October 2023 - openSUSE Security Announce

SUSE-SU-2023:4288-1: important: Security update for python-Werkzeug
by security＠lists.opensuse.org 31 Oct '23

31 Oct '23

# Security update for python-Werkzeug Announcement ID: SUSE-SU-2023:4288-1 Rating: important References: * bsc#1216581 Cross-References: * CVE-2023-46136 CVSS scores: * CVE-2023-46136 ( SUSE ): 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H * CVE-2023-46136 ( NVD ): 8.0 CVSS:3.1/AV:A/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H Affected Products: * openSUSE Leap 15.4 * openSUSE Leap 15.5 * Python 3 Module 15-SP4 * Python 3 Module 15-SP5 * SUSE Linux Enterprise Desktop 15 SP4 * SUSE Linux Enterprise Desktop 15 SP5 * SUSE Linux Enterprise High Performance Computing 15 SP4 * SUSE Linux Enterprise High Performance Computing 15 SP5 * SUSE Linux Enterprise Server 15 SP4 * SUSE Linux Enterprise Server 15 SP5 * SUSE Linux Enterprise Server for SAP Applications 15 SP4 * SUSE Linux Enterprise Server for SAP Applications 15 SP5 * SUSE Manager Proxy 4.3 * SUSE Manager Retail Branch Server 4.3 * SUSE Manager Server 4.3 An update that solves one vulnerability can now be installed. ## Description: This update for python-Werkzeug fixes the following issues: * CVE-2023-46136: Fixed a potential denial of service via large multipart file uploads (bsc#1216581). ## Patch Instructions: To install this SUSE update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: * openSUSE Leap 15.4 zypper in -t patch SUSE-2023-4288=1 openSUSE-SLE-15.4-2023-4288=1 * openSUSE Leap 15.5 zypper in -t patch openSUSE-SLE-15.5-2023-4288=1 * Python 3 Module 15-SP4 zypper in -t patch SUSE-SLE-Module-Python3-15-SP4-2023-4288=1 * Python 3 Module 15-SP5 zypper in -t patch SUSE-SLE-Module-Python3-15-SP5-2023-4288=1 ## Package List: * openSUSE Leap 15.4 (noarch) * python311-Werkzeug-2.3.6-150400.6.6.1 * openSUSE Leap 15.5 (noarch) * python311-Werkzeug-2.3.6-150400.6.6.1 * Python 3 Module 15-SP4 (noarch) * python311-Werkzeug-2.3.6-150400.6.6.1 * Python 3 Module 15-SP5 (noarch) * python311-Werkzeug-2.3.6-150400.6.6.1 ## References: * https://www.suse.com/security/cve/CVE-2023-46136.html * https://bugzilla.suse.com/show_bug.cgi?id=1216581

1 0

SUSE-SU-2023:4289-1: important: Security update for java-17-openjdk
by security＠lists.opensuse.org 31 Oct '23

31 Oct '23

# Security update for java-17-openjdk Announcement ID: SUSE-SU-2023:4289-1 Rating: important References: * bsc#1214790 * bsc#1216339 * bsc#1216374 Cross-References: * CVE-2023-22025 * CVE-2023-22081 CVSS scores: * CVE-2023-22025 ( SUSE ): 3.7 CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:N * CVE-2023-22025 ( NVD ): 3.7 CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:N * CVE-2023-22081 ( SUSE ): 5.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L * CVE-2023-22081 ( NVD ): 5.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L Affected Products: * Basesystem Module 15-SP4 * Basesystem Module 15-SP5 * openSUSE Leap 15.4 * openSUSE Leap 15.5 * SUSE Linux Enterprise Desktop 15 SP4 * SUSE Linux Enterprise Desktop 15 SP5 * SUSE Linux Enterprise High Performance Computing 15 SP4 * SUSE Linux Enterprise High Performance Computing 15 SP5 * SUSE Linux Enterprise Real Time 15 SP4 * SUSE Linux Enterprise Real Time 15 SP5 * SUSE Linux Enterprise Server 15 SP4 * SUSE Linux Enterprise Server 15 SP5 * SUSE Linux Enterprise Server for SAP Applications 15 SP4 * SUSE Linux Enterprise Server for SAP Applications 15 SP5 * SUSE Manager Proxy 4.3 * SUSE Manager Retail Branch Server 4.3 * SUSE Manager Server 4.3 An update that solves two vulnerabilities and has one security fix can now be installed. ## Description: This update for java-17-openjdk fixes the following issues: * Updated to JDK 17.0.9+9 (October 2023 CPU): * CVE-2023-22081: Fixed a partial denial of service issue that could be triggered via HTTPS (bsc#1216374). * CVE-2023-22025: Fixed a memory corruption issue in applications using AVX-512 (bsc#1216339). Please visit the Oracle Release Notes page for the full changelog: https://www.oracle.com/java/technologies/javase/17all-relnotes.html ## Patch Instructions: To install this SUSE update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: * openSUSE Leap 15.4 zypper in -t patch SUSE-2023-4289=1 openSUSE-SLE-15.4-2023-4289=1 * openSUSE Leap 15.5 zypper in -t patch openSUSE-SLE-15.5-2023-4289=1 * Basesystem Module 15-SP4 zypper in -t patch SUSE-SLE-Module-Basesystem-15-SP4-2023-4289=1 * Basesystem Module 15-SP5 zypper in -t patch SUSE-SLE-Module-Basesystem-15-SP5-2023-4289=1 ## Package List: * openSUSE Leap 15.4 (aarch64 ppc64le s390x x86_64 i586) * java-17-openjdk-headless-debuginfo-17.0.9.0-150400.3.33.1 * java-17-openjdk-demo-17.0.9.0-150400.3.33.1 * java-17-openjdk-devel-debuginfo-17.0.9.0-150400.3.33.1 * java-17-openjdk-debugsource-17.0.9.0-150400.3.33.1 * java-17-openjdk-headless-17.0.9.0-150400.3.33.1 * java-17-openjdk-src-17.0.9.0-150400.3.33.1 * java-17-openjdk-jmods-17.0.9.0-150400.3.33.1 * java-17-openjdk-debuginfo-17.0.9.0-150400.3.33.1 * java-17-openjdk-devel-17.0.9.0-150400.3.33.1 * java-17-openjdk-17.0.9.0-150400.3.33.1 * openSUSE Leap 15.4 (noarch) * java-17-openjdk-javadoc-17.0.9.0-150400.3.33.1 * openSUSE Leap 15.5 (aarch64 ppc64le s390x x86_64) * java-17-openjdk-headless-debuginfo-17.0.9.0-150400.3.33.1 * java-17-openjdk-demo-17.0.9.0-150400.3.33.1 * java-17-openjdk-devel-debuginfo-17.0.9.0-150400.3.33.1 * java-17-openjdk-debugsource-17.0.9.0-150400.3.33.1 * java-17-openjdk-headless-17.0.9.0-150400.3.33.1 * java-17-openjdk-src-17.0.9.0-150400.3.33.1 * java-17-openjdk-jmods-17.0.9.0-150400.3.33.1 * java-17-openjdk-debuginfo-17.0.9.0-150400.3.33.1 * java-17-openjdk-devel-17.0.9.0-150400.3.33.1 * java-17-openjdk-17.0.9.0-150400.3.33.1 * openSUSE Leap 15.5 (noarch) * java-17-openjdk-javadoc-17.0.9.0-150400.3.33.1 * Basesystem Module 15-SP4 (aarch64 ppc64le s390x x86_64) * java-17-openjdk-headless-debuginfo-17.0.9.0-150400.3.33.1 * java-17-openjdk-demo-17.0.9.0-150400.3.33.1 * java-17-openjdk-devel-debuginfo-17.0.9.0-150400.3.33.1 * java-17-openjdk-debugsource-17.0.9.0-150400.3.33.1 * java-17-openjdk-headless-17.0.9.0-150400.3.33.1 * java-17-openjdk-debuginfo-17.0.9.0-150400.3.33.1 * java-17-openjdk-devel-17.0.9.0-150400.3.33.1 * java-17-openjdk-17.0.9.0-150400.3.33.1 * Basesystem Module 15-SP5 (aarch64 ppc64le s390x x86_64) * java-17-openjdk-headless-debuginfo-17.0.9.0-150400.3.33.1 * java-17-openjdk-demo-17.0.9.0-150400.3.33.1 * java-17-openjdk-devel-debuginfo-17.0.9.0-150400.3.33.1 * java-17-openjdk-debugsource-17.0.9.0-150400.3.33.1 * java-17-openjdk-headless-17.0.9.0-150400.3.33.1 * java-17-openjdk-debuginfo-17.0.9.0-150400.3.33.1 * java-17-openjdk-devel-17.0.9.0-150400.3.33.1 * java-17-openjdk-17.0.9.0-150400.3.33.1 ## References: * https://www.suse.com/security/cve/CVE-2023-22025.html * https://www.suse.com/security/cve/CVE-2023-22081.html * https://bugzilla.suse.com/show_bug.cgi?id=1214790 * https://bugzilla.suse.com/show_bug.cgi?id=1216339 * https://bugzilla.suse.com/show_bug.cgi?id=1216374

1 0

SUSE-SU-2023:4290-1: important: Security update for redis
by security＠lists.opensuse.org 31 Oct '23

31 Oct '23

# Security update for redis Announcement ID: SUSE-SU-2023:4290-1 Rating: important References: * bsc#1216376 Cross-References: * CVE-2023-45145 CVSS scores: * CVE-2023-45145 ( SUSE ): 7.0 CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H * CVE-2023-45145 ( NVD ): 3.6 CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:L/I:L/A:N Affected Products: * openSUSE Leap 15.4 * openSUSE Leap 15.5 * Server Applications Module 15-SP4 * Server Applications Module 15-SP5 * SUSE Linux Enterprise High Performance Computing 15 SP4 * SUSE Linux Enterprise High Performance Computing 15 SP5 * SUSE Linux Enterprise Real Time 15 SP4 * SUSE Linux Enterprise Real Time 15 SP5 * SUSE Linux Enterprise Server 15 SP4 * SUSE Linux Enterprise Server 15 SP5 * SUSE Linux Enterprise Server for SAP Applications 15 SP4 * SUSE Linux Enterprise Server for SAP Applications 15 SP5 * SUSE Manager Proxy 4.3 * SUSE Manager Retail Branch Server 4.3 * SUSE Manager Server 4.3 An update that solves one vulnerability can now be installed. ## Description: This update for redis fixes the following issues: * CVE-2023-45145: Fixed a potential permission bypass due to a race condition during UNIX socket creation (bsc#1216376). ## Patch Instructions: To install this SUSE update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: * openSUSE Leap 15.4 zypper in -t patch SUSE-2023-4290=1 openSUSE-SLE-15.4-2023-4290=1 * openSUSE Leap 15.5 zypper in -t patch openSUSE-SLE-15.5-2023-4290=1 * Server Applications Module 15-SP4 zypper in -t patch SUSE-SLE-Module-Server-Applications-15-SP4-2023-4290=1 * Server Applications Module 15-SP5 zypper in -t patch SUSE-SLE-Module-Server-Applications-15-SP5-2023-4290=1 ## Package List: * openSUSE Leap 15.4 (aarch64 ppc64le s390x x86_64 i586) * redis-debuginfo-6.2.6-150400.3.25.1 * redis-debugsource-6.2.6-150400.3.25.1 * redis-6.2.6-150400.3.25.1 * openSUSE Leap 15.5 (aarch64 ppc64le s390x x86_64) * redis-debuginfo-6.2.6-150400.3.25.1 * redis-debugsource-6.2.6-150400.3.25.1 * redis-6.2.6-150400.3.25.1 * Server Applications Module 15-SP4 (aarch64 ppc64le s390x x86_64) * redis-debuginfo-6.2.6-150400.3.25.1 * redis-debugsource-6.2.6-150400.3.25.1 * redis-6.2.6-150400.3.25.1 * Server Applications Module 15-SP5 (aarch64 ppc64le s390x x86_64) * redis-debuginfo-6.2.6-150400.3.25.1 * redis-debugsource-6.2.6-150400.3.25.1 * redis-6.2.6-150400.3.25.1 ## References: * https://www.suse.com/security/cve/CVE-2023-45145.html * https://bugzilla.suse.com/show_bug.cgi?id=1216376

1 0

SUSE-SU-2023:4291-1: moderate: Security update for poppler
by security＠lists.opensuse.org 31 Oct '23

31 Oct '23

# Security update for poppler Announcement ID: SUSE-SU-2023:4291-1 Rating: moderate References: * bsc#1213888 Cross-References: * CVE-2023-34872 CVSS scores: * CVE-2023-34872 ( SUSE ): 5.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L * CVE-2023-34872 ( NVD ): 5.5 CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H Affected Products: * Basesystem Module 15-SP5 * openSUSE Leap 15.5 * SUSE Linux Enterprise Desktop 15 SP5 * SUSE Linux Enterprise High Performance Computing 15 SP5 * SUSE Linux Enterprise Micro 5.5 * SUSE Linux Enterprise Real Time 15 SP5 * SUSE Linux Enterprise Server 15 SP5 * SUSE Linux Enterprise Server for SAP Applications 15 SP5 * SUSE Package Hub 15 15-SP5 An update that solves one vulnerability can now be installed. ## Description: This update for poppler fixes the following issues: * CVE-2023-34872: Fixed a remote denial-of-service in Outline.cc. (bsc#1213888) ## Patch Instructions: To install this SUSE update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: * SUSE Package Hub 15 15-SP5 zypper in -t patch SUSE-SLE-Module-Packagehub-Subpackages-15-SP5-2023-4291=1 * openSUSE Leap 15.5 zypper in -t patch SUSE-2023-4291=1 openSUSE-SLE-15.5-2023-4291=1 * Basesystem Module 15-SP5 zypper in -t patch SUSE-SLE-Module-Basesystem-15-SP5-2023-4291=1 ## Package List: * SUSE Package Hub 15 15-SP5 (aarch64 ppc64le s390x x86_64) * poppler-debugsource-23.01.0-150500.3.5.2 * libpoppler-cpp0-23.01.0-150500.3.5.2 * poppler-qt5-debugsource-23.01.0-150500.3.5.1 * libpoppler-qt5-1-debuginfo-23.01.0-150500.3.5.1 * libpoppler-qt5-devel-23.01.0-150500.3.5.1 * libpoppler-qt5-1-23.01.0-150500.3.5.1 * libpoppler-devel-23.01.0-150500.3.5.2 * libpoppler-cpp0-debuginfo-23.01.0-150500.3.5.2 * SUSE Package Hub 15 15-SP5 (x86_64) * libpoppler-glib8-32bit-debuginfo-23.01.0-150500.3.5.2 * libpoppler126-32bit-23.01.0-150500.3.5.2 * libpoppler126-32bit-debuginfo-23.01.0-150500.3.5.2 * libpoppler-glib8-32bit-23.01.0-150500.3.5.2 * openSUSE Leap 15.5 (aarch64 ppc64le s390x x86_64 i586) * libpoppler-glib-devel-23.01.0-150500.3.5.2 * poppler-tools-debuginfo-23.01.0-150500.3.5.2 * libpoppler-glib8-23.01.0-150500.3.5.2 * libpoppler126-debuginfo-23.01.0-150500.3.5.2 * poppler-tools-23.01.0-150500.3.5.2 * libpoppler-qt6-3-23.01.0-150500.3.5.1 * poppler-debugsource-23.01.0-150500.3.5.2 * libpoppler-cpp0-23.01.0-150500.3.5.2 * poppler-qt5-debugsource-23.01.0-150500.3.5.1 * libpoppler-glib8-debuginfo-23.01.0-150500.3.5.2 * libpoppler-qt5-1-debuginfo-23.01.0-150500.3.5.1 * libpoppler-qt5-devel-23.01.0-150500.3.5.1 * typelib-1_0-Poppler-0_18-23.01.0-150500.3.5.2 * libpoppler-qt6-3-debuginfo-23.01.0-150500.3.5.1 * libpoppler-qt6-devel-23.01.0-150500.3.5.1 * libpoppler126-23.01.0-150500.3.5.2 * poppler-qt6-debugsource-23.01.0-150500.3.5.1 * libpoppler-qt5-1-23.01.0-150500.3.5.1 * libpoppler-devel-23.01.0-150500.3.5.2 * libpoppler-cpp0-debuginfo-23.01.0-150500.3.5.2 * openSUSE Leap 15.5 (x86_64) * libpoppler-qt5-1-32bit-debuginfo-23.01.0-150500.3.5.1 * libpoppler-glib8-32bit-debuginfo-23.01.0-150500.3.5.2 * libpoppler126-32bit-23.01.0-150500.3.5.2 * libpoppler-cpp0-32bit-debuginfo-23.01.0-150500.3.5.2 * libpoppler126-32bit-debuginfo-23.01.0-150500.3.5.2 * libpoppler-glib8-32bit-23.01.0-150500.3.5.2 * libpoppler-qt5-1-32bit-23.01.0-150500.3.5.1 * libpoppler-cpp0-32bit-23.01.0-150500.3.5.2 * openSUSE Leap 15.5 (aarch64_ilp32) * libpoppler126-64bit-23.01.0-150500.3.5.2 * libpoppler-cpp0-64bit-debuginfo-23.01.0-150500.3.5.2 * libpoppler126-64bit-debuginfo-23.01.0-150500.3.5.2 * libpoppler-qt5-1-64bit-debuginfo-23.01.0-150500.3.5.1 * libpoppler-glib8-64bit-debuginfo-23.01.0-150500.3.5.2 * libpoppler-glib8-64bit-23.01.0-150500.3.5.2 * libpoppler-cpp0-64bit-23.01.0-150500.3.5.2 * libpoppler-qt5-1-64bit-23.01.0-150500.3.5.1 * Basesystem Module 15-SP5 (aarch64 ppc64le s390x x86_64) * libpoppler-glib-devel-23.01.0-150500.3.5.2 * poppler-tools-debuginfo-23.01.0-150500.3.5.2 * libpoppler-glib8-23.01.0-150500.3.5.2 * libpoppler126-debuginfo-23.01.0-150500.3.5.2 * poppler-tools-23.01.0-150500.3.5.2 * poppler-debugsource-23.01.0-150500.3.5.2 * libpoppler-cpp0-23.01.0-150500.3.5.2 * libpoppler-glib8-debuginfo-23.01.0-150500.3.5.2 * typelib-1_0-Poppler-0_18-23.01.0-150500.3.5.2 * libpoppler126-23.01.0-150500.3.5.2 * libpoppler-devel-23.01.0-150500.3.5.2 * libpoppler-cpp0-debuginfo-23.01.0-150500.3.5.2 ## References: * https://www.suse.com/security/cve/CVE-2023-34872.html * https://bugzilla.suse.com/show_bug.cgi?id=1213888

1 0

SUSE-SU-2023:4292-1: important: Security update for xorg-x11-server
by security＠lists.opensuse.org 31 Oct '23

31 Oct '23

# Security update for xorg-x11-server Announcement ID: SUSE-SU-2023:4292-1 Rating: important References: * bsc#1216133 * bsc#1216135 * bsc#1216261 Cross-References: * CVE-2023-5367 * CVE-2023-5380 * CVE-2023-5574 CVSS scores: * CVE-2023-5367 ( SUSE ): 7.8 CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H * CVE-2023-5367 ( NVD ): 7.8 CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H * CVE-2023-5380 ( SUSE ): 5.1 CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H * CVE-2023-5380 ( NVD ): 5.1 CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H * CVE-2023-5574 ( SUSE ): 7.4 CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H * CVE-2023-5574 ( NVD ): 7.0 CVSS:3.1/AV:L/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H Affected Products: * Basesystem Module 15-SP4 * Development Tools Module 15-SP4 * openSUSE Leap 15.4 * SUSE Linux Enterprise Desktop 15 SP4 * SUSE Linux Enterprise High Performance Computing 15 SP4 * SUSE Linux Enterprise Real Time 15 SP4 * SUSE Linux Enterprise Server 15 SP4 * SUSE Linux Enterprise Server for SAP Applications 15 SP4 * SUSE Manager Proxy 4.3 * SUSE Manager Retail Branch Server 4.3 * SUSE Manager Server 4.3 An update that solves three vulnerabilities can now be installed. ## Description: This update for xorg-x11-server fixes the following issues: * CVE-2023-5574: Fixed a privilege escalation issue that could be triggered via the Damage extension protocol (bsc#1216261). * CVE-2023-5380: Fixed a memory safety issue that could be triggered when using multiple protocol screens (bsc#1216133). * CVE-2023-5367: Fixed a memory safety issue in both the XI2 and RandR protocols (bsc#1216135). ## Patch Instructions: To install this SUSE update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: * openSUSE Leap 15.4 zypper in -t patch SUSE-2023-4292=1 openSUSE-SLE-15.4-2023-4292=1 * Basesystem Module 15-SP4 zypper in -t patch SUSE-SLE-Module-Basesystem-15-SP4-2023-4292=1 * Development Tools Module 15-SP4 zypper in -t patch SUSE-SLE-Module-Development-Tools-15-SP4-2023-4292=1 ## Package List: * openSUSE Leap 15.4 (aarch64 ppc64le s390x x86_64 i586) * xorg-x11-server-extra-debuginfo-1.20.3-150400.38.29.1 * xorg-x11-server-extra-1.20.3-150400.38.29.1 * xorg-x11-server-debugsource-1.20.3-150400.38.29.1 * xorg-x11-server-sdk-1.20.3-150400.38.29.1 * xorg-x11-server-debuginfo-1.20.3-150400.38.29.1 * xorg-x11-server-1.20.3-150400.38.29.1 * xorg-x11-server-source-1.20.3-150400.38.29.1 * Basesystem Module 15-SP4 (aarch64 ppc64le s390x x86_64) * xorg-x11-server-extra-debuginfo-1.20.3-150400.38.29.1 * xorg-x11-server-extra-1.20.3-150400.38.29.1 * xorg-x11-server-debugsource-1.20.3-150400.38.29.1 * xorg-x11-server-debuginfo-1.20.3-150400.38.29.1 * xorg-x11-server-1.20.3-150400.38.29.1 * Development Tools Module 15-SP4 (aarch64 ppc64le s390x x86_64) * xorg-x11-server-sdk-1.20.3-150400.38.29.1 * xorg-x11-server-debuginfo-1.20.3-150400.38.29.1 * xorg-x11-server-debugsource-1.20.3-150400.38.29.1 ## References: * https://www.suse.com/security/cve/CVE-2023-5367.html * https://www.suse.com/security/cve/CVE-2023-5380.html * https://www.suse.com/security/cve/CVE-2023-5574.html * https://bugzilla.suse.com/show_bug.cgi?id=1216133 * https://bugzilla.suse.com/show_bug.cgi?id=1216135 * https://bugzilla.suse.com/show_bug.cgi?id=1216261

1 0

SUSE-SU-2023:4293-1: important: Security update for xwayland
by security＠lists.opensuse.org 31 Oct '23

31 Oct '23

# Security update for xwayland Announcement ID: SUSE-SU-2023:4293-1 Rating: important References: * bsc#1216135 * bsc#1216261 Cross-References: * CVE-2023-5367 * CVE-2023-5574 CVSS scores: * CVE-2023-5367 ( SUSE ): 7.8 CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H * CVE-2023-5367 ( NVD ): 7.8 CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H * CVE-2023-5574 ( SUSE ): 7.4 CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H * CVE-2023-5574 ( NVD ): 7.0 CVSS:3.1/AV:L/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H Affected Products: * openSUSE Leap 15.4 * SUSE Linux Enterprise Desktop 15 SP4 * SUSE Linux Enterprise Server 15 SP4 * SUSE Linux Enterprise Server for SAP Applications 15 SP4 * SUSE Linux Enterprise Workstation Extension 15 SP4 An update that solves two vulnerabilities can now be installed. ## Description: This update for xwayland fixes the following issues: * CVE-2023-5574: Fixed a privilege escalation issue that could be triggered via the Damage extension protocol (bsc#1216261). * CVE-2023-5367: Fixed a memory safety issue in both the XI2 and RandR protocols (bsc#1216135). ## Patch Instructions: To install this SUSE update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: * openSUSE Leap 15.4 zypper in -t patch SUSE-2023-4293=1 openSUSE-SLE-15.4-2023-4293=1 * SUSE Linux Enterprise Workstation Extension 15 SP4 zypper in -t patch SUSE-SLE-Product-WE-15-SP4-2023-4293=1 ## Package List: * openSUSE Leap 15.4 (aarch64 ppc64le s390x x86_64 i586) * xwayland-21.1.4-150400.3.20.1 * xwayland-devel-21.1.4-150400.3.20.1 * xwayland-debugsource-21.1.4-150400.3.20.1 * xwayland-debuginfo-21.1.4-150400.3.20.1 * SUSE Linux Enterprise Workstation Extension 15 SP4 (x86_64) * xwayland-21.1.4-150400.3.20.1 * xwayland-debugsource-21.1.4-150400.3.20.1 * xwayland-debuginfo-21.1.4-150400.3.20.1 ## References: * https://www.suse.com/security/cve/CVE-2023-5367.html * https://www.suse.com/security/cve/CVE-2023-5574.html * https://bugzilla.suse.com/show_bug.cgi?id=1216135 * https://bugzilla.suse.com/show_bug.cgi?id=1216261

1 0

SUSE-SU-2023:4294-1: important: Security update for webkit2gtk3
by security＠lists.opensuse.org 31 Oct '23

31 Oct '23

# Security update for webkit2gtk3 Announcement ID: SUSE-SU-2023:4294-1 Rating: important References: * bsc#1214093 * bsc#1214640 * bsc#1214835 * bsc#1215072 * bsc#1215661 * bsc#1215866 * bsc#1215867 * bsc#1215868 * bsc#1215869 * bsc#1215870 * bsc#1216483 Cross-References: * CVE-2023-35074 * CVE-2023-39434 * CVE-2023-39928 * CVE-2023-40451 * CVE-2023-41074 * CVE-2023-41993 CVSS scores: * CVE-2023-35074 ( SUSE ): 8.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H * CVE-2023-35074 ( NVD ): 8.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H * CVE-2023-39434 ( SUSE ): 8.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H * CVE-2023-39434 ( NVD ): 8.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H * CVE-2023-39928 ( SUSE ): 8.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H * CVE-2023-39928 ( NVD ): 8.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H * CVE-2023-40451 ( SUSE ): 8.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H * CVE-2023-40451 ( NVD ): 8.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H * CVE-2023-41074 ( SUSE ): 8.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H * CVE-2023-41074 ( NVD ): 8.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H * CVE-2023-41993 ( SUSE ): 8.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:L * CVE-2023-41993 ( NVD ): 9.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H Affected Products: * Basesystem Module 15-SP4 * Basesystem Module 15-SP5 * Desktop Applications Module 15-SP4 * Desktop Applications Module 15-SP5 * Development Tools Module 15-SP4 * Development Tools Module 15-SP5 * openSUSE Leap 15.4 * openSUSE Leap 15.5 * SUSE Linux Enterprise Desktop 15 SP4 * SUSE Linux Enterprise Desktop 15 SP5 * SUSE Linux Enterprise High Performance Computing 15 SP4 * SUSE Linux Enterprise High Performance Computing 15 SP5 * SUSE Linux Enterprise Real Time 15 SP4 * SUSE Linux Enterprise Real Time 15 SP5 * SUSE Linux Enterprise Server 15 SP4 * SUSE Linux Enterprise Server 15 SP5 * SUSE Linux Enterprise Server for SAP Applications 15 SP4 * SUSE Linux Enterprise Server for SAP Applications 15 SP5 * SUSE Manager Proxy 4.3 * SUSE Manager Retail Branch Server 4.3 * SUSE Manager Server 4.3 An update that solves six vulnerabilities and has five security fixes can now be installed. ## Description: This update for webkit2gtk3 ships missing Lang packages to SUSE Linux Enterprise 15 SP4 and SP5. Security fixes: * CVE-2023-41993: Fixed an issue where processing malicious web content could have lead to arbitrary code execution (bsc#1215661). * CVE-2023-39928: Fixed a use-after-free that could be exploited to execute arbitrary code when visiting a malicious webpage (bsc#1215868). * CVE-2023-41074: Fixed an issue where processing malicious web content could have lead to arbitrary code execution (bsc#1215870). Other fixes: * Fixed missing package dependencies (bsc#1215072). ## Patch Instructions: To install this SUSE update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: * openSUSE Leap 15.4 zypper in -t patch SUSE-2023-4294=1 openSUSE-SLE-15.4-2023-4294=1 * openSUSE Leap 15.5 zypper in -t patch openSUSE-SLE-15.5-2023-4294=1 * Basesystem Module 15-SP4 zypper in -t patch SUSE-SLE-Module-Basesystem-15-SP4-2023-4294=1 * Basesystem Module 15-SP5 zypper in -t patch SUSE-SLE-Module-Basesystem-15-SP5-2023-4294=1 * Desktop Applications Module 15-SP4 zypper in -t patch SUSE-SLE-Module-Desktop-Applications-15-SP4-2023-4294=1 * Desktop Applications Module 15-SP5 zypper in -t patch SUSE-SLE-Module-Desktop-Applications-15-SP5-2023-4294=1 * Development Tools Module 15-SP4 zypper in -t patch SUSE-SLE-Module-Development-Tools-15-SP4-2023-4294=1 * Development Tools Module 15-SP5 zypper in -t patch SUSE-SLE-Module-Development-Tools-15-SP5-2023-4294=1 ## Package List: * openSUSE Leap 15.4 (noarch) * WebKitGTK-4.0-lang-2.42.1-150400.4.57.2 * WebKitGTK-6.0-lang-2.42.1-150400.4.57.3 * WebKitGTK-4.1-lang-2.42.1-150400.4.57.2 * openSUSE Leap 15.4 (aarch64 ppc64le s390x x86_64 i586) * typelib-1_0-WebKit2-4_0-2.42.1-150400.4.57.2 * webkit2gtk4-minibrowser-debuginfo-2.42.1-150400.4.57.3 * libjavascriptcoregtk-6_0-1-2.42.1-150400.4.57.3 * webkit2gtk3-devel-2.42.1-150400.4.57.2 * libwebkit2gtk-4_1-0-2.42.1-150400.4.57.2 * typelib-1_0-WebKit2WebExtension-4_1-2.42.1-150400.4.57.2 * webkitgtk-6_0-injected-bundles-debuginfo-2.42.1-150400.4.57.3 * libjavascriptcoregtk-4_1-0-debuginfo-2.42.1-150400.4.57.2 * webkit-jsc-6.0-2.42.1-150400.4.57.3 * libwebkit2gtk-4_1-0-debuginfo-2.42.1-150400.4.57.2 * libjavascriptcoregtk-4_1-0-2.42.1-150400.4.57.2 * typelib-1_0-JavaScriptCore-6_0-2.42.1-150400.4.57.3 * libwebkitgtk-6_0-4-debuginfo-2.42.1-150400.4.57.3 * webkit2gtk-4_1-injected-bundles-2.42.1-150400.4.57.2 * webkit2gtk4-minibrowser-2.42.1-150400.4.57.3 * webkit-jsc-4-debuginfo-2.42.1-150400.4.57.2 * webkit2gtk-4_0-injected-bundles-debuginfo-2.42.1-150400.4.57.2 * typelib-1_0-WebKit-6_0-2.42.1-150400.4.57.3 * libjavascriptcoregtk-6_0-1-debuginfo-2.42.1-150400.4.57.3 * typelib-1_0-JavaScriptCore-4_0-2.42.1-150400.4.57.2 * webkit2gtk4-devel-2.42.1-150400.4.57.3 * webkit2gtk3-soup2-minibrowser-2.42.1-150400.4.57.2 * webkit-jsc-4-2.42.1-150400.4.57.2 * webkit2gtk3-debugsource-2.42.1-150400.4.57.2 * libjavascriptcoregtk-4_0-18-2.42.1-150400.4.57.2 * webkitgtk-6_0-injected-bundles-2.42.1-150400.4.57.3 * typelib-1_0-WebKitWebProcessExtension-6_0-2.42.1-150400.4.57.3 * libwebkitgtk-6_0-4-2.42.1-150400.4.57.3 * libwebkit2gtk-4_0-37-2.42.1-150400.4.57.2 * webkit2gtk-4_1-injected-bundles-debuginfo-2.42.1-150400.4.57.2 * webkit-jsc-4.1-debuginfo-2.42.1-150400.4.57.2 * typelib-1_0-JavaScriptCore-4_1-2.42.1-150400.4.57.2 * webkit2gtk-4_0-injected-bundles-2.42.1-150400.4.57.2 * webkit2gtk3-soup2-minibrowser-debuginfo-2.42.1-150400.4.57.2 * typelib-1_0-WebKit2WebExtension-4_0-2.42.1-150400.4.57.2 * webkit2gtk3-minibrowser-2.42.1-150400.4.57.2 * webkit2gtk3-soup2-devel-2.42.1-150400.4.57.2 * webkit2gtk4-debugsource-2.42.1-150400.4.57.3 * webkit2gtk3-soup2-debugsource-2.42.1-150400.4.57.2 * libwebkit2gtk-4_0-37-debuginfo-2.42.1-150400.4.57.2 * libjavascriptcoregtk-4_0-18-debuginfo-2.42.1-150400.4.57.2 * webkit-jsc-6.0-debuginfo-2.42.1-150400.4.57.3 * webkit-jsc-4.1-2.42.1-150400.4.57.2 * webkit2gtk3-minibrowser-debuginfo-2.42.1-150400.4.57.2 * typelib-1_0-WebKit2-4_1-2.42.1-150400.4.57.2 * openSUSE Leap 15.4 (x86_64) * libjavascriptcoregtk-4_1-0-32bit-2.42.1-150400.4.57.2 * libwebkit2gtk-4_1-0-32bit-2.42.1-150400.4.57.2 * libjavascriptcoregtk-4_1-0-32bit-debuginfo-2.42.1-150400.4.57.2 * libjavascriptcoregtk-4_0-18-32bit-2.42.1-150400.4.57.2 * libwebkit2gtk-4_0-37-32bit-2.42.1-150400.4.57.2 * libwebkit2gtk-4_1-0-32bit-debuginfo-2.42.1-150400.4.57.2 * libwebkit2gtk-4_0-37-32bit-debuginfo-2.42.1-150400.4.57.2 * libjavascriptcoregtk-4_0-18-32bit-debuginfo-2.42.1-150400.4.57.2 * openSUSE Leap 15.4 (aarch64_ilp32) * libjavascriptcoregtk-4_1-0-64bit-2.42.1-150400.4.57.2 * libjavascriptcoregtk-4_1-0-64bit-debuginfo-2.42.1-150400.4.57.2 * libwebkit2gtk-4_0-37-64bit-debuginfo-2.42.1-150400.4.57.2 * libjavascriptcoregtk-4_0-18-64bit-debuginfo-2.42.1-150400.4.57.2 * libjavascriptcoregtk-4_0-18-64bit-2.42.1-150400.4.57.2 * libwebkit2gtk-4_1-0-64bit-2.42.1-150400.4.57.2 * libwebkit2gtk-4_1-0-64bit-debuginfo-2.42.1-150400.4.57.2 * libwebkit2gtk-4_0-37-64bit-2.42.1-150400.4.57.2 * openSUSE Leap 15.5 (noarch) * WebKitGTK-4.0-lang-2.42.1-150400.4.57.2 * WebKitGTK-6.0-lang-2.42.1-150400.4.57.3 * WebKitGTK-4.1-lang-2.42.1-150400.4.57.2 * openSUSE Leap 15.5 (aarch64 ppc64le s390x x86_64) * typelib-1_0-WebKit2-4_0-2.42.1-150400.4.57.2 * webkit2gtk4-minibrowser-debuginfo-2.42.1-150400.4.57.3 * libjavascriptcoregtk-6_0-1-2.42.1-150400.4.57.3 * webkit2gtk3-devel-2.42.1-150400.4.57.2 * libwebkit2gtk-4_1-0-2.42.1-150400.4.57.2 * typelib-1_0-WebKit2WebExtension-4_1-2.42.1-150400.4.57.2 * webkitgtk-6_0-injected-bundles-debuginfo-2.42.1-150400.4.57.3 * libjavascriptcoregtk-4_1-0-debuginfo-2.42.1-150400.4.57.2 * webkit-jsc-6.0-2.42.1-150400.4.57.3 * libwebkit2gtk-4_1-0-debuginfo-2.42.1-150400.4.57.2 * libjavascriptcoregtk-4_1-0-2.42.1-150400.4.57.2 * typelib-1_0-JavaScriptCore-6_0-2.42.1-150400.4.57.3 * libwebkitgtk-6_0-4-debuginfo-2.42.1-150400.4.57.3 * webkit2gtk-4_1-injected-bundles-2.42.1-150400.4.57.2 * webkit2gtk4-minibrowser-2.42.1-150400.4.57.3 * webkit-jsc-4-debuginfo-2.42.1-150400.4.57.2 * webkit2gtk-4_0-injected-bundles-debuginfo-2.42.1-150400.4.57.2 * typelib-1_0-WebKit-6_0-2.42.1-150400.4.57.3 * libjavascriptcoregtk-6_0-1-debuginfo-2.42.1-150400.4.57.3 * typelib-1_0-JavaScriptCore-4_0-2.42.1-150400.4.57.2 * webkit2gtk4-devel-2.42.1-150400.4.57.3 * webkit2gtk3-soup2-minibrowser-2.42.1-150400.4.57.2 * webkit-jsc-4-2.42.1-150400.4.57.2 * libjavascriptcoregtk-4_0-18-2.42.1-150400.4.57.2 * webkit2gtk3-debugsource-2.42.1-150400.4.57.2 * webkitgtk-6_0-injected-bundles-2.42.1-150400.4.57.3 * typelib-1_0-WebKitWebProcessExtension-6_0-2.42.1-150400.4.57.3 * libwebkitgtk-6_0-4-2.42.1-150400.4.57.3 * libwebkit2gtk-4_0-37-2.42.1-150400.4.57.2 * webkit2gtk-4_1-injected-bundles-debuginfo-2.42.1-150400.4.57.2 * webkit-jsc-4.1-debuginfo-2.42.1-150400.4.57.2 * typelib-1_0-JavaScriptCore-4_1-2.42.1-150400.4.57.2 * webkit2gtk-4_0-injected-bundles-2.42.1-150400.4.57.2 * webkit2gtk3-soup2-minibrowser-debuginfo-2.42.1-150400.4.57.2 * typelib-1_0-WebKit2WebExtension-4_0-2.42.1-150400.4.57.2 * webkit2gtk3-minibrowser-2.42.1-150400.4.57.2 * webkit2gtk3-soup2-devel-2.42.1-150400.4.57.2 * webkit2gtk4-debugsource-2.42.1-150400.4.57.3 * webkit2gtk3-soup2-debugsource-2.42.1-150400.4.57.2 * libwebkit2gtk-4_0-37-debuginfo-2.42.1-150400.4.57.2 * libjavascriptcoregtk-4_0-18-debuginfo-2.42.1-150400.4.57.2 * webkit-jsc-6.0-debuginfo-2.42.1-150400.4.57.3 * webkit-jsc-4.1-2.42.1-150400.4.57.2 * webkit2gtk3-minibrowser-debuginfo-2.42.1-150400.4.57.2 * typelib-1_0-WebKit2-4_1-2.42.1-150400.4.57.2 * openSUSE Leap 15.5 (x86_64) * libjavascriptcoregtk-4_1-0-32bit-2.42.1-150400.4.57.2 * libwebkit2gtk-4_1-0-32bit-2.42.1-150400.4.57.2 * libjavascriptcoregtk-4_1-0-32bit-debuginfo-2.42.1-150400.4.57.2 * libjavascriptcoregtk-4_0-18-32bit-2.42.1-150400.4.57.2 * libwebkit2gtk-4_1-0-32bit-debuginfo-2.42.1-150400.4.57.2 * libwebkit2gtk-4_0-37-32bit-debuginfo-2.42.1-150400.4.57.2 * libjavascriptcoregtk-4_0-18-32bit-debuginfo-2.42.1-150400.4.57.2 * libwebkit2gtk-4_0-37-32bit-2.42.1-150400.4.57.2 * openSUSE Leap 15.5 (aarch64_ilp32) * libjavascriptcoregtk-4_1-0-64bit-2.42.1-150400.4.57.2 * libjavascriptcoregtk-4_1-0-64bit-debuginfo-2.42.1-150400.4.57.2 * libwebkit2gtk-4_0-37-64bit-debuginfo-2.42.1-150400.4.57.2 * libjavascriptcoregtk-4_0-18-64bit-debuginfo-2.42.1-150400.4.57.2 * libjavascriptcoregtk-4_0-18-64bit-2.42.1-150400.4.57.2 * libwebkit2gtk-4_1-0-64bit-2.42.1-150400.4.57.2 * libwebkit2gtk-4_1-0-64bit-debuginfo-2.42.1-150400.4.57.2 * libwebkit2gtk-4_0-37-64bit-2.42.1-150400.4.57.2 * Basesystem Module 15-SP4 (noarch) * WebKitGTK-4.0-lang-2.42.1-150400.4.57.2 * Basesystem Module 15-SP4 (aarch64 ppc64le s390x x86_64) * typelib-1_0-WebKit2-4_0-2.42.1-150400.4.57.2 * typelib-1_0-JavaScriptCore-4_0-2.42.1-150400.4.57.2 * typelib-1_0-WebKit2WebExtension-4_0-2.42.1-150400.4.57.2 * webkit2gtk3-soup2-devel-2.42.1-150400.4.57.2 * libjavascriptcoregtk-4_0-18-2.42.1-150400.4.57.2 * webkit2gtk3-soup2-debugsource-2.42.1-150400.4.57.2 * libwebkit2gtk-4_0-37-debuginfo-2.42.1-150400.4.57.2 * webkit2gtk-4_0-injected-bundles-debuginfo-2.42.1-150400.4.57.2 * libwebkit2gtk-4_0-37-2.42.1-150400.4.57.2 * libjavascriptcoregtk-4_0-18-debuginfo-2.42.1-150400.4.57.2 * webkit2gtk-4_0-injected-bundles-2.42.1-150400.4.57.2 * Basesystem Module 15-SP5 (noarch) * WebKitGTK-4.0-lang-2.42.1-150400.4.57.2 * Basesystem Module 15-SP5 (aarch64 ppc64le s390x x86_64) * typelib-1_0-WebKit2-4_0-2.42.1-150400.4.57.2 * typelib-1_0-JavaScriptCore-4_0-2.42.1-150400.4.57.2 * typelib-1_0-WebKit2WebExtension-4_0-2.42.1-150400.4.57.2 * webkit2gtk3-soup2-devel-2.42.1-150400.4.57.2 * libjavascriptcoregtk-4_0-18-2.42.1-150400.4.57.2 * webkit2gtk3-soup2-debugsource-2.42.1-150400.4.57.2 * libwebkit2gtk-4_0-37-debuginfo-2.42.1-150400.4.57.2 * webkit2gtk-4_0-injected-bundles-debuginfo-2.42.1-150400.4.57.2 * libwebkit2gtk-4_0-37-2.42.1-150400.4.57.2 * libjavascriptcoregtk-4_0-18-debuginfo-2.42.1-150400.4.57.2 * webkit2gtk-4_0-injected-bundles-2.42.1-150400.4.57.2 * Desktop Applications Module 15-SP4 (noarch) * WebKitGTK-4.1-lang-2.42.1-150400.4.57.2 * Desktop Applications Module 15-SP4 (aarch64 ppc64le s390x x86_64) * webkit2gtk3-debugsource-2.42.1-150400.4.57.2 * webkit2gtk3-devel-2.42.1-150400.4.57.2 * libwebkit2gtk-4_1-0-2.42.1-150400.4.57.2 * typelib-1_0-WebKit2WebExtension-4_1-2.42.1-150400.4.57.2 * libjavascriptcoregtk-4_1-0-2.42.1-150400.4.57.2 * webkit2gtk-4_1-injected-bundles-2.42.1-150400.4.57.2 * libjavascriptcoregtk-4_1-0-debuginfo-2.42.1-150400.4.57.2 * webkit2gtk-4_1-injected-bundles-debuginfo-2.42.1-150400.4.57.2 * libwebkit2gtk-4_1-0-debuginfo-2.42.1-150400.4.57.2 * typelib-1_0-JavaScriptCore-4_1-2.42.1-150400.4.57.2 * typelib-1_0-WebKit2-4_1-2.42.1-150400.4.57.2 * Desktop Applications Module 15-SP5 (noarch) * WebKitGTK-4.1-lang-2.42.1-150400.4.57.2 * Desktop Applications Module 15-SP5 (aarch64 ppc64le s390x x86_64) * webkit2gtk3-debugsource-2.42.1-150400.4.57.2 * webkit2gtk3-devel-2.42.1-150400.4.57.2 * libwebkit2gtk-4_1-0-2.42.1-150400.4.57.2 * typelib-1_0-WebKit2WebExtension-4_1-2.42.1-150400.4.57.2 * libjavascriptcoregtk-4_1-0-2.42.1-150400.4.57.2 * webkit2gtk-4_1-injected-bundles-2.42.1-150400.4.57.2 * libjavascriptcoregtk-4_1-0-debuginfo-2.42.1-150400.4.57.2 * webkit2gtk-4_1-injected-bundles-debuginfo-2.42.1-150400.4.57.2 * libwebkit2gtk-4_1-0-debuginfo-2.42.1-150400.4.57.2 * typelib-1_0-JavaScriptCore-4_1-2.42.1-150400.4.57.2 * typelib-1_0-WebKit2-4_1-2.42.1-150400.4.57.2 * Development Tools Module 15-SP4 (noarch) * WebKitGTK-6.0-lang-2.42.1-150400.4.57.3 * Development Tools Module 15-SP4 (aarch64 ppc64le s390x x86_64) * libjavascriptcoregtk-6_0-1-debuginfo-2.42.1-150400.4.57.3 * libjavascriptcoregtk-6_0-1-2.42.1-150400.4.57.3 * webkit2gtk4-debugsource-2.42.1-150400.4.57.3 * libwebkitgtk-6_0-4-debuginfo-2.42.1-150400.4.57.3 * webkitgtk-6_0-injected-bundles-2.42.1-150400.4.57.3 * libwebkitgtk-6_0-4-2.42.1-150400.4.57.3 * Development Tools Module 15-SP5 (noarch) * WebKitGTK-6.0-lang-2.42.1-150400.4.57.3 * Development Tools Module 15-SP5 (aarch64 ppc64le s390x x86_64) * libjavascriptcoregtk-6_0-1-debuginfo-2.42.1-150400.4.57.3 * libjavascriptcoregtk-6_0-1-2.42.1-150400.4.57.3 * webkit2gtk4-debugsource-2.42.1-150400.4.57.3 * libwebkitgtk-6_0-4-debuginfo-2.42.1-150400.4.57.3 * webkitgtk-6_0-injected-bundles-2.42.1-150400.4.57.3 * libwebkitgtk-6_0-4-2.42.1-150400.4.57.3 ## References: * https://www.suse.com/security/cve/CVE-2023-35074.html * https://www.suse.com/security/cve/CVE-2023-39434.html * https://www.suse.com/security/cve/CVE-2023-39928.html * https://www.suse.com/security/cve/CVE-2023-40451.html * https://www.suse.com/security/cve/CVE-2023-41074.html * https://www.suse.com/security/cve/CVE-2023-41993.html * https://bugzilla.suse.com/show_bug.cgi?id=1214093 * https://bugzilla.suse.com/show_bug.cgi?id=1214640 * https://bugzilla.suse.com/show_bug.cgi?id=1214835 * https://bugzilla.suse.com/show_bug.cgi?id=1215072 * https://bugzilla.suse.com/show_bug.cgi?id=1215661 * https://bugzilla.suse.com/show_bug.cgi?id=1215866 * https://bugzilla.suse.com/show_bug.cgi?id=1215867 * https://bugzilla.suse.com/show_bug.cgi?id=1215868 * https://bugzilla.suse.com/show_bug.cgi?id=1215869 * https://bugzilla.suse.com/show_bug.cgi?id=1215870 * https://bugzilla.suse.com/show_bug.cgi?id=1216483

1 0

SUSE-SU-2023:4295-1: important: Security update for nodejs10
by security＠lists.opensuse.org 31 Oct '23

31 Oct '23

# Security update for nodejs10 Announcement ID: SUSE-SU-2023:4295-1 Rating: important References: * bsc#1216190 Cross-References: * CVE-2023-44487 CVSS scores: * CVE-2023-44487 ( SUSE ): 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H * CVE-2023-44487 ( NVD ): 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H Affected Products: * openSUSE Leap 15.4 * SUSE CaaS Platform 4.0 * SUSE Linux Enterprise High Performance Computing 15 SP1 * SUSE Linux Enterprise High Performance Computing 15 SP1 LTSS 15-SP1 * SUSE Linux Enterprise High Performance Computing 15 SP2 * SUSE Linux Enterprise High Performance Computing 15 SP2 LTSS 15-SP2 * SUSE Linux Enterprise Server 15 SP1 * SUSE Linux Enterprise Server 15 SP1 LTSS 15-SP1 * SUSE Linux Enterprise Server 15 SP2 * SUSE Linux Enterprise Server 15 SP2 LTSS 15-SP2 * SUSE Linux Enterprise Server for SAP Applications 15 SP1 * SUSE Linux Enterprise Server for SAP Applications 15 SP2 An update that solves one vulnerability can now be installed. ## Description: This update for nodejs10 fixes the following issues: * CVE-2023-44487: Fixed the Rapid Reset attack in nghttp2. (bsc#1216190) ## Patch Instructions: To install this SUSE update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: * openSUSE Leap 15.4 zypper in -t patch openSUSE-SLE-15.4-2023-4295=1 * SUSE Linux Enterprise High Performance Computing 15 SP1 LTSS 15-SP1 zypper in -t patch SUSE-SLE-Product-HPC-15-SP1-LTSS-2023-4295=1 * SUSE Linux Enterprise High Performance Computing 15 SP2 LTSS 15-SP2 zypper in -t patch SUSE-SLE-Product-HPC-15-SP2-LTSS-2023-4295=1 * SUSE Linux Enterprise Server 15 SP1 LTSS 15-SP1 zypper in -t patch SUSE-SLE-Product-SLES-15-SP1-LTSS-2023-4295=1 * SUSE Linux Enterprise Server 15 SP2 LTSS 15-SP2 zypper in -t patch SUSE-SLE-Product-SLES-15-SP2-LTSS-2023-4295=1 * SUSE Linux Enterprise Server for SAP Applications 15 SP1 zypper in -t patch SUSE-SLE-Product-SLES_SAP-15-SP1-2023-4295=1 * SUSE Linux Enterprise Server for SAP Applications 15 SP2 zypper in -t patch SUSE-SLE-Product-SLES_SAP-15-SP2-2023-4295=1 * SUSE CaaS Platform 4.0 To install this update, use the SUSE CaaS Platform 'skuba' tool. It will inform you if it detects new updates and let you then trigger updating of the complete cluster in a controlled way. ## Package List: * openSUSE Leap 15.4 (aarch64 ppc64le s390x x86_64) * npm10-10.24.1-150000.1.62.3 * nodejs10-debuginfo-10.24.1-150000.1.62.3 * nodejs10-debugsource-10.24.1-150000.1.62.3 * nodejs10-devel-10.24.1-150000.1.62.3 * nodejs10-10.24.1-150000.1.62.3 * openSUSE Leap 15.4 (noarch) * nodejs10-docs-10.24.1-150000.1.62.3 * SUSE Linux Enterprise High Performance Computing 15 SP1 LTSS 15-SP1 (aarch64 x86_64) * npm10-10.24.1-150000.1.62.3 * nodejs10-debuginfo-10.24.1-150000.1.62.3 * nodejs10-debugsource-10.24.1-150000.1.62.3 * nodejs10-devel-10.24.1-150000.1.62.3 * nodejs10-10.24.1-150000.1.62.3 * SUSE Linux Enterprise High Performance Computing 15 SP1 LTSS 15-SP1 (noarch) * nodejs10-docs-10.24.1-150000.1.62.3 * SUSE Linux Enterprise High Performance Computing 15 SP2 LTSS 15-SP2 (aarch64 x86_64) * npm10-10.24.1-150000.1.62.3 * nodejs10-debuginfo-10.24.1-150000.1.62.3 * nodejs10-debugsource-10.24.1-150000.1.62.3 * nodejs10-devel-10.24.1-150000.1.62.3 * nodejs10-10.24.1-150000.1.62.3 * SUSE Linux Enterprise High Performance Computing 15 SP2 LTSS 15-SP2 (noarch) * nodejs10-docs-10.24.1-150000.1.62.3 * SUSE Linux Enterprise Server 15 SP1 LTSS 15-SP1 (aarch64 ppc64le s390x x86_64) * npm10-10.24.1-150000.1.62.3 * nodejs10-debuginfo-10.24.1-150000.1.62.3 * nodejs10-debugsource-10.24.1-150000.1.62.3 * nodejs10-devel-10.24.1-150000.1.62.3 * nodejs10-10.24.1-150000.1.62.3 * SUSE Linux Enterprise Server 15 SP1 LTSS 15-SP1 (noarch) * nodejs10-docs-10.24.1-150000.1.62.3 * SUSE Linux Enterprise Server 15 SP2 LTSS 15-SP2 (aarch64 ppc64le s390x x86_64) * npm10-10.24.1-150000.1.62.3 * nodejs10-debuginfo-10.24.1-150000.1.62.3 * nodejs10-debugsource-10.24.1-150000.1.62.3 * nodejs10-devel-10.24.1-150000.1.62.3 * nodejs10-10.24.1-150000.1.62.3 * SUSE Linux Enterprise Server 15 SP2 LTSS 15-SP2 (noarch) * nodejs10-docs-10.24.1-150000.1.62.3 * SUSE Linux Enterprise Server for SAP Applications 15 SP1 (ppc64le x86_64) * npm10-10.24.1-150000.1.62.3 * nodejs10-debuginfo-10.24.1-150000.1.62.3 * nodejs10-debugsource-10.24.1-150000.1.62.3 * nodejs10-devel-10.24.1-150000.1.62.3 * nodejs10-10.24.1-150000.1.62.3 * SUSE Linux Enterprise Server for SAP Applications 15 SP1 (noarch) * nodejs10-docs-10.24.1-150000.1.62.3 * SUSE Linux Enterprise Server for SAP Applications 15 SP2 (ppc64le x86_64) * npm10-10.24.1-150000.1.62.3 * nodejs10-debuginfo-10.24.1-150000.1.62.3 * nodejs10-debugsource-10.24.1-150000.1.62.3 * nodejs10-devel-10.24.1-150000.1.62.3 * nodejs10-10.24.1-150000.1.62.3 * SUSE Linux Enterprise Server for SAP Applications 15 SP2 (noarch) * nodejs10-docs-10.24.1-150000.1.62.3 * SUSE CaaS Platform 4.0 (x86_64) * npm10-10.24.1-150000.1.62.3 * nodejs10-debuginfo-10.24.1-150000.1.62.3 * nodejs10-debugsource-10.24.1-150000.1.62.3 * nodejs10-devel-10.24.1-150000.1.62.3 * nodejs10-10.24.1-150000.1.62.3 * SUSE CaaS Platform 4.0 (noarch) * nodejs10-docs-10.24.1-150000.1.62.3 ## References: * https://www.suse.com/security/cve/CVE-2023-44487.html * https://bugzilla.suse.com/show_bug.cgi?id=1216190

1 0

SUSE-SU-2023:4302-1: important: Security update for MozillaThunderbird
by security＠lists.opensuse.org 31 Oct '23

31 Oct '23

# Security update for MozillaThunderbird Announcement ID: SUSE-SU-2023:4302-1 Rating: important References: * bsc#1216338 Cross-References: * CVE-2023-5721 * CVE-2023-5724 * CVE-2023-5725 * CVE-2023-5726 * CVE-2023-5727 * CVE-2023-5728 * CVE-2023-5730 * CVE-2023-5732 CVSS scores: * CVE-2023-5721 ( SUSE ): 7.5 CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H * CVE-2023-5724 ( SUSE ): 6.1 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N * CVE-2023-5725 ( SUSE ): 6.1 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N * CVE-2023-5726 ( SUSE ): 6.1 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N * CVE-2023-5727 ( SUSE ): 6.1 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N * CVE-2023-5728 ( SUSE ): 6.1 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N * CVE-2023-5730 ( SUSE ): 7.5 CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H * CVE-2023-5732 ( SUSE ): 6.1 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N Affected Products: * openSUSE Leap 15.4 * openSUSE Leap 15.5 * SUSE Linux Enterprise Desktop 15 SP4 * SUSE Linux Enterprise Desktop 15 SP5 * SUSE Linux Enterprise High Performance Computing 15 SP4 * SUSE Linux Enterprise High Performance Computing 15 SP5 * SUSE Linux Enterprise Micro 5.3 * SUSE Linux Enterprise Micro 5.4 * SUSE Linux Enterprise Micro 5.5 * SUSE Linux Enterprise Real Time 15 SP4 * SUSE Linux Enterprise Real Time 15 SP5 * SUSE Linux Enterprise Server 15 SP4 * SUSE Linux Enterprise Server 15 SP5 * SUSE Linux Enterprise Server for SAP Applications 15 SP4 * SUSE Linux Enterprise Server for SAP Applications 15 SP5 * SUSE Linux Enterprise Workstation Extension 15 SP4 * SUSE Linux Enterprise Workstation Extension 15 SP5 * SUSE Manager Proxy 4.3 * SUSE Manager Retail Branch Server 4.3 * SUSE Manager Server 4.3 * SUSE Package Hub 15 15-SP4 * SUSE Package Hub 15 15-SP5 An update that solves eight vulnerabilities can now be installed. ## Description: This update for MozillaThunderbird fixes the following issues: * Updated to version 115.4.1: * CVE-2023-5721: Fixed a potential clickjack via queued up rendering. * CVE-2023-5732: Fixed an address bar spoofing via bidirectional characters * CVE-2023-5724: Fixed a crash due to a large WebGL draw. * CVE-2023-5725: Fixed an issue where WebExtensions could open arbitrary URLs. * CVE-2023-5726: Fixed an issue where fullscreen notifications would be obscured by file the open dialog on macOS. * CVE-2023-5727: Fixed a download protection bypass on on Windows. * CVE-2023-5728: Fixed a crash caused by improper object tracking during GC in the JavaScript engine. * CVE-2023-5730: Fixed multiple memory safety issues. ## Patch Instructions: To install this SUSE update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: * openSUSE Leap 15.4 zypper in -t patch openSUSE-SLE-15.4-2023-4302=1 * openSUSE Leap 15.5 zypper in -t patch openSUSE-SLE-15.5-2023-4302=1 * SUSE Package Hub 15 15-SP4 zypper in -t patch SUSE-SLE-Module-Packagehub-Subpackages-15-SP4-2023-4302=1 * SUSE Package Hub 15 15-SP5 zypper in -t patch SUSE-SLE-Module-Packagehub-Subpackages-15-SP5-2023-4302=1 * SUSE Linux Enterprise Workstation Extension 15 SP4 zypper in -t patch SUSE-SLE-Product-WE-15-SP4-2023-4302=1 * SUSE Linux Enterprise Workstation Extension 15 SP5 zypper in -t patch SUSE-SLE-Product-WE-15-SP5-2023-4302=1 ## Package List: * openSUSE Leap 15.4 (aarch64 ppc64le s390x x86_64) * MozillaThunderbird-115.4.1-150200.8.136.1 * MozillaThunderbird-translations-common-115.4.1-150200.8.136.1 * MozillaThunderbird-translations-other-115.4.1-150200.8.136.1 * MozillaThunderbird-debuginfo-115.4.1-150200.8.136.1 * MozillaThunderbird-debugsource-115.4.1-150200.8.136.1 * openSUSE Leap 15.5 (aarch64 ppc64le s390x x86_64) * MozillaThunderbird-115.4.1-150200.8.136.1 * MozillaThunderbird-translations-common-115.4.1-150200.8.136.1 * MozillaThunderbird-translations-other-115.4.1-150200.8.136.1 * MozillaThunderbird-debuginfo-115.4.1-150200.8.136.1 * MozillaThunderbird-debugsource-115.4.1-150200.8.136.1 * SUSE Package Hub 15 15-SP4 (aarch64 ppc64le s390x) * MozillaThunderbird-115.4.1-150200.8.136.1 * MozillaThunderbird-translations-common-115.4.1-150200.8.136.1 * MozillaThunderbird-translations-other-115.4.1-150200.8.136.1 * MozillaThunderbird-debuginfo-115.4.1-150200.8.136.1 * MozillaThunderbird-debugsource-115.4.1-150200.8.136.1 * SUSE Package Hub 15 15-SP5 (aarch64 ppc64le s390x) * MozillaThunderbird-115.4.1-150200.8.136.1 * MozillaThunderbird-translations-common-115.4.1-150200.8.136.1 * MozillaThunderbird-translations-other-115.4.1-150200.8.136.1 * MozillaThunderbird-debuginfo-115.4.1-150200.8.136.1 * MozillaThunderbird-debugsource-115.4.1-150200.8.136.1 * SUSE Linux Enterprise Workstation Extension 15 SP4 (x86_64) * MozillaThunderbird-115.4.1-150200.8.136.1 * MozillaThunderbird-translations-common-115.4.1-150200.8.136.1 * MozillaThunderbird-translations-other-115.4.1-150200.8.136.1 * MozillaThunderbird-debuginfo-115.4.1-150200.8.136.1 * MozillaThunderbird-debugsource-115.4.1-150200.8.136.1 * SUSE Linux Enterprise Workstation Extension 15 SP5 (x86_64) * MozillaThunderbird-115.4.1-150200.8.136.1 * MozillaThunderbird-translations-common-115.4.1-150200.8.136.1 * MozillaThunderbird-translations-other-115.4.1-150200.8.136.1 * MozillaThunderbird-debuginfo-115.4.1-150200.8.136.1 * MozillaThunderbird-debugsource-115.4.1-150200.8.136.1 ## References: * https://www.suse.com/security/cve/CVE-2023-5721.html * https://www.suse.com/security/cve/CVE-2023-5724.html * https://www.suse.com/security/cve/CVE-2023-5725.html * https://www.suse.com/security/cve/CVE-2023-5726.html * https://www.suse.com/security/cve/CVE-2023-5727.html * https://www.suse.com/security/cve/CVE-2023-5728.html * https://www.suse.com/security/cve/CVE-2023-5730.html * https://www.suse.com/security/cve/CVE-2023-5732.html * https://bugzilla.suse.com/show_bug.cgi?id=1216338

1 0

SUSE-SU-2023:4306-1: important: Security update for xwayland
by security＠lists.opensuse.org 31 Oct '23

31 Oct '23

# Security update for xwayland Announcement ID: SUSE-SU-2023:4306-1 Rating: important References: * bsc#1216135 * bsc#1216261 Cross-References: * CVE-2023-5367 * CVE-2023-5574 CVSS scores: * CVE-2023-5367 ( SUSE ): 7.8 CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H * CVE-2023-5367 ( NVD ): 7.8 CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H * CVE-2023-5574 ( SUSE ): 7.4 CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H * CVE-2023-5574 ( NVD ): 7.0 CVSS:3.1/AV:L/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H Affected Products: * openSUSE Leap 15.5 * SUSE Linux Enterprise Desktop 15 SP5 * SUSE Linux Enterprise Server 15 SP5 * SUSE Linux Enterprise Server for SAP Applications 15 SP5 * SUSE Linux Enterprise Workstation Extension 15 SP5 An update that solves two vulnerabilities can now be installed. ## Description: This update for xwayland fixes the following issues: * CVE-2023-5574: Fixed a privilege escalation issue that could be triggered via the Damage extension protocol (bsc#1216261). * CVE-2023-5367: Fixed a memory safety issue in both the XI2 and RandR protocols (bsc#1216135). ## Patch Instructions: To install this SUSE update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: * openSUSE Leap 15.5 zypper in -t patch SUSE-2023-4306=1 openSUSE-SLE-15.5-2023-4306=1 * SUSE Linux Enterprise Workstation Extension 15 SP5 zypper in -t patch SUSE-SLE-Product-WE-15-SP5-2023-4306=1 ## Package List: * openSUSE Leap 15.5 (aarch64 ppc64le s390x x86_64 i586) * xwayland-22.1.5-150500.7.5.1 * xwayland-debuginfo-22.1.5-150500.7.5.1 * xwayland-debugsource-22.1.5-150500.7.5.1 * xwayland-devel-22.1.5-150500.7.5.1 * SUSE Linux Enterprise Workstation Extension 15 SP5 (x86_64) * xwayland-22.1.5-150500.7.5.1 * xwayland-debuginfo-22.1.5-150500.7.5.1 * xwayland-debugsource-22.1.5-150500.7.5.1 ## References: * https://www.suse.com/security/cve/CVE-2023-5367.html * https://www.suse.com/security/cve/CVE-2023-5574.html * https://bugzilla.suse.com/show_bug.cgi?id=1216135 * https://bugzilla.suse.com/show_bug.cgi?id=1216261

1 0