openSUSE Security Announce
Threads by month
- ----- 2025 -----
- January
- ----- 2024 -----
- December
- November
- October
- September
- August
- July
- June
- May
- April
- March
- February
- January
- ----- 2023 -----
- December
- November
- October
- September
- August
- July
- June
- May
- April
- March
- February
- January
- ----- 2022 -----
- December
- November
- October
- September
- August
- July
- June
- May
- April
- March
- February
- January
- ----- 2021 -----
- December
- November
- October
- September
- August
- July
- June
- May
- April
- March
- February
- January
- ----- 2020 -----
- December
- November
- October
- September
- August
- July
- June
- May
- April
- March
- February
- January
- ----- 2019 -----
- December
- November
- October
- September
- August
- July
- June
- May
- April
- March
- February
- January
- ----- 2018 -----
- December
- November
- October
- September
- August
- July
- June
- May
- April
- March
- February
- January
- ----- 2017 -----
- December
- November
- October
- September
- August
- July
- June
- May
- April
- March
- February
- January
- ----- 2016 -----
- December
- November
- October
- September
- August
- July
- June
- May
- April
- March
- February
- January
- ----- 2015 -----
- December
- November
- October
- September
- August
- July
- June
- May
- April
- March
- February
- January
- ----- 2014 -----
- December
- November
- October
- September
- August
- July
- June
- May
- April
- March
- February
- January
- ----- 2013 -----
- December
- November
- October
- September
- August
- July
- June
- May
- April
- March
- February
- January
- ----- 2012 -----
- December
- November
- October
- September
- August
- July
- June
- May
- April
- March
- February
- January
- ----- 2011 -----
- December
- November
- October
- September
- August
- July
- June
- May
- April
- March
- February
- January
- ----- 2010 -----
- December
- November
- October
- September
- August
- July
- June
- May
- April
- March
- February
- January
- ----- 2009 -----
- December
- November
- October
- September
- August
- July
- June
- May
- April
- March
- February
- January
- ----- 2008 -----
- December
- November
- October
- September
- August
- July
- June
- May
- April
- March
- February
- January
- ----- 2007 -----
- December
- November
- October
- September
- August
- July
- June
- May
- April
- March
- February
- January
- ----- 2006 -----
- December
- November
- October
- September
- August
- July
- June
- May
- April
- March
- February
- January
- ----- 2005 -----
- December
- November
- October
- September
- August
- July
- June
- May
- April
- March
- February
- January
- ----- 2004 -----
- December
- November
- October
- September
- August
- July
- June
- May
- April
- March
- February
- January
- ----- 2003 -----
- December
- November
- October
- September
- August
- July
- June
- May
- April
- March
- February
- January
- ----- 2002 -----
- December
- November
- October
- September
- August
- July
- June
- May
- April
- March
- February
- January
- ----- 2001 -----
- December
- November
- October
- September
- August
- July
- June
- May
- April
- March
- February
- January
- ----- 2000 -----
- December
- November
- October
- September
- August
- July
- June
- May
- April
- March
- February
- January
- ----- 1999 -----
- December
- November
- October
- September
- August
November 2023
- 2 participants
- 105 discussions
SUSE-SU-2023:4378-1: important: Security update for the Linux Kernel
by security＠lists.opensuse.org 06 Nov '23
by security＠lists.opensuse.org 06 Nov '23
06 Nov '23
# Security update for the Linux Kernel
Announcement ID: SUSE-SU-2023:4378-1
Rating: important
References:
* bsc#1208788
* bsc#1210778
* bsc#1211307
* bsc#1212423
* bsc#1212649
* bsc#1213705
* bsc#1213772
* bsc#1214842
* bsc#1215095
* bsc#1215104
* bsc#1215518
* bsc#1215955
* bsc#1215956
* bsc#1215957
* bsc#1215986
* bsc#1216062
* bsc#1216345
* bsc#1216510
* bsc#1216511
* bsc#1216512
* bsc#1216621
Cross-References:
* CVE-2023-2163
* CVE-2023-31085
* CVE-2023-34324
* CVE-2023-3777
* CVE-2023-39189
* CVE-2023-39193
* CVE-2023-5178
CVSS scores:
* CVE-2023-2163 ( SUSE ): 7.1 CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N
* CVE-2023-2163 ( NVD ): 10.0 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:N
* CVE-2023-31085 ( SUSE ): 5.5 CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
* CVE-2023-31085 ( NVD ): 5.5 CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
* CVE-2023-34324 ( SUSE ): 5.7 CVSS:3.1/AV:A/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
* CVE-2023-3777 ( SUSE ): 7.8 CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
* CVE-2023-3777 ( NVD ): 7.8 CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
* CVE-2023-39189 ( SUSE ): 4.4 CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:N
* CVE-2023-39189 ( NVD ): 5.1 CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:L
* CVE-2023-39193 ( SUSE ): 5.1 CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:L
* CVE-2023-39193 ( NVD ): 6.1 CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:L
* CVE-2023-5178 ( SUSE ): 7.2 CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H
* CVE-2023-5178 ( NVD ): 8.8 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Affected Products:
* Basesystem Module 15-SP4
* Development Tools Module 15-SP4
* Legacy Module 15-SP4
* openSUSE Leap 15.4
* openSUSE Leap Micro 5.3
* openSUSE Leap Micro 5.4
* SUSE Linux Enterprise Desktop 15 SP4
* SUSE Linux Enterprise High Availability Extension 15 SP4
* SUSE Linux Enterprise High Performance Computing 15 SP4
* SUSE Linux Enterprise Live Patching 15-SP4
* SUSE Linux Enterprise Micro 5.3
* SUSE Linux Enterprise Micro 5.4
* SUSE Linux Enterprise Micro for Rancher 5.3
* SUSE Linux Enterprise Micro for Rancher 5.4
* SUSE Linux Enterprise Real Time 15 SP4
* SUSE Linux Enterprise Server 15 SP4
* SUSE Linux Enterprise Server for SAP Applications 15 SP4
* SUSE Linux Enterprise Workstation Extension 15 SP4
* SUSE Manager Proxy 4.3
* SUSE Manager Retail Branch Server 4.3
* SUSE Manager Server 4.3
An update that solves seven vulnerabilities and has 14 security fixes can now be
installed.
## Description:
The SUSE Linux Enterprise 15 SP4 kernel was updated to receive various security
and bugfixes.
The following security bugs were fixed:
* CVE-2023-2163: Fixed an incorrect verifier pruning in BPF that could lead to
unsafe code paths being incorrectly marked as safe, resulting in arbitrary
read/write in kernel memory, lateral privilege escalation, and container
escape. (bsc#1215518)
* CVE-2023-34324: Fixed a possible deadlock in Linux kernel event handling.
(bsc#1215745).
* CVE-2023-39189: Fixed a flaw in the Netfilter subsystem that could allow a
local privileged (CAP_NET_ADMIN) attacker to trigger an out-of-bounds read,
leading to a crash or information disclosure. (bsc#1216046)
* CVE-2023-5178: Fixed an UAF in queue intialization setup. (bsc#1215768)
* CVE-2023-31085: Fixed a divide-by-zero error in do_div(sz,mtd->erasesize)
that could cause a local DoS. (bsc#1210778)
* CVE-2023-39193: Fixed an out of bounds read in the xtables subsystem
(bsc#1215860).
* CVE-2023-3777: Fixed a use-after-free vulnerability in netfilter: nf_tables
component can be exploited to achieve local privilege escalation.
(bsc#1215095)
The following non-security bugs were fixed:
* 9p: virtio: make sure 'offs' is initialized in zc_request (git-fixes).
* ACPI: irq: Fix incorrect return value in acpi_register_gsi() (git-fixes).
* ACPI: resource: Skip IRQ override on ASUS ExpertBook B1402CBA (git-fixes).
* ALSA: hda: Disable power save for solving pop issue on Lenovo ThinkCentre
M70q (git-fixes).
* ALSA: hda/realtek: Change model for Intel RVP board (git-fixes).
* ALSA: usb-audio: Fix microphone sound on Opencomm2 Headset (git-fixes).
* ASoC: codecs: wcd938x-sdw: fix runtime PM imbalance on probe errors (git-
fixes).
* ASoC: codecs: wcd938x-sdw: fix use after free on driver unbind (git-fixes).
* ASoC: codecs: wcd938x: drop bogus bind error handling (git-fixes).
* ASoC: codecs: wcd938x: fix unbind tear down order (git-fixes).
* ASoC: fsl: imx-pcm-rpmsg: Add SNDRV_PCM_INFO_BATCH flag (git-fixes).
* ASoC: imx-rpmsg: Set ignore_pmdown_time for dai_link (git-fixes).
* ASoC: pxa: fix a memory leak in probe() (git-fixes).
* ata: libata-core: Do not register PM operations for SAS ports (git-fixes).
* ata: libata-core: Fix ata_port_request_pm() locking (git-fixes).
* ata: libata-core: Fix port and device removal (git-fixes).
* ata: libata-sata: increase PMP SRST timeout to 10s (git-fixes).
* ata: libata-scsi: ignore reserved bits for REPORT SUPPORTED OPERATION CODES
(git-fixes).
* blk-cgroup: Fix NULL deref caused by blkg_policy_data being installed before
init (bsc#1216062).
* blk-cgroup: support to track if policy is online (bsc#1216062).
* Bluetooth: avoid memcmp() out of bounds warning (git-fixes).
* Bluetooth: Avoid redundant authentication (git-fixes).
* Bluetooth: btusb: add shutdown function for QCA6174 (git-fixes).
* Bluetooth: Fix a refcnt underflow problem for hci_conn (git-fixes).
* Bluetooth: hci_event: Fix coding style (git-fixes).
* Bluetooth: hci_event: Fix using memcmp when comparing keys (git-fixes).
* Bluetooth: hci_event: Ignore NULL link key (git-fixes).
* Bluetooth: hci_sock: Correctly bounds check and pad HCI_MON_NEW_INDEX name
(git-fixes).
* Bluetooth: hci_sock: fix slab oob read in create_monitor_event (git-fixes).
* Bluetooth: Reject connection with the device which has same BD_ADDR (git-
fixes).
* Bluetooth: vhci: Fix race when opening vhci device (git-fixes).
* bpf: propagate precision in ALU/ALU64 operations (git-fixes).
* bus: ti-sysc: Fix missing AM35xx SoC matching (git-fixes).
* bus: ti-sysc: Use fsleep() instead of usleep_range() in sysc_reset() (git-
fixes).
* cgroup: Remove duplicates in cgroup v1 tasks file (bsc#1211307).
* cgroup/cpuset: Change references of cpuset_mutex to cpuset_rwsem
(bsc#1215955).
* clk: tegra: fix error return case for recalc_rate (git-fixes).
* counter: microchip-tcb-capture: Fix the use of internal GCLK logic (git-
fixes).
* crypto: qat - add fw_counters debugfs file (PED-6401).
* crypto: qat - add heartbeat counters check (PED-6401).
* crypto: qat - add heartbeat feature (PED-6401).
* crypto: qat - add internal timer for qat 4xxx (PED-6401).
* crypto: qat - add measure clock frequency (PED-6401).
* crypto: qat - add missing function declaration in adf_dbgfs.h (PED-6401).
* crypto: qat - add qat_zlib_deflate (PED-6401).
* crypto: qat - add support for 402xx devices (PED-6401).
* crypto: qat - change value of default idle filter (PED-6401).
* crypto: qat - delay sysfs initialization (PED-6401).
* crypto: qat - do not export adf_init_admin_pm() (PED-6401).
* crypto: qat - drop log level of msg in get_instance_node() (PED-6401).
* crypto: qat - drop obsolete heartbeat interface (PED-6401).
* crypto: qat - drop redundant adf_enable_aer() (PED-6401).
* crypto: qat - expose pm_idle_enabled through sysfs (PED-6401).
* crypto: qat - extend buffer list logic interface (PED-6401).
* crypto: qat - extend configuration for 4xxx (PED-6401).
* crypto: qat - fix apply custom thread-service mapping for dc service
(PED-6401).
* crypto: qat - fix concurrency issue when device state changes (PED-6401).
* crypto: qat - fix crypto capability detection for 4xxx (PED-6401).
* crypto: qat - fix spelling mistakes from 'bufer' to 'buffer' (PED-6401).
* crypto: qat - Include algapi.h for low-level Crypto API (PED-6401).
* crypto: qat - make fw images name constant (PED-6401).
* crypto: qat - make state machine functions static (PED-6401).
* crypto: qat - move dbgfs init to separate file (PED-6401).
* crypto: qat - move returns to default case (PED-6401).
* crypto: qat - refactor device restart logic (PED-6401).
* crypto: qat - refactor fw config logic for 4xxx (PED-6401).
* crypto: qat - remove ADF_STATUS_PF_RUNNING flag from probe (PED-6401).
* crypto: qat - Remove unused function declarations (PED-6401).
* crypto: qat - replace state machine calls (PED-6401).
* crypto: qat - replace the if statement with min() (PED-6401).
* crypto: qat - set deprecated capabilities as reserved (PED-6401).
* crypto: qat - unmap buffer before free for DH (PED-6401).
* crypto: qat - unmap buffers before free for RSA (PED-6401).
* crypto: qat - update slice mask for 4xxx devices (PED-6401).
* crypto: qat - use kfree_sensitive instead of memset/kfree() (PED-6401).
* dmaengine: idxd: use spin_lock_irqsave before wait_event_lock_irq (git-
fixes).
* dmaengine: mediatek: Fix deadlock caused by synchronize_irq() (git-fixes).
* dmaengine: stm32-mdma: abort resume if no ongoing transfer (git-fixes).
* Documentation: qat: change kernel version (PED-6401).
* Documentation: qat: rewrite description (PED-6401).
* Drivers: hv: vmbus: Call hv_synic_free() if hv_synic_alloc() fails (git-
fixes).
* Drivers: hv: vmbus: Fix vmbus_wait_for_unload() to scan present CPUs (git-
fixes).
* drm: panel-orientation-quirks: Add quirk for One Mix 2S (git-fixes).
* drm/amd/display: Do not check registers, if using AUX BL control (git-
fixes).
* drm/amd/display: Do not set dpms_off for seamless boot (git-fixes).
* drm/amdgpu: add missing NULL check (git-fixes).
* drm/amdgpu: Handle null atom context in VBIOS info ioctl (git-fixes).
* drm/i915: Retry gtt fault when out of fence registers (git-fixes).
* drm/msm/dp: do not reinitialize phy unless retry during link training (git-
fixes).
* drm/msm/dpu: change _dpu_plane_calc_bw() to use u64 to avoid overflow (git-
fixes).
* drm/msm/dsi: fix irq_of_parse_and_map() error checking (git-fixes).
* drm/msm/dsi: skip the wait for video mode done if not applicable (git-
fixes).
* drm/vmwgfx: fix typo of sizeof argument (git-fixes).
* firmware: arm_ffa: Do not set the memory region attributes for MEM_LEND
(git-fixes).
* firmware: imx-dsp: Fix an error handling path in imx_dsp_setup_channels()
(git-fixes).
* gpio: aspeed: fix the GPIO number passed to pinctrl_gpio_set_config() (git-
fixes).
* gpio: pmic-eic-sprd: Add can_sleep flag for PMIC EIC chip (git-fixes).
* gpio: pxa: disable pinctrl calls for MMP_GPIO (git-fixes).
* gpio: tb10x: Fix an error handling path in tb10x_gpio_probe() (git-fixes).
* gpio: timberdale: Fix potential deadlock on &tgpio->lock (git-fixes).
* gpio: vf610: set value before the direction to avoid a glitch (git-fixes).
* gve: Do not fully free QPL pages on prefill errors (git-fixes).
* HID: holtek: fix slab-out-of-bounds Write in holtek_kbd_input_event (git-
fixes).
* HID: intel-ish-hid: ipc: Disable and reenable ACPI GPE bit (git-fixes).
* HID: logitech-hidpp: Fix kernel crash on receiver USB disconnect (git-
fixes).
* HID: multitouch: Add required quirk for Synaptics 0xcd7e device (git-fixes).
* HID: sony: Fix a potential memory leak in sony_probe() (git-fixes).
* HID: sony: remove duplicate NULL check before calling usb_free_urb() (git-
fixes).
* i2c: i801: unregister tco_pdev in i801_probe() error path (git-fixes).
* i2c: mux: Avoid potential false error message in i2c_mux_add_adapter (git-
fixes).
* i2c: mux: demux-pinctrl: check the return value of devm_kstrdup() (git-
fixes).
* i2c: mux: gpio: Add missing fwnode_handle_put() (git-fixes).
* i2c: mux: gpio: Replace custom acpi_get_local_address() (git-fixes).
* i2c: npcm7xx: Fix callback completion ordering (git-fixes).
* IB/mlx4: Fix the size of a buffer in add_port_entries() (git-fixes)
* ieee802154: ca8210: Fix a potential UAF in ca8210_probe (git-fixes).
* iio: pressure: bmp280: Fix NULL pointer exception (git-fixes).
* iio: pressure: dps310: Adjust Timeout Settings (git-fixes).
* iio: pressure: ms5611: ms5611_prom_is_valid false negative bug (git-fixes).
* Input: goodix - ensure int GPIO is in input for gpio_count == 1 &&
gpio_int_idx == 0 case (git-fixes).
* Input: powermate - fix use-after-free in powermate_config_complete (git-
fixes).
* Input: psmouse - fix fast_reconnect function for PS/2 mode (git-fixes).
* Input: xpad - add PXN V900 support (git-fixes).
* iommu/amd: Add map/unmap_pages() iommu_domain_ops callback support
(bsc#1212423).
* iommu/amd/io-pgtable: Implement map_pages io_pgtable_ops callback
(bsc#1212423).
* iommu/amd/io-pgtable: Implement unmap_pages io_pgtable_ops callback
(bsc#1212423).
* kabi: blkcg_policy_data fix KABI (bsc#1216062).
* kabi: workaround for enum nft_trans_phase (bsc#1215104).
* kprobes: Prohibit probing on CFI preamble symbol (git-fixes).
* KVM: s390: fix gisa destroy operation might lead to cpu stalls (git-fixes
bsc#1216512).
* KVM: SVM: Do not kill SEV guest if SMAP erratum triggers in usermode (git-
fixes).
* KVM: x86: add support for CPUID leaf 0x80000021 (bsc#1213772).
* KVM: x86: Fix clang -Wimplicit-fallthrough in do_host_cpuid() (git-fixes).
* KVM: x86: Move open-coded CPUID leaf 0x80000021 EAX bit propagation code
(bsc#1213772).
* KVM: x86: Propagate the AMD Automatic IBRS feature to the guest
(bsc#1213772).
* KVM: x86: synthesize CPUID leaf 0x80000021h if useful (bsc#1213772).
* KVM: x86: work around QEMU issue with synthetic CPUID leaves (git-fixes).
* KVM: x86/mmu: Reconstruct shadow page root if the guest PDPTEs is changed
(git-fixes).
* leds: Drop BUG_ON check for LED_COLOR_ID_MULTI (git-fixes).
* mm, memcg: reconsider kmem.limit_in_bytes deprecation (bsc#1208788
bsc#1213705).
* mmc: core: Capture correct oemid-bits for eMMC cards (git-fixes).
* mmc: core: sdio: hold retuning if sdio in 1-bit mode (git-fixes).
* mmc: mtk-sd: Use readl_poll_timeout_atomic in msdc_reset_hw (git-fixes).
* mtd: physmap-core: Restore map_rom fallback (git-fixes).
* mtd: rawnand: arasan: Ensure program page operations are successful (git-
fixes).
* mtd: rawnand: marvell: Ensure program page operations are successful (git-
fixes).
* mtd: rawnand: pl353: Ensure program page operations are successful (git-
fixes).
* mtd: rawnand: qcom: Unmap the right resource upon probe failure (git-fixes).
* mtd: spinand: micron: correct bitmask for ecc status (git-fixes).
* net: mana: Fix oversized sge0 for GSO packets (bsc#1215986).
* net: mana: Fix TX CQE error handling (bsc#1215986).
* net: nfc: llcp: Add lock when modifying device list (git-fixes).
* net: rfkill: gpio: prevent value glitch during probe (git-fixes).
* net: sched: add barrier to fix packet stuck problem for lockless qdisc
(bsc#1216345).
* net: sched: fixed barrier to prevent skbuff sticking in qdisc backlog
(bsc#1216345).
* net: usb: dm9601: fix uninitialized variable use in dm9601_mdio_read (git-
fixes).
* net: usb: smsc75xx: Fix uninit-value access in __smsc75xx_read_reg (git-
fixes).
* net: usb: smsc75xx: Fix uninit-value access in __smsc75xx_read_reg (git-
fixes).
* net: usb: smsc95xx: Fix an error code in smsc95xx_reset() (git-fixes).
* net/sched: fix netdevice reference leaks in attach_default_qdiscs() (git-
fixes).
* netfilter: nf_tables: add NFT_TRANS_PREPARE_ERROR to deal with bound
set/chain (git-fixes).
* netfilter: nf_tables: unbind non-anonymous set if rule construction fails
(git-fixes).
* nfc: nci: assert requested protocol is valid (git-fixes).
* nfc: nci: fix possible NULL pointer dereference in send_acknowledge() (git-
fixes).
* nilfs2: fix potential use after free in nilfs_gccache_submit_read_data()
(git-fixes).
* nvme-fc: Prevent null pointer dereference in nvme_fc_io_getuuid()
(bsc#1214842).
* phy: mapphone-mdm6600: Fix pinctrl_pm handling for sleep pins (git-fixes).
* phy: mapphone-mdm6600: Fix runtime disable on probe (git-fixes).
* phy: mapphone-mdm6600: Fix runtime PM for remove (git-fixes).
* pinctrl: avoid unsafe code pattern in find_pinctrl() (git-fixes).
* pinctrl: renesas: rzn1: Enable missing PINMUX (git-fixes).
* platform/surface: platform_profile: Propagate error if profile registration
fails (git-fixes).
* platform/x86: asus-wmi: Change ASUS_WMI_BRN_DOWN code from 0x20 to 0x2e
(git-fixes).
* platform/x86: asus-wmi: Map 0x2a code, Ignore 0x2b and 0x2c events (git-
fixes).
* platform/x86: think-lmi: Fix reference leak (git-fixes).
* platform/x86: touchscreen_dmi: Add info for the Positivo C4128B (git-fixes).
* power: supply: ucs1002: fix error code in ucs1002_get_property() (git-
fixes).
* r8152: check budget for r8152_poll() (git-fixes).
* RDMA/cma: Fix truncation compilation warning in make_cma_ports (git-fixes)
* RDMA/cma: Initialize ib_sa_multicast structure to 0 when join (git-fixes)
* RDMA/core: Require admin capabilities to set system parameters (git-fixes)
* RDMA/cxgb4: Check skb value for failure to allocate (git-fixes)
* RDMA/mlx5: Fix NULL string error (git-fixes)
* RDMA/siw: Fix connection failure handling (git-fixes)
* RDMA/srp: Do not call scsi_done() from srp_abort() (git-fixes)
* RDMA/uverbs: Fix typo of sizeof argument (git-fixes)
* regmap: fix NULL deref on lookup (git-fixes).
* regmap: rbtree: Fix wrong register marked as in-cache when creating new node
(git-fixes).
* ring-buffer: Avoid softlockup in ring_buffer_resize() (git-fixes).
* ring-buffer: Do not attempt to read past "commit" (git-fixes).
* ring-buffer: Fix bytes info in per_cpu buffer stats (git-fixes).
* ring-buffer: Update "shortest_full" in polling (git-fixes).
* s390: add z16 elf platform (git-fixes LTC#203789 bsc#1215956 LTC#203788
bsc#1215957).
* s390/cio: fix a memleak in css_alloc_subchannel (git-fixes bsc#1216510).
* s390/pci: fix iommu bitmap allocation (git-fixes bsc#1216511).
* sched/cpuset: Bring back cpuset_mutex (bsc#1215955).
* sched/deadline,rt: Remove unused parameter from pick_next_[rt|dl]_entity()
(git fixes (sched)).
* sched/rt: Fix live lock between select_fallback_rq() and RT push (git fixes
(sched)).
* sched/rt: Fix sysctl_sched_rr_timeslice intial value (git fixes (sched)).
* serial: 8250_port: Check IRQ data before use (git-fixes).
* soc: imx8m: Enable OCOTP clock for imx8mm before reading registers (git-
fixes).
* spi: nxp-fspi: reset the FLSHxCR1 registers (git-fixes).
* spi: stm32: add a delay before SPI disable (git-fixes).
* spi: sun6i: fix race between DMA RX transfer completion and RX FIFO drain
(git-fixes).
* spi: sun6i: reduce DMA RX transfer width to single byte (git-fixes).
* thunderbolt: Check that lane 1 is in CL0 before enabling lane bonding (git-
fixes).
* thunderbolt: Workaround an IOMMU fault on certain systems with Intel Maple
Ridge (git-fixes).
* tracing: Have current_trace inc the trace array ref count (git-fixes).
* tracing: Have event inject files inc the trace array ref count (git-fixes).
* tracing: Have option files inc the trace array ref count (git-fixes).
* tracing: Have tracing_max_latency inc the trace array ref count (git-fixes).
* tracing: Increase trace array ref count on enable and filter files (git-
fixes).
* tracing: Make trace_marker{,_raw} stream-like (git-fixes).
* usb: cdnsp: Fixes issue with dequeuing not queued requests (git-fixes).
* usb: dwc3: Soft reset phy on probe for host (git-fixes).
* usb: gadget: ncm: Handle decoding of multiple NTB's in unwrap call (git-
fixes).
* usb: gadget: udc-xilinx: replace memcpy with memcpy_toio (git-fixes).
* usb: musb: Get the musb_qh poniter after musb_giveback (git-fixes).
* usb: musb: Modify the "HWVers" register address (git-fixes).
* usb: serial: option: add entry for Sierra EM9191 with new firmware (git-
fixes).
* usb: serial: option: add Fibocom to DELL custom modem FM101R-GL (git-fixes).
* usb: serial: option: add Telit LE910C4-WWX 0x1035 composition (git-fixes).
* usb: typec: altmodes/displayport: Signal hpd low when exiting mode (git-
fixes).
* usb: xhci: xhci-ring: Use sysdev for mapping bounce buffer (git-fixes).
* vmbus_testing: fix wrong python syntax for integer value comparison (git-
fixes).
* vringh: do not use vringh_kiov_advance() in vringh_iov_xfer() (git-fixes).
* watchdog: iTCO_wdt: No need to stop the timer in probe (git-fixes).
* watchdog: iTCO_wdt: Set NO_REBOOT if the watchdog is not already running
(git-fixes).
* wifi: cfg80211: avoid leaking stack data into trace (git-fixes).
* wifi: cfg80211: Fix 6GHz scan configuration (git-fixes).
* wifi: iwlwifi: dbg_ini: fix structure packing (git-fixes).
* wifi: iwlwifi: Ensure ack flag is properly cleared (git-fixes).
* wifi: iwlwifi: mvm: Fix a memory corruption issue (git-fixes).
* wifi: mac80211: allow transmitting EAPOL frames with tainted key (git-
fixes).
* wifi: mt76: mt76x02: fix MT76x0 external LNA gain handling (git-fixes).
* wifi: mwifiex: Fix oob check condition in mwifiex_process_rx_packet (git-
fixes).
* wifi: mwifiex: Fix tlv_buf_left calculation (git-fixes).
* wifi: mwifiex: Sanity check tlv_len and tlv_bitmap_len (git-fixes).
* x86/cpu, kvm: Add the NO_NESTED_DATA_BP feature (bsc#1213772).
* x86/cpu, kvm: Add the Null Selector Clears Base feature (bsc#1213772).
* x86/cpu, kvm: Add the SMM_CTL MSR not present feature (bsc#1213772).
* x86/cpu, kvm: Move X86_FEATURE_LFENCE_RDTSC to its native leaf
(bsc#1213772).
* x86/cpu: Enable STIBP on AMD if Automatic IBRS is enabled (bsc#1213772).
* x86/cpu: Support AMD Automatic IBRS (bsc#1213772).
* x86/sev: Check for user-space IOIO pointing to kernel space (bsc#1212649).
* x86/sev: Check IOBM for IOIO exceptions from user-space (bsc#1212649).
* x86/sev: Disable MMIO emulation from user mode (bsc#1212649).
* xen-netback: use default TX queue size for vifs (git-fixes).
## Special Instructions and Notes:
* Please reboot the system after installing this update.
## Patch Instructions:
To install this SUSE update use the SUSE recommended installation methods like
YaST online_update or "zypper patch".
Alternatively you can run the command listed for your product:
* openSUSE Leap 15.4
zypper in -t patch openSUSE-SLE-15.4-2023-4378=1 SUSE-2023-4378=1
* openSUSE Leap Micro 5.3
zypper in -t patch openSUSE-Leap-Micro-5.3-2023-4378=1
* openSUSE Leap Micro 5.4
zypper in -t patch openSUSE-Leap-Micro-5.4-2023-4378=1
* SUSE Linux Enterprise Micro for Rancher 5.3
zypper in -t patch SUSE-SLE-Micro-5.3-2023-4378=1
* SUSE Linux Enterprise Micro 5.3
zypper in -t patch SUSE-SLE-Micro-5.3-2023-4378=1
* SUSE Linux Enterprise Micro for Rancher 5.4
zypper in -t patch SUSE-SLE-Micro-5.4-2023-4378=1
* SUSE Linux Enterprise Micro 5.4
zypper in -t patch SUSE-SLE-Micro-5.4-2023-4378=1
* Basesystem Module 15-SP4
zypper in -t patch SUSE-SLE-Module-Basesystem-15-SP4-2023-4378=1
* Development Tools Module 15-SP4
zypper in -t patch SUSE-SLE-Module-Development-Tools-15-SP4-2023-4378=1
* Legacy Module 15-SP4
zypper in -t patch SUSE-SLE-Module-Legacy-15-SP4-2023-4378=1
* SUSE Linux Enterprise Live Patching 15-SP4
zypper in -t patch SUSE-SLE-Module-Live-Patching-15-SP4-2023-4378=1
Please note that this is the initial kernel livepatch without fixes itself, this
package is later updated by separate standalone kernel livepatch updates.
* SUSE Linux Enterprise High Availability Extension 15 SP4
zypper in -t patch SUSE-SLE-Product-HA-15-SP4-2023-4378=1
* SUSE Linux Enterprise Workstation Extension 15 SP4
zypper in -t patch SUSE-SLE-Product-WE-15-SP4-2023-4378=1
## Package List:
* openSUSE Leap 15.4 (noarch nosrc)
* kernel-docs-5.14.21-150400.24.97.1
* openSUSE Leap 15.4 (noarch)
* kernel-devel-5.14.21-150400.24.97.1
* kernel-source-5.14.21-150400.24.97.1
* kernel-source-vanilla-5.14.21-150400.24.97.1
* kernel-macros-5.14.21-150400.24.97.1
* kernel-docs-html-5.14.21-150400.24.97.1
* openSUSE Leap 15.4 (nosrc ppc64le x86_64)
* kernel-debug-5.14.21-150400.24.97.1
* openSUSE Leap 15.4 (ppc64le x86_64)
* kernel-debug-debuginfo-5.14.21-150400.24.97.1
* kernel-debug-devel-5.14.21-150400.24.97.1
* kernel-debug-debugsource-5.14.21-150400.24.97.1
* kernel-debug-livepatch-devel-5.14.21-150400.24.97.1
* kernel-debug-devel-debuginfo-5.14.21-150400.24.97.1
* openSUSE Leap 15.4 (aarch64 ppc64le x86_64)
* kernel-kvmsmall-debuginfo-5.14.21-150400.24.97.1
* kernel-default-base-5.14.21-150400.24.97.1.150400.24.44.2
* kernel-default-base-rebuild-5.14.21-150400.24.97.1.150400.24.44.2
* kernel-kvmsmall-devel-debuginfo-5.14.21-150400.24.97.1
* kernel-kvmsmall-devel-5.14.21-150400.24.97.1
* kernel-kvmsmall-debugsource-5.14.21-150400.24.97.1
* kernel-kvmsmall-livepatch-devel-5.14.21-150400.24.97.1
* openSUSE Leap 15.4 (aarch64 ppc64le s390x x86_64)
* kernel-default-debuginfo-5.14.21-150400.24.97.1
* dlm-kmp-default-5.14.21-150400.24.97.1
* ocfs2-kmp-default-debuginfo-5.14.21-150400.24.97.1
* dlm-kmp-default-debuginfo-5.14.21-150400.24.97.1
* kernel-default-devel-debuginfo-5.14.21-150400.24.97.1
* gfs2-kmp-default-5.14.21-150400.24.97.1
* kernel-default-extra-5.14.21-150400.24.97.1
* kernel-default-extra-debuginfo-5.14.21-150400.24.97.1
* kernel-obs-qa-5.14.21-150400.24.97.1
* cluster-md-kmp-default-5.14.21-150400.24.97.1
* kernel-default-devel-5.14.21-150400.24.97.1
* kernel-obs-build-debugsource-5.14.21-150400.24.97.1
* gfs2-kmp-default-debuginfo-5.14.21-150400.24.97.1
* cluster-md-kmp-default-debuginfo-5.14.21-150400.24.97.1
* kernel-default-livepatch-devel-5.14.21-150400.24.97.1
* kernel-default-optional-debuginfo-5.14.21-150400.24.97.1
* ocfs2-kmp-default-5.14.21-150400.24.97.1
* kernel-syms-5.14.21-150400.24.97.1
* reiserfs-kmp-default-debuginfo-5.14.21-150400.24.97.1
* reiserfs-kmp-default-5.14.21-150400.24.97.1
* kernel-default-debugsource-5.14.21-150400.24.97.1
* kernel-default-optional-5.14.21-150400.24.97.1
* kselftests-kmp-default-debuginfo-5.14.21-150400.24.97.1
* kernel-default-livepatch-5.14.21-150400.24.97.1
* kselftests-kmp-default-5.14.21-150400.24.97.1
* kernel-obs-build-5.14.21-150400.24.97.1
* openSUSE Leap 15.4 (aarch64 ppc64le s390x x86_64 nosrc)
* kernel-default-5.14.21-150400.24.97.1
* openSUSE Leap 15.4 (aarch64 nosrc ppc64le x86_64)
* kernel-kvmsmall-5.14.21-150400.24.97.1
* openSUSE Leap 15.4 (ppc64le s390x x86_64)
* kernel-livepatch-SLE15-SP4_Update_20-debugsource-1-150400.9.3.2
* kernel-livepatch-5_14_21-150400_24_97-default-debuginfo-1-150400.9.3.2
* kernel-livepatch-5_14_21-150400_24_97-default-1-150400.9.3.2
* openSUSE Leap 15.4 (nosrc s390x)
* kernel-zfcpdump-5.14.21-150400.24.97.1
* openSUSE Leap 15.4 (s390x)
* kernel-zfcpdump-debugsource-5.14.21-150400.24.97.1
* kernel-zfcpdump-debuginfo-5.14.21-150400.24.97.1
* openSUSE Leap 15.4 (nosrc)
* dtb-aarch64-5.14.21-150400.24.97.1
* openSUSE Leap 15.4 (aarch64)
* kernel-64kb-extra-5.14.21-150400.24.97.1
* dtb-xilinx-5.14.21-150400.24.97.1
* dtb-socionext-5.14.21-150400.24.97.1
* ocfs2-kmp-64kb-5.14.21-150400.24.97.1
* dtb-sprd-5.14.21-150400.24.97.1
* dlm-kmp-64kb-5.14.21-150400.24.97.1
* dtb-allwinner-5.14.21-150400.24.97.1
* reiserfs-kmp-64kb-5.14.21-150400.24.97.1
* dtb-amd-5.14.21-150400.24.97.1
* dtb-exynos-5.14.21-150400.24.97.1
* dtb-mediatek-5.14.21-150400.24.97.1
* dtb-arm-5.14.21-150400.24.97.1
* dtb-altera-5.14.21-150400.24.97.1
* dtb-lg-5.14.21-150400.24.97.1
* dtb-renesas-5.14.21-150400.24.97.1
* dtb-freescale-5.14.21-150400.24.97.1
* kernel-64kb-debuginfo-5.14.21-150400.24.97.1
* reiserfs-kmp-64kb-debuginfo-5.14.21-150400.24.97.1
* dtb-qcom-5.14.21-150400.24.97.1
* dtb-marvell-5.14.21-150400.24.97.1
* dtb-cavium-5.14.21-150400.24.97.1
* dlm-kmp-64kb-debuginfo-5.14.21-150400.24.97.1
* gfs2-kmp-64kb-5.14.21-150400.24.97.1
* kernel-64kb-optional-5.14.21-150400.24.97.1
* cluster-md-kmp-64kb-5.14.21-150400.24.97.1
* dtb-apm-5.14.21-150400.24.97.1
* kernel-64kb-optional-debuginfo-5.14.21-150400.24.97.1
* kernel-64kb-livepatch-devel-5.14.21-150400.24.97.1
* dtb-rockchip-5.14.21-150400.24.97.1
* ocfs2-kmp-64kb-debuginfo-5.14.21-150400.24.97.1
* dtb-hisilicon-5.14.21-150400.24.97.1
* dtb-amlogic-5.14.21-150400.24.97.1
* kselftests-kmp-64kb-debuginfo-5.14.21-150400.24.97.1
* dtb-amazon-5.14.21-150400.24.97.1
* kselftests-kmp-64kb-5.14.21-150400.24.97.1
* dtb-apple-5.14.21-150400.24.97.1
* dtb-nvidia-5.14.21-150400.24.97.1
* cluster-md-kmp-64kb-debuginfo-5.14.21-150400.24.97.1
* kernel-64kb-devel-5.14.21-150400.24.97.1
* dtb-broadcom-5.14.21-150400.24.97.1
* kernel-64kb-extra-debuginfo-5.14.21-150400.24.97.1
* gfs2-kmp-64kb-debuginfo-5.14.21-150400.24.97.1
* kernel-64kb-devel-debuginfo-5.14.21-150400.24.97.1
* kernel-64kb-debugsource-5.14.21-150400.24.97.1
* openSUSE Leap 15.4 (aarch64 nosrc)
* kernel-64kb-5.14.21-150400.24.97.1
* openSUSE Leap Micro 5.3 (aarch64 nosrc x86_64)
* kernel-default-5.14.21-150400.24.97.1
* openSUSE Leap Micro 5.3 (aarch64 x86_64)
* kernel-default-debuginfo-5.14.21-150400.24.97.1
* kernel-default-base-5.14.21-150400.24.97.1.150400.24.44.2
* kernel-default-debugsource-5.14.21-150400.24.97.1
* openSUSE Leap Micro 5.4 (aarch64 nosrc s390x x86_64)
* kernel-default-5.14.21-150400.24.97.1
* openSUSE Leap Micro 5.4 (aarch64 x86_64)
* kernel-default-base-5.14.21-150400.24.97.1.150400.24.44.2
* openSUSE Leap Micro 5.4 (aarch64 s390x x86_64)
* kernel-default-debuginfo-5.14.21-150400.24.97.1
* kernel-default-debugsource-5.14.21-150400.24.97.1
* SUSE Linux Enterprise Micro for Rancher 5.3 (aarch64 nosrc s390x x86_64)
* kernel-default-5.14.21-150400.24.97.1
* SUSE Linux Enterprise Micro for Rancher 5.3 (aarch64 x86_64)
* kernel-default-base-5.14.21-150400.24.97.1.150400.24.44.2
* SUSE Linux Enterprise Micro for Rancher 5.3 (aarch64 s390x x86_64)
* kernel-default-debuginfo-5.14.21-150400.24.97.1
* kernel-default-debugsource-5.14.21-150400.24.97.1
* SUSE Linux Enterprise Micro 5.3 (aarch64 nosrc s390x x86_64)
* kernel-default-5.14.21-150400.24.97.1
* SUSE Linux Enterprise Micro 5.3 (aarch64 x86_64)
* kernel-default-base-5.14.21-150400.24.97.1.150400.24.44.2
* SUSE Linux Enterprise Micro 5.3 (aarch64 s390x x86_64)
* kernel-default-debuginfo-5.14.21-150400.24.97.1
* kernel-default-debugsource-5.14.21-150400.24.97.1
* SUSE Linux Enterprise Micro for Rancher 5.4 (aarch64 nosrc s390x x86_64)
* kernel-default-5.14.21-150400.24.97.1
* SUSE Linux Enterprise Micro for Rancher 5.4 (aarch64 x86_64)
* kernel-default-base-5.14.21-150400.24.97.1.150400.24.44.2
* SUSE Linux Enterprise Micro for Rancher 5.4 (aarch64 s390x x86_64)
* kernel-default-debuginfo-5.14.21-150400.24.97.1
* kernel-default-debugsource-5.14.21-150400.24.97.1
* SUSE Linux Enterprise Micro 5.4 (aarch64 nosrc s390x x86_64)
* kernel-default-5.14.21-150400.24.97.1
* SUSE Linux Enterprise Micro 5.4 (aarch64 x86_64)
* kernel-default-base-5.14.21-150400.24.97.1.150400.24.44.2
* SUSE Linux Enterprise Micro 5.4 (aarch64 s390x x86_64)
* kernel-default-debuginfo-5.14.21-150400.24.97.1
* kernel-default-debugsource-5.14.21-150400.24.97.1
* Basesystem Module 15-SP4 (aarch64 nosrc)
* kernel-64kb-5.14.21-150400.24.97.1
* Basesystem Module 15-SP4 (aarch64)
* kernel-64kb-devel-debuginfo-5.14.21-150400.24.97.1
* kernel-64kb-debugsource-5.14.21-150400.24.97.1
* kernel-64kb-devel-5.14.21-150400.24.97.1
* kernel-64kb-debuginfo-5.14.21-150400.24.97.1
* Basesystem Module 15-SP4 (aarch64 ppc64le s390x x86_64 nosrc)
* kernel-default-5.14.21-150400.24.97.1
* Basesystem Module 15-SP4 (aarch64 ppc64le x86_64)
* kernel-default-base-5.14.21-150400.24.97.1.150400.24.44.2
* Basesystem Module 15-SP4 (aarch64 ppc64le s390x x86_64)
* kernel-default-devel-5.14.21-150400.24.97.1
* kernel-default-debuginfo-5.14.21-150400.24.97.1
* kernel-default-devel-debuginfo-5.14.21-150400.24.97.1
* kernel-default-debugsource-5.14.21-150400.24.97.1
* Basesystem Module 15-SP4 (noarch)
* kernel-macros-5.14.21-150400.24.97.1
* kernel-devel-5.14.21-150400.24.97.1
* Basesystem Module 15-SP4 (nosrc s390x)
* kernel-zfcpdump-5.14.21-150400.24.97.1
* Basesystem Module 15-SP4 (s390x)
* kernel-zfcpdump-debugsource-5.14.21-150400.24.97.1
* kernel-zfcpdump-debuginfo-5.14.21-150400.24.97.1
* Development Tools Module 15-SP4 (noarch nosrc)
* kernel-docs-5.14.21-150400.24.97.1
* Development Tools Module 15-SP4 (aarch64 ppc64le s390x x86_64)
* kernel-obs-build-debugsource-5.14.21-150400.24.97.1
* kernel-syms-5.14.21-150400.24.97.1
* kernel-obs-build-5.14.21-150400.24.97.1
* Development Tools Module 15-SP4 (noarch)
* kernel-source-5.14.21-150400.24.97.1
* Legacy Module 15-SP4 (nosrc)
* kernel-default-5.14.21-150400.24.97.1
* Legacy Module 15-SP4 (aarch64 ppc64le s390x x86_64)
* reiserfs-kmp-default-5.14.21-150400.24.97.1
* kernel-default-debuginfo-5.14.21-150400.24.97.1
* reiserfs-kmp-default-debuginfo-5.14.21-150400.24.97.1
* kernel-default-debugsource-5.14.21-150400.24.97.1
* SUSE Linux Enterprise Live Patching 15-SP4 (nosrc)
* kernel-default-5.14.21-150400.24.97.1
* SUSE Linux Enterprise Live Patching 15-SP4 (ppc64le s390x x86_64)
* kernel-default-debuginfo-5.14.21-150400.24.97.1
* kernel-default-debugsource-5.14.21-150400.24.97.1
* kernel-default-livepatch-devel-5.14.21-150400.24.97.1
* kernel-default-livepatch-5.14.21-150400.24.97.1
* kernel-livepatch-5_14_21-150400_24_97-default-debuginfo-1-150400.9.3.2
* kernel-livepatch-SLE15-SP4_Update_20-debugsource-1-150400.9.3.2
* kernel-livepatch-5_14_21-150400_24_97-default-1-150400.9.3.2
* SUSE Linux Enterprise High Availability Extension 15 SP4 (aarch64 ppc64le
s390x x86_64)
* ocfs2-kmp-default-debuginfo-5.14.21-150400.24.97.1
* cluster-md-kmp-default-debuginfo-5.14.21-150400.24.97.1
* kernel-default-debuginfo-5.14.21-150400.24.97.1
* dlm-kmp-default-debuginfo-5.14.21-150400.24.97.1
* kernel-default-debugsource-5.14.21-150400.24.97.1
* gfs2-kmp-default-5.14.21-150400.24.97.1
* ocfs2-kmp-default-5.14.21-150400.24.97.1
* cluster-md-kmp-default-5.14.21-150400.24.97.1
* dlm-kmp-default-5.14.21-150400.24.97.1
* gfs2-kmp-default-debuginfo-5.14.21-150400.24.97.1
* SUSE Linux Enterprise High Availability Extension 15 SP4 (nosrc)
* kernel-default-5.14.21-150400.24.97.1
* SUSE Linux Enterprise Workstation Extension 15 SP4 (nosrc)
* kernel-default-5.14.21-150400.24.97.1
* SUSE Linux Enterprise Workstation Extension 15 SP4 (x86_64)
* kernel-default-extra-5.14.21-150400.24.97.1
* kernel-default-debuginfo-5.14.21-150400.24.97.1
* kernel-default-extra-debuginfo-5.14.21-150400.24.97.1
* kernel-default-debugsource-5.14.21-150400.24.97.1
## References:
* https://www.suse.com/security/cve/CVE-2023-2163.html
* https://www.suse.com/security/cve/CVE-2023-31085.html
* https://www.suse.com/security/cve/CVE-2023-34324.html
* https://www.suse.com/security/cve/CVE-2023-3777.html
* https://www.suse.com/security/cve/CVE-2023-39189.html
* https://www.suse.com/security/cve/CVE-2023-39193.html
* https://www.suse.com/security/cve/CVE-2023-5178.html
* https://bugzilla.suse.com/show_bug.cgi?id=1208788
* https://bugzilla.suse.com/show_bug.cgi?id=1210778
* https://bugzilla.suse.com/show_bug.cgi?id=1211307
* https://bugzilla.suse.com/show_bug.cgi?id=1212423
* https://bugzilla.suse.com/show_bug.cgi?id=1212649
* https://bugzilla.suse.com/show_bug.cgi?id=1213705
* https://bugzilla.suse.com/show_bug.cgi?id=1213772
* https://bugzilla.suse.com/show_bug.cgi?id=1214842
* https://bugzilla.suse.com/show_bug.cgi?id=1215095
* https://bugzilla.suse.com/show_bug.cgi?id=1215104
* https://bugzilla.suse.com/show_bug.cgi?id=1215518
* https://bugzilla.suse.com/show_bug.cgi?id=1215955
* https://bugzilla.suse.com/show_bug.cgi?id=1215956
* https://bugzilla.suse.com/show_bug.cgi?id=1215957
* https://bugzilla.suse.com/show_bug.cgi?id=1215986
* https://bugzilla.suse.com/show_bug.cgi?id=1216062
* https://bugzilla.suse.com/show_bug.cgi?id=1216345
* https://bugzilla.suse.com/show_bug.cgi?id=1216510
* https://bugzilla.suse.com/show_bug.cgi?id=1216511
* https://bugzilla.suse.com/show_bug.cgi?id=1216512
* https://bugzilla.suse.com/show_bug.cgi?id=1216621
1
0
06 Nov '23
# Security update for squid
Announcement ID: SUSE-SU-2023:4380-1
Rating: important
References:
* bsc#1216495
* bsc#1216498
* bsc#1216500
* bsc#1216803
Cross-References:
* CVE-2023-46724
* CVE-2023-46846
* CVE-2023-46847
* CVE-2023-46848
CVSS scores:
* CVE-2023-46724 ( SUSE ): 8.6 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:N/A:H
* CVE-2023-46724 ( NVD ): 8.6 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:N/A:H
* CVE-2023-46846 ( SUSE ): 5.9 CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:N
* CVE-2023-46846 ( NVD ): 9.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:L/A:N
* CVE-2023-46847 ( SUSE ): 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
* CVE-2023-46847 ( NVD ): 9.9 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:H
* CVE-2023-46848 ( SUSE ): 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
* CVE-2023-46848 ( NVD ): 8.6 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:N/A:H
Affected Products:
* openSUSE Leap 15.4
* openSUSE Leap 15.5
* Server Applications Module 15-SP4
* Server Applications Module 15-SP5
* SUSE Linux Enterprise High Performance Computing 15 SP4
* SUSE Linux Enterprise High Performance Computing 15 SP5
* SUSE Linux Enterprise Real Time 15 SP4
* SUSE Linux Enterprise Real Time 15 SP5
* SUSE Linux Enterprise Server 15 SP4
* SUSE Linux Enterprise Server 15 SP5
* SUSE Linux Enterprise Server for SAP Applications 15 SP4
* SUSE Linux Enterprise Server for SAP Applications 15 SP5
* SUSE Manager Proxy 4.3
* SUSE Manager Retail Branch Server 4.3
* SUSE Manager Server 4.3
An update that solves four vulnerabilities can now be installed.
## Description:
This update for squid fixes the following issues:
* CVE-2023-46846: Request/Response smuggling in HTTP/1.1 and ICAP
(bsc#1216500).
* CVE-2023-46847: Denial of Service in HTTP Digest Authentication
(bsc#1216495).
* CVE-2023-46724: Fix validation of certificates with CN=* (bsc#1216803).
* CVE-2023-46848: Denial of Service in FTP (bsc#1216498).
## Patch Instructions:
To install this SUSE update use the SUSE recommended installation methods like
YaST online_update or "zypper patch".
Alternatively you can run the command listed for your product:
* openSUSE Leap 15.4
zypper in -t patch SUSE-2023-4380=1 openSUSE-SLE-15.4-2023-4380=1
* openSUSE Leap 15.5
zypper in -t patch openSUSE-SLE-15.5-2023-4380=1
* Server Applications Module 15-SP4
zypper in -t patch SUSE-SLE-Module-Server-Applications-15-SP4-2023-4380=1
* Server Applications Module 15-SP5
zypper in -t patch SUSE-SLE-Module-Server-Applications-15-SP5-2023-4380=1
## Package List:
* openSUSE Leap 15.4 (aarch64 ppc64le s390x x86_64 i586)
* squid-5.7-150400.3.12.1
* squid-debugsource-5.7-150400.3.12.1
* squid-debuginfo-5.7-150400.3.12.1
* openSUSE Leap 15.5 (aarch64 ppc64le s390x x86_64)
* squid-5.7-150400.3.12.1
* squid-debugsource-5.7-150400.3.12.1
* squid-debuginfo-5.7-150400.3.12.1
* Server Applications Module 15-SP4 (aarch64 ppc64le s390x x86_64)
* squid-5.7-150400.3.12.1
* squid-debugsource-5.7-150400.3.12.1
* squid-debuginfo-5.7-150400.3.12.1
* Server Applications Module 15-SP5 (aarch64 ppc64le s390x x86_64)
* squid-5.7-150400.3.12.1
* squid-debugsource-5.7-150400.3.12.1
* squid-debuginfo-5.7-150400.3.12.1
## References:
* https://www.suse.com/security/cve/CVE-2023-46724.html
* https://www.suse.com/security/cve/CVE-2023-46846.html
* https://www.suse.com/security/cve/CVE-2023-46847.html
* https://www.suse.com/security/cve/CVE-2023-46848.html
* https://bugzilla.suse.com/show_bug.cgi?id=1216495
* https://bugzilla.suse.com/show_bug.cgi?id=1216498
* https://bugzilla.suse.com/show_bug.cgi?id=1216500
* https://bugzilla.suse.com/show_bug.cgi?id=1216803
1
0
06 Nov '23
# Security update for tiff
Announcement ID: SUSE-SU-2023:4370-1
Rating: moderate
References:
* bsc#1212535
* bsc#1212881
* bsc#1212883
* bsc#1212888
* bsc#1213273
* bsc#1213274
* bsc#1213589
* bsc#1213590
* bsc#1214574
Cross-References:
* CVE-2020-18768
* CVE-2023-25433
* CVE-2023-26966
* CVE-2023-2908
* CVE-2023-3316
* CVE-2023-3576
* CVE-2023-3618
* CVE-2023-38288
* CVE-2023-38289
CVSS scores:
* CVE-2020-18768 ( SUSE ): 5.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L
* CVE-2020-18768 ( NVD ): 5.5 CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H
* CVE-2023-25433 ( NVD ): 5.5 CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H
* CVE-2023-26966 ( SUSE ): 4.4 CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:L
* CVE-2023-26966 ( NVD ): 5.5 CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H
* CVE-2023-2908 ( SUSE ): 5.5 CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H
* CVE-2023-2908 ( NVD ): 5.5 CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H
* CVE-2023-3316 ( SUSE ): 5.5 CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H
* CVE-2023-3316 ( NVD ): 5.9 CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H
* CVE-2023-3576 ( SUSE ): 3.3 CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:L
* CVE-2023-3576 ( NVD ): 5.5 CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H
* CVE-2023-3618 ( SUSE ): 5.5 CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H
* CVE-2023-3618 ( NVD ): 6.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H
* CVE-2023-38288 ( SUSE ): 3.3 CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:L
* CVE-2023-38289 ( SUSE ): 3.3 CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:L
Affected Products:
* Basesystem Module 15-SP4
* Basesystem Module 15-SP5
* openSUSE Leap 15.4
* openSUSE Leap 15.5
* openSUSE Leap Micro 5.3
* openSUSE Leap Micro 5.4
* SUSE Linux Enterprise Desktop 15 SP4
* SUSE Linux Enterprise Desktop 15 SP5
* SUSE Linux Enterprise High Performance Computing 15 SP4
* SUSE Linux Enterprise High Performance Computing 15 SP5
* SUSE Linux Enterprise Micro 5.2
* SUSE Linux Enterprise Micro 5.3
* SUSE Linux Enterprise Micro 5.4
* SUSE Linux Enterprise Micro 5.5
* SUSE Linux Enterprise Micro for Rancher 5.2
* SUSE Linux Enterprise Micro for Rancher 5.3
* SUSE Linux Enterprise Micro for Rancher 5.4
* SUSE Linux Enterprise Real Time 15 SP4
* SUSE Linux Enterprise Real Time 15 SP5
* SUSE Linux Enterprise Server 15 SP4
* SUSE Linux Enterprise Server 15 SP5
* SUSE Linux Enterprise Server for SAP Applications 15 SP4
* SUSE Linux Enterprise Server for SAP Applications 15 SP5
* SUSE Manager Proxy 4.3
* SUSE Manager Retail Branch Server 4.3
* SUSE Manager Server 4.3
* SUSE Package Hub 15 15-SP4
* SUSE Package Hub 15 15-SP5
An update that solves nine vulnerabilities can now be installed.
## Description:
This update for tiff fixes the following issues:
* CVE-2023-38289: Fixed a NULL pointer dereference in raw2tiff (bsc#1213589).
* CVE-2023-38288: Fixed an integer overflow in raw2tiff (bsc#1213590).
* CVE-2023-3576: Fixed a memory leak in tiffcrop (bsc#1213273).
* CVE-2020-18768: Fixed an out of bounds read in tiffcp (bsc#1214574).
* CVE-2023-26966: Fixed an out of bounds read when transforming a little-
endian file to a big-endian output (bsc#1212881)
* CVE-2023-3618: Fixed a NULL pointer dereference while encoding FAX3 files
(bsc#1213274).
* CVE-2023-2908: Fixed an undefined behavior issue when doing pointer
arithmetic on a NULL pointer (bsc#1212888).
* CVE-2023-3316: Fixed a NULL pointer dereference while opening a file in an
inaccessible path (bsc#1212535).
* CVE-2023-25433: Fixed a buffer overflow in tiffcrop (bsc#1212883).
## Patch Instructions:
To install this SUSE update use the SUSE recommended installation methods like
YaST online_update or "zypper patch".
Alternatively you can run the command listed for your product:
* SUSE Linux Enterprise Micro 5.2
zypper in -t patch SUSE-SUSE-MicroOS-5.2-2023-4370=1
* SUSE Linux Enterprise Micro for Rancher 5.2
zypper in -t patch SUSE-SUSE-MicroOS-5.2-2023-4370=1
* openSUSE Leap Micro 5.3
zypper in -t patch openSUSE-Leap-Micro-5.3-2023-4370=1
* openSUSE Leap Micro 5.4
zypper in -t patch openSUSE-Leap-Micro-5.4-2023-4370=1
* openSUSE Leap 15.4
zypper in -t patch openSUSE-SLE-15.4-2023-4370=1
* openSUSE Leap 15.5
zypper in -t patch openSUSE-SLE-15.5-2023-4370=1
* SUSE Linux Enterprise Micro for Rancher 5.3
zypper in -t patch SUSE-SLE-Micro-5.3-2023-4370=1
* SUSE Linux Enterprise Micro 5.3
zypper in -t patch SUSE-SLE-Micro-5.3-2023-4370=1
* SUSE Linux Enterprise Micro for Rancher 5.4
zypper in -t patch SUSE-SLE-Micro-5.4-2023-4370=1
* SUSE Linux Enterprise Micro 5.4
zypper in -t patch SUSE-SLE-Micro-5.4-2023-4370=1
* SUSE Linux Enterprise Micro 5.5
zypper in -t patch SUSE-SLE-Micro-5.5-2023-4370=1
* Basesystem Module 15-SP4
zypper in -t patch SUSE-SLE-Module-Basesystem-15-SP4-2023-4370=1
* Basesystem Module 15-SP5
zypper in -t patch SUSE-SLE-Module-Basesystem-15-SP5-2023-4370=1
* SUSE Package Hub 15 15-SP4
zypper in -t patch SUSE-SLE-Module-Packagehub-Subpackages-15-SP4-2023-4370=1
* SUSE Package Hub 15 15-SP5
zypper in -t patch SUSE-SLE-Module-Packagehub-Subpackages-15-SP5-2023-4370=1
## Package List:
* SUSE Linux Enterprise Micro 5.2 (aarch64 s390x x86_64)
* libtiff5-debuginfo-4.0.9-150000.45.32.1
* tiff-debuginfo-4.0.9-150000.45.32.1
* libtiff5-4.0.9-150000.45.32.1
* tiff-debugsource-4.0.9-150000.45.32.1
* SUSE Linux Enterprise Micro for Rancher 5.2 (aarch64 s390x x86_64)
* libtiff5-debuginfo-4.0.9-150000.45.32.1
* tiff-debuginfo-4.0.9-150000.45.32.1
* libtiff5-4.0.9-150000.45.32.1
* tiff-debugsource-4.0.9-150000.45.32.1
* openSUSE Leap Micro 5.3 (aarch64 x86_64)
* libtiff5-debuginfo-4.0.9-150000.45.32.1
* tiff-debuginfo-4.0.9-150000.45.32.1
* libtiff5-4.0.9-150000.45.32.1
* tiff-debugsource-4.0.9-150000.45.32.1
* openSUSE Leap Micro 5.4 (aarch64 s390x x86_64)
* libtiff5-debuginfo-4.0.9-150000.45.32.1
* tiff-debuginfo-4.0.9-150000.45.32.1
* libtiff5-4.0.9-150000.45.32.1
* tiff-debugsource-4.0.9-150000.45.32.1
* openSUSE Leap 15.4 (x86_64)
* libtiff5-32bit-debuginfo-4.0.9-150000.45.32.1
* libtiff5-32bit-4.0.9-150000.45.32.1
* libtiff-devel-32bit-4.0.9-150000.45.32.1
* openSUSE Leap 15.4 (aarch64 ppc64le s390x x86_64)
* tiff-debugsource-4.0.9-150000.45.32.1
* libtiff5-debuginfo-4.0.9-150000.45.32.1
* libtiff-devel-4.0.9-150000.45.32.1
* tiff-4.0.9-150000.45.32.1
* tiff-debuginfo-4.0.9-150000.45.32.1
* libtiff5-4.0.9-150000.45.32.1
* openSUSE Leap 15.5 (x86_64)
* libtiff5-32bit-debuginfo-4.0.9-150000.45.32.1
* libtiff5-32bit-4.0.9-150000.45.32.1
* libtiff-devel-32bit-4.0.9-150000.45.32.1
* openSUSE Leap 15.5 (aarch64 ppc64le s390x x86_64)
* tiff-debugsource-4.0.9-150000.45.32.1
* libtiff5-debuginfo-4.0.9-150000.45.32.1
* libtiff-devel-4.0.9-150000.45.32.1
* tiff-4.0.9-150000.45.32.1
* tiff-debuginfo-4.0.9-150000.45.32.1
* libtiff5-4.0.9-150000.45.32.1
* SUSE Linux Enterprise Micro for Rancher 5.3 (aarch64 s390x x86_64)
* libtiff5-debuginfo-4.0.9-150000.45.32.1
* tiff-debuginfo-4.0.9-150000.45.32.1
* libtiff5-4.0.9-150000.45.32.1
* tiff-debugsource-4.0.9-150000.45.32.1
* SUSE Linux Enterprise Micro 5.3 (aarch64 s390x x86_64)
* libtiff5-debuginfo-4.0.9-150000.45.32.1
* tiff-debuginfo-4.0.9-150000.45.32.1
* libtiff5-4.0.9-150000.45.32.1
* tiff-debugsource-4.0.9-150000.45.32.1
* SUSE Linux Enterprise Micro for Rancher 5.4 (aarch64 s390x x86_64)
* libtiff5-debuginfo-4.0.9-150000.45.32.1
* tiff-debuginfo-4.0.9-150000.45.32.1
* libtiff5-4.0.9-150000.45.32.1
* tiff-debugsource-4.0.9-150000.45.32.1
* SUSE Linux Enterprise Micro 5.4 (aarch64 s390x x86_64)
* libtiff5-debuginfo-4.0.9-150000.45.32.1
* tiff-debuginfo-4.0.9-150000.45.32.1
* libtiff5-4.0.9-150000.45.32.1
* tiff-debugsource-4.0.9-150000.45.32.1
* SUSE Linux Enterprise Micro 5.5 (aarch64 s390x x86_64)
* libtiff5-debuginfo-4.0.9-150000.45.32.1
* tiff-debuginfo-4.0.9-150000.45.32.1
* libtiff5-4.0.9-150000.45.32.1
* tiff-debugsource-4.0.9-150000.45.32.1
* Basesystem Module 15-SP4 (aarch64 ppc64le s390x x86_64)
* tiff-debugsource-4.0.9-150000.45.32.1
* libtiff5-debuginfo-4.0.9-150000.45.32.1
* libtiff-devel-4.0.9-150000.45.32.1
* tiff-debuginfo-4.0.9-150000.45.32.1
* libtiff5-4.0.9-150000.45.32.1
* Basesystem Module 15-SP4 (x86_64)
* libtiff5-32bit-debuginfo-4.0.9-150000.45.32.1
* libtiff5-32bit-4.0.9-150000.45.32.1
* Basesystem Module 15-SP5 (aarch64 ppc64le s390x x86_64)
* tiff-debugsource-4.0.9-150000.45.32.1
* libtiff5-debuginfo-4.0.9-150000.45.32.1
* libtiff-devel-4.0.9-150000.45.32.1
* tiff-debuginfo-4.0.9-150000.45.32.1
* libtiff5-4.0.9-150000.45.32.1
* Basesystem Module 15-SP5 (x86_64)
* libtiff5-32bit-debuginfo-4.0.9-150000.45.32.1
* libtiff5-32bit-4.0.9-150000.45.32.1
* SUSE Package Hub 15 15-SP4 (aarch64 ppc64le s390x x86_64)
* tiff-debuginfo-4.0.9-150000.45.32.1
* tiff-debugsource-4.0.9-150000.45.32.1
* tiff-4.0.9-150000.45.32.1
* SUSE Package Hub 15 15-SP5 (aarch64 ppc64le s390x x86_64)
* tiff-debuginfo-4.0.9-150000.45.32.1
* tiff-debugsource-4.0.9-150000.45.32.1
* tiff-4.0.9-150000.45.32.1
## References:
* https://www.suse.com/security/cve/CVE-2020-18768.html
* https://www.suse.com/security/cve/CVE-2023-25433.html
* https://www.suse.com/security/cve/CVE-2023-26966.html
* https://www.suse.com/security/cve/CVE-2023-2908.html
* https://www.suse.com/security/cve/CVE-2023-3316.html
* https://www.suse.com/security/cve/CVE-2023-3576.html
* https://www.suse.com/security/cve/CVE-2023-3618.html
* https://www.suse.com/security/cve/CVE-2023-38288.html
* https://www.suse.com/security/cve/CVE-2023-38289.html
* https://bugzilla.suse.com/show_bug.cgi?id=1212535
* https://bugzilla.suse.com/show_bug.cgi?id=1212881
* https://bugzilla.suse.com/show_bug.cgi?id=1212883
* https://bugzilla.suse.com/show_bug.cgi?id=1212888
* https://bugzilla.suse.com/show_bug.cgi?id=1213273
* https://bugzilla.suse.com/show_bug.cgi?id=1213274
* https://bugzilla.suse.com/show_bug.cgi?id=1213589
* https://bugzilla.suse.com/show_bug.cgi?id=1213590
* https://bugzilla.suse.com/show_bug.cgi?id=1214574
1
0
SUSE-SU-2023:4372-1: important: Security update for util-linux
by security＠lists.opensuse.org 06 Nov '23
by security＠lists.opensuse.org 06 Nov '23
06 Nov '23
# Security update for util-linux
Announcement ID: SUSE-SU-2023:4372-1
Rating: important
References:
* bsc#1213865
Cross-References:
* CVE-2018-7738
CVSS scores:
* CVE-2018-7738 ( SUSE ): 8.2 CVSS:3.0/AV:L/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:H
* CVE-2018-7738 ( NVD ): 7.8 CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Affected Products:
* openSUSE Leap 15.4
* openSUSE Leap 15.5
An update that solves one vulnerability can now be installed.
## Description:
This update for util-linux fixes the following issues:
* CVE-2018-7738: Fixed shell code injection in umount bash-completions
(bsc#1213865).
## Patch Instructions:
To install this SUSE update use the SUSE recommended installation methods like
YaST online_update or "zypper patch".
Alternatively you can run the command listed for your product:
* openSUSE Leap 15.4
zypper in -t patch openSUSE-SLE-15.4-2023-4372=1
* openSUSE Leap 15.5
zypper in -t patch openSUSE-SLE-15.5-2023-4372=1
## Package List:
* openSUSE Leap 15.4 (aarch64 ppc64le s390x x86_64)
* python-libmount-debugsource-2.31.1-150000.9.24.1
* python-libmount-debuginfo-2.31.1-150000.9.24.1
* openSUSE Leap 15.5 (aarch64 ppc64le s390x x86_64)
* python-libmount-debugsource-2.31.1-150000.9.24.1
* python-libmount-debuginfo-2.31.1-150000.9.24.1
## References:
* https://www.suse.com/security/cve/CVE-2018-7738.html
* https://bugzilla.suse.com/show_bug.cgi?id=1213865
1
0
SUSE-SU-2023:4373-1: important: Security update for nodejs12
by security＠lists.opensuse.org 06 Nov '23
by security＠lists.opensuse.org 06 Nov '23
06 Nov '23
# Security update for nodejs12
Announcement ID: SUSE-SU-2023:4373-1
Rating: important
References:
* bsc#1216190
* bsc#1216272
Cross-References:
* CVE-2023-38552
* CVE-2023-44487
CVSS scores:
* CVE-2023-38552 ( SUSE ): 6.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N
* CVE-2023-38552 ( NVD ): 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N
* CVE-2023-44487 ( SUSE ): 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
* CVE-2023-44487 ( NVD ): 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Affected Products:
* openSUSE Leap 15.4
* SUSE Enterprise Storage 7.1
* SUSE Linux Enterprise High Performance Computing 15 SP2
* SUSE Linux Enterprise High Performance Computing 15 SP2 LTSS 15-SP2
* SUSE Linux Enterprise High Performance Computing 15 SP3
* SUSE Linux Enterprise High Performance Computing ESPOS 15 SP3
* SUSE Linux Enterprise High Performance Computing LTSS 15 SP3
* SUSE Linux Enterprise Server 15 SP2
* SUSE Linux Enterprise Server 15 SP2 LTSS 15-SP2
* SUSE Linux Enterprise Server 15 SP3
* SUSE Linux Enterprise Server 15 SP3 LTSS 15-SP3
* SUSE Linux Enterprise Server for SAP Applications 15 SP2
* SUSE Linux Enterprise Server for SAP Applications 15 SP3
* SUSE Manager Server 4.2
An update that solves two vulnerabilities can now be installed.
## Description:
This update for nodejs12 fixes the following issues:
* CVE-2023-44487: Fixed the Rapid Reset attack in nghttp2. (bsc#1216190)
* CVE-2023-38552: Fixed an integrity checks according to policies that could
be circumvented. (bsc#1216272)
## Patch Instructions:
To install this SUSE update use the SUSE recommended installation methods like
YaST online_update or "zypper patch".
Alternatively you can run the command listed for your product:
* openSUSE Leap 15.4
zypper in -t patch openSUSE-SLE-15.4-2023-4373=1
* SUSE Linux Enterprise High Performance Computing 15 SP2 LTSS 15-SP2
zypper in -t patch SUSE-SLE-Product-HPC-15-SP2-LTSS-2023-4373=1
* SUSE Linux Enterprise High Performance Computing ESPOS 15 SP3
zypper in -t patch SUSE-SLE-Product-HPC-15-SP3-ESPOS-2023-4373=1
* SUSE Linux Enterprise High Performance Computing LTSS 15 SP3
zypper in -t patch SUSE-SLE-Product-HPC-15-SP3-LTSS-2023-4373=1
* SUSE Linux Enterprise Server 15 SP2 LTSS 15-SP2
zypper in -t patch SUSE-SLE-Product-SLES-15-SP2-LTSS-2023-4373=1
* SUSE Linux Enterprise Server 15 SP3 LTSS 15-SP3
zypper in -t patch SUSE-SLE-Product-SLES-15-SP3-LTSS-2023-4373=1
* SUSE Linux Enterprise Server for SAP Applications 15 SP2
zypper in -t patch SUSE-SLE-Product-SLES_SAP-15-SP2-2023-4373=1
* SUSE Linux Enterprise Server for SAP Applications 15 SP3
zypper in -t patch SUSE-SLE-Product-SLES_SAP-15-SP3-2023-4373=1
* SUSE Manager Server 4.2
zypper in -t patch SUSE-SLE-Product-SUSE-Manager-Server-4.2-2023-4373=1
* SUSE Enterprise Storage 7.1
zypper in -t patch SUSE-Storage-7.1-2023-4373=1
## Package List:
* openSUSE Leap 15.4 (aarch64 ppc64le s390x x86_64)
* nodejs14-14.21.3-150200.15.52.2
* nodejs14-devel-14.21.3-150200.15.52.2
* corepack14-14.21.3-150200.15.52.2
* nodejs14-debugsource-14.21.3-150200.15.52.2
* npm14-14.21.3-150200.15.52.2
* nodejs14-debuginfo-14.21.3-150200.15.52.2
* openSUSE Leap 15.4 (noarch)
* nodejs14-docs-14.21.3-150200.15.52.2
* SUSE Linux Enterprise High Performance Computing 15 SP2 LTSS 15-SP2 (aarch64
x86_64)
* nodejs14-14.21.3-150200.15.52.2
* nodejs14-devel-14.21.3-150200.15.52.2
* nodejs14-debugsource-14.21.3-150200.15.52.2
* npm14-14.21.3-150200.15.52.2
* nodejs14-debuginfo-14.21.3-150200.15.52.2
* SUSE Linux Enterprise High Performance Computing 15 SP2 LTSS 15-SP2 (noarch)
* nodejs14-docs-14.21.3-150200.15.52.2
* SUSE Linux Enterprise High Performance Computing ESPOS 15 SP3 (aarch64
x86_64)
* nodejs14-14.21.3-150200.15.52.2
* nodejs14-devel-14.21.3-150200.15.52.2
* nodejs14-debugsource-14.21.3-150200.15.52.2
* npm14-14.21.3-150200.15.52.2
* nodejs14-debuginfo-14.21.3-150200.15.52.2
* SUSE Linux Enterprise High Performance Computing ESPOS 15 SP3 (noarch)
* nodejs14-docs-14.21.3-150200.15.52.2
* SUSE Linux Enterprise High Performance Computing LTSS 15 SP3 (aarch64
x86_64)
* nodejs14-14.21.3-150200.15.52.2
* nodejs14-devel-14.21.3-150200.15.52.2
* nodejs14-debugsource-14.21.3-150200.15.52.2
* npm14-14.21.3-150200.15.52.2
* nodejs14-debuginfo-14.21.3-150200.15.52.2
* SUSE Linux Enterprise High Performance Computing LTSS 15 SP3 (noarch)
* nodejs14-docs-14.21.3-150200.15.52.2
* SUSE Linux Enterprise Server 15 SP2 LTSS 15-SP2 (aarch64 ppc64le s390x
x86_64)
* nodejs14-14.21.3-150200.15.52.2
* nodejs14-devel-14.21.3-150200.15.52.2
* nodejs14-debugsource-14.21.3-150200.15.52.2
* npm14-14.21.3-150200.15.52.2
* nodejs14-debuginfo-14.21.3-150200.15.52.2
* SUSE Linux Enterprise Server 15 SP2 LTSS 15-SP2 (noarch)
* nodejs14-docs-14.21.3-150200.15.52.2
* SUSE Linux Enterprise Server 15 SP3 LTSS 15-SP3 (aarch64 ppc64le s390x
x86_64)
* nodejs14-14.21.3-150200.15.52.2
* nodejs14-devel-14.21.3-150200.15.52.2
* nodejs14-debugsource-14.21.3-150200.15.52.2
* npm14-14.21.3-150200.15.52.2
* nodejs14-debuginfo-14.21.3-150200.15.52.2
* SUSE Linux Enterprise Server 15 SP3 LTSS 15-SP3 (noarch)
* nodejs14-docs-14.21.3-150200.15.52.2
* SUSE Linux Enterprise Server for SAP Applications 15 SP2 (ppc64le x86_64)
* nodejs14-14.21.3-150200.15.52.2
* nodejs14-devel-14.21.3-150200.15.52.2
* nodejs14-debugsource-14.21.3-150200.15.52.2
* npm14-14.21.3-150200.15.52.2
* nodejs14-debuginfo-14.21.3-150200.15.52.2
* SUSE Linux Enterprise Server for SAP Applications 15 SP2 (noarch)
* nodejs14-docs-14.21.3-150200.15.52.2
* SUSE Linux Enterprise Server for SAP Applications 15 SP3 (ppc64le x86_64)
* nodejs14-14.21.3-150200.15.52.2
* nodejs14-devel-14.21.3-150200.15.52.2
* nodejs14-debugsource-14.21.3-150200.15.52.2
* npm14-14.21.3-150200.15.52.2
* nodejs14-debuginfo-14.21.3-150200.15.52.2
* SUSE Linux Enterprise Server for SAP Applications 15 SP3 (noarch)
* nodejs14-docs-14.21.3-150200.15.52.2
* SUSE Manager Server 4.2 (ppc64le s390x x86_64)
* nodejs14-14.21.3-150200.15.52.2
* nodejs14-devel-14.21.3-150200.15.52.2
* nodejs14-debugsource-14.21.3-150200.15.52.2
* npm14-14.21.3-150200.15.52.2
* nodejs14-debuginfo-14.21.3-150200.15.52.2
* SUSE Manager Server 4.2 (noarch)
* nodejs14-docs-14.21.3-150200.15.52.2
* SUSE Enterprise Storage 7.1 (aarch64 x86_64)
* nodejs14-14.21.3-150200.15.52.2
* nodejs14-devel-14.21.3-150200.15.52.2
* nodejs14-debugsource-14.21.3-150200.15.52.2
* npm14-14.21.3-150200.15.52.2
* nodejs14-debuginfo-14.21.3-150200.15.52.2
* SUSE Enterprise Storage 7.1 (noarch)
* nodejs14-docs-14.21.3-150200.15.52.2
## References:
* https://www.suse.com/security/cve/CVE-2023-38552.html
* https://www.suse.com/security/cve/CVE-2023-44487.html
* https://bugzilla.suse.com/show_bug.cgi?id=1216190
* https://bugzilla.suse.com/show_bug.cgi?id=1216272
1
0
SUSE-SU-2023:4374-1: important: Security update for nodejs12
by security＠lists.opensuse.org 06 Nov '23
by security＠lists.opensuse.org 06 Nov '23
06 Nov '23
# Security update for nodejs12
Announcement ID: SUSE-SU-2023:4374-1
Rating: important
References:
* bsc#1216190
* bsc#1216272
Cross-References:
* CVE-2023-38552
* CVE-2023-44487
CVSS scores:
* CVE-2023-38552 ( SUSE ): 6.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N
* CVE-2023-38552 ( NVD ): 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N
* CVE-2023-44487 ( SUSE ): 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
* CVE-2023-44487 ( NVD ): 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Affected Products:
* openSUSE Leap 15.4
* SUSE Enterprise Storage 7.1
* SUSE Linux Enterprise High Performance Computing 15 SP2
* SUSE Linux Enterprise High Performance Computing 15 SP2 LTSS 15-SP2
* SUSE Linux Enterprise High Performance Computing 15 SP3
* SUSE Linux Enterprise High Performance Computing ESPOS 15 SP3
* SUSE Linux Enterprise High Performance Computing LTSS 15 SP3
* SUSE Linux Enterprise Server 15 SP2
* SUSE Linux Enterprise Server 15 SP2 LTSS 15-SP2
* SUSE Linux Enterprise Server 15 SP3
* SUSE Linux Enterprise Server 15 SP3 LTSS 15-SP3
* SUSE Linux Enterprise Server for SAP Applications 15 SP2
* SUSE Linux Enterprise Server for SAP Applications 15 SP3
* SUSE Manager Server 4.2
An update that solves two vulnerabilities can now be installed.
## Description:
This update for nodejs12 fixes the following issues:
* CVE-2023-44487: Fixed the Rapid Reset attack in nghttp2. (bsc#1216190)
* CVE-2023-38552: Fixed an integrity checks according to policies that could
be circumvented. (bsc#1216272)
## Patch Instructions:
To install this SUSE update use the SUSE recommended installation methods like
YaST online_update or "zypper patch".
Alternatively you can run the command listed for your product:
* openSUSE Leap 15.4
zypper in -t patch openSUSE-SLE-15.4-2023-4374=1
* SUSE Linux Enterprise High Performance Computing 15 SP2 LTSS 15-SP2
zypper in -t patch SUSE-SLE-Product-HPC-15-SP2-LTSS-2023-4374=1
* SUSE Linux Enterprise High Performance Computing ESPOS 15 SP3
zypper in -t patch SUSE-SLE-Product-HPC-15-SP3-ESPOS-2023-4374=1
* SUSE Linux Enterprise High Performance Computing LTSS 15 SP3
zypper in -t patch SUSE-SLE-Product-HPC-15-SP3-LTSS-2023-4374=1
* SUSE Linux Enterprise Server 15 SP2 LTSS 15-SP2
zypper in -t patch SUSE-SLE-Product-SLES-15-SP2-LTSS-2023-4374=1
* SUSE Linux Enterprise Server 15 SP3 LTSS 15-SP3
zypper in -t patch SUSE-SLE-Product-SLES-15-SP3-LTSS-2023-4374=1
* SUSE Linux Enterprise Server for SAP Applications 15 SP2
zypper in -t patch SUSE-SLE-Product-SLES_SAP-15-SP2-2023-4374=1
* SUSE Linux Enterprise Server for SAP Applications 15 SP3
zypper in -t patch SUSE-SLE-Product-SLES_SAP-15-SP3-2023-4374=1
* SUSE Manager Server 4.2
zypper in -t patch SUSE-SLE-Product-SUSE-Manager-Server-4.2-2023-4374=1
* SUSE Enterprise Storage 7.1
zypper in -t patch SUSE-Storage-7.1-2023-4374=1
## Package List:
* openSUSE Leap 15.4 (aarch64 ppc64le s390x x86_64)
* nodejs12-12.22.12-150200.4.53.2
* npm12-12.22.12-150200.4.53.2
* nodejs12-devel-12.22.12-150200.4.53.2
* nodejs12-debuginfo-12.22.12-150200.4.53.2
* nodejs12-debugsource-12.22.12-150200.4.53.2
* openSUSE Leap 15.4 (noarch)
* nodejs12-docs-12.22.12-150200.4.53.2
* SUSE Linux Enterprise High Performance Computing 15 SP2 LTSS 15-SP2 (aarch64
x86_64)
* nodejs12-12.22.12-150200.4.53.2
* npm12-12.22.12-150200.4.53.2
* nodejs12-devel-12.22.12-150200.4.53.2
* nodejs12-debuginfo-12.22.12-150200.4.53.2
* nodejs12-debugsource-12.22.12-150200.4.53.2
* SUSE Linux Enterprise High Performance Computing 15 SP2 LTSS 15-SP2 (noarch)
* nodejs12-docs-12.22.12-150200.4.53.2
* SUSE Linux Enterprise High Performance Computing ESPOS 15 SP3 (aarch64
x86_64)
* nodejs12-12.22.12-150200.4.53.2
* npm12-12.22.12-150200.4.53.2
* nodejs12-devel-12.22.12-150200.4.53.2
* nodejs12-debuginfo-12.22.12-150200.4.53.2
* nodejs12-debugsource-12.22.12-150200.4.53.2
* SUSE Linux Enterprise High Performance Computing ESPOS 15 SP3 (noarch)
* nodejs12-docs-12.22.12-150200.4.53.2
* SUSE Linux Enterprise High Performance Computing LTSS 15 SP3 (aarch64
x86_64)
* nodejs12-12.22.12-150200.4.53.2
* npm12-12.22.12-150200.4.53.2
* nodejs12-devel-12.22.12-150200.4.53.2
* nodejs12-debuginfo-12.22.12-150200.4.53.2
* nodejs12-debugsource-12.22.12-150200.4.53.2
* SUSE Linux Enterprise High Performance Computing LTSS 15 SP3 (noarch)
* nodejs12-docs-12.22.12-150200.4.53.2
* SUSE Linux Enterprise Server 15 SP2 LTSS 15-SP2 (aarch64 ppc64le s390x
x86_64)
* nodejs12-12.22.12-150200.4.53.2
* npm12-12.22.12-150200.4.53.2
* nodejs12-devel-12.22.12-150200.4.53.2
* nodejs12-debuginfo-12.22.12-150200.4.53.2
* nodejs12-debugsource-12.22.12-150200.4.53.2
* SUSE Linux Enterprise Server 15 SP2 LTSS 15-SP2 (noarch)
* nodejs12-docs-12.22.12-150200.4.53.2
* SUSE Linux Enterprise Server 15 SP3 LTSS 15-SP3 (aarch64 ppc64le s390x
x86_64)
* nodejs12-12.22.12-150200.4.53.2
* npm12-12.22.12-150200.4.53.2
* nodejs12-devel-12.22.12-150200.4.53.2
* nodejs12-debuginfo-12.22.12-150200.4.53.2
* nodejs12-debugsource-12.22.12-150200.4.53.2
* SUSE Linux Enterprise Server 15 SP3 LTSS 15-SP3 (noarch)
* nodejs12-docs-12.22.12-150200.4.53.2
* SUSE Linux Enterprise Server for SAP Applications 15 SP2 (ppc64le x86_64)
* nodejs12-12.22.12-150200.4.53.2
* npm12-12.22.12-150200.4.53.2
* nodejs12-devel-12.22.12-150200.4.53.2
* nodejs12-debuginfo-12.22.12-150200.4.53.2
* nodejs12-debugsource-12.22.12-150200.4.53.2
* SUSE Linux Enterprise Server for SAP Applications 15 SP2 (noarch)
* nodejs12-docs-12.22.12-150200.4.53.2
* SUSE Linux Enterprise Server for SAP Applications 15 SP3 (ppc64le x86_64)
* nodejs12-12.22.12-150200.4.53.2
* npm12-12.22.12-150200.4.53.2
* nodejs12-devel-12.22.12-150200.4.53.2
* nodejs12-debuginfo-12.22.12-150200.4.53.2
* nodejs12-debugsource-12.22.12-150200.4.53.2
* SUSE Linux Enterprise Server for SAP Applications 15 SP3 (noarch)
* nodejs12-docs-12.22.12-150200.4.53.2
* SUSE Manager Server 4.2 (ppc64le s390x x86_64)
* nodejs12-12.22.12-150200.4.53.2
* npm12-12.22.12-150200.4.53.2
* nodejs12-devel-12.22.12-150200.4.53.2
* nodejs12-debuginfo-12.22.12-150200.4.53.2
* nodejs12-debugsource-12.22.12-150200.4.53.2
* SUSE Manager Server 4.2 (noarch)
* nodejs12-docs-12.22.12-150200.4.53.2
* SUSE Enterprise Storage 7.1 (aarch64 x86_64)
* nodejs12-12.22.12-150200.4.53.2
* npm12-12.22.12-150200.4.53.2
* nodejs12-devel-12.22.12-150200.4.53.2
* nodejs12-debuginfo-12.22.12-150200.4.53.2
* nodejs12-debugsource-12.22.12-150200.4.53.2
* SUSE Enterprise Storage 7.1 (noarch)
* nodejs12-docs-12.22.12-150200.4.53.2
## References:
* https://www.suse.com/security/cve/CVE-2023-38552.html
* https://www.suse.com/security/cve/CVE-2023-44487.html
* https://bugzilla.suse.com/show_bug.cgi?id=1216190
* https://bugzilla.suse.com/show_bug.cgi?id=1216272
1
0
SUSE-SU-2023:4072-2: important: Security update for the Linux Kernel
by security＠lists.opensuse.org 06 Nov '23
by security＠lists.opensuse.org 06 Nov '23
06 Nov '23
# Security update for the Linux Kernel
Announcement ID: SUSE-SU-2023:4072-2
Rating: important
References:
* bsc#1202845
* bsc#1213808
* bsc#1214928
* bsc#1214940
* bsc#1214941
* bsc#1214942
* bsc#1214943
* bsc#1214944
* bsc#1214950
* bsc#1214951
* bsc#1214954
* bsc#1214957
* bsc#1214986
* bsc#1214988
* bsc#1214992
* bsc#1214993
* bsc#1215322
* bsc#1215877
* bsc#1215894
* bsc#1215895
* bsc#1215896
* bsc#1215911
* bsc#1215915
* bsc#1215916
Cross-References:
* CVE-2023-1192
* CVE-2023-1206
* CVE-2023-1859
* CVE-2023-2177
* CVE-2023-39192
* CVE-2023-39193
* CVE-2023-39194
* CVE-2023-4155
* CVE-2023-42753
* CVE-2023-42754
* CVE-2023-4389
* CVE-2023-4563
* CVE-2023-4622
* CVE-2023-4623
* CVE-2023-4881
* CVE-2023-4921
* CVE-2023-5345
CVSS scores:
* CVE-2023-1192 ( SUSE ): 6.5 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
* CVE-2023-1192 ( NVD ): 6.5 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
* CVE-2023-1206 ( SUSE ): 5.9 CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H
* CVE-2023-1206 ( NVD ): 5.7 CVSS:3.1/AV:A/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
* CVE-2023-1859 ( SUSE ): 1.9 CVSS:3.1/AV:L/AC:H/PR:H/UI:N/S:U/C:N/I:N/A:L
* CVE-2023-1859 ( NVD ): 4.7 CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:N/I:N/A:H
* CVE-2023-2177 ( SUSE ): 5.5 CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
* CVE-2023-2177 ( NVD ): 5.5 CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
* CVE-2023-39192 ( SUSE ): 6.0 CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:H
* CVE-2023-39192 ( NVD ): 6.7 CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:C/C:H/I:N/A:L
* CVE-2023-39193 ( SUSE ): 5.1 CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:L
* CVE-2023-39193 ( NVD ): 6.1 CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:L
* CVE-2023-39194 ( SUSE ): 3.2 CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:C/C:L/I:N/A:N
* CVE-2023-39194 ( NVD ): 3.2 CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:C/C:L/I:N/A:N
* CVE-2023-4155 ( SUSE ): 6.5 CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:N/I:N/A:H
* CVE-2023-4155 ( NVD ): 5.3 CVSS:3.1/AV:L/AC:H/PR:H/UI:N/S:C/C:N/I:N/A:H
* CVE-2023-42753 ( SUSE ): 7.0 CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H
* CVE-2023-42753 ( NVD ): 7.0 CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H
* CVE-2023-42754 ( SUSE ): 5.5 CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
* CVE-2023-42754 ( NVD ): 5.5 CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
* CVE-2023-4389 ( SUSE ): 5.8 CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:L/I:L/A:H
* CVE-2023-4389 ( NVD ): 7.0 CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H
* CVE-2023-4563 ( SUSE ): 0.0 CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:N/I:N/A:N
* CVE-2023-4622 ( SUSE ): 7.8 CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
* CVE-2023-4622 ( NVD ): 7.8 CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
* CVE-2023-4623 ( SUSE ): 7.8 CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
* CVE-2023-4623 ( NVD ): 7.8 CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
* CVE-2023-4881 ( SUSE ): 6.1 CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:L
* CVE-2023-4881 ( NVD ): 6.1 CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:H
* CVE-2023-4921 ( SUSE ): 7.8 CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
* CVE-2023-4921 ( NVD ): 7.8 CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
* CVE-2023-5345 ( SUSE ): 7.0 CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H
* CVE-2023-5345 ( NVD ): 7.8 CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Affected Products:
* openSUSE Leap 15.4
An update that solves 17 vulnerabilities and has seven security fixes can now be
installed.
## Description:
The SUSE Linux Enterprise 15 SP4 kernel was updated to receive various security
and bugfixes.
The following security bugs were fixed:
* CVE-2023-4563: Fixed an use-after-free flaw in the nftables sub-component.
This vulnerability could allow a local attacker to crash the system or lead
to a kernel information leak problem. (bsc#1214727)
* CVE-2023-39194: Fixed a flaw in the processing of state filters which could
allow a local attackers to disclose sensitive information. (bsc#1215861)
* CVE-2023-39193: Fixed a flaw in the processing of state filters which could
allow a local attackers to disclose sensitive information. (bsc#1215860)
* CVE-2023-39192: Fixed a flaw in the u32_match_it function which could allow
a local attackers to disclose sensitive information. (bsc#1215858)
* CVE-2023-42754: Fixed a null pointer dereference in ipv4_link_failure which
could lead an authenticated attacker to trigger a DoS. (bsc#1215467)
* CVE-2023-5345: fixed an use-after-free vulnerability in the fs/smb/client
component which could be exploited to achieve local privilege escalation.
(bsc#1215899)
* CVE-2023-4155: Fixed a flaw in KVM AMD Secure Encrypted Virtualization
(SEV). An attacker can trigger a stack overflow and cause a denial of
service or potentially guest-to-host escape in kernel configurations without
stack guard pages. (bsc#1214022)
* CVE-2023-4389: Fixed a reference counting issue in the Btrfs filesystem that
could be exploited in order to leak internal kernel information or crash the
system (bsc#1214351).
* CVE-2023-42753: Fixed an array indexing vulnerability in the netfilter
subsystem. This issue may have allowed a local user to crash the system or
potentially escalate their privileges (bsc#1215150).
* CVE-2023-1206: Fixed a hash collision flaw in the IPv6 connection lookup
table. A user located in the local network or with a high bandwidth
connection can increase the CPU usage of the server that accepts IPV6
connections up to 95% (bsc#1212703).
* CVE-2023-4921: Fixed a use-after-free vulnerability in the QFQ network
scheduler which could be exploited to achieve local privilege escalatio
(bsc#1215275).
* CVE-2023-4622: Fixed a use-after-free vulnerability in the Unix domain
sockets component which could be exploited to achieve local privilege
escalation (bsc#1215117).
* CVE-2023-4623: Fixed a use-after-free issue in the HFSC network scheduler
which could be exploited to achieve local privilege escalation
(bsc#1215115).
* CVE-2023-1859: Fixed a use-after-free flaw in Xen transport for 9pfs which
could be exploited to crash the system (bsc#1210169).
* CVE-2023-4881: Fixed a out-of-bounds write flaw in the netfilter subsystem
that could lead to potential information disclosure or a denial of service
(bsc#1215221).
* CVE-2023-2177: Fixed a null pointer dereference issue in the sctp network
protocol which could allow a user to crash the system (bsc#1210643).
* CVE-2023-1192: Fixed use-after-free in cifs_demultiplex_thread()
(bsc#1208995).
The following non-security bugs were fixed:
* ALSA: hda/cirrus: Fix broken audio on hardware with two CS42L42 codecs (git-
fixes).
* ALSA: hda/realtek: Splitting the UX3402 into two separate models (git-
fixes).
* ARM: pxa: remove use of symbol_get() (git-fixes).
* arm64: csum: Fix OoB access in IP checksum code for negative lengths (git-
fixes).
* arm64: module-plts: inline linux/moduleloader.h (git-fixes)
* arm64: module: Use module_init_layout_section() to spot init sections (git-
fixes)
* arm64: sdei: abort running SDEI handlers during crash (git-fixes)
* arm64: tegra: Update AHUB clock parent and rate (git-fixes)
* arm64/fpsimd: Only provide the length to cpufeature for xCR registers (git-
fixes)
* ASoC: imx-audmix: Fix return error with devm_clk_get() (git-fixes).
* ASoC: meson: spdifin: start hw on dai probe (git-fixes).
* ASoC: soc-utils: Export snd_soc_dai_is_dummy() symbol (git-fixes).
* ASoC: tegra: Fix redundant PLLA and PLLA_OUT0 updates (git-fixes).
* ata: libata: disallow dev-initiated LPM transitions to unsupported states
(git-fixes).
* ata: pata_falcon: fix IO base selection for Q40 (git-fixes).
* ata: pata_ftide010: Add missing MODULE_DESCRIPTION (git-fixes).
* ata: sata_gemini: Add missing MODULE_DESCRIPTION (git-fixes).
* backlight: gpio_backlight: Drop output GPIO direction check for initial
power state (git-fixes).
* blk-iocost: fix divide by 0 error in calc_lcoefs() (bsc#1214986).
* blk-iocost: use spin_lock_irqsave in adjust_inuse_and_calc_cost
(bsc#1214992).
* block/mq-deadline: use correct way to throttling write requests
(bsc#1214993).
* Bluetooth: btsdio: fix use after free bug in btsdio_remove due to race
condition (git-fixes).
* bnx2x: new flag for track HW resource allocation (bsc#1202845 bsc#1215322).
* bpf: Clear the probe_addr for uprobe (git-fixes).
* btrfs: do not hold CPU for too long when defragging a file (bsc#1214988).
* drm: gm12u320: Fix the timeout usage for usb_bulk_msg() (git-fixes).
* drm/amd/display: fix the white screen issue when >= 64GB DRAM (git-fixes).
* drm/amd/display: prevent potential division by zero errors (git-fixes).
* drm/display: Do not assume dual mode adaptors support i2c sub-addressing
(bsc#1213808).
* drm/i915: mark requests for GuC virtual engines to avoid use-after-free
(git-fixes).
* drm/i915/gvt: Drop unused helper intel_vgpu_reset_gtt() (git-fixes).
* drm/virtio: Correct drm_gem_shmem_get_sg_table() error handling (git-fixes).
* drm/virtio: Use appropriate atomic state in virtio_gpu_plane_cleanup_fb()
(git-fixes).
* ext4: avoid potential data overflow in next_linear_group (bsc#1214951).
* ext4: correct inline offset when handling xattrs in inode body
(bsc#1214950).
* ext4: fix memory leaks in ext4_fname_{setup_filename,prepare_lookup}
(bsc#1214954).
* ext4: fix wrong unit use in ext4_mb_clear_bb (bsc#1214943).
* ext4: fix wrong unit use in ext4_mb_new_blocks (bsc#1214944).
* ext4: get block from bh in ext4_free_blocks for fast commit replay
(bsc#1214942).
* ext4: reflect error codes from ext4_multi_mount_protect() to its callers
(bsc#1214941).
* ext4: Remove ext4 locking of moved directory (bsc#1214957).
* ext4: set goal start correctly in ext4_mb_normalize_request (bsc#1214940).
* fs: do not update freeing inode i_io_list (bsc#1214813).
* fs: Establish locking order for unrelated directories (bsc#1214958).
* fs: Lock moved directories (bsc#1214959).
* fs: lockd: avoid possible wrong NULL parameter (git-fixes).
* fs: no need to check source (bsc#1215752).
* fs: record I_DIRTY_TIME even if inode already has I_DIRTY_INODE
(bsc#1214813).
* fuse: nlookup missing decrement in fuse_direntplus_link (bsc#1215581).
* gve: Add AF_XDP zero-copy support for GQI-QPL format (bsc#1214479).
* gve: Add XDP DROP and TX support for GQI-QPL format (bsc#1214479).
* gve: Add XDP REDIRECT support for GQI-QPL format (bsc#1214479).
* gve: Changes to add new TX queues (bsc#1214479).
* gve: Control path for DQO-QPL (bsc#1214479).
* gve: fix frag_list chaining (bsc#1214479).
* gve: Fix gve interrupt names (bsc#1214479).
* gve: RX path for DQO-QPL (bsc#1214479).
* gve: trivial spell fix Recive to Receive (bsc#1214479).
* gve: Tx path for DQO-QPL (bsc#1214479).
* gve: Unify duplicate GQ min pkt desc size constants (bsc#1214479).
* gve: use vmalloc_array and vcalloc (bsc#1214479).
* gve: XDP support GQI-QPL: helper function changes (bsc#1214479).
* hwrng: virtio - add an internal buffer (git-fixes).
* hwrng: virtio - always add a pending request (git-fixes).
* hwrng: virtio - do not wait on cleanup (git-fixes).
* hwrng: virtio - do not waste entropy (git-fixes).
* hwrng: virtio - Fix race on data_avail and actual data (git-fixes).
* i2c: aspeed: Reset the i2c controller when timeout occurs (git-fixes).
* i3c: master: svc: fix probe failure when no i3c device exist (git-fixes).
* idr: fix param name in idr_alloc_cyclic() doc (git-fixes).
* Input: tca6416-keypad - fix interrupt enable disbalance (git-fixes).
* iommu/virtio: Detach domain on endpoint release (git-fixes).
* jbd2: check 'jh->b_transaction' before removing it from checkpoint
(bsc#1214953).
* jbd2: correct the end of the journal recovery scan range (bsc#1214955).
* jbd2: fix a race when checking checkpoint buffer busy (bsc#1214949).
* jbd2: fix checkpoint cleanup performance regression (bsc#1214952).
* jbd2: Fix wrongly judgement for buffer head removing while doing checkpoint
(bsc#1214948).
* jbd2: recheck chechpointing non-dirty buffer (bsc#1214945).
* jbd2: remove journal_clean_one_cp_list() (bsc#1214947).
* jbd2: remove t_checkpoint_io_list (bsc#1214946).
* jbd2: restore t_checkpoint_io_list to maintain kABI (bsc#1214946).
* kabi/severities: ignore mlx4 internal symbols
* kconfig: fix possible buffer overflow (git-fixes).
* kernel-binary: Move build-time definitions together Move source list and
build architecture to buildrequires to aid in future reorganization of the
spec template.
* kernel-binary: python3 is needed for build At least
scripts/bpf_helpers_doc.py requires python3 since Linux 4.18 Other simimlar
scripts may exist.
* kselftest/runner.sh: Propagate SIGTERM to runner child (git-fixes).
* KVM: s390: fix KVM_S390_GET_CMMA_BITS for GFNs in memslot holes (git-fixes
bsc#1215915).
* KVM: s390: interrupt: use READ_ONCE() before cmpxchg() (git-fixes
bsc#1215896).
* KVM: s390: pv: fix external interruption loop not always detected (git-fixes
bsc#1215916).
* KVM: s390: vsie: Fix the initialization of the epoch extension (epdx) field
(git-fixes bsc#1215894).
* KVM: s390: vsie: fix the length of APCB bitmap (git-fixes bsc#1215895).
* KVM: s390/diag: fix racy access of physical cpu number in diag 9c handler
(git-fixes bsc#1215911).
* KVM: SVM: Remove a duplicate definition of VMCB_AVIC_APIC_BAR_MASK (git-
fixes).
* KVM: VMX: Fix header file dependency of asm/vmx.h (git-fixes).
* KVM: x86: Fix KVM_CAP_SYNC_REGS's sync_regs() TOCTOU issues (git-fixes).
* KVM: x86/mmu: Include mmu.h in spte.h (git-fixes).
* loop: Fix use-after-free issues (bsc#1214991).
* loop: loop_set_status_from_info() check before assignment (bsc#1214990).
* mlx4: Avoid resetting MLX4_INTFF_BONDING per driver (bsc#1187236).
* mlx4: Connect the ethernet part to the auxiliary bus (bsc#1187236).
* mlx4: Connect the infiniband part to the auxiliary bus (bsc#1187236).
* mlx4: Delete custom device management logic (bsc#1187236).
* mlx4: Get rid of the mlx4_interface.activate callback (bsc#1187236).
* mlx4: Get rid of the mlx4_interface.get_dev callback (bsc#1187236).
* mlx4: Move the bond work to the core driver (bsc#1187236).
* mlx4: Register mlx4 devices to an auxiliary virtual bus (bsc#1187236).
* mlx4: Rename member mlx4_en_dev.nb to netdev_nb (bsc#1187236).
* mlx4: Replace the mlx4_interface.event callback with a notifier
(bsc#1187236).
* mlx4: Use 'void *' as the event param of mlx4_dispatch_event()
(bsc#1187236).
* module: Expose module_init_layout_section() (git-fixes)
* net: do not allow gso_size to be set to GSO_BY_FRAGS (git-fixes).
* net: mana: Add page pool for RX buffers (bsc#1214040).
* net: mana: Configure hwc timeout from hardware (bsc#1214037).
* net: phy: micrel: Correct bit assignments for phy_device flags (git-fixes).
* net: usb: qmi_wwan: add Quectel EM05GV2 (git-fixes).
* net/mlx4: Remove many unnecessary NULL values (bsc#1187236).
* NFS: Guard against READDIR loop when entry names exceed MAXNAMELEN (git-
fixes).
* NFS/blocklayout: Use the passed in gfp flags (git-fixes).
* NFS/pNFS: Fix assignment of xprtdata.cred (git-fixes).
* NFS/pNFS: Report EINVAL errors from connect() to the server (git-fixes).
* NFSD: da_addr_body field missing in some GETDEVICEINFO replies (git-fixes).
* NFSD: fix change_info in NFSv4 RENAME replies (git-fixes).
* NFSD: Fix race to FREE_STATEID and cl_revoked (git-fixes).
* NFSv4: Fix dropped lock for racing OPEN and delegation return (git-fixes).
* NFSv4: fix out path in __nfs4_get_acl_uncached (git-fixes).
* NFSv4.2: fix error handling in nfs42_proc_getxattr (git-fixes).
* NFSv4.2: fix handling of COPY ERR_OFFLOAD_NO_REQ (git-fixes).
* NFSv4/pNFS: minor fix for cleanup path in nfs4_get_device_info (git-fixes).
* ntb: Clean up tx tail index on link down (git-fixes).
* ntb: Drop packets when qp link is down (git-fixes).
* ntb: Fix calculation ntb_transport_tx_free_entry() (git-fixes).
* nvme-auth: use chap->s2 to indicate bidirectional authentication
(bsc#1214543).
* nvme-tcp: add recovery_delay to sysfs (bsc#1201284).
* nvme-tcp: delay error recovery until the next KATO interval (bsc#1201284).
* nvme-tcp: Do not terminate commands when in RESETTING (bsc#1201284).
* nvme-tcp: make 'err_work' a delayed work (bsc#1201284).
* PCI: Free released resource after coalescing (git-fixes).
* platform/mellanox: mlxbf-pmc: Fix potential buffer overflows (git-fixes).
* platform/mellanox: mlxbf-pmc: Fix reading of unprogrammed events (git-
fixes).
* platform/mellanox: mlxbf-tmfifo: Drop jumbo frames (git-fixes).
* platform/mellanox: mlxbf-tmfifo: Drop the Rx packet if no more descriptors
(git-fixes).
* platform/x86: intel_scu_ipc: Check status after timeout in busy_loop() (git-
fixes).
* platform/x86: intel_scu_ipc: Check status upon timeout in
ipc_wait_for_interrupt() (git-fixes).
* platform/x86: intel_scu_ipc: Do not override scu in
intel_scu_ipc_dev_simple_command() (git-fixes).
* platform/x86: intel_scu_ipc: Fail IPC send if still busy (git-fixes).
* powerpc/fadump: make is_kdump_kernel() return false when fadump is active
(bsc#1212639 ltc#202582).
* powerpc/iommu: Fix notifiers being shared by PCI and VIO buses
(bsc#1065729).
* powerpc/rtas: mandate RTAS syscall filtering (bsc#1023051).
* powerpc/xics: Remove unnecessary endian conversion (bsc#1065729).
* printk: ringbuffer: Fix truncating buffer size min_t cast (bsc#1215875).
* pwm: lpc32xx: Remove handling of PWM channels (git-fixes).
* quota: add new helper dquot_active() (bsc#1214998).
* quota: factor out dquot_write_dquot() (bsc#1214995).
* quota: fix dqput() to follow the guarantees dquot_srcu should provide
(bsc#1214963).
* quota: fix warning in dqgrab() (bsc#1214962).
* quota: Properly disable quotas when add_dquot_ref() fails (bsc#1214961).
* quota: rename dquot_active() to inode_quota_active() (bsc#1214997).
* s390/qeth: Do not call dev_close/dev_open (DOWN/UP) (bsc#1214873 git-fixes).
* s390/zcrypt: do not leak memory if dev_set_name() fails (git-fixes
bsc#1215148).
* scsi: 3w-xxxx: Add error handling for initialization failure in tw_probe()
(git-fixes).
* scsi: 53c700: Check that command slot is not NULL (git-fixes).
* scsi: core: Fix legacy /proc parsing buffer overflow (git-fixes).
* scsi: core: Fix possible memory leak if device_add() fails (git-fixes).
* scsi: fnic: Replace return codes in fnic_clean_pending_aborts() (git-fixes).
* scsi: lpfc: Do not abuse UUID APIs and LPFC_COMPRESS_VMID_SIZE (git-fixes).
* scsi: lpfc: Early return after marking final NLP_DROPPED flag in
dev_loss_tmo (git-fixes).
* scsi: lpfc: Fix the NULL vs IS_ERR() bug for debugfs_create_file() (git-
fixes).
* scsi: lpfc: Modify when a node should be put in device recovery mode during
RSCN (git-fixes).
* scsi: lpfc: Prevent use-after-free during rmmod with mapped NVMe rports
(git-fixes).
* scsi: lpfc: Remove reftag check in DIF paths (git-fixes).
* scsi: qedf: Add synchronization between I/O completions and abort
(bsc#1210658).
* scsi: qedf: Fix firmware halt over suspend and resume (git-fixes).
* scsi: qedf: Fix NULL dereference in error handling (git-fixes).
* scsi: qedi: Fix firmware halt over suspend and resume (git-fixes).
* scsi: qla2xxx: Add logs for SFP temperature monitoring (bsc#1214928).
* scsi: qla2xxx: Allow 32-byte CDBs (bsc#1214928).
* scsi: qla2xxx: Error code did not return to upper layer (bsc#1214928).
* scsi: qla2xxx: Fix firmware resource tracking (bsc#1214928).
* scsi: qla2xxx: Fix NULL vs IS_ERR() bug for debugfs_create_dir() (git-
fixes).
* scsi: qla2xxx: Fix smatch warn for qla_init_iocb_limit() (bsc#1214928).
* scsi: qla2xxx: Flush mailbox commands on chip reset (bsc#1214928).
* scsi: qla2xxx: Move resource to allow code reuse (bsc#1214928).
* scsi: qla2xxx: Remove unsupported ql2xenabledif option (bsc#1214928).
* scsi: qla2xxx: Remove unused declarations (bsc#1214928).
* scsi: qla2xxx: Remove unused variables in qla24xx_build_scsi_type_6_iocbs()
(bsc#1214928).
* scsi: qla2xxx: Update version to 10.02.09.100-k (bsc#1214928).
* scsi: qla2xxx: Use raw_smp_processor_id() instead of smp_processor_id()
(git-fixes).
* scsi: scsi_debug: Remove dead code (git-fixes).
* scsi: snic: Fix double free in snic_tgt_create() (git-fixes).
* scsi: snic: Fix possible memory leak if device_add() fails (git-fixes).
* scsi: storvsc: Handle additional SRB status values (git-fixes).
* scsi: zfcp: Fix a double put in zfcp_port_enqueue() (git-fixes bsc#1215941).
* selftests: tracing: Fix to unmount tracefs for recovering environment (git-
fixes).
* SUNRPC: Mark the cred for revalidation if the server rejects it (git-fixes).
* tcpm: Avoid soft reset when partner does not support get_status (git-fixes).
* tracing: Fix race issue between cpu buffer write and swap (git-fixes).
* tracing: Remove extra space at the end of hwlat_detector/mode (git-fixes).
* tracing: Remove unnecessary copying of tr->current_trace (git-fixes).
* uapi: stddef.h: Fix __DECLARE_FLEX_ARRAY for C++ (git-fixes).
* udf: Fix extension of the last extent in the file (bsc#1214964).
* udf: Fix file corruption when appending just after end of preallocated
extent (bsc#1214965).
* udf: Fix off-by-one error when discarding preallocation (bsc#1214966).
* udf: Fix uninitialized array access for some pathnames (bsc#1214967).
* uprobes/x86: Allow to probe a NOP instruction with 0x66 prefix (git-fixes).
* usb: ehci: add workaround for chipidea PORTSC.PEC bug (git-fixes).
* usb: ehci: move new member has_ci_pec_bug into hole (git-fixes).
* usb: serial: option: add FOXCONN T99W368/T99W373 product (git-fixes).
* usb: serial: option: add Quectel EM05G variant (0x030e) (git-fixes).
* usb: typec: tcpci: clear the fault status bit (git-fixes).
* usb: typec: tcpci: move tcpci.h to include/linux/usb/ (git-fixes).
* vhost_vdpa: fix the crash in unmap a large memory (git-fixes).
* vhost-scsi: unbreak any layout for response (git-fixes).
* vhost: allow batching hint without size (git-fixes).
* vhost: fix hung thread due to erroneous iotlb entries (git-fixes).
* vhost: handle error while adding split ranges to iotlb (git-fixes).
* virtio_net: add checking sq is full inside xdp xmit (git-fixes).
* virtio_net: Fix probe failed when modprobe virtio_net (git-fixes).
* virtio_net: reorder some funcs (git-fixes).
* virtio_net: separate the logic of checking whether sq is full (git-fixes).
* virtio_ring: fix avail_wrap_counter in virtqueue_add_packed (git-fixes).
* virtio-mmio: do not break lifecycle of vm_dev (git-fixes).
* virtio-net: fix race between set queues and probe (git-fixes).
* virtio-net: set queues after driver_ok (git-fixes).
* virtio-rng: make device ready before making request (git-fixes).
* virtio: acknowledge all features before access (git-fixes).
* vmcore: remove dependency with is_kdump_kernel() for exporting vmcore
(bsc#1212639 ltc#202582).
* watchdog: intel-mid_wdt: add MODULE_ALIAS() to allow auto-load (git-fixes).
* word-at-a-time: use the same return type for has_zero regardless of
endianness (bsc#1065729).
* x86/alternative: Fix race in try_get_desc() (git-fixes).
* x86/boot/e820: Fix typo in e820.c comment (git-fixes).
* x86/bugs: Reset speculation control settings on init (git-fixes).
* x86/cpu: Add Lunar Lake M (git-fixes).
* x86/cpu: Add model number for Intel Arrow Lake processor (git-fixes).
* x86/fpu: Take task_struct* in copy_sigframe_from_user_to_xstate() (git-
fixes).
* x86/head/64: Switch to KERNEL_CS as soon as new GDT is installed (git-
fixes).
* x86/i8259: Mark legacy PIC interrupts with IRQ_LEVEL (git-fixes).
* x86/ioapic: Do not return 0 from arch_dynirq_lower_bound() (git-fixes).
* x86/ioremap: Fix page aligned size calculation in __ioremap_caller() (git-
fixes).
* x86/mce: Retrieve poison range from hardware (git-fixes).
* x86/mem_encrypt: Unbreak the AMD_MEM_ENCRYPT=n build (git-fixes).
* x86/mm: Avoid incomplete Global INVLPG flushes (git-fixes).
* x86/mm: Do not shuffle CPU entry areas without KASLR (git-fixes).
* x86/purgatory: remove PGO flags (git-fixes).
* x86/PVH: avoid 32-bit build warning when obtaining VGA console info (git-
fixes).
* x86/reboot: Disable virtualization in an emergency if SVM is supported (git-
fixes).
* x86/resctl: fix scheduler confusion with 'current' (git-fixes).
* x86/resctrl: Fix task CLOSID/RMID update race (git-fixes).
* x86/resctrl: Fix to restore to original value when re-enabling hardware
prefetch register (git-fixes).
* x86/rtc: Remove __init for runtime functions (git-fixes).
* x86/sgx: Reduce delay and interference of enclave release (git-fixes).
* x86/srso: Do not probe microcode in a guest (git-fixes).
* x86/srso: Fix SBPB enablement for spec_rstack_overflow=off (git-fixes).
* x86/srso: Fix srso_show_state() side effect (git-fixes).
* x86/srso: Set CPUID feature bits independently of bug or mitigation status
(git-fixes).
* x86/virt: Force GIF=1 prior to disabling SVM (for reboot flows) (git-fixes).
* xen: remove a confusing comment on auto-translated guest I/O (git-fixes).
* xprtrdma: Remap Receive buffers after a reconnect (git-fixes).
## Special Instructions and Notes:
* Please reboot the system after installing this update.
## Patch Instructions:
To install this SUSE update use the SUSE recommended installation methods like
YaST online_update or "zypper patch".
Alternatively you can run the command listed for your product:
* openSUSE Leap 15.4
zypper in -t patch openSUSE-SLE-15.4-2023-4072=1
## Package List:
* openSUSE Leap 15.4 (aarch64 ppc64le s390x x86_64)
* cluster-md-kmp-default-5.14.21-150400.24.92.1
* kselftests-kmp-default-debuginfo-5.14.21-150400.24.92.1
* gfs2-kmp-default-5.14.21-150400.24.92.1
* reiserfs-kmp-default-debuginfo-5.14.21-150400.24.92.1
* kernel-syms-5.14.21-150400.24.92.1
* kselftests-kmp-default-5.14.21-150400.24.92.1
* gfs2-kmp-default-debuginfo-5.14.21-150400.24.92.1
* kernel-default-optional-5.14.21-150400.24.92.1
* kernel-default-extra-5.14.21-150400.24.92.1
* ocfs2-kmp-default-debuginfo-5.14.21-150400.24.92.1
* ocfs2-kmp-default-5.14.21-150400.24.92.1
* kernel-default-devel-5.14.21-150400.24.92.1
* kernel-default-optional-debuginfo-5.14.21-150400.24.92.1
* kernel-obs-qa-5.14.21-150400.24.92.1
* kernel-default-debugsource-5.14.21-150400.24.92.1
* dlm-kmp-default-5.14.21-150400.24.92.1
* cluster-md-kmp-default-debuginfo-5.14.21-150400.24.92.1
* kernel-obs-build-debugsource-5.14.21-150400.24.92.1
* kernel-default-livepatch-5.14.21-150400.24.92.1
* kernel-obs-build-5.14.21-150400.24.92.1
* kernel-default-debuginfo-5.14.21-150400.24.92.1
* kernel-default-devel-debuginfo-5.14.21-150400.24.92.1
* reiserfs-kmp-default-5.14.21-150400.24.92.1
* kernel-default-extra-debuginfo-5.14.21-150400.24.92.1
* dlm-kmp-default-debuginfo-5.14.21-150400.24.92.1
* kernel-default-livepatch-devel-5.14.21-150400.24.92.1
* openSUSE Leap 15.4 (nosrc ppc64le x86_64)
* kernel-debug-5.14.21-150400.24.92.1
* openSUSE Leap 15.4 (ppc64le x86_64)
* kernel-debug-devel-5.14.21-150400.24.92.1
* kernel-debug-livepatch-devel-5.14.21-150400.24.92.1
* kernel-debug-debugsource-5.14.21-150400.24.92.1
* kernel-debug-debuginfo-5.14.21-150400.24.92.1
* kernel-debug-devel-debuginfo-5.14.21-150400.24.92.1
* openSUSE Leap 15.4 (aarch64 ppc64le s390x x86_64 nosrc)
* kernel-default-5.14.21-150400.24.92.1
* openSUSE Leap 15.4 (aarch64 ppc64le x86_64)
* kernel-kvmsmall-livepatch-devel-5.14.21-150400.24.92.1
* kernel-default-base-rebuild-5.14.21-150400.24.92.1.150400.24.42.1
* kernel-kvmsmall-debuginfo-5.14.21-150400.24.92.1
* kernel-kvmsmall-devel-5.14.21-150400.24.92.1
* kernel-default-base-5.14.21-150400.24.92.1.150400.24.42.1
* kernel-kvmsmall-devel-debuginfo-5.14.21-150400.24.92.1
* kernel-kvmsmall-debugsource-5.14.21-150400.24.92.1
* openSUSE Leap 15.4 (noarch)
* kernel-docs-html-5.14.21-150400.24.92.1
* kernel-source-5.14.21-150400.24.92.1
* kernel-source-vanilla-5.14.21-150400.24.92.1
* kernel-macros-5.14.21-150400.24.92.1
* kernel-devel-5.14.21-150400.24.92.1
* openSUSE Leap 15.4 (noarch nosrc)
* kernel-docs-5.14.21-150400.24.92.1
* openSUSE Leap 15.4 (aarch64 nosrc ppc64le x86_64)
* kernel-kvmsmall-5.14.21-150400.24.92.1
* openSUSE Leap 15.4 (nosrc s390x)
* kernel-zfcpdump-5.14.21-150400.24.92.1
* openSUSE Leap 15.4 (s390x)
* kernel-zfcpdump-debugsource-5.14.21-150400.24.92.1
* kernel-zfcpdump-debuginfo-5.14.21-150400.24.92.1
* openSUSE Leap 15.4 (aarch64)
* dtb-allwinner-5.14.21-150400.24.92.1
* dtb-altera-5.14.21-150400.24.92.1
* dtb-marvell-5.14.21-150400.24.92.1
* dtb-apple-5.14.21-150400.24.92.1
* kernel-64kb-devel-5.14.21-150400.24.92.1
* reiserfs-kmp-64kb-debuginfo-5.14.21-150400.24.92.1
* cluster-md-kmp-64kb-5.14.21-150400.24.92.1
* kernel-64kb-extra-5.14.21-150400.24.92.1
* kselftests-kmp-64kb-5.14.21-150400.24.92.1
* dtb-hisilicon-5.14.21-150400.24.92.1
* kernel-64kb-debugsource-5.14.21-150400.24.92.1
* dtb-freescale-5.14.21-150400.24.92.1
* dtb-apm-5.14.21-150400.24.92.1
* dtb-amd-5.14.21-150400.24.92.1
* dtb-arm-5.14.21-150400.24.92.1
* dtb-qcom-5.14.21-150400.24.92.1
* dtb-rockchip-5.14.21-150400.24.92.1
* kselftests-kmp-64kb-debuginfo-5.14.21-150400.24.92.1
* dtb-nvidia-5.14.21-150400.24.92.1
* kernel-64kb-debuginfo-5.14.21-150400.24.92.1
* kernel-64kb-optional-5.14.21-150400.24.92.1
* dtb-amlogic-5.14.21-150400.24.92.1
* dtb-broadcom-5.14.21-150400.24.92.1
* dtb-exynos-5.14.21-150400.24.92.1
* ocfs2-kmp-64kb-5.14.21-150400.24.92.1
* cluster-md-kmp-64kb-debuginfo-5.14.21-150400.24.92.1
* reiserfs-kmp-64kb-5.14.21-150400.24.92.1
* dlm-kmp-64kb-5.14.21-150400.24.92.1
* dtb-lg-5.14.21-150400.24.92.1
* gfs2-kmp-64kb-debuginfo-5.14.21-150400.24.92.1
* dtb-renesas-5.14.21-150400.24.92.1
* kernel-64kb-devel-debuginfo-5.14.21-150400.24.92.1
* dtb-amazon-5.14.21-150400.24.92.1
* dtb-socionext-5.14.21-150400.24.92.1
* dtb-cavium-5.14.21-150400.24.92.1
* kernel-64kb-optional-debuginfo-5.14.21-150400.24.92.1
* dlm-kmp-64kb-debuginfo-5.14.21-150400.24.92.1
* dtb-xilinx-5.14.21-150400.24.92.1
* kernel-64kb-livepatch-devel-5.14.21-150400.24.92.1
* ocfs2-kmp-64kb-debuginfo-5.14.21-150400.24.92.1
* kernel-64kb-extra-debuginfo-5.14.21-150400.24.92.1
* dtb-mediatek-5.14.21-150400.24.92.1
* dtb-sprd-5.14.21-150400.24.92.1
* gfs2-kmp-64kb-5.14.21-150400.24.92.1
* openSUSE Leap 15.4 (nosrc)
* dtb-aarch64-5.14.21-150400.24.92.1
* openSUSE Leap 15.4 (aarch64 nosrc)
* kernel-64kb-5.14.21-150400.24.92.1
## References:
* https://www.suse.com/security/cve/CVE-2023-1192.html
* https://www.suse.com/security/cve/CVE-2023-1206.html
* https://www.suse.com/security/cve/CVE-2023-1859.html
* https://www.suse.com/security/cve/CVE-2023-2177.html
* https://www.suse.com/security/cve/CVE-2023-39192.html
* https://www.suse.com/security/cve/CVE-2023-39193.html
* https://www.suse.com/security/cve/CVE-2023-39194.html
* https://www.suse.com/security/cve/CVE-2023-4155.html
* https://www.suse.com/security/cve/CVE-2023-42753.html
* https://www.suse.com/security/cve/CVE-2023-42754.html
* https://www.suse.com/security/cve/CVE-2023-4389.html
* https://www.suse.com/security/cve/CVE-2023-4563.html
* https://www.suse.com/security/cve/CVE-2023-4622.html
* https://www.suse.com/security/cve/CVE-2023-4623.html
* https://www.suse.com/security/cve/CVE-2023-4881.html
* https://www.suse.com/security/cve/CVE-2023-4921.html
* https://www.suse.com/security/cve/CVE-2023-5345.html
* https://bugzilla.suse.com/show_bug.cgi?id=1202845
* https://bugzilla.suse.com/show_bug.cgi?id=1213808
* https://bugzilla.suse.com/show_bug.cgi?id=1214928
* https://bugzilla.suse.com/show_bug.cgi?id=1214940
* https://bugzilla.suse.com/show_bug.cgi?id=1214941
* https://bugzilla.suse.com/show_bug.cgi?id=1214942
* https://bugzilla.suse.com/show_bug.cgi?id=1214943
* https://bugzilla.suse.com/show_bug.cgi?id=1214944
* https://bugzilla.suse.com/show_bug.cgi?id=1214950
* https://bugzilla.suse.com/show_bug.cgi?id=1214951
* https://bugzilla.suse.com/show_bug.cgi?id=1214954
* https://bugzilla.suse.com/show_bug.cgi?id=1214957
* https://bugzilla.suse.com/show_bug.cgi?id=1214986
* https://bugzilla.suse.com/show_bug.cgi?id=1214988
* https://bugzilla.suse.com/show_bug.cgi?id=1214992
* https://bugzilla.suse.com/show_bug.cgi?id=1214993
* https://bugzilla.suse.com/show_bug.cgi?id=1215322
* https://bugzilla.suse.com/show_bug.cgi?id=1215877
* https://bugzilla.suse.com/show_bug.cgi?id=1215894
* https://bugzilla.suse.com/show_bug.cgi?id=1215895
* https://bugzilla.suse.com/show_bug.cgi?id=1215896
* https://bugzilla.suse.com/show_bug.cgi?id=1215911
* https://bugzilla.suse.com/show_bug.cgi?id=1215915
* https://bugzilla.suse.com/show_bug.cgi?id=1215916
1
0
openSUSE-SU-2023:0351-1: important: Security update for virtualbox
by opensuse-security＠opensuse.org 04 Nov '23
by opensuse-security＠opensuse.org 04 Nov '23
04 Nov '23
openSUSE Security Update: Security update for virtualbox
______________________________________________________________________________
Announcement ID: openSUSE-SU-2023:0351-1
Rating: important
References: #1216363 #1216364 #1216365
Cross-References: CVE-2023-22098 CVE-2023-22099 CVE-2023-22100
CVSS scores:
CVE-2023-22098 (NVD) : 7.3 CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:C/C:L/I:L/A:H
CVE-2023-22098 (SUSE): 7.3 CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:C/C:L/I:L/A:H
CVE-2023-22099 (NVD) : 8.2 CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H
CVE-2023-22099 (SUSE): 7.3 CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:C/C:L/I:L/A:H
CVE-2023-22100 (NVD) : 7.9 CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:C/C:H/I:N/A:H
CVE-2023-22100 (SUSE): 7.9 CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:C/C:H/I:N/A:H
Affected Products:
openSUSE Leap 15.4
______________________________________________________________________________
An update that fixes three vulnerabilities is now available.
Description:
This update for virtualbox fixes the following issues:
- Version bump to VirtualBox 7.0.12 (released October 17 2023 by Oracle)
Fixes the following:
- CVE-2023-22098 (boo#1216363)
- CVE-2023-22099 (boo#1216364)
- CVE-2023-22100 (boo#1216365)
This is a maintenance release. The following items were fixed and/or added:
- VMM: Fixed using a debugger inside the guest under certain circumstances
(bugs #21413 and #21546)
- VMM: Fixed detection of VT-x being used by other hypervisors (bug #21867)
- VMM: Introduced additional improvements in Split Lock Detection feature
of recent Intel CPUs on Linux hosts (bug #20180)
- GUI: Fixed issue when the nested hardware virtualization setting was not
displayed in the VM details panel (bug #21707)
- GUI: Introduced NLS update for Croatian, Indonesian, Italian, Japanese,
Korean, Dutch and Turkish languages as well as added general
look-and-feel improvements
- Devices: Fixed black screen in Windows guests with multiple guest
screens when 3D is disabled (7.0.10 regression)
- Devices: Fixed PCI device identifiers for the VirtIO network interface
(bug #21516)
- Devices: Fixed VLAN support for the VirtIO network interface (bug #21778)
- Devices: Fixed loading saved states when a TPM is configured (7.0.10
regression, bug #21773)
- Networking: Fixed memory leaks in the VBoxIntNetSwitch process on macOS
(bug #21752)
- Networking: Fixed TCP connections with IP addresses ending on .2 when
the NAT network attachment is used (bug #21513)
- VRDP: Added general improvements
- VBoxManage: Added improvements for "list usbfilters" command
- Unattended: Added kick start file support for Oracle Linux 8 and Oracle
Linux 9.
- Main: Added more Linux OS subtypes
- Host Services: Fixed Guest Properties service crash under rare
circumstance
- Linux Host and Guest: Fixed few "field-spanning write" kernel warnings
(bugs #21410 and #21862)
- Linux Guest Additions: Added more fixes for RHEL 8.9 and 9.3 kernel
- Linux Guest Additions: Added more fixes for kernel 6.4
- Linux Guest Additions: Added initial support for OpenSUSE 15.5 kernel
- Linux Guest Additions: Added initial support for kernels 6.5 and 6.6
- Linux Guest Additions: Added version reporting for "rcvboxadd
status-kernel" and "rcvboxadd status-user" commands
- BIOS: Restored support for ISA SCSI HBAs in the BIOS (bug #21736)
- Convert to systemd-sysusers
Patch Instructions:
To install this openSUSE Security Update use the SUSE recommended installation methods
like YaST online_update or "zypper patch".
Alternatively you can run the command listed for your product:
- openSUSE Leap 15.4:
zypper in -t patch openSUSE-2023-351=1
Package List:
- openSUSE Leap 15.4 (x86_64):
python3-virtualbox-7.0.12-lp154.2.43.1
python3-virtualbox-debuginfo-7.0.12-lp154.2.43.1
virtualbox-7.0.12-lp154.2.43.1
virtualbox-debuginfo-7.0.12-lp154.2.43.1
virtualbox-debugsource-7.0.12-lp154.2.43.1
virtualbox-devel-7.0.12-lp154.2.43.1
virtualbox-guest-tools-7.0.12-lp154.2.43.1
virtualbox-guest-tools-debuginfo-7.0.12-lp154.2.43.1
virtualbox-kmp-debugsource-7.0.12-lp154.2.43.1
virtualbox-kmp-default-7.0.12_k5.14.21_150400.24.92-lp154.2.43.1
virtualbox-kmp-default-debuginfo-7.0.12_k5.14.21_150400.24.92-lp154.2.43.1
virtualbox-qt-7.0.12-lp154.2.43.1
virtualbox-qt-debuginfo-7.0.12-lp154.2.43.1
virtualbox-vnc-7.0.12-lp154.2.43.1
virtualbox-websrv-7.0.12-lp154.2.43.1
virtualbox-websrv-debuginfo-7.0.12-lp154.2.43.1
- openSUSE Leap 15.4 (noarch):
virtualbox-guest-desktop-icons-7.0.12-lp154.2.43.1
virtualbox-guest-source-7.0.12-lp154.2.43.1
virtualbox-host-source-7.0.12-lp154.2.43.1
References:
https://www.suse.com/security/cve/CVE-2023-22098.html
https://www.suse.com/security/cve/CVE-2023-22099.html
https://www.suse.com/security/cve/CVE-2023-22100.html
https://bugzilla.suse.com/1216363
https://bugzilla.suse.com/1216364
https://bugzilla.suse.com/1216365
1
0
openSUSE-SU-2023:0352-1: important: Security update for virtualbox
by opensuse-security＠opensuse.org 04 Nov '23
by opensuse-security＠opensuse.org 04 Nov '23
04 Nov '23
openSUSE Security Update: Security update for virtualbox
______________________________________________________________________________
Announcement ID: openSUSE-SU-2023:0352-1
Rating: important
References: #1215463 #1216363 #1216364 #1216365
Cross-References: CVE-2023-22098 CVE-2023-22099 CVE-2023-22100
CVSS scores:
CVE-2023-22098 (NVD) : 7.3 CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:C/C:L/I:L/A:H
CVE-2023-22098 (SUSE): 7.3 CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:C/C:L/I:L/A:H
CVE-2023-22099 (NVD) : 8.2 CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H
CVE-2023-22099 (SUSE): 7.3 CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:C/C:L/I:L/A:H
CVE-2023-22100 (NVD) : 7.9 CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:C/C:H/I:N/A:H
CVE-2023-22100 (SUSE): 7.9 CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:C/C:H/I:N/A:H
Affected Products:
openSUSE Leap 15.5
______________________________________________________________________________
An update that solves three vulnerabilities and has one
errata is now available.
Description:
This update for virtualbox fixes the following issues:
- Version bump to VirtualBox 7.0.12 (released October 17 2023 by Oracle)
Fixes the following:
- CVE-2023-22098 (boo#1216363)
- CVE-2023-22099 (boo#1216364)
- CVE-2023-22100 (boo#1216365)
This is a maintenance release. The following items were fixed and/or added:
- VMM: Fixed using a debugger inside the guest under certain circumstances
(bugs #21413 and #21546)
- VMM: Fixed detection of VT-x being used by other hypervisors (bug #21867)
- VMM: Introduced additional improvements in Split Lock Detection feature
of recent Intel CPUs on Linux hosts (bug #20180)
- GUI: Fixed issue when the nested hardware virtualization setting was not
displayed in the VM details panel (bug #21707)
- GUI: Introduced NLS update for Croatian, Indonesian, Italian, Japanese,
Korean, Dutch and Turkish languages as well as added general
look-and-feel improvements
- Devices: Fixed black screen in Windows guests with multiple guest
screens when 3D is disabled (7.0.10 regression)
- Devices: Fixed PCI device identifiers for the VirtIO network interface
(bug #21516)
- Devices: Fixed VLAN support for the VirtIO network interface (bug #21778)
- Devices: Fixed loading saved states when a TPM is configured (7.0.10
regression, bug #21773)
- Networking: Fixed memory leaks in the VBoxIntNetSwitch process on macOS
(bug #21752)
- Networking: Fixed TCP connections with IP addresses ending on .2 when
the NAT network attachment is used (bug #21513)
- VRDP: Added general improvements
- VBoxManage: Added improvements for "list usbfilters" command
- Unattended: Added kick start file support for Oracle Linux 8 and Oracle
Linux 9.
- Main: Added more Linux OS subtypes
- Host Services: Fixed Guest Properties service crash under rare
circumstance
- Linux Host and Guest: Fixed few "field-spanning write" kernel warnings
(bugs #21410 and #21862)
- Linux Guest Additions: Added more fixes for RHEL 8.9 and 9.3 kernel
- Linux Guest Additions: Added more fixes for kernel 6.4
- Linux Guest Additions: Added initial support for OpenSUSE 15.5 kernel
- Linux Guest Additions: Added initial support for kernels 6.5 and 6.6
- Linux Guest Additions: Added version reporting for "rcvboxadd
status-kernel" and "rcvboxadd status-user" commands
- BIOS: Restored support for ISA SCSI HBAs in the BIOS (bug #21736)
- Convert to systemd-sysusers
- Fix problems with 6.5 kernels and shared folders. (boo#1215463).
Patch Instructions:
To install this openSUSE Security Update use the SUSE recommended installation methods
like YaST online_update or "zypper patch".
Alternatively you can run the command listed for your product:
- openSUSE Leap 15.5:
zypper in -t patch openSUSE-2023-352=1
Package List:
- openSUSE Leap 15.5 (noarch):
virtualbox-guest-desktop-icons-7.0.12-lp155.2.13.1
virtualbox-guest-source-7.0.12-lp155.2.13.1
virtualbox-host-source-7.0.12-lp155.2.13.1
- openSUSE Leap 15.5 (x86_64):
python3-virtualbox-7.0.12-lp155.2.13.1
python3-virtualbox-debuginfo-7.0.12-lp155.2.13.1
virtualbox-7.0.12-lp155.2.13.1
virtualbox-debuginfo-7.0.12-lp155.2.13.1
virtualbox-debugsource-7.0.12-lp155.2.13.1
virtualbox-devel-7.0.12-lp155.2.13.1
virtualbox-guest-tools-7.0.12-lp155.2.13.1
virtualbox-guest-tools-debuginfo-7.0.12-lp155.2.13.1
virtualbox-kmp-debugsource-7.0.12-lp155.2.13.1
virtualbox-kmp-default-7.0.12_k5.14.21_150500.55.31-lp155.2.13.1
virtualbox-kmp-default-debuginfo-7.0.12_k5.14.21_150500.55.31-lp155.2.13.1
virtualbox-qt-7.0.12-lp155.2.13.1
virtualbox-qt-debuginfo-7.0.12-lp155.2.13.1
virtualbox-vnc-7.0.12-lp155.2.13.1
virtualbox-websrv-7.0.12-lp155.2.13.1
virtualbox-websrv-debuginfo-7.0.12-lp155.2.13.1
References:
https://www.suse.com/security/cve/CVE-2023-22098.html
https://www.suse.com/security/cve/CVE-2023-22099.html
https://www.suse.com/security/cve/CVE-2023-22100.html
https://bugzilla.suse.com/1215463
https://bugzilla.suse.com/1216363
https://bugzilla.suse.com/1216364
https://bugzilla.suse.com/1216365
1
0
openSUSE-SU-2023:0354-1: important: Security update for opera
by opensuse-security＠opensuse.org 04 Nov '23
by opensuse-security＠opensuse.org 04 Nov '23
04 Nov '23
openSUSE Security Update: Security update for opera
______________________________________________________________________________
Announcement ID: openSUSE-SU-2023:0354-1
Rating: important
References:
Cross-References: CVE-2023-5472
CVSS scores:
CVE-2023-5472 (NVD) : 8.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Affected Products:
openSUSE Leap 15.5:NonFree
______________________________________________________________________________
An update that fixes one vulnerability is now available.
Description:
This update for opera fixes the following issues:
- Update to 104.0.4944.36
* CHR-9492 Update Chromium on desktop-stable-118-4944 to 118.0.5993.118
* DNA-112757 [Tab close button] Close button is cutted when a lot tabs
are opened
- The update to chromium 118.0.5993.118 fixes following issues:
CVE-2023-5472
- Update to 104.0.4944.33
* CHR-9487 Update Chromium on desktop-stable-118-4944 to 118.0.5993.96
* DNA-111963 Show duplicate indicator when hovering tab in tab tooltip
- Changes in 104.0.4944.28
* DNA-112454 [Start Page] No context menu in Search bar using right
button of mouse
* DNA-112053 Context menu is too large on Mac
* DNA-111989 Favicons are displayed too close to titles in history menu
Patch Instructions:
To install this openSUSE Security Update use the SUSE recommended installation methods
like YaST online_update or "zypper patch".
Alternatively you can run the command listed for your product:
- openSUSE Leap 15.5:NonFree:
zypper in -t patch openSUSE-2023-354=1
Package List:
- openSUSE Leap 15.5:NonFree (x86_64):
opera-104.0.4944.36-lp155.3.18.1
References:
https://www.suse.com/security/cve/CVE-2023-5472.html
1
0