October 2024 - openSUSE Security Announce

SUSE-SU-2024:3523-1: critical: Security update for cups-filters
by OPENSUSE-SECURITY-UPDATES 04 Oct '24

04 Oct '24

# Security update for cups-filters Announcement ID: SUSE-SU-2024:3523-1 Release Date: 2024-10-04T13:17:53Z Rating: critical References: * bsc#1230939 Cross-References: * CVE-2024-47176 CVSS scores: * CVE-2024-47176 ( SUSE ): 9.3 CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:H/SI:H/SA:H * CVE-2024-47176 ( SUSE ): 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N * CVE-2024-47176 ( NVD ): 5.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N Affected Products: * Basesystem Module 15-SP5 * Basesystem Module 15-SP6 * openSUSE Leap 15.5 * openSUSE Leap 15.6 * SUSE Enterprise Storage 7.1 * SUSE Linux Enterprise Desktop 15 SP4 LTSS 15-SP4 * SUSE Linux Enterprise Desktop 15 SP5 * SUSE Linux Enterprise Desktop 15 SP6 * SUSE Linux Enterprise High Performance Computing 15 SP2 * SUSE Linux Enterprise High Performance Computing 15 SP2 LTSS 15-SP2 * SUSE Linux Enterprise High Performance Computing 15 SP3 * SUSE Linux Enterprise High Performance Computing 15 SP4 * SUSE Linux Enterprise High Performance Computing 15 SP5 * SUSE Linux Enterprise High Performance Computing ESPOS 15 SP4 * SUSE Linux Enterprise High Performance Computing LTSS 15 SP3 * SUSE Linux Enterprise High Performance Computing LTSS 15 SP4 * SUSE Linux Enterprise Real Time 15 SP5 * SUSE Linux Enterprise Real Time 15 SP6 * SUSE Linux Enterprise Server 15 SP2 * SUSE Linux Enterprise Server 15 SP2 LTSS 15-SP2 * SUSE Linux Enterprise Server 15 SP3 * SUSE Linux Enterprise Server 15 SP3 LTSS 15-SP3 * SUSE Linux Enterprise Server 15 SP4 * SUSE Linux Enterprise Server 15 SP4 LTSS 15-SP4 * SUSE Linux Enterprise Server 15 SP5 * SUSE Linux Enterprise Server 15 SP6 * SUSE Linux Enterprise Server for SAP Applications 15 SP2 * SUSE Linux Enterprise Server for SAP Applications 15 SP3 * SUSE Linux Enterprise Server for SAP Applications 15 SP4 * SUSE Linux Enterprise Server for SAP Applications 15 SP5 * SUSE Linux Enterprise Server for SAP Applications 15 SP6 * SUSE Manager Proxy 4.3 * SUSE Manager Retail Branch Server 4.3 * SUSE Manager Server 4.3 An update that solves one vulnerability can now be installed. ## Description: This update for cups-filters fixes the following issues: * cups-browsed would bind on UDP INADDR_ANY:631 and trust any packet from any source to trigger a Get-Printer-Attributes IPP request to an attacker controlled URL. This patch removes support for the legacy CUPS and LDAP protocols(bsc#1230939, CVE-2024-47176) ## Patch Instructions: To install this SUSE update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: * SUSE Linux Enterprise Server 15 SP4 LTSS 15-SP4 zypper in -t patch SUSE-SLE-Product-SLES-15-SP4-LTSS-2024-3523=1 * SUSE Linux Enterprise Server for SAP Applications 15 SP2 zypper in -t patch SUSE-SLE-Product-SLES_SAP-15-SP2-2024-3523=1 * SUSE Linux Enterprise Server for SAP Applications 15 SP3 zypper in -t patch SUSE-SLE-Product-SLES_SAP-15-SP3-2024-3523=1 * SUSE Linux Enterprise Server for SAP Applications 15 SP4 zypper in -t patch SUSE-SLE-Product-SLES_SAP-15-SP4-2024-3523=1 * SUSE Manager Proxy 4.3 zypper in -t patch SUSE-SLE-Product-SUSE-Manager-Proxy-4.3-2024-3523=1 * SUSE Manager Retail Branch Server 4.3 zypper in -t patch SUSE-SLE-Product-SUSE-Manager-Retail-Branch- Server-4.3-2024-3523=1 * SUSE Manager Server 4.3 zypper in -t patch SUSE-SLE-Product-SUSE-Manager-Server-4.3-2024-3523=1 * SUSE Enterprise Storage 7.1 zypper in -t patch SUSE-Storage-7.1-2024-3523=1 * openSUSE Leap 15.5 zypper in -t patch openSUSE-SLE-15.5-2024-3523=1 * openSUSE Leap 15.6 zypper in -t patch openSUSE-SLE-15.6-2024-3523=1 * Basesystem Module 15-SP5 zypper in -t patch SUSE-SLE-Module-Basesystem-15-SP5-2024-3523=1 * Basesystem Module 15-SP6 zypper in -t patch SUSE-SLE-Module-Basesystem-15-SP6-2024-3523=1 * SUSE Linux Enterprise High Performance Computing 15 SP2 LTSS 15-SP2 zypper in -t patch SUSE-SLE-Product-HPC-15-SP2-LTSS-2024-3523=1 * SUSE Linux Enterprise High Performance Computing LTSS 15 SP3 zypper in -t patch SUSE-SLE-Product-HPC-15-SP3-LTSS-2024-3523=1 * SUSE Linux Enterprise High Performance Computing ESPOS 15 SP4 zypper in -t patch SUSE-SLE-Product-HPC-15-SP4-ESPOS-2024-3523=1 * SUSE Linux Enterprise High Performance Computing LTSS 15 SP4 zypper in -t patch SUSE-SLE-Product-HPC-15-SP4-LTSS-2024-3523=1 * SUSE Linux Enterprise Desktop 15 SP4 LTSS 15-SP4 zypper in -t patch SUSE-SLE-Product-SLED-15-SP4-LTSS-2024-3523=1 * SUSE Linux Enterprise Server 15 SP2 LTSS 15-SP2 zypper in -t patch SUSE-SLE-Product-SLES-15-SP2-LTSS-2024-3523=1 * SUSE Linux Enterprise Server 15 SP3 LTSS 15-SP3 zypper in -t patch SUSE-SLE-Product-SLES-15-SP3-LTSS-2024-3523=1 ## Package List: * SUSE Linux Enterprise Server 15 SP4 LTSS 15-SP4 (aarch64 ppc64le s390x x86_64) * cups-filters-1.25.0-150200.3.16.1 * cups-filters-debugsource-1.25.0-150200.3.16.1 * cups-filters-devel-1.25.0-150200.3.16.1 * cups-filters-debuginfo-1.25.0-150200.3.16.1 * SUSE Linux Enterprise Server for SAP Applications 15 SP2 (ppc64le x86_64) * cups-filters-1.25.0-150200.3.16.1 * cups-filters-debugsource-1.25.0-150200.3.16.1 * cups-filters-devel-1.25.0-150200.3.16.1 * cups-filters-debuginfo-1.25.0-150200.3.16.1 * SUSE Linux Enterprise Server for SAP Applications 15 SP3 (ppc64le x86_64) * cups-filters-1.25.0-150200.3.16.1 * cups-filters-debugsource-1.25.0-150200.3.16.1 * cups-filters-devel-1.25.0-150200.3.16.1 * cups-filters-debuginfo-1.25.0-150200.3.16.1 * SUSE Linux Enterprise Server for SAP Applications 15 SP4 (ppc64le x86_64) * cups-filters-1.25.0-150200.3.16.1 * cups-filters-debugsource-1.25.0-150200.3.16.1 * cups-filters-devel-1.25.0-150200.3.16.1 * cups-filters-debuginfo-1.25.0-150200.3.16.1 * SUSE Manager Proxy 4.3 (x86_64) * cups-filters-1.25.0-150200.3.16.1 * cups-filters-debugsource-1.25.0-150200.3.16.1 * cups-filters-devel-1.25.0-150200.3.16.1 * cups-filters-debuginfo-1.25.0-150200.3.16.1 * SUSE Manager Retail Branch Server 4.3 (x86_64) * cups-filters-1.25.0-150200.3.16.1 * cups-filters-debugsource-1.25.0-150200.3.16.1 * cups-filters-devel-1.25.0-150200.3.16.1 * cups-filters-debuginfo-1.25.0-150200.3.16.1 * SUSE Manager Server 4.3 (ppc64le s390x x86_64) * cups-filters-1.25.0-150200.3.16.1 * cups-filters-debugsource-1.25.0-150200.3.16.1 * cups-filters-devel-1.25.0-150200.3.16.1 * cups-filters-debuginfo-1.25.0-150200.3.16.1 * SUSE Enterprise Storage 7.1 (aarch64 x86_64) * cups-filters-1.25.0-150200.3.16.1 * cups-filters-debugsource-1.25.0-150200.3.16.1 * cups-filters-devel-1.25.0-150200.3.16.1 * cups-filters-debuginfo-1.25.0-150200.3.16.1 * openSUSE Leap 15.5 (aarch64 ppc64le s390x x86_64) * cups-filters-1.25.0-150200.3.16.1 * cups-filters-debugsource-1.25.0-150200.3.16.1 * cups-filters-devel-1.25.0-150200.3.16.1 * cups-filters-debuginfo-1.25.0-150200.3.16.1 * openSUSE Leap 15.6 (aarch64 ppc64le s390x x86_64) * cups-filters-1.25.0-150200.3.16.1 * cups-filters-debugsource-1.25.0-150200.3.16.1 * cups-filters-devel-1.25.0-150200.3.16.1 * cups-filters-debuginfo-1.25.0-150200.3.16.1 * Basesystem Module 15-SP5 (aarch64 ppc64le s390x x86_64) * cups-filters-1.25.0-150200.3.16.1 * cups-filters-debugsource-1.25.0-150200.3.16.1 * cups-filters-devel-1.25.0-150200.3.16.1 * cups-filters-debuginfo-1.25.0-150200.3.16.1 * Basesystem Module 15-SP6 (aarch64 ppc64le s390x x86_64) * cups-filters-1.25.0-150200.3.16.1 * cups-filters-debugsource-1.25.0-150200.3.16.1 * cups-filters-devel-1.25.0-150200.3.16.1 * cups-filters-debuginfo-1.25.0-150200.3.16.1 * SUSE Linux Enterprise High Performance Computing 15 SP2 LTSS 15-SP2 (aarch64 x86_64) * cups-filters-1.25.0-150200.3.16.1 * cups-filters-debugsource-1.25.0-150200.3.16.1 * cups-filters-devel-1.25.0-150200.3.16.1 * cups-filters-debuginfo-1.25.0-150200.3.16.1 * SUSE Linux Enterprise High Performance Computing LTSS 15 SP3 (aarch64 x86_64) * cups-filters-1.25.0-150200.3.16.1 * cups-filters-debugsource-1.25.0-150200.3.16.1 * cups-filters-devel-1.25.0-150200.3.16.1 * cups-filters-debuginfo-1.25.0-150200.3.16.1 * SUSE Linux Enterprise High Performance Computing ESPOS 15 SP4 (aarch64 x86_64) * cups-filters-1.25.0-150200.3.16.1 * cups-filters-debugsource-1.25.0-150200.3.16.1 * cups-filters-devel-1.25.0-150200.3.16.1 * cups-filters-debuginfo-1.25.0-150200.3.16.1 * SUSE Linux Enterprise High Performance Computing LTSS 15 SP4 (aarch64 x86_64) * cups-filters-1.25.0-150200.3.16.1 * cups-filters-debugsource-1.25.0-150200.3.16.1 * cups-filters-devel-1.25.0-150200.3.16.1 * cups-filters-debuginfo-1.25.0-150200.3.16.1 * SUSE Linux Enterprise Desktop 15 SP4 LTSS 15-SP4 (x86_64) * cups-filters-1.25.0-150200.3.16.1 * cups-filters-debugsource-1.25.0-150200.3.16.1 * cups-filters-devel-1.25.0-150200.3.16.1 * cups-filters-debuginfo-1.25.0-150200.3.16.1 * SUSE Linux Enterprise Server 15 SP2 LTSS 15-SP2 (aarch64 ppc64le s390x x86_64) * cups-filters-1.25.0-150200.3.16.1 * cups-filters-debugsource-1.25.0-150200.3.16.1 * cups-filters-devel-1.25.0-150200.3.16.1 * cups-filters-debuginfo-1.25.0-150200.3.16.1 * SUSE Linux Enterprise Server 15 SP3 LTSS 15-SP3 (aarch64 ppc64le s390x x86_64) * cups-filters-1.25.0-150200.3.16.1 * cups-filters-debugsource-1.25.0-150200.3.16.1 * cups-filters-devel-1.25.0-150200.3.16.1 * cups-filters-debuginfo-1.25.0-150200.3.16.1 ## References: * https://www.suse.com/security/cve/CVE-2024-47176.html * https://bugzilla.suse.com/show_bug.cgi?id=1230939

1 0

SUSE-SU-2024:3524-1: important: Security update for frr
by OPENSUSE-SECURITY-UPDATES 04 Oct '24

04 Oct '24

# Security update for frr Announcement ID: SUSE-SU-2024:3524-1 Release Date: 2024-10-04T13:18:52Z Rating: important References: * bsc#1230866 Cross-References: * CVE-2017-15865 CVSS scores: * CVE-2017-15865 ( SUSE ): 8.7 CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N * CVE-2017-15865 ( SUSE ): 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N * CVE-2017-15865 ( NVD ): 7.5 CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N Affected Products: * openSUSE Leap 15.3 * SUSE Enterprise Storage 7.1 * SUSE Linux Enterprise High Performance Computing 15 SP3 * SUSE Linux Enterprise High Performance Computing 15 SP4 * SUSE Linux Enterprise High Performance Computing ESPOS 15 SP4 * SUSE Linux Enterprise High Performance Computing LTSS 15 SP3 * SUSE Linux Enterprise High Performance Computing LTSS 15 SP4 * SUSE Linux Enterprise Server 15 SP3 * SUSE Linux Enterprise Server 15 SP3 LTSS 15-SP3 * SUSE Linux Enterprise Server 15 SP4 * SUSE Linux Enterprise Server 15 SP4 LTSS 15-SP4 * SUSE Linux Enterprise Server for SAP Applications 15 SP3 * SUSE Linux Enterprise Server for SAP Applications 15 SP4 * SUSE Manager Proxy 4.3 * SUSE Manager Retail Branch Server 4.3 * SUSE Manager Server 4.3 An update that solves one vulnerability can now be installed. ## Description: This update for frr fixes the following issue: * Arithmetic overflow when parsing attribute of update packet due to regression introduced by the fix for CVE-2017-15865. (bsc#1230866) ## Patch Instructions: To install this SUSE update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: * openSUSE Leap 15.3 zypper in -t patch SUSE-2024-3524=1 * SUSE Linux Enterprise High Performance Computing LTSS 15 SP3 zypper in -t patch SUSE-SLE-Product-HPC-15-SP3-LTSS-2024-3524=1 * SUSE Linux Enterprise High Performance Computing ESPOS 15 SP4 zypper in -t patch SUSE-SLE-Product-HPC-15-SP4-ESPOS-2024-3524=1 * SUSE Linux Enterprise High Performance Computing LTSS 15 SP4 zypper in -t patch SUSE-SLE-Product-HPC-15-SP4-LTSS-2024-3524=1 * SUSE Linux Enterprise Server 15 SP3 LTSS 15-SP3 zypper in -t patch SUSE-SLE-Product-SLES-15-SP3-LTSS-2024-3524=1 * SUSE Linux Enterprise Server 15 SP4 LTSS 15-SP4 zypper in -t patch SUSE-SLE-Product-SLES-15-SP4-LTSS-2024-3524=1 * SUSE Linux Enterprise Server for SAP Applications 15 SP3 zypper in -t patch SUSE-SLE-Product-SLES_SAP-15-SP3-2024-3524=1 * SUSE Linux Enterprise Server for SAP Applications 15 SP4 zypper in -t patch SUSE-SLE-Product-SLES_SAP-15-SP4-2024-3524=1 * SUSE Manager Proxy 4.3 zypper in -t patch SUSE-SLE-Product-SUSE-Manager-Proxy-4.3-2024-3524=1 * SUSE Manager Retail Branch Server 4.3 zypper in -t patch SUSE-SLE-Product-SUSE-Manager-Retail-Branch- Server-4.3-2024-3524=1 * SUSE Manager Server 4.3 zypper in -t patch SUSE-SLE-Product-SUSE-Manager-Server-4.3-2024-3524=1 * SUSE Enterprise Storage 7.1 zypper in -t patch SUSE-Storage-7.1-2024-3524=1 ## Package List: * openSUSE Leap 15.3 (aarch64 ppc64le s390x x86_64 i586) * libfrrospfapiclient0-7.4-150300.4.32.1 * libfrrgrpc_pb0-7.4-150300.4.32.1 * libfrrospfapiclient0-debuginfo-7.4-150300.4.32.1 * libfrrzmq0-7.4-150300.4.32.1 * libfrr_pb0-7.4-150300.4.32.1 * libmlag_pb0-debuginfo-7.4-150300.4.32.1 * libfrr_pb0-debuginfo-7.4-150300.4.32.1 * libfrrcares0-debuginfo-7.4-150300.4.32.1 * libfrrfpm_pb0-7.4-150300.4.32.1 * libfrrsnmp0-debuginfo-7.4-150300.4.32.1 * libfrrgrpc_pb0-debuginfo-7.4-150300.4.32.1 * frr-debugsource-7.4-150300.4.32.1 * libfrrzmq0-debuginfo-7.4-150300.4.32.1 * libfrr0-7.4-150300.4.32.1 * libfrrfpm_pb0-debuginfo-7.4-150300.4.32.1 * libfrrcares0-7.4-150300.4.32.1 * libfrr0-debuginfo-7.4-150300.4.32.1 * libmlag_pb0-7.4-150300.4.32.1 * frr-devel-7.4-150300.4.32.1 * frr-debuginfo-7.4-150300.4.32.1 * libfrrsnmp0-7.4-150300.4.32.1 * frr-7.4-150300.4.32.1 * SUSE Linux Enterprise High Performance Computing LTSS 15 SP3 (aarch64 x86_64) * libfrrospfapiclient0-7.4-150300.4.32.1 * libfrrgrpc_pb0-7.4-150300.4.32.1 * libfrrospfapiclient0-debuginfo-7.4-150300.4.32.1 * libfrrzmq0-7.4-150300.4.32.1 * libfrr_pb0-7.4-150300.4.32.1 * libmlag_pb0-debuginfo-7.4-150300.4.32.1 * libfrr_pb0-debuginfo-7.4-150300.4.32.1 * libfrrcares0-debuginfo-7.4-150300.4.32.1 * libfrrfpm_pb0-7.4-150300.4.32.1 * libfrrsnmp0-debuginfo-7.4-150300.4.32.1 * frr-7.4-150300.4.32.1 * libfrrgrpc_pb0-debuginfo-7.4-150300.4.32.1 * frr-debugsource-7.4-150300.4.32.1 * libfrrzmq0-debuginfo-7.4-150300.4.32.1 * libfrr0-7.4-150300.4.32.1 * libfrrcares0-7.4-150300.4.32.1 * libfrr0-debuginfo-7.4-150300.4.32.1 * libmlag_pb0-7.4-150300.4.32.1 * frr-devel-7.4-150300.4.32.1 * frr-debuginfo-7.4-150300.4.32.1 * libfrrsnmp0-7.4-150300.4.32.1 * libfrrfpm_pb0-debuginfo-7.4-150300.4.32.1 * SUSE Linux Enterprise High Performance Computing ESPOS 15 SP4 (aarch64 x86_64) * libfrrospfapiclient0-7.4-150300.4.32.1 * libfrrgrpc_pb0-7.4-150300.4.32.1 * libfrrospfapiclient0-debuginfo-7.4-150300.4.32.1 * libfrrzmq0-7.4-150300.4.32.1 * libfrr_pb0-7.4-150300.4.32.1 * libmlag_pb0-debuginfo-7.4-150300.4.32.1 * libfrr_pb0-debuginfo-7.4-150300.4.32.1 * libfrrcares0-debuginfo-7.4-150300.4.32.1 * libfrrfpm_pb0-7.4-150300.4.32.1 * libfrrsnmp0-debuginfo-7.4-150300.4.32.1 * frr-7.4-150300.4.32.1 * libfrrgrpc_pb0-debuginfo-7.4-150300.4.32.1 * frr-debugsource-7.4-150300.4.32.1 * libfrrzmq0-debuginfo-7.4-150300.4.32.1 * libfrr0-7.4-150300.4.32.1 * libfrrcares0-7.4-150300.4.32.1 * libfrr0-debuginfo-7.4-150300.4.32.1 * libmlag_pb0-7.4-150300.4.32.1 * frr-devel-7.4-150300.4.32.1 * frr-debuginfo-7.4-150300.4.32.1 * libfrrsnmp0-7.4-150300.4.32.1 * libfrrfpm_pb0-debuginfo-7.4-150300.4.32.1 * SUSE Linux Enterprise High Performance Computing LTSS 15 SP4 (aarch64 x86_64) * libfrrospfapiclient0-7.4-150300.4.32.1 * libfrrgrpc_pb0-7.4-150300.4.32.1 * libfrrospfapiclient0-debuginfo-7.4-150300.4.32.1 * libfrrzmq0-7.4-150300.4.32.1 * libfrr_pb0-7.4-150300.4.32.1 * libmlag_pb0-debuginfo-7.4-150300.4.32.1 * libfrr_pb0-debuginfo-7.4-150300.4.32.1 * libfrrcares0-debuginfo-7.4-150300.4.32.1 * libfrrfpm_pb0-7.4-150300.4.32.1 * libfrrsnmp0-debuginfo-7.4-150300.4.32.1 * frr-7.4-150300.4.32.1 * libfrrgrpc_pb0-debuginfo-7.4-150300.4.32.1 * frr-debugsource-7.4-150300.4.32.1 * libfrrzmq0-debuginfo-7.4-150300.4.32.1 * libfrr0-7.4-150300.4.32.1 * libfrrcares0-7.4-150300.4.32.1 * libfrr0-debuginfo-7.4-150300.4.32.1 * libmlag_pb0-7.4-150300.4.32.1 * frr-devel-7.4-150300.4.32.1 * frr-debuginfo-7.4-150300.4.32.1 * libfrrsnmp0-7.4-150300.4.32.1 * libfrrfpm_pb0-debuginfo-7.4-150300.4.32.1 * SUSE Linux Enterprise Server 15 SP3 LTSS 15-SP3 (aarch64 ppc64le s390x x86_64) * libfrrospfapiclient0-7.4-150300.4.32.1 * libfrrgrpc_pb0-7.4-150300.4.32.1 * libfrrospfapiclient0-debuginfo-7.4-150300.4.32.1 * libfrrzmq0-7.4-150300.4.32.1 * libfrr_pb0-7.4-150300.4.32.1 * libmlag_pb0-debuginfo-7.4-150300.4.32.1 * libfrr_pb0-debuginfo-7.4-150300.4.32.1 * libfrrcares0-debuginfo-7.4-150300.4.32.1 * libfrrfpm_pb0-7.4-150300.4.32.1 * libfrrsnmp0-debuginfo-7.4-150300.4.32.1 * frr-7.4-150300.4.32.1 * libfrrgrpc_pb0-debuginfo-7.4-150300.4.32.1 * frr-debugsource-7.4-150300.4.32.1 * libfrrzmq0-debuginfo-7.4-150300.4.32.1 * libfrr0-7.4-150300.4.32.1 * libfrrcares0-7.4-150300.4.32.1 * libfrr0-debuginfo-7.4-150300.4.32.1 * libmlag_pb0-7.4-150300.4.32.1 * frr-devel-7.4-150300.4.32.1 * frr-debuginfo-7.4-150300.4.32.1 * libfrrsnmp0-7.4-150300.4.32.1 * libfrrfpm_pb0-debuginfo-7.4-150300.4.32.1 * SUSE Linux Enterprise Server 15 SP4 LTSS 15-SP4 (aarch64 ppc64le s390x x86_64) * libfrrospfapiclient0-7.4-150300.4.32.1 * libfrrgrpc_pb0-7.4-150300.4.32.1 * libfrrospfapiclient0-debuginfo-7.4-150300.4.32.1 * libfrrzmq0-7.4-150300.4.32.1 * libfrr_pb0-7.4-150300.4.32.1 * libmlag_pb0-debuginfo-7.4-150300.4.32.1 * libfrr_pb0-debuginfo-7.4-150300.4.32.1 * libfrrcares0-debuginfo-7.4-150300.4.32.1 * libfrrfpm_pb0-7.4-150300.4.32.1 * libfrrsnmp0-debuginfo-7.4-150300.4.32.1 * frr-7.4-150300.4.32.1 * libfrrgrpc_pb0-debuginfo-7.4-150300.4.32.1 * frr-debugsource-7.4-150300.4.32.1 * libfrrzmq0-debuginfo-7.4-150300.4.32.1 * libfrr0-7.4-150300.4.32.1 * libfrrcares0-7.4-150300.4.32.1 * libfrr0-debuginfo-7.4-150300.4.32.1 * libmlag_pb0-7.4-150300.4.32.1 * frr-devel-7.4-150300.4.32.1 * frr-debuginfo-7.4-150300.4.32.1 * libfrrsnmp0-7.4-150300.4.32.1 * libfrrfpm_pb0-debuginfo-7.4-150300.4.32.1 * SUSE Linux Enterprise Server for SAP Applications 15 SP3 (ppc64le x86_64) * libfrrospfapiclient0-7.4-150300.4.32.1 * libfrrgrpc_pb0-7.4-150300.4.32.1 * libfrrospfapiclient0-debuginfo-7.4-150300.4.32.1 * libfrrzmq0-7.4-150300.4.32.1 * libfrr_pb0-7.4-150300.4.32.1 * libmlag_pb0-debuginfo-7.4-150300.4.32.1 * libfrr_pb0-debuginfo-7.4-150300.4.32.1 * libfrrcares0-debuginfo-7.4-150300.4.32.1 * libfrrfpm_pb0-7.4-150300.4.32.1 * libfrrsnmp0-debuginfo-7.4-150300.4.32.1 * frr-7.4-150300.4.32.1 * libfrrgrpc_pb0-debuginfo-7.4-150300.4.32.1 * frr-debugsource-7.4-150300.4.32.1 * libfrrzmq0-debuginfo-7.4-150300.4.32.1 * libfrr0-7.4-150300.4.32.1 * libfrrcares0-7.4-150300.4.32.1 * libfrr0-debuginfo-7.4-150300.4.32.1 * libmlag_pb0-7.4-150300.4.32.1 * frr-devel-7.4-150300.4.32.1 * frr-debuginfo-7.4-150300.4.32.1 * libfrrsnmp0-7.4-150300.4.32.1 * libfrrfpm_pb0-debuginfo-7.4-150300.4.32.1 * SUSE Linux Enterprise Server for SAP Applications 15 SP4 (ppc64le x86_64) * libfrrospfapiclient0-7.4-150300.4.32.1 * libfrrgrpc_pb0-7.4-150300.4.32.1 * libfrrospfapiclient0-debuginfo-7.4-150300.4.32.1 * libfrrzmq0-7.4-150300.4.32.1 * libfrr_pb0-7.4-150300.4.32.1 * libmlag_pb0-debuginfo-7.4-150300.4.32.1 * libfrr_pb0-debuginfo-7.4-150300.4.32.1 * libfrrcares0-debuginfo-7.4-150300.4.32.1 * libfrrfpm_pb0-7.4-150300.4.32.1 * libfrrsnmp0-debuginfo-7.4-150300.4.32.1 * frr-7.4-150300.4.32.1 * libfrrgrpc_pb0-debuginfo-7.4-150300.4.32.1 * frr-debugsource-7.4-150300.4.32.1 * libfrrzmq0-debuginfo-7.4-150300.4.32.1 * libfrr0-7.4-150300.4.32.1 * libfrrcares0-7.4-150300.4.32.1 * libfrr0-debuginfo-7.4-150300.4.32.1 * libmlag_pb0-7.4-150300.4.32.1 * frr-devel-7.4-150300.4.32.1 * frr-debuginfo-7.4-150300.4.32.1 * libfrrsnmp0-7.4-150300.4.32.1 * libfrrfpm_pb0-debuginfo-7.4-150300.4.32.1 * SUSE Manager Proxy 4.3 (x86_64) * libfrrospfapiclient0-7.4-150300.4.32.1 * libfrrgrpc_pb0-7.4-150300.4.32.1 * libfrrospfapiclient0-debuginfo-7.4-150300.4.32.1 * libfrrzmq0-7.4-150300.4.32.1 * libfrr_pb0-7.4-150300.4.32.1 * libmlag_pb0-debuginfo-7.4-150300.4.32.1 * libfrr_pb0-debuginfo-7.4-150300.4.32.1 * libfrrcares0-debuginfo-7.4-150300.4.32.1 * libfrrfpm_pb0-7.4-150300.4.32.1 * libfrrsnmp0-debuginfo-7.4-150300.4.32.1 * frr-7.4-150300.4.32.1 * libfrrgrpc_pb0-debuginfo-7.4-150300.4.32.1 * frr-debugsource-7.4-150300.4.32.1 * libfrrzmq0-debuginfo-7.4-150300.4.32.1 * libfrr0-7.4-150300.4.32.1 * libfrrcares0-7.4-150300.4.32.1 * libfrr0-debuginfo-7.4-150300.4.32.1 * libmlag_pb0-7.4-150300.4.32.1 * frr-devel-7.4-150300.4.32.1 * frr-debuginfo-7.4-150300.4.32.1 * libfrrsnmp0-7.4-150300.4.32.1 * libfrrfpm_pb0-debuginfo-7.4-150300.4.32.1 * SUSE Manager Retail Branch Server 4.3 (x86_64) * libfrrospfapiclient0-7.4-150300.4.32.1 * libfrrgrpc_pb0-7.4-150300.4.32.1 * libfrrospfapiclient0-debuginfo-7.4-150300.4.32.1 * libfrrzmq0-7.4-150300.4.32.1 * libfrr_pb0-7.4-150300.4.32.1 * libmlag_pb0-debuginfo-7.4-150300.4.32.1 * libfrr_pb0-debuginfo-7.4-150300.4.32.1 * libfrrcares0-debuginfo-7.4-150300.4.32.1 * libfrrfpm_pb0-7.4-150300.4.32.1 * libfrrsnmp0-debuginfo-7.4-150300.4.32.1 * frr-7.4-150300.4.32.1 * libfrrgrpc_pb0-debuginfo-7.4-150300.4.32.1 * frr-debugsource-7.4-150300.4.32.1 * libfrrzmq0-debuginfo-7.4-150300.4.32.1 * libfrr0-7.4-150300.4.32.1 * libfrrcares0-7.4-150300.4.32.1 * libfrr0-debuginfo-7.4-150300.4.32.1 * libmlag_pb0-7.4-150300.4.32.1 * frr-devel-7.4-150300.4.32.1 * frr-debuginfo-7.4-150300.4.32.1 * libfrrsnmp0-7.4-150300.4.32.1 * libfrrfpm_pb0-debuginfo-7.4-150300.4.32.1 * SUSE Manager Server 4.3 (ppc64le s390x x86_64) * libfrrospfapiclient0-7.4-150300.4.32.1 * libfrrgrpc_pb0-7.4-150300.4.32.1 * libfrrospfapiclient0-debuginfo-7.4-150300.4.32.1 * libfrrzmq0-7.4-150300.4.32.1 * libfrr_pb0-7.4-150300.4.32.1 * libmlag_pb0-debuginfo-7.4-150300.4.32.1 * libfrr_pb0-debuginfo-7.4-150300.4.32.1 * libfrrcares0-debuginfo-7.4-150300.4.32.1 * libfrrfpm_pb0-7.4-150300.4.32.1 * libfrrsnmp0-debuginfo-7.4-150300.4.32.1 * frr-7.4-150300.4.32.1 * libfrrgrpc_pb0-debuginfo-7.4-150300.4.32.1 * frr-debugsource-7.4-150300.4.32.1 * libfrrzmq0-debuginfo-7.4-150300.4.32.1 * libfrr0-7.4-150300.4.32.1 * libfrrcares0-7.4-150300.4.32.1 * libfrr0-debuginfo-7.4-150300.4.32.1 * libmlag_pb0-7.4-150300.4.32.1 * frr-devel-7.4-150300.4.32.1 * frr-debuginfo-7.4-150300.4.32.1 * libfrrsnmp0-7.4-150300.4.32.1 * libfrrfpm_pb0-debuginfo-7.4-150300.4.32.1 * SUSE Enterprise Storage 7.1 (aarch64 x86_64) * libfrrospfapiclient0-7.4-150300.4.32.1 * libfrrgrpc_pb0-7.4-150300.4.32.1 * libfrrospfapiclient0-debuginfo-7.4-150300.4.32.1 * libfrrzmq0-7.4-150300.4.32.1 * libfrr_pb0-7.4-150300.4.32.1 * libmlag_pb0-debuginfo-7.4-150300.4.32.1 * libfrr_pb0-debuginfo-7.4-150300.4.32.1 * libfrrcares0-debuginfo-7.4-150300.4.32.1 * libfrrfpm_pb0-7.4-150300.4.32.1 * libfrrsnmp0-debuginfo-7.4-150300.4.32.1 * frr-7.4-150300.4.32.1 * libfrrgrpc_pb0-debuginfo-7.4-150300.4.32.1 * frr-debugsource-7.4-150300.4.32.1 * libfrrzmq0-debuginfo-7.4-150300.4.32.1 * libfrr0-7.4-150300.4.32.1 * libfrrcares0-7.4-150300.4.32.1 * libfrr0-debuginfo-7.4-150300.4.32.1 * libmlag_pb0-7.4-150300.4.32.1 * frr-devel-7.4-150300.4.32.1 * frr-debuginfo-7.4-150300.4.32.1 * libfrrsnmp0-7.4-150300.4.32.1 * libfrrfpm_pb0-debuginfo-7.4-150300.4.32.1 ## References: * https://www.suse.com/security/cve/CVE-2017-15865.html * https://bugzilla.suse.com/show_bug.cgi?id=1230866

1 0

SUSE-SU-2024:3525-1: important: Security update for openssl-3
by OPENSUSE-SECURITY-UPDATES 04 Oct '24

04 Oct '24

# Security update for openssl-3 Announcement ID: SUSE-SU-2024:3525-1 Release Date: 2024-10-04T13:21:09Z Rating: important References: * bsc#1230698 Cross-References: * CVE-2024-41996 CVSS scores: * CVE-2024-41996 ( SUSE ): 8.2 CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N * CVE-2024-41996 ( SUSE ): 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H Affected Products: * openSUSE Leap 15.4 * SUSE Linux Enterprise Desktop 15 SP4 LTSS 15-SP4 * SUSE Linux Enterprise High Performance Computing 15 SP4 * SUSE Linux Enterprise High Performance Computing ESPOS 15 SP4 * SUSE Linux Enterprise High Performance Computing LTSS 15 SP4 * SUSE Linux Enterprise Micro 5.3 * SUSE Linux Enterprise Micro 5.4 * SUSE Linux Enterprise Micro for Rancher 5.3 * SUSE Linux Enterprise Micro for Rancher 5.4 * SUSE Linux Enterprise Server 15 SP4 * SUSE Linux Enterprise Server 15 SP4 LTSS 15-SP4 * SUSE Linux Enterprise Server for SAP Applications 15 SP4 * SUSE Manager Proxy 4.3 * SUSE Manager Retail Branch Server 4.3 * SUSE Manager Server 4.3 An update that solves one vulnerability can now be installed. ## Description: This update for openssl-3 fixes the following issues: * CVE-2024-41996: Validating the order of the public keys in the Diffie- Hellman Key Agreement Protocol, when an approved safe prime is used, allows remote attackers to trigger expensive server-side DHE (bsc#1230698) ## Patch Instructions: To install this SUSE update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: * openSUSE Leap 15.4 zypper in -t patch SUSE-2024-3525=1 * SUSE Linux Enterprise Micro for Rancher 5.3 zypper in -t patch SUSE-SLE-Micro-5.3-2024-3525=1 * SUSE Linux Enterprise Micro 5.3 zypper in -t patch SUSE-SLE-Micro-5.3-2024-3525=1 * SUSE Linux Enterprise Micro for Rancher 5.4 zypper in -t patch SUSE-SLE-Micro-5.4-2024-3525=1 * SUSE Linux Enterprise Micro 5.4 zypper in -t patch SUSE-SLE-Micro-5.4-2024-3525=1 * SUSE Linux Enterprise High Performance Computing ESPOS 15 SP4 zypper in -t patch SUSE-SLE-Product-HPC-15-SP4-ESPOS-2024-3525=1 * SUSE Linux Enterprise High Performance Computing LTSS 15 SP4 zypper in -t patch SUSE-SLE-Product-HPC-15-SP4-LTSS-2024-3525=1 * SUSE Linux Enterprise Desktop 15 SP4 LTSS 15-SP4 zypper in -t patch SUSE-SLE-Product-SLED-15-SP4-LTSS-2024-3525=1 * SUSE Linux Enterprise Server 15 SP4 LTSS 15-SP4 zypper in -t patch SUSE-SLE-Product-SLES-15-SP4-LTSS-2024-3525=1 * SUSE Linux Enterprise Server for SAP Applications 15 SP4 zypper in -t patch SUSE-SLE-Product-SLES_SAP-15-SP4-2024-3525=1 * SUSE Manager Proxy 4.3 zypper in -t patch SUSE-SLE-Product-SUSE-Manager-Proxy-4.3-2024-3525=1 * SUSE Manager Retail Branch Server 4.3 zypper in -t patch SUSE-SLE-Product-SUSE-Manager-Retail-Branch- Server-4.3-2024-3525=1 * SUSE Manager Server 4.3 zypper in -t patch SUSE-SLE-Product-SUSE-Manager-Server-4.3-2024-3525=1 ## Package List: * openSUSE Leap 15.4 (aarch64 ppc64le s390x x86_64 i586) * openssl-3-3.0.8-150400.4.66.1 * openssl-3-debugsource-3.0.8-150400.4.66.1 * libopenssl-3-devel-3.0.8-150400.4.66.1 * openssl-3-debuginfo-3.0.8-150400.4.66.1 * libopenssl3-3.0.8-150400.4.66.1 * libopenssl3-debuginfo-3.0.8-150400.4.66.1 * openSUSE Leap 15.4 (x86_64) * libopenssl3-32bit-3.0.8-150400.4.66.1 * libopenssl-3-devel-32bit-3.0.8-150400.4.66.1 * libopenssl3-32bit-debuginfo-3.0.8-150400.4.66.1 * openSUSE Leap 15.4 (noarch) * openssl-3-doc-3.0.8-150400.4.66.1 * openSUSE Leap 15.4 (aarch64_ilp32) * libopenssl3-64bit-3.0.8-150400.4.66.1 * libopenssl-3-devel-64bit-3.0.8-150400.4.66.1 * libopenssl3-64bit-debuginfo-3.0.8-150400.4.66.1 * SUSE Linux Enterprise Micro for Rancher 5.3 (aarch64 s390x x86_64) * openssl-3-debugsource-3.0.8-150400.4.66.1 * libopenssl3-3.0.8-150400.4.66.1 * libopenssl3-debuginfo-3.0.8-150400.4.66.1 * SUSE Linux Enterprise Micro 5.3 (aarch64 s390x x86_64) * openssl-3-debugsource-3.0.8-150400.4.66.1 * libopenssl3-3.0.8-150400.4.66.1 * libopenssl3-debuginfo-3.0.8-150400.4.66.1 * SUSE Linux Enterprise Micro for Rancher 5.4 (aarch64 s390x x86_64) * openssl-3-debugsource-3.0.8-150400.4.66.1 * libopenssl3-3.0.8-150400.4.66.1 * libopenssl3-debuginfo-3.0.8-150400.4.66.1 * SUSE Linux Enterprise Micro 5.4 (aarch64 s390x x86_64) * openssl-3-debugsource-3.0.8-150400.4.66.1 * libopenssl3-3.0.8-150400.4.66.1 * libopenssl3-debuginfo-3.0.8-150400.4.66.1 * SUSE Linux Enterprise High Performance Computing ESPOS 15 SP4 (aarch64 x86_64) * openssl-3-3.0.8-150400.4.66.1 * openssl-3-debugsource-3.0.8-150400.4.66.1 * libopenssl-3-devel-3.0.8-150400.4.66.1 * openssl-3-debuginfo-3.0.8-150400.4.66.1 * libopenssl3-3.0.8-150400.4.66.1 * libopenssl3-debuginfo-3.0.8-150400.4.66.1 * SUSE Linux Enterprise High Performance Computing LTSS 15 SP4 (aarch64 x86_64) * openssl-3-3.0.8-150400.4.66.1 * openssl-3-debugsource-3.0.8-150400.4.66.1 * libopenssl-3-devel-3.0.8-150400.4.66.1 * openssl-3-debuginfo-3.0.8-150400.4.66.1 * libopenssl3-3.0.8-150400.4.66.1 * libopenssl3-debuginfo-3.0.8-150400.4.66.1 * SUSE Linux Enterprise Desktop 15 SP4 LTSS 15-SP4 (x86_64) * openssl-3-3.0.8-150400.4.66.1 * openssl-3-debugsource-3.0.8-150400.4.66.1 * libopenssl-3-devel-3.0.8-150400.4.66.1 * openssl-3-debuginfo-3.0.8-150400.4.66.1 * libopenssl3-3.0.8-150400.4.66.1 * libopenssl3-debuginfo-3.0.8-150400.4.66.1 * SUSE Linux Enterprise Server 15 SP4 LTSS 15-SP4 (aarch64 ppc64le s390x x86_64) * openssl-3-3.0.8-150400.4.66.1 * openssl-3-debugsource-3.0.8-150400.4.66.1 * libopenssl-3-devel-3.0.8-150400.4.66.1 * openssl-3-debuginfo-3.0.8-150400.4.66.1 * libopenssl3-3.0.8-150400.4.66.1 * libopenssl3-debuginfo-3.0.8-150400.4.66.1 * SUSE Linux Enterprise Server for SAP Applications 15 SP4 (ppc64le x86_64) * openssl-3-3.0.8-150400.4.66.1 * openssl-3-debugsource-3.0.8-150400.4.66.1 * libopenssl-3-devel-3.0.8-150400.4.66.1 * openssl-3-debuginfo-3.0.8-150400.4.66.1 * libopenssl3-3.0.8-150400.4.66.1 * libopenssl3-debuginfo-3.0.8-150400.4.66.1 * SUSE Manager Proxy 4.3 (x86_64) * openssl-3-3.0.8-150400.4.66.1 * openssl-3-debugsource-3.0.8-150400.4.66.1 * libopenssl-3-devel-3.0.8-150400.4.66.1 * openssl-3-debuginfo-3.0.8-150400.4.66.1 * libopenssl3-3.0.8-150400.4.66.1 * libopenssl3-debuginfo-3.0.8-150400.4.66.1 * SUSE Manager Retail Branch Server 4.3 (x86_64) * openssl-3-3.0.8-150400.4.66.1 * openssl-3-debugsource-3.0.8-150400.4.66.1 * libopenssl-3-devel-3.0.8-150400.4.66.1 * openssl-3-debuginfo-3.0.8-150400.4.66.1 * libopenssl3-3.0.8-150400.4.66.1 * libopenssl3-debuginfo-3.0.8-150400.4.66.1 * SUSE Manager Server 4.3 (ppc64le s390x x86_64) * openssl-3-3.0.8-150400.4.66.1 * openssl-3-debugsource-3.0.8-150400.4.66.1 * libopenssl-3-devel-3.0.8-150400.4.66.1 * openssl-3-debuginfo-3.0.8-150400.4.66.1 * libopenssl3-3.0.8-150400.4.66.1 * libopenssl3-debuginfo-3.0.8-150400.4.66.1 ## References: * https://www.suse.com/security/cve/CVE-2024-41996.html * https://bugzilla.suse.com/show_bug.cgi?id=1230698

1 0

SUSE-SU-2024:3533-1: important: Security update for pcp
by OPENSUSE-SECURITY-UPDATES 04 Oct '24

04 Oct '24

# Security update for pcp Announcement ID: SUSE-SU-2024:3533-1 Release Date: 2024-10-04T14:40:38Z Rating: important References: * bsc#1217826 * bsc#1222121 * bsc#1222815 * bsc#1230551 * bsc#1230552 * jsc#PED-8192 * jsc#PED-8389 Cross-References: * CVE-2023-6917 * CVE-2024-3019 * CVE-2024-45769 * CVE-2024-45770 CVSS scores: * CVE-2023-6917 ( SUSE ): 6.7 CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H * CVE-2024-3019 ( SUSE ): 8.8 CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H * CVE-2024-45769 ( NVD ): 5.5 CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H * CVE-2024-45770 ( SUSE ): 4.6 CVSS:4.0/AV:L/AC:L/AT:N/PR:H/UI:N/VC:L/VI:L/VA:N/SC:L/SI:L/SA:N * CVE-2024-45770 ( SUSE ): 6.0 CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:N * CVE-2024-45770 ( NVD ): 4.4 CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N Affected Products: * Development Tools Module 15-SP6 * openSUSE Leap 15.6 * SUSE Linux Enterprise Desktop 15 SP6 * SUSE Linux Enterprise Real Time 15 SP6 * SUSE Linux Enterprise Server 15 SP6 * SUSE Linux Enterprise Server for SAP Applications 15 SP6 An update that solves four vulnerabilities, contains two features and has one security fix can now be installed. ## Description: This update for pcp fixes the following issues: pcp was updated from version 5.3.7 to version 6.2.0 (jsc#PED-8192, jsc#PED-8389): * Security issues fixed: * CVE-2024-45770: Fixed a symlink attack that allows escalating from the pcp to the root user (bsc#1230552) * CVE-2024-45769: Fixed a heap corruption through metric pmstore operations (bsc#1230551) * CVE-2023-6917: Fixed local privilege escalation from pcp user to root in /usr/libexec/pcp/lib/pmproxy (bsc#1217826) * CVE-2024-3019: Disabled redis proxy by default (bsc#1222121) * Major changes: * Add version 3 PCP archive support: instance domain change-deltas, Y2038-safe timestamps, nanosecond-precision timestamps, arbitrary timezones support, 64-bit file offsets used throughout for larger (beyond 2GB) individual volumes. * Opt-in using the /etc/pcp.conf PCP_ARCHIVE_VERSION setting * Version 2 archives remain the default (for next few years). * Switch to using OpenSSL only throughout PCP (dropped NSS/NSPR); this impacts on libpcp, PMAPI clients and PMCD use of encryption; these are now configured and used consistently with pmproxy HTTPS support and redis- server, which were both already using OpenSSL. * New nanosecond precision timestamp PMAPI calls for PCP library interfaces that make use of timestamps. These are all optional, and full backward compatibility is preserved for existing tools. * For the full list of changes please consult the packaged CHANGELOG file * Other packaging changes: * Moved pmlogger_daily into main package (bsc#1222815) * Change dependency from openssl-devel >= 1.1.1 to openssl-devel >= 1.0.2p. Required for SLE-12. * Introduce 'pmda-resctrl' package, disabled for architectures other than x86_64. * Change the architecture for various subpackages to 'noarch' as they contain no binaries. * Disable 'pmda-mssql', as it fails to build. ## Patch Instructions: To install this SUSE update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: * openSUSE Leap 15.6 zypper in -t patch openSUSE-SLE-15.6-2024-3533=1 SUSE-2024-3533=1 * Development Tools Module 15-SP6 zypper in -t patch SUSE-SLE-Module-Development-Tools-15-SP6-2024-3533=1 ## Package List: * openSUSE Leap 15.6 (aarch64 ppc64le s390x x86_64 i586) * pcp-pmda-dm-6.2.0-150600.3.6.1 * libpcp_web1-debuginfo-6.2.0-150600.3.6.1 * libpcp_gui2-debuginfo-6.2.0-150600.3.6.1 * pcp-pmda-nvidia-gpu-debuginfo-6.2.0-150600.3.6.1 * pcp-pmda-hacluster-debuginfo-6.2.0-150600.3.6.1 * pcp-pmda-lustrecomm-6.2.0-150600.3.6.1 * pcp-pmda-gfs2-6.2.0-150600.3.6.1 * pcp-pmda-mounts-debuginfo-6.2.0-150600.3.6.1 * pcp-devel-debuginfo-6.2.0-150600.3.6.1 * pcp-system-tools-6.2.0-150600.3.6.1 * python3-pcp-6.2.0-150600.3.6.1 * pcp-pmda-systemd-debuginfo-6.2.0-150600.3.6.1 * libpcp3-debuginfo-6.2.0-150600.3.6.1 * pcp-pmda-apache-6.2.0-150600.3.6.1 * pcp-pmda-sockets-debuginfo-6.2.0-150600.3.6.1 * perl-PCP-MMV-6.2.0-150600.3.6.1 * pcp-pmda-summary-6.2.0-150600.3.6.1 * pcp-pmda-bash-6.2.0-150600.3.6.1 * pcp-pmda-mailq-6.2.0-150600.3.6.1 * pcp-pmda-sendmail-6.2.0-150600.3.6.1 * libpcp_web1-6.2.0-150600.3.6.1 * pcp-pmda-apache-debuginfo-6.2.0-150600.3.6.1 * pcp-pmda-logger-6.2.0-150600.3.6.1 * pcp-testsuite-debuginfo-6.2.0-150600.3.6.1 * pcp-pmda-trace-debuginfo-6.2.0-150600.3.6.1 * pcp-devel-6.2.0-150600.3.6.1 * pcp-pmda-summary-debuginfo-6.2.0-150600.3.6.1 * pcp-pmda-logger-debuginfo-6.2.0-150600.3.6.1 * perl-PCP-PMDA-6.2.0-150600.3.6.1 * pcp-pmda-sockets-6.2.0-150600.3.6.1 * pcp-pmda-weblog-6.2.0-150600.3.6.1 * perl-PCP-MMV-debuginfo-6.2.0-150600.3.6.1 * pcp-debugsource-6.2.0-150600.3.6.1 * pcp-6.2.0-150600.3.6.1 * pcp-pmda-smart-6.2.0-150600.3.6.1 * pcp-pmda-roomtemp-6.2.0-150600.3.6.1 * pcp-pmda-docker-debuginfo-6.2.0-150600.3.6.1 * pcp-pmda-shping-6.2.0-150600.3.6.1 * pcp-pmda-shping-debuginfo-6.2.0-150600.3.6.1 * perl-PCP-LogSummary-6.2.0-150600.3.6.1 * libpcp_gui2-6.2.0-150600.3.6.1 * pcp-pmda-smart-debuginfo-6.2.0-150600.3.6.1 * perl-PCP-LogImport-6.2.0-150600.3.6.1 * libpcp3-6.2.0-150600.3.6.1 * pcp-pmda-cifs-debuginfo-6.2.0-150600.3.6.1 * python3-pcp-debuginfo-6.2.0-150600.3.6.1 * pcp-pmda-cifs-6.2.0-150600.3.6.1 * pcp-pmda-cisco-6.2.0-150600.3.6.1 * pcp-pmda-hacluster-6.2.0-150600.3.6.1 * pcp-pmda-mailq-debuginfo-6.2.0-150600.3.6.1 * pcp-import-collectl2pcp-6.2.0-150600.3.6.1 * pcp-pmda-gfs2-debuginfo-6.2.0-150600.3.6.1 * libpcp_import1-debuginfo-6.2.0-150600.3.6.1 * libpcp-devel-6.2.0-150600.3.6.1 * pcp-pmda-roomtemp-debuginfo-6.2.0-150600.3.6.1 * libpcp_trace2-debuginfo-6.2.0-150600.3.6.1 * pcp-pmda-trace-6.2.0-150600.3.6.1 * perl-PCP-PMDA-debuginfo-6.2.0-150600.3.6.1 * pcp-pmda-zimbra-debuginfo-6.2.0-150600.3.6.1 * libpcp_mmv1-6.2.0-150600.3.6.1 * pcp-pmda-nvidia-gpu-6.2.0-150600.3.6.1 * pcp-pmda-bash-debuginfo-6.2.0-150600.3.6.1 * pcp-pmda-cisco-debuginfo-6.2.0-150600.3.6.1 * libpcp_import1-6.2.0-150600.3.6.1 * pcp-gui-debuginfo-6.2.0-150600.3.6.1 * libpcp_trace2-6.2.0-150600.3.6.1 * pcp-testsuite-6.2.0-150600.3.6.1 * libpcp_mmv1-debuginfo-6.2.0-150600.3.6.1 * pcp-pmda-systemd-6.2.0-150600.3.6.1 * pcp-pmda-lustrecomm-debuginfo-6.2.0-150600.3.6.1 * pcp-pmda-sendmail-debuginfo-6.2.0-150600.3.6.1 * pcp-pmda-weblog-debuginfo-6.2.0-150600.3.6.1 * pcp-system-tools-debuginfo-6.2.0-150600.3.6.1 * pcp-pmda-mounts-6.2.0-150600.3.6.1 * pcp-import-collectl2pcp-debuginfo-6.2.0-150600.3.6.1 * pcp-pmda-zimbra-6.2.0-150600.3.6.1 * pcp-gui-6.2.0-150600.3.6.1 * pcp-debuginfo-6.2.0-150600.3.6.1 * pcp-pmda-docker-6.2.0-150600.3.6.1 * pcp-pmda-dm-debuginfo-6.2.0-150600.3.6.1 * perl-PCP-LogImport-debuginfo-6.2.0-150600.3.6.1 * openSUSE Leap 15.6 (noarch) * pcp-pmda-redis-6.2.0-150600.3.6.1 * pcp-pmda-snmp-6.2.0-150600.3.6.1 * pcp-pmda-postfix-6.2.0-150600.3.6.1 * pcp-pmda-memcache-6.2.0-150600.3.6.1 * pcp-pmda-mysql-6.2.0-150600.3.6.1 * pcp-pmda-news-6.2.0-150600.3.6.1 * pcp-pmda-samba-6.2.0-150600.3.6.1 * pcp-export-pcp2influxdb-6.2.0-150600.3.6.1 * pcp-pmda-nfsclient-6.2.0-150600.3.6.1 * pcp-pmda-openmetrics-6.2.0-150600.3.6.1 * pcp-export-pcp2elasticsearch-6.2.0-150600.3.6.1 * pcp-conf-6.2.0-150600.3.6.1 * pcp-pmda-nutcracker-6.2.0-150600.3.6.1 * pcp-pmda-lmsensors-6.2.0-150600.3.6.1 * pcp-pmda-unbound-6.2.0-150600.3.6.1 * pcp-pmda-gluster-6.2.0-150600.3.6.1 * pcp-pmda-mic-6.2.0-150600.3.6.1 * pcp-pmda-named-6.2.0-150600.3.6.1 * pcp-pmda-netfilter-6.2.0-150600.3.6.1 * pcp-pmda-zswap-6.2.0-150600.3.6.1 * pcp-pmda-ds389-6.2.0-150600.3.6.1 * pcp-pmda-slurm-6.2.0-150600.3.6.1 * pcp-import-mrtg2pcp-6.2.0-150600.3.6.1 * pcp-pmda-dbping-6.2.0-150600.3.6.1 * pcp-pmda-netcheck-6.2.0-150600.3.6.1 * pcp-pmda-openvswitch-6.2.0-150600.3.6.1 * pcp-pmda-json-6.2.0-150600.3.6.1 * pcp-pmda-elasticsearch-6.2.0-150600.3.6.1 * pcp-import-sar2pcp-6.2.0-150600.3.6.1 * pcp-doc-6.2.0-150600.3.6.1 * pcp-pmda-haproxy-6.2.0-150600.3.6.1 * pcp-pmda-gpsd-6.2.0-150600.3.6.1 * pcp-pmda-ds389log-6.2.0-150600.3.6.1 * pcp-export-pcp2json-6.2.0-150600.3.6.1 * pcp-pmda-gpfs-6.2.0-150600.3.6.1 * pcp-pmda-oracle-6.2.0-150600.3.6.1 * pcp-pmda-rsyslog-6.2.0-150600.3.6.1 * pcp-export-pcp2zabbix-6.2.0-150600.3.6.1 * pcp-pmda-lustre-6.2.0-150600.3.6.1 * pcp-import-iostat2pcp-6.2.0-150600.3.6.1 * pcp-pmda-activemq-6.2.0-150600.3.6.1 * pcp-import-ganglia2pcp-6.2.0-150600.3.6.1 * pcp-pmda-bonding-6.2.0-150600.3.6.1 * pcp-pmda-pdns-6.2.0-150600.3.6.1 * pcp-zeroconf-6.2.0-150600.3.6.1 * pcp-export-pcp2spark-6.2.0-150600.3.6.1 * pcp-pmda-rabbitmq-6.2.0-150600.3.6.1 * pcp-pmda-nginx-6.2.0-150600.3.6.1 * pcp-export-pcp2graphite-6.2.0-150600.3.6.1 * pcp-export-pcp2xml-6.2.0-150600.3.6.1 * openSUSE Leap 15.6 (aarch64 ppc64le x86_64 i586) * pcp-pmda-infiniband-6.2.0-150600.3.6.1 * pcp-pmda-perfevent-debuginfo-6.2.0-150600.3.6.1 * pcp-pmda-infiniband-debuginfo-6.2.0-150600.3.6.1 * pcp-pmda-perfevent-6.2.0-150600.3.6.1 * openSUSE Leap 15.6 (x86_64) * pcp-pmda-resctrl-6.2.0-150600.3.6.1 * pcp-pmda-resctrl-debuginfo-6.2.0-150600.3.6.1 * Development Tools Module 15-SP6 (aarch64 ppc64le s390x x86_64) * libpcp_web1-debuginfo-6.2.0-150600.3.6.1 * libpcp_gui2-debuginfo-6.2.0-150600.3.6.1 * pcp-system-tools-6.2.0-150600.3.6.1 * python3-pcp-6.2.0-150600.3.6.1 * pcp-devel-debuginfo-6.2.0-150600.3.6.1 * libpcp3-debuginfo-6.2.0-150600.3.6.1 * perl-PCP-MMV-6.2.0-150600.3.6.1 * libpcp_web1-6.2.0-150600.3.6.1 * pcp-devel-6.2.0-150600.3.6.1 * perl-PCP-MMV-debuginfo-6.2.0-150600.3.6.1 * pcp-debugsource-6.2.0-150600.3.6.1 * pcp-6.2.0-150600.3.6.1 * perl-PCP-LogSummary-6.2.0-150600.3.6.1 * libpcp_gui2-6.2.0-150600.3.6.1 * perl-PCP-LogImport-6.2.0-150600.3.6.1 * libpcp3-6.2.0-150600.3.6.1 * python3-pcp-debuginfo-6.2.0-150600.3.6.1 * perl-PCP-PMDA-6.2.0-150600.3.6.1 * libpcp_import1-debuginfo-6.2.0-150600.3.6.1 * libpcp-devel-6.2.0-150600.3.6.1 * libpcp_trace2-debuginfo-6.2.0-150600.3.6.1 * libpcp_mmv1-6.2.0-150600.3.6.1 * libpcp_import1-6.2.0-150600.3.6.1 * libpcp_trace2-6.2.0-150600.3.6.1 * libpcp_mmv1-debuginfo-6.2.0-150600.3.6.1 * pcp-system-tools-debuginfo-6.2.0-150600.3.6.1 * perl-PCP-PMDA-debuginfo-6.2.0-150600.3.6.1 * pcp-debuginfo-6.2.0-150600.3.6.1 * perl-PCP-LogImport-debuginfo-6.2.0-150600.3.6.1 * Development Tools Module 15-SP6 (noarch) * pcp-import-sar2pcp-6.2.0-150600.3.6.1 * pcp-conf-6.2.0-150600.3.6.1 * pcp-import-iostat2pcp-6.2.0-150600.3.6.1 * pcp-import-mrtg2pcp-6.2.0-150600.3.6.1 * pcp-doc-6.2.0-150600.3.6.1 * Development Tools Module 15-SP6 (ppc64le) * pcp-pmda-perfevent-debuginfo-6.2.0-150600.3.6.1 * pcp-pmda-perfevent-6.2.0-150600.3.6.1 ## References: * https://www.suse.com/security/cve/CVE-2023-6917.html * https://www.suse.com/security/cve/CVE-2024-3019.html * https://www.suse.com/security/cve/CVE-2024-45769.html * https://www.suse.com/security/cve/CVE-2024-45770.html * https://bugzilla.suse.com/show_bug.cgi?id=1217826 * https://bugzilla.suse.com/show_bug.cgi?id=1222121 * https://bugzilla.suse.com/show_bug.cgi?id=1222815 * https://bugzilla.suse.com/show_bug.cgi?id=1230551 * https://bugzilla.suse.com/show_bug.cgi?id=1230552 * https://jira.suse.com/browse/PED-8192 * https://jira.suse.com/browse/PED-8389

1 0

SUSE-SU-2024:3519-1: important: Security update for MozillaFirefox
by OPENSUSE-SECURITY-UPDATES 03 Oct '24

03 Oct '24

# Security update for MozillaFirefox Announcement ID: SUSE-SU-2024:3519-1 Release Date: 2024-10-03T13:06:48Z Rating: important References: * bsc#1230979 Affected Products: * Desktop Applications Module 15-SP5 * Desktop Applications Module 15-SP6 * openSUSE Leap 15.5 * openSUSE Leap 15.6 * SUSE Enterprise Storage 7.1 * SUSE Linux Enterprise Desktop 15 SP4 LTSS 15-SP4 * SUSE Linux Enterprise Desktop 15 SP5 * SUSE Linux Enterprise Desktop 15 SP6 * SUSE Linux Enterprise High Performance Computing 15 SP2 * SUSE Linux Enterprise High Performance Computing 15 SP2 LTSS 15-SP2 * SUSE Linux Enterprise High Performance Computing 15 SP3 * SUSE Linux Enterprise High Performance Computing 15 SP4 * SUSE Linux Enterprise High Performance Computing 15 SP5 * SUSE Linux Enterprise High Performance Computing ESPOS 15 SP4 * SUSE Linux Enterprise High Performance Computing LTSS 15 SP3 * SUSE Linux Enterprise High Performance Computing LTSS 15 SP4 * SUSE Linux Enterprise Real Time 15 SP5 * SUSE Linux Enterprise Real Time 15 SP6 * SUSE Linux Enterprise Server 15 SP2 * SUSE Linux Enterprise Server 15 SP2 LTSS 15-SP2 * SUSE Linux Enterprise Server 15 SP3 * SUSE Linux Enterprise Server 15 SP3 LTSS 15-SP3 * SUSE Linux Enterprise Server 15 SP4 * SUSE Linux Enterprise Server 15 SP4 LTSS 15-SP4 * SUSE Linux Enterprise Server 15 SP5 * SUSE Linux Enterprise Server 15 SP6 * SUSE Linux Enterprise Server for SAP Applications 15 SP2 * SUSE Linux Enterprise Server for SAP Applications 15 SP3 * SUSE Linux Enterprise Server for SAP Applications 15 SP4 * SUSE Linux Enterprise Server for SAP Applications 15 SP5 * SUSE Linux Enterprise Server for SAP Applications 15 SP6 An update that has one security fix can now be installed. ## Description: This update for MozillaFirefox fixes the following issues: Update to Firefox Extended Support Release 128.3.0 ESR (MFSA-2024-47, bsc#1230979): * CVE-2024-8900: Clipboard write permission bypass * CVE-2024-9392: Compromised content process can bypass site isolation * CVE-2024-9393: Cross-origin access to PDF contents through multipart responses * CVE-2024-9394: Cross-origin access to JSON contents through multipart responses * CVE-2024-9396: Potential memory corruption may occur when cloning certain objects * CVE-2024-9397: Potential directory upload bypass via clickjacking * CVE-2024-9398: External protocol handlers could be enumerated via popups * CVE-2024-9399: Specially crafted WebTransport requests could lead to denial of service * CVE-2024-9400: Potential memory corruption during JIT compilation * CVE-2024-9401: Memory safety bugs fixed in Firefox 131, Firefox ESR 115.16, Firefox ESR 128.3, Thunderbird 131, and Thunderbird 128.3 * CVE-2024-9402: Memory safety bugs fixed in Firefox 131, Firefox ESR 128.3, Thunderbird 131, and Thunderbird 128.3 ## Patch Instructions: To install this SUSE update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: * SUSE Linux Enterprise High Performance Computing LTSS 15 SP4 zypper in -t patch SUSE-SLE-Product-HPC-15-SP4-LTSS-2024-3519=1 * SUSE Linux Enterprise Desktop 15 SP4 LTSS 15-SP4 zypper in -t patch SUSE-SLE-Product-SLED-15-SP4-LTSS-2024-3519=1 * SUSE Linux Enterprise Server 15 SP2 LTSS 15-SP2 zypper in -t patch SUSE-SLE-Product-SLES-15-SP2-LTSS-2024-3519=1 * SUSE Linux Enterprise Server 15 SP3 LTSS 15-SP3 zypper in -t patch SUSE-SLE-Product-SLES-15-SP3-LTSS-2024-3519=1 * SUSE Linux Enterprise Server 15 SP4 LTSS 15-SP4 zypper in -t patch SUSE-SLE-Product-SLES-15-SP4-LTSS-2024-3519=1 * SUSE Linux Enterprise Server for SAP Applications 15 SP2 zypper in -t patch SUSE-SLE-Product-SLES_SAP-15-SP2-2024-3519=1 * SUSE Linux Enterprise Server for SAP Applications 15 SP3 zypper in -t patch SUSE-SLE-Product-SLES_SAP-15-SP3-2024-3519=1 * SUSE Linux Enterprise Server for SAP Applications 15 SP4 zypper in -t patch SUSE-SLE-Product-SLES_SAP-15-SP4-2024-3519=1 * SUSE Enterprise Storage 7.1 zypper in -t patch SUSE-Storage-7.1-2024-3519=1 * openSUSE Leap 15.5 zypper in -t patch openSUSE-SLE-15.5-2024-3519=1 * openSUSE Leap 15.6 zypper in -t patch openSUSE-SLE-15.6-2024-3519=1 * Desktop Applications Module 15-SP5 zypper in -t patch SUSE-SLE-Module-Desktop-Applications-15-SP5-2024-3519=1 * Desktop Applications Module 15-SP6 zypper in -t patch SUSE-SLE-Module-Desktop-Applications-15-SP6-2024-3519=1 * SUSE Linux Enterprise High Performance Computing 15 SP2 LTSS 15-SP2 zypper in -t patch SUSE-SLE-Product-HPC-15-SP2-LTSS-2024-3519=1 * SUSE Linux Enterprise High Performance Computing LTSS 15 SP3 zypper in -t patch SUSE-SLE-Product-HPC-15-SP3-LTSS-2024-3519=1 * SUSE Linux Enterprise High Performance Computing ESPOS 15 SP4 zypper in -t patch SUSE-SLE-Product-HPC-15-SP4-ESPOS-2024-3519=1 ## Package List: * SUSE Linux Enterprise High Performance Computing LTSS 15 SP4 (aarch64 x86_64) * MozillaFirefox-debuginfo-128.3.0-150200.152.152.1 * MozillaFirefox-debugsource-128.3.0-150200.152.152.1 * MozillaFirefox-translations-other-128.3.0-150200.152.152.1 * MozillaFirefox-translations-common-128.3.0-150200.152.152.1 * MozillaFirefox-128.3.0-150200.152.152.1 * SUSE Linux Enterprise High Performance Computing LTSS 15 SP4 (noarch) * MozillaFirefox-devel-128.3.0-150200.152.152.1 * SUSE Linux Enterprise Desktop 15 SP4 LTSS 15-SP4 (x86_64) * MozillaFirefox-debuginfo-128.3.0-150200.152.152.1 * MozillaFirefox-debugsource-128.3.0-150200.152.152.1 * MozillaFirefox-translations-other-128.3.0-150200.152.152.1 * MozillaFirefox-translations-common-128.3.0-150200.152.152.1 * MozillaFirefox-128.3.0-150200.152.152.1 * SUSE Linux Enterprise Desktop 15 SP4 LTSS 15-SP4 (noarch) * MozillaFirefox-devel-128.3.0-150200.152.152.1 * SUSE Linux Enterprise Server 15 SP2 LTSS 15-SP2 (aarch64 ppc64le s390x x86_64) * MozillaFirefox-debuginfo-128.3.0-150200.152.152.1 * MozillaFirefox-debugsource-128.3.0-150200.152.152.1 * MozillaFirefox-translations-other-128.3.0-150200.152.152.1 * MozillaFirefox-translations-common-128.3.0-150200.152.152.1 * MozillaFirefox-128.3.0-150200.152.152.1 * SUSE Linux Enterprise Server 15 SP2 LTSS 15-SP2 (noarch) * MozillaFirefox-devel-128.3.0-150200.152.152.1 * SUSE Linux Enterprise Server 15 SP3 LTSS 15-SP3 (aarch64 ppc64le s390x x86_64) * MozillaFirefox-debuginfo-128.3.0-150200.152.152.1 * MozillaFirefox-debugsource-128.3.0-150200.152.152.1 * MozillaFirefox-translations-other-128.3.0-150200.152.152.1 * MozillaFirefox-translations-common-128.3.0-150200.152.152.1 * MozillaFirefox-128.3.0-150200.152.152.1 * SUSE Linux Enterprise Server 15 SP3 LTSS 15-SP3 (noarch) * MozillaFirefox-devel-128.3.0-150200.152.152.1 * SUSE Linux Enterprise Server 15 SP4 LTSS 15-SP4 (aarch64 ppc64le s390x x86_64) * MozillaFirefox-debuginfo-128.3.0-150200.152.152.1 * MozillaFirefox-debugsource-128.3.0-150200.152.152.1 * MozillaFirefox-translations-other-128.3.0-150200.152.152.1 * MozillaFirefox-translations-common-128.3.0-150200.152.152.1 * MozillaFirefox-128.3.0-150200.152.152.1 * SUSE Linux Enterprise Server 15 SP4 LTSS 15-SP4 (noarch) * MozillaFirefox-devel-128.3.0-150200.152.152.1 * SUSE Linux Enterprise Server for SAP Applications 15 SP2 (ppc64le x86_64) * MozillaFirefox-debuginfo-128.3.0-150200.152.152.1 * MozillaFirefox-debugsource-128.3.0-150200.152.152.1 * MozillaFirefox-translations-other-128.3.0-150200.152.152.1 * MozillaFirefox-translations-common-128.3.0-150200.152.152.1 * MozillaFirefox-128.3.0-150200.152.152.1 * SUSE Linux Enterprise Server for SAP Applications 15 SP2 (noarch) * MozillaFirefox-devel-128.3.0-150200.152.152.1 * SUSE Linux Enterprise Server for SAP Applications 15 SP3 (ppc64le x86_64) * MozillaFirefox-debuginfo-128.3.0-150200.152.152.1 * MozillaFirefox-debugsource-128.3.0-150200.152.152.1 * MozillaFirefox-translations-other-128.3.0-150200.152.152.1 * MozillaFirefox-translations-common-128.3.0-150200.152.152.1 * MozillaFirefox-128.3.0-150200.152.152.1 * SUSE Linux Enterprise Server for SAP Applications 15 SP3 (noarch) * MozillaFirefox-devel-128.3.0-150200.152.152.1 * SUSE Linux Enterprise Server for SAP Applications 15 SP4 (ppc64le x86_64) * MozillaFirefox-debuginfo-128.3.0-150200.152.152.1 * MozillaFirefox-debugsource-128.3.0-150200.152.152.1 * MozillaFirefox-translations-other-128.3.0-150200.152.152.1 * MozillaFirefox-translations-common-128.3.0-150200.152.152.1 * MozillaFirefox-128.3.0-150200.152.152.1 * SUSE Linux Enterprise Server for SAP Applications 15 SP4 (noarch) * MozillaFirefox-devel-128.3.0-150200.152.152.1 * SUSE Enterprise Storage 7.1 (aarch64 x86_64) * MozillaFirefox-debuginfo-128.3.0-150200.152.152.1 * MozillaFirefox-debugsource-128.3.0-150200.152.152.1 * MozillaFirefox-translations-other-128.3.0-150200.152.152.1 * MozillaFirefox-translations-common-128.3.0-150200.152.152.1 * MozillaFirefox-128.3.0-150200.152.152.1 * SUSE Enterprise Storage 7.1 (noarch) * MozillaFirefox-devel-128.3.0-150200.152.152.1 * openSUSE Leap 15.5 (aarch64 ppc64le s390x x86_64) * MozillaFirefox-debuginfo-128.3.0-150200.152.152.1 * MozillaFirefox-debugsource-128.3.0-150200.152.152.1 * MozillaFirefox-translations-other-128.3.0-150200.152.152.1 * MozillaFirefox-branding-upstream-128.3.0-150200.152.152.1 * MozillaFirefox-translations-common-128.3.0-150200.152.152.1 * MozillaFirefox-128.3.0-150200.152.152.1 * openSUSE Leap 15.5 (noarch) * MozillaFirefox-devel-128.3.0-150200.152.152.1 * openSUSE Leap 15.6 (aarch64 ppc64le s390x x86_64) * MozillaFirefox-debuginfo-128.3.0-150200.152.152.1 * MozillaFirefox-debugsource-128.3.0-150200.152.152.1 * MozillaFirefox-translations-other-128.3.0-150200.152.152.1 * MozillaFirefox-branding-upstream-128.3.0-150200.152.152.1 * MozillaFirefox-translations-common-128.3.0-150200.152.152.1 * MozillaFirefox-128.3.0-150200.152.152.1 * openSUSE Leap 15.6 (noarch) * MozillaFirefox-devel-128.3.0-150200.152.152.1 * Desktop Applications Module 15-SP5 (aarch64 ppc64le s390x x86_64) * MozillaFirefox-debuginfo-128.3.0-150200.152.152.1 * MozillaFirefox-debugsource-128.3.0-150200.152.152.1 * MozillaFirefox-translations-other-128.3.0-150200.152.152.1 * MozillaFirefox-translations-common-128.3.0-150200.152.152.1 * MozillaFirefox-128.3.0-150200.152.152.1 * Desktop Applications Module 15-SP5 (noarch) * MozillaFirefox-devel-128.3.0-150200.152.152.1 * Desktop Applications Module 15-SP6 (aarch64 ppc64le s390x x86_64) * MozillaFirefox-debuginfo-128.3.0-150200.152.152.1 * MozillaFirefox-debugsource-128.3.0-150200.152.152.1 * MozillaFirefox-translations-other-128.3.0-150200.152.152.1 * MozillaFirefox-translations-common-128.3.0-150200.152.152.1 * MozillaFirefox-128.3.0-150200.152.152.1 * Desktop Applications Module 15-SP6 (noarch) * MozillaFirefox-devel-128.3.0-150200.152.152.1 * SUSE Linux Enterprise High Performance Computing 15 SP2 LTSS 15-SP2 (aarch64 x86_64) * MozillaFirefox-debuginfo-128.3.0-150200.152.152.1 * MozillaFirefox-debugsource-128.3.0-150200.152.152.1 * MozillaFirefox-translations-other-128.3.0-150200.152.152.1 * MozillaFirefox-translations-common-128.3.0-150200.152.152.1 * MozillaFirefox-128.3.0-150200.152.152.1 * SUSE Linux Enterprise High Performance Computing 15 SP2 LTSS 15-SP2 (noarch) * MozillaFirefox-devel-128.3.0-150200.152.152.1 * SUSE Linux Enterprise High Performance Computing LTSS 15 SP3 (aarch64 x86_64) * MozillaFirefox-debuginfo-128.3.0-150200.152.152.1 * MozillaFirefox-debugsource-128.3.0-150200.152.152.1 * MozillaFirefox-translations-other-128.3.0-150200.152.152.1 * MozillaFirefox-translations-common-128.3.0-150200.152.152.1 * MozillaFirefox-128.3.0-150200.152.152.1 * SUSE Linux Enterprise High Performance Computing LTSS 15 SP3 (noarch) * MozillaFirefox-devel-128.3.0-150200.152.152.1 * SUSE Linux Enterprise High Performance Computing ESPOS 15 SP4 (aarch64 x86_64) * MozillaFirefox-debuginfo-128.3.0-150200.152.152.1 * MozillaFirefox-debugsource-128.3.0-150200.152.152.1 * MozillaFirefox-translations-other-128.3.0-150200.152.152.1 * MozillaFirefox-translations-common-128.3.0-150200.152.152.1 * MozillaFirefox-128.3.0-150200.152.152.1 * SUSE Linux Enterprise High Performance Computing ESPOS 15 SP4 (noarch) * MozillaFirefox-devel-128.3.0-150200.152.152.1 ## References: * https://bugzilla.suse.com/show_bug.cgi?id=1230979

1 0

SUSE-SU-2024:3516-1: moderate: Security update for libpcap
by OPENSUSE-SECURITY-UPDATES 03 Oct '24

03 Oct '24

# Security update for libpcap Announcement ID: SUSE-SU-2024:3516-1 Release Date: 2024-10-03T11:33:46Z Rating: moderate References: * bsc#1230020 * bsc#1230034 Cross-References: * CVE-2023-7256 * CVE-2024-8006 CVSS scores: * CVE-2023-7256 ( SUSE ): 6.4 CVSS:3.1/AV:L/AC:H/PR:H/UI:N/S:U/C:H/I:H/A:H * CVE-2023-7256 ( NVD ): 4.4 CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H * CVE-2023-7256 ( NVD ): 4.4 CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H * CVE-2024-8006 ( SUSE ): 4.2 CVSS:3.1/AV:L/AC:L/PR:H/UI:R/S:U/C:N/I:N/A:H * CVE-2024-8006 ( NVD ): 4.4 CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H * CVE-2024-8006 ( NVD ): 4.4 CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H Affected Products: * openSUSE Leap 15.3 * SUSE Linux Enterprise Micro 5.1 * SUSE Linux Enterprise Micro 5.2 * SUSE Linux Enterprise Micro for Rancher 5.2 An update that solves two vulnerabilities can now be installed. ## Description: This update for libpcap fixes the following issues: * CVE-2024-8006: NULL pointer dereference in function pcap_findalldevs_ex(). (bsc#1230034) * CVE-2023-7256: double free via struct addrinfo in function sock_initaddress(). (bsc#1230020) ## Patch Instructions: To install this SUSE update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: * openSUSE Leap 15.3 zypper in -t patch SUSE-2024-3516=1 * SUSE Linux Enterprise Micro 5.1 zypper in -t patch SUSE-SUSE-MicroOS-5.1-2024-3516=1 * SUSE Linux Enterprise Micro 5.2 zypper in -t patch SUSE-SUSE-MicroOS-5.2-2024-3516=1 * SUSE Linux Enterprise Micro for Rancher 5.2 zypper in -t patch SUSE-SUSE-MicroOS-5.2-2024-3516=1 ## Package List: * openSUSE Leap 15.3 (aarch64 ppc64le s390x x86_64 i586) * libpcap-devel-static-1.9.1-150300.3.3.1 * libpcap1-debuginfo-1.9.1-150300.3.3.1 * libpcap-debugsource-1.9.1-150300.3.3.1 * libpcap1-1.9.1-150300.3.3.1 * libpcap-devel-1.9.1-150300.3.3.1 * openSUSE Leap 15.3 (x86_64) * libpcap-devel-32bit-1.9.1-150300.3.3.1 * libpcap1-32bit-debuginfo-1.9.1-150300.3.3.1 * libpcap1-32bit-1.9.1-150300.3.3.1 * openSUSE Leap 15.3 (aarch64_ilp32) * libpcap-devel-64bit-1.9.1-150300.3.3.1 * libpcap1-64bit-debuginfo-1.9.1-150300.3.3.1 * libpcap1-64bit-1.9.1-150300.3.3.1 * SUSE Linux Enterprise Micro 5.1 (aarch64 s390x x86_64) * libpcap1-debuginfo-1.9.1-150300.3.3.1 * libpcap-debugsource-1.9.1-150300.3.3.1 * libpcap1-1.9.1-150300.3.3.1 * SUSE Linux Enterprise Micro 5.2 (aarch64 s390x x86_64) * libpcap1-debuginfo-1.9.1-150300.3.3.1 * libpcap-debugsource-1.9.1-150300.3.3.1 * libpcap1-1.9.1-150300.3.3.1 * SUSE Linux Enterprise Micro for Rancher 5.2 (aarch64 s390x x86_64) * libpcap1-debuginfo-1.9.1-150300.3.3.1 * libpcap-debugsource-1.9.1-150300.3.3.1 * libpcap1-1.9.1-150300.3.3.1 ## References: * https://www.suse.com/security/cve/CVE-2023-7256.html * https://www.suse.com/security/cve/CVE-2024-8006.html * https://bugzilla.suse.com/show_bug.cgi?id=1230020 * https://bugzilla.suse.com/show_bug.cgi?id=1230034

1 0

SUSE-SU-2024:3501-1: important: Security update for openssl-3
by OPENSUSE-SECURITY-UPDATES 01 Oct '24

01 Oct '24

# Security update for openssl-3 Announcement ID: SUSE-SU-2024:3501-1 Release Date: 2024-10-01T14:03:42Z Rating: important References: * bsc#1230698 Cross-References: * CVE-2024-41996 CVSS scores: * CVE-2024-41996 ( SUSE ): 8.2 CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N * CVE-2024-41996 ( SUSE ): 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H Affected Products: * Basesystem Module 15-SP6 * openSUSE Leap 15.6 * SUSE Linux Enterprise Desktop 15 SP6 * SUSE Linux Enterprise Real Time 15 SP6 * SUSE Linux Enterprise Server 15 SP6 * SUSE Linux Enterprise Server for SAP Applications 15 SP6 An update that solves one vulnerability can now be installed. ## Description: This update for openssl-3 fixes the following issues: * CVE-2024-41996: Validating the order of the public keys in the Diffie- Hellman Key Agreement Protocol, when an approved safe prime is used, allows remote attackers to trigger expensive server-side DHE (bsc#1230698) ## Patch Instructions: To install this SUSE update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: * openSUSE Leap 15.6 zypper in -t patch SUSE-2024-3501=1 openSUSE-SLE-15.6-2024-3501=1 * Basesystem Module 15-SP6 zypper in -t patch SUSE-SLE-Module-Basesystem-15-SP6-2024-3501=1 ## Package List: * openSUSE Leap 15.6 (aarch64 ppc64le s390x x86_64 i586) * openssl-3-3.1.4-150600.5.18.1 * libopenssl-3-fips-provider-debuginfo-3.1.4-150600.5.18.1 * openssl-3-debuginfo-3.1.4-150600.5.18.1 * libopenssl3-debuginfo-3.1.4-150600.5.18.1 * libopenssl-3-fips-provider-3.1.4-150600.5.18.1 * libopenssl3-3.1.4-150600.5.18.1 * openssl-3-debugsource-3.1.4-150600.5.18.1 * libopenssl-3-devel-3.1.4-150600.5.18.1 * openSUSE Leap 15.6 (x86_64) * libopenssl3-32bit-debuginfo-3.1.4-150600.5.18.1 * libopenssl-3-devel-32bit-3.1.4-150600.5.18.1 * libopenssl-3-fips-provider-32bit-3.1.4-150600.5.18.1 * libopenssl-3-fips-provider-32bit-debuginfo-3.1.4-150600.5.18.1 * libopenssl3-32bit-3.1.4-150600.5.18.1 * openSUSE Leap 15.6 (noarch) * openssl-3-doc-3.1.4-150600.5.18.1 * openSUSE Leap 15.6 (aarch64_ilp32) * libopenssl-3-devel-64bit-3.1.4-150600.5.18.1 * libopenssl3-64bit-debuginfo-3.1.4-150600.5.18.1 * libopenssl-3-fips-provider-64bit-debuginfo-3.1.4-150600.5.18.1 * libopenssl-3-fips-provider-64bit-3.1.4-150600.5.18.1 * libopenssl3-64bit-3.1.4-150600.5.18.1 * Basesystem Module 15-SP6 (aarch64 ppc64le s390x x86_64) * openssl-3-3.1.4-150600.5.18.1 * libopenssl-3-fips-provider-debuginfo-3.1.4-150600.5.18.1 * openssl-3-debuginfo-3.1.4-150600.5.18.1 * libopenssl3-debuginfo-3.1.4-150600.5.18.1 * libopenssl-3-fips-provider-3.1.4-150600.5.18.1 * libopenssl3-3.1.4-150600.5.18.1 * openssl-3-debugsource-3.1.4-150600.5.18.1 * libopenssl-3-devel-3.1.4-150600.5.18.1 * Basesystem Module 15-SP6 (x86_64) * libopenssl-3-fips-provider-32bit-debuginfo-3.1.4-150600.5.18.1 * libopenssl3-32bit-3.1.4-150600.5.18.1 * libopenssl3-32bit-debuginfo-3.1.4-150600.5.18.1 * libopenssl-3-fips-provider-32bit-3.1.4-150600.5.18.1 ## References: * https://www.suse.com/security/cve/CVE-2024-41996.html * https://bugzilla.suse.com/show_bug.cgi?id=1230698

1 0

SUSE-SU-2024:3502-1: moderate: Security update for openvpn
by OPENSUSE-SECURITY-UPDATES 01 Oct '24

01 Oct '24

# Security update for openvpn Announcement ID: SUSE-SU-2024:3502-1 Release Date: 2024-10-01T14:03:57Z Rating: moderate References: * bsc#1227546 Cross-References: * CVE-2024-28882 CVSS scores: * CVE-2024-28882 ( SUSE ): 4.3 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L Affected Products: * Basesystem Module 15-SP6 * openSUSE Leap 15.6 * SUSE Linux Enterprise Desktop 15 SP6 * SUSE Linux Enterprise Real Time 15 SP6 * SUSE Linux Enterprise Server 15 SP6 * SUSE Linux Enterprise Server for SAP Applications 15 SP6 An update that solves one vulnerability can now be installed. ## Description: This update for openvpn fixes the following issues: * CVE-2024-28882: Fix multiple exit notifications from authenticated clients will extend the validity of a closing session (bsc#1227546) ## Patch Instructions: To install this SUSE update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: * openSUSE Leap 15.6 zypper in -t patch SUSE-2024-3502=1 openSUSE-SLE-15.6-2024-3502=1 * Basesystem Module 15-SP6 zypper in -t patch SUSE-SLE-Module-Basesystem-15-SP6-2024-3502=1 ## Package List: * openSUSE Leap 15.6 (aarch64 ppc64le s390x x86_64 i586) * openvpn-down-root-plugin-debuginfo-2.6.8-150600.3.3.1 * openvpn-2.6.8-150600.3.3.1 * openvpn-auth-pam-plugin-2.6.8-150600.3.3.1 * openvpn-devel-2.6.8-150600.3.3.1 * openvpn-down-root-plugin-2.6.8-150600.3.3.1 * openvpn-debuginfo-2.6.8-150600.3.3.1 * openvpn-debugsource-2.6.8-150600.3.3.1 * openvpn-auth-pam-plugin-debuginfo-2.6.8-150600.3.3.1 * Basesystem Module 15-SP6 (aarch64 ppc64le s390x x86_64) * openvpn-2.6.8-150600.3.3.1 * openvpn-auth-pam-plugin-2.6.8-150600.3.3.1 * openvpn-devel-2.6.8-150600.3.3.1 * openvpn-debuginfo-2.6.8-150600.3.3.1 * openvpn-debugsource-2.6.8-150600.3.3.1 * openvpn-auth-pam-plugin-debuginfo-2.6.8-150600.3.3.1 ## References: * https://www.suse.com/security/cve/CVE-2024-28882.html * https://bugzilla.suse.com/show_bug.cgi?id=1227546

1 0

SUSE-SU-2024:3505-1: moderate: Security update for OpenIPMI
by OPENSUSE-SECURITY-UPDATES 01 Oct '24

01 Oct '24

# Security update for OpenIPMI Announcement ID: SUSE-SU-2024:3505-1 Release Date: 2024-10-01T14:43:37Z Rating: moderate References: * bsc#1229910 Cross-References: * CVE-2024-42934 CVSS scores: * CVE-2024-42934 ( SUSE ): 2.3 CVSS:4.0/AV:A/AC:L/AT:P/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N * CVE-2024-42934 ( SUSE ): 5.0 CVSS:3.1/AV:A/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:L Affected Products: * Basesystem Module 15-SP6 * openSUSE Leap 15.6 * SUSE Linux Enterprise Desktop 15 SP6 * SUSE Linux Enterprise Real Time 15 SP6 * SUSE Linux Enterprise Server 15 SP6 * SUSE Linux Enterprise Server for SAP Applications 15 SP6 An update that solves one vulnerability can now be installed. ## Description: This update for OpenIPMI fixes the following issues: * CVE-2024-42934: crash or message authentication bypass on IPMI simulator due to missing bounds check. (bsc#1229910) ## Patch Instructions: To install this SUSE update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: * openSUSE Leap 15.6 zypper in -t patch SUSE-2024-3505=1 openSUSE-SLE-15.6-2024-3505=1 * Basesystem Module 15-SP6 zypper in -t patch SUSE-SLE-Module-Basesystem-15-SP6-2024-3505=1 ## Package List: * openSUSE Leap 15.6 (aarch64 ppc64le s390x x86_64 i586) * OpenIPMI-debugsource-2.0.31-150600.10.3.1 * OpenIPMI-python3-debuginfo-2.0.31-150600.10.3.1 * OpenIPMI-debuginfo-2.0.31-150600.10.3.1 * OpenIPMI-python3-2.0.31-150600.10.3.1 * libOpenIPMI0-debuginfo-2.0.31-150600.10.3.1 * OpenIPMI-2.0.31-150600.10.3.1 * OpenIPMI-devel-2.0.31-150600.10.3.1 * libOpenIPMI0-2.0.31-150600.10.3.1 * Basesystem Module 15-SP6 (aarch64 ppc64le s390x x86_64) * OpenIPMI-debugsource-2.0.31-150600.10.3.1 * OpenIPMI-debuginfo-2.0.31-150600.10.3.1 * libOpenIPMI0-debuginfo-2.0.31-150600.10.3.1 * OpenIPMI-2.0.31-150600.10.3.1 * OpenIPMI-devel-2.0.31-150600.10.3.1 * libOpenIPMI0-2.0.31-150600.10.3.1 ## References: * https://www.suse.com/security/cve/CVE-2024-42934.html * https://bugzilla.suse.com/show_bug.cgi?id=1229910

1 0

SUSE-SU-2024:3507-1: important: Security update for MozillaThunderbird
by OPENSUSE-SECURITY-UPDATES 01 Oct '24

01 Oct '24

# Security update for MozillaThunderbird Announcement ID: SUSE-SU-2024:3507-1 Release Date: 2024-10-01T15:02:22Z Rating: important References: * bsc#1184272 * bsc#1226316 * bsc#1228648 * bsc#1229821 Cross-References: * CVE-2024-6600 * CVE-2024-6601 * CVE-2024-6602 * CVE-2024-6603 * CVE-2024-6604 * CVE-2024-6606 * CVE-2024-6607 * CVE-2024-6608 * CVE-2024-6609 * CVE-2024-6610 * CVE-2024-6611 * CVE-2024-6612 * CVE-2024-6613 * CVE-2024-6614 * CVE-2024-6615 * CVE-2024-7518 * CVE-2024-7519 * CVE-2024-7520 * CVE-2024-7521 * CVE-2024-7522 * CVE-2024-7525 * CVE-2024-7526 * CVE-2024-7527 * CVE-2024-7528 * CVE-2024-7529 * CVE-2024-8381 * CVE-2024-8382 * CVE-2024-8384 * CVE-2024-8385 * CVE-2024-8386 * CVE-2024-8387 * CVE-2024-8394 CVSS scores: * CVE-2024-6600 ( SUSE ): 6.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:L * CVE-2024-6601 ( SUSE ): 4.7 CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:L/I:L/A:N * CVE-2024-6602 ( SUSE ): 6.1 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:N/I:L/A:L * CVE-2024-6603 ( SUSE ): 5.4 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:L * CVE-2024-6604 ( SUSE ): 8.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H * CVE-2024-6606 ( SUSE ): 8.2 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:N/A:L * CVE-2024-6607 ( SUSE ): 5.4 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:N * CVE-2024-6608 ( SUSE ): 4.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:L * CVE-2024-6608 ( NVD ): 4.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:L * CVE-2024-6609 ( SUSE ): 4.7 CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:N/I:L/A:L * CVE-2024-6609 ( NVD ): 8.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H * CVE-2024-6610 ( SUSE ): 4.7 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:N/I:N/A:L * CVE-2024-6610 ( NVD ): 4.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:L * CVE-2024-6611 ( SUSE ): 4.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:N * CVE-2024-6612 ( SUSE ): 3.1 CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:L/I:N/A:N * CVE-2024-6614 ( SUSE ): 4.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N * CVE-2024-6615 ( SUSE ): 8.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H * CVE-2024-7518 ( SUSE ): 7.4 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:N/A:N * CVE-2024-7518 ( NVD ): 6.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N * CVE-2024-7519 ( SUSE ): 7.5 CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H * CVE-2024-7519 ( NVD ): 9.6 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H * CVE-2024-7520 ( SUSE ): 8.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H * CVE-2024-7520 ( NVD ): 8.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H * CVE-2024-7521 ( SUSE ): 8.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H * CVE-2024-7521 ( NVD ): 8.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H * CVE-2024-7522 ( SUSE ): 7.1 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:L * CVE-2024-7522 ( NVD ): 8.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H * CVE-2024-7525 ( SUSE ): 7.1 CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:U/C:H/I:H/A:H * CVE-2024-7525 ( NVD ): 8.1 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:N * CVE-2024-7526 ( SUSE ): 7.1 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:L * CVE-2024-7526 ( NVD ): 6.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N * CVE-2024-7526 ( NVD ): 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N * CVE-2024-7527 ( SUSE ): 8.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H * CVE-2024-7527 ( NVD ): 8.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H * CVE-2024-7528 ( SUSE ): 8.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H * CVE-2024-7528 ( NVD ): 8.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H * CVE-2024-7529 ( SUSE ): 8.1 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:N * CVE-2024-7529 ( NVD ): 6.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N * CVE-2024-8381 ( SUSE ): 7.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L * CVE-2024-8381 ( NVD ): 9.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H * CVE-2024-8382 ( SUSE ): 5.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N * CVE-2024-8382 ( NVD ): 8.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H * CVE-2024-8384 ( SUSE ): 5.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L * CVE-2024-8384 ( NVD ): 9.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H * CVE-2024-8385 ( SUSE ): 7.3 CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H * CVE-2024-8385 ( NVD ): 9.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H * CVE-2024-8386 ( SUSE ): 4.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N * CVE-2024-8386 ( NVD ): 6.1 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N * CVE-2024-8387 ( SUSE ): 7.5 CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H * CVE-2024-8387 ( NVD ): 9.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H * CVE-2024-8394 ( NVD ): 6.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H Affected Products: * openSUSE Leap 15.5 * openSUSE Leap 15.6 * SUSE Linux Enterprise Desktop 15 SP4 LTSS 15-SP4 * SUSE Linux Enterprise Desktop 15 SP5 * SUSE Linux Enterprise Desktop 15 SP6 * SUSE Linux Enterprise High Performance Computing 15 SP5 * SUSE Linux Enterprise Micro 5.5 * SUSE Linux Enterprise Real Time 15 SP5 * SUSE Linux Enterprise Real Time 15 SP6 * SUSE Linux Enterprise Server 15 SP5 * SUSE Linux Enterprise Server 15 SP6 * SUSE Linux Enterprise Server for SAP Applications 15 SP5 * SUSE Linux Enterprise Server for SAP Applications 15 SP6 * SUSE Linux Enterprise Workstation Extension 15 SP5 * SUSE Linux Enterprise Workstation Extension 15 SP6 * SUSE Package Hub 15 15-SP5 * SUSE Package Hub 15 15-SP6 An update that solves 32 vulnerabilities can now be installed. ## Description: This update for MozillaThunderbird fixes the following issues: * Mozilla Thunderbird 128.2.3 MFSA 2024-43 (bsc#1229821) * CVE-2024-8394: Crash when aborting verification of OTR chat. * CVE-2024-8385: WASM type confusion involving ArrayTypes. * CVE-2024-8381: Type confusion when looking up a property name in a "with" block. * CVE-2024-8382: Internal event interfaces were exposed to web content when browser EventHandler listener callbacks ran. * CVE-2024-8384: Garbage collection could mis-color cross-compartment objects in OOM conditions. * CVE-2024-8386: SelectElements could be shown over another site if popups are allowed. * CVE-2024-8387: Memory safety bugs fixed in Firefox 130, Firefox ESR 128.2, and Thunderbird 128.2. MFSA 2024-37 (bsc#1228648) * CVE-2024-7518: Fullscreen notification dialog can be obscured by document content. * CVE-2024-7519: Out of bounds memory access in graphics shared memory handling. * CVE-2024-7520: Type confusion in WebAssembly. * CVE-2024-7521: Incomplete WebAssembly exception handing. * CVE-2024-7522: Out of bounds read in editor component. * CVE-2024-7525: Missing permission check when creating a StreamFilter. * CVE-2024-7526: Uninitialized memory used by WebGL. * CVE-2024-7527: Use-after-free in JavaScript garbage collection. * CVE-2024-7528: Use-after-free in IndexedDB. * CVE-2024-7529: Document content could partially obscure security prompts. MFSA 2024-32 (bsc#1226316) * CVE-2024-6606: Out-of-bounds read in clipboard component. * CVE-2024-6607: Leaving pointerlock by pressing the escape key could be prevented. * CVE-2024-6608: Cursor could be moved out of the viewport using pointerlock. * CVE-2024-6609: Memory corruption in NSS. * CVE-2024-6610: Form validation popups could block exiting full-screen mode. * CVE-2024-6600: Memory corruption in WebGL API. * CVE-2024-6601: Race condition in permission assignment. * CVE-2024-6602: Memory corruption in NSS. * CVE-2024-6603: Memory corruption in thread creation. * CVE-2024-6611: Incorrect handling of SameSite cookies. * CVE-2024-6612: CSP violation leakage when using devtools. * CVE-2024-6613: Incorrect listing of stack frames. * CVE-2024-6614: Incorrect listing of stack frames. * CVE-2024-6604: Memory safety bugs fixed in Firefox 128, Firefox ESR 115.13, Thunderbird 128, and Thunderbird 115.13. * CVE-2024-6615: Memory safety bugs fixed in Firefox 128 and Thunderbird 128. Bug fixes: \- Recommend libfido2-udev in order to try to get security keys (e.g. Yubikeys) working out of the box. (bsc#1184272) ## Patch Instructions: To install this SUSE update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: * openSUSE Leap 15.5 zypper in -t patch openSUSE-SLE-15.5-2024-3507=1 * openSUSE Leap 15.6 zypper in -t patch openSUSE-SLE-15.6-2024-3507=1 * SUSE Package Hub 15 15-SP5 zypper in -t patch SUSE-SLE-Module-Packagehub-Subpackages-15-SP5-2024-3507=1 * SUSE Package Hub 15 15-SP6 zypper in -t patch SUSE-SLE-Module-Packagehub-Subpackages-15-SP6-2024-3507=1 * SUSE Linux Enterprise Desktop 15 SP4 LTSS 15-SP4 zypper in -t patch SUSE-SLE-Product-SLED-15-SP4-LTSS-2024-3507=1 * SUSE Linux Enterprise Workstation Extension 15 SP5 zypper in -t patch SUSE-SLE-Product-WE-15-SP5-2024-3507=1 * SUSE Linux Enterprise Workstation Extension 15 SP6 zypper in -t patch SUSE-SLE-Product-WE-15-SP6-2024-3507=1 ## Package List: * openSUSE Leap 15.5 (aarch64 ppc64le s390x x86_64) * MozillaThunderbird-debugsource-128.2.3-150200.8.177.1 * MozillaThunderbird-translations-other-128.2.3-150200.8.177.1 * MozillaThunderbird-translations-common-128.2.3-150200.8.177.1 * MozillaThunderbird-128.2.3-150200.8.177.1 * MozillaThunderbird-debuginfo-128.2.3-150200.8.177.1 * openSUSE Leap 15.6 (aarch64 ppc64le s390x x86_64) * MozillaThunderbird-debugsource-128.2.3-150200.8.177.1 * MozillaThunderbird-translations-other-128.2.3-150200.8.177.1 * MozillaThunderbird-translations-common-128.2.3-150200.8.177.1 * MozillaThunderbird-128.2.3-150200.8.177.1 * MozillaThunderbird-debuginfo-128.2.3-150200.8.177.1 * SUSE Package Hub 15 15-SP5 (aarch64 ppc64le s390x) * MozillaThunderbird-debugsource-128.2.3-150200.8.177.1 * MozillaThunderbird-translations-other-128.2.3-150200.8.177.1 * MozillaThunderbird-translations-common-128.2.3-150200.8.177.1 * MozillaThunderbird-128.2.3-150200.8.177.1 * MozillaThunderbird-debuginfo-128.2.3-150200.8.177.1 * SUSE Package Hub 15 15-SP6 (aarch64 ppc64le s390x) * MozillaThunderbird-debugsource-128.2.3-150200.8.177.1 * MozillaThunderbird-translations-other-128.2.3-150200.8.177.1 * MozillaThunderbird-translations-common-128.2.3-150200.8.177.1 * MozillaThunderbird-128.2.3-150200.8.177.1 * MozillaThunderbird-debuginfo-128.2.3-150200.8.177.1 * SUSE Linux Enterprise Desktop 15 SP4 LTSS 15-SP4 (x86_64) * MozillaThunderbird-debugsource-128.2.3-150200.8.177.1 * MozillaThunderbird-translations-other-128.2.3-150200.8.177.1 * MozillaThunderbird-translations-common-128.2.3-150200.8.177.1 * MozillaThunderbird-128.2.3-150200.8.177.1 * MozillaThunderbird-debuginfo-128.2.3-150200.8.177.1 * SUSE Linux Enterprise Workstation Extension 15 SP5 (x86_64) * MozillaThunderbird-debugsource-128.2.3-150200.8.177.1 * MozillaThunderbird-translations-other-128.2.3-150200.8.177.1 * MozillaThunderbird-translations-common-128.2.3-150200.8.177.1 * MozillaThunderbird-128.2.3-150200.8.177.1 * MozillaThunderbird-debuginfo-128.2.3-150200.8.177.1 * SUSE Linux Enterprise Workstation Extension 15 SP6 (x86_64) * MozillaThunderbird-debugsource-128.2.3-150200.8.177.1 * MozillaThunderbird-translations-other-128.2.3-150200.8.177.1 * MozillaThunderbird-translations-common-128.2.3-150200.8.177.1 * MozillaThunderbird-128.2.3-150200.8.177.1 * MozillaThunderbird-debuginfo-128.2.3-150200.8.177.1 ## References: * https://www.suse.com/security/cve/CVE-2024-6600.html * https://www.suse.com/security/cve/CVE-2024-6601.html * https://www.suse.com/security/cve/CVE-2024-6602.html * https://www.suse.com/security/cve/CVE-2024-6603.html * https://www.suse.com/security/cve/CVE-2024-6604.html * https://www.suse.com/security/cve/CVE-2024-6606.html * https://www.suse.com/security/cve/CVE-2024-6607.html * https://www.suse.com/security/cve/CVE-2024-6608.html * https://www.suse.com/security/cve/CVE-2024-6609.html * https://www.suse.com/security/cve/CVE-2024-6610.html * https://www.suse.com/security/cve/CVE-2024-6611.html * https://www.suse.com/security/cve/CVE-2024-6612.html * https://www.suse.com/security/cve/CVE-2024-6613.html * https://www.suse.com/security/cve/CVE-2024-6614.html * https://www.suse.com/security/cve/CVE-2024-6615.html * https://www.suse.com/security/cve/CVE-2024-7518.html * https://www.suse.com/security/cve/CVE-2024-7519.html * https://www.suse.com/security/cve/CVE-2024-7520.html * https://www.suse.com/security/cve/CVE-2024-7521.html * https://www.suse.com/security/cve/CVE-2024-7522.html * https://www.suse.com/security/cve/CVE-2024-7525.html * https://www.suse.com/security/cve/CVE-2024-7526.html * https://www.suse.com/security/cve/CVE-2024-7527.html * https://www.suse.com/security/cve/CVE-2024-7528.html * https://www.suse.com/security/cve/CVE-2024-7529.html * https://www.suse.com/security/cve/CVE-2024-8381.html * https://www.suse.com/security/cve/CVE-2024-8382.html * https://www.suse.com/security/cve/CVE-2024-8384.html * https://www.suse.com/security/cve/CVE-2024-8385.html * https://www.suse.com/security/cve/CVE-2024-8386.html * https://www.suse.com/security/cve/CVE-2024-8387.html * https://www.suse.com/security/cve/CVE-2024-8394.html * https://bugzilla.suse.com/show_bug.cgi?id=1184272 * https://bugzilla.suse.com/show_bug.cgi?id=1226316 * https://bugzilla.suse.com/show_bug.cgi?id=1228648 * https://bugzilla.suse.com/show_bug.cgi?id=1229821

1 0