December 2023 - openSUSE Security Announce

openSUSE-SU-2023:0424-1: moderate: Security update for deepin-compressor
by opensuse-security＠opensuse.org 30 Dec '23

30 Dec '23

openSUSE Security Update: Security update for deepin-compressor ______________________________________________________________________________ Announcement ID: openSUSE-SU-2023:0424-1 Rating: moderate References: #1218428 Cross-References: CVE-2023-50255 Affected Products: openSUSE Backports SLE-15-SP4 ______________________________________________________________________________ An update that fixes one vulnerability is now available. Description: This update for deepin-compressor fixes the following issues: - CVE-2023-50255: Fix Zip Path Traversal (boo#1218428) Patch Instructions: To install this openSUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Backports SLE-15-SP4: zypper in -t patch openSUSE-2023-424=1 Package List: - openSUSE Backports SLE-15-SP4 (aarch64 ppc64le s390x x86_64): deepin-compressor-5.12.2-bp154.2.3.1 - openSUSE Backports SLE-15-SP4 (noarch): deepin-compressor-lang-5.12.2-bp154.2.3.1 References: https://www.suse.com/security/cve/CVE-2023-50255.html https://bugzilla.suse.com/1218428

1 0

openSUSE-SU-2023:0421-1: important: Security update for proftpd
by opensuse-security＠opensuse.org 30 Dec '23

30 Dec '23

openSUSE Security Update: Security update for proftpd ______________________________________________________________________________ Announcement ID: openSUSE-SU-2023:0421-1 Rating: important References: Cross-References: CVE-2023-48795 CVSS scores: CVE-2023-48795 (NVD) : 5.9 CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:N CVE-2023-48795 (SUSE): 5.9 CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:N Affected Products: openSUSE Backports SLE-15-SP4 openSUSE Backports SLE-15-SP5 ______________________________________________________________________________ An update that fixes one vulnerability is now available. Description: This update for proftpd fixes the following issues: Update to version 1.3.8a * Implemented mitigations for "Terrapin" SSH attack (CVE-2023-48795). * http://proftpd.org/docs/NEWS-1.3.8b Patch Instructions: To install this openSUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Backports SLE-15-SP5: zypper in -t patch openSUSE-2023-421=1 - openSUSE Backports SLE-15-SP4: zypper in -t patch openSUSE-2023-421=1 Package List: - openSUSE Backports SLE-15-SP5 (aarch64 i586 ppc64le s390x x86_64): proftpd-1.3.8b-bp155.2.3.1 proftpd-debuginfo-1.3.8b-bp155.2.3.1 proftpd-debugsource-1.3.8b-bp155.2.3.1 proftpd-devel-1.3.8b-bp155.2.3.1 proftpd-doc-1.3.8b-bp155.2.3.1 proftpd-ldap-1.3.8b-bp155.2.3.1 proftpd-ldap-debuginfo-1.3.8b-bp155.2.3.1 proftpd-mysql-1.3.8b-bp155.2.3.1 proftpd-mysql-debuginfo-1.3.8b-bp155.2.3.1 proftpd-pgsql-1.3.8b-bp155.2.3.1 proftpd-pgsql-debuginfo-1.3.8b-bp155.2.3.1 proftpd-radius-1.3.8b-bp155.2.3.1 proftpd-radius-debuginfo-1.3.8b-bp155.2.3.1 proftpd-sqlite-1.3.8b-bp155.2.3.1 proftpd-sqlite-debuginfo-1.3.8b-bp155.2.3.1 - openSUSE Backports SLE-15-SP5 (noarch): proftpd-lang-1.3.8b-bp155.2.3.1 - openSUSE Backports SLE-15-SP4 (aarch64 i586 ppc64le s390x x86_64): proftpd-1.3.8b-bp154.3.12.1 proftpd-devel-1.3.8b-bp154.3.12.1 proftpd-doc-1.3.8b-bp154.3.12.1 proftpd-ldap-1.3.8b-bp154.3.12.1 proftpd-mysql-1.3.8b-bp154.3.12.1 proftpd-pgsql-1.3.8b-bp154.3.12.1 proftpd-radius-1.3.8b-bp154.3.12.1 proftpd-sqlite-1.3.8b-bp154.3.12.1 - openSUSE Backports SLE-15-SP4 (noarch): proftpd-lang-1.3.8b-bp154.3.12.1 References: https://www.suse.com/security/cve/CVE-2023-48795.html

1 0

openSUSE-SU-2023:0423-1: moderate: Security update for deepin-compressor
by opensuse-security＠opensuse.org 30 Dec '23

30 Dec '23

openSUSE Security Update: Security update for deepin-compressor ______________________________________________________________________________ Announcement ID: openSUSE-SU-2023:0423-1 Rating: moderate References: #1218428 Cross-References: CVE-2023-50255 Affected Products: openSUSE Backports SLE-15-SP5 ______________________________________________________________________________ An update that fixes one vulnerability is now available. Description: This update for deepin-compressor fixes the following issues: - CVE-2023-50255: Fix Zip Path Traversal (boo#1218428) Patch Instructions: To install this openSUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Backports SLE-15-SP5: zypper in -t patch openSUSE-2023-423=1 Package List: - openSUSE Backports SLE-15-SP5 (aarch64 ppc64le s390x x86_64): deepin-compressor-5.12.13-bp155.2.3.1 - openSUSE Backports SLE-15-SP5 (noarch): deepin-compressor-lang-5.12.13-bp155.2.3.1 References: https://www.suse.com/security/cve/CVE-2023-50255.html https://bugzilla.suse.com/1218428

1 0

SUSE-SU-2023:4983-1: moderate: Security update for gnutls
by OPENSUSE-SECURITY-UPDATES 28 Dec '23

28 Dec '23

# Security update for gnutls Announcement ID: SUSE-SU-2023:4983-1 Rating: moderate References: * bsc#1217277 Cross-References: * CVE-2023-5981 CVSS scores: * CVE-2023-5981 ( SUSE ): 5.9 CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N * CVE-2023-5981 ( NVD ): 5.9 CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N Affected Products: * Basesystem Module 15-SP4 * Basesystem Module 15-SP5 * openSUSE Leap 15.4 * openSUSE Leap 15.5 * openSUSE Leap Micro 5.4 * SUSE Linux Enterprise Desktop 15 SP4 * SUSE Linux Enterprise Desktop 15 SP5 * SUSE Linux Enterprise High Performance Computing 15 SP4 * SUSE Linux Enterprise High Performance Computing 15 SP5 * SUSE Linux Enterprise Micro 5.4 * SUSE Linux Enterprise Micro 5.5 * SUSE Linux Enterprise Micro for Rancher 5.4 * SUSE Linux Enterprise Real Time 15 SP4 * SUSE Linux Enterprise Real Time 15 SP5 * SUSE Linux Enterprise Server 15 SP4 * SUSE Linux Enterprise Server 15 SP5 * SUSE Linux Enterprise Server for SAP Applications 15 SP4 * SUSE Linux Enterprise Server for SAP Applications 15 SP5 * SUSE Manager Proxy 4.3 * SUSE Manager Retail Branch Server 4.3 * SUSE Manager Server 4.3 An update that solves one vulnerability can now be installed. ## Description: This update for gnutls fixes the following issues: * CVE-2023-5981: Fixed timing side-channel inside RSA-PSK key exchange (bsc#1217277). ## Patch Instructions: To install this SUSE update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: * openSUSE Leap 15.4 zypper in -t patch openSUSE-SLE-15.4-2023-4983=1 SUSE-2023-4983=1 * openSUSE Leap Micro 5.4 zypper in -t patch openSUSE-Leap-Micro-5.4-2023-4983=1 * openSUSE Leap 15.5 zypper in -t patch openSUSE-SLE-15.5-2023-4983=1 * SUSE Linux Enterprise Micro for Rancher 5.4 zypper in -t patch SUSE-SLE-Micro-5.4-2023-4983=1 * SUSE Linux Enterprise Micro 5.4 zypper in -t patch SUSE-SLE-Micro-5.4-2023-4983=1 * SUSE Linux Enterprise Micro 5.5 zypper in -t patch SUSE-SLE-Micro-5.5-2023-4983=1 * Basesystem Module 15-SP4 zypper in -t patch SUSE-SLE-Module-Basesystem-15-SP4-2023-4983=1 * Basesystem Module 15-SP5 zypper in -t patch SUSE-SLE-Module-Basesystem-15-SP5-2023-4983=1 ## Package List: * openSUSE Leap 15.4 (aarch64 ppc64le s390x x86_64 i586) * libgnutlsxx-devel-3.7.3-150400.4.38.1 * libgnutlsxx28-3.7.3-150400.4.38.1 * gnutls-debugsource-3.7.3-150400.4.38.1 * libgnutls30-hmac-3.7.3-150400.4.38.1 * libgnutlsxx28-debuginfo-3.7.3-150400.4.38.1 * gnutls-debuginfo-3.7.3-150400.4.38.1 * libgnutls30-3.7.3-150400.4.38.1 * gnutls-guile-debuginfo-3.7.3-150400.4.38.1 * gnutls-guile-3.7.3-150400.4.38.1 * libgnutls-devel-3.7.3-150400.4.38.1 * gnutls-3.7.3-150400.4.38.1 * libgnutls30-debuginfo-3.7.3-150400.4.38.1 * openSUSE Leap 15.4 (x86_64) * libgnutls-devel-32bit-3.7.3-150400.4.38.1 * libgnutls30-32bit-debuginfo-3.7.3-150400.4.38.1 * libgnutls30-32bit-3.7.3-150400.4.38.1 * libgnutls30-hmac-32bit-3.7.3-150400.4.38.1 * openSUSE Leap 15.4 (aarch64_ilp32) * libgnutls30-64bit-3.7.3-150400.4.38.1 * libgnutls30-hmac-64bit-3.7.3-150400.4.38.1 * libgnutls-devel-64bit-3.7.3-150400.4.38.1 * libgnutls30-64bit-debuginfo-3.7.3-150400.4.38.1 * openSUSE Leap Micro 5.4 (aarch64 s390x x86_64) * gnutls-debugsource-3.7.3-150400.4.38.1 * libgnutls30-hmac-3.7.3-150400.4.38.1 * gnutls-debuginfo-3.7.3-150400.4.38.1 * libgnutls30-3.7.3-150400.4.38.1 * gnutls-3.7.3-150400.4.38.1 * libgnutls30-debuginfo-3.7.3-150400.4.38.1 * openSUSE Leap 15.5 (aarch64 ppc64le s390x x86_64) * libgnutlsxx-devel-3.7.3-150400.4.38.1 * libgnutlsxx28-3.7.3-150400.4.38.1 * gnutls-debugsource-3.7.3-150400.4.38.1 * libgnutls30-hmac-3.7.3-150400.4.38.1 * libgnutlsxx28-debuginfo-3.7.3-150400.4.38.1 * gnutls-debuginfo-3.7.3-150400.4.38.1 * libgnutls30-3.7.3-150400.4.38.1 * gnutls-guile-debuginfo-3.7.3-150400.4.38.1 * gnutls-guile-3.7.3-150400.4.38.1 * libgnutls-devel-3.7.3-150400.4.38.1 * gnutls-3.7.3-150400.4.38.1 * libgnutls30-debuginfo-3.7.3-150400.4.38.1 * openSUSE Leap 15.5 (x86_64) * libgnutls-devel-32bit-3.7.3-150400.4.38.1 * libgnutls30-32bit-debuginfo-3.7.3-150400.4.38.1 * libgnutls30-32bit-3.7.3-150400.4.38.1 * libgnutls30-hmac-32bit-3.7.3-150400.4.38.1 * SUSE Linux Enterprise Micro for Rancher 5.4 (aarch64 s390x x86_64) * gnutls-debugsource-3.7.3-150400.4.38.1 * libgnutls30-hmac-3.7.3-150400.4.38.1 * gnutls-debuginfo-3.7.3-150400.4.38.1 * libgnutls30-3.7.3-150400.4.38.1 * gnutls-3.7.3-150400.4.38.1 * libgnutls30-debuginfo-3.7.3-150400.4.38.1 * SUSE Linux Enterprise Micro 5.4 (aarch64 s390x x86_64) * gnutls-debugsource-3.7.3-150400.4.38.1 * libgnutls30-hmac-3.7.3-150400.4.38.1 * gnutls-debuginfo-3.7.3-150400.4.38.1 * libgnutls30-3.7.3-150400.4.38.1 * gnutls-3.7.3-150400.4.38.1 * libgnutls30-debuginfo-3.7.3-150400.4.38.1 * SUSE Linux Enterprise Micro 5.5 (aarch64 s390x x86_64) * gnutls-debugsource-3.7.3-150400.4.38.1 * libgnutls30-hmac-3.7.3-150400.4.38.1 * gnutls-debuginfo-3.7.3-150400.4.38.1 * libgnutls30-3.7.3-150400.4.38.1 * gnutls-3.7.3-150400.4.38.1 * libgnutls30-debuginfo-3.7.3-150400.4.38.1 * Basesystem Module 15-SP4 (aarch64 ppc64le s390x x86_64) * libgnutlsxx-devel-3.7.3-150400.4.38.1 * libgnutlsxx28-3.7.3-150400.4.38.1 * gnutls-debugsource-3.7.3-150400.4.38.1 * libgnutls30-hmac-3.7.3-150400.4.38.1 * libgnutlsxx28-debuginfo-3.7.3-150400.4.38.1 * gnutls-debuginfo-3.7.3-150400.4.38.1 * libgnutls30-3.7.3-150400.4.38.1 * libgnutls-devel-3.7.3-150400.4.38.1 * gnutls-3.7.3-150400.4.38.1 * libgnutls30-debuginfo-3.7.3-150400.4.38.1 * Basesystem Module 15-SP4 (x86_64) * libgnutls30-32bit-debuginfo-3.7.3-150400.4.38.1 * libgnutls30-32bit-3.7.3-150400.4.38.1 * libgnutls30-hmac-32bit-3.7.3-150400.4.38.1 * Basesystem Module 15-SP5 (aarch64 ppc64le s390x x86_64) * libgnutlsxx-devel-3.7.3-150400.4.38.1 * libgnutlsxx28-3.7.3-150400.4.38.1 * gnutls-debugsource-3.7.3-150400.4.38.1 * libgnutls30-hmac-3.7.3-150400.4.38.1 * libgnutlsxx28-debuginfo-3.7.3-150400.4.38.1 * gnutls-debuginfo-3.7.3-150400.4.38.1 * libgnutls30-3.7.3-150400.4.38.1 * libgnutls-devel-3.7.3-150400.4.38.1 * gnutls-3.7.3-150400.4.38.1 * libgnutls30-debuginfo-3.7.3-150400.4.38.1 * Basesystem Module 15-SP5 (x86_64) * libgnutls30-32bit-debuginfo-3.7.3-150400.4.38.1 * libgnutls30-32bit-3.7.3-150400.4.38.1 * libgnutls30-hmac-32bit-3.7.3-150400.4.38.1 ## References: * https://www.suse.com/security/cve/CVE-2023-5981.html * https://bugzilla.suse.com/show_bug.cgi?id=1217277

1 0

SUSE-SU-2023:4988-1: low: Security update for python-pip
by OPENSUSE-SECURITY-UPDATES 28 Dec '23

28 Dec '23

# Security update for python-pip Announcement ID: SUSE-SU-2023:4988-1 Rating: low References: * bsc#1217353 Cross-References: * CVE-2023-5752 CVSS scores: * CVE-2023-5752 ( SUSE ): 3.3 CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N * CVE-2023-5752 ( NVD ): 5.5 CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N Affected Products: * openSUSE Leap 15.4 * openSUSE Leap 15.5 * Python 3 Module 15-SP4 * Python 3 Module 15-SP5 * SUSE Linux Enterprise Desktop 15 SP4 * SUSE Linux Enterprise Desktop 15 SP5 * SUSE Linux Enterprise High Performance Computing 15 SP4 * SUSE Linux Enterprise High Performance Computing 15 SP5 * SUSE Linux Enterprise Server 15 SP4 * SUSE Linux Enterprise Server 15 SP5 * SUSE Linux Enterprise Server for SAP Applications 15 SP4 * SUSE Linux Enterprise Server for SAP Applications 15 SP5 * SUSE Manager Proxy 4.3 * SUSE Manager Retail Branch Server 4.3 * SUSE Manager Server 4.3 An update that solves one vulnerability can now be installed. ## Description: This update for python-pip fixes the following issues: * CVE-2023-5752: Fixed injection of arbitrary configuration through Mercurial parameter (bsc#1217353). ## Patch Instructions: To install this SUSE update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: * openSUSE Leap 15.4 zypper in -t patch SUSE-2023-4988=1 openSUSE-SLE-15.4-2023-4988=1 * openSUSE Leap 15.5 zypper in -t patch openSUSE-SLE-15.5-2023-4988=1 * Python 3 Module 15-SP4 zypper in -t patch SUSE-SLE-Module-Python3-15-SP4-2023-4988=1 * Python 3 Module 15-SP5 zypper in -t patch SUSE-SLE-Module-Python3-15-SP5-2023-4988=1 ## Package List: * openSUSE Leap 15.4 (noarch) * python311-pip-22.3.1-150400.17.12.1 * openSUSE Leap 15.5 (noarch) * python311-pip-22.3.1-150400.17.12.1 * Python 3 Module 15-SP4 (noarch) * python311-pip-22.3.1-150400.17.12.1 * Python 3 Module 15-SP5 (noarch) * python311-pip-22.3.1-150400.17.12.1 ## References: * https://www.suse.com/security/cve/CVE-2023-5752.html * https://bugzilla.suse.com/show_bug.cgi?id=1217353

1 0

SUSE-SU-2023:4981-1: important: Security update for postfix
by OPENSUSE-SECURITY-UPDATES 28 Dec '23

28 Dec '23

# Security update for postfix Announcement ID: SUSE-SU-2023:4981-1 Rating: important References: * bsc#1218304 * bsc#1218314 Cross-References: * CVE-2023-51764 CVSS scores: * CVE-2023-51764 ( SUSE ): 5.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N Affected Products: * Basesystem Module 15-SP5 * Legacy Module 15-SP5 * openSUSE Leap 15.5 * Server Applications Module 15-SP5 * SUSE Linux Enterprise Desktop 15 SP5 * SUSE Linux Enterprise High Performance Computing 15 SP5 * SUSE Linux Enterprise Real Time 15 SP5 * SUSE Linux Enterprise Server 15 SP5 * SUSE Linux Enterprise Server for SAP Applications 15 SP5 An update that solves one vulnerability and has one security fix can now be installed. ## Description: This update for postfix fixes the following issues: * CVE-2023-51764: Fixed new SMTP smuggling attack (bsc#1218304). ## Patch Instructions: To install this SUSE update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: * openSUSE Leap 15.5 zypper in -t patch SUSE-2023-4981=1 openSUSE-SLE-15.5-2023-4981=1 * Basesystem Module 15-SP5 zypper in -t patch SUSE-SLE-Module-Basesystem-15-SP5-2023-4981=1 * Legacy Module 15-SP5 zypper in -t patch SUSE-SLE-Module-Legacy-15-SP5-2023-4981=1 * Server Applications Module 15-SP5 zypper in -t patch SUSE-SLE-Module-Server-Applications-15-SP5-2023-4981=1 ## Package List: * openSUSE Leap 15.5 (aarch64 ppc64le s390x x86_64 i586) * postfix-bdb-debugsource-3.7.3-150500.3.11.1 * postfix-debugsource-3.7.3-150500.3.11.1 * postfix-3.7.3-150500.3.11.1 * postfix-debuginfo-3.7.3-150500.3.11.1 * postfix-ldap-debuginfo-3.7.3-150500.3.11.1 * postfix-postgresql-3.7.3-150500.3.11.1 * postfix-bdb-debuginfo-3.7.3-150500.3.11.1 * postfix-ldap-3.7.3-150500.3.11.1 * postfix-postgresql-debuginfo-3.7.3-150500.3.11.1 * postfix-bdb-lmdb-debuginfo-3.7.3-150500.3.11.1 * postfix-bdb-3.7.3-150500.3.11.1 * postfix-bdb-lmdb-3.7.3-150500.3.11.1 * postfix-devel-3.7.3-150500.3.11.1 * postfix-mysql-3.7.3-150500.3.11.1 * postfix-mysql-debuginfo-3.7.3-150500.3.11.1 * openSUSE Leap 15.5 (noarch) * postfix-doc-3.7.3-150500.3.11.1 * Basesystem Module 15-SP5 (aarch64 ppc64le s390x x86_64) * postfix-debugsource-3.7.3-150500.3.11.1 * postfix-3.7.3-150500.3.11.1 * postfix-debuginfo-3.7.3-150500.3.11.1 * postfix-ldap-debuginfo-3.7.3-150500.3.11.1 * postfix-ldap-3.7.3-150500.3.11.1 * postfix-devel-3.7.3-150500.3.11.1 * Basesystem Module 15-SP5 (noarch) * postfix-doc-3.7.3-150500.3.11.1 * Legacy Module 15-SP5 (aarch64 ppc64le s390x x86_64) * postfix-bdb-debugsource-3.7.3-150500.3.11.1 * postfix-bdb-debuginfo-3.7.3-150500.3.11.1 * postfix-bdb-lmdb-debuginfo-3.7.3-150500.3.11.1 * postfix-bdb-3.7.3-150500.3.11.1 * postfix-bdb-lmdb-3.7.3-150500.3.11.1 * Server Applications Module 15-SP5 (aarch64 ppc64le s390x x86_64) * postfix-debuginfo-3.7.3-150500.3.11.1 * postfix-debugsource-3.7.3-150500.3.11.1 * postfix-mysql-3.7.3-150500.3.11.1 * postfix-mysql-debuginfo-3.7.3-150500.3.11.1 ## References: * https://www.suse.com/security/cve/CVE-2023-51764.html * https://bugzilla.suse.com/show_bug.cgi?id=1218304 * https://bugzilla.suse.com/show_bug.cgi?id=1218314

1 0

openSUSE-SU-2023:0418-1: important: Security update for zabbix
by opensuse-security＠opensuse.org 28 Dec '23

28 Dec '23

openSUSE Security Update: Security update for zabbix ______________________________________________________________________________ Announcement ID: openSUSE-SU-2023:0418-1 Rating: important References: #1218199 Cross-References: CVE-2023-32727 CVSS scores: CVE-2023-32727 (NVD) : 7.2 CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H CVE-2023-32727 (SUSE): 6.8 CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:U/C:H/I:H/A:H Affected Products: openSUSE Backports SLE-15-SP5 ______________________________________________________________________________ An update that fixes one vulnerability is now available. Description: This update for zabbix fixes the following issues: Updated to latest release 4.0.50: - CVE-2023-32727: Fixed potential arbitrary code execution in icmpping (boo#1218199) Patch Instructions: To install this openSUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Backports SLE-15-SP5: zypper in -t patch openSUSE-2023-418=1 Package List: - openSUSE Backports SLE-15-SP5 (aarch64 i586 ppc64le s390x x86_64): zabbix-agent-4.0.50-bp155.3.9.1 zabbix-java-gateway-4.0.50-bp155.3.9.1 zabbix-phpfrontend-4.0.50-bp155.3.9.1 zabbix-proxy-4.0.50-bp155.3.9.1 zabbix-proxy-mysql-4.0.50-bp155.3.9.1 zabbix-proxy-postgresql-4.0.50-bp155.3.9.1 zabbix-proxy-sqlite-4.0.50-bp155.3.9.1 zabbix-server-4.0.50-bp155.3.9.1 zabbix-server-mysql-4.0.50-bp155.3.9.1 zabbix-server-postgresql-4.0.50-bp155.3.9.1 References: https://www.suse.com/security/cve/CVE-2023-32727.html https://bugzilla.suse.com/1218199

1 0

openSUSE-SU-2023:0419-1: important: Security update for zabbix
by opensuse-security＠opensuse.org 28 Dec '23

28 Dec '23

openSUSE Security Update: Security update for zabbix ______________________________________________________________________________ Announcement ID: openSUSE-SU-2023:0419-1 Rating: important References: #1218199 Cross-References: CVE-2023-32727 CVSS scores: CVE-2023-32727 (NVD) : 7.2 CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H CVE-2023-32727 (SUSE): 6.8 CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:U/C:H/I:H/A:H Affected Products: openSUSE Backports SLE-15-SP4 ______________________________________________________________________________ An update that fixes one vulnerability is now available. Description: This update for zabbix fixes the following issues: Updated to latest release 4.0.50: - CVE-2023-32727: Fixed potential arbitrary code execution in icmpping (boo#1218199) Patch Instructions: To install this openSUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Backports SLE-15-SP4: zypper in -t patch openSUSE-2023-419=1 Package List: - openSUSE Backports SLE-15-SP4 (aarch64 i586 ppc64le s390x x86_64): zabbix-agent-4.0.50-bp154.2.9.1 zabbix-java-gateway-4.0.50-bp154.2.9.1 zabbix-phpfrontend-4.0.50-bp154.2.9.1 zabbix-proxy-4.0.50-bp154.2.9.1 zabbix-proxy-mysql-4.0.50-bp154.2.9.1 zabbix-proxy-postgresql-4.0.50-bp154.2.9.1 zabbix-proxy-sqlite-4.0.50-bp154.2.9.1 zabbix-server-4.0.50-bp154.2.9.1 zabbix-server-mysql-4.0.50-bp154.2.9.1 zabbix-server-postgresql-4.0.50-bp154.2.9.1 References: https://www.suse.com/security/cve/CVE-2023-32727.html https://bugzilla.suse.com/1218199

1 0

SUSE-SU-2023:4974-1: moderate: Security update for distribution
by OPENSUSE-SECURITY-UPDATES 26 Dec '23

26 Dec '23

# Security update for distribution Announcement ID: SUSE-SU-2023:4974-1 Rating: moderate References: * bsc#1216491 Affected Products: * Containers Module 15-SP4 * Containers Module 15-SP5 * openSUSE Leap 15.4 * openSUSE Leap 15.5 * SUSE Linux Enterprise High Performance Computing 15 SP4 * SUSE Linux Enterprise High Performance Computing 15 SP5 * SUSE Linux Enterprise Real Time 15 SP4 * SUSE Linux Enterprise Real Time 15 SP5 * SUSE Linux Enterprise Server 15 SP4 * SUSE Linux Enterprise Server 15 SP5 * SUSE Linux Enterprise Server for SAP Applications 15 SP4 * SUSE Linux Enterprise Server for SAP Applications 15 SP5 * SUSE Manager Proxy 4.3 * SUSE Manager Retail Branch Server 4.3 * SUSE Manager Server 4.3 An update that has one security fix can now be installed. ## Description: This update for distribution fixes the following issues: distribution was updated to 2.8.3 (bsc#1216491): * Pass `BUILDTAGS` argument to `go build` * Enable Go build tags * `reference`: replace deprecated function `SplitHostname` * Dont parse errors as JSON unless Content-Type is set to JSON * update to go 1.20.8 * Set `Content-Type` header in registry client `ReadFrom` * deprecate reference package, migrate to github.com/distribution/reference * `digestset`: deprecate package in favor of `go-digest/digestset` * Do not close HTTP request body in HTTP handler ## Patch Instructions: To install this SUSE update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: * openSUSE Leap 15.4 zypper in -t patch openSUSE-SLE-15.4-2023-4974=1 SUSE-2023-4974=1 * openSUSE Leap 15.5 zypper in -t patch openSUSE-SLE-15.5-2023-4974=1 * Containers Module 15-SP4 zypper in -t patch SUSE-SLE-Module-Containers-15-SP4-2023-4974=1 * Containers Module 15-SP5 zypper in -t patch SUSE-SLE-Module-Containers-15-SP5-2023-4974=1 ## Package List: * openSUSE Leap 15.4 (aarch64 ppc64le s390x x86_64 i586) * distribution-registry-2.8.3-150400.9.24.1 * openSUSE Leap 15.5 (aarch64 ppc64le s390x x86_64) * distribution-registry-2.8.3-150400.9.24.1 * Containers Module 15-SP4 (aarch64 ppc64le s390x x86_64) * distribution-registry-2.8.3-150400.9.24.1 * Containers Module 15-SP5 (aarch64 ppc64le s390x x86_64) * distribution-registry-2.8.3-150400.9.24.1 ## References: * https://bugzilla.suse.com/show_bug.cgi?id=1216491

1 0

openSUSE-SU-2023:0413-1: moderate: Security update for cppcheck
by opensuse-security＠opensuse.org 24 Dec '23

24 Dec '23

openSUSE Security Update: Security update for cppcheck ______________________________________________________________________________ Announcement ID: openSUSE-SU-2023:0413-1 Rating: moderate References: #1215233 Cross-References: CVE-2023-39070 CVSS scores: CVE-2023-39070 (NVD) : 7.8 CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H Affected Products: openSUSE Backports SLE-15-SP5 ______________________________________________________________________________ An update that fixes one vulnerability is now available. Description: This update for cppcheck fixes the following issues: - CVE-2023-39070: Fixed heap use-after-free in removeContradiction() (boo#1215233) - update to 2.12.1: * Support importing projects with project-name - update to 2.12.0: * uselessOverride finds overriding functions that either duplicate code from or delegate back to the base class implementation * knownPointerToBool finds pointer to bool conversions that are always true or false * truncLongCastAssignment and truncLongCastReturn check additional types, including float/double/long double * duplInheritedMember also reports duplicated member functions * constParameter*/constVariable* checks find more instances of pointers/references that can be const, e.g. when calling library functions * Write how many checkers was activated after a run * Added --checkers-report that can be used to generate a report in a file that shows what checkers was activated and disabled * The qmake build system has been deprecated and will be removed in a future version. * Command-line option '--template - update to 2.11: * pop_back on empty container is UB * Improve useStlAlgorithm check to handle many more conditions in the loop for any_of, all_of and none_of algorithms * ValueFlow can evaluate the return value of functions even when conditionals are used * ValueFlow will now forward the container sizes being returned from a function * ValueFlow can infer possible values from possible symbolic values * Improve valueflow after pushing to container * The new option --check-level= has been added that controls how much checking is made by Cppcheck. The default checking level is "normal". If you feel that you can wait longer on results you can use --check-level=exhaustive. * It is no longer necessary to run "--check-config" to get detailed "missingInclude" and "missingIncludeSystem" messages. They will always be issued in the regular analysis if "missingInclude" is enabled. * "missingInclude" and "missingIncludeSystem" are reported with "-j" is > 1 and processes are used in the backend (default in non-Windows binaries) * "missingInclude" and "missingIncludeSystem" will now cause the "--error-exitcode" to be applied * "--enable=information" will no longer implicitly enable "missingInclude" starting with 2.16. Please enable it explicitly if you require it. * The `constParameter` and `constVariable` checks have been split into 3 different IDs based on if the variable is a pointer, a reference, or local. The different IDs will allow users to suppress different const warning based on variable type. * `constParameter` * `constParameterReference` * `constParameterPointer` * `constVariable` * `constVariableReference` * `constVariablePointer` * More command-line parameters will now check if the given integer argument is actually valid. Several other internal string-to-integer conversions will now be error checked. * scanning projects (with -j1) will now defer the analysis of markup files until the whole code was processed - update to 2.10.3: * SymbolDatabase: Fix handling of function pointer arguments - update to 2.10.2: * GUI: Set proper title for compliance report dialog * GUI: Generate compliance report * Tokenizer: tweaked simplification of function pointers * fix whole program analysis * Import Project: Fix problem with define value with space * Fix execution of executable addons from GUI * fix for windows installer, no other changes * Fixes when importing AST from clang * comments can be added at end of suppression in suppressions file is similar to GCC. If you want to get warnings in the old * Added Cppcheck annotations cppcheck_low(VALUE) and * Added API01-C: Avoid laying out strings in memory directly * Duplicate expression for condition and assignment: if (x==3) x=3; * Patch was submitted (https://github.com/danmar/cppcheck/pull/1554) and accepted so this change should be reverted and replaced with a CMake compile definition - Multifile checking for buffer overruns and uninitialized - A bunch of additions to several Libraries, especially * Additionally, lots of false positives and bugs have been fixed and several existing checks have been improved. - Library files have now a 'format' attribute. Format version - Cppcheck does no longer abort checking if unhandled - Detect shift by too many bits, signed integer overflow and - Dead pointer usage when pointer alias local variable that - Improved AST creation (support placement new, C++-style - Support GCC extension __attriute__((used)) and MSVC - Better support for static member variables, inherited - Improved typedef support where multiple variables are - Avoid checking code multiple times by calculating a checksum. - HTML report: display 'verbose' message using clickable * Additionally, lots of false positives and bugs have been fixed - Returning references to literals or references to calculation - Enhanced support for commutative operators in duplicate - Definition of minsize for buffer arguments in .cfg files - Fixed handling of #error: Do not report them if -f and -D - Generate xml dump of AST/ValueFlow/SymbolDatabase/TokenList - Cppcheck requires a C++11 compiler supporting the common subset of features supported by GCC 4.4, Visual Studio 2010 - Much improved support of complex combinations of function - More robust error detection in several checks due to usage - Allocation/Deallocation functions can be extend across - Better handling of some C++11 language features like enum - Check for unhandled exceptions when exception specifiers * Additionally, a large number of false positives and crashs has been fixed. - New option to enable warnings but not style messages: - Cppcheck used to skip includes where the header filename is enclosed in <>. You can now include these headers also by using -I. - New POSIX checks: pipe() buffer size, redundant calls of set/get user id, too big value passed to usleep(), buffer - Storing getc() return value in char variable and comparing - Portability check that warns when using NULL as argument to variadic function. It has undefined behaviour on some - Improved checking for uninitialized struct members, - Added --include to the cppcheck command line client. This forces inclusion of the given file. This can for instance be used - The threads handling has been improved. Using -jN now works in - NULL pointers: Improved checking of default function argument values. - full change log http://raw.github.com/danmar/cppcheck/master/Changelog Patch Instructions: To install this openSUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Backports SLE-15-SP5: zypper in -t patch openSUSE-2023-413=1 Package List: - openSUSE Backports SLE-15-SP5 (aarch64 ppc64le s390x x86_64): cppcheck-2.12.1-bp155.2.3.1 cppcheck-gui-2.12.1-bp155.2.3.1 References: https://www.suse.com/security/cve/CVE-2023-39070.html https://bugzilla.suse.com/1215233

1 0