August 2023 - openSUSE Security Announce

SUSE-SU-2023:3447-1: moderate: Security update for xen
by security＠lists.opensuse.org 28 Aug '23

28 Aug '23

# Security update for xen Announcement ID: SUSE-SU-2023:3447-1 Rating: moderate References: * #1027519 * #1212684 * #1213616 * #1214082 * #1214083 Cross-References: * CVE-2022-40982 * CVE-2023-20569 * CVE-2023-20593 CVSS scores: * CVE-2022-40982 ( SUSE ): 6.2 CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N * CVE-2022-40982 ( NVD ): 6.5 CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N * CVE-2023-20569 ( SUSE ): 5.6 CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:C/C:H/I:N/A:N * CVE-2023-20569 ( NVD ): 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N * CVE-2023-20593 ( SUSE ): 6.2 CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N * CVE-2023-20593 ( NVD ): 5.5 CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N Affected Products: * Basesystem Module 15-SP5 * openSUSE Leap 15.5 * Server Applications Module 15-SP5 * SUSE Linux Enterprise Desktop 15 SP5 * SUSE Linux Enterprise High Performance Computing 15 SP5 * SUSE Linux Enterprise Real Time 15 SP5 * SUSE Linux Enterprise Server 15 SP5 * SUSE Linux Enterprise Server for SAP Applications 15 SP5 An update that solves three vulnerabilities and has two fixes can now be installed. ## Description: This update for xen fixes the following issues: * CVE-2023-20569: Fixed side channel attack Inception or RAS Poisoning. (bsc#1214082, XSA-434) * CVE-2022-40982: Fixed transient execution attack called "Gather Data Sampling". (bsc#1214083, XSA-435) * CVE-2023-20593: Fixed a ZenBleed issue in "Zen 2" CPUs that could allow an attacker to potentially access sensitive information. (bsc#1213616, XSA-433) ## Patch Instructions: To install this SUSE Moderate update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: * Server Applications Module 15-SP5 zypper in -t patch SUSE-SLE-Module-Server-Applications-15-SP5-2023-3447=1 * openSUSE Leap 15.5 zypper in -t patch SUSE-2023-3447=1 openSUSE-SLE-15.5-2023-3447=1 * Basesystem Module 15-SP5 zypper in -t patch SUSE-SLE-Module-Basesystem-15-SP5-2023-3447=1 ## Package List: * Server Applications Module 15-SP5 (x86_64) * xen-tools-debuginfo-4.17.2_02-150500.3.6.1 * xen-tools-4.17.2_02-150500.3.6.1 * xen-devel-4.17.2_02-150500.3.6.1 * xen-debugsource-4.17.2_02-150500.3.6.1 * xen-4.17.2_02-150500.3.6.1 * Server Applications Module 15-SP5 (noarch) * xen-tools-xendomains-wait-disk-4.17.2_02-150500.3.6.1 * openSUSE Leap 15.5 (aarch64 x86_64 i586) * xen-libs-4.17.2_02-150500.3.6.1 * xen-tools-domU-debuginfo-4.17.2_02-150500.3.6.1 * xen-devel-4.17.2_02-150500.3.6.1 * xen-tools-domU-4.17.2_02-150500.3.6.1 * xen-libs-debuginfo-4.17.2_02-150500.3.6.1 * xen-debugsource-4.17.2_02-150500.3.6.1 * openSUSE Leap 15.5 (x86_64) * xen-libs-32bit-debuginfo-4.17.2_02-150500.3.6.1 * xen-libs-32bit-4.17.2_02-150500.3.6.1 * openSUSE Leap 15.5 (aarch64 x86_64) * xen-4.17.2_02-150500.3.6.1 * xen-tools-debuginfo-4.17.2_02-150500.3.6.1 * xen-tools-4.17.2_02-150500.3.6.1 * xen-doc-html-4.17.2_02-150500.3.6.1 * openSUSE Leap 15.5 (noarch) * xen-tools-xendomains-wait-disk-4.17.2_02-150500.3.6.1 * openSUSE Leap 15.5 (aarch64_ilp32) * xen-libs-64bit-debuginfo-4.17.2_02-150500.3.6.1 * xen-libs-64bit-4.17.2_02-150500.3.6.1 * Basesystem Module 15-SP5 (x86_64) * xen-libs-4.17.2_02-150500.3.6.1 * xen-tools-domU-debuginfo-4.17.2_02-150500.3.6.1 * xen-tools-domU-4.17.2_02-150500.3.6.1 * xen-debugsource-4.17.2_02-150500.3.6.1 * xen-libs-debuginfo-4.17.2_02-150500.3.6.1 ## References: * https://www.suse.com/security/cve/CVE-2022-40982.html * https://www.suse.com/security/cve/CVE-2023-20569.html * https://www.suse.com/security/cve/CVE-2023-20593.html * https://bugzilla.suse.com/show_bug.cgi?id=1027519 * https://bugzilla.suse.com/show_bug.cgi?id=1212684 * https://bugzilla.suse.com/show_bug.cgi?id=1213616 * https://bugzilla.suse.com/show_bug.cgi?id=1214082 * https://bugzilla.suse.com/show_bug.cgi?id=1214083

1 0

SUSE-SU-2023:3454-1: important: Security update for ca-certificates-mozilla
by security＠lists.opensuse.org 28 Aug '23

28 Aug '23

# Security update for ca-certificates-mozilla Announcement ID: SUSE-SU-2023:3454-1 Rating: important References: * #1214248 Affected Products: * Basesystem Module 15-SP4 * Basesystem Module 15-SP5 * Development Tools Module 15-SP4 * Development Tools Module 15-SP5 * openSUSE Leap 15.4 * openSUSE Leap 15.5 * openSUSE Leap Micro 5.3 * openSUSE Leap Micro 5.4 * SUSE Enterprise Storage 7.1 * SUSE Linux Enterprise Desktop 15 SP4 * SUSE Linux Enterprise Desktop 15 SP5 * SUSE Linux Enterprise High Performance Computing 15 SP2 * SUSE Linux Enterprise High Performance Computing 15 SP2 LTSS 15-SP2 * SUSE Linux Enterprise High Performance Computing 15 SP3 * SUSE Linux Enterprise High Performance Computing 15 SP4 * SUSE Linux Enterprise High Performance Computing 15 SP5 * SUSE Linux Enterprise High Performance Computing ESPOS 15 SP3 * SUSE Linux Enterprise High Performance Computing LTSS 15 SP3 * SUSE Linux Enterprise Micro 5.1 * SUSE Linux Enterprise Micro 5.2 * SUSE Linux Enterprise Micro 5.3 * SUSE Linux Enterprise Micro 5.4 * SUSE Linux Enterprise Micro for Rancher 5.2 * SUSE Linux Enterprise Micro for Rancher 5.3 * SUSE Linux Enterprise Micro for Rancher 5.4 * SUSE Linux Enterprise Real Time 15 SP4 * SUSE Linux Enterprise Real Time 15 SP5 * SUSE Linux Enterprise Server 15 SP2 * SUSE Linux Enterprise Server 15 SP2 LTSS 15-SP2 * SUSE Linux Enterprise Server 15 SP3 * SUSE Linux Enterprise Server 15 SP3 LTSS 15-SP3 * SUSE Linux Enterprise Server 15 SP4 * SUSE Linux Enterprise Server 15 SP5 * SUSE Linux Enterprise Server for SAP Applications 15 SP2 * SUSE Linux Enterprise Server for SAP Applications 15 SP3 * SUSE Linux Enterprise Server for SAP Applications 15 SP4 * SUSE Linux Enterprise Server for SAP Applications 15 SP5 * SUSE Manager Proxy 4.2 * SUSE Manager Proxy 4.3 * SUSE Manager Retail Branch Server 4.2 * SUSE Manager Retail Branch Server 4.3 * SUSE Manager Server 4.2 * SUSE Manager Server 4.3 An update that has one fix can now be installed. ## Description: This update for ca-certificates-mozilla fixes the following issues: * Updated to 2.62 state of Mozilla SSL root CAs (bsc#1214248) Added: * Atos TrustedRoot Root CA ECC G2 2020 * Atos TrustedRoot Root CA ECC TLS 2021 * Atos TrustedRoot Root CA RSA G2 2020 * Atos TrustedRoot Root CA RSA TLS 2021 * BJCA Global Root CA1 * BJCA Global Root CA2 * LAWtrust Root CA2 (4096) * Sectigo Public Email Protection Root E46 * Sectigo Public Email Protection Root R46 * Sectigo Public Server Authentication Root E46 * Sectigo Public Server Authentication Root R46 * SSL.com Client ECC Root CA 2022 * SSL.com Client RSA Root CA 2022 * SSL.com TLS ECC Root CA 2022 * SSL.com TLS RSA Root CA 2022 Removed CAs: * Chambers of Commerce Root * E-Tugra Certification Authority * E-Tugra Global Root CA ECC v3 * E-Tugra Global Root CA RSA v3 * Hongkong Post Root CA 1 ## Patch Instructions: To install this SUSE Important update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: * openSUSE Leap Micro 5.3 zypper in -t patch openSUSE-Leap-Micro-5.3-2023-3454=1 * openSUSE Leap Micro 5.4 zypper in -t patch openSUSE-Leap-Micro-5.4-2023-3454=1 * openSUSE Leap 15.4 zypper in -t patch openSUSE-SLE-15.4-2023-3454=1 * openSUSE Leap 15.5 zypper in -t patch openSUSE-SLE-15.5-2023-3454=1 * SUSE Linux Enterprise Micro for Rancher 5.3 zypper in -t patch SUSE-SLE-Micro-5.3-2023-3454=1 * SUSE Linux Enterprise Micro 5.3 zypper in -t patch SUSE-SLE-Micro-5.3-2023-3454=1 * SUSE Linux Enterprise Micro for Rancher 5.4 zypper in -t patch SUSE-SLE-Micro-5.4-2023-3454=1 * SUSE Linux Enterprise Micro 5.4 zypper in -t patch SUSE-SLE-Micro-5.4-2023-3454=1 * Basesystem Module 15-SP4 zypper in -t patch SUSE-SLE-Module-Basesystem-15-SP4-2023-3454=1 * Basesystem Module 15-SP5 zypper in -t patch SUSE-SLE-Module-Basesystem-15-SP5-2023-3454=1 * Development Tools Module 15-SP4 zypper in -t patch SUSE-SLE-Module-Development-Tools-15-SP4-2023-3454=1 * Development Tools Module 15-SP5 zypper in -t patch SUSE-SLE-Module-Development-Tools-15-SP5-2023-3454=1 * SUSE Linux Enterprise High Performance Computing 15 SP2 LTSS 15-SP2 zypper in -t patch SUSE-SLE-Product-HPC-15-SP2-LTSS-2023-3454=1 * SUSE Linux Enterprise High Performance Computing ESPOS 15 SP3 zypper in -t patch SUSE-SLE-Product-HPC-15-SP3-ESPOS-2023-3454=1 * SUSE Linux Enterprise High Performance Computing LTSS 15 SP3 zypper in -t patch SUSE-SLE-Product-HPC-15-SP3-LTSS-2023-3454=1 * SUSE Linux Enterprise Server 15 SP2 LTSS 15-SP2 zypper in -t patch SUSE-SLE-Product-SLES-15-SP2-LTSS-2023-3454=1 * SUSE Linux Enterprise Server 15 SP3 LTSS 15-SP3 zypper in -t patch SUSE-SLE-Product-SLES-15-SP3-LTSS-2023-3454=1 * SUSE Linux Enterprise Server for SAP Applications 15 SP2 zypper in -t patch SUSE-SLE-Product-SLES_SAP-15-SP2-2023-3454=1 * SUSE Linux Enterprise Server for SAP Applications 15 SP3 zypper in -t patch SUSE-SLE-Product-SLES_SAP-15-SP3-2023-3454=1 * SUSE Manager Proxy 4.2 zypper in -t patch SUSE-SLE-Product-SUSE-Manager-Proxy-4.2-2023-3454=1 * SUSE Manager Retail Branch Server 4.2 zypper in -t patch SUSE-SLE-Product-SUSE-Manager-Retail-Branch- Server-4.2-2023-3454=1 * SUSE Manager Server 4.2 zypper in -t patch SUSE-SLE-Product-SUSE-Manager-Server-4.2-2023-3454=1 * SUSE Enterprise Storage 7.1 zypper in -t patch SUSE-Storage-7.1-2023-3454=1 * SUSE Linux Enterprise Micro 5.1 zypper in -t patch SUSE-SUSE-MicroOS-5.1-2023-3454=1 * SUSE Linux Enterprise Micro 5.2 zypper in -t patch SUSE-SUSE-MicroOS-5.2-2023-3454=1 * SUSE Linux Enterprise Micro for Rancher 5.2 zypper in -t patch SUSE-SUSE-MicroOS-5.2-2023-3454=1 ## Package List: * openSUSE Leap Micro 5.3 (noarch) * ca-certificates-mozilla-2.62-150200.30.1 * openSUSE Leap Micro 5.4 (noarch) * ca-certificates-mozilla-2.62-150200.30.1 * openSUSE Leap 15.4 (noarch) * ca-certificates-mozilla-prebuilt-2.62-150200.30.1 * ca-certificates-mozilla-2.62-150200.30.1 * openSUSE Leap 15.5 (noarch) * ca-certificates-mozilla-prebuilt-2.62-150200.30.1 * ca-certificates-mozilla-2.62-150200.30.1 * SUSE Linux Enterprise Micro for Rancher 5.3 (noarch) * ca-certificates-mozilla-2.62-150200.30.1 * SUSE Linux Enterprise Micro 5.3 (noarch) * ca-certificates-mozilla-2.62-150200.30.1 * SUSE Linux Enterprise Micro for Rancher 5.4 (noarch) * ca-certificates-mozilla-2.62-150200.30.1 * SUSE Linux Enterprise Micro 5.4 (noarch) * ca-certificates-mozilla-2.62-150200.30.1 * Basesystem Module 15-SP4 (noarch) * ca-certificates-mozilla-2.62-150200.30.1 * Basesystem Module 15-SP5 (noarch) * ca-certificates-mozilla-2.62-150200.30.1 * Development Tools Module 15-SP4 (noarch) * ca-certificates-mozilla-prebuilt-2.62-150200.30.1 * Development Tools Module 15-SP5 (noarch) * ca-certificates-mozilla-prebuilt-2.62-150200.30.1 * SUSE Linux Enterprise High Performance Computing 15 SP2 LTSS 15-SP2 (noarch) * ca-certificates-mozilla-prebuilt-2.62-150200.30.1 * ca-certificates-mozilla-2.62-150200.30.1 * SUSE Linux Enterprise High Performance Computing ESPOS 15 SP3 (noarch) * ca-certificates-mozilla-prebuilt-2.62-150200.30.1 * ca-certificates-mozilla-2.62-150200.30.1 * SUSE Linux Enterprise High Performance Computing LTSS 15 SP3 (noarch) * ca-certificates-mozilla-prebuilt-2.62-150200.30.1 * ca-certificates-mozilla-2.62-150200.30.1 * SUSE Linux Enterprise Server 15 SP2 LTSS 15-SP2 (noarch) * ca-certificates-mozilla-prebuilt-2.62-150200.30.1 * ca-certificates-mozilla-2.62-150200.30.1 * SUSE Linux Enterprise Server 15 SP3 LTSS 15-SP3 (noarch) * ca-certificates-mozilla-prebuilt-2.62-150200.30.1 * ca-certificates-mozilla-2.62-150200.30.1 * SUSE Linux Enterprise Server for SAP Applications 15 SP2 (noarch) * ca-certificates-mozilla-prebuilt-2.62-150200.30.1 * ca-certificates-mozilla-2.62-150200.30.1 * SUSE Linux Enterprise Server for SAP Applications 15 SP3 (noarch) * ca-certificates-mozilla-prebuilt-2.62-150200.30.1 * ca-certificates-mozilla-2.62-150200.30.1 * SUSE Manager Proxy 4.2 (noarch) * ca-certificates-mozilla-2.62-150200.30.1 * SUSE Manager Retail Branch Server 4.2 (noarch) * ca-certificates-mozilla-2.62-150200.30.1 * SUSE Manager Server 4.2 (noarch) * ca-certificates-mozilla-2.62-150200.30.1 * SUSE Enterprise Storage 7.1 (noarch) * ca-certificates-mozilla-prebuilt-2.62-150200.30.1 * ca-certificates-mozilla-2.62-150200.30.1 * SUSE Linux Enterprise Micro 5.1 (noarch) * ca-certificates-mozilla-2.62-150200.30.1 * SUSE Linux Enterprise Micro 5.2 (noarch) * ca-certificates-mozilla-prebuilt-2.62-150200.30.1 * ca-certificates-mozilla-2.62-150200.30.1 * SUSE Linux Enterprise Micro for Rancher 5.2 (noarch) * ca-certificates-mozilla-prebuilt-2.62-150200.30.1 * ca-certificates-mozilla-2.62-150200.30.1 ## References: * https://bugzilla.suse.com/show_bug.cgi?id=1214248

1 0

SUSE-SU-2023:3438-1: low: Security update for ghostscript
by security＠lists.opensuse.org 28 Aug '23

28 Aug '23

# Security update for ghostscript Announcement ID: SUSE-SU-2023:3438-1 Rating: low References: * #1213637 Cross-References: * CVE-2023-38559 CVSS scores: * CVE-2023-38559 ( SUSE ): 3.3 CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:L * CVE-2023-38559 ( NVD ): 5.5 CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H Affected Products: * Basesystem Module 15-SP4 * Basesystem Module 15-SP5 * openSUSE Leap 15.4 * openSUSE Leap 15.5 * SUSE Linux Enterprise Desktop 15 SP4 * SUSE Linux Enterprise Desktop 15 SP5 * SUSE Linux Enterprise High Performance Computing 15 SP4 * SUSE Linux Enterprise High Performance Computing 15 SP5 * SUSE Linux Enterprise Real Time 15 SP4 * SUSE Linux Enterprise Real Time 15 SP5 * SUSE Linux Enterprise Server 15 SP4 * SUSE Linux Enterprise Server 15 SP5 * SUSE Linux Enterprise Server for SAP Applications 15 SP4 * SUSE Linux Enterprise Server for SAP Applications 15 SP5 * SUSE Manager Proxy 4.2 * SUSE Manager Proxy 4.3 * SUSE Manager Retail Branch Server 4.2 * SUSE Manager Retail Branch Server 4.3 * SUSE Manager Server 4.2 * SUSE Manager Server 4.3 An update that solves one vulnerability can now be installed. ## Description: This update for ghostscript fixes the following issues: * CVE-2023-38559: Fixed out-of-bounds read in devn_pcx_write_rle() that could result in DoS (bsc#1213637). ## Patch Instructions: To install this SUSE Low update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: * openSUSE Leap 15.4 zypper in -t patch openSUSE-SLE-15.4-2023-3438=1 * openSUSE Leap 15.5 zypper in -t patch openSUSE-SLE-15.5-2023-3438=1 * Basesystem Module 15-SP4 zypper in -t patch SUSE-SLE-Module-Basesystem-15-SP4-2023-3438=1 * Basesystem Module 15-SP5 zypper in -t patch SUSE-SLE-Module-Basesystem-15-SP5-2023-3438=1 * SUSE Manager Proxy 4.2 zypper in -t patch SUSE-SLE-Product-SUSE-Manager-Proxy-4.2-2023-3438=1 * SUSE Manager Retail Branch Server 4.2 zypper in -t patch SUSE-SLE-Product-SUSE-Manager-Retail-Branch- Server-4.2-2023-3438=1 * SUSE Manager Server 4.2 zypper in -t patch SUSE-SLE-Product-SUSE-Manager-Server-4.2-2023-3438=1 ## Package List: * openSUSE Leap 15.4 (aarch64 ppc64le s390x x86_64) * ghostscript-x11-debuginfo-9.52-150000.170.1 * ghostscript-devel-9.52-150000.170.1 * ghostscript-9.52-150000.170.1 * ghostscript-debuginfo-9.52-150000.170.1 * ghostscript-x11-9.52-150000.170.1 * ghostscript-debugsource-9.52-150000.170.1 * openSUSE Leap 15.5 (aarch64 ppc64le s390x x86_64) * ghostscript-x11-debuginfo-9.52-150000.170.1 * ghostscript-devel-9.52-150000.170.1 * ghostscript-9.52-150000.170.1 * ghostscript-debuginfo-9.52-150000.170.1 * ghostscript-x11-9.52-150000.170.1 * ghostscript-debugsource-9.52-150000.170.1 * Basesystem Module 15-SP4 (aarch64 ppc64le s390x x86_64) * ghostscript-x11-debuginfo-9.52-150000.170.1 * ghostscript-devel-9.52-150000.170.1 * ghostscript-9.52-150000.170.1 * ghostscript-debuginfo-9.52-150000.170.1 * ghostscript-x11-9.52-150000.170.1 * ghostscript-debugsource-9.52-150000.170.1 * Basesystem Module 15-SP5 (aarch64 ppc64le s390x x86_64) * ghostscript-x11-debuginfo-9.52-150000.170.1 * ghostscript-devel-9.52-150000.170.1 * ghostscript-9.52-150000.170.1 * ghostscript-debuginfo-9.52-150000.170.1 * ghostscript-x11-9.52-150000.170.1 * ghostscript-debugsource-9.52-150000.170.1 * SUSE Manager Proxy 4.2 (x86_64) * ghostscript-x11-debuginfo-9.52-150000.170.1 * ghostscript-devel-9.52-150000.170.1 * ghostscript-9.52-150000.170.1 * ghostscript-debuginfo-9.52-150000.170.1 * ghostscript-x11-9.52-150000.170.1 * ghostscript-debugsource-9.52-150000.170.1 * SUSE Manager Retail Branch Server 4.2 (x86_64) * ghostscript-x11-debuginfo-9.52-150000.170.1 * ghostscript-devel-9.52-150000.170.1 * ghostscript-9.52-150000.170.1 * ghostscript-debuginfo-9.52-150000.170.1 * ghostscript-x11-9.52-150000.170.1 * ghostscript-debugsource-9.52-150000.170.1 * SUSE Manager Server 4.2 (ppc64le s390x x86_64) * ghostscript-x11-debuginfo-9.52-150000.170.1 * ghostscript-devel-9.52-150000.170.1 * ghostscript-9.52-150000.170.1 * ghostscript-debuginfo-9.52-150000.170.1 * ghostscript-x11-9.52-150000.170.1 * ghostscript-debugsource-9.52-150000.170.1 ## References: * https://www.suse.com/security/cve/CVE-2023-38559.html * https://bugzilla.suse.com/show_bug.cgi?id=1213637

1 0

SUSE-SU-2023:3440-1: low: Security update for gawk
by security＠lists.opensuse.org 28 Aug '23

28 Aug '23

# Security update for gawk Announcement ID: SUSE-SU-2023:3440-1 Rating: low References: * #1214025 Cross-References: * CVE-2023-4156 CVSS scores: * CVE-2023-4156 ( SUSE ): 3.3 CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:L Affected Products: * Basesystem Module 15-SP4 * Basesystem Module 15-SP5 * openSUSE Leap 15.4 * openSUSE Leap 15.5 * openSUSE Leap Micro 5.3 * openSUSE Leap Micro 5.4 * SUSE Linux Enterprise Desktop 15 SP4 * SUSE Linux Enterprise Desktop 15 SP5 * SUSE Linux Enterprise High Performance Computing 15 SP4 * SUSE Linux Enterprise High Performance Computing 15 SP5 * SUSE Linux Enterprise Micro 5.1 * SUSE Linux Enterprise Micro 5.2 * SUSE Linux Enterprise Micro 5.3 * SUSE Linux Enterprise Micro 5.4 * SUSE Linux Enterprise Micro for Rancher 5.2 * SUSE Linux Enterprise Micro for Rancher 5.3 * SUSE Linux Enterprise Micro for Rancher 5.4 * SUSE Linux Enterprise Real Time 15 SP4 * SUSE Linux Enterprise Real Time 15 SP5 * SUSE Linux Enterprise Server 15 SP4 * SUSE Linux Enterprise Server 15 SP5 * SUSE Linux Enterprise Server for SAP Applications 15 SP4 * SUSE Linux Enterprise Server for SAP Applications 15 SP5 * SUSE Manager Proxy 4.2 * SUSE Manager Proxy 4.3 * SUSE Manager Retail Branch Server 4.2 * SUSE Manager Retail Branch Server 4.3 * SUSE Manager Server 4.2 * SUSE Manager Server 4.3 An update that solves one vulnerability can now be installed. ## Description: This update for gawk fixes the following issues: * CVE-2023-4156: Fix a heap out of bound read by validating the index into argument list. (bsc#1214025) ## Patch Instructions: To install this SUSE Low update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: * openSUSE Leap 15.4 zypper in -t patch openSUSE-SLE-15.4-2023-3440=1 * openSUSE Leap 15.5 zypper in -t patch openSUSE-SLE-15.5-2023-3440=1 * SUSE Linux Enterprise Micro for Rancher 5.3 zypper in -t patch SUSE-SLE-Micro-5.3-2023-3440=1 * SUSE Linux Enterprise Micro 5.3 zypper in -t patch SUSE-SLE-Micro-5.3-2023-3440=1 * SUSE Linux Enterprise Micro for Rancher 5.4 zypper in -t patch SUSE-SLE-Micro-5.4-2023-3440=1 * SUSE Linux Enterprise Micro 5.4 zypper in -t patch SUSE-SLE-Micro-5.4-2023-3440=1 * Basesystem Module 15-SP4 zypper in -t patch SUSE-SLE-Module-Basesystem-15-SP4-2023-3440=1 * Basesystem Module 15-SP5 zypper in -t patch SUSE-SLE-Module-Basesystem-15-SP5-2023-3440=1 * SUSE Manager Proxy 4.2 zypper in -t patch SUSE-SLE-Product-SUSE-Manager-Proxy-4.2-2023-3440=1 * SUSE Manager Retail Branch Server 4.2 zypper in -t patch SUSE-SLE-Product-SUSE-Manager-Retail-Branch- Server-4.2-2023-3440=1 * SUSE Manager Server 4.2 zypper in -t patch SUSE-SLE-Product-SUSE-Manager-Server-4.2-2023-3440=1 * SUSE Linux Enterprise Micro 5.1 zypper in -t patch SUSE-SUSE-MicroOS-5.1-2023-3440=1 * SUSE Linux Enterprise Micro 5.2 zypper in -t patch SUSE-SUSE-MicroOS-5.2-2023-3440=1 * SUSE Linux Enterprise Micro for Rancher 5.2 zypper in -t patch SUSE-SUSE-MicroOS-5.2-2023-3440=1 * openSUSE Leap Micro 5.3 zypper in -t patch openSUSE-Leap-Micro-5.3-2023-3440=1 * openSUSE Leap Micro 5.4 zypper in -t patch openSUSE-Leap-Micro-5.4-2023-3440=1 ## Package List: * openSUSE Leap 15.4 (aarch64 ppc64le s390x x86_64) * gawk-4.2.1-150000.3.3.1 * gawk-debuginfo-4.2.1-150000.3.3.1 * gawk-debugsource-4.2.1-150000.3.3.1 * openSUSE Leap 15.5 (aarch64 ppc64le s390x x86_64) * gawk-4.2.1-150000.3.3.1 * gawk-debuginfo-4.2.1-150000.3.3.1 * gawk-debugsource-4.2.1-150000.3.3.1 * SUSE Linux Enterprise Micro for Rancher 5.3 (aarch64 s390x x86_64) * gawk-4.2.1-150000.3.3.1 * gawk-debuginfo-4.2.1-150000.3.3.1 * gawk-debugsource-4.2.1-150000.3.3.1 * SUSE Linux Enterprise Micro 5.3 (aarch64 s390x x86_64) * gawk-4.2.1-150000.3.3.1 * gawk-debuginfo-4.2.1-150000.3.3.1 * gawk-debugsource-4.2.1-150000.3.3.1 * SUSE Linux Enterprise Micro for Rancher 5.4 (aarch64 s390x x86_64) * gawk-4.2.1-150000.3.3.1 * gawk-debuginfo-4.2.1-150000.3.3.1 * gawk-debugsource-4.2.1-150000.3.3.1 * SUSE Linux Enterprise Micro 5.4 (aarch64 s390x x86_64) * gawk-4.2.1-150000.3.3.1 * gawk-debuginfo-4.2.1-150000.3.3.1 * gawk-debugsource-4.2.1-150000.3.3.1 * Basesystem Module 15-SP4 (aarch64 ppc64le s390x x86_64) * gawk-4.2.1-150000.3.3.1 * gawk-debuginfo-4.2.1-150000.3.3.1 * gawk-debugsource-4.2.1-150000.3.3.1 * Basesystem Module 15-SP5 (aarch64 ppc64le s390x x86_64) * gawk-4.2.1-150000.3.3.1 * gawk-debuginfo-4.2.1-150000.3.3.1 * gawk-debugsource-4.2.1-150000.3.3.1 * SUSE Manager Proxy 4.2 (x86_64) * gawk-4.2.1-150000.3.3.1 * gawk-debuginfo-4.2.1-150000.3.3.1 * gawk-debugsource-4.2.1-150000.3.3.1 * SUSE Manager Retail Branch Server 4.2 (x86_64) * gawk-4.2.1-150000.3.3.1 * gawk-debuginfo-4.2.1-150000.3.3.1 * gawk-debugsource-4.2.1-150000.3.3.1 * SUSE Manager Server 4.2 (ppc64le s390x x86_64) * gawk-4.2.1-150000.3.3.1 * gawk-debuginfo-4.2.1-150000.3.3.1 * gawk-debugsource-4.2.1-150000.3.3.1 * SUSE Linux Enterprise Micro 5.1 (aarch64 s390x x86_64) * gawk-4.2.1-150000.3.3.1 * gawk-debuginfo-4.2.1-150000.3.3.1 * gawk-debugsource-4.2.1-150000.3.3.1 * SUSE Linux Enterprise Micro 5.2 (aarch64 s390x x86_64) * gawk-4.2.1-150000.3.3.1 * gawk-debuginfo-4.2.1-150000.3.3.1 * gawk-debugsource-4.2.1-150000.3.3.1 * SUSE Linux Enterprise Micro for Rancher 5.2 (aarch64 s390x x86_64) * gawk-4.2.1-150000.3.3.1 * gawk-debuginfo-4.2.1-150000.3.3.1 * gawk-debugsource-4.2.1-150000.3.3.1 * openSUSE Leap Micro 5.3 (aarch64 x86_64) * gawk-4.2.1-150000.3.3.1 * gawk-debuginfo-4.2.1-150000.3.3.1 * gawk-debugsource-4.2.1-150000.3.3.1 * openSUSE Leap Micro 5.4 (aarch64 s390x x86_64) * gawk-4.2.1-150000.3.3.1 * gawk-debuginfo-4.2.1-150000.3.3.1 * gawk-debugsource-4.2.1-150000.3.3.1 ## References: * https://www.suse.com/security/cve/CVE-2023-4156.html * https://bugzilla.suse.com/show_bug.cgi?id=1214025

1 0

SUSE-SU-2023:3441-1: important: Security update for java-1_8_0-ibm
by security＠lists.opensuse.org 28 Aug '23

28 Aug '23

# Security update for java-1_8_0-ibm Announcement ID: SUSE-SU-2023:3441-1 Rating: important References: * #1207922 * #1213473 * #1213474 * #1213475 * #1213479 * #1213481 * #1213482 * #1213541 * #1213934 * #1214431 Cross-References: * CVE-2022-40609 * CVE-2023-22006 * CVE-2023-22036 * CVE-2023-22041 * CVE-2023-22044 * CVE-2023-22045 * CVE-2023-22049 * CVE-2023-25193 CVSS scores: * CVE-2022-40609 ( SUSE ): 8.1 CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H * CVE-2022-40609 ( NVD ): 8.1 CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H * CVE-2023-22006 ( SUSE ): 3.1 CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:N/I:L/A:N * CVE-2023-22006 ( NVD ): 3.1 CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:N/I:L/A:N * CVE-2023-22036 ( SUSE ): 3.7 CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:L * CVE-2023-22036 ( NVD ): 3.7 CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:L * CVE-2023-22041 ( SUSE ): 5.1 CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N * CVE-2023-22041 ( NVD ): 5.1 CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N * CVE-2023-22044 ( SUSE ): 3.7 CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N * CVE-2023-22044 ( NVD ): 3.7 CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N * CVE-2023-22045 ( SUSE ): 3.7 CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N * CVE-2023-22045 ( NVD ): 3.7 CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N * CVE-2023-22049 ( SUSE ): 3.7 CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:N * CVE-2023-22049 ( NVD ): 3.7 CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:N * CVE-2023-25193 ( SUSE ): 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H * CVE-2023-25193 ( NVD ): 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H Affected Products: * Legacy Module 15-SP4 * Legacy Module 15-SP5 * openSUSE Leap 15.4 * openSUSE Leap 15.5 * SUSE CaaS Platform 4.0 * SUSE Enterprise Storage 7 * SUSE Enterprise Storage 7.1 * SUSE Linux Enterprise High Performance Computing 15 SP3 * SUSE Linux Enterprise High Performance Computing 15 SP4 * SUSE Linux Enterprise High Performance Computing ESPOS 15 SP3 * SUSE Linux Enterprise High Performance Computing LTSS 15 SP3 * SUSE Linux Enterprise Server 15 SP1 * SUSE Linux Enterprise Server 15 SP1 LTSS 15-SP1 * SUSE Linux Enterprise Server 15 SP2 * SUSE Linux Enterprise Server 15 SP2 LTSS 15-SP2 * SUSE Linux Enterprise Server 15 SP3 * SUSE Linux Enterprise Server 15 SP3 LTSS 15-SP3 * SUSE Linux Enterprise Server 15 SP4 * SUSE Linux Enterprise Server 15 SP5 * SUSE Linux Enterprise Server for SAP Applications 15 SP1 * SUSE Linux Enterprise Server for SAP Applications 15 SP2 * SUSE Linux Enterprise Server for SAP Applications 15 SP3 * SUSE Linux Enterprise Server for SAP Applications 15 SP4 * SUSE Linux Enterprise Server for SAP Applications 15 SP5 * SUSE Manager Proxy 4.3 * SUSE Manager Retail Branch Server 4.3 * SUSE Manager Server 4.3 An update that solves eight vulnerabilities and has two fixes can now be installed. ## Description: This update for java-1_8_0-ibm fixes the following issues: * Update to Java 8.0 Service Refresh 8 Fix Pack 10 (bsc#1213541) * CVE-2022-40609: Fixed an unsafe deserialization flaw which could allow a remote attacker to execute arbitrary code on the system. (bsc#1213934) * CVE-2023-22041: Fixed a flaw whcih could allow unauthorized access to critical data or complete access. (bsc#1213475) * CVE-2023-22049: Fixed a flaw which could result in unauthorized update. (bsc#1213482) * CVE-2023-22045: Fixed a flaw which could result in unauthorized read access to a subset of Oracle Java SE, Oracle GraalVM Enterprise Edition, Oracle GraalVM for JDK accessible data. (bsc#1213481) * CVE-2023-22044: Fixed a flaw which could result in unauthorized read access to a subset of Oracle Java SE, Oracle GraalVM Enterprise Edition, Oracle GraalVM for JDK accessible data. (bsc#1213479) * CVE-2023-22036: Fixed a flaw which could result in unauthorized ability to cause a partial denial of service. (bsc#1213474) * CVE-2023-25193: Fixed a flaw which could allows attackers to trigger O(n^2) growth via consecutive marks during the process of looking back for base glyphs when attaching marks. (bsc#1207922) * CVE-2023-22006: Fixed a flaw which could result in unauthorized update, insert or delete access for JDK accessible data. (bsc#1213473) ## Patch Instructions: To install this SUSE Important update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: * openSUSE Leap 15.4 zypper in -t patch openSUSE-SLE-15.4-2023-3441=1 * openSUSE Leap 15.5 zypper in -t patch openSUSE-SLE-15.5-2023-3441=1 * Legacy Module 15-SP4 zypper in -t patch SUSE-SLE-Module-Legacy-15-SP4-2023-3441=1 * Legacy Module 15-SP5 zypper in -t patch SUSE-SLE-Module-Legacy-15-SP5-2023-3441=1 * SUSE Linux Enterprise High Performance Computing ESPOS 15 SP3 zypper in -t patch SUSE-SLE-Product-HPC-15-SP3-ESPOS-2023-3441=1 * SUSE Linux Enterprise High Performance Computing LTSS 15 SP3 zypper in -t patch SUSE-SLE-Product-HPC-15-SP3-LTSS-2023-3441=1 * SUSE Linux Enterprise Server 15 SP1 LTSS 15-SP1 zypper in -t patch SUSE-SLE-Product-SLES-15-SP1-LTSS-2023-3441=1 * SUSE Linux Enterprise Server 15 SP2 LTSS 15-SP2 zypper in -t patch SUSE-SLE-Product-SLES-15-SP2-LTSS-2023-3441=1 * SUSE Linux Enterprise Server 15 SP3 LTSS 15-SP3 zypper in -t patch SUSE-SLE-Product-SLES-15-SP3-LTSS-2023-3441=1 * SUSE Linux Enterprise Server for SAP Applications 15 SP1 zypper in -t patch SUSE-SLE-Product-SLES_SAP-15-SP1-2023-3441=1 * SUSE Linux Enterprise Server for SAP Applications 15 SP2 zypper in -t patch SUSE-SLE-Product-SLES_SAP-15-SP2-2023-3441=1 * SUSE Linux Enterprise Server for SAP Applications 15 SP3 zypper in -t patch SUSE-SLE-Product-SLES_SAP-15-SP3-2023-3441=1 * SUSE Enterprise Storage 7.1 zypper in -t patch SUSE-Storage-7.1-2023-3441=1 * SUSE Enterprise Storage 7 zypper in -t patch SUSE-Storage-7-2023-3441=1 * SUSE CaaS Platform 4.0 To install this update, use the SUSE CaaS Platform 'skuba' tool. It will inform you if it detects new updates and let you then trigger updating of the complete cluster in a controlled way. ## Package List: * openSUSE Leap 15.4 (nosrc ppc64le s390x x86_64) * java-1_8_0-ibm-1.8.0_sr8.10-150000.3.80.1 * openSUSE Leap 15.4 (x86_64) * java-1_8_0-ibm-plugin-1.8.0_sr8.10-150000.3.80.1 * java-1_8_0-ibm-devel-32bit-1.8.0_sr8.10-150000.3.80.1 * java-1_8_0-ibm-alsa-1.8.0_sr8.10-150000.3.80.1 * java-1_8_0-ibm-32bit-1.8.0_sr8.10-150000.3.80.1 * openSUSE Leap 15.4 (ppc64le s390x x86_64) * java-1_8_0-ibm-demo-1.8.0_sr8.10-150000.3.80.1 * java-1_8_0-ibm-devel-1.8.0_sr8.10-150000.3.80.1 * java-1_8_0-ibm-src-1.8.0_sr8.10-150000.3.80.1 * openSUSE Leap 15.5 (nosrc ppc64le s390x x86_64) * java-1_8_0-ibm-1.8.0_sr8.10-150000.3.80.1 * openSUSE Leap 15.5 (x86_64) * java-1_8_0-ibm-plugin-1.8.0_sr8.10-150000.3.80.1 * java-1_8_0-ibm-devel-32bit-1.8.0_sr8.10-150000.3.80.1 * java-1_8_0-ibm-alsa-1.8.0_sr8.10-150000.3.80.1 * java-1_8_0-ibm-32bit-1.8.0_sr8.10-150000.3.80.1 * openSUSE Leap 15.5 (ppc64le s390x x86_64) * java-1_8_0-ibm-demo-1.8.0_sr8.10-150000.3.80.1 * java-1_8_0-ibm-devel-1.8.0_sr8.10-150000.3.80.1 * java-1_8_0-ibm-src-1.8.0_sr8.10-150000.3.80.1 * Legacy Module 15-SP4 (nosrc ppc64le s390x x86_64) * java-1_8_0-ibm-1.8.0_sr8.10-150000.3.80.1 * Legacy Module 15-SP4 (ppc64le s390x x86_64) * java-1_8_0-ibm-devel-1.8.0_sr8.10-150000.3.80.1 * Legacy Module 15-SP4 (x86_64) * java-1_8_0-ibm-plugin-1.8.0_sr8.10-150000.3.80.1 * java-1_8_0-ibm-alsa-1.8.0_sr8.10-150000.3.80.1 * Legacy Module 15-SP5 (nosrc ppc64le s390x x86_64) * java-1_8_0-ibm-1.8.0_sr8.10-150000.3.80.1 * Legacy Module 15-SP5 (ppc64le s390x x86_64) * java-1_8_0-ibm-devel-1.8.0_sr8.10-150000.3.80.1 * Legacy Module 15-SP5 (x86_64) * java-1_8_0-ibm-plugin-1.8.0_sr8.10-150000.3.80.1 * java-1_8_0-ibm-alsa-1.8.0_sr8.10-150000.3.80.1 * SUSE Linux Enterprise High Performance Computing ESPOS 15 SP3 (nosrc x86_64) * java-1_8_0-ibm-1.8.0_sr8.10-150000.3.80.1 * SUSE Linux Enterprise High Performance Computing ESPOS 15 SP3 (x86_64) * java-1_8_0-ibm-plugin-1.8.0_sr8.10-150000.3.80.1 * java-1_8_0-ibm-devel-1.8.0_sr8.10-150000.3.80.1 * java-1_8_0-ibm-alsa-1.8.0_sr8.10-150000.3.80.1 * SUSE Linux Enterprise High Performance Computing LTSS 15 SP3 (nosrc x86_64) * java-1_8_0-ibm-1.8.0_sr8.10-150000.3.80.1 * SUSE Linux Enterprise High Performance Computing LTSS 15 SP3 (x86_64) * java-1_8_0-ibm-plugin-1.8.0_sr8.10-150000.3.80.1 * java-1_8_0-ibm-devel-1.8.0_sr8.10-150000.3.80.1 * java-1_8_0-ibm-alsa-1.8.0_sr8.10-150000.3.80.1 * SUSE Linux Enterprise Server 15 SP1 LTSS 15-SP1 (nosrc ppc64le s390x x86_64) * java-1_8_0-ibm-1.8.0_sr8.10-150000.3.80.1 * SUSE Linux Enterprise Server 15 SP1 LTSS 15-SP1 (ppc64le s390x x86_64) * java-1_8_0-ibm-devel-1.8.0_sr8.10-150000.3.80.1 * SUSE Linux Enterprise Server 15 SP1 LTSS 15-SP1 (x86_64) * java-1_8_0-ibm-plugin-1.8.0_sr8.10-150000.3.80.1 * java-1_8_0-ibm-alsa-1.8.0_sr8.10-150000.3.80.1 * SUSE Linux Enterprise Server 15 SP2 LTSS 15-SP2 (nosrc ppc64le s390x x86_64) * java-1_8_0-ibm-1.8.0_sr8.10-150000.3.80.1 * SUSE Linux Enterprise Server 15 SP2 LTSS 15-SP2 (ppc64le s390x x86_64) * java-1_8_0-ibm-devel-1.8.0_sr8.10-150000.3.80.1 * SUSE Linux Enterprise Server 15 SP2 LTSS 15-SP2 (x86_64) * java-1_8_0-ibm-plugin-1.8.0_sr8.10-150000.3.80.1 * java-1_8_0-ibm-alsa-1.8.0_sr8.10-150000.3.80.1 * SUSE Linux Enterprise Server 15 SP3 LTSS 15-SP3 (nosrc ppc64le s390x x86_64) * java-1_8_0-ibm-1.8.0_sr8.10-150000.3.80.1 * SUSE Linux Enterprise Server 15 SP3 LTSS 15-SP3 (ppc64le s390x x86_64) * java-1_8_0-ibm-devel-1.8.0_sr8.10-150000.3.80.1 * SUSE Linux Enterprise Server 15 SP3 LTSS 15-SP3 (x86_64) * java-1_8_0-ibm-plugin-1.8.0_sr8.10-150000.3.80.1 * java-1_8_0-ibm-alsa-1.8.0_sr8.10-150000.3.80.1 * SUSE Linux Enterprise Server for SAP Applications 15 SP1 (nosrc ppc64le x86_64) * java-1_8_0-ibm-1.8.0_sr8.10-150000.3.80.1 * SUSE Linux Enterprise Server for SAP Applications 15 SP1 (ppc64le x86_64) * java-1_8_0-ibm-devel-1.8.0_sr8.10-150000.3.80.1 * SUSE Linux Enterprise Server for SAP Applications 15 SP1 (x86_64) * java-1_8_0-ibm-plugin-1.8.0_sr8.10-150000.3.80.1 * java-1_8_0-ibm-alsa-1.8.0_sr8.10-150000.3.80.1 * SUSE Linux Enterprise Server for SAP Applications 15 SP2 (nosrc ppc64le x86_64) * java-1_8_0-ibm-1.8.0_sr8.10-150000.3.80.1 * SUSE Linux Enterprise Server for SAP Applications 15 SP2 (ppc64le x86_64) * java-1_8_0-ibm-devel-1.8.0_sr8.10-150000.3.80.1 * SUSE Linux Enterprise Server for SAP Applications 15 SP2 (x86_64) * java-1_8_0-ibm-plugin-1.8.0_sr8.10-150000.3.80.1 * java-1_8_0-ibm-alsa-1.8.0_sr8.10-150000.3.80.1 * SUSE Linux Enterprise Server for SAP Applications 15 SP3 (nosrc ppc64le x86_64) * java-1_8_0-ibm-1.8.0_sr8.10-150000.3.80.1 * SUSE Linux Enterprise Server for SAP Applications 15 SP3 (ppc64le x86_64) * java-1_8_0-ibm-devel-1.8.0_sr8.10-150000.3.80.1 * SUSE Linux Enterprise Server for SAP Applications 15 SP3 (x86_64) * java-1_8_0-ibm-plugin-1.8.0_sr8.10-150000.3.80.1 * java-1_8_0-ibm-alsa-1.8.0_sr8.10-150000.3.80.1 * SUSE Enterprise Storage 7.1 (nosrc x86_64) * java-1_8_0-ibm-1.8.0_sr8.10-150000.3.80.1 * SUSE Enterprise Storage 7.1 (x86_64) * java-1_8_0-ibm-plugin-1.8.0_sr8.10-150000.3.80.1 * java-1_8_0-ibm-devel-1.8.0_sr8.10-150000.3.80.1 * java-1_8_0-ibm-alsa-1.8.0_sr8.10-150000.3.80.1 * SUSE Enterprise Storage 7 (nosrc x86_64) * java-1_8_0-ibm-1.8.0_sr8.10-150000.3.80.1 * SUSE Enterprise Storage 7 (x86_64) * java-1_8_0-ibm-plugin-1.8.0_sr8.10-150000.3.80.1 * java-1_8_0-ibm-devel-1.8.0_sr8.10-150000.3.80.1 * java-1_8_0-ibm-alsa-1.8.0_sr8.10-150000.3.80.1 * SUSE CaaS Platform 4.0 (nosrc x86_64) * java-1_8_0-ibm-1.8.0_sr8.10-150000.3.80.1 * SUSE CaaS Platform 4.0 (x86_64) * java-1_8_0-ibm-plugin-1.8.0_sr8.10-150000.3.80.1 * java-1_8_0-ibm-devel-1.8.0_sr8.10-150000.3.80.1 * java-1_8_0-ibm-alsa-1.8.0_sr8.10-150000.3.80.1 ## References: * https://www.suse.com/security/cve/CVE-2022-40609.html * https://www.suse.com/security/cve/CVE-2023-22006.html * https://www.suse.com/security/cve/CVE-2023-22036.html * https://www.suse.com/security/cve/CVE-2023-22041.html * https://www.suse.com/security/cve/CVE-2023-22044.html * https://www.suse.com/security/cve/CVE-2023-22045.html * https://www.suse.com/security/cve/CVE-2023-22049.html * https://www.suse.com/security/cve/CVE-2023-25193.html * https://bugzilla.suse.com/show_bug.cgi?id=1207922 * https://bugzilla.suse.com/show_bug.cgi?id=1213473 * https://bugzilla.suse.com/show_bug.cgi?id=1213474 * https://bugzilla.suse.com/show_bug.cgi?id=1213475 * https://bugzilla.suse.com/show_bug.cgi?id=1213479 * https://bugzilla.suse.com/show_bug.cgi?id=1213481 * https://bugzilla.suse.com/show_bug.cgi?id=1213482 * https://bugzilla.suse.com/show_bug.cgi?id=1213541 * https://bugzilla.suse.com/show_bug.cgi?id=1213934 * https://bugzilla.suse.com/show_bug.cgi?id=1214431

1 0

SUSE-SU-2023:3433-1: low: Security update for indent
by security＠lists.opensuse.org 24 Aug '23

24 Aug '23

# Security update for indent Announcement ID: SUSE-SU-2023:3433-1 Rating: low References: * #1214243 Cross-References: * CVE-2023-40305 CVSS scores: * CVE-2023-40305 ( SUSE ): 3.3 CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:L * CVE-2023-40305 ( NVD ): 7.8 CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H Affected Products: * Development Tools Module 15-SP4 * Development Tools Module 15-SP5 * openSUSE Leap 15.4 * openSUSE Leap 15.5 * SUSE Linux Enterprise Desktop 15 SP4 * SUSE Linux Enterprise Desktop 15 SP5 * SUSE Linux Enterprise High Performance Computing 15 SP4 * SUSE Linux Enterprise High Performance Computing 15 SP5 * SUSE Linux Enterprise Real Time 15 SP4 * SUSE Linux Enterprise Real Time 15 SP5 * SUSE Linux Enterprise Server 15 SP4 * SUSE Linux Enterprise Server 15 SP5 * SUSE Linux Enterprise Server for SAP Applications 15 SP4 * SUSE Linux Enterprise Server for SAP Applications 15 SP5 * SUSE Manager Proxy 4.3 * SUSE Manager Retail Branch Server 4.3 * SUSE Manager Server 4.3 An update that solves one vulnerability can now be installed. ## Description: This update for indent fixes the following issues: * CVE-2023-40305: Fixed a memory safety issues bug. (bsc#1214243) ## Patch Instructions: To install this SUSE Low update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: * openSUSE Leap 15.5 zypper in -t patch openSUSE-SLE-15.5-2023-3433=1 * Development Tools Module 15-SP4 zypper in -t patch SUSE-SLE-Module-Development-Tools-15-SP4-2023-3433=1 * Development Tools Module 15-SP5 zypper in -t patch SUSE-SLE-Module-Development-Tools-15-SP5-2023-3433=1 * openSUSE Leap 15.4 zypper in -t patch openSUSE-SLE-15.4-2023-3433=1 ## Package List: * openSUSE Leap 15.5 (aarch64 ppc64le s390x x86_64) * indent-2.2.11-150000.3.6.1 * indent-debugsource-2.2.11-150000.3.6.1 * indent-debuginfo-2.2.11-150000.3.6.1 * Development Tools Module 15-SP4 (aarch64 ppc64le s390x x86_64) * indent-2.2.11-150000.3.6.1 * indent-debugsource-2.2.11-150000.3.6.1 * indent-debuginfo-2.2.11-150000.3.6.1 * Development Tools Module 15-SP5 (aarch64 ppc64le s390x x86_64) * indent-2.2.11-150000.3.6.1 * indent-debugsource-2.2.11-150000.3.6.1 * indent-debuginfo-2.2.11-150000.3.6.1 * openSUSE Leap 15.4 (aarch64 ppc64le s390x x86_64) * indent-2.2.11-150000.3.6.1 * indent-debugsource-2.2.11-150000.3.6.1 * indent-debuginfo-2.2.11-150000.3.6.1 ## References: * https://www.suse.com/security/cve/CVE-2023-40305.html * https://bugzilla.suse.com/show_bug.cgi?id=1214243

1 0

SUSE-SU-2023:3419-1: important: Security update for webkit2gtk3
by security＠lists.opensuse.org 24 Aug '23

24 Aug '23

# Security update for webkit2gtk3 Announcement ID: SUSE-SU-2023:3419-1 Rating: important References: * #1212863 * #1213905 Cross-References: * CVE-2022-48503 * CVE-2023-32435 * CVE-2023-32439 * CVE-2023-38133 * CVE-2023-38572 * CVE-2023-38592 * CVE-2023-38594 * CVE-2023-38595 * CVE-2023-38597 * CVE-2023-38599 * CVE-2023-38600 * CVE-2023-38611 CVSS scores: * CVE-2022-48503 ( SUSE ): 8.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H * CVE-2022-48503 ( NVD ): 8.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H * CVE-2023-32435 ( SUSE ): 8.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H * CVE-2023-32435 ( NVD ): 8.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H * CVE-2023-32439 ( SUSE ): 8.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H * CVE-2023-32439 ( NVD ): 8.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H * CVE-2023-38133 ( SUSE ): 6.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N * CVE-2023-38133 ( NVD ): 6.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N * CVE-2023-38572 ( NVD ): 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N * CVE-2023-38592 ( NVD ): 8.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H * CVE-2023-38594 ( SUSE ): 8.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H * CVE-2023-38594 ( NVD ): 8.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H * CVE-2023-38595 ( NVD ): 8.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H * CVE-2023-38597 ( SUSE ): 8.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H * CVE-2023-38597 ( NVD ): 8.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H * CVE-2023-38599 ( NVD ): 6.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N * CVE-2023-38600 ( NVD ): 8.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H * CVE-2023-38611 ( NVD ): 8.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H Affected Products: * Basesystem Module 15-SP4 * Basesystem Module 15-SP5 * Desktop Applications Module 15-SP4 * Desktop Applications Module 15-SP5 * Development Tools Module 15-SP4 * Development Tools Module 15-SP5 * openSUSE Leap 15.4 * openSUSE Leap 15.5 * SUSE Linux Enterprise Desktop 15 SP4 * SUSE Linux Enterprise Desktop 15 SP5 * SUSE Linux Enterprise High Performance Computing 15 SP4 * SUSE Linux Enterprise High Performance Computing 15 SP5 * SUSE Linux Enterprise Real Time 15 SP4 * SUSE Linux Enterprise Real Time 15 SP5 * SUSE Linux Enterprise Server 15 SP4 * SUSE Linux Enterprise Server 15 SP5 * SUSE Linux Enterprise Server for SAP Applications 15 SP4 * SUSE Linux Enterprise Server for SAP Applications 15 SP5 * SUSE Manager Proxy 4.3 * SUSE Manager Retail Branch Server 4.3 * SUSE Manager Server 4.3 An update that solves 12 vulnerabilities can now be installed. ## Description: This update for webkit2gtk3 fixes the following issues: Update to version 2.40.5 (bsc#1213905): * CVE-2023-38133: Fixed information disclosure. * CVE-2023-38572: Fixed Same-Origin-Policy bypass. * CVE-2023-38592: Fixed arbitrary code execution. * CVE-2023-38594: Fixed arbitrary code execution. * CVE-2023-38595: Fixed arbitrary code execution. * CVE-2023-38597: Fixed arbitrary code execution. * CVE-2023-38599: Fixed sensitive user information tracking. * CVE-2023-38600: Fixed arbitrary code execution. * CVE-2023-38611: Fixed arbitrary code execution. Update to version 2.40.3 (bsc#1212863): * CVE-2023-32439: Fixed a bug where processing maliciously crafted web content may lead to arbitrary code execution. (bsc#1212863) * CVE-2023-32435: Fixed a bug where processing web content may lead to arbitrary code execution. (bsc#1212863) * CVE-2022-48503: Fixed a bug where processing web content may lead to arbitrary code execution. (bsc#1212863) ## Patch Instructions: To install this SUSE Important update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: * openSUSE Leap 15.4 zypper in -t patch SUSE-2023-3419=1 openSUSE-SLE-15.4-2023-3419=1 * openSUSE Leap 15.5 zypper in -t patch openSUSE-SLE-15.5-2023-3419=1 * Basesystem Module 15-SP4 zypper in -t patch SUSE-SLE-Module-Basesystem-15-SP4-2023-3419=1 * Basesystem Module 15-SP5 zypper in -t patch SUSE-SLE-Module-Basesystem-15-SP5-2023-3419=1 * Desktop Applications Module 15-SP4 zypper in -t patch SUSE-SLE-Module-Desktop-Applications-15-SP4-2023-3419=1 * Desktop Applications Module 15-SP5 zypper in -t patch SUSE-SLE-Module-Desktop-Applications-15-SP5-2023-3419=1 * Development Tools Module 15-SP4 zypper in -t patch SUSE-SLE-Module-Development-Tools-15-SP4-2023-3419=1 * Development Tools Module 15-SP5 zypper in -t patch SUSE-SLE-Module-Development-Tools-15-SP5-2023-3419=1 ## Package List: * openSUSE Leap 15.4 (noarch) * WebKitGTK-4.1-lang-2.40.5-150400.4.45.3 * WebKitGTK-4.0-lang-2.40.5-150400.4.45.3 * WebKitGTK-6.0-lang-2.40.5-150400.4.45.3 * openSUSE Leap 15.4 (aarch64 ppc64le s390x x86_64 i586) * webkit2gtk3-soup2-minibrowser-debuginfo-2.40.5-150400.4.45.3 * libwebkit2gtk-4_0-37-debuginfo-2.40.5-150400.4.45.3 * libjavascriptcoregtk-4_0-18-2.40.5-150400.4.45.3 * libwebkitgtk-6_0-4-2.40.5-150400.4.45.3 * webkit2gtk4-devel-2.40.5-150400.4.45.3 * typelib-1_0-WebKit2WebExtension-4_0-2.40.5-150400.4.45.3 * libjavascriptcoregtk-6_0-1-2.40.5-150400.4.45.3 * webkit-jsc-4.1-debuginfo-2.40.5-150400.4.45.3 * typelib-1_0-JavaScriptCore-6_0-2.40.5-150400.4.45.3 * typelib-1_0-WebKitWebProcessExtension-6_0-2.40.5-150400.4.45.3 * webkit2gtk3-debugsource-2.40.5-150400.4.45.3 * webkit-jsc-4-debuginfo-2.40.5-150400.4.45.3 * typelib-1_0-WebKit-6_0-2.40.5-150400.4.45.3 * webkit2gtk-4_0-injected-bundles-2.40.5-150400.4.45.3 * webkit2gtk4-debugsource-2.40.5-150400.4.45.3 * webkit2gtk-4_1-injected-bundles-debuginfo-2.40.5-150400.4.45.3 * webkit2gtk4-minibrowser-2.40.5-150400.4.45.3 * webkit-jsc-4.1-2.40.5-150400.4.45.3 * typelib-1_0-WebKit2-4_1-2.40.5-150400.4.45.3 * libwebkitgtk-6_0-4-debuginfo-2.40.5-150400.4.45.3 * libjavascriptcoregtk-6_0-1-debuginfo-2.40.5-150400.4.45.3 * webkit-jsc-6.0-debuginfo-2.40.5-150400.4.45.3 * webkit2gtk4-minibrowser-debuginfo-2.40.5-150400.4.45.3 * webkit-jsc-6.0-2.40.5-150400.4.45.3 * typelib-1_0-JavaScriptCore-4_0-2.40.5-150400.4.45.3 * webkit2gtk3-soup2-minibrowser-2.40.5-150400.4.45.3 * webkit2gtk-4_0-injected-bundles-debuginfo-2.40.5-150400.4.45.3 * webkitgtk-6_0-injected-bundles-debuginfo-2.40.5-150400.4.45.3 * webkit2gtk3-devel-2.40.5-150400.4.45.3 * libwebkit2gtk-4_1-0-2.40.5-150400.4.45.3 * libwebkit2gtk-4_1-0-debuginfo-2.40.5-150400.4.45.3 * typelib-1_0-WebKit2WebExtension-4_1-2.40.5-150400.4.45.3 * libjavascriptcoregtk-4_1-0-2.40.5-150400.4.45.3 * libjavascriptcoregtk-4_0-18-debuginfo-2.40.5-150400.4.45.3 * webkit2gtk3-soup2-devel-2.40.5-150400.4.45.3 * webkit2gtk3-minibrowser-2.40.5-150400.4.45.3 * libjavascriptcoregtk-4_1-0-debuginfo-2.40.5-150400.4.45.3 * webkit2gtk3-minibrowser-debuginfo-2.40.5-150400.4.45.3 * webkit-jsc-4-2.40.5-150400.4.45.3 * typelib-1_0-JavaScriptCore-4_1-2.40.5-150400.4.45.3 * webkit2gtk3-soup2-debugsource-2.40.5-150400.4.45.3 * libwebkit2gtk-4_0-37-2.40.5-150400.4.45.3 * webkitgtk-6_0-injected-bundles-2.40.5-150400.4.45.3 * typelib-1_0-WebKit2-4_0-2.40.5-150400.4.45.3 * webkit2gtk-4_1-injected-bundles-2.40.5-150400.4.45.3 * openSUSE Leap 15.4 (x86_64) * libwebkit2gtk-4_0-37-32bit-debuginfo-2.40.5-150400.4.45.3 * libjavascriptcoregtk-4_0-18-32bit-2.40.5-150400.4.45.3 * libwebkit2gtk-4_0-37-32bit-2.40.5-150400.4.45.3 * libjavascriptcoregtk-4_1-0-32bit-debuginfo-2.40.5-150400.4.45.3 * libwebkit2gtk-4_1-0-32bit-2.40.5-150400.4.45.3 * libjavascriptcoregtk-4_1-0-32bit-2.40.5-150400.4.45.3 * libjavascriptcoregtk-4_0-18-32bit-debuginfo-2.40.5-150400.4.45.3 * libwebkit2gtk-4_1-0-32bit-debuginfo-2.40.5-150400.4.45.3 * openSUSE Leap 15.4 (aarch64_ilp32) * libjavascriptcoregtk-4_1-0-64bit-debuginfo-2.40.5-150400.4.45.3 * libwebkit2gtk-4_0-37-64bit-debuginfo-2.40.5-150400.4.45.3 * libwebkit2gtk-4_0-37-64bit-2.40.5-150400.4.45.3 * libjavascriptcoregtk-4_1-0-64bit-2.40.5-150400.4.45.3 * libjavascriptcoregtk-4_0-18-64bit-2.40.5-150400.4.45.3 * libjavascriptcoregtk-4_0-18-64bit-debuginfo-2.40.5-150400.4.45.3 * libwebkit2gtk-4_1-0-64bit-2.40.5-150400.4.45.3 * libwebkit2gtk-4_1-0-64bit-debuginfo-2.40.5-150400.4.45.3 * openSUSE Leap 15.5 (noarch) * WebKitGTK-4.1-lang-2.40.5-150400.4.45.3 * WebKitGTK-4.0-lang-2.40.5-150400.4.45.3 * WebKitGTK-6.0-lang-2.40.5-150400.4.45.3 * openSUSE Leap 15.5 (aarch64 ppc64le s390x x86_64) * webkit2gtk3-soup2-minibrowser-debuginfo-2.40.5-150400.4.45.3 * libwebkit2gtk-4_0-37-debuginfo-2.40.5-150400.4.45.3 * libjavascriptcoregtk-4_0-18-2.40.5-150400.4.45.3 * libwebkitgtk-6_0-4-2.40.5-150400.4.45.3 * webkit2gtk-4_1-injected-bundles-2.40.5-150400.4.45.3 * webkit2gtk4-devel-2.40.5-150400.4.45.3 * typelib-1_0-WebKit2WebExtension-4_0-2.40.5-150400.4.45.3 * libjavascriptcoregtk-6_0-1-2.40.5-150400.4.45.3 * webkit-jsc-4.1-debuginfo-2.40.5-150400.4.45.3 * typelib-1_0-JavaScriptCore-6_0-2.40.5-150400.4.45.3 * typelib-1_0-WebKitWebProcessExtension-6_0-2.40.5-150400.4.45.3 * typelib-1_0-WebKit-6_0-2.40.5-150400.4.45.3 * webkit-jsc-4-debuginfo-2.40.5-150400.4.45.3 * webkit2gtk3-debugsource-2.40.5-150400.4.45.3 * webkit2gtk-4_0-injected-bundles-2.40.5-150400.4.45.3 * webkit2gtk4-debugsource-2.40.5-150400.4.45.3 * webkit2gtk-4_1-injected-bundles-debuginfo-2.40.5-150400.4.45.3 * webkit2gtk4-minibrowser-2.40.5-150400.4.45.3 * webkit-jsc-4.1-2.40.5-150400.4.45.3 * typelib-1_0-WebKit2-4_1-2.40.5-150400.4.45.3 * libwebkitgtk-6_0-4-debuginfo-2.40.5-150400.4.45.3 * libjavascriptcoregtk-6_0-1-debuginfo-2.40.5-150400.4.45.3 * webkit-jsc-6.0-debuginfo-2.40.5-150400.4.45.3 * webkit2gtk4-minibrowser-debuginfo-2.40.5-150400.4.45.3 * webkit-jsc-6.0-2.40.5-150400.4.45.3 * typelib-1_0-JavaScriptCore-4_0-2.40.5-150400.4.45.3 * webkit2gtk3-soup2-minibrowser-2.40.5-150400.4.45.3 * webkit2gtk-4_0-injected-bundles-debuginfo-2.40.5-150400.4.45.3 * webkitgtk-6_0-injected-bundles-debuginfo-2.40.5-150400.4.45.3 * webkit2gtk3-devel-2.40.5-150400.4.45.3 * libwebkit2gtk-4_1-0-2.40.5-150400.4.45.3 * libwebkit2gtk-4_1-0-debuginfo-2.40.5-150400.4.45.3 * libjavascriptcoregtk-4_1-0-2.40.5-150400.4.45.3 * libjavascriptcoregtk-4_0-18-debuginfo-2.40.5-150400.4.45.3 * webkit2gtk3-soup2-devel-2.40.5-150400.4.45.3 * webkit2gtk3-minibrowser-2.40.5-150400.4.45.3 * libjavascriptcoregtk-4_1-0-debuginfo-2.40.5-150400.4.45.3 * webkit-jsc-4-2.40.5-150400.4.45.3 * webkit2gtk3-minibrowser-debuginfo-2.40.5-150400.4.45.3 * typelib-1_0-JavaScriptCore-4_1-2.40.5-150400.4.45.3 * webkit2gtk3-soup2-debugsource-2.40.5-150400.4.45.3 * libwebkit2gtk-4_0-37-2.40.5-150400.4.45.3 * webkitgtk-6_0-injected-bundles-2.40.5-150400.4.45.3 * typelib-1_0-WebKit2-4_0-2.40.5-150400.4.45.3 * typelib-1_0-WebKit2WebExtension-4_1-2.40.5-150400.4.45.3 * openSUSE Leap 15.5 (x86_64) * libwebkit2gtk-4_0-37-32bit-debuginfo-2.40.5-150400.4.45.3 * libwebkit2gtk-4_0-37-32bit-2.40.5-150400.4.45.3 * libjavascriptcoregtk-4_0-18-32bit-2.40.5-150400.4.45.3 * libjavascriptcoregtk-4_1-0-32bit-debuginfo-2.40.5-150400.4.45.3 * libwebkit2gtk-4_1-0-32bit-2.40.5-150400.4.45.3 * libjavascriptcoregtk-4_1-0-32bit-2.40.5-150400.4.45.3 * libjavascriptcoregtk-4_0-18-32bit-debuginfo-2.40.5-150400.4.45.3 * libwebkit2gtk-4_1-0-32bit-debuginfo-2.40.5-150400.4.45.3 * openSUSE Leap 15.5 (aarch64_ilp32) * libjavascriptcoregtk-4_1-0-64bit-debuginfo-2.40.5-150400.4.45.3 * libwebkit2gtk-4_0-37-64bit-debuginfo-2.40.5-150400.4.45.3 * libwebkit2gtk-4_0-37-64bit-2.40.5-150400.4.45.3 * libjavascriptcoregtk-4_1-0-64bit-2.40.5-150400.4.45.3 * libjavascriptcoregtk-4_0-18-64bit-2.40.5-150400.4.45.3 * libjavascriptcoregtk-4_0-18-64bit-debuginfo-2.40.5-150400.4.45.3 * libwebkit2gtk-4_1-0-64bit-2.40.5-150400.4.45.3 * libwebkit2gtk-4_1-0-64bit-debuginfo-2.40.5-150400.4.45.3 * Basesystem Module 15-SP4 (aarch64 ppc64le s390x x86_64) * typelib-1_0-JavaScriptCore-4_0-2.40.5-150400.4.45.3 * webkit2gtk-4_0-injected-bundles-debuginfo-2.40.5-150400.4.45.3 * libwebkit2gtk-4_0-37-debuginfo-2.40.5-150400.4.45.3 * webkit2gtk-4_0-injected-bundles-2.40.5-150400.4.45.3 * libjavascriptcoregtk-4_0-18-2.40.5-150400.4.45.3 * webkit2gtk3-soup2-debugsource-2.40.5-150400.4.45.3 * libwebkit2gtk-4_0-37-2.40.5-150400.4.45.3 * libjavascriptcoregtk-4_0-18-debuginfo-2.40.5-150400.4.45.3 * typelib-1_0-WebKit2-4_0-2.40.5-150400.4.45.3 * typelib-1_0-WebKit2WebExtension-4_0-2.40.5-150400.4.45.3 * webkit2gtk3-soup2-devel-2.40.5-150400.4.45.3 * Basesystem Module 15-SP5 (aarch64 ppc64le s390x x86_64) * typelib-1_0-JavaScriptCore-4_0-2.40.5-150400.4.45.3 * webkit2gtk-4_0-injected-bundles-debuginfo-2.40.5-150400.4.45.3 * libwebkit2gtk-4_0-37-debuginfo-2.40.5-150400.4.45.3 * webkit2gtk-4_0-injected-bundles-2.40.5-150400.4.45.3 * libjavascriptcoregtk-4_0-18-2.40.5-150400.4.45.3 * webkit2gtk3-soup2-debugsource-2.40.5-150400.4.45.3 * libwebkit2gtk-4_0-37-2.40.5-150400.4.45.3 * libjavascriptcoregtk-4_0-18-debuginfo-2.40.5-150400.4.45.3 * typelib-1_0-WebKit2-4_0-2.40.5-150400.4.45.3 * typelib-1_0-WebKit2WebExtension-4_0-2.40.5-150400.4.45.3 * webkit2gtk3-soup2-devel-2.40.5-150400.4.45.3 * Desktop Applications Module 15-SP4 (aarch64 ppc64le s390x x86_64) * webkit2gtk3-debugsource-2.40.5-150400.4.45.3 * libjavascriptcoregtk-4_1-0-debuginfo-2.40.5-150400.4.45.3 * typelib-1_0-JavaScriptCore-4_1-2.40.5-150400.4.45.3 * webkit2gtk3-devel-2.40.5-150400.4.45.3 * libwebkit2gtk-4_1-0-2.40.5-150400.4.45.3 * libwebkit2gtk-4_1-0-debuginfo-2.40.5-150400.4.45.3 * webkit2gtk-4_1-injected-bundles-debuginfo-2.40.5-150400.4.45.3 * libjavascriptcoregtk-4_1-0-2.40.5-150400.4.45.3 * webkit2gtk-4_1-injected-bundles-2.40.5-150400.4.45.3 * typelib-1_0-WebKit2-4_1-2.40.5-150400.4.45.3 * typelib-1_0-WebKit2WebExtension-4_1-2.40.5-150400.4.45.3 * Desktop Applications Module 15-SP5 (aarch64 ppc64le s390x x86_64) * webkit2gtk3-debugsource-2.40.5-150400.4.45.3 * libjavascriptcoregtk-4_1-0-debuginfo-2.40.5-150400.4.45.3 * typelib-1_0-JavaScriptCore-4_1-2.40.5-150400.4.45.3 * webkit2gtk3-devel-2.40.5-150400.4.45.3 * libwebkit2gtk-4_1-0-2.40.5-150400.4.45.3 * libwebkit2gtk-4_1-0-debuginfo-2.40.5-150400.4.45.3 * webkit2gtk-4_1-injected-bundles-debuginfo-2.40.5-150400.4.45.3 * libjavascriptcoregtk-4_1-0-2.40.5-150400.4.45.3 * webkit2gtk-4_1-injected-bundles-2.40.5-150400.4.45.3 * typelib-1_0-WebKit2-4_1-2.40.5-150400.4.45.3 * typelib-1_0-WebKit2WebExtension-4_1-2.40.5-150400.4.45.3 * Development Tools Module 15-SP4 (aarch64 ppc64le s390x x86_64) * webkit2gtk4-debugsource-2.40.5-150400.4.45.3 * libwebkitgtk-6_0-4-2.40.5-150400.4.45.3 * webkitgtk-6_0-injected-bundles-2.40.5-150400.4.45.3 * libwebkitgtk-6_0-4-debuginfo-2.40.5-150400.4.45.3 * libjavascriptcoregtk-6_0-1-2.40.5-150400.4.45.3 * libjavascriptcoregtk-6_0-1-debuginfo-2.40.5-150400.4.45.3 * Development Tools Module 15-SP5 (aarch64 ppc64le s390x x86_64) * webkit2gtk4-debugsource-2.40.5-150400.4.45.3 * libwebkitgtk-6_0-4-2.40.5-150400.4.45.3 * webkitgtk-6_0-injected-bundles-2.40.5-150400.4.45.3 * libwebkitgtk-6_0-4-debuginfo-2.40.5-150400.4.45.3 * libjavascriptcoregtk-6_0-1-2.40.5-150400.4.45.3 * libjavascriptcoregtk-6_0-1-debuginfo-2.40.5-150400.4.45.3 ## References: * https://www.suse.com/security/cve/CVE-2022-48503.html * https://www.suse.com/security/cve/CVE-2023-32435.html * https://www.suse.com/security/cve/CVE-2023-32439.html * https://www.suse.com/security/cve/CVE-2023-38133.html * https://www.suse.com/security/cve/CVE-2023-38572.html * https://www.suse.com/security/cve/CVE-2023-38592.html * https://www.suse.com/security/cve/CVE-2023-38594.html * https://www.suse.com/security/cve/CVE-2023-38595.html * https://www.suse.com/security/cve/CVE-2023-38597.html * https://www.suse.com/security/cve/CVE-2023-38599.html * https://www.suse.com/security/cve/CVE-2023-38600.html * https://www.suse.com/security/cve/CVE-2023-38611.html * https://bugzilla.suse.com/show_bug.cgi?id=1212863 * https://bugzilla.suse.com/show_bug.cgi?id=1213905

1 0

RE: ADNOC-UAE-197-1022 FOR CONTRACTORS/VENDORS - Invitation to Tender (ITT) or Request for Quotation(RFQ)
by Abu Dhabi National Oil Company - ADNOC 23 Aug '23

23 Aug '23

= --RE: Invitation to Tender (ITT) or Request for Quotation(RFQ)-- = Dear Sir / Madam This invitation is coming from the desk of Abu Dhabi National Oil Company (ADNOC) which is in line with the ongoing projects of interest hence the extension of the Invitation to you and your esteemed organization. This invitation is In line with the continuous development and expansion of Abu Dhabi National Oil Company (ADNOC) located at Abu Dhabi National Oil Company Tower, West Corniche Road, P.O. Box: 898 United Arab Emirates,and we do hereby notify your company and your esteemed organization of the ongoing enrollment of new Vendors, contractors, suppliers, intending partners and the Validation of the existing Vendors for the ADNOC 2023 mid-projects. This contractor/vendor/suppliers' enrollment is for the 2023 projects which will be closing in 14 days' time beginning today. Therefore, prospective Contractors/Vendors and existing vendors who are interested in receiving the Invitation to Tender (ITT) or Request for Quotation(RFQ) are to provide us with sufficient information to make an initial assessment of their capability, and competence to handle any of the projects as shall be listed. As you receive this notice, kindly indicate your intention to participate or reasons for non-participation and if you have initially identified your intent, please ignore. These projects are open to both local and international companies worldwide. If you and your organization have the intention to participate in the process, please confirm your interest by replying to this email so as to receive the EOI "Acknowledgement Form" and other Vendor registration questionnaires and lay down formalities for the submission of per-qualification documents on or before the stated deadline above. We sincerely appreciate your interest in this invitation and we look forward to your early response to show your interest. Kind Regards, Mr. Barry Dean Vendor Coordinator Group Procurement Contracts Shared Services Center ADNOC - Abu Dhabi National Oil Company, U.A.E Address. ADNOC Tower, West Corniche Road, P.O. Box: 898 United Arab Emirates

1 0

SUSE-SU-2023:3394-1: important: Security update for postfix
by security＠lists.opensuse.org 23 Aug '23

23 Aug '23

# Security update for postfix Announcement ID: SUSE-SU-2023:3394-1 Rating: important References: * #1211196 * #1213515 Cross-References: * CVE-2023-32182 CVSS scores: Affected Products: * Basesystem Module 15-SP5 * Legacy Module 15-SP5 * openSUSE Leap 15.5 * Server Applications Module 15-SP5 * SUSE Linux Enterprise Desktop 15 SP5 * SUSE Linux Enterprise High Performance Computing 15 SP5 * SUSE Linux Enterprise Real Time 15 SP5 * SUSE Linux Enterprise Server 15 SP5 * SUSE Linux Enterprise Server for SAP Applications 15 SP5 An update that solves one vulnerability and has one fix can now be installed. ## Description: This update for postfix fixes the following issues: * CVE-2023-32182: Fixed config_postfix SUSE specific script potentially bad /tmp file usage (bsc#1211196). * Update to from 3.7.2 to 3.7.3: * Fixes a bug where some messages were not delivered after "warning: Unexpected record type 'X'. (bsc#1213515) ## Patch Instructions: To install this SUSE Important update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: * openSUSE Leap 15.5 zypper in -t patch SUSE-2023-3394=1 openSUSE-SLE-15.5-2023-3394=1 * Basesystem Module 15-SP5 zypper in -t patch SUSE-SLE-Module-Basesystem-15-SP5-2023-3394=1 * Legacy Module 15-SP5 zypper in -t patch SUSE-SLE-Module-Legacy-15-SP5-2023-3394=1 * Server Applications Module 15-SP5 zypper in -t patch SUSE-SLE-Module-Server-Applications-15-SP5-2023-3394=1 ## Package List: * openSUSE Leap 15.5 (aarch64 ppc64le s390x x86_64 i586) * postfix-ldap-3.7.3-150500.3.5.1 * postfix-ldap-debuginfo-3.7.3-150500.3.5.1 * postfix-bdb-lmdb-3.7.3-150500.3.5.1 * postfix-bdb-lmdb-debuginfo-3.7.3-150500.3.5.1 * postfix-bdb-debugsource-3.7.3-150500.3.5.1 * postfix-devel-3.7.3-150500.3.5.1 * postfix-postgresql-debuginfo-3.7.3-150500.3.5.1 * postfix-bdb-debuginfo-3.7.3-150500.3.5.1 * postfix-debuginfo-3.7.3-150500.3.5.1 * postfix-3.7.3-150500.3.5.1 * postfix-mysql-3.7.3-150500.3.5.1 * postfix-postgresql-3.7.3-150500.3.5.1 * postfix-bdb-3.7.3-150500.3.5.1 * postfix-debugsource-3.7.3-150500.3.5.1 * postfix-mysql-debuginfo-3.7.3-150500.3.5.1 * openSUSE Leap 15.5 (noarch) * postfix-doc-3.7.3-150500.3.5.1 * Basesystem Module 15-SP5 (aarch64 ppc64le s390x x86_64) * postfix-ldap-3.7.3-150500.3.5.1 * postfix-ldap-debuginfo-3.7.3-150500.3.5.1 * postfix-devel-3.7.3-150500.3.5.1 * postfix-debuginfo-3.7.3-150500.3.5.1 * postfix-3.7.3-150500.3.5.1 * postfix-debugsource-3.7.3-150500.3.5.1 * Basesystem Module 15-SP5 (noarch) * postfix-doc-3.7.3-150500.3.5.1 * Legacy Module 15-SP5 (aarch64 ppc64le s390x x86_64) * postfix-bdb-lmdb-3.7.3-150500.3.5.1 * postfix-bdb-lmdb-debuginfo-3.7.3-150500.3.5.1 * postfix-bdb-debugsource-3.7.3-150500.3.5.1 * postfix-bdb-debuginfo-3.7.3-150500.3.5.1 * postfix-bdb-3.7.3-150500.3.5.1 * Server Applications Module 15-SP5 (aarch64 ppc64le s390x x86_64) * postfix-mysql-3.7.3-150500.3.5.1 * postfix-debugsource-3.7.3-150500.3.5.1 * postfix-debuginfo-3.7.3-150500.3.5.1 * postfix-mysql-debuginfo-3.7.3-150500.3.5.1 ## References: * https://www.suse.com/security/cve/CVE-2023-32182.html * https://bugzilla.suse.com/show_bug.cgi?id=1211196 * https://bugzilla.suse.com/show_bug.cgi?id=1213515

1 0

SUSE-SU-2023:3395-1: moderate: Security update for xen
by security＠lists.opensuse.org 23 Aug '23

23 Aug '23

# Security update for xen Announcement ID: SUSE-SU-2023:3395-1 Rating: moderate References: * #1027519 * #1213616 * #1214082 * #1214083 Cross-References: * CVE-2022-40982 * CVE-2023-20569 * CVE-2023-20593 CVSS scores: * CVE-2022-40982 ( SUSE ): 6.2 CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N * CVE-2022-40982 ( NVD ): 6.5 CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N * CVE-2023-20569 ( SUSE ): 5.6 CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:C/C:H/I:N/A:N * CVE-2023-20569 ( NVD ): 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N * CVE-2023-20593 ( SUSE ): 6.2 CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N * CVE-2023-20593 ( NVD ): 5.5 CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N Affected Products: * Basesystem Module 15-SP4 * openSUSE Leap 15.4 * openSUSE Leap Micro 5.3 * openSUSE Leap Micro 5.4 * Server Applications Module 15-SP4 * SUSE Linux Enterprise Desktop 15 SP4 * SUSE Linux Enterprise High Performance Computing 15 SP4 * SUSE Linux Enterprise Micro 5.3 * SUSE Linux Enterprise Micro 5.4 * SUSE Linux Enterprise Micro for Rancher 5.3 * SUSE Linux Enterprise Micro for Rancher 5.4 * SUSE Linux Enterprise Real Time 15 SP4 * SUSE Linux Enterprise Server 15 SP4 * SUSE Linux Enterprise Server for SAP Applications 15 SP4 * SUSE Manager Proxy 4.3 * SUSE Manager Retail Branch Server 4.3 * SUSE Manager Server 4.3 An update that solves three vulnerabilities and has one fix can now be installed. ## Description: This update for xen fixes the following issues: * CVE-2023-20569: Fixed side channel attack Inception or RAS Poisoning. (bsc#1214082, XSA-434) * CVE-2022-40982: Fixed transient execution attack called "Gather Data Sampling". (bsc#1214083, XSA-435) * CVE-2023-20593: Fixed a ZenBleed issue in "Zen 2" CPUs that could allow an attacker to potentially access sensitive information. (bsc#1213616, XSA-433) ## Patch Instructions: To install this SUSE Moderate update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: * openSUSE Leap 15.4 zypper in -t patch openSUSE-SLE-15.4-2023-3395=1 SUSE-2023-3395=1 * openSUSE Leap Micro 5.3 zypper in -t patch openSUSE-Leap-Micro-5.3-2023-3395=1 * openSUSE Leap Micro 5.4 zypper in -t patch openSUSE-Leap-Micro-5.4-2023-3395=1 * SUSE Linux Enterprise Micro for Rancher 5.3 zypper in -t patch SUSE-SLE-Micro-5.3-2023-3395=1 * SUSE Linux Enterprise Micro 5.3 zypper in -t patch SUSE-SLE-Micro-5.3-2023-3395=1 * SUSE Linux Enterprise Micro for Rancher 5.4 zypper in -t patch SUSE-SLE-Micro-5.4-2023-3395=1 * SUSE Linux Enterprise Micro 5.4 zypper in -t patch SUSE-SLE-Micro-5.4-2023-3395=1 * Basesystem Module 15-SP4 zypper in -t patch SUSE-SLE-Module-Basesystem-15-SP4-2023-3395=1 * Server Applications Module 15-SP4 zypper in -t patch SUSE-SLE-Module-Server-Applications-15-SP4-2023-3395=1 ## Package List: * openSUSE Leap 15.4 (aarch64 x86_64 i586) * xen-libs-4.16.5_02-150400.4.31.1 * xen-tools-domU-4.16.5_02-150400.4.31.1 * xen-devel-4.16.5_02-150400.4.31.1 * xen-libs-debuginfo-4.16.5_02-150400.4.31.1 * xen-debugsource-4.16.5_02-150400.4.31.1 * xen-tools-domU-debuginfo-4.16.5_02-150400.4.31.1 * openSUSE Leap 15.4 (x86_64) * xen-libs-32bit-debuginfo-4.16.5_02-150400.4.31.1 * xen-libs-32bit-4.16.5_02-150400.4.31.1 * openSUSE Leap 15.4 (aarch64 x86_64) * xen-tools-4.16.5_02-150400.4.31.1 * xen-doc-html-4.16.5_02-150400.4.31.1 * xen-tools-debuginfo-4.16.5_02-150400.4.31.1 * xen-4.16.5_02-150400.4.31.1 * openSUSE Leap 15.4 (noarch) * xen-tools-xendomains-wait-disk-4.16.5_02-150400.4.31.1 * openSUSE Leap 15.4 (aarch64_ilp32) * xen-libs-64bit-4.16.5_02-150400.4.31.1 * xen-libs-64bit-debuginfo-4.16.5_02-150400.4.31.1 * openSUSE Leap Micro 5.3 (x86_64) * xen-debugsource-4.16.5_02-150400.4.31.1 * xen-libs-debuginfo-4.16.5_02-150400.4.31.1 * xen-libs-4.16.5_02-150400.4.31.1 * openSUSE Leap Micro 5.4 (x86_64) * xen-debugsource-4.16.5_02-150400.4.31.1 * xen-libs-debuginfo-4.16.5_02-150400.4.31.1 * xen-libs-4.16.5_02-150400.4.31.1 * SUSE Linux Enterprise Micro for Rancher 5.3 (x86_64) * xen-debugsource-4.16.5_02-150400.4.31.1 * xen-libs-debuginfo-4.16.5_02-150400.4.31.1 * xen-libs-4.16.5_02-150400.4.31.1 * SUSE Linux Enterprise Micro 5.3 (x86_64) * xen-debugsource-4.16.5_02-150400.4.31.1 * xen-libs-debuginfo-4.16.5_02-150400.4.31.1 * xen-libs-4.16.5_02-150400.4.31.1 * SUSE Linux Enterprise Micro for Rancher 5.4 (x86_64) * xen-debugsource-4.16.5_02-150400.4.31.1 * xen-libs-debuginfo-4.16.5_02-150400.4.31.1 * xen-libs-4.16.5_02-150400.4.31.1 * SUSE Linux Enterprise Micro 5.4 (x86_64) * xen-debugsource-4.16.5_02-150400.4.31.1 * xen-libs-debuginfo-4.16.5_02-150400.4.31.1 * xen-libs-4.16.5_02-150400.4.31.1 * Basesystem Module 15-SP4 (x86_64) * xen-libs-4.16.5_02-150400.4.31.1 * xen-tools-domU-4.16.5_02-150400.4.31.1 * xen-libs-debuginfo-4.16.5_02-150400.4.31.1 * xen-debugsource-4.16.5_02-150400.4.31.1 * xen-tools-domU-debuginfo-4.16.5_02-150400.4.31.1 * Server Applications Module 15-SP4 (x86_64) * xen-devel-4.16.5_02-150400.4.31.1 * xen-debugsource-4.16.5_02-150400.4.31.1 * xen-tools-4.16.5_02-150400.4.31.1 * xen-tools-debuginfo-4.16.5_02-150400.4.31.1 * xen-4.16.5_02-150400.4.31.1 * Server Applications Module 15-SP4 (noarch) * xen-tools-xendomains-wait-disk-4.16.5_02-150400.4.31.1 ## References: * https://www.suse.com/security/cve/CVE-2022-40982.html * https://www.suse.com/security/cve/CVE-2023-20569.html * https://www.suse.com/security/cve/CVE-2023-20593.html * https://bugzilla.suse.com/show_bug.cgi?id=1027519 * https://bugzilla.suse.com/show_bug.cgi?id=1213616 * https://bugzilla.suse.com/show_bug.cgi?id=1214082 * https://bugzilla.suse.com/show_bug.cgi?id=1214083

1 0