November 2024 - openSUSE Security Announce

openSUSE-SU-2024:14491-1: moderate: libnghttp2-14-1.64.0-1.1 on GA media
by meissner＠suse.com 15 Nov '24

15 Nov '24

# libnghttp2-14-1.64.0-1.1 on GA media Announcement ID: openSUSE-SU-2024:14491-1 Rating: moderate Cross-References: * CVE-2019-18802 CVSS scores: * CVE-2019-18802 ( SUSE ): 7.5 CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H Affected Products: * openSUSE Tumbleweed An update that solves one vulnerability can now be installed. ## Description: These are all security issues fixed in the libnghttp2-14-1.64.0-1.1 package on the GA media of openSUSE Tumbleweed. ## Package List: * openSUSE Tumbleweed: * libnghttp2-14 1.64.0-1.1 * libnghttp2-14-32bit 1.64.0-1.1 * libnghttp2-devel 1.64.0-1.1 * nghttp2 1.64.0-1.1 ## References: * https://www.suse.com/security/cve/CVE-2019-18802.html

1 0

openSUSE-SU-2024:14488-1: moderate: libsoup-3_0-0-3.6.0-2.1 on GA media
by meissner＠suse.com 15 Nov '24

15 Nov '24

# libsoup-3_0-0-3.6.0-2.1 on GA media Announcement ID: openSUSE-SU-2024:14488-1 Rating: moderate Cross-References: * CVE-2024-52531 * CVE-2024-52532 CVSS scores: * CVE-2024-52531 ( SUSE ): 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N * CVE-2024-52531 ( SUSE ): 8.7 CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N * CVE-2024-52532 ( SUSE ): 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H * CVE-2024-52532 ( SUSE ): 7.1 CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N Affected Products: * openSUSE Tumbleweed An update that solves 2 vulnerabilities can now be installed. ## Description: These are all security issues fixed in the libsoup-3_0-0-3.6.0-2.1 package on the GA media of openSUSE Tumbleweed. ## Package List: * openSUSE Tumbleweed: * libsoup-3_0-0 3.6.0-2.1 * libsoup-3_0-0-32bit 3.6.0-2.1 * libsoup-devel 3.6.0-2.1 * libsoup-devel-32bit 3.6.0-2.1 * libsoup-lang 3.6.0-2.1 * typelib-1_0-Soup-3_0 3.6.0-2.1 ## References: * https://www.suse.com/security/cve/CVE-2024-52531.html * https://www.suse.com/security/cve/CVE-2024-52532.html

1 0

openSUSE-SU-2024:14489-1: moderate: libsoup-2_4-1-2.74.3-4.1 on GA media
by meissner＠suse.com 15 Nov '24

15 Nov '24

# libsoup-2_4-1-2.74.3-4.1 on GA media Announcement ID: openSUSE-SU-2024:14489-1 Rating: moderate Cross-References: * CVE-2024-52530 * CVE-2024-52531 * CVE-2024-52532 CVSS scores: * CVE-2024-52530 ( SUSE ): 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N * CVE-2024-52530 ( SUSE ): 8.7 CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N * CVE-2024-52531 ( SUSE ): 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N * CVE-2024-52531 ( SUSE ): 8.7 CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N * CVE-2024-52532 ( SUSE ): 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H * CVE-2024-52532 ( SUSE ): 7.1 CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N Affected Products: * openSUSE Tumbleweed An update that solves 3 vulnerabilities can now be installed. ## Description: These are all security issues fixed in the libsoup-2_4-1-2.74.3-4.1 package on the GA media of openSUSE Tumbleweed. ## Package List: * openSUSE Tumbleweed: * libsoup-2_4-1 2.74.3-4.1 * libsoup-2_4-1-32bit 2.74.3-4.1 * libsoup2-devel 2.74.3-4.1 * libsoup2-devel-32bit 2.74.3-4.1 * libsoup2-lang 2.74.3-4.1 * typelib-1_0-Soup-2_4 2.74.3-4.1 ## References: * https://www.suse.com/security/cve/CVE-2024-52530.html * https://www.suse.com/security/cve/CVE-2024-52531.html * https://www.suse.com/security/cve/CVE-2024-52532.html

1 0

openSUSE-SU-2024:14490-1: moderate: libvirt-10.9.0-3.1 on GA media
by meissner＠suse.com 15 Nov '24

15 Nov '24

# libvirt-10.9.0-3.1 on GA media Announcement ID: openSUSE-SU-2024:14490-1 Rating: moderate Cross-References: * CVE-2020-12430 * CVE-2023-2700 CVSS scores: * CVE-2020-12430 ( SUSE ): 4.3 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L * CVE-2023-2700 ( SUSE ): 5 CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:N/I:N/A:H Affected Products: * openSUSE Tumbleweed An update that solves 2 vulnerabilities can now be installed. ## Description: These are all security issues fixed in the libvirt-10.9.0-3.1 package on the GA media of openSUSE Tumbleweed. ## Package List: * openSUSE Tumbleweed: * libvirt 10.9.0-3.1 * libvirt-client 10.9.0-3.1 * libvirt-client-qemu 10.9.0-3.1 * libvirt-daemon 10.9.0-3.1 * libvirt-daemon-common 10.9.0-3.1 * libvirt-daemon-config-network 10.9.0-3.1 * libvirt-daemon-config-nwfilter 10.9.0-3.1 * libvirt-daemon-driver-libxl 10.9.0-3.1 * libvirt-daemon-driver-lxc 10.9.0-3.1 * libvirt-daemon-driver-network 10.9.0-3.1 * libvirt-daemon-driver-nodedev 10.9.0-3.1 * libvirt-daemon-driver-nwfilter 10.9.0-3.1 * libvirt-daemon-driver-qemu 10.9.0-3.1 * libvirt-daemon-driver-secret 10.9.0-3.1 * libvirt-daemon-driver-storage 10.9.0-3.1 * libvirt-daemon-driver-storage-core 10.9.0-3.1 * libvirt-daemon-driver-storage-disk 10.9.0-3.1 * libvirt-daemon-driver-storage-gluster 10.9.0-3.1 * libvirt-daemon-driver-storage-iscsi 10.9.0-3.1 * libvirt-daemon-driver-storage-iscsi-direct 10.9.0-3.1 * libvirt-daemon-driver-storage-logical 10.9.0-3.1 * libvirt-daemon-driver-storage-mpath 10.9.0-3.1 * libvirt-daemon-driver-storage-rbd 10.9.0-3.1 * libvirt-daemon-driver-storage-scsi 10.9.0-3.1 * libvirt-daemon-hooks 10.9.0-3.1 * libvirt-daemon-lock 10.9.0-3.1 * libvirt-daemon-log 10.9.0-3.1 * libvirt-daemon-lxc 10.9.0-3.1 * libvirt-daemon-plugin-lockd 10.9.0-3.1 * libvirt-daemon-plugin-sanlock 10.9.0-3.1 * libvirt-daemon-proxy 10.9.0-3.1 * libvirt-daemon-qemu 10.9.0-3.1 * libvirt-daemon-xen 10.9.0-3.1 * libvirt-devel 10.9.0-3.1 * libvirt-doc 10.9.0-3.1 * libvirt-libs 10.9.0-3.1 * libvirt-nss 10.9.0-3.1 * libvirt-ssh-proxy 10.9.0-3.1 * wireshark-plugin-libvirt 10.9.0-3.1 ## References: * https://www.suse.com/security/cve/CVE-2020-12430.html * https://www.suse.com/security/cve/CVE-2023-2700.html

1 0

openSUSE-SU-2024:14487-1: moderate: gio-branding-upstream-2.82.2-2.1 on GA media
by meissner＠suse.com 15 Nov '24

15 Nov '24

# gio-branding-upstream-2.82.2-2.1 on GA media Announcement ID: openSUSE-SU-2024:14487-1 Rating: moderate Cross-References: * CVE-2024-52533 CVSS scores: * CVE-2024-52533 ( SUSE ): 7.1 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:H * CVE-2024-52533 ( SUSE ): 7 CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:N/VI:L/VA:H/SC:N/SI:N/SA:N Affected Products: * openSUSE Tumbleweed An update that solves one vulnerability can now be installed. ## Description: These are all security issues fixed in the gio-branding-upstream-2.82.2-2.1 package on the GA media of openSUSE Tumbleweed. ## Package List: * openSUSE Tumbleweed: * gio-branding-upstream 2.82.2-2.1 * glib2-devel 2.82.2-2.1 * glib2-devel-32bit 2.82.2-2.1 * glib2-devel-static 2.82.2-2.1 * glib2-lang 2.82.2-2.1 * glib2-tests-devel 2.82.2-2.1 * glib2-tools 2.82.2-2.1 * glib2-tools-32bit 2.82.2-2.1 * libgio-2_0-0 2.82.2-2.1 * libgio-2_0-0-32bit 2.82.2-2.1 * libgirepository-2_0-0 2.82.2-2.1 * libglib-2_0-0 2.82.2-2.1 * libglib-2_0-0-32bit 2.82.2-2.1 * libgmodule-2_0-0 2.82.2-2.1 * libgmodule-2_0-0-32bit 2.82.2-2.1 * libgobject-2_0-0 2.82.2-2.1 * libgobject-2_0-0-32bit 2.82.2-2.1 * libgthread-2_0-0 2.82.2-2.1 * libgthread-2_0-0-32bit 2.82.2-2.1 * typelib-1_0-GIRepository-3_0 2.82.2-2.1 * typelib-1_0-GLib-2_0 2.82.2-2.1 * typelib-1_0-GLibUnix-2_0 2.82.2-2.1 * typelib-1_0-GModule-2_0 2.82.2-2.1 * typelib-1_0-GObject-2_0 2.82.2-2.1 * typelib-1_0-Gio-2_0 2.82.2-2.1 ## References: * https://www.suse.com/security/cve/CVE-2024-52533.html

1 0

openSUSE-SU-2024:14492-1: moderate: wget-1.25.0-1.1 on GA media
by meissner＠suse.com 15 Nov '24

15 Nov '24

# wget-1.25.0-1.1 on GA media Announcement ID: openSUSE-SU-2024:14492-1 Rating: moderate Cross-References: * CVE-2024-10524 Affected Products: * openSUSE Tumbleweed An update that solves one vulnerability can now be installed. ## Description: These are all security issues fixed in the wget-1.25.0-1.1 package on the GA media of openSUSE Tumbleweed. ## Package List: * openSUSE Tumbleweed: * wget 1.25.0-1.1 * wget-lang 1.25.0-1.1 ## References: * https://www.suse.com/security/cve/CVE-2024-10524.html

1 0

SUSE-SU-2024:3999-1: important: Security update for apache2
by OPENSUSE-SECURITY-UPDATES 15 Nov '24

15 Nov '24

# Security update for apache2 Announcement ID: SUSE-SU-2024:3999-1 Release Date: 2024-11-15T13:35:34Z Rating: important References: * bsc#1233165 Cross-References: * CVE-2023-45802 CVSS scores: * CVE-2023-45802 ( SUSE ): 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H * CVE-2023-45802 ( NVD ): 5.9 CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H Affected Products: * Basesystem Module 15-SP5 * openSUSE Leap 15.4 * openSUSE Leap 15.5 * Server Applications Module 15-SP5 * Server Applications Module 15-SP6 * SUSE Linux Enterprise Desktop 15 SP4 LTSS 15-SP4 * SUSE Linux Enterprise Desktop 15 SP5 * SUSE Linux Enterprise High Performance Computing 15 SP4 * SUSE Linux Enterprise High Performance Computing 15 SP5 * SUSE Linux Enterprise High Performance Computing ESPOS 15 SP4 * SUSE Linux Enterprise High Performance Computing LTSS 15 SP4 * SUSE Linux Enterprise Micro 5.5 * SUSE Linux Enterprise Real Time 15 SP5 * SUSE Linux Enterprise Real Time 15 SP6 * SUSE Linux Enterprise Server 15 SP4 * SUSE Linux Enterprise Server 15 SP4 LTSS 15-SP4 * SUSE Linux Enterprise Server 15 SP5 * SUSE Linux Enterprise Server 15 SP6 * SUSE Linux Enterprise Server for SAP Applications 15 SP4 * SUSE Linux Enterprise Server for SAP Applications 15 SP5 * SUSE Linux Enterprise Server for SAP Applications 15 SP6 * SUSE Manager Proxy 4.3 * SUSE Manager Retail Branch Server 4.3 * SUSE Manager Server 4.3 * SUSE Package Hub 15 15-SP5 An update that solves one vulnerability can now be installed. ## Description: This update for apache2 fixes the following issues: * CVE-2023-45802: Fixed regression with previous fix (bsc#1233165). ## Patch Instructions: To install this SUSE update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: * SUSE Manager Proxy 4.3 zypper in -t patch SUSE-SLE-Product-SUSE-Manager-Proxy-4.3-2024-3999=1 * SUSE Manager Retail Branch Server 4.3 zypper in -t patch SUSE-SLE-Product-SUSE-Manager-Retail-Branch- Server-4.3-2024-3999=1 * SUSE Manager Server 4.3 zypper in -t patch SUSE-SLE-Product-SUSE-Manager-Server-4.3-2024-3999=1 * openSUSE Leap 15.4 zypper in -t patch SUSE-2024-3999=1 * openSUSE Leap 15.5 zypper in -t patch openSUSE-SLE-15.5-2024-3999=1 * Basesystem Module 15-SP5 zypper in -t patch SUSE-SLE-Module-Basesystem-15-SP5-2024-3999=1 * SUSE Package Hub 15 15-SP5 zypper in -t patch SUSE-SLE-Module-Packagehub-Subpackages-15-SP5-2024-3999=1 * Server Applications Module 15-SP5 zypper in -t patch SUSE-SLE-Module-Server-Applications-15-SP5-2024-3999=1 * Server Applications Module 15-SP6 zypper in -t patch SUSE-SLE-Module-Server-Applications-15-SP6-2024-3999=1 * SUSE Linux Enterprise High Performance Computing ESPOS 15 SP4 zypper in -t patch SUSE-SLE-Product-HPC-15-SP4-ESPOS-2024-3999=1 * SUSE Linux Enterprise High Performance Computing LTSS 15 SP4 zypper in -t patch SUSE-SLE-Product-HPC-15-SP4-LTSS-2024-3999=1 * SUSE Linux Enterprise Desktop 15 SP4 LTSS 15-SP4 zypper in -t patch SUSE-SLE-Product-SLED-15-SP4-LTSS-2024-3999=1 * SUSE Linux Enterprise Server 15 SP4 LTSS 15-SP4 zypper in -t patch SUSE-SLE-Product-SLES-15-SP4-LTSS-2024-3999=1 * SUSE Linux Enterprise Server for SAP Applications 15 SP4 zypper in -t patch SUSE-SLE-Product-SLES_SAP-15-SP4-2024-3999=1 ## Package List: * SUSE Manager Proxy 4.3 (x86_64) * apache2-utils-2.4.51-150400.6.43.1 * apache2-prefork-2.4.51-150400.6.43.1 * apache2-prefork-debuginfo-2.4.51-150400.6.43.1 * apache2-devel-2.4.51-150400.6.43.1 * apache2-worker-debuginfo-2.4.51-150400.6.43.1 * apache2-2.4.51-150400.6.43.1 * apache2-utils-debuginfo-2.4.51-150400.6.43.1 * apache2-worker-2.4.51-150400.6.43.1 * apache2-debuginfo-2.4.51-150400.6.43.1 * apache2-debugsource-2.4.51-150400.6.43.1 * SUSE Manager Proxy 4.3 (noarch) * apache2-doc-2.4.51-150400.6.43.1 * SUSE Manager Retail Branch Server 4.3 (x86_64) * apache2-utils-2.4.51-150400.6.43.1 * apache2-prefork-2.4.51-150400.6.43.1 * apache2-prefork-debuginfo-2.4.51-150400.6.43.1 * apache2-devel-2.4.51-150400.6.43.1 * apache2-worker-debuginfo-2.4.51-150400.6.43.1 * apache2-2.4.51-150400.6.43.1 * apache2-utils-debuginfo-2.4.51-150400.6.43.1 * apache2-worker-2.4.51-150400.6.43.1 * apache2-debuginfo-2.4.51-150400.6.43.1 * apache2-debugsource-2.4.51-150400.6.43.1 * SUSE Manager Retail Branch Server 4.3 (noarch) * apache2-doc-2.4.51-150400.6.43.1 * SUSE Manager Server 4.3 (ppc64le s390x x86_64) * apache2-utils-2.4.51-150400.6.43.1 * apache2-prefork-2.4.51-150400.6.43.1 * apache2-prefork-debuginfo-2.4.51-150400.6.43.1 * apache2-devel-2.4.51-150400.6.43.1 * apache2-worker-debuginfo-2.4.51-150400.6.43.1 * apache2-2.4.51-150400.6.43.1 * apache2-utils-debuginfo-2.4.51-150400.6.43.1 * apache2-worker-2.4.51-150400.6.43.1 * apache2-debuginfo-2.4.51-150400.6.43.1 * apache2-debugsource-2.4.51-150400.6.43.1 * SUSE Manager Server 4.3 (noarch) * apache2-doc-2.4.51-150400.6.43.1 * openSUSE Leap 15.4 (aarch64 ppc64le s390x x86_64 i586) * apache2-utils-2.4.51-150400.6.43.1 * apache2-prefork-2.4.51-150400.6.43.1 * apache2-prefork-debuginfo-2.4.51-150400.6.43.1 * apache2-devel-2.4.51-150400.6.43.1 * apache2-event-2.4.51-150400.6.43.1 * apache2-worker-debuginfo-2.4.51-150400.6.43.1 * apache2-2.4.51-150400.6.43.1 * apache2-example-pages-2.4.51-150400.6.43.1 * apache2-utils-debuginfo-2.4.51-150400.6.43.1 * apache2-worker-2.4.51-150400.6.43.1 * apache2-debuginfo-2.4.51-150400.6.43.1 * apache2-event-debuginfo-2.4.51-150400.6.43.1 * apache2-debugsource-2.4.51-150400.6.43.1 * openSUSE Leap 15.4 (noarch) * apache2-doc-2.4.51-150400.6.43.1 * openSUSE Leap 15.5 (aarch64 ppc64le s390x x86_64) * apache2-utils-2.4.51-150400.6.43.1 * apache2-prefork-2.4.51-150400.6.43.1 * apache2-prefork-debuginfo-2.4.51-150400.6.43.1 * apache2-devel-2.4.51-150400.6.43.1 * apache2-event-2.4.51-150400.6.43.1 * apache2-worker-debuginfo-2.4.51-150400.6.43.1 * apache2-2.4.51-150400.6.43.1 * apache2-example-pages-2.4.51-150400.6.43.1 * apache2-utils-debuginfo-2.4.51-150400.6.43.1 * apache2-worker-2.4.51-150400.6.43.1 * apache2-debuginfo-2.4.51-150400.6.43.1 * apache2-event-debuginfo-2.4.51-150400.6.43.1 * apache2-debugsource-2.4.51-150400.6.43.1 * openSUSE Leap 15.5 (noarch) * apache2-doc-2.4.51-150400.6.43.1 * Basesystem Module 15-SP5 (aarch64 ppc64le s390x x86_64) * apache2-utils-2.4.51-150400.6.43.1 * apache2-prefork-2.4.51-150400.6.43.1 * apache2-prefork-debuginfo-2.4.51-150400.6.43.1 * apache2-2.4.51-150400.6.43.1 * apache2-utils-debuginfo-2.4.51-150400.6.43.1 * apache2-debuginfo-2.4.51-150400.6.43.1 * apache2-debugsource-2.4.51-150400.6.43.1 * SUSE Package Hub 15 15-SP5 (aarch64 ppc64le s390x x86_64) * apache2-event-2.4.51-150400.6.43.1 * apache2-debuginfo-2.4.51-150400.6.43.1 * apache2-event-debuginfo-2.4.51-150400.6.43.1 * apache2-debugsource-2.4.51-150400.6.43.1 * Server Applications Module 15-SP5 (aarch64 ppc64le s390x x86_64) * apache2-devel-2.4.51-150400.6.43.1 * apache2-worker-debuginfo-2.4.51-150400.6.43.1 * apache2-worker-2.4.51-150400.6.43.1 * apache2-debuginfo-2.4.51-150400.6.43.1 * apache2-debugsource-2.4.51-150400.6.43.1 * Server Applications Module 15-SP5 (noarch) * apache2-doc-2.4.51-150400.6.43.1 * Server Applications Module 15-SP6 (noarch) * apache2-doc-2.4.51-150400.6.43.1 * SUSE Linux Enterprise High Performance Computing ESPOS 15 SP4 (aarch64 x86_64) * apache2-utils-2.4.51-150400.6.43.1 * apache2-prefork-2.4.51-150400.6.43.1 * apache2-prefork-debuginfo-2.4.51-150400.6.43.1 * apache2-devel-2.4.51-150400.6.43.1 * apache2-worker-debuginfo-2.4.51-150400.6.43.1 * apache2-2.4.51-150400.6.43.1 * apache2-utils-debuginfo-2.4.51-150400.6.43.1 * apache2-worker-2.4.51-150400.6.43.1 * apache2-debuginfo-2.4.51-150400.6.43.1 * apache2-debugsource-2.4.51-150400.6.43.1 * SUSE Linux Enterprise High Performance Computing ESPOS 15 SP4 (noarch) * apache2-doc-2.4.51-150400.6.43.1 * SUSE Linux Enterprise High Performance Computing LTSS 15 SP4 (aarch64 x86_64) * apache2-utils-2.4.51-150400.6.43.1 * apache2-prefork-2.4.51-150400.6.43.1 * apache2-prefork-debuginfo-2.4.51-150400.6.43.1 * apache2-devel-2.4.51-150400.6.43.1 * apache2-worker-debuginfo-2.4.51-150400.6.43.1 * apache2-2.4.51-150400.6.43.1 * apache2-utils-debuginfo-2.4.51-150400.6.43.1 * apache2-worker-2.4.51-150400.6.43.1 * apache2-debuginfo-2.4.51-150400.6.43.1 * apache2-debugsource-2.4.51-150400.6.43.1 * SUSE Linux Enterprise High Performance Computing LTSS 15 SP4 (noarch) * apache2-doc-2.4.51-150400.6.43.1 * SUSE Linux Enterprise Desktop 15 SP4 LTSS 15-SP4 (x86_64) * apache2-utils-2.4.51-150400.6.43.1 * apache2-prefork-2.4.51-150400.6.43.1 * apache2-prefork-debuginfo-2.4.51-150400.6.43.1 * apache2-2.4.51-150400.6.43.1 * apache2-utils-debuginfo-2.4.51-150400.6.43.1 * apache2-debuginfo-2.4.51-150400.6.43.1 * apache2-debugsource-2.4.51-150400.6.43.1 * SUSE Linux Enterprise Server 15 SP4 LTSS 15-SP4 (aarch64 ppc64le s390x x86_64) * apache2-utils-2.4.51-150400.6.43.1 * apache2-prefork-2.4.51-150400.6.43.1 * apache2-prefork-debuginfo-2.4.51-150400.6.43.1 * apache2-devel-2.4.51-150400.6.43.1 * apache2-worker-debuginfo-2.4.51-150400.6.43.1 * apache2-2.4.51-150400.6.43.1 * apache2-utils-debuginfo-2.4.51-150400.6.43.1 * apache2-worker-2.4.51-150400.6.43.1 * apache2-debuginfo-2.4.51-150400.6.43.1 * apache2-debugsource-2.4.51-150400.6.43.1 * SUSE Linux Enterprise Server 15 SP4 LTSS 15-SP4 (noarch) * apache2-doc-2.4.51-150400.6.43.1 * SUSE Linux Enterprise Server for SAP Applications 15 SP4 (ppc64le x86_64) * apache2-utils-2.4.51-150400.6.43.1 * apache2-prefork-2.4.51-150400.6.43.1 * apache2-prefork-debuginfo-2.4.51-150400.6.43.1 * apache2-devel-2.4.51-150400.6.43.1 * apache2-worker-debuginfo-2.4.51-150400.6.43.1 * apache2-2.4.51-150400.6.43.1 * apache2-utils-debuginfo-2.4.51-150400.6.43.1 * apache2-worker-2.4.51-150400.6.43.1 * apache2-debuginfo-2.4.51-150400.6.43.1 * apache2-debugsource-2.4.51-150400.6.43.1 * SUSE Linux Enterprise Server for SAP Applications 15 SP4 (noarch) * apache2-doc-2.4.51-150400.6.43.1 ## References: * https://www.suse.com/security/cve/CVE-2023-45802.html * https://bugzilla.suse.com/show_bug.cgi?id=1233165

1 0

SUSE-SU-2024:3997-1: moderate: Security update for python3-wxPython
by OPENSUSE-SECURITY-UPDATES 15 Nov '24

15 Nov '24

# Security update for python3-wxPython Announcement ID: SUSE-SU-2024:3997-1 Release Date: 2024-11-15T08:36:38Z Rating: moderate References: * bsc#1232590 Cross-References: * CVE-2024-50602 CVSS scores: * CVE-2024-50602 ( SUSE ): 5.6 CVSS:4.0/AV:L/AC:L/AT:P/PR:N/UI:A/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N * CVE-2024-50602 ( SUSE ): 5.5 CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H * CVE-2024-50602 ( NVD ): 5.9 CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H Affected Products: * openSUSE Leap 15.4 * openSUSE Leap 15.5 * openSUSE Leap 15.6 * SUSE Linux Enterprise Desktop 15 SP5 * SUSE Linux Enterprise Desktop 15 SP6 * SUSE Linux Enterprise High Performance Computing 15 SP5 * SUSE Linux Enterprise Micro 5.5 * SUSE Linux Enterprise Real Time 15 SP5 * SUSE Linux Enterprise Real Time 15 SP6 * SUSE Linux Enterprise Server 15 SP5 * SUSE Linux Enterprise Server 15 SP6 * SUSE Linux Enterprise Server for SAP Applications 15 SP5 * SUSE Linux Enterprise Server for SAP Applications 15 SP6 * SUSE Package Hub 15 15-SP5 * SUSE Package Hub 15 15-SP6 An update that solves one vulnerability can now be installed. ## Description: This update for python3-wxPython fixes the following issues: * CVE-2024-50602: Fixed a denial of service in the vendored libexpat's XML_ResumeParser function (bsc#1232590). ## Patch Instructions: To install this SUSE update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: * openSUSE Leap 15.4 zypper in -t patch SUSE-2024-3997=1 * openSUSE Leap 15.5 zypper in -t patch openSUSE-SLE-15.5-2024-3997=1 * openSUSE Leap 15.6 zypper in -t patch openSUSE-SLE-15.6-2024-3997=1 * SUSE Package Hub 15 15-SP5 zypper in -t patch SUSE-SLE-Module-Packagehub-Subpackages-15-SP5-2024-3997=1 * SUSE Package Hub 15 15-SP6 zypper in -t patch SUSE-SLE-Module-Packagehub-Subpackages-15-SP6-2024-3997=1 ## Package List: * openSUSE Leap 15.4 (aarch64 ppc64le s390x x86_64 i586) * python3-wxPython-debugsource-4.1.1-150400.10.1 * python3-wxPython-4.1.1-150400.10.1 * python3-wxPython-lang-4.1.1-150400.10.1 * python3-wxPython-debuginfo-4.1.1-150400.10.1 * openSUSE Leap 15.5 (aarch64 ppc64le s390x x86_64) * python3-wxPython-debugsource-4.1.1-150400.10.1 * python3-wxPython-4.1.1-150400.10.1 * python3-wxPython-lang-4.1.1-150400.10.1 * python3-wxPython-debuginfo-4.1.1-150400.10.1 * openSUSE Leap 15.6 (aarch64 ppc64le s390x x86_64) * python3-wxPython-debugsource-4.1.1-150400.10.1 * python3-wxPython-4.1.1-150400.10.1 * python3-wxPython-lang-4.1.1-150400.10.1 * python3-wxPython-debuginfo-4.1.1-150400.10.1 * SUSE Package Hub 15 15-SP5 (aarch64 ppc64le s390x x86_64) * python3-wxPython-debugsource-4.1.1-150400.10.1 * python3-wxPython-4.1.1-150400.10.1 * python3-wxPython-debuginfo-4.1.1-150400.10.1 * SUSE Package Hub 15 15-SP6 (aarch64 ppc64le s390x x86_64) * python3-wxPython-debugsource-4.1.1-150400.10.1 * python3-wxPython-4.1.1-150400.10.1 * python3-wxPython-debuginfo-4.1.1-150400.10.1 ## References: * https://www.suse.com/security/cve/CVE-2024-50602.html * https://bugzilla.suse.com/show_bug.cgi?id=1232590

1 0

SUSE-SU-2024:3988-1: important: Security update for buildah
by OPENSUSE-SECURITY-UPDATES 14 Nov '24

14 Nov '24

# Security update for buildah Announcement ID: SUSE-SU-2024:3988-1 Release Date: 2024-11-14T10:13:27Z Rating: important References: * bsc#1231208 * bsc#1231230 * bsc#1231499 * bsc#1231698 * bsc#1232522 Cross-References: * CVE-2024-9341 * CVE-2024-9407 * CVE-2024-9675 * CVE-2024-9676 CVSS scores: * CVE-2024-9341 ( SUSE ): 5.8 CVSS:4.0/AV:N/AC:H/AT:N/PR:L/UI:A/VC:H/VI:L/VA:N/SC:N/SI:N/SA:N * CVE-2024-9341 ( SUSE ): 5.4 CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:U/C:H/I:L/A:N * CVE-2024-9341 ( NVD ): 5.4 CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:U/C:H/I:L/A:N * CVE-2024-9407 ( SUSE ): 5.6 CVSS:4.0/AV:L/AC:L/AT:P/PR:N/UI:A/VC:H/VI:L/VA:N/SC:N/SI:N/SA:N * CVE-2024-9407 ( SUSE ): 5.3 CVSS:3.1/AV:L/AC:H/PR:N/UI:R/S:U/C:H/I:L/A:N * CVE-2024-9407 ( NVD ): 4.7 CVSS:3.1/AV:L/AC:H/PR:H/UI:N/S:U/C:H/I:L/A:N * CVE-2024-9675 ( SUSE ): 4.8 CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:N/SC:L/SI:L/SA:N * CVE-2024-9675 ( SUSE ): 4.4 CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N * CVE-2024-9675 ( NVD ): 4.4 CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N * CVE-2024-9676 ( SUSE ): 5.7 CVSS:4.0/AV:L/AC:L/AT:P/PR:N/UI:P/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N * CVE-2024-9676 ( SUSE ): 4.7 CVSS:3.1/AV:L/AC:H/PR:N/UI:R/S:U/C:N/I:N/A:H * CVE-2024-9676 ( NVD ): 6.5 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H Affected Products: * openSUSE Leap 15.4 * SUSE Linux Enterprise High Performance Computing 15 SP4 * SUSE Linux Enterprise High Performance Computing ESPOS 15 SP4 * SUSE Linux Enterprise High Performance Computing LTSS 15 SP4 * SUSE Linux Enterprise Server 15 SP4 * SUSE Linux Enterprise Server 15 SP4 LTSS 15-SP4 * SUSE Linux Enterprise Server for SAP Applications 15 SP4 An update that solves four vulnerabilities and has one security fix can now be installed. ## Description: This update for buildah fixes the following issues: * CVE-2024-9676: Fixed github.com/containers/storage: symlink traversal vulnerability in the containers/storage library can cause Denial of Service (DoS) (bsc#1231698): * CVE-2024-9675: VUL-0: CVE-2024-9675: buildah,podman: buildah: cache arbitrary directory mount (bsc#1231499): * CVE-2024-9407: Fixed improper input validation in bind-propagation Option of Dockerfile RUN --mount Instruction (bsc#1231208) * CVE-2024-9341: Fixed FIPS Crypto-Policy Directory Mounting Issue in containers/common Go Library (bsc#1231230) * Using networking slirp4netns as default instead of pasta on SLE (bsc#1232522). ## Patch Instructions: To install this SUSE update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: * openSUSE Leap 15.4 zypper in -t patch SUSE-2024-3988=1 * SUSE Linux Enterprise High Performance Computing ESPOS 15 SP4 zypper in -t patch SUSE-SLE-Product-HPC-15-SP4-ESPOS-2024-3988=1 * SUSE Linux Enterprise High Performance Computing LTSS 15 SP4 zypper in -t patch SUSE-SLE-Product-HPC-15-SP4-LTSS-2024-3988=1 * SUSE Linux Enterprise Server 15 SP4 LTSS 15-SP4 zypper in -t patch SUSE-SLE-Product-SLES-15-SP4-LTSS-2024-3988=1 * SUSE Linux Enterprise Server for SAP Applications 15 SP4 zypper in -t patch SUSE-SLE-Product-SLES_SAP-15-SP4-2024-3988=1 ## Package List: * openSUSE Leap 15.4 (aarch64 ppc64le s390x x86_64 i586) * buildah-1.35.4-150400.3.33.1 * SUSE Linux Enterprise High Performance Computing ESPOS 15 SP4 (aarch64 x86_64) * buildah-1.35.4-150400.3.33.1 * SUSE Linux Enterprise High Performance Computing LTSS 15 SP4 (aarch64 x86_64) * buildah-1.35.4-150400.3.33.1 * SUSE Linux Enterprise Server 15 SP4 LTSS 15-SP4 (aarch64 ppc64le s390x x86_64) * buildah-1.35.4-150400.3.33.1 * SUSE Linux Enterprise Server for SAP Applications 15 SP4 (ppc64le x86_64) * buildah-1.35.4-150400.3.33.1 ## References: * https://www.suse.com/security/cve/CVE-2024-9341.html * https://www.suse.com/security/cve/CVE-2024-9407.html * https://www.suse.com/security/cve/CVE-2024-9675.html * https://www.suse.com/security/cve/CVE-2024-9676.html * https://bugzilla.suse.com/show_bug.cgi?id=1231208 * https://bugzilla.suse.com/show_bug.cgi?id=1231230 * https://bugzilla.suse.com/show_bug.cgi?id=1231499 * https://bugzilla.suse.com/show_bug.cgi?id=1231698 * https://bugzilla.suse.com/show_bug.cgi?id=1232522

1 0

openSUSE-SU-2024:14486-1: moderate: switchboard-plug-bluetooth-8.0.1-1.1 on GA media
by meissner＠suse.com 13 Nov '24

13 Nov '24

# switchboard-plug-bluetooth-8.0.1-1.1 on GA media Announcement ID: openSUSE-SU-2024:14486-1 Rating: moderate Cross-References: * CVE-2021-21367 Affected Products: * openSUSE Tumbleweed An update that solves one vulnerability can now be installed. ## Description: These are all security issues fixed in the switchboard-plug-bluetooth-8.0.1-1.1 package on the GA media of openSUSE Tumbleweed. ## Package List: * openSUSE Tumbleweed: * switchboard-plug-bluetooth 8.0.1-1.1 * switchboard-plug-bluetooth-lang 8.0.1-1.1 ## References: * https://www.suse.com/security/cve/CVE-2021-21367.html

1 0