August 2023 - openSUSE Security Announce

SUSE-SU-2023:3247-1: important: Security update for gstreamer-plugins-ugly
by security＠lists.opensuse.org 08 Aug '23

08 Aug '23

# Security update for gstreamer-plugins-ugly Announcement ID: SUSE-SU-2023:3247-1 Rating: important References: * #1213750 * #1213751 Cross-References: * CVE-2023-38103 * CVE-2023-38104 CVSS scores: * CVE-2023-38103 ( SUSE ): 8.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H * CVE-2023-38104 ( SUSE ): 8.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H Affected Products: * openSUSE Leap 15.5 * SUSE Linux Enterprise Desktop 15 SP5 * SUSE Linux Enterprise Server 15 SP5 * SUSE Linux Enterprise Server for SAP Applications 15 SP5 * SUSE Linux Enterprise Workstation Extension 15 SP5 An update that solves two vulnerabilities can now be installed. ## Description: This update for gstreamer-plugins-ugly fixes the following issues: * CVE-2023-38103: Fixed an integer overflows when calculating the size of SIPR audio buffers. (bsc#1213751) * CVE-2023-38104: Fixed an integer overflow when calculation audio packet size . (bsc#1213750) ## Patch Instructions: To install this SUSE Important update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: * openSUSE Leap 15.5 zypper in -t patch SUSE-2023-3247=1 openSUSE-SLE-15.5-2023-3247=1 * SUSE Linux Enterprise Workstation Extension 15 SP5 zypper in -t patch SUSE-SLE-Product-WE-15-SP5-2023-3247=1 ## Package List: * openSUSE Leap 15.5 (aarch64 ppc64le s390x x86_64 i586) * gstreamer-plugins-ugly-debugsource-1.22.0-150500.3.3.1 * gstreamer-plugins-ugly-debuginfo-1.22.0-150500.3.3.1 * gstreamer-plugins-ugly-1.22.0-150500.3.3.1 * openSUSE Leap 15.5 (x86_64) * gstreamer-plugins-ugly-32bit-1.22.0-150500.3.3.1 * gstreamer-plugins-ugly-32bit-debuginfo-1.22.0-150500.3.3.1 * openSUSE Leap 15.5 (noarch) * gstreamer-plugins-ugly-lang-1.22.0-150500.3.3.1 * openSUSE Leap 15.5 (aarch64_ilp32) * gstreamer-plugins-ugly-64bit-1.22.0-150500.3.3.1 * gstreamer-plugins-ugly-64bit-debuginfo-1.22.0-150500.3.3.1 * SUSE Linux Enterprise Workstation Extension 15 SP5 (x86_64) * gstreamer-plugins-ugly-debugsource-1.22.0-150500.3.3.1 * gstreamer-plugins-ugly-debuginfo-1.22.0-150500.3.3.1 * gstreamer-plugins-ugly-1.22.0-150500.3.3.1 * SUSE Linux Enterprise Workstation Extension 15 SP5 (noarch) * gstreamer-plugins-ugly-lang-1.22.0-150500.3.3.1 ## References: * https://www.suse.com/security/cve/CVE-2023-38103.html * https://www.suse.com/security/cve/CVE-2023-38104.html * https://bugzilla.suse.com/show_bug.cgi?id=1213750 * https://bugzilla.suse.com/show_bug.cgi?id=1213751

1 0

SUSE-SU-2023:3248-1: important: Security update for gstreamer-plugins-good
by security＠lists.opensuse.org 08 Aug '23

08 Aug '23

# Security update for gstreamer-plugins-good Announcement ID: SUSE-SU-2023:3248-1 Rating: important References: * #1213128 Cross-References: * CVE-2023-37327 CVSS scores: * CVE-2023-37327 ( SUSE ): 7.8 CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H Affected Products: * Basesystem Module 15-SP5 * openSUSE Leap 15.5 * SUSE Linux Enterprise Desktop 15 SP5 * SUSE Linux Enterprise High Performance Computing 15 SP5 * SUSE Linux Enterprise Real Time 15 SP5 * SUSE Linux Enterprise Server 15 SP5 * SUSE Linux Enterprise Server for SAP Applications 15 SP5 An update that solves one vulnerability can now be installed. ## Description: This update for gstreamer-plugins-good fixes the following issues: * CVE-2023-37327: Fixed FLAC file parsing integer overflow remote code execution vulnerability. (bsc#1213128) ## Patch Instructions: To install this SUSE Important update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: * openSUSE Leap 15.5 zypper in -t patch SUSE-2023-3248=1 openSUSE-SLE-15.5-2023-3248=1 * Basesystem Module 15-SP5 zypper in -t patch SUSE-SLE-Module-Basesystem-15-SP5-2023-3248=1 ## Package List: * openSUSE Leap 15.5 (aarch64 ppc64le s390x x86_64 i586) * gstreamer-plugins-good-extra-1.22.0-150500.4.3.1 * gstreamer-plugins-good-debuginfo-1.22.0-150500.4.3.1 * gstreamer-plugins-good-gtk-debuginfo-1.22.0-150500.4.3.1 * gstreamer-plugins-good-jack-debuginfo-1.22.0-150500.4.3.1 * gstreamer-plugins-good-1.22.0-150500.4.3.1 * gstreamer-plugins-good-qtqml-1.22.0-150500.4.3.1 * gstreamer-plugins-good-jack-1.22.0-150500.4.3.1 * gstreamer-plugins-good-qtqml-debuginfo-1.22.0-150500.4.3.1 * gstreamer-plugins-good-debugsource-1.22.0-150500.4.3.1 * gstreamer-plugins-good-extra-debuginfo-1.22.0-150500.4.3.1 * gstreamer-plugins-good-gtk-1.22.0-150500.4.3.1 * openSUSE Leap 15.5 (x86_64) * gstreamer-plugins-good-extra-32bit-1.22.0-150500.4.3.1 * gstreamer-plugins-good-extra-32bit-debuginfo-1.22.0-150500.4.3.1 * gstreamer-plugins-good-32bit-1.22.0-150500.4.3.1 * gstreamer-plugins-good-jack-32bit-debuginfo-1.22.0-150500.4.3.1 * gstreamer-plugins-good-jack-32bit-1.22.0-150500.4.3.1 * gstreamer-plugins-good-32bit-debuginfo-1.22.0-150500.4.3.1 * openSUSE Leap 15.5 (noarch) * gstreamer-plugins-good-lang-1.22.0-150500.4.3.1 * openSUSE Leap 15.5 (aarch64_ilp32) * gstreamer-plugins-good-jack-64bit-debuginfo-1.22.0-150500.4.3.1 * gstreamer-plugins-good-64bit-1.22.0-150500.4.3.1 * gstreamer-plugins-good-jack-64bit-1.22.0-150500.4.3.1 * gstreamer-plugins-good-extra-64bit-1.22.0-150500.4.3.1 * gstreamer-plugins-good-64bit-debuginfo-1.22.0-150500.4.3.1 * gstreamer-plugins-good-extra-64bit-debuginfo-1.22.0-150500.4.3.1 * Basesystem Module 15-SP5 (aarch64 ppc64le s390x x86_64) * gstreamer-plugins-good-1.22.0-150500.4.3.1 * gstreamer-plugins-good-debuginfo-1.22.0-150500.4.3.1 * gstreamer-plugins-good-debugsource-1.22.0-150500.4.3.1 * Basesystem Module 15-SP5 (noarch) * gstreamer-plugins-good-lang-1.22.0-150500.4.3.1 ## References: * https://www.suse.com/security/cve/CVE-2023-37327.html * https://bugzilla.suse.com/show_bug.cgi?id=1213128

1 0

SUSE-SU-2023:3249-1: important: Security update for gstreamer-plugins-bad
by security＠lists.opensuse.org 08 Aug '23

08 Aug '23

# Security update for gstreamer-plugins-bad Announcement ID: SUSE-SU-2023:3249-1 Rating: important References: * #1213126 Cross-References: * CVE-2023-37329 CVSS scores: * CVE-2023-37329 ( SUSE ): 7.8 CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H Affected Products: * Basesystem Module 15-SP5 * Desktop Applications Module 15-SP5 * openSUSE Leap 15.5 * SUSE Linux Enterprise Desktop 15 SP5 * SUSE Linux Enterprise High Performance Computing 15 SP5 * SUSE Linux Enterprise Micro 5.5 * SUSE Linux Enterprise Real Time 15 SP5 * SUSE Linux Enterprise Server 15 SP5 * SUSE Linux Enterprise Server for SAP Applications 15 SP5 * SUSE Package Hub 15 15-SP5 An update that solves one vulnerability can now be installed. ## Description: This update for gstreamer-plugins-bad fixes the following issues: * CVE-2023-37329: Fixed a heap overwrite in PGS subtitle overlay decoder which might trigger a crash or remote code execution. (bsc#1213126) ## Patch Instructions: To install this SUSE Important update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: * openSUSE Leap 15.5 zypper in -t patch SUSE-2023-3249=1 * Basesystem Module 15-SP5 zypper in -t patch SUSE-SLE-Module-Basesystem-15-SP5-2023-3249=1 * Desktop Applications Module 15-SP5 zypper in -t patch SUSE-SLE-Module-Desktop-Applications-15-SP5-2023-3249=1 * SUSE Package Hub 15 15-SP5 zypper in -t patch SUSE-SLE-Module-Packagehub-Subpackages-15-SP5-2023-3249=1 ## Package List: * openSUSE Leap 15.5 (aarch64 ppc64le s390x x86_64 i586) * gstreamer-plugins-bad-devel-1.22.0-150500.3.3.1 * libgstplayer-1_0-0-1.22.0-150500.3.3.1 * typelib-1_0-GstInsertBin-1_0-1.22.0-150500.3.3.1 * typelib-1_0-GstTranscoder-1_0-1.22.0-150500.3.3.1 * libgstbasecamerabinsrc-1_0-0-1.22.0-150500.3.3.1 * typelib-1_0-GstPlayer-1_0-1.22.0-150500.3.3.1 * typelib-1_0-GstBadAudio-1_0-1.22.0-150500.3.3.1 * gstreamer-plugins-bad-chromaprint-debuginfo-1.22.0-150500.3.3.1 * libgstcuda-1_0-0-debuginfo-1.22.0-150500.3.3.1 * libgstphotography-1_0-0-debuginfo-1.22.0-150500.3.3.1 * gstreamer-transcoder-debuginfo-1.22.0-150500.3.3.1 * libgstcodecs-1_0-0-1.22.0-150500.3.3.1 * libgstva-1_0-0-1.22.0-150500.3.3.1 * libgstplay-1_0-0-1.22.0-150500.3.3.1 * libgstplayer-1_0-0-debuginfo-1.22.0-150500.3.3.1 * typelib-1_0-GstVulkanXCB-1_0-1.22.0-150500.3.3.1 * typelib-1_0-GstVa-1_0-1.22.0-150500.3.3.1 * libgstwebrtcnice-1_0-0-debuginfo-1.22.0-150500.3.3.1 * libgstvulkan-1_0-0-1.22.0-150500.3.3.1 * typelib-1_0-GstVulkan-1_0-1.22.0-150500.3.3.1 * libgstwayland-1_0-0-debuginfo-1.22.0-150500.3.3.1 * gstreamer-plugins-bad-1.22.0-150500.3.3.1 * libgstisoff-1_0-0-debuginfo-1.22.0-150500.3.3.1 * libgstphotography-1_0-0-1.22.0-150500.3.3.1 * libgsturidownloader-1_0-0-debuginfo-1.22.0-150500.3.3.1 * libgstmpegts-1_0-0-1.22.0-150500.3.3.1 * libgsttranscoder-1_0-0-1.22.0-150500.3.3.1 * libgsttranscoder-1_0-0-debuginfo-1.22.0-150500.3.3.1 * typelib-1_0-GstMpegts-1_0-1.22.0-150500.3.3.1 * typelib-1_0-CudaGst-1_0-1.22.0-150500.3.3.1 * libgstwebrtc-1_0-0-1.22.0-150500.3.3.1 * gstreamer-plugins-bad-debuginfo-1.22.0-150500.3.3.1 * libgstisoff-1_0-0-1.22.0-150500.3.3.1 * typelib-1_0-GstWebRTC-1_0-1.22.0-150500.3.3.1 * libgstvulkan-1_0-0-debuginfo-1.22.0-150500.3.3.1 * libgstinsertbin-1_0-0-1.22.0-150500.3.3.1 * libgstva-1_0-0-debuginfo-1.22.0-150500.3.3.1 * libgstplay-1_0-0-debuginfo-1.22.0-150500.3.3.1 * libgstadaptivedemux-1_0-0-1.22.0-150500.3.3.1 * gstreamer-plugins-bad-debugsource-1.22.0-150500.3.3.1 * libgstcodecparsers-1_0-0-debuginfo-1.22.0-150500.3.3.1 * gstreamer-transcoder-devel-1.22.0-150500.3.3.1 * libgstcodecs-1_0-0-debuginfo-1.22.0-150500.3.3.1 * libgstsctp-1_0-0-1.22.0-150500.3.3.1 * libgstsctp-1_0-0-debuginfo-1.22.0-150500.3.3.1 * libgstwebrtcnice-1_0-0-1.22.0-150500.3.3.1 * libgstbadaudio-1_0-0-1.22.0-150500.3.3.1 * typelib-1_0-GstCuda-1_0-1.22.0-150500.3.3.1 * libgstwebrtc-1_0-0-debuginfo-1.22.0-150500.3.3.1 * typelib-1_0-GstCodecs-1_0-1.22.0-150500.3.3.1 * libgstmpegts-1_0-0-debuginfo-1.22.0-150500.3.3.1 * libgstadaptivedemux-1_0-0-debuginfo-1.22.0-150500.3.3.1 * libgstbasecamerabinsrc-1_0-0-debuginfo-1.22.0-150500.3.3.1 * libgstbadaudio-1_0-0-debuginfo-1.22.0-150500.3.3.1 * typelib-1_0-GstVulkanWayland-1_0-1.22.0-150500.3.3.1 * gstreamer-plugins-bad-chromaprint-1.22.0-150500.3.3.1 * libgstcodecparsers-1_0-0-1.22.0-150500.3.3.1 * libgstinsertbin-1_0-0-debuginfo-1.22.0-150500.3.3.1 * typelib-1_0-GstPlay-1_0-1.22.0-150500.3.3.1 * libgstwayland-1_0-0-1.22.0-150500.3.3.1 * libgstcuda-1_0-0-1.22.0-150500.3.3.1 * gstreamer-transcoder-1.22.0-150500.3.3.1 * libgsturidownloader-1_0-0-1.22.0-150500.3.3.1 * openSUSE Leap 15.5 (x86_64) * libgstsctp-1_0-0-32bit-1.22.0-150500.3.3.1 * libgstbadaudio-1_0-0-32bit-debuginfo-1.22.0-150500.3.3.1 * libgstisoff-1_0-0-32bit-1.22.0-150500.3.3.1 * gstreamer-plugins-bad-32bit-debuginfo-1.22.0-150500.3.3.1 * libgstcodecs-1_0-0-32bit-1.22.0-150500.3.3.1 * libgstadaptivedemux-1_0-0-32bit-1.22.0-150500.3.3.1 * gstreamer-plugins-bad-chromaprint-32bit-1.22.0-150500.3.3.1 * gstreamer-plugins-bad-chromaprint-32bit-debuginfo-1.22.0-150500.3.3.1 * libgstinsertbin-1_0-0-32bit-1.22.0-150500.3.3.1 * libgstcuda-1_0-0-32bit-debuginfo-1.22.0-150500.3.3.1 * libgstplayer-1_0-0-32bit-debuginfo-1.22.0-150500.3.3.1 * libgsturidownloader-1_0-0-32bit-1.22.0-150500.3.3.1 * libgstadaptivedemux-1_0-0-32bit-debuginfo-1.22.0-150500.3.3.1 * libgstwebrtc-1_0-0-32bit-debuginfo-1.22.0-150500.3.3.1 * libgstsctp-1_0-0-32bit-debuginfo-1.22.0-150500.3.3.1 * libgstplayer-1_0-0-32bit-1.22.0-150500.3.3.1 * libgstphotography-1_0-0-32bit-debuginfo-1.22.0-150500.3.3.1 * libgstbasecamerabinsrc-1_0-0-32bit-1.22.0-150500.3.3.1 * libgstcodecparsers-1_0-0-32bit-debuginfo-1.22.0-150500.3.3.1 * libgstphotography-1_0-0-32bit-1.22.0-150500.3.3.1 * libgstisoff-1_0-0-32bit-debuginfo-1.22.0-150500.3.3.1 * libgstbadaudio-1_0-0-32bit-1.22.0-150500.3.3.1 * libgstplay-1_0-0-32bit-1.22.0-150500.3.3.1 * libgstcodecparsers-1_0-0-32bit-1.22.0-150500.3.3.1 * gstreamer-plugins-bad-32bit-1.22.0-150500.3.3.1 * libgstmpegts-1_0-0-32bit-1.22.0-150500.3.3.1 * libgstplay-1_0-0-32bit-debuginfo-1.22.0-150500.3.3.1 * libgstwayland-1_0-0-32bit-debuginfo-1.22.0-150500.3.3.1 * libgstinsertbin-1_0-0-32bit-debuginfo-1.22.0-150500.3.3.1 * libgstwayland-1_0-0-32bit-1.22.0-150500.3.3.1 * libgsturidownloader-1_0-0-32bit-debuginfo-1.22.0-150500.3.3.1 * libgstva-1_0-0-32bit-debuginfo-1.22.0-150500.3.3.1 * libgstmpegts-1_0-0-32bit-debuginfo-1.22.0-150500.3.3.1 * libgstbasecamerabinsrc-1_0-0-32bit-debuginfo-1.22.0-150500.3.3.1 * libgstwebrtcnice-1_0-0-32bit-1.22.0-150500.3.3.1 * libgstwebrtcnice-1_0-0-32bit-debuginfo-1.22.0-150500.3.3.1 * libgstva-1_0-0-32bit-1.22.0-150500.3.3.1 * libgstvulkan-1_0-0-32bit-debuginfo-1.22.0-150500.3.3.1 * libgstvulkan-1_0-0-32bit-1.22.0-150500.3.3.1 * libgstcuda-1_0-0-32bit-1.22.0-150500.3.3.1 * libgstwebrtc-1_0-0-32bit-1.22.0-150500.3.3.1 * libgstcodecs-1_0-0-32bit-debuginfo-1.22.0-150500.3.3.1 * openSUSE Leap 15.5 (noarch) * gstreamer-plugins-bad-lang-1.22.0-150500.3.3.1 * openSUSE Leap 15.5 (aarch64_ilp32) * libgstisoff-1_0-0-64bit-1.22.0-150500.3.3.1 * libgstcuda-1_0-0-64bit-debuginfo-1.22.0-150500.3.3.1 * libgstplayer-1_0-0-64bit-debuginfo-1.22.0-150500.3.3.1 * libgstsctp-1_0-0-64bit-1.22.0-150500.3.3.1 * libgstisoff-1_0-0-64bit-debuginfo-1.22.0-150500.3.3.1 * libgstwebrtcnice-1_0-0-64bit-1.22.0-150500.3.3.1 * libgstwebrtc-1_0-0-64bit-debuginfo-1.22.0-150500.3.3.1 * libgstphotography-1_0-0-64bit-1.22.0-150500.3.3.1 * libgstsctp-1_0-0-64bit-debuginfo-1.22.0-150500.3.3.1 * libgsturidownloader-1_0-0-64bit-1.22.0-150500.3.3.1 * libgstcuda-1_0-0-64bit-1.22.0-150500.3.3.1 * libgstcodecparsers-1_0-0-64bit-1.22.0-150500.3.3.1 * libgstva-1_0-0-64bit-1.22.0-150500.3.3.1 * gstreamer-plugins-bad-chromaprint-64bit-1.22.0-150500.3.3.1 * libgstinsertbin-1_0-0-64bit-1.22.0-150500.3.3.1 * gstreamer-plugins-bad-64bit-debuginfo-1.22.0-150500.3.3.1 * libgstmpegts-1_0-0-64bit-debuginfo-1.22.0-150500.3.3.1 * libgstbasecamerabinsrc-1_0-0-64bit-1.22.0-150500.3.3.1 * libgstplay-1_0-0-64bit-debuginfo-1.22.0-150500.3.3.1 * libgstwebrtc-1_0-0-64bit-1.22.0-150500.3.3.1 * gstreamer-plugins-bad-chromaprint-64bit-debuginfo-1.22.0-150500.3.3.1 * libgstmpegts-1_0-0-64bit-1.22.0-150500.3.3.1 * libgstwebrtcnice-1_0-0-64bit-debuginfo-1.22.0-150500.3.3.1 * libgstcodecs-1_0-0-64bit-1.22.0-150500.3.3.1 * libgstva-1_0-0-64bit-debuginfo-1.22.0-150500.3.3.1 * libgstinsertbin-1_0-0-64bit-debuginfo-1.22.0-150500.3.3.1 * libgstwayland-1_0-0-64bit-debuginfo-1.22.0-150500.3.3.1 * gstreamer-plugins-bad-64bit-1.22.0-150500.3.3.1 * libgstplayer-1_0-0-64bit-1.22.0-150500.3.3.1 * libgsturidownloader-1_0-0-64bit-debuginfo-1.22.0-150500.3.3.1 * libgstbadaudio-1_0-0-64bit-debuginfo-1.22.0-150500.3.3.1 * libgstphotography-1_0-0-64bit-debuginfo-1.22.0-150500.3.3.1 * libgstwayland-1_0-0-64bit-1.22.0-150500.3.3.1 * libgstvulkan-1_0-0-64bit-debuginfo-1.22.0-150500.3.3.1 * libgstadaptivedemux-1_0-0-64bit-1.22.0-150500.3.3.1 * libgstbasecamerabinsrc-1_0-0-64bit-debuginfo-1.22.0-150500.3.3.1 * libgstcodecparsers-1_0-0-64bit-debuginfo-1.22.0-150500.3.3.1 * libgstvulkan-1_0-0-64bit-1.22.0-150500.3.3.1 * libgstbadaudio-1_0-0-64bit-1.22.0-150500.3.3.1 * libgstplay-1_0-0-64bit-1.22.0-150500.3.3.1 * libgstcodecs-1_0-0-64bit-debuginfo-1.22.0-150500.3.3.1 * libgstadaptivedemux-1_0-0-64bit-debuginfo-1.22.0-150500.3.3.1 * Basesystem Module 15-SP5 (aarch64 ppc64le s390x x86_64) * libgstplayer-1_0-0-1.22.0-150500.3.3.1 * libgstphotography-1_0-0-1.22.0-150500.3.3.1 * libgstphotography-1_0-0-debuginfo-1.22.0-150500.3.3.1 * libgstplay-1_0-0-debuginfo-1.22.0-150500.3.3.1 * libgstplay-1_0-0-1.22.0-150500.3.3.1 * libgstplayer-1_0-0-debuginfo-1.22.0-150500.3.3.1 * gstreamer-plugins-bad-debugsource-1.22.0-150500.3.3.1 * gstreamer-plugins-bad-debuginfo-1.22.0-150500.3.3.1 * Desktop Applications Module 15-SP5 (aarch64 ppc64le s390x x86_64) * gstreamer-plugins-bad-devel-1.22.0-150500.3.3.1 * typelib-1_0-GstInsertBin-1_0-1.22.0-150500.3.3.1 * libgstbasecamerabinsrc-1_0-0-1.22.0-150500.3.3.1 * typelib-1_0-GstPlayer-1_0-1.22.0-150500.3.3.1 * typelib-1_0-GstBadAudio-1_0-1.22.0-150500.3.3.1 * gstreamer-plugins-bad-chromaprint-debuginfo-1.22.0-150500.3.3.1 * libgstcuda-1_0-0-debuginfo-1.22.0-150500.3.3.1 * libgstcodecs-1_0-0-1.22.0-150500.3.3.1 * libgstva-1_0-0-1.22.0-150500.3.3.1 * typelib-1_0-GstVa-1_0-1.22.0-150500.3.3.1 * libgstwebrtcnice-1_0-0-debuginfo-1.22.0-150500.3.3.1 * libgstvulkan-1_0-0-1.22.0-150500.3.3.1 * libgstwayland-1_0-0-debuginfo-1.22.0-150500.3.3.1 * gstreamer-plugins-bad-1.22.0-150500.3.3.1 * libgstisoff-1_0-0-debuginfo-1.22.0-150500.3.3.1 * libgsturidownloader-1_0-0-debuginfo-1.22.0-150500.3.3.1 * libgstmpegts-1_0-0-1.22.0-150500.3.3.1 * libgsttranscoder-1_0-0-1.22.0-150500.3.3.1 * libgsttranscoder-1_0-0-debuginfo-1.22.0-150500.3.3.1 * typelib-1_0-GstMpegts-1_0-1.22.0-150500.3.3.1 * typelib-1_0-CudaGst-1_0-1.22.0-150500.3.3.1 * libgstwebrtc-1_0-0-1.22.0-150500.3.3.1 * gstreamer-plugins-bad-debuginfo-1.22.0-150500.3.3.1 * libgstisoff-1_0-0-1.22.0-150500.3.3.1 * typelib-1_0-GstWebRTC-1_0-1.22.0-150500.3.3.1 * libgstvulkan-1_0-0-debuginfo-1.22.0-150500.3.3.1 * libgstva-1_0-0-debuginfo-1.22.0-150500.3.3.1 * libgstadaptivedemux-1_0-0-1.22.0-150500.3.3.1 * gstreamer-plugins-bad-debugsource-1.22.0-150500.3.3.1 * libgstcodecparsers-1_0-0-debuginfo-1.22.0-150500.3.3.1 * libgstcodecs-1_0-0-debuginfo-1.22.0-150500.3.3.1 * libgstsctp-1_0-0-1.22.0-150500.3.3.1 * libgstsctp-1_0-0-debuginfo-1.22.0-150500.3.3.1 * libgstwebrtcnice-1_0-0-1.22.0-150500.3.3.1 * libgstbadaudio-1_0-0-1.22.0-150500.3.3.1 * typelib-1_0-GstCuda-1_0-1.22.0-150500.3.3.1 * libgstwebrtc-1_0-0-debuginfo-1.22.0-150500.3.3.1 * typelib-1_0-GstCodecs-1_0-1.22.0-150500.3.3.1 * libgstmpegts-1_0-0-debuginfo-1.22.0-150500.3.3.1 * libgstadaptivedemux-1_0-0-debuginfo-1.22.0-150500.3.3.1 * libgstbasecamerabinsrc-1_0-0-debuginfo-1.22.0-150500.3.3.1 * libgstbadaudio-1_0-0-debuginfo-1.22.0-150500.3.3.1 * gstreamer-plugins-bad-chromaprint-1.22.0-150500.3.3.1 * libgstcodecparsers-1_0-0-1.22.0-150500.3.3.1 * libgstinsertbin-1_0-0-debuginfo-1.22.0-150500.3.3.1 * typelib-1_0-GstPlay-1_0-1.22.0-150500.3.3.1 * libgstwayland-1_0-0-1.22.0-150500.3.3.1 * libgstcuda-1_0-0-1.22.0-150500.3.3.1 * libgstinsertbin-1_0-0-1.22.0-150500.3.3.1 * libgsturidownloader-1_0-0-1.22.0-150500.3.3.1 * Desktop Applications Module 15-SP5 (noarch) * gstreamer-plugins-bad-lang-1.22.0-150500.3.3.1 * SUSE Package Hub 15 15-SP5 (aarch64 ppc64le s390x x86_64) * libgsttranscoder-1_0-0-1.22.0-150500.3.3.1 * gstreamer-plugins-bad-debugsource-1.22.0-150500.3.3.1 * libgsttranscoder-1_0-0-debuginfo-1.22.0-150500.3.3.1 * gstreamer-plugins-bad-debuginfo-1.22.0-150500.3.3.1 ## References: * https://www.suse.com/security/cve/CVE-2023-37329.html * https://bugzilla.suse.com/show_bug.cgi?id=1213126

1 0

SUSE-SU-2023:3250-1: important: Security update for gstreamer-plugins-base
by security＠lists.opensuse.org 08 Aug '23

08 Aug '23

# Security update for gstreamer-plugins-base Announcement ID: SUSE-SU-2023:3250-1 Rating: important References: * #1213128 * #1213131 Cross-References: * CVE-2023-37327 * CVE-2023-37328 CVSS scores: * CVE-2023-37327 ( SUSE ): 7.8 CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H * CVE-2023-37328 ( SUSE ): 7.8 CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H Affected Products: * Basesystem Module 15-SP5 * openSUSE Leap 15.5 * SUSE Linux Enterprise Desktop 15 SP5 * SUSE Linux Enterprise High Performance Computing 15 SP5 * SUSE Linux Enterprise Micro 5.5 * SUSE Linux Enterprise Real Time 15 SP5 * SUSE Linux Enterprise Server 15 SP5 * SUSE Linux Enterprise Server for SAP Applications 15 SP5 * SUSE Package Hub 15 15-SP5 An update that solves two vulnerabilities can now be installed. ## Description: This update for gstreamer-plugins-base fixes the following issues: * CVE-2023-37327: Fixed FLAC file parsing integer overflow remote code execution vulnerability. (bsc#1213128) * CVE-2023-37328: Fixed PGS file parsing heap-based buffer overflow remote code execution vulnerability. (bsc#1213131) ## Patch Instructions: To install this SUSE Important update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: * openSUSE Leap 15.5 zypper in -t patch openSUSE-SLE-15.5-2023-3250=1 SUSE-2023-3250=1 * Basesystem Module 15-SP5 zypper in -t patch SUSE-SLE-Module-Basesystem-15-SP5-2023-3250=1 * SUSE Package Hub 15 15-SP5 zypper in -t patch SUSE-SLE-Module-Packagehub-Subpackages-15-SP5-2023-3250=1 ## Package List: * openSUSE Leap 15.5 (aarch64 ppc64le s390x x86_64 i586) * typelib-1_0-GstAudio-1_0-1.22.0-150500.3.3.1 * typelib-1_0-GstTag-1_0-1.22.0-150500.3.3.1 * libgstaudio-1_0-0-1.22.0-150500.3.3.1 * libgstrtp-1_0-0-debuginfo-1.22.0-150500.3.3.1 * typelib-1_0-GstApp-1_0-1.22.0-150500.3.3.1 * typelib-1_0-GstGLWayland-1_0-1.22.0-150500.3.3.1 * gstreamer-plugins-base-debuginfo-1.22.0-150500.3.3.1 * libgstgl-1_0-0-1.22.0-150500.3.3.1 * gstreamer-plugins-base-1.22.0-150500.3.3.1 * libgstapp-1_0-0-debuginfo-1.22.0-150500.3.3.1 * libgstallocators-1_0-0-debuginfo-1.22.0-150500.3.3.1 * libgstsdp-1_0-0-debuginfo-1.22.0-150500.3.3.1 * typelib-1_0-GstVideo-1_0-1.22.0-150500.3.3.1 * gstreamer-plugins-base-devel-1.22.0-150500.3.3.1 * typelib-1_0-GstGL-1_0-1.22.0-150500.3.3.1 * libgstaudio-1_0-0-debuginfo-1.22.0-150500.3.3.1 * typelib-1_0-GstAllocators-1_0-1.22.0-150500.3.3.1 * libgstallocators-1_0-0-1.22.0-150500.3.3.1 * libgstapp-1_0-0-1.22.0-150500.3.3.1 * libgstvideo-1_0-0-1.22.0-150500.3.3.1 * libgstsdp-1_0-0-1.22.0-150500.3.3.1 * typelib-1_0-GstRtsp-1_0-1.22.0-150500.3.3.1 * typelib-1_0-GstSdp-1_0-1.22.0-150500.3.3.1 * libgstrtsp-1_0-0-1.22.0-150500.3.3.1 * libgstfft-1_0-0-1.22.0-150500.3.3.1 * libgsttag-1_0-0-1.22.0-150500.3.3.1 * libgstpbutils-1_0-0-1.22.0-150500.3.3.1 * libgstrtsp-1_0-0-debuginfo-1.22.0-150500.3.3.1 * libgstfft-1_0-0-debuginfo-1.22.0-150500.3.3.1 * libgstvideo-1_0-0-debuginfo-1.22.0-150500.3.3.1 * libgstriff-1_0-0-1.22.0-150500.3.3.1 * gstreamer-plugins-base-debugsource-1.22.0-150500.3.3.1 * typelib-1_0-GstGLEGL-1_0-1.22.0-150500.3.3.1 * typelib-1_0-GstPbutils-1_0-1.22.0-150500.3.3.1 * libgsttag-1_0-0-debuginfo-1.22.0-150500.3.3.1 * libgstpbutils-1_0-0-debuginfo-1.22.0-150500.3.3.1 * libgstriff-1_0-0-debuginfo-1.22.0-150500.3.3.1 * libgstrtp-1_0-0-1.22.0-150500.3.3.1 * typelib-1_0-GstRtp-1_0-1.22.0-150500.3.3.1 * libgstgl-1_0-0-debuginfo-1.22.0-150500.3.3.1 * typelib-1_0-GstGLX11-1_0-1.22.0-150500.3.3.1 * openSUSE Leap 15.5 (x86_64) * libgstgl-1_0-0-32bit-1.22.0-150500.3.3.1 * libgstriff-1_0-0-32bit-debuginfo-1.22.0-150500.3.3.1 * libgstvideo-1_0-0-32bit-debuginfo-1.22.0-150500.3.3.1 * libgstfft-1_0-0-32bit-1.22.0-150500.3.3.1 * libgstvideo-1_0-0-32bit-1.22.0-150500.3.3.1 * libgstsdp-1_0-0-32bit-1.22.0-150500.3.3.1 * libgstallocators-1_0-0-32bit-debuginfo-1.22.0-150500.3.3.1 * libgstrtsp-1_0-0-32bit-debuginfo-1.22.0-150500.3.3.1 * libgstgl-1_0-0-32bit-debuginfo-1.22.0-150500.3.3.1 * libgstallocators-1_0-0-32bit-1.22.0-150500.3.3.1 * libgstriff-1_0-0-32bit-1.22.0-150500.3.3.1 * libgstfft-1_0-0-32bit-debuginfo-1.22.0-150500.3.3.1 * libgstpbutils-1_0-0-32bit-debuginfo-1.22.0-150500.3.3.1 * gstreamer-plugins-base-32bit-debuginfo-1.22.0-150500.3.3.1 * gstreamer-plugins-base-32bit-1.22.0-150500.3.3.1 * libgstapp-1_0-0-32bit-1.22.0-150500.3.3.1 * libgstapp-1_0-0-32bit-debuginfo-1.22.0-150500.3.3.1 * libgstaudio-1_0-0-32bit-debuginfo-1.22.0-150500.3.3.1 * libgstrtsp-1_0-0-32bit-1.22.0-150500.3.3.1 * libgstaudio-1_0-0-32bit-1.22.0-150500.3.3.1 * libgstrtp-1_0-0-32bit-debuginfo-1.22.0-150500.3.3.1 * libgsttag-1_0-0-32bit-debuginfo-1.22.0-150500.3.3.1 * libgstsdp-1_0-0-32bit-debuginfo-1.22.0-150500.3.3.1 * libgstpbutils-1_0-0-32bit-1.22.0-150500.3.3.1 * libgstrtp-1_0-0-32bit-1.22.0-150500.3.3.1 * gstreamer-plugins-base-devel-32bit-1.22.0-150500.3.3.1 * libgsttag-1_0-0-32bit-1.22.0-150500.3.3.1 * openSUSE Leap 15.5 (noarch) * gstreamer-plugins-base-lang-1.22.0-150500.3.3.1 * openSUSE Leap 15.5 (aarch64_ilp32) * libgstriff-1_0-0-64bit-debuginfo-1.22.0-150500.3.3.1 * libgstpbutils-1_0-0-64bit-1.22.0-150500.3.3.1 * libgstvideo-1_0-0-64bit-1.22.0-150500.3.3.1 * libgsttag-1_0-0-64bit-1.22.0-150500.3.3.1 * libgstrtp-1_0-0-64bit-1.22.0-150500.3.3.1 * libgsttag-1_0-0-64bit-debuginfo-1.22.0-150500.3.3.1 * libgstapp-1_0-0-64bit-debuginfo-1.22.0-150500.3.3.1 * libgstgl-1_0-0-64bit-debuginfo-1.22.0-150500.3.3.1 * libgstaudio-1_0-0-64bit-debuginfo-1.22.0-150500.3.3.1 * gstreamer-plugins-base-devel-64bit-1.22.0-150500.3.3.1 * libgstgl-1_0-0-64bit-1.22.0-150500.3.3.1 * libgstrtsp-1_0-0-64bit-debuginfo-1.22.0-150500.3.3.1 * libgstsdp-1_0-0-64bit-debuginfo-1.22.0-150500.3.3.1 * libgstrtsp-1_0-0-64bit-1.22.0-150500.3.3.1 * libgstpbutils-1_0-0-64bit-debuginfo-1.22.0-150500.3.3.1 * libgstriff-1_0-0-64bit-1.22.0-150500.3.3.1 * libgstfft-1_0-0-64bit-1.22.0-150500.3.3.1 * libgstallocators-1_0-0-64bit-1.22.0-150500.3.3.1 * libgstaudio-1_0-0-64bit-1.22.0-150500.3.3.1 * libgstvideo-1_0-0-64bit-debuginfo-1.22.0-150500.3.3.1 * gstreamer-plugins-base-64bit-1.22.0-150500.3.3.1 * libgstrtp-1_0-0-64bit-debuginfo-1.22.0-150500.3.3.1 * libgstsdp-1_0-0-64bit-1.22.0-150500.3.3.1 * libgstapp-1_0-0-64bit-1.22.0-150500.3.3.1 * libgstallocators-1_0-0-64bit-debuginfo-1.22.0-150500.3.3.1 * libgstfft-1_0-0-64bit-debuginfo-1.22.0-150500.3.3.1 * gstreamer-plugins-base-64bit-debuginfo-1.22.0-150500.3.3.1 * Basesystem Module 15-SP5 (aarch64 ppc64le s390x x86_64) * typelib-1_0-GstAudio-1_0-1.22.0-150500.3.3.1 * typelib-1_0-GstTag-1_0-1.22.0-150500.3.3.1 * libgstaudio-1_0-0-1.22.0-150500.3.3.1 * libgstrtp-1_0-0-debuginfo-1.22.0-150500.3.3.1 * typelib-1_0-GstApp-1_0-1.22.0-150500.3.3.1 * typelib-1_0-GstGLWayland-1_0-1.22.0-150500.3.3.1 * gstreamer-plugins-base-debuginfo-1.22.0-150500.3.3.1 * libgstgl-1_0-0-1.22.0-150500.3.3.1 * gstreamer-plugins-base-1.22.0-150500.3.3.1 * libgstapp-1_0-0-debuginfo-1.22.0-150500.3.3.1 * libgstallocators-1_0-0-debuginfo-1.22.0-150500.3.3.1 * libgstsdp-1_0-0-debuginfo-1.22.0-150500.3.3.1 * typelib-1_0-GstVideo-1_0-1.22.0-150500.3.3.1 * gstreamer-plugins-base-devel-1.22.0-150500.3.3.1 * typelib-1_0-GstGL-1_0-1.22.0-150500.3.3.1 * libgstaudio-1_0-0-debuginfo-1.22.0-150500.3.3.1 * typelib-1_0-GstAllocators-1_0-1.22.0-150500.3.3.1 * libgstallocators-1_0-0-1.22.0-150500.3.3.1 * libgstapp-1_0-0-1.22.0-150500.3.3.1 * libgstvideo-1_0-0-1.22.0-150500.3.3.1 * libgstsdp-1_0-0-1.22.0-150500.3.3.1 * typelib-1_0-GstRtsp-1_0-1.22.0-150500.3.3.1 * typelib-1_0-GstSdp-1_0-1.22.0-150500.3.3.1 * libgstrtsp-1_0-0-1.22.0-150500.3.3.1 * libgstfft-1_0-0-1.22.0-150500.3.3.1 * libgsttag-1_0-0-1.22.0-150500.3.3.1 * libgstpbutils-1_0-0-1.22.0-150500.3.3.1 * libgstrtsp-1_0-0-debuginfo-1.22.0-150500.3.3.1 * libgstfft-1_0-0-debuginfo-1.22.0-150500.3.3.1 * libgstvideo-1_0-0-debuginfo-1.22.0-150500.3.3.1 * libgstriff-1_0-0-1.22.0-150500.3.3.1 * gstreamer-plugins-base-debugsource-1.22.0-150500.3.3.1 * typelib-1_0-GstGLEGL-1_0-1.22.0-150500.3.3.1 * typelib-1_0-GstPbutils-1_0-1.22.0-150500.3.3.1 * libgsttag-1_0-0-debuginfo-1.22.0-150500.3.3.1 * libgstpbutils-1_0-0-debuginfo-1.22.0-150500.3.3.1 * libgstriff-1_0-0-debuginfo-1.22.0-150500.3.3.1 * libgstrtp-1_0-0-1.22.0-150500.3.3.1 * typelib-1_0-GstRtp-1_0-1.22.0-150500.3.3.1 * libgstgl-1_0-0-debuginfo-1.22.0-150500.3.3.1 * typelib-1_0-GstGLX11-1_0-1.22.0-150500.3.3.1 * Basesystem Module 15-SP5 (noarch) * gstreamer-plugins-base-lang-1.22.0-150500.3.3.1 * SUSE Package Hub 15 15-SP5 (x86_64) * libgstaudio-1_0-0-32bit-1.22.0-150500.3.3.1 * libgsttag-1_0-0-32bit-debuginfo-1.22.0-150500.3.3.1 * libgstvideo-1_0-0-32bit-debuginfo-1.22.0-150500.3.3.1 * gstreamer-plugins-base-debugsource-1.22.0-150500.3.3.1 * gstreamer-plugins-base-32bit-debuginfo-1.22.0-150500.3.3.1 * gstreamer-plugins-base-debuginfo-1.22.0-150500.3.3.1 * libgstvideo-1_0-0-32bit-1.22.0-150500.3.3.1 * libgsttag-1_0-0-32bit-1.22.0-150500.3.3.1 * libgstaudio-1_0-0-32bit-debuginfo-1.22.0-150500.3.3.1 ## References: * https://www.suse.com/security/cve/CVE-2023-37327.html * https://www.suse.com/security/cve/CVE-2023-37328.html * https://bugzilla.suse.com/show_bug.cgi?id=1213128 * https://bugzilla.suse.com/show_bug.cgi?id=1213131

1 0

SUSE-SU-2023:3229-1: important: Security update for rubygem-actionpack-5_1
by security＠lists.opensuse.org 08 Aug '23

08 Aug '23

# Security update for rubygem-actionpack-5_1 Announcement ID: SUSE-SU-2023:3229-1 Rating: important References: * #1213312 Cross-References: * CVE-2023-28362 CVSS scores: * CVE-2023-28362 ( SUSE ): 6.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N Affected Products: * openSUSE Leap 15.4 * openSUSE Leap 15.5 * SUSE Linux Enterprise High Availability Extension 15 SP1 * SUSE Linux Enterprise High Availability Extension 15 SP2 * SUSE Linux Enterprise High Availability Extension 15 SP3 * SUSE Linux Enterprise High Availability Extension 15 SP4 * SUSE Linux Enterprise High Availability Extension 15 SP5 * SUSE Linux Enterprise High Performance Computing 15 SP1 * SUSE Linux Enterprise High Performance Computing 15 SP2 * SUSE Linux Enterprise High Performance Computing 15 SP3 * SUSE Linux Enterprise High Performance Computing 15 SP4 * SUSE Linux Enterprise High Performance Computing 15 SP5 * SUSE Linux Enterprise Server 15 SP1 * SUSE Linux Enterprise Server 15 SP1 Business Critical Linux 15-SP1 * SUSE Linux Enterprise Server 15 SP2 * SUSE Linux Enterprise Server 15 SP2 Business Critical Linux 15-SP2 * SUSE Linux Enterprise Server 15 SP3 * SUSE Linux Enterprise Server 15 SP3 Business Critical Linux 15-SP3 * SUSE Linux Enterprise Server 15 SP4 * SUSE Linux Enterprise Server 15 SP5 * SUSE Linux Enterprise Server for SAP Applications 15 SP1 * SUSE Linux Enterprise Server for SAP Applications 15 SP2 * SUSE Linux Enterprise Server for SAP Applications 15 SP3 * SUSE Linux Enterprise Server for SAP Applications 15 SP4 * SUSE Linux Enterprise Server for SAP Applications 15 SP5 * SUSE Manager Proxy 4.0 * SUSE Manager Proxy 4.1 * SUSE Manager Proxy 4.2 * SUSE Manager Proxy 4.3 * SUSE Manager Retail Branch Server 4.0 * SUSE Manager Retail Branch Server 4.1 * SUSE Manager Retail Branch Server 4.2 * SUSE Manager Retail Branch Server 4.3 * SUSE Manager Server 4.0 * SUSE Manager Server 4.1 * SUSE Manager Server 4.2 * SUSE Manager Server 4.3 An update that solves one vulnerability can now be installed. ## Description: This update for rubygem-actionpack-5_1 fixes the following issues: * CVE-2023-28362: Fixed possible XSS via User Supplied Values to redirect_to (bsc#1213312). ## Patch Instructions: To install this SUSE Important update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: * openSUSE Leap 15.4 zypper in -t patch openSUSE-SLE-15.4-2023-3229=1 * openSUSE Leap 15.5 zypper in -t patch openSUSE-SLE-15.5-2023-3229=1 * SUSE Linux Enterprise High Availability Extension 15 SP1 zypper in -t patch SUSE-SLE-Product-HA-15-SP1-2023-3229=1 * SUSE Linux Enterprise High Availability Extension 15 SP2 zypper in -t patch SUSE-SLE-Product-HA-15-SP2-2023-3229=1 * SUSE Linux Enterprise High Availability Extension 15 SP3 zypper in -t patch SUSE-SLE-Product-HA-15-SP3-2023-3229=1 * SUSE Linux Enterprise High Availability Extension 15 SP4 zypper in -t patch SUSE-SLE-Product-HA-15-SP4-2023-3229=1 * SUSE Linux Enterprise High Availability Extension 15 SP5 zypper in -t patch SUSE-SLE-Product-HA-15-SP5-2023-3229=1 ## Package List: * openSUSE Leap 15.4 (aarch64 ppc64le s390x x86_64) * ruby2.5-rubygem-actionpack-5_1-5.1.4-150000.3.18.1 * ruby2.5-rubygem-actionpack-doc-5_1-5.1.4-150000.3.18.1 * openSUSE Leap 15.5 (aarch64 ppc64le s390x x86_64) * ruby2.5-rubygem-actionpack-5_1-5.1.4-150000.3.18.1 * ruby2.5-rubygem-actionpack-doc-5_1-5.1.4-150000.3.18.1 * SUSE Linux Enterprise High Availability Extension 15 SP1 (aarch64 ppc64le s390x x86_64) * ruby2.5-rubygem-actionpack-5_1-5.1.4-150000.3.18.1 * SUSE Linux Enterprise High Availability Extension 15 SP2 (aarch64 ppc64le s390x x86_64) * ruby2.5-rubygem-actionpack-5_1-5.1.4-150000.3.18.1 * SUSE Linux Enterprise High Availability Extension 15 SP3 (aarch64 ppc64le s390x x86_64) * ruby2.5-rubygem-actionpack-5_1-5.1.4-150000.3.18.1 * SUSE Linux Enterprise High Availability Extension 15 SP4 (aarch64 ppc64le s390x x86_64) * ruby2.5-rubygem-actionpack-5_1-5.1.4-150000.3.18.1 * SUSE Linux Enterprise High Availability Extension 15 SP5 (aarch64 ppc64le s390x x86_64) * ruby2.5-rubygem-actionpack-5_1-5.1.4-150000.3.18.1 ## References: * https://www.suse.com/security/cve/CVE-2023-28362.html * https://bugzilla.suse.com/show_bug.cgi?id=1213312

1 0

SUSE-SU-2023:3230-1: important: Security update for cjose
by security＠lists.opensuse.org 08 Aug '23

08 Aug '23

# Security update for cjose Announcement ID: SUSE-SU-2023:3230-1 Rating: important References: * #1213385 Cross-References: * CVE-2023-37464 CVSS scores: * CVE-2023-37464 ( SUSE ): 8.6 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:H/A:N * CVE-2023-37464 ( NVD ): 8.6 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:H/A:N Affected Products: * openSUSE Leap 15.4 * openSUSE Leap 15.5 * Server Applications Module 15-SP4 * Server Applications Module 15-SP5 * SUSE CaaS Platform 4.0 * SUSE Enterprise Storage 7 * SUSE Enterprise Storage 7.1 * SUSE Linux Enterprise High Performance Computing 15 SP1 * SUSE Linux Enterprise High Performance Computing 15 SP1 LTSS 15-SP1 * SUSE Linux Enterprise High Performance Computing 15 SP2 * SUSE Linux Enterprise High Performance Computing 15 SP2 LTSS 15-SP2 * SUSE Linux Enterprise High Performance Computing 15 SP3 * SUSE Linux Enterprise High Performance Computing 15 SP4 * SUSE Linux Enterprise High Performance Computing 15 SP5 * SUSE Linux Enterprise High Performance Computing ESPOS 15 SP3 * SUSE Linux Enterprise High Performance Computing LTSS 15 SP3 * SUSE Linux Enterprise Real Time 15 SP3 * SUSE Linux Enterprise Real Time 15 SP4 * SUSE Linux Enterprise Real Time 15 SP5 * SUSE Linux Enterprise Server 15 SP1 * SUSE Linux Enterprise Server 15 SP1 LTSS 15-SP1 * SUSE Linux Enterprise Server 15 SP2 * SUSE Linux Enterprise Server 15 SP2 LTSS 15-SP2 * SUSE Linux Enterprise Server 15 SP3 * SUSE Linux Enterprise Server 15 SP3 LTSS 15-SP3 * SUSE Linux Enterprise Server 15 SP4 * SUSE Linux Enterprise Server 15 SP5 * SUSE Linux Enterprise Server for SAP Applications 15 SP1 * SUSE Linux Enterprise Server for SAP Applications 15 SP2 * SUSE Linux Enterprise Server for SAP Applications 15 SP3 * SUSE Linux Enterprise Server for SAP Applications 15 SP4 * SUSE Linux Enterprise Server for SAP Applications 15 SP5 * SUSE Manager Proxy 4.2 * SUSE Manager Proxy 4.3 * SUSE Manager Retail Branch Server 4.2 * SUSE Manager Retail Branch Server 4.3 * SUSE Manager Server 4.2 * SUSE Manager Server 4.3 An update that solves one vulnerability can now be installed. ## Description: This update for cjose fixes the following issues: * CVE-2023-37464: Fixed AES GCM decryption uses the Tag length from the actual Authentication Tag (bsc#1213385). ## Patch Instructions: To install this SUSE Important update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: * openSUSE Leap 15.4 zypper in -t patch openSUSE-SLE-15.4-2023-3230=1 * openSUSE Leap 15.5 zypper in -t patch openSUSE-SLE-15.5-2023-3230=1 * Server Applications Module 15-SP4 zypper in -t patch SUSE-SLE-Module-Server-Applications-15-SP4-2023-3230=1 * Server Applications Module 15-SP5 zypper in -t patch SUSE-SLE-Module-Server-Applications-15-SP5-2023-3230=1 * SUSE Linux Enterprise High Performance Computing 15 SP1 LTSS 15-SP1 zypper in -t patch SUSE-SLE-Product-HPC-15-SP1-LTSS-2023-3230=1 * SUSE Linux Enterprise High Performance Computing 15 SP2 LTSS 15-SP2 zypper in -t patch SUSE-SLE-Product-HPC-15-SP2-LTSS-2023-3230=1 * SUSE Linux Enterprise High Performance Computing ESPOS 15 SP3 zypper in -t patch SUSE-SLE-Product-HPC-15-SP3-ESPOS-2023-3230=1 * SUSE Linux Enterprise High Performance Computing LTSS 15 SP3 zypper in -t patch SUSE-SLE-Product-HPC-15-SP3-LTSS-2023-3230=1 * SUSE Linux Enterprise Real Time 15 SP3 zypper in -t patch SUSE-SLE-Product-RT-15-SP3-2023-3230=1 * SUSE Linux Enterprise Server 15 SP1 LTSS 15-SP1 zypper in -t patch SUSE-SLE-Product-SLES-15-SP1-LTSS-2023-3230=1 * SUSE Linux Enterprise Server 15 SP2 LTSS 15-SP2 zypper in -t patch SUSE-SLE-Product-SLES-15-SP2-LTSS-2023-3230=1 * SUSE Linux Enterprise Server 15 SP3 LTSS 15-SP3 zypper in -t patch SUSE-SLE-Product-SLES-15-SP3-LTSS-2023-3230=1 * SUSE Linux Enterprise Server for SAP Applications 15 SP1 zypper in -t patch SUSE-SLE-Product-SLES_SAP-15-SP1-2023-3230=1 * SUSE Linux Enterprise Server for SAP Applications 15 SP2 zypper in -t patch SUSE-SLE-Product-SLES_SAP-15-SP2-2023-3230=1 * SUSE Linux Enterprise Server for SAP Applications 15 SP3 zypper in -t patch SUSE-SLE-Product-SLES_SAP-15-SP3-2023-3230=1 * SUSE Manager Proxy 4.2 zypper in -t patch SUSE-SLE-Product-SUSE-Manager-Proxy-4.2-2023-3230=1 * SUSE Manager Retail Branch Server 4.2 zypper in -t patch SUSE-SLE-Product-SUSE-Manager-Retail-Branch- Server-4.2-2023-3230=1 * SUSE Manager Server 4.2 zypper in -t patch SUSE-SLE-Product-SUSE-Manager-Server-4.2-2023-3230=1 * SUSE Enterprise Storage 7.1 zypper in -t patch SUSE-Storage-7.1-2023-3230=1 * SUSE Enterprise Storage 7 zypper in -t patch SUSE-Storage-7-2023-3230=1 * SUSE CaaS Platform 4.0 To install this update, use the SUSE CaaS Platform 'skuba' tool. It will inform you if it detects new updates and let you then trigger updating of the complete cluster in a controlled way. ## Package List: * openSUSE Leap 15.4 (aarch64 ppc64le s390x x86_64) * libcjose0-0.6.1-150100.4.6.1 * libcjose0-debuginfo-0.6.1-150100.4.6.1 * cjose-debugsource-0.6.1-150100.4.6.1 * libcjose-devel-0.6.1-150100.4.6.1 * openSUSE Leap 15.5 (aarch64 ppc64le s390x x86_64) * libcjose0-0.6.1-150100.4.6.1 * libcjose0-debuginfo-0.6.1-150100.4.6.1 * cjose-debugsource-0.6.1-150100.4.6.1 * libcjose-devel-0.6.1-150100.4.6.1 * Server Applications Module 15-SP4 (aarch64 ppc64le s390x x86_64) * libcjose0-0.6.1-150100.4.6.1 * libcjose0-debuginfo-0.6.1-150100.4.6.1 * cjose-debugsource-0.6.1-150100.4.6.1 * libcjose-devel-0.6.1-150100.4.6.1 * Server Applications Module 15-SP5 (aarch64 ppc64le s390x x86_64) * libcjose0-0.6.1-150100.4.6.1 * libcjose0-debuginfo-0.6.1-150100.4.6.1 * cjose-debugsource-0.6.1-150100.4.6.1 * libcjose-devel-0.6.1-150100.4.6.1 * SUSE Linux Enterprise High Performance Computing 15 SP1 LTSS 15-SP1 (aarch64 x86_64) * libcjose0-0.6.1-150100.4.6.1 * libcjose0-debuginfo-0.6.1-150100.4.6.1 * cjose-debugsource-0.6.1-150100.4.6.1 * libcjose-devel-0.6.1-150100.4.6.1 * SUSE Linux Enterprise High Performance Computing 15 SP2 LTSS 15-SP2 (aarch64 x86_64) * libcjose0-0.6.1-150100.4.6.1 * libcjose0-debuginfo-0.6.1-150100.4.6.1 * cjose-debugsource-0.6.1-150100.4.6.1 * libcjose-devel-0.6.1-150100.4.6.1 * SUSE Linux Enterprise High Performance Computing ESPOS 15 SP3 (aarch64 x86_64) * libcjose0-0.6.1-150100.4.6.1 * libcjose0-debuginfo-0.6.1-150100.4.6.1 * cjose-debugsource-0.6.1-150100.4.6.1 * libcjose-devel-0.6.1-150100.4.6.1 * SUSE Linux Enterprise High Performance Computing LTSS 15 SP3 (aarch64 x86_64) * libcjose0-0.6.1-150100.4.6.1 * libcjose0-debuginfo-0.6.1-150100.4.6.1 * cjose-debugsource-0.6.1-150100.4.6.1 * libcjose-devel-0.6.1-150100.4.6.1 * SUSE Linux Enterprise Real Time 15 SP3 (x86_64) * libcjose0-0.6.1-150100.4.6.1 * libcjose0-debuginfo-0.6.1-150100.4.6.1 * cjose-debugsource-0.6.1-150100.4.6.1 * libcjose-devel-0.6.1-150100.4.6.1 * SUSE Linux Enterprise Server 15 SP1 LTSS 15-SP1 (aarch64 ppc64le x86_64) * libcjose0-0.6.1-150100.4.6.1 * libcjose0-debuginfo-0.6.1-150100.4.6.1 * cjose-debugsource-0.6.1-150100.4.6.1 * libcjose-devel-0.6.1-150100.4.6.1 * SUSE Linux Enterprise Server 15 SP2 LTSS 15-SP2 (aarch64 ppc64le s390x x86_64) * libcjose0-0.6.1-150100.4.6.1 * libcjose0-debuginfo-0.6.1-150100.4.6.1 * cjose-debugsource-0.6.1-150100.4.6.1 * libcjose-devel-0.6.1-150100.4.6.1 * SUSE Linux Enterprise Server 15 SP3 LTSS 15-SP3 (aarch64 ppc64le s390x x86_64) * libcjose0-0.6.1-150100.4.6.1 * libcjose0-debuginfo-0.6.1-150100.4.6.1 * cjose-debugsource-0.6.1-150100.4.6.1 * libcjose-devel-0.6.1-150100.4.6.1 * SUSE Linux Enterprise Server for SAP Applications 15 SP1 (ppc64le x86_64) * libcjose0-0.6.1-150100.4.6.1 * libcjose0-debuginfo-0.6.1-150100.4.6.1 * cjose-debugsource-0.6.1-150100.4.6.1 * libcjose-devel-0.6.1-150100.4.6.1 * SUSE Linux Enterprise Server for SAP Applications 15 SP2 (ppc64le x86_64) * libcjose0-0.6.1-150100.4.6.1 * libcjose0-debuginfo-0.6.1-150100.4.6.1 * cjose-debugsource-0.6.1-150100.4.6.1 * libcjose-devel-0.6.1-150100.4.6.1 * SUSE Linux Enterprise Server for SAP Applications 15 SP3 (ppc64le x86_64) * libcjose0-0.6.1-150100.4.6.1 * libcjose0-debuginfo-0.6.1-150100.4.6.1 * cjose-debugsource-0.6.1-150100.4.6.1 * libcjose-devel-0.6.1-150100.4.6.1 * SUSE Manager Proxy 4.2 (x86_64) * libcjose0-0.6.1-150100.4.6.1 * libcjose0-debuginfo-0.6.1-150100.4.6.1 * cjose-debugsource-0.6.1-150100.4.6.1 * libcjose-devel-0.6.1-150100.4.6.1 * SUSE Manager Retail Branch Server 4.2 (x86_64) * libcjose0-0.6.1-150100.4.6.1 * libcjose0-debuginfo-0.6.1-150100.4.6.1 * cjose-debugsource-0.6.1-150100.4.6.1 * libcjose-devel-0.6.1-150100.4.6.1 * SUSE Manager Server 4.2 (ppc64le s390x x86_64) * libcjose0-0.6.1-150100.4.6.1 * libcjose0-debuginfo-0.6.1-150100.4.6.1 * cjose-debugsource-0.6.1-150100.4.6.1 * libcjose-devel-0.6.1-150100.4.6.1 * SUSE Enterprise Storage 7.1 (aarch64 x86_64) * libcjose0-0.6.1-150100.4.6.1 * libcjose0-debuginfo-0.6.1-150100.4.6.1 * cjose-debugsource-0.6.1-150100.4.6.1 * libcjose-devel-0.6.1-150100.4.6.1 * SUSE Enterprise Storage 7 (aarch64 x86_64) * libcjose0-0.6.1-150100.4.6.1 * libcjose0-debuginfo-0.6.1-150100.4.6.1 * cjose-debugsource-0.6.1-150100.4.6.1 * libcjose-devel-0.6.1-150100.4.6.1 * SUSE CaaS Platform 4.0 (x86_64) * libcjose0-0.6.1-150100.4.6.1 * libcjose0-debuginfo-0.6.1-150100.4.6.1 * cjose-debugsource-0.6.1-150100.4.6.1 * libcjose-devel-0.6.1-150100.4.6.1 ## References: * https://www.suse.com/security/cve/CVE-2023-37464.html * https://bugzilla.suse.com/show_bug.cgi?id=1213385

1 0

SUSE-SU-2023:3233-1: important: Security update for webkit2gtk3
by security＠lists.opensuse.org 08 Aug '23

08 Aug '23

# Security update for webkit2gtk3 Announcement ID: SUSE-SU-2023:3233-1 Rating: important References: * #1212863 * #1213905 Cross-References: * CVE-2022-48503 * CVE-2023-32435 * CVE-2023-32439 * CVE-2023-38133 * CVE-2023-38572 * CVE-2023-38592 * CVE-2023-38594 * CVE-2023-38595 * CVE-2023-38597 * CVE-2023-38599 * CVE-2023-38600 * CVE-2023-38611 CVSS scores: * CVE-2022-48503 ( SUSE ): 8.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H * CVE-2023-32435 ( SUSE ): 8.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H * CVE-2023-32435 ( NVD ): 8.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H * CVE-2023-32439 ( SUSE ): 8.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H * CVE-2023-32439 ( NVD ): 8.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H * CVE-2023-38133 ( NVD ): 6.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N * CVE-2023-38572 ( NVD ): 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N * CVE-2023-38592 ( NVD ): 8.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H * CVE-2023-38594 ( NVD ): 8.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H * CVE-2023-38595 ( NVD ): 8.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H * CVE-2023-38597 ( NVD ): 8.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H * CVE-2023-38599 ( NVD ): 6.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N * CVE-2023-38600 ( NVD ): 8.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H * CVE-2023-38611 ( NVD ): 8.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H Affected Products: * openSUSE Leap 15.4 * SUSE Enterprise Storage 7.1 * SUSE Linux Enterprise High Performance Computing 15 SP2 * SUSE Linux Enterprise High Performance Computing 15 SP2 LTSS 15-SP2 * SUSE Linux Enterprise High Performance Computing 15 SP3 * SUSE Linux Enterprise High Performance Computing ESPOS 15 SP3 * SUSE Linux Enterprise High Performance Computing LTSS 15 SP3 * SUSE Linux Enterprise Server 15 SP2 * SUSE Linux Enterprise Server 15 SP2 LTSS 15-SP2 * SUSE Linux Enterprise Server 15 SP3 * SUSE Linux Enterprise Server 15 SP3 LTSS 15-SP3 * SUSE Linux Enterprise Server for SAP Applications 15 SP2 * SUSE Linux Enterprise Server for SAP Applications 15 SP3 * SUSE Manager Proxy 4.2 * SUSE Manager Retail Branch Server 4.2 * SUSE Manager Server 4.2 An update that solves 12 vulnerabilities can now be installed. ## Description: This update for webkit2gtk3 fixes the following issues: Update to version 2.40.5 (bsc#1213905): * CVE-2023-38133: Fixed information disclosure. * CVE-2023-38572: Fixed Same-Origin-Policy bypass. * CVE-2023-38592: Fixed arbitrary code execution. * CVE-2023-38594: Fixed arbitrary code execution. * CVE-2023-38595: Fixed arbitrary code execution. * CVE-2023-38597: Fixed arbitrary code execution. * CVE-2023-38599: Fixed sensitive user information tracking. * CVE-2023-38600: Fixed arbitrary code execution. * CVE-2023-38611: Fixed arbitrary code execution. Update to version 2.40.3 (bsc#1212863): * CVE-2023-32439: Fixed a bug where processing maliciously crafted web content may lead to arbitrary code execution. (bsc#1212863) * CVE-2023-32435: Fixed a bug where processing web content may lead to arbitrary code execution. (bsc#1212863) * CVE-2022-48503: Fixed a bug where processing web content may lead to arbitrary code execution. (bsc#1212863) ## Patch Instructions: To install this SUSE Important update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: * SUSE Linux Enterprise High Performance Computing ESPOS 15 SP3 zypper in -t patch SUSE-SLE-Product-HPC-15-SP3-ESPOS-2023-3233=1 * SUSE Linux Enterprise High Performance Computing LTSS 15 SP3 zypper in -t patch SUSE-SLE-Product-HPC-15-SP3-LTSS-2023-3233=1 * SUSE Linux Enterprise Server 15 SP2 LTSS 15-SP2 zypper in -t patch SUSE-SLE-Product-SLES-15-SP2-LTSS-2023-3233=1 * SUSE Linux Enterprise Server 15 SP3 LTSS 15-SP3 zypper in -t patch SUSE-SLE-Product-SLES-15-SP3-LTSS-2023-3233=1 * SUSE Linux Enterprise Server for SAP Applications 15 SP2 zypper in -t patch SUSE-SLE-Product-SLES_SAP-15-SP2-2023-3233=1 * SUSE Linux Enterprise Server for SAP Applications 15 SP3 zypper in -t patch SUSE-SLE-Product-SLES_SAP-15-SP3-2023-3233=1 * SUSE Manager Proxy 4.2 zypper in -t patch SUSE-SLE-Product-SUSE-Manager-Proxy-4.2-2023-3233=1 * SUSE Manager Retail Branch Server 4.2 zypper in -t patch SUSE-SLE-Product-SUSE-Manager-Retail-Branch- Server-4.2-2023-3233=1 * SUSE Manager Server 4.2 zypper in -t patch SUSE-SLE-Product-SUSE-Manager-Server-4.2-2023-3233=1 * SUSE Enterprise Storage 7.1 zypper in -t patch SUSE-Storage-7.1-2023-3233=1 * openSUSE Leap 15.4 zypper in -t patch openSUSE-SLE-15.4-2023-3233=1 * SUSE Linux Enterprise High Performance Computing 15 SP2 LTSS 15-SP2 zypper in -t patch SUSE-SLE-Product-HPC-15-SP2-LTSS-2023-3233=1 ## Package List: * SUSE Linux Enterprise High Performance Computing ESPOS 15 SP3 (aarch64 x86_64) * webkit2gtk3-devel-2.40.5-150200.78.1 * typelib-1_0-JavaScriptCore-4_0-2.40.5-150200.78.1 * webkit2gtk-4_0-injected-bundles-2.40.5-150200.78.1 * libwebkit2gtk-4_0-37-2.40.5-150200.78.1 * libwebkit2gtk-4_0-37-debuginfo-2.40.5-150200.78.1 * typelib-1_0-WebKit2-4_0-2.40.5-150200.78.1 * webkit2gtk-4_0-injected-bundles-debuginfo-2.40.5-150200.78.1 * webkit2gtk3-debugsource-2.40.5-150200.78.1 * typelib-1_0-WebKit2WebExtension-4_0-2.40.5-150200.78.1 * libjavascriptcoregtk-4_0-18-2.40.5-150200.78.1 * libjavascriptcoregtk-4_0-18-debuginfo-2.40.5-150200.78.1 * SUSE Linux Enterprise High Performance Computing ESPOS 15 SP3 (noarch) * libwebkit2gtk3-lang-2.40.5-150200.78.1 * SUSE Linux Enterprise High Performance Computing LTSS 15 SP3 (aarch64 x86_64) * webkit2gtk3-devel-2.40.5-150200.78.1 * typelib-1_0-JavaScriptCore-4_0-2.40.5-150200.78.1 * webkit2gtk-4_0-injected-bundles-2.40.5-150200.78.1 * libwebkit2gtk-4_0-37-2.40.5-150200.78.1 * libwebkit2gtk-4_0-37-debuginfo-2.40.5-150200.78.1 * typelib-1_0-WebKit2-4_0-2.40.5-150200.78.1 * webkit2gtk-4_0-injected-bundles-debuginfo-2.40.5-150200.78.1 * webkit2gtk3-debugsource-2.40.5-150200.78.1 * typelib-1_0-WebKit2WebExtension-4_0-2.40.5-150200.78.1 * libjavascriptcoregtk-4_0-18-2.40.5-150200.78.1 * libjavascriptcoregtk-4_0-18-debuginfo-2.40.5-150200.78.1 * SUSE Linux Enterprise High Performance Computing LTSS 15 SP3 (noarch) * libwebkit2gtk3-lang-2.40.5-150200.78.1 * SUSE Linux Enterprise Server 15 SP2 LTSS 15-SP2 (aarch64 ppc64le s390x x86_64) * webkit2gtk3-devel-2.40.5-150200.78.1 * typelib-1_0-JavaScriptCore-4_0-2.40.5-150200.78.1 * webkit2gtk-4_0-injected-bundles-2.40.5-150200.78.1 * libwebkit2gtk-4_0-37-2.40.5-150200.78.1 * libwebkit2gtk-4_0-37-debuginfo-2.40.5-150200.78.1 * typelib-1_0-WebKit2-4_0-2.40.5-150200.78.1 * webkit2gtk-4_0-injected-bundles-debuginfo-2.40.5-150200.78.1 * webkit2gtk3-debugsource-2.40.5-150200.78.1 * typelib-1_0-WebKit2WebExtension-4_0-2.40.5-150200.78.1 * libjavascriptcoregtk-4_0-18-2.40.5-150200.78.1 * libjavascriptcoregtk-4_0-18-debuginfo-2.40.5-150200.78.1 * SUSE Linux Enterprise Server 15 SP2 LTSS 15-SP2 (noarch) * libwebkit2gtk3-lang-2.40.5-150200.78.1 * SUSE Linux Enterprise Server 15 SP3 LTSS 15-SP3 (aarch64 ppc64le s390x x86_64) * webkit2gtk3-devel-2.40.5-150200.78.1 * typelib-1_0-JavaScriptCore-4_0-2.40.5-150200.78.1 * webkit2gtk-4_0-injected-bundles-2.40.5-150200.78.1 * libwebkit2gtk-4_0-37-2.40.5-150200.78.1 * libwebkit2gtk-4_0-37-debuginfo-2.40.5-150200.78.1 * typelib-1_0-WebKit2-4_0-2.40.5-150200.78.1 * webkit2gtk-4_0-injected-bundles-debuginfo-2.40.5-150200.78.1 * webkit2gtk3-debugsource-2.40.5-150200.78.1 * typelib-1_0-WebKit2WebExtension-4_0-2.40.5-150200.78.1 * libjavascriptcoregtk-4_0-18-2.40.5-150200.78.1 * libjavascriptcoregtk-4_0-18-debuginfo-2.40.5-150200.78.1 * SUSE Linux Enterprise Server 15 SP3 LTSS 15-SP3 (noarch) * libwebkit2gtk3-lang-2.40.5-150200.78.1 * SUSE Linux Enterprise Server for SAP Applications 15 SP2 (ppc64le x86_64) * webkit2gtk3-devel-2.40.5-150200.78.1 * typelib-1_0-JavaScriptCore-4_0-2.40.5-150200.78.1 * webkit2gtk-4_0-injected-bundles-2.40.5-150200.78.1 * libwebkit2gtk-4_0-37-2.40.5-150200.78.1 * libwebkit2gtk-4_0-37-debuginfo-2.40.5-150200.78.1 * typelib-1_0-WebKit2-4_0-2.40.5-150200.78.1 * webkit2gtk-4_0-injected-bundles-debuginfo-2.40.5-150200.78.1 * webkit2gtk3-debugsource-2.40.5-150200.78.1 * typelib-1_0-WebKit2WebExtension-4_0-2.40.5-150200.78.1 * libjavascriptcoregtk-4_0-18-2.40.5-150200.78.1 * libjavascriptcoregtk-4_0-18-debuginfo-2.40.5-150200.78.1 * SUSE Linux Enterprise Server for SAP Applications 15 SP2 (noarch) * libwebkit2gtk3-lang-2.40.5-150200.78.1 * SUSE Linux Enterprise Server for SAP Applications 15 SP3 (ppc64le x86_64) * webkit2gtk3-devel-2.40.5-150200.78.1 * typelib-1_0-JavaScriptCore-4_0-2.40.5-150200.78.1 * webkit2gtk-4_0-injected-bundles-2.40.5-150200.78.1 * libwebkit2gtk-4_0-37-2.40.5-150200.78.1 * libwebkit2gtk-4_0-37-debuginfo-2.40.5-150200.78.1 * typelib-1_0-WebKit2-4_0-2.40.5-150200.78.1 * webkit2gtk-4_0-injected-bundles-debuginfo-2.40.5-150200.78.1 * webkit2gtk3-debugsource-2.40.5-150200.78.1 * typelib-1_0-WebKit2WebExtension-4_0-2.40.5-150200.78.1 * libjavascriptcoregtk-4_0-18-2.40.5-150200.78.1 * libjavascriptcoregtk-4_0-18-debuginfo-2.40.5-150200.78.1 * SUSE Linux Enterprise Server for SAP Applications 15 SP3 (noarch) * libwebkit2gtk3-lang-2.40.5-150200.78.1 * SUSE Manager Proxy 4.2 (x86_64) * webkit2gtk-4_0-injected-bundles-2.40.5-150200.78.1 * libwebkit2gtk-4_0-37-2.40.5-150200.78.1 * libwebkit2gtk-4_0-37-debuginfo-2.40.5-150200.78.1 * webkit2gtk-4_0-injected-bundles-debuginfo-2.40.5-150200.78.1 * webkit2gtk3-debugsource-2.40.5-150200.78.1 * libjavascriptcoregtk-4_0-18-2.40.5-150200.78.1 * libjavascriptcoregtk-4_0-18-debuginfo-2.40.5-150200.78.1 * SUSE Manager Proxy 4.2 (noarch) * libwebkit2gtk3-lang-2.40.5-150200.78.1 * SUSE Manager Retail Branch Server 4.2 (x86_64) * webkit2gtk-4_0-injected-bundles-2.40.5-150200.78.1 * libwebkit2gtk-4_0-37-2.40.5-150200.78.1 * libwebkit2gtk-4_0-37-debuginfo-2.40.5-150200.78.1 * webkit2gtk-4_0-injected-bundles-debuginfo-2.40.5-150200.78.1 * webkit2gtk3-debugsource-2.40.5-150200.78.1 * libjavascriptcoregtk-4_0-18-2.40.5-150200.78.1 * libjavascriptcoregtk-4_0-18-debuginfo-2.40.5-150200.78.1 * SUSE Manager Retail Branch Server 4.2 (noarch) * libwebkit2gtk3-lang-2.40.5-150200.78.1 * SUSE Manager Server 4.2 (ppc64le s390x x86_64) * webkit2gtk-4_0-injected-bundles-2.40.5-150200.78.1 * libwebkit2gtk-4_0-37-2.40.5-150200.78.1 * libwebkit2gtk-4_0-37-debuginfo-2.40.5-150200.78.1 * webkit2gtk-4_0-injected-bundles-debuginfo-2.40.5-150200.78.1 * webkit2gtk3-debugsource-2.40.5-150200.78.1 * libjavascriptcoregtk-4_0-18-2.40.5-150200.78.1 * libjavascriptcoregtk-4_0-18-debuginfo-2.40.5-150200.78.1 * SUSE Manager Server 4.2 (noarch) * libwebkit2gtk3-lang-2.40.5-150200.78.1 * SUSE Enterprise Storage 7.1 (aarch64 x86_64) * webkit2gtk3-devel-2.40.5-150200.78.1 * typelib-1_0-JavaScriptCore-4_0-2.40.5-150200.78.1 * webkit2gtk-4_0-injected-bundles-2.40.5-150200.78.1 * libwebkit2gtk-4_0-37-2.40.5-150200.78.1 * libwebkit2gtk-4_0-37-debuginfo-2.40.5-150200.78.1 * typelib-1_0-WebKit2-4_0-2.40.5-150200.78.1 * webkit2gtk-4_0-injected-bundles-debuginfo-2.40.5-150200.78.1 * webkit2gtk3-debugsource-2.40.5-150200.78.1 * typelib-1_0-WebKit2WebExtension-4_0-2.40.5-150200.78.1 * libjavascriptcoregtk-4_0-18-2.40.5-150200.78.1 * libjavascriptcoregtk-4_0-18-debuginfo-2.40.5-150200.78.1 * SUSE Enterprise Storage 7.1 (noarch) * libwebkit2gtk3-lang-2.40.5-150200.78.1 * openSUSE Leap 15.4 (noarch) * libwebkit2gtk3-lang-2.40.5-150200.78.1 * SUSE Linux Enterprise High Performance Computing 15 SP2 LTSS 15-SP2 (aarch64 x86_64) * webkit2gtk3-devel-2.40.5-150200.78.1 * typelib-1_0-JavaScriptCore-4_0-2.40.5-150200.78.1 * webkit2gtk-4_0-injected-bundles-2.40.5-150200.78.1 * libwebkit2gtk-4_0-37-2.40.5-150200.78.1 * libwebkit2gtk-4_0-37-debuginfo-2.40.5-150200.78.1 * typelib-1_0-WebKit2-4_0-2.40.5-150200.78.1 * webkit2gtk-4_0-injected-bundles-debuginfo-2.40.5-150200.78.1 * webkit2gtk3-debugsource-2.40.5-150200.78.1 * typelib-1_0-WebKit2WebExtension-4_0-2.40.5-150200.78.1 * libjavascriptcoregtk-4_0-18-2.40.5-150200.78.1 * libjavascriptcoregtk-4_0-18-debuginfo-2.40.5-150200.78.1 * SUSE Linux Enterprise High Performance Computing 15 SP2 LTSS 15-SP2 (noarch) * libwebkit2gtk3-lang-2.40.5-150200.78.1 ## References: * https://www.suse.com/security/cve/CVE-2022-48503.html * https://www.suse.com/security/cve/CVE-2023-32435.html * https://www.suse.com/security/cve/CVE-2023-32439.html * https://www.suse.com/security/cve/CVE-2023-38133.html * https://www.suse.com/security/cve/CVE-2023-38572.html * https://www.suse.com/security/cve/CVE-2023-38592.html * https://www.suse.com/security/cve/CVE-2023-38594.html * https://www.suse.com/security/cve/CVE-2023-38595.html * https://www.suse.com/security/cve/CVE-2023-38597.html * https://www.suse.com/security/cve/CVE-2023-38599.html * https://www.suse.com/security/cve/CVE-2023-38600.html * https://www.suse.com/security/cve/CVE-2023-38611.html * https://bugzilla.suse.com/show_bug.cgi?id=1212863 * https://bugzilla.suse.com/show_bug.cgi?id=1213905

1 0

SUSE-SU-2023:3228-1: important: Security update for MozillaThunderbird
by security＠lists.opensuse.org 08 Aug '23

08 Aug '23

# Security update for MozillaThunderbird Announcement ID: SUSE-SU-2023:3228-1 Rating: important References: * #1213657 * #1213746 Cross-References: * CVE-2023-4045 * CVE-2023-4046 * CVE-2023-4047 * CVE-2023-4048 * CVE-2023-4049 * CVE-2023-4050 * CVE-2023-4052 * CVE-2023-4054 * CVE-2023-4055 * CVE-2023-4056 * CVE-2023-4057 CVSS scores: * CVE-2023-4045 ( SUSE ): 6.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N * CVE-2023-4045 ( NVD ): 5.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N * CVE-2023-4046 ( NVD ): 5.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L * CVE-2023-4047 ( NVD ): 8.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H * CVE-2023-4048 ( NVD ): 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H * CVE-2023-4049 ( NVD ): 5.9 CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H * CVE-2023-4050 ( NVD ): 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H * CVE-2023-4052 ( NVD ): 6.5 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N * CVE-2023-4054 ( NVD ): 5.5 CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N * CVE-2023-4055 ( NVD ): 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N * CVE-2023-4056 ( NVD ): 9.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H * CVE-2023-4057 ( NVD ): 9.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H Affected Products: * openSUSE Leap 15.4 * openSUSE Leap 15.5 * SUSE Linux Enterprise Desktop 15 SP4 * SUSE Linux Enterprise Desktop 15 SP5 * SUSE Linux Enterprise High Performance Computing 15 SP4 * SUSE Linux Enterprise High Performance Computing 15 SP5 * SUSE Linux Enterprise Micro 5.3 * SUSE Linux Enterprise Micro 5.4 * SUSE Linux Enterprise Micro 5.5 * SUSE Linux Enterprise Real Time 15 SP4 * SUSE Linux Enterprise Real Time 15 SP5 * SUSE Linux Enterprise Server 15 SP4 * SUSE Linux Enterprise Server 15 SP5 * SUSE Linux Enterprise Server for SAP Applications 15 SP4 * SUSE Linux Enterprise Server for SAP Applications 15 SP5 * SUSE Linux Enterprise Workstation Extension 15 SP4 * SUSE Linux Enterprise Workstation Extension 15 SP5 * SUSE Manager Proxy 4.3 * SUSE Manager Retail Branch Server 4.3 * SUSE Manager Server 4.3 * SUSE Package Hub 15 15-SP4 * SUSE Package Hub 15 15-SP5 An update that solves 11 vulnerabilities can now be installed. ## Description: This update for MozillaThunderbird fixes the following issues: Update Mozilla Thunderbird 115.1.0 (bsc#1213746): * CVE-2023-4045: Fixed cross-origin restrictions bypass with Offscreen Canvas (bmo#1833876). * CVE-2023-4046: Fixed incorrect value used during WASM compilation (bmo#1837686). * CVE-2023-4047: Fixed potential permissions request bypass via clickjacking (bmo#1839073). * CVE-2023-4048: Fixed crash in DOMParser due to out-of-memory conditions (bmo#1841368). * CVE-2023-4049: Fixed potential race conditions when releasing platform objects (bmo#1842658). * CVE-2023-4050: Fixed stack buffer overflow in StorageManager (bmo#1843038). * CVE-2023-4052: Fixed file deletion and privilege escalation through Firefox uninstaller (bmo#1824420). * CVE-2023-4054: Fixed lack of warning when opening appref-ms files (bmo#1840777). * CVE-2023-4055: Fixed cookie jar overflow caused unexpected cookie jar state (bmo#1782561). * CVE-2023-4056: Fixed memory safety bugs (bmo#1820587, bmo#1824634, bmo#1839235, bmo#1842325, bmo#1843847). * CVE-2023-4057: Fixed memory safety bugs (bmo#1841682). Bugfixes: * Remove bashisms from startup-script (bsc#1213657). ## Patch Instructions: To install this SUSE Important update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: * openSUSE Leap 15.5 zypper in -t patch openSUSE-SLE-15.5-2023-3228=1 * SUSE Package Hub 15 15-SP4 zypper in -t patch SUSE-SLE-Module-Packagehub-Subpackages-15-SP4-2023-3228=1 * SUSE Package Hub 15 15-SP5 zypper in -t patch SUSE-SLE-Module-Packagehub-Subpackages-15-SP5-2023-3228=1 * SUSE Linux Enterprise Workstation Extension 15 SP4 zypper in -t patch SUSE-SLE-Product-WE-15-SP4-2023-3228=1 * SUSE Linux Enterprise Workstation Extension 15 SP5 zypper in -t patch SUSE-SLE-Product-WE-15-SP5-2023-3228=1 * openSUSE Leap 15.4 zypper in -t patch openSUSE-SLE-15.4-2023-3228=1 ## Package List: * openSUSE Leap 15.5 (aarch64 ppc64le s390x x86_64) * MozillaThunderbird-debuginfo-115.1.0-150200.8.127.1 * MozillaThunderbird-115.1.0-150200.8.127.1 * MozillaThunderbird-translations-common-115.1.0-150200.8.127.1 * MozillaThunderbird-debugsource-115.1.0-150200.8.127.1 * MozillaThunderbird-translations-other-115.1.0-150200.8.127.1 * SUSE Package Hub 15 15-SP4 (aarch64 ppc64le s390x) * MozillaThunderbird-debuginfo-115.1.0-150200.8.127.1 * MozillaThunderbird-115.1.0-150200.8.127.1 * MozillaThunderbird-translations-common-115.1.0-150200.8.127.1 * MozillaThunderbird-debugsource-115.1.0-150200.8.127.1 * MozillaThunderbird-translations-other-115.1.0-150200.8.127.1 * SUSE Package Hub 15 15-SP5 (aarch64 ppc64le s390x) * MozillaThunderbird-debuginfo-115.1.0-150200.8.127.1 * MozillaThunderbird-115.1.0-150200.8.127.1 * MozillaThunderbird-translations-common-115.1.0-150200.8.127.1 * MozillaThunderbird-debugsource-115.1.0-150200.8.127.1 * MozillaThunderbird-translations-other-115.1.0-150200.8.127.1 * SUSE Linux Enterprise Workstation Extension 15 SP4 (x86_64) * MozillaThunderbird-debuginfo-115.1.0-150200.8.127.1 * MozillaThunderbird-115.1.0-150200.8.127.1 * MozillaThunderbird-translations-common-115.1.0-150200.8.127.1 * MozillaThunderbird-debugsource-115.1.0-150200.8.127.1 * MozillaThunderbird-translations-other-115.1.0-150200.8.127.1 * SUSE Linux Enterprise Workstation Extension 15 SP5 (x86_64) * MozillaThunderbird-debuginfo-115.1.0-150200.8.127.1 * MozillaThunderbird-115.1.0-150200.8.127.1 * MozillaThunderbird-translations-common-115.1.0-150200.8.127.1 * MozillaThunderbird-debugsource-115.1.0-150200.8.127.1 * MozillaThunderbird-translations-other-115.1.0-150200.8.127.1 * openSUSE Leap 15.4 (aarch64 ppc64le s390x x86_64) * MozillaThunderbird-debuginfo-115.1.0-150200.8.127.1 * MozillaThunderbird-115.1.0-150200.8.127.1 * MozillaThunderbird-translations-common-115.1.0-150200.8.127.1 * MozillaThunderbird-debugsource-115.1.0-150200.8.127.1 * MozillaThunderbird-translations-other-115.1.0-150200.8.127.1 ## References: * https://www.suse.com/security/cve/CVE-2023-4045.html * https://www.suse.com/security/cve/CVE-2023-4046.html * https://www.suse.com/security/cve/CVE-2023-4047.html * https://www.suse.com/security/cve/CVE-2023-4048.html * https://www.suse.com/security/cve/CVE-2023-4049.html * https://www.suse.com/security/cve/CVE-2023-4050.html * https://www.suse.com/security/cve/CVE-2023-4052.html * https://www.suse.com/security/cve/CVE-2023-4054.html * https://www.suse.com/security/cve/CVE-2023-4055.html * https://www.suse.com/security/cve/CVE-2023-4056.html * https://www.suse.com/security/cve/CVE-2023-4057.html * https://bugzilla.suse.com/show_bug.cgi?id=1213657 * https://bugzilla.suse.com/show_bug.cgi?id=1213746

1 0

SUSE-SU-2023:3225-1: important: Security update for qt6-base
by security＠lists.opensuse.org 08 Aug '23

08 Aug '23

# Security update for qt6-base Announcement ID: SUSE-SU-2023:3225-1 Rating: important References: * #1209616 * #1211642 * #1211797 * #1211994 * #1213326 Cross-References: * CVE-2023-24607 * CVE-2023-32762 * CVE-2023-33285 * CVE-2023-34410 * CVE-2023-38197 CVSS scores: * CVE-2023-24607 ( NVD ): 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H * CVE-2023-32762 ( SUSE ): 5.3 CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:N/I:H/A:N * CVE-2023-32762 ( NVD ): 5.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N * CVE-2023-33285 ( SUSE ): 6.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:L * CVE-2023-33285 ( NVD ): 5.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L * CVE-2023-34410 ( SUSE ): 6.2 CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N * CVE-2023-34410 ( NVD ): 5.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N * CVE-2023-38197 ( SUSE ): 5.5 CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H * CVE-2023-38197 ( NVD ): 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H Affected Products: * Desktop Applications Module 15-SP5 * openSUSE Leap 15.5 * SUSE Linux Enterprise Desktop 15 SP5 * SUSE Linux Enterprise High Performance Computing 15 SP5 * SUSE Linux Enterprise Micro 5.5 * SUSE Linux Enterprise Real Time 15 SP5 * SUSE Linux Enterprise Server 15 SP5 * SUSE Linux Enterprise Server for SAP Applications 15 SP5 * SUSE Package Hub 15 15-SP5 An update that solves five vulnerabilities can now be installed. ## Description: This update for qt6-base fixes the following issues: * CVE-2023-34410: Fixed certificate validation does not always consider whether the root of a chain is a configured CA certificate (bsc#1211994). * CVE-2023-33285: Fixed buffer overflow in QDnsLookup (bsc#1211642). * CVE-2023-32762: Fixed Qt Network incorrectly parses the strict-transport- security (HSTS) header (bsc#1211797). * CVE-2023-38197: Fixed infinite loops in QXmlStreamReader(bsc#1213326). * CVE-2023-24607: Fixed Qt SQL ODBC driver plugin DOS (bsc#1209616). ## Patch Instructions: To install this SUSE Important update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: * openSUSE Leap 15.5 zypper in -t patch SUSE-2023-3225=1 openSUSE-SLE-15.5-2023-3225=1 * Desktop Applications Module 15-SP5 zypper in -t patch SUSE-SLE-Module-Desktop-Applications-15-SP5-2023-3225=1 * SUSE Package Hub 15 15-SP5 zypper in -t patch SUSE-SLE-Module-Packagehub-Subpackages-15-SP5-2023-3225=1 ## Package List: * openSUSE Leap 15.5 (aarch64 ppc64le s390x x86_64 i586) * libQt6Concurrent6-debuginfo-6.4.2-150500.3.7.4 * qt6-base-common-devel-debuginfo-6.4.2-150500.3.7.4 * qt6-widgets-private-devel-6.4.2-150500.3.7.4 * qt6-gui-devel-6.4.2-150500.3.7.4 * libQt6Network6-debuginfo-6.4.2-150500.3.7.4 * qt6-gui-private-devel-6.4.2-150500.3.7.4 * libQt6Widgets6-6.4.2-150500.3.7.4 * qt6-dbus-devel-6.4.2-150500.3.7.4 * qt6-platformtheme-xdgdesktopportal-6.4.2-150500.3.7.4 * qt6-network-private-devel-6.4.2-150500.3.7.4 * libQt6Test6-debuginfo-6.4.2-150500.3.7.4 * libQt6Sql6-debuginfo-6.4.2-150500.3.7.4 * qt6-base-common-devel-6.4.2-150500.3.7.4 * qt6-base-examples-debuginfo-6.4.2-150500.3.7.4 * qt6-base-docs-html-6.4.2-150500.3.7.1 * qt6-kmssupport-private-devel-6.4.2-150500.3.7.4 * qt6-base-examples-6.4.2-150500.3.7.4 * qt6-platformtheme-gtk3-debuginfo-6.4.2-150500.3.7.4 * qt6-base-docs-qch-6.4.2-150500.3.7.1 * libQt6OpenGL6-debuginfo-6.4.2-150500.3.7.4 * qt6-core-devel-6.4.2-150500.3.7.4 * qt6-networkinformation-glib-6.4.2-150500.3.7.4 * qt6-openglwidgets-devel-6.4.2-150500.3.7.4 * qt6-platformtheme-xdgdesktopportal-debuginfo-6.4.2-150500.3.7.4 * libQt6Widgets6-debuginfo-6.4.2-150500.3.7.4 * libQt6Core6-6.4.2-150500.3.7.4 * libQt6PrintSupport6-debuginfo-6.4.2-150500.3.7.4 * qt6-sql-sqlite-6.4.2-150500.3.7.4 * qt6-network-devel-6.4.2-150500.3.7.4 * qt6-base-debugsource-6.4.2-150500.3.7.4 * qt6-networkinformation-nm-6.4.2-150500.3.7.4 * qt6-core-private-devel-6.4.2-150500.3.7.4 * qt6-printsupport-private-devel-6.4.2-150500.3.7.4 * libQt6DBus6-debuginfo-6.4.2-150500.3.7.4 * qt6-test-private-devel-6.4.2-150500.3.7.4 * qt6-xml-private-devel-6.4.2-150500.3.7.4 * qt6-network-tls-6.4.2-150500.3.7.4 * qt6-network-tls-debuginfo-6.4.2-150500.3.7.4 * qt6-kmssupport-devel-static-6.4.2-150500.3.7.4 * qt6-networkinformation-glib-debuginfo-6.4.2-150500.3.7.4 * qt6-platformtheme-gtk3-6.4.2-150500.3.7.4 * qt6-printsupport-cups-debuginfo-6.4.2-150500.3.7.4 * libQt6PrintSupport6-6.4.2-150500.3.7.4 * qt6-dbus-private-devel-6.4.2-150500.3.7.4 * qt6-networkinformation-nm-debuginfo-6.4.2-150500.3.7.4 * qt6-sql-unixODBC-6.4.2-150500.3.7.4 * qt6-sql-postgresql-debuginfo-6.4.2-150500.3.7.4 * libQt6Xml6-6.4.2-150500.3.7.4 * qt6-sql-unixODBC-debuginfo-6.4.2-150500.3.7.4 * qt6-widgets-devel-6.4.2-150500.3.7.4 * libQt6Sql6-6.4.2-150500.3.7.4 * qt6-opengl-devel-6.4.2-150500.3.7.4 * libQt6Network6-6.4.2-150500.3.7.4 * libQt6Xml6-debuginfo-6.4.2-150500.3.7.4 * qt6-opengl-private-devel-6.4.2-150500.3.7.4 * qt6-printsupport-cups-6.4.2-150500.3.7.4 * qt6-platformsupport-private-devel-6.4.2-150500.3.7.4 * qt6-concurrent-devel-6.4.2-150500.3.7.4 * qt6-sql-mysql-6.4.2-150500.3.7.4 * qt6-platformsupport-devel-static-6.4.2-150500.3.7.4 * qt6-sql-private-devel-6.4.2-150500.3.7.4 * libQt6Core6-debuginfo-6.4.2-150500.3.7.4 * libQt6OpenGLWidgets6-debuginfo-6.4.2-150500.3.7.4 * qt6-sql-devel-6.4.2-150500.3.7.4 * qt6-base-debuginfo-6.4.2-150500.3.7.4 * qt6-printsupport-devel-6.4.2-150500.3.7.4 * libQt6Concurrent6-6.4.2-150500.3.7.4 * qt6-sql-mysql-debuginfo-6.4.2-150500.3.7.4 * libQt6Test6-6.4.2-150500.3.7.4 * qt6-sql-sqlite-debuginfo-6.4.2-150500.3.7.4 * qt6-test-devel-6.4.2-150500.3.7.4 * qt6-xml-devel-6.4.2-150500.3.7.4 * libQt6Gui6-debuginfo-6.4.2-150500.3.7.4 * libQt6OpenGLWidgets6-6.4.2-150500.3.7.4 * qt6-sql-postgresql-6.4.2-150500.3.7.4 * libQt6OpenGL6-6.4.2-150500.3.7.4 * libQt6Gui6-6.4.2-150500.3.7.4 * libQt6DBus6-6.4.2-150500.3.7.4 * openSUSE Leap 15.5 (noarch) * qt6-base-devel-6.4.2-150500.3.7.4 * qt6-base-private-devel-6.4.2-150500.3.7.4 * qt6-docs-common-6.4.2-150500.3.7.4 * Desktop Applications Module 15-SP5 (aarch64 ppc64le s390x x86_64) * qt6-base-debuginfo-6.4.2-150500.3.7.4 * libQt6Widgets6-debuginfo-6.4.2-150500.3.7.4 * libQt6Network6-debuginfo-6.4.2-150500.3.7.4 * libQt6Core6-6.4.2-150500.3.7.4 * libQt6Widgets6-6.4.2-150500.3.7.4 * libQt6Network6-6.4.2-150500.3.7.4 * qt6-base-debugsource-6.4.2-150500.3.7.4 * libQt6Gui6-debuginfo-6.4.2-150500.3.7.4 * libQt6DBus6-debuginfo-6.4.2-150500.3.7.4 * qt6-network-tls-6.4.2-150500.3.7.4 * libQt6Core6-debuginfo-6.4.2-150500.3.7.4 * libQt6Gui6-6.4.2-150500.3.7.4 * libQt6OpenGL6-6.4.2-150500.3.7.4 * libQt6DBus6-6.4.2-150500.3.7.4 * qt6-network-tls-debuginfo-6.4.2-150500.3.7.4 * libQt6OpenGL6-debuginfo-6.4.2-150500.3.7.4 * SUSE Package Hub 15 15-SP5 (aarch64 ppc64le s390x x86_64) * libQt6Concurrent6-debuginfo-6.4.2-150500.3.7.4 * qt6-base-common-devel-debuginfo-6.4.2-150500.3.7.4 * qt6-widgets-private-devel-6.4.2-150500.3.7.4 * qt6-gui-devel-6.4.2-150500.3.7.4 * libQt6Network6-debuginfo-6.4.2-150500.3.7.4 * qt6-gui-private-devel-6.4.2-150500.3.7.4 * libQt6Widgets6-6.4.2-150500.3.7.4 * qt6-dbus-devel-6.4.2-150500.3.7.4 * libQt6Test6-debuginfo-6.4.2-150500.3.7.4 * libQt6Sql6-debuginfo-6.4.2-150500.3.7.4 * qt6-base-common-devel-6.4.2-150500.3.7.4 * qt6-kmssupport-private-devel-6.4.2-150500.3.7.4 * libQt6OpenGL6-debuginfo-6.4.2-150500.3.7.4 * qt6-core-devel-6.4.2-150500.3.7.4 * qt6-openglwidgets-devel-6.4.2-150500.3.7.4 * libQt6Widgets6-debuginfo-6.4.2-150500.3.7.4 * libQt6Core6-6.4.2-150500.3.7.4 * libQt6PrintSupport6-debuginfo-6.4.2-150500.3.7.4 * qt6-sql-sqlite-6.4.2-150500.3.7.4 * qt6-network-devel-6.4.2-150500.3.7.4 * qt6-base-debugsource-6.4.2-150500.3.7.4 * qt6-core-private-devel-6.4.2-150500.3.7.4 * libQt6DBus6-debuginfo-6.4.2-150500.3.7.4 * qt6-network-tls-6.4.2-150500.3.7.4 * qt6-network-tls-debuginfo-6.4.2-150500.3.7.4 * qt6-kmssupport-devel-static-6.4.2-150500.3.7.4 * libQt6PrintSupport6-6.4.2-150500.3.7.4 * libQt6Xml6-6.4.2-150500.3.7.4 * qt6-widgets-devel-6.4.2-150500.3.7.4 * libQt6Sql6-6.4.2-150500.3.7.4 * qt6-opengl-devel-6.4.2-150500.3.7.4 * libQt6Network6-6.4.2-150500.3.7.4 * libQt6Xml6-debuginfo-6.4.2-150500.3.7.4 * qt6-opengl-private-devel-6.4.2-150500.3.7.4 * qt6-concurrent-devel-6.4.2-150500.3.7.4 * qt6-platformsupport-devel-static-6.4.2-150500.3.7.4 * libQt6Core6-debuginfo-6.4.2-150500.3.7.4 * libQt6OpenGLWidgets6-debuginfo-6.4.2-150500.3.7.4 * qt6-sql-devel-6.4.2-150500.3.7.4 * qt6-base-debuginfo-6.4.2-150500.3.7.4 * qt6-printsupport-devel-6.4.2-150500.3.7.4 * libQt6Concurrent6-6.4.2-150500.3.7.4 * qt6-sql-sqlite-debuginfo-6.4.2-150500.3.7.4 * libQt6Test6-6.4.2-150500.3.7.4 * qt6-test-devel-6.4.2-150500.3.7.4 * qt6-xml-devel-6.4.2-150500.3.7.4 * libQt6Gui6-debuginfo-6.4.2-150500.3.7.4 * libQt6OpenGLWidgets6-6.4.2-150500.3.7.4 * libQt6OpenGL6-6.4.2-150500.3.7.4 * libQt6Gui6-6.4.2-150500.3.7.4 * libQt6DBus6-6.4.2-150500.3.7.4 * SUSE Package Hub 15 15-SP5 (noarch) * qt6-base-devel-6.4.2-150500.3.7.4 ## References: * https://www.suse.com/security/cve/CVE-2023-24607.html * https://www.suse.com/security/cve/CVE-2023-32762.html * https://www.suse.com/security/cve/CVE-2023-33285.html * https://www.suse.com/security/cve/CVE-2023-34410.html * https://www.suse.com/security/cve/CVE-2023-38197.html * https://bugzilla.suse.com/show_bug.cgi?id=1209616 * https://bugzilla.suse.com/show_bug.cgi?id=1211642 * https://bugzilla.suse.com/show_bug.cgi?id=1211797 * https://bugzilla.suse.com/show_bug.cgi?id=1211994 * https://bugzilla.suse.com/show_bug.cgi?id=1213326

1 0

SUSE-SU-2023:3226-1: important: Security update for gstreamer-plugins-ugly
by security＠lists.opensuse.org 08 Aug '23

08 Aug '23

# Security update for gstreamer-plugins-ugly Announcement ID: SUSE-SU-2023:3226-1 Rating: important References: * #1213750 * #1213751 Cross-References: * CVE-2023-38103 * CVE-2023-38104 CVSS scores: * CVE-2023-38103 ( SUSE ): 8.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H * CVE-2023-38104 ( SUSE ): 8.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H Affected Products: * openSUSE Leap 15.4 * SUSE Linux Enterprise Desktop 15 SP4 * SUSE Linux Enterprise Server 15 SP4 * SUSE Linux Enterprise Server for SAP Applications 15 SP4 * SUSE Linux Enterprise Workstation Extension 15 SP4 An update that solves two vulnerabilities can now be installed. ## Description: This update for gstreamer-plugins-ugly fixes the following issues: * CVE-2023-38104: Fixed integer overflow during parsing of MDPR chunks (bsc#1213750). * CVE-2023-38103: Fixed integer overflow during parsing of MDPR chunks (bsc#1213751). ## Patch Instructions: To install this SUSE Important update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: * openSUSE Leap 15.4 zypper in -t patch SUSE-2023-3226=1 openSUSE-SLE-15.4-2023-3226=1 * SUSE Linux Enterprise Workstation Extension 15 SP4 zypper in -t patch SUSE-SLE-Product-WE-15-SP4-2023-3226=1 ## Package List: * openSUSE Leap 15.4 (aarch64 ppc64le s390x x86_64 i586) * gstreamer-plugins-ugly-debugsource-1.20.1-150400.3.3.1 * gstreamer-plugins-ugly-debuginfo-1.20.1-150400.3.3.1 * gstreamer-plugins-ugly-1.20.1-150400.3.3.1 * openSUSE Leap 15.4 (x86_64) * gstreamer-plugins-ugly-32bit-debuginfo-1.20.1-150400.3.3.1 * gstreamer-plugins-ugly-32bit-1.20.1-150400.3.3.1 * openSUSE Leap 15.4 (noarch) * gstreamer-plugins-ugly-lang-1.20.1-150400.3.3.1 * openSUSE Leap 15.4 (aarch64_ilp32) * gstreamer-plugins-ugly-64bit-debuginfo-1.20.1-150400.3.3.1 * gstreamer-plugins-ugly-64bit-1.20.1-150400.3.3.1 * SUSE Linux Enterprise Workstation Extension 15 SP4 (x86_64) * gstreamer-plugins-ugly-debugsource-1.20.1-150400.3.3.1 * gstreamer-plugins-ugly-debuginfo-1.20.1-150400.3.3.1 * gstreamer-plugins-ugly-1.20.1-150400.3.3.1 * SUSE Linux Enterprise Workstation Extension 15 SP4 (noarch) * gstreamer-plugins-ugly-lang-1.20.1-150400.3.3.1 ## References: * https://www.suse.com/security/cve/CVE-2023-38103.html * https://www.suse.com/security/cve/CVE-2023-38104.html * https://bugzilla.suse.com/show_bug.cgi?id=1213750 * https://bugzilla.suse.com/show_bug.cgi?id=1213751

1 0