October 2024 - openSUSE Security Announce

SUSE-SU-2024:3860-1: important: Security update for the Linux Kernel (Live Patch 13 for SLE 15 SP5)
by OPENSUSE-SECURITY-UPDATES 31 Oct '24

31 Oct '24

# Security update for the Linux Kernel (Live Patch 13 for SLE 15 SP5) Announcement ID: SUSE-SU-2024:3860-1 Release Date: 2024-10-31T16:33:36Z Rating: important References: * bsc#1223363 * bsc#1223683 * bsc#1225011 * bsc#1225012 * bsc#1225013 * bsc#1225099 * bsc#1225309 * bsc#1225311 * bsc#1225312 * bsc#1225739 * bsc#1225819 * bsc#1226325 * bsc#1226327 * bsc#1227471 * bsc#1228573 * bsc#1228786 Cross-References: * CVE-2021-47598 * CVE-2023-52752 * CVE-2023-52846 * CVE-2024-26828 * CVE-2024-26923 * CVE-2024-27398 * CVE-2024-35861 * CVE-2024-35862 * CVE-2024-35863 * CVE-2024-35864 * CVE-2024-35867 * CVE-2024-35905 * CVE-2024-36899 * CVE-2024-36964 * CVE-2024-40954 * CVE-2024-41059 CVSS scores: * CVE-2021-47598 ( SUSE ): 7.8 CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H * CVE-2021-47598 ( NVD ): 7.8 CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H * CVE-2023-52752 ( SUSE ): 7.8 CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H * CVE-2023-52752 ( NVD ): 7.8 CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H * CVE-2023-52846 ( SUSE ): 7.0 CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H * CVE-2024-26828 ( SUSE ): 7.3 CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:N/I:H/A:H * CVE-2024-26923 ( SUSE ): 7.0 CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H * CVE-2024-27398 ( SUSE ): 7.8 CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H * CVE-2024-35861 ( SUSE ): 7.8 CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H * CVE-2024-35862 ( SUSE ): 7.8 CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H * CVE-2024-35863 ( SUSE ): 7.8 CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H * CVE-2024-35864 ( SUSE ): 7.8 CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H * CVE-2024-35867 ( SUSE ): 7.8 CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H * CVE-2024-35905 ( SUSE ): 7.8 CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H * CVE-2024-36899 ( SUSE ): 7.0 CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H * CVE-2024-36964 ( SUSE ): 7.2 CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H * CVE-2024-40954 ( SUSE ): 7.0 CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H * CVE-2024-40954 ( NVD ): 7.8 CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H * CVE-2024-41059 ( SUSE ): 7.3 CVSS:4.0/AV:L/AC:H/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N * CVE-2024-41059 ( SUSE ): 7.8 CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H * CVE-2024-41059 ( NVD ): 7.1 CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:H Affected Products: * openSUSE Leap 15.5 * SUSE Linux Enterprise High Performance Computing 15 SP5 * SUSE Linux Enterprise Live Patching 15-SP5 * SUSE Linux Enterprise Micro 5.5 * SUSE Linux Enterprise Real Time 15 SP5 * SUSE Linux Enterprise Server 15 SP5 * SUSE Linux Enterprise Server for SAP Applications 15 SP5 An update that solves 16 vulnerabilities can now be installed. ## Description: This update for the Linux Kernel 5.14.21-150500_55_62 fixes several issues. The following security issues were fixed: * CVE-2024-35905: Fixed int overflow for stack access size (bsc#1226327). * CVE-2021-47598: sch_cake: do not call cake_destroy() from cake_init() (bsc#1227471). * CVE-2024-35863: Fixed potential UAF in is_valid_oplock_break() (bsc#1225011). * CVE-2023-52752: smb: client: fix use-after-free bug in cifs_debug_data_proc_show() (bsc#1225819). * CVE-2024-35862: Fixed potential UAF in smb2_is_network_name_deleted() (bsc#1225311). * CVE-2024-35867: Fixed potential UAF in cifs_stats_proc_show() (bsc#1225012). * CVE-2024-35864: Fixed potential UAF in smb2_is_valid_lease_break() (bsc#1225309). * CVE-2024-35861: Fixed potential UAF in cifs_signal_cifsd_for_reconnect() (bsc#1225312). * CVE-2024-36899: gpiolib: cdev: Fix use after free in lineinfo_changed_notify (bsc#1225739). * CVE-2024-40954: net: do not leave a dangling sk pointer, when socket creation fails (bsc#1227808) * CVE-2024-41059: hfsplus: fix uninit-value in copy_name (bsc#1228573). * CVE-2024-36964: fs/9p: only translate RWX permissions for plain 9P2000 (bsc#1226325). * CVE-2023-52846: hsr: Prevent use after free in prp_create_tagged_frame() (bsc#1225099). * CVE-2024-27398: Fixed use-after-free bugs caused by sco_sock_timeout (bsc#1225013). * CVE-2024-26923: Fixed false-positive lockdep splat for spin_lock() in __unix_gc() (bsc#1223683). * CVE-2024-26828: Fixed underflow in parse_server_interfaces() (bsc#1223363). ## Patch Instructions: To install this SUSE update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: * SUSE Linux Enterprise Live Patching 15-SP5 zypper in -t patch SUSE-SLE-Module-Live-Patching-15-SP5-2024-3860=1 * openSUSE Leap 15.5 zypper in -t patch SUSE-2024-3860=1 ## Package List: * SUSE Linux Enterprise Live Patching 15-SP5 (ppc64le s390x x86_64) * kernel-livepatch-5_14_21-150500_55_62-default-6-150500.11.6.1 * kernel-livepatch-5_14_21-150500_55_62-default-debuginfo-6-150500.11.6.1 * kernel-livepatch-SLE15-SP5_Update_13-debugsource-6-150500.11.6.1 * openSUSE Leap 15.5 (ppc64le s390x x86_64) * kernel-livepatch-5_14_21-150500_55_62-default-6-150500.11.6.1 * kernel-livepatch-5_14_21-150500_55_62-default-debuginfo-6-150500.11.6.1 * kernel-livepatch-SLE15-SP5_Update_13-debugsource-6-150500.11.6.1 ## References: * https://www.suse.com/security/cve/CVE-2021-47598.html * https://www.suse.com/security/cve/CVE-2023-52752.html * https://www.suse.com/security/cve/CVE-2023-52846.html * https://www.suse.com/security/cve/CVE-2024-26828.html * https://www.suse.com/security/cve/CVE-2024-26923.html * https://www.suse.com/security/cve/CVE-2024-27398.html * https://www.suse.com/security/cve/CVE-2024-35861.html * https://www.suse.com/security/cve/CVE-2024-35862.html * https://www.suse.com/security/cve/CVE-2024-35863.html * https://www.suse.com/security/cve/CVE-2024-35864.html * https://www.suse.com/security/cve/CVE-2024-35867.html * https://www.suse.com/security/cve/CVE-2024-35905.html * https://www.suse.com/security/cve/CVE-2024-36899.html * https://www.suse.com/security/cve/CVE-2024-36964.html * https://www.suse.com/security/cve/CVE-2024-40954.html * https://www.suse.com/security/cve/CVE-2024-41059.html * https://bugzilla.suse.com/show_bug.cgi?id=1223363 * https://bugzilla.suse.com/show_bug.cgi?id=1223683 * https://bugzilla.suse.com/show_bug.cgi?id=1225011 * https://bugzilla.suse.com/show_bug.cgi?id=1225012 * https://bugzilla.suse.com/show_bug.cgi?id=1225013 * https://bugzilla.suse.com/show_bug.cgi?id=1225099 * https://bugzilla.suse.com/show_bug.cgi?id=1225309 * https://bugzilla.suse.com/show_bug.cgi?id=1225311 * https://bugzilla.suse.com/show_bug.cgi?id=1225312 * https://bugzilla.suse.com/show_bug.cgi?id=1225739 * https://bugzilla.suse.com/show_bug.cgi?id=1225819 * https://bugzilla.suse.com/show_bug.cgi?id=1226325 * https://bugzilla.suse.com/show_bug.cgi?id=1226327 * https://bugzilla.suse.com/show_bug.cgi?id=1227471 * https://bugzilla.suse.com/show_bug.cgi?id=1228573 * https://bugzilla.suse.com/show_bug.cgi?id=1228786

1 0

openSUSE-SU-2024:14443-1: moderate: xsd-4.1.0-3.1 on GA media
by meissner＠suse.com 31 Oct '24

31 Oct '24

# xsd-4.1.0-3.1 on GA media Announcement ID: openSUSE-SU-2024:14443-1 Rating: moderate Cross-References: * CVE-2024-50602 CVSS scores: * CVE-2024-50602 ( SUSE ): 5.5 CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H * CVE-2024-50602 ( SUSE ): 5.6 CVSS:4.0/AV:L/AC:L/AT:P/PR:N/UI:A/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N Affected Products: * openSUSE Tumbleweed An update that solves one vulnerability can now be installed. ## Description: These are all security issues fixed in the xsd-4.1.0-3.1 package on the GA media of openSUSE Tumbleweed. ## Package List: * openSUSE Tumbleweed: * xsd 4.1.0-3.1 * xsd-doc 4.1.0-3.1 ## References: * https://www.suse.com/security/cve/CVE-2024-50602.html

1 0

openSUSE-SU-2024:14442-1: moderate: netty-4.1.114-1.1 on GA media
by meissner＠suse.com 31 Oct '24

31 Oct '24

# netty-4.1.114-1.1 on GA media Announcement ID: openSUSE-SU-2024:14442-1 Rating: moderate Cross-References: * CVE-2021-21409 * CVE-2021-37136 * CVE-2021-37137 * CVE-2022-24823 * CVE-2022-41881 * CVE-2022-41915 * CVE-2023-34462 * CVE-2023-44487 * CVE-2024-29025 CVSS scores: * CVE-2021-21409 ( SUSE ): 6.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N * CVE-2021-37136 ( SUSE ): 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H * CVE-2021-37137 ( SUSE ): 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H * CVE-2022-24823 ( SUSE ): 6.2 CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N * CVE-2022-41881 ( SUSE ): 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H * CVE-2022-41915 ( SUSE ): 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N * CVE-2023-34462 ( SUSE ): 6.5 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H * CVE-2023-44487 ( SUSE ): 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H * CVE-2024-29025 ( SUSE ): 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H Affected Products: * openSUSE Tumbleweed An update that solves 9 vulnerabilities can now be installed. ## Description: These are all security issues fixed in the netty-4.1.114-1.1 package on the GA media of openSUSE Tumbleweed. ## Package List: * openSUSE Tumbleweed: * netty 4.1.114-1.1 * netty-javadoc 4.1.114-1.1 * netty-poms 4.1.114-1.1 ## References: * https://www.suse.com/security/cve/CVE-2021-21409.html * https://www.suse.com/security/cve/CVE-2021-37136.html * https://www.suse.com/security/cve/CVE-2021-37137.html * https://www.suse.com/security/cve/CVE-2022-24823.html * https://www.suse.com/security/cve/CVE-2022-41881.html * https://www.suse.com/security/cve/CVE-2022-41915.html * https://www.suse.com/security/cve/CVE-2023-34462.html * https://www.suse.com/security/cve/CVE-2023-44487.html * https://www.suse.com/security/cve/CVE-2024-29025.html

1 0

openSUSE-SU-2024:14439-1: moderate: alloy-1.4.3-1.1 on GA media
by meissner＠suse.com 31 Oct '24

31 Oct '24

# alloy-1.4.3-1.1 on GA media Announcement ID: openSUSE-SU-2024:14439-1 Rating: moderate Cross-References: * CVE-2024-36129 * CVE-2024-8975 Affected Products: * openSUSE Tumbleweed An update that solves 2 vulnerabilities can now be installed. ## Description: These are all security issues fixed in the alloy-1.4.3-1.1 package on the GA media of openSUSE Tumbleweed. ## Package List: * openSUSE Tumbleweed: * alloy 1.4.3-1.1 ## References: * https://www.suse.com/security/cve/CVE-2024-36129.html * https://www.suse.com/security/cve/CVE-2024-8975.html

1 0

openSUSE-SU-2024:14440-1: moderate: cargo-audit-advisory-db-20241030-1.1 on GA media
by meissner＠suse.com 31 Oct '24

31 Oct '24

# cargo-audit-advisory-db-20241030-1.1 on GA media Announcement ID: openSUSE-SU-2024:14440-1 Rating: moderate Cross-References: * CVE-2024-47609 Affected Products: * openSUSE Tumbleweed An update that solves one vulnerability can now be installed. ## Description: These are all security issues fixed in the cargo-audit-advisory-db-20241030-1.1 package on the GA media of openSUSE Tumbleweed. ## Package List: * openSUSE Tumbleweed: * cargo-audit-advisory-db 20241030-1.1 ## References: * https://www.suse.com/security/cve/CVE-2024-47609.html

1 0

openSUSE-SU-2024:14437-1: moderate: python310-Werkzeug-3.0.6-1.1 on GA media
by meissner＠suse.com 31 Oct '24

31 Oct '24

# python310-Werkzeug-3.0.6-1.1 on GA media Announcement ID: openSUSE-SU-2024:14437-1 Rating: moderate Cross-References: * CVE-2024-49767 CVSS scores: * CVE-2024-49767 ( SUSE ): 5.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L * CVE-2024-49767 ( SUSE ): 6.9 CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X Affected Products: * openSUSE Tumbleweed An update that solves one vulnerability can now be installed. ## Description: These are all security issues fixed in the python310-Werkzeug-3.0.6-1.1 package on the GA media of openSUSE Tumbleweed. ## Package List: * openSUSE Tumbleweed: * python310-Werkzeug 3.0.6-1.1 * python311-Werkzeug 3.0.6-1.1 * python312-Werkzeug 3.0.6-1.1 ## References: * https://www.suse.com/security/cve/CVE-2024-49767.html

1 0

openSUSE-SU-2024:14438-1: moderate: MozillaThunderbird-128.4.0-1.1 on GA media
by meissner＠suse.com 31 Oct '24

31 Oct '24

# MozillaThunderbird-128.4.0-1.1 on GA media Announcement ID: openSUSE-SU-2024:14438-1 Rating: moderate Cross-References: * CVE-2024-10458 * CVE-2024-10459 * CVE-2024-10460 * CVE-2024-10461 * CVE-2024-10462 * CVE-2024-10463 * CVE-2024-10464 * CVE-2024-10465 * CVE-2024-10466 * CVE-2024-10467 CVSS scores: * CVE-2024-10458 ( SUSE ): 8.1 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:N * CVE-2024-10458 ( SUSE ): 8.6 CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N * CVE-2024-10459 ( SUSE ): 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H * CVE-2024-10459 ( SUSE ): 8.7 CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N * CVE-2024-10460 ( SUSE ): 5.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N * CVE-2024-10460 ( SUSE ): 6.9 CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N * CVE-2024-10461 ( SUSE ): 6.1 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N * CVE-2024-10461 ( SUSE ): 5.3 CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N * CVE-2024-10462 ( SUSE ): 5.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N * CVE-2024-10462 ( SUSE ): 6.9 CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N * CVE-2024-10463 ( SUSE ): 3.7 CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N * CVE-2024-10463 ( SUSE ): 6.3 CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N * CVE-2024-10464 ( SUSE ): 5.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L * CVE-2024-10464 ( SUSE ): 6.9 CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N * CVE-2024-10465 ( SUSE ): 4.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N * CVE-2024-10465 ( SUSE ): 5.1 CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N * CVE-2024-10466 ( SUSE ): 5.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L * CVE-2024-10466 ( SUSE ): 6.9 CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N * CVE-2024-10467 ( SUSE ): 9.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H * CVE-2024-10467 ( SUSE ): 9.3 CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N Affected Products: * openSUSE Tumbleweed An update that solves 10 vulnerabilities can now be installed. ## Description: These are all security issues fixed in the MozillaThunderbird-128.4.0-1.1 package on the GA media of openSUSE Tumbleweed. ## Package List: * openSUSE Tumbleweed: * MozillaThunderbird 128.4.0-1.1 * MozillaThunderbird-openpgp-librnp 128.4.0-1.1 * MozillaThunderbird-translations-common 128.4.0-1.1 * MozillaThunderbird-translations-other 128.4.0-1.1 ## References: * https://www.suse.com/security/cve/CVE-2024-10458.html * https://www.suse.com/security/cve/CVE-2024-10459.html * https://www.suse.com/security/cve/CVE-2024-10460.html * https://www.suse.com/security/cve/CVE-2024-10461.html * https://www.suse.com/security/cve/CVE-2024-10462.html * https://www.suse.com/security/cve/CVE-2024-10463.html * https://www.suse.com/security/cve/CVE-2024-10464.html * https://www.suse.com/security/cve/CVE-2024-10465.html * https://www.suse.com/security/cve/CVE-2024-10466.html * https://www.suse.com/security/cve/CVE-2024-10467.html

1 0

openSUSE-SU-2024:14436-1: moderate: openvpn-2.6.10-2.1 on GA media
by meissner＠suse.com 31 Oct '24

31 Oct '24

# openvpn-2.6.10-2.1 on GA media Announcement ID: openSUSE-SU-2024:14436-1 Rating: moderate Cross-References: * CVE-2024-28882 CVSS scores: * CVE-2024-28882 ( SUSE ): 4.3 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L Affected Products: * openSUSE Tumbleweed An update that solves one vulnerability can now be installed. ## Description: These are all security issues fixed in the openvpn-2.6.10-2.1 package on the GA media of openSUSE Tumbleweed. ## Package List: * openSUSE Tumbleweed: * openvpn 2.6.10-2.1 * openvpn-auth-pam-plugin 2.6.10-2.1 * openvpn-devel 2.6.10-2.1 * openvpn-down-root-plugin 2.6.10-2.1 ## References: * https://www.suse.com/security/cve/CVE-2024-28882.html

1 0

openSUSE-SU-2024:14441-1: moderate: chromedriver-130.0.6723.69-1.1 on GA media
by meissner＠suse.com 31 Oct '24

31 Oct '24

# chromedriver-130.0.6723.69-1.1 on GA media Announcement ID: openSUSE-SU-2024:14441-1 Rating: moderate Cross-References: * CVE-2024-10229 * CVE-2024-10230 * CVE-2024-10231 Affected Products: * openSUSE Tumbleweed An update that solves 3 vulnerabilities can now be installed. ## Description: These are all security issues fixed in the chromedriver-130.0.6723.69-1.1 package on the GA media of openSUSE Tumbleweed. ## Package List: * openSUSE Tumbleweed: * chromedriver 130.0.6723.69-1.1 * chromium 130.0.6723.69-1.1 ## References: * https://www.suse.com/security/cve/CVE-2024-10229.html * https://www.suse.com/security/cve/CVE-2024-10230.html * https://www.suse.com/security/cve/CVE-2024-10231.html

1 0

openSUSE-SU-2024:14435-1: moderate: corepack22-22.10.0-1.1 on GA media
by meissner＠suse.com 31 Oct '24

31 Oct '24

# corepack22-22.10.0-1.1 on GA media Announcement ID: openSUSE-SU-2024:14435-1 Rating: moderate Cross-References: * CVE-2024-22018 * CVE-2024-22020 * CVE-2024-36137 * CVE-2024-36138 * CVE-2024-37372 CVSS scores: * CVE-2024-22018 ( SUSE ): 2.8 CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:L/I:N/A:N * CVE-2024-22020 ( SUSE ): 6.5 CVSS:3.1/AV:L/AC:H/PR:N/UI:R/S:U/C:L/I:H/A:H * CVE-2024-36137 ( SUSE ): 3.9 CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:L/I:L/A:N Affected Products: * openSUSE Tumbleweed An update that solves 5 vulnerabilities can now be installed. ## Description: These are all security issues fixed in the corepack22-22.10.0-1.1 package on the GA media of openSUSE Tumbleweed. ## Package List: * openSUSE Tumbleweed: * corepack22 22.10.0-1.1 * nodejs22 22.10.0-1.1 * nodejs22-devel 22.10.0-1.1 * nodejs22-docs 22.10.0-1.1 * npm22 22.10.0-1.1 ## References: * https://www.suse.com/security/cve/CVE-2024-22018.html * https://www.suse.com/security/cve/CVE-2024-22020.html * https://www.suse.com/security/cve/CVE-2024-36137.html * https://www.suse.com/security/cve/CVE-2024-36138.html * https://www.suse.com/security/cve/CVE-2024-37372.html

1 0