January 2023 - openSUSE Security Announce

SUSE-SU-2023:0114-1: important: Security update for sudo
by opensuse-security＠opensuse.org 20 Jan '23

20 Jan '23

SUSE Security Update: Security update for sudo ______________________________________________________________________________ Announcement ID: SUSE-SU-2023:0114-1 Rating: important References: #1207082 Cross-References: CVE-2023-22809 CVSS scores: CVE-2023-22809 (SUSE): 7.8 CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H Affected Products: SUSE Linux Enterprise Desktop 15-SP4 SUSE Linux Enterprise High Performance Computing 15-SP4 SUSE Linux Enterprise Micro 5.3 SUSE Linux Enterprise Module for Basesystem 15-SP4 SUSE Linux Enterprise Server 15-SP4 SUSE Linux Enterprise Server for SAP Applications 15-SP4 SUSE Manager Proxy 4.3 SUSE Manager Retail Branch Server 4.3 SUSE Manager Server 4.3 openSUSE Leap 15.4 openSUSE Leap Micro 5.3 ______________________________________________________________________________ An update that fixes one vulnerability is now available. Description: This update for sudo fixes the following issues: - CVE-2023-22809: Fixed an arbitrary file write issue that could be exploited by users with sudoedit permissions (bsc#1207082). Patch Instructions: To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap Micro 5.3: zypper in -t patch openSUSE-Leap-Micro-5.3-2023-114=1 - openSUSE Leap 15.4: zypper in -t patch openSUSE-SLE-15.4-2023-114=1 - SUSE Linux Enterprise Module for Basesystem 15-SP4: zypper in -t patch SUSE-SLE-Module-Basesystem-15-SP4-2023-114=1 - SUSE Linux Enterprise Micro 5.3: zypper in -t patch SUSE-SLE-Micro-5.3-2023-114=1 Package List: - openSUSE Leap Micro 5.3 (aarch64 x86_64): sudo-1.9.9-150400.4.12.1 sudo-debuginfo-1.9.9-150400.4.12.1 sudo-debugsource-1.9.9-150400.4.12.1 - openSUSE Leap 15.4 (aarch64 ppc64le s390x x86_64): sudo-1.9.9-150400.4.12.1 sudo-debuginfo-1.9.9-150400.4.12.1 sudo-debugsource-1.9.9-150400.4.12.1 sudo-devel-1.9.9-150400.4.12.1 sudo-plugin-python-1.9.9-150400.4.12.1 sudo-plugin-python-debuginfo-1.9.9-150400.4.12.1 sudo-test-1.9.9-150400.4.12.1 - SUSE Linux Enterprise Module for Basesystem 15-SP4 (aarch64 ppc64le s390x x86_64): sudo-1.9.9-150400.4.12.1 sudo-debuginfo-1.9.9-150400.4.12.1 sudo-debugsource-1.9.9-150400.4.12.1 sudo-devel-1.9.9-150400.4.12.1 sudo-plugin-python-1.9.9-150400.4.12.1 sudo-plugin-python-debuginfo-1.9.9-150400.4.12.1 - SUSE Linux Enterprise Micro 5.3 (aarch64 s390x x86_64): sudo-1.9.9-150400.4.12.1 sudo-debuginfo-1.9.9-150400.4.12.1 sudo-debugsource-1.9.9-150400.4.12.1 References: https://www.suse.com/security/cve/CVE-2023-22809.html https://bugzilla.suse.com/1207082

1 0

SUSE-SU-2023:0108-1: important: Security update for git
by opensuse-security＠opensuse.org 20 Jan '23

20 Jan '23

SUSE Security Update: Security update for git ______________________________________________________________________________ Announcement ID: SUSE-SU-2023:0108-1 Rating: important References: #1207032 #1207033 Cross-References: CVE-2022-23521 CVE-2022-41903 CVSS scores: CVE-2022-23521 (SUSE): 7.8 CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H CVE-2022-41903 (SUSE): 7.8 CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H Affected Products: SUSE CaaS Platform 4.0 SUSE Enterprise Storage 6 SUSE Enterprise Storage 7 SUSE Linux Enterprise High Performance Computing 15-SP1-LTSS SUSE Linux Enterprise High Performance Computing 15-SP2-LTSS SUSE Linux Enterprise Server 15-SP1-LTSS SUSE Linux Enterprise Server 15-SP2-LTSS SUSE Linux Enterprise Server for SAP 15-SP1 SUSE Linux Enterprise Server for SAP 15-SP2 openSUSE Leap 15.4 ______________________________________________________________________________ An update that fixes two vulnerabilities is now available. Description: This update for git fixes the following issues: - CVE-2022-41903: Fixed a heap overflow in the "git archive" and "git log --format" commands (bsc#1207033). - CVE-2022-23521: Fixed an integer overflow that could be triggered when parsing a gitattributes file (bsc#1207032). Patch Instructions: To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 15.4: zypper in -t patch openSUSE-SLE-15.4-2023-108=1 - SUSE Linux Enterprise Server for SAP 15-SP2: zypper in -t patch SUSE-SLE-Product-SLES_SAP-15-SP2-2023-108=1 - SUSE Linux Enterprise Server for SAP 15-SP1: zypper in -t patch SUSE-SLE-Product-SLES_SAP-15-SP1-2023-108=1 - SUSE Linux Enterprise Server 15-SP2-LTSS: zypper in -t patch SUSE-SLE-Product-SLES-15-SP2-LTSS-2023-108=1 - SUSE Linux Enterprise Server 15-SP1-LTSS: zypper in -t patch SUSE-SLE-Product-SLES-15-SP1-LTSS-2023-108=1 - SUSE Linux Enterprise High Performance Computing 15-SP2-LTSS: zypper in -t patch SUSE-SLE-Product-HPC-15-SP2-LTSS-2023-108=1 - SUSE Linux Enterprise High Performance Computing 15-SP1-LTSS: zypper in -t patch SUSE-SLE-Product-HPC-15-SP1-LTSS-2023-108=1 - SUSE Enterprise Storage 7: zypper in -t patch SUSE-Storage-7-2023-108=1 - SUSE Enterprise Storage 6: zypper in -t patch SUSE-Storage-6-2023-108=1 - SUSE CaaS Platform 4.0: To install this update, use the SUSE CaaS Platform 'skuba' tool. It will inform you if it detects new updates and let you then trigger updating of the complete cluster in a controlled way. Package List: - openSUSE Leap 15.4 (aarch64 ppc64le s390x x86_64): git-svn-debuginfo-2.26.2-150000.44.1 - SUSE Linux Enterprise Server for SAP 15-SP2 (ppc64le x86_64): git-2.26.2-150000.44.1 git-arch-2.26.2-150000.44.1 git-core-2.26.2-150000.44.1 git-core-debuginfo-2.26.2-150000.44.1 git-cvs-2.26.2-150000.44.1 git-daemon-2.26.2-150000.44.1 git-daemon-debuginfo-2.26.2-150000.44.1 git-debuginfo-2.26.2-150000.44.1 git-debugsource-2.26.2-150000.44.1 git-email-2.26.2-150000.44.1 git-gui-2.26.2-150000.44.1 git-svn-2.26.2-150000.44.1 git-svn-debuginfo-2.26.2-150000.44.1 git-web-2.26.2-150000.44.1 gitk-2.26.2-150000.44.1 - SUSE Linux Enterprise Server for SAP 15-SP2 (noarch): git-doc-2.26.2-150000.44.1 - SUSE Linux Enterprise Server for SAP 15-SP1 (ppc64le x86_64): git-2.26.2-150000.44.1 git-arch-2.26.2-150000.44.1 git-core-2.26.2-150000.44.1 git-core-debuginfo-2.26.2-150000.44.1 git-cvs-2.26.2-150000.44.1 git-daemon-2.26.2-150000.44.1 git-daemon-debuginfo-2.26.2-150000.44.1 git-debuginfo-2.26.2-150000.44.1 git-debugsource-2.26.2-150000.44.1 git-email-2.26.2-150000.44.1 git-gui-2.26.2-150000.44.1 git-svn-2.26.2-150000.44.1 git-svn-debuginfo-2.26.2-150000.44.1 git-web-2.26.2-150000.44.1 gitk-2.26.2-150000.44.1 - SUSE Linux Enterprise Server for SAP 15-SP1 (noarch): git-doc-2.26.2-150000.44.1 - SUSE Linux Enterprise Server 15-SP2-LTSS (aarch64 ppc64le s390x x86_64): git-2.26.2-150000.44.1 git-arch-2.26.2-150000.44.1 git-core-2.26.2-150000.44.1 git-core-debuginfo-2.26.2-150000.44.1 git-cvs-2.26.2-150000.44.1 git-daemon-2.26.2-150000.44.1 git-daemon-debuginfo-2.26.2-150000.44.1 git-debuginfo-2.26.2-150000.44.1 git-debugsource-2.26.2-150000.44.1 git-email-2.26.2-150000.44.1 git-gui-2.26.2-150000.44.1 git-svn-2.26.2-150000.44.1 git-svn-debuginfo-2.26.2-150000.44.1 git-web-2.26.2-150000.44.1 gitk-2.26.2-150000.44.1 - SUSE Linux Enterprise Server 15-SP2-LTSS (noarch): git-doc-2.26.2-150000.44.1 - SUSE Linux Enterprise Server 15-SP1-LTSS (aarch64 ppc64le s390x x86_64): git-2.26.2-150000.44.1 git-arch-2.26.2-150000.44.1 git-core-2.26.2-150000.44.1 git-core-debuginfo-2.26.2-150000.44.1 git-cvs-2.26.2-150000.44.1 git-daemon-2.26.2-150000.44.1 git-daemon-debuginfo-2.26.2-150000.44.1 git-debuginfo-2.26.2-150000.44.1 git-debugsource-2.26.2-150000.44.1 git-email-2.26.2-150000.44.1 git-gui-2.26.2-150000.44.1 git-svn-2.26.2-150000.44.1 git-svn-debuginfo-2.26.2-150000.44.1 git-web-2.26.2-150000.44.1 gitk-2.26.2-150000.44.1 - SUSE Linux Enterprise Server 15-SP1-LTSS (noarch): git-doc-2.26.2-150000.44.1 - SUSE Linux Enterprise High Performance Computing 15-SP2-LTSS (aarch64 x86_64): git-2.26.2-150000.44.1 git-arch-2.26.2-150000.44.1 git-core-2.26.2-150000.44.1 git-core-debuginfo-2.26.2-150000.44.1 git-cvs-2.26.2-150000.44.1 git-daemon-2.26.2-150000.44.1 git-daemon-debuginfo-2.26.2-150000.44.1 git-debuginfo-2.26.2-150000.44.1 git-debugsource-2.26.2-150000.44.1 git-email-2.26.2-150000.44.1 git-gui-2.26.2-150000.44.1 git-svn-2.26.2-150000.44.1 git-svn-debuginfo-2.26.2-150000.44.1 git-web-2.26.2-150000.44.1 gitk-2.26.2-150000.44.1 - SUSE Linux Enterprise High Performance Computing 15-SP2-LTSS (noarch): git-doc-2.26.2-150000.44.1 - SUSE Linux Enterprise High Performance Computing 15-SP1-LTSS (aarch64 x86_64): git-2.26.2-150000.44.1 git-arch-2.26.2-150000.44.1 git-core-2.26.2-150000.44.1 git-core-debuginfo-2.26.2-150000.44.1 git-cvs-2.26.2-150000.44.1 git-daemon-2.26.2-150000.44.1 git-daemon-debuginfo-2.26.2-150000.44.1 git-debuginfo-2.26.2-150000.44.1 git-debugsource-2.26.2-150000.44.1 git-email-2.26.2-150000.44.1 git-gui-2.26.2-150000.44.1 git-svn-2.26.2-150000.44.1 git-svn-debuginfo-2.26.2-150000.44.1 git-web-2.26.2-150000.44.1 gitk-2.26.2-150000.44.1 - SUSE Linux Enterprise High Performance Computing 15-SP1-LTSS (noarch): git-doc-2.26.2-150000.44.1 - SUSE Enterprise Storage 7 (aarch64 x86_64): git-2.26.2-150000.44.1 git-arch-2.26.2-150000.44.1 git-core-2.26.2-150000.44.1 git-core-debuginfo-2.26.2-150000.44.1 git-cvs-2.26.2-150000.44.1 git-daemon-2.26.2-150000.44.1 git-daemon-debuginfo-2.26.2-150000.44.1 git-debuginfo-2.26.2-150000.44.1 git-debugsource-2.26.2-150000.44.1 git-email-2.26.2-150000.44.1 git-gui-2.26.2-150000.44.1 git-svn-2.26.2-150000.44.1 git-svn-debuginfo-2.26.2-150000.44.1 git-web-2.26.2-150000.44.1 gitk-2.26.2-150000.44.1 - SUSE Enterprise Storage 7 (noarch): git-doc-2.26.2-150000.44.1 - SUSE Enterprise Storage 6 (aarch64 x86_64): git-2.26.2-150000.44.1 git-arch-2.26.2-150000.44.1 git-core-2.26.2-150000.44.1 git-core-debuginfo-2.26.2-150000.44.1 git-cvs-2.26.2-150000.44.1 git-daemon-2.26.2-150000.44.1 git-daemon-debuginfo-2.26.2-150000.44.1 git-debuginfo-2.26.2-150000.44.1 git-debugsource-2.26.2-150000.44.1 git-email-2.26.2-150000.44.1 git-gui-2.26.2-150000.44.1 git-svn-2.26.2-150000.44.1 git-svn-debuginfo-2.26.2-150000.44.1 git-web-2.26.2-150000.44.1 gitk-2.26.2-150000.44.1 - SUSE Enterprise Storage 6 (noarch): git-doc-2.26.2-150000.44.1 - SUSE CaaS Platform 4.0 (noarch): git-doc-2.26.2-150000.44.1 - SUSE CaaS Platform 4.0 (x86_64): git-2.26.2-150000.44.1 git-arch-2.26.2-150000.44.1 git-core-2.26.2-150000.44.1 git-core-debuginfo-2.26.2-150000.44.1 git-cvs-2.26.2-150000.44.1 git-daemon-2.26.2-150000.44.1 git-daemon-debuginfo-2.26.2-150000.44.1 git-debuginfo-2.26.2-150000.44.1 git-debugsource-2.26.2-150000.44.1 git-email-2.26.2-150000.44.1 git-gui-2.26.2-150000.44.1 git-svn-2.26.2-150000.44.1 git-svn-debuginfo-2.26.2-150000.44.1 git-web-2.26.2-150000.44.1 gitk-2.26.2-150000.44.1 References: https://www.suse.com/security/cve/CVE-2022-23521.html https://www.suse.com/security/cve/CVE-2022-41903.html https://bugzilla.suse.com/1207032 https://bugzilla.suse.com/1207033

1 0

SUSE-SU-2023:0110-1: important: Security update for git
by opensuse-security＠opensuse.org 20 Jan '23

20 Jan '23

SUSE Security Update: Security update for git ______________________________________________________________________________ Announcement ID: SUSE-SU-2023:0110-1 Rating: important References: #1207032 #1207033 Cross-References: CVE-2022-23521 CVE-2022-41903 CVSS scores: CVE-2022-23521 (SUSE): 7.8 CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H CVE-2022-41903 (SUSE): 7.8 CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H Affected Products: SUSE Enterprise Storage 7.1 SUSE Linux Enterprise Desktop 15-SP4 SUSE Linux Enterprise High Performance Computing 15-SP3-ESPOS SUSE Linux Enterprise High Performance Computing 15-SP3-LTSS SUSE Linux Enterprise High Performance Computing 15-SP4 SUSE Linux Enterprise Module for Basesystem 15-SP4 SUSE Linux Enterprise Module for Development Tools 15-SP4 SUSE Linux Enterprise Realtime Extension 15-SP3 SUSE Linux Enterprise Server 15-SP3-LTSS SUSE Linux Enterprise Server 15-SP4 SUSE Linux Enterprise Server for SAP 15-SP3 SUSE Linux Enterprise Server for SAP Applications 15-SP4 SUSE Manager Proxy 4.2 SUSE Manager Proxy 4.3 SUSE Manager Retail Branch Server 4.2 SUSE Manager Retail Branch Server 4.3 SUSE Manager Server 4.2 SUSE Manager Server 4.3 openSUSE Leap 15.4 ______________________________________________________________________________ An update that fixes two vulnerabilities is now available. Description: This update for git fixes the following issues: - CVE-2022-41903: Fixed a heap overflow in the "git archive" and "git log --format" commands (bsc#1207033). - CVE-2022-23521: Fixed an integer overflow that could be triggered when parsing a gitattributes file (bsc#1207032). Patch Instructions: To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 15.4: zypper in -t patch openSUSE-SLE-15.4-2023-110=1 - SUSE Manager Server 4.2: zypper in -t patch SUSE-SLE-Product-SUSE-Manager-Server-4.2-2023-110=1 - SUSE Manager Retail Branch Server 4.2: zypper in -t patch SUSE-SLE-Product-SUSE-Manager-Retail-Branch-Server-4.2-2023-110=1 - SUSE Manager Proxy 4.2: zypper in -t patch SUSE-SLE-Product-SUSE-Manager-Proxy-4.2-2023-110=1 - SUSE Linux Enterprise Server for SAP 15-SP3: zypper in -t patch SUSE-SLE-Product-SLES_SAP-15-SP3-2023-110=1 - SUSE Linux Enterprise Server 15-SP3-LTSS: zypper in -t patch SUSE-SLE-Product-SLES-15-SP3-LTSS-2023-110=1 - SUSE Linux Enterprise Realtime Extension 15-SP3: zypper in -t patch SUSE-SLE-Product-RT-15-SP3-2023-110=1 - SUSE Linux Enterprise Module for Development Tools 15-SP4: zypper in -t patch SUSE-SLE-Module-Development-Tools-15-SP4-2023-110=1 - SUSE Linux Enterprise Module for Basesystem 15-SP4: zypper in -t patch SUSE-SLE-Module-Basesystem-15-SP4-2023-110=1 - SUSE Linux Enterprise High Performance Computing 15-SP3-LTSS: zypper in -t patch SUSE-SLE-Product-HPC-15-SP3-LTSS-2023-110=1 - SUSE Linux Enterprise High Performance Computing 15-SP3-ESPOS: zypper in -t patch SUSE-SLE-Product-HPC-15-SP3-ESPOS-2023-110=1 - SUSE Enterprise Storage 7.1: zypper in -t patch SUSE-Storage-7.1-2023-110=1 Package List: - openSUSE Leap 15.4 (aarch64 ppc64le s390x x86_64): git-2.35.3-150300.10.21.1 git-arch-2.35.3-150300.10.21.1 git-core-2.35.3-150300.10.21.1 git-core-debuginfo-2.35.3-150300.10.21.1 git-credential-gnome-keyring-2.35.3-150300.10.21.1 git-credential-gnome-keyring-debuginfo-2.35.3-150300.10.21.1 git-credential-libsecret-2.35.3-150300.10.21.1 git-credential-libsecret-debuginfo-2.35.3-150300.10.21.1 git-cvs-2.35.3-150300.10.21.1 git-daemon-2.35.3-150300.10.21.1 git-daemon-debuginfo-2.35.3-150300.10.21.1 git-debuginfo-2.35.3-150300.10.21.1 git-debugsource-2.35.3-150300.10.21.1 git-email-2.35.3-150300.10.21.1 git-gui-2.35.3-150300.10.21.1 git-p4-2.35.3-150300.10.21.1 git-svn-2.35.3-150300.10.21.1 git-web-2.35.3-150300.10.21.1 gitk-2.35.3-150300.10.21.1 perl-Git-2.35.3-150300.10.21.1 - openSUSE Leap 15.4 (noarch): git-doc-2.35.3-150300.10.21.1 - SUSE Manager Server 4.2 (ppc64le s390x x86_64): git-core-2.35.3-150300.10.21.1 git-core-debuginfo-2.35.3-150300.10.21.1 git-debuginfo-2.35.3-150300.10.21.1 git-debugsource-2.35.3-150300.10.21.1 perl-Git-2.35.3-150300.10.21.1 - SUSE Manager Retail Branch Server 4.2 (x86_64): git-core-2.35.3-150300.10.21.1 git-core-debuginfo-2.35.3-150300.10.21.1 git-debuginfo-2.35.3-150300.10.21.1 git-debugsource-2.35.3-150300.10.21.1 perl-Git-2.35.3-150300.10.21.1 - SUSE Manager Proxy 4.2 (x86_64): git-core-2.35.3-150300.10.21.1 git-core-debuginfo-2.35.3-150300.10.21.1 git-debuginfo-2.35.3-150300.10.21.1 git-debugsource-2.35.3-150300.10.21.1 perl-Git-2.35.3-150300.10.21.1 - SUSE Linux Enterprise Server for SAP 15-SP3 (ppc64le x86_64): git-2.35.3-150300.10.21.1 git-arch-2.35.3-150300.10.21.1 git-core-2.35.3-150300.10.21.1 git-core-debuginfo-2.35.3-150300.10.21.1 git-cvs-2.35.3-150300.10.21.1 git-daemon-2.35.3-150300.10.21.1 git-daemon-debuginfo-2.35.3-150300.10.21.1 git-debuginfo-2.35.3-150300.10.21.1 git-debugsource-2.35.3-150300.10.21.1 git-email-2.35.3-150300.10.21.1 git-gui-2.35.3-150300.10.21.1 git-svn-2.35.3-150300.10.21.1 git-web-2.35.3-150300.10.21.1 gitk-2.35.3-150300.10.21.1 perl-Git-2.35.3-150300.10.21.1 - SUSE Linux Enterprise Server for SAP 15-SP3 (noarch): git-doc-2.35.3-150300.10.21.1 - SUSE Linux Enterprise Server 15-SP3-LTSS (aarch64 ppc64le s390x x86_64): git-2.35.3-150300.10.21.1 git-arch-2.35.3-150300.10.21.1 git-core-2.35.3-150300.10.21.1 git-core-debuginfo-2.35.3-150300.10.21.1 git-cvs-2.35.3-150300.10.21.1 git-daemon-2.35.3-150300.10.21.1 git-daemon-debuginfo-2.35.3-150300.10.21.1 git-debuginfo-2.35.3-150300.10.21.1 git-debugsource-2.35.3-150300.10.21.1 git-email-2.35.3-150300.10.21.1 git-gui-2.35.3-150300.10.21.1 git-svn-2.35.3-150300.10.21.1 git-web-2.35.3-150300.10.21.1 gitk-2.35.3-150300.10.21.1 perl-Git-2.35.3-150300.10.21.1 - SUSE Linux Enterprise Server 15-SP3-LTSS (noarch): git-doc-2.35.3-150300.10.21.1 - SUSE Linux Enterprise Realtime Extension 15-SP3 (noarch): git-doc-2.35.3-150300.10.21.1 - SUSE Linux Enterprise Realtime Extension 15-SP3 (x86_64): git-2.35.3-150300.10.21.1 git-arch-2.35.3-150300.10.21.1 git-core-2.35.3-150300.10.21.1 git-core-debuginfo-2.35.3-150300.10.21.1 git-cvs-2.35.3-150300.10.21.1 git-daemon-2.35.3-150300.10.21.1 git-daemon-debuginfo-2.35.3-150300.10.21.1 git-debuginfo-2.35.3-150300.10.21.1 git-debugsource-2.35.3-150300.10.21.1 git-email-2.35.3-150300.10.21.1 git-gui-2.35.3-150300.10.21.1 git-svn-2.35.3-150300.10.21.1 git-web-2.35.3-150300.10.21.1 gitk-2.35.3-150300.10.21.1 perl-Git-2.35.3-150300.10.21.1 - SUSE Linux Enterprise Module for Development Tools 15-SP4 (aarch64 ppc64le s390x x86_64): git-2.35.3-150300.10.21.1 git-arch-2.35.3-150300.10.21.1 git-cvs-2.35.3-150300.10.21.1 git-daemon-2.35.3-150300.10.21.1 git-daemon-debuginfo-2.35.3-150300.10.21.1 git-debuginfo-2.35.3-150300.10.21.1 git-debugsource-2.35.3-150300.10.21.1 git-email-2.35.3-150300.10.21.1 git-gui-2.35.3-150300.10.21.1 git-svn-2.35.3-150300.10.21.1 git-web-2.35.3-150300.10.21.1 gitk-2.35.3-150300.10.21.1 perl-Git-2.35.3-150300.10.21.1 - SUSE Linux Enterprise Module for Development Tools 15-SP4 (noarch): git-doc-2.35.3-150300.10.21.1 - SUSE Linux Enterprise Module for Basesystem 15-SP4 (aarch64 ppc64le s390x x86_64): git-core-2.35.3-150300.10.21.1 git-core-debuginfo-2.35.3-150300.10.21.1 git-debuginfo-2.35.3-150300.10.21.1 git-debugsource-2.35.3-150300.10.21.1 - SUSE Linux Enterprise High Performance Computing 15-SP3-LTSS (aarch64 x86_64): git-2.35.3-150300.10.21.1 git-arch-2.35.3-150300.10.21.1 git-core-2.35.3-150300.10.21.1 git-core-debuginfo-2.35.3-150300.10.21.1 git-cvs-2.35.3-150300.10.21.1 git-daemon-2.35.3-150300.10.21.1 git-daemon-debuginfo-2.35.3-150300.10.21.1 git-debuginfo-2.35.3-150300.10.21.1 git-debugsource-2.35.3-150300.10.21.1 git-email-2.35.3-150300.10.21.1 git-gui-2.35.3-150300.10.21.1 git-svn-2.35.3-150300.10.21.1 git-web-2.35.3-150300.10.21.1 gitk-2.35.3-150300.10.21.1 perl-Git-2.35.3-150300.10.21.1 - SUSE Linux Enterprise High Performance Computing 15-SP3-LTSS (noarch): git-doc-2.35.3-150300.10.21.1 - SUSE Linux Enterprise High Performance Computing 15-SP3-ESPOS (aarch64 x86_64): git-2.35.3-150300.10.21.1 git-arch-2.35.3-150300.10.21.1 git-core-2.35.3-150300.10.21.1 git-core-debuginfo-2.35.3-150300.10.21.1 git-cvs-2.35.3-150300.10.21.1 git-daemon-2.35.3-150300.10.21.1 git-daemon-debuginfo-2.35.3-150300.10.21.1 git-debuginfo-2.35.3-150300.10.21.1 git-debugsource-2.35.3-150300.10.21.1 git-email-2.35.3-150300.10.21.1 git-gui-2.35.3-150300.10.21.1 git-svn-2.35.3-150300.10.21.1 git-web-2.35.3-150300.10.21.1 gitk-2.35.3-150300.10.21.1 perl-Git-2.35.3-150300.10.21.1 - SUSE Linux Enterprise High Performance Computing 15-SP3-ESPOS (noarch): git-doc-2.35.3-150300.10.21.1 - SUSE Enterprise Storage 7.1 (aarch64 x86_64): git-2.35.3-150300.10.21.1 git-arch-2.35.3-150300.10.21.1 git-core-2.35.3-150300.10.21.1 git-core-debuginfo-2.35.3-150300.10.21.1 git-cvs-2.35.3-150300.10.21.1 git-daemon-2.35.3-150300.10.21.1 git-daemon-debuginfo-2.35.3-150300.10.21.1 git-debuginfo-2.35.3-150300.10.21.1 git-debugsource-2.35.3-150300.10.21.1 git-email-2.35.3-150300.10.21.1 git-gui-2.35.3-150300.10.21.1 git-svn-2.35.3-150300.10.21.1 git-web-2.35.3-150300.10.21.1 gitk-2.35.3-150300.10.21.1 perl-Git-2.35.3-150300.10.21.1 - SUSE Enterprise Storage 7.1 (noarch): git-doc-2.35.3-150300.10.21.1 References: https://www.suse.com/security/cve/CVE-2022-23521.html https://www.suse.com/security/cve/CVE-2022-41903.html https://bugzilla.suse.com/1207032 https://bugzilla.suse.com/1207033

1 0

SUSE-SU-2023:0115-1: important: Security update for sudo
by opensuse-security＠opensuse.org 20 Jan '23

20 Jan '23

SUSE Security Update: Security update for sudo ______________________________________________________________________________ Announcement ID: SUSE-SU-2023:0115-1 Rating: important References: #1207082 Cross-References: CVE-2023-22809 CVSS scores: CVE-2023-22809 (SUSE): 7.8 CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H Affected Products: SUSE Enterprise Storage 7.1 SUSE Linux Enterprise High Performance Computing 15-SP3-ESPOS SUSE Linux Enterprise High Performance Computing 15-SP3-LTSS SUSE Linux Enterprise Micro 5.1 SUSE Linux Enterprise Micro 5.2 SUSE Linux Enterprise Realtime Extension 15-SP3 SUSE Linux Enterprise Server 15-SP3-LTSS SUSE Linux Enterprise Server for SAP 15-SP3 SUSE Manager Proxy 4.2 SUSE Manager Retail Branch Server 4.2 SUSE Manager Server 4.2 openSUSE Leap Micro 5.2 ______________________________________________________________________________ An update that fixes one vulnerability is now available. Description: This update for sudo fixes the following issues: - CVE-2023-22809: Fixed an arbitrary file write issue that could be exploited by users with sudoedit permissions (bsc#1207082). Patch Instructions: To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap Micro 5.2: zypper in -t patch openSUSE-Leap-Micro-5.2-2023-115=1 - SUSE Manager Server 4.2: zypper in -t patch SUSE-SLE-Product-SUSE-Manager-Server-4.2-2023-115=1 - SUSE Manager Retail Branch Server 4.2: zypper in -t patch SUSE-SLE-Product-SUSE-Manager-Retail-Branch-Server-4.2-2023-115=1 - SUSE Manager Proxy 4.2: zypper in -t patch SUSE-SLE-Product-SUSE-Manager-Proxy-4.2-2023-115=1 - SUSE Linux Enterprise Server for SAP 15-SP3: zypper in -t patch SUSE-SLE-Product-SLES_SAP-15-SP3-2023-115=1 - SUSE Linux Enterprise Server 15-SP3-LTSS: zypper in -t patch SUSE-SLE-Product-SLES-15-SP3-LTSS-2023-115=1 - SUSE Linux Enterprise Realtime Extension 15-SP3: zypper in -t patch SUSE-SLE-Product-RT-15-SP3-2023-115=1 - SUSE Linux Enterprise Micro 5.2: zypper in -t patch SUSE-SUSE-MicroOS-5.2-2023-115=1 - SUSE Linux Enterprise Micro 5.1: zypper in -t patch SUSE-SUSE-MicroOS-5.1-2023-115=1 - SUSE Linux Enterprise High Performance Computing 15-SP3-LTSS: zypper in -t patch SUSE-SLE-Product-HPC-15-SP3-LTSS-2023-115=1 - SUSE Linux Enterprise High Performance Computing 15-SP3-ESPOS: zypper in -t patch SUSE-SLE-Product-HPC-15-SP3-ESPOS-2023-115=1 - SUSE Enterprise Storage 7.1: zypper in -t patch SUSE-Storage-7.1-2023-115=1 Package List: - openSUSE Leap Micro 5.2 (aarch64 x86_64): sudo-1.9.5p2-150300.3.19.1 sudo-debuginfo-1.9.5p2-150300.3.19.1 sudo-debugsource-1.9.5p2-150300.3.19.1 - SUSE Manager Server 4.2 (ppc64le s390x x86_64): sudo-1.9.5p2-150300.3.19.1 sudo-debuginfo-1.9.5p2-150300.3.19.1 sudo-debugsource-1.9.5p2-150300.3.19.1 sudo-devel-1.9.5p2-150300.3.19.1 sudo-plugin-python-1.9.5p2-150300.3.19.1 sudo-plugin-python-debuginfo-1.9.5p2-150300.3.19.1 - SUSE Manager Retail Branch Server 4.2 (x86_64): sudo-1.9.5p2-150300.3.19.1 sudo-debuginfo-1.9.5p2-150300.3.19.1 sudo-debugsource-1.9.5p2-150300.3.19.1 sudo-devel-1.9.5p2-150300.3.19.1 sudo-plugin-python-1.9.5p2-150300.3.19.1 sudo-plugin-python-debuginfo-1.9.5p2-150300.3.19.1 - SUSE Manager Proxy 4.2 (x86_64): sudo-1.9.5p2-150300.3.19.1 sudo-debuginfo-1.9.5p2-150300.3.19.1 sudo-debugsource-1.9.5p2-150300.3.19.1 sudo-devel-1.9.5p2-150300.3.19.1 sudo-plugin-python-1.9.5p2-150300.3.19.1 sudo-plugin-python-debuginfo-1.9.5p2-150300.3.19.1 - SUSE Linux Enterprise Server for SAP 15-SP3 (ppc64le x86_64): sudo-1.9.5p2-150300.3.19.1 sudo-debuginfo-1.9.5p2-150300.3.19.1 sudo-debugsource-1.9.5p2-150300.3.19.1 sudo-devel-1.9.5p2-150300.3.19.1 sudo-plugin-python-1.9.5p2-150300.3.19.1 sudo-plugin-python-debuginfo-1.9.5p2-150300.3.19.1 - SUSE Linux Enterprise Server 15-SP3-LTSS (aarch64 ppc64le s390x x86_64): sudo-1.9.5p2-150300.3.19.1 sudo-debuginfo-1.9.5p2-150300.3.19.1 sudo-debugsource-1.9.5p2-150300.3.19.1 sudo-devel-1.9.5p2-150300.3.19.1 sudo-plugin-python-1.9.5p2-150300.3.19.1 sudo-plugin-python-debuginfo-1.9.5p2-150300.3.19.1 - SUSE Linux Enterprise Realtime Extension 15-SP3 (x86_64): sudo-1.9.5p2-150300.3.19.1 sudo-debuginfo-1.9.5p2-150300.3.19.1 sudo-debugsource-1.9.5p2-150300.3.19.1 sudo-devel-1.9.5p2-150300.3.19.1 sudo-plugin-python-1.9.5p2-150300.3.19.1 sudo-plugin-python-debuginfo-1.9.5p2-150300.3.19.1 - SUSE Linux Enterprise Micro 5.2 (aarch64 s390x x86_64): sudo-1.9.5p2-150300.3.19.1 sudo-debuginfo-1.9.5p2-150300.3.19.1 sudo-debugsource-1.9.5p2-150300.3.19.1 - SUSE Linux Enterprise Micro 5.1 (aarch64 s390x x86_64): sudo-1.9.5p2-150300.3.19.1 sudo-debuginfo-1.9.5p2-150300.3.19.1 sudo-debugsource-1.9.5p2-150300.3.19.1 - SUSE Linux Enterprise High Performance Computing 15-SP3-LTSS (aarch64 x86_64): sudo-1.9.5p2-150300.3.19.1 sudo-debuginfo-1.9.5p2-150300.3.19.1 sudo-debugsource-1.9.5p2-150300.3.19.1 sudo-devel-1.9.5p2-150300.3.19.1 sudo-plugin-python-1.9.5p2-150300.3.19.1 sudo-plugin-python-debuginfo-1.9.5p2-150300.3.19.1 - SUSE Linux Enterprise High Performance Computing 15-SP3-ESPOS (aarch64 x86_64): sudo-1.9.5p2-150300.3.19.1 sudo-debuginfo-1.9.5p2-150300.3.19.1 sudo-debugsource-1.9.5p2-150300.3.19.1 sudo-devel-1.9.5p2-150300.3.19.1 sudo-plugin-python-1.9.5p2-150300.3.19.1 sudo-plugin-python-debuginfo-1.9.5p2-150300.3.19.1 - SUSE Enterprise Storage 7.1 (aarch64 x86_64): sudo-1.9.5p2-150300.3.19.1 sudo-debuginfo-1.9.5p2-150300.3.19.1 sudo-debugsource-1.9.5p2-150300.3.19.1 sudo-devel-1.9.5p2-150300.3.19.1 sudo-plugin-python-1.9.5p2-150300.3.19.1 sudo-plugin-python-debuginfo-1.9.5p2-150300.3.19.1 References: https://www.suse.com/security/cve/CVE-2023-22809.html https://bugzilla.suse.com/1207082

1 0

SUSE-SU-2023:0113-1: important: Security update for MozillaFirefox
by opensuse-security＠opensuse.org 20 Jan '23

20 Jan '23

SUSE Security Update: Security update for MozillaFirefox ______________________________________________________________________________ Announcement ID: SUSE-SU-2023:0113-1 Rating: important References: #1207119 Cross-References: CVE-2022-46871 CVE-2022-46877 CVE-2023-23598 CVE-2023-23601 CVE-2023-23602 CVE-2023-23603 CVE-2023-23605 CVSS scores: CVE-2022-46871 (NVD) : 8.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H CVE-2022-46877 (NVD) : 4.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N Affected Products: SUSE Enterprise Storage 7 SUSE Enterprise Storage 7.1 SUSE Linux Enterprise Desktop 15-SP4 SUSE Linux Enterprise High Performance Computing 15-SP2-LTSS SUSE Linux Enterprise High Performance Computing 15-SP3-ESPOS SUSE Linux Enterprise High Performance Computing 15-SP3-LTSS SUSE Linux Enterprise High Performance Computing 15-SP4 SUSE Linux Enterprise Module for Desktop Applications 15-SP4 SUSE Linux Enterprise Realtime Extension 15-SP3 SUSE Linux Enterprise Server 15-SP2-LTSS SUSE Linux Enterprise Server 15-SP3-LTSS SUSE Linux Enterprise Server 15-SP4 SUSE Linux Enterprise Server for SAP 15-SP2 SUSE Linux Enterprise Server for SAP 15-SP3 SUSE Linux Enterprise Server for SAP Applications 15-SP4 SUSE Manager Proxy 4.3 SUSE Manager Retail Branch Server 4.3 SUSE Manager Server 4.3 openSUSE Leap 15.4 ______________________________________________________________________________ An update that fixes 7 vulnerabilities is now available. Description: This update for MozillaFirefox fixes the following issues: - Updated to version 102.7.0 ESR (bsc#1207119): - CVE-2022-46871: Updated an out of date library (libusrsctp) which contained several vulnerabilities. - CVE-2023-23598: Fixed an arbitrary file read from GTK drag and drop on Linux. - CVE-2023-23601: Fixed a potential spoofing attack when dragging a URL from a cross-origin iframe into the same tab. - CVE-2023-23602: Fixed a mishandled security check, which caused the Content Security Policy header to be ignored for WebSockets in WebWorkers. - CVE-2022-46877: Fixed a fullscreen notification bypass which could be leveraged in spoofing attacks. - CVE-2023-23603: Fixed a Content Security Policy bypass via format directives. - CVE-2023-23605: Fixed several memory safety bugs. Patch Instructions: To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 15.4: zypper in -t patch openSUSE-SLE-15.4-2023-113=1 - SUSE Linux Enterprise Server for SAP 15-SP3: zypper in -t patch SUSE-SLE-Product-SLES_SAP-15-SP3-2023-113=1 - SUSE Linux Enterprise Server for SAP 15-SP2: zypper in -t patch SUSE-SLE-Product-SLES_SAP-15-SP2-2023-113=1 - SUSE Linux Enterprise Server 15-SP3-LTSS: zypper in -t patch SUSE-SLE-Product-SLES-15-SP3-LTSS-2023-113=1 - SUSE Linux Enterprise Server 15-SP2-LTSS: zypper in -t patch SUSE-SLE-Product-SLES-15-SP2-LTSS-2023-113=1 - SUSE Linux Enterprise Realtime Extension 15-SP3: zypper in -t patch SUSE-SLE-Product-RT-15-SP3-2023-113=1 - SUSE Linux Enterprise Module for Desktop Applications 15-SP4: zypper in -t patch SUSE-SLE-Module-Desktop-Applications-15-SP4-2023-113=1 - SUSE Linux Enterprise High Performance Computing 15-SP3-LTSS: zypper in -t patch SUSE-SLE-Product-HPC-15-SP3-LTSS-2023-113=1 - SUSE Linux Enterprise High Performance Computing 15-SP3-ESPOS: zypper in -t patch SUSE-SLE-Product-HPC-15-SP3-ESPOS-2023-113=1 - SUSE Linux Enterprise High Performance Computing 15-SP2-LTSS: zypper in -t patch SUSE-SLE-Product-HPC-15-SP2-LTSS-2023-113=1 - SUSE Enterprise Storage 7.1: zypper in -t patch SUSE-Storage-7.1-2023-113=1 - SUSE Enterprise Storage 7: zypper in -t patch SUSE-Storage-7-2023-113=1 Package List: - openSUSE Leap 15.4 (aarch64 ppc64le s390x x86_64): MozillaFirefox-102.7.0-150200.152.73.1 MozillaFirefox-branding-upstream-102.7.0-150200.152.73.1 MozillaFirefox-debuginfo-102.7.0-150200.152.73.1 MozillaFirefox-debugsource-102.7.0-150200.152.73.1 MozillaFirefox-devel-102.7.0-150200.152.73.1 MozillaFirefox-translations-common-102.7.0-150200.152.73.1 MozillaFirefox-translations-other-102.7.0-150200.152.73.1 - SUSE Linux Enterprise Server for SAP 15-SP3 (ppc64le x86_64): MozillaFirefox-102.7.0-150200.152.73.1 MozillaFirefox-debuginfo-102.7.0-150200.152.73.1 MozillaFirefox-debugsource-102.7.0-150200.152.73.1 MozillaFirefox-devel-102.7.0-150200.152.73.1 MozillaFirefox-translations-common-102.7.0-150200.152.73.1 MozillaFirefox-translations-other-102.7.0-150200.152.73.1 - SUSE Linux Enterprise Server for SAP 15-SP2 (ppc64le x86_64): MozillaFirefox-102.7.0-150200.152.73.1 MozillaFirefox-debuginfo-102.7.0-150200.152.73.1 MozillaFirefox-debugsource-102.7.0-150200.152.73.1 MozillaFirefox-devel-102.7.0-150200.152.73.1 MozillaFirefox-translations-common-102.7.0-150200.152.73.1 MozillaFirefox-translations-other-102.7.0-150200.152.73.1 - SUSE Linux Enterprise Server 15-SP3-LTSS (aarch64 ppc64le s390x x86_64): MozillaFirefox-102.7.0-150200.152.73.1 MozillaFirefox-debuginfo-102.7.0-150200.152.73.1 MozillaFirefox-debugsource-102.7.0-150200.152.73.1 MozillaFirefox-translations-common-102.7.0-150200.152.73.1 MozillaFirefox-translations-other-102.7.0-150200.152.73.1 - SUSE Linux Enterprise Server 15-SP3-LTSS (aarch64 ppc64le x86_64): MozillaFirefox-devel-102.7.0-150200.152.73.1 - SUSE Linux Enterprise Server 15-SP2-LTSS (aarch64 ppc64le s390x x86_64): MozillaFirefox-102.7.0-150200.152.73.1 MozillaFirefox-debuginfo-102.7.0-150200.152.73.1 MozillaFirefox-debugsource-102.7.0-150200.152.73.1 MozillaFirefox-devel-102.7.0-150200.152.73.1 MozillaFirefox-translations-common-102.7.0-150200.152.73.1 MozillaFirefox-translations-other-102.7.0-150200.152.73.1 - SUSE Linux Enterprise Realtime Extension 15-SP3 (x86_64): MozillaFirefox-102.7.0-150200.152.73.1 MozillaFirefox-debuginfo-102.7.0-150200.152.73.1 MozillaFirefox-debugsource-102.7.0-150200.152.73.1 MozillaFirefox-devel-102.7.0-150200.152.73.1 MozillaFirefox-translations-common-102.7.0-150200.152.73.1 MozillaFirefox-translations-other-102.7.0-150200.152.73.1 - SUSE Linux Enterprise Module for Desktop Applications 15-SP4 (aarch64 ppc64le s390x x86_64): MozillaFirefox-102.7.0-150200.152.73.1 MozillaFirefox-debuginfo-102.7.0-150200.152.73.1 MozillaFirefox-debugsource-102.7.0-150200.152.73.1 MozillaFirefox-translations-common-102.7.0-150200.152.73.1 MozillaFirefox-translations-other-102.7.0-150200.152.73.1 - SUSE Linux Enterprise Module for Desktop Applications 15-SP4 (aarch64 ppc64le x86_64): MozillaFirefox-devel-102.7.0-150200.152.73.1 - SUSE Linux Enterprise High Performance Computing 15-SP3-LTSS (aarch64 x86_64): MozillaFirefox-102.7.0-150200.152.73.1 MozillaFirefox-debuginfo-102.7.0-150200.152.73.1 MozillaFirefox-debugsource-102.7.0-150200.152.73.1 MozillaFirefox-devel-102.7.0-150200.152.73.1 MozillaFirefox-translations-common-102.7.0-150200.152.73.1 MozillaFirefox-translations-other-102.7.0-150200.152.73.1 - SUSE Linux Enterprise High Performance Computing 15-SP3-ESPOS (aarch64 x86_64): MozillaFirefox-102.7.0-150200.152.73.1 MozillaFirefox-debuginfo-102.7.0-150200.152.73.1 MozillaFirefox-debugsource-102.7.0-150200.152.73.1 MozillaFirefox-devel-102.7.0-150200.152.73.1 MozillaFirefox-translations-common-102.7.0-150200.152.73.1 MozillaFirefox-translations-other-102.7.0-150200.152.73.1 - SUSE Linux Enterprise High Performance Computing 15-SP2-LTSS (aarch64 x86_64): MozillaFirefox-102.7.0-150200.152.73.1 MozillaFirefox-debuginfo-102.7.0-150200.152.73.1 MozillaFirefox-debugsource-102.7.0-150200.152.73.1 MozillaFirefox-devel-102.7.0-150200.152.73.1 MozillaFirefox-translations-common-102.7.0-150200.152.73.1 MozillaFirefox-translations-other-102.7.0-150200.152.73.1 - SUSE Enterprise Storage 7.1 (aarch64 x86_64): MozillaFirefox-102.7.0-150200.152.73.1 MozillaFirefox-debuginfo-102.7.0-150200.152.73.1 MozillaFirefox-debugsource-102.7.0-150200.152.73.1 MozillaFirefox-devel-102.7.0-150200.152.73.1 MozillaFirefox-translations-common-102.7.0-150200.152.73.1 MozillaFirefox-translations-other-102.7.0-150200.152.73.1 - SUSE Enterprise Storage 7 (aarch64 x86_64): MozillaFirefox-102.7.0-150200.152.73.1 MozillaFirefox-debuginfo-102.7.0-150200.152.73.1 MozillaFirefox-debugsource-102.7.0-150200.152.73.1 MozillaFirefox-devel-102.7.0-150200.152.73.1 MozillaFirefox-translations-common-102.7.0-150200.152.73.1 MozillaFirefox-translations-other-102.7.0-150200.152.73.1 References: https://www.suse.com/security/cve/CVE-2022-46871.html https://www.suse.com/security/cve/CVE-2022-46877.html https://www.suse.com/security/cve/CVE-2023-23598.html https://www.suse.com/security/cve/CVE-2023-23601.html https://www.suse.com/security/cve/CVE-2023-23602.html https://www.suse.com/security/cve/CVE-2023-23603.html https://www.suse.com/security/cve/CVE-2023-23605.html https://bugzilla.suse.com/1207119

1 0

SUSE-SU-2023:0119-1: important: Security update for mozilla-nss
by opensuse-security＠opensuse.org 20 Jan '23

20 Jan '23

SUSE Security Update: Security update for mozilla-nss ______________________________________________________________________________ Announcement ID: SUSE-SU-2023:0119-1 Rating: important References: #1204272 #1207038 Cross-References: CVE-2022-23491 CVE-2022-3479 CVSS scores: CVE-2022-23491 (NVD) : 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N CVE-2022-23491 (SUSE): 6.6 CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:H/I:H/A:H CVE-2022-3479 (NVD) : 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H CVE-2022-3479 (SUSE): 6.5 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H Affected Products: SUSE Linux Enterprise Desktop 15-SP4 SUSE Linux Enterprise High Performance Computing 15-SP4 SUSE Linux Enterprise Micro 5.3 SUSE Linux Enterprise Module for Basesystem 15-SP4 SUSE Linux Enterprise Server 15-SP4 SUSE Linux Enterprise Server for SAP Applications 15-SP4 SUSE Manager Proxy 4.3 SUSE Manager Retail Branch Server 4.3 SUSE Manager Server 4.3 openSUSE Leap 15.4 openSUSE Leap Micro 5.3 ______________________________________________________________________________ An update that fixes two vulnerabilities is now available. Description: This update for mozilla-nss fixes the following issues: - CVE-2022-3479: Fixed a potential crash that could be triggered when a server requested a client authentication certificate, but the client had no certificates stored (bsc#1204272). - Updated to version 3.79.3 (bsc#1207038): - CVE-2022-23491: Removed trust for 3 root certificates from TrustCor. Patch Instructions: To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap Micro 5.3: zypper in -t patch openSUSE-Leap-Micro-5.3-2023-119=1 - openSUSE Leap 15.4: zypper in -t patch openSUSE-SLE-15.4-2023-119=1 - SUSE Linux Enterprise Module for Basesystem 15-SP4: zypper in -t patch SUSE-SLE-Module-Basesystem-15-SP4-2023-119=1 - SUSE Linux Enterprise Micro 5.3: zypper in -t patch SUSE-SLE-Micro-5.3-2023-119=1 Package List: - openSUSE Leap Micro 5.3 (aarch64 x86_64): libfreebl3-3.79.3-150400.3.23.1 libfreebl3-debuginfo-3.79.3-150400.3.23.1 libfreebl3-hmac-3.79.3-150400.3.23.1 libsoftokn3-3.79.3-150400.3.23.1 libsoftokn3-debuginfo-3.79.3-150400.3.23.1 libsoftokn3-hmac-3.79.3-150400.3.23.1 mozilla-nss-3.79.3-150400.3.23.1 mozilla-nss-certs-3.79.3-150400.3.23.1 mozilla-nss-certs-debuginfo-3.79.3-150400.3.23.1 mozilla-nss-debuginfo-3.79.3-150400.3.23.1 mozilla-nss-debugsource-3.79.3-150400.3.23.1 mozilla-nss-tools-3.79.3-150400.3.23.1 mozilla-nss-tools-debuginfo-3.79.3-150400.3.23.1 - openSUSE Leap 15.4 (aarch64 ppc64le s390x x86_64): libfreebl3-3.79.3-150400.3.23.1 libfreebl3-debuginfo-3.79.3-150400.3.23.1 libfreebl3-hmac-3.79.3-150400.3.23.1 libsoftokn3-3.79.3-150400.3.23.1 libsoftokn3-debuginfo-3.79.3-150400.3.23.1 libsoftokn3-hmac-3.79.3-150400.3.23.1 mozilla-nss-3.79.3-150400.3.23.1 mozilla-nss-certs-3.79.3-150400.3.23.1 mozilla-nss-certs-debuginfo-3.79.3-150400.3.23.1 mozilla-nss-debuginfo-3.79.3-150400.3.23.1 mozilla-nss-debugsource-3.79.3-150400.3.23.1 mozilla-nss-devel-3.79.3-150400.3.23.1 mozilla-nss-sysinit-3.79.3-150400.3.23.1 mozilla-nss-sysinit-debuginfo-3.79.3-150400.3.23.1 mozilla-nss-tools-3.79.3-150400.3.23.1 mozilla-nss-tools-debuginfo-3.79.3-150400.3.23.1 - openSUSE Leap 15.4 (x86_64): libfreebl3-32bit-3.79.3-150400.3.23.1 libfreebl3-32bit-debuginfo-3.79.3-150400.3.23.1 libfreebl3-hmac-32bit-3.79.3-150400.3.23.1 libsoftokn3-32bit-3.79.3-150400.3.23.1 libsoftokn3-32bit-debuginfo-3.79.3-150400.3.23.1 libsoftokn3-hmac-32bit-3.79.3-150400.3.23.1 mozilla-nss-32bit-3.79.3-150400.3.23.1 mozilla-nss-32bit-debuginfo-3.79.3-150400.3.23.1 mozilla-nss-certs-32bit-3.79.3-150400.3.23.1 mozilla-nss-certs-32bit-debuginfo-3.79.3-150400.3.23.1 mozilla-nss-sysinit-32bit-3.79.3-150400.3.23.1 mozilla-nss-sysinit-32bit-debuginfo-3.79.3-150400.3.23.1 - SUSE Linux Enterprise Module for Basesystem 15-SP4 (aarch64 ppc64le s390x x86_64): libfreebl3-3.79.3-150400.3.23.1 libfreebl3-debuginfo-3.79.3-150400.3.23.1 libfreebl3-hmac-3.79.3-150400.3.23.1 libsoftokn3-3.79.3-150400.3.23.1 libsoftokn3-debuginfo-3.79.3-150400.3.23.1 libsoftokn3-hmac-3.79.3-150400.3.23.1 mozilla-nss-3.79.3-150400.3.23.1 mozilla-nss-certs-3.79.3-150400.3.23.1 mozilla-nss-certs-debuginfo-3.79.3-150400.3.23.1 mozilla-nss-debuginfo-3.79.3-150400.3.23.1 mozilla-nss-debugsource-3.79.3-150400.3.23.1 mozilla-nss-devel-3.79.3-150400.3.23.1 mozilla-nss-sysinit-3.79.3-150400.3.23.1 mozilla-nss-sysinit-debuginfo-3.79.3-150400.3.23.1 mozilla-nss-tools-3.79.3-150400.3.23.1 mozilla-nss-tools-debuginfo-3.79.3-150400.3.23.1 - SUSE Linux Enterprise Module for Basesystem 15-SP4 (x86_64): libfreebl3-32bit-3.79.3-150400.3.23.1 libfreebl3-32bit-debuginfo-3.79.3-150400.3.23.1 libfreebl3-hmac-32bit-3.79.3-150400.3.23.1 libsoftokn3-32bit-3.79.3-150400.3.23.1 libsoftokn3-32bit-debuginfo-3.79.3-150400.3.23.1 libsoftokn3-hmac-32bit-3.79.3-150400.3.23.1 mozilla-nss-32bit-3.79.3-150400.3.23.1 mozilla-nss-32bit-debuginfo-3.79.3-150400.3.23.1 mozilla-nss-certs-32bit-3.79.3-150400.3.23.1 mozilla-nss-certs-32bit-debuginfo-3.79.3-150400.3.23.1 - SUSE Linux Enterprise Micro 5.3 (aarch64 s390x x86_64): libfreebl3-3.79.3-150400.3.23.1 libfreebl3-debuginfo-3.79.3-150400.3.23.1 libfreebl3-hmac-3.79.3-150400.3.23.1 libsoftokn3-3.79.3-150400.3.23.1 libsoftokn3-debuginfo-3.79.3-150400.3.23.1 libsoftokn3-hmac-3.79.3-150400.3.23.1 mozilla-nss-3.79.3-150400.3.23.1 mozilla-nss-certs-3.79.3-150400.3.23.1 mozilla-nss-certs-debuginfo-3.79.3-150400.3.23.1 mozilla-nss-debuginfo-3.79.3-150400.3.23.1 mozilla-nss-debugsource-3.79.3-150400.3.23.1 mozilla-nss-tools-3.79.3-150400.3.23.1 mozilla-nss-tools-debuginfo-3.79.3-150400.3.23.1 References: https://www.suse.com/security/cve/CVE-2022-23491.html https://www.suse.com/security/cve/CVE-2022-3479.html https://bugzilla.suse.com/1204272 https://bugzilla.suse.com/1207038

1 0

SUSE-SU-2023:0103-1: moderate: Security update for postgresql-jdbc
by opensuse-security＠opensuse.org 19 Jan '23

19 Jan '23

SUSE Security Update: Security update for postgresql-jdbc ______________________________________________________________________________ Announcement ID: SUSE-SU-2023:0103-1 Rating: moderate References: #1206921 Cross-References: CVE-2022-41946 CVSS scores: CVE-2022-41946 (NVD) : 5.5 CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N CVE-2022-41946 (SUSE): 5.5 CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N Affected Products: SUSE Linux Enterprise High Performance Computing 15-SP4 SUSE Linux Enterprise Module for Server Applications 15-SP4 SUSE Linux Enterprise Server 15-SP4 SUSE Linux Enterprise Server for SAP Applications 15-SP4 SUSE Manager Proxy 4.3 SUSE Manager Retail Branch Server 4.3 SUSE Manager Server 4.3 openSUSE Leap 15.4 ______________________________________________________________________________ An update that fixes one vulnerability is now available. Description: This update for postgresql-jdbc fixes the following issues: - CVE-2022-41946: Fixed a local information disclosure issue due to improper handling of temporary files (bsc#1206921). Patch Instructions: To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 15.4: zypper in -t patch openSUSE-SLE-15.4-2023-103=1 - SUSE Linux Enterprise Module for Server Applications 15-SP4: zypper in -t patch SUSE-SLE-Module-Server-Applications-15-SP4-2023-103=1 Package List: - openSUSE Leap 15.4 (noarch): postgresql-jdbc-42.2.25-150400.3.9.2 postgresql-jdbc-javadoc-42.2.25-150400.3.9.2 - SUSE Linux Enterprise Module for Server Applications 15-SP4 (noarch): postgresql-jdbc-42.2.25-150400.3.9.2 References: https://www.suse.com/security/cve/CVE-2022-41946.html https://bugzilla.suse.com/1206921

1 0

SUSE-SU-2023:0095-1: important: Security update for libzypp-plugin-appdata
by opensuse-security＠opensuse.org 17 Jan '23

17 Jan '23

SUSE Security Update: Security update for libzypp-plugin-appdata ______________________________________________________________________________ Announcement ID: SUSE-SU-2023:0095-1 Rating: important References: #1206836 Cross-References: CVE-2023-22643 Affected Products: SUSE Linux Enterprise Desktop 15-SP4 SUSE Linux Enterprise High Performance Computing 15-SP4 SUSE Linux Enterprise Module for Desktop Applications 15-SP4 SUSE Linux Enterprise Module for Packagehub Subpackages 15-SP4 SUSE Linux Enterprise Server 15-SP4 SUSE Linux Enterprise Server for SAP Applications 15-SP4 SUSE Manager Proxy 4.3 SUSE Manager Retail Branch Server 4.3 SUSE Manager Server 4.3 openSUSE Leap 15.4 ______________________________________________________________________________ An update that fixes one vulnerability is now available. Description: This update for libzypp-plugin-appdata fixes the following issues: - CVE-2023-22643: Fixed potential shell injection related to malicious repo names (bsc#1206836). Patch Instructions: To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 15.4: zypper in -t patch openSUSE-SLE-15.4-2023-95=1 - SUSE Linux Enterprise Module for Packagehub Subpackages 15-SP4: zypper in -t patch SUSE-SLE-Module-Packagehub-Subpackages-15-SP4-2023-95=1 - SUSE Linux Enterprise Module for Desktop Applications 15-SP4: zypper in -t patch SUSE-SLE-Module-Desktop-Applications-15-SP4-2023-95=1 Package List: - openSUSE Leap 15.4 (noarch): libzypp-plugin-appdata-1.0.1+git.20180426-150400.18.3.1 openSUSE-appdata-extra-1.0.1+git.20180426-150400.18.3.1 - SUSE Linux Enterprise Module for Packagehub Subpackages 15-SP4 (noarch): openSUSE-appdata-extra-1.0.1+git.20180426-150400.18.3.1 - SUSE Linux Enterprise Module for Desktop Applications 15-SP4 (noarch): libzypp-plugin-appdata-1.0.1+git.20180426-150400.18.3.1 References: https://www.suse.com/security/cve/CVE-2023-22643.html https://bugzilla.suse.com/1206836

1 0

openSUSE-SU-2023:0022-1: moderate: Security update for tor
by opensuse-security＠opensuse.org 17 Jan '23

17 Jan '23

openSUSE Security Update: Security update for tor ______________________________________________________________________________ Announcement ID: openSUSE-SU-2023:0022-1 Rating: moderate References: #1207110 Affected Products: openSUSE Backports SLE-15-SP3 ______________________________________________________________________________ An update that contains security fixes can now be installed. Description: This update for tor fixes the following issues: tor 0.4.7.13: * fix SafeSocks option to avoid DNS leaks (boo#1207110, TROVE-2022-002) * improve congestion control * fix relay channel handling tor 0.4.7.12: * new key for moria1 * new metrics are exported on the MetricsPort for the congestion control subsystem Patch Instructions: To install this openSUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Backports SLE-15-SP3: zypper in -t patch openSUSE-2023-22=1 Package List: - openSUSE Backports SLE-15-SP3 (aarch64 i586 ppc64le s390x x86_64): tor-0.4.7.13-bp153.2.24.1 References: https://bugzilla.suse.com/1207110

1 0

openSUSE-SU-2023:0020-1: important: Security update for libheimdal
by opensuse-security＠opensuse.org 16 Jan '23

16 Jan '23

openSUSE Security Update: Security update for libheimdal ______________________________________________________________________________ Announcement ID: openSUSE-SU-2023:0020-1 Rating: important References: Cross-References: CVE-2019-14870 CVE-2021-3671 CVE-2021-44758 CVE-2022-3437 CVE-2022-41916 CVE-2022-42898 CVE-2022-44640 CVSS scores: CVE-2019-14870 (NVD) : 5.4 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N CVE-2019-14870 (SUSE): 5.4 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N CVE-2021-3671 (NVD) : 6.5 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H CVE-2021-3671 (SUSE): 6.5 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H CVE-2021-44758 (NVD) : 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H CVE-2022-3437 (SUSE): 5.9 CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:N/I:H/A:L CVE-2022-41916 (NVD) : 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H CVE-2022-42898 (NVD) : 8.8 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H CVE-2022-42898 (SUSE): 6.4 CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:L/I:H/A:L CVE-2022-44640 (NVD) : 9.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H Affected Products: openSUSE Backports SLE-15-SP3 ______________________________________________________________________________ An update that fixes 7 vulnerabilities is now available. Description: This update for libheimdal fixes the following issues: Update to version 7.8.0 - CVE-2022-42898 PAC parse integer overflows - CVE-2022-3437 Overflows and non-constant time leaks in DES{,3} and arcfour - CVE-2022-41916 Fix Unicode normalization read of 1 bytes past end of array - CVE-2021-44758 A null pointer de-reference DoS in SPNEGO acceptors - CVE-2021-3671 A null pointer de-reference when handling missing sname in TGS-REQ - CVE-2022-44640 Heimdal KDC: invalid free in ASN.1 codec - CVE-2019-14870: Validate client attributes in protocol-transition Patch Instructions: To install this openSUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Backports SLE-15-SP3: zypper in -t patch openSUSE-2023-20=1 Package List: - openSUSE Backports SLE-15-SP3 (aarch64 i586 ppc64le s390x x86_64): libasn1-8-7.8.0-bp153.2.4.1 libgssapi3-7.8.0-bp153.2.4.1 libhcrypto4-7.8.0-bp153.2.4.1 libhdb9-7.8.0-bp153.2.4.1 libheimbase1-7.8.0-bp153.2.4.1 libheimdal-devel-7.8.0-bp153.2.4.1 libheimedit0-7.8.0-bp153.2.4.1 libheimntlm0-7.8.0-bp153.2.4.1 libhx509-5-7.8.0-bp153.2.4.1 libkadm5clnt7-7.8.0-bp153.2.4.1 libkadm5srv8-7.8.0-bp153.2.4.1 libkafs0-7.8.0-bp153.2.4.1 libkdc2-7.8.0-bp153.2.4.1 libkrb5-26-7.8.0-bp153.2.4.1 libotp0-7.8.0-bp153.2.4.1 libroken18-7.8.0-bp153.2.4.1 libsl0-7.8.0-bp153.2.4.1 libwind0-7.8.0-bp153.2.4.1 References: https://www.suse.com/security/cve/CVE-2019-14870.html https://www.suse.com/security/cve/CVE-2021-3671.html https://www.suse.com/security/cve/CVE-2021-44758.html https://www.suse.com/security/cve/CVE-2022-3437.html https://www.suse.com/security/cve/CVE-2022-41916.html https://www.suse.com/security/cve/CVE-2022-42898.html https://www.suse.com/security/cve/CVE-2022-44640.html

1 0