux Enterprise Server for SAP 15 (ppc64le x86_64): libopenssl-1_0_0-devel-1.0.2p-150000.3.56.1 libopenssl1_0_0-1.0.2p-150000.3.56.1 libopenssl1_0_0-debuginfo-1.0.2p-150000.3.56.1 openssl-1_0_0-1.0.2p-150000.3.56.1 openssl-1_0_0-debuginfo-1.0.2p-150000.3.56.1 openssl-1_0_0-debugsource-1.0.2p-150000.3.56.1 - SUSE Linux Enterprise Server 15-SP2-LTSS (aarch64 ppc64le s390x x86_64): libopenssl-1_0_0-devel-1.0.2p-150000.3.56.1 libopenssl1_0_0-1.0.2p-150000.3.56.1 libopenssl1_0_0-debuginfo-1.0.2p-150000.3.56.1 openssl-1_0_0-1.0.2p-150000.3.56.1 openssl-1_0_0-debuginfo-1.0.2p-150000.3.56.1 openssl-1_0_0-debugsource-1.0.2p-150000.3.56.1 - SUSE Linux Enterprise Server 15-SP1-LTSS (aarch64 ppc64le s390x x86_64): libopenssl-1_0_0-devel-1.0.2p-150000.3.56.1 libopenssl1_0_0-1.0.2p-150000.3.56.1 libopenssl1_0_0-debuginfo-1.0.2p-150000.3.56.1 openssl-1_0_0-1.0.2p-150000.3.56.1 openssl-1_0_0-debuginfo-1.0.2p-150000.3.56.1 openssl-1_0_0-debugsource-1.0.2p-150000.3.56.1 - SUSE Linux Enterprise Server 15-SP1-BCL (x86_64): libopenssl-1_0_0-devel-1.0.2p-150000.3.56.1 libopenssl1_0_0-1.0.2p-150000.3.56.1 libopenssl1_0_0-debuginfo-1.0.2p-150000.3.56.1 openssl-1_0_0-1.0.2p-150000.3.56.1 openssl-1_0_0-debuginfo-1.0.2p-150000.3.56.1 openssl-1_0_0-debugsource-1.0.2p-150000.3.56.1 - SUSE Linux Enterprise Server 15-LTSS (aarch64 s390x): libopenssl-1_0_0-devel-1.0.2p-150000.3.56.1 libopenssl1_0_0-1.0.2p-150000.3.56.1 libopenssl1_0_0-debuginfo-1.0.2p-150000.3.56.1 openssl-1_0_0-1.0.2p-150000.3.56.1 openssl-1_0_0-debuginfo-1.0.2p-150000.3.56.1 openssl-1_0_0-debugsource-1.0.2p-150000.3.56.1 - SUSE Linux Enterprise Module for Legacy Software 15-SP4 (aarch64 ppc64le s390x x86_64): libopenssl-1_0_0-devel-1.0.2p-150000.3.56.1 libopenssl10-1.0.2p-150000.3.56.1 libopenssl10-debuginfo-1.0.2p-150000.3.56.1 libopenssl1_0_0-1.0.2p-150000.3.56.1 libopenssl1_0_0-debuginfo-1.0.2p-150000.3.56.1 openssl-1_0_0-1.0.2p-150000.3.56.1 openssl-1_0_0-debuginfo-1.0.2p-150000.3.56.1 openssl-1_0_0-debugsource-1.0.2p-150000.3.56.1 - SUSE Linux Enterprise Module for Legacy Software 15-SP3 (aarch64 ppc64le s390x x86_64): libopenssl-1_0_0-devel-1.0.2p-150000.3.56.1 libopenssl10-1.0.2p-150000.3.56.1 libopenssl10-debuginfo-1.0.2p-150000.3.56.1 libopenssl1_0_0-1.0.2p-150000.3.56.1 libopenssl1_0_0-debuginfo-1.0.2p-150000.3.56.1 openssl-1_0_0-1.0.2p-150000.3.56.1 openssl-1_0_0-debuginfo-1.0.2p-150000.3.56.1 openssl-1_0_0-debugsource-1.0.2p-150000.3.56.1 - SUSE Enterprise Storage 7 (aarch64 x86_64): libopenssl-1_0_0-devel-1.0.2p-150000.3.56.1 libopenssl1_0_0-1.0.2p-150000.3.56.1 libopenssl1_0_0-debuginfo-1.0.2p-150000.3.56.1 openssl-1_0_0-1.0.2p-150000.3.56.1 openssl-1_0_0-debuginfo-1.0.2p-150000.3.56.1 openssl-1_0_0-debugsource-1.0.2p-150000.3.56.1 - SUSE Enterprise Storage 6 (aarch64 x86_64): libopenssl-1_0_0-devel-1.0.2p-150000.3.56.1 libopenssl1_0_0-1.0.2p-150000.3.56.1 libopenssl1_0_0-debuginfo-1.0.2p-150000.3.56.1 openssl-1_0_0-1.0.2p-150000.3.56.1 openssl-1_0_0-debuginfo-1.0.2p-150000.3.56.1 openssl-1_0_0-debugsource-1.0.2p-150000.3.56.1 - SUSE CaaS Platform 4.0 (x86_64): libopenssl-1_0_0-devel-1.0.2p-150000.3.56.1 libopenssl1_0_0-1.0.2p-150000.3.56.1 libopenssl1_0_0-debuginfo-1.0.2p-150000.3.56.1 openssl-1_0_0-1.0.2p-150000.3.56.1 openssl-1_0_0-debuginfo-1.0.2p-150000.3.56.1 openssl-1_0_0-debugsource-1.0.2p-150000.3.56.1 References: https://www.suse.com/security/cve/CVE-2022-1292.html https://www.suse.com/security/cve/CVE-2022-2068.html https://bugzilla.suse.com/1199166 https://bugzilla.suse.com/1200550

1 0

SUSE-SU-2022:2320-1: important: Security update for MozillaThunderbird
by opensuse-security＠opensuse.org 07 Jul '22

07 Jul '22

SUSE Security Update: Security update for MozillaThunderbird ______________________________________________________________________________ Announcement ID: SUSE-SU-2022:2320-1 Rating: important References: #1200793 Cross-References: CVE-2022-2200 CVE-2022-2226 CVE-2022-31744 CVE-2022-34468 CVE-2022-34470 CVE-2022-34472 CVE-2022-34478 CVE-2022-34479 CVE-2022-34481 CVE-2022-34484 Affected Products: SUSE Linux Enterprise Desktop 15-SP3 SUSE Linux Enterprise Desktop 15-SP4 SUSE Linux Enterprise High Performance Computing 15-SP3 SUSE Linux Enterprise High Performance Computing 15-SP4 SUSE Linux Enterprise Module for Packagehub Subpackages 15-SP3 SUSE Linux Enterprise Module for Packagehub Subpackages 15-SP4 SUSE Linux Enterprise Server 15-SP3 SUSE Linux Enterprise Server 15-SP4 SUSE Linux Enterprise Server for SAP Applications 15-SP3 SUSE Linux Enterprise Server for SAP Applications 15-SP4 SUSE Linux Enterprise Storage 7.1 SUSE Linux Enterprise Workstation Extension 15-SP3 SUSE Linux Enterprise Workstation Extension 15-SP4 SUSE Manager Proxy 4.2 SUSE Manager Proxy 4.3 SUSE Manager Retail Branch Server 4.2 SUSE Manager Retail Branch Server 4.3 SUSE Manager Server 4.2 SUSE Manager Server 4.3 openSUSE Leap 15.3 openSUSE Leap 15.4 ______________________________________________________________________________ An update that fixes 10 vulnerabilities is now available. Description: This update for MozillaThunderbird fixes the following issues: - CVE-2022-2200: Undesired attributes could be set as part of prototype pollution (bmo#1771381) - CVE-2022-2226: An email with a mismatching OpenPGP signature date was accepted as valid (bmo#1775441) - CVE-2022-31744: CSP bypass enabling stylesheet injection (bmo#1757604) - CVE-2022-34468: CSP sandbox header without `allow-scripts` can be bypassed via retargeted javascript: URI (bmo#1768537) - CVE-2022-34470: Use-after-free in nsSHistory (bmo#1765951) - CVE-2022-34472: Unavailable PAC file resulted in OCSP requests being blocked (bmo#1770123) - CVE-2022-34478: Microsoft protocols can be attacked if a user accepts a prompt (bmo#1773717) - CVE-2022-34479: A popup window could be resized in a way to overlay the address bar with web content (bmo#1745595) - CVE-2022-34481: Potential integer overflow in ReplaceElementsAt (bmo#1497246) - CVE-2022-34484: Memory safety bugs fixed in Thunderbird 91.11 and Thunderbird 102 (bmo#1763634, bmo#1772651) Patch Instructions: To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 15.4: zypper in -t patch openSUSE-SLE-15.4-2022-2320=1 - openSUSE Leap 15.3: zypper in -t patch openSUSE-SLE-15.3-2022-2320=1 - SUSE Linux Enterprise Workstation Extension 15-SP4: zypper in -t patch SUSE-SLE-Product-WE-15-SP4-2022-2320=1 - SUSE Linux Enterprise Workstation Extension 15-SP3: zypper in -t patch SUSE-SLE-Product-WE-15-SP3-2022-2320=1 - SUSE Linux Enterprise Module for Packagehub Subpackages 15-SP4: zypper in -t patch SUSE-SLE-Module-Packagehub-Subpackages-15-SP4-2022-2320=1 - SUSE Linux Enterprise Module for Packagehub Subpackages 15-SP3: zypper in -t patch SUSE-SLE-Module-Packagehub-Subpackages-15-SP3-2022-2320=1 Package List: - openSUSE Leap 15.4 (aarch64 ppc64le s390x x86_64): MozillaThunderbird-91.11.0-150200.8.76.1 MozillaThunderbird-debuginfo-91.11.0-150200.8.76.1 MozillaThunderbird-debugsource-91.11.0-150200.8.76.1 MozillaThunderbird-translations-common-91.11.0-150200.8.76.1 MozillaThunderbird-translations-other-91.11.0-150200.8.76.1 - openSUSE Leap 15.3 (aarch64 ppc64le s390x x86_64): MozillaThunderbird-91.11.0-150200.8.76.1 MozillaThunderbird-debuginfo-91.11.0-150200.8.76.1 MozillaThunderbird-debugsource-91.11.0-150200.8.76.1 MozillaThunderbird-translations-common-91.11.0-150200.8.76.1 MozillaThunderbird-translations-other-91.11.0-150200.8.76.1 - SUSE Linux Enterprise Workstation Extension 15-SP4 (x86_64): MozillaThunderbird-91.11.0-150200.8.76.1 MozillaThunderbird-debuginfo-91.11.0-150200.8.76.1 MozillaThunderbird-debugsource-91.11.0-150200.8.76.1 MozillaThunderbird-translations-common-91.11.0-150200.8.76.1 MozillaThunderbird-translations-other-91.11.0-150200.8.76.1 - SUSE Linux Enterprise Workstation Extension 15-SP3 (x86_64): MozillaThunderbird-91.11.0-150200.8.76.1 MozillaThunderbird-debuginfo-91.11.0-150200.8.76.1 MozillaThunderbird-debugsource-91.11.0-150200.8.76.1 MozillaThunderbird-translations-common-91.11.0-150200.8.76.1 MozillaThunderbird-translations-other-91.11.0-150200.8.76.1 - SUSE Linux Enterprise Module for Packagehub Subpackages 15-SP4 (aarch64 ppc64le s390x): MozillaThunderbird-91.11.0-150200.8.76.1 MozillaThunderbird-debuginfo-91.11.0-150200.8.76.1 MozillaThunderbird-debugsource-91.11.0-150200.8.76.1 MozillaThunderbird-translations-common-91.11.0-150200.8.76.1 MozillaThunderbird-translations-other-91.11.0-150200.8.76.1 - SUSE Linux Enterprise Module for Packagehub Subpackages 15-SP3 (aarch64 ppc64le s390x): MozillaThunderbird-91.11.0-150200.8.76.1 MozillaThunderbird-debuginfo-91.11.0-150200.8.76.1 MozillaThunderbird-debugsource-91.11.0-150200.8.76.1 MozillaThunderbird-translations-common-91.11.0-150200.8.76.1 MozillaThunderbird-translations-other-91.11.0-150200.8.76.1 References: https://www.suse.com/security/cve/CVE-2022-2200.html https://www.suse.com/security/cve/CVE-2022-2226.html https://www.suse.com/security/cve/CVE-2022-31744.html https://www.suse.com/security/cve/CVE-2022-34468.html https://www.suse.com/security/cve/CVE-2022-34470.html https://www.suse.com/security/cve/CVE-2022-34472.html https://www.suse.com/security/cve/CVE-2022-34478.html https://www.suse.com/security/cve/CVE-2022-34479.html https://www.suse.com/security/cve/CVE-2022-34481.html https://www.suse.com/security/cve/CVE-2022-34484.html https://bugzilla.suse.com/1200793

1 0

SUSE-SU-2022:2313-1: important: Security update for MozillaFirefox
by opensuse-security＠opensuse.org 07 Jul '22

07 Jul '22

SUSE Security Update: Security update for MozillaFirefox ______________________________________________________________________________ Announcement ID: SUSE-SU-2022:2313-1 Rating: important References: #1200793 Cross-References: CVE-2022-2200 CVE-2022-31744 CVE-2022-34468 CVE-2022-34470 CVE-2022-34472 CVE-2022-34478 CVE-2022-34479 CVE-2022-34481 CVE-2022-34484 Affected Products: SUSE Enterprise Storage 7 SUSE Linux Enterprise Desktop 15-SP3 SUSE Linux Enterprise Desktop 15-SP4 SUSE Linux Enterprise High Performance Computing 15-SP2-ESPOS SUSE Linux Enterprise High Performance Computing 15-SP2-LTSS SUSE Linux Enterprise High Performance Computing 15-SP3 SUSE Linux Enterprise High Performance Computing 15-SP4 SUSE Linux Enterprise Module for Desktop Applications 15-SP3 SUSE Linux Enterprise Module for Desktop Applications 15-SP4 SUSE Linux Enterprise Server 15-SP2-BCL SUSE Linux Enterprise Server 15-SP2-LTSS SUSE Linux Enterprise Server 15-SP3 SUSE Linux Enterprise Server 15-SP4 SUSE Linux Enterprise Server for SAP 15-SP2 SUSE Linux Enterprise Server for SAP Applications 15-SP3 SUSE Linux Enterprise Server for SAP Applications 15-SP4 SUSE Linux Enterprise Storage 7.1 SUSE Manager Proxy 4.1 SUSE Manager Proxy 4.2 SUSE Manager Proxy 4.3 SUSE Manager Retail Branch Server 4.1 SUSE Manager Retail Branch Server 4.2 SUSE Manager Retail Branch Server 4.3 SUSE Manager Server 4.1 SUSE Manager Server 4.2 SUSE Manager Server 4.3 openSUSE Leap 15.3 openSUSE Leap 15.4 ______________________________________________________________________________ An update that fixes 9 vulnerabilities is now available. Description: This update for MozillaFirefox fixes the following issues: Update to Firefox Extended Support Release 91.11.0 ESR (MFSA 2022-25) (bsc#1200793): - CVE-2022-2200: Undesired attributes could be set as part of prototype pollution (bmo#1771381) - CVE-2022-31744: CSP bypass enabling stylesheet injection (bmo#1757604) - CVE-2022-34468: CSP sandbox header without `allow-scripts` can be bypassed via retargeted javascript: URI (bmo#1768537) - CVE-2022-34470: Use-after-free in nsSHistory (bmo#1765951) - CVE-2022-34472: Unavailable PAC file resulted in OCSP requests being blocked (bmo#1770123) - CVE-2022-34478: Microsoft protocols can be attacked if a user accepts a prompt (bmo#1773717) - CVE-2022-34479: A popup window could be resized in a way to overlay the address bar with web content (bmo#1745595) - CVE-2022-34481: Potential integer overflow in ReplaceElementsAt (bmo#1497246) - CVE-2022-34484: Memory safety bugs fixed in Firefox 102 and Firefox ESR 91.11 (bmo#1763634, bmo#1772651) Patch Instructions: To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 15.4: zypper in -t patch openSUSE-SLE-15.4-2022-2313=1 - openSUSE Leap 15.3: zypper in -t patch openSUSE-SLE-15.3-2022-2313=1 - SUSE Manager Server 4.1: zypper in -t patch SUSE-SLE-Product-SUSE-Manager-Server-4.1-2022-2313=1 - SUSE Manager Retail Branch Server 4.1: zypper in -t patch SUSE-SLE-Product-SUSE-Manager-Retail-Branch-Server-4.1-2022-2313=1 - SUSE Manager Proxy 4.1: zypper in -t patch SUSE-SLE-Product-SUSE-Manager-Proxy-4.1-2022-2313=1 - SUSE Linux Enterprise Server for SAP 15-SP2: zypper in -t patch SUSE-SLE-Product-SLES_SAP-15-SP2-2022-2313=1 - SUSE Linux Enterprise Server 15-SP2-LTSS: zypper in -t patch SUSE-SLE-Product-SLES-15-SP2-LTSS-2022-2313=1 - SUSE Linux Enterprise Server 15-SP2-BCL: zypper in -t patch SUSE-SLE-Product-SLES-15-SP2-BCL-2022-2313=1 - SUSE Linux Enterprise Module for Desktop Applications 15-SP4: zypper in -t patch SUSE-SLE-Module-Desktop-Applications-15-SP4-2022-2313=1 - SUSE Linux Enterprise Module for Desktop Applications 15-SP3: zypper in -t patch SUSE-SLE-Module-Desktop-Applications-15-SP3-2022-2313=1 - SUSE Linux Enterprise High Performance Computing 15-SP2-LTSS: zypper in -t patch SUSE-SLE-Product-HPC-15-SP2-LTSS-2022-2313=1 - SUSE Linux Enterprise High Performance Computing 15-SP2-ESPOS: zypper in -t patch SUSE-SLE-Product-HPC-15-SP2-ESPOS-2022-2313=1 - SUSE Enterprise Storage 7: zypper in -t patch SUSE-Storage-7-2022-2313=1 Package List: - openSUSE Leap 15.4 (aarch64 ppc64le s390x x86_64): MozillaFirefox-91.11.0-150200.152.48.1 MozillaFirefox-branding-upstream-91.11.0-150200.152.48.1 MozillaFirefox-debuginfo-91.11.0-150200.152.48.1 MozillaFirefox-debugsource-91.11.0-150200.152.48.1 MozillaFirefox-devel-91.11.0-150200.152.48.1 MozillaFirefox-translations-common-91.11.0-150200.152.48.1 MozillaFirefox-translations-other-91.11.0-150200.152.48.1 - openSUSE Leap 15.3 (aarch64 ppc64le s390x x86_64): MozillaFirefox-91.11.0-150200.152.48.1 MozillaFirefox-branding-upstream-91.11.0-150200.152.48.1 MozillaFirefox-debuginfo-91.11.0-150200.152.48.1 MozillaFirefox-debugsource-91.11.0-150200.152.48.1 MozillaFirefox-devel-91.11.0-150200.152.48.1 MozillaFirefox-translations-common-91.11.0-150200.152.48.1 MozillaFirefox-translations-other-91.11.0-150200.152.48.1 - SUSE Manager Server 4.1 (ppc64le s390x x86_64): MozillaFirefox-91.11.0-150200.152.48.1 MozillaFirefox-debuginfo-91.11.0-150200.152.48.1 MozillaFirefox-debugsource-91.11.0-150200.152.48.1 MozillaFirefox-devel-91.11.0-150200.152.48.1 MozillaFirefox-translations-common-91.11.0-150200.152.48.1 MozillaFirefox-translations-other-91.11.0-150200.152.48.1 - SUSE Manager Retail Branch Server 4.1 (x86_64): MozillaFirefox-91.11.0-150200.152.48.1 MozillaFirefox-debuginfo-91.11.0-150200.152.48.1 MozillaFirefox-debugsource-91.11.0-150200.152.48.1 MozillaFirefox-devel-91.11.0-150200.152.48.1 MozillaFirefox-translations-common-91.11.0-150200.152.48.1 MozillaFirefox-translations-other-91.11.0-150200.152.48.1 - SUSE Manager Proxy 4.1 (x86_64): MozillaFirefox-91.11.0-150200.152.48.1 MozillaFirefox-debuginfo-91.11.0-150200.152.48.1 MozillaFirefox-debugsource-91.11.0-150200.152.48.1 MozillaFirefox-devel-91.11.0-150200.152.48.1 MozillaFirefox-translations-common-91.11.0-150200.152.48.1 MozillaFirefox-translations-other-91.11.0-150200.152.48.1 - SUSE Linux Enterprise Server for SAP 15-SP2 (ppc64le x86_64): MozillaFirefox-91.11.0-150200.152.48.1 MozillaFirefox-debuginfo-91.11.0-150200.152.48.1 MozillaFirefox-debugsource-91.11.0-150200.152.48.1 MozillaFirefox-devel-91.11.0-150200.152.48.1 MozillaFirefox-translations-common-91.11.0-150200.152.48.1 MozillaFirefox-translations-other-91.11.0-150200.152.48.1 - SUSE Linux Enterprise Server 15-SP2-LTSS (aarch64 ppc64le s390x x86_64): MozillaFirefox-91.11.0-150200.152.48.1 MozillaFirefox-debuginfo-91.11.0-150200.152.48.1 MozillaFirefox-debugsource-91.11.0-150200.152.48.1 MozillaFirefox-devel-91.11.0-150200.152.48.1 MozillaFirefox-translations-common-91.11.0-150200.152.48.1 MozillaFirefox-translations-other-91.11.0-150200.152.48.1 - SUSE Linux Enterprise Server 15-SP2-BCL (x86_64): MozillaFirefox-91.11.0-150200.152.48.1 MozillaFirefox-debuginfo-91.11.0-150200.152.48.1 MozillaFirefox-debugsource-91.11.0-150200.152.48.1 MozillaFirefox-devel-91.11.0-150200.152.48.1 MozillaFirefox-translations-common-91.11.0-150200.152.48.1 MozillaFirefox-translations-other-91.11.0-150200.152.48.1 - SUSE Linux Enterprise Module for Desktop Applications 15-SP4 (aarch64 ppc64le s390x x86_64): MozillaFirefox-91.11.0-150200.152.48.1 MozillaFirefox-debuginfo-91.11.0-150200.152.48.1 MozillaFirefox-debugsource-91.11.0-150200.152.48.1 MozillaFirefox-translations-common-91.11.0-150200.152.48.1 MozillaFirefox-translations-other-91.11.0-150200.152.48.1 - SUSE Linux Enterprise Module for Desktop Applications 15-SP4 (aarch64 ppc64le x86_64): MozillaFirefox-devel-91.11.0-150200.152.48.1 - SUSE Linux Enterprise Module for Desktop Applications 15-SP3 (aarch64 ppc64le s390x x86_64): MozillaFirefox-91.11.0-150200.152.48.1 MozillaFirefox-debuginfo-91.11.0-150200.152.48.1 MozillaFirefox-debugsource-91.11.0-150200.152.48.1 MozillaFirefox-translations-common-91.11.0-150200.152.48.1 MozillaFirefox-translations-other-91.11.0-150200.152.48.1 - SUSE Linux Enterprise Module for Desktop Applications 15-SP3 (aarch64 ppc64le x86_64): MozillaFirefox-devel-91.11.0-150200.152.48.1 - SUSE Linux Enterprise High Performance Computing 15-SP2-LTSS (aarch64 x86_64): MozillaFirefox-91.11.0-150200.152.48.1 MozillaFirefox-debuginfo-91.11.0-150200.152.48.1 MozillaFirefox-debugsource-91.11.0-150200.152.48.1 MozillaFirefox-devel-91.11.0-150200.152.48.1 MozillaFirefox-translations-common-91.11.0-150200.152.48.1 MozillaFirefox-translations-other-91.11.0-150200.152.48.1 - SUSE Linux Enterprise High Performance Computing 15-SP2-ESPOS (aarch64 x86_64): MozillaFirefox-91.11.0-150200.152.48.1 MozillaFirefox-debuginfo-91.11.0-150200.152.48.1 MozillaFirefox-debugsource-91.11.0-150200.152.48.1 MozillaFirefox-devel-91.11.0-150200.152.48.1 MozillaFirefox-translations-common-91.11.0-150200.152.48.1 MozillaFirefox-translations-other-91.11.0-150200.152.48.1 - SUSE Enterprise Storage 7 (aarch64 x86_64): MozillaFirefox-91.11.0-150200.152.48.1 MozillaFirefox-debuginfo-91.11.0-150200.152.48.1 MozillaFirefox-debugsource-91.11.0-150200.152.48.1 MozillaFirefox-devel-91.11.0-150200.152.48.1 MozillaFirefox-translations-common-91.11.0-150200.152.48.1 MozillaFirefox-translations-other-91.11.0-150200.152.48.1 References: https://www.suse.com/security/cve/CVE-2022-2200.html https://www.suse.com/security/cve/CVE-2022-31744.html https://www.suse.com/security/cve/CVE-2022-34468.html https://www.suse.com/security/cve/CVE-2022-34470.html https://www.suse.com/security/cve/CVE-2022-34472.html https://www.suse.com/security/cve/CVE-2022-34478.html https://www.suse.com/security/cve/CVE-2022-34479.html https://www.suse.com/security/cve/CVE-2022-34481.html https://www.suse.com/security/cve/CVE-2022-34484.html https://bugzilla.suse.com/1200793

1 0

SUSE-SU-2022:2298-1: important: Security update for liblouis
by opensuse-security＠opensuse.org 06 Jul '22

06 Jul '22

SUSE Security Update: Security update for liblouis ______________________________________________________________________________ Announcement ID: SUSE-SU-2022:2298-1 Rating: important References: #1197085 #1200120 Cross-References: CVE-2022-26981 CVE-2022-31783 CVSS scores: CVE-2022-26981 (NVD) : 7.8 CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H CVE-2022-26981 (SUSE): 7.1 CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:H CVE-2022-31783 (NVD) : 5.5 CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H CVE-2022-31783 (SUSE): 6.1 CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:H Affected Products: SUSE Linux Enterprise Desktop 15-SP4 SUSE Linux Enterprise High Performance Computing 15-SP4 SUSE Linux Enterprise Module for Desktop Applications 15-SP4 SUSE Linux Enterprise Server 15-SP4 SUSE Linux Enterprise Server for SAP Applications 15-SP4 openSUSE Leap 15.4 ______________________________________________________________________________ An update that fixes two vulnerabilities is now available. Description: This update for liblouis fixes the following issues: - CVE-2022-26981: fix buffer overrun in compilePassOpcode (bsc#1197085). - CVE-2022-31783: prevent an invalid memory write in compileRule (bsc#1200120). Patch Instructions: To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 15.4: zypper in -t patch openSUSE-SLE-15.4-2022-2298=1 - SUSE Linux Enterprise Module for Desktop Applications 15-SP4: zypper in -t patch SUSE-SLE-Module-Desktop-Applications-15-SP4-2022-2298=1 Package List: - openSUSE Leap 15.4 (aarch64 ppc64le s390x x86_64): liblouis-debuginfo-3.20.0-150400.3.3.1 liblouis-debugsource-3.20.0-150400.3.3.1 liblouis-devel-3.20.0-150400.3.3.1 liblouis-doc-3.20.0-150400.3.3.1 liblouis-tools-3.20.0-150400.3.3.1 liblouis-tools-debuginfo-3.20.0-150400.3.3.1 liblouis20-3.20.0-150400.3.3.1 liblouis20-debuginfo-3.20.0-150400.3.3.1 python3-louis-3.20.0-150400.3.3.1 - openSUSE Leap 15.4 (noarch): liblouis-data-3.20.0-150400.3.3.1 - SUSE Linux Enterprise Module for Desktop Applications 15-SP4 (aarch64 ppc64le s390x x86_64): liblouis-debuginfo-3.20.0-150400.3.3.1 liblouis-debugsource-3.20.0-150400.3.3.1 liblouis-devel-3.20.0-150400.3.3.1 liblouis20-3.20.0-150400.3.3.1 liblouis20-debuginfo-3.20.0-150400.3.3.1 python3-louis-3.20.0-150400.3.3.1 - SUSE Linux Enterprise Module for Desktop Applications 15-SP4 (noarch): liblouis-data-3.20.0-150400.3.3.1 References: https://www.suse.com/security/cve/CVE-2022-26981.html https://www.suse.com/security/cve/CVE-2022-31783.html https://bugzilla.suse.com/1197085 https://bugzilla.suse.com/1200120

1 0

SUSE-SU-2022:2306-1: important: Security update for openssl-3
by opensuse-security＠opensuse.org 06 Jul '22

06 Jul '22

SUSE Security Update: Security update for openssl-3 ______________________________________________________________________________ Announcement ID: SUSE-SU-2022:2306-1 Rating: important References: #1185637 #1199166 #1199167 #1199168 #1199169 #1200550 #1201099 Cross-References: CVE-2022-1292 CVE-2022-1343 CVE-2022-1434 CVE-2022-1473 CVE-2022-2068 CVE-2022-2097 CVSS scores: CVE-2022-1292 (NVD) : 9.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H CVE-2022-1292 (SUSE): 6.7 CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H CVE-2022-1343 (NVD) : 5.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N CVE-2022-1343 (SUSE): 6.1 CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:L/I:H/A:N CVE-2022-1434 (NVD) : 5.9 CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:N CVE-2022-1434 (SUSE): 8.8 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H CVE-2022-1473 (NVD) : 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H CVE-2022-1473 (SUSE): 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H CVE-2022-2068 (NVD) : 9.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H CVE-2022-2068 (SUSE): 6.7 CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H CVE-2022-2097 (SUSE): 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N Affected Products: SUSE Linux Enterprise Desktop 15-SP4 SUSE Linux Enterprise High Performance Computing 15-SP4 SUSE Linux Enterprise Module for Basesystem 15-SP4 SUSE Linux Enterprise Server 15-SP4 SUSE Linux Enterprise Server for SAP Applications 15-SP4 openSUSE Leap 15.4 ______________________________________________________________________________ An update that solves 6 vulnerabilities and has one errata is now available. Description: This update for openssl-3 fixes the following issues: - CVE-2022-2068: Fixed more shell code injection issues in c_rehash. (bsc#1200550) - CVE-2022-1292: Properly sanitise shell metacharacters in c_rehash script. (bsc#1199166) - CVE-2022-1343: Fixed incorrect signature verification in OCSP_basic_verify (bsc#1199167). - CVE-2022-2097: Fixed partial missing encryption in AES OCB mode (bsc#1201099). - CVE-2022-1434: Fixed incorrect MAC key used in the RC4-MD5 ciphersuite (bsc#1199168). - CVE-2022-1473: Fixed resource leakage when decoding certificates and keys (bsc#1199169). Patch Instructions: To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 15.4: zypper in -t patch openSUSE-SLE-15.4-2022-2306=1 - SUSE Linux Enterprise Module for Basesystem 15-SP4: zypper in -t patch SUSE-SLE-Module-Basesystem-15-SP4-2022-2306=1 Package List: - openSUSE Leap 15.4 (aarch64 ppc64le s390x x86_64): libopenssl-3-devel-3.0.1-150400.4.7.1 libopenssl3-3.0.1-150400.4.7.1 libopenssl3-debuginfo-3.0.1-150400.4.7.1 openssl-3-3.0.1-150400.4.7.1 openssl-3-debuginfo-3.0.1-150400.4.7.1 openssl-3-debugsource-3.0.1-150400.4.7.1 - openSUSE Leap 15.4 (noarch): openssl-3-doc-3.0.1-150400.4.7.1 - openSUSE Leap 15.4 (x86_64): libopenssl-3-devel-32bit-3.0.1-150400.4.7.1 libopenssl3-32bit-3.0.1-150400.4.7.1 libopenssl3-32bit-debuginfo-3.0.1-150400.4.7.1 - SUSE Linux Enterprise Module for Basesystem 15-SP4 (aarch64 ppc64le s390x x86_64): libopenssl-3-devel-3.0.1-150400.4.7.1 libopenssl3-3.0.1-150400.4.7.1 libopenssl3-debuginfo-3.0.1-150400.4.7.1 openssl-3-3.0.1-150400.4.7.1 openssl-3-debuginfo-3.0.1-150400.4.7.1 openssl-3-debugsource-3.0.1-150400.4.7.1 References: https://www.suse.com/security/cve/CVE-2022-1292.html https://www.suse.com/security/cve/CVE-2022-1343.html https://www.suse.com/security/cve/CVE-2022-1434.html https://www.suse.com/security/cve/CVE-2022-1473.html https://www.suse.com/security/cve/CVE-2022-2068.html https://www.suse.com/security/cve/CVE-2022-2097.html https://bugzilla.suse.com/1185637 https://bugzilla.suse.com/1199166 https://bugzilla.suse.com/1199167 https://bugzilla.suse.com/1199168 https://bugzilla.suse.com/1199169 https://bugzilla.suse.com/1200550 https://bugzilla.suse.com/1201099

1 0