November 2023 - openSUSE Security Announce

openSUSE-SU-2023:0387-1: important: Security update for chromium
by opensuse-security＠opensuse.org 30 Nov '23

30 Nov '23

openSUSE Security Update: Security update for chromium ______________________________________________________________________________ Announcement ID: openSUSE-SU-2023:0387-1 Rating: important References: #1217614 #1217615 #1217616 Cross-References: CVE-2023-6345 CVE-2023-6346 CVE-2023-6347 CVE-2023-6348 CVE-2023-6350 CVE-2023-6351 Affected Products: openSUSE Backports SLE-15-SP4 openSUSE Backports SLE-15-SP5 ______________________________________________________________________________ An update that fixes 6 vulnerabilities is now available. Description: This update for Chromium fixes the following issue: Chromium 119.0.6045.199 (boo#1217616) * CVE-2023-6348: Type Confusion in Spellcheck * CVE-2023-6347: Use after free in Mojo * CVE-2023-6346: Use after free in WebAudio * CVE-2023-6350: Out of bounds memory access in libavif (boo#1217614) * CVE-2023-6351: Use after free in libavif (boo#1217615) * CVE-2023-6345: Integer overflow in Skia * Various fixes from internal audits, fuzzing and other initiatives. Patch Instructions: To install this openSUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Backports SLE-15-SP5: zypper in -t patch openSUSE-2023-387=1 - openSUSE Backports SLE-15-SP4: zypper in -t patch openSUSE-2023-387=1 Package List: - openSUSE Backports SLE-15-SP5 (aarch64 x86_64): chromedriver-119.0.6045.199-bp155.2.61.1 chromedriver-debuginfo-119.0.6045.199-bp155.2.61.1 chromium-119.0.6045.199-bp155.2.61.1 chromium-debuginfo-119.0.6045.199-bp155.2.61.1 - openSUSE Backports SLE-15-SP4 (aarch64 x86_64): chromedriver-119.0.6045.199-bp154.2.147.1 chromium-119.0.6045.199-bp154.2.147.1 References: https://www.suse.com/security/cve/CVE-2023-6345.html https://www.suse.com/security/cve/CVE-2023-6346.html https://www.suse.com/security/cve/CVE-2023-6347.html https://www.suse.com/security/cve/CVE-2023-6348.html https://www.suse.com/security/cve/CVE-2023-6350.html https://www.suse.com/security/cve/CVE-2023-6351.html https://bugzilla.suse.com/1217614 https://bugzilla.suse.com/1217615 https://bugzilla.suse.com/1217616

1 0

openSUSE-SU-2023:0386-1: important: Security update for opera
by opensuse-security＠opensuse.org 30 Nov '23

30 Nov '23

openSUSE Security Update: Security update for opera ______________________________________________________________________________ Announcement ID: openSUSE-SU-2023:0386-1 Rating: important References: Cross-References: CVE-2023-5997 CVE-2023-6112 CVSS scores: CVE-2023-5997 (NVD) : 8.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H CVE-2023-6112 (NVD) : 8.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H Affected Products: openSUSE Leap 15.5:NonFree ______________________________________________________________________________ An update that fixes two vulnerabilities is now available. Description: This update for opera fixes the following issues: - Update to 105.0.4970.21 * DNA-112425 Choosing Workspace Icons doesn’t work as expected * DNA-112787 glow around tiles in Top Sites section in BABE in dark theme - The update to chromium 119.0.6045.159 fixes following issues: CVE-2023-5997, CVE-2023-6112 - Update to 105.0.4970.16 * CHR-9416 Updating Chromium on desktop-stable-* branches * DNA-111903 [Lin] [Component-based-scrollbar] Old design is displayed on Ubuntu 20.04 * DNA-112914 Visual glitch with HWA enabled in some random places * DNA-113137 [WinLin][Sidebar autohide] Sidebar panel is not connected with sidebar - Update to 105.0.4970.13 * CHR-9416 Updating Chromium on desktop-stable-* branches * DNA-111885 [Address bar] Hover effect on padlock icon is not rounded * DNA-112411 Active Tab in Tab Island in Dark Mode should have different colour * DNA-112431 Dragging tab quickly past last island on the right, causes tab to be dropped at the end of tab strip instead of at location of the cursor * DNA-112878 [Tab strip] Detached tab not restored after restarting browser * DNA-112900 Crash at opera::component_based:: ComponentTabDragController::StopViewDragging * DNA-112996 Translations for O105 * DNA-113213 Promote 105 to stable - Complete Opera 105 changelog at: https://blogs.opera.com/desktop/changelog-for-105/ - Update to 104.0.4944.54 * DNA-111938 Option 'Automatically hide sidebar' and Full screen makes Opera freeze * DNA-112241 Stuttering video on some systems with OOP SW H.264 decoding * DNA-112636 [Tab strip] Detach button on meeting tabs moves on hover and is replaced by close tab * DNA-112862 Crash at extensions::BookmarksPrivateAPI:: OnListenerAdded(extensions::EventListenerInfo const&) * DNA-112990 Crash when closing tab tooltip and opening Search tabs Patch Instructions: To install this openSUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 15.5:NonFree: zypper in -t patch openSUSE-2023-386=1 Package List: - openSUSE Leap 15.5:NonFree (x86_64): opera-105.0.4970.21-lp155.3.21.1 References: https://www.suse.com/security/cve/CVE-2023-5997.html https://www.suse.com/security/cve/CVE-2023-6112.html

1 0

openSUSE-SU-2023:0384-1: moderate: Security update for python-django-grappelli
by opensuse-security＠opensuse.org 30 Nov '23

30 Nov '23

openSUSE Security Update: Security update for python-django-grappelli ______________________________________________________________________________ Announcement ID: openSUSE-SU-2023:0384-1 Rating: moderate References: #1216481 Cross-References: CVE-2021-46898 CVSS scores: CVE-2021-46898 (NVD) : 6.1 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N Affected Products: openSUSE Backports SLE-15-SP4 ______________________________________________________________________________ An update that fixes one vulnerability is now available. Description: This update for python-django-grappelli fixes the following issues: Update to 2.14.4: - CVE-2021-46898: Fixed views/switch.py vulnerable to protocol-relative URL attacks (boo#1216481) - Fixed: Redirect with switch user. - Improved: Remove extra filtering in AutocompleteLookup. - Improved: Added import statement with URLs for quickstart docs. - Improved: Added additional blocks with inlines to allow override. - Fixed: Compatibility with Django 3.1. - Fixed: Docs about adding Grappelli documentation URLS. Patch Instructions: To install this openSUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Backports SLE-15-SP4: zypper in -t patch openSUSE-2023-384=1 Package List: - openSUSE Backports SLE-15-SP4 (noarch): python3-django-grappelli-2.14.4-bp154.2.3.1 References: https://www.suse.com/security/cve/CVE-2021-46898.html https://bugzilla.suse.com/1216481

1 0

openSUSE-SU-2023:0385-1: important: Security update for opera
by opensuse-security＠opensuse.org 30 Nov '23

30 Nov '23

openSUSE Security Update: Security update for opera ______________________________________________________________________________ Announcement ID: openSUSE-SU-2023:0385-1 Rating: important References: Cross-References: CVE-2023-5997 CVE-2023-6112 CVSS scores: CVE-2023-5997 (NVD) : 8.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H CVE-2023-6112 (NVD) : 8.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H Affected Products: openSUSE Leap 15.4:NonFree ______________________________________________________________________________ An update that fixes two vulnerabilities is now available. Description: This update for opera fixes the following issues: - Update to 105.0.4970.21 * DNA-112425 Choosing Workspace Icons doesn’t work as expected * DNA-112787 glow around tiles in Top Sites section in BABE in dark theme - The update to chromium 119.0.6045.159 fixes following issues: CVE-2023-5997, CVE-2023-6112 - Update to 105.0.4970.16 * CHR-9416 Updating Chromium on desktop-stable-* branches * DNA-111903 [Lin] [Component-based-scrollbar] Old design is displayed on Ubuntu 20.04 * DNA-112914 Visual glitch with HWA enabled in some random places * DNA-113137 [WinLin][Sidebar autohide] Sidebar panel is not connected with sidebar - Update to 105.0.4970.13 * CHR-9416 Updating Chromium on desktop-stable-* branches * DNA-111885 [Address bar] Hover effect on padlock icon is not rounded * DNA-112411 Active Tab in Tab Island in Dark Mode should have different colour * DNA-112431 Dragging tab quickly past last island on the right, causes tab to be dropped at the end of tab strip instead of at location of the cursor * DNA-112878 [Tab strip] Detached tab not restored after restarting browser * DNA-112900 Crash at opera::component_based:: ComponentTabDragController::StopViewDragging * DNA-112996 Translations for O105 * DNA-113213 Promote 105 to stable - Complete Opera 105 changelog at: https://blogs.opera.com/desktop/changelog-for-105/ - Update to 104.0.4944.54 * DNA-111938 Option 'Automatically hide sidebar' and Full screen makes Opera freeze * DNA-112241 Stuttering video on some systems with OOP SW H.264 decoding * DNA-112636 [Tab strip] Detach button on meeting tabs moves on hover and is replaced by close tab * DNA-112862 Crash at extensions::BookmarksPrivateAPI:: OnListenerAdded(extensions::EventListenerInfo const&) * DNA-112990 Crash when closing tab tooltip and opening Search tabs Patch Instructions: To install this openSUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 15.4:NonFree: zypper in -t patch openSUSE-2023-385=1 Package List: - openSUSE Leap 15.4:NonFree (x86_64): opera-105.0.4970.21-lp154.2.62.1 References: https://www.suse.com/security/cve/CVE-2023-5997.html https://www.suse.com/security/cve/CVE-2023-6112.html

1 0

SUSE-SU-2023:4608-1: moderate: Security update for python-Twisted
by security＠lists.opensuse.org 29 Nov '23

29 Nov '23

# Security update for python-Twisted Announcement ID: SUSE-SU-2023:4608-1 Rating: moderate References: * bsc#1216588 Cross-References: * CVE-2023-46137 CVSS scores: * CVE-2023-46137 ( SUSE ): 5.9 CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:N * CVE-2023-46137 ( NVD ): 5.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N Affected Products: * openSUSE Leap 15.4 * openSUSE Leap 15.5 * Python 3 Module 15-SP4 * Python 3 Module 15-SP5 * SUSE Linux Enterprise Desktop 15 SP4 * SUSE Linux Enterprise Desktop 15 SP5 * SUSE Linux Enterprise High Performance Computing 15 SP4 * SUSE Linux Enterprise High Performance Computing 15 SP5 * SUSE Linux Enterprise Server 15 SP4 * SUSE Linux Enterprise Server 15 SP5 * SUSE Linux Enterprise Server for SAP Applications 15 SP4 * SUSE Linux Enterprise Server for SAP Applications 15 SP5 * SUSE Manager Proxy 4.3 * SUSE Manager Retail Branch Server 4.3 * SUSE Manager Server 4.3 An update that solves one vulnerability can now be installed. ## Description: This update for python-Twisted fixes the following issues: * CVE-2023-46137: Fixed issue inside serializing pipelined HTTP requests. (bsc#1216588) ## Patch Instructions: To install this SUSE update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: * openSUSE Leap 15.4 zypper in -t patch SUSE-2023-4608=1 openSUSE-SLE-15.4-2023-4608=1 * openSUSE Leap 15.5 zypper in -t patch openSUSE-SLE-15.5-2023-4608=1 * Python 3 Module 15-SP4 zypper in -t patch SUSE-SLE-Module-Python3-15-SP4-2023-4608=1 * Python 3 Module 15-SP5 zypper in -t patch SUSE-SLE-Module-Python3-15-SP5-2023-4608=1 ## Package List: * openSUSE Leap 15.4 (noarch) * python311-Twisted-22.10.0-150400.5.13.1 * python311-Twisted-conch_nacl-22.10.0-150400.5.13.1 * python311-Twisted-serial-22.10.0-150400.5.13.1 * python311-Twisted-tls-22.10.0-150400.5.13.1 * python311-Twisted-contextvars-22.10.0-150400.5.13.1 * python311-Twisted-http2-22.10.0-150400.5.13.1 * python311-Twisted-conch-22.10.0-150400.5.13.1 * python311-Twisted-all_non_platform-22.10.0-150400.5.13.1 * openSUSE Leap 15.5 (noarch) * python311-Twisted-22.10.0-150400.5.13.1 * python311-Twisted-conch_nacl-22.10.0-150400.5.13.1 * python311-Twisted-serial-22.10.0-150400.5.13.1 * python311-Twisted-tls-22.10.0-150400.5.13.1 * python311-Twisted-contextvars-22.10.0-150400.5.13.1 * python311-Twisted-http2-22.10.0-150400.5.13.1 * python311-Twisted-conch-22.10.0-150400.5.13.1 * python311-Twisted-all_non_platform-22.10.0-150400.5.13.1 * Python 3 Module 15-SP4 (noarch) * python311-Twisted-22.10.0-150400.5.13.1 * python311-Twisted-conch_nacl-22.10.0-150400.5.13.1 * python311-Twisted-serial-22.10.0-150400.5.13.1 * python311-Twisted-tls-22.10.0-150400.5.13.1 * python311-Twisted-contextvars-22.10.0-150400.5.13.1 * python311-Twisted-http2-22.10.0-150400.5.13.1 * python311-Twisted-conch-22.10.0-150400.5.13.1 * python311-Twisted-all_non_platform-22.10.0-150400.5.13.1 * Python 3 Module 15-SP5 (noarch) * python311-Twisted-22.10.0-150400.5.13.1 * python311-Twisted-conch_nacl-22.10.0-150400.5.13.1 * python311-Twisted-serial-22.10.0-150400.5.13.1 * python311-Twisted-tls-22.10.0-150400.5.13.1 * python311-Twisted-contextvars-22.10.0-150400.5.13.1 * python311-Twisted-http2-22.10.0-150400.5.13.1 * python311-Twisted-conch-22.10.0-150400.5.13.1 * python311-Twisted-all_non_platform-22.10.0-150400.5.13.1 ## References: * https://www.suse.com/security/cve/CVE-2023-46137.html * https://bugzilla.suse.com/show_bug.cgi?id=1216588

1 0

SUSE-SU-2023:4607-1: moderate: Security update for python3-Twisted
by security＠lists.opensuse.org 29 Nov '23

29 Nov '23

# Security update for python3-Twisted Announcement ID: SUSE-SU-2023:4607-1 Rating: moderate References: * bsc#1216588 Cross-References: * CVE-2023-46137 CVSS scores: * CVE-2023-46137 ( SUSE ): 5.9 CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:N * CVE-2023-46137 ( NVD ): 5.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N Affected Products: * openSUSE Leap 15.4 * openSUSE Leap 15.5 * Server Applications Module 15-SP4 * Server Applications Module 15-SP5 * SUSE Linux Enterprise High Performance Computing 15 SP4 * SUSE Linux Enterprise High Performance Computing 15 SP5 * SUSE Linux Enterprise Real Time 15 SP4 * SUSE Linux Enterprise Real Time 15 SP5 * SUSE Linux Enterprise Server 15 SP4 * SUSE Linux Enterprise Server 15 SP5 * SUSE Linux Enterprise Server for SAP Applications 15 SP4 * SUSE Linux Enterprise Server for SAP Applications 15 SP5 * SUSE Manager Proxy 4.3 * SUSE Manager Retail Branch Server 4.3 * SUSE Manager Server 4.3 An update that solves one vulnerability can now be installed. ## Description: This update for python3-Twisted fixes the following issues: * CVE-2023-46137: Fixed issue inside serializing pipelined HTTP requests. (bsc#1216588) ## Patch Instructions: To install this SUSE update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: * openSUSE Leap 15.4 zypper in -t patch SUSE-2023-4607=1 openSUSE-SLE-15.4-2023-4607=1 * openSUSE Leap 15.5 zypper in -t patch openSUSE-SLE-15.5-2023-4607=1 * Server Applications Module 15-SP4 zypper in -t patch SUSE-SLE-Module-Server-Applications-15-SP4-2023-4607=1 * Server Applications Module 15-SP5 zypper in -t patch SUSE-SLE-Module-Server-Applications-15-SP5-2023-4607=1 ## Package List: * openSUSE Leap 15.4 (aarch64 ppc64le s390x x86_64 i586) * python3-Twisted-22.2.0-150400.15.1 * python-Twisted-doc-22.2.0-150400.15.1 * openSUSE Leap 15.5 (aarch64 ppc64le s390x x86_64) * python3-Twisted-22.2.0-150400.15.1 * Server Applications Module 15-SP4 (aarch64 ppc64le s390x x86_64) * python3-Twisted-22.2.0-150400.15.1 * Server Applications Module 15-SP5 (aarch64 ppc64le s390x x86_64) * python3-Twisted-22.2.0-150400.15.1 ## References: * https://www.suse.com/security/cve/CVE-2023-46137.html * https://bugzilla.suse.com/show_bug.cgi?id=1216588

1 0

SUSE-SU-2023:4594-1: important: Security update for gstreamer-plugins-bad
by security＠lists.opensuse.org 28 Nov '23

28 Nov '23

# Security update for gstreamer-plugins-bad Announcement ID: SUSE-SU-2023:4594-1 Rating: important References: * bsc#1215793 * bsc#1215796 Cross-References: * CVE-2023-40474 * CVE-2023-40476 CVSS scores: * CVE-2023-40474 ( SUSE ): 8.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H * CVE-2023-40476 ( SUSE ): 8.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:L Affected Products: * openSUSE Leap 15.3 * SUSE Enterprise Storage 7.1 * SUSE Linux Enterprise High Performance Computing 15 SP3 * SUSE Linux Enterprise High Performance Computing ESPOS 15 SP3 * SUSE Linux Enterprise High Performance Computing LTSS 15 SP3 * SUSE Linux Enterprise Server 15 SP3 * SUSE Linux Enterprise Server 15 SP3 LTSS 15-SP3 * SUSE Linux Enterprise Server for SAP Applications 15 SP3 An update that solves two vulnerabilities can now be installed. ## Description: This update for gstreamer-plugins-bad fixes the following issues: * CVE-2023-40474: Fixed integer overflow causing out of bounds writes when handling invalid uncompressed video (bsc#1215796). * CVE-2023-40476: Fixed possible overflow using max_sub_layers_minus1 (bsc#1215793). ## Patch Instructions: To install this SUSE update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: * openSUSE Leap 15.3 zypper in -t patch SUSE-2023-4594=1 * SUSE Linux Enterprise High Performance Computing ESPOS 15 SP3 zypper in -t patch SUSE-SLE-Product-HPC-15-SP3-ESPOS-2023-4594=1 * SUSE Linux Enterprise High Performance Computing LTSS 15 SP3 zypper in -t patch SUSE-SLE-Product-HPC-15-SP3-LTSS-2023-4594=1 * SUSE Linux Enterprise Server 15 SP3 LTSS 15-SP3 zypper in -t patch SUSE-SLE-Product-SLES-15-SP3-LTSS-2023-4594=1 * SUSE Linux Enterprise Server for SAP Applications 15 SP3 zypper in -t patch SUSE-SLE-Product-SLES_SAP-15-SP3-2023-4594=1 * SUSE Enterprise Storage 7.1 zypper in -t patch SUSE-Storage-7.1-2023-4594=1 ## Package List: * openSUSE Leap 15.3 (aarch64 ppc64le s390x x86_64 i586) * libgstcodecparsers-1_0-0-debuginfo-1.16.3-150300.9.12.2 * libgstinsertbin-1_0-0-1.16.3-150300.9.12.2 * gstreamer-plugins-bad-debugsource-1.16.3-150300.9.12.2 * libgstmpegts-1_0-0-debuginfo-1.16.3-150300.9.12.2 * gstreamer-plugins-bad-chromaprint-1.16.3-150300.9.12.2 * libgstphotography-1_0-0-1.16.3-150300.9.12.2 * typelib-1_0-GstInsertBin-1_0-1.16.3-150300.9.12.2 * libgstadaptivedemux-1_0-0-debuginfo-1.16.3-150300.9.12.2 * libgsturidownloader-1_0-0-debuginfo-1.16.3-150300.9.12.2 * libgstbasecamerabinsrc-1_0-0-1.16.3-150300.9.12.2 * libgstbadaudio-1_0-0-1.16.3-150300.9.12.2 * gstreamer-plugins-bad-1.16.3-150300.9.12.2 * libgstwayland-1_0-0-1.16.3-150300.9.12.2 * libgstplayer-1_0-0-1.16.3-150300.9.12.2 * libgstisoff-1_0-0-1.16.3-150300.9.12.2 * gstreamer-plugins-bad-doc-1.16.3-150300.9.12.2 * gstreamer-plugins-bad-devel-1.16.3-150300.9.12.2 * libgstsctp-1_0-0-1.16.3-150300.9.12.2 * libgstwayland-1_0-0-debuginfo-1.16.3-150300.9.12.2 * libgstbasecamerabinsrc-1_0-0-debuginfo-1.16.3-150300.9.12.2 * libgstcodecparsers-1_0-0-1.16.3-150300.9.12.2 * libgstwebrtc-1_0-0-1.16.3-150300.9.12.2 * libgstplayer-1_0-0-debuginfo-1.16.3-150300.9.12.2 * libgstphotography-1_0-0-debuginfo-1.16.3-150300.9.12.2 * gstreamer-plugins-bad-debuginfo-1.16.3-150300.9.12.2 * typelib-1_0-GstMpegts-1_0-1.16.3-150300.9.12.2 * typelib-1_0-GstPlayer-1_0-1.16.3-150300.9.12.2 * libgstsctp-1_0-0-debuginfo-1.16.3-150300.9.12.2 * libgstwebrtc-1_0-0-debuginfo-1.16.3-150300.9.12.2 * libgstmpegts-1_0-0-1.16.3-150300.9.12.2 * libgstinsertbin-1_0-0-debuginfo-1.16.3-150300.9.12.2 * libgstisoff-1_0-0-debuginfo-1.16.3-150300.9.12.2 * libgsturidownloader-1_0-0-1.16.3-150300.9.12.2 * libgstbadaudio-1_0-0-debuginfo-1.16.3-150300.9.12.2 * libgstadaptivedemux-1_0-0-1.16.3-150300.9.12.2 * gstreamer-plugins-bad-chromaprint-debuginfo-1.16.3-150300.9.12.2 * typelib-1_0-GstWebRTC-1_0-1.16.3-150300.9.12.2 * openSUSE Leap 15.3 (x86_64) * libgstinsertbin-1_0-0-32bit-debuginfo-1.16.3-150300.9.12.2 * libgstmpegts-1_0-0-32bit-1.16.3-150300.9.12.2 * libgstplayer-1_0-0-32bit-1.16.3-150300.9.12.2 * libgstbadaudio-1_0-0-32bit-1.16.3-150300.9.12.2 * libgstwayland-1_0-0-32bit-1.16.3-150300.9.12.2 * libgstcodecparsers-1_0-0-32bit-debuginfo-1.16.3-150300.9.12.2 * libgsturidownloader-1_0-0-32bit-1.16.3-150300.9.12.2 * libgsturidownloader-1_0-0-32bit-debuginfo-1.16.3-150300.9.12.2 * libgstwayland-1_0-0-32bit-debuginfo-1.16.3-150300.9.12.2 * libgstwebrtc-1_0-0-32bit-1.16.3-150300.9.12.2 * libgstplayer-1_0-0-32bit-debuginfo-1.16.3-150300.9.12.2 * libgstmpegts-1_0-0-32bit-debuginfo-1.16.3-150300.9.12.2 * gstreamer-plugins-bad-32bit-debuginfo-1.16.3-150300.9.12.2 * libgstcodecparsers-1_0-0-32bit-1.16.3-150300.9.12.2 * libgstadaptivedemux-1_0-0-32bit-1.16.3-150300.9.12.2 * libgstphotography-1_0-0-32bit-debuginfo-1.16.3-150300.9.12.2 * libgstinsertbin-1_0-0-32bit-1.16.3-150300.9.12.2 * libgstbasecamerabinsrc-1_0-0-32bit-1.16.3-150300.9.12.2 * libgstbasecamerabinsrc-1_0-0-32bit-debuginfo-1.16.3-150300.9.12.2 * libgstsctp-1_0-0-32bit-debuginfo-1.16.3-150300.9.12.2 * libgstisoff-1_0-0-32bit-1.16.3-150300.9.12.2 * gstreamer-plugins-bad-chromaprint-32bit-debuginfo-1.16.3-150300.9.12.2 * gstreamer-plugins-bad-32bit-1.16.3-150300.9.12.2 * gstreamer-plugins-bad-chromaprint-32bit-1.16.3-150300.9.12.2 * libgstphotography-1_0-0-32bit-1.16.3-150300.9.12.2 * libgstisoff-1_0-0-32bit-debuginfo-1.16.3-150300.9.12.2 * libgstbadaudio-1_0-0-32bit-debuginfo-1.16.3-150300.9.12.2 * libgstsctp-1_0-0-32bit-1.16.3-150300.9.12.2 * libgstwebrtc-1_0-0-32bit-debuginfo-1.16.3-150300.9.12.2 * libgstadaptivedemux-1_0-0-32bit-debuginfo-1.16.3-150300.9.12.2 * openSUSE Leap 15.3 (noarch) * gstreamer-plugins-bad-lang-1.16.3-150300.9.12.2 * openSUSE Leap 15.3 (aarch64_ilp32) * libgstbadaudio-1_0-0-64bit-1.16.3-150300.9.12.2 * libgstbasecamerabinsrc-1_0-0-64bit-1.16.3-150300.9.12.2 * libgstbadaudio-1_0-0-64bit-debuginfo-1.16.3-150300.9.12.2 * libgstmpegts-1_0-0-64bit-1.16.3-150300.9.12.2 * libgsturidownloader-1_0-0-64bit-debuginfo-1.16.3-150300.9.12.2 * libgstplayer-1_0-0-64bit-debuginfo-1.16.3-150300.9.12.2 * gstreamer-plugins-bad-64bit-debuginfo-1.16.3-150300.9.12.2 * libgstwayland-1_0-0-64bit-1.16.3-150300.9.12.2 * libgstsctp-1_0-0-64bit-1.16.3-150300.9.12.2 * libgstadaptivedemux-1_0-0-64bit-debuginfo-1.16.3-150300.9.12.2 * gstreamer-plugins-bad-chromaprint-64bit-1.16.3-150300.9.12.2 * libgsturidownloader-1_0-0-64bit-1.16.3-150300.9.12.2 * libgstmpegts-1_0-0-64bit-debuginfo-1.16.3-150300.9.12.2 * libgstwebrtc-1_0-0-64bit-1.16.3-150300.9.12.2 * gstreamer-plugins-bad-chromaprint-64bit-debuginfo-1.16.3-150300.9.12.2 * gstreamer-plugins-bad-64bit-1.16.3-150300.9.12.2 * libgstwayland-1_0-0-64bit-debuginfo-1.16.3-150300.9.12.2 * libgstinsertbin-1_0-0-64bit-debuginfo-1.16.3-150300.9.12.2 * libgstadaptivedemux-1_0-0-64bit-1.16.3-150300.9.12.2 * libgstwebrtc-1_0-0-64bit-debuginfo-1.16.3-150300.9.12.2 * libgstphotography-1_0-0-64bit-1.16.3-150300.9.12.2 * libgstisoff-1_0-0-64bit-1.16.3-150300.9.12.2 * libgstisoff-1_0-0-64bit-debuginfo-1.16.3-150300.9.12.2 * libgstbasecamerabinsrc-1_0-0-64bit-debuginfo-1.16.3-150300.9.12.2 * libgstcodecparsers-1_0-0-64bit-debuginfo-1.16.3-150300.9.12.2 * libgstinsertbin-1_0-0-64bit-1.16.3-150300.9.12.2 * libgstsctp-1_0-0-64bit-debuginfo-1.16.3-150300.9.12.2 * libgstphotography-1_0-0-64bit-debuginfo-1.16.3-150300.9.12.2 * libgstplayer-1_0-0-64bit-1.16.3-150300.9.12.2 * libgstcodecparsers-1_0-0-64bit-1.16.3-150300.9.12.2 * SUSE Linux Enterprise High Performance Computing ESPOS 15 SP3 (aarch64 x86_64) * libgstcodecparsers-1_0-0-debuginfo-1.16.3-150300.9.12.2 * libgstinsertbin-1_0-0-1.16.3-150300.9.12.2 * gstreamer-plugins-bad-debugsource-1.16.3-150300.9.12.2 * libgstmpegts-1_0-0-debuginfo-1.16.3-150300.9.12.2 * gstreamer-plugins-bad-chromaprint-1.16.3-150300.9.12.2 * libgstphotography-1_0-0-1.16.3-150300.9.12.2 * typelib-1_0-GstInsertBin-1_0-1.16.3-150300.9.12.2 * libgstadaptivedemux-1_0-0-debuginfo-1.16.3-150300.9.12.2 * libgsturidownloader-1_0-0-debuginfo-1.16.3-150300.9.12.2 * libgstbasecamerabinsrc-1_0-0-1.16.3-150300.9.12.2 * libgstbadaudio-1_0-0-1.16.3-150300.9.12.2 * gstreamer-plugins-bad-1.16.3-150300.9.12.2 * libgstwayland-1_0-0-1.16.3-150300.9.12.2 * libgstplayer-1_0-0-1.16.3-150300.9.12.2 * libgstisoff-1_0-0-1.16.3-150300.9.12.2 * libgstsctp-1_0-0-1.16.3-150300.9.12.2 * gstreamer-plugins-bad-devel-1.16.3-150300.9.12.2 * libgstwayland-1_0-0-debuginfo-1.16.3-150300.9.12.2 * libgstbasecamerabinsrc-1_0-0-debuginfo-1.16.3-150300.9.12.2 * libgstcodecparsers-1_0-0-1.16.3-150300.9.12.2 * libgstwebrtc-1_0-0-1.16.3-150300.9.12.2 * libgstplayer-1_0-0-debuginfo-1.16.3-150300.9.12.2 * libgstphotography-1_0-0-debuginfo-1.16.3-150300.9.12.2 * gstreamer-plugins-bad-debuginfo-1.16.3-150300.9.12.2 * typelib-1_0-GstMpegts-1_0-1.16.3-150300.9.12.2 * typelib-1_0-GstPlayer-1_0-1.16.3-150300.9.12.2 * libgstsctp-1_0-0-debuginfo-1.16.3-150300.9.12.2 * libgstwebrtc-1_0-0-debuginfo-1.16.3-150300.9.12.2 * libgstmpegts-1_0-0-1.16.3-150300.9.12.2 * libgstinsertbin-1_0-0-debuginfo-1.16.3-150300.9.12.2 * libgstisoff-1_0-0-debuginfo-1.16.3-150300.9.12.2 * libgsturidownloader-1_0-0-1.16.3-150300.9.12.2 * libgstbadaudio-1_0-0-debuginfo-1.16.3-150300.9.12.2 * libgstadaptivedemux-1_0-0-1.16.3-150300.9.12.2 * gstreamer-plugins-bad-chromaprint-debuginfo-1.16.3-150300.9.12.2 * typelib-1_0-GstWebRTC-1_0-1.16.3-150300.9.12.2 * SUSE Linux Enterprise High Performance Computing ESPOS 15 SP3 (noarch) * gstreamer-plugins-bad-lang-1.16.3-150300.9.12.2 * SUSE Linux Enterprise High Performance Computing LTSS 15 SP3 (aarch64 x86_64) * libgstcodecparsers-1_0-0-debuginfo-1.16.3-150300.9.12.2 * libgstinsertbin-1_0-0-1.16.3-150300.9.12.2 * gstreamer-plugins-bad-debugsource-1.16.3-150300.9.12.2 * libgstmpegts-1_0-0-debuginfo-1.16.3-150300.9.12.2 * gstreamer-plugins-bad-chromaprint-1.16.3-150300.9.12.2 * libgstphotography-1_0-0-1.16.3-150300.9.12.2 * typelib-1_0-GstInsertBin-1_0-1.16.3-150300.9.12.2 * libgstadaptivedemux-1_0-0-debuginfo-1.16.3-150300.9.12.2 * libgsturidownloader-1_0-0-debuginfo-1.16.3-150300.9.12.2 * libgstbasecamerabinsrc-1_0-0-1.16.3-150300.9.12.2 * libgstbadaudio-1_0-0-1.16.3-150300.9.12.2 * gstreamer-plugins-bad-1.16.3-150300.9.12.2 * libgstwayland-1_0-0-1.16.3-150300.9.12.2 * libgstplayer-1_0-0-1.16.3-150300.9.12.2 * libgstisoff-1_0-0-1.16.3-150300.9.12.2 * libgstsctp-1_0-0-1.16.3-150300.9.12.2 * gstreamer-plugins-bad-devel-1.16.3-150300.9.12.2 * libgstwayland-1_0-0-debuginfo-1.16.3-150300.9.12.2 * libgstbasecamerabinsrc-1_0-0-debuginfo-1.16.3-150300.9.12.2 * libgstcodecparsers-1_0-0-1.16.3-150300.9.12.2 * libgstwebrtc-1_0-0-1.16.3-150300.9.12.2 * libgstplayer-1_0-0-debuginfo-1.16.3-150300.9.12.2 * libgstphotography-1_0-0-debuginfo-1.16.3-150300.9.12.2 * gstreamer-plugins-bad-debuginfo-1.16.3-150300.9.12.2 * typelib-1_0-GstMpegts-1_0-1.16.3-150300.9.12.2 * typelib-1_0-GstPlayer-1_0-1.16.3-150300.9.12.2 * libgstsctp-1_0-0-debuginfo-1.16.3-150300.9.12.2 * libgstwebrtc-1_0-0-debuginfo-1.16.3-150300.9.12.2 * libgstmpegts-1_0-0-1.16.3-150300.9.12.2 * libgstinsertbin-1_0-0-debuginfo-1.16.3-150300.9.12.2 * libgstisoff-1_0-0-debuginfo-1.16.3-150300.9.12.2 * libgsturidownloader-1_0-0-1.16.3-150300.9.12.2 * libgstbadaudio-1_0-0-debuginfo-1.16.3-150300.9.12.2 * libgstadaptivedemux-1_0-0-1.16.3-150300.9.12.2 * gstreamer-plugins-bad-chromaprint-debuginfo-1.16.3-150300.9.12.2 * typelib-1_0-GstWebRTC-1_0-1.16.3-150300.9.12.2 * SUSE Linux Enterprise High Performance Computing LTSS 15 SP3 (noarch) * gstreamer-plugins-bad-lang-1.16.3-150300.9.12.2 * SUSE Linux Enterprise Server 15 SP3 LTSS 15-SP3 (aarch64 ppc64le s390x x86_64) * libgstcodecparsers-1_0-0-debuginfo-1.16.3-150300.9.12.2 * libgstinsertbin-1_0-0-1.16.3-150300.9.12.2 * gstreamer-plugins-bad-debugsource-1.16.3-150300.9.12.2 * libgstmpegts-1_0-0-debuginfo-1.16.3-150300.9.12.2 * gstreamer-plugins-bad-chromaprint-1.16.3-150300.9.12.2 * libgstphotography-1_0-0-1.16.3-150300.9.12.2 * typelib-1_0-GstInsertBin-1_0-1.16.3-150300.9.12.2 * libgstadaptivedemux-1_0-0-debuginfo-1.16.3-150300.9.12.2 * libgsturidownloader-1_0-0-debuginfo-1.16.3-150300.9.12.2 * libgstbasecamerabinsrc-1_0-0-1.16.3-150300.9.12.2 * libgstbadaudio-1_0-0-1.16.3-150300.9.12.2 * gstreamer-plugins-bad-1.16.3-150300.9.12.2 * libgstwayland-1_0-0-1.16.3-150300.9.12.2 * libgstplayer-1_0-0-1.16.3-150300.9.12.2 * libgstisoff-1_0-0-1.16.3-150300.9.12.2 * libgstsctp-1_0-0-1.16.3-150300.9.12.2 * gstreamer-plugins-bad-devel-1.16.3-150300.9.12.2 * libgstwayland-1_0-0-debuginfo-1.16.3-150300.9.12.2 * libgstbasecamerabinsrc-1_0-0-debuginfo-1.16.3-150300.9.12.2 * libgstcodecparsers-1_0-0-1.16.3-150300.9.12.2 * libgstwebrtc-1_0-0-1.16.3-150300.9.12.2 * libgstplayer-1_0-0-debuginfo-1.16.3-150300.9.12.2 * libgstphotography-1_0-0-debuginfo-1.16.3-150300.9.12.2 * gstreamer-plugins-bad-debuginfo-1.16.3-150300.9.12.2 * typelib-1_0-GstMpegts-1_0-1.16.3-150300.9.12.2 * typelib-1_0-GstPlayer-1_0-1.16.3-150300.9.12.2 * libgstsctp-1_0-0-debuginfo-1.16.3-150300.9.12.2 * libgstwebrtc-1_0-0-debuginfo-1.16.3-150300.9.12.2 * libgstmpegts-1_0-0-1.16.3-150300.9.12.2 * libgstinsertbin-1_0-0-debuginfo-1.16.3-150300.9.12.2 * libgstisoff-1_0-0-debuginfo-1.16.3-150300.9.12.2 * libgsturidownloader-1_0-0-1.16.3-150300.9.12.2 * libgstbadaudio-1_0-0-debuginfo-1.16.3-150300.9.12.2 * libgstadaptivedemux-1_0-0-1.16.3-150300.9.12.2 * gstreamer-plugins-bad-chromaprint-debuginfo-1.16.3-150300.9.12.2 * typelib-1_0-GstWebRTC-1_0-1.16.3-150300.9.12.2 * SUSE Linux Enterprise Server 15 SP3 LTSS 15-SP3 (noarch) * gstreamer-plugins-bad-lang-1.16.3-150300.9.12.2 * SUSE Linux Enterprise Server for SAP Applications 15 SP3 (ppc64le x86_64) * libgstcodecparsers-1_0-0-debuginfo-1.16.3-150300.9.12.2 * libgstinsertbin-1_0-0-1.16.3-150300.9.12.2 * gstreamer-plugins-bad-debugsource-1.16.3-150300.9.12.2 * libgstmpegts-1_0-0-debuginfo-1.16.3-150300.9.12.2 * gstreamer-plugins-bad-chromaprint-1.16.3-150300.9.12.2 * libgstphotography-1_0-0-1.16.3-150300.9.12.2 * typelib-1_0-GstInsertBin-1_0-1.16.3-150300.9.12.2 * libgstadaptivedemux-1_0-0-debuginfo-1.16.3-150300.9.12.2 * libgsturidownloader-1_0-0-debuginfo-1.16.3-150300.9.12.2 * libgstbasecamerabinsrc-1_0-0-1.16.3-150300.9.12.2 * libgstbadaudio-1_0-0-1.16.3-150300.9.12.2 * gstreamer-plugins-bad-1.16.3-150300.9.12.2 * libgstwayland-1_0-0-1.16.3-150300.9.12.2 * libgstplayer-1_0-0-1.16.3-150300.9.12.2 * libgstisoff-1_0-0-1.16.3-150300.9.12.2 * libgstsctp-1_0-0-1.16.3-150300.9.12.2 * gstreamer-plugins-bad-devel-1.16.3-150300.9.12.2 * libgstwayland-1_0-0-debuginfo-1.16.3-150300.9.12.2 * libgstbasecamerabinsrc-1_0-0-debuginfo-1.16.3-150300.9.12.2 * libgstcodecparsers-1_0-0-1.16.3-150300.9.12.2 * libgstwebrtc-1_0-0-1.16.3-150300.9.12.2 * libgstplayer-1_0-0-debuginfo-1.16.3-150300.9.12.2 * libgstphotography-1_0-0-debuginfo-1.16.3-150300.9.12.2 * gstreamer-plugins-bad-debuginfo-1.16.3-150300.9.12.2 * typelib-1_0-GstMpegts-1_0-1.16.3-150300.9.12.2 * typelib-1_0-GstPlayer-1_0-1.16.3-150300.9.12.2 * libgstsctp-1_0-0-debuginfo-1.16.3-150300.9.12.2 * libgstwebrtc-1_0-0-debuginfo-1.16.3-150300.9.12.2 * libgstmpegts-1_0-0-1.16.3-150300.9.12.2 * libgstinsertbin-1_0-0-debuginfo-1.16.3-150300.9.12.2 * libgstisoff-1_0-0-debuginfo-1.16.3-150300.9.12.2 * libgsturidownloader-1_0-0-1.16.3-150300.9.12.2 * libgstbadaudio-1_0-0-debuginfo-1.16.3-150300.9.12.2 * libgstadaptivedemux-1_0-0-1.16.3-150300.9.12.2 * gstreamer-plugins-bad-chromaprint-debuginfo-1.16.3-150300.9.12.2 * typelib-1_0-GstWebRTC-1_0-1.16.3-150300.9.12.2 * SUSE Linux Enterprise Server for SAP Applications 15 SP3 (noarch) * gstreamer-plugins-bad-lang-1.16.3-150300.9.12.2 * SUSE Enterprise Storage 7.1 (aarch64 x86_64) * libgstcodecparsers-1_0-0-debuginfo-1.16.3-150300.9.12.2 * libgstinsertbin-1_0-0-1.16.3-150300.9.12.2 * gstreamer-plugins-bad-debugsource-1.16.3-150300.9.12.2 * libgstmpegts-1_0-0-debuginfo-1.16.3-150300.9.12.2 * gstreamer-plugins-bad-chromaprint-1.16.3-150300.9.12.2 * libgstphotography-1_0-0-1.16.3-150300.9.12.2 * typelib-1_0-GstInsertBin-1_0-1.16.3-150300.9.12.2 * libgstadaptivedemux-1_0-0-debuginfo-1.16.3-150300.9.12.2 * libgsturidownloader-1_0-0-debuginfo-1.16.3-150300.9.12.2 * libgstbasecamerabinsrc-1_0-0-1.16.3-150300.9.12.2 * libgstbadaudio-1_0-0-1.16.3-150300.9.12.2 * gstreamer-plugins-bad-1.16.3-150300.9.12.2 * libgstwayland-1_0-0-1.16.3-150300.9.12.2 * libgstplayer-1_0-0-1.16.3-150300.9.12.2 * libgstisoff-1_0-0-1.16.3-150300.9.12.2 * libgstsctp-1_0-0-1.16.3-150300.9.12.2 * gstreamer-plugins-bad-devel-1.16.3-150300.9.12.2 * libgstwayland-1_0-0-debuginfo-1.16.3-150300.9.12.2 * libgstbasecamerabinsrc-1_0-0-debuginfo-1.16.3-150300.9.12.2 * libgstcodecparsers-1_0-0-1.16.3-150300.9.12.2 * libgstwebrtc-1_0-0-1.16.3-150300.9.12.2 * libgstplayer-1_0-0-debuginfo-1.16.3-150300.9.12.2 * libgstphotography-1_0-0-debuginfo-1.16.3-150300.9.12.2 * gstreamer-plugins-bad-debuginfo-1.16.3-150300.9.12.2 * typelib-1_0-GstMpegts-1_0-1.16.3-150300.9.12.2 * typelib-1_0-GstPlayer-1_0-1.16.3-150300.9.12.2 * libgstsctp-1_0-0-debuginfo-1.16.3-150300.9.12.2 * libgstwebrtc-1_0-0-debuginfo-1.16.3-150300.9.12.2 * libgstmpegts-1_0-0-1.16.3-150300.9.12.2 * libgstinsertbin-1_0-0-debuginfo-1.16.3-150300.9.12.2 * libgstisoff-1_0-0-debuginfo-1.16.3-150300.9.12.2 * libgsturidownloader-1_0-0-1.16.3-150300.9.12.2 * libgstbadaudio-1_0-0-debuginfo-1.16.3-150300.9.12.2 * libgstadaptivedemux-1_0-0-1.16.3-150300.9.12.2 * gstreamer-plugins-bad-chromaprint-debuginfo-1.16.3-150300.9.12.2 * typelib-1_0-GstWebRTC-1_0-1.16.3-150300.9.12.2 * SUSE Enterprise Storage 7.1 (noarch) * gstreamer-plugins-bad-lang-1.16.3-150300.9.12.2 ## References: * https://www.suse.com/security/cve/CVE-2023-40474.html * https://www.suse.com/security/cve/CVE-2023-40476.html * https://bugzilla.suse.com/show_bug.cgi?id=1215793 * https://bugzilla.suse.com/show_bug.cgi?id=1215796

1 0

SUSE-SU-2023:4586-1: important: Security update for xerces-c
by security＠lists.opensuse.org 27 Nov '23

27 Nov '23

# Security update for xerces-c Announcement ID: SUSE-SU-2023:4586-1 Rating: important References: * bsc#1216156 Cross-References: * CVE-2023-37536 CVSS scores: * CVE-2023-37536 ( SUSE ): 8.2 CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:H * CVE-2023-37536 ( NVD ): 8.8 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H Affected Products: * Basesystem Module 15-SP4 * Basesystem Module 15-SP5 * openSUSE Leap 15.3 * openSUSE Leap 15.4 * openSUSE Leap 15.5 * SUSE Enterprise Storage 7.1 * SUSE Linux Enterprise Desktop 15 SP4 * SUSE Linux Enterprise Desktop 15 SP5 * SUSE Linux Enterprise High Performance Computing 15 SP3 * SUSE Linux Enterprise High Performance Computing 15 SP4 * SUSE Linux Enterprise High Performance Computing 15 SP5 * SUSE Linux Enterprise High Performance Computing ESPOS 15 SP3 * SUSE Linux Enterprise High Performance Computing LTSS 15 SP3 * SUSE Linux Enterprise Real Time 15 SP4 * SUSE Linux Enterprise Real Time 15 SP5 * SUSE Linux Enterprise Server 15 SP3 * SUSE Linux Enterprise Server 15 SP3 LTSS 15-SP3 * SUSE Linux Enterprise Server 15 SP4 * SUSE Linux Enterprise Server 15 SP5 * SUSE Linux Enterprise Server for SAP Applications 15 SP3 * SUSE Linux Enterprise Server for SAP Applications 15 SP4 * SUSE Linux Enterprise Server for SAP Applications 15 SP5 * SUSE Manager Proxy 4.3 * SUSE Manager Retail Branch Server 4.3 * SUSE Manager Server 4.3 An update that solves one vulnerability can now be installed. ## Description: This update for xerces-c fixes the following issues: * CVE-2023-37536: Fixed an integer overflow that could have led to a out-of- bounds memory accesses (bsc#1216156). ## Patch Instructions: To install this SUSE update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: * openSUSE Leap 15.3 zypper in -t patch SUSE-2023-4586=1 * openSUSE Leap 15.4 zypper in -t patch openSUSE-SLE-15.4-2023-4586=1 * openSUSE Leap 15.5 zypper in -t patch openSUSE-SLE-15.5-2023-4586=1 * Basesystem Module 15-SP4 zypper in -t patch SUSE-SLE-Module-Basesystem-15-SP4-2023-4586=1 * Basesystem Module 15-SP5 zypper in -t patch SUSE-SLE-Module-Basesystem-15-SP5-2023-4586=1 * SUSE Linux Enterprise High Performance Computing ESPOS 15 SP3 zypper in -t patch SUSE-SLE-Product-HPC-15-SP3-ESPOS-2023-4586=1 * SUSE Linux Enterprise High Performance Computing LTSS 15 SP3 zypper in -t patch SUSE-SLE-Product-HPC-15-SP3-LTSS-2023-4586=1 * SUSE Linux Enterprise Server 15 SP3 LTSS 15-SP3 zypper in -t patch SUSE-SLE-Product-SLES-15-SP3-LTSS-2023-4586=1 * SUSE Linux Enterprise Server for SAP Applications 15 SP3 zypper in -t patch SUSE-SLE-Product-SLES_SAP-15-SP3-2023-4586=1 * SUSE Enterprise Storage 7.1 zypper in -t patch SUSE-Storage-7.1-2023-4586=1 ## Package List: * openSUSE Leap 15.3 (aarch64 ppc64le s390x x86_64 i586) * xerces-c-doc-3.2.3-150300.3.3.2 * libxerces-c-devel-3.2.3-150300.3.3.2 * xerces-c-debugsource-3.2.3-150300.3.3.2 * xerces-c-3.2.3-150300.3.3.2 * xerces-c-debuginfo-3.2.3-150300.3.3.2 * libxerces-c-3_2-debuginfo-3.2.3-150300.3.3.2 * libxerces-c-3_2-3.2.3-150300.3.3.2 * openSUSE Leap 15.3 (x86_64) * libxerces-c-3_2-32bit-3.2.3-150300.3.3.2 * libxerces-c-3_2-32bit-debuginfo-3.2.3-150300.3.3.2 * openSUSE Leap 15.3 (aarch64_ilp32) * libxerces-c-3_2-64bit-debuginfo-3.2.3-150300.3.3.2 * libxerces-c-3_2-64bit-3.2.3-150300.3.3.2 * openSUSE Leap 15.4 (aarch64 ppc64le s390x x86_64) * xerces-c-doc-3.2.3-150300.3.3.2 * libxerces-c-devel-3.2.3-150300.3.3.2 * xerces-c-debugsource-3.2.3-150300.3.3.2 * xerces-c-3.2.3-150300.3.3.2 * xerces-c-debuginfo-3.2.3-150300.3.3.2 * libxerces-c-3_2-debuginfo-3.2.3-150300.3.3.2 * libxerces-c-3_2-3.2.3-150300.3.3.2 * openSUSE Leap 15.4 (x86_64) * libxerces-c-3_2-32bit-3.2.3-150300.3.3.2 * libxerces-c-3_2-32bit-debuginfo-3.2.3-150300.3.3.2 * openSUSE Leap 15.5 (aarch64 ppc64le s390x x86_64) * xerces-c-doc-3.2.3-150300.3.3.2 * libxerces-c-devel-3.2.3-150300.3.3.2 * xerces-c-debugsource-3.2.3-150300.3.3.2 * xerces-c-3.2.3-150300.3.3.2 * xerces-c-debuginfo-3.2.3-150300.3.3.2 * libxerces-c-3_2-debuginfo-3.2.3-150300.3.3.2 * libxerces-c-3_2-3.2.3-150300.3.3.2 * openSUSE Leap 15.5 (x86_64) * libxerces-c-3_2-32bit-3.2.3-150300.3.3.2 * libxerces-c-3_2-32bit-debuginfo-3.2.3-150300.3.3.2 * Basesystem Module 15-SP4 (aarch64 ppc64le s390x x86_64) * libxerces-c-devel-3.2.3-150300.3.3.2 * xerces-c-debugsource-3.2.3-150300.3.3.2 * xerces-c-debuginfo-3.2.3-150300.3.3.2 * libxerces-c-3_2-debuginfo-3.2.3-150300.3.3.2 * libxerces-c-3_2-3.2.3-150300.3.3.2 * Basesystem Module 15-SP5 (aarch64 ppc64le s390x x86_64) * libxerces-c-devel-3.2.3-150300.3.3.2 * xerces-c-debugsource-3.2.3-150300.3.3.2 * xerces-c-debuginfo-3.2.3-150300.3.3.2 * libxerces-c-3_2-debuginfo-3.2.3-150300.3.3.2 * libxerces-c-3_2-3.2.3-150300.3.3.2 * SUSE Linux Enterprise High Performance Computing ESPOS 15 SP3 (aarch64 x86_64) * libxerces-c-devel-3.2.3-150300.3.3.2 * xerces-c-debugsource-3.2.3-150300.3.3.2 * xerces-c-debuginfo-3.2.3-150300.3.3.2 * libxerces-c-3_2-debuginfo-3.2.3-150300.3.3.2 * libxerces-c-3_2-3.2.3-150300.3.3.2 * SUSE Linux Enterprise High Performance Computing LTSS 15 SP3 (aarch64 x86_64) * libxerces-c-devel-3.2.3-150300.3.3.2 * xerces-c-debugsource-3.2.3-150300.3.3.2 * xerces-c-debuginfo-3.2.3-150300.3.3.2 * libxerces-c-3_2-debuginfo-3.2.3-150300.3.3.2 * libxerces-c-3_2-3.2.3-150300.3.3.2 * SUSE Linux Enterprise Server 15 SP3 LTSS 15-SP3 (aarch64 ppc64le s390x x86_64) * libxerces-c-devel-3.2.3-150300.3.3.2 * xerces-c-debugsource-3.2.3-150300.3.3.2 * xerces-c-debuginfo-3.2.3-150300.3.3.2 * libxerces-c-3_2-debuginfo-3.2.3-150300.3.3.2 * libxerces-c-3_2-3.2.3-150300.3.3.2 * SUSE Linux Enterprise Server for SAP Applications 15 SP3 (ppc64le x86_64) * libxerces-c-devel-3.2.3-150300.3.3.2 * xerces-c-debugsource-3.2.3-150300.3.3.2 * xerces-c-debuginfo-3.2.3-150300.3.3.2 * libxerces-c-3_2-debuginfo-3.2.3-150300.3.3.2 * libxerces-c-3_2-3.2.3-150300.3.3.2 * SUSE Enterprise Storage 7.1 (aarch64 x86_64) * libxerces-c-devel-3.2.3-150300.3.3.2 * xerces-c-debugsource-3.2.3-150300.3.3.2 * xerces-c-debuginfo-3.2.3-150300.3.3.2 * libxerces-c-3_2-debuginfo-3.2.3-150300.3.3.2 * libxerces-c-3_2-3.2.3-150300.3.3.2 ## References: * https://www.suse.com/security/cve/CVE-2023-37536.html * https://bugzilla.suse.com/show_bug.cgi?id=1216156

1 0

SUSE-SU-2023:4587-1: important: Security update for vim
by security＠lists.opensuse.org 27 Nov '23

27 Nov '23

# Security update for vim Announcement ID: SUSE-SU-2023:4587-1 Rating: important References: * bsc#1215940 * bsc#1216001 * bsc#1216167 * bsc#1216696 Cross-References: * CVE-2023-46246 * CVE-2023-5344 * CVE-2023-5441 * CVE-2023-5535 CVSS scores: * CVE-2023-46246 ( SUSE ): 4.0 CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L * CVE-2023-46246 ( NVD ): 4.0 CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L * CVE-2023-5344 ( SUSE ): 4.0 CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L * CVE-2023-5344 ( NVD ): 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H * CVE-2023-5344 ( NVD ): 4.0 CVSS:3.0/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L * CVE-2023-5441 ( SUSE ): 6.2 CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H * CVE-2023-5441 ( NVD ): 5.5 CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H * CVE-2023-5441 ( NVD ): 6.2 CVSS:3.0/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H * CVE-2023-5535 ( SUSE ): 7.8 CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H * CVE-2023-5535 ( NVD ): 7.8 CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H * CVE-2023-5535 ( NVD ): 7.8 CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H Affected Products: * Basesystem Module 15-SP4 * Desktop Applications Module 15-SP4 * openSUSE Leap 15.4 * openSUSE Leap Micro 5.3 * openSUSE Leap Micro 5.4 * SUSE CaaS Platform 4.0 * SUSE Enterprise Storage 7.1 * SUSE Linux Enterprise Desktop 15 SP4 * SUSE Linux Enterprise High Performance Computing 15 SP1 * SUSE Linux Enterprise High Performance Computing 15 SP1 LTSS 15-SP1 * SUSE Linux Enterprise High Performance Computing 15 SP2 * SUSE Linux Enterprise High Performance Computing 15 SP2 LTSS 15-SP2 * SUSE Linux Enterprise High Performance Computing 15 SP3 * SUSE Linux Enterprise High Performance Computing 15 SP4 * SUSE Linux Enterprise High Performance Computing ESPOS 15 SP3 * SUSE Linux Enterprise High Performance Computing LTSS 15 SP3 * SUSE Linux Enterprise Micro 5.1 * SUSE Linux Enterprise Micro 5.2 * SUSE Linux Enterprise Micro 5.3 * SUSE Linux Enterprise Micro 5.4 * SUSE Linux Enterprise Micro for Rancher 5.2 * SUSE Linux Enterprise Micro for Rancher 5.3 * SUSE Linux Enterprise Micro for Rancher 5.4 * SUSE Linux Enterprise Real Time 15 SP4 * SUSE Linux Enterprise Server 15 SP1 * SUSE Linux Enterprise Server 15 SP1 LTSS 15-SP1 * SUSE Linux Enterprise Server 15 SP2 * SUSE Linux Enterprise Server 15 SP2 LTSS 15-SP2 * SUSE Linux Enterprise Server 15 SP3 * SUSE Linux Enterprise Server 15 SP3 LTSS 15-SP3 * SUSE Linux Enterprise Server 15 SP4 * SUSE Linux Enterprise Server for SAP Applications 15 SP1 * SUSE Linux Enterprise Server for SAP Applications 15 SP2 * SUSE Linux Enterprise Server for SAP Applications 15 SP3 * SUSE Linux Enterprise Server for SAP Applications 15 SP4 * SUSE Manager Proxy 4.3 * SUSE Manager Retail Branch Server 4.3 * SUSE Manager Server 4.3 An update that solves four vulnerabilities can now be installed. ## Description: This update for vim fixes the following issues: * CVE-2023-5344: Heap-based Buffer Overflow in vim prior to 9.0.1969 (bsc#1215940) * CVE-2023-5441: segfault in exmode when redrawing (bsc#1216001) * CVE-2023-5535: use-after-free from buf_contents_changed() (bsc#1216167) * CVE-2023-46246: Integer Overflow in :history command (bsc#1216696) ## Patch Instructions: To install this SUSE update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: * openSUSE Leap Micro 5.3 zypper in -t patch openSUSE-Leap-Micro-5.3-2023-4587=1 * openSUSE Leap Micro 5.4 zypper in -t patch openSUSE-Leap-Micro-5.4-2023-4587=1 * openSUSE Leap 15.4 zypper in -t patch openSUSE-SLE-15.4-2023-4587=1 * SUSE Linux Enterprise Micro for Rancher 5.3 zypper in -t patch SUSE-SLE-Micro-5.3-2023-4587=1 * SUSE Linux Enterprise Micro 5.3 zypper in -t patch SUSE-SLE-Micro-5.3-2023-4587=1 * SUSE Linux Enterprise Micro for Rancher 5.4 zypper in -t patch SUSE-SLE-Micro-5.4-2023-4587=1 * SUSE Linux Enterprise Micro 5.4 zypper in -t patch SUSE-SLE-Micro-5.4-2023-4587=1 * Basesystem Module 15-SP4 zypper in -t patch SUSE-SLE-Module-Basesystem-15-SP4-2023-4587=1 * Desktop Applications Module 15-SP4 zypper in -t patch SUSE-SLE-Module-Desktop-Applications-15-SP4-2023-4587=1 * SUSE Linux Enterprise High Performance Computing 15 SP1 LTSS 15-SP1 zypper in -t patch SUSE-SLE-Product-HPC-15-SP1-LTSS-2023-4587=1 * SUSE Linux Enterprise High Performance Computing 15 SP2 LTSS 15-SP2 zypper in -t patch SUSE-SLE-Product-HPC-15-SP2-LTSS-2023-4587=1 * SUSE Linux Enterprise High Performance Computing ESPOS 15 SP3 zypper in -t patch SUSE-SLE-Product-HPC-15-SP3-ESPOS-2023-4587=1 * SUSE Linux Enterprise High Performance Computing LTSS 15 SP3 zypper in -t patch SUSE-SLE-Product-HPC-15-SP3-LTSS-2023-4587=1 * SUSE Linux Enterprise Server 15 SP1 LTSS 15-SP1 zypper in -t patch SUSE-SLE-Product-SLES-15-SP1-LTSS-2023-4587=1 * SUSE Linux Enterprise Server 15 SP2 LTSS 15-SP2 zypper in -t patch SUSE-SLE-Product-SLES-15-SP2-LTSS-2023-4587=1 * SUSE Linux Enterprise Server 15 SP3 LTSS 15-SP3 zypper in -t patch SUSE-SLE-Product-SLES-15-SP3-LTSS-2023-4587=1 * SUSE Linux Enterprise Server for SAP Applications 15 SP1 zypper in -t patch SUSE-SLE-Product-SLES_SAP-15-SP1-2023-4587=1 * SUSE Linux Enterprise Server for SAP Applications 15 SP2 zypper in -t patch SUSE-SLE-Product-SLES_SAP-15-SP2-2023-4587=1 * SUSE Linux Enterprise Server for SAP Applications 15 SP3 zypper in -t patch SUSE-SLE-Product-SLES_SAP-15-SP3-2023-4587=1 * SUSE Enterprise Storage 7.1 zypper in -t patch SUSE-Storage-7.1-2023-4587=1 * SUSE CaaS Platform 4.0 To install this update, use the SUSE CaaS Platform 'skuba' tool. It will inform you if it detects new updates and let you then trigger updating of the complete cluster in a controlled way. * SUSE Linux Enterprise Micro 5.1 zypper in -t patch SUSE-SUSE-MicroOS-5.1-2023-4587=1 * SUSE Linux Enterprise Micro 5.2 zypper in -t patch SUSE-SUSE-MicroOS-5.2-2023-4587=1 * SUSE Linux Enterprise Micro for Rancher 5.2 zypper in -t patch SUSE-SUSE-MicroOS-5.2-2023-4587=1 ## Package List: * openSUSE Leap Micro 5.3 (noarch) * vim-data-common-9.0.2103-150000.5.57.1 * openSUSE Leap Micro 5.3 (aarch64 x86_64) * vim-small-debuginfo-9.0.2103-150000.5.57.1 * vim-debuginfo-9.0.2103-150000.5.57.1 * vim-debugsource-9.0.2103-150000.5.57.1 * vim-small-9.0.2103-150000.5.57.1 * openSUSE Leap Micro 5.4 (noarch) * vim-data-common-9.0.2103-150000.5.57.1 * openSUSE Leap Micro 5.4 (aarch64 s390x x86_64) * vim-small-debuginfo-9.0.2103-150000.5.57.1 * vim-debuginfo-9.0.2103-150000.5.57.1 * vim-debugsource-9.0.2103-150000.5.57.1 * vim-small-9.0.2103-150000.5.57.1 * openSUSE Leap 15.4 (aarch64 ppc64le s390x x86_64) * gvim-9.0.2103-150000.5.57.1 * vim-debugsource-9.0.2103-150000.5.57.1 * vim-small-9.0.2103-150000.5.57.1 * vim-debuginfo-9.0.2103-150000.5.57.1 * gvim-debuginfo-9.0.2103-150000.5.57.1 * vim-9.0.2103-150000.5.57.1 * vim-small-debuginfo-9.0.2103-150000.5.57.1 * openSUSE Leap 15.4 (noarch) * vim-data-common-9.0.2103-150000.5.57.1 * vim-data-9.0.2103-150000.5.57.1 * SUSE Linux Enterprise Micro for Rancher 5.3 (noarch) * vim-data-common-9.0.2103-150000.5.57.1 * SUSE Linux Enterprise Micro for Rancher 5.3 (aarch64 s390x x86_64) * vim-small-debuginfo-9.0.2103-150000.5.57.1 * vim-debuginfo-9.0.2103-150000.5.57.1 * vim-debugsource-9.0.2103-150000.5.57.1 * vim-small-9.0.2103-150000.5.57.1 * SUSE Linux Enterprise Micro 5.3 (noarch) * vim-data-common-9.0.2103-150000.5.57.1 * SUSE Linux Enterprise Micro 5.3 (aarch64 s390x x86_64) * vim-small-debuginfo-9.0.2103-150000.5.57.1 * vim-debuginfo-9.0.2103-150000.5.57.1 * vim-debugsource-9.0.2103-150000.5.57.1 * vim-small-9.0.2103-150000.5.57.1 * SUSE Linux Enterprise Micro for Rancher 5.4 (noarch) * vim-data-common-9.0.2103-150000.5.57.1 * SUSE Linux Enterprise Micro for Rancher 5.4 (aarch64 s390x x86_64) * vim-small-debuginfo-9.0.2103-150000.5.57.1 * vim-debuginfo-9.0.2103-150000.5.57.1 * vim-debugsource-9.0.2103-150000.5.57.1 * vim-small-9.0.2103-150000.5.57.1 * SUSE Linux Enterprise Micro 5.4 (noarch) * vim-data-common-9.0.2103-150000.5.57.1 * SUSE Linux Enterprise Micro 5.4 (aarch64 s390x x86_64) * vim-small-debuginfo-9.0.2103-150000.5.57.1 * vim-debuginfo-9.0.2103-150000.5.57.1 * vim-debugsource-9.0.2103-150000.5.57.1 * vim-small-9.0.2103-150000.5.57.1 * Basesystem Module 15-SP4 (aarch64 ppc64le s390x x86_64) * vim-debugsource-9.0.2103-150000.5.57.1 * vim-small-9.0.2103-150000.5.57.1 * vim-debuginfo-9.0.2103-150000.5.57.1 * vim-9.0.2103-150000.5.57.1 * vim-small-debuginfo-9.0.2103-150000.5.57.1 * Basesystem Module 15-SP4 (noarch) * vim-data-common-9.0.2103-150000.5.57.1 * vim-data-9.0.2103-150000.5.57.1 * Desktop Applications Module 15-SP4 (aarch64 ppc64le s390x x86_64) * gvim-debuginfo-9.0.2103-150000.5.57.1 * vim-debuginfo-9.0.2103-150000.5.57.1 * gvim-9.0.2103-150000.5.57.1 * vim-debugsource-9.0.2103-150000.5.57.1 * SUSE Linux Enterprise High Performance Computing 15 SP1 LTSS 15-SP1 (aarch64 x86_64) * gvim-9.0.2103-150000.5.57.1 * vim-debugsource-9.0.2103-150000.5.57.1 * vim-debuginfo-9.0.2103-150000.5.57.1 * gvim-debuginfo-9.0.2103-150000.5.57.1 * vim-9.0.2103-150000.5.57.1 * SUSE Linux Enterprise High Performance Computing 15 SP1 LTSS 15-SP1 (noarch) * vim-data-common-9.0.2103-150000.5.57.1 * vim-data-9.0.2103-150000.5.57.1 * SUSE Linux Enterprise High Performance Computing 15 SP2 LTSS 15-SP2 (aarch64 x86_64) * gvim-9.0.2103-150000.5.57.1 * vim-debugsource-9.0.2103-150000.5.57.1 * vim-debuginfo-9.0.2103-150000.5.57.1 * gvim-debuginfo-9.0.2103-150000.5.57.1 * vim-9.0.2103-150000.5.57.1 * SUSE Linux Enterprise High Performance Computing 15 SP2 LTSS 15-SP2 (noarch) * vim-data-common-9.0.2103-150000.5.57.1 * vim-data-9.0.2103-150000.5.57.1 * SUSE Linux Enterprise High Performance Computing ESPOS 15 SP3 (aarch64 x86_64) * gvim-9.0.2103-150000.5.57.1 * vim-debugsource-9.0.2103-150000.5.57.1 * vim-small-9.0.2103-150000.5.57.1 * vim-debuginfo-9.0.2103-150000.5.57.1 * gvim-debuginfo-9.0.2103-150000.5.57.1 * vim-9.0.2103-150000.5.57.1 * vim-small-debuginfo-9.0.2103-150000.5.57.1 * SUSE Linux Enterprise High Performance Computing ESPOS 15 SP3 (noarch) * vim-data-common-9.0.2103-150000.5.57.1 * vim-data-9.0.2103-150000.5.57.1 * SUSE Linux Enterprise High Performance Computing LTSS 15 SP3 (aarch64 x86_64) * gvim-9.0.2103-150000.5.57.1 * vim-debugsource-9.0.2103-150000.5.57.1 * vim-small-9.0.2103-150000.5.57.1 * vim-debuginfo-9.0.2103-150000.5.57.1 * gvim-debuginfo-9.0.2103-150000.5.57.1 * vim-9.0.2103-150000.5.57.1 * vim-small-debuginfo-9.0.2103-150000.5.57.1 * SUSE Linux Enterprise High Performance Computing LTSS 15 SP3 (noarch) * vim-data-common-9.0.2103-150000.5.57.1 * vim-data-9.0.2103-150000.5.57.1 * SUSE Linux Enterprise Server 15 SP1 LTSS 15-SP1 (aarch64 ppc64le s390x x86_64) * gvim-9.0.2103-150000.5.57.1 * vim-debugsource-9.0.2103-150000.5.57.1 * vim-debuginfo-9.0.2103-150000.5.57.1 * gvim-debuginfo-9.0.2103-150000.5.57.1 * vim-9.0.2103-150000.5.57.1 * SUSE Linux Enterprise Server 15 SP1 LTSS 15-SP1 (noarch) * vim-data-common-9.0.2103-150000.5.57.1 * vim-data-9.0.2103-150000.5.57.1 * SUSE Linux Enterprise Server 15 SP2 LTSS 15-SP2 (aarch64 ppc64le s390x x86_64) * gvim-9.0.2103-150000.5.57.1 * vim-debugsource-9.0.2103-150000.5.57.1 * vim-debuginfo-9.0.2103-150000.5.57.1 * gvim-debuginfo-9.0.2103-150000.5.57.1 * vim-9.0.2103-150000.5.57.1 * SUSE Linux Enterprise Server 15 SP2 LTSS 15-SP2 (noarch) * vim-data-common-9.0.2103-150000.5.57.1 * vim-data-9.0.2103-150000.5.57.1 * SUSE Linux Enterprise Server 15 SP3 LTSS 15-SP3 (aarch64 ppc64le s390x x86_64) * gvim-9.0.2103-150000.5.57.1 * vim-debugsource-9.0.2103-150000.5.57.1 * vim-small-9.0.2103-150000.5.57.1 * vim-debuginfo-9.0.2103-150000.5.57.1 * gvim-debuginfo-9.0.2103-150000.5.57.1 * vim-9.0.2103-150000.5.57.1 * vim-small-debuginfo-9.0.2103-150000.5.57.1 * SUSE Linux Enterprise Server 15 SP3 LTSS 15-SP3 (noarch) * vim-data-common-9.0.2103-150000.5.57.1 * vim-data-9.0.2103-150000.5.57.1 * SUSE Linux Enterprise Server for SAP Applications 15 SP1 (ppc64le x86_64) * gvim-9.0.2103-150000.5.57.1 * vim-debugsource-9.0.2103-150000.5.57.1 * vim-debuginfo-9.0.2103-150000.5.57.1 * gvim-debuginfo-9.0.2103-150000.5.57.1 * vim-9.0.2103-150000.5.57.1 * SUSE Linux Enterprise Server for SAP Applications 15 SP1 (noarch) * vim-data-common-9.0.2103-150000.5.57.1 * vim-data-9.0.2103-150000.5.57.1 * SUSE Linux Enterprise Server for SAP Applications 15 SP2 (ppc64le x86_64) * gvim-9.0.2103-150000.5.57.1 * vim-debugsource-9.0.2103-150000.5.57.1 * vim-debuginfo-9.0.2103-150000.5.57.1 * gvim-debuginfo-9.0.2103-150000.5.57.1 * vim-9.0.2103-150000.5.57.1 * SUSE Linux Enterprise Server for SAP Applications 15 SP2 (noarch) * vim-data-common-9.0.2103-150000.5.57.1 * vim-data-9.0.2103-150000.5.57.1 * SUSE Linux Enterprise Server for SAP Applications 15 SP3 (ppc64le x86_64) * gvim-9.0.2103-150000.5.57.1 * vim-debugsource-9.0.2103-150000.5.57.1 * vim-small-9.0.2103-150000.5.57.1 * vim-debuginfo-9.0.2103-150000.5.57.1 * gvim-debuginfo-9.0.2103-150000.5.57.1 * vim-9.0.2103-150000.5.57.1 * vim-small-debuginfo-9.0.2103-150000.5.57.1 * SUSE Linux Enterprise Server for SAP Applications 15 SP3 (noarch) * vim-data-common-9.0.2103-150000.5.57.1 * vim-data-9.0.2103-150000.5.57.1 * SUSE Enterprise Storage 7.1 (aarch64 x86_64) * gvim-9.0.2103-150000.5.57.1 * vim-debugsource-9.0.2103-150000.5.57.1 * vim-small-9.0.2103-150000.5.57.1 * vim-debuginfo-9.0.2103-150000.5.57.1 * gvim-debuginfo-9.0.2103-150000.5.57.1 * vim-9.0.2103-150000.5.57.1 * vim-small-debuginfo-9.0.2103-150000.5.57.1 * SUSE Enterprise Storage 7.1 (noarch) * vim-data-common-9.0.2103-150000.5.57.1 * vim-data-9.0.2103-150000.5.57.1 * SUSE CaaS Platform 4.0 (x86_64) * gvim-9.0.2103-150000.5.57.1 * vim-debugsource-9.0.2103-150000.5.57.1 * vim-debuginfo-9.0.2103-150000.5.57.1 * gvim-debuginfo-9.0.2103-150000.5.57.1 * vim-9.0.2103-150000.5.57.1 * SUSE CaaS Platform 4.0 (noarch) * vim-data-common-9.0.2103-150000.5.57.1 * vim-data-9.0.2103-150000.5.57.1 * SUSE Linux Enterprise Micro 5.1 (noarch) * vim-data-common-9.0.2103-150000.5.57.1 * SUSE Linux Enterprise Micro 5.1 (aarch64 s390x x86_64) * vim-small-debuginfo-9.0.2103-150000.5.57.1 * vim-debuginfo-9.0.2103-150000.5.57.1 * vim-debugsource-9.0.2103-150000.5.57.1 * vim-small-9.0.2103-150000.5.57.1 * SUSE Linux Enterprise Micro 5.2 (noarch) * vim-data-common-9.0.2103-150000.5.57.1 * SUSE Linux Enterprise Micro 5.2 (aarch64 s390x x86_64) * vim-small-debuginfo-9.0.2103-150000.5.57.1 * vim-debuginfo-9.0.2103-150000.5.57.1 * vim-debugsource-9.0.2103-150000.5.57.1 * vim-small-9.0.2103-150000.5.57.1 * SUSE Linux Enterprise Micro for Rancher 5.2 (noarch) * vim-data-common-9.0.2103-150000.5.57.1 * SUSE Linux Enterprise Micro for Rancher 5.2 (aarch64 s390x x86_64) * vim-small-debuginfo-9.0.2103-150000.5.57.1 * vim-debuginfo-9.0.2103-150000.5.57.1 * vim-debugsource-9.0.2103-150000.5.57.1 * vim-small-9.0.2103-150000.5.57.1 ## References: * https://www.suse.com/security/cve/CVE-2023-46246.html * https://www.suse.com/security/cve/CVE-2023-5344.html * https://www.suse.com/security/cve/CVE-2023-5441.html * https://www.suse.com/security/cve/CVE-2023-5535.html * https://bugzilla.suse.com/show_bug.cgi?id=1215940 * https://bugzilla.suse.com/show_bug.cgi?id=1216001 * https://bugzilla.suse.com/show_bug.cgi?id=1216167 * https://bugzilla.suse.com/show_bug.cgi?id=1216696

1 0

SUSE-SU-2023:4588-1: important: Security update for MozillaThunderbird
by security＠lists.opensuse.org 27 Nov '23

27 Nov '23

# Security update for MozillaThunderbird Announcement ID: SUSE-SU-2023:4588-1 Rating: important References: * bsc#1217230 Cross-References: * CVE-2023-6204 * CVE-2023-6205 * CVE-2023-6206 * CVE-2023-6207 * CVE-2023-6208 * CVE-2023-6209 * CVE-2023-6212 CVSS scores: Affected Products: * openSUSE Leap 15.4 * openSUSE Leap 15.5 * SUSE Linux Enterprise Desktop 15 SP4 * SUSE Linux Enterprise Desktop 15 SP5 * SUSE Linux Enterprise High Performance Computing 15 SP4 * SUSE Linux Enterprise High Performance Computing 15 SP5 * SUSE Linux Enterprise Micro 5.3 * SUSE Linux Enterprise Micro 5.4 * SUSE Linux Enterprise Micro 5.5 * SUSE Linux Enterprise Micro 6.0 * SUSE Linux Enterprise Real Time 15 SP4 * SUSE Linux Enterprise Real Time 15 SP5 * SUSE Linux Enterprise Server 15 SP4 * SUSE Linux Enterprise Server 15 SP5 * SUSE Linux Enterprise Server for SAP Applications 15 SP4 * SUSE Linux Enterprise Server for SAP Applications 15 SP5 * SUSE Linux Enterprise Workstation Extension 15 SP4 * SUSE Linux Enterprise Workstation Extension 15 SP5 * SUSE Manager Proxy 4.3 * SUSE Manager Retail Branch Server 4.3 * SUSE Manager Server 4.3 * SUSE Package Hub 15 15-SP4 * SUSE Package Hub 15 15-SP5 An update that solves seven vulnerabilities can now be installed. ## Description: This update for MozillaThunderbird fixes the following issues: * Mozilla Thunderbird 115.5.0 MFSA 2023-52 (bsc#1217230) * CVE-2023-6204: Out-of-bound memory access in WebGL2 blitFramebuffer * CVE-2023-6205: Use-after-free in MessagePort::Entangled * CVE-2023-6206: Clickjacking permission prompts using the fullscreen transition * CVE-2023-6207: Use-after-free in ReadableByteStreamQueueEntry::Buffer * CVE-2023-6208: Using Selection API would copy contents into X11 primary selection. * CVE-2023-6209: Incorrect parsing of relative URLs starting with "///" * CVE-2023-6212: Memory safety bugs ## Patch Instructions: To install this SUSE update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: * openSUSE Leap 15.4 zypper in -t patch openSUSE-SLE-15.4-2023-4588=1 * openSUSE Leap 15.5 zypper in -t patch openSUSE-SLE-15.5-2023-4588=1 * SUSE Package Hub 15 15-SP4 zypper in -t patch SUSE-SLE-Module-Packagehub-Subpackages-15-SP4-2023-4588=1 * SUSE Package Hub 15 15-SP5 zypper in -t patch SUSE-SLE-Module-Packagehub-Subpackages-15-SP5-2023-4588=1 * SUSE Linux Enterprise Workstation Extension 15 SP4 zypper in -t patch SUSE-SLE-Product-WE-15-SP4-2023-4588=1 * SUSE Linux Enterprise Workstation Extension 15 SP5 zypper in -t patch SUSE-SLE-Product-WE-15-SP5-2023-4588=1 ## Package List: * openSUSE Leap 15.4 (aarch64 ppc64le s390x x86_64) * MozillaThunderbird-debuginfo-115.5.0-150200.8.139.1 * MozillaThunderbird-debugsource-115.5.0-150200.8.139.1 * MozillaThunderbird-translations-common-115.5.0-150200.8.139.1 * MozillaThunderbird-115.5.0-150200.8.139.1 * MozillaThunderbird-translations-other-115.5.0-150200.8.139.1 * openSUSE Leap 15.5 (aarch64 ppc64le s390x x86_64) * MozillaThunderbird-debuginfo-115.5.0-150200.8.139.1 * MozillaThunderbird-debugsource-115.5.0-150200.8.139.1 * MozillaThunderbird-translations-common-115.5.0-150200.8.139.1 * MozillaThunderbird-115.5.0-150200.8.139.1 * MozillaThunderbird-translations-other-115.5.0-150200.8.139.1 * SUSE Package Hub 15 15-SP4 (aarch64 ppc64le s390x) * MozillaThunderbird-debuginfo-115.5.0-150200.8.139.1 * MozillaThunderbird-debugsource-115.5.0-150200.8.139.1 * MozillaThunderbird-translations-common-115.5.0-150200.8.139.1 * MozillaThunderbird-115.5.0-150200.8.139.1 * MozillaThunderbird-translations-other-115.5.0-150200.8.139.1 * SUSE Package Hub 15 15-SP5 (aarch64 ppc64le s390x) * MozillaThunderbird-debuginfo-115.5.0-150200.8.139.1 * MozillaThunderbird-debugsource-115.5.0-150200.8.139.1 * MozillaThunderbird-translations-common-115.5.0-150200.8.139.1 * MozillaThunderbird-115.5.0-150200.8.139.1 * MozillaThunderbird-translations-other-115.5.0-150200.8.139.1 * SUSE Linux Enterprise Workstation Extension 15 SP4 (x86_64) * MozillaThunderbird-debuginfo-115.5.0-150200.8.139.1 * MozillaThunderbird-debugsource-115.5.0-150200.8.139.1 * MozillaThunderbird-translations-common-115.5.0-150200.8.139.1 * MozillaThunderbird-115.5.0-150200.8.139.1 * MozillaThunderbird-translations-other-115.5.0-150200.8.139.1 * SUSE Linux Enterprise Workstation Extension 15 SP5 (x86_64) * MozillaThunderbird-debuginfo-115.5.0-150200.8.139.1 * MozillaThunderbird-debugsource-115.5.0-150200.8.139.1 * MozillaThunderbird-translations-common-115.5.0-150200.8.139.1 * MozillaThunderbird-115.5.0-150200.8.139.1 * MozillaThunderbird-translations-other-115.5.0-150200.8.139.1 ## References: * https://www.suse.com/security/cve/CVE-2023-6204.html * https://www.suse.com/security/cve/CVE-2023-6205.html * https://www.suse.com/security/cve/CVE-2023-6206.html * https://www.suse.com/security/cve/CVE-2023-6207.html * https://www.suse.com/security/cve/CVE-2023-6208.html * https://www.suse.com/security/cve/CVE-2023-6209.html * https://www.suse.com/security/cve/CVE-2023-6212.html * https://bugzilla.suse.com/show_bug.cgi?id=1217230

1 0