September 2022 - openSUSE Security Announce

SUSE-SU-2022:3325-1: important: Security update for go1.18
by opensuse-security＠opensuse.org 21 Sep '22

21 Sep '22

SUSE Security Update: Security update for go1.18 ______________________________________________________________________________ Announcement ID: SUSE-SU-2022:3325-1 Rating: important References: #1193742 #1203185 Cross-References: CVE-2022-27664 CVSS scores: CVE-2022-27664 (NVD) : 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H CVE-2022-27664 (SUSE): 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H Affected Products: SUSE Linux Enterprise Desktop 15-SP3 SUSE Linux Enterprise Desktop 15-SP4 SUSE Linux Enterprise High Performance Computing 15-SP3 SUSE Linux Enterprise High Performance Computing 15-SP4 SUSE Linux Enterprise Module for Development Tools 15-SP3 SUSE Linux Enterprise Module for Development Tools 15-SP4 SUSE Linux Enterprise Server 15-SP3 SUSE Linux Enterprise Server 15-SP4 SUSE Linux Enterprise Server for SAP Applications 15-SP3 SUSE Linux Enterprise Server for SAP Applications 15-SP4 SUSE Linux Enterprise Storage 7.1 SUSE Manager Proxy 4.2 SUSE Manager Proxy 4.3 SUSE Manager Retail Branch Server 4.2 SUSE Manager Retail Branch Server 4.3 SUSE Manager Server 4.2 SUSE Manager Server 4.3 openSUSE Leap 15.3 openSUSE Leap 15.4 ______________________________________________________________________________ An update that solves one vulnerability and has one errata is now available. Description: This update for go1.18 fixes the following issues: Update to go version 1.18.6 (bsc#1193742): - CVE-2022-27664: Fixed DoS in net/http caused by mishandled server errors after sending GOAWAY (bsc#1203185). Patch Instructions: To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 15.4: zypper in -t patch openSUSE-SLE-15.4-2022-3325=1 - openSUSE Leap 15.3: zypper in -t patch openSUSE-SLE-15.3-2022-3325=1 - SUSE Linux Enterprise Module for Development Tools 15-SP4: zypper in -t patch SUSE-SLE-Module-Development-Tools-15-SP4-2022-3325=1 - SUSE Linux Enterprise Module for Development Tools 15-SP3: zypper in -t patch SUSE-SLE-Module-Development-Tools-15-SP3-2022-3325=1 Package List: - openSUSE Leap 15.4 (aarch64 ppc64le s390x x86_64): go1.18-1.18.6-150000.1.31.1 go1.18-doc-1.18.6-150000.1.31.1 - openSUSE Leap 15.4 (aarch64 x86_64): go1.18-race-1.18.6-150000.1.31.1 - openSUSE Leap 15.3 (aarch64 ppc64le s390x x86_64): go1.18-1.18.6-150000.1.31.1 go1.18-doc-1.18.6-150000.1.31.1 - openSUSE Leap 15.3 (aarch64 x86_64): go1.18-race-1.18.6-150000.1.31.1 - SUSE Linux Enterprise Module for Development Tools 15-SP4 (aarch64 ppc64le s390x x86_64): go1.18-1.18.6-150000.1.31.1 go1.18-doc-1.18.6-150000.1.31.1 - SUSE Linux Enterprise Module for Development Tools 15-SP4 (aarch64 x86_64): go1.18-race-1.18.6-150000.1.31.1 - SUSE Linux Enterprise Module for Development Tools 15-SP3 (aarch64 ppc64le s390x x86_64): go1.18-1.18.6-150000.1.31.1 go1.18-doc-1.18.6-150000.1.31.1 - SUSE Linux Enterprise Module for Development Tools 15-SP3 (aarch64 x86_64): go1.18-race-1.18.6-150000.1.31.1 References: https://www.suse.com/security/cve/CVE-2022-27664.html https://bugzilla.suse.com/1193742 https://bugzilla.suse.com/1203185

1 0

SUSE-SU-2022:3321-1: important: Security update for kubevirt, virt-api-container, virt-controller-container, virt-handler-container, virt-launcher-container, virt-libguestfs-tools-container, virt-operator-container
by opensuse-security＠opensuse.org 20 Sep '22

20 Sep '22

SUSE Security Update: Security update for kubevirt, virt-api-container, virt-controller-container, virt-handler-container, virt-launcher-container, virt-libguestfs-tools-container, virt-operator-container ______________________________________________________________________________ Announcement ID: SUSE-SU-2022:3321-1 Rating: important References: #1199392 #1199460 #1199603 #1200528 #1202516 Cross-References: CVE-2022-1798 CVE-2022-1996 CVE-2022-29162 CVSS scores: CVE-2022-1798 (NVD) : 6.5 CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N CVE-2022-1798 (SUSE): 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N CVE-2022-1996 (NVD) : 9.1 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N CVE-2022-1996 (SUSE): 7.5 CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H CVE-2022-29162 (NVD) : 7.8 CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H CVE-2022-29162 (SUSE): 4 CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:N Affected Products: SUSE Linux Enterprise High Performance Computing 15-SP3 SUSE Linux Enterprise Module for Containers 15-SP3 SUSE Linux Enterprise Server 15-SP3 SUSE Linux Enterprise Server for SAP Applications 15-SP3 SUSE Linux Enterprise Storage 7.1 SUSE Manager Proxy 4.2 SUSE Manager Retail Branch Server 4.2 SUSE Manager Server 4.2 openSUSE Leap 15.3 ______________________________________________________________________________ An update that solves three vulnerabilities and has two fixes is now available. Description: This update for kubevirt, virt-api-container, virt-controller-container, virt-handler-container, virt-launcher-container, virt-libguestfs-tools-container, virt-operator-container fixes the following issues: Security issues fixed: - CVE-2022-1798: Fix arbitrary file read on the host from KubeVirt VMs (bsc#1202516) Security issues fixed in vendored dependencies: - CVE-2022-1996: Fixed go-restful CORS bypass (bsc#1200528) - CVE-2022-29162: Fixed runc incorrect handling of inheritable capabilities in default configuration (bsc#1199460) Other fixes: - Pack nft rules and nsswitch.conf for virt-handler - Only create 1MiB-aligned disk images (bsc#1199603) - Avoid to return nil failure message - Use semantic equality comparison - Allow to configure utility containers for update test - Install nftables to manage network rules - Install tar to allow kubectl cp ... - Symlink nsswitch.conf and nft rules to proper locations - Enable USB redirection support for QEMU - Install vim-small instread of vim - Drop libvirt-daemon-driver-storage-core - Install ethtool and gawk (bsc#1199392) - Use non-versioned appliance to avoid redundant rpm query - Explicitly state the dependency on kubevirt main package Patch Instructions: To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 15.3: zypper in -t patch openSUSE-SLE-15.3-2022-3321=1 - SUSE Linux Enterprise Module for Containers 15-SP3: zypper in -t patch SUSE-SLE-Module-Containers-15-SP3-2022-3321=1 Package List: - openSUSE Leap 15.3 (x86_64): kubevirt-container-disk-0.49.0-150300.8.13.1 kubevirt-container-disk-debuginfo-0.49.0-150300.8.13.1 kubevirt-manifests-0.49.0-150300.8.13.1 kubevirt-tests-0.49.0-150300.8.13.1 kubevirt-tests-debuginfo-0.49.0-150300.8.13.1 kubevirt-virt-api-0.49.0-150300.8.13.1 kubevirt-virt-api-debuginfo-0.49.0-150300.8.13.1 kubevirt-virt-controller-0.49.0-150300.8.13.1 kubevirt-virt-controller-debuginfo-0.49.0-150300.8.13.1 kubevirt-virt-handler-0.49.0-150300.8.13.1 kubevirt-virt-handler-debuginfo-0.49.0-150300.8.13.1 kubevirt-virt-launcher-0.49.0-150300.8.13.1 kubevirt-virt-launcher-debuginfo-0.49.0-150300.8.13.1 kubevirt-virt-operator-0.49.0-150300.8.13.1 kubevirt-virt-operator-debuginfo-0.49.0-150300.8.13.1 kubevirt-virtctl-0.49.0-150300.8.13.1 kubevirt-virtctl-debuginfo-0.49.0-150300.8.13.1 obs-service-kubevirt_containers_meta-0.49.0-150300.8.13.1 - SUSE Linux Enterprise Module for Containers 15-SP3 (x86_64): kubevirt-manifests-0.49.0-150300.8.13.1 kubevirt-virtctl-0.49.0-150300.8.13.1 kubevirt-virtctl-debuginfo-0.49.0-150300.8.13.1 References: https://www.suse.com/security/cve/CVE-2022-1798.html https://www.suse.com/security/cve/CVE-2022-1996.html https://www.suse.com/security/cve/CVE-2022-29162.html https://bugzilla.suse.com/1199392 https://bugzilla.suse.com/1199460 https://bugzilla.suse.com/1199603 https://bugzilla.suse.com/1200528 https://bugzilla.suse.com/1202516

1 0

SUSE-SU-2022:3320-1: important: Security update for vsftpd
by opensuse-security＠opensuse.org 20 Sep '22

20 Sep '22

SUSE Security Update: Security update for vsftpd ______________________________________________________________________________ Announcement ID: SUSE-SU-2022:3320-1 Rating: important References: #1021387 #1052900 #1187678 #1187686 #786024 PM-3322 Cross-References: CVE-2021-3618 CVSS scores: CVE-2021-3618 (NVD) : 7.4 CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N CVE-2021-3618 (SUSE): 7.4 CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N Affected Products: SUSE Linux Enterprise High Performance Computing 15-SP4 SUSE Linux Enterprise Module for Server Applications 15-SP4 SUSE Linux Enterprise Server 15-SP4 SUSE Linux Enterprise Server for SAP Applications 15-SP4 SUSE Manager Proxy 4.3 SUSE Manager Retail Branch Server 4.3 SUSE Manager Server 4.3 openSUSE Leap 15.4 ______________________________________________________________________________ An update that solves one vulnerability, contains one feature and has four fixes is now available. Description: This update for vsftpd fixes the following issues: - CVE-2021-3618: Enforced security checks against ALPACA attack (bsc#1187678, bsc#1187686, PM-3322). Bugfixes: - Fixed a seccomp failure in FIPS mode when SSL was enabled (bsc#1052900). - Allowed wait4() to be called so that the broker can wait for its child processes (bsc#1021387). - Allowed sendto() syscall when /dev/log support is enabled (bsc#786024). Patch Instructions: To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 15.4: zypper in -t patch openSUSE-SLE-15.4-2022-3320=1 - SUSE Linux Enterprise Module for Server Applications 15-SP4: zypper in -t patch SUSE-SLE-Module-Server-Applications-15-SP4-2022-3320=1 Package List: - openSUSE Leap 15.4 (aarch64 ppc64le s390x x86_64): vsftpd-3.0.5-150400.3.3.1 vsftpd-debuginfo-3.0.5-150400.3.3.1 vsftpd-debugsource-3.0.5-150400.3.3.1 - SUSE Linux Enterprise Module for Server Applications 15-SP4 (aarch64 ppc64le s390x x86_64): vsftpd-3.0.5-150400.3.3.1 vsftpd-debuginfo-3.0.5-150400.3.3.1 vsftpd-debugsource-3.0.5-150400.3.3.1 References: https://www.suse.com/security/cve/CVE-2021-3618.html https://bugzilla.suse.com/1021387 https://bugzilla.suse.com/1052900 https://bugzilla.suse.com/1187678 https://bugzilla.suse.com/1187686 https://bugzilla.suse.com/786024

1 0

openSUSE-SU-2022:10128-1: moderate: Security update for permissions
by opensuse-security＠opensuse.org 20 Sep '22

20 Sep '22

openSUSE Security Update: Security update for permissions ______________________________________________________________________________ Announcement ID: openSUSE-SU-2022:10128-1 Rating: moderate References: #1203018 Cross-References: CVE-2022-31252 CVSS scores: CVE-2022-31252 (SUSE): 6.7 CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H Affected Products: openSUSE Leap 15.3 ______________________________________________________________________________ An update that fixes one vulnerability is now available. Description: This update for permissions fixes the following issues: Update to version 20200127: * chkstat: also consider group controlled paths (boo#1203018, CVE-2022-31252) Patch Instructions: To install this openSUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 15.3: zypper in -t patch openSUSE-2022-10128=1 Package List: - openSUSE Leap 15.3 (aarch64 i586 ppc64le s390x x86_64): permissions-20200127-lp153.24.12.1 permissions-debuginfo-20200127-lp153.24.12.1 permissions-debugsource-20200127-lp153.24.12.1 - openSUSE Leap 15.3 (noarch): permissions-zypp-plugin-20200127-lp153.24.12.1 References: https://www.suse.com/security/cve/CVE-2022-31252.html https://bugzilla.suse.com/1203018

1 0

SUSE-SU-2022:3309-1: moderate: Security update for wireshark
by opensuse-security＠opensuse.org 19 Sep '22

19 Sep '22

SUSE Security Update: Security update for wireshark ______________________________________________________________________________ Announcement ID: SUSE-SU-2022:3309-1 Rating: moderate References: #1194165 #1203388 Cross-References: CVE-2021-4186 CVE-2022-3190 CVSS scores: CVE-2021-4186 (NVD) : 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H CVE-2021-4186 (SUSE): 4.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:L CVE-2022-3190 (NVD) : 5.5 CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H CVE-2022-3190 (SUSE): 6.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H Affected Products: SUSE Linux Enterprise Desktop 15-SP3 SUSE Linux Enterprise Desktop 15-SP4 SUSE Linux Enterprise High Performance Computing 15-SP3 SUSE Linux Enterprise High Performance Computing 15-SP4 SUSE Linux Enterprise Module for Basesystem 15-SP3 SUSE Linux Enterprise Module for Basesystem 15-SP4 SUSE Linux Enterprise Module for Desktop Applications 15-SP3 SUSE Linux Enterprise Module for Desktop Applications 15-SP4 SUSE Linux Enterprise Server 15-SP3 SUSE Linux Enterprise Server 15-SP4 SUSE Linux Enterprise Server for SAP Applications 15-SP3 SUSE Linux Enterprise Server for SAP Applications 15-SP4 SUSE Linux Enterprise Storage 7.1 SUSE Manager Proxy 4.2 SUSE Manager Proxy 4.3 SUSE Manager Retail Branch Server 4.2 SUSE Manager Retail Branch Server 4.3 SUSE Manager Server 4.2 SUSE Manager Server 4.3 openSUSE Leap 15.3 openSUSE Leap 15.4 ______________________________________________________________________________ An update that fixes two vulnerabilities is now available. Description: This update for wireshark fixes the following issues: Updated to Wireshark 3.6.8: - CVE-2022-3190: Fixed F5 Ethernet Trailer dissector infinite loop (bsc#1203388). - CVE-2021-4186: Fixed Gryphon dissector crash (bsc#1194165). Patch Instructions: To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 15.4: zypper in -t patch openSUSE-SLE-15.4-2022-3309=1 - openSUSE Leap 15.3: zypper in -t patch openSUSE-SLE-15.3-2022-3309=1 - SUSE Linux Enterprise Module for Desktop Applications 15-SP4: zypper in -t patch SUSE-SLE-Module-Desktop-Applications-15-SP4-2022-3309=1 - SUSE Linux Enterprise Module for Desktop Applications 15-SP3: zypper in -t patch SUSE-SLE-Module-Desktop-Applications-15-SP3-2022-3309=1 - SUSE Linux Enterprise Module for Basesystem 15-SP4: zypper in -t patch SUSE-SLE-Module-Basesystem-15-SP4-2022-3309=1 - SUSE Linux Enterprise Module for Basesystem 15-SP3: zypper in -t patch SUSE-SLE-Module-Basesystem-15-SP3-2022-3309=1 Package List: - openSUSE Leap 15.4 (aarch64 ppc64le s390x x86_64): libwireshark15-3.6.8-150000.3.74.1 libwireshark15-debuginfo-3.6.8-150000.3.74.1 libwiretap12-3.6.8-150000.3.74.1 libwiretap12-debuginfo-3.6.8-150000.3.74.1 libwsutil13-3.6.8-150000.3.74.1 libwsutil13-debuginfo-3.6.8-150000.3.74.1 wireshark-3.6.8-150000.3.74.1 wireshark-debuginfo-3.6.8-150000.3.74.1 wireshark-debugsource-3.6.8-150000.3.74.1 wireshark-devel-3.6.8-150000.3.74.1 wireshark-ui-qt-3.6.8-150000.3.74.1 wireshark-ui-qt-debuginfo-3.6.8-150000.3.74.1 - openSUSE Leap 15.3 (aarch64 ppc64le s390x x86_64): libwireshark15-3.6.8-150000.3.74.1 libwireshark15-debuginfo-3.6.8-150000.3.74.1 libwiretap12-3.6.8-150000.3.74.1 libwiretap12-debuginfo-3.6.8-150000.3.74.1 libwsutil13-3.6.8-150000.3.74.1 libwsutil13-debuginfo-3.6.8-150000.3.74.1 wireshark-3.6.8-150000.3.74.1 wireshark-debuginfo-3.6.8-150000.3.74.1 wireshark-debugsource-3.6.8-150000.3.74.1 wireshark-devel-3.6.8-150000.3.74.1 wireshark-ui-qt-3.6.8-150000.3.74.1 wireshark-ui-qt-debuginfo-3.6.8-150000.3.74.1 - SUSE Linux Enterprise Module for Desktop Applications 15-SP4 (aarch64 ppc64le s390x x86_64): wireshark-debuginfo-3.6.8-150000.3.74.1 wireshark-debugsource-3.6.8-150000.3.74.1 wireshark-devel-3.6.8-150000.3.74.1 wireshark-ui-qt-3.6.8-150000.3.74.1 wireshark-ui-qt-debuginfo-3.6.8-150000.3.74.1 - SUSE Linux Enterprise Module for Desktop Applications 15-SP3 (aarch64 ppc64le s390x x86_64): wireshark-debuginfo-3.6.8-150000.3.74.1 wireshark-debugsource-3.6.8-150000.3.74.1 wireshark-devel-3.6.8-150000.3.74.1 wireshark-ui-qt-3.6.8-150000.3.74.1 wireshark-ui-qt-debuginfo-3.6.8-150000.3.74.1 - SUSE Linux Enterprise Module for Basesystem 15-SP4 (aarch64 ppc64le s390x x86_64): libwireshark15-3.6.8-150000.3.74.1 libwireshark15-debuginfo-3.6.8-150000.3.74.1 libwiretap12-3.6.8-150000.3.74.1 libwiretap12-debuginfo-3.6.8-150000.3.74.1 libwsutil13-3.6.8-150000.3.74.1 libwsutil13-debuginfo-3.6.8-150000.3.74.1 wireshark-3.6.8-150000.3.74.1 wireshark-debuginfo-3.6.8-150000.3.74.1 wireshark-debugsource-3.6.8-150000.3.74.1 - SUSE Linux Enterprise Module for Basesystem 15-SP3 (aarch64 ppc64le s390x x86_64): libwireshark15-3.6.8-150000.3.74.1 libwireshark15-debuginfo-3.6.8-150000.3.74.1 libwiretap12-3.6.8-150000.3.74.1 libwiretap12-debuginfo-3.6.8-150000.3.74.1 libwsutil13-3.6.8-150000.3.74.1 libwsutil13-debuginfo-3.6.8-150000.3.74.1 wireshark-3.6.8-150000.3.74.1 wireshark-debuginfo-3.6.8-150000.3.74.1 wireshark-debugsource-3.6.8-150000.3.74.1 References: https://www.suse.com/security/cve/CVE-2021-4186.html https://www.suse.com/security/cve/CVE-2022-3190.html https://bugzilla.suse.com/1194165 https://bugzilla.suse.com/1203388

1 0

SUSE-SU-2022:3307-1: moderate: Security update for sqlite3
by opensuse-security＠opensuse.org 19 Sep '22

19 Sep '22

SUSE Security Update: Security update for sqlite3 ______________________________________________________________________________ Announcement ID: SUSE-SU-2022:3307-1 Rating: moderate References: #1189802 #1195773 #1201783 Cross-References: CVE-2021-36690 CVE-2022-35737 CVSS scores: CVE-2021-36690 (NVD) : 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H CVE-2021-36690 (SUSE): 5.5 CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H CVE-2022-35737 (NVD) : 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H CVE-2022-35737 (SUSE): 6.3 CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:N Affected Products: SUSE Linux Enterprise Desktop 15-SP3 SUSE Linux Enterprise Desktop 15-SP4 SUSE Linux Enterprise High Performance Computing 15-SP3 SUSE Linux Enterprise High Performance Computing 15-SP4 SUSE Linux Enterprise Micro 5.1 SUSE Linux Enterprise Micro 5.2 SUSE Linux Enterprise Module for Basesystem 15-SP3 SUSE Linux Enterprise Module for Basesystem 15-SP4 SUSE Linux Enterprise Server 15-SP3 SUSE Linux Enterprise Server 15-SP4 SUSE Linux Enterprise Server for SAP Applications 15-SP3 SUSE Linux Enterprise Server for SAP Applications 15-SP4 SUSE Linux Enterprise Storage 7.1 SUSE Manager Proxy 4.2 SUSE Manager Proxy 4.3 SUSE Manager Retail Branch Server 4.2 SUSE Manager Retail Branch Server 4.3 SUSE Manager Server 4.2 SUSE Manager Server 4.3 openSUSE Leap 15.3 openSUSE Leap 15.4 openSUSE Leap Micro 5.2 ______________________________________________________________________________ An update that solves two vulnerabilities and has one errata is now available. Description: This update for sqlite3 fixes the following issues: - CVE-2022-35737: Fixed an array-bounds overflow if billions of bytes are used in a string argument to a C API (bnc#1201783). - CVE-2021-36690: Fixed an issue with the SQLite Expert extension when a column has no collating sequence (bsc#1189802). - Package the Tcl bindings here again so that we only ship one copy of SQLite (bsc#1195773). Patch Instructions: To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap Micro 5.2: zypper in -t patch openSUSE-Leap-Micro-5.2-2022-3307=1 - openSUSE Leap 15.4: zypper in -t patch openSUSE-SLE-15.4-2022-3307=1 - openSUSE Leap 15.3: zypper in -t patch openSUSE-SLE-15.3-2022-3307=1 - SUSE Linux Enterprise Module for Basesystem 15-SP4: zypper in -t patch SUSE-SLE-Module-Basesystem-15-SP4-2022-3307=1 - SUSE Linux Enterprise Module for Basesystem 15-SP3: zypper in -t patch SUSE-SLE-Module-Basesystem-15-SP3-2022-3307=1 - SUSE Linux Enterprise Micro 5.2: zypper in -t patch SUSE-SUSE-MicroOS-5.2-2022-3307=1 - SUSE Linux Enterprise Micro 5.1: zypper in -t patch SUSE-SUSE-MicroOS-5.1-2022-3307=1 Package List: - openSUSE Leap Micro 5.2 (aarch64 x86_64): libsqlite3-0-3.39.3-150000.3.17.1 libsqlite3-0-debuginfo-3.39.3-150000.3.17.1 sqlite3-debuginfo-3.39.3-150000.3.17.1 sqlite3-debugsource-3.39.3-150000.3.17.1 - openSUSE Leap 15.4 (aarch64 ppc64le s390x x86_64): libsqlite3-0-3.39.3-150000.3.17.1 libsqlite3-0-debuginfo-3.39.3-150000.3.17.1 sqlite3-3.39.3-150000.3.17.1 sqlite3-debuginfo-3.39.3-150000.3.17.1 sqlite3-debugsource-3.39.3-150000.3.17.1 sqlite3-devel-3.39.3-150000.3.17.1 - openSUSE Leap 15.4 (noarch): sqlite3-doc-3.39.3-150000.3.17.1 - openSUSE Leap 15.4 (x86_64): libsqlite3-0-32bit-3.39.3-150000.3.17.1 libsqlite3-0-32bit-debuginfo-3.39.3-150000.3.17.1 - openSUSE Leap 15.3 (aarch64 ppc64le s390x x86_64): libsqlite3-0-3.39.3-150000.3.17.1 libsqlite3-0-debuginfo-3.39.3-150000.3.17.1 sqlite3-3.39.3-150000.3.17.1 sqlite3-debuginfo-3.39.3-150000.3.17.1 sqlite3-debugsource-3.39.3-150000.3.17.1 sqlite3-devel-3.39.3-150000.3.17.1 - openSUSE Leap 15.3 (x86_64): libsqlite3-0-32bit-3.39.3-150000.3.17.1 libsqlite3-0-32bit-debuginfo-3.39.3-150000.3.17.1 - openSUSE Leap 15.3 (noarch): sqlite3-doc-3.39.3-150000.3.17.1 - SUSE Linux Enterprise Module for Basesystem 15-SP4 (aarch64 ppc64le s390x x86_64): libsqlite3-0-3.39.3-150000.3.17.1 libsqlite3-0-debuginfo-3.39.3-150000.3.17.1 sqlite3-3.39.3-150000.3.17.1 sqlite3-debuginfo-3.39.3-150000.3.17.1 sqlite3-debugsource-3.39.3-150000.3.17.1 sqlite3-devel-3.39.3-150000.3.17.1 - SUSE Linux Enterprise Module for Basesystem 15-SP4 (x86_64): libsqlite3-0-32bit-3.39.3-150000.3.17.1 libsqlite3-0-32bit-debuginfo-3.39.3-150000.3.17.1 - SUSE Linux Enterprise Module for Basesystem 15-SP3 (aarch64 ppc64le s390x x86_64): libsqlite3-0-3.39.3-150000.3.17.1 libsqlite3-0-debuginfo-3.39.3-150000.3.17.1 sqlite3-3.39.3-150000.3.17.1 sqlite3-debuginfo-3.39.3-150000.3.17.1 sqlite3-debugsource-3.39.3-150000.3.17.1 sqlite3-devel-3.39.3-150000.3.17.1 - SUSE Linux Enterprise Module for Basesystem 15-SP3 (x86_64): libsqlite3-0-32bit-3.39.3-150000.3.17.1 libsqlite3-0-32bit-debuginfo-3.39.3-150000.3.17.1 - SUSE Linux Enterprise Micro 5.2 (aarch64 s390x x86_64): libsqlite3-0-3.39.3-150000.3.17.1 libsqlite3-0-debuginfo-3.39.3-150000.3.17.1 sqlite3-debuginfo-3.39.3-150000.3.17.1 sqlite3-debugsource-3.39.3-150000.3.17.1 - SUSE Linux Enterprise Micro 5.1 (aarch64 s390x x86_64): libsqlite3-0-3.39.3-150000.3.17.1 libsqlite3-0-debuginfo-3.39.3-150000.3.17.1 sqlite3-debuginfo-3.39.3-150000.3.17.1 sqlite3-debugsource-3.39.3-150000.3.17.1 References: https://www.suse.com/security/cve/CVE-2021-36690.html https://www.suse.com/security/cve/CVE-2022-35737.html https://bugzilla.suse.com/1189802 https://bugzilla.suse.com/1195773 https://bugzilla.suse.com/1201783

1 0

SUSE-SU-2022:3305-1: important: Security update for libtirpc
by opensuse-security＠opensuse.org 19 Sep '22

19 Sep '22

SUSE Security Update: Security update for libtirpc ______________________________________________________________________________ Announcement ID: SUSE-SU-2022:3305-1 Rating: important References: #1201680 Cross-References: CVE-2021-46828 CVSS scores: CVE-2021-46828 (NVD) : 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H CVE-2021-46828 (SUSE): 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H Affected Products: SUSE Linux Enterprise Desktop 15-SP3 SUSE Linux Enterprise Desktop 15-SP4 SUSE Linux Enterprise High Performance Computing 15-SP3 SUSE Linux Enterprise High Performance Computing 15-SP4 SUSE Linux Enterprise Micro 5.1 SUSE Linux Enterprise Micro 5.2 SUSE Linux Enterprise Module for Basesystem 15-SP3 SUSE Linux Enterprise Module for Basesystem 15-SP4 SUSE Linux Enterprise Server 15-SP3 SUSE Linux Enterprise Server 15-SP4 SUSE Linux Enterprise Server for SAP Applications 15-SP3 SUSE Linux Enterprise Server for SAP Applications 15-SP4 SUSE Linux Enterprise Storage 7.1 SUSE Manager Proxy 4.2 SUSE Manager Proxy 4.3 SUSE Manager Retail Branch Server 4.2 SUSE Manager Retail Branch Server 4.3 SUSE Manager Server 4.2 SUSE Manager Server 4.3 openSUSE Leap 15.3 openSUSE Leap 15.4 openSUSE Leap Micro 5.2 ______________________________________________________________________________ An update that fixes one vulnerability is now available. Description: This update for libtirpc fixes the following issues: - CVE-2021-46828: Fixed denial of service vulnerability with lots of connections (bsc#1201680). Patch Instructions: To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap Micro 5.2: zypper in -t patch openSUSE-Leap-Micro-5.2-2022-3305=1 - openSUSE Leap 15.4: zypper in -t patch openSUSE-SLE-15.4-2022-3305=1 - openSUSE Leap 15.3: zypper in -t patch openSUSE-SLE-15.3-2022-3305=1 - SUSE Linux Enterprise Module for Basesystem 15-SP4: zypper in -t patch SUSE-SLE-Module-Basesystem-15-SP4-2022-3305=1 - SUSE Linux Enterprise Module for Basesystem 15-SP3: zypper in -t patch SUSE-SLE-Module-Basesystem-15-SP3-2022-3305=1 - SUSE Linux Enterprise Micro 5.2: zypper in -t patch SUSE-SUSE-MicroOS-5.2-2022-3305=1 - SUSE Linux Enterprise Micro 5.1: zypper in -t patch SUSE-SUSE-MicroOS-5.1-2022-3305=1 Package List: - openSUSE Leap Micro 5.2 (aarch64 x86_64): libtirpc-debugsource-1.2.6-150300.3.14.1 libtirpc-netconfig-1.2.6-150300.3.14.1 libtirpc3-1.2.6-150300.3.14.1 libtirpc3-debuginfo-1.2.6-150300.3.14.1 - openSUSE Leap 15.4 (aarch64 ppc64le s390x x86_64): libtirpc-debugsource-1.2.6-150300.3.14.1 libtirpc-devel-1.2.6-150300.3.14.1 libtirpc-netconfig-1.2.6-150300.3.14.1 libtirpc3-1.2.6-150300.3.14.1 libtirpc3-debuginfo-1.2.6-150300.3.14.1 - openSUSE Leap 15.4 (x86_64): libtirpc3-32bit-1.2.6-150300.3.14.1 libtirpc3-32bit-debuginfo-1.2.6-150300.3.14.1 - openSUSE Leap 15.3 (aarch64 ppc64le s390x x86_64): libtirpc-debugsource-1.2.6-150300.3.14.1 libtirpc-devel-1.2.6-150300.3.14.1 libtirpc-netconfig-1.2.6-150300.3.14.1 libtirpc3-1.2.6-150300.3.14.1 libtirpc3-debuginfo-1.2.6-150300.3.14.1 - openSUSE Leap 15.3 (x86_64): libtirpc3-32bit-1.2.6-150300.3.14.1 libtirpc3-32bit-debuginfo-1.2.6-150300.3.14.1 - SUSE Linux Enterprise Module for Basesystem 15-SP4 (aarch64 ppc64le s390x x86_64): libtirpc-debugsource-1.2.6-150300.3.14.1 libtirpc-devel-1.2.6-150300.3.14.1 libtirpc-netconfig-1.2.6-150300.3.14.1 libtirpc3-1.2.6-150300.3.14.1 libtirpc3-debuginfo-1.2.6-150300.3.14.1 - SUSE Linux Enterprise Module for Basesystem 15-SP4 (x86_64): libtirpc3-32bit-1.2.6-150300.3.14.1 libtirpc3-32bit-debuginfo-1.2.6-150300.3.14.1 - SUSE Linux Enterprise Module for Basesystem 15-SP3 (aarch64 ppc64le s390x x86_64): libtirpc-debugsource-1.2.6-150300.3.14.1 libtirpc-devel-1.2.6-150300.3.14.1 libtirpc-netconfig-1.2.6-150300.3.14.1 libtirpc3-1.2.6-150300.3.14.1 libtirpc3-debuginfo-1.2.6-150300.3.14.1 - SUSE Linux Enterprise Module for Basesystem 15-SP3 (x86_64): libtirpc3-32bit-1.2.6-150300.3.14.1 libtirpc3-32bit-debuginfo-1.2.6-150300.3.14.1 - SUSE Linux Enterprise Micro 5.2 (aarch64 s390x x86_64): libtirpc-debugsource-1.2.6-150300.3.14.1 libtirpc-netconfig-1.2.6-150300.3.14.1 libtirpc3-1.2.6-150300.3.14.1 libtirpc3-debuginfo-1.2.6-150300.3.14.1 - SUSE Linux Enterprise Micro 5.1 (aarch64 s390x x86_64): libtirpc-debugsource-1.2.6-150300.3.14.1 libtirpc-netconfig-1.2.6-150300.3.14.1 libtirpc3-1.2.6-150300.3.14.1 libtirpc3-debuginfo-1.2.6-150300.3.14.1 References: https://www.suse.com/security/cve/CVE-2021-46828.html https://bugzilla.suse.com/1201680

1 0

SUSE-SU-2022:3306-1: moderate: Security update for libarchive
by opensuse-security＠opensuse.org 19 Sep '22

19 Sep '22

SUSE Security Update: Security update for libarchive ______________________________________________________________________________ Announcement ID: SUSE-SU-2022:3306-1 Rating: moderate References: #1192425 Cross-References: CVE-2021-23177 CVSS scores: CVE-2021-23177 (NVD) : 7.8 CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H CVE-2021-23177 (SUSE): 6.6 CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:L/A:L Affected Products: SUSE Linux Enterprise Desktop 15-SP4 SUSE Linux Enterprise High Performance Computing 15-SP4 SUSE Linux Enterprise Module for Basesystem 15-SP4 SUSE Linux Enterprise Module for Development Tools 15-SP4 SUSE Linux Enterprise Server 15-SP4 SUSE Linux Enterprise Server for SAP Applications 15-SP4 SUSE Manager Proxy 4.3 SUSE Manager Retail Branch Server 4.3 SUSE Manager Server 4.3 openSUSE Leap 15.4 ______________________________________________________________________________ An update that fixes one vulnerability is now available. Description: This update for libarchive fixes the following issues: - CVE-2021-23177: Fixed symlink ACL extraction that modifies ACLs of the target system (bsc#1192425). Patch Instructions: To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 15.4: zypper in -t patch openSUSE-SLE-15.4-2022-3306=1 - SUSE Linux Enterprise Module for Development Tools 15-SP4: zypper in -t patch SUSE-SLE-Module-Development-Tools-15-SP4-2022-3306=1 - SUSE Linux Enterprise Module for Basesystem 15-SP4: zypper in -t patch SUSE-SLE-Module-Basesystem-15-SP4-2022-3306=1 Package List: - openSUSE Leap 15.4 (aarch64 ppc64le s390x x86_64): bsdtar-3.5.1-150400.3.6.1 bsdtar-debuginfo-3.5.1-150400.3.6.1 libarchive-debugsource-3.5.1-150400.3.6.1 libarchive-devel-3.5.1-150400.3.6.1 libarchive13-3.5.1-150400.3.6.1 libarchive13-debuginfo-3.5.1-150400.3.6.1 - openSUSE Leap 15.4 (x86_64): libarchive13-32bit-3.5.1-150400.3.6.1 libarchive13-32bit-debuginfo-3.5.1-150400.3.6.1 - SUSE Linux Enterprise Module for Development Tools 15-SP4 (aarch64 ppc64le s390x x86_64): bsdtar-3.5.1-150400.3.6.1 bsdtar-debuginfo-3.5.1-150400.3.6.1 libarchive-debugsource-3.5.1-150400.3.6.1 - SUSE Linux Enterprise Module for Basesystem 15-SP4 (aarch64 ppc64le s390x x86_64): libarchive-debugsource-3.5.1-150400.3.6.1 libarchive-devel-3.5.1-150400.3.6.1 libarchive13-3.5.1-150400.3.6.1 libarchive13-debuginfo-3.5.1-150400.3.6.1 References: https://www.suse.com/security/cve/CVE-2021-23177.html https://bugzilla.suse.com/1192425

1 0

openSUSE-SU-2022:10126-1: moderate: Security update for mupdf
by opensuse-security＠opensuse.org 17 Sep '22

17 Sep '22

openSUSE Security Update: Security update for mupdf ______________________________________________________________________________ Announcement ID: openSUSE-SU-2022:10126-1 Rating: moderate References: #1202858 Cross-References: CVE-2018-25032 CVE-2021-4216 CVSS scores: CVE-2018-25032 (NVD) : 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H CVE-2018-25032 (SUSE): 8.1 CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H CVE-2021-4216 (NVD) : 5.5 CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H Affected Products: openSUSE Backports SLE-15-SP4 ______________________________________________________________________________ An update that fixes two vulnerabilities is now available. Description: This update for mupdf fixes the following issues: mupdf was updated to 1.20.3: * return error, not success when unable to lock native device resource. * Bug 705620: Start journal operation instead of pushing local xref. * Ensure AndroidDrawDevice is destroyed, even upon exception. * source/pdf/pdf-clean.c: fix segv from incorrect call to fz_drop_pixmap(). * Bug 705681: Enclose code in begin/end operation. * Guard against SEGVs when calling archive functions with NULL archive. mupdf was updated to 1.20.0 (boo#1202858, CVE-2021-4216): * Experimental C# bindings * Cross compilation should no longer need a host compiler * Major additions to JNI bindings * New API to edit outline * New API to resolve and create links * New API to toggle individual layers in PDF * Layer panel in mupdf-gl * Layer option in mutool draw * New API to add a Javascript console * Console panel in mupdf-gl * Text search API extended to be able to distinguish between separate search hits * Command line tool improvements: * all: Negative page numbers to index from the last page * mutool draw: Add option to render document without text * mutool draw and convert: Support DPI option in text and HTML output * New hybrid HTML output format using "scripts/pdftohtml" script: * Graphics in a background image * Text on top * Improved WASM viewer demo * Support high DPI screens * Progressive loading * Update to zlib 1.2.12 for security fix mupdf was updated to 1.19.1: * Updated zlib to 1.2.12 due to CVE-2018-25032 Patch Instructions: To install this openSUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Backports SLE-15-SP4: zypper in -t patch openSUSE-2022-10126=1 Package List: - openSUSE Backports SLE-15-SP4 (aarch64 ppc64le s390x x86_64): mupdf-1.20.3-bp154.2.3.1 mupdf-devel-static-1.20.3-bp154.2.3.1 References: https://www.suse.com/security/cve/CVE-2018-25032.html https://www.suse.com/security/cve/CVE-2021-4216.html https://bugzilla.suse.com/1202858

1 0

openSUSE-SU-2022:10125-1: moderate: Security update for mupdf
by opensuse-security＠opensuse.org 17 Sep '22

17 Sep '22

openSUSE Security Update: Security update for mupdf ______________________________________________________________________________ Announcement ID: openSUSE-SU-2022:10125-1 Rating: moderate References: #1202858 Cross-References: CVE-2021-4216 CVSS scores: CVE-2021-4216 (NVD) : 5.5 CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H Affected Products: openSUSE Backports SLE-15-SP3 ______________________________________________________________________________ An update that fixes one vulnerability is now available. Description: This update for mupdf fixes the following issues: - CVE-2021-4216: Fixed division by zero for zero width pages in muraster (boo#1202858) Patch Instructions: To install this openSUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Backports SLE-15-SP3: zypper in -t patch openSUSE-2022-10125=1 Package List: - openSUSE Backports SLE-15-SP3 (aarch64 i586 ppc64le s390x x86_64): mupdf-1.12.0-bp153.2.6.1 mupdf-devel-static-1.12.0-bp153.2.6.1 References: https://www.suse.com/security/cve/CVE-2021-4216.html https://bugzilla.suse.com/1202858

1 0