September 2022 - openSUSE Security Announce

SUSE-SU-2022:3408-1: important: Security update for the Linux Kernel
by opensuse-security＠opensuse.org 26 Sep '22

26 Sep '22

SUSE Security Update: Security update for the Linux Kernel ______________________________________________________________________________ Announcement ID: SUSE-SU-2022:3408-1 Rating: important References: #1177440 #1180153 #1188944 #1191881 #1194535 #1196616 #1197158 #1199482 #1199665 #1201019 #1201420 #1201705 #1201726 #1201948 #1202096 #1202097 #1202154 #1202335 #1202346 #1202347 #1202393 #1202396 #1202672 #1202897 #1202898 #1203098 #1203107 Cross-References: CVE-2020-36516 CVE-2021-4203 CVE-2022-1012 CVE-2022-20368 CVE-2022-20369 CVE-2022-21385 CVE-2022-2588 CVE-2022-26373 CVE-2022-2639 CVE-2022-2663 CVE-2022-29581 CVE-2022-2977 CVE-2022-3028 CVE-2022-36879 CVE-2022-39188 CVSS scores: CVE-2020-36516 (NVD) : 5.9 CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:N/I:H/A:L CVE-2020-36516 (SUSE): 8.1 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:H CVE-2021-4203 (NVD) : 6.8 CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:N/A:H CVE-2021-4203 (SUSE): 5.8 CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:L/A:L CVE-2022-1012 (NVD) : 9.1 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:H CVE-2022-1012 (SUSE): 6.5 CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:H CVE-2022-20368 (NVD) : 7.8 CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H CVE-2022-20368 (SUSE): 5.5 CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H CVE-2022-20369 (NVD) : 6.7 CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H CVE-2022-20369 (SUSE): 5.5 CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H CVE-2022-21385 (NVD) : 6.2 CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H CVE-2022-21385 (SUSE): 6.2 CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H CVE-2022-2588 (SUSE): 7.8 CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H CVE-2022-26373 (NVD) : 5.5 CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N CVE-2022-26373 (SUSE): 5.5 CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N CVE-2022-2639 (NVD) : 7.8 CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H CVE-2022-2639 (SUSE): 6.1 CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:H CVE-2022-2663 (NVD) : 5.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N CVE-2022-2663 (SUSE): 5.9 CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:N CVE-2022-29581 (NVD) : 7.8 CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H CVE-2022-29581 (SUSE): 7.8 CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H CVE-2022-2977 (NVD) : 7.8 CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H CVE-2022-2977 (SUSE): 4.2 CVSS:3.1/AV:L/AC:L/PR:H/UI:R/S:U/C:N/I:N/A:H CVE-2022-3028 (NVD) : 7 CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H CVE-2022-3028 (SUSE): 6.7 CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H CVE-2022-36879 (NVD) : 5.5 CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H CVE-2022-36879 (SUSE): 4.1 CVSS:3.1/AV:L/AC:H/PR:H/UI:N/S:U/C:N/I:N/A:H CVE-2022-39188 (NVD) : 4.7 CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:N/I:N/A:H CVE-2022-39188 (SUSE): 7 CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H Affected Products: SUSE CaaS Platform 4.0 SUSE Enterprise Storage 6 SUSE Linux Enterprise High Availability 15-SP1 SUSE Linux Enterprise High Performance Computing 15-SP1 SUSE Linux Enterprise High Performance Computing 15-SP1-ESPOS SUSE Linux Enterprise High Performance Computing 15-SP1-LTSS SUSE Linux Enterprise Module for Live Patching 15-SP1 SUSE Linux Enterprise Server 15-SP1 SUSE Linux Enterprise Server 15-SP1-BCL SUSE Linux Enterprise Server 15-SP1-LTSS SUSE Linux Enterprise Server for SAP 15-SP1 SUSE Linux Enterprise Server for SAP Applications 15-SP1 SUSE Linux Enterprise Storage 6 SUSE Manager Proxy 4.0 SUSE Manager Retail Branch Server 4.0 SUSE Manager Server 4.0 openSUSE Leap 15.3 openSUSE Leap 15.4 ______________________________________________________________________________ An update that solves 15 vulnerabilities and has 12 fixes is now available. Description: The SUSE Linux Enterprise 15 SP1 LTSS kernel was updated to receive various security and bugfixes. The following security bugs were fixed: - CVE-2020-36516: Fixed an issue in the mixed IPID assignment method where an attacker was able to inject data into or terminate a victim's TCP session (bnc#1196616). - CVE-2021-4203: Fixed use-after-free read flaw that was found in sock_getsockopt() in net/core/sock.c due to SO_PEERCRED and SO_PEERGROUPS race with listen() (bnc#1194535). - CVE-2022-1012: Fixed a memory leak problem that was found in the TCP source port generation algorithm in net/ipv4/tcp.c (bnc#1199482). - CVE-2022-20368: Fixed slab-out-of-bounds access in packet_recvmsg() (bsc#1202346). - CVE-2022-20369: Fixed out of bounds write in v4l2_m2m_querybuf of v4l2-mem2mem.c (bnc#1202347). - CVE-2022-21385: Fixed a flaw in net_rds_alloc_sgs() that allowed unprivileged local users to crash the machine (bnc#1202897). - CVE-2022-2588: Fixed use-after-free in cls_route (bsc#1202096). - CVE-2022-26373: Fixed non-transparent sharing of return predictor targets between contexts in some Intel Processors (bnc#1201726). - CVE-2022-2639: Fixed an integer coercion error that was found in the openvswitch kernel module (bnc#1202154). - CVE-2022-2663: Fixed an issue that was found in nf_conntrack_irc where the message handling could be confused and incorrectly matches the message (bnc#1202097). - CVE-2022-29581: Fixed improper update of reference count vulnerability in net/sched that allowed a local attacker to cause privilege escalation to root (bnc#1199665). - CVE-2022-2977: Fixed reference counting for struct tpm_chip (bsc#1202672). - CVE-2022-3028: Fixed race condition that was found in the IP framework for transforming packets (XFRM subsystem) (bnc#1202898). - CVE-2022-36879: Fixed an issue in xfrm_expand_policies in net/xfrm/xfrm_policy.c where a refcount could be dropped twice (bnc#1201948). - CVE-2022-39188: Fixed race condition in include/asm-generic/tlb.h where a device driver can free a page while it still has stale TLB entries (bnc#1203107). The following non-security bugs were fixed: - rpm: Fix parsing of rpm/macros.kernel-source on SLE12 (bsc#1201019). - cifs: fix error paths in cifs_tree_connect() (bsc#1177440). - cifs: fix uninitialized pointer in error case in dfs_cache_get_tgt_share (bsc#1188944). - cifs: report error instead of invalid when revalidating a dentry fails (bsc#1177440). - cifs: skip trailing separators of prefix paths (bsc#1188944). - kernel-obs-build: include qemu_fw_cfg (boo#1201705) - lightnvm: Remove lightnvm implemenation (bsc#1191881 bsc#1201420 ZDI-CAN-17325). - md/bitmap: do not set sb values if can't pass sanity check (bsc#1197158). - mm/rmap.c: do not reuse anon_vma if we just want a copy (git-fixes, bsc#1203098). - mm/rmap: Fix anon_vma->degree ambiguity leading to double-reuse (git-fixes, bsc#1203098). - net_sched: cls_route: disallow handle of 0 (bsc#1202393). - net_sched: cls_route: disallow handle of 0 (bsc#1202393). - objtool: Add --backtrace support (bsc#1202396). - objtool: Add support for intra-function calls (bsc#1202396). - objtool: Allow no-op CFI ops in alternatives (bsc#1202396). - objtool: Convert insn type to enum (bsc#1202396). - objtool: Do not use ignore flag for fake jumps (bsc#1202396). - objtool: Fix !CFI insn_state propagation (bsc#1202396). - objtool: Fix ORC vs alternatives (bsc#1202396). - objtool: Fix sibling call detection (bsc#1202396). - objtool: Make handle_insn_ops() unconditional (bsc#1202396). - objtool: Remove INSN_STACK (bsc#1202396). - objtool: Remove check preventing branches within alternative (bsc#1202396). - objtool: Rename elf_open() to prevent conflict with libelf from elftoolchain (bsc#1202396). - objtool: Rename struct cfi_state (bsc#1202396). - objtool: Rework allocating stack_ops on decode (bsc#1202396). - objtool: Rewrite alt->skip_orig (bsc#1202396). - objtool: Set insn->func for alternatives (bsc#1202396). - objtool: Support conditional retpolines (bsc#1202396). - objtool: Support multiple stack_op per instruction (bsc#1202396). - objtool: Track original function across branches (bsc#1202396). - objtool: Uniquely identify alternative instruction groups (bsc#1202396). - objtool: Use Elf_Scn typedef instead of assuming struct name (bsc#1202396). - tcp: add some entropy in __inet_hash_connect() (bsc#1180153 bsc#1202335). - tcp: change source port randomizarion at connect() time (bsc#1180153 bsc#1202335). Special Instructions and Notes: Please reboot the system after installing this update. Patch Instructions: To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 15.4: zypper in -t patch openSUSE-SLE-15.4-2022-3408=1 - openSUSE Leap 15.3: zypper in -t patch openSUSE-SLE-15.3-2022-3408=1 - SUSE Linux Enterprise Server for SAP 15-SP1: zypper in -t patch SUSE-SLE-Product-SLES_SAP-15-SP1-2022-3408=1 - SUSE Linux Enterprise Server 15-SP1-LTSS: zypper in -t patch SUSE-SLE-Product-SLES-15-SP1-LTSS-2022-3408=1 - SUSE Linux Enterprise Server 15-SP1-BCL: zypper in -t patch SUSE-SLE-Product-SLES-15-SP1-BCL-2022-3408=1 - SUSE Linux Enterprise Module for Live Patching 15-SP1: zypper in -t patch SUSE-SLE-Module-Live-Patching-15-SP1-2022-3408=1 Please note that this is the initial kernel livepatch without fixes itself, this livepatch package is later updated by seperate standalone livepatch updates. - SUSE Linux Enterprise High Performance Computing 15-SP1-LTSS: zypper in -t patch SUSE-SLE-Product-HPC-15-SP1-LTSS-2022-3408=1 - SUSE Linux Enterprise High Performance Computing 15-SP1-ESPOS: zypper in -t patch SUSE-SLE-Product-HPC-15-SP1-ESPOS-2022-3408=1 - SUSE Linux Enterprise High Availability 15-SP1: zypper in -t patch SUSE-SLE-Product-HA-15-SP1-2022-3408=1 - SUSE Enterprise Storage 6: zypper in -t patch SUSE-Storage-6-2022-3408=1 - SUSE CaaS Platform 4.0: To install this update, use the SUSE CaaS Platform 'skuba' tool. It will inform you if it detects new updates and let you then trigger updating of the complete cluster in a controlled way. Package List: - openSUSE Leap 15.4 (aarch64 ppc64le s390x x86_64): kernel-default-base-debuginfo-4.12.14-150100.197.123.1 kernel-vanilla-4.12.14-150100.197.123.1 kernel-vanilla-base-4.12.14-150100.197.123.1 kernel-vanilla-base-debuginfo-4.12.14-150100.197.123.1 kernel-vanilla-debuginfo-4.12.14-150100.197.123.1 kernel-vanilla-debugsource-4.12.14-150100.197.123.1 kernel-vanilla-devel-4.12.14-150100.197.123.1 kernel-vanilla-devel-debuginfo-4.12.14-150100.197.123.1 kernel-vanilla-livepatch-devel-4.12.14-150100.197.123.1 - openSUSE Leap 15.4 (ppc64le x86_64): kernel-debug-base-4.12.14-150100.197.123.1 kernel-debug-base-debuginfo-4.12.14-150100.197.123.1 - openSUSE Leap 15.4 (x86_64): kernel-kvmsmall-base-4.12.14-150100.197.123.1 kernel-kvmsmall-base-debuginfo-4.12.14-150100.197.123.1 - openSUSE Leap 15.4 (s390x): kernel-default-man-4.12.14-150100.197.123.1 kernel-zfcpdump-man-4.12.14-150100.197.123.1 - openSUSE Leap 15.3 (aarch64 ppc64le s390x x86_64): kernel-default-base-debuginfo-4.12.14-150100.197.123.1 kernel-vanilla-4.12.14-150100.197.123.1 kernel-vanilla-base-4.12.14-150100.197.123.1 kernel-vanilla-base-debuginfo-4.12.14-150100.197.123.1 kernel-vanilla-debuginfo-4.12.14-150100.197.123.1 kernel-vanilla-debugsource-4.12.14-150100.197.123.1 kernel-vanilla-devel-4.12.14-150100.197.123.1 kernel-vanilla-devel-debuginfo-4.12.14-150100.197.123.1 kernel-vanilla-livepatch-devel-4.12.14-150100.197.123.1 - openSUSE Leap 15.3 (ppc64le x86_64): kernel-debug-base-4.12.14-150100.197.123.1 kernel-debug-base-debuginfo-4.12.14-150100.197.123.1 - openSUSE Leap 15.3 (x86_64): kernel-kvmsmall-base-4.12.14-150100.197.123.1 kernel-kvmsmall-base-debuginfo-4.12.14-150100.197.123.1 - openSUSE Leap 15.3 (s390x): kernel-default-man-4.12.14-150100.197.123.1 kernel-zfcpdump-man-4.12.14-150100.197.123.1 - SUSE Linux Enterprise Server for SAP 15-SP1 (ppc64le x86_64): kernel-default-4.12.14-150100.197.123.1 kernel-default-base-4.12.14-150100.197.123.1 kernel-default-base-debuginfo-4.12.14-150100.197.123.1 kernel-default-debuginfo-4.12.14-150100.197.123.1 kernel-default-debugsource-4.12.14-150100.197.123.1 kernel-default-devel-4.12.14-150100.197.123.1 kernel-default-devel-debuginfo-4.12.14-150100.197.123.1 kernel-obs-build-4.12.14-150100.197.123.1 kernel-obs-build-debugsource-4.12.14-150100.197.123.1 kernel-syms-4.12.14-150100.197.123.1 reiserfs-kmp-default-4.12.14-150100.197.123.1 reiserfs-kmp-default-debuginfo-4.12.14-150100.197.123.1 - SUSE Linux Enterprise Server for SAP 15-SP1 (noarch): kernel-devel-4.12.14-150100.197.123.1 kernel-docs-4.12.14-150100.197.123.1 kernel-macros-4.12.14-150100.197.123.1 kernel-source-4.12.14-150100.197.123.1 - SUSE Linux Enterprise Server 15-SP1-LTSS (aarch64 ppc64le s390x x86_64): kernel-default-4.12.14-150100.197.123.1 kernel-default-base-4.12.14-150100.197.123.1 kernel-default-base-debuginfo-4.12.14-150100.197.123.1 kernel-default-debuginfo-4.12.14-150100.197.123.1 kernel-default-debugsource-4.12.14-150100.197.123.1 kernel-default-devel-4.12.14-150100.197.123.1 kernel-default-devel-debuginfo-4.12.14-150100.197.123.1 kernel-obs-build-4.12.14-150100.197.123.1 kernel-obs-build-debugsource-4.12.14-150100.197.123.1 kernel-syms-4.12.14-150100.197.123.1 reiserfs-kmp-default-4.12.14-150100.197.123.1 reiserfs-kmp-default-debuginfo-4.12.14-150100.197.123.1 - SUSE Linux Enterprise Server 15-SP1-LTSS (noarch): kernel-devel-4.12.14-150100.197.123.1 kernel-docs-4.12.14-150100.197.123.1 kernel-macros-4.12.14-150100.197.123.1 kernel-source-4.12.14-150100.197.123.1 - SUSE Linux Enterprise Server 15-SP1-LTSS (s390x): kernel-default-man-4.12.14-150100.197.123.1 kernel-zfcpdump-debuginfo-4.12.14-150100.197.123.1 kernel-zfcpdump-debugsource-4.12.14-150100.197.123.1 - SUSE Linux Enterprise Server 15-SP1-BCL (noarch): kernel-devel-4.12.14-150100.197.123.1 kernel-docs-4.12.14-150100.197.123.1 kernel-macros-4.12.14-150100.197.123.1 kernel-source-4.12.14-150100.197.123.1 - SUSE Linux Enterprise Server 15-SP1-BCL (x86_64): kernel-default-4.12.14-150100.197.123.1 kernel-default-base-4.12.14-150100.197.123.1 kernel-default-base-debuginfo-4.12.14-150100.197.123.1 kernel-default-debuginfo-4.12.14-150100.197.123.1 kernel-default-debugsource-4.12.14-150100.197.123.1 kernel-default-devel-4.12.14-150100.197.123.1 kernel-default-devel-debuginfo-4.12.14-150100.197.123.1 kernel-obs-build-4.12.14-150100.197.123.1 kernel-obs-build-debugsource-4.12.14-150100.197.123.1 kernel-syms-4.12.14-150100.197.123.1 reiserfs-kmp-default-4.12.14-150100.197.123.1 reiserfs-kmp-default-debuginfo-4.12.14-150100.197.123.1 - SUSE Linux Enterprise Module for Live Patching 15-SP1 (ppc64le x86_64): kernel-default-debuginfo-4.12.14-150100.197.123.1 kernel-default-debugsource-4.12.14-150100.197.123.1 kernel-default-livepatch-4.12.14-150100.197.123.1 kernel-default-livepatch-devel-4.12.14-150100.197.123.1 kernel-livepatch-4_12_14-150100_197_123-default-1-150100.3.3.1 - SUSE Linux Enterprise High Performance Computing 15-SP1-LTSS (aarch64 x86_64): kernel-default-4.12.14-150100.197.123.1 kernel-default-base-4.12.14-150100.197.123.1 kernel-default-base-debuginfo-4.12.14-150100.197.123.1 kernel-default-debuginfo-4.12.14-150100.197.123.1 kernel-default-debugsource-4.12.14-150100.197.123.1 kernel-default-devel-4.12.14-150100.197.123.1 kernel-default-devel-debuginfo-4.12.14-150100.197.123.1 kernel-obs-build-4.12.14-150100.197.123.1 kernel-obs-build-debugsource-4.12.14-150100.197.123.1 kernel-syms-4.12.14-150100.197.123.1 - SUSE Linux Enterprise High Performance Computing 15-SP1-LTSS (noarch): kernel-devel-4.12.14-150100.197.123.1 kernel-docs-4.12.14-150100.197.123.1 kernel-macros-4.12.14-150100.197.123.1 kernel-source-4.12.14-150100.197.123.1 - SUSE Linux Enterprise High Performance Computing 15-SP1-ESPOS (aarch64 x86_64): kernel-default-4.12.14-150100.197.123.1 kernel-default-base-4.12.14-150100.197.123.1 kernel-default-base-debuginfo-4.12.14-150100.197.123.1 kernel-default-debuginfo-4.12.14-150100.197.123.1 kernel-default-debugsource-4.12.14-150100.197.123.1 kernel-default-devel-4.12.14-150100.197.123.1 kernel-default-devel-debuginfo-4.12.14-150100.197.123.1 kernel-obs-build-4.12.14-150100.197.123.1 kernel-obs-build-debugsource-4.12.14-150100.197.123.1 kernel-syms-4.12.14-150100.197.123.1 - SUSE Linux Enterprise High Performance Computing 15-SP1-ESPOS (noarch): kernel-devel-4.12.14-150100.197.123.1 kernel-docs-4.12.14-150100.197.123.1 kernel-macros-4.12.14-150100.197.123.1 kernel-source-4.12.14-150100.197.123.1 - SUSE Linux Enterprise High Availability 15-SP1 (aarch64 ppc64le s390x x86_64): cluster-md-kmp-default-4.12.14-150100.197.123.1 cluster-md-kmp-default-debuginfo-4.12.14-150100.197.123.1 dlm-kmp-default-4.12.14-150100.197.123.1 dlm-kmp-default-debuginfo-4.12.14-150100.197.123.1 gfs2-kmp-default-4.12.14-150100.197.123.1 gfs2-kmp-default-debuginfo-4.12.14-150100.197.123.1 kernel-default-debuginfo-4.12.14-150100.197.123.1 kernel-default-debugsource-4.12.14-150100.197.123.1 ocfs2-kmp-default-4.12.14-150100.197.123.1 ocfs2-kmp-default-debuginfo-4.12.14-150100.197.123.1 - SUSE Enterprise Storage 6 (aarch64 x86_64): kernel-default-4.12.14-150100.197.123.1 kernel-default-base-4.12.14-150100.197.123.1 kernel-default-base-debuginfo-4.12.14-150100.197.123.1 kernel-default-debuginfo-4.12.14-150100.197.123.1 kernel-default-debugsource-4.12.14-150100.197.123.1 kernel-default-devel-4.12.14-150100.197.123.1 kernel-default-devel-debuginfo-4.12.14-150100.197.123.1 kernel-obs-build-4.12.14-150100.197.123.1 kernel-obs-build-debugsource-4.12.14-150100.197.123.1 kernel-syms-4.12.14-150100.197.123.1 reiserfs-kmp-default-4.12.14-150100.197.123.1 reiserfs-kmp-default-debuginfo-4.12.14-150100.197.123.1 - SUSE Enterprise Storage 6 (noarch): kernel-devel-4.12.14-150100.197.123.1 kernel-docs-4.12.14-150100.197.123.1 kernel-macros-4.12.14-150100.197.123.1 kernel-source-4.12.14-150100.197.123.1 - SUSE CaaS Platform 4.0 (x86_64): kernel-default-4.12.14-150100.197.123.1 kernel-default-base-4.12.14-150100.197.123.1 kernel-default-base-debuginfo-4.12.14-150100.197.123.1 kernel-default-debuginfo-4.12.14-150100.197.123.1 kernel-default-debugsource-4.12.14-150100.197.123.1 kernel-default-devel-4.12.14-150100.197.123.1 kernel-default-devel-debuginfo-4.12.14-150100.197.123.1 kernel-obs-build-4.12.14-150100.197.123.1 kernel-obs-build-debugsource-4.12.14-150100.197.123.1 kernel-syms-4.12.14-150100.197.123.1 reiserfs-kmp-default-4.12.14-150100.197.123.1 reiserfs-kmp-default-debuginfo-4.12.14-150100.197.123.1 - SUSE CaaS Platform 4.0 (noarch): kernel-devel-4.12.14-150100.197.123.1 kernel-docs-4.12.14-150100.197.123.1 kernel-macros-4.12.14-150100.197.123.1 kernel-source-4.12.14-150100.197.123.1 References: https://www.suse.com/security/cve/CVE-2020-36516.html https://www.suse.com/security/cve/CVE-2021-4203.html https://www.suse.com/security/cve/CVE-2022-1012.html https://www.suse.com/security/cve/CVE-2022-20368.html https://www.suse.com/security/cve/CVE-2022-20369.html https://www.suse.com/security/cve/CVE-2022-21385.html https://www.suse.com/security/cve/CVE-2022-2588.html https://www.suse.com/security/cve/CVE-2022-26373.html https://www.suse.com/security/cve/CVE-2022-2639.html https://www.suse.com/security/cve/CVE-2022-2663.html https://www.suse.com/security/cve/CVE-2022-29581.html https://www.suse.com/security/cve/CVE-2022-2977.html https://www.suse.com/security/cve/CVE-2022-3028.html https://www.suse.com/security/cve/CVE-2022-36879.html https://www.suse.com/security/cve/CVE-2022-39188.html https://bugzilla.suse.com/1177440 https://bugzilla.suse.com/1180153 https://bugzilla.suse.com/1188944 https://bugzilla.suse.com/1191881 https://bugzilla.suse.com/1194535 https://bugzilla.suse.com/1196616 https://bugzilla.suse.com/1197158 https://bugzilla.suse.com/1199482 https://bugzilla.suse.com/1199665 https://bugzilla.suse.com/1201019 https://bugzilla.suse.com/1201420 https://bugzilla.suse.com/1201705 https://bugzilla.suse.com/1201726 https://bugzilla.suse.com/1201948 https://bugzilla.suse.com/1202096 https://bugzilla.suse.com/1202097 https://bugzilla.suse.com/1202154 https://bugzilla.suse.com/1202335 https://bugzilla.suse.com/1202346 https://bugzilla.suse.com/1202347 https://bugzilla.suse.com/1202393 https://bugzilla.suse.com/1202396 https://bugzilla.suse.com/1202672 https://bugzilla.suse.com/1202897 https://bugzilla.suse.com/1202898 https://bugzilla.suse.com/1203098 https://bugzilla.suse.com/1203107

1 0

SUSE-SU-2022:3393-1: moderate: Security update for libarchive
by opensuse-security＠opensuse.org 26 Sep '22

26 Sep '22

SUSE Security Update: Security update for libarchive ______________________________________________________________________________ Announcement ID: SUSE-SU-2022:3393-1 Rating: moderate References: #1192425 Cross-References: CVE-2021-23177 CVSS scores: CVE-2021-23177 (NVD) : 7.8 CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H CVE-2021-23177 (SUSE): 6.6 CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:L/A:L Affected Products: SUSE Linux Enterprise Desktop 15-SP3 SUSE Linux Enterprise High Performance Computing 15-SP3 SUSE Linux Enterprise Module for Basesystem 15-SP3 SUSE Linux Enterprise Module for Development Tools 15-SP3 SUSE Linux Enterprise Server 15-SP3 SUSE Linux Enterprise Server for SAP Applications 15-SP3 SUSE Linux Enterprise Storage 7.1 SUSE Manager Proxy 4.2 SUSE Manager Retail Branch Server 4.2 SUSE Manager Server 4.2 openSUSE Leap 15.3 ______________________________________________________________________________ An update that fixes one vulnerability is now available. Description: This update for libarchive fixes the following issues: - CVE-2021-23177: Fixed symlink ACL extraction that modifies ACLs of the target system (bsc#1192425). Patch Instructions: To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 15.3: zypper in -t patch openSUSE-SLE-15.3-2022-3393=1 - SUSE Linux Enterprise Module for Development Tools 15-SP3: zypper in -t patch SUSE-SLE-Module-Development-Tools-15-SP3-2022-3393=1 - SUSE Linux Enterprise Module for Basesystem 15-SP3: zypper in -t patch SUSE-SLE-Module-Basesystem-15-SP3-2022-3393=1 Package List: - openSUSE Leap 15.3 (aarch64 ppc64le s390x x86_64): bsdtar-3.4.2-150200.4.9.1 bsdtar-debuginfo-3.4.2-150200.4.9.1 libarchive-debugsource-3.4.2-150200.4.9.1 libarchive-devel-3.4.2-150200.4.9.1 libarchive13-3.4.2-150200.4.9.1 libarchive13-debuginfo-3.4.2-150200.4.9.1 - openSUSE Leap 15.3 (x86_64): libarchive13-32bit-3.4.2-150200.4.9.1 libarchive13-32bit-debuginfo-3.4.2-150200.4.9.1 - SUSE Linux Enterprise Module for Development Tools 15-SP3 (aarch64 ppc64le s390x x86_64): bsdtar-3.4.2-150200.4.9.1 bsdtar-debuginfo-3.4.2-150200.4.9.1 libarchive-debugsource-3.4.2-150200.4.9.1 - SUSE Linux Enterprise Module for Basesystem 15-SP3 (aarch64 ppc64le s390x x86_64): libarchive-debugsource-3.4.2-150200.4.9.1 libarchive-devel-3.4.2-150200.4.9.1 libarchive13-3.4.2-150200.4.9.1 libarchive13-debuginfo-3.4.2-150200.4.9.1 References: https://www.suse.com/security/cve/CVE-2021-23177.html https://bugzilla.suse.com/1192425

1 0

SUSE-SU-2022:3396-1: important: Security update for MozillaFirefox
by opensuse-security＠opensuse.org 26 Sep '22

26 Sep '22

SUSE Security Update: Security update for MozillaFirefox ______________________________________________________________________________ Announcement ID: SUSE-SU-2022:3396-1 Rating: important References: #1200793 #1201758 #1202645 #1203477 Cross-References: CVE-2022-2200 CVE-2022-2505 CVE-2022-34468 CVE-2022-34469 CVE-2022-34470 CVE-2022-34471 CVE-2022-34472 CVE-2022-34473 CVE-2022-34474 CVE-2022-34475 CVE-2022-34476 CVE-2022-34477 CVE-2022-34478 CVE-2022-34479 CVE-2022-34480 CVE-2022-34481 CVE-2022-34482 CVE-2022-34483 CVE-2022-34484 CVE-2022-34485 CVE-2022-36314 CVE-2022-36318 CVE-2022-36319 CVE-2022-38472 CVE-2022-38473 CVE-2022-38476 CVE-2022-38477 CVE-2022-38478 CVE-2022-40956 CVE-2022-40957 CVE-2022-40958 CVE-2022-40959 CVE-2022-40960 CVE-2022-40962 CVSS scores: CVE-2022-2505 (SUSE): 7.5 CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H CVE-2022-34472 (SUSE): 6.1 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N CVE-2022-36314 (SUSE): 6.1 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N CVE-2022-36318 (SUSE): 6.1 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N CVE-2022-36319 (SUSE): 6.1 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N Affected Products: SUSE Enterprise Storage 7 SUSE Linux Enterprise Desktop 15-SP3 SUSE Linux Enterprise Desktop 15-SP4 SUSE Linux Enterprise High Performance Computing 15-SP2-ESPOS SUSE Linux Enterprise High Performance Computing 15-SP2-LTSS SUSE Linux Enterprise High Performance Computing 15-SP3 SUSE Linux Enterprise High Performance Computing 15-SP4 SUSE Linux Enterprise Module for Desktop Applications 15-SP3 SUSE Linux Enterprise Module for Desktop Applications 15-SP4 SUSE Linux Enterprise Server 15-SP2-BCL SUSE Linux Enterprise Server 15-SP2-LTSS SUSE Linux Enterprise Server 15-SP3 SUSE Linux Enterprise Server 15-SP4 SUSE Linux Enterprise Server for SAP 15-SP2 SUSE Linux Enterprise Server for SAP Applications 15-SP3 SUSE Linux Enterprise Server for SAP Applications 15-SP4 SUSE Linux Enterprise Storage 7.1 SUSE Manager Proxy 4.1 SUSE Manager Proxy 4.2 SUSE Manager Proxy 4.3 SUSE Manager Retail Branch Server 4.1 SUSE Manager Retail Branch Server 4.2 SUSE Manager Retail Branch Server 4.3 SUSE Manager Server 4.1 SUSE Manager Server 4.2 SUSE Manager Server 4.3 openSUSE Leap 15.3 openSUSE Leap 15.4 ______________________________________________________________________________ An update that fixes 34 vulnerabilities is now available. Description: This update for MozillaFirefox fixes the following issues: Mozilla Firefox was updated to 102.3.0esr ESR (bsc#1200793, bsc#1201758, bsc#1202645, bsc#1203477): - CVE-2022-40959: Fixed bypassing FeaturePolicy restrictions on transient pages. - CVE-2022-40960: Fixed data-race when parsing non-UTF-8 URLs in threads. - CVE-2022-40958: Fixed bypassing secure context restriction for cookies with __Host and __Secure prefix. - CVE-2022-40956: Fixed content-security-policy base-uri bypass. - CVE-2022-40957: Fixed incoherent instruction cache when building WASM on ARM64. - CVE-2022-40962: Fixed memory safety bugs. - CVE-2022-38472: Fixed a potential address bar spoofing via XSLT error handling. - CVE-2022-38473: Fixed an issue where cross-origin XSLT documents could inherit the parent's permissions. - CVE-2022-38478: Fixed various memory safety issues. - CVE-2022-38476: Fixed data race and potential use-after-free in PK11_ChangePW. - CVE-2022-38477: Fixed memory safety bugs. - CVE-2022-36319: Fixed mouse position spoofing with CSS transforms. - CVE-2022-36318: Fixed directory indexes for bundled resources reflected URL parameters. - CVE-2022-36314: Fixed unexpected network loads when opening local .lnk files. - CVE-2022-2505: Fixed memory safety bugs. - CVE-2022-34479: Fixed vulnerabilty where a popup window could be resized in a way to overlay the address bar with web content. - CVE-2022-34470: Fixed use-after-free in nsSHistory. - CVE-2022-34468: Fixed bypass of CSP sandbox header without `allow-scripts` via retargeted javascript: URI. - CVE-2022-34482: Fixed drag and drop of malicious image that could have led to malicious executable and potential code execution. - CVE-2022-34483: Fixed drag and drop of malicious image that could have led to malicious executable and potential code execution. - CVE-2022-34476: Fixed vulnerability where ASN.1 parser could have been tricked into accepting malformed ASN.1. - CVE-2022-34481: Fixed potential integer overflow in ReplaceElementsAt - CVE-2022-34474: Fixed vulnerability where sandboxed iframes could redirect to external schemes. - CVE-2022-34469: Fixed TLS certificate errors on HSTS-protected domains which could be bypassed by the user on Firefox for Android. - CVE-2022-34471: Fixed vulnerability where a compromised server could trick a browser into an addon downgrade. - CVE-2022-34472: Fixed vulnerability where an unavailable PAC file resulted in OCSP requests being blocked. - CVE-2022-34478: Fixed vulnerability where Microsoft protocols can be attacked if a user accepts a prompt. - CVE-2022-2200: Fixed vulnerability where undesired attributes could be set as part of prototype pollution. - CVE-2022-34480: Fixed free of uninitialized pointer in lg_init. - CVE-2022-34477: Fixed vulnerability in MediaError message property leaking information on cross-origin same-site pages. - CVE-2022-34475: Fixed vulnerability where the HTML Sanitizer could have been bypassed via same-origin script via use tags. - CVE-2022-34473: Fixed vulnerability where the HTML Sanitizer could have been bypassed via use tags. - CVE-2022-34484: Fixed memory safety bugs. - CVE-2022-34485: Fixed memory safety bugs. Patch Instructions: To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 15.4: zypper in -t patch openSUSE-SLE-15.4-2022-3396=1 - openSUSE Leap 15.3: zypper in -t patch openSUSE-SLE-15.3-2022-3396=1 - SUSE Manager Server 4.1: zypper in -t patch SUSE-SLE-Product-SUSE-Manager-Server-4.1-2022-3396=1 - SUSE Manager Retail Branch Server 4.1: zypper in -t patch SUSE-SLE-Product-SUSE-Manager-Retail-Branch-Server-4.1-2022-3396=1 - SUSE Manager Proxy 4.1: zypper in -t patch SUSE-SLE-Product-SUSE-Manager-Proxy-4.1-2022-3396=1 - SUSE Linux Enterprise Server for SAP 15-SP2: zypper in -t patch SUSE-SLE-Product-SLES_SAP-15-SP2-2022-3396=1 - SUSE Linux Enterprise Server 15-SP2-LTSS: zypper in -t patch SUSE-SLE-Product-SLES-15-SP2-LTSS-2022-3396=1 - SUSE Linux Enterprise Server 15-SP2-BCL: zypper in -t patch SUSE-SLE-Product-SLES-15-SP2-BCL-2022-3396=1 - SUSE Linux Enterprise Module for Desktop Applications 15-SP4: zypper in -t patch SUSE-SLE-Module-Desktop-Applications-15-SP4-2022-3396=1 - SUSE Linux Enterprise Module for Desktop Applications 15-SP3: zypper in -t patch SUSE-SLE-Module-Desktop-Applications-15-SP3-2022-3396=1 - SUSE Linux Enterprise High Performance Computing 15-SP2-LTSS: zypper in -t patch SUSE-SLE-Product-HPC-15-SP2-LTSS-2022-3396=1 - SUSE Linux Enterprise High Performance Computing 15-SP2-ESPOS: zypper in -t patch SUSE-SLE-Product-HPC-15-SP2-ESPOS-2022-3396=1 - SUSE Enterprise Storage 7: zypper in -t patch SUSE-Storage-7-2022-3396=1 Package List: - openSUSE Leap 15.4 (aarch64 ppc64le s390x x86_64): MozillaFirefox-102.3.0-150200.152.61.1 MozillaFirefox-branding-SLE-102-150200.9.10.1 MozillaFirefox-branding-upstream-102.3.0-150200.152.61.1 MozillaFirefox-debuginfo-102.3.0-150200.152.61.1 MozillaFirefox-debugsource-102.3.0-150200.152.61.1 MozillaFirefox-devel-102.3.0-150200.152.61.1 MozillaFirefox-translations-common-102.3.0-150200.152.61.1 MozillaFirefox-translations-other-102.3.0-150200.152.61.1 - openSUSE Leap 15.3 (aarch64 ppc64le s390x x86_64): MozillaFirefox-102.3.0-150200.152.61.1 MozillaFirefox-branding-SLE-102-150200.9.10.1 MozillaFirefox-branding-upstream-102.3.0-150200.152.61.1 MozillaFirefox-debuginfo-102.3.0-150200.152.61.1 MozillaFirefox-debugsource-102.3.0-150200.152.61.1 MozillaFirefox-devel-102.3.0-150200.152.61.1 MozillaFirefox-translations-common-102.3.0-150200.152.61.1 MozillaFirefox-translations-other-102.3.0-150200.152.61.1 - SUSE Manager Server 4.1 (ppc64le s390x x86_64): MozillaFirefox-102.3.0-150200.152.61.1 MozillaFirefox-branding-SLE-102-150200.9.10.1 MozillaFirefox-debuginfo-102.3.0-150200.152.61.1 MozillaFirefox-debugsource-102.3.0-150200.152.61.1 MozillaFirefox-devel-102.3.0-150200.152.61.1 MozillaFirefox-translations-common-102.3.0-150200.152.61.1 MozillaFirefox-translations-other-102.3.0-150200.152.61.1 - SUSE Manager Retail Branch Server 4.1 (x86_64): MozillaFirefox-102.3.0-150200.152.61.1 MozillaFirefox-branding-SLE-102-150200.9.10.1 MozillaFirefox-debuginfo-102.3.0-150200.152.61.1 MozillaFirefox-debugsource-102.3.0-150200.152.61.1 MozillaFirefox-devel-102.3.0-150200.152.61.1 MozillaFirefox-translations-common-102.3.0-150200.152.61.1 MozillaFirefox-translations-other-102.3.0-150200.152.61.1 - SUSE Manager Proxy 4.1 (x86_64): MozillaFirefox-102.3.0-150200.152.61.1 MozillaFirefox-branding-SLE-102-150200.9.10.1 MozillaFirefox-debuginfo-102.3.0-150200.152.61.1 MozillaFirefox-debugsource-102.3.0-150200.152.61.1 MozillaFirefox-devel-102.3.0-150200.152.61.1 MozillaFirefox-translations-common-102.3.0-150200.152.61.1 MozillaFirefox-translations-other-102.3.0-150200.152.61.1 - SUSE Linux Enterprise Server for SAP 15-SP2 (ppc64le x86_64): MozillaFirefox-102.3.0-150200.152.61.1 MozillaFirefox-branding-SLE-102-150200.9.10.1 MozillaFirefox-debuginfo-102.3.0-150200.152.61.1 MozillaFirefox-debugsource-102.3.0-150200.152.61.1 MozillaFirefox-devel-102.3.0-150200.152.61.1 MozillaFirefox-translations-common-102.3.0-150200.152.61.1 MozillaFirefox-translations-other-102.3.0-150200.152.61.1 - SUSE Linux Enterprise Server 15-SP2-LTSS (aarch64 ppc64le s390x x86_64): MozillaFirefox-102.3.0-150200.152.61.1 MozillaFirefox-branding-SLE-102-150200.9.10.1 MozillaFirefox-debuginfo-102.3.0-150200.152.61.1 MozillaFirefox-debugsource-102.3.0-150200.152.61.1 MozillaFirefox-devel-102.3.0-150200.152.61.1 MozillaFirefox-translations-common-102.3.0-150200.152.61.1 MozillaFirefox-translations-other-102.3.0-150200.152.61.1 - SUSE Linux Enterprise Server 15-SP2-BCL (x86_64): MozillaFirefox-102.3.0-150200.152.61.1 MozillaFirefox-branding-SLE-102-150200.9.10.1 MozillaFirefox-debuginfo-102.3.0-150200.152.61.1 MozillaFirefox-debugsource-102.3.0-150200.152.61.1 MozillaFirefox-devel-102.3.0-150200.152.61.1 MozillaFirefox-translations-common-102.3.0-150200.152.61.1 MozillaFirefox-translations-other-102.3.0-150200.152.61.1 - SUSE Linux Enterprise Module for Desktop Applications 15-SP4 (aarch64 ppc64le s390x x86_64): MozillaFirefox-102.3.0-150200.152.61.1 MozillaFirefox-branding-SLE-102-150200.9.10.1 MozillaFirefox-debuginfo-102.3.0-150200.152.61.1 MozillaFirefox-debugsource-102.3.0-150200.152.61.1 MozillaFirefox-translations-common-102.3.0-150200.152.61.1 MozillaFirefox-translations-other-102.3.0-150200.152.61.1 - SUSE Linux Enterprise Module for Desktop Applications 15-SP4 (aarch64 ppc64le x86_64): MozillaFirefox-devel-102.3.0-150200.152.61.1 - SUSE Linux Enterprise Module for Desktop Applications 15-SP3 (aarch64 ppc64le s390x x86_64): MozillaFirefox-102.3.0-150200.152.61.1 MozillaFirefox-branding-SLE-102-150200.9.10.1 MozillaFirefox-debuginfo-102.3.0-150200.152.61.1 MozillaFirefox-debugsource-102.3.0-150200.152.61.1 MozillaFirefox-translations-common-102.3.0-150200.152.61.1 MozillaFirefox-translations-other-102.3.0-150200.152.61.1 - SUSE Linux Enterprise Module for Desktop Applications 15-SP3 (aarch64 ppc64le x86_64): MozillaFirefox-devel-102.3.0-150200.152.61.1 - SUSE Linux Enterprise High Performance Computing 15-SP2-LTSS (aarch64 x86_64): MozillaFirefox-102.3.0-150200.152.61.1 MozillaFirefox-branding-SLE-102-150200.9.10.1 MozillaFirefox-debuginfo-102.3.0-150200.152.61.1 MozillaFirefox-debugsource-102.3.0-150200.152.61.1 MozillaFirefox-devel-102.3.0-150200.152.61.1 MozillaFirefox-translations-common-102.3.0-150200.152.61.1 MozillaFirefox-translations-other-102.3.0-150200.152.61.1 - SUSE Linux Enterprise High Performance Computing 15-SP2-ESPOS (aarch64 x86_64): MozillaFirefox-102.3.0-150200.152.61.1 MozillaFirefox-branding-SLE-102-150200.9.10.1 MozillaFirefox-debuginfo-102.3.0-150200.152.61.1 MozillaFirefox-debugsource-102.3.0-150200.152.61.1 MozillaFirefox-devel-102.3.0-150200.152.61.1 MozillaFirefox-translations-common-102.3.0-150200.152.61.1 MozillaFirefox-translations-other-102.3.0-150200.152.61.1 - SUSE Enterprise Storage 7 (aarch64 x86_64): MozillaFirefox-102.3.0-150200.152.61.1 MozillaFirefox-branding-SLE-102-150200.9.10.1 MozillaFirefox-debuginfo-102.3.0-150200.152.61.1 MozillaFirefox-debugsource-102.3.0-150200.152.61.1 MozillaFirefox-devel-102.3.0-150200.152.61.1 MozillaFirefox-translations-common-102.3.0-150200.152.61.1 MozillaFirefox-translations-other-102.3.0-150200.152.61.1 References: https://www.suse.com/security/cve/CVE-2022-2200.html https://www.suse.com/security/cve/CVE-2022-2505.html https://www.suse.com/security/cve/CVE-2022-34468.html https://www.suse.com/security/cve/CVE-2022-34469.html https://www.suse.com/security/cve/CVE-2022-34470.html https://www.suse.com/security/cve/CVE-2022-34471.html https://www.suse.com/security/cve/CVE-2022-34472.html https://www.suse.com/security/cve/CVE-2022-34473.html https://www.suse.com/security/cve/CVE-2022-34474.html https://www.suse.com/security/cve/CVE-2022-34475.html https://www.suse.com/security/cve/CVE-2022-34476.html https://www.suse.com/security/cve/CVE-2022-34477.html https://www.suse.com/security/cve/CVE-2022-34478.html https://www.suse.com/security/cve/CVE-2022-34479.html https://www.suse.com/security/cve/CVE-2022-34480.html https://www.suse.com/security/cve/CVE-2022-34481.html https://www.suse.com/security/cve/CVE-2022-34482.html https://www.suse.com/security/cve/CVE-2022-34483.html https://www.suse.com/security/cve/CVE-2022-34484.html https://www.suse.com/security/cve/CVE-2022-34485.html https://www.suse.com/security/cve/CVE-2022-36314.html https://www.suse.com/security/cve/CVE-2022-36318.html https://www.suse.com/security/cve/CVE-2022-36319.html https://www.suse.com/security/cve/CVE-2022-38472.html https://www.suse.com/security/cve/CVE-2022-38473.html https://www.suse.com/security/cve/CVE-2022-38476.html https://www.suse.com/security/cve/CVE-2022-38477.html https://www.suse.com/security/cve/CVE-2022-38478.html https://www.suse.com/security/cve/CVE-2022-40956.html https://www.suse.com/security/cve/CVE-2022-40957.html https://www.suse.com/security/cve/CVE-2022-40958.html https://www.suse.com/security/cve/CVE-2022-40959.html https://www.suse.com/security/cve/CVE-2022-40960.html https://www.suse.com/security/cve/CVE-2022-40962.html https://bugzilla.suse.com/1200793 https://bugzilla.suse.com/1201758 https://bugzilla.suse.com/1202645 https://bugzilla.suse.com/1203477

1 0

SUSE-SU-2022:3397-1: important: Security update for snakeyaml
by opensuse-security＠opensuse.org 26 Sep '22

26 Sep '22

SUSE Security Update: Security update for snakeyaml ______________________________________________________________________________ Announcement ID: SUSE-SU-2022:3397-1 Rating: important References: #1202932 #1203149 #1203153 #1203154 #1203158 Cross-References: CVE-2020-13936 CVE-2022-25857 CVE-2022-38749 CVE-2022-38750 CVE-2022-38751 CVE-2022-38752 CVSS scores: CVE-2020-13936 (NVD) : 8.8 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H CVE-2020-13936 (SUSE): 8.8 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H CVE-2022-25857 (NVD) : 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H CVE-2022-25857 (SUSE): 6.2 CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H CVE-2022-38749 (NVD) : 6.5 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H CVE-2022-38749 (SUSE): 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H CVE-2022-38750 (NVD) : 5.5 CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H CVE-2022-38750 (SUSE): 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H CVE-2022-38751 (NVD) : 6.5 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H CVE-2022-38751 (SUSE): 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H CVE-2022-38752 (NVD) : 6.5 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H CVE-2022-38752 (SUSE): 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H Affected Products: SUSE Linux Enterprise Desktop 15-SP3 SUSE Linux Enterprise Desktop 15-SP4 SUSE Linux Enterprise High Performance Computing 15-SP3 SUSE Linux Enterprise High Performance Computing 15-SP4 SUSE Linux Enterprise Module for Development Tools 15-SP3 SUSE Linux Enterprise Module for Development Tools 15-SP4 SUSE Linux Enterprise Module for SUSE Manager Server 4.2 SUSE Linux Enterprise Module for SUSE Manager Server 4.3 SUSE Linux Enterprise Server 15-SP3 SUSE Linux Enterprise Server 15-SP4 SUSE Linux Enterprise Server for SAP Applications 15-SP3 SUSE Linux Enterprise Server for SAP Applications 15-SP4 SUSE Linux Enterprise Storage 7.1 SUSE Manager Proxy 4.2 SUSE Manager Proxy 4.3 SUSE Manager Retail Branch Server 4.2 SUSE Manager Retail Branch Server 4.3 SUSE Manager Server 4.2 SUSE Manager Server 4.3 openSUSE Leap 15.3 openSUSE Leap 15.4 ______________________________________________________________________________ An update that fixes 6 vulnerabilities is now available. Description: This update for snakeyaml fixes the following issues: - CVE-2022-38750: Fixed uncaught exception in org.yaml.snakeyaml.constructor.BaseConstructor.constructObject (bsc#1203158). - CVE-2022-38749: Fixed StackOverflowError for many open unmatched brackets (bsc#1203149). - CVE-2022-38752: Fixed uncaught exception in java.base/java.util.ArrayList.hashCode (bsc#1203154). - CVE-2022-38751: Fixed unrestricted data matched with Regular Expressions (bsc#1203153). - CVE-2022-25857: Fixed denial of service vulnerability due missing to nested depth limitation for collections (bsc#1202932). Patch Instructions: To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 15.4: zypper in -t patch openSUSE-SLE-15.4-2022-3397=1 - openSUSE Leap 15.3: zypper in -t patch openSUSE-SLE-15.3-2022-3397=1 - SUSE Linux Enterprise Module for SUSE Manager Server 4.3: zypper in -t patch SUSE-SLE-Module-SUSE-Manager-Server-4.3-2022-3397=1 - SUSE Linux Enterprise Module for SUSE Manager Server 4.2: zypper in -t patch SUSE-SLE-Module-SUSE-Manager-Server-4.2-2022-3397=1 - SUSE Linux Enterprise Module for Development Tools 15-SP4: zypper in -t patch SUSE-SLE-Module-Development-Tools-15-SP4-2022-3397=1 - SUSE Linux Enterprise Module for Development Tools 15-SP3: zypper in -t patch SUSE-SLE-Module-Development-Tools-15-SP3-2022-3397=1 Package List: - openSUSE Leap 15.4 (noarch): snakeyaml-1.31-150200.3.8.1 snakeyaml-javadoc-1.31-150200.3.8.1 - openSUSE Leap 15.3 (noarch): snakeyaml-1.31-150200.3.8.1 snakeyaml-javadoc-1.31-150200.3.8.1 - SUSE Linux Enterprise Module for SUSE Manager Server 4.3 (noarch): snakeyaml-1.31-150200.3.8.1 - SUSE Linux Enterprise Module for SUSE Manager Server 4.2 (noarch): snakeyaml-1.31-150200.3.8.1 - SUSE Linux Enterprise Module for Development Tools 15-SP4 (noarch): snakeyaml-1.31-150200.3.8.1 - SUSE Linux Enterprise Module for Development Tools 15-SP3 (noarch): snakeyaml-1.31-150200.3.8.1 References: https://www.suse.com/security/cve/CVE-2020-13936.html https://www.suse.com/security/cve/CVE-2022-25857.html https://www.suse.com/security/cve/CVE-2022-38749.html https://www.suse.com/security/cve/CVE-2022-38750.html https://www.suse.com/security/cve/CVE-2022-38751.html https://www.suse.com/security/cve/CVE-2022-38752.html https://bugzilla.suse.com/1202932 https://bugzilla.suse.com/1203149 https://bugzilla.suse.com/1203153 https://bugzilla.suse.com/1203154 https://bugzilla.suse.com/1203158

1 0

SUSE-SU-2022:3400-1: moderate: Security update for libcaca
by opensuse-security＠opensuse.org 26 Sep '22

26 Sep '22

SUSE Security Update: Security update for libcaca ______________________________________________________________________________ Announcement ID: SUSE-SU-2022:3400-1 Rating: moderate References: #1182731 Cross-References: CVE-2021-3410 CVSS scores: CVE-2021-3410 (NVD) : 7.8 CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H CVE-2021-3410 (SUSE): 5.5 CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H Affected Products: SUSE Linux Enterprise Desktop 15-SP3 SUSE Linux Enterprise Desktop 15-SP4 SUSE Linux Enterprise High Performance Computing 15-SP3 SUSE Linux Enterprise High Performance Computing 15-SP4 SUSE Linux Enterprise Module for Basesystem 15-SP3 SUSE Linux Enterprise Module for Basesystem 15-SP4 SUSE Linux Enterprise Server 15-SP3 SUSE Linux Enterprise Server 15-SP4 SUSE Linux Enterprise Server for SAP Applications 15-SP3 SUSE Linux Enterprise Server for SAP Applications 15-SP4 SUSE Linux Enterprise Storage 7.1 SUSE Manager Proxy 4.2 SUSE Manager Proxy 4.3 SUSE Manager Retail Branch Server 4.2 SUSE Manager Retail Branch Server 4.3 SUSE Manager Server 4.2 SUSE Manager Server 4.3 openSUSE Leap 15.3 openSUSE Leap 15.4 ______________________________________________________________________________ An update that fixes one vulnerability is now available. Description: This update for libcaca fixes the following issues: - CVE-2021-3410: Fixed overflow when multiplying large ints (bsc#1182731). Patch Instructions: To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 15.4: zypper in -t patch openSUSE-SLE-15.4-2022-3400=1 - openSUSE Leap 15.3: zypper in -t patch openSUSE-SLE-15.3-2022-3400=1 - SUSE Linux Enterprise Module for Basesystem 15-SP4: zypper in -t patch SUSE-SLE-Module-Basesystem-15-SP4-2022-3400=1 - SUSE Linux Enterprise Module for Basesystem 15-SP3: zypper in -t patch SUSE-SLE-Module-Basesystem-15-SP3-2022-3400=1 Package List: - openSUSE Leap 15.4 (aarch64 ppc64le s390x x86_64): caca-utils-0.99.beta19.git20171003-150200.11.9.1 caca-utils-debuginfo-0.99.beta19.git20171003-150200.11.9.1 libcaca-debugsource-0.99.beta19.git20171003-150200.11.9.1 libcaca-devel-0.99.beta19.git20171003-150200.11.9.1 libcaca-ruby-0.99.beta19.git20171003-150200.11.9.1 libcaca-ruby-debuginfo-0.99.beta19.git20171003-150200.11.9.1 libcaca0-0.99.beta19.git20171003-150200.11.9.1 libcaca0-debuginfo-0.99.beta19.git20171003-150200.11.9.1 libcaca0-plugins-0.99.beta19.git20171003-150200.11.9.1 libcaca0-plugins-debuginfo-0.99.beta19.git20171003-150200.11.9.1 - openSUSE Leap 15.4 (noarch): python3-caca-0.99.beta19.git20171003-150200.11.9.1 - openSUSE Leap 15.4 (x86_64): libcaca0-32bit-0.99.beta19.git20171003-150200.11.9.1 libcaca0-32bit-debuginfo-0.99.beta19.git20171003-150200.11.9.1 libcaca0-plugins-32bit-0.99.beta19.git20171003-150200.11.9.1 libcaca0-plugins-32bit-debuginfo-0.99.beta19.git20171003-150200.11.9.1 - openSUSE Leap 15.3 (aarch64 ppc64le s390x x86_64): caca-utils-0.99.beta19.git20171003-150200.11.9.1 caca-utils-debuginfo-0.99.beta19.git20171003-150200.11.9.1 libcaca-debugsource-0.99.beta19.git20171003-150200.11.9.1 libcaca-devel-0.99.beta19.git20171003-150200.11.9.1 libcaca-ruby-0.99.beta19.git20171003-150200.11.9.1 libcaca-ruby-debuginfo-0.99.beta19.git20171003-150200.11.9.1 libcaca0-0.99.beta19.git20171003-150200.11.9.1 libcaca0-debuginfo-0.99.beta19.git20171003-150200.11.9.1 libcaca0-plugins-0.99.beta19.git20171003-150200.11.9.1 libcaca0-plugins-debuginfo-0.99.beta19.git20171003-150200.11.9.1 - openSUSE Leap 15.3 (x86_64): libcaca0-32bit-0.99.beta19.git20171003-150200.11.9.1 libcaca0-32bit-debuginfo-0.99.beta19.git20171003-150200.11.9.1 libcaca0-plugins-32bit-0.99.beta19.git20171003-150200.11.9.1 libcaca0-plugins-32bit-debuginfo-0.99.beta19.git20171003-150200.11.9.1 - openSUSE Leap 15.3 (noarch): python3-caca-0.99.beta19.git20171003-150200.11.9.1 - SUSE Linux Enterprise Module for Basesystem 15-SP4 (aarch64 ppc64le s390x x86_64): libcaca-debugsource-0.99.beta19.git20171003-150200.11.9.1 libcaca-devel-0.99.beta19.git20171003-150200.11.9.1 libcaca0-0.99.beta19.git20171003-150200.11.9.1 libcaca0-debuginfo-0.99.beta19.git20171003-150200.11.9.1 libcaca0-plugins-0.99.beta19.git20171003-150200.11.9.1 libcaca0-plugins-debuginfo-0.99.beta19.git20171003-150200.11.9.1 - SUSE Linux Enterprise Module for Basesystem 15-SP3 (aarch64 ppc64le s390x x86_64): libcaca-debugsource-0.99.beta19.git20171003-150200.11.9.1 libcaca-devel-0.99.beta19.git20171003-150200.11.9.1 libcaca0-0.99.beta19.git20171003-150200.11.9.1 libcaca0-debuginfo-0.99.beta19.git20171003-150200.11.9.1 libcaca0-plugins-0.99.beta19.git20171003-150200.11.9.1 libcaca0-plugins-debuginfo-0.99.beta19.git20171003-150200.11.9.1 References: https://www.suse.com/security/cve/CVE-2021-3410.html https://bugzilla.suse.com/1182731

1 0

SUSE-SU-2022:3394-1: moderate: Security update for permissions
by opensuse-security＠opensuse.org 26 Sep '22

26 Sep '22

SUSE Security Update: Security update for permissions ______________________________________________________________________________ Announcement ID: SUSE-SU-2022:3394-1 Rating: moderate References: #1203018 Cross-References: CVE-2022-31252 CVSS scores: CVE-2022-31252 (SUSE): 6.7 CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H Affected Products: SUSE Linux Enterprise Desktop 15-SP3 SUSE Linux Enterprise High Performance Computing 15-SP3 SUSE Linux Enterprise Micro 5.1 SUSE Linux Enterprise Micro 5.2 SUSE Linux Enterprise Module for Basesystem 15-SP3 SUSE Linux Enterprise Server 15-SP3 SUSE Linux Enterprise Server for SAP Applications 15-SP3 SUSE Linux Enterprise Storage 7.1 SUSE Manager Proxy 4.2 SUSE Manager Retail Branch Server 4.2 SUSE Manager Server 4.2 openSUSE Leap 15.3 openSUSE Leap Micro 5.2 ______________________________________________________________________________ An update that fixes one vulnerability is now available. Description: This update for permissions fixes the following issues: - CVE-2022-31252: Fixed chkstat group controlled paths (bsc#1203018). Patch Instructions: To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap Micro 5.2: zypper in -t patch openSUSE-Leap-Micro-5.2-2022-3394=1 - openSUSE Leap 15.3: zypper in -t patch openSUSE-SLE-15.3-2022-3394=1 - SUSE Linux Enterprise Module for Basesystem 15-SP3: zypper in -t patch SUSE-SLE-Module-Basesystem-15-SP3-2022-3394=1 - SUSE Linux Enterprise Micro 5.2: zypper in -t patch SUSE-SUSE-MicroOS-5.2-2022-3394=1 - SUSE Linux Enterprise Micro 5.1: zypper in -t patch SUSE-SUSE-MicroOS-5.1-2022-3394=1 Package List: - openSUSE Leap Micro 5.2 (aarch64 x86_64): permissions-20181225-150200.23.15.1 permissions-debuginfo-20181225-150200.23.15.1 permissions-debugsource-20181225-150200.23.15.1 - openSUSE Leap 15.3 (aarch64 ppc64le s390x x86_64): permissions-20181225-150200.23.15.1 permissions-debuginfo-20181225-150200.23.15.1 permissions-debugsource-20181225-150200.23.15.1 - openSUSE Leap 15.3 (noarch): permissions-zypp-plugin-20181225-150200.23.15.1 - SUSE Linux Enterprise Module for Basesystem 15-SP3 (aarch64 ppc64le s390x x86_64): permissions-20181225-150200.23.15.1 permissions-debuginfo-20181225-150200.23.15.1 permissions-debugsource-20181225-150200.23.15.1 - SUSE Linux Enterprise Module for Basesystem 15-SP3 (noarch): permissions-zypp-plugin-20181225-150200.23.15.1 - SUSE Linux Enterprise Micro 5.2 (aarch64 s390x x86_64): permissions-20181225-150200.23.15.1 permissions-debuginfo-20181225-150200.23.15.1 permissions-debugsource-20181225-150200.23.15.1 - SUSE Linux Enterprise Micro 5.1 (aarch64 s390x x86_64): permissions-20181225-150200.23.15.1 permissions-debuginfo-20181225-150200.23.15.1 permissions-debugsource-20181225-150200.23.15.1 References: https://www.suse.com/security/cve/CVE-2022-31252.html https://bugzilla.suse.com/1203018

1 0

SUSE-SU-2022:3399-1: moderate: Security update for unzip
by opensuse-security＠opensuse.org 26 Sep '22

26 Sep '22

SUSE Security Update: Security update for unzip ______________________________________________________________________________ Announcement ID: SUSE-SU-2022:3399-1 Rating: moderate References: #1196177 #1196180 Cross-References: CVE-2022-0529 CVE-2022-0530 CVSS scores: CVE-2022-0529 (NVD) : 5.5 CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H CVE-2022-0529 (SUSE): 4.7 CVSS:3.1/AV:L/AC:H/PR:N/UI:R/S:U/C:N/I:N/A:H CVE-2022-0530 (NVD) : 5.5 CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H CVE-2022-0530 (SUSE): 4.7 CVSS:3.1/AV:L/AC:H/PR:N/UI:R/S:U/C:N/I:N/A:H Affected Products: SUSE Linux Enterprise Desktop 15-SP3 SUSE Linux Enterprise Desktop 15-SP4 SUSE Linux Enterprise High Performance Computing 15-SP3 SUSE Linux Enterprise High Performance Computing 15-SP4 SUSE Linux Enterprise Module for Basesystem 15-SP3 SUSE Linux Enterprise Module for Basesystem 15-SP4 SUSE Linux Enterprise Server 15-SP3 SUSE Linux Enterprise Server 15-SP4 SUSE Linux Enterprise Server for SAP Applications 15-SP3 SUSE Linux Enterprise Server for SAP Applications 15-SP4 SUSE Linux Enterprise Storage 7.1 SUSE Manager Proxy 4.2 SUSE Manager Proxy 4.3 SUSE Manager Retail Branch Server 4.2 SUSE Manager Retail Branch Server 4.3 SUSE Manager Server 4.2 SUSE Manager Server 4.3 openSUSE Leap 15.3 openSUSE Leap 15.4 ______________________________________________________________________________ An update that fixes two vulnerabilities is now available. Description: This update for unzip fixes the following issues: - CVE-2022-0530: Fixed SIGSEGV during the conversion of an utf-8 string to a local string (bsc#1196177). - CVE-2022-0529: Fixed heap out-of-bound writes and reads during conversion of wide string to local string (bsc#1196180) Patch Instructions: To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 15.4: zypper in -t patch openSUSE-SLE-15.4-2022-3399=1 - openSUSE Leap 15.3: zypper in -t patch openSUSE-SLE-15.3-2022-3399=1 - SUSE Linux Enterprise Module for Basesystem 15-SP4: zypper in -t patch SUSE-SLE-Module-Basesystem-15-SP4-2022-3399=1 - SUSE Linux Enterprise Module for Basesystem 15-SP3: zypper in -t patch SUSE-SLE-Module-Basesystem-15-SP3-2022-3399=1 Package List: - openSUSE Leap 15.4 (aarch64 ppc64le s390x x86_64): unzip-6.00-150000.4.11.1 unzip-debuginfo-6.00-150000.4.11.1 unzip-debugsource-6.00-150000.4.11.1 unzip-doc-6.00-150000.4.11.1 - openSUSE Leap 15.3 (aarch64 ppc64le s390x x86_64): unzip-6.00-150000.4.11.1 unzip-debuginfo-6.00-150000.4.11.1 unzip-debugsource-6.00-150000.4.11.1 unzip-doc-6.00-150000.4.11.1 - SUSE Linux Enterprise Module for Basesystem 15-SP4 (aarch64 ppc64le s390x x86_64): unzip-6.00-150000.4.11.1 unzip-debuginfo-6.00-150000.4.11.1 unzip-debugsource-6.00-150000.4.11.1 - SUSE Linux Enterprise Module for Basesystem 15-SP3 (aarch64 ppc64le s390x x86_64): unzip-6.00-150000.4.11.1 unzip-debuginfo-6.00-150000.4.11.1 unzip-debugsource-6.00-150000.4.11.1 References: https://www.suse.com/security/cve/CVE-2022-0529.html https://www.suse.com/security/cve/CVE-2022-0530.html https://bugzilla.suse.com/1196177 https://bugzilla.suse.com/1196180

1 0

openSUSE-SU-2022:10130-1: important: Security update for opera
by opensuse-security＠opensuse.org 26 Sep '22

26 Sep '22

openSUSE Security Update: Security update for opera ______________________________________________________________________________ Announcement ID: openSUSE-SU-2022:10130-1 Rating: important References: Cross-References: CVE-2022-3196 CVE-2022-3197 CVE-2022-3198 CVE-2022-3199 CVE-2022-3200 CVE-2022-3201 Affected Products: openSUSE Leap 15.3:NonFree ______________________________________________________________________________ An update that fixes 6 vulnerabilities is now available. Description: This update for opera fixes the following issues: Update to 91.0.4516.20 - CHR-9019 Update chromium on desktop-stable-105-4516 to 105.0.5195.127 - DNA-101312 Allow changing logged in user with BrowserAPI - The update to chromium 105.0.5195.127 fixes following issues: CVE-2022-3196, CVE-2022-3197, CVE-2022-3198, CVE-2022-3199, CVE-2022-3200, CVE-2022-3201 Update to 91.0.4516.16 - CHR-9010 Update chromium on desktop-stable-105-4516 to 105.0.5195.102 - DNA-101447 Incorrect translation in Russian - DNA-101482 Crash at ProfileKey::GetProtoDatabaseProvider() - DNA-101495 Performance Stint 2022 - DNA-101551 Add version number info to browser API - DNA-101662 Suppress 'Allowing special test code paths' warning on buildbot - DNA-101753 News don't show after close browser - DNA-101760 Translations for O91 - DNA-101799 Crash at opera::SuggestionList::SortAndCull - DNA-101812 Sponsored site gets chosen as default entry when typing part of top-level domain - DNA-101876 Promote 91 to stable - Complete Opera 91.0 changelog at: https://blogs.opera.com/desktop/changelog-for-91/ Update to 90.0.4480.107 - DNA-100664 Shopping corner widget - DNA-101495 Performance Stint 2022 - DNA-101753 News don��t show after close browser - DNA-101799 Crash at opera::SuggestionList::SortAndCull Patch Instructions: To install this openSUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 15.3:NonFree: zypper in -t patch openSUSE-2022-10130=1 Package List: - openSUSE Leap 15.3:NonFree (x86_64): opera-91.0.4516.20-lp153.2.63.1 References: https://www.suse.com/security/cve/CVE-2022-3196.html https://www.suse.com/security/cve/CVE-2022-3197.html https://www.suse.com/security/cve/CVE-2022-3198.html https://www.suse.com/security/cve/CVE-2022-3199.html https://www.suse.com/security/cve/CVE-2022-3200.html https://www.suse.com/security/cve/CVE-2022-3201.html

1 0

SUSE-SU-2022:3391-1: important: Security update for mariadb
by opensuse-security＠opensuse.org 26 Sep '22

26 Sep '22

SUSE Security Update: Security update for mariadb ______________________________________________________________________________ Announcement ID: SUSE-SU-2022:3391-1 Rating: important References: #1200105 #1201161 #1201162 #1201163 #1201164 #1201165 #1201166 #1201167 #1201168 #1201169 #1201170 #1202863 Cross-References: CVE-2022-32081 CVE-2022-32082 CVE-2022-32083 CVE-2022-32084 CVE-2022-32085 CVE-2022-32086 CVE-2022-32087 CVE-2022-32088 CVE-2022-32089 CVE-2022-32091 CVE-2022-38791 CVSS scores: CVE-2022-32081 (NVD) : 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H CVE-2022-32081 (SUSE): 4.4 CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H CVE-2022-32082 (NVD) : 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H CVE-2022-32082 (SUSE): 4.4 CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H CVE-2022-32083 (NVD) : 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H CVE-2022-32083 (SUSE): 4.4 CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H CVE-2022-32084 (NVD) : 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H CVE-2022-32084 (SUSE): 4.4 CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H CVE-2022-32085 (NVD) : 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H CVE-2022-32085 (SUSE): 4.4 CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H CVE-2022-32086 (NVD) : 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H CVE-2022-32086 (SUSE): 4.4 CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H CVE-2022-32087 (NVD) : 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H CVE-2022-32087 (SUSE): 4.4 CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H CVE-2022-32088 (NVD) : 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H CVE-2022-32088 (SUSE): 4.4 CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H CVE-2022-32089 (NVD) : 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H CVE-2022-32089 (SUSE): 4.4 CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H CVE-2022-32091 (NVD) : 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H CVE-2022-32091 (SUSE): 4.4 CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H CVE-2022-38791 (NVD) : 5.5 CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H CVE-2022-38791 (SUSE): 6.2 CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H Affected Products: SUSE Linux Enterprise High Performance Computing 15-SP3 SUSE Linux Enterprise Module for Packagehub Subpackages 15-SP3 SUSE Linux Enterprise Module for Server Applications 15-SP3 SUSE Linux Enterprise Server 15-SP3 SUSE Linux Enterprise Server for SAP Applications 15-SP3 SUSE Linux Enterprise Storage 7.1 SUSE Manager Proxy 4.2 SUSE Manager Retail Branch Server 4.2 SUSE Manager Server 4.2 openSUSE Leap 15.3 ______________________________________________________________________________ An update that solves 11 vulnerabilities and has one errata is now available. Description: This update for mariadb fixes the following issues: Update to 10.5.17: - CVE-2022-32082: Fixed assertion failure at table->get_ref_count() == 0 in dict0dict.cc (bsc#1201162). - CVE-2022-32089: Fixed segmentation fault via the component st_select_lex_unit::exclude_level (bsc#1201169). - CVE-2022-32081: Fixed use-after-poison in prepare_inplace_add_virtual at /storage/innobase/handler/handler0alter.cc (bsc#1201161). - CVE-2022-32091: Fixed use-after-poison in __interceptor_memset at /libsanitizer/sanitizer_common/sanitizer_common_interceptors.inc (bsc#1201170). - CVE-2022-32084: Fixed segmentation fault via the component sub_select (bsc#1201164). - CVE-2022-38791: Fixed deadlock in compress_write in extra/mariabackup/ds_compress.cc (bsc#1202863). - CVE-2022-32088: Fixed segmentation fault via the component Exec_time_tracker::get_loops/Filesort_tracker::report_use/filesort (bsc#1201168). - CVE-2022-32087: Fixed segmentation fault via the component Item_args::walk_args (bsc#1201167). - CVE-2022-32086: Fixed segmentation fault via the component Item_field::fix_outer_field (bsc#1201166). - CVE-2022-32085: Fixed segmentation fault via the component Item_func_in::cleanup/Item::cleanup_processor (bsc#1201165). - CVE-2022-32083: Fixed segmentation fault via the component Item_subselect::init_expr_cache_tracker (bsc#1201163). Bugfixes: - Fixed mysql-systemd-helper being unaware of custom group (bsc#1200105). Patch Instructions: To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 15.3: zypper in -t patch openSUSE-SLE-15.3-2022-3391=1 - SUSE Linux Enterprise Module for Server Applications 15-SP3: zypper in -t patch SUSE-SLE-Module-Server-Applications-15-SP3-2022-3391=1 - SUSE Linux Enterprise Module for Packagehub Subpackages 15-SP3: zypper in -t patch SUSE-SLE-Module-Packagehub-Subpackages-15-SP3-2022-3391=1 Package List: - openSUSE Leap 15.3 (aarch64 ppc64le s390x x86_64): libmariadbd-devel-10.5.17-150300.3.21.1 libmariadbd19-10.5.17-150300.3.21.1 libmariadbd19-debuginfo-10.5.17-150300.3.21.1 mariadb-10.5.17-150300.3.21.1 mariadb-bench-10.5.17-150300.3.21.1 mariadb-bench-debuginfo-10.5.17-150300.3.21.1 mariadb-client-10.5.17-150300.3.21.1 mariadb-client-debuginfo-10.5.17-150300.3.21.1 mariadb-debuginfo-10.5.17-150300.3.21.1 mariadb-debugsource-10.5.17-150300.3.21.1 mariadb-rpm-macros-10.5.17-150300.3.21.1 mariadb-test-10.5.17-150300.3.21.1 mariadb-test-debuginfo-10.5.17-150300.3.21.1 mariadb-tools-10.5.17-150300.3.21.1 mariadb-tools-debuginfo-10.5.17-150300.3.21.1 - openSUSE Leap 15.3 (noarch): mariadb-errormessages-10.5.17-150300.3.21.1 - SUSE Linux Enterprise Module for Server Applications 15-SP3 (aarch64 ppc64le s390x x86_64): libmariadbd-devel-10.5.17-150300.3.21.1 libmariadbd19-10.5.17-150300.3.21.1 libmariadbd19-debuginfo-10.5.17-150300.3.21.1 mariadb-10.5.17-150300.3.21.1 mariadb-client-10.5.17-150300.3.21.1 mariadb-client-debuginfo-10.5.17-150300.3.21.1 mariadb-debuginfo-10.5.17-150300.3.21.1 mariadb-debugsource-10.5.17-150300.3.21.1 mariadb-tools-10.5.17-150300.3.21.1 mariadb-tools-debuginfo-10.5.17-150300.3.21.1 - SUSE Linux Enterprise Module for Server Applications 15-SP3 (noarch): mariadb-errormessages-10.5.17-150300.3.21.1 - SUSE Linux Enterprise Module for Packagehub Subpackages 15-SP3 (aarch64 ppc64le s390x x86_64): mariadb-galera-10.5.17-150300.3.21.1 References: https://www.suse.com/security/cve/CVE-2022-32081.html https://www.suse.com/security/cve/CVE-2022-32082.html https://www.suse.com/security/cve/CVE-2022-32083.html https://www.suse.com/security/cve/CVE-2022-32084.html https://www.suse.com/security/cve/CVE-2022-32085.html https://www.suse.com/security/cve/CVE-2022-32086.html https://www.suse.com/security/cve/CVE-2022-32087.html https://www.suse.com/security/cve/CVE-2022-32088.html https://www.suse.com/security/cve/CVE-2022-32089.html https://www.suse.com/security/cve/CVE-2022-32091.html https://www.suse.com/security/cve/CVE-2022-38791.html https://bugzilla.suse.com/1200105 https://bugzilla.suse.com/1201161 https://bugzilla.suse.com/1201162 https://bugzilla.suse.com/1201163 https://bugzilla.suse.com/1201164 https://bugzilla.suse.com/1201165 https://bugzilla.suse.com/1201166 https://bugzilla.suse.com/1201167 https://bugzilla.suse.com/1201168 https://bugzilla.suse.com/1201169 https://bugzilla.suse.com/1201170 https://bugzilla.suse.com/1202863

1 0

SUSE-SU-2022:3390-1: important: Security update for dpdk
by opensuse-security＠opensuse.org 26 Sep '22

26 Sep '22

SUSE Security Update: Security update for dpdk ______________________________________________________________________________ Announcement ID: SUSE-SU-2022:3390-1 Rating: important References: #1202903 #1202956 Cross-References: CVE-2022-2132 CVE-2022-28199 CVSS scores: CVE-2022-2132 (NVD) : 8.6 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:N/A:H CVE-2022-2132 (SUSE): 8.6 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:N/A:H CVE-2022-28199 (NVD) : 6.5 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H CVE-2022-28199 (SUSE): 7.3 CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:L/I:H/A:H Affected Products: SUSE Linux Enterprise High Performance Computing 15-SP3 SUSE Linux Enterprise Module for Server Applications 15-SP3 SUSE Linux Enterprise Server 15-SP3 SUSE Linux Enterprise Server for SAP Applications 15-SP3 SUSE Linux Enterprise Storage 7.1 SUSE Manager Proxy 4.2 SUSE Manager Retail Branch Server 4.2 SUSE Manager Server 4.2 openSUSE Leap 15.3 ______________________________________________________________________________ An update that fixes two vulnerabilities is now available. Description: This update for dpdk fixes the following issues: - CVE-2022-2132: Fixed DoS when a vhost header crosses more than two descriptors and exhausts all mbufs (bsc#1202903). - CVE-2022-28199: Fixed buffer overflow in the vhost code (bsc#1202956). Patch Instructions: To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 15.3: zypper in -t patch openSUSE-SLE-15.3-2022-3390=1 - SUSE Linux Enterprise Module for Server Applications 15-SP3: zypper in -t patch SUSE-SLE-Module-Server-Applications-15-SP3-2022-3390=1 Package List: - openSUSE Leap 15.3 (aarch64 ppc64le x86_64): dpdk-19.11.4-150300.16.1 dpdk-debuginfo-19.11.4-150300.16.1 dpdk-debugsource-19.11.4-150300.16.1 dpdk-devel-19.11.4-150300.16.1 dpdk-devel-debuginfo-19.11.4-150300.16.1 dpdk-examples-19.11.4-150300.16.1 dpdk-examples-debuginfo-19.11.4-150300.16.1 dpdk-kmp-default-19.11.4_k5.3.18_150300.59.93-150300.16.1 dpdk-kmp-default-debuginfo-19.11.4_k5.3.18_150300.59.93-150300.16.1 dpdk-tools-19.11.4-150300.16.1 dpdk-tools-debuginfo-19.11.4-150300.16.1 libdpdk-20_0-19.11.4-150300.16.1 libdpdk-20_0-debuginfo-19.11.4-150300.16.1 - openSUSE Leap 15.3 (aarch64 x86_64): dpdk-kmp-preempt-19.11.4_k5.3.18_150300.59.93-150300.16.1 dpdk-kmp-preempt-debuginfo-19.11.4_k5.3.18_150300.59.93-150300.16.1 - openSUSE Leap 15.3 (aarch64): dpdk-thunderx-19.11.4-150300.16.1 dpdk-thunderx-debuginfo-19.11.4-150300.16.1 dpdk-thunderx-debugsource-19.11.4-150300.16.1 dpdk-thunderx-devel-19.11.4-150300.16.1 dpdk-thunderx-devel-debuginfo-19.11.4-150300.16.1 dpdk-thunderx-examples-19.11.4-150300.16.1 dpdk-thunderx-examples-debuginfo-19.11.4-150300.16.1 dpdk-thunderx-kmp-default-19.11.4_k5.3.18_150300.59.93-150300.16.1 dpdk-thunderx-kmp-default-debuginfo-19.11.4_k5.3.18_150300.59.93-150300.16.1 dpdk-thunderx-kmp-preempt-19.11.4_k5.3.18_150300.59.93-150300.16.1 dpdk-thunderx-kmp-preempt-debuginfo-19.11.4_k5.3.18_150300.59.93-150300.16.1 dpdk-thunderx-tools-19.11.4-150300.16.1 dpdk-thunderx-tools-debuginfo-19.11.4-150300.16.1 - openSUSE Leap 15.3 (noarch): dpdk-doc-19.11.4-150300.16.1 dpdk-thunderx-doc-19.11.4-150300.16.1 - SUSE Linux Enterprise Module for Server Applications 15-SP3 (aarch64 ppc64le x86_64): dpdk-19.11.4-150300.16.1 dpdk-debuginfo-19.11.4-150300.16.1 dpdk-debugsource-19.11.4-150300.16.1 dpdk-devel-19.11.4-150300.16.1 dpdk-devel-debuginfo-19.11.4-150300.16.1 dpdk-kmp-default-19.11.4_k5.3.18_150300.59.93-150300.16.1 dpdk-kmp-default-debuginfo-19.11.4_k5.3.18_150300.59.93-150300.16.1 dpdk-tools-19.11.4-150300.16.1 dpdk-tools-debuginfo-19.11.4-150300.16.1 libdpdk-20_0-19.11.4-150300.16.1 libdpdk-20_0-debuginfo-19.11.4-150300.16.1 - SUSE Linux Enterprise Module for Server Applications 15-SP3 (aarch64): dpdk-thunderx-19.11.4-150300.16.1 dpdk-thunderx-debuginfo-19.11.4-150300.16.1 dpdk-thunderx-debugsource-19.11.4-150300.16.1 dpdk-thunderx-devel-19.11.4-150300.16.1 dpdk-thunderx-devel-debuginfo-19.11.4-150300.16.1 dpdk-thunderx-kmp-default-19.11.4_k5.3.18_150300.59.93-150300.16.1 dpdk-thunderx-kmp-default-debuginfo-19.11.4_k5.3.18_150300.59.93-150300.16.1 References: https://www.suse.com/security/cve/CVE-2022-2132.html https://www.suse.com/security/cve/CVE-2022-28199.html https://bugzilla.suse.com/1202903 https://bugzilla.suse.com/1202956

1 0