October 2023 - openSUSE Security Announce

SUSE-SU-2023:3957-1: important: Security update for rubygem-puma
by security＠lists.opensuse.org 04 Oct '23

04 Oct '23

# Security update for rubygem-puma Announcement ID: SUSE-SU-2023:3957-1 Rating: important References: * #1214425 Cross-References: * CVE-2023-40175 CVSS scores: * CVE-2023-40175 ( SUSE ): 7.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L * CVE-2023-40175 ( NVD ): 7.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L Affected Products: * openSUSE Leap 15.4 * openSUSE Leap 15.5 * SUSE Linux Enterprise High Availability Extension 15 SP1 * SUSE Linux Enterprise High Availability Extension 15 SP2 * SUSE Linux Enterprise High Availability Extension 15 SP3 * SUSE Linux Enterprise High Availability Extension 15 SP4 * SUSE Linux Enterprise High Availability Extension 15 SP5 * SUSE Linux Enterprise High Performance Computing 15 SP1 * SUSE Linux Enterprise High Performance Computing 15 SP2 * SUSE Linux Enterprise High Performance Computing 15 SP3 * SUSE Linux Enterprise High Performance Computing 15 SP4 * SUSE Linux Enterprise High Performance Computing 15 SP5 * SUSE Linux Enterprise Server 15 SP1 * SUSE Linux Enterprise Server 15 SP1 Business Critical Linux 15-SP1 * SUSE Linux Enterprise Server 15 SP2 * SUSE Linux Enterprise Server 15 SP2 Business Critical Linux 15-SP2 * SUSE Linux Enterprise Server 15 SP3 * SUSE Linux Enterprise Server 15 SP3 Business Critical Linux 15-SP3 * SUSE Linux Enterprise Server 15 SP4 * SUSE Linux Enterprise Server 15 SP5 * SUSE Linux Enterprise Server for SAP Applications 15 SP1 * SUSE Linux Enterprise Server for SAP Applications 15 SP2 * SUSE Linux Enterprise Server for SAP Applications 15 SP3 * SUSE Linux Enterprise Server for SAP Applications 15 SP4 * SUSE Linux Enterprise Server for SAP Applications 15 SP5 * SUSE Manager Proxy 4.0 * SUSE Manager Proxy 4.1 * SUSE Manager Proxy 4.2 * SUSE Manager Proxy 4.3 * SUSE Manager Retail Branch Server 4.0 * SUSE Manager Retail Branch Server 4.1 * SUSE Manager Retail Branch Server 4.2 * SUSE Manager Retail Branch Server 4.3 * SUSE Manager Server 4.0 * SUSE Manager Server 4.1 * SUSE Manager Server 4.2 * SUSE Manager Server 4.3 An update that solves one vulnerability can now be installed. ## Description: This update for rubygem-puma fixes the following issues: * CVE-2023-40175: Fixed HTTP request smuggling when parsing chunked transfer encoding bodies and zero-length content-length headers (bsc#1214425). ## Patch Instructions: To install this SUSE update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: * openSUSE Leap 15.4 zypper in -t patch openSUSE-SLE-15.4-2023-3957=1 * openSUSE Leap 15.5 zypper in -t patch openSUSE-SLE-15.5-2023-3957=1 * SUSE Linux Enterprise High Availability Extension 15 SP1 zypper in -t patch SUSE-SLE-Product-HA-15-SP1-2023-3957=1 * SUSE Linux Enterprise High Availability Extension 15 SP2 zypper in -t patch SUSE-SLE-Product-HA-15-SP2-2023-3957=1 * SUSE Linux Enterprise High Availability Extension 15 SP3 zypper in -t patch SUSE-SLE-Product-HA-15-SP3-2023-3957=1 * SUSE Linux Enterprise High Availability Extension 15 SP4 zypper in -t patch SUSE-SLE-Product-HA-15-SP4-2023-3957=1 * SUSE Linux Enterprise High Availability Extension 15 SP5 zypper in -t patch SUSE-SLE-Product-HA-15-SP5-2023-3957=1 ## Package List: * openSUSE Leap 15.4 (aarch64 ppc64le s390x x86_64) * ruby2.5-rubygem-puma-debuginfo-4.3.12-150000.3.12.1 * ruby2.5-rubygem-puma-doc-4.3.12-150000.3.12.1 * ruby2.5-rubygem-puma-4.3.12-150000.3.12.1 * rubygem-puma-debugsource-4.3.12-150000.3.12.1 * openSUSE Leap 15.5 (aarch64 ppc64le s390x x86_64) * ruby2.5-rubygem-puma-debuginfo-4.3.12-150000.3.12.1 * ruby2.5-rubygem-puma-doc-4.3.12-150000.3.12.1 * ruby2.5-rubygem-puma-4.3.12-150000.3.12.1 * rubygem-puma-debugsource-4.3.12-150000.3.12.1 * SUSE Linux Enterprise High Availability Extension 15 SP1 (aarch64 ppc64le s390x x86_64) * ruby2.5-rubygem-puma-debuginfo-4.3.12-150000.3.12.1 * ruby2.5-rubygem-puma-4.3.12-150000.3.12.1 * SUSE Linux Enterprise High Availability Extension 15 SP2 (aarch64 ppc64le s390x x86_64) * ruby2.5-rubygem-puma-debuginfo-4.3.12-150000.3.12.1 * ruby2.5-rubygem-puma-4.3.12-150000.3.12.1 * SUSE Linux Enterprise High Availability Extension 15 SP3 (aarch64 ppc64le s390x x86_64) * ruby2.5-rubygem-puma-debuginfo-4.3.12-150000.3.12.1 * rubygem-puma-debugsource-4.3.12-150000.3.12.1 * ruby2.5-rubygem-puma-4.3.12-150000.3.12.1 * SUSE Linux Enterprise High Availability Extension 15 SP4 (aarch64 ppc64le s390x x86_64) * ruby2.5-rubygem-puma-debuginfo-4.3.12-150000.3.12.1 * rubygem-puma-debugsource-4.3.12-150000.3.12.1 * ruby2.5-rubygem-puma-4.3.12-150000.3.12.1 * SUSE Linux Enterprise High Availability Extension 15 SP5 (aarch64 ppc64le s390x x86_64) * ruby2.5-rubygem-puma-debuginfo-4.3.12-150000.3.12.1 * rubygem-puma-debugsource-4.3.12-150000.3.12.1 * ruby2.5-rubygem-puma-4.3.12-150000.3.12.1 ## References: * https://www.suse.com/security/cve/CVE-2023-40175.html * https://bugzilla.suse.com/show_bug.cgi?id=1214425

1 0

SUSE-SU-2023:3963-1: moderate: Security update for libX11
by security＠lists.opensuse.org 04 Oct '23

04 Oct '23

# Security update for libX11 Announcement ID: SUSE-SU-2023:3963-1 Rating: moderate References: * #1215683 * #1215684 * #1215685 Cross-References: * CVE-2023-43785 * CVE-2023-43786 * CVE-2023-43787 CVSS scores: * CVE-2023-43785 ( SUSE ): 4.4 CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:L * CVE-2023-43786 ( SUSE ): 5.5 CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H * CVE-2023-43787 ( SUSE ): 5.3 CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:L Affected Products: * Basesystem Module 15-SP4 * Basesystem Module 15-SP5 * openSUSE Leap 15.4 * openSUSE Leap 15.5 * SUSE Linux Enterprise Desktop 15 SP4 * SUSE Linux Enterprise Desktop 15 SP5 * SUSE Linux Enterprise High Performance Computing 15 SP4 * SUSE Linux Enterprise High Performance Computing 15 SP5 * SUSE Linux Enterprise Micro 5.2 * SUSE Linux Enterprise Micro 5.3 * SUSE Linux Enterprise Micro 5.4 * SUSE Linux Enterprise Micro 5.5 * SUSE Linux Enterprise Micro for Rancher 5.2 * SUSE Linux Enterprise Micro for Rancher 5.3 * SUSE Linux Enterprise Micro for Rancher 5.4 * SUSE Linux Enterprise Real Time 15 SP4 * SUSE Linux Enterprise Real Time 15 SP5 * SUSE Linux Enterprise Server 15 SP4 * SUSE Linux Enterprise Server 15 SP5 * SUSE Linux Enterprise Server for SAP Applications 15 SP4 * SUSE Linux Enterprise Server for SAP Applications 15 SP5 * SUSE Manager Proxy 4.2 * SUSE Manager Proxy 4.3 * SUSE Manager Retail Branch Server 4.2 * SUSE Manager Retail Branch Server 4.3 * SUSE Manager Server 4.2 * SUSE Manager Server 4.3 An update that solves three vulnerabilities can now be installed. ## Description: This update for libX11 fixes the following issues: * CVE-2023-43786: Fixed stack exhaustion from infinite recursion in PutSubImage() (bsc#1215684). * CVE-2023-43787: Fixed integer overflow in XCreateImage() leading to a heap overflow (bsc#1215685). * CVE-2023-43785: Fixed out-of-bounds memory access in _XkbReadKeySyms() (bsc#1215683). ## Patch Instructions: To install this SUSE update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: * openSUSE Leap 15.5 zypper in -t patch openSUSE-SLE-15.5-2023-3963=1 * SUSE Linux Enterprise Micro for Rancher 5.3 zypper in -t patch SUSE-SLE-Micro-5.3-2023-3963=1 * SUSE Linux Enterprise Micro 5.3 zypper in -t patch SUSE-SLE-Micro-5.3-2023-3963=1 * SUSE Linux Enterprise Micro for Rancher 5.4 zypper in -t patch SUSE-SLE-Micro-5.4-2023-3963=1 * SUSE Linux Enterprise Micro 5.4 zypper in -t patch SUSE-SLE-Micro-5.4-2023-3963=1 * SUSE Linux Enterprise Micro 5.5 zypper in -t patch SUSE-SLE-Micro-5.5-2023-3963=1 * Basesystem Module 15-SP4 zypper in -t patch SUSE-SLE-Module-Basesystem-15-SP4-2023-3963=1 * Basesystem Module 15-SP5 zypper in -t patch SUSE-SLE-Module-Basesystem-15-SP5-2023-3963=1 * SUSE Manager Proxy 4.2 zypper in -t patch SUSE-SLE-Product-SUSE-Manager-Proxy-4.2-2023-3963=1 * SUSE Manager Retail Branch Server 4.2 zypper in -t patch SUSE-SLE-Product-SUSE-Manager-Retail-Branch- Server-4.2-2023-3963=1 * SUSE Manager Server 4.2 zypper in -t patch SUSE-SLE-Product-SUSE-Manager-Server-4.2-2023-3963=1 * SUSE Linux Enterprise Micro 5.2 zypper in -t patch SUSE-SUSE-MicroOS-5.2-2023-3963=1 * SUSE Linux Enterprise Micro for Rancher 5.2 zypper in -t patch SUSE-SUSE-MicroOS-5.2-2023-3963=1 * openSUSE Leap 15.4 zypper in -t patch openSUSE-SLE-15.4-2023-3963=1 ## Package List: * openSUSE Leap 15.5 (aarch64 ppc64le s390x x86_64) * libX11-xcb1-1.6.5-150000.3.33.1 * libX11-6-1.6.5-150000.3.33.1 * libX11-6-debuginfo-1.6.5-150000.3.33.1 * libX11-xcb1-debuginfo-1.6.5-150000.3.33.1 * libX11-debugsource-1.6.5-150000.3.33.1 * libX11-devel-1.6.5-150000.3.33.1 * openSUSE Leap 15.5 (x86_64) * libX11-6-32bit-debuginfo-1.6.5-150000.3.33.1 * libX11-devel-32bit-1.6.5-150000.3.33.1 * libX11-6-32bit-1.6.5-150000.3.33.1 * libX11-xcb1-32bit-debuginfo-1.6.5-150000.3.33.1 * libX11-xcb1-32bit-1.6.5-150000.3.33.1 * openSUSE Leap 15.5 (noarch) * libX11-data-1.6.5-150000.3.33.1 * SUSE Linux Enterprise Micro for Rancher 5.3 (aarch64 s390x x86_64) * libX11-xcb1-1.6.5-150000.3.33.1 * libX11-6-1.6.5-150000.3.33.1 * libX11-6-debuginfo-1.6.5-150000.3.33.1 * libX11-xcb1-debuginfo-1.6.5-150000.3.33.1 * libX11-debugsource-1.6.5-150000.3.33.1 * SUSE Linux Enterprise Micro for Rancher 5.3 (noarch) * libX11-data-1.6.5-150000.3.33.1 * SUSE Linux Enterprise Micro 5.3 (aarch64 s390x x86_64) * libX11-xcb1-1.6.5-150000.3.33.1 * libX11-6-1.6.5-150000.3.33.1 * libX11-6-debuginfo-1.6.5-150000.3.33.1 * libX11-xcb1-debuginfo-1.6.5-150000.3.33.1 * libX11-debugsource-1.6.5-150000.3.33.1 * SUSE Linux Enterprise Micro 5.3 (noarch) * libX11-data-1.6.5-150000.3.33.1 * SUSE Linux Enterprise Micro for Rancher 5.4 (aarch64 s390x x86_64) * libX11-xcb1-1.6.5-150000.3.33.1 * libX11-6-1.6.5-150000.3.33.1 * libX11-6-debuginfo-1.6.5-150000.3.33.1 * libX11-xcb1-debuginfo-1.6.5-150000.3.33.1 * libX11-debugsource-1.6.5-150000.3.33.1 * SUSE Linux Enterprise Micro for Rancher 5.4 (noarch) * libX11-data-1.6.5-150000.3.33.1 * SUSE Linux Enterprise Micro 5.4 (aarch64 s390x x86_64) * libX11-xcb1-1.6.5-150000.3.33.1 * libX11-6-1.6.5-150000.3.33.1 * libX11-6-debuginfo-1.6.5-150000.3.33.1 * libX11-xcb1-debuginfo-1.6.5-150000.3.33.1 * libX11-debugsource-1.6.5-150000.3.33.1 * SUSE Linux Enterprise Micro 5.4 (noarch) * libX11-data-1.6.5-150000.3.33.1 * SUSE Linux Enterprise Micro 5.5 (aarch64 s390x x86_64) * libX11-xcb1-1.6.5-150000.3.33.1 * libX11-6-1.6.5-150000.3.33.1 * libX11-6-debuginfo-1.6.5-150000.3.33.1 * libX11-xcb1-debuginfo-1.6.5-150000.3.33.1 * libX11-debugsource-1.6.5-150000.3.33.1 * SUSE Linux Enterprise Micro 5.5 (noarch) * libX11-data-1.6.5-150000.3.33.1 * Basesystem Module 15-SP4 (aarch64 ppc64le s390x x86_64) * libX11-xcb1-1.6.5-150000.3.33.1 * libX11-6-1.6.5-150000.3.33.1 * libX11-6-debuginfo-1.6.5-150000.3.33.1 * libX11-xcb1-debuginfo-1.6.5-150000.3.33.1 * libX11-debugsource-1.6.5-150000.3.33.1 * libX11-devel-1.6.5-150000.3.33.1 * Basesystem Module 15-SP4 (noarch) * libX11-data-1.6.5-150000.3.33.1 * Basesystem Module 15-SP4 (x86_64) * libX11-6-32bit-debuginfo-1.6.5-150000.3.33.1 * libX11-xcb1-32bit-1.6.5-150000.3.33.1 * libX11-6-32bit-1.6.5-150000.3.33.1 * libX11-xcb1-32bit-debuginfo-1.6.5-150000.3.33.1 * Basesystem Module 15-SP5 (aarch64 ppc64le s390x x86_64) * libX11-xcb1-1.6.5-150000.3.33.1 * libX11-6-1.6.5-150000.3.33.1 * libX11-6-debuginfo-1.6.5-150000.3.33.1 * libX11-xcb1-debuginfo-1.6.5-150000.3.33.1 * libX11-debugsource-1.6.5-150000.3.33.1 * libX11-devel-1.6.5-150000.3.33.1 * Basesystem Module 15-SP5 (noarch) * libX11-data-1.6.5-150000.3.33.1 * Basesystem Module 15-SP5 (x86_64) * libX11-xcb1-32bit-debuginfo-1.6.5-150000.3.33.1 * libX11-6-32bit-debuginfo-1.6.5-150000.3.33.1 * libX11-6-32bit-1.6.5-150000.3.33.1 * libX11-xcb1-32bit-1.6.5-150000.3.33.1 * SUSE Manager Proxy 4.2 (x86_64) * libX11-xcb1-1.6.5-150000.3.33.1 * libX11-6-32bit-debuginfo-1.6.5-150000.3.33.1 * libX11-xcb1-32bit-1.6.5-150000.3.33.1 * libX11-6-32bit-1.6.5-150000.3.33.1 * libX11-6-1.6.5-150000.3.33.1 * libX11-xcb1-32bit-debuginfo-1.6.5-150000.3.33.1 * libX11-6-debuginfo-1.6.5-150000.3.33.1 * libX11-xcb1-debuginfo-1.6.5-150000.3.33.1 * libX11-debugsource-1.6.5-150000.3.33.1 * libX11-devel-1.6.5-150000.3.33.1 * SUSE Manager Proxy 4.2 (noarch) * libX11-data-1.6.5-150000.3.33.1 * SUSE Manager Retail Branch Server 4.2 (x86_64) * libX11-xcb1-1.6.5-150000.3.33.1 * libX11-6-32bit-debuginfo-1.6.5-150000.3.33.1 * libX11-xcb1-32bit-1.6.5-150000.3.33.1 * libX11-6-32bit-1.6.5-150000.3.33.1 * libX11-6-1.6.5-150000.3.33.1 * libX11-xcb1-32bit-debuginfo-1.6.5-150000.3.33.1 * libX11-6-debuginfo-1.6.5-150000.3.33.1 * libX11-xcb1-debuginfo-1.6.5-150000.3.33.1 * libX11-debugsource-1.6.5-150000.3.33.1 * libX11-devel-1.6.5-150000.3.33.1 * SUSE Manager Retail Branch Server 4.2 (noarch) * libX11-data-1.6.5-150000.3.33.1 * SUSE Manager Server 4.2 (ppc64le s390x x86_64) * libX11-xcb1-1.6.5-150000.3.33.1 * libX11-6-1.6.5-150000.3.33.1 * libX11-6-debuginfo-1.6.5-150000.3.33.1 * libX11-xcb1-debuginfo-1.6.5-150000.3.33.1 * libX11-debugsource-1.6.5-150000.3.33.1 * libX11-devel-1.6.5-150000.3.33.1 * SUSE Manager Server 4.2 (noarch) * libX11-data-1.6.5-150000.3.33.1 * SUSE Manager Server 4.2 (x86_64) * libX11-6-32bit-1.6.5-150000.3.33.1 * libX11-6-32bit-debuginfo-1.6.5-150000.3.33.1 * libX11-xcb1-32bit-1.6.5-150000.3.33.1 * libX11-xcb1-32bit-debuginfo-1.6.5-150000.3.33.1 * SUSE Linux Enterprise Micro 5.2 (aarch64 s390x x86_64) * libX11-xcb1-1.6.5-150000.3.33.1 * libX11-6-1.6.5-150000.3.33.1 * libX11-6-debuginfo-1.6.5-150000.3.33.1 * libX11-xcb1-debuginfo-1.6.5-150000.3.33.1 * libX11-debugsource-1.6.5-150000.3.33.1 * SUSE Linux Enterprise Micro 5.2 (noarch) * libX11-data-1.6.5-150000.3.33.1 * SUSE Linux Enterprise Micro for Rancher 5.2 (aarch64 s390x x86_64) * libX11-xcb1-1.6.5-150000.3.33.1 * libX11-6-1.6.5-150000.3.33.1 * libX11-6-debuginfo-1.6.5-150000.3.33.1 * libX11-xcb1-debuginfo-1.6.5-150000.3.33.1 * libX11-debugsource-1.6.5-150000.3.33.1 * SUSE Linux Enterprise Micro for Rancher 5.2 (noarch) * libX11-data-1.6.5-150000.3.33.1 * openSUSE Leap 15.4 (aarch64 ppc64le s390x x86_64) * libX11-xcb1-1.6.5-150000.3.33.1 * libX11-6-1.6.5-150000.3.33.1 * libX11-6-debuginfo-1.6.5-150000.3.33.1 * libX11-xcb1-debuginfo-1.6.5-150000.3.33.1 * libX11-debugsource-1.6.5-150000.3.33.1 * libX11-devel-1.6.5-150000.3.33.1 * openSUSE Leap 15.4 (x86_64) * libX11-6-32bit-debuginfo-1.6.5-150000.3.33.1 * libX11-devel-32bit-1.6.5-150000.3.33.1 * libX11-6-32bit-1.6.5-150000.3.33.1 * libX11-xcb1-32bit-debuginfo-1.6.5-150000.3.33.1 * libX11-xcb1-32bit-1.6.5-150000.3.33.1 * openSUSE Leap 15.4 (noarch) * libX11-data-1.6.5-150000.3.33.1 ## References: * https://www.suse.com/security/cve/CVE-2023-43785.html * https://www.suse.com/security/cve/CVE-2023-43786.html * https://www.suse.com/security/cve/CVE-2023-43787.html * https://bugzilla.suse.com/show_bug.cgi?id=1215683 * https://bugzilla.suse.com/show_bug.cgi?id=1215684 * https://bugzilla.suse.com/show_bug.cgi?id=1215685

1 0

SUSE-SU-2023:3965-1: moderate: Security update for libXpm
by security＠lists.opensuse.org 04 Oct '23

04 Oct '23

# Security update for libXpm Announcement ID: SUSE-SU-2023:3965-1 Rating: moderate References: * #1215686 * #1215687 Cross-References: * CVE-2023-43788 * CVE-2023-43789 CVSS scores: * CVE-2023-43788 ( SUSE ): 6.1 CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:H * CVE-2023-43789 ( SUSE ): 5.5 CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H Affected Products: * Basesystem Module 15-SP4 * Basesystem Module 15-SP5 * openSUSE Leap 15.4 * openSUSE Leap 15.5 * SUSE Linux Enterprise Desktop 15 SP4 * SUSE Linux Enterprise Desktop 15 SP5 * SUSE Linux Enterprise High Performance Computing 15 SP4 * SUSE Linux Enterprise High Performance Computing 15 SP5 * SUSE Linux Enterprise Micro 5.3 * SUSE Linux Enterprise Micro 5.4 * SUSE Linux Enterprise Micro 5.5 * SUSE Linux Enterprise Real Time 15 SP4 * SUSE Linux Enterprise Real Time 15 SP5 * SUSE Linux Enterprise Server 15 SP4 * SUSE Linux Enterprise Server 15 SP5 * SUSE Linux Enterprise Server for SAP Applications 15 SP4 * SUSE Linux Enterprise Server for SAP Applications 15 SP5 * SUSE Linux Enterprise Workstation Extension 15 SP4 * SUSE Linux Enterprise Workstation Extension 15 SP5 * SUSE Manager Proxy 4.2 * SUSE Manager Proxy 4.3 * SUSE Manager Retail Branch Server 4.2 * SUSE Manager Retail Branch Server 4.3 * SUSE Manager Server 4.2 * SUSE Manager Server 4.3 * SUSE Package Hub 15 15-SP4 * SUSE Package Hub 15 15-SP5 An update that solves two vulnerabilities can now be installed. ## Description: This update for libXpm fixes the following issues: * CVE-2023-43788: Fixed an out of bounds read when creating an image (bsc#1215686). * CVE-2023-43789: Fixed an out of bounds read when parsing an XPM file with a corrupted colormap (bsc#1215687). ## Patch Instructions: To install this SUSE update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: * openSUSE Leap 15.4 zypper in -t patch openSUSE-SLE-15.4-2023-3965=1 * openSUSE Leap 15.5 zypper in -t patch openSUSE-SLE-15.5-2023-3965=1 * Basesystem Module 15-SP4 zypper in -t patch SUSE-SLE-Module-Basesystem-15-SP4-2023-3965=1 * Basesystem Module 15-SP5 zypper in -t patch SUSE-SLE-Module-Basesystem-15-SP5-2023-3965=1 * SUSE Package Hub 15 15-SP4 zypper in -t patch SUSE-SLE-Module-Packagehub-Subpackages-15-SP4-2023-3965=1 * SUSE Package Hub 15 15-SP5 zypper in -t patch SUSE-SLE-Module-Packagehub-Subpackages-15-SP5-2023-3965=1 * SUSE Manager Proxy 4.2 zypper in -t patch SUSE-SLE-Product-SUSE-Manager-Proxy-4.2-2023-3965=1 * SUSE Manager Retail Branch Server 4.2 zypper in -t patch SUSE-SLE-Product-SUSE-Manager-Retail-Branch- Server-4.2-2023-3965=1 * SUSE Manager Server 4.2 zypper in -t patch SUSE-SLE-Product-SUSE-Manager-Server-4.2-2023-3965=1 * SUSE Linux Enterprise Workstation Extension 15 SP4 zypper in -t patch SUSE-SLE-Product-WE-15-SP4-2023-3965=1 * SUSE Linux Enterprise Workstation Extension 15 SP5 zypper in -t patch SUSE-SLE-Product-WE-15-SP5-2023-3965=1 ## Package List: * openSUSE Leap 15.4 (aarch64 ppc64le s390x x86_64) * libXpm4-debuginfo-3.5.12-150000.3.10.1 * libXpm-tools-3.5.12-150000.3.10.1 * libXpm4-3.5.12-150000.3.10.1 * libXpm-tools-debuginfo-3.5.12-150000.3.10.1 * libXpm-devel-3.5.12-150000.3.10.1 * libXpm-debugsource-3.5.12-150000.3.10.1 * openSUSE Leap 15.4 (x86_64) * libXpm4-32bit-debuginfo-3.5.12-150000.3.10.1 * libXpm-devel-32bit-3.5.12-150000.3.10.1 * libXpm4-32bit-3.5.12-150000.3.10.1 * openSUSE Leap 15.5 (aarch64 ppc64le s390x x86_64) * libXpm4-debuginfo-3.5.12-150000.3.10.1 * libXpm-tools-3.5.12-150000.3.10.1 * libXpm4-3.5.12-150000.3.10.1 * libXpm-tools-debuginfo-3.5.12-150000.3.10.1 * libXpm-devel-3.5.12-150000.3.10.1 * libXpm-debugsource-3.5.12-150000.3.10.1 * openSUSE Leap 15.5 (x86_64) * libXpm4-32bit-debuginfo-3.5.12-150000.3.10.1 * libXpm-devel-32bit-3.5.12-150000.3.10.1 * libXpm4-32bit-3.5.12-150000.3.10.1 * Basesystem Module 15-SP4 (aarch64 ppc64le s390x x86_64) * libXpm4-3.5.12-150000.3.10.1 * libXpm-devel-3.5.12-150000.3.10.1 * libXpm-debugsource-3.5.12-150000.3.10.1 * libXpm4-debuginfo-3.5.12-150000.3.10.1 * Basesystem Module 15-SP5 (aarch64 ppc64le s390x x86_64) * libXpm4-3.5.12-150000.3.10.1 * libXpm-devel-3.5.12-150000.3.10.1 * libXpm-debugsource-3.5.12-150000.3.10.1 * libXpm4-debuginfo-3.5.12-150000.3.10.1 * SUSE Package Hub 15 15-SP4 (x86_64) * libXpm4-32bit-debuginfo-3.5.12-150000.3.10.1 * libXpm4-32bit-3.5.12-150000.3.10.1 * libXpm-debugsource-3.5.12-150000.3.10.1 * SUSE Package Hub 15 15-SP5 (x86_64) * libXpm4-32bit-debuginfo-3.5.12-150000.3.10.1 * libXpm4-32bit-3.5.12-150000.3.10.1 * libXpm-debugsource-3.5.12-150000.3.10.1 * SUSE Manager Proxy 4.2 (x86_64) * libXpm4-3.5.12-150000.3.10.1 * libXpm-devel-3.5.12-150000.3.10.1 * libXpm-debugsource-3.5.12-150000.3.10.1 * libXpm4-debuginfo-3.5.12-150000.3.10.1 * SUSE Manager Retail Branch Server 4.2 (x86_64) * libXpm4-3.5.12-150000.3.10.1 * libXpm-devel-3.5.12-150000.3.10.1 * libXpm-debugsource-3.5.12-150000.3.10.1 * libXpm4-debuginfo-3.5.12-150000.3.10.1 * SUSE Manager Server 4.2 (ppc64le s390x x86_64) * libXpm4-3.5.12-150000.3.10.1 * libXpm-devel-3.5.12-150000.3.10.1 * libXpm-debugsource-3.5.12-150000.3.10.1 * libXpm4-debuginfo-3.5.12-150000.3.10.1 * SUSE Linux Enterprise Workstation Extension 15 SP4 (x86_64) * libXpm-tools-3.5.12-150000.3.10.1 * libXpm-debugsource-3.5.12-150000.3.10.1 * libXpm-tools-debuginfo-3.5.12-150000.3.10.1 * SUSE Linux Enterprise Workstation Extension 15 SP5 (x86_64) * libXpm-tools-3.5.12-150000.3.10.1 * libXpm-debugsource-3.5.12-150000.3.10.1 * libXpm-tools-debuginfo-3.5.12-150000.3.10.1 ## References: * https://www.suse.com/security/cve/CVE-2023-43788.html * https://www.suse.com/security/cve/CVE-2023-43789.html * https://bugzilla.suse.com/show_bug.cgi?id=1215686 * https://bugzilla.suse.com/show_bug.cgi?id=1215687

1 0

SUSE-SU-2023:3964-1: important: Security update for the Linux Kernel
by security＠lists.opensuse.org 04 Oct '23

04 Oct '23

# Security update for the Linux Kernel Announcement ID: SUSE-SU-2023:3964-1 Rating: important References: * #1023051 * #1120059 * #1177719 * #1188885 * #1193629 * #1194869 * #1205462 * #1208902 * #1208949 * #1209284 * #1209799 * #1210048 * #1210448 * #1212091 * #1212142 * #1212526 * #1212857 * #1212873 * #1213026 * #1213123 * #1213546 * #1213580 * #1213601 * #1213666 * #1213757 * #1213759 * #1213916 * #1213921 * #1213927 * #1213946 * #1213968 * #1213970 * #1213971 * #1214000 * #1214019 * #1214120 * #1214149 * #1214180 * #1214238 * #1214285 * #1214297 * #1214299 * #1214350 * #1214368 * #1214370 * #1214371 * #1214372 * #1214380 * #1214386 * #1214392 * #1214393 * #1214397 * #1214428 * #1214451 * #1214635 * #1214659 * #1214661 * #1214729 * #1214742 * #1214743 * #1214756 * #1215522 * #1215523 * #1215552 * #1215553 * PED-4579 * PED-4759 * PED-4927 * PED-4929 * PED-5738 * PED-6003 * PED-6004 Cross-References: * CVE-2023-2007 * CVE-2023-20588 * CVE-2023-34319 * CVE-2023-3610 * CVE-2023-37453 * CVE-2023-3772 * CVE-2023-3863 * CVE-2023-4128 * CVE-2023-4133 * CVE-2023-4134 * CVE-2023-4147 * CVE-2023-4194 * CVE-2023-4273 * CVE-2023-4387 * CVE-2023-4459 * CVE-2023-4569 CVSS scores: * CVE-2023-2007 ( SUSE ): 4.4 CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:N * CVE-2023-2007 ( NVD ): 7.8 CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H * CVE-2023-20588 ( SUSE ): 6.0 CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:C/C:H/I:N/A:N * CVE-2023-20588 ( NVD ): 5.5 CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N * CVE-2023-34319 ( SUSE ): 6.5 CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:N/I:N/A:H * CVE-2023-34319 ( NVD ): 7.8 CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H * CVE-2023-3610 ( SUSE ): 7.8 CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H * CVE-2023-3610 ( NVD ): 7.8 CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H * CVE-2023-37453 ( SUSE ): 4.6 CVSS:3.1/AV:P/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H * CVE-2023-37453 ( NVD ): 4.6 CVSS:3.1/AV:P/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H * CVE-2023-3772 ( SUSE ): 5.5 CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H * CVE-2023-3772 ( NVD ): 5.5 CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H * CVE-2023-3863 ( SUSE ): 7.4 CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H * CVE-2023-3863 ( NVD ): 6.4 CVSS:3.1/AV:L/AC:H/PR:H/UI:N/S:U/C:H/I:H/A:H * CVE-2023-4128 ( SUSE ): 6.7 CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H * CVE-2023-4128 ( NVD ): 7.8 CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H * CVE-2023-4133 ( SUSE ): 5.1 CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H * CVE-2023-4133 ( NVD ): 5.5 CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H * CVE-2023-4134 ( SUSE ): 4.1 CVSS:3.1/AV:L/AC:H/PR:H/UI:N/S:U/C:N/I:N/A:H * CVE-2023-4147 ( SUSE ): 7.8 CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H * CVE-2023-4147 ( NVD ): 7.8 CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H * CVE-2023-4194 ( SUSE ): 4.7 CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:N/A:N * CVE-2023-4194 ( NVD ): 5.5 CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N * CVE-2023-4273 ( SUSE ): 7.8 CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H * CVE-2023-4273 ( NVD ): 6.0 CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:N * CVE-2023-4387 ( SUSE ): 6.6 CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:H/I:H/A:H * CVE-2023-4387 ( NVD ): 7.1 CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:H * CVE-2023-4459 ( SUSE ): 6.5 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H * CVE-2023-4459 ( NVD ): 6.5 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H * CVE-2023-4569 ( SUSE ): 3.3 CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L * CVE-2023-4569 ( NVD ): 5.5 CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N Affected Products: * openSUSE Leap 15.4 * SUSE Linux Enterprise High Performance Computing 15 SP4 * SUSE Linux Enterprise Live Patching 15-SP4 * SUSE Linux Enterprise Micro 5.3 * SUSE Linux Enterprise Micro 5.4 * SUSE Linux Enterprise Micro for Rancher 5.3 * SUSE Linux Enterprise Micro for Rancher 5.4 * SUSE Linux Enterprise Real Time 15 SP4 * SUSE Linux Enterprise Server 15 SP4 * SUSE Linux Enterprise Server for SAP Applications 15 SP4 * SUSE Real Time Module 15-SP4 An update that solves 16 vulnerabilities, contains seven features and has 49 security fixes can now be installed. ## Description: The SUSE Linux Enterprise 15 SP4 RT kernel was updated to receive various security and bugfixes. The following security bugs were fixed: * CVE-2023-2007: Fixed a flaw in the DPT I2O Controller driver that could allow an attacker to escalate privileges and execute arbitrary code in the context of the kernel (bsc#1210448). * CVE-2023-20588: Fixed a division-by-zero error on some AMD processors that can potentially return speculative data resulting in loss of confidentiality (bsc#1213927). * CVE-2023-34319: Fixed buffer overrun triggered by unusual packet in xen/netback (XSA-432) (bsc#1213546). * CVE-2023-3610: Fixed use-after-free vulnerability in nf_tables can be exploited to achieve local privilege escalation (bsc#1213580). * CVE-2023-37453: Fixed oversight in SuperSpeed initialization (bsc#1213123). * CVE-2023-3772: Fixed a flaw in XFRM subsystem that may have allowed a malicious user with CAP_NET_ADMIN privileges to directly dereference a NULL pointer leading to a possible kernel crash and denial of service (bsc#1213666). * CVE-2023-3863: Fixed a use-after-free flaw was found in nfc_llcp_find_local that allowed a local user with special privileges to impact a kernel information leak issue (bsc#1213601). * CVE-2023-4128: Fixed a use-after-free flaw in net/sched/cls_fw.c that allowed a local attacker to perform a local privilege escalation due to incorrect handling of the existing filter, leading to a kernel information leak issue (bsc#1214149). * CVE-2023-4133: Fixed use after free bugs caused by circular dependency problem in cxgb4 (bsc#1213970). * CVE-2023-4134: Fixed use-after-free in cyttsp4_watchdog_work() (bsc#1213971). * CVE-2023-4147: Fixed use-after-free in nf_tables_newrule (bsc#1213968). * CVE-2023-4194: Fixed a type confusion in net tun_chr_open() (bsc#1214019). * CVE-2023-4273: Fixed a flaw in the exFAT driver of the Linux kernel that alloawed a local privileged attacker to overflow the kernel stack (bsc#1214120). * CVE-2023-4387: Fixed use-after-free flaw in vmxnet3_rq_alloc_rx_buf that could allow a local attacker to crash the system due to a double-free (bsc#1214350). * CVE-2023-4459: Fixed a NULL pointer dereference flaw in vmxnet3_rq_cleanup that may have allowed a local attacker with normal user privilege to cause a denial of service (bsc#1214451). * CVE-2023-4569: Fixed information leak in nft_set_catchall_flush in net/netfilter/nf_tables_api.c (bsc#1214729). The following non-security bugs were fixed: * Drop amdgpu patch causing spamming (bsc#1215523) * acpi: processor: perflib: avoid updating frequency qos unnecessarily (git- fixes). * acpi: processor: perflib: use the "no limit" frequency qos (git-fixes). * acpi: x86: s2idle: fix a logic error parsing amd constraints table (git- fixes). * alsa: ac97: fix possible error value of *rac97 (git-fixes). * alsa: hda/cs8409: support new dell dolphin variants (git-fixes). * alsa: hda/realtek - remodified 3k pull low procedure (git-fixes). * alsa: hda/realtek: add quirk for hp victus 16-d1xxx to enable mute led (git- fixes). * alsa: hda/realtek: add quirk for mute leds on hp envy x360 15-eu0xxx (git- fixes). * alsa: hda/realtek: add quirks for hp g11 laptops (git-fixes). * alsa: hda/realtek: switch dell oasis models to use spi (git-fixes). * alsa: pcm: fix missing fixup call in compat hw_refine ioctl (git-fixes). * alsa: usb-audio: add support for mythware xa001au capture and playback interfaces (git-fixes). * alsa: usb-audio: fix init call orders for uac1 (git-fixes). * alsa: ymfpci: fix the missing snd_card_free() call at probe error (git- fixes). * amba: bus: fix refcount leak (git-fixes). * arm64: dts: imx8mn-var-som: add missing pull-up for onboard phy reset pinmux (git-fixes). * arm64: dts: qcom: qrb5165-rb5: fix thermal zone conflict (git-fixes). * arm64: dts: rockchip: disable hs400 for emmc on rock pi 4 (git-fixes). * arm: dts: imx6dl: prtrvt, prtvt7, prti6q, prtwd2: fix usb related warnings (git-fixes). * arm: dts: imx6sll: fixup of operating points (git-fixes). * arm: spear: do not use timer namespace for timer_shutdown() function (bsc#1213970). * asoc: lower "no backend dais enabled for ... port" log severity (git-fixes). * asoc: meson: axg-tdm-formatter: fix channel slot allocation (git-fixes). * asoc: rt5665: add missed regulator_bulk_disable (git-fixes). * asoc: sof: intel: fix soundwire/hdaudio mutual exclusion (git-fixes). * asoc: stac9766: fix build errors with regmap_ac97 (git-fixes). * asoc: tegra: fix sfc conversion for few rates (git-fixes). * audit: fix possible soft lockup in __audit_inode_child() (git-fixes). * backlight/bd6107: compare against struct fb_info.device (git-fixes). * backlight/gpio_backlight: compare against struct fb_info.device (git-fixes). * backlight/lv5207lp: compare against struct fb_info.device (git-fixes). * batman-adv: do not get eth header before batadv_check_management_packet (git-fixes). * batman-adv: do not increase mtu when set by user (git-fixes). * batman-adv: fix batadv_v_ogm_aggr_send memory leak (git-fixes). * batman-adv: fix tt global entry leak when client roamed back (git-fixes). * batman-adv: hold rtnl lock during mtu update via netlink (git-fixes). * batman-adv: trigger events for auto adjusted mtu (git-fixes). * bluetooth: btusb: add mt7922 bluetooth id for the asus ally (git-fixes). * bluetooth: btusb: do not call kfree_skb() under spin_lock_irqsave() (git- fixes). * bluetooth: fix potential use-after-free when clear keys (git-fixes). * bluetooth: l2cap: fix use-after-free (git-fixes). * bluetooth: l2cap: fix use-after-free in l2cap_sock_ready_cb (git-fixes). * bluetooth: nokia: fix value check in nokia_bluetooth_serdev_probe() (git- fixes). * bluetooth: remove unused declaration amp_read_loc_info() (git-fixes). * bnx2x: fix page fault following eeh recovery (bsc#1214299). * bpf: disable preemption in bpf_event_output (git-fixes). * bus: ti-sysc: fix build warning for 64-bit build (git-fixes). * bus: ti-sysc: fix cast to enum warning (git-fixes). * bus: ti-sysc: flush posted write on enable before reset (git-fixes). * can: gs_usb: gs_usb_receive_bulk_callback(): count rx overflow errors also in case of oom (git-fixes). * ceph: defer stopping mdsc delayed_work (bsc#1214392). * ceph: do not check for quotas on mds stray dirs (bsc#1214238). * ceph: never send metrics if disable_send_metrics is set (bsc#1214180). * check-for-config-changes: ignore builtin_return_address_strips_pac (bsc#1214380). gcc7 on sle 15 does not support this while later gcc does. * cifs: add missing return value check for cifs_sb_tlink (bsc#1193629). * cifs: allow dumping keys for directories too (bsc#1193629). * cifs: fix mid leak during reconnection after timeout threshold (git-fixes). * cifs: if deferred close is disabled then close files immediately (git- fixes). * cifs: is_network_name_deleted should return a bool (bsc#1193629). * cifs: update internal module version number for cifs.ko (bsc#1193629). * clk: fix slab-out-of-bounds error in devm_clk_release() (git-fixes). * clk: fix undefined reference to `clk_rate_exclusive_{get,put}' (git-fixes). * clk: imx8mp: fix sai4 clock (git-fixes). * clk: imx: composite-8m: fix clock pauses when set_rate would be a no-op (git-fixes). * clk: imx: pll14xx: dynamically configure pll for 393216000/361267200hz (git- fixes). * clk: qcom: camcc-sc7180: fix async resume during probe (git-fixes). * clk: qcom: gcc-mdm9615: use proper parent for pll0_vote clock (git-fixes). * clk: qcom: gcc-sc7180: fix up gcc_sdcc2_apps_clk_src (git-fixes). * clk: qcom: gcc-sm8250: fix gcc_sdcc2_apps_clk_src (git-fixes). * clk: sunxi-ng: modify mismatched function name (git-fixes). * clocksource/drivers/arm_arch_timer: do not use timer namespace for timer_shutdown() function (bsc#1213970). * clocksource/drivers/sp804: do not use timer namespace for timer_shutdown() function (bsc#1213970). * config_nvme_verbose_errors=y gone with a82baa8083b * config_printk_safe_log_buf_shift=13 gone with 7e152d55123 * cpu/smt: allow enabling partial smt states via sysfs (bsc#1214285 bsc#1205462 ltc#200161 ltc#200588). * cpu/smt: create topology_smt_thread_allowed() (bsc#1214285 bsc#1205462 ltc#200161 ltc#200588). * cpu/smt: move smt prototypes into cpu_smt.h (bsc#1214285 bsc#1205462 ltc#200161 ltc#200588). * cpu/smt: move smt/control simple exit cases earlier (bsc#1214285 bsc#1205462 ltc#200161 ltc#200588). * cpu/smt: remove topology_smt_supported() (bsc#1214285 bsc#1205462 ltc#200161 ltc#200588). * cpu/smt: store the current/max number of threads (bsc#1214285 bsc#1205462 ltc#200161 ltc#200588). * cpufreq: fix the race condition while updating the transition_task of policy (git-fixes). * cpufreq: intel_pstate: adjust balance_performance epp for sapphire rapids (bsc#1214659). * cpufreq: intel_pstate: enable hwp io boost for all servers (bsc#1208949 jsc#ped-6003 jsc#ped-6004). * cpufreq: intel_pstate: fix scaling for hybrid-capable systems with disabled e-cores (bsc#1212526 bsc#1214368 jsc#ped-4927 jsc#ped-4929). * cpufreq: intel_pstate: hybrid: rework hwp calibration (bsc#1212526 bsc#1214368 jsc#ped-4927 jsc#ped-4929). * cpufreq: intel_pstate: hybrid: use known scaling factor for p-cores (bsc#1212526 bsc#1214368 jsc#ped-4927 jsc#ped-4929). * cpufreq: intel_pstate: read all msrs on the target cpu (bsc#1212526 bsc#1214368 jsc#ped-4927 jsc#ped-4929). * created new preempt kernel flavor configs are cloned from the respective $arch/default configs. all changed configs appart from config_preempt->y are a result of dependencies, namely many lock/unlock primitives are no longer inlined in the preempt kernel. tree_rcu has been also changed to preempt_rcu which is the default implementation for preempt kernel. * crypto: caam - fix unchecked return value error (git-fixes). * crypto: stm32 - properly handle pm_runtime_get failing (git-fixes). * dma-buf/sw_sync: avoid recursive lock during fence signal (git-fixes). * dma-buf/sync_file: fix docs syntax (git-fixes). * dmaengine: idxd: modify the dependence of attribute pasid_enabled (git- fixes). * dmaengine: mcf-edma: fix a potential un-allocated memory access (git-fixes). * dmaengine: pl330: return dma_paused when transaction is paused (git-fixes). * dmaengine: ste_dma40: add missing irq check in d40_probe (git-fixes). * docs/process/howto: replace c89 with c11 (bsc#1214756). * docs: kernel-parameters: refer to the correct bitmap function (git-fixes). * docs: networking: replace skb_hwtstamp_tx with skb_tstamp_tx (git-fixes). * docs: printk-formats: fix hex printing of signed values (git-fixes). * documentation: devices.txt: fix minors for ttycpm* (git-fixes). * documentation: devices.txt: remove ttyioc* (git-fixes). * documentation: devices.txt: remove ttysioc* (git-fixes). * driver core: test_async: fix an error code (git-fixes). * drivers: clk: keystone: fix parameter judgment in _of_pll_clk_init() (git- fixes). * drivers: usb: smsusb: fix error handling code in smsusb_init_device (git- fixes). * drm/amd/display: check attr flag before set cursor degamma on dcn3+ (git- fixes). * drm/amd/display: check tg is non-null before checking if enabled (git- fixes). * drm/amd/display: do not wait for mpc idle if tg is disabled (git-fixes). * drm/amd/display: fix access hdcp_workqueue assert (git-fixes). * drm/amd/display: phase3 mst hdcp for multiple displays (git-fixes). * drm/amd/display: save restore hdcp state when display is unplugged from mst hub (git-fixes). * drm/amd/pm: fix variable dereferenced issue in amdgpu_device_attr_create() (git-fixes). * drm/amd: flush any delayed gfxoff on suspend entry (git-fixes). * drm/amdgpu: avoid integer overflow warning in amdgpu_device_resize_fb_bar() (git-fixes). * drm/amdgpu: fix potential fence use-after-free v2 (git-fixes). * drm/amdgpu: install stub fence into potential unused fence pointers (git- fixes). * drm/amdgpu: use rmw accessors for changing lnkctl (git-fixes). * drm/armada: fix off-by-one error in armada_overlay_get_property() (git- fixes). * drm/ast: fix dram init on ast2200 (git-fixes). * drm/atomic-helper: update reference to drm_crtc_force_disable_all() (git- fixes). * drm/bridge: anx7625: drop device lock before drm_helper_hpd_irq_event() (git-fixes). * drm/bridge: fix -wunused-const-variable= warning (git-fixes). * drm/bridge: tc358764: fix debug print parameter order (git-fixes). * drm/etnaviv: fix dumping of active mmu context (git-fixes). * drm/mediatek: fix dereference before null check (git-fixes). * drm/mediatek: fix potential memory leak if vmap() fail (git-fixes). * drm/msm/a2xx: call adreno_gpu_init() earlier (git-fixes). * drm/msm/mdp5: do not leak some plane state (git-fixes). * drm/msm: update dev core dump to not print backwards (git-fixes). * drm/nouveau/disp: revert a null check inside nouveau_connector_get_modes (git-fixes). * drm/nouveau/gr: enable memory loads on helper invocation on all channels (git-fixes). * drm/panel: simple: add missing connector type and pixel format for auo t215hvn01 (git-fixes). * drm/panel: simple: fix auo g121ean01 panel timings according to the docs (git-fixes). * drm/qxl: fix uaf on handle creation (git-fixes). * drm/radeon: use rmw accessors for changing lnkctl (git-fixes). * drm/rockchip: do not spam logs in atomic check (git-fixes). * drm/shmem-helper: reset vma->vm_ops before calling dma_buf_mmap() (git- fixes). * drm/tegra: dpaux: fix incorrect return value of platform_get_irq (git- fixes). * drm/ttm: check null pointer before accessing when swapping (git-fixes). * drm/ttm: never consider pinned bos for eviction&swap (git-fixes). * drm/vmwgfx: fix shader stage validation (git-fixes). * drm: adv7511: fix low refresh rate register for adv7533/5 (git-fixes). * drm: xlnx: zynqmp_dpsub: add missing check for dma_set_mask (git-fixes). * drop cfg80211 lock fix patches that caused a regression (bsc#1213757) * drop rtsx patch that caused a regression (bsc#1214397,bsc#1214428) * dt-bindings: clock: xlnx,versal-clk: drop select:false (git-fixes). * dt-bindings: clocks: imx8mp: make sai4 a dummy clock (git-fixes). * dt-bindings: crypto: ti,sa2ul: make power-domains conditional (git-fixes). * e1000: fix typos in comments (jsc#ped-5738). * e1000: remove unnecessary use of kmap_atomic() (jsc#ped-5738). * e1000: switch to napi_build_skb() (jsc#ped-5738). * e1000: switch to napi_consume_skb() (jsc#ped-5738). * enable analog devices industrial ethernet phy driver (jsc#ped-4759) * exfat: fix unexpected eof while reading dir (bsc#1214000). * exfat: release s_lock before calling dir_emit() (bsc#1214000). * exfat_iterate(): do not open-code file_inode(file) (bsc#1214000). * fbdev/ep93xx-fb: do not assign to struct fb_info.dev (git-fixes). * fbdev: fix potential oob read in fast_imageblit() (git-fixes). * fbdev: fix sys_imageblit() for arbitrary image widths (git-fixes). * fbdev: improve performance of sys_imageblit() (git-fixes). * fbdev: mmp: fix value check in mmphw_probe() (git-fixes). * file: reinstate f_pos locking optimization for regular files (bsc#1213759). * firmware: arm_scmi: drop of node reference in the transport channel setup (git-fixes). * firmware: cs_dsp: fix new control name check (git-fixes). * firmware: meson_sm: fix to avoid potential null pointer dereference (git- fixes). * firmware: stratix10-svc: fix an null vs is_err() bug in probe (git-fixes). * fs/sysv: null check to prevent null-ptr-deref bug (git-fixes). * ftrace: fix possible warning on checking all pages used in ftrace_process_locs() (git-fixes). * gpio: mvebu: fix irq domain leak (git-fixes). * gpio: mvebu: make use of devm_pwmchip_add (git-fixes). * gpio: tps68470: make tps68470_gpio_output() always set the initial value (git-fixes). * hid: add quirk for 03f0:464a hp elite presenter mouse (git-fixes). * hid: logitech-dj: fix error handling in logi_dj_recv_switch_to_dj_mode() (git-fixes). * hid: logitech-hidpp: add usb and bluetooth ids for the logitech g915 tkl keyboard (git-fixes). * hid: multitouch: correct devm device reference for hidinput input_dev name (git-fixes). * hid: wacom: remove the battery when the ekr is off (git-fixes). * hwmon: (pmbus/bel-pfe) enable pmbus_skip_status_check for pfe1100 (git- fixes). * hwmon: (tmp513) fix the channel number in tmp51x_is_visible() (git-fixes). * hwpoison: offline support: fix spelling in documentation/abi/ (git-fixes). * hwrng: iproc-rng200 - implement suspend and resume calls (git-fixes). * hwrng: nomadik - keep clock enabled while hwrng is registered (git-fixes). * hwrng: pic32 - use devm_clk_get_enabled (git-fixes). * i2c: bcm-iproc: fix bcm_iproc_i2c_isr deadlock issue (git-fixes). * i2c: delete error messages for failed memory allocations (git-fixes). * i2c: designware: correct length byte validation logic (git-fixes). * i2c: designware: handle invalid smbus block data response length value (git- fixes). * i2c: hisi: only handle the interrupt of the driver's transfer (git-fixes). * i2c: improve size determinations (git-fixes). * i2c: nomadik: remove a useless call in the remove function (git-fixes). * i2c: nomadik: remove unnecessary goto label (git-fixes). * i2c: nomadik: use devm_clk_get_enabled() (git-fixes). * i40e: fix an null vs is_err() bug for debugfs_create_dir() (git-fixes). * iavf: fix potential races for fdir filters (git-fixes). * ib/hfi1: fix possible panic during hotplug remove (git-fixes) * ib/uverbs: fix an potential error pointer dereference (git-fixes) * ice: fix crash by keep old cfg when update tcs more than queues (git-fixes). * ice: fix max_rate check while configuring tx rate limits (git-fixes). * ice: fix memory management in ice_ethtool_fdir.c (git-fixes). * ice: fix rdma vsi removal during queue rebuild (git-fixes). * iio: adc: ina2xx: avoid null pointer dereference on of device match (git- fixes). * iio: adc: stx104: implement and utilize register structures (git-fixes). * iio: adc: stx104: utilize iomap interface (git-fixes). * iio: cros_ec: fix the allocation size for cros_ec_command (git-fixes). * input: exc3000 - properly stop timer on shutdown (git-fixes). * intel/e1000:fix repeated words in comments (jsc#ped-5738). * intel: remove unused macros (jsc#ped-5738). * iommu/amd: add pci segment support for ivrs_ commands (git-fixes). * iommu/amd: fix compile warning in init code (git-fixes). * iommu/amd: fix ill-formed ivrs_ioapic, ivrs_hpet and ivrs_acpihid options (git-fixes). * iommu/amd: fix ivrs_acpihid cmdline parsing code (git-fixes). * iommu/amd: fix pci device refcount leak in ppr_notifier() (git-fixes). * iommu/amd: use full 64-bit value in build_completion_wait() (git-fixes). * iommu/arm-smmu-v3: check return value after calling platform_get_resource() (git-fixes). * iommu/arm-smmu-v3: fix event handling soft lockup (git-fixes). * iommu/arm-smmu-v3: make default domain type of hisilicon ptt device to identity (git-fixes). * iommu/arm-smmu: fix possible null-ptr-deref in arm_smmu_device_probe() (git- fixes). * iommu/dart: initialize dart_streams_enable (git-fixes). * iommu/dma: fix incorrect error return on iommu deferred attach (git-fixes). * iommu/dma: fix iova map result check bug (git-fixes). * iommu/dma: return error code from iommu_dma_map_sg() (git-fixes). * iommu/fsl_pamu: fix resource leak in fsl_pamu_probe() (git-fixes). * iommu/io-pgtable-arm-v7s: add a quirk to allow pgtable pa up to 35bit (git- fixes). * iommu/iova: fix module config properly (git-fixes). * iommu/omap: fix buffer overflow in debugfs (git-fixes). * iommu/rockchip: fix permission bits in page table entries v2 (git-fixes). * iommu/sun50i: consider all fault sources for reset (git-fixes). * iommu/sun50i: fix flush size (git-fixes). * iommu/sun50i: fix r/w permission check (git-fixes). * iommu/sun50i: fix reset release (git-fixes). * iommu/sun50i: implement .iotlb_sync_map (git-fixes). * iommu/sun50i: remove iommu_domain_identity (git-fixes). * iommu/vt-d: add rpls to quirk list to skip te disabling (git-fixes). * iommu/vt-d: check correct capability for sagaw determination (git-fixes). * iommu/vt-d: clean up si_domain in the init_dmars() error path (git-fixes). * iommu/vt-d: correctly calculate sagaw value of iommu (git-fixes). * iommu/vt-d: fix kdump kernels boot failure with scalable mode (git-fixes). * iommu/vt-d: fix pci device refcount leak in dmar_dev_scope_init() (git- fixes). * iommu/vt-d: fix pci device refcount leak in has_external_pci() (git-fixes). * iommu/vt-d: preset access bit for iova in fl non-leaf paging entries (git- fixes). * iommu/vt-d: set sre bit only when hardware has srs cap (git-fixes). * ipmi:ssif: add check for kstrdup (git-fixes). * ipmi:ssif: fix a memory leak when scanning for an adapter (git-fixes). * ipmi_si: fix a memleak in try_smi_init() (git-fixes). * jffs2: correct logic when creating a hole in jffs2_write_begin (git-fixes). * kabi/severities: ignore newly added srso mitigation functions * kabi: allow extra bugsints (bsc#1213927). * kbuild: add -wno-shift-negative-value where -wextra is used (bsc#1214756). * kbuild: move to -std=gnu11 (bsc#1214756). * kernel-binary: common dependencies cleanup common dependencies are copied to a subpackage, there is no need for copying defines or build dependencies there. * kernel-binary: drop code for kerntypes support kerntypes was a suse-specific feature dropped before sle 12. * kunit: make kunit_test_timeout compatible with comment (git-fixes). * kvm: s390: fix sthyi error handling (git-fixes bsc#1214370). * leds: fix bug_on check for led_color_id_multi that is always false (git- fixes). * leds: multicolor: use rounded division when calculating color components (git-fixes). * leds: pwm: fix error code in led_pwm_create_fwnode() (git-fixes). * leds: trigger: tty: do not use led_on/off constants, use led_blink_set_oneshot instead (git-fixes). * leds: turris-omnia: drop unnecessary mutex locking (git-fixes). * lib/test_meminit: allocate pages up to order max_order (git-fixes). * lib/test_meminit: destroy cache in kmem_cache_alloc_bulk() test (git-fixes). * libceph: fix potential hang in ceph_osdc_notify() (bsc#1214393). * md/raid0: factor out helper for mapping and submitting a bio (bsc#1213916). * md/raid0: fix performance regression for large sequential writes (bsc#1213916). * media: ad5820: drop unsupported ad5823 from i2c_ and of_device_id tables (git-fixes). * media: cx24120: add retval check for cx24120_message_send() (git-fixes). * media: dib7000p: fix potential division by zero (git-fixes). * media: dvb-usb: m920x: fix a potential memory leak in m920x_i2c_xfer() (git- fixes). * media: go7007: remove redundant if statement (git-fixes). * media: i2c: ccs: check rules is non-null (git-fixes). * media: i2c: rdacm21: fix uninitialized value (git-fixes). * media: i2c: tvp5150: check return value of devm_kasprintf() (git-fixes). * media: ov2680: add ov2680_fill_format() helper function (git-fixes). * media: ov2680: do not take the lock for try_fmt calls (git-fixes). * media: ov2680: fix ov2680_bayer_order() (git-fixes). * media: ov2680: fix ov2680_set_fmt() which == v4l2_subdev_format_try not working (git-fixes). * media: ov2680: fix regulators being left enabled on ov2680_power_on() errors (git-fixes). * media: ov2680: fix vflip / hflip set functions (git-fixes). * media: ov2680: remove video_v4l2_subdev_api ifdef-s (git-fixes). * media: ov5640: enable mipi interface in ov5640_set_power_mipi() (git-fixes). * media: rkvdec: increase max supported height for h.264 (git-fixes). * media: v4l2-core: fix a potential resource leak in v4l2_fwnode_parse_link() (git-fixes). * media: v4l2-mem2mem: add lock to protect parameter num_rdy (git-fixes). * media: venus: hfi_venus: only consider sys_idle_indicator on v1 (git-fixes). * media: venus: hfi_venus: write to vidc_ctrl_init after unmasking interrupts (git-fixes). * misc: rtsx: judge aspm mode to set petxcfg reg (git-fixes). * mkspec: allow unsupported kmps (bsc#1214386) * mlxsw: pci: add shutdown method in pci driver (git-fixes). * mmc: block: fix in_flight[issue_type] value error (git-fixes). * mmc: moxart: read scr register without changing byte order (git-fixes). * mmc: wbsd: fix double mmc_free_host() in wbsd_init() (git-fixes). * module: avoid allocation if module is already present and ready (bsc#1213921). * module: extract patient module check into helper (bsc#1213921). * module: move check_modinfo() early to early_mod_check() (bsc#1213921). * module: move early sanity checks into a helper (bsc#1213921). * move upstreamed powerpc patches into sorted section * mtd: rawnand: brcmnand: fix crash during the panic_write (git-fixes). * mtd: rawnand: brcmnand: fix mtd oobsize (git-fixes). * mtd: rawnand: brcmnand: fix potential false time out warning (git-fixes). * mtd: rawnand: brcmnand: fix potential out-of-bounds access in oob write (git-fixes). * mtd: rawnand: fsl_upm: fix an off-by one test in fun_exec_op() (git-fixes). * mtd: rawnand: fsmc: handle clk prepare error in fsmc_nand_resume() (git- fixes). * mtd: rawnand: omap_elm: fix incorrect type in assignment (git-fixes). * mtd: rawnand: rockchip: align hwecc vs. raw page helper layouts (git-fixes). * mtd: rawnand: rockchip: fix oobfree offset and description (git-fixes). * mtd: spi-nor: check bus width while setting qe bit (git-fixes). * mtd: spinand: toshiba: fix ecc_get_status (git-fixes). * n_tty: rename tail to old_tail in n_tty_read() (git-fixes). * net: hns3: fix wrong bw weight of disabled tc issue (git-fixes). * net: ieee802154: at86rf230: stop leaking skb's (git-fixes). * net: mana: fix mana vf unload when hardware is unresponsive (git-fixes). * net: phy: at803x: remove set/get wol callbacks for ar8032 (git-fixes). * net: phy: broadcom: stub c45 read/write for 54810 (git-fixes). * net: phy: fix irq-based wake-on-lan over hibernate / power off (git-fixes). * net: usb: lan78xx: reorder cleanup operations to avoid uaf bugs (git-fixes). * net: usbnet: fix warning in usbnet_start_xmit/usb_submit_urb (git-fixes). * netfs: fix lockdep warning from taking sb_writers whilst holding mmap_lock (bsc#1214742). * netfs: fix missing xas_retry() calls in xarray iteration (bsc#1213946). * netfs: fix parameter of cleanup() (bsc#1214743). * nfsd: remove incorrect check in nfsd4_validate_stateid (git-fixes). * nilfs2: fix use-after-free of nilfs_root in dirtying inodes via iput (git- fixes). * nilfs2: fix warning in mark_buffer_dirty due to discarded buffer reuse (git- fixes). * nvme-rdma: fix potential unbalanced freeze & unfreeze (bsc#1208902). * nvme-tcp: fix potential unbalanced freeze & unfreeze (bsc#1208902). * objtool/x86: fix srso mess (git-fixes). * objtool/x86: fixup frame-pointer vs rethunk (git-fixes). * objtool: union instruction::{call_dest,jump_table} (git-fixes). * old-flavors: drop 2.6 kernels. 2.6 based kernels are eol, upgrading from them is no longer suported. * pci/aspm: avoid link retraining race (git-fixes). * pci/aspm: factor out pcie_wait_for_retrain() (git-fixes). * pci/aspm: return 0 or -etimedout from pcie_retrain_link() (git-fixes). * pci: acpiphp: reassign resources on bridge if necessary (git-fixes). * pci: acpiphp: use pci_assign_unassigned_bridge_resources() only for non-root bus (git-fixes). * pci: mark nvidia t4 gpus to avoid bus reset (git-fixes). * pci: meson: remove cast between incompatible function type (git-fixes). * pci: microchip: correct the ded and sec interrupt bit offsets (git-fixes). * pci: microchip: remove cast between incompatible function type (git-fixes). * pci: pciehp: use rmw accessors for changing lnkctl (git-fixes). * pci: rockchip: remove writes to unused registers (git-fixes). * pci: s390: fix use-after-free of pci resources with per-function hotplug (git-fixes). * pci: tegra194: fix possible array out of bounds access (git-fixes). * pcmcia: rsrc_nonstatic: fix memory leak in nonstatic_release_resource_db() (git-fixes). * phy/rockchip: inno-hdmi: do not power on rk3328 post pll on reg write (git- fixes). * phy/rockchip: inno-hdmi: round fractal pixclock in rk3328 recalc_rate (git- fixes). * phy/rockchip: inno-hdmi: use correct vco_div_5 macro on rk3328 (git-fixes). * phy: qcom-snps-femto-v2: keep cfg_ahb_clk enabled during runtime suspend (git-fixes). * phy: qcom-snps-femto-v2: properly enable ref clock (git-fixes). * phy: qcom-snps: correct struct qcom_snps_hsphy kerneldoc (git-fixes). * phy: qcom-snps: use dev_err_probe() to simplify code (git-fixes). * pinctrl: cherryview: fix address_space_handler() argument (git-fixes). * pinctrl: mcp23s08: check return value of devm_kasprintf() (git-fixes). * pinctrl: renesas: rza2: add lock around pinctrl_generic{{add,remove}_group,{add,remove}_function} (git-fixes). * platform/x86: dell-sysman: fix reference leak (git-fixes). * pm / devfreq: fix leak in devfreq_dev_release() (git-fixes). * powerpc/64e: fix kexec build error (bsc#1212091 ltc#199106). * powerpc/iommu: do not set failed sg dma_address to dma_mapping_error (bsc#1212091 ltc#199106). * powerpc/iommu: fix iommu_table_in_use for a small default dma window case (bsc#1212091 ltc#199106). * powerpc/iommu: incorrect ddw table is referenced for sr-iov device (bsc#1212091 ltc#199106). * powerpc/iommu: return error code from .map_sg() ops (bsc#1212091 ltc#199106). * powerpc/iommu: tces are incorrectly manipulated with dlpar add/remove of memory (bsc#1212091 ltc#199106). * powerpc/kernel/iommu: add new iommu_table_in_use() helper (bsc#1212091 ltc#199106). * powerpc/kexec: fix build failure from uninitialised variable (bsc#1212091 ltc#199106). * powerpc/mm/altmap: fix altmap boundary check (bsc#1120059 git-fixes). * powerpc/pseries/ddw: do not try direct mapping with persistent memory and one window (bsc#1212091 ltc#199106). * powerpc/pseries/ddw: simplify enable_ddw() (bsc#1212091 ltc#199106). * powerpc/pseries/iommu: add ddw_list_new_entry() helper (bsc#1212091 ltc#199106). * powerpc/pseries/iommu: add ddw_property_create() and refactor enable_ddw() (bsc#1212091 ltc#199106). * powerpc/pseries/iommu: add iommu_pseries_alloc_table() helper (bsc#1212091 ltc#199106). * powerpc/pseries/iommu: add of_node_put() before break (bsc#1212091 ltc#199106). * powerpc/pseries/iommu: allow ddw windows starting at 0x00 (bsc#1212091 ltc#199106). * powerpc/pseries/iommu: check if the default window in use before removing it (bsc#1212091 ltc#199106). * powerpc/pseries/iommu: create huge dma window if no mmio32 is present (bsc#1212091 ltc#199106). * powerpc/pseries/iommu: find existing ddw with given property name (bsc#1212091 ltc#199106). * powerpc/pseries/iommu: make use of ddw for indirect mapping (bsc#1212091 ltc#199106). * powerpc/pseries/iommu: print ibm,query-pe-dma-windows parameters (bsc#1212091 ltc#199106). * powerpc/pseries/iommu: rename "direct window" to "dma window" (bsc#1212091 ltc#199106). * powerpc/pseries/iommu: reorganize iommu_table_setparms*() with new helper (bsc#1212091 ltc#199106). * powerpc/pseries/iommu: replace hard-coded page shift (bsc#1212091 ltc#199106). * powerpc/pseries/iommu: update remove_dma_window() to accept property name (bsc#1212091 ltc#199106). * powerpc/pseries/iommu: use correct vfree for it_map (bsc#1212091 ltc#199106). * powerpc/pseries: add __init attribute to eligible functions (bsc#1212091 ltc#199106). * powerpc/pseries: honour current smt state when dlpar onlining cpus (bsc#1214285 bsc#1205462 ltc#200161 ltc#200588). * powerpc/pseries: initialise cpu hotplug callbacks earlier (bsc#1214285 bsc#1205462 ltc#200161 ltc#200588). * powerpc/rtas: block error injection when locked down (bsc#1023051). * powerpc/rtas: enture rtas_call is called with mmu enabled (bsc#1023051). * powerpc/rtas_flash: allow user copy to flash block cache objects (bsc#1194869). * powerpc/security: fix speculation_store_bypass reporting on power10 (bsc#1188885 ltc#193722 git-fixes). * powerpc: add hotplug_smt support (bsc#1214285 bsc#1205462 ltc#200161 ltc#200588). update config files. * powerpc: fix typos in comments (bsc#1212091 ltc#199106). * powerpc: move dma64_propname define to a header (bsc#1214297 ltc#197503). * pseries/iommu/ddw: fix kdump to work in absence of ibm,dma-window (bsc#1214297 ltc#197503). * pstore/ram: check start of empty przs during init (git-fixes). * pwm: add a stub for devm_pwmchip_add() (git-fixes). * pwm: meson: fix handling of period/duty if greater than uint_max (git- fixes). * pwm: meson: simplify duplicated per-channel tracking (git-fixes). * qed: fix scheduling in a tasklet while getting stats (git-fixes). * rdma/bnxt_re: fix error handling in probe failure path (git-fixes) * rdma/bnxt_re: fix max_qp count for virtual functions (git-fixes) * rdma/efa: fix wrong resources deallocation order (git-fixes) * rdma/hns: fix cq and qp cache affinity (git-fixes) * rdma/hns: fix incorrect post-send with direct wqe of wr-list (git-fixes) * rdma/hns: fix port active speed (git-fixes) * rdma/irdma: prevent zero-length stag registration (git-fixes) * rdma/irdma: replace one-element array with flexible-array member (git-fixes) * rdma/mlx5: return the firmware result upon destroying qp/rq (git-fixes) * rdma/qedr: remove a duplicate assignment in irdma_query_ah() (git-fixes) * rdma/siw: balance the reference of cep->kref in the error path (git-fixes) * rdma/siw: correct wrong debug message (git-fixes) * rdma/umem: set iova in odp flow (git-fixes) * readme.branch: add miroslav franc as a sle15-sp4 co-maintainer. * regmap: rbtree: use alloc_flags for memory allocations (git-fixes). * revert "ib/isert: fix incorrect release of isert connection" (git-fixes) * revert "tracing: add "(fault)" name injection to kernel probes" (git-fixes). * ring-buffer: do not swap cpu_buffer during resize process (git-fixes). * ring-buffer: fix deadloop issue on reading trace_pipe (git-fixes). * ring-buffer: fix wrong stat of cpu_buffer->read (git-fixes). * rpmsg: glink: add check for kstrdup (git-fixes). * s390/purgatory: disable branch profiling (git-fixes bsc#1214372). * sched/fair: fix inaccurate tally of ttwu_move_affine (git fixes). * sched/fair: use recent_used_cpu to test p->cpus_ptr (git fixes). * sched/psi: use kernfs polling functions for psi trigger polling (bsc#1209799). * scsi: bsg: increase number of devices (bsc#1210048). * scsi: core: do not wait for quiesce in scsi_device_block() (bsc#1209284). * scsi: core: do not wait for quiesce in scsi_stop_queue() (bsc#1209284). * scsi: core: improve warning message in scsi_device_block() (bsc#1209284). * scsi: core: merge scsi_internal_device_block() and device_block() (bsc#1209284). * scsi: rdma/srp: fix residual handling (git-fixes) * scsi: sg: increase number of devices (bsc#1210048). * scsi: storvsc: always set no_report_opcodes (git-fixes). * scsi: storvsc: fix handling of virtual fibre channel timeouts (git-fixes). * scsi: storvsc: handle srb status value 0x30 (git-fixes). * scsi: storvsc: limit max_sectors for virtual fibre channel devices (git- fixes). * scsi: zfcp: defer fc_rport blocking until after adisc response (git-fixes bsc#1214371). * selftests/futex: order calls to futex_lock_pi (git-fixes). * selftests/harness: actually report skip for signal tests (git-fixes). * selftests/resctrl: close perf value read fd on errors (git-fixes). * selftests/resctrl: do not leak buffer in fill_cache() (git-fixes). * selftests/resctrl: unmount resctrl fs if child fails to run benchmark (git- fixes). * selftests/rseq: check if libc rseq support is registered (git-fixes). * selftests: forwarding: add a helper to skip test when using veth pairs (git- fixes). * selftests: forwarding: ethtool: skip when using veth pairs (git-fixes). * selftests: forwarding: ethtool_extended_state: skip when using veth pairs (git-fixes). * selftests: forwarding: skip test when no interfaces are specified (git- fixes). * selftests: forwarding: switch off timeout (git-fixes). * selftests: forwarding: tc_actions: cleanup temporary files when test is aborted (git-fixes). * selftests: forwarding: tc_actions: use ncat instead of nc (git-fixes). * selftests: forwarding: tc_flower: relax success criterion (git-fixes). * selftests: mirror_gre_changes: tighten up the ttl test match (git-fixes). * serial: sc16is7xx: fix broken port 0 uart init (git-fixes). * serial: sc16is7xx: fix bug when first setting gpio direction (git-fixes). * serial: sprd: assign sprd_port after initialized to avoid wrong access (git- fixes). * serial: sprd: fix dma buffer leak issue (git-fixes). * serial: tegra: handle clk prepare error in tegra_uart_hw_init() (git-fixes). * sfc: fix crash when reading stats while nic is resetting (git-fixes). * smb3: do not send lease break acknowledgment if all file handles have been closed (git-fixes). * smb3: do not set ntlmssp_version flag for negotiate not auth request (bsc#1193629). * smb: client: fix -wstringop-overflow issues (bsc#1193629). * smb: client: fix dfs link mount against w2k8 (bsc#1212142). * smb: client: fix null auth (git-fixes). * soc: aspeed: socinfo: add kfree for kstrdup (git-fixes). * soundwire: bus: pm_runtime_request_resume on peripheral attachment (git- fixes). * soundwire: fix enumeration completion (git-fixes). * spi: tegra20-sflash: fix to check return value of platform_get_irq() in tegra_sflash_probe() (git-fixes). * supported.conf: fix typos for -!optional markers * target: compare and write backend driver sense handling (bsc#1177719 bsc#1213026). * target_core_rbd: fix leak and reduce kmalloc calls (bsc#1212873). * target_core_rbd: fix rbd_img_request.snap_id assignment (bsc#1212857). * target_core_rbd: remove snapshot existence validation code (bsc#1212857). * thunderbolt: read retimer nvm authentication status prior tb_retimer_set_inbound_sbtx() (git-fixes). * timers: add shutdown mechanism to the internal functions (bsc#1213970). * timers: provide timer_shutdown_sync (bsc#1213970). * timers: rename del_timer() to timer_delete() (bsc#1213970). * timers: rename del_timer_sync() to timer_delete_sync() (bsc#1213970). * timers: replace bug_on()s (bsc#1213970). * timers: silently ignore timers with a null function (bsc#1213970). * timers: split [try_to_]del_timer_sync to prepare for shutdown mode (bsc#1213970). * timers: update kernel-doc for various functions (bsc#1213970). * timers: use del_timer_sync() even on up (bsc#1213970). * tracing/histograms: add histograms to hist_vars if they have referenced variables (git-fixes). * tracing/histograms: return an error if we fail to add histogram to hist_vars list (git-fixes). * tracing/probes: fix not to count error code to total length (git-fixes). * tracing/probes: fix to avoid double count of the string length on the array (git-fixes). * tracing/probes: fix to record 0-length data_loc in fetch_store_string*() if fails (git-fixes). * tracing/probes: fix to update dynamic data counter if fetcharg uses it (git- fixes). * tracing: fix cpu buffers unavailable due to 'record_disabled' missed (git- fixes). * tracing: fix memleak due to race between current_tracer and trace (git- fixes). * tracing: fix memory leak of iter->temp when reading trace_pipe (git-fixes). * tracing: fix null pointer dereference in tracing_err_log_open() (git-fixes). * tracing: fix warning in trace_buffered_event_disable() (git-fixes). * tty: fix hang on tty device with no_room set (git-fixes). * tty: n_gsm: fix the uaf caused by race condition in gsm_cleanup_mux (git- fixes). * tty: serial: fsl_lpuart: add i.mxrt1050 support (git-fixes). * tty: serial: fsl_lpuart: clear the error flags by writing 1 for lpuart32 platforms (git-fixes). * tty: serial: fsl_lpuart: make rx_watermark configurable for different platforms (git-fixes). * tty: serial: fsl_lpuart: reduce rx watermark to 0 on ls1028a (git-fixes). * ubifs: fix memleak when insert_old_idx() failed (git-fixes). * update patches.suse/cpufreq-intel_pstate-fix-cpu-pstate.turbo_freq-initi (git-fixes bsc#1212526 bsc#1214368 jsc#ped-4927 jsc#ped-4929). * usb-storage: alauda: fix uninit-value in alauda_check_media() (git-fixes). * usb: chipidea: imx: add missing usb phy dpdm wakeup setting (git-fixes). * usb: chipidea: imx: do not request qos for imx8ulp (git-fixes). * usb: chipidea: imx: improve logic if samsung,picophy-* parameter is 0 (git- fixes). * usb: common: usb-conn-gpio: prevent bailing out if initial role is none (git-fixes). * usb: dwc3: fix typos in gadget.c (git-fixes). * usb: dwc3: meson-g12a: do post init to fix broken usb after resumption (git- fixes). * usb: dwc3: properly handle processing of pending events (git-fixes). * usb: gadget: f_mass_storage: fix unused variable warning (git-fixes). * usb: gadget: fix the memory leak in raw_gadget driver (git-fixes). * usb: gadget: u_serial: avoid spinlock recursion in __gs_console_push (git- fixes). * usb: ohci-at91: fix the unhandle interrupt when resume (git-fixes). * usb: phy: mxs: fix getting wrong state with mxs_phy_is_otg_host() (git- fixes). * usb: quirks: add quirk for focusrite scarlett (git-fixes). * usb: serial: option: add quectel ec200a module support (git-fixes). * usb: serial: option: support quectel em060k_128 (git-fixes). * usb: serial: simple: add kaufmann rks+can vcp (git-fixes). * usb: serial: simple: sort driver entries (git-fixes). * usb: typec: altmodes/displayport: signal hpd when configuring pin assignment (git-fixes). * usb: typec: tcpm: fix response to vsafe0v event (git-fixes). * usb: typec: tcpm: set initial svdm version based on pd revision (git-fixes). * usb: zaurus: add id for a-300/b-500/c-700 (git-fixes). * watchdog: sp5100_tco: support hygon fch/sch (server controller hub) (git- fixes). * wifi: ath10k: use rmw accessors for changing lnkctl (git-fixes). * wifi: ath11k: use rmw accessors for changing lnkctl (git-fixes). * wifi: ath9k: fix races between ath9k_wmi_cmd and ath9k_wmi_ctrl_rx (git- fixes). * wifi: ath9k: protect wmi command response buffer replacement with a lock (git-fixes). * wifi: ath9k: use is_err() with debugfs_create_dir() (git-fixes). * wifi: cfg80211: fix return value in scan logic (git-fixes). * wifi: cfg80211: fix sband iftype data lookup for ap_vlan (git-fixes). * wifi: mt76: mt7615: do not advertise 5 ghz on first phy of mt7615d (dbdc) (git-fixes). * wifi: mt76: mt7915: fix power-limits while chan_switch (git-fixes). * wifi: mt76: mt7921: do not support one stream on secondary antenna only (git-fixes). * wifi: mt76: testmode: add nla_policy for mt76_tm_attr_tx_length (git-fixes). * wifi: mwifiex: avoid possible null skb pointer dereference (git-fixes). * wifi: mwifiex: fix error recovery in pcie buffer descriptor management (git- fixes). * wifi: mwifiex: fix memory leak in mwifiex_histogram_read() (git-fixes). * wifi: mwifiex: fix missed return in oob checks failed path (git-fixes). * wifi: mwifiex: fix oob and integer underflow when rx packets (git-fixes). * wifi: nl80211/cfg80211: add forgotten nla_policy for bss color attribute (git-fixes). * wifi: radiotap: fix kernel-doc notation warnings (git-fixes). * wifi: rtw89: debug: fix error handling in rtw89_debug_priv_btc_manual_set() (git-fixes). * x86/alternative: make custom return thunk unconditional (git-fixes). * x86/cpu/amd: disable xsaves on amd family 0x17 (git-fixes). * x86/cpu/kvm: provide untrain_ret_vm (git-fixes). * x86/cpu: clean up srso return thunk mess (git-fixes). * x86/cpu: cleanup the untrain mess (git-fixes). * x86/cpu: fix __x86_return_thunk symbol type (git-fixes). * x86/cpu: fix up srso_safe_ret() and __x86_return_thunk() (git-fixes). * x86/cpu: rename original retbleed methods (git-fixes). * x86/cpu: rename srso_(.*) _alias to srso_alias_ \1 (git-fixes). * x86/mce: make sure logged mces are processed after sysfs update (git-fixes). * x86/retpoline,kprobes: fix position of thunk sections with config_lto_clang (git-fixes). * x86/retpoline,kprobes: skip optprobe check for indirect jumps with retpolines and ibt (git-fixes). * x86/retpoline: do not clobber rflags during srso_safe_ret() (git-fixes). * x86/sev: Make enc_dec_hypercall() accept a size instead of npages (bsc#1214635). * x86/speculation: add cpu_show_gds() prototype (git-fixes). * x86/speculation: mark all skylake cpus as vulnerable to gds (git-fixes). * x86/srso: correct the mitigation status when smt is disabled (git-fixes). * x86/srso: disable the mitigation on unaffected configurations (git-fixes). * x86/srso: explain the untraining sequences a bit more (git-fixes). * x86/srso: fix build breakage with the llvm linker (git-fixes). * x86/srso: fix return thunks in generated code (git-fixes). * x86/static_call: fix __static_call_fixup() (git-fixes). * xfs: fix sb write verify for lazysbcount (bsc#1214661). ## Special Instructions and Notes: * Please reboot the system after installing this update. ## Patch Instructions: To install this SUSE update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: * openSUSE Leap 15.4 zypper in -t patch openSUSE-SLE-15.4-2023-3964=1 * SUSE Linux Enterprise Micro for Rancher 5.3 zypper in -t patch SUSE-SLE-Micro-5.3-2023-3964=1 * SUSE Linux Enterprise Micro 5.3 zypper in -t patch SUSE-SLE-Micro-5.3-2023-3964=1 * SUSE Linux Enterprise Micro for Rancher 5.4 zypper in -t patch SUSE-SLE-Micro-5.4-2023-3964=1 * SUSE Linux Enterprise Micro 5.4 zypper in -t patch SUSE-SLE-Micro-5.4-2023-3964=1 * SUSE Linux Enterprise Live Patching 15-SP4 zypper in -t patch SUSE-SLE-Module-Live-Patching-15-SP4-2023-3964=1 * SUSE Real Time Module 15-SP4 zypper in -t patch SUSE-SLE-Module-RT-15-SP4-2023-3964=1 ## Package List: * openSUSE Leap 15.4 (x86_64) * kernel-rt-debugsource-5.14.21-150400.15.53.1 * dlm-kmp-rt-5.14.21-150400.15.53.1 * kernel-rt-devel-5.14.21-150400.15.53.1 * gfs2-kmp-rt-debuginfo-5.14.21-150400.15.53.1 * kernel-rt_debug-debugsource-5.14.21-150400.15.53.1 * kernel-rt-devel-debuginfo-5.14.21-150400.15.53.1 * kernel-rt_debug-debuginfo-5.14.21-150400.15.53.1 * kernel-rt-debuginfo-5.14.21-150400.15.53.1 * kernel-rt_debug-devel-5.14.21-150400.15.53.1 * kernel-syms-rt-5.14.21-150400.15.53.1 * dlm-kmp-rt-debuginfo-5.14.21-150400.15.53.1 * ocfs2-kmp-rt-debuginfo-5.14.21-150400.15.53.1 * gfs2-kmp-rt-5.14.21-150400.15.53.1 * cluster-md-kmp-rt-debuginfo-5.14.21-150400.15.53.1 * kernel-rt_debug-devel-debuginfo-5.14.21-150400.15.53.1 * cluster-md-kmp-rt-5.14.21-150400.15.53.1 * ocfs2-kmp-rt-5.14.21-150400.15.53.1 * openSUSE Leap 15.4 (noarch) * kernel-source-rt-5.14.21-150400.15.53.1 * kernel-devel-rt-5.14.21-150400.15.53.1 * openSUSE Leap 15.4 (nosrc x86_64) * kernel-rt-5.14.21-150400.15.53.1 * kernel-rt_debug-5.14.21-150400.15.53.1 * SUSE Linux Enterprise Micro for Rancher 5.3 (nosrc x86_64) * kernel-rt-5.14.21-150400.15.53.1 * SUSE Linux Enterprise Micro for Rancher 5.3 (x86_64) * kernel-rt-debugsource-5.14.21-150400.15.53.1 * kernel-rt-debuginfo-5.14.21-150400.15.53.1 * SUSE Linux Enterprise Micro 5.3 (nosrc x86_64) * kernel-rt-5.14.21-150400.15.53.1 * SUSE Linux Enterprise Micro 5.3 (x86_64) * kernel-rt-debugsource-5.14.21-150400.15.53.1 * kernel-rt-debuginfo-5.14.21-150400.15.53.1 * SUSE Linux Enterprise Micro for Rancher 5.4 (nosrc x86_64) * kernel-rt-5.14.21-150400.15.53.1 * SUSE Linux Enterprise Micro for Rancher 5.4 (x86_64) * kernel-rt-debugsource-5.14.21-150400.15.53.1 * kernel-rt-debuginfo-5.14.21-150400.15.53.1 * SUSE Linux Enterprise Micro 5.4 (nosrc x86_64) * kernel-rt-5.14.21-150400.15.53.1 * SUSE Linux Enterprise Micro 5.4 (x86_64) * kernel-rt-debugsource-5.14.21-150400.15.53.1 * kernel-rt-debuginfo-5.14.21-150400.15.53.1 * SUSE Linux Enterprise Live Patching 15-SP4 (x86_64) * kernel-livepatch-5_14_21-150400_15_53-rt-1-150400.1.3.1 * kernel-livepatch-SLE15-SP4-RT_Update_13-debugsource-1-150400.1.3.1 * kernel-livepatch-5_14_21-150400_15_53-rt-debuginfo-1-150400.1.3.1 * SUSE Real Time Module 15-SP4 (x86_64) * kernel-rt-debugsource-5.14.21-150400.15.53.1 * dlm-kmp-rt-5.14.21-150400.15.53.1 * kernel-rt-devel-5.14.21-150400.15.53.1 * gfs2-kmp-rt-debuginfo-5.14.21-150400.15.53.1 * kernel-rt_debug-debugsource-5.14.21-150400.15.53.1 * kernel-rt-devel-debuginfo-5.14.21-150400.15.53.1 * kernel-rt_debug-debuginfo-5.14.21-150400.15.53.1 * kernel-rt-debuginfo-5.14.21-150400.15.53.1 * kernel-rt_debug-devel-5.14.21-150400.15.53.1 * kernel-syms-rt-5.14.21-150400.15.53.1 * dlm-kmp-rt-debuginfo-5.14.21-150400.15.53.1 * ocfs2-kmp-rt-debuginfo-5.14.21-150400.15.53.1 * gfs2-kmp-rt-5.14.21-150400.15.53.1 * cluster-md-kmp-rt-debuginfo-5.14.21-150400.15.53.1 * kernel-rt_debug-devel-debuginfo-5.14.21-150400.15.53.1 * cluster-md-kmp-rt-5.14.21-150400.15.53.1 * ocfs2-kmp-rt-5.14.21-150400.15.53.1 * SUSE Real Time Module 15-SP4 (noarch) * kernel-source-rt-5.14.21-150400.15.53.1 * kernel-devel-rt-5.14.21-150400.15.53.1 * SUSE Real Time Module 15-SP4 (nosrc x86_64) * kernel-rt-5.14.21-150400.15.53.1 * kernel-rt_debug-5.14.21-150400.15.53.1 ## References: * https://www.suse.com/security/cve/CVE-2023-2007.html * https://www.suse.com/security/cve/CVE-2023-20588.html * https://www.suse.com/security/cve/CVE-2023-34319.html * https://www.suse.com/security/cve/CVE-2023-3610.html * https://www.suse.com/security/cve/CVE-2023-37453.html * https://www.suse.com/security/cve/CVE-2023-3772.html * https://www.suse.com/security/cve/CVE-2023-3863.html * https://www.suse.com/security/cve/CVE-2023-4128.html * https://www.suse.com/security/cve/CVE-2023-4133.html * https://www.suse.com/security/cve/CVE-2023-4134.html * https://www.suse.com/security/cve/CVE-2023-4147.html * https://www.suse.com/security/cve/CVE-2023-4194.html * https://www.suse.com/security/cve/CVE-2023-4273.html * https://www.suse.com/security/cve/CVE-2023-4387.html * https://www.suse.com/security/cve/CVE-2023-4459.html * https://www.suse.com/security/cve/CVE-2023-4569.html * https://bugzilla.suse.com/show_bug.cgi?id=1023051 * https://bugzilla.suse.com/show_bug.cgi?id=1120059 * https://bugzilla.suse.com/show_bug.cgi?id=1177719 * https://bugzilla.suse.com/show_bug.cgi?id=1188885 * https://bugzilla.suse.com/show_bug.cgi?id=1193629 * https://bugzilla.suse.com/show_bug.cgi?id=1194869 * https://bugzilla.suse.com/show_bug.cgi?id=1205462 * https://bugzilla.suse.com/show_bug.cgi?id=1208902 * https://bugzilla.suse.com/show_bug.cgi?id=1208949 * https://bugzilla.suse.com/show_bug.cgi?id=1209284 * https://bugzilla.suse.com/show_bug.cgi?id=1209799 * https://bugzilla.suse.com/show_bug.cgi?id=1210048 * https://bugzilla.suse.com/show_bug.cgi?id=1210448 * https://bugzilla.suse.com/show_bug.cgi?id=1212091 * https://bugzilla.suse.com/show_bug.cgi?id=1212142 * https://bugzilla.suse.com/show_bug.cgi?id=1212526 * https://bugzilla.suse.com/show_bug.cgi?id=1212857 * https://bugzilla.suse.com/show_bug.cgi?id=1212873 * https://bugzilla.suse.com/show_bug.cgi?id=1213026 * https://bugzilla.suse.com/show_bug.cgi?id=1213123 * https://bugzilla.suse.com/show_bug.cgi?id=1213546 * https://bugzilla.suse.com/show_bug.cgi?id=1213580 * https://bugzilla.suse.com/show_bug.cgi?id=1213601 * https://bugzilla.suse.com/show_bug.cgi?id=1213666 * https://bugzilla.suse.com/show_bug.cgi?id=1213757 * https://bugzilla.suse.com/show_bug.cgi?id=1213759 * https://bugzilla.suse.com/show_bug.cgi?id=1213916 * https://bugzilla.suse.com/show_bug.cgi?id=1213921 * https://bugzilla.suse.com/show_bug.cgi?id=1213927 * https://bugzilla.suse.com/show_bug.cgi?id=1213946 * https://bugzilla.suse.com/show_bug.cgi?id=1213968 * https://bugzilla.suse.com/show_bug.cgi?id=1213970 * https://bugzilla.suse.com/show_bug.cgi?id=1213971 * https://bugzilla.suse.com/show_bug.cgi?id=1214000 * https://bugzilla.suse.com/show_bug.cgi?id=1214019 * https://bugzilla.suse.com/show_bug.cgi?id=1214120 * https://bugzilla.suse.com/show_bug.cgi?id=1214149 * https://bugzilla.suse.com/show_bug.cgi?id=1214180 * https://bugzilla.suse.com/show_bug.cgi?id=1214238 * https://bugzilla.suse.com/show_bug.cgi?id=1214285 * https://bugzilla.suse.com/show_bug.cgi?id=1214297 * https://bugzilla.suse.com/show_bug.cgi?id=1214299 * https://bugzilla.suse.com/show_bug.cgi?id=1214350 * https://bugzilla.suse.com/show_bug.cgi?id=1214368 * https://bugzilla.suse.com/show_bug.cgi?id=1214370 * https://bugzilla.suse.com/show_bug.cgi?id=1214371 * https://bugzilla.suse.com/show_bug.cgi?id=1214372 * https://bugzilla.suse.com/show_bug.cgi?id=1214380 * https://bugzilla.suse.com/show_bug.cgi?id=1214386 * https://bugzilla.suse.com/show_bug.cgi?id=1214392 * https://bugzilla.suse.com/show_bug.cgi?id=1214393 * https://bugzilla.suse.com/show_bug.cgi?id=1214397 * https://bugzilla.suse.com/show_bug.cgi?id=1214428 * https://bugzilla.suse.com/show_bug.cgi?id=1214451 * https://bugzilla.suse.com/show_bug.cgi?id=1214635 * https://bugzilla.suse.com/show_bug.cgi?id=1214659 * https://bugzilla.suse.com/show_bug.cgi?id=1214661 * https://bugzilla.suse.com/show_bug.cgi?id=1214729 * https://bugzilla.suse.com/show_bug.cgi?id=1214742 * https://bugzilla.suse.com/show_bug.cgi?id=1214743 * https://bugzilla.suse.com/show_bug.cgi?id=1214756 * https://bugzilla.suse.com/show_bug.cgi?id=1215522 * https://bugzilla.suse.com/show_bug.cgi?id=1215523 * https://bugzilla.suse.com/show_bug.cgi?id=1215552 * https://bugzilla.suse.com/show_bug.cgi?id=1215553 * https://jira.suse.com/browse/PED-4579 * https://jira.suse.com/browse/PED-4759 * https://jira.suse.com/browse/PED-4927 * https://jira.suse.com/browse/PED-4929 * https://jira.suse.com/browse/PED-5738 * https://jira.suse.com/browse/PED-6003 * https://jira.suse.com/browse/PED-6004

1 0

SUSE-SU-2023:3943-1: important: Security update for python311
by security＠lists.opensuse.org 03 Oct '23

03 Oct '23

# Security update for python311 Announcement ID: SUSE-SU-2023:3943-1 Rating: important References: * #1214692 * #1214693 Cross-References: * CVE-2023-40217 * CVE-2023-41105 CVSS scores: * CVE-2023-40217 ( SUSE ): 7.4 CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N * CVE-2023-40217 ( NVD ): 5.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N * CVE-2023-41105 ( SUSE ): 6.7 CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N * CVE-2023-41105 ( NVD ): 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N Affected Products: * openSUSE Leap 15.4 * openSUSE Leap 15.5 * Python 3 Module 15-SP4 * Python 3 Module 15-SP5 * SUSE Linux Enterprise Desktop 15 SP4 * SUSE Linux Enterprise Desktop 15 SP5 * SUSE Linux Enterprise High Performance Computing 15 SP4 * SUSE Linux Enterprise High Performance Computing 15 SP5 * SUSE Linux Enterprise Server 15 SP4 * SUSE Linux Enterprise Server 15 SP5 * SUSE Linux Enterprise Server for SAP Applications 15 SP4 * SUSE Linux Enterprise Server for SAP Applications 15 SP5 * SUSE Manager Proxy 4.3 * SUSE Manager Retail Branch Server 4.3 * SUSE Manager Server 4.3 An update that solves two vulnerabilities can now be installed. ## Description: This update for python311 fixes the following issues: Update to 3.11.5. * CVE-2023-40217: Fixed TLS handshake bypass on closed sockets (bsc#1214692). * CVE-2023-41105: Fixed input truncation on null bytes in os.path.normpath (bsc#1214693). ## Patch Instructions: To install this SUSE update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: * openSUSE Leap 15.4 zypper in -t patch SUSE-2023-3943=1 openSUSE-SLE-15.4-2023-3943=1 * openSUSE Leap 15.5 zypper in -t patch openSUSE-SLE-15.5-2023-3943=1 * Python 3 Module 15-SP4 zypper in -t patch SUSE-SLE-Module-Python3-15-SP4-2023-3943=1 * Python 3 Module 15-SP5 zypper in -t patch SUSE-SLE-Module-Python3-15-SP5-2023-3943=1 ## Package List: * openSUSE Leap 15.4 (aarch64 ppc64le s390x x86_64 i586) * python311-curses-3.11.5-150400.9.20.1 * python311-doc-devhelp-3.11.5-150400.9.20.2 * python311-testsuite-debuginfo-3.11.5-150400.9.20.2 * libpython3_11-1_0-3.11.5-150400.9.20.2 * python311-dbm-debuginfo-3.11.5-150400.9.20.1 * python311-core-debugsource-3.11.5-150400.9.20.2 * python311-tools-3.11.5-150400.9.20.2 * python311-tk-debuginfo-3.11.5-150400.9.20.1 * python311-curses-debuginfo-3.11.5-150400.9.20.1 * python311-doc-3.11.5-150400.9.20.2 * python311-devel-3.11.5-150400.9.20.2 * python311-idle-3.11.5-150400.9.20.1 * python311-base-debuginfo-3.11.5-150400.9.20.2 * python311-tk-3.11.5-150400.9.20.1 * python311-dbm-3.11.5-150400.9.20.1 * python311-3.11.5-150400.9.20.1 * python311-debugsource-3.11.5-150400.9.20.1 * python311-testsuite-3.11.5-150400.9.20.2 * python311-debuginfo-3.11.5-150400.9.20.1 * python311-base-3.11.5-150400.9.20.2 * libpython3_11-1_0-debuginfo-3.11.5-150400.9.20.2 * openSUSE Leap 15.4 (x86_64) * python311-32bit-debuginfo-3.11.5-150400.9.20.1 * python311-32bit-3.11.5-150400.9.20.1 * libpython3_11-1_0-32bit-3.11.5-150400.9.20.2 * libpython3_11-1_0-32bit-debuginfo-3.11.5-150400.9.20.2 * python311-base-32bit-debuginfo-3.11.5-150400.9.20.2 * python311-base-32bit-3.11.5-150400.9.20.2 * openSUSE Leap 15.4 (aarch64_ilp32) * libpython3_11-1_0-64bit-3.11.5-150400.9.20.2 * python311-64bit-debuginfo-3.11.5-150400.9.20.1 * python311-base-64bit-debuginfo-3.11.5-150400.9.20.2 * python311-base-64bit-3.11.5-150400.9.20.2 * libpython3_11-1_0-64bit-debuginfo-3.11.5-150400.9.20.2 * python311-64bit-3.11.5-150400.9.20.1 * openSUSE Leap 15.5 (aarch64 ppc64le s390x x86_64) * python311-curses-3.11.5-150400.9.20.1 * python311-doc-devhelp-3.11.5-150400.9.20.2 * python311-testsuite-debuginfo-3.11.5-150400.9.20.2 * libpython3_11-1_0-3.11.5-150400.9.20.2 * python311-dbm-debuginfo-3.11.5-150400.9.20.1 * python311-core-debugsource-3.11.5-150400.9.20.2 * python311-tools-3.11.5-150400.9.20.2 * python311-tk-debuginfo-3.11.5-150400.9.20.1 * python311-curses-debuginfo-3.11.5-150400.9.20.1 * python311-doc-3.11.5-150400.9.20.2 * python311-devel-3.11.5-150400.9.20.2 * python311-idle-3.11.5-150400.9.20.1 * python311-base-debuginfo-3.11.5-150400.9.20.2 * python311-tk-3.11.5-150400.9.20.1 * python311-3.11.5-150400.9.20.1 * python311-dbm-3.11.5-150400.9.20.1 * python311-debugsource-3.11.5-150400.9.20.1 * python311-testsuite-3.11.5-150400.9.20.2 * python311-debuginfo-3.11.5-150400.9.20.1 * python311-base-3.11.5-150400.9.20.2 * libpython3_11-1_0-debuginfo-3.11.5-150400.9.20.2 * openSUSE Leap 15.5 (x86_64) * python311-32bit-debuginfo-3.11.5-150400.9.20.1 * python311-32bit-3.11.5-150400.9.20.1 * libpython3_11-1_0-32bit-3.11.5-150400.9.20.2 * libpython3_11-1_0-32bit-debuginfo-3.11.5-150400.9.20.2 * python311-base-32bit-debuginfo-3.11.5-150400.9.20.2 * python311-base-32bit-3.11.5-150400.9.20.2 * Python 3 Module 15-SP4 (aarch64 ppc64le s390x x86_64) * python311-debuginfo-3.11.5-150400.9.20.1 * python311-curses-3.11.5-150400.9.20.1 * python311-doc-devhelp-3.11.5-150400.9.20.2 * python311-curses-debuginfo-3.11.5-150400.9.20.1 * python311-tk-3.11.5-150400.9.20.1 * libpython3_11-1_0-3.11.5-150400.9.20.2 * python311-idle-3.11.5-150400.9.20.1 * python311-base-3.11.5-150400.9.20.2 * python311-dbm-debuginfo-3.11.5-150400.9.20.1 * python311-3.11.5-150400.9.20.1 * python311-dbm-3.11.5-150400.9.20.1 * python311-doc-3.11.5-150400.9.20.2 * python311-devel-3.11.5-150400.9.20.2 * python311-core-debugsource-3.11.5-150400.9.20.2 * python311-tools-3.11.5-150400.9.20.2 * python311-base-debuginfo-3.11.5-150400.9.20.2 * python311-debugsource-3.11.5-150400.9.20.1 * libpython3_11-1_0-debuginfo-3.11.5-150400.9.20.2 * python311-tk-debuginfo-3.11.5-150400.9.20.1 * Python 3 Module 15-SP5 (aarch64 ppc64le s390x x86_64) * python311-debuginfo-3.11.5-150400.9.20.1 * python311-curses-3.11.5-150400.9.20.1 * python311-doc-devhelp-3.11.5-150400.9.20.2 * python311-curses-debuginfo-3.11.5-150400.9.20.1 * python311-tk-3.11.5-150400.9.20.1 * libpython3_11-1_0-3.11.5-150400.9.20.2 * python311-idle-3.11.5-150400.9.20.1 * python311-base-3.11.5-150400.9.20.2 * python311-dbm-debuginfo-3.11.5-150400.9.20.1 * python311-3.11.5-150400.9.20.1 * python311-dbm-3.11.5-150400.9.20.1 * python311-doc-3.11.5-150400.9.20.2 * python311-devel-3.11.5-150400.9.20.2 * python311-core-debugsource-3.11.5-150400.9.20.2 * python311-tools-3.11.5-150400.9.20.2 * python311-base-debuginfo-3.11.5-150400.9.20.2 * python311-debugsource-3.11.5-150400.9.20.1 * libpython3_11-1_0-debuginfo-3.11.5-150400.9.20.2 * python311-tk-debuginfo-3.11.5-150400.9.20.1 ## References: * https://www.suse.com/security/cve/CVE-2023-40217.html * https://www.suse.com/security/cve/CVE-2023-41105.html * https://bugzilla.suse.com/show_bug.cgi?id=1214692 * https://bugzilla.suse.com/show_bug.cgi?id=1214693

1 0

SUSE-SU-2023:3944-1: moderate: Security update for libqb
by security＠lists.opensuse.org 03 Oct '23

03 Oct '23

# Security update for libqb Announcement ID: SUSE-SU-2023:3944-1 Rating: moderate References: * #1214066 Cross-References: * CVE-2023-39976 CVSS scores: * CVE-2023-39976 ( SUSE ): 5.9 CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H * CVE-2023-39976 ( NVD ): 9.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H Affected Products: * Basesystem Module 15-SP4 * openSUSE Leap 15.4 * SUSE Linux Enterprise Desktop 15 SP4 * SUSE Linux Enterprise High Availability Extension 15 SP4 * SUSE Linux Enterprise High Performance Computing 15 SP4 * SUSE Linux Enterprise Real Time 15 SP4 * SUSE Linux Enterprise Server 15 SP4 * SUSE Linux Enterprise Server for SAP Applications 15 SP4 * SUSE Manager Proxy 4.3 * SUSE Manager Retail Branch Server 4.3 * SUSE Manager Server 4.3 An update that solves one vulnerability can now be installed. ## Description: This update for libqb fixes the following issues: * CVE-2023-39976: Fixed potential bufferoverflow with long log messages (bsc#1214066). ## Patch Instructions: To install this SUSE update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: * openSUSE Leap 15.4 zypper in -t patch SUSE-2023-3944=1 openSUSE-SLE-15.4-2023-3944=1 * Basesystem Module 15-SP4 zypper in -t patch SUSE-SLE-Module-Basesystem-15-SP4-2023-3944=1 * SUSE Linux Enterprise High Availability Extension 15 SP4 zypper in -t patch SUSE-SLE-Product-HA-15-SP4-2023-3944=1 ## Package List: * openSUSE Leap 15.4 (aarch64 ppc64le s390x x86_64 i586) * libqb-devel-2.0.4+20211112.a2691b9-150400.4.3.1 * doxygen2man-2.0.4+20211112.a2691b9-150400.4.3.1 * libqb-tools-debuginfo-2.0.4+20211112.a2691b9-150400.4.3.1 * libqb100-2.0.4+20211112.a2691b9-150400.4.3.1 * doxygen2man-debuginfo-2.0.4+20211112.a2691b9-150400.4.3.1 * libqb-debugsource-2.0.4+20211112.a2691b9-150400.4.3.1 * libqb100-debuginfo-2.0.4+20211112.a2691b9-150400.4.3.1 * libqb-tests-debuginfo-2.0.4+20211112.a2691b9-150400.4.3.1 * libqb-tests-2.0.4+20211112.a2691b9-150400.4.3.1 * libqb-tools-2.0.4+20211112.a2691b9-150400.4.3.1 * openSUSE Leap 15.4 (x86_64) * libqb100-32bit-debuginfo-2.0.4+20211112.a2691b9-150400.4.3.1 * libqb100-32bit-2.0.4+20211112.a2691b9-150400.4.3.1 * libqb-devel-32bit-2.0.4+20211112.a2691b9-150400.4.3.1 * openSUSE Leap 15.4 (aarch64_ilp32) * libqb100-64bit-2.0.4+20211112.a2691b9-150400.4.3.1 * libqb100-64bit-debuginfo-2.0.4+20211112.a2691b9-150400.4.3.1 * libqb-devel-64bit-2.0.4+20211112.a2691b9-150400.4.3.1 * Basesystem Module 15-SP4 (aarch64 ppc64le s390x x86_64) * libqb-debugsource-2.0.4+20211112.a2691b9-150400.4.3.1 * libqb100-debuginfo-2.0.4+20211112.a2691b9-150400.4.3.1 * libqb-devel-2.0.4+20211112.a2691b9-150400.4.3.1 * libqb100-2.0.4+20211112.a2691b9-150400.4.3.1 * SUSE Linux Enterprise High Availability Extension 15 SP4 (aarch64 ppc64le s390x x86_64) * doxygen2man-2.0.4+20211112.a2691b9-150400.4.3.1 * libqb-tools-debuginfo-2.0.4+20211112.a2691b9-150400.4.3.1 * doxygen2man-debuginfo-2.0.4+20211112.a2691b9-150400.4.3.1 * libqb-debugsource-2.0.4+20211112.a2691b9-150400.4.3.1 * libqb-tests-debuginfo-2.0.4+20211112.a2691b9-150400.4.3.1 * libqb-tests-2.0.4+20211112.a2691b9-150400.4.3.1 * libqb-tools-2.0.4+20211112.a2691b9-150400.4.3.1 ## References: * https://www.suse.com/security/cve/CVE-2023-39976.html * https://bugzilla.suse.com/show_bug.cgi?id=1214066

1 0

SUSE-SU-2023:3945-1: moderate: Security update for postfix
by security＠lists.opensuse.org 03 Oct '23

03 Oct '23

# Security update for postfix Announcement ID: SUSE-SU-2023:3945-1 Rating: moderate References: * #1211196 * #1215372 Cross-References: * CVE-2023-32182 CVSS scores: * CVE-2023-32182 ( SUSE ): 5.5 CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N * CVE-2023-32182 ( NVD ): 5.9 CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L Affected Products: * Basesystem Module 15-SP4 * Legacy Module 15-SP4 * openSUSE Leap 15.4 * Server Applications Module 15-SP4 * SUSE Linux Enterprise Desktop 15 SP4 * SUSE Linux Enterprise High Performance Computing 15 SP4 * SUSE Linux Enterprise Real Time 15 SP4 * SUSE Linux Enterprise Server 15 SP4 * SUSE Linux Enterprise Server for SAP Applications 15 SP4 * SUSE Manager Proxy 4.2 * SUSE Manager Proxy 4.3 * SUSE Manager Retail Branch Server 4.2 * SUSE Manager Retail Branch Server 4.3 * SUSE Manager Server 4.2 * SUSE Manager Server 4.3 An update that solves one vulnerability and has one security fix can now be installed. ## Description: This update for postfix fixes the following issues: Security fixes: * CVE-2023-32182: Fixed config_postfix SUSE specific script using potentially bad /tmp file (bsc#1211196). Other fixes: * postfix: config.postfix causes too tight permission on main.cf (bsc#1215372). ## Patch Instructions: To install this SUSE update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: * openSUSE Leap 15.4 zypper in -t patch openSUSE-SLE-15.4-2023-3945=1 * Basesystem Module 15-SP4 zypper in -t patch SUSE-SLE-Module-Basesystem-15-SP4-2023-3945=1 * Legacy Module 15-SP4 zypper in -t patch SUSE-SLE-Module-Legacy-15-SP4-2023-3945=1 * Server Applications Module 15-SP4 zypper in -t patch SUSE-SLE-Module-Server-Applications-15-SP4-2023-3945=1 * SUSE Manager Proxy 4.2 zypper in -t patch SUSE-SLE-Product-SUSE-Manager-Proxy-4.2-2023-3945=1 * SUSE Manager Retail Branch Server 4.2 zypper in -t patch SUSE-SLE-Product-SUSE-Manager-Retail-Branch- Server-4.2-2023-3945=1 * SUSE Manager Server 4.2 zypper in -t patch SUSE-SLE-Product-SUSE-Manager-Server-4.2-2023-3945=1 ## Package List: * openSUSE Leap 15.4 (aarch64 ppc64le s390x x86_64) * postfix-ldap-debuginfo-3.5.9-150300.5.12.2 * postfix-bdb-lmdb-3.5.9-150300.5.12.2 * postfix-bdb-debugsource-3.5.9-150300.5.12.2 * postfix-3.5.9-150300.5.12.2 * postfix-postgresql-debuginfo-3.5.9-150300.5.12.2 * postfix-ldap-3.5.9-150300.5.12.2 * postfix-debuginfo-3.5.9-150300.5.12.2 * postfix-mysql-debuginfo-3.5.9-150300.5.12.2 * postfix-postgresql-3.5.9-150300.5.12.2 * postfix-bdb-3.5.9-150300.5.12.2 * postfix-bdb-debuginfo-3.5.9-150300.5.12.2 * postfix-debugsource-3.5.9-150300.5.12.2 * postfix-devel-3.5.9-150300.5.12.2 * postfix-bdb-lmdb-debuginfo-3.5.9-150300.5.12.2 * postfix-mysql-3.5.9-150300.5.12.2 * openSUSE Leap 15.4 (noarch) * postfix-doc-3.5.9-150300.5.12.2 * Basesystem Module 15-SP4 (aarch64 ppc64le s390x x86_64) * postfix-ldap-debuginfo-3.5.9-150300.5.12.2 * postfix-3.5.9-150300.5.12.2 * postfix-ldap-3.5.9-150300.5.12.2 * postfix-debuginfo-3.5.9-150300.5.12.2 * postfix-devel-3.5.9-150300.5.12.2 * postfix-debugsource-3.5.9-150300.5.12.2 * Basesystem Module 15-SP4 (noarch) * postfix-doc-3.5.9-150300.5.12.2 * Legacy Module 15-SP4 (aarch64 ppc64le s390x x86_64) * postfix-bdb-lmdb-3.5.9-150300.5.12.2 * postfix-bdb-debugsource-3.5.9-150300.5.12.2 * postfix-bdb-3.5.9-150300.5.12.2 * postfix-bdb-debuginfo-3.5.9-150300.5.12.2 * postfix-bdb-lmdb-debuginfo-3.5.9-150300.5.12.2 * Server Applications Module 15-SP4 (aarch64 ppc64le s390x x86_64) * postfix-mysql-debuginfo-3.5.9-150300.5.12.2 * postfix-debugsource-3.5.9-150300.5.12.2 * postfix-debuginfo-3.5.9-150300.5.12.2 * postfix-mysql-3.5.9-150300.5.12.2 * SUSE Manager Proxy 4.2 (x86_64) * postfix-ldap-debuginfo-3.5.9-150300.5.12.2 * postfix-3.5.9-150300.5.12.2 * postfix-ldap-3.5.9-150300.5.12.2 * postfix-debuginfo-3.5.9-150300.5.12.2 * postfix-mysql-debuginfo-3.5.9-150300.5.12.2 * postfix-devel-3.5.9-150300.5.12.2 * postfix-debugsource-3.5.9-150300.5.12.2 * postfix-mysql-3.5.9-150300.5.12.2 * SUSE Manager Proxy 4.2 (noarch) * postfix-doc-3.5.9-150300.5.12.2 * SUSE Manager Retail Branch Server 4.2 (x86_64) * postfix-ldap-debuginfo-3.5.9-150300.5.12.2 * postfix-3.5.9-150300.5.12.2 * postfix-ldap-3.5.9-150300.5.12.2 * postfix-debuginfo-3.5.9-150300.5.12.2 * postfix-mysql-debuginfo-3.5.9-150300.5.12.2 * postfix-devel-3.5.9-150300.5.12.2 * postfix-debugsource-3.5.9-150300.5.12.2 * postfix-mysql-3.5.9-150300.5.12.2 * SUSE Manager Retail Branch Server 4.2 (noarch) * postfix-doc-3.5.9-150300.5.12.2 * SUSE Manager Server 4.2 (ppc64le s390x x86_64) * postfix-ldap-debuginfo-3.5.9-150300.5.12.2 * postfix-3.5.9-150300.5.12.2 * postfix-ldap-3.5.9-150300.5.12.2 * postfix-debuginfo-3.5.9-150300.5.12.2 * postfix-mysql-debuginfo-3.5.9-150300.5.12.2 * postfix-devel-3.5.9-150300.5.12.2 * postfix-debugsource-3.5.9-150300.5.12.2 * postfix-mysql-3.5.9-150300.5.12.2 * SUSE Manager Server 4.2 (noarch) * postfix-doc-3.5.9-150300.5.12.2 ## References: * https://www.suse.com/security/cve/CVE-2023-32182.html * https://bugzilla.suse.com/show_bug.cgi?id=1211196 * https://bugzilla.suse.com/show_bug.cgi?id=1215372

1 0

SUSE-SU-2023:3946-1: important: Security update for libvpx
by security＠lists.opensuse.org 03 Oct '23

03 Oct '23

# Security update for libvpx Announcement ID: SUSE-SU-2023:3946-1 Rating: important References: * #1215778 Cross-References: * CVE-2023-5217 CVSS scores: * CVE-2023-5217 ( SUSE ): 8.4 CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H * CVE-2023-5217 ( NVD ): 8.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H Affected Products: * Basesystem Module 15-SP4 * Basesystem Module 15-SP5 * openSUSE Leap 15.4 * openSUSE Leap 15.5 * SUSE Linux Enterprise Desktop 15 SP4 * SUSE Linux Enterprise Desktop 15 SP5 * SUSE Linux Enterprise High Performance Computing 15 SP4 * SUSE Linux Enterprise High Performance Computing 15 SP5 * SUSE Linux Enterprise Micro 5.3 * SUSE Linux Enterprise Micro 5.4 * SUSE Linux Enterprise Micro 5.5 * SUSE Linux Enterprise Real Time 15 SP4 * SUSE Linux Enterprise Real Time 15 SP5 * SUSE Linux Enterprise Server 15 SP4 * SUSE Linux Enterprise Server 15 SP5 * SUSE Linux Enterprise Server for SAP Applications 15 SP4 * SUSE Linux Enterprise Server for SAP Applications 15 SP5 * SUSE Manager Proxy 4.3 * SUSE Manager Retail Branch Server 4.3 * SUSE Manager Server 4.3 * SUSE Package Hub 15 15-SP4 * SUSE Package Hub 15 15-SP5 An update that solves one vulnerability can now be installed. ## Description: This update for libvpx fixes the following issues: * CVE-2023-5217: Fixed a heap buffer overflow (bsc#1215778). ## Patch Instructions: To install this SUSE update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: * Basesystem Module 15-SP4 zypper in -t patch SUSE-SLE-Module-Basesystem-15-SP4-2023-3946=1 * Basesystem Module 15-SP5 zypper in -t patch SUSE-SLE-Module-Basesystem-15-SP5-2023-3946=1 * SUSE Package Hub 15 15-SP4 zypper in -t patch SUSE-SLE-Module-Packagehub-Subpackages-15-SP4-2023-3946=1 * SUSE Package Hub 15 15-SP5 zypper in -t patch SUSE-SLE-Module-Packagehub-Subpackages-15-SP5-2023-3946=1 * openSUSE Leap 15.4 zypper in -t patch SUSE-2023-3946=1 openSUSE-SLE-15.4-2023-3946=1 * openSUSE Leap 15.5 zypper in -t patch openSUSE-SLE-15.5-2023-3946=1 ## Package List: * Basesystem Module 15-SP4 (aarch64 ppc64le s390x x86_64) * libvpx-devel-1.11.0-150400.3.3.1 * libvpx-debugsource-1.11.0-150400.3.3.1 * libvpx7-debuginfo-1.11.0-150400.3.3.1 * libvpx7-1.11.0-150400.3.3.1 * Basesystem Module 15-SP5 (aarch64 ppc64le s390x x86_64) * libvpx-devel-1.11.0-150400.3.3.1 * libvpx-debugsource-1.11.0-150400.3.3.1 * libvpx7-debuginfo-1.11.0-150400.3.3.1 * libvpx7-1.11.0-150400.3.3.1 * SUSE Package Hub 15 15-SP4 (aarch64 ppc64le s390x x86_64) * libvpx-debugsource-1.11.0-150400.3.3.1 * vpx-tools-debuginfo-1.11.0-150400.3.3.1 * vpx-tools-1.11.0-150400.3.3.1 * SUSE Package Hub 15 15-SP5 (aarch64 ppc64le s390x x86_64) * libvpx-debugsource-1.11.0-150400.3.3.1 * vpx-tools-debuginfo-1.11.0-150400.3.3.1 * vpx-tools-1.11.0-150400.3.3.1 * openSUSE Leap 15.4 (aarch64 ppc64le s390x x86_64 i586) * libvpx7-debuginfo-1.11.0-150400.3.3.1 * libvpx-devel-1.11.0-150400.3.3.1 * libvpx-debugsource-1.11.0-150400.3.3.1 * vpx-tools-debuginfo-1.11.0-150400.3.3.1 * vpx-tools-1.11.0-150400.3.3.1 * libvpx7-1.11.0-150400.3.3.1 * openSUSE Leap 15.4 (x86_64) * libvpx7-32bit-debuginfo-1.11.0-150400.3.3.1 * libvpx7-32bit-1.11.0-150400.3.3.1 * openSUSE Leap 15.4 (aarch64_ilp32) * libvpx7-64bit-debuginfo-1.11.0-150400.3.3.1 * libvpx7-64bit-1.11.0-150400.3.3.1 * openSUSE Leap 15.5 (aarch64 ppc64le s390x x86_64) * libvpx7-debuginfo-1.11.0-150400.3.3.1 * libvpx-devel-1.11.0-150400.3.3.1 * libvpx-debugsource-1.11.0-150400.3.3.1 * vpx-tools-debuginfo-1.11.0-150400.3.3.1 * vpx-tools-1.11.0-150400.3.3.1 * libvpx7-1.11.0-150400.3.3.1 * openSUSE Leap 15.5 (x86_64) * libvpx7-32bit-debuginfo-1.11.0-150400.3.3.1 * libvpx7-32bit-1.11.0-150400.3.3.1 ## References: * https://www.suse.com/security/cve/CVE-2023-5217.html * https://bugzilla.suse.com/show_bug.cgi?id=1215778

1 0

SUSE-SU-2023:3947-1: moderate: Security update for poppler
by security＠lists.opensuse.org 03 Oct '23

03 Oct '23

# Security update for poppler Announcement ID: SUSE-SU-2023:3947-1 Rating: moderate References: * #1214618 * #1214621 * #1214622 Cross-References: * CVE-2022-37050 * CVE-2022-37051 * CVE-2022-38349 CVSS scores: * CVE-2022-37050 ( SUSE ): 5.5 CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H * CVE-2022-37050 ( NVD ): 6.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H * CVE-2022-37051 ( SUSE ): 5.5 CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H * CVE-2022-37051 ( NVD ): 6.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H * CVE-2022-38349 ( SUSE ): 3.3 CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:L * CVE-2022-38349 ( NVD ): 6.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H Affected Products: * Basesystem Module 15-SP4 * openSUSE Leap 15.4 * SUSE Linux Enterprise Desktop 15 SP4 * SUSE Linux Enterprise Desktop 15 SP5 * SUSE Linux Enterprise High Performance Computing 15 SP4 * SUSE Linux Enterprise Micro 5.3 * SUSE Linux Enterprise Micro 5.4 * SUSE Linux Enterprise Real Time 15 SP4 * SUSE Linux Enterprise Server 15 SP4 * SUSE Linux Enterprise Server 15 SP5 * SUSE Linux Enterprise Server for SAP Applications 15 SP4 * SUSE Linux Enterprise Server for SAP Applications 15 SP5 * SUSE Linux Enterprise Workstation Extension 15 SP5 * SUSE Manager Proxy 4.3 * SUSE Manager Retail Branch Server 4.3 * SUSE Manager Server 4.3 * SUSE Package Hub 15 15-SP4 An update that solves three vulnerabilities can now be installed. ## Description: This update for poppler fixes the following issues: * CVE-2022-37050: Fixed denial-of-service via savePageAs in PDFDoc.c (bsc#1214622). * CVE-2022-37051: Fixed abort in main() in pdfunite.cc (bsc#1214621). * CVE-2022-38349: Fixed reachable assertion in Object.h that will lead to denial of service (bsc#1214618). ## Patch Instructions: To install this SUSE update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: * openSUSE Leap 15.4 zypper in -t patch SUSE-2023-3947=1 openSUSE-SLE-15.4-2023-3947=1 * Basesystem Module 15-SP4 zypper in -t patch SUSE-SLE-Module-Basesystem-15-SP4-2023-3947=1 * SUSE Package Hub 15 15-SP4 zypper in -t patch SUSE-SLE-Module-Packagehub-Subpackages-15-SP4-2023-3947=1 * SUSE Linux Enterprise Workstation Extension 15 SP5 zypper in -t patch SUSE-SLE-Product-WE-15-SP5-2023-3947=1 ## Package List: * openSUSE Leap 15.4 (aarch64 ppc64le s390x x86_64 i586) * poppler-tools-22.01.0-150400.3.11.2 * typelib-1_0-Poppler-0_18-22.01.0-150400.3.11.2 * libpoppler-glib8-22.01.0-150400.3.11.2 * libpoppler-qt6-3-debuginfo-22.01.0-150400.3.11.2 * poppler-tools-debuginfo-22.01.0-150400.3.11.2 * libpoppler-glib-devel-22.01.0-150400.3.11.2 * libpoppler-cpp0-22.01.0-150400.3.11.2 * libpoppler-devel-22.01.0-150400.3.11.2 * libpoppler117-debuginfo-22.01.0-150400.3.11.2 * libpoppler-qt6-3-22.01.0-150400.3.11.2 * libpoppler-cpp0-debuginfo-22.01.0-150400.3.11.2 * libpoppler-qt5-1-debuginfo-22.01.0-150400.3.11.2 * libpoppler-qt6-devel-22.01.0-150400.3.11.2 * libpoppler117-22.01.0-150400.3.11.2 * poppler-qt6-debugsource-22.01.0-150400.3.11.2 * poppler-qt5-debugsource-22.01.0-150400.3.11.2 * libpoppler-glib8-debuginfo-22.01.0-150400.3.11.2 * libpoppler-qt5-devel-22.01.0-150400.3.11.2 * poppler-debugsource-22.01.0-150400.3.11.2 * libpoppler-qt5-1-22.01.0-150400.3.11.2 * openSUSE Leap 15.4 (x86_64) * libpoppler-glib8-32bit-22.01.0-150400.3.11.2 * libpoppler117-32bit-debuginfo-22.01.0-150400.3.11.2 * libpoppler-cpp0-32bit-debuginfo-22.01.0-150400.3.11.2 * libpoppler-qt5-1-32bit-22.01.0-150400.3.11.2 * libpoppler-glib8-32bit-debuginfo-22.01.0-150400.3.11.2 * libpoppler-qt5-1-32bit-debuginfo-22.01.0-150400.3.11.2 * libpoppler-cpp0-32bit-22.01.0-150400.3.11.2 * libpoppler117-32bit-22.01.0-150400.3.11.2 * openSUSE Leap 15.4 (aarch64_ilp32) * libpoppler117-64bit-22.01.0-150400.3.11.2 * libpoppler-glib8-64bit-22.01.0-150400.3.11.2 * libpoppler-cpp0-64bit-debuginfo-22.01.0-150400.3.11.2 * libpoppler117-64bit-debuginfo-22.01.0-150400.3.11.2 * libpoppler-qt5-1-64bit-debuginfo-22.01.0-150400.3.11.2 * libpoppler-qt5-1-64bit-22.01.0-150400.3.11.2 * libpoppler-cpp0-64bit-22.01.0-150400.3.11.2 * libpoppler-glib8-64bit-debuginfo-22.01.0-150400.3.11.2 * Basesystem Module 15-SP4 (aarch64 ppc64le s390x x86_64) * poppler-tools-22.01.0-150400.3.11.2 * typelib-1_0-Poppler-0_18-22.01.0-150400.3.11.2 * libpoppler-glib8-22.01.0-150400.3.11.2 * poppler-tools-debuginfo-22.01.0-150400.3.11.2 * libpoppler-glib-devel-22.01.0-150400.3.11.2 * libpoppler-cpp0-22.01.0-150400.3.11.2 * libpoppler-devel-22.01.0-150400.3.11.2 * libpoppler117-debuginfo-22.01.0-150400.3.11.2 * libpoppler-cpp0-debuginfo-22.01.0-150400.3.11.2 * libpoppler117-22.01.0-150400.3.11.2 * libpoppler-glib8-debuginfo-22.01.0-150400.3.11.2 * poppler-debugsource-22.01.0-150400.3.11.2 * SUSE Package Hub 15 15-SP4 (aarch64 ppc64le s390x x86_64) * libpoppler-cpp0-22.01.0-150400.3.11.2 * libpoppler-devel-22.01.0-150400.3.11.2 * libpoppler-cpp0-debuginfo-22.01.0-150400.3.11.2 * libpoppler-qt5-1-debuginfo-22.01.0-150400.3.11.2 * poppler-qt5-debugsource-22.01.0-150400.3.11.2 * libpoppler-qt5-devel-22.01.0-150400.3.11.2 * poppler-debugsource-22.01.0-150400.3.11.2 * libpoppler-qt5-1-22.01.0-150400.3.11.2 * SUSE Package Hub 15 15-SP4 (x86_64) * libpoppler-glib8-32bit-22.01.0-150400.3.11.2 * libpoppler117-32bit-debuginfo-22.01.0-150400.3.11.2 * libpoppler-glib8-32bit-debuginfo-22.01.0-150400.3.11.2 * libpoppler117-32bit-22.01.0-150400.3.11.2 * SUSE Linux Enterprise Workstation Extension 15 SP5 (x86_64) * poppler-debugsource-22.01.0-150400.3.11.2 * libpoppler117-22.01.0-150400.3.11.2 * libpoppler117-debuginfo-22.01.0-150400.3.11.2 ## References: * https://www.suse.com/security/cve/CVE-2022-37050.html * https://www.suse.com/security/cve/CVE-2022-37051.html * https://www.suse.com/security/cve/CVE-2022-38349.html * https://bugzilla.suse.com/show_bug.cgi?id=1214618 * https://bugzilla.suse.com/show_bug.cgi?id=1214621 * https://bugzilla.suse.com/show_bug.cgi?id=1214622

1 0

SUSE-SU-2023:3948-1: important: Security update for libvpx
by security＠lists.opensuse.org 03 Oct '23

03 Oct '23

# Security update for libvpx Announcement ID: SUSE-SU-2023:3948-1 Rating: important References: * #1215778 Cross-References: * CVE-2023-5217 CVSS scores: * CVE-2023-5217 ( SUSE ): 8.4 CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H * CVE-2023-5217 ( NVD ): 8.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H Affected Products: * Desktop Applications Module 15-SP4 * Desktop Applications Module 15-SP5 * openSUSE Leap 15.4 * SUSE CaaS Platform 4.0 * SUSE Enterprise Storage 7.1 * SUSE Linux Enterprise Desktop 15 SP4 * SUSE Linux Enterprise Desktop 15 SP5 * SUSE Linux Enterprise High Performance Computing 15 SP1 * SUSE Linux Enterprise High Performance Computing 15 SP1 LTSS 15-SP1 * SUSE Linux Enterprise High Performance Computing 15 SP2 * SUSE Linux Enterprise High Performance Computing 15 SP2 LTSS 15-SP2 * SUSE Linux Enterprise High Performance Computing 15 SP3 * SUSE Linux Enterprise High Performance Computing 15 SP4 * SUSE Linux Enterprise High Performance Computing 15 SP5 * SUSE Linux Enterprise High Performance Computing ESPOS 15 SP3 * SUSE Linux Enterprise High Performance Computing LTSS 15 SP3 * SUSE Linux Enterprise Real Time 15 SP4 * SUSE Linux Enterprise Real Time 15 SP5 * SUSE Linux Enterprise Server 15 SP1 * SUSE Linux Enterprise Server 15 SP1 LTSS 15-SP1 * SUSE Linux Enterprise Server 15 SP2 * SUSE Linux Enterprise Server 15 SP2 LTSS 15-SP2 * SUSE Linux Enterprise Server 15 SP3 * SUSE Linux Enterprise Server 15 SP3 LTSS 15-SP3 * SUSE Linux Enterprise Server 15 SP4 * SUSE Linux Enterprise Server 15 SP5 * SUSE Linux Enterprise Server for SAP Applications 15 SP1 * SUSE Linux Enterprise Server for SAP Applications 15 SP2 * SUSE Linux Enterprise Server for SAP Applications 15 SP3 * SUSE Linux Enterprise Server for SAP Applications 15 SP4 * SUSE Linux Enterprise Server for SAP Applications 15 SP5 * SUSE Manager Proxy 4.2 * SUSE Manager Proxy 4.3 * SUSE Manager Retail Branch Server 4.2 * SUSE Manager Retail Branch Server 4.3 * SUSE Manager Server 4.2 * SUSE Manager Server 4.3 An update that solves one vulnerability can now be installed. ## Description: This update for libvpx fixes the following issues: * CVE-2023-5217: Fixed a heap buffer overflow (bsc#1215778). ## Patch Instructions: To install this SUSE update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: * openSUSE Leap 15.4 zypper in -t patch openSUSE-SLE-15.4-2023-3948=1 * Desktop Applications Module 15-SP4 zypper in -t patch SUSE-SLE-Module-Desktop-Applications-15-SP4-2023-3948=1 * Desktop Applications Module 15-SP5 zypper in -t patch SUSE-SLE-Module-Desktop-Applications-15-SP5-2023-3948=1 * SUSE Linux Enterprise High Performance Computing 15 SP1 LTSS 15-SP1 zypper in -t patch SUSE-SLE-Product-HPC-15-SP1-LTSS-2023-3948=1 * SUSE Linux Enterprise High Performance Computing 15 SP2 LTSS 15-SP2 zypper in -t patch SUSE-SLE-Product-HPC-15-SP2-LTSS-2023-3948=1 * SUSE Linux Enterprise High Performance Computing ESPOS 15 SP3 zypper in -t patch SUSE-SLE-Product-HPC-15-SP3-ESPOS-2023-3948=1 * SUSE Linux Enterprise High Performance Computing LTSS 15 SP3 zypper in -t patch SUSE-SLE-Product-HPC-15-SP3-LTSS-2023-3948=1 * SUSE Linux Enterprise Server 15 SP1 LTSS 15-SP1 zypper in -t patch SUSE-SLE-Product-SLES-15-SP1-LTSS-2023-3948=1 * SUSE Linux Enterprise Server 15 SP2 LTSS 15-SP2 zypper in -t patch SUSE-SLE-Product-SLES-15-SP2-LTSS-2023-3948=1 * SUSE Linux Enterprise Server 15 SP3 LTSS 15-SP3 zypper in -t patch SUSE-SLE-Product-SLES-15-SP3-LTSS-2023-3948=1 * SUSE Linux Enterprise Server for SAP Applications 15 SP1 zypper in -t patch SUSE-SLE-Product-SLES_SAP-15-SP1-2023-3948=1 * SUSE Linux Enterprise Server for SAP Applications 15 SP2 zypper in -t patch SUSE-SLE-Product-SLES_SAP-15-SP2-2023-3948=1 * SUSE Linux Enterprise Server for SAP Applications 15 SP3 zypper in -t patch SUSE-SLE-Product-SLES_SAP-15-SP3-2023-3948=1 * SUSE Manager Proxy 4.2 zypper in -t patch SUSE-SLE-Product-SUSE-Manager-Proxy-4.2-2023-3948=1 * SUSE Manager Retail Branch Server 4.2 zypper in -t patch SUSE-SLE-Product-SUSE-Manager-Retail-Branch- Server-4.2-2023-3948=1 * SUSE Manager Server 4.2 zypper in -t patch SUSE-SLE-Product-SUSE-Manager-Server-4.2-2023-3948=1 * SUSE Enterprise Storage 7.1 zypper in -t patch SUSE-Storage-7.1-2023-3948=1 * SUSE CaaS Platform 4.0 To install this update, use the SUSE CaaS Platform 'skuba' tool. It will inform you if it detects new updates and let you then trigger updating of the complete cluster in a controlled way. ## Package List: * openSUSE Leap 15.4 (aarch64 ppc64le s390x x86_64) * libvpx4-debuginfo-1.6.1-150000.6.11.1 * libvpx4-1.6.1-150000.6.11.1 * openSUSE Leap 15.4 (x86_64) * libvpx4-32bit-debuginfo-1.6.1-150000.6.11.1 * libvpx4-32bit-1.6.1-150000.6.11.1 * Desktop Applications Module 15-SP4 (aarch64 ppc64le s390x x86_64) * libvpx-debugsource-1.6.1-150000.6.11.1 * libvpx4-debuginfo-1.6.1-150000.6.11.1 * libvpx4-1.6.1-150000.6.11.1 * Desktop Applications Module 15-SP5 (aarch64 ppc64le s390x x86_64) * libvpx-debugsource-1.6.1-150000.6.11.1 * libvpx4-debuginfo-1.6.1-150000.6.11.1 * libvpx4-1.6.1-150000.6.11.1 * SUSE Linux Enterprise High Performance Computing 15 SP1 LTSS 15-SP1 (aarch64 x86_64) * libvpx-debugsource-1.6.1-150000.6.11.1 * libvpx4-debuginfo-1.6.1-150000.6.11.1 * libvpx4-1.6.1-150000.6.11.1 * libvpx-devel-1.6.1-150000.6.11.1 * SUSE Linux Enterprise High Performance Computing 15 SP1 LTSS 15-SP1 (x86_64) * libvpx4-32bit-debuginfo-1.6.1-150000.6.11.1 * libvpx4-32bit-1.6.1-150000.6.11.1 * SUSE Linux Enterprise High Performance Computing 15 SP2 LTSS 15-SP2 (aarch64 x86_64) * libvpx-debugsource-1.6.1-150000.6.11.1 * libvpx4-debuginfo-1.6.1-150000.6.11.1 * libvpx4-1.6.1-150000.6.11.1 * libvpx-devel-1.6.1-150000.6.11.1 * SUSE Linux Enterprise High Performance Computing ESPOS 15 SP3 (aarch64 x86_64) * libvpx-debugsource-1.6.1-150000.6.11.1 * libvpx4-debuginfo-1.6.1-150000.6.11.1 * libvpx4-1.6.1-150000.6.11.1 * libvpx-devel-1.6.1-150000.6.11.1 * SUSE Linux Enterprise High Performance Computing LTSS 15 SP3 (aarch64 x86_64) * libvpx-debugsource-1.6.1-150000.6.11.1 * libvpx4-debuginfo-1.6.1-150000.6.11.1 * libvpx4-1.6.1-150000.6.11.1 * libvpx-devel-1.6.1-150000.6.11.1 * SUSE Linux Enterprise Server 15 SP1 LTSS 15-SP1 (aarch64 ppc64le s390x x86_64) * libvpx-debugsource-1.6.1-150000.6.11.1 * libvpx4-debuginfo-1.6.1-150000.6.11.1 * libvpx4-1.6.1-150000.6.11.1 * libvpx-devel-1.6.1-150000.6.11.1 * SUSE Linux Enterprise Server 15 SP1 LTSS 15-SP1 (x86_64) * libvpx4-32bit-debuginfo-1.6.1-150000.6.11.1 * libvpx4-32bit-1.6.1-150000.6.11.1 * SUSE Linux Enterprise Server 15 SP2 LTSS 15-SP2 (aarch64 ppc64le s390x x86_64) * libvpx-debugsource-1.6.1-150000.6.11.1 * libvpx4-debuginfo-1.6.1-150000.6.11.1 * libvpx4-1.6.1-150000.6.11.1 * libvpx-devel-1.6.1-150000.6.11.1 * SUSE Linux Enterprise Server 15 SP3 LTSS 15-SP3 (aarch64 ppc64le s390x x86_64) * libvpx-debugsource-1.6.1-150000.6.11.1 * libvpx4-debuginfo-1.6.1-150000.6.11.1 * libvpx4-1.6.1-150000.6.11.1 * libvpx-devel-1.6.1-150000.6.11.1 * SUSE Linux Enterprise Server for SAP Applications 15 SP1 (ppc64le x86_64) * libvpx-debugsource-1.6.1-150000.6.11.1 * libvpx4-debuginfo-1.6.1-150000.6.11.1 * libvpx4-1.6.1-150000.6.11.1 * libvpx-devel-1.6.1-150000.6.11.1 * SUSE Linux Enterprise Server for SAP Applications 15 SP1 (x86_64) * libvpx4-32bit-debuginfo-1.6.1-150000.6.11.1 * libvpx4-32bit-1.6.1-150000.6.11.1 * SUSE Linux Enterprise Server for SAP Applications 15 SP2 (ppc64le x86_64) * libvpx-debugsource-1.6.1-150000.6.11.1 * libvpx4-debuginfo-1.6.1-150000.6.11.1 * libvpx4-1.6.1-150000.6.11.1 * libvpx-devel-1.6.1-150000.6.11.1 * SUSE Linux Enterprise Server for SAP Applications 15 SP3 (ppc64le x86_64) * libvpx-debugsource-1.6.1-150000.6.11.1 * libvpx4-debuginfo-1.6.1-150000.6.11.1 * libvpx4-1.6.1-150000.6.11.1 * libvpx-devel-1.6.1-150000.6.11.1 * SUSE Manager Proxy 4.2 (x86_64) * libvpx-debugsource-1.6.1-150000.6.11.1 * libvpx4-debuginfo-1.6.1-150000.6.11.1 * libvpx4-1.6.1-150000.6.11.1 * libvpx-devel-1.6.1-150000.6.11.1 * SUSE Manager Retail Branch Server 4.2 (x86_64) * libvpx-debugsource-1.6.1-150000.6.11.1 * libvpx4-debuginfo-1.6.1-150000.6.11.1 * libvpx4-1.6.1-150000.6.11.1 * libvpx-devel-1.6.1-150000.6.11.1 * SUSE Manager Server 4.2 (ppc64le s390x x86_64) * libvpx-debugsource-1.6.1-150000.6.11.1 * libvpx4-debuginfo-1.6.1-150000.6.11.1 * libvpx4-1.6.1-150000.6.11.1 * libvpx-devel-1.6.1-150000.6.11.1 * SUSE Enterprise Storage 7.1 (aarch64 x86_64) * libvpx-debugsource-1.6.1-150000.6.11.1 * libvpx4-debuginfo-1.6.1-150000.6.11.1 * libvpx4-1.6.1-150000.6.11.1 * libvpx-devel-1.6.1-150000.6.11.1 * SUSE CaaS Platform 4.0 (x86_64) * libvpx4-32bit-1.6.1-150000.6.11.1 * libvpx4-1.6.1-150000.6.11.1 * libvpx-debugsource-1.6.1-150000.6.11.1 * libvpx4-debuginfo-1.6.1-150000.6.11.1 * libvpx4-32bit-debuginfo-1.6.1-150000.6.11.1 * libvpx-devel-1.6.1-150000.6.11.1 ## References: * https://www.suse.com/security/cve/CVE-2023-5217.html * https://bugzilla.suse.com/show_bug.cgi?id=1215778

1 0