September 2022 - openSUSE Security Announce

SUSE-SU-2022:3020-1: important: Security update for php-composer2
by opensuse-security＠opensuse.org 05 Sep '22

05 Sep '22

SUSE Security Update: Security update for php-composer2 ______________________________________________________________________________ Announcement ID: SUSE-SU-2022:3020-1 Rating: important References: #1198494 Cross-References: CVE-2022-24828 CVSS scores: CVE-2022-24828 (NVD) : 8.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H CVE-2022-24828 (SUSE): 7 CVSS:3.1/AV:L/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H Affected Products: SUSE Linux Enterprise High Performance Computing 15-SP4 SUSE Linux Enterprise Module for Web Scripting 15-SP4 SUSE Linux Enterprise Server 15-SP4 SUSE Linux Enterprise Server for SAP Applications 15-SP4 SUSE Manager Proxy 4.3 SUSE Manager Retail Branch Server 4.3 SUSE Manager Server 4.3 openSUSE Leap 15.4 ______________________________________________________________________________ An update that fixes one vulnerability is now available. Description: This update for php-composer2 fixes the following issues: - CVE-2022-24828: Fixed a code injection issue that affected integrators using specific APIs to read untrusted input files (bsc#1198494). Patch Instructions: To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 15.4: zypper in -t patch openSUSE-SLE-15.4-2022-3020=1 - SUSE Linux Enterprise Module for Web Scripting 15-SP4: zypper in -t patch SUSE-SLE-Module-Web-Scripting-15-SP4-2022-3020=1 Package List: - openSUSE Leap 15.4 (noarch): php-composer2-2.2.3-150400.3.3.1 - SUSE Linux Enterprise Module for Web Scripting 15-SP4 (noarch): php-composer2-2.2.3-150400.3.3.1 References: https://www.suse.com/security/cve/CVE-2022-24828.html https://bugzilla.suse.com/1198494

1 0

SUSE-SU-2022:3003-1: Security update for curl
by opensuse-security＠opensuse.org 02 Sep '22

02 Sep '22

SUSE Security Update: Security update for curl ______________________________________________________________________________ Announcement ID: SUSE-SU-2022:3003-1 Rating: low References: #1202593 Cross-References: CVE-2022-35252 CVSS scores: CVE-2022-35252 (SUSE): 3.7 CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:L Affected Products: SUSE Linux Enterprise Desktop 15-SP4 SUSE Linux Enterprise High Performance Computing 15-SP4 SUSE Linux Enterprise Module for Basesystem 15-SP4 SUSE Linux Enterprise Server 15-SP4 SUSE Linux Enterprise Server for SAP Applications 15-SP4 SUSE Manager Proxy 4.3 SUSE Manager Retail Branch Server 4.3 SUSE Manager Server 4.3 openSUSE Leap 15.4 ______________________________________________________________________________ An update that fixes one vulnerability is now available. Description: This update for curl fixes the following issues: - CVE-2022-35252: Fixed a potential injection of control characters into cookies, which could be exploited by sister sites to cause a denial of service (bsc#1202593). Patch Instructions: To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 15.4: zypper in -t patch openSUSE-SLE-15.4-2022-3003=1 - SUSE Linux Enterprise Module for Basesystem 15-SP4: zypper in -t patch SUSE-SLE-Module-Basesystem-15-SP4-2022-3003=1 Package List: - openSUSE Leap 15.4 (aarch64 ppc64le s390x x86_64): curl-7.79.1-150400.5.6.1 curl-debuginfo-7.79.1-150400.5.6.1 curl-debugsource-7.79.1-150400.5.6.1 libcurl-devel-7.79.1-150400.5.6.1 libcurl4-7.79.1-150400.5.6.1 libcurl4-debuginfo-7.79.1-150400.5.6.1 - openSUSE Leap 15.4 (x86_64): libcurl-devel-32bit-7.79.1-150400.5.6.1 libcurl4-32bit-7.79.1-150400.5.6.1 libcurl4-32bit-debuginfo-7.79.1-150400.5.6.1 - SUSE Linux Enterprise Module for Basesystem 15-SP4 (aarch64 ppc64le s390x x86_64): curl-7.79.1-150400.5.6.1 curl-debuginfo-7.79.1-150400.5.6.1 curl-debugsource-7.79.1-150400.5.6.1 libcurl-devel-7.79.1-150400.5.6.1 libcurl4-7.79.1-150400.5.6.1 libcurl4-debuginfo-7.79.1-150400.5.6.1 - SUSE Linux Enterprise Module for Basesystem 15-SP4 (x86_64): libcurl4-32bit-7.79.1-150400.5.6.1 libcurl4-32bit-debuginfo-7.79.1-150400.5.6.1 References: https://www.suse.com/security/cve/CVE-2022-35252.html https://bugzilla.suse.com/1202593

1 0

SUSE-SU-2022:3004-1: Security update for curl
by opensuse-security＠opensuse.org 02 Sep '22

02 Sep '22

SUSE Security Update: Security update for curl ______________________________________________________________________________ Announcement ID: SUSE-SU-2022:3004-1 Rating: low References: #1202593 Cross-References: CVE-2022-35252 CVSS scores: CVE-2022-35252 (SUSE): 3.7 CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:L Affected Products: SUSE Linux Enterprise Desktop 15-SP3 SUSE Linux Enterprise High Performance Computing 15-SP3 SUSE Linux Enterprise Micro 5.1 SUSE Linux Enterprise Micro 5.2 SUSE Linux Enterprise Module for Basesystem 15-SP3 SUSE Linux Enterprise Server 15-SP3 SUSE Linux Enterprise Server for SAP Applications 15-SP3 SUSE Linux Enterprise Storage 7.1 SUSE Manager Proxy 4.2 SUSE Manager Retail Branch Server 4.2 SUSE Manager Server 4.2 openSUSE Leap 15.3 openSUSE Leap Micro 5.2 ______________________________________________________________________________ An update that fixes one vulnerability is now available. Description: This update for curl fixes the following issues: - CVE-2022-35252: Fixed a potential injection of control characters into cookies, which could be exploited by sister sites to cause a denial of service (bsc#1202593). Patch Instructions: To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap Micro 5.2: zypper in -t patch openSUSE-Leap-Micro-5.2-2022-3004=1 - openSUSE Leap 15.3: zypper in -t patch openSUSE-SLE-15.3-2022-3004=1 - SUSE Linux Enterprise Module for Basesystem 15-SP3: zypper in -t patch SUSE-SLE-Module-Basesystem-15-SP3-2022-3004=1 - SUSE Linux Enterprise Micro 5.2: zypper in -t patch SUSE-SUSE-MicroOS-5.2-2022-3004=1 - SUSE Linux Enterprise Micro 5.1: zypper in -t patch SUSE-SUSE-MicroOS-5.1-2022-3004=1 Package List: - openSUSE Leap Micro 5.2 (aarch64 x86_64): curl-7.66.0-150200.4.39.1 curl-debuginfo-7.66.0-150200.4.39.1 curl-debugsource-7.66.0-150200.4.39.1 libcurl4-7.66.0-150200.4.39.1 libcurl4-debuginfo-7.66.0-150200.4.39.1 - openSUSE Leap 15.3 (aarch64 ppc64le s390x x86_64): curl-7.66.0-150200.4.39.1 curl-debuginfo-7.66.0-150200.4.39.1 curl-debugsource-7.66.0-150200.4.39.1 libcurl-devel-7.66.0-150200.4.39.1 libcurl4-7.66.0-150200.4.39.1 libcurl4-debuginfo-7.66.0-150200.4.39.1 - openSUSE Leap 15.3 (x86_64): libcurl-devel-32bit-7.66.0-150200.4.39.1 libcurl4-32bit-7.66.0-150200.4.39.1 libcurl4-32bit-debuginfo-7.66.0-150200.4.39.1 - SUSE Linux Enterprise Module for Basesystem 15-SP3 (aarch64 ppc64le s390x x86_64): curl-7.66.0-150200.4.39.1 curl-debuginfo-7.66.0-150200.4.39.1 curl-debugsource-7.66.0-150200.4.39.1 libcurl-devel-7.66.0-150200.4.39.1 libcurl4-7.66.0-150200.4.39.1 libcurl4-debuginfo-7.66.0-150200.4.39.1 - SUSE Linux Enterprise Module for Basesystem 15-SP3 (x86_64): libcurl4-32bit-7.66.0-150200.4.39.1 libcurl4-32bit-debuginfo-7.66.0-150200.4.39.1 - SUSE Linux Enterprise Micro 5.2 (aarch64 s390x x86_64): curl-7.66.0-150200.4.39.1 curl-debuginfo-7.66.0-150200.4.39.1 curl-debugsource-7.66.0-150200.4.39.1 libcurl4-7.66.0-150200.4.39.1 libcurl4-debuginfo-7.66.0-150200.4.39.1 - SUSE Linux Enterprise Micro 5.1 (aarch64 s390x x86_64): curl-7.66.0-150200.4.39.1 curl-debuginfo-7.66.0-150200.4.39.1 curl-debugsource-7.66.0-150200.4.39.1 libcurl4-7.66.0-150200.4.39.1 libcurl4-debuginfo-7.66.0-150200.4.39.1 References: https://www.suse.com/security/cve/CVE-2022-35252.html https://bugzilla.suse.com/1202593

1 0

SUSE-SU-2022:2996-1: moderate: Security update for gdk-pixbuf
by opensuse-security＠opensuse.org 02 Sep '22

02 Sep '22

SUSE Security Update: Security update for gdk-pixbuf ______________________________________________________________________________ Announcement ID: SUSE-SU-2022:2996-1 Rating: moderate References: #1201826 Cross-References: CVE-2021-46829 CVSS scores: CVE-2021-46829 (NVD) : 7.8 CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H CVE-2021-46829 (SUSE): 5.5 CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H Affected Products: SUSE Linux Enterprise Desktop 15-SP3 SUSE Linux Enterprise High Performance Computing 15-SP3 SUSE Linux Enterprise Micro 5.2 SUSE Linux Enterprise Module for Basesystem 15-SP3 SUSE Linux Enterprise Module for Desktop Applications 15-SP3 SUSE Linux Enterprise Server 15-SP3 SUSE Linux Enterprise Server for SAP Applications 15-SP3 SUSE Linux Enterprise Storage 7.1 SUSE Manager Proxy 4.2 SUSE Manager Retail Branch Server 4.2 SUSE Manager Server 4.2 openSUSE Leap 15.3 openSUSE Leap Micro 5.2 ______________________________________________________________________________ An update that fixes one vulnerability is now available. Description: This update for gdk-pixbuf fixes the following issues: - CVE-2021-46829: Fixed overflow when compositing or clearing frames (bsc#1201826). Patch Instructions: To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap Micro 5.2: zypper in -t patch openSUSE-Leap-Micro-5.2-2022-2996=1 - openSUSE Leap 15.3: zypper in -t patch openSUSE-SLE-15.3-2022-2996=1 - SUSE Linux Enterprise Module for Desktop Applications 15-SP3: zypper in -t patch SUSE-SLE-Module-Desktop-Applications-15-SP3-2022-2996=1 - SUSE Linux Enterprise Module for Basesystem 15-SP3: zypper in -t patch SUSE-SLE-Module-Basesystem-15-SP3-2022-2996=1 - SUSE Linux Enterprise Micro 5.2: zypper in -t patch SUSE-SUSE-MicroOS-5.2-2022-2996=1 Package List: - openSUSE Leap Micro 5.2 (aarch64 x86_64): gdk-pixbuf-debugsource-2.40.0-150200.3.6.1 gdk-pixbuf-query-loaders-2.40.0-150200.3.6.1 gdk-pixbuf-query-loaders-debuginfo-2.40.0-150200.3.6.1 libgdk_pixbuf-2_0-0-2.40.0-150200.3.6.1 libgdk_pixbuf-2_0-0-debuginfo-2.40.0-150200.3.6.1 typelib-1_0-GdkPixbuf-2_0-2.40.0-150200.3.6.1 - openSUSE Leap 15.3 (aarch64 ppc64le s390x x86_64): gdk-pixbuf-debugsource-2.40.0-150200.3.6.1 gdk-pixbuf-devel-2.40.0-150200.3.6.1 gdk-pixbuf-devel-debuginfo-2.40.0-150200.3.6.1 gdk-pixbuf-query-loaders-2.40.0-150200.3.6.1 gdk-pixbuf-query-loaders-debuginfo-2.40.0-150200.3.6.1 gdk-pixbuf-thumbnailer-2.40.0-150200.3.6.1 gdk-pixbuf-thumbnailer-debuginfo-2.40.0-150200.3.6.1 libgdk_pixbuf-2_0-0-2.40.0-150200.3.6.1 libgdk_pixbuf-2_0-0-debuginfo-2.40.0-150200.3.6.1 typelib-1_0-GdkPixbuf-2_0-2.40.0-150200.3.6.1 typelib-1_0-GdkPixdata-2_0-2.40.0-150200.3.6.1 - openSUSE Leap 15.3 (noarch): gdk-pixbuf-lang-2.40.0-150200.3.6.1 - openSUSE Leap 15.3 (x86_64): gdk-pixbuf-devel-32bit-2.40.0-150200.3.6.1 gdk-pixbuf-devel-32bit-debuginfo-2.40.0-150200.3.6.1 gdk-pixbuf-query-loaders-32bit-2.40.0-150200.3.6.1 gdk-pixbuf-query-loaders-32bit-debuginfo-2.40.0-150200.3.6.1 libgdk_pixbuf-2_0-0-32bit-2.40.0-150200.3.6.1 libgdk_pixbuf-2_0-0-32bit-debuginfo-2.40.0-150200.3.6.1 - SUSE Linux Enterprise Module for Desktop Applications 15-SP3 (x86_64): gdk-pixbuf-debugsource-2.40.0-150200.3.6.1 gdk-pixbuf-query-loaders-32bit-2.40.0-150200.3.6.1 gdk-pixbuf-query-loaders-32bit-debuginfo-2.40.0-150200.3.6.1 libgdk_pixbuf-2_0-0-32bit-2.40.0-150200.3.6.1 libgdk_pixbuf-2_0-0-32bit-debuginfo-2.40.0-150200.3.6.1 - SUSE Linux Enterprise Module for Basesystem 15-SP3 (aarch64 ppc64le s390x x86_64): gdk-pixbuf-debugsource-2.40.0-150200.3.6.1 gdk-pixbuf-devel-2.40.0-150200.3.6.1 gdk-pixbuf-devel-debuginfo-2.40.0-150200.3.6.1 gdk-pixbuf-query-loaders-2.40.0-150200.3.6.1 gdk-pixbuf-query-loaders-debuginfo-2.40.0-150200.3.6.1 gdk-pixbuf-thumbnailer-2.40.0-150200.3.6.1 gdk-pixbuf-thumbnailer-debuginfo-2.40.0-150200.3.6.1 libgdk_pixbuf-2_0-0-2.40.0-150200.3.6.1 libgdk_pixbuf-2_0-0-debuginfo-2.40.0-150200.3.6.1 typelib-1_0-GdkPixbuf-2_0-2.40.0-150200.3.6.1 typelib-1_0-GdkPixdata-2_0-2.40.0-150200.3.6.1 - SUSE Linux Enterprise Module for Basesystem 15-SP3 (noarch): gdk-pixbuf-lang-2.40.0-150200.3.6.1 - SUSE Linux Enterprise Micro 5.2 (aarch64 s390x x86_64): gdk-pixbuf-debugsource-2.40.0-150200.3.6.1 gdk-pixbuf-query-loaders-2.40.0-150200.3.6.1 gdk-pixbuf-query-loaders-debuginfo-2.40.0-150200.3.6.1 libgdk_pixbuf-2_0-0-2.40.0-150200.3.6.1 libgdk_pixbuf-2_0-0-debuginfo-2.40.0-150200.3.6.1 typelib-1_0-GdkPixbuf-2_0-2.40.0-150200.3.6.1 References: https://www.suse.com/security/cve/CVE-2021-46829.html https://bugzilla.suse.com/1201826

1 0

SUSE-SU-2022:2998-1: moderate: Security update for ImageMagick
by opensuse-security＠opensuse.org 02 Sep '22

02 Sep '22

SUSE Security Update: Security update for ImageMagick ______________________________________________________________________________ Announcement ID: SUSE-SU-2022:2998-1 Rating: moderate References: #1199350 #1202250 Cross-References: CVE-2022-2719 CVE-2022-28463 CVSS scores: CVE-2022-2719 (NVD) : 5.5 CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H CVE-2022-2719 (SUSE): 5.5 CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H CVE-2022-28463 (NVD) : 7.8 CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H CVE-2022-28463 (SUSE): 5.5 CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N Affected Products: SUSE Linux Enterprise Desktop 15-SP4 SUSE Linux Enterprise High Performance Computing 15-SP4 SUSE Linux Enterprise Module for Desktop Applications 15-SP4 SUSE Linux Enterprise Module for Development Tools 15-SP4 SUSE Linux Enterprise Server 15-SP4 SUSE Linux Enterprise Server for SAP Applications 15-SP4 SUSE Manager Proxy 4.3 SUSE Manager Retail Branch Server 4.3 SUSE Manager Server 4.3 openSUSE Leap 15.4 ______________________________________________________________________________ An update that fixes two vulnerabilities is now available. Description: This update for ImageMagick fixes the following issues: - CVE-2022-2719: Fixed a reachable assertion that could lead to denial of service via a crafted file (bsc#1202250). - CVE-2022-28463: Fixed a buffer overflow that could be triggered by a crafted input file (bsc#1199350). Patch Instructions: To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 15.4: zypper in -t patch openSUSE-SLE-15.4-2022-2998=1 - SUSE Linux Enterprise Module for Development Tools 15-SP4: zypper in -t patch SUSE-SLE-Module-Development-Tools-15-SP4-2022-2998=1 - SUSE Linux Enterprise Module for Desktop Applications 15-SP4: zypper in -t patch SUSE-SLE-Module-Desktop-Applications-15-SP4-2022-2998=1 Package List: - openSUSE Leap 15.4 (aarch64 ppc64le s390x x86_64): ImageMagick-7.1.0.9-150400.6.6.1 ImageMagick-config-7-SUSE-7.1.0.9-150400.6.6.1 ImageMagick-config-7-upstream-7.1.0.9-150400.6.6.1 ImageMagick-debuginfo-7.1.0.9-150400.6.6.1 ImageMagick-debugsource-7.1.0.9-150400.6.6.1 ImageMagick-devel-7.1.0.9-150400.6.6.1 ImageMagick-extra-7.1.0.9-150400.6.6.1 ImageMagick-extra-debuginfo-7.1.0.9-150400.6.6.1 libMagick++-7_Q16HDRI5-7.1.0.9-150400.6.6.1 libMagick++-7_Q16HDRI5-debuginfo-7.1.0.9-150400.6.6.1 libMagick++-devel-7.1.0.9-150400.6.6.1 libMagickCore-7_Q16HDRI10-7.1.0.9-150400.6.6.1 libMagickCore-7_Q16HDRI10-debuginfo-7.1.0.9-150400.6.6.1 libMagickWand-7_Q16HDRI10-7.1.0.9-150400.6.6.1 libMagickWand-7_Q16HDRI10-debuginfo-7.1.0.9-150400.6.6.1 perl-PerlMagick-7.1.0.9-150400.6.6.1 perl-PerlMagick-debuginfo-7.1.0.9-150400.6.6.1 - openSUSE Leap 15.4 (x86_64): ImageMagick-devel-32bit-7.1.0.9-150400.6.6.1 libMagick++-7_Q16HDRI5-32bit-7.1.0.9-150400.6.6.1 libMagick++-7_Q16HDRI5-32bit-debuginfo-7.1.0.9-150400.6.6.1 libMagick++-devel-32bit-7.1.0.9-150400.6.6.1 libMagickCore-7_Q16HDRI10-32bit-7.1.0.9-150400.6.6.1 libMagickCore-7_Q16HDRI10-32bit-debuginfo-7.1.0.9-150400.6.6.1 libMagickWand-7_Q16HDRI10-32bit-7.1.0.9-150400.6.6.1 libMagickWand-7_Q16HDRI10-32bit-debuginfo-7.1.0.9-150400.6.6.1 - openSUSE Leap 15.4 (noarch): ImageMagick-doc-7.1.0.9-150400.6.6.1 - SUSE Linux Enterprise Module for Development Tools 15-SP4 (aarch64 ppc64le s390x x86_64): ImageMagick-debuginfo-7.1.0.9-150400.6.6.1 ImageMagick-debugsource-7.1.0.9-150400.6.6.1 perl-PerlMagick-7.1.0.9-150400.6.6.1 perl-PerlMagick-debuginfo-7.1.0.9-150400.6.6.1 - SUSE Linux Enterprise Module for Desktop Applications 15-SP4 (aarch64 ppc64le s390x x86_64): ImageMagick-7.1.0.9-150400.6.6.1 ImageMagick-config-7-SUSE-7.1.0.9-150400.6.6.1 ImageMagick-config-7-upstream-7.1.0.9-150400.6.6.1 ImageMagick-debuginfo-7.1.0.9-150400.6.6.1 ImageMagick-debugsource-7.1.0.9-150400.6.6.1 ImageMagick-devel-7.1.0.9-150400.6.6.1 libMagick++-7_Q16HDRI5-7.1.0.9-150400.6.6.1 libMagick++-7_Q16HDRI5-debuginfo-7.1.0.9-150400.6.6.1 libMagick++-devel-7.1.0.9-150400.6.6.1 libMagickCore-7_Q16HDRI10-7.1.0.9-150400.6.6.1 libMagickCore-7_Q16HDRI10-debuginfo-7.1.0.9-150400.6.6.1 libMagickWand-7_Q16HDRI10-7.1.0.9-150400.6.6.1 libMagickWand-7_Q16HDRI10-debuginfo-7.1.0.9-150400.6.6.1 References: https://www.suse.com/security/cve/CVE-2022-2719.html https://www.suse.com/security/cve/CVE-2022-28463.html https://bugzilla.suse.com/1199350 https://bugzilla.suse.com/1202250

1 0

SUSE-SU-2022:2993-1: important: Security update for freerdp
by opensuse-security＠opensuse.org 02 Sep '22

02 Sep '22

SUSE Security Update: Security update for freerdp ______________________________________________________________________________ Announcement ID: SUSE-SU-2022:2993-1 Rating: important References: #1191895 Cross-References: CVE-2021-41159 CVE-2021-41160 CVSS scores: CVE-2021-41159 (NVD) : 5.8 CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:N/I:H/A:N CVE-2021-41159 (SUSE): 8.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H CVE-2021-41160 (NVD) : 5.3 CVSS:3.1/AV:L/AC:H/PR:H/UI:N/S:C/C:N/I:H/A:N CVE-2021-41160 (SUSE): 8.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H Affected Products: SUSE Linux Enterprise Desktop 15-SP4 SUSE Linux Enterprise High Performance Computing 15-SP4 SUSE Linux Enterprise Module for Packagehub Subpackages 15-SP4 SUSE Linux Enterprise Server 15-SP4 SUSE Linux Enterprise Server for SAP Applications 15-SP4 SUSE Linux Enterprise Workstation Extension 15-SP4 SUSE Manager Proxy 4.3 SUSE Manager Retail Branch Server 4.3 SUSE Manager Server 4.3 openSUSE Leap 15.4 ______________________________________________________________________________ An update that fixes two vulnerabilities is now available. Description: This update for freerdp fixes the following issues: - Fixed two input validation issues (bsc#1191895): - CVE-2021-41159: Fixed an improper validation of client input for gateway connections. - CVE-2021-41160: Fixed improper region checks that could lead to memory corruption. Patch Instructions: To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 15.4: zypper in -t patch openSUSE-SLE-15.4-2022-2993=1 - SUSE Linux Enterprise Workstation Extension 15-SP4: zypper in -t patch SUSE-SLE-Product-WE-15-SP4-2022-2993=1 - SUSE Linux Enterprise Module for Packagehub Subpackages 15-SP4: zypper in -t patch SUSE-SLE-Module-Packagehub-Subpackages-15-SP4-2022-2993=1 Package List: - openSUSE Leap 15.4 (aarch64 ppc64le s390x x86_64): freerdp-2.4.0-150400.3.6.1 freerdp-debuginfo-2.4.0-150400.3.6.1 freerdp-debugsource-2.4.0-150400.3.6.1 freerdp-devel-2.4.0-150400.3.6.1 freerdp-proxy-2.4.0-150400.3.6.1 freerdp-proxy-debuginfo-2.4.0-150400.3.6.1 freerdp-server-2.4.0-150400.3.6.1 freerdp-server-debuginfo-2.4.0-150400.3.6.1 freerdp-wayland-2.4.0-150400.3.6.1 freerdp-wayland-debuginfo-2.4.0-150400.3.6.1 libfreerdp2-2.4.0-150400.3.6.1 libfreerdp2-debuginfo-2.4.0-150400.3.6.1 libuwac0-0-2.4.0-150400.3.6.1 libuwac0-0-debuginfo-2.4.0-150400.3.6.1 libwinpr2-2.4.0-150400.3.6.1 libwinpr2-debuginfo-2.4.0-150400.3.6.1 uwac0-0-devel-2.4.0-150400.3.6.1 winpr2-devel-2.4.0-150400.3.6.1 - SUSE Linux Enterprise Workstation Extension 15-SP4 (x86_64): freerdp-2.4.0-150400.3.6.1 freerdp-debuginfo-2.4.0-150400.3.6.1 freerdp-debugsource-2.4.0-150400.3.6.1 freerdp-devel-2.4.0-150400.3.6.1 freerdp-proxy-2.4.0-150400.3.6.1 freerdp-proxy-debuginfo-2.4.0-150400.3.6.1 libfreerdp2-2.4.0-150400.3.6.1 libfreerdp2-debuginfo-2.4.0-150400.3.6.1 libwinpr2-2.4.0-150400.3.6.1 libwinpr2-debuginfo-2.4.0-150400.3.6.1 winpr2-devel-2.4.0-150400.3.6.1 - SUSE Linux Enterprise Module for Packagehub Subpackages 15-SP4 (aarch64 ppc64le s390x): freerdp-2.4.0-150400.3.6.1 freerdp-debuginfo-2.4.0-150400.3.6.1 freerdp-debugsource-2.4.0-150400.3.6.1 freerdp-devel-2.4.0-150400.3.6.1 freerdp-proxy-2.4.0-150400.3.6.1 freerdp-proxy-debuginfo-2.4.0-150400.3.6.1 libfreerdp2-2.4.0-150400.3.6.1 libfreerdp2-debuginfo-2.4.0-150400.3.6.1 libwinpr2-2.4.0-150400.3.6.1 libwinpr2-debuginfo-2.4.0-150400.3.6.1 winpr2-devel-2.4.0-150400.3.6.1 References: https://www.suse.com/security/cve/CVE-2021-41159.html https://www.suse.com/security/cve/CVE-2021-41160.html https://bugzilla.suse.com/1191895

1 0

SUSE-SU-2022:2995-1: moderate: Security update for gdk-pixbuf
by opensuse-security＠opensuse.org 02 Sep '22

02 Sep '22

SUSE Security Update: Security update for gdk-pixbuf ______________________________________________________________________________ Announcement ID: SUSE-SU-2022:2995-1 Rating: moderate References: #1201826 Cross-References: CVE-2021-46829 CVSS scores: CVE-2021-46829 (NVD) : 7.8 CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H CVE-2021-46829 (SUSE): 5.5 CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H Affected Products: SUSE Linux Enterprise Desktop 15-SP4 SUSE Linux Enterprise High Performance Computing 15-SP4 SUSE Linux Enterprise Module for Basesystem 15-SP4 SUSE Linux Enterprise Server 15-SP4 SUSE Linux Enterprise Server for SAP Applications 15-SP4 SUSE Manager Proxy 4.3 SUSE Manager Retail Branch Server 4.3 SUSE Manager Server 4.3 openSUSE Leap 15.4 ______________________________________________________________________________ An update that fixes one vulnerability is now available. Description: This update for gdk-pixbuf fixes the following issues: Update to version 2.42.8, including the following: - CVE-2021-46829: Fixed a heap-based buffer overflow when compositing or clearing frames in GIF files (bsc#1201826). Patch Instructions: To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 15.4: zypper in -t patch openSUSE-SLE-15.4-2022-2995=1 - SUSE Linux Enterprise Module for Basesystem 15-SP4: zypper in -t patch SUSE-SLE-Module-Basesystem-15-SP4-2022-2995=1 Package List: - openSUSE Leap 15.4 (aarch64 ppc64le s390x x86_64): gdk-pixbuf-debugsource-2.42.8-150400.5.3.1 gdk-pixbuf-devel-2.42.8-150400.5.3.1 gdk-pixbuf-devel-debuginfo-2.42.8-150400.5.3.1 gdk-pixbuf-query-loaders-2.42.8-150400.5.3.1 gdk-pixbuf-query-loaders-debuginfo-2.42.8-150400.5.3.1 gdk-pixbuf-thumbnailer-2.42.8-150400.5.3.1 gdk-pixbuf-thumbnailer-debuginfo-2.42.8-150400.5.3.1 libgdk_pixbuf-2_0-0-2.42.8-150400.5.3.1 libgdk_pixbuf-2_0-0-debuginfo-2.42.8-150400.5.3.1 typelib-1_0-GdkPixbuf-2_0-2.42.8-150400.5.3.1 typelib-1_0-GdkPixdata-2_0-2.42.8-150400.5.3.1 - openSUSE Leap 15.4 (x86_64): gdk-pixbuf-devel-32bit-2.42.8-150400.5.3.1 gdk-pixbuf-devel-32bit-debuginfo-2.42.8-150400.5.3.1 gdk-pixbuf-query-loaders-32bit-2.42.8-150400.5.3.1 gdk-pixbuf-query-loaders-32bit-debuginfo-2.42.8-150400.5.3.1 libgdk_pixbuf-2_0-0-32bit-2.42.8-150400.5.3.1 libgdk_pixbuf-2_0-0-32bit-debuginfo-2.42.8-150400.5.3.1 - openSUSE Leap 15.4 (noarch): gdk-pixbuf-lang-2.42.8-150400.5.3.1 - SUSE Linux Enterprise Module for Basesystem 15-SP4 (aarch64 ppc64le s390x x86_64): gdk-pixbuf-debugsource-2.42.8-150400.5.3.1 gdk-pixbuf-devel-2.42.8-150400.5.3.1 gdk-pixbuf-devel-debuginfo-2.42.8-150400.5.3.1 gdk-pixbuf-query-loaders-2.42.8-150400.5.3.1 gdk-pixbuf-query-loaders-debuginfo-2.42.8-150400.5.3.1 gdk-pixbuf-thumbnailer-2.42.8-150400.5.3.1 gdk-pixbuf-thumbnailer-debuginfo-2.42.8-150400.5.3.1 libgdk_pixbuf-2_0-0-2.42.8-150400.5.3.1 libgdk_pixbuf-2_0-0-debuginfo-2.42.8-150400.5.3.1 typelib-1_0-GdkPixbuf-2_0-2.42.8-150400.5.3.1 typelib-1_0-GdkPixdata-2_0-2.42.8-150400.5.3.1 - SUSE Linux Enterprise Module for Basesystem 15-SP4 (noarch): gdk-pixbuf-lang-2.42.8-150400.5.3.1 - SUSE Linux Enterprise Module for Basesystem 15-SP4 (x86_64): gdk-pixbuf-query-loaders-32bit-2.42.8-150400.5.3.1 gdk-pixbuf-query-loaders-32bit-debuginfo-2.42.8-150400.5.3.1 libgdk_pixbuf-2_0-0-32bit-2.42.8-150400.5.3.1 libgdk_pixbuf-2_0-0-32bit-debuginfo-2.42.8-150400.5.3.1 References: https://www.suse.com/security/cve/CVE-2021-46829.html https://bugzilla.suse.com/1201826

1 0

SUSE-SU-2022:2599-2: important: Security update for xen
by opensuse-security＠opensuse.org 01 Sep '22

01 Sep '22

SUSE Security Update: Security update for xen ______________________________________________________________________________ Announcement ID: SUSE-SU-2022:2599-2 Rating: important References: #1027519 #1199965 #1199966 #1200549 #1201394 #1201469 Cross-References: CVE-2022-21123 CVE-2022-21125 CVE-2022-21166 CVE-2022-23816 CVE-2022-23825 CVE-2022-26362 CVE-2022-26363 CVE-2022-26364 CVE-2022-29900 CVE-2022-33745 CVSS scores: CVE-2022-21123 (NVD) : 5.5 CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N CVE-2022-21123 (SUSE): 6.1 CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:L/A:N CVE-2022-21125 (NVD) : 5.5 CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N CVE-2022-21125 (SUSE): 5.6 CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:C/C:H/I:N/A:N CVE-2022-21166 (NVD) : 5.5 CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N CVE-2022-21166 (SUSE): 5.5 CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N CVE-2022-23816 (SUSE): 5.6 CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:C/C:H/I:N/A:N CVE-2022-23825 (NVD) : 6.5 CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N CVE-2022-23825 (SUSE): 5.6 CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:C/C:H/I:N/A:N CVE-2022-26362 (NVD) : 6.4 CVSS:3.1/AV:L/AC:H/PR:H/UI:N/S:U/C:H/I:H/A:H CVE-2022-26362 (SUSE): 7.4 CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H CVE-2022-26363 (NVD) : 6.7 CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H CVE-2022-26363 (SUSE): 8.1 CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H CVE-2022-26364 (NVD) : 6.7 CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H CVE-2022-26364 (SUSE): 8.1 CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H CVE-2022-29900 (NVD) : 6.5 CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N CVE-2022-29900 (SUSE): 4.7 CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:N/A:N CVE-2022-33745 (NVD) : 8.8 CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H CVE-2022-33745 (SUSE): 7.5 CVSS:3.1/AV:L/AC:H/PR:H/UI:N/S:C/C:H/I:H/A:H Affected Products: openSUSE Leap Micro 5.2 ______________________________________________________________________________ An update that fixes 10 vulnerabilities is now available. Description: This update for xen fixes the following issues: - CVE-2022-26363, CVE-2022-26364: Fixed insufficient care with non-coherent mappings (XSA-402) (bsc#1199966). - CVE-2022-21123, CVE-2022-21125, CVE-2022-21166: Fixed MMIO stale data vulnerabilities on x86 (XSA-404) (bsc#1200549). - CVE-2022-26362: Fixed a race condition in typeref acquisition (XSA-401) (bsc#1199965). - CVE-2022-33745: Fixed insufficient TLB flush for x86 PV guests in shadow mode (XSA-408) (bsc#1201394). - CVE-2022-23816, CVE-2022-23825, CVE-2022-29900: Fixed RETBLEED vulnerability, arbitrary speculative code execution with return instructions (XSA-407) (bsc#1201469). Fixed several upstream bugs (bsc#1027519). Special Instructions and Notes: Please reboot the system after installing this update. Patch Instructions: To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap Micro 5.2: zypper in -t patch openSUSE-Leap-Micro-5.2-2022-2599=1 Package List: - openSUSE Leap Micro 5.2 (x86_64): xen-debugsource-4.14.5_04-150300.3.32.1 xen-libs-4.14.5_04-150300.3.32.1 xen-libs-debuginfo-4.14.5_04-150300.3.32.1 References: https://www.suse.com/security/cve/CVE-2022-21123.html https://www.suse.com/security/cve/CVE-2022-21125.html https://www.suse.com/security/cve/CVE-2022-21166.html https://www.suse.com/security/cve/CVE-2022-23816.html https://www.suse.com/security/cve/CVE-2022-23825.html https://www.suse.com/security/cve/CVE-2022-26362.html https://www.suse.com/security/cve/CVE-2022-26363.html https://www.suse.com/security/cve/CVE-2022-26364.html https://www.suse.com/security/cve/CVE-2022-29900.html https://www.suse.com/security/cve/CVE-2022-33745.html https://bugzilla.suse.com/1027519 https://bugzilla.suse.com/1199965 https://bugzilla.suse.com/1199966 https://bugzilla.suse.com/1200549 https://bugzilla.suse.com/1201394 https://bugzilla.suse.com/1201469

1 0

SUSE-SU-2022:2547-2: important: Security update for logrotate
by opensuse-security＠opensuse.org 01 Sep '22

01 Sep '22

SUSE Security Update: Security update for logrotate ______________________________________________________________________________ Announcement ID: SUSE-SU-2022:2547-2 Rating: important References: #1192449 #1200278 #1200802 Affected Products: openSUSE Leap Micro 5.2 ______________________________________________________________________________ An update that contains security fixes can now be installed. Description: This update for logrotate fixes the following issues: Security issues fixed: - Improved coredump handing for SUID binaries (bsc#1192449). Non-security issues fixed: - Fixed "logrotate emits unintended warning: keyword size not properly separated, found 0x3d" (bsc#1200278, bsc#1200802). Patch Instructions: To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap Micro 5.2: zypper in -t patch openSUSE-Leap-Micro-5.2-2022-2547=1 Package List: - openSUSE Leap Micro 5.2 (aarch64 x86_64): logrotate-3.13.0-150000.4.7.1 logrotate-debuginfo-3.13.0-150000.4.7.1 logrotate-debugsource-3.13.0-150000.4.7.1 References: https://bugzilla.suse.com/1192449 https://bugzilla.suse.com/1200278 https://bugzilla.suse.com/1200802

1 0

SUSE-SU-2022:2614-2: moderate: Security update for dwarves and elfutils
by opensuse-security＠opensuse.org 01 Sep '22

01 Sep '22

SUSE Security Update: Security update for dwarves and elfutils ______________________________________________________________________________ Announcement ID: SUSE-SU-2022:2614-2 Rating: moderate References: #1033084 #1033085 #1033086 #1033087 #1033088 #1033089 #1033090 #1082318 #1104264 #1106390 #1107066 #1107067 #1111973 #1112723 #1112726 #1123685 #1125007 SLE-24501 Cross-References: CVE-2017-7607 CVE-2017-7608 CVE-2017-7609 CVE-2017-7610 CVE-2017-7611 CVE-2017-7612 CVE-2017-7613 CVE-2018-16062 CVE-2018-16402 CVE-2018-16403 CVE-2018-18310 CVE-2018-18520 CVE-2018-18521 CVE-2019-7146 CVE-2019-7148 CVE-2019-7149 CVE-2019-7150 CVE-2019-7664 CVE-2019-7665 CVSS scores: CVE-2017-7607 (NVD) : 5.5 CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H CVE-2017-7607 (SUSE): 4.3 CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:L CVE-2017-7608 (NVD) : 5.5 CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H CVE-2017-7608 (SUSE): 3.3 CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:L CVE-2017-7609 (NVD) : 5.5 CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H CVE-2017-7609 (SUSE): 3.3 CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:L CVE-2017-7610 (NVD) : 5.5 CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H CVE-2017-7610 (SUSE): 3.3 CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:L CVE-2017-7611 (NVD) : 5.5 CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H CVE-2017-7611 (SUSE): 3.3 CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:L CVE-2017-7612 (NVD) : 5.5 CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H CVE-2017-7612 (SUSE): 3.3 CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:L CVE-2017-7613 (NVD) : 5.5 CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H CVE-2017-7613 (SUSE): 3.3 CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:L CVE-2018-16062 (NVD) : 5.5 CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H CVE-2018-16062 (SUSE): 5.4 CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:L CVE-2018-16402 (NVD) : 9.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H CVE-2018-16402 (SUSE): 4.3 CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:L CVE-2018-16403 (NVD) : 5.5 CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H CVE-2018-16403 (SUSE): 3.3 CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:L CVE-2018-18310 (NVD) : 5.5 CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H CVE-2018-18310 (SUSE): 3.3 CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:L CVE-2018-18520 (NVD) : 6.5 CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H CVE-2018-18520 (SUSE): 3.3 CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:L CVE-2018-18521 (NVD) : 5.5 CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H CVE-2018-18521 (SUSE): 3.3 CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:L CVE-2019-7146 (NVD) : 5.5 CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H CVE-2019-7148 (NVD) : 6.5 CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H CVE-2019-7149 (NVD) : 6.5 CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H CVE-2019-7150 (NVD) : 5.5 CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H CVE-2019-7150 (SUSE): 3.3 CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:L CVE-2019-7664 (NVD) : 5.5 CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H CVE-2019-7664 (SUSE): 3.3 CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:L CVE-2019-7665 (NVD) : 5.5 CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H CVE-2019-7665 (SUSE): 3.3 CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:L Affected Products: openSUSE Leap Micro 5.2 ______________________________________________________________________________ An update that fixes 19 vulnerabilities, contains one feature is now available. Description: This update for dwarves and elfutils fixes the following issues: elfutils was updated to version 0.177 (jsc#SLE-24501): - elfclassify: New tool to analyze ELF objects. - readelf: Print DW_AT_data_member_location as decimal offset. Decode DW_AT_discr_list block attributes. - libdw: Add DW_AT_GNU_numerator, DW_AT_GNU_denominator and DW_AT_GNU_bias. - libdwelf: Add dwelf_elf_e_machine_string. dwelf_elf_begin now only returns NULL when there is an error reading or decompressing a file. If the file is not an ELF file an ELF handle of type ELF_K_NONE is returned. - backends: Add support for C-SKY. Update to version 0.176: - build: Add new --enable-install-elfh option. Do NOT use this for system installs (it overrides glibc elf.h). - backends: riscv improved core file and return value location support. - Fixes: - CVE-2019-7146, CVE-2019-7148, CVE-2019-7149, CVE-2019-7664 - CVE-2019-7150: dwfl_segment_report_module doesn't check whether the dyn data read from core file is truncated (bsc#1123685) - CVE-2019-7665: NT_PLATFORM core file note should be a zero terminated string (CVE is a bit misleading, as this is not a bug in libelf as described) (bsc#1125007) Update to version 0.175: - readelf: Handle mutliple .debug_macro sections. Recognize and parse GNU Property, NT_VERSION and GNU Build Attribute ELF Notes. - strip: Handle SHT_GROUP correctly. Add strip --reloc-debug-sections-only option. Handle relocations against GNU compressed sections. - libdwelf: New function dwelf_elf_begin. - libcpu: Recognize bpf jump variants BPF_JLT, BPF_JLE, BPF_JSLT and BPF_JSLE. backends: RISCV handles ADD/SUB relocations. Handle SHT_X86_64_UNWIND. - CVE-2018-18521: arlib: Divide-by-zero vulnerabilities in the function arlib_add_symbols() used by eu-ranlib (bsc#1112723) - CVE-2018-18310: Invalid Address Read problem in dwfl_segment_report_module.c (bsc#1111973) - CVE-2018-18520: eu-size: Bad handling of ar files inside are files (bsc#1112726) Update to version 0.174: - libelf, libdw and all tools now handle extended shnum and shstrndx correctly. - elfcompress: Don't rewrite input file if no section data needs updating. Try harder to keep same file mode bits (suid) on rewrite. - strip: Handle mixed (out of order) allocated/non-allocated sections. - unstrip: Handle SHT_GROUP sections. - backends: RISCV and M68K now have backend implementations to generate CFI based backtraces. - Fixes: - CVE-2018-16402: libelf: denial of service/double free on an attempt to decompress the same section twice (bsc#1107066) Double-free crash in nm and readelf - CVE-2018-16403: heap buffer overflow in readelf (bsc#1107067) - CVE-2018-16062: heap-buffer-overflow in /elfutils/libdw/dwarf_getaranges.c:156 (bsc#1106390) Update to version 0.173: - More fixes for crashes and hangs found by afl-fuzz. In particular various functions now detect and break infinite loops caused by bad DIE tree cycles. - readelf: Will now lookup the size and signedness of constant value types to display them correctly (and not just how they were encoded). - libdw: New function dwarf_next_lines to read CU-less .debug_line data. dwarf_begin_elf now accepts ELF files containing just .debug_line or .debug_frame sections (which can be read without needing a DIE tree from the .debug_info section). Removed dwarf_getscn_info, which was never implemented. - backends: Handle BPF simple relocations. The RISCV backends now handles ABI specific CFI and knows about RISCV register types and names. Update to version 0.172: - Various bug fixes in libdw and eu-readelf dealing with bad DWARF5 data. Thanks to running the afl fuzzer on eu-readelf and various testcases. Update to version 0.171: - DWARF5 and split dwarf, including GNU DebugFission, are supported now. Data can be read from the new DWARF sections .debug_addr, .debug_line_str, .debug_loclists, .debug_str_offsets and .debug_rnglists. Plus the new DWARF5 and GNU DebugFission encodings of the existing .debug sections. Also in split DWARF .dwo (DWARF object) files. This support is mostly handled by existing functions (dwarf_getlocation*, dwarf_getsrclines, dwarf_ranges, dwarf_form*, etc.) now returning the data from the new sections and data formats. But some new functions have been added to more easily get information about skeleton and split compile units (dwarf_get_units and dwarf_cu_info), handle new attribute data (dwarf_getabbrevattr_data) and to keep references to Dwarf_Dies that might come from different sections or files (dwarf_die_addr_die). - Not yet supported are .dwp (Dwarf Package) and .sup (Dwarf Supplementary) files, the .debug_names index, the .debug_cu_index and .debug_tu_index sections. Only a single .debug_info (and .debug_types) section are currently handled. - readelf: Handle all new DWARF5 sections. --debug-dump=info+ will show split unit DIEs when found. --dwarf-skeleton can be used when inspecting a .dwo file. Recognizes GNU locviews with --debug-dump=loc. - libdw: New functions dwarf_die_addr_die, dwarf_get_units, dwarf_getabbrevattr_data and dwarf_cu_info. libdw will now try to resolve the alt file on first use of an alt attribute FORM when not set yet with dwarf_set_alt. dwarf_aggregate_size() now works with multi-dimensional arrays. - libdwfl: Use process_vm_readv when available instead of ptrace. backends: Add a RISC-V backend. There were various improvements to build on Windows. The sha1 and md5 implementations have been removed, they weren't used. Update to version 0.170: - libdw: Added new DWARF5 attribute, tag, character encoding, language code, calling convention, defaulted member function and macro constants to dwarf.h. New functions dwarf_default_lower_bound and dwarf_line_file. dwarf_peel_type now handles DWARF5 immutable, packed and shared tags. dwarf_getmacros now handles DWARF5 .debug_macro sections. - strip: Add -R, --remove-section=SECTION and --keep-section=SECTION. - backends: The bpf disassembler is now always build on all platforms. Update to version 0.169: - backends: Add support for EM_PPC64 GNU_ATTRIBUTES. Frame pointer unwinding fallback support for i386, x86_64, aarch64. - translations: Update Polish translation. - CVE-2017-7611: elfutils: DoS (heap-based buffer over-read and application crash) via a crafted ELF file (bsc#1033088) - CVE-2017-7610: elflint: heap-based buffer overflow in check_group (bsc#1033087) - CVE-2017-7609: memory allocation failure in __libelf_decompress (bsc#1033086) - CVE-2017-7607: heap-based buffer overflow in handle_gnu_hashi (readelf.c) (bsc#1033084) - CVE-2017-7608: heap-based buffer overflow in ebl_object_note_type_name (eblobjnotetypename.c) (bsc#1033085) - CVE-2017-7613: elfutils: denial of service (memory consumption) via a crafted ELF file (bsc#1033090) - CVE-2017-7612: elfutils: denial of service (heap-based buffer over-read and application crash) via a crafted ELF file (bsc#1033089) - Don't make elfutils recommend elfutils-lang as elfutils-lang already supplements elfutils. dwarves is shipped new in version 1.22 to provide tooling for use by the Linux Kernel BTF verification framework. Patch Instructions: To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap Micro 5.2: zypper in -t patch openSUSE-Leap-Micro-5.2-2022-2614=1 Package List: - openSUSE Leap Micro 5.2 (aarch64 x86_64): dwarves-1.22-150300.7.3.1 dwarves-debuginfo-1.22-150300.7.3.1 dwarves-debugsource-1.22-150300.7.3.1 elfutils-0.177-150300.11.3.1 elfutils-debuginfo-0.177-150300.11.3.1 elfutils-debugsource-0.177-150300.11.3.1 libasm1-0.177-150300.11.3.1 libasm1-debuginfo-0.177-150300.11.3.1 libdw1-0.177-150300.11.3.1 libdw1-debuginfo-0.177-150300.11.3.1 libdwarves-devel-1.22-150300.7.3.1 libdwarves1-1.22-150300.7.3.1 libdwarves1-debuginfo-1.22-150300.7.3.1 libebl-plugins-0.177-150300.11.3.1 libebl-plugins-debuginfo-0.177-150300.11.3.1 libelf1-0.177-150300.11.3.1 libelf1-debuginfo-0.177-150300.11.3.1 References: https://www.suse.com/security/cve/CVE-2017-7607.html https://www.suse.com/security/cve/CVE-2017-7608.html https://www.suse.com/security/cve/CVE-2017-7609.html https://www.suse.com/security/cve/CVE-2017-7610.html https://www.suse.com/security/cve/CVE-2017-7611.html https://www.suse.com/security/cve/CVE-2017-7612.html https://www.suse.com/security/cve/CVE-2017-7613.html https://www.suse.com/security/cve/CVE-2018-16062.html https://www.suse.com/security/cve/CVE-2018-16402.html https://www.suse.com/security/cve/CVE-2018-16403.html https://www.suse.com/security/cve/CVE-2018-18310.html https://www.suse.com/security/cve/CVE-2018-18520.html https://www.suse.com/security/cve/CVE-2018-18521.html https://www.suse.com/security/cve/CVE-2019-7146.html https://www.suse.com/security/cve/CVE-2019-7148.html https://www.suse.com/security/cve/CVE-2019-7149.html https://www.suse.com/security/cve/CVE-2019-7150.html https://www.suse.com/security/cve/CVE-2019-7664.html https://www.suse.com/security/cve/CVE-2019-7665.html https://bugzilla.suse.com/1033084 https://bugzilla.suse.com/1033085 https://bugzilla.suse.com/1033086 https://bugzilla.suse.com/1033087 https://bugzilla.suse.com/1033088 https://bugzilla.suse.com/1033089 https://bugzilla.suse.com/1033090 https://bugzilla.suse.com/1082318 https://bugzilla.suse.com/1104264 https://bugzilla.suse.com/1106390 https://bugzilla.suse.com/1107066 https://bugzilla.suse.com/1107067 https://bugzilla.suse.com/1111973 https://bugzilla.suse.com/1112723 https://bugzilla.suse.com/1112726 https://bugzilla.suse.com/1123685 https://bugzilla.suse.com/1125007

1 0