November 2024 - openSUSE Security Announce

openSUSE-SU-2024:0349-1: important: Security update for htmldoc
by opensuse-security＠opensuse.org 05 Nov '24

05 Nov '24

openSUSE Security Update: Security update for htmldoc ______________________________________________________________________________ Announcement ID: openSUSE-SU-2024:0349-1 Rating: important References: #1232380 Cross-References: CVE-2024-46478 Affected Products: openSUSE Backports SLE-15-SP5 ______________________________________________________________________________ An update that fixes one vulnerability is now available. Description: This update for htmldoc fixes the following issues: - CVE-2024-46478: Fixed a buffer overflow when handling tabs through the parse_pre function (boo#1232380). Patch Instructions: To install this openSUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Backports SLE-15-SP5: zypper in -t patch openSUSE-2024-349=1 Package List: - openSUSE Backports SLE-15-SP5 (aarch64 i586 ppc64le s390x x86_64): htmldoc-1.9.16-bp155.2.6.1 References: https://www.suse.com/security/cve/CVE-2024-46478.html https://bugzilla.suse.com/1232380

1 0

openSUSE-SU-2024:14457-1: moderate: audacity-3.7.0-1.1 on GA media
by meissner＠suse.com 05 Nov '24

05 Nov '24

# audacity-3.7.0-1.1 on GA media Announcement ID: openSUSE-SU-2024:14457-1 Rating: moderate Cross-References: * CVE-2024-50602 CVSS scores: * CVE-2024-50602 ( SUSE ): 5.5 CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H * CVE-2024-50602 ( SUSE ): 5.6 CVSS:4.0/AV:L/AC:L/AT:P/PR:N/UI:A/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N Affected Products: * openSUSE Tumbleweed An update that solves one vulnerability can now be installed. ## Description: These are all security issues fixed in the audacity-3.7.0-1.1 package on the GA media of openSUSE Tumbleweed. ## Package List: * openSUSE Tumbleweed: * audacity 3.7.0-1.1 * audacity-lang 3.7.0-1.1 ## References: * https://www.suse.com/security/cve/CVE-2024-50602.html

1 0

openSUSE-SU-2024:14459-1: moderate: qbittorrent-5.0.1-2.1 on GA media
by meissner＠suse.com 05 Nov '24

05 Nov '24

# qbittorrent-5.0.1-2.1 on GA media Announcement ID: openSUSE-SU-2024:14459-1 Rating: moderate Cross-References: * CVE-2024-51774 Affected Products: * openSUSE Tumbleweed An update that solves one vulnerability can now be installed. ## Description: These are all security issues fixed in the qbittorrent-5.0.1-2.1 package on the GA media of openSUSE Tumbleweed. ## Package List: * openSUSE Tumbleweed: * qbittorrent 5.0.1-2.1 * qbittorrent-nox 5.0.1-2.1 ## References: * https://www.suse.com/security/cve/CVE-2024-51774.html

1 0

openSUSE-SU-2024:14458-1: moderate: govulncheck-vulndb-0.0.20241104T154416-1.1 on GA media
by meissner＠suse.com 05 Nov '24

05 Nov '24

# govulncheck-vulndb-0.0.20241104T154416-1.1 on GA media Announcement ID: openSUSE-SU-2024:14458-1 Rating: moderate Cross-References: * CVE-2024-0132 * CVE-2024-0133 * CVE-2024-10005 * CVE-2024-10006 * CVE-2024-10086 * CVE-2024-10452 * CVE-2024-46872 * CVE-2024-47401 * CVE-2024-50052 CVSS scores: * CVE-2024-0132 ( SUSE ): 8.3 CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:H/I:H/A:H * CVE-2024-0132 ( SUSE ): 8.9 CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:A/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H * CVE-2024-0133 ( SUSE ): 4.7 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:N/I:L/A:N * CVE-2024-0133 ( SUSE ): 2.1 CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:A/VC:N/VI:L/VA:N/SC:N/SI:L/SA:N * CVE-2024-10452 ( SUSE ): 2.2 CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:N/I:L/A:N * CVE-2024-10452 ( SUSE ): 2.1 CVSS:4.0/AV:N/AC:H/AT:N/PR:H/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N Affected Products: * openSUSE Tumbleweed An update that solves 9 vulnerabilities can now be installed. ## Description: These are all security issues fixed in the govulncheck-vulndb-0.0.20241104T154416-1.1 package on the GA media of openSUSE Tumbleweed. ## Package List: * openSUSE Tumbleweed: * govulncheck-vulndb 0.0.20241104T154416-1.1 ## References: * https://www.suse.com/security/cve/CVE-2024-0132.html * https://www.suse.com/security/cve/CVE-2024-0133.html * https://www.suse.com/security/cve/CVE-2024-10005.html * https://www.suse.com/security/cve/CVE-2024-10006.html * https://www.suse.com/security/cve/CVE-2024-10086.html * https://www.suse.com/security/cve/CVE-2024-10452.html * https://www.suse.com/security/cve/CVE-2024-46872.html * https://www.suse.com/security/cve/CVE-2024-47401.html * https://www.suse.com/security/cve/CVE-2024-50052.html

1 0

openSUSE-SU-2024:0347-1: important: Security update for chromium
by opensuse-security＠opensuse.org 05 Nov '24

05 Nov '24

openSUSE Security Update: Security update for chromium ______________________________________________________________________________ Announcement ID: openSUSE-SU-2024:0347-1 Rating: important References: #1232566 Cross-References: CVE-2024-10487 CVE-2024-10488 Affected Products: openSUSE Backports SLE-15-SP6 ______________________________________________________________________________ An update that fixes two vulnerabilities is now available. Description: This update for chromium fixes the following issues: Update to version 130.0.6723.91 (boo#1232566): - CVE-2024-10487: Out of bounds write in Dawn - CVE-2024-10488: Use after free in WebRTC Patch Instructions: To install this openSUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Backports SLE-15-SP6: zypper in -t patch openSUSE-2024-347=1 Package List: - openSUSE Backports SLE-15-SP6 (aarch64 x86_64): chromedriver-130.0.6723.91-bp156.2.47.1 chromium-130.0.6723.91-bp156.2.47.1 References: https://www.suse.com/security/cve/CVE-2024-10487.html https://www.suse.com/security/cve/CVE-2024-10488.html https://bugzilla.suse.com/1232566

1 0

openSUSE-SU-2024:0348-1: important: Security update for chromium
by opensuse-security＠opensuse.org 05 Nov '24

05 Nov '24

openSUSE Security Update: Security update for chromium ______________________________________________________________________________ Announcement ID: openSUSE-SU-2024:0348-1 Rating: important References: #1232566 Cross-References: CVE-2024-10487 CVE-2024-10488 Affected Products: openSUSE Backports SLE-15-SP5 ______________________________________________________________________________ An update that fixes two vulnerabilities is now available. Description: This update for chromium fixes the following issues: Update to version 130.0.6723.91 (boo#1232566): - CVE-2024-10487: Out of bounds write in Dawn - CVE-2024-10488: Use after free in WebRTC Patch Instructions: To install this openSUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Backports SLE-15-SP5: zypper in -t patch openSUSE-2024-348=1 Package List: - openSUSE Backports SLE-15-SP5 (aarch64 x86_64): chromedriver-130.0.6723.91-bp155.2.135.1 chromium-130.0.6723.91-bp155.2.135.1 References: https://www.suse.com/security/cve/CVE-2024-10487.html https://www.suse.com/security/cve/CVE-2024-10488.html https://bugzilla.suse.com/1232566

1 0

SUSE-SU-2024:3911-1: important: Security update for govulncheck-vulndb
by OPENSUSE-SECURITY-UPDATES 05 Nov '24

05 Nov '24

# Security update for govulncheck-vulndb Announcement ID: SUSE-SU-2024:3911-1 Release Date: 2024-11-05T07:45:06Z Rating: important References: * jsc#PED-11136 Cross-References: * CVE-2022-45157 * CVE-2023-22644 * CVE-2023-32197 * CVE-2024-10214 * CVE-2024-10241 * CVE-2024-22030 * CVE-2024-22036 * CVE-2024-33662 * CVE-2024-36814 * CVE-2024-38365 * CVE-2024-39223 * CVE-2024-47003 * CVE-2024-47067 * CVE-2024-47182 * CVE-2024-47534 * CVE-2024-47616 * CVE-2024-47825 * CVE-2024-47827 * CVE-2024-47832 * CVE-2024-47877 * CVE-2024-48909 * CVE-2024-48921 * CVE-2024-49380 * CVE-2024-49381 * CVE-2024-49753 * CVE-2024-49757 * CVE-2024-50312 * CVE-2024-7558 * CVE-2024-7594 * CVE-2024-8037 * CVE-2024-8038 * CVE-2024-8901 * CVE-2024-8975 * CVE-2024-8996 * CVE-2024-9180 * CVE-2024-9264 * CVE-2024-9312 * CVE-2024-9313 * CVE-2024-9341 * CVE-2024-9355 * CVE-2024-9407 * CVE-2024-9486 * CVE-2024-9594 * CVE-2024-9675 CVSS scores: * CVE-2023-22644 ( NVD ): 9.4 CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X * CVE-2023-22644 ( NVD ): 5.5 CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N * CVE-2023-22644 ( NVD ): 8.8 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H * CVE-2024-10214 ( NVD ): 3.5 CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:L/I:N/A:N * CVE-2024-10241 ( NVD ): 4.3 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N * CVE-2024-22030 ( NVD ): 8.0 CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:H/I:H/A:H * CVE-2024-36814 ( NVD ): 4.9 CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:N * CVE-2024-38365 ( NVD ): 7.4 CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:H * CVE-2024-39223 ( NVD ): 9.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H * CVE-2024-47003 ( NVD ): 6.5 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H * CVE-2024-47003 ( NVD ): 3.1 CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:N/I:N/A:L * CVE-2024-47067 ( NVD ): 5.1 CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X * CVE-2024-47182 ( NVD ): 4.8 CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:N * CVE-2024-47182 ( NVD ): 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N * CVE-2024-47534 ( NVD ): 8.2 CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X * CVE-2024-47534 ( NVD ): 0.0 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:N * CVE-2024-47616 ( NVD ): 6.8 CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:N * CVE-2024-47825 ( NVD ): 4.0 CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:L/I:N/A:N * CVE-2024-47827 ( NVD ): 5.7 CVSS:3.1/AV:A/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H * CVE-2024-47832 ( NVD ): 9.3 CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X * CVE-2024-47877 ( NVD ): 6.9 CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X * CVE-2024-48909 ( NVD ): 2.0 CVSS:3.1/AV:N/AC:H/PR:H/UI:R/S:U/C:L/I:N/A:N * CVE-2024-48909 ( NVD ): 2.4 CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:U/C:L/I:N/A:N * CVE-2024-48921 ( NVD ): 8.7 CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X * CVE-2024-49380 ( NVD ): 8.9 CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X * CVE-2024-49381 ( NVD ): 7.7 CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X * CVE-2024-49753 ( NVD ): 5.9 CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:H/I:H/A:N * CVE-2024-49757 ( NVD ): 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N * CVE-2024-50312 ( NVD ): 5.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N * CVE-2024-50312 ( NVD ): 5.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N * CVE-2024-50312 ( NVD ): 5.3 CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N * CVE-2024-7558 ( NVD ): 8.7 CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:L/I:H/A:H * CVE-2024-7594 ( NVD ): 7.5 CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H * CVE-2024-8037 ( NVD ): 6.5 CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:L/I:H/A:H * CVE-2024-8038 ( NVD ): 7.9 CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:H * CVE-2024-8901 ( NVD ): 6.9 CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:N/SC:H/SI:L/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X * CVE-2024-8901 ( NVD ): 7.5 CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:L/A:N * CVE-2024-8975 ( NVD ): 7.3 CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H * CVE-2024-8975 ( NVD ): 7.8 CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H * CVE-2024-8996 ( NVD ): 7.3 CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H * CVE-2024-8996 ( NVD ): 7.8 CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H * CVE-2024-9180 ( NVD ): 7.2 CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H * CVE-2024-9180 ( NVD ): 7.2 CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H * CVE-2024-9264 ( SUSE ): 9.4 CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X * CVE-2024-9264 ( SUSE ): 9.9 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H * CVE-2024-9264 ( NVD ): 9.4 CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X * CVE-2024-9264 ( NVD ): 8.8 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H * CVE-2024-9264 ( NVD ): 9.9 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H * CVE-2024-9312 ( NVD ): 7.5 CVSS:3.1/AV:L/AC:H/PR:H/UI:N/S:C/C:H/I:H/A:H * CVE-2024-9313 ( NVD ): 8.8 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H * CVE-2024-9341 ( SUSE ): 5.8 CVSS:4.0/AV:N/AC:H/AT:N/PR:L/UI:A/VC:H/VI:L/VA:N/SC:N/SI:N/SA:N * CVE-2024-9341 ( SUSE ): 5.4 CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:U/C:H/I:L/A:N * CVE-2024-9341 ( NVD ): 5.4 CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:U/C:H/I:L/A:N * CVE-2024-9355 ( NVD ): 6.5 CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:L * CVE-2024-9407 ( SUSE ): 5.6 CVSS:4.0/AV:L/AC:L/AT:P/PR:N/UI:A/VC:H/VI:L/VA:N/SC:N/SI:N/SA:N * CVE-2024-9407 ( SUSE ): 5.3 CVSS:3.1/AV:L/AC:H/PR:N/UI:R/S:U/C:H/I:L/A:N * CVE-2024-9407 ( NVD ): 4.7 CVSS:3.1/AV:L/AC:H/PR:H/UI:N/S:U/C:H/I:L/A:N * CVE-2024-9486 ( NVD ): 9.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H * CVE-2024-9594 ( NVD ): 6.3 CVSS:3.1/AV:A/AC:H/PR:H/UI:R/S:U/C:H/I:H/A:H * CVE-2024-9675 ( SUSE ): 4.8 CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:N/SC:L/SI:L/SA:N * CVE-2024-9675 ( SUSE ): 4.4 CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N * CVE-2024-9675 ( NVD ): 4.4 CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N Affected Products: * openSUSE Leap 15.5 * openSUSE Leap 15.6 * SUSE Linux Enterprise Desktop 15 SP5 * SUSE Linux Enterprise Desktop 15 SP6 * SUSE Linux Enterprise High Performance Computing 15 SP5 * SUSE Linux Enterprise Micro 5.5 * SUSE Linux Enterprise Real Time 15 SP5 * SUSE Linux Enterprise Real Time 15 SP6 * SUSE Linux Enterprise Server 15 SP5 * SUSE Linux Enterprise Server 15 SP6 * SUSE Linux Enterprise Server for SAP Applications 15 SP5 * SUSE Linux Enterprise Server for SAP Applications 15 SP6 * SUSE Package Hub 15 15-SP5 * SUSE Package Hub 15 15-SP6 An update that solves 44 vulnerabilities and contains one feature can now be installed. ## Description: This update for govulncheck-vulndb fixes the following issues: Update to version 0.0.20241030T212825 2024-10-30T21:28:25Z ( jsc#PED-11136 ) * Go CVE Numbering Authority IDs added or updated with aliases: * GO-2024-3230 CVE-2024-48921 GHSA-qjvc-p88j-j9rm * GO-2024-3232 CVE-2024-10241 GHSA-6mvp-gh77-7vwh * Go CVE Numbering Authority IDs added or updated with aliases: * GO-2024-3226 CVE-2024-47827 GHSA-ghjw-32xw-ffwr * GO-2024-3227 CVE-2024-10214 GHSA-hm57-h27x-599c * GO-2024-3228 GHSA-wcx9-ccpj-hx3c * Go CVE Numbering Authority IDs added or updated with aliases: * GO-2024-3207 GHSA-p5wf-cmr4-xrwr * GO-2024-3208 CVE-2024-47825 GHSA-3wwx-63fv-pfq6 * GO-2024-3210 CVE-2024-8901 * GO-2024-3211 CVE-2024-50312 * GO-2024-3212 GHSA-rjfv-pjvx-mjgv * GO-2024-3213 CVE-2024-49380 * GO-2024-3214 CVE-2024-49381 * GO-2024-3215 CVE-2024-9264 GHSA-q99m-qcv4-fpm7 * GO-2024-3216 CVE-2024-49753 GHSA-6cf5-w9h3-4rqv * GO-2024-3217 CVE-2024-49757 GHSA-3rmw-76m6-4gjc * GO-2024-3219 GHSA-7h65-4p22-39j6 * GO-2024-3220 CVE-2023-32197 GHSA-7h8m-pvw3-5gh4 * GO-2024-3221 CVE-2024-22036 GHSA-h99m-6755-rgwc * GO-2024-3222 GHSA-x7xj-jvwp-97rv * GO-2024-3223 CVE-2022-45157 GHSA-xj7w-r753-vj8v * GO-2024-3224 CVE-2024-39223 GHSA-8wxx-35qc-vp6r * Go CVE Numbering Authority IDs added or updated with aliases: * GO-2024-3189 CVE-2024-38365 GHSA-27vh-h6mc-q6g8 * GO-2024-3203 CVE-2024-9486 * GO-2024-3204 CVE-2024-9594 * Go CVE Numbering Authority IDs added or updated with aliases: * GO-2024-3189 CVE-2024-38365 GHSA-27vh-h6mc-q6g8 * GO-2024-3196 CVE-2024-47877 GHSA-8rm2-93mq-jqhc * GO-2024-3199 GHSA-vv6c-69r6-chg9 * GO-2024-3200 CVE-2024-48909 GHSA-3c32-4hq9-6wgj * GO-2024-3201 CVE-2023-22644 * Go CVE Numbering Authority IDs added or updated with aliases: * GO-2024-3166 CVE-2024-47534 GHSA-4f8r-qqr9-fq8j * GO-2024-3171 CVE-2024-9341 GHSA-mc76-5925-c5p6 * Go CVE Numbering Authority IDs added or updated with aliases: * GO-2024-3161 CVE-2024-22030 GHSA-h4h5-9833-v2p4 * GO-2024-3162 CVE-2024-7594 GHSA-jg74-mwgw-v6x3 * GO-2024-3163 CVE-2024-47182 * GO-2024-3164 CVE-2024-47003 GHSA-59hf-mpf8-pqjh * GO-2024-3166 CVE-2024-47534 GHSA-4f8r-qqr9-fq8j * GO-2024-3167 CVE-2024-9355 GHSA-3h3x-2hwv-hr52 * GO-2024-3168 CVE-2024-8975 GHSA-chqx-36rm-rf8h * GO-2024-3169 CVE-2024-9407 GHSA-fhqq-8f65-5xfc * GO-2024-3170 CVE-2024-8996 GHSA-m5gv-m5f9-wgv4 * GO-2024-3172 CVE-2024-33662 GHSA-9mjw-79r6-c9m8 * GO-2024-3173 CVE-2024-7558 GHSA-mh98-763h-m9v4 * GO-2024-3174 CVE-2024-8037 GHSA-8v4w-f4r9-7h6x * GO-2024-3175 CVE-2024-8038 GHSA-xwgj-vpm9-q2rq * GO-2024-3179 CVE-2024-47616 GHSA-r7rh-jww5-5fjr * GO-2024-3181 CVE-2024-9313 GHSA-x5q3-c8rm-w787 * GO-2024-3182 GHSA-wpr2-j6gr-pjw9 * GO-2024-3184 CVE-2024-36814 GHSA-9cp9-8gw2-8v7m * GO-2024-3185 CVE-2024-47832 * GO-2024-3186 CVE-2024-9675 GHSA-586p-749j-fhwp * GO-2024-3188 CVE-2024-9312 GHSA-4gfw-wf7c-w6g2 * GO-2024-3190 CVE-2024-47067 GHSA-8pph-gfhp-w226 * GO-2024-3191 CVE-2024-9180 GHSA-rr8j-7w34-xp5j ## Patch Instructions: To install this SUSE update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: * openSUSE Leap 15.5 zypper in -t patch openSUSE-SLE-15.5-2024-3911=1 * openSUSE Leap 15.6 zypper in -t patch openSUSE-SLE-15.6-2024-3911=1 * SUSE Package Hub 15 15-SP5 zypper in -t patch SUSE-SLE-Module-Packagehub-Subpackages-15-SP5-2024-3911=1 * SUSE Package Hub 15 15-SP6 zypper in -t patch SUSE-SLE-Module-Packagehub-Subpackages-15-SP6-2024-3911=1 ## Package List: * openSUSE Leap 15.5 (noarch) * govulncheck-vulndb-0.0.20241030T212825-150000.1.9.1 * openSUSE Leap 15.6 (noarch) * govulncheck-vulndb-0.0.20241030T212825-150000.1.9.1 * SUSE Package Hub 15 15-SP5 (noarch) * govulncheck-vulndb-0.0.20241030T212825-150000.1.9.1 * SUSE Package Hub 15 15-SP6 (noarch) * govulncheck-vulndb-0.0.20241030T212825-150000.1.9.1 ## References: * https://www.suse.com/security/cve/CVE-2022-45157.html * https://www.suse.com/security/cve/CVE-2023-22644.html * https://www.suse.com/security/cve/CVE-2023-32197.html * https://www.suse.com/security/cve/CVE-2024-10214.html * https://www.suse.com/security/cve/CVE-2024-10241.html * https://www.suse.com/security/cve/CVE-2024-22030.html * https://www.suse.com/security/cve/CVE-2024-22036.html * https://www.suse.com/security/cve/CVE-2024-33662.html * https://www.suse.com/security/cve/CVE-2024-36814.html * https://www.suse.com/security/cve/CVE-2024-38365.html * https://www.suse.com/security/cve/CVE-2024-39223.html * https://www.suse.com/security/cve/CVE-2024-47003.html * https://www.suse.com/security/cve/CVE-2024-47067.html * https://www.suse.com/security/cve/CVE-2024-47182.html * https://www.suse.com/security/cve/CVE-2024-47534.html * https://www.suse.com/security/cve/CVE-2024-47616.html * https://www.suse.com/security/cve/CVE-2024-47825.html * https://www.suse.com/security/cve/CVE-2024-47827.html * https://www.suse.com/security/cve/CVE-2024-47832.html * https://www.suse.com/security/cve/CVE-2024-47877.html * https://www.suse.com/security/cve/CVE-2024-48909.html * https://www.suse.com/security/cve/CVE-2024-48921.html * https://www.suse.com/security/cve/CVE-2024-49380.html * https://www.suse.com/security/cve/CVE-2024-49381.html * https://www.suse.com/security/cve/CVE-2024-49753.html * https://www.suse.com/security/cve/CVE-2024-49757.html * https://www.suse.com/security/cve/CVE-2024-50312.html * https://www.suse.com/security/cve/CVE-2024-7558.html * https://www.suse.com/security/cve/CVE-2024-7594.html * https://www.suse.com/security/cve/CVE-2024-8037.html * https://www.suse.com/security/cve/CVE-2024-8038.html * https://www.suse.com/security/cve/CVE-2024-8901.html * https://www.suse.com/security/cve/CVE-2024-8975.html * https://www.suse.com/security/cve/CVE-2024-8996.html * https://www.suse.com/security/cve/CVE-2024-9180.html * https://www.suse.com/security/cve/CVE-2024-9264.html * https://www.suse.com/security/cve/CVE-2024-9312.html * https://www.suse.com/security/cve/CVE-2024-9313.html * https://www.suse.com/security/cve/CVE-2024-9341.html * https://www.suse.com/security/cve/CVE-2024-9355.html * https://www.suse.com/security/cve/CVE-2024-9407.html * https://www.suse.com/security/cve/CVE-2024-9486.html * https://www.suse.com/security/cve/CVE-2024-9594.html * https://www.suse.com/security/cve/CVE-2024-9675.html * https://jira.suse.com/browse/PED-11136

1 0

openSUSE-SU-2024:14456-1: moderate: python312-3.12.7-2.1 on GA media
by meissner＠suse.com 04 Nov '24

04 Nov '24

# python312-3.12.7-2.1 on GA media Announcement ID: openSUSE-SU-2024:14456-1 Rating: moderate Cross-References: * CVE-2024-9287 CVSS scores: * CVE-2024-9287 ( SUSE ): 6.5 CVSS:3.1/AV:L/AC:L/PR:H/UI:R/S:U/C:H/I:H/A:H * CVE-2024-9287 ( SUSE ): 5.3 CVSS:4.0/AV:L/AC:L/AT:P/PR:H/UI:A/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:Green Affected Products: * openSUSE Tumbleweed An update that solves one vulnerability can now be installed. ## Description: These are all security issues fixed in the python312-3.12.7-2.1 package on the GA media of openSUSE Tumbleweed. ## Package List: * openSUSE Tumbleweed: * python312 3.12.7-2.1 * python312-32bit 3.12.7-2.1 * python312-curses 3.12.7-2.1 * python312-dbm 3.12.7-2.1 * python312-idle 3.12.7-2.1 * python312-tk 3.12.7-2.1 * python312-x86-64-v3 3.12.7-2.1 ## References: * https://www.suse.com/security/cve/CVE-2024-9287.html

1 0

openSUSE-SU-2024:14455-1: moderate: python311-3.11.10-3.1 on GA media
by meissner＠suse.com 04 Nov '24

04 Nov '24

# python311-3.11.10-3.1 on GA media Announcement ID: openSUSE-SU-2024:14455-1 Rating: moderate Cross-References: * CVE-2024-9287 CVSS scores: * CVE-2024-9287 ( SUSE ): 6.5 CVSS:3.1/AV:L/AC:L/PR:H/UI:R/S:U/C:H/I:H/A:H * CVE-2024-9287 ( SUSE ): 5.3 CVSS:4.0/AV:L/AC:L/AT:P/PR:H/UI:A/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:Green Affected Products: * openSUSE Tumbleweed An update that solves one vulnerability can now be installed. ## Description: These are all security issues fixed in the python311-3.11.10-3.1 package on the GA media of openSUSE Tumbleweed. ## Package List: * openSUSE Tumbleweed: * python311 3.11.10-3.1 * python311-32bit 3.11.10-3.1 * python311-curses 3.11.10-3.1 * python311-dbm 3.11.10-3.1 * python311-idle 3.11.10-3.1 * python311-tk 3.11.10-3.1 * python311-x86-64-v3 3.11.10-3.1 ## References: * https://www.suse.com/security/cve/CVE-2024-9287.html

1 0

SUSE-SU-2024:3905-1: moderate: Security update for openssl-1_1
by OPENSUSE-SECURITY-UPDATES 04 Nov '24

04 Nov '24

# Security update for openssl-1_1 Announcement ID: SUSE-SU-2024:3905-1 Release Date: 2024-11-04T12:39:19Z Rating: moderate References: * bsc#1220262 * bsc#1224258 * bsc#1224260 * bsc#1224264 * bsc#1224265 * bsc#1224266 * bsc#1224267 * bsc#1224268 * bsc#1224269 * bsc#1224270 * bsc#1224271 * bsc#1224272 * bsc#1224273 * bsc#1224275 * bsc#1228618 * bsc#1228619 * bsc#1228623 Cross-References: * CVE-2023-50782 CVSS scores: * CVE-2023-50782 ( SUSE ): 5.9 CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N * CVE-2023-50782 ( NVD ): 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N * CVE-2023-50782 ( NVD ): 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N Affected Products: * Basesystem Module 15-SP6 * Development Tools Module 15-SP6 * Legacy Module 15-SP6 * openSUSE Leap 15.6 * SUSE Linux Enterprise Desktop 15 SP6 * SUSE Linux Enterprise Real Time 15 SP6 * SUSE Linux Enterprise Server 15 SP6 * SUSE Linux Enterprise Server for SAP Applications 15 SP6 An update that solves one vulnerability and has 16 security fixes can now be installed. ## Description: This update for openssl-1_1 fixes the following issues: Security fixes: * CVE-2023-50782: Implicit rejection in PKCS#1 v1.5 (bsc#1220262) Other fixes: * FIPS: AES GCM external IV implementation (bsc#1228618) * FIPS: Mark PBKDF2 and HKDF HMAC input keys with size >= 112 bits as approved in the SLI. (bsc#1228623) * FIPS: Enforce KDF in FIPS style (bsc#1224270) * FIPS: Mark HKDF and TLSv1.3 KDF as approved in the SLI (bsc#1228619) * FIPS: The X9.31 scheme is not approved for RSA signature operations in FIPS 186-5. (bsc#1224269) * FIPS: Differentiate the PSS length requirements (bsc#1224275) * FIPS: Mark sigGen and sigVer primitives as non-approved (bsc#1224272) * FIPS: Disable PKCSv1.5 and shake in FIPS mode (bsc#1224271) * FIPS: Mark SHA1 as non-approved in the SLI (bsc#1224266) * FIPS: DH FIPS selftest and safe prime group (bsc#1224264) * FIPS: Remove not needed FIPS DRBG files (bsc#1224268) * FIPS: Add Pair-wise Consistency Test when generating DH key (bsc#1224265) * FIPS: Disallow non-approved KDF types (bsc#1224267) * FIPS: Disallow RSA sigVer with 1024 and ECDSA sigVer/keyVer P-192 (bsc#1224273) * FIPS: DRBG component chaining (bsc#1224258) * FIPS: Align CRNGT_BUFSIZ with Jitter RNG output size (bsc#1224260) ## Patch Instructions: To install this SUSE update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: * Legacy Module 15-SP6 zypper in -t patch SUSE-SLE-Module-Legacy-15-SP6-2024-3905=1 * openSUSE Leap 15.6 zypper in -t patch SUSE-2024-3905=1 openSUSE-SLE-15.6-2024-3905=1 * Basesystem Module 15-SP6 zypper in -t patch SUSE-SLE-Module-Basesystem-15-SP6-2024-3905=1 * Development Tools Module 15-SP6 zypper in -t patch SUSE-SLE-Module-Development-Tools-15-SP6-2024-3905=1 ## Package List: * Legacy Module 15-SP6 (aarch64 ppc64le s390x x86_64) * openssl-1_1-debugsource-1.1.1w-150600.5.9.1 * openssl-1_1-debuginfo-1.1.1w-150600.5.9.1 * openssl-1_1-1.1.1w-150600.5.9.1 * openSUSE Leap 15.6 (aarch64 ppc64le s390x x86_64 i586) * libopenssl-1_1-devel-1.1.1w-150600.5.9.1 * openssl-1_1-1.1.1w-150600.5.9.1 * openssl-1_1-debuginfo-1.1.1w-150600.5.9.1 * libopenssl1_1-debuginfo-1.1.1w-150600.5.9.1 * openssl-1_1-debugsource-1.1.1w-150600.5.9.1 * libopenssl1_1-1.1.1w-150600.5.9.1 * openSUSE Leap 15.6 (x86_64) * libopenssl1_1-32bit-1.1.1w-150600.5.9.1 * libopenssl-1_1-devel-32bit-1.1.1w-150600.5.9.1 * libopenssl1_1-32bit-debuginfo-1.1.1w-150600.5.9.1 * openSUSE Leap 15.6 (noarch) * openssl-1_1-doc-1.1.1w-150600.5.9.1 * openSUSE Leap 15.6 (aarch64_ilp32) * libopenssl1_1-64bit-1.1.1w-150600.5.9.1 * libopenssl-1_1-devel-64bit-1.1.1w-150600.5.9.1 * libopenssl1_1-64bit-debuginfo-1.1.1w-150600.5.9.1 * Basesystem Module 15-SP6 (aarch64 ppc64le s390x x86_64) * openssl-1_1-debugsource-1.1.1w-150600.5.9.1 * openssl-1_1-debuginfo-1.1.1w-150600.5.9.1 * libopenssl1_1-debuginfo-1.1.1w-150600.5.9.1 * libopenssl1_1-1.1.1w-150600.5.9.1 * Basesystem Module 15-SP6 (x86_64) * libopenssl1_1-32bit-1.1.1w-150600.5.9.1 * libopenssl1_1-32bit-debuginfo-1.1.1w-150600.5.9.1 * Development Tools Module 15-SP6 (aarch64 ppc64le s390x x86_64) * openssl-1_1-debugsource-1.1.1w-150600.5.9.1 * libopenssl-1_1-devel-1.1.1w-150600.5.9.1 * openssl-1_1-debuginfo-1.1.1w-150600.5.9.1 ## References: * https://www.suse.com/security/cve/CVE-2023-50782.html * https://bugzilla.suse.com/show_bug.cgi?id=1220262 * https://bugzilla.suse.com/show_bug.cgi?id=1224258 * https://bugzilla.suse.com/show_bug.cgi?id=1224260 * https://bugzilla.suse.com/show_bug.cgi?id=1224264 * https://bugzilla.suse.com/show_bug.cgi?id=1224265 * https://bugzilla.suse.com/show_bug.cgi?id=1224266 * https://bugzilla.suse.com/show_bug.cgi?id=1224267 * https://bugzilla.suse.com/show_bug.cgi?id=1224268 * https://bugzilla.suse.com/show_bug.cgi?id=1224269 * https://bugzilla.suse.com/show_bug.cgi?id=1224270 * https://bugzilla.suse.com/show_bug.cgi?id=1224271 * https://bugzilla.suse.com/show_bug.cgi?id=1224272 * https://bugzilla.suse.com/show_bug.cgi?id=1224273 * https://bugzilla.suse.com/show_bug.cgi?id=1224275 * https://bugzilla.suse.com/show_bug.cgi?id=1228618 * https://bugzilla.suse.com/show_bug.cgi?id=1228619 * https://bugzilla.suse.com/show_bug.cgi?id=1228623

1 0