September 2023 - openSUSE Security Announce

SUSE-SU-2023:3835-1: important: Securitys update for open-vm-tools
by security＠lists.opensuse.org 27 Sep '23

27 Sep '23

# Securitys update for open-vm-tools Announcement ID: SUSE-SU-2023:3835-1 Rating: important References: * #1205927 * #1214850 * PED-1344 Cross-References: * CVE-2023-20900 CVSS scores: * CVE-2023-20900 ( SUSE ): 7.5 CVSS:3.1/AV:A/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H * CVE-2023-20900 ( NVD ): 7.5 CVSS:3.1/AV:A/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H Affected Products: * Basesystem Module 15-SP4 * Basesystem Module 15-SP5 * Desktop Applications Module 15-SP4 * Desktop Applications Module 15-SP5 * openSUSE Leap 15.4 * openSUSE Leap 15.5 * SUSE Enterprise Storage 7.1 * SUSE Linux Enterprise Desktop 15 SP4 * SUSE Linux Enterprise Desktop 15 SP5 * SUSE Linux Enterprise High Performance Computing 15 SP3 * SUSE Linux Enterprise High Performance Computing 15 SP4 * SUSE Linux Enterprise High Performance Computing 15 SP5 * SUSE Linux Enterprise High Performance Computing ESPOS 15 SP3 * SUSE Linux Enterprise High Performance Computing LTSS 15 SP3 * SUSE Linux Enterprise Micro 5.1 * SUSE Linux Enterprise Micro 5.2 * SUSE Linux Enterprise Micro 5.3 * SUSE Linux Enterprise Micro 5.4 * SUSE Linux Enterprise Micro for Rancher 5.2 * SUSE Linux Enterprise Micro for Rancher 5.3 * SUSE Linux Enterprise Micro for Rancher 5.4 * SUSE Linux Enterprise Real Time 15 SP4 * SUSE Linux Enterprise Real Time 15 SP5 * SUSE Linux Enterprise Server 15 SP3 * SUSE Linux Enterprise Server 15 SP3 LTSS 15-SP3 * SUSE Linux Enterprise Server 15 SP4 * SUSE Linux Enterprise Server 15 SP5 * SUSE Linux Enterprise Server for SAP Applications 15 SP3 * SUSE Linux Enterprise Server for SAP Applications 15 SP4 * SUSE Linux Enterprise Server for SAP Applications 15 SP5 * SUSE Manager Proxy 4.2 * SUSE Manager Proxy 4.3 * SUSE Manager Retail Branch Server 4.2 * SUSE Manager Retail Branch Server 4.3 * SUSE Manager Server 4.2 * SUSE Manager Server 4.3 An update that solves one vulnerability, contains one feature and has one security fix can now be installed. ## Description: This update for open-vm-tools fixes the following issues: Update to 12.3.0 (build 22234872) (bsc#1214850) * There are no new features in the open-vm-tools 12.3.0 release. This is primarily a maintenance release that addresses a few critical problems, including: * This release integrates CVE-2023-20900 without the need for a patch. For more information on this vulnerability and its impact on VMware products, see https://www.vmware.com/security/advisories/VMSA-2023-0019.html. * A tools.conf configuration setting is available to temporaily direct Linux quiesced snaphots to restore pre open-vm-tools 12.2.0 behavior of ignoring file systems already frozen. * Building of the VMware Guest Authentication Service (VGAuth) using "xml- security-c" and "xerces-c" is being deprecated. * A number of Coverity reported issues have been addressed. * A number of GitHub issues and pull requests have been handled. Please see the Resolves Issues section of the Release Notes. * For issues resolved in this release, see the Resolved Issues section of the Release Notes. * For complete details, see: https://github.com/vmware/open-vm- tools/releases/tag/stable-12.3.0 * Release Notes are available at https://github.com/vmware/open-vm- tools/blob/stable-12.3.0/ReleaseNotes.md * The granular changes that have gone into the 12.3.0 release are in the ChangeLog at https://github.com/vmware/open-vm- tools/blob/stable-12.3.0/open-vm-tools/ChangeLog * Fix (bsc#1205927) - hv_vmbus module is loaded unnecessarily in VMware guests * jsc#PED-1344 - reinable building containerinfo plugin for SLES 15 SP4. ## Patch Instructions: To install this SUSE update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: * openSUSE Leap 15.4 zypper in -t patch openSUSE-SLE-15.4-2023-3835=1 * openSUSE Leap 15.5 zypper in -t patch openSUSE-SLE-15.5-2023-3835=1 * SUSE Linux Enterprise Micro for Rancher 5.3 zypper in -t patch SUSE-SLE-Micro-5.3-2023-3835=1 * SUSE Linux Enterprise Micro 5.3 zypper in -t patch SUSE-SLE-Micro-5.3-2023-3835=1 * SUSE Linux Enterprise Micro for Rancher 5.4 zypper in -t patch SUSE-SLE-Micro-5.4-2023-3835=1 * SUSE Linux Enterprise Micro 5.4 zypper in -t patch SUSE-SLE-Micro-5.4-2023-3835=1 * Basesystem Module 15-SP4 zypper in -t patch SUSE-SLE-Module-Basesystem-15-SP4-2023-3835=1 * Basesystem Module 15-SP5 zypper in -t patch SUSE-SLE-Module-Basesystem-15-SP5-2023-3835=1 * Desktop Applications Module 15-SP4 zypper in -t patch SUSE-SLE-Module-Desktop-Applications-15-SP4-2023-3835=1 * Desktop Applications Module 15-SP5 zypper in -t patch SUSE-SLE-Module-Desktop-Applications-15-SP5-2023-3835=1 * SUSE Linux Enterprise High Performance Computing ESPOS 15 SP3 zypper in -t patch SUSE-SLE-Product-HPC-15-SP3-ESPOS-2023-3835=1 * SUSE Linux Enterprise High Performance Computing LTSS 15 SP3 zypper in -t patch SUSE-SLE-Product-HPC-15-SP3-LTSS-2023-3835=1 * SUSE Linux Enterprise Server 15 SP3 LTSS 15-SP3 zypper in -t patch SUSE-SLE-Product-SLES-15-SP3-LTSS-2023-3835=1 * SUSE Linux Enterprise Server for SAP Applications 15 SP3 zypper in -t patch SUSE-SLE-Product-SLES_SAP-15-SP3-2023-3835=1 * SUSE Manager Proxy 4.2 zypper in -t patch SUSE-SLE-Product-SUSE-Manager-Proxy-4.2-2023-3835=1 * SUSE Manager Retail Branch Server 4.2 zypper in -t patch SUSE-SLE-Product-SUSE-Manager-Retail-Branch- Server-4.2-2023-3835=1 * SUSE Manager Server 4.2 zypper in -t patch SUSE-SLE-Product-SUSE-Manager-Server-4.2-2023-3835=1 * SUSE Enterprise Storage 7.1 zypper in -t patch SUSE-Storage-7.1-2023-3835=1 * SUSE Linux Enterprise Micro 5.1 zypper in -t patch SUSE-SUSE-MicroOS-5.1-2023-3835=1 * SUSE Linux Enterprise Micro 5.2 zypper in -t patch SUSE-SUSE-MicroOS-5.2-2023-3835=1 * SUSE Linux Enterprise Micro for Rancher 5.2 zypper in -t patch SUSE-SUSE-MicroOS-5.2-2023-3835=1 ## Package List: * openSUSE Leap 15.4 (aarch64 x86_64) * open-vm-tools-desktop-12.3.0-150300.37.1 * open-vm-tools-containerinfo-debuginfo-12.3.0-150300.37.1 * open-vm-tools-debuginfo-12.3.0-150300.37.1 * open-vm-tools-containerinfo-12.3.0-150300.37.1 * open-vm-tools-sdmp-debuginfo-12.3.0-150300.37.1 * open-vm-tools-debugsource-12.3.0-150300.37.1 * open-vm-tools-desktop-debuginfo-12.3.0-150300.37.1 * open-vm-tools-sdmp-12.3.0-150300.37.1 * libvmtools-devel-12.3.0-150300.37.1 * libvmtools0-12.3.0-150300.37.1 * open-vm-tools-12.3.0-150300.37.1 * libvmtools0-debuginfo-12.3.0-150300.37.1 * openSUSE Leap 15.4 (x86_64) * open-vm-tools-salt-minion-12.3.0-150300.37.1 * openSUSE Leap 15.5 (aarch64 x86_64) * open-vm-tools-desktop-12.3.0-150300.37.1 * open-vm-tools-containerinfo-debuginfo-12.3.0-150300.37.1 * open-vm-tools-debuginfo-12.3.0-150300.37.1 * open-vm-tools-containerinfo-12.3.0-150300.37.1 * open-vm-tools-sdmp-debuginfo-12.3.0-150300.37.1 * open-vm-tools-debugsource-12.3.0-150300.37.1 * open-vm-tools-desktop-debuginfo-12.3.0-150300.37.1 * open-vm-tools-sdmp-12.3.0-150300.37.1 * libvmtools-devel-12.3.0-150300.37.1 * libvmtools0-12.3.0-150300.37.1 * open-vm-tools-12.3.0-150300.37.1 * libvmtools0-debuginfo-12.3.0-150300.37.1 * openSUSE Leap 15.5 (x86_64) * open-vm-tools-salt-minion-12.3.0-150300.37.1 * SUSE Linux Enterprise Micro for Rancher 5.3 (x86_64) * open-vm-tools-debuginfo-12.3.0-150300.37.1 * open-vm-tools-debugsource-12.3.0-150300.37.1 * libvmtools0-12.3.0-150300.37.1 * open-vm-tools-12.3.0-150300.37.1 * libvmtools0-debuginfo-12.3.0-150300.37.1 * SUSE Linux Enterprise Micro 5.3 (x86_64) * open-vm-tools-debuginfo-12.3.0-150300.37.1 * open-vm-tools-debugsource-12.3.0-150300.37.1 * libvmtools0-12.3.0-150300.37.1 * open-vm-tools-12.3.0-150300.37.1 * libvmtools0-debuginfo-12.3.0-150300.37.1 * SUSE Linux Enterprise Micro for Rancher 5.4 (x86_64) * open-vm-tools-debuginfo-12.3.0-150300.37.1 * open-vm-tools-debugsource-12.3.0-150300.37.1 * libvmtools0-12.3.0-150300.37.1 * open-vm-tools-12.3.0-150300.37.1 * libvmtools0-debuginfo-12.3.0-150300.37.1 * SUSE Linux Enterprise Micro 5.4 (x86_64) * open-vm-tools-debuginfo-12.3.0-150300.37.1 * open-vm-tools-debugsource-12.3.0-150300.37.1 * libvmtools0-12.3.0-150300.37.1 * open-vm-tools-12.3.0-150300.37.1 * libvmtools0-debuginfo-12.3.0-150300.37.1 * Basesystem Module 15-SP4 (aarch64 x86_64) * open-vm-tools-containerinfo-debuginfo-12.3.0-150300.37.1 * open-vm-tools-debuginfo-12.3.0-150300.37.1 * open-vm-tools-containerinfo-12.3.0-150300.37.1 * open-vm-tools-sdmp-debuginfo-12.3.0-150300.37.1 * open-vm-tools-debugsource-12.3.0-150300.37.1 * open-vm-tools-sdmp-12.3.0-150300.37.1 * libvmtools-devel-12.3.0-150300.37.1 * libvmtools0-12.3.0-150300.37.1 * open-vm-tools-12.3.0-150300.37.1 * libvmtools0-debuginfo-12.3.0-150300.37.1 * Basesystem Module 15-SP4 (x86_64) * open-vm-tools-salt-minion-12.3.0-150300.37.1 * Basesystem Module 15-SP5 (aarch64 x86_64) * open-vm-tools-containerinfo-debuginfo-12.3.0-150300.37.1 * open-vm-tools-debuginfo-12.3.0-150300.37.1 * open-vm-tools-containerinfo-12.3.0-150300.37.1 * open-vm-tools-sdmp-debuginfo-12.3.0-150300.37.1 * open-vm-tools-debugsource-12.3.0-150300.37.1 * open-vm-tools-sdmp-12.3.0-150300.37.1 * libvmtools0-12.3.0-150300.37.1 * open-vm-tools-12.3.0-150300.37.1 * libvmtools0-debuginfo-12.3.0-150300.37.1 * Basesystem Module 15-SP5 (x86_64) * libvmtools-devel-12.3.0-150300.37.1 * open-vm-tools-salt-minion-12.3.0-150300.37.1 * Desktop Applications Module 15-SP4 (aarch64 x86_64) * open-vm-tools-desktop-12.3.0-150300.37.1 * open-vm-tools-desktop-debuginfo-12.3.0-150300.37.1 * open-vm-tools-debuginfo-12.3.0-150300.37.1 * open-vm-tools-debugsource-12.3.0-150300.37.1 * Desktop Applications Module 15-SP5 (aarch64 x86_64) * open-vm-tools-desktop-12.3.0-150300.37.1 * open-vm-tools-desktop-debuginfo-12.3.0-150300.37.1 * open-vm-tools-debuginfo-12.3.0-150300.37.1 * open-vm-tools-debugsource-12.3.0-150300.37.1 * SUSE Linux Enterprise High Performance Computing ESPOS 15 SP3 (x86_64) * open-vm-tools-desktop-12.3.0-150300.37.1 * open-vm-tools-containerinfo-debuginfo-12.3.0-150300.37.1 * open-vm-tools-debuginfo-12.3.0-150300.37.1 * open-vm-tools-containerinfo-12.3.0-150300.37.1 * open-vm-tools-sdmp-debuginfo-12.3.0-150300.37.1 * open-vm-tools-debugsource-12.3.0-150300.37.1 * open-vm-tools-desktop-debuginfo-12.3.0-150300.37.1 * open-vm-tools-sdmp-12.3.0-150300.37.1 * libvmtools-devel-12.3.0-150300.37.1 * libvmtools0-12.3.0-150300.37.1 * open-vm-tools-salt-minion-12.3.0-150300.37.1 * open-vm-tools-12.3.0-150300.37.1 * libvmtools0-debuginfo-12.3.0-150300.37.1 * SUSE Linux Enterprise High Performance Computing LTSS 15 SP3 (x86_64) * open-vm-tools-desktop-12.3.0-150300.37.1 * open-vm-tools-containerinfo-debuginfo-12.3.0-150300.37.1 * open-vm-tools-debuginfo-12.3.0-150300.37.1 * open-vm-tools-containerinfo-12.3.0-150300.37.1 * open-vm-tools-sdmp-debuginfo-12.3.0-150300.37.1 * open-vm-tools-debugsource-12.3.0-150300.37.1 * open-vm-tools-desktop-debuginfo-12.3.0-150300.37.1 * open-vm-tools-sdmp-12.3.0-150300.37.1 * libvmtools-devel-12.3.0-150300.37.1 * libvmtools0-12.3.0-150300.37.1 * open-vm-tools-12.3.0-150300.37.1 * libvmtools0-debuginfo-12.3.0-150300.37.1 * SUSE Linux Enterprise Server 15 SP3 LTSS 15-SP3 (x86_64) * open-vm-tools-desktop-12.3.0-150300.37.1 * open-vm-tools-containerinfo-debuginfo-12.3.0-150300.37.1 * open-vm-tools-debuginfo-12.3.0-150300.37.1 * open-vm-tools-containerinfo-12.3.0-150300.37.1 * open-vm-tools-sdmp-debuginfo-12.3.0-150300.37.1 * open-vm-tools-debugsource-12.3.0-150300.37.1 * open-vm-tools-desktop-debuginfo-12.3.0-150300.37.1 * open-vm-tools-sdmp-12.3.0-150300.37.1 * libvmtools-devel-12.3.0-150300.37.1 * libvmtools0-12.3.0-150300.37.1 * open-vm-tools-salt-minion-12.3.0-150300.37.1 * open-vm-tools-12.3.0-150300.37.1 * libvmtools0-debuginfo-12.3.0-150300.37.1 * SUSE Linux Enterprise Server for SAP Applications 15 SP3 (x86_64) * open-vm-tools-desktop-12.3.0-150300.37.1 * open-vm-tools-containerinfo-debuginfo-12.3.0-150300.37.1 * open-vm-tools-debuginfo-12.3.0-150300.37.1 * open-vm-tools-containerinfo-12.3.0-150300.37.1 * open-vm-tools-sdmp-debuginfo-12.3.0-150300.37.1 * open-vm-tools-debugsource-12.3.0-150300.37.1 * open-vm-tools-desktop-debuginfo-12.3.0-150300.37.1 * open-vm-tools-sdmp-12.3.0-150300.37.1 * libvmtools-devel-12.3.0-150300.37.1 * libvmtools0-12.3.0-150300.37.1 * open-vm-tools-12.3.0-150300.37.1 * libvmtools0-debuginfo-12.3.0-150300.37.1 * SUSE Manager Proxy 4.2 (x86_64) * open-vm-tools-debuginfo-12.3.0-150300.37.1 * open-vm-tools-sdmp-debuginfo-12.3.0-150300.37.1 * open-vm-tools-debugsource-12.3.0-150300.37.1 * open-vm-tools-sdmp-12.3.0-150300.37.1 * libvmtools-devel-12.3.0-150300.37.1 * libvmtools0-12.3.0-150300.37.1 * open-vm-tools-12.3.0-150300.37.1 * libvmtools0-debuginfo-12.3.0-150300.37.1 * SUSE Manager Retail Branch Server 4.2 (x86_64) * open-vm-tools-debuginfo-12.3.0-150300.37.1 * open-vm-tools-sdmp-debuginfo-12.3.0-150300.37.1 * open-vm-tools-debugsource-12.3.0-150300.37.1 * open-vm-tools-sdmp-12.3.0-150300.37.1 * libvmtools-devel-12.3.0-150300.37.1 * libvmtools0-12.3.0-150300.37.1 * open-vm-tools-12.3.0-150300.37.1 * libvmtools0-debuginfo-12.3.0-150300.37.1 * SUSE Manager Server 4.2 (x86_64) * open-vm-tools-debuginfo-12.3.0-150300.37.1 * open-vm-tools-sdmp-debuginfo-12.3.0-150300.37.1 * open-vm-tools-debugsource-12.3.0-150300.37.1 * open-vm-tools-sdmp-12.3.0-150300.37.1 * libvmtools-devel-12.3.0-150300.37.1 * libvmtools0-12.3.0-150300.37.1 * open-vm-tools-12.3.0-150300.37.1 * libvmtools0-debuginfo-12.3.0-150300.37.1 * SUSE Enterprise Storage 7.1 (x86_64) * open-vm-tools-desktop-12.3.0-150300.37.1 * open-vm-tools-containerinfo-debuginfo-12.3.0-150300.37.1 * open-vm-tools-debuginfo-12.3.0-150300.37.1 * open-vm-tools-containerinfo-12.3.0-150300.37.1 * open-vm-tools-sdmp-debuginfo-12.3.0-150300.37.1 * open-vm-tools-debugsource-12.3.0-150300.37.1 * open-vm-tools-desktop-debuginfo-12.3.0-150300.37.1 * open-vm-tools-sdmp-12.3.0-150300.37.1 * libvmtools-devel-12.3.0-150300.37.1 * libvmtools0-12.3.0-150300.37.1 * open-vm-tools-salt-minion-12.3.0-150300.37.1 * open-vm-tools-12.3.0-150300.37.1 * libvmtools0-debuginfo-12.3.0-150300.37.1 * SUSE Linux Enterprise Micro 5.1 (x86_64) * open-vm-tools-debuginfo-12.3.0-150300.37.1 * open-vm-tools-debugsource-12.3.0-150300.37.1 * libvmtools0-12.3.0-150300.37.1 * open-vm-tools-12.3.0-150300.37.1 * libvmtools0-debuginfo-12.3.0-150300.37.1 * SUSE Linux Enterprise Micro 5.2 (x86_64) * open-vm-tools-debuginfo-12.3.0-150300.37.1 * open-vm-tools-debugsource-12.3.0-150300.37.1 * libvmtools0-12.3.0-150300.37.1 * open-vm-tools-12.3.0-150300.37.1 * libvmtools0-debuginfo-12.3.0-150300.37.1 * SUSE Linux Enterprise Micro for Rancher 5.2 (x86_64) * open-vm-tools-debuginfo-12.3.0-150300.37.1 * open-vm-tools-debugsource-12.3.0-150300.37.1 * libvmtools0-12.3.0-150300.37.1 * open-vm-tools-12.3.0-150300.37.1 * libvmtools0-debuginfo-12.3.0-150300.37.1 ## References: * https://www.suse.com/security/cve/CVE-2023-20900.html * https://bugzilla.suse.com/show_bug.cgi?id=1205927 * https://bugzilla.suse.com/show_bug.cgi?id=1214850 * https://jira.suse.com/browse/PED-1344

1 0

SUSE-SU-2023:3839-1: important: Security update for quagga
by security＠lists.opensuse.org 27 Sep '23

27 Sep '23

# Security update for quagga Announcement ID: SUSE-SU-2023:3839-1 Rating: important References: * #1213284 * #1214735 Cross-References: * CVE-2023-38802 * CVE-2023-41358 CVSS scores: * CVE-2023-38802 ( SUSE ): 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H * CVE-2023-38802 ( NVD ): 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H * CVE-2023-41358 ( SUSE ): 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H * CVE-2023-41358 ( NVD ): 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H Affected Products: * openSUSE Leap 15.4 * openSUSE Leap 15.5 * Server Applications Module 15-SP4 * Server Applications Module 15-SP5 * SUSE Linux Enterprise High Performance Computing 15 SP4 * SUSE Linux Enterprise High Performance Computing 15 SP5 * SUSE Linux Enterprise Real Time 15 SP4 * SUSE Linux Enterprise Real Time 15 SP5 * SUSE Linux Enterprise Server 15 SP4 * SUSE Linux Enterprise Server 15 SP5 * SUSE Linux Enterprise Server for SAP Applications 15 SP4 * SUSE Linux Enterprise Server for SAP Applications 15 SP5 * SUSE Manager Proxy 4.3 * SUSE Manager Retail Branch Server 4.3 * SUSE Manager Server 4.3 An update that solves two vulnerabilities can now be installed. ## Description: This update for quagga fixes the following issues: * CVE-2023-38802: Fixed bad length handling in BGP attribute handling (bsc#1213284). * CVE-2023-41358: Fixed possible crash when processing NLRIs if the attribute length is zero (bsc#1214735). ## Patch Instructions: To install this SUSE update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: * openSUSE Leap 15.4 zypper in -t patch SUSE-2023-3839=1 openSUSE-SLE-15.4-2023-3839=1 * openSUSE Leap 15.5 zypper in -t patch openSUSE-SLE-15.5-2023-3839=1 * Server Applications Module 15-SP4 zypper in -t patch SUSE-SLE-Module-Server-Applications-15-SP4-2023-3839=1 * Server Applications Module 15-SP5 zypper in -t patch SUSE-SLE-Module-Server-Applications-15-SP5-2023-3839=1 ## Package List: * openSUSE Leap 15.4 (aarch64 ppc64le s390x x86_64 i586) * quagga-debugsource-1.1.1-150400.12.5.1 * libzebra1-debuginfo-1.1.1-150400.12.5.1 * quagga-debuginfo-1.1.1-150400.12.5.1 * libospfapiclient0-debuginfo-1.1.1-150400.12.5.1 * libospf0-1.1.1-150400.12.5.1 * quagga-devel-1.1.1-150400.12.5.1 * libquagga_pb0-1.1.1-150400.12.5.1 * quagga-1.1.1-150400.12.5.1 * libfpm_pb0-1.1.1-150400.12.5.1 * libfpm_pb0-debuginfo-1.1.1-150400.12.5.1 * libzebra1-1.1.1-150400.12.5.1 * libquagga_pb0-debuginfo-1.1.1-150400.12.5.1 * libospf0-debuginfo-1.1.1-150400.12.5.1 * libospfapiclient0-1.1.1-150400.12.5.1 * openSUSE Leap 15.5 (aarch64 ppc64le s390x x86_64) * quagga-debugsource-1.1.1-150400.12.5.1 * libzebra1-debuginfo-1.1.1-150400.12.5.1 * quagga-debuginfo-1.1.1-150400.12.5.1 * libospfapiclient0-debuginfo-1.1.1-150400.12.5.1 * libospf0-1.1.1-150400.12.5.1 * quagga-devel-1.1.1-150400.12.5.1 * libquagga_pb0-1.1.1-150400.12.5.1 * quagga-1.1.1-150400.12.5.1 * libfpm_pb0-1.1.1-150400.12.5.1 * libfpm_pb0-debuginfo-1.1.1-150400.12.5.1 * libzebra1-1.1.1-150400.12.5.1 * libquagga_pb0-debuginfo-1.1.1-150400.12.5.1 * libospf0-debuginfo-1.1.1-150400.12.5.1 * libospfapiclient0-1.1.1-150400.12.5.1 * Server Applications Module 15-SP4 (aarch64 ppc64le s390x x86_64) * quagga-debugsource-1.1.1-150400.12.5.1 * libzebra1-debuginfo-1.1.1-150400.12.5.1 * quagga-debuginfo-1.1.1-150400.12.5.1 * libospfapiclient0-debuginfo-1.1.1-150400.12.5.1 * libospf0-1.1.1-150400.12.5.1 * quagga-devel-1.1.1-150400.12.5.1 * libquagga_pb0-1.1.1-150400.12.5.1 * quagga-1.1.1-150400.12.5.1 * libfpm_pb0-1.1.1-150400.12.5.1 * libfpm_pb0-debuginfo-1.1.1-150400.12.5.1 * libzebra1-1.1.1-150400.12.5.1 * libquagga_pb0-debuginfo-1.1.1-150400.12.5.1 * libospf0-debuginfo-1.1.1-150400.12.5.1 * libospfapiclient0-1.1.1-150400.12.5.1 * Server Applications Module 15-SP5 (aarch64 ppc64le s390x x86_64) * quagga-debugsource-1.1.1-150400.12.5.1 * libzebra1-debuginfo-1.1.1-150400.12.5.1 * quagga-debuginfo-1.1.1-150400.12.5.1 * libospfapiclient0-debuginfo-1.1.1-150400.12.5.1 * libospf0-1.1.1-150400.12.5.1 * quagga-devel-1.1.1-150400.12.5.1 * libquagga_pb0-1.1.1-150400.12.5.1 * quagga-1.1.1-150400.12.5.1 * libfpm_pb0-1.1.1-150400.12.5.1 * libfpm_pb0-debuginfo-1.1.1-150400.12.5.1 * libzebra1-1.1.1-150400.12.5.1 * libquagga_pb0-debuginfo-1.1.1-150400.12.5.1 * libospf0-debuginfo-1.1.1-150400.12.5.1 * libospfapiclient0-1.1.1-150400.12.5.1 ## References: * https://www.suse.com/security/cve/CVE-2023-38802.html * https://www.suse.com/security/cve/CVE-2023-41358.html * https://bugzilla.suse.com/show_bug.cgi?id=1213284 * https://bugzilla.suse.com/show_bug.cgi?id=1214735

1 0

SUSE-SU-2023:3840-1: important: Security update for go1.20-openssl
by security＠lists.opensuse.org 27 Sep '23

27 Sep '23

# Security update for go1.20-openssl Announcement ID: SUSE-SU-2023:3840-1 Rating: important References: * #1206346 * #1213880 * #1215084 * #1215085 * #1215090 Cross-References: * CVE-2023-29409 * CVE-2023-39318 * CVE-2023-39319 CVSS scores: * CVE-2023-29409 ( SUSE ): 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H * CVE-2023-29409 ( NVD ): 5.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L * CVE-2023-39318 ( SUSE ): 6.8 CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:N * CVE-2023-39318 ( NVD ): 6.1 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N * CVE-2023-39319 ( SUSE ): 6.8 CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:N * CVE-2023-39319 ( NVD ): 6.1 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N Affected Products: * Development Tools Module 15-SP4 * Development Tools Module 15-SP5 * openSUSE Leap 15.4 * openSUSE Leap 15.5 * SUSE Linux Enterprise Desktop 15 SP4 * SUSE Linux Enterprise Desktop 15 SP5 * SUSE Linux Enterprise High Performance Computing 15 SP4 * SUSE Linux Enterprise High Performance Computing 15 SP5 * SUSE Linux Enterprise Real Time 15 SP4 * SUSE Linux Enterprise Real Time 15 SP5 * SUSE Linux Enterprise Server 15 SP4 * SUSE Linux Enterprise Server 15 SP5 * SUSE Linux Enterprise Server for SAP Applications 15 SP4 * SUSE Linux Enterprise Server for SAP Applications 15 SP5 * SUSE Manager Proxy 4.3 * SUSE Manager Retail Branch Server 4.3 * SUSE Manager Server 4.3 An update that solves three vulnerabilities and has two security fixes can now be installed. ## Description: This update for go1.20-openssl fixes the following issues: Update to version 1.20.8 (bsc#1206346). * CVE-2023-29409: Fixed unrestricted RSA keys in certificates (bsc#1213880). * CVE-2023-39319: Fixed improper handling of special tags within script contexts in html/template (bsc#1215085). * CVE-2023-39318: Fixed improper handling of HTML-like comments within script contexts (bsc#1215084). The following non-security bug was fixed: * Add missing directory pprof html asset directory to package (bsc#1215090). ## Patch Instructions: To install this SUSE update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: * openSUSE Leap 15.4 zypper in -t patch openSUSE-SLE-15.4-2023-3840=1 * openSUSE Leap 15.5 zypper in -t patch openSUSE-SLE-15.5-2023-3840=1 * Development Tools Module 15-SP4 zypper in -t patch SUSE-SLE-Module-Development-Tools-15-SP4-2023-3840=1 * Development Tools Module 15-SP5 zypper in -t patch SUSE-SLE-Module-Development-Tools-15-SP5-2023-3840=1 ## Package List: * openSUSE Leap 15.4 (aarch64 ppc64le s390x x86_64) * go1.20-openssl-1.20.8.1-150000.1.11.1 * go1.20-openssl-race-1.20.8.1-150000.1.11.1 * go1.20-openssl-debuginfo-1.20.8.1-150000.1.11.1 * go1.20-openssl-doc-1.20.8.1-150000.1.11.1 * openSUSE Leap 15.5 (aarch64 ppc64le s390x x86_64) * go1.20-openssl-1.20.8.1-150000.1.11.1 * go1.20-openssl-race-1.20.8.1-150000.1.11.1 * go1.20-openssl-debuginfo-1.20.8.1-150000.1.11.1 * go1.20-openssl-doc-1.20.8.1-150000.1.11.1 * Development Tools Module 15-SP4 (aarch64 ppc64le s390x x86_64) * go1.20-openssl-1.20.8.1-150000.1.11.1 * go1.20-openssl-race-1.20.8.1-150000.1.11.1 * go1.20-openssl-debuginfo-1.20.8.1-150000.1.11.1 * go1.20-openssl-doc-1.20.8.1-150000.1.11.1 * Development Tools Module 15-SP5 (aarch64 ppc64le s390x x86_64) * go1.20-openssl-1.20.8.1-150000.1.11.1 * go1.20-openssl-race-1.20.8.1-150000.1.11.1 * go1.20-openssl-debuginfo-1.20.8.1-150000.1.11.1 * go1.20-openssl-doc-1.20.8.1-150000.1.11.1 ## References: * https://www.suse.com/security/cve/CVE-2023-29409.html * https://www.suse.com/security/cve/CVE-2023-39318.html * https://www.suse.com/security/cve/CVE-2023-39319.html * https://bugzilla.suse.com/show_bug.cgi?id=1206346 * https://bugzilla.suse.com/show_bug.cgi?id=1213880 * https://bugzilla.suse.com/show_bug.cgi?id=1215084 * https://bugzilla.suse.com/show_bug.cgi?id=1215085 * https://bugzilla.suse.com/show_bug.cgi?id=1215090

1 0

SUSE-SU-2023:3841-1: important: Security update for go1.19-openssl
by security＠lists.opensuse.org 27 Sep '23

27 Sep '23

# Security update for go1.19-openssl Announcement ID: SUSE-SU-2023:3841-1 Rating: important References: * #1200441 * #1213229 * #1213880 * #1215090 Cross-References: * CVE-2023-29406 * CVE-2023-29409 CVSS scores: * CVE-2023-29406 ( SUSE ): 4.8 CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:N * CVE-2023-29406 ( NVD ): 6.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N * CVE-2023-29409 ( SUSE ): 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H * CVE-2023-29409 ( NVD ): 5.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L Affected Products: * Development Tools Module 15-SP4 * Development Tools Module 15-SP5 * openSUSE Leap 15.4 * openSUSE Leap 15.5 * SUSE Linux Enterprise Desktop 15 SP4 * SUSE Linux Enterprise Desktop 15 SP5 * SUSE Linux Enterprise High Performance Computing 15 SP4 * SUSE Linux Enterprise High Performance Computing 15 SP5 * SUSE Linux Enterprise Real Time 15 SP4 * SUSE Linux Enterprise Real Time 15 SP5 * SUSE Linux Enterprise Server 15 SP4 * SUSE Linux Enterprise Server 15 SP5 * SUSE Linux Enterprise Server for SAP Applications 15 SP4 * SUSE Linux Enterprise Server for SAP Applications 15 SP5 * SUSE Manager Proxy 4.3 * SUSE Manager Retail Branch Server 4.3 * SUSE Manager Server 4.3 An update that solves two vulnerabilities and has two security fixes can now be installed. ## Description: This update for go1.19-openssl fixes the following issues: Update to version 1.19.13 (bsc#1200441). * CVE-2023-29409: Fixed unrestricted RSA keys in certificates (bsc#1213880). * CVE-2023-29406: Fixed insufficient sanitization of Host header (bsc#1213229). The following non-security bug was fixed: * Add missing directory pprof html asset directory to package (bsc#1215090). ## Patch Instructions: To install this SUSE update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: * openSUSE Leap 15.4 zypper in -t patch openSUSE-SLE-15.4-2023-3841=1 * openSUSE Leap 15.5 zypper in -t patch openSUSE-SLE-15.5-2023-3841=1 * Development Tools Module 15-SP4 zypper in -t patch SUSE-SLE-Module-Development-Tools-15-SP4-2023-3841=1 * Development Tools Module 15-SP5 zypper in -t patch SUSE-SLE-Module-Development-Tools-15-SP5-2023-3841=1 ## Package List: * openSUSE Leap 15.4 (aarch64 ppc64le s390x x86_64) * go1.19-openssl-doc-1.19.13.1-150000.1.8.1 * go1.19-openssl-1.19.13.1-150000.1.8.1 * go1.19-openssl-race-1.19.13.1-150000.1.8.1 * openSUSE Leap 15.5 (aarch64 ppc64le s390x x86_64) * go1.19-openssl-doc-1.19.13.1-150000.1.8.1 * go1.19-openssl-1.19.13.1-150000.1.8.1 * go1.19-openssl-race-1.19.13.1-150000.1.8.1 * Development Tools Module 15-SP4 (aarch64 ppc64le s390x x86_64) * go1.19-openssl-doc-1.19.13.1-150000.1.8.1 * go1.19-openssl-1.19.13.1-150000.1.8.1 * go1.19-openssl-race-1.19.13.1-150000.1.8.1 * Development Tools Module 15-SP5 (aarch64 ppc64le s390x x86_64) * go1.19-openssl-doc-1.19.13.1-150000.1.8.1 * go1.19-openssl-1.19.13.1-150000.1.8.1 * go1.19-openssl-race-1.19.13.1-150000.1.8.1 ## References: * https://www.suse.com/security/cve/CVE-2023-29406.html * https://www.suse.com/security/cve/CVE-2023-29409.html * https://bugzilla.suse.com/show_bug.cgi?id=1200441 * https://bugzilla.suse.com/show_bug.cgi?id=1213229 * https://bugzilla.suse.com/show_bug.cgi?id=1213880 * https://bugzilla.suse.com/show_bug.cgi?id=1215090

1 0

SUSE-SU-2023:3805-1: important: Security update for bind
by security＠lists.opensuse.org 27 Sep '23

27 Sep '23

# Security update for bind Announcement ID: SUSE-SU-2023:3805-1 Rating: important References: * #1215472 Cross-References: * CVE-2023-3341 CVSS scores: * CVE-2023-3341 ( SUSE ): 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H * CVE-2023-3341 ( NVD ): 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H Affected Products: * openSUSE Leap 15.4 * SUSE CaaS Platform 4.0 * SUSE Linux Enterprise High Performance Computing 15 SP1 * SUSE Linux Enterprise High Performance Computing 15 SP1 LTSS 15-SP1 * SUSE Linux Enterprise High Performance Computing 15 SP2 * SUSE Linux Enterprise High Performance Computing 15 SP2 LTSS 15-SP2 * SUSE Linux Enterprise Micro 5.0 * SUSE Linux Enterprise Micro 5.1 * SUSE Linux Enterprise Micro 5.2 * SUSE Linux Enterprise Micro 5.3 * SUSE Linux Enterprise Micro 5.4 * SUSE Linux Enterprise Server 15 SP1 * SUSE Linux Enterprise Server 15 SP1 LTSS 15-SP1 * SUSE Linux Enterprise Server 15 SP2 * SUSE Linux Enterprise Server 15 SP2 LTSS 15-SP2 * SUSE Linux Enterprise Server for SAP Applications 15 SP1 * SUSE Linux Enterprise Server for SAP Applications 15 SP2 * SUSE Manager Client Tools for SLE Micro 5 An update that solves one vulnerability can now be installed. ## Description: This update for bind fixes the following issues: * CVE-2023-3341: Fixed stack exhaustion flaw in control channel code may cause named to terminate unexpectedly (bsc#1215472). ## Patch Instructions: To install this SUSE update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: * openSUSE Leap 15.4 zypper in -t patch openSUSE-SLE-15.4-2023-3805=1 * SUSE Manager Client Tools for SLE Micro 5 zypper in -t patch SUSE-SLE-Manager-Tools-For-Micro-5-2023-3805=1 * SUSE Linux Enterprise High Performance Computing 15 SP1 LTSS 15-SP1 zypper in -t patch SUSE-SLE-Product-HPC-15-SP1-LTSS-2023-3805=1 * SUSE Linux Enterprise High Performance Computing 15 SP2 LTSS 15-SP2 zypper in -t patch SUSE-SLE-Product-HPC-15-SP2-LTSS-2023-3805=1 * SUSE Linux Enterprise Server 15 SP1 LTSS 15-SP1 zypper in -t patch SUSE-SLE-Product-SLES-15-SP1-LTSS-2023-3805=1 * SUSE Linux Enterprise Server 15 SP2 LTSS 15-SP2 zypper in -t patch SUSE-SLE-Product-SLES-15-SP2-LTSS-2023-3805=1 * SUSE Linux Enterprise Server for SAP Applications 15 SP1 zypper in -t patch SUSE-SLE-Product-SLES_SAP-15-SP1-2023-3805=1 * SUSE Linux Enterprise Server for SAP Applications 15 SP2 zypper in -t patch SUSE-SLE-Product-SLES_SAP-15-SP2-2023-3805=1 * SUSE CaaS Platform 4.0 To install this update, use the SUSE CaaS Platform 'skuba' tool. It will inform you if it detects new updates and let you then trigger updating of the complete cluster in a controlled way. ## Package List: * openSUSE Leap 15.4 (x86_64) * libbind9-1600-32bit-9.16.6-150000.12.71.1 * libisc1606-32bit-debuginfo-9.16.6-150000.12.71.1 * bind-devel-32bit-9.16.6-150000.12.71.1 * libdns1605-32bit-debuginfo-9.16.6-150000.12.71.1 * libdns1605-32bit-9.16.6-150000.12.71.1 * libisccc1600-32bit-9.16.6-150000.12.71.1 * libns1604-32bit-9.16.6-150000.12.71.1 * libisccfg1600-32bit-9.16.6-150000.12.71.1 * libirs1601-32bit-debuginfo-9.16.6-150000.12.71.1 * libns1604-32bit-debuginfo-9.16.6-150000.12.71.1 * libisc1606-32bit-9.16.6-150000.12.71.1 * libbind9-1600-32bit-debuginfo-9.16.6-150000.12.71.1 * libirs1601-32bit-9.16.6-150000.12.71.1 * libisccc1600-32bit-debuginfo-9.16.6-150000.12.71.1 * libisccfg1600-32bit-debuginfo-9.16.6-150000.12.71.1 * SUSE Manager Client Tools for SLE Micro 5 (aarch64 s390x x86_64) * libisc1606-9.16.6-150000.12.71.1 * libisccc1600-9.16.6-150000.12.71.1 * bind-utils-9.16.6-150000.12.71.1 * libbind9-1600-9.16.6-150000.12.71.1 * libisccfg1600-9.16.6-150000.12.71.1 * libirs1601-9.16.6-150000.12.71.1 * libdns1605-9.16.6-150000.12.71.1 * SUSE Manager Client Tools for SLE Micro 5 (aarch64_ilp32) * libisc1606-64bit-9.16.6-150000.12.71.1 * libbind9-1600-64bit-9.16.6-150000.12.71.1 * libisccfg1600-64bit-9.16.6-150000.12.71.1 * libirs1601-64bit-9.16.6-150000.12.71.1 * libdns1605-64bit-9.16.6-150000.12.71.1 * libisccc1600-64bit-9.16.6-150000.12.71.1 * SUSE Manager Client Tools for SLE Micro 5 (noarch) * python3-bind-9.16.6-150000.12.71.1 * SUSE Manager Client Tools for SLE Micro 5 (s390x x86_64) * libns1604-9.16.6-150000.12.71.1 * SUSE Linux Enterprise High Performance Computing 15 SP1 LTSS 15-SP1 (aarch64 x86_64) * libisccc1600-9.16.6-150000.12.71.1 * bind-utils-9.16.6-150000.12.71.1 * libirs1601-9.16.6-150000.12.71.1 * bind-utils-debuginfo-9.16.6-150000.12.71.1 * libirs-devel-9.16.6-150000.12.71.1 * bind-chrootenv-9.16.6-150000.12.71.1 * bind-debuginfo-9.16.6-150000.12.71.1 * libisc1606-9.16.6-150000.12.71.1 * bind-debugsource-9.16.6-150000.12.71.1 * libisc1606-debuginfo-9.16.6-150000.12.71.1 * libisccfg1600-debuginfo-9.16.6-150000.12.71.1 * libdns1605-9.16.6-150000.12.71.1 * libisccc1600-debuginfo-9.16.6-150000.12.71.1 * libisccfg1600-9.16.6-150000.12.71.1 * libns1604-debuginfo-9.16.6-150000.12.71.1 * bind-devel-9.16.6-150000.12.71.1 * libirs1601-debuginfo-9.16.6-150000.12.71.1 * libbind9-1600-debuginfo-9.16.6-150000.12.71.1 * libns1604-9.16.6-150000.12.71.1 * libdns1605-debuginfo-9.16.6-150000.12.71.1 * libbind9-1600-9.16.6-150000.12.71.1 * bind-9.16.6-150000.12.71.1 * SUSE Linux Enterprise High Performance Computing 15 SP1 LTSS 15-SP1 (noarch) * bind-doc-9.16.6-150000.12.71.1 * python3-bind-9.16.6-150000.12.71.1 * SUSE Linux Enterprise High Performance Computing 15 SP2 LTSS 15-SP2 (aarch64 x86_64) * libisccc1600-9.16.6-150000.12.71.1 * bind-utils-9.16.6-150000.12.71.1 * libirs1601-9.16.6-150000.12.71.1 * bind-utils-debuginfo-9.16.6-150000.12.71.1 * libirs-devel-9.16.6-150000.12.71.1 * bind-chrootenv-9.16.6-150000.12.71.1 * bind-debuginfo-9.16.6-150000.12.71.1 * libisc1606-9.16.6-150000.12.71.1 * bind-debugsource-9.16.6-150000.12.71.1 * libisc1606-debuginfo-9.16.6-150000.12.71.1 * libisccfg1600-debuginfo-9.16.6-150000.12.71.1 * libdns1605-9.16.6-150000.12.71.1 * libisccc1600-debuginfo-9.16.6-150000.12.71.1 * libisccfg1600-9.16.6-150000.12.71.1 * libns1604-debuginfo-9.16.6-150000.12.71.1 * bind-devel-9.16.6-150000.12.71.1 * libirs1601-debuginfo-9.16.6-150000.12.71.1 * libbind9-1600-debuginfo-9.16.6-150000.12.71.1 * libns1604-9.16.6-150000.12.71.1 * libdns1605-debuginfo-9.16.6-150000.12.71.1 * libbind9-1600-9.16.6-150000.12.71.1 * bind-9.16.6-150000.12.71.1 * SUSE Linux Enterprise High Performance Computing 15 SP2 LTSS 15-SP2 (noarch) * bind-doc-9.16.6-150000.12.71.1 * python3-bind-9.16.6-150000.12.71.1 * SUSE Linux Enterprise Server 15 SP1 LTSS 15-SP1 (aarch64 ppc64le s390x x86_64) * libisccc1600-9.16.6-150000.12.71.1 * bind-utils-9.16.6-150000.12.71.1 * libirs1601-9.16.6-150000.12.71.1 * bind-utils-debuginfo-9.16.6-150000.12.71.1 * libirs-devel-9.16.6-150000.12.71.1 * bind-chrootenv-9.16.6-150000.12.71.1 * bind-debuginfo-9.16.6-150000.12.71.1 * libisc1606-9.16.6-150000.12.71.1 * bind-debugsource-9.16.6-150000.12.71.1 * libisc1606-debuginfo-9.16.6-150000.12.71.1 * libisccfg1600-debuginfo-9.16.6-150000.12.71.1 * libdns1605-9.16.6-150000.12.71.1 * libisccc1600-debuginfo-9.16.6-150000.12.71.1 * libisccfg1600-9.16.6-150000.12.71.1 * libns1604-debuginfo-9.16.6-150000.12.71.1 * bind-devel-9.16.6-150000.12.71.1 * libirs1601-debuginfo-9.16.6-150000.12.71.1 * libbind9-1600-debuginfo-9.16.6-150000.12.71.1 * libns1604-9.16.6-150000.12.71.1 * libdns1605-debuginfo-9.16.6-150000.12.71.1 * libbind9-1600-9.16.6-150000.12.71.1 * bind-9.16.6-150000.12.71.1 * SUSE Linux Enterprise Server 15 SP1 LTSS 15-SP1 (noarch) * bind-doc-9.16.6-150000.12.71.1 * python3-bind-9.16.6-150000.12.71.1 * SUSE Linux Enterprise Server 15 SP2 LTSS 15-SP2 (aarch64 ppc64le s390x x86_64) * libisccc1600-9.16.6-150000.12.71.1 * bind-utils-9.16.6-150000.12.71.1 * libirs1601-9.16.6-150000.12.71.1 * bind-utils-debuginfo-9.16.6-150000.12.71.1 * libirs-devel-9.16.6-150000.12.71.1 * bind-chrootenv-9.16.6-150000.12.71.1 * bind-debuginfo-9.16.6-150000.12.71.1 * libisc1606-9.16.6-150000.12.71.1 * bind-debugsource-9.16.6-150000.12.71.1 * libisc1606-debuginfo-9.16.6-150000.12.71.1 * libisccfg1600-debuginfo-9.16.6-150000.12.71.1 * libdns1605-9.16.6-150000.12.71.1 * libisccc1600-debuginfo-9.16.6-150000.12.71.1 * libisccfg1600-9.16.6-150000.12.71.1 * libns1604-debuginfo-9.16.6-150000.12.71.1 * bind-devel-9.16.6-150000.12.71.1 * libirs1601-debuginfo-9.16.6-150000.12.71.1 * libbind9-1600-debuginfo-9.16.6-150000.12.71.1 * libns1604-9.16.6-150000.12.71.1 * libdns1605-debuginfo-9.16.6-150000.12.71.1 * libbind9-1600-9.16.6-150000.12.71.1 * bind-9.16.6-150000.12.71.1 * SUSE Linux Enterprise Server 15 SP2 LTSS 15-SP2 (noarch) * bind-doc-9.16.6-150000.12.71.1 * python3-bind-9.16.6-150000.12.71.1 * SUSE Linux Enterprise Server for SAP Applications 15 SP1 (ppc64le x86_64) * libisccc1600-9.16.6-150000.12.71.1 * bind-utils-9.16.6-150000.12.71.1 * libirs1601-9.16.6-150000.12.71.1 * bind-utils-debuginfo-9.16.6-150000.12.71.1 * libirs-devel-9.16.6-150000.12.71.1 * bind-chrootenv-9.16.6-150000.12.71.1 * bind-debuginfo-9.16.6-150000.12.71.1 * libisc1606-9.16.6-150000.12.71.1 * bind-debugsource-9.16.6-150000.12.71.1 * libisc1606-debuginfo-9.16.6-150000.12.71.1 * libisccfg1600-debuginfo-9.16.6-150000.12.71.1 * libdns1605-9.16.6-150000.12.71.1 * libisccc1600-debuginfo-9.16.6-150000.12.71.1 * libisccfg1600-9.16.6-150000.12.71.1 * libns1604-debuginfo-9.16.6-150000.12.71.1 * bind-devel-9.16.6-150000.12.71.1 * libirs1601-debuginfo-9.16.6-150000.12.71.1 * libbind9-1600-debuginfo-9.16.6-150000.12.71.1 * libns1604-9.16.6-150000.12.71.1 * libdns1605-debuginfo-9.16.6-150000.12.71.1 * libbind9-1600-9.16.6-150000.12.71.1 * bind-9.16.6-150000.12.71.1 * SUSE Linux Enterprise Server for SAP Applications 15 SP1 (noarch) * bind-doc-9.16.6-150000.12.71.1 * python3-bind-9.16.6-150000.12.71.1 * SUSE Linux Enterprise Server for SAP Applications 15 SP2 (ppc64le x86_64) * libisccc1600-9.16.6-150000.12.71.1 * bind-utils-9.16.6-150000.12.71.1 * libirs1601-9.16.6-150000.12.71.1 * bind-utils-debuginfo-9.16.6-150000.12.71.1 * libirs-devel-9.16.6-150000.12.71.1 * bind-chrootenv-9.16.6-150000.12.71.1 * bind-debuginfo-9.16.6-150000.12.71.1 * libisc1606-9.16.6-150000.12.71.1 * bind-debugsource-9.16.6-150000.12.71.1 * libisc1606-debuginfo-9.16.6-150000.12.71.1 * libisccfg1600-debuginfo-9.16.6-150000.12.71.1 * libdns1605-9.16.6-150000.12.71.1 * libisccc1600-debuginfo-9.16.6-150000.12.71.1 * libisccfg1600-9.16.6-150000.12.71.1 * libns1604-debuginfo-9.16.6-150000.12.71.1 * bind-devel-9.16.6-150000.12.71.1 * libirs1601-debuginfo-9.16.6-150000.12.71.1 * libbind9-1600-debuginfo-9.16.6-150000.12.71.1 * libns1604-9.16.6-150000.12.71.1 * libdns1605-debuginfo-9.16.6-150000.12.71.1 * libbind9-1600-9.16.6-150000.12.71.1 * bind-9.16.6-150000.12.71.1 * SUSE Linux Enterprise Server for SAP Applications 15 SP2 (noarch) * bind-doc-9.16.6-150000.12.71.1 * python3-bind-9.16.6-150000.12.71.1 * SUSE CaaS Platform 4.0 (x86_64) * libisccc1600-9.16.6-150000.12.71.1 * bind-utils-9.16.6-150000.12.71.1 * libirs1601-9.16.6-150000.12.71.1 * bind-utils-debuginfo-9.16.6-150000.12.71.1 * libirs-devel-9.16.6-150000.12.71.1 * bind-chrootenv-9.16.6-150000.12.71.1 * bind-debuginfo-9.16.6-150000.12.71.1 * libisc1606-9.16.6-150000.12.71.1 * bind-debugsource-9.16.6-150000.12.71.1 * libisc1606-debuginfo-9.16.6-150000.12.71.1 * libisccfg1600-debuginfo-9.16.6-150000.12.71.1 * libdns1605-9.16.6-150000.12.71.1 * libisccc1600-debuginfo-9.16.6-150000.12.71.1 * libisccfg1600-9.16.6-150000.12.71.1 * libns1604-debuginfo-9.16.6-150000.12.71.1 * bind-devel-9.16.6-150000.12.71.1 * libirs1601-debuginfo-9.16.6-150000.12.71.1 * libbind9-1600-debuginfo-9.16.6-150000.12.71.1 * libns1604-9.16.6-150000.12.71.1 * libdns1605-debuginfo-9.16.6-150000.12.71.1 * libbind9-1600-9.16.6-150000.12.71.1 * bind-9.16.6-150000.12.71.1 * SUSE CaaS Platform 4.0 (noarch) * bind-doc-9.16.6-150000.12.71.1 * python3-bind-9.16.6-150000.12.71.1 ## References: * https://www.suse.com/security/cve/CVE-2023-3341.html * https://bugzilla.suse.com/show_bug.cgi?id=1215472

1 0

SUSE-SU-2023:3813-1: important: Security update for rubygem-actionview-5_1
by security＠lists.opensuse.org 27 Sep '23

27 Sep '23

# Security update for rubygem-actionview-5_1 Announcement ID: SUSE-SU-2023:3813-1 Rating: important References: * #1209826 Cross-References: * CVE-2023-23913 CVSS scores: * CVE-2023-23913 ( SUSE ): 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N Affected Products: * openSUSE Leap 15.4 * openSUSE Leap 15.5 * SUSE Linux Enterprise High Availability Extension 15 SP1 * SUSE Linux Enterprise High Availability Extension 15 SP2 * SUSE Linux Enterprise High Availability Extension 15 SP3 * SUSE Linux Enterprise High Availability Extension 15 SP4 * SUSE Linux Enterprise High Availability Extension 15 SP5 * SUSE Linux Enterprise High Performance Computing 15 SP1 * SUSE Linux Enterprise High Performance Computing 15 SP2 * SUSE Linux Enterprise High Performance Computing 15 SP3 * SUSE Linux Enterprise High Performance Computing 15 SP4 * SUSE Linux Enterprise High Performance Computing 15 SP5 * SUSE Linux Enterprise Server 15 SP1 * SUSE Linux Enterprise Server 15 SP1 Business Critical Linux 15-SP1 * SUSE Linux Enterprise Server 15 SP2 * SUSE Linux Enterprise Server 15 SP2 Business Critical Linux 15-SP2 * SUSE Linux Enterprise Server 15 SP3 * SUSE Linux Enterprise Server 15 SP3 Business Critical Linux 15-SP3 * SUSE Linux Enterprise Server 15 SP4 * SUSE Linux Enterprise Server 15 SP5 * SUSE Linux Enterprise Server for SAP Applications 15 SP1 * SUSE Linux Enterprise Server for SAP Applications 15 SP2 * SUSE Linux Enterprise Server for SAP Applications 15 SP3 * SUSE Linux Enterprise Server for SAP Applications 15 SP4 * SUSE Linux Enterprise Server for SAP Applications 15 SP5 * SUSE Manager Proxy 4.0 * SUSE Manager Proxy 4.1 * SUSE Manager Proxy 4.2 * SUSE Manager Proxy 4.3 * SUSE Manager Retail Branch Server 4.0 * SUSE Manager Retail Branch Server 4.1 * SUSE Manager Retail Branch Server 4.2 * SUSE Manager Retail Branch Server 4.3 * SUSE Manager Server 4.0 * SUSE Manager Server 4.1 * SUSE Manager Server 4.2 * SUSE Manager Server 4.3 An update that solves one vulnerability can now be installed. ## Description: This update for rubygem-actionview-5_1 fixes the following issues: * CVE-2023-23913: Fixed DOM Based Cross-site Scripting in rails-ujs (bsc#1209826). ## Patch Instructions: To install this SUSE update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: * SUSE Linux Enterprise High Availability Extension 15 SP4 zypper in -t patch SUSE-SLE-Product-HA-15-SP4-2023-3813=1 * SUSE Linux Enterprise High Availability Extension 15 SP5 zypper in -t patch SUSE-SLE-Product-HA-15-SP5-2023-3813=1 * openSUSE Leap 15.4 zypper in -t patch openSUSE-SLE-15.4-2023-3813=1 * openSUSE Leap 15.5 zypper in -t patch openSUSE-SLE-15.5-2023-3813=1 * SUSE Linux Enterprise High Availability Extension 15 SP1 zypper in -t patch SUSE-SLE-Product-HA-15-SP1-2023-3813=1 * SUSE Linux Enterprise High Availability Extension 15 SP2 zypper in -t patch SUSE-SLE-Product-HA-15-SP2-2023-3813=1 * SUSE Linux Enterprise High Availability Extension 15 SP3 zypper in -t patch SUSE-SLE-Product-HA-15-SP3-2023-3813=1 ## Package List: * SUSE Linux Enterprise High Availability Extension 15 SP4 (aarch64 ppc64le s390x x86_64) * ruby2.5-rubygem-actionview-5_1-5.1.4-150000.3.9.1 * SUSE Linux Enterprise High Availability Extension 15 SP5 (aarch64 ppc64le s390x x86_64) * ruby2.5-rubygem-actionview-5_1-5.1.4-150000.3.9.1 * openSUSE Leap 15.4 (aarch64 ppc64le s390x x86_64) * ruby2.5-rubygem-actionview-5_1-5.1.4-150000.3.9.1 * ruby2.5-rubygem-actionview-doc-5_1-5.1.4-150000.3.9.1 * openSUSE Leap 15.5 (aarch64 ppc64le s390x x86_64) * ruby2.5-rubygem-actionview-5_1-5.1.4-150000.3.9.1 * ruby2.5-rubygem-actionview-doc-5_1-5.1.4-150000.3.9.1 * SUSE Linux Enterprise High Availability Extension 15 SP1 (aarch64 ppc64le s390x x86_64) * ruby2.5-rubygem-actionview-5_1-5.1.4-150000.3.9.1 * SUSE Linux Enterprise High Availability Extension 15 SP2 (aarch64 ppc64le s390x x86_64) * ruby2.5-rubygem-actionview-5_1-5.1.4-150000.3.9.1 * SUSE Linux Enterprise High Availability Extension 15 SP3 (aarch64 ppc64le s390x x86_64) * ruby2.5-rubygem-actionview-5_1-5.1.4-150000.3.9.1 ## References: * https://www.suse.com/security/cve/CVE-2023-23913.html * https://bugzilla.suse.com/show_bug.cgi?id=1209826

1 0

SUSE-SU-2023:3806-1: important: Security update for the Linux Kernel RT (Live Patch 3 for SLE 15 SP5)
by security＠lists.opensuse.org 27 Sep '23

27 Sep '23

# Security update for the Linux Kernel RT (Live Patch 3 for SLE 15 SP5) Announcement ID: SUSE-SU-2023:3806-1 Rating: important References: * #1214123 Cross-References: * CVE-2023-4273 CVSS scores: * CVE-2023-4273 ( SUSE ): 7.8 CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H * CVE-2023-4273 ( NVD ): 6.0 CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:N Affected Products: * openSUSE Leap 15.5 * SUSE Linux Enterprise High Performance Computing 15 SP4 * SUSE Linux Enterprise High Performance Computing 15 SP5 * SUSE Linux Enterprise Live Patching 15-SP4 * SUSE Linux Enterprise Live Patching 15-SP5 * SUSE Linux Enterprise Micro 5.3 * SUSE Linux Enterprise Micro 5.4 * SUSE Linux Enterprise Micro 5.5 * SUSE Linux Enterprise Real Time 15 SP4 * SUSE Linux Enterprise Real Time 15 SP5 * SUSE Linux Enterprise Server 15 SP4 * SUSE Linux Enterprise Server 15 SP5 * SUSE Linux Enterprise Server for SAP Applications 15 SP4 * SUSE Linux Enterprise Server for SAP Applications 15 SP5 An update that solves one vulnerability can now be installed. ## Description: This update for the Linux Kernel 5.14.21-150500_13_11 fixes one issue. The following security issue was fixed: * CVE-2023-4273: Fixed a flaw in the exFAT driver of the Linux kernel that alloawed a local privileged attacker to overflow the kernel stack (bsc#1214123). ## Patch Instructions: To install this SUSE update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: * SUSE Linux Enterprise Live Patching 15-SP4 zypper in -t patch SUSE-SLE-Module-Live-Patching-15-SP4-2023-3806=1 * openSUSE Leap 15.5 zypper in -t patch SUSE-2023-3807=1 * SUSE Linux Enterprise Live Patching 15-SP5 zypper in -t patch SUSE-SLE-Module-Live-Patching-15-SP5-2023-3807=1 ## Package List: * SUSE Linux Enterprise Live Patching 15-SP4 (x86_64) * kernel-livepatch-SLE15-SP4-RT_Update_11-debugsource-2-150400.2.1 * kernel-livepatch-5_14_21-150400_15_46-rt-debuginfo-2-150400.2.1 * kernel-livepatch-5_14_21-150400_15_46-rt-2-150400.2.1 * openSUSE Leap 15.5 (x86_64) * kernel-livepatch-5_14_21-150500_13_11-rt-2-150500.2.1 * kernel-livepatch-5_14_21-150500_13_11-rt-debuginfo-2-150500.2.1 * kernel-livepatch-SLE15-SP5-RT_Update_3-debugsource-2-150500.2.1 * SUSE Linux Enterprise Live Patching 15-SP5 (x86_64) * kernel-livepatch-5_14_21-150500_13_11-rt-2-150500.2.1 * kernel-livepatch-5_14_21-150500_13_11-rt-debuginfo-2-150500.2.1 * kernel-livepatch-SLE15-SP5-RT_Update_3-debugsource-2-150500.2.1 ## References: * https://www.suse.com/security/cve/CVE-2023-4273.html * https://bugzilla.suse.com/show_bug.cgi?id=1214123

1 0

SUSE-SU-2023:3801-1: important: Security update for gstreamer-plugins-base
by security＠lists.opensuse.org 27 Sep '23

27 Sep '23

# Security update for gstreamer-plugins-base Announcement ID: SUSE-SU-2023:3801-1 Rating: important References: * #1185448 * #1213128 * #1213131 Cross-References: * CVE-2021-3522 * CVE-2023-37327 * CVE-2023-37328 CVSS scores: * CVE-2021-3522 ( SUSE ): 5.5 CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H * CVE-2021-3522 ( NVD ): 5.5 CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H * CVE-2023-37327 ( SUSE ): 7.8 CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H * CVE-2023-37328 ( SUSE ): 7.8 CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H Affected Products: * openSUSE Leap 15.4 * SUSE CaaS Platform 4.0 * SUSE Linux Enterprise High Performance Computing 15 SP1 * SUSE Linux Enterprise High Performance Computing 15 SP1 LTSS 15-SP1 * SUSE Linux Enterprise Server 15 SP1 * SUSE Linux Enterprise Server 15 SP1 LTSS 15-SP1 * SUSE Linux Enterprise Server for SAP Applications 15 SP1 An update that solves three vulnerabilities can now be installed. ## Description: This update for gstreamer-plugins-base fixes the following issues: * CVE-2023-37327: Fixed FLAC file parsing integer overflow (bsc#1213128). * CVE-2023-37328: Fixed PGS file parsing heap-based buffer overflow (bsc#1213131). * CVE-2021-3522: Fixed frame size check and potential invalid reads (bsc#1185448). ## Patch Instructions: To install this SUSE update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: * openSUSE Leap 15.4 zypper in -t patch openSUSE-SLE-15.4-2023-3801=1 * SUSE Linux Enterprise High Performance Computing 15 SP1 LTSS 15-SP1 zypper in -t patch SUSE-SLE-Product-HPC-15-SP1-LTSS-2023-3801=1 * SUSE Linux Enterprise Server 15 SP1 LTSS 15-SP1 zypper in -t patch SUSE-SLE-Product-SLES-15-SP1-LTSS-2023-3801=1 * SUSE Linux Enterprise Server for SAP Applications 15 SP1 zypper in -t patch SUSE-SLE-Product-SLES_SAP-15-SP1-2023-3801=1 * SUSE CaaS Platform 4.0 To install this update, use the SUSE CaaS Platform 'skuba' tool. It will inform you if it detects new updates and let you then trigger updating of the complete cluster in a controlled way. ## Package List: * openSUSE Leap 15.4 (aarch64 ppc64le s390x x86_64) * typelib-1_0-GstFft-1_0-1.12.5-150000.3.6.1 * SUSE Linux Enterprise High Performance Computing 15 SP1 LTSS 15-SP1 (aarch64 x86_64) * typelib-1_0-GstSdp-1_0-1.12.5-150000.3.6.1 * typelib-1_0-GstAllocators-1_0-1.12.5-150000.3.6.1 * libgstapp-1_0-0-1.12.5-150000.3.6.1 * libgstsdp-1_0-0-debuginfo-1.12.5-150000.3.6.1 * gstreamer-plugins-base-debuginfo-1.12.5-150000.3.6.1 * typelib-1_0-GstAudio-1_0-1.12.5-150000.3.6.1 * libgsttag-1_0-0-debuginfo-1.12.5-150000.3.6.1 * libgstallocators-1_0-0-1.12.5-150000.3.6.1 * typelib-1_0-GstVideo-1_0-1.12.5-150000.3.6.1 * libgstfft-1_0-0-debuginfo-1.12.5-150000.3.6.1 * libgstallocators-1_0-0-debuginfo-1.12.5-150000.3.6.1 * libgstaudio-1_0-0-debuginfo-1.12.5-150000.3.6.1 * libgstaudio-1_0-0-1.12.5-150000.3.6.1 * typelib-1_0-GstRtp-1_0-1.12.5-150000.3.6.1 * gstreamer-plugins-base-devel-1.12.5-150000.3.6.1 * libgstrtp-1_0-0-debuginfo-1.12.5-150000.3.6.1 * typelib-1_0-GstPbutils-1_0-1.12.5-150000.3.6.1 * typelib-1_0-GstTag-1_0-1.12.5-150000.3.6.1 * gstreamer-plugins-base-1.12.5-150000.3.6.1 * libgsttag-1_0-0-1.12.5-150000.3.6.1 * libgstriff-1_0-0-debuginfo-1.12.5-150000.3.6.1 * typelib-1_0-GstRtsp-1_0-1.12.5-150000.3.6.1 * libgstpbutils-1_0-0-1.12.5-150000.3.6.1 * libgstvideo-1_0-0-debuginfo-1.12.5-150000.3.6.1 * gstreamer-plugins-base-debugsource-1.12.5-150000.3.6.1 * libgstsdp-1_0-0-1.12.5-150000.3.6.1 * libgstriff-1_0-0-1.12.5-150000.3.6.1 * libgstpbutils-1_0-0-debuginfo-1.12.5-150000.3.6.1 * libgstrtsp-1_0-0-debuginfo-1.12.5-150000.3.6.1 * libgstapp-1_0-0-debuginfo-1.12.5-150000.3.6.1 * libgstfft-1_0-0-1.12.5-150000.3.6.1 * typelib-1_0-GstFft-1_0-1.12.5-150000.3.6.1 * libgstrtsp-1_0-0-1.12.5-150000.3.6.1 * libgstrtp-1_0-0-1.12.5-150000.3.6.1 * typelib-1_0-GstApp-1_0-1.12.5-150000.3.6.1 * libgstvideo-1_0-0-1.12.5-150000.3.6.1 * SUSE Linux Enterprise High Performance Computing 15 SP1 LTSS 15-SP1 (noarch) * gstreamer-plugins-base-lang-1.12.5-150000.3.6.1 * SUSE Linux Enterprise Server 15 SP1 LTSS 15-SP1 (aarch64 ppc64le s390x x86_64) * typelib-1_0-GstSdp-1_0-1.12.5-150000.3.6.1 * typelib-1_0-GstAllocators-1_0-1.12.5-150000.3.6.1 * libgstapp-1_0-0-1.12.5-150000.3.6.1 * libgstsdp-1_0-0-debuginfo-1.12.5-150000.3.6.1 * gstreamer-plugins-base-debuginfo-1.12.5-150000.3.6.1 * typelib-1_0-GstAudio-1_0-1.12.5-150000.3.6.1 * libgsttag-1_0-0-debuginfo-1.12.5-150000.3.6.1 * libgstallocators-1_0-0-1.12.5-150000.3.6.1 * typelib-1_0-GstVideo-1_0-1.12.5-150000.3.6.1 * libgstfft-1_0-0-debuginfo-1.12.5-150000.3.6.1 * libgstallocators-1_0-0-debuginfo-1.12.5-150000.3.6.1 * libgstaudio-1_0-0-debuginfo-1.12.5-150000.3.6.1 * libgstaudio-1_0-0-1.12.5-150000.3.6.1 * typelib-1_0-GstRtp-1_0-1.12.5-150000.3.6.1 * gstreamer-plugins-base-devel-1.12.5-150000.3.6.1 * libgstrtp-1_0-0-debuginfo-1.12.5-150000.3.6.1 * typelib-1_0-GstPbutils-1_0-1.12.5-150000.3.6.1 * typelib-1_0-GstTag-1_0-1.12.5-150000.3.6.1 * gstreamer-plugins-base-1.12.5-150000.3.6.1 * libgsttag-1_0-0-1.12.5-150000.3.6.1 * libgstriff-1_0-0-debuginfo-1.12.5-150000.3.6.1 * typelib-1_0-GstRtsp-1_0-1.12.5-150000.3.6.1 * libgstpbutils-1_0-0-1.12.5-150000.3.6.1 * libgstvideo-1_0-0-debuginfo-1.12.5-150000.3.6.1 * gstreamer-plugins-base-debugsource-1.12.5-150000.3.6.1 * libgstsdp-1_0-0-1.12.5-150000.3.6.1 * libgstriff-1_0-0-1.12.5-150000.3.6.1 * libgstpbutils-1_0-0-debuginfo-1.12.5-150000.3.6.1 * libgstrtsp-1_0-0-debuginfo-1.12.5-150000.3.6.1 * libgstapp-1_0-0-debuginfo-1.12.5-150000.3.6.1 * libgstfft-1_0-0-1.12.5-150000.3.6.1 * typelib-1_0-GstFft-1_0-1.12.5-150000.3.6.1 * libgstrtsp-1_0-0-1.12.5-150000.3.6.1 * libgstrtp-1_0-0-1.12.5-150000.3.6.1 * typelib-1_0-GstApp-1_0-1.12.5-150000.3.6.1 * libgstvideo-1_0-0-1.12.5-150000.3.6.1 * SUSE Linux Enterprise Server 15 SP1 LTSS 15-SP1 (noarch) * gstreamer-plugins-base-lang-1.12.5-150000.3.6.1 * SUSE Linux Enterprise Server for SAP Applications 15 SP1 (ppc64le x86_64) * typelib-1_0-GstSdp-1_0-1.12.5-150000.3.6.1 * typelib-1_0-GstAllocators-1_0-1.12.5-150000.3.6.1 * libgstapp-1_0-0-1.12.5-150000.3.6.1 * libgstsdp-1_0-0-debuginfo-1.12.5-150000.3.6.1 * gstreamer-plugins-base-debuginfo-1.12.5-150000.3.6.1 * typelib-1_0-GstAudio-1_0-1.12.5-150000.3.6.1 * libgsttag-1_0-0-debuginfo-1.12.5-150000.3.6.1 * libgstallocators-1_0-0-1.12.5-150000.3.6.1 * typelib-1_0-GstVideo-1_0-1.12.5-150000.3.6.1 * libgstfft-1_0-0-debuginfo-1.12.5-150000.3.6.1 * libgstallocators-1_0-0-debuginfo-1.12.5-150000.3.6.1 * libgstaudio-1_0-0-debuginfo-1.12.5-150000.3.6.1 * libgstaudio-1_0-0-1.12.5-150000.3.6.1 * typelib-1_0-GstRtp-1_0-1.12.5-150000.3.6.1 * gstreamer-plugins-base-devel-1.12.5-150000.3.6.1 * libgstrtp-1_0-0-debuginfo-1.12.5-150000.3.6.1 * typelib-1_0-GstPbutils-1_0-1.12.5-150000.3.6.1 * typelib-1_0-GstTag-1_0-1.12.5-150000.3.6.1 * gstreamer-plugins-base-1.12.5-150000.3.6.1 * libgsttag-1_0-0-1.12.5-150000.3.6.1 * libgstriff-1_0-0-debuginfo-1.12.5-150000.3.6.1 * typelib-1_0-GstRtsp-1_0-1.12.5-150000.3.6.1 * libgstpbutils-1_0-0-1.12.5-150000.3.6.1 * libgstvideo-1_0-0-debuginfo-1.12.5-150000.3.6.1 * gstreamer-plugins-base-debugsource-1.12.5-150000.3.6.1 * libgstsdp-1_0-0-1.12.5-150000.3.6.1 * libgstriff-1_0-0-1.12.5-150000.3.6.1 * libgstpbutils-1_0-0-debuginfo-1.12.5-150000.3.6.1 * libgstrtsp-1_0-0-debuginfo-1.12.5-150000.3.6.1 * libgstapp-1_0-0-debuginfo-1.12.5-150000.3.6.1 * libgstfft-1_0-0-1.12.5-150000.3.6.1 * typelib-1_0-GstFft-1_0-1.12.5-150000.3.6.1 * libgstrtsp-1_0-0-1.12.5-150000.3.6.1 * libgstrtp-1_0-0-1.12.5-150000.3.6.1 * typelib-1_0-GstApp-1_0-1.12.5-150000.3.6.1 * libgstvideo-1_0-0-1.12.5-150000.3.6.1 * SUSE Linux Enterprise Server for SAP Applications 15 SP1 (noarch) * gstreamer-plugins-base-lang-1.12.5-150000.3.6.1 * SUSE CaaS Platform 4.0 (x86_64) * typelib-1_0-GstSdp-1_0-1.12.5-150000.3.6.1 * typelib-1_0-GstAllocators-1_0-1.12.5-150000.3.6.1 * libgstapp-1_0-0-1.12.5-150000.3.6.1 * libgstsdp-1_0-0-debuginfo-1.12.5-150000.3.6.1 * gstreamer-plugins-base-debuginfo-1.12.5-150000.3.6.1 * typelib-1_0-GstAudio-1_0-1.12.5-150000.3.6.1 * libgsttag-1_0-0-debuginfo-1.12.5-150000.3.6.1 * libgstallocators-1_0-0-1.12.5-150000.3.6.1 * typelib-1_0-GstVideo-1_0-1.12.5-150000.3.6.1 * libgstfft-1_0-0-debuginfo-1.12.5-150000.3.6.1 * libgstallocators-1_0-0-debuginfo-1.12.5-150000.3.6.1 * libgstaudio-1_0-0-debuginfo-1.12.5-150000.3.6.1 * libgstaudio-1_0-0-1.12.5-150000.3.6.1 * typelib-1_0-GstRtp-1_0-1.12.5-150000.3.6.1 * gstreamer-plugins-base-devel-1.12.5-150000.3.6.1 * libgstrtp-1_0-0-debuginfo-1.12.5-150000.3.6.1 * typelib-1_0-GstPbutils-1_0-1.12.5-150000.3.6.1 * typelib-1_0-GstTag-1_0-1.12.5-150000.3.6.1 * gstreamer-plugins-base-1.12.5-150000.3.6.1 * libgsttag-1_0-0-1.12.5-150000.3.6.1 * libgstriff-1_0-0-debuginfo-1.12.5-150000.3.6.1 * typelib-1_0-GstRtsp-1_0-1.12.5-150000.3.6.1 * libgstpbutils-1_0-0-1.12.5-150000.3.6.1 * libgstvideo-1_0-0-debuginfo-1.12.5-150000.3.6.1 * gstreamer-plugins-base-debugsource-1.12.5-150000.3.6.1 * libgstsdp-1_0-0-1.12.5-150000.3.6.1 * libgstriff-1_0-0-1.12.5-150000.3.6.1 * libgstpbutils-1_0-0-debuginfo-1.12.5-150000.3.6.1 * libgstrtsp-1_0-0-debuginfo-1.12.5-150000.3.6.1 * libgstapp-1_0-0-debuginfo-1.12.5-150000.3.6.1 * libgstfft-1_0-0-1.12.5-150000.3.6.1 * typelib-1_0-GstFft-1_0-1.12.5-150000.3.6.1 * libgstrtsp-1_0-0-1.12.5-150000.3.6.1 * libgstrtp-1_0-0-1.12.5-150000.3.6.1 * typelib-1_0-GstApp-1_0-1.12.5-150000.3.6.1 * libgstvideo-1_0-0-1.12.5-150000.3.6.1 * SUSE CaaS Platform 4.0 (noarch) * gstreamer-plugins-base-lang-1.12.5-150000.3.6.1 ## References: * https://www.suse.com/security/cve/CVE-2021-3522.html * https://www.suse.com/security/cve/CVE-2023-37327.html * https://www.suse.com/security/cve/CVE-2023-37328.html * https://bugzilla.suse.com/show_bug.cgi?id=1185448 * https://bugzilla.suse.com/show_bug.cgi?id=1213128 * https://bugzilla.suse.com/show_bug.cgi?id=1213131

1 0

SUSE-SU-2023:3792-1: moderate: Security update for ImageMagick
by security＠lists.opensuse.org 26 Sep '23

26 Sep '23

# Security update for ImageMagick Announcement ID: SUSE-SU-2023:3792-1 Rating: moderate References: * #1214578 Cross-References: * CVE-2020-21679 CVSS scores: * CVE-2020-21679 ( NVD ): 5.5 CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H Affected Products: * openSUSE Leap 15.4 An update that solves one vulnerability can now be installed. ## Description: This update for ImageMagick fixes the following issues: * CVE-2020-21679: Fixed a buffer overflow in WritePCXImage function in pcx.c which may allow a remote attackers to cause a denial of service. (bsc#1214578) ## Patch Instructions: To install this SUSE update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: * openSUSE Leap 15.4 zypper in -t patch openSUSE-SLE-15.4-2023-3792=1 ## Package List: * openSUSE Leap 15.4 (x86_64) * libMagick++-7_Q16HDRI4-32bit-debuginfo-7.0.7.34-150200.10.54.1 * libMagick++-7_Q16HDRI4-32bit-7.0.7.34-150200.10.54.1 * libMagickWand-7_Q16HDRI6-32bit-debuginfo-7.0.7.34-150200.10.54.1 * libMagickWand-7_Q16HDRI6-32bit-7.0.7.34-150200.10.54.1 * libMagickCore-7_Q16HDRI6-32bit-7.0.7.34-150200.10.54.1 * libMagickCore-7_Q16HDRI6-32bit-debuginfo-7.0.7.34-150200.10.54.1 * openSUSE Leap 15.4 (aarch64 ppc64le s390x x86_64) * libMagickCore-7_Q16HDRI6-7.0.7.34-150200.10.54.1 * libMagickWand-7_Q16HDRI6-debuginfo-7.0.7.34-150200.10.54.1 * libMagick++-7_Q16HDRI4-debuginfo-7.0.7.34-150200.10.54.1 * libMagickCore-7_Q16HDRI6-debuginfo-7.0.7.34-150200.10.54.1 * libMagickWand-7_Q16HDRI6-7.0.7.34-150200.10.54.1 * libMagick++-7_Q16HDRI4-7.0.7.34-150200.10.54.1 ## References: * https://www.suse.com/security/cve/CVE-2020-21679.html * https://bugzilla.suse.com/show_bug.cgi?id=1214578

1 0

openSUSE-SU-2023:0275-1: important: Security update for cacti, cacti-spine
by opensuse-security＠opensuse.org 26 Sep '23

26 Sep '23

openSUSE Security Update: Security update for cacti, cacti-spine ______________________________________________________________________________ Announcement ID: openSUSE-SU-2023:0275-1 Rating: important References: #1215040 #1215042 #1215043 #1215044 #1215045 #1215047 #1215050 #1215051 #1215052 #1215053 #1215054 #1215055 #1215056 #1215058 #1215059 #1215081 #1215082 Cross-References: CVE-2023-30534 CVE-2023-39357 CVE-2023-39358 CVE-2023-39359 CVE-2023-39360 CVE-2023-39361 CVE-2023-39362 CVE-2023-39364 CVE-2023-39365 CVE-2023-39366 CVE-2023-39510 CVE-2023-39511 CVE-2023-39512 CVE-2023-39513 CVE-2023-39514 CVE-2023-39515 CVE-2023-39516 CVSS scores: CVE-2023-30534 (NVD) : 4.3 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N CVE-2023-39357 (NVD) : 8.8 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H CVE-2023-39358 (NVD) : 8.8 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H CVE-2023-39359 (NVD) : 8.8 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H CVE-2023-39360 (NVD) : 6.1 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N CVE-2023-39361 (NVD) : 9.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H CVE-2023-39362 (NVD) : 7.2 CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H CVE-2023-39364 (NVD) : 3.5 CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:L/I:N/A:N CVE-2023-39365 (NVD) : 4.6 CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:L/I:N/A:L CVE-2023-39366 (NVD) : 6.1 CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:U/C:H/I:H/A:N CVE-2023-39510 (NVD) : 6.1 CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:U/C:H/I:H/A:N CVE-2023-39511 (NVD) : 6.1 CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:U/C:H/I:H/A:N CVE-2023-39512 (NVD) : 6.1 CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:U/C:H/I:H/A:N CVE-2023-39513 (NVD) : 6.1 CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:U/C:H/I:H/A:N CVE-2023-39514 (NVD) : 6.1 CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:U/C:H/I:H/A:N CVE-2023-39515 (NVD) : 6.1 CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:U/C:H/I:H/A:N CVE-2023-39516 (NVD) : 6.1 CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:U/C:H/I:H/A:N Affected Products: SUSE Linux Enterprise High Performance Computing 12 SUSE Linux Enterprise Server 12 SUSE Linux Enterprise Server 12-SP3 SUSE Linux Enterprise Server 12-SP4 SUSE Linux Enterprise Server 12-SP5 SUSE Linux Enterprise Server for SAP Applications 12 SUSE Linux Enterprise Server for SAP Applications 12-SP3 SUSE Linux Enterprise Server for SAP Applications 12-SP4 SUSE Linux Enterprise Server for SAP Applications 12-SP5 SUSE Package Hub for SUSE Linux Enterprise 12 openSUSE Backports SLE-15-SP4 openSUSE Backports SLE-15-SP5 ______________________________________________________________________________ An update that fixes 17 vulnerabilities is now available. Description: This update for cacti, cacti-spine fixes the following issues: cacti-spine 1.2.25: * Spine should see if script to be executed is executable * Enhance number recognition * When polling devices, sort by larger number of items first * Log format may be corrupted when timeout occurs * Compile warning appears due to GCC flag on RHEL7/RHEL8 * Downed device detection only checks one of the two uptime OIDs * Compile error appears due to execinfo.h on FreeBSD * Bootstrap shell script contains some PHP cruft * Padding is not always removed from the start of non-numeric strings * Improve SNMP result handling for non-numeric results * Further improve SNMP result handling for non-numeric results * Remove check for the max_oids column which has been present since Cacti v1.0 * Minimize Sorting when fetching poller records for maximum performance * Spine should see if script to be executed is executable cacti-spine 1.2.24: * Fix segfault when ignoring older OIDs cacti 1.2.25: * CVE-2023-30534: Protect against Insecure deserialization of filter data (boo#1215082) * CVE-2023-39360: Cross-Site Scripting vulnerability when creating new graphs (boo#1215044) * CVE-2023-39361: Unauthenticated SQL Injection when viewing graphs (boo#1215045) * CVE-2023-39357: SQL Injection when saving data with sql_save() (boo#1215040) * CVE-2023-39362: Authenticated command injection when using SNMP options (boo#1215047) * CVE-2023-39359: Authenticated SQL injection vulnerability when managing graphs (boo#1215043) * CVE-2023-39358: Authenticated SQL injection vulnerability when managing reports (boo#1215042) * CVE-2023-39365: SQL Injection when using regular expressions (boo#1215051) * CVE-2023-39364: redirect in change password functionality (boo#1215050) * CVE-2023-39366: Cross-Site Scripting vulnerability with Device Name when managing Data Sources (boo#1215052) * CVE-2023-39510: Cross-Site Scripting vulnerability with Device Name when administrating Reports (boo#1215053) * CVE-2023-39511: Cross-Site Scripting vulnerability with Device Name when editing Graphs whilst managing Reports (boo#1215081) * CVE-2023-39512: Cross-Site Scripting vulnerability with Device Name when managing Data Sources (boo#1215054) * CVE-2023-39513: Cross-Site Scripting vulnerability with Device Name when debugging data queries (boo#1215055) * CVE-2023-39514: Cross-Site Scripting vulnerability with Data Source Name when managing Graphs (boo#1215056) * CVE-2023-39515: Cross-Site Scripting vulnerability with Data Source Name when debugging Data Queries (boo#1215058) * CVE-2023-39516: Cross-Site Scripting vulnerability with Data Source Information when managing Data Sources (boo#1215059) * When rebuilding the Poller Cache from command line, allow it to be multi-threaded * When searching tree or list views, the URL does not update after changes * When creating a Data Source Template with a specific snmp port, the port is not always applied * When a Data Query references a file, the filename should be trimmed to remove spurious spaces * THold plugin may not always install or upgrade properly * RRD file structures are not always updated properly, if there are more Data Sources in the Data Template than the Graph Template * When reindexing devices, errors may sometimes be shown * Boost may loose data when the database server is overloaded * Boost can sometimes output unexpected or invalid values * Boost should not attempt to start if there are no items to process * Rebuilding the poller cache does not always work as expected * Host CPU items may not work poll as expected when on a remote data collector where hmib is also enabled * When creating new graphs, invalid offset errors may be generated * When importing packages, SQL errors may be generated * When managing plugins from command line, the --plugin option is not properly handled * When automating an install of Cacti, error messages can be appear * When performing automated install of a plugin, warnings can be thrown * Automation references the wrong table name causing errors * Data Source Info Mode produces invalid recommendations * Data Source Debug 'Run All' generates too many log messages * The description of rebuild poller cache in utilities does not display properly * When reindexing a device, debug information may not always display properly * Upon displaying a form with errors, the session error fields variable isn't cleared * MariaDB clusters will no longer support exclusive locks * RRDtool can fail to update when sources in Data Template and Graph Template data sources do not match * Compatibility improvements for Boost under PHP 8.x * When searching the tree, increase the time before querying for items * Device Location drop down does not always populate correctly * When viewing Realtime graphs, undefined variable errors may be reported * SNMP Uptime is not always ignored for spikekills * Improve detection of downed Devices * When reporting missing functions from Plugins, ensure messages do not occur too often * When starting the Cacti daemon, database errors may be reported when there is no problem * When reporting from RRDcheck, ensure prefix is in the correct casing * Improve Orphaned Data Source options and display * Parsing the PHP Configuration may sometimes produce errors * Security processes attempt to check for a user lockout even if there is no user logged in * When attempting to edit a tree, the search filter for Graphs remains disabled * When reindexing, a Data Source that could be un-orphaned may not always be unorphaned * When parsing a date value, there could be more than 30 chars * Untemplated Data Sources can fail to update due to lack of an assigned Graph * When processing items to check, do not include disabled hosts * When saving a Data Source Template, SQL errors may be reported * When importing a Template, errors may be recorded * Some display strings have invalid formatting that cannot be parsed * When filtering with regular expressions, the 'does not match' option does not always function as expected * When enabling a plugin, sometimes it can appear as if nothing happens * Ensure the Rows Per Page option shows limitations set by configuration * Plugins are unable to modify fields in the setting 'Change Device Settings' * When reporting emails being sent, ensure BCC addresses are also included * Improve compatibility of SNMP class trim handling under PHP 8.x * When importing legacy Data Query Templates, the Template can become unusable * Provide ability to raise an event when extending the settings form * Prevent unsupported SQL Mode flags from being set * The DSStats summary does not always display expected values * When performing a fresh install, device classification may be missing. * Duplication functions for Graph/Template and Data Source/Template do not return and id * Duplication of Device Templates should be an API call * Unable to convert database to latin1 instead of utf8 if desired * When creating Graphs, the process may become slower over time as more items exist * When a bulk walk size is set to automatic, this is not always set to the optimal value * Update copyright notice on import packages * When viewing Orphan Graphs, SQL errors may be reported * When reindexing hosts from command line, ensure only one process runs at once * When a Data Query has no Graphs, it may not be deletable * When duplicating a Graph Template, provide an option to not duplicate Data Query association * When duplicating a Data Template errors can appear in the Cacti log * When importing a Package, previewing makes unexpected changes to Cacti Templates * When enabling boost on a fresh install, an error may be reported * Improve compatibility for backtrace logging under PHP 8.x * Improve compatibility for Advanced Ping under PHP 8.x * Provide new templates for Fortigate and Aruba Cluster to be available during install * Provide new template for SNMP Printer to be available during install * When importing devices, allow a device classification to be known * Extend length of maximum name in settings table * Extend length of maximum name in user settings table * Data Queries do not have a Duplication function * Upgrade d3.js v7.8.2 and billboard.js v3.7.4 * Upgrade ua-parser.js to version 1.0.35 * Update Cisco Device Template to include HSRP graph template * New hook for device template change 'device_template_change' cacti 1.2.24 * Fix: Unable to import Local Linux Machine template * Fix multiple charting and display issues * Compatibility changes for SNMP under PHP 8.2, and other PHP compatibility updates * Fix multiple issues editing settings * timeout fixes for Basic Auth * multiple data poller bug fixes Patch Instructions: To install this openSUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Backports SLE-15-SP5: zypper in -t patch openSUSE-2023-275=1 - openSUSE Backports SLE-15-SP4: zypper in -t patch openSUSE-2023-275=1 - SUSE Package Hub for SUSE Linux Enterprise 12: zypper in -t patch openSUSE-2023-275=1 Package List: - openSUSE Backports SLE-15-SP5 (aarch64 i586 ppc64le s390x x86_64): cacti-spine-1.2.25-bp155.2.3.1 cacti-spine-debuginfo-1.2.25-bp155.2.3.1 cacti-spine-debugsource-1.2.25-bp155.2.3.1 - openSUSE Backports SLE-15-SP5 (noarch): cacti-1.2.25-bp155.2.3.1 - openSUSE Backports SLE-15-SP4 (aarch64 i586 ppc64le s390x x86_64): cacti-spine-1.2.25-bp154.2.9.1 - openSUSE Backports SLE-15-SP4 (noarch): cacti-1.2.25-bp154.2.9.1 - SUSE Package Hub for SUSE Linux Enterprise 12 (aarch64 ppc64le s390x x86_64): cacti-spine-1.2.25-29.1 - SUSE Package Hub for SUSE Linux Enterprise 12 (noarch): cacti-1.2.25-35.1 References: https://www.suse.com/security/cve/CVE-2023-30534.html https://www.suse.com/security/cve/CVE-2023-39357.html https://www.suse.com/security/cve/CVE-2023-39358.html https://www.suse.com/security/cve/CVE-2023-39359.html https://www.suse.com/security/cve/CVE-2023-39360.html https://www.suse.com/security/cve/CVE-2023-39361.html https://www.suse.com/security/cve/CVE-2023-39362.html https://www.suse.com/security/cve/CVE-2023-39364.html https://www.suse.com/security/cve/CVE-2023-39365.html https://www.suse.com/security/cve/CVE-2023-39366.html https://www.suse.com/security/cve/CVE-2023-39510.html https://www.suse.com/security/cve/CVE-2023-39511.html https://www.suse.com/security/cve/CVE-2023-39512.html https://www.suse.com/security/cve/CVE-2023-39513.html https://www.suse.com/security/cve/CVE-2023-39514.html https://www.suse.com/security/cve/CVE-2023-39515.html https://www.suse.com/security/cve/CVE-2023-39516.html https://bugzilla.suse.com/1215040 https://bugzilla.suse.com/1215042 https://bugzilla.suse.com/1215043 https://bugzilla.suse.com/1215044 https://bugzilla.suse.com/1215045 https://bugzilla.suse.com/1215047 https://bugzilla.suse.com/1215050 https://bugzilla.suse.com/1215051 https://bugzilla.suse.com/1215052 https://bugzilla.suse.com/1215053 https://bugzilla.suse.com/1215054 https://bugzilla.suse.com/1215055 https://bugzilla.suse.com/1215056 https://bugzilla.suse.com/1215058 https://bugzilla.suse.com/1215059 https://bugzilla.suse.com/1215081 https://bugzilla.suse.com/1215082

1 0