July 2023 - openSUSE Security Announce

SUSE-SU-2023:3013-1: moderate: Security update for openssl-3
by security＠lists.opensuse.org 28 Jul '23

28 Jul '23

# Security update for openssl-3 Announcement ID: SUSE-SU-2023:3013-1 Rating: moderate References: * #1213383 * #1213487 Cross-References: * CVE-2023-2975 * CVE-2023-3446 CVSS scores: * CVE-2023-2975 ( SUSE ): 5.9 CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:N * CVE-2023-2975 ( NVD ): 5.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N * CVE-2023-3446 ( SUSE ): 5.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L Affected Products: * Basesystem Module 15-SP4 * openSUSE Leap 15.4 * SUSE Linux Enterprise Desktop 15 SP4 * SUSE Linux Enterprise High Performance Computing 15 SP4 * SUSE Linux Enterprise Real Time 15 SP4 * SUSE Linux Enterprise Server 15 SP4 * SUSE Linux Enterprise Server for SAP Applications 15 SP4 * SUSE Manager Proxy 4.3 * SUSE Manager Retail Branch Server 4.3 * SUSE Manager Server 4.3 An update that solves two vulnerabilities can now be installed. ## Description: This update for openssl-3 fixes the following issues: * CVE-2023-2975: Fixed AES-SIV implementation ignores empty associated data entries (bsc#1213383). * CVE-2023-3446: Fixed DH_check() excessive time with over sized modulus (bsc#1213487). ## Patch Instructions: To install this SUSE Moderate update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: * openSUSE Leap 15.4 zypper in -t patch SUSE-2023-3013=1 openSUSE-SLE-15.4-2023-3013=1 * Basesystem Module 15-SP4 zypper in -t patch SUSE-SLE-Module-Basesystem-15-SP4-2023-3013=1 ## Package List: * openSUSE Leap 15.4 (aarch64 ppc64le s390x x86_64 i586) * libopenssl3-debuginfo-3.0.8-150400.4.31.2 * libopenssl-3-devel-3.0.8-150400.4.31.2 * openssl-3-debugsource-3.0.8-150400.4.31.2 * openssl-3-3.0.8-150400.4.31.2 * openssl-3-debuginfo-3.0.8-150400.4.31.2 * libopenssl3-3.0.8-150400.4.31.2 * openSUSE Leap 15.4 (x86_64) * libopenssl-3-devel-32bit-3.0.8-150400.4.31.2 * libopenssl3-32bit-3.0.8-150400.4.31.2 * libopenssl3-32bit-debuginfo-3.0.8-150400.4.31.2 * openSUSE Leap 15.4 (noarch) * openssl-3-doc-3.0.8-150400.4.31.2 * openSUSE Leap 15.4 (aarch64_ilp32) * libopenssl3-64bit-debuginfo-3.0.8-150400.4.31.2 * libopenssl-3-devel-64bit-3.0.8-150400.4.31.2 * libopenssl3-64bit-3.0.8-150400.4.31.2 * Basesystem Module 15-SP4 (aarch64 ppc64le s390x x86_64) * libopenssl3-debuginfo-3.0.8-150400.4.31.2 * libopenssl-3-devel-3.0.8-150400.4.31.2 * openssl-3-debugsource-3.0.8-150400.4.31.2 * openssl-3-3.0.8-150400.4.31.2 * openssl-3-debuginfo-3.0.8-150400.4.31.2 * libopenssl3-3.0.8-150400.4.31.2 ## References: * https://www.suse.com/security/cve/CVE-2023-2975.html * https://www.suse.com/security/cve/CVE-2023-3446.html * https://bugzilla.suse.com/show_bug.cgi?id=1213383 * https://bugzilla.suse.com/show_bug.cgi?id=1213487

1 0

SUSE-SU-2023:3002-1: moderate: Security update for go1.20-openssl
by security＠lists.opensuse.org 27 Jul '23

27 Jul '23

# Security update for go1.20-openssl Announcement ID: SUSE-SU-2023:3002-1 Rating: moderate References: * #1206346 * #1213229 Cross-References: * CVE-2023-29406 CVSS scores: * CVE-2023-29406 ( SUSE ): 4.8 CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:N * CVE-2023-29406 ( NVD ): 6.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N Affected Products: * Development Tools Module 15-SP4 * Development Tools Module 15-SP5 * openSUSE Leap 15.4 * openSUSE Leap 15.5 * SUSE Linux Enterprise Desktop 15 SP4 * SUSE Linux Enterprise Desktop 15 SP5 * SUSE Linux Enterprise High Performance Computing 15 SP4 * SUSE Linux Enterprise High Performance Computing 15 SP5 * SUSE Linux Enterprise Real Time 15 SP4 * SUSE Linux Enterprise Real Time 15 SP5 * SUSE Linux Enterprise Server 15 SP4 * SUSE Linux Enterprise Server 15 SP5 * SUSE Linux Enterprise Server for SAP Applications 15 SP4 * SUSE Linux Enterprise Server for SAP Applications 15 SP5 * SUSE Manager Proxy 4.3 * SUSE Manager Retail Branch Server 4.3 * SUSE Manager Server 4.3 An update that solves one vulnerability and has one fix can now be installed. ## Description: This update for go1.20-openssl fixes the following issues: Update to version 1.20.6.1 (bsc#1206346): * CVE-2023-29406: Fixed insufficient sanitization of Host header (bsc#1213229). ## Patch Instructions: To install this SUSE Moderate update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: * openSUSE Leap 15.4 zypper in -t patch openSUSE-SLE-15.4-2023-3002=1 * openSUSE Leap 15.5 zypper in -t patch openSUSE-SLE-15.5-2023-3002=1 * Development Tools Module 15-SP4 zypper in -t patch SUSE-SLE-Module-Development-Tools-15-SP4-2023-3002=1 * Development Tools Module 15-SP5 zypper in -t patch SUSE-SLE-Module-Development-Tools-15-SP5-2023-3002=1 ## Package List: * openSUSE Leap 15.4 (aarch64 ppc64le s390x x86_64) * go1.20-openssl-debuginfo-1.20.6.1-150000.1.8.1 * go1.20-openssl-1.20.6.1-150000.1.8.1 * go1.20-openssl-doc-1.20.6.1-150000.1.8.1 * go1.20-openssl-race-1.20.6.1-150000.1.8.1 * openSUSE Leap 15.5 (aarch64 ppc64le s390x x86_64) * go1.20-openssl-debuginfo-1.20.6.1-150000.1.8.1 * go1.20-openssl-1.20.6.1-150000.1.8.1 * go1.20-openssl-doc-1.20.6.1-150000.1.8.1 * go1.20-openssl-race-1.20.6.1-150000.1.8.1 * Development Tools Module 15-SP4 (aarch64 ppc64le s390x x86_64) * go1.20-openssl-debuginfo-1.20.6.1-150000.1.8.1 * go1.20-openssl-1.20.6.1-150000.1.8.1 * go1.20-openssl-doc-1.20.6.1-150000.1.8.1 * go1.20-openssl-race-1.20.6.1-150000.1.8.1 * Development Tools Module 15-SP5 (aarch64 ppc64le s390x x86_64) * go1.20-openssl-debuginfo-1.20.6.1-150000.1.8.1 * go1.20-openssl-1.20.6.1-150000.1.8.1 * go1.20-openssl-doc-1.20.6.1-150000.1.8.1 * go1.20-openssl-race-1.20.6.1-150000.1.8.1 ## References: * https://www.suse.com/security/cve/CVE-2023-29406.html * https://bugzilla.suse.com/show_bug.cgi?id=1206346 * https://bugzilla.suse.com/show_bug.cgi?id=1213229

1 0

openSUSE-SU-2023:0193-1: important: Security update for chromium
by opensuse-security＠opensuse.org 26 Jul '23

26 Jul '23

openSUSE Security Update: Security update for chromium ______________________________________________________________________________ Announcement ID: openSUSE-SU-2023:0193-1 Rating: important References: #1213462 Cross-References: CVE-2023-3727 CVE-2023-3728 CVE-2023-3730 CVE-2023-3732 CVE-2023-3733 CVE-2023-3734 CVE-2023-3735 CVE-2023-3736 CVE-2023-3737 CVE-2023-3738 CVE-2023-3740 Affected Products: openSUSE Backports SLE-15-SP4 openSUSE Backports SLE-15-SP5 ______________________________________________________________________________ An update that fixes 11 vulnerabilities is now available. Description: This update for chromium fixes the following issues: Chromium 115.0.5790.102: * stability fix Chromium 115.0.5790.98: * Security: The Storage, Service Worker, and Communication APIs are now partitioned in third-party contexts to prevent certain types of side-channel cross-site tracking * HTTPS: Automatically and optimistically upgrade all main-frame navigations to HTTPS, with fast fallback to HTTP. * CSS: accept multiple values of the display property * CSS: support boolean context style container queries * CSS: support scroll-driven animations * Increase the maximum size of a WebAssembly.Module() on the main thread to 8 MB * FedCM: Support credential management mediation requirements for auto re-authentication * Deprecate the document.domain setter * Deprecate mutation events * Security fixes (boo#1213462): - CVE-2023-3727: Use after free in WebRTC - CVE-2023-3728: Use after free in WebRTC - CVE-2023-3730: Use after free in Tab Groups - CVE-2023-3732: Out of bounds memory access in Mojo - CVE-2023-3733: Inappropriate implementation in WebApp Installs - CVE-2023-3734: Inappropriate implementation in Picture In Picture - CVE-2023-3735: Inappropriate implementation in Web API Permission Prompts - CVE-2023-3736: Inappropriate implementation in Custom Tabs - CVE-2023-3737: Inappropriate implementation in Notifications - CVE-2023-3738: Inappropriate implementation in Autofill - CVE-2023-3740: Insufficient validation of untrusted input in Themes - Various fixes from internal audits, fuzzing and other initiatives Patch Instructions: To install this openSUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Backports SLE-15-SP5: zypper in -t patch openSUSE-2023-193=1 - openSUSE Backports SLE-15-SP4: zypper in -t patch openSUSE-2023-193=1 Package List: - openSUSE Backports SLE-15-SP5 (aarch64 x86_64): chromedriver-115.0.5790.102-bp155.2.13.1 chromedriver-debuginfo-115.0.5790.102-bp155.2.13.1 chromium-115.0.5790.102-bp155.2.13.1 chromium-debuginfo-115.0.5790.102-bp155.2.13.1 - openSUSE Backports SLE-15-SP4 (aarch64 x86_64): chromedriver-115.0.5790.102-bp154.2.99.1 chromium-115.0.5790.102-bp154.2.99.1 References: https://www.suse.com/security/cve/CVE-2023-3727.html https://www.suse.com/security/cve/CVE-2023-3728.html https://www.suse.com/security/cve/CVE-2023-3730.html https://www.suse.com/security/cve/CVE-2023-3732.html https://www.suse.com/security/cve/CVE-2023-3733.html https://www.suse.com/security/cve/CVE-2023-3734.html https://www.suse.com/security/cve/CVE-2023-3735.html https://www.suse.com/security/cve/CVE-2023-3736.html https://www.suse.com/security/cve/CVE-2023-3737.html https://www.suse.com/security/cve/CVE-2023-3738.html https://www.suse.com/security/cve/CVE-2023-3740.html https://bugzilla.suse.com/1213462

1 0

SUSE-SU-2023:2987-1: important: Security update for iperf
by security＠lists.opensuse.org 26 Jul '23

26 Jul '23

# Security update for iperf Announcement ID: SUSE-SU-2023:2987-1 Rating: important References: * #1213430 Cross-References: * CVE-2023-38403 CVSS scores: * CVE-2023-38403 ( SUSE ): 7.4 CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:H Affected Products: * openSUSE Leap 15.4 * openSUSE Leap 15.5 * SUSE Enterprise Storage 7 * SUSE Enterprise Storage 7.1 * SUSE Linux Enterprise Desktop 15 SP4 * SUSE Linux Enterprise Desktop 15 SP5 * SUSE Linux Enterprise High Performance Computing 15 SP4 * SUSE Linux Enterprise High Performance Computing 15 SP5 * SUSE Linux Enterprise Micro 5.3 * SUSE Linux Enterprise Micro 5.4 * SUSE Linux Enterprise Real Time 15 SP4 * SUSE Linux Enterprise Real Time 15 SP5 * SUSE Linux Enterprise Server 15 SP2 * SUSE Linux Enterprise Server 15 SP3 * SUSE Linux Enterprise Server 15 SP4 * SUSE Linux Enterprise Server 15 SP5 * SUSE Linux Enterprise Server for SAP Applications 15 SP4 * SUSE Linux Enterprise Server for SAP Applications 15 SP5 * SUSE Manager Proxy 4.3 * SUSE Manager Retail Branch Server 4.3 * SUSE Manager Server 4.3 * SUSE Package Hub 15 15-SP4 * SUSE Package Hub 15 15-SP5 An update that solves one vulnerability can now be installed. ## Description: This update for iperf fixes the following issues: * CVE-2023-38403: Fixed integer overflow leading to heap buffer overflow (bsc#1213430). ## Patch Instructions: To install this SUSE Important update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: * openSUSE Leap 15.4 zypper in -t patch openSUSE-SLE-15.4-2023-2987=1 * openSUSE Leap 15.5 zypper in -t patch openSUSE-SLE-15.5-2023-2987=1 * SUSE Package Hub 15 15-SP4 zypper in -t patch SUSE-SLE-Module-Packagehub-Subpackages-15-SP4-2023-2987=1 * SUSE Package Hub 15 15-SP5 zypper in -t patch SUSE-SLE-Module-Packagehub-Subpackages-15-SP5-2023-2987=1 * SUSE Enterprise Storage 7.1 zypper in -t patch SUSE-Storage-7.1-2023-2987=1 * SUSE Enterprise Storage 7 zypper in -t patch SUSE-Storage-7-2023-2987=1 ## Package List: * openSUSE Leap 15.4 (aarch64 ppc64le s390x x86_64) * iperf-debuginfo-3.5-150000.3.3.1 * libiperf0-debuginfo-3.5-150000.3.3.1 * iperf-3.5-150000.3.3.1 * iperf-devel-3.5-150000.3.3.1 * libiperf0-3.5-150000.3.3.1 * iperf-debugsource-3.5-150000.3.3.1 * openSUSE Leap 15.5 (aarch64 ppc64le s390x x86_64) * iperf-debuginfo-3.5-150000.3.3.1 * libiperf0-debuginfo-3.5-150000.3.3.1 * iperf-3.5-150000.3.3.1 * iperf-devel-3.5-150000.3.3.1 * libiperf0-3.5-150000.3.3.1 * iperf-debugsource-3.5-150000.3.3.1 * SUSE Package Hub 15 15-SP4 (aarch64 ppc64le s390x x86_64) * iperf-debuginfo-3.5-150000.3.3.1 * libiperf0-debuginfo-3.5-150000.3.3.1 * iperf-3.5-150000.3.3.1 * iperf-devel-3.5-150000.3.3.1 * libiperf0-3.5-150000.3.3.1 * iperf-debugsource-3.5-150000.3.3.1 * SUSE Package Hub 15 15-SP5 (aarch64 ppc64le s390x x86_64) * iperf-debuginfo-3.5-150000.3.3.1 * libiperf0-debuginfo-3.5-150000.3.3.1 * iperf-3.5-150000.3.3.1 * iperf-devel-3.5-150000.3.3.1 * libiperf0-3.5-150000.3.3.1 * iperf-debugsource-3.5-150000.3.3.1 * SUSE Enterprise Storage 7.1 (aarch64 x86_64) * iperf-debuginfo-3.5-150000.3.3.1 * libiperf0-debuginfo-3.5-150000.3.3.1 * iperf-3.5-150000.3.3.1 * libiperf0-3.5-150000.3.3.1 * iperf-debugsource-3.5-150000.3.3.1 * SUSE Enterprise Storage 7 (aarch64 x86_64) * iperf-debuginfo-3.5-150000.3.3.1 * libiperf0-debuginfo-3.5-150000.3.3.1 * iperf-3.5-150000.3.3.1 * libiperf0-3.5-150000.3.3.1 * iperf-debugsource-3.5-150000.3.3.1 ## References: * https://www.suse.com/security/cve/CVE-2023-38403.html * https://bugzilla.suse.com/show_bug.cgi?id=1213430

1 0

SUSE-SU-2023:2988-1: important: Security update for conmon
by security＠lists.opensuse.org 26 Jul '23

26 Jul '23

# Security update for conmon Announcement ID: SUSE-SU-2023:2988-1 Rating: important References: * #1208737 * #1209307 Affected Products: * Containers Module 15-SP5 * openSUSE Leap 15.5 * SUSE Linux Enterprise High Performance Computing 15 SP5 * SUSE Linux Enterprise Real Time 15 SP5 * SUSE Linux Enterprise Server 15 SP5 * SUSE Linux Enterprise Server for SAP Applications 15 SP5 An update that has two fixes can now be installed. ## Description: This update for conmon fixes the following issues: conmon was updated to version 2.1.7: * Bumped go version to 1.19 (bsc#1209307). Bugfixes: * Fixed leaking symbolic links in the opt_socket_path directory * Fixed oom handling issues (bsc#1208737). * Fixed OOM watcher for cgroupv2 `oom_kill` events ## Patch Instructions: To install this SUSE Important update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: * openSUSE Leap 15.5 zypper in -t patch SUSE-2023-2988=1 openSUSE-SLE-15.5-2023-2988=1 * Containers Module 15-SP5 zypper in -t patch SUSE-SLE-Module-Containers-15-SP5-2023-2988=1 ## Package List: * openSUSE Leap 15.5 (aarch64 ppc64le s390x x86_64 i586) * conmon-debuginfo-2.1.7-150500.9.3.1 * conmon-2.1.7-150500.9.3.1 * Containers Module 15-SP5 (aarch64 ppc64le s390x x86_64) * conmon-debuginfo-2.1.7-150500.9.3.1 * conmon-2.1.7-150500.9.3.1 ## References: * https://bugzilla.suse.com/show_bug.cgi?id=1208737 * https://bugzilla.suse.com/show_bug.cgi?id=1209307

1 0

SUSE-SU-2023:2989-1: important: Security update for conmon
by security＠lists.opensuse.org 26 Jul '23

26 Jul '23

# Security update for conmon Announcement ID: SUSE-SU-2023:2989-1 Rating: important References: * #1208737 * #1209307 Affected Products: * Containers Module 15-SP4 * openSUSE Leap 15.4 * openSUSE Leap Micro 5.3 * openSUSE Leap Micro 5.4 * SUSE Linux Enterprise High Performance Computing 15 SP4 * SUSE Linux Enterprise Micro 5.3 * SUSE Linux Enterprise Micro 5.4 * SUSE Linux Enterprise Micro for Rancher 5.3 * SUSE Linux Enterprise Micro for Rancher 5.4 * SUSE Linux Enterprise Real Time 15 SP4 * SUSE Linux Enterprise Server 15 SP4 * SUSE Linux Enterprise Server for SAP Applications 15 SP4 * SUSE Manager Proxy 4.3 * SUSE Manager Retail Branch Server 4.3 * SUSE Manager Server 4.3 An update that has two fixes can now be installed. ## Description: This update for conmon fixes the following issues: conmon was updated to version 2.1.7: * Bumped go version to 1.19 (bsc#1209307). Bugfixes: * Fixed leaking symbolic links in the opt_socket_path directory. * Fixed cgroup oom issues (bsc#1208737). * Fixed OOM watcher for cgroupv2 `oom_kill` events. ## Patch Instructions: To install this SUSE Important update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: * openSUSE Leap 15.4 zypper in -t patch openSUSE-SLE-15.4-2023-2989=1 SUSE-2023-2989=1 * openSUSE Leap Micro 5.3 zypper in -t patch openSUSE-Leap-Micro-5.3-2023-2989=1 * openSUSE Leap Micro 5.4 zypper in -t patch openSUSE-Leap-Micro-5.4-2023-2989=1 * SUSE Linux Enterprise Micro for Rancher 5.3 zypper in -t patch SUSE-SLE-Micro-5.3-2023-2989=1 * SUSE Linux Enterprise Micro 5.3 zypper in -t patch SUSE-SLE-Micro-5.3-2023-2989=1 * SUSE Linux Enterprise Micro for Rancher 5.4 zypper in -t patch SUSE-SLE-Micro-5.4-2023-2989=1 * SUSE Linux Enterprise Micro 5.4 zypper in -t patch SUSE-SLE-Micro-5.4-2023-2989=1 * Containers Module 15-SP4 zypper in -t patch SUSE-SLE-Module-Containers-15-SP4-2023-2989=1 ## Package List: * openSUSE Leap 15.4 (aarch64 ppc64le s390x x86_64 i586) * conmon-debuginfo-2.1.7-150400.3.11.1 * conmon-2.1.7-150400.3.11.1 * openSUSE Leap Micro 5.3 (aarch64 x86_64) * conmon-debuginfo-2.1.7-150400.3.11.1 * conmon-2.1.7-150400.3.11.1 * openSUSE Leap Micro 5.4 (aarch64 s390x x86_64) * conmon-debuginfo-2.1.7-150400.3.11.1 * conmon-2.1.7-150400.3.11.1 * SUSE Linux Enterprise Micro for Rancher 5.3 (aarch64 s390x x86_64) * conmon-debuginfo-2.1.7-150400.3.11.1 * conmon-2.1.7-150400.3.11.1 * SUSE Linux Enterprise Micro 5.3 (aarch64 s390x x86_64) * conmon-debuginfo-2.1.7-150400.3.11.1 * conmon-2.1.7-150400.3.11.1 * SUSE Linux Enterprise Micro for Rancher 5.4 (aarch64 s390x x86_64) * conmon-debuginfo-2.1.7-150400.3.11.1 * conmon-2.1.7-150400.3.11.1 * SUSE Linux Enterprise Micro 5.4 (aarch64 s390x x86_64) * conmon-debuginfo-2.1.7-150400.3.11.1 * conmon-2.1.7-150400.3.11.1 * Containers Module 15-SP4 (aarch64 ppc64le s390x x86_64) * conmon-debuginfo-2.1.7-150400.3.11.1 * conmon-2.1.7-150400.3.11.1 ## References: * https://bugzilla.suse.com/show_bug.cgi?id=1208737 * https://bugzilla.suse.com/show_bug.cgi?id=1209307

1 0

SUSE-SU-2023:2974-1: moderate: Security update for netty, netty-tcnative
by security＠lists.opensuse.org 26 Jul '23

26 Jul '23

# Security update for netty, netty-tcnative Announcement ID: SUSE-SU-2023:2974-1 Rating: moderate References: * #1212637 Cross-References: * CVE-2023-34462 CVSS scores: * CVE-2023-34462 ( SUSE ): 6.5 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H * CVE-2023-34462 ( NVD ): 6.5 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H Affected Products: * Development Tools Module 15-SP4 * Development Tools Module 15-SP5 * openSUSE Leap 15.4 * openSUSE Leap 15.5 * SUSE Linux Enterprise Desktop 15 SP4 * SUSE Linux Enterprise Desktop 15 SP5 * SUSE Linux Enterprise High Performance Computing 15 SP4 * SUSE Linux Enterprise High Performance Computing 15 SP5 * SUSE Linux Enterprise Real Time 15 SP3 * SUSE Linux Enterprise Real Time 15 SP4 * SUSE Linux Enterprise Real Time 15 SP5 * SUSE Linux Enterprise Server 15 SP4 * SUSE Linux Enterprise Server 15 SP5 * SUSE Linux Enterprise Server for SAP Applications 15 SP4 * SUSE Linux Enterprise Server for SAP Applications 15 SP5 * SUSE Manager Proxy 4.3 * SUSE Manager Retail Branch Server 4.3 * SUSE Manager Server 4.3 * SUSE Package Hub 15 15-SP5 An update that solves one vulnerability can now be installed. ## Description: This update for netty, netty-tcnative fixes the following issues: Upgrade to upstream version 4.1.94: * CVE-2023-34462: Allow to limit the maximum lenght of the ClientHello (bsc#1212637). ## Patch Instructions: To install this SUSE Moderate update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: * openSUSE Leap 15.4 zypper in -t patch openSUSE-SLE-15.4-2023-2974=1 * openSUSE Leap 15.5 zypper in -t patch openSUSE-SLE-15.5-2023-2974=1 * Development Tools Module 15-SP4 zypper in -t patch SUSE-SLE-Module-Development-Tools-15-SP4-2023-2974=1 * Development Tools Module 15-SP5 zypper in -t patch SUSE-SLE-Module-Development-Tools-15-SP5-2023-2974=1 * SUSE Package Hub 15 15-SP5 zypper in -t patch SUSE-SLE-Module-Packagehub-Subpackages-15-SP5-2023-2974=1 * SUSE Linux Enterprise Real Time 15 SP3 zypper in -t patch SUSE-SLE-Product-RT-15-SP3-2023-2974=1 ## Package List: * openSUSE Leap 15.4 (aarch64 ppc64le s390x x86_64) * netty-tcnative-2.0.61-150200.3.13.1 * netty-4.1.94-150200.4.17.1 * openSUSE Leap 15.4 (noarch) * netty-tcnative-javadoc-2.0.61-150200.3.13.1 * netty-poms-4.1.94-150200.4.17.1 * netty-javadoc-4.1.94-150200.4.17.1 * openSUSE Leap 15.5 (aarch64 ppc64le s390x x86_64) * netty-tcnative-2.0.61-150200.3.13.1 * netty-4.1.94-150200.4.17.1 * openSUSE Leap 15.5 (noarch) * netty-tcnative-javadoc-2.0.61-150200.3.13.1 * netty-poms-4.1.94-150200.4.17.1 * netty-javadoc-4.1.94-150200.4.17.1 * Development Tools Module 15-SP4 (aarch64 ppc64le s390x x86_64) * netty-tcnative-2.0.61-150200.3.13.1 * Development Tools Module 15-SP5 (aarch64 ppc64le s390x x86_64) * netty-tcnative-2.0.61-150200.3.13.1 * SUSE Package Hub 15 15-SP5 (aarch64 ppc64le s390x x86_64) * netty-4.1.94-150200.4.17.1 * SUSE Package Hub 15 15-SP5 (noarch) * netty-poms-4.1.94-150200.4.17.1 * netty-javadoc-4.1.94-150200.4.17.1 * SUSE Linux Enterprise Real Time 15 SP3 (x86_64) * netty-tcnative-2.0.61-150200.3.13.1 ## References: * https://www.suse.com/security/cve/CVE-2023-34462.html * https://bugzilla.suse.com/show_bug.cgi?id=1212637

1 0

SUSE-SU-2023:2979-1: moderate: Security update for mysql-connector-java
by security＠lists.opensuse.org 26 Jul '23

26 Jul '23

# Security update for mysql-connector-java Announcement ID: SUSE-SU-2023:2979-1 Rating: moderate References: * #1211247 Cross-References: * CVE-2023-21971 CVSS scores: * CVE-2023-21971 ( SUSE ): 5.3 CVSS:3.1/AV:N/AC:H/PR:H/UI:R/S:U/C:L/I:L/A:H * CVE-2023-21971 ( NVD ): 5.3 CVSS:3.1/AV:N/AC:H/PR:H/UI:R/S:U/C:L/I:L/A:H Affected Products: * openSUSE Leap 15.4 * openSUSE Leap 15.5 An update that solves one vulnerability can now be installed. ## Description: This update for mysql-connector-java fixes the following issues: * CVE-2023-21971: Fixed a denial-of-service vulnerability in the java.sql.DriverManager.getConnection() method when used with untrusted inputs (bsc#1211247). ## Patch Instructions: To install this SUSE Moderate update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: * openSUSE Leap 15.4 zypper in -t patch openSUSE-SLE-15.4-2023-2979=1 * openSUSE Leap 15.5 zypper in -t patch openSUSE-SLE-15.5-2023-2979=1 ## Package List: * openSUSE Leap 15.4 (noarch) * mysql-connector-java-8.0.33-150200.3.18.1 * openSUSE Leap 15.5 (noarch) * mysql-connector-java-8.0.33-150200.3.18.1 ## References: * https://www.suse.com/security/cve/CVE-2023-21971.html * https://bugzilla.suse.com/show_bug.cgi?id=1211247

1 0

SUSE-SU-2023:2980-1: moderate: Security update for php7
by security＠lists.opensuse.org 26 Jul '23

26 Jul '23

# Security update for php7 Announcement ID: SUSE-SU-2023:2980-1 Rating: moderate References: * #1212349 Cross-References: * CVE-2023-3247 CVSS scores: * CVE-2023-3247 ( SUSE ): 5.3 CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:N/A:N * CVE-2023-3247 ( NVD ): 2.6 CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:U/C:L/I:N/A:N Affected Products: * openSUSE Leap 15.4 * SUSE Manager Server 4.2 An update that solves one vulnerability can now be installed. ## Description: This update for php7 fixes the following issues: * CVE-2023-3247: Fixed missing error check and insufficient random bytes in HTTP Digest authentication for SOAP (bsc#1212349). ## Patch Instructions: To install this SUSE Moderate update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: * SUSE Manager Server 4.2 zypper in -t patch SUSE-SLE-Product-SUSE-Manager-Server-4.2-2023-2980=1 * openSUSE Leap 15.4 zypper in -t patch openSUSE-SLE-15.4-2023-2980=1 ## Package List: * SUSE Manager Server 4.2 (ppc64le s390x x86_64) * php7-mysql-7.4.33-150200.3.57.1 * php7-odbc-7.4.33-150200.3.57.1 * php7-fastcgi-debuginfo-7.4.33-150200.3.57.1 * php7-ldap-debuginfo-7.4.33-150200.3.57.1 * php7-debugsource-7.4.33-150200.3.57.1 * php7-xmlreader-7.4.33-150200.3.57.1 * php7-enchant-debuginfo-7.4.33-150200.3.57.1 * php7-enchant-7.4.33-150200.3.57.1 * php7-mbstring-7.4.33-150200.3.57.1 * php7-mysql-debuginfo-7.4.33-150200.3.57.1 * php7-sqlite-debuginfo-7.4.33-150200.3.57.1 * php7-dba-debuginfo-7.4.33-150200.3.57.1 * php7-7.4.33-150200.3.57.1 * php7-xmlrpc-7.4.33-150200.3.57.1 * php7-ctype-7.4.33-150200.3.57.1 * php7-intl-debuginfo-7.4.33-150200.3.57.1 * php7-sysvmsg-debuginfo-7.4.33-150200.3.57.1 * php7-sockets-7.4.33-150200.3.57.1 * php7-gmp-7.4.33-150200.3.57.1 * php7-phar-debuginfo-7.4.33-150200.3.57.1 * php7-bz2-debuginfo-7.4.33-150200.3.57.1 * php7-iconv-7.4.33-150200.3.57.1 * php7-calendar-debuginfo-7.4.33-150200.3.57.1 * php7-pdo-7.4.33-150200.3.57.1 * php7-sqlite-7.4.33-150200.3.57.1 * php7-fpm-7.4.33-150200.3.57.1 * php7-iconv-debuginfo-7.4.33-150200.3.57.1 * php7-openssl-debuginfo-7.4.33-150200.3.57.1 * php7-ldap-7.4.33-150200.3.57.1 * php7-tokenizer-7.4.33-150200.3.57.1 * php7-soap-debuginfo-7.4.33-150200.3.57.1 * php7-zip-debuginfo-7.4.33-150200.3.57.1 * php7-curl-debuginfo-7.4.33-150200.3.57.1 * php7-dom-debuginfo-7.4.33-150200.3.57.1 * php7-xsl-debuginfo-7.4.33-150200.3.57.1 * php7-openssl-7.4.33-150200.3.57.1 * php7-json-debuginfo-7.4.33-150200.3.57.1 * php7-exif-7.4.33-150200.3.57.1 * php7-gmp-debuginfo-7.4.33-150200.3.57.1 * php7-opcache-7.4.33-150200.3.57.1 * php7-sysvshm-debuginfo-7.4.33-150200.3.57.1 * php7-curl-7.4.33-150200.3.57.1 * php7-fileinfo-debuginfo-7.4.33-150200.3.57.1 * php7-ftp-debuginfo-7.4.33-150200.3.57.1 * php7-gd-7.4.33-150200.3.57.1 * php7-sysvshm-7.4.33-150200.3.57.1 * php7-bcmath-debuginfo-7.4.33-150200.3.57.1 * php7-pgsql-debuginfo-7.4.33-150200.3.57.1 * php7-pdo-debuginfo-7.4.33-150200.3.57.1 * php7-xsl-7.4.33-150200.3.57.1 * php7-odbc-debuginfo-7.4.33-150200.3.57.1 * php7-fastcgi-7.4.33-150200.3.57.1 * php7-posix-7.4.33-150200.3.57.1 * php7-json-7.4.33-150200.3.57.1 * php7-mbstring-debuginfo-7.4.33-150200.3.57.1 * apache2-mod_php7-7.4.33-150200.3.57.1 * php7-pcntl-7.4.33-150200.3.57.1 * php7-xmlreader-debuginfo-7.4.33-150200.3.57.1 * php7-sodium-7.4.33-150200.3.57.1 * php7-dba-7.4.33-150200.3.57.1 * php7-posix-debuginfo-7.4.33-150200.3.57.1 * php7-shmop-7.4.33-150200.3.57.1 * php7-snmp-debuginfo-7.4.33-150200.3.57.1 * php7-devel-7.4.33-150200.3.57.1 * php7-sysvmsg-7.4.33-150200.3.57.1 * php7-tokenizer-debuginfo-7.4.33-150200.3.57.1 * php7-sysvsem-debuginfo-7.4.33-150200.3.57.1 * php7-xmlwriter-debuginfo-7.4.33-150200.3.57.1 * php7-zlib-debuginfo-7.4.33-150200.3.57.1 * php7-intl-7.4.33-150200.3.57.1 * php7-calendar-7.4.33-150200.3.57.1 * php7-fpm-debuginfo-7.4.33-150200.3.57.1 * php7-xmlrpc-debuginfo-7.4.33-150200.3.57.1 * php7-readline-debuginfo-7.4.33-150200.3.57.1 * php7-snmp-7.4.33-150200.3.57.1 * php7-exif-debuginfo-7.4.33-150200.3.57.1 * php7-ftp-7.4.33-150200.3.57.1 * php7-bz2-7.4.33-150200.3.57.1 * php7-dom-7.4.33-150200.3.57.1 * php7-phar-7.4.33-150200.3.57.1 * php7-xmlwriter-7.4.33-150200.3.57.1 * php7-pgsql-7.4.33-150200.3.57.1 * php7-opcache-debuginfo-7.4.33-150200.3.57.1 * php7-fileinfo-7.4.33-150200.3.57.1 * php7-bcmath-7.4.33-150200.3.57.1 * php7-soap-7.4.33-150200.3.57.1 * php7-debuginfo-7.4.33-150200.3.57.1 * php7-zip-7.4.33-150200.3.57.1 * php7-sockets-debuginfo-7.4.33-150200.3.57.1 * php7-gettext-debuginfo-7.4.33-150200.3.57.1 * php7-ctype-debuginfo-7.4.33-150200.3.57.1 * php7-sysvsem-7.4.33-150200.3.57.1 * php7-tidy-7.4.33-150200.3.57.1 * php7-zlib-7.4.33-150200.3.57.1 * php7-pcntl-debuginfo-7.4.33-150200.3.57.1 * php7-gettext-7.4.33-150200.3.57.1 * php7-sodium-debuginfo-7.4.33-150200.3.57.1 * php7-shmop-debuginfo-7.4.33-150200.3.57.1 * php7-gd-debuginfo-7.4.33-150200.3.57.1 * php7-tidy-debuginfo-7.4.33-150200.3.57.1 * apache2-mod_php7-debuginfo-7.4.33-150200.3.57.1 * php7-readline-7.4.33-150200.3.57.1 * openSUSE Leap 15.4 (aarch64 ppc64le s390x x86_64) * php7-firebird-debuginfo-7.4.33-150200.3.57.1 * php7-firebird-7.4.33-150200.3.57.1 ## References: * https://www.suse.com/security/cve/CVE-2023-3247.html * https://bugzilla.suse.com/show_bug.cgi?id=1212349

1 0

SUSE-SU-2023:2981-1: moderate: Security update for libqt5-qtsvg
by security＠lists.opensuse.org 26 Jul '23

26 Jul '23

# Security update for libqt5-qtsvg Announcement ID: SUSE-SU-2023:2981-1 Rating: moderate References: * #1196654 * #1211298 Cross-References: * CVE-2021-45930 * CVE-2023-32573 CVSS scores: * CVE-2021-45930 ( SUSE ): 5.5 CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H * CVE-2021-45930 ( NVD ): 5.5 CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H * CVE-2023-32573 ( SUSE ): 4.4 CVSS:3.1/AV:L/AC:H/PR:L/UI:R/S:U/C:N/I:N/A:H * CVE-2023-32573 ( NVD ): 6.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H Affected Products: * Basesystem Module 15-SP4 * Desktop Applications Module 15-SP4 * openSUSE Leap 15.4 * SUSE Linux Enterprise Desktop 15 SP4 * SUSE Linux Enterprise High Performance Computing 15 SP4 * SUSE Linux Enterprise Real Time 15 SP4 * SUSE Linux Enterprise Server 15 SP4 * SUSE Linux Enterprise Server for SAP Applications 15 SP4 * SUSE Manager Proxy 4.3 * SUSE Manager Retail Branch Server 4.3 * SUSE Manager Server 4.3 An update that solves two vulnerabilities can now be installed. ## Description: This update for libqt5-qtsvg fixes the following issues: * CVE-2021-45930: Fixed an out-of-bounds write that may have lead to a denial- of-service (bsc#1196654). * CVE-2023-32573: Fixed missing initialization of QtSvg QSvgFont m_unitsPerEm variable (bsc#1211298). ## Patch Instructions: To install this SUSE Moderate update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: * openSUSE Leap 15.4 zypper in -t patch SUSE-2023-2981=1 openSUSE-SLE-15.4-2023-2981=1 * Basesystem Module 15-SP4 zypper in -t patch SUSE-SLE-Module-Basesystem-15-SP4-2023-2981=1 * Desktop Applications Module 15-SP4 zypper in -t patch SUSE-SLE-Module-Desktop-Applications-15-SP4-2023-2981=1 ## Package List: * openSUSE Leap 15.4 (x86_64) * libQt5Svg5-32bit-5.15.2+kde16-150400.3.3.1 * libqt5-qtsvg-devel-32bit-5.15.2+kde16-150400.3.3.1 * libQt5Svg5-32bit-debuginfo-5.15.2+kde16-150400.3.3.1 * openSUSE Leap 15.4 (aarch64 ppc64le s390x x86_64 i586) * libqt5-qtsvg-examples-debuginfo-5.15.2+kde16-150400.3.3.1 * libqt5-qtsvg-devel-5.15.2+kde16-150400.3.3.1 * libqt5-qtsvg-examples-5.15.2+kde16-150400.3.3.1 * libqt5-qtsvg-debugsource-5.15.2+kde16-150400.3.3.1 * libQt5Svg5-5.15.2+kde16-150400.3.3.1 * libQt5Svg5-debuginfo-5.15.2+kde16-150400.3.3.1 * openSUSE Leap 15.4 (noarch) * libqt5-qtsvg-private-headers-devel-5.15.2+kde16-150400.3.3.1 * openSUSE Leap 15.4 (aarch64_ilp32) * libQt5Svg5-64bit-5.15.2+kde16-150400.3.3.1 * libQt5Svg5-64bit-debuginfo-5.15.2+kde16-150400.3.3.1 * libqt5-qtsvg-devel-64bit-5.15.2+kde16-150400.3.3.1 * Basesystem Module 15-SP4 (aarch64 ppc64le s390x x86_64) * libqt5-qtsvg-devel-5.15.2+kde16-150400.3.3.1 * libQt5Svg5-5.15.2+kde16-150400.3.3.1 * libQt5Svg5-debuginfo-5.15.2+kde16-150400.3.3.1 * libqt5-qtsvg-debugsource-5.15.2+kde16-150400.3.3.1 * Desktop Applications Module 15-SP4 (noarch) * libqt5-qtsvg-private-headers-devel-5.15.2+kde16-150400.3.3.1 ## References: * https://www.suse.com/security/cve/CVE-2021-45930.html * https://www.suse.com/security/cve/CVE-2023-32573.html * https://bugzilla.suse.com/show_bug.cgi?id=1196654 * https://bugzilla.suse.com/show_bug.cgi?id=1211298

1 0