December 2024 - openSUSE Security Announce

openSUSE-SU-2024:14611-1: moderate: libQt6Pdf6-6.8.1-2.1 on GA media
by meissner＠suse.com 30 Dec '24

30 Dec '24

# libQt6Pdf6-6.8.1-2.1 on GA media Announcement ID: openSUSE-SU-2024:14611-1 Rating: moderate Cross-References: * CVE-2024-40896 CVSS scores: * CVE-2024-40896 ( SUSE ): 8.6 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:L * CVE-2024-40896 ( SUSE ): 8.8 CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:L/VA:L/SC:N/SI:N/SA:N Affected Products: * openSUSE Tumbleweed An update that solves one vulnerability can now be installed. ## Description: These are all security issues fixed in the libQt6Pdf6-6.8.1-2.1 package on the GA media of openSUSE Tumbleweed. ## Package List: * openSUSE Tumbleweed: * libQt6Pdf6 6.8.1-2.1 * libQt6PdfQuick6 6.8.1-2.1 * libQt6PdfWidgets6 6.8.1-2.1 * libQt6WebEngineCore6 6.8.1-2.1 * libQt6WebEngineQuick6 6.8.1-2.1 * libQt6WebEngineWidgets6 6.8.1-2.1 * qt6-pdf-devel 6.8.1-2.1 * qt6-pdf-imports 6.8.1-2.1 * qt6-pdf-private-devel 6.8.1-2.1 * qt6-pdfquick-devel 6.8.1-2.1 * qt6-pdfquick-private-devel 6.8.1-2.1 * qt6-pdfwidgets-devel 6.8.1-2.1 * qt6-pdfwidgets-private-devel 6.8.1-2.1 * qt6-webengine 6.8.1-2.1 * qt6-webengine-examples 6.8.1-2.1 * qt6-webengine-imports 6.8.1-2.1 * qt6-webenginecore-devel 6.8.1-2.1 * qt6-webenginecore-private-devel 6.8.1-2.1 * qt6-webenginequick-devel 6.8.1-2.1 * qt6-webenginequick-private-devel 6.8.1-2.1 * qt6-webenginewidgets-devel 6.8.1-2.1 * qt6-webenginewidgets-private-devel 6.8.1-2.1 ## References: * https://www.suse.com/security/cve/CVE-2024-40896.html

1 0

openSUSE-SU-2024:14610-1: moderate: assimp-devel-5.4.3-3.1 on GA media
by meissner＠suse.com 30 Dec '24

30 Dec '24

# assimp-devel-5.4.3-3.1 on GA media Announcement ID: openSUSE-SU-2024:14610-1 Rating: moderate Cross-References: * CVE-2024-48423 * CVE-2024-48424 * CVE-2024-48425 * CVE-2024-53425 CVSS scores: * CVE-2024-48423 ( SUSE ): 6.6 CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:H * CVE-2024-48424 ( SUSE ): 5.5 CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H * CVE-2024-48425 ( SUSE ): 5.5 CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H * CVE-2024-53425 ( SUSE ): 6.2 CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H Affected Products: * openSUSE Tumbleweed An update that solves 4 vulnerabilities can now be installed. ## Description: These are all security issues fixed in the assimp-devel-5.4.3-3.1 package on the GA media of openSUSE Tumbleweed. ## Package List: * openSUSE Tumbleweed: * assimp-devel 5.4.3-3.1 * libassimp5 5.4.3-3.1 ## References: * https://www.suse.com/security/cve/CVE-2024-48423.html * https://www.suse.com/security/cve/CVE-2024-48424.html * https://www.suse.com/security/cve/CVE-2024-48425.html * https://www.suse.com/security/cve/CVE-2024-53425.html

1 0

SUSE-SU-2024:4435-1: moderate: Security update for poppler
by OPENSUSE-SECURITY-UPDATES 30 Dec '24

30 Dec '24

# Security update for poppler Announcement ID: SUSE-SU-2024:4435-1 Release Date: 2024-12-30T13:23:04Z Rating: moderate References: * bsc#1234795 Cross-References: * CVE-2024-56378 CVSS scores: * CVE-2024-56378 ( SUSE ): 4.8 CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:L/SC:N/SI:N/SA:N * CVE-2024-56378 ( SUSE ): 4.4 CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:L * CVE-2024-56378 ( NVD ): 4.3 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N Affected Products: * Basesystem Module 15-SP6 * openSUSE Leap 15.6 * SUSE Linux Enterprise Desktop 15 SP6 * SUSE Linux Enterprise Real Time 15 SP6 * SUSE Linux Enterprise Server 15 SP6 * SUSE Linux Enterprise Server for SAP Applications 15 SP6 * SUSE Package Hub 15 15-SP6 An update that solves one vulnerability can now be installed. ## Description: This update for poppler fixes the following issues: * CVE-2024-56378: out-of-bounds read within JBIG2Bitmap::combine, which can lead to an application crash. (bsc#1234795) ## Patch Instructions: To install this SUSE update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: * openSUSE Leap 15.6 zypper in -t patch openSUSE-SLE-15.6-2024-4435=1 SUSE-2024-4435=1 * Basesystem Module 15-SP6 zypper in -t patch SUSE-SLE-Module-Basesystem-15-SP6-2024-4435=1 * SUSE Package Hub 15 15-SP6 zypper in -t patch SUSE-SLE-Module-Packagehub-Subpackages-15-SP6-2024-4435=1 ## Package List: * openSUSE Leap 15.6 (aarch64 ppc64le s390x x86_64 i586) * libpoppler-qt5-1-debuginfo-24.03.0-150600.3.5.1 * libpoppler-devel-24.03.0-150600.3.5.1 * libpoppler-qt5-devel-24.03.0-150600.3.5.1 * libpoppler-qt6-devel-24.03.0-150600.3.5.1 * libpoppler-qt6-3-24.03.0-150600.3.5.1 * libpoppler-glib8-24.03.0-150600.3.5.1 * libpoppler-qt5-1-24.03.0-150600.3.5.1 * poppler-tools-24.03.0-150600.3.5.1 * poppler-qt5-debugsource-24.03.0-150600.3.5.1 * libpoppler135-24.03.0-150600.3.5.1 * poppler-tools-debuginfo-24.03.0-150600.3.5.1 * poppler-qt6-debugsource-24.03.0-150600.3.5.1 * poppler-debugsource-24.03.0-150600.3.5.1 * libpoppler-cpp0-24.03.0-150600.3.5.1 * libpoppler-glib-devel-24.03.0-150600.3.5.1 * libpoppler-cpp0-debuginfo-24.03.0-150600.3.5.1 * typelib-1_0-Poppler-0_18-24.03.0-150600.3.5.1 * libpoppler135-debuginfo-24.03.0-150600.3.5.1 * libpoppler-qt6-3-debuginfo-24.03.0-150600.3.5.1 * libpoppler-glib8-debuginfo-24.03.0-150600.3.5.1 * openSUSE Leap 15.6 (x86_64) * libpoppler135-32bit-24.03.0-150600.3.5.1 * libpoppler135-32bit-debuginfo-24.03.0-150600.3.5.1 * libpoppler-qt5-1-32bit-24.03.0-150600.3.5.1 * libpoppler-glib8-32bit-debuginfo-24.03.0-150600.3.5.1 * libpoppler-cpp0-32bit-24.03.0-150600.3.5.1 * libpoppler-qt5-1-32bit-debuginfo-24.03.0-150600.3.5.1 * libpoppler-glib8-32bit-24.03.0-150600.3.5.1 * libpoppler-cpp0-32bit-debuginfo-24.03.0-150600.3.5.1 * openSUSE Leap 15.6 (aarch64_ilp32) * libpoppler-glib8-64bit-debuginfo-24.03.0-150600.3.5.1 * libpoppler-cpp0-64bit-24.03.0-150600.3.5.1 * libpoppler-cpp0-64bit-debuginfo-24.03.0-150600.3.5.1 * libpoppler135-64bit-24.03.0-150600.3.5.1 * libpoppler135-64bit-debuginfo-24.03.0-150600.3.5.1 * libpoppler-qt5-1-64bit-24.03.0-150600.3.5.1 * libpoppler-qt5-1-64bit-debuginfo-24.03.0-150600.3.5.1 * libpoppler-glib8-64bit-24.03.0-150600.3.5.1 * Basesystem Module 15-SP6 (aarch64 ppc64le s390x x86_64) * libpoppler-devel-24.03.0-150600.3.5.1 * poppler-tools-24.03.0-150600.3.5.1 * libpoppler-glib8-24.03.0-150600.3.5.1 * poppler-tools-debuginfo-24.03.0-150600.3.5.1 * libpoppler135-24.03.0-150600.3.5.1 * poppler-debugsource-24.03.0-150600.3.5.1 * libpoppler-cpp0-24.03.0-150600.3.5.1 * libpoppler-glib-devel-24.03.0-150600.3.5.1 * libpoppler-cpp0-debuginfo-24.03.0-150600.3.5.1 * typelib-1_0-Poppler-0_18-24.03.0-150600.3.5.1 * libpoppler135-debuginfo-24.03.0-150600.3.5.1 * libpoppler-glib8-debuginfo-24.03.0-150600.3.5.1 * SUSE Package Hub 15 15-SP6 (aarch64 ppc64le s390x x86_64) * libpoppler-qt5-1-debuginfo-24.03.0-150600.3.5.1 * libpoppler-devel-24.03.0-150600.3.5.1 * libpoppler-qt5-devel-24.03.0-150600.3.5.1 * libpoppler-qt6-devel-24.03.0-150600.3.5.1 * libpoppler-qt6-3-24.03.0-150600.3.5.1 * libpoppler-qt5-1-24.03.0-150600.3.5.1 * poppler-qt6-debugsource-24.03.0-150600.3.5.1 * poppler-debugsource-24.03.0-150600.3.5.1 * libpoppler-cpp0-24.03.0-150600.3.5.1 * libpoppler-cpp0-debuginfo-24.03.0-150600.3.5.1 * libpoppler-qt6-3-debuginfo-24.03.0-150600.3.5.1 * poppler-qt5-debugsource-24.03.0-150600.3.5.1 * SUSE Package Hub 15 15-SP6 (x86_64) * libpoppler-glib8-32bit-debuginfo-24.03.0-150600.3.5.1 * libpoppler135-32bit-24.03.0-150600.3.5.1 * libpoppler-glib8-32bit-24.03.0-150600.3.5.1 * libpoppler135-32bit-debuginfo-24.03.0-150600.3.5.1 ## References: * https://www.suse.com/security/cve/CVE-2024-56378.html * https://bugzilla.suse.com/show_bug.cgi?id=1234795

1 0

SUSE-SU-2024:4436-1: moderate: Security update for grpc
by OPENSUSE-SECURITY-UPDATES 30 Dec '24

30 Dec '24

# Security update for grpc Announcement ID: SUSE-SU-2024:4436-1 Release Date: 2024-12-30T13:23:26Z Rating: moderate References: * bsc#1228919 * bsc#1233821 Cross-References: * CVE-2024-11407 * CVE-2024-7246 CVSS scores: * CVE-2024-11407 ( SUSE ): 6.9 CVSS:4.0/AV:N/AC:H/AT:P/PR:L/UI:P/VC:N/VI:N/VA:H/SC:N/SI:N/SA:H/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:N/AU:N/R:A/V:X/RE:L/U:Green * CVE-2024-11407 ( SUSE ): 5.8 CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:C/C:N/I:N/A:H * CVE-2024-11407 ( NVD ): 6.9 CVSS:4.0/AV:N/AC:H/AT:P/PR:L/UI:P/VC:N/VI:N/VA:H/SC:N/SI:N/SA:H/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:N/AU:N/R:A/V:X/RE:L/U:Green * CVE-2024-7246 ( SUSE ): 6.3 CVSS:4.0/AV:N/AC:H/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:L * CVE-2024-7246 ( SUSE ): 5.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:N/A:L Affected Products: * Basesystem Module 15-SP5 * openSUSE Leap 15.5 * Public Cloud Module 15-SP5 * SUSE Linux Enterprise Desktop 15 SP5 * SUSE Linux Enterprise High Performance Computing 15 SP5 * SUSE Linux Enterprise Real Time 15 SP5 * SUSE Linux Enterprise Server 15 SP5 * SUSE Linux Enterprise Server for SAP Applications 15 SP5 An update that solves two vulnerabilities can now be installed. ## Description: This update for grpc fixes the following issues: * CVE-2024-7246: HPACK table poisoning by gRPC clients communicating with a HTTP/2 proxy. (bsc#1228919) * CVE-2024-11407: data corruption on servers with transmit zero copy enabled. (bsc#1233821) ## Patch Instructions: To install this SUSE update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: * openSUSE Leap 15.5 zypper in -t patch SUSE-2024-4436=1 openSUSE-SLE-15.5-2024-4436=1 * Basesystem Module 15-SP5 zypper in -t patch SUSE-SLE-Module-Basesystem-15-SP5-2024-4436=1 * Public Cloud Module 15-SP5 zypper in -t patch SUSE-SLE-Module-Public-Cloud-15-SP5-2024-4436=1 ## Package List: * openSUSE Leap 15.5 (aarch64 ppc64le s390x x86_64 i586) * grpc-devel-1.60.0-150500.11.8.1 * libupb37-1.60.0-150500.11.8.1 * libgrpc++1_60-1.60.0-150500.11.8.1 * libgrpc++1_60-debuginfo-1.60.0-150500.11.8.1 * libgrpc37-debuginfo-1.60.0-150500.11.8.1 * libgrpc1_60-1.60.0-150500.11.8.1 * upb-devel-1.60.0-150500.11.8.1 * libgrpc1_60-debuginfo-1.60.0-150500.11.8.1 * libupb37-debuginfo-1.60.0-150500.11.8.1 * grpc-devel-debuginfo-1.60.0-150500.11.8.1 * grpc-debuginfo-1.60.0-150500.11.8.1 * libgrpc37-1.60.0-150500.11.8.1 * grpc-debugsource-1.60.0-150500.11.8.1 * openSUSE Leap 15.5 (noarch) * grpc-source-1.60.0-150500.11.8.1 * Basesystem Module 15-SP5 (aarch64 ppc64le s390x x86_64) * grpc-devel-1.60.0-150500.11.8.1 * libupb37-1.60.0-150500.11.8.1 * libgrpc++1_60-1.60.0-150500.11.8.1 * libgrpc++1_60-debuginfo-1.60.0-150500.11.8.1 * libgrpc37-debuginfo-1.60.0-150500.11.8.1 * libgrpc1_60-1.60.0-150500.11.8.1 * libgrpc1_60-debuginfo-1.60.0-150500.11.8.1 * libupb37-debuginfo-1.60.0-150500.11.8.1 * grpc-debuginfo-1.60.0-150500.11.8.1 * libgrpc37-1.60.0-150500.11.8.1 * grpc-debugsource-1.60.0-150500.11.8.1 * Public Cloud Module 15-SP5 (aarch64 ppc64le s390x x86_64) * libupb37-1.60.0-150500.11.8.1 * libgrpc37-debuginfo-1.60.0-150500.11.8.1 * libgrpc1_60-1.60.0-150500.11.8.1 * libgrpc1_60-debuginfo-1.60.0-150500.11.8.1 * libupb37-debuginfo-1.60.0-150500.11.8.1 * grpc-debuginfo-1.60.0-150500.11.8.1 * libgrpc37-1.60.0-150500.11.8.1 * grpc-debugsource-1.60.0-150500.11.8.1 ## References: * https://www.suse.com/security/cve/CVE-2024-11407.html * https://www.suse.com/security/cve/CVE-2024-7246.html * https://bugzilla.suse.com/show_bug.cgi?id=1228919 * https://bugzilla.suse.com/show_bug.cgi?id=1233821

1 0

SUSE-SU-2024:4433-1: moderate: Security update for govulncheck-vulndb
by OPENSUSE-SECURITY-UPDATES 30 Dec '24

30 Dec '24

# Security update for govulncheck-vulndb Announcement ID: SUSE-SU-2024:4433-1 Release Date: 2024-12-30T08:24:02Z Rating: moderate References: * jsc#PED-11136 Affected Products: * openSUSE Leap 15.5 * openSUSE Leap 15.6 * SUSE Linux Enterprise Desktop 15 SP5 * SUSE Linux Enterprise Desktop 15 SP6 * SUSE Linux Enterprise High Performance Computing 15 SP5 * SUSE Linux Enterprise Micro 5.5 * SUSE Linux Enterprise Real Time 15 SP5 * SUSE Linux Enterprise Real Time 15 SP6 * SUSE Linux Enterprise Server 15 SP5 * SUSE Linux Enterprise Server 15 SP6 * SUSE Linux Enterprise Server for SAP Applications 15 SP5 * SUSE Linux Enterprise Server for SAP Applications 15 SP6 * SUSE Package Hub 15 15-SP5 * SUSE Package Hub 15 15-SP6 An update that contains one feature can now be installed. ## Description: This update for govulncheck-vulndb fixes the following issues: * Update to version 0.0.20241218T202206 2024-12-18T20:22:06Z. (jsc#PED-11136) Go CVE Numbering Authority IDs added or updated with aliases: * GO-2024-3333 * Update to version 0.0.20241218T163557 2024-12-18T16:35:57Z. (jsc#PED-11136) Go CVE Numbering Authority IDs added or updated with aliases: * GO-2024-3331 GHSA-9j3m-fr7q-jxfw * GO-2024-3334 GHSA-qqc8-rv37-79q5 * GO-2024-3335 GHSA-xx83-cxmq-x89m * GO-2024-3336 GHSA-cwq8-g58r-32hg * GO-2024-3337 GHSA-69pr-78gv-7c6h * GO-2024-3338 GHSA-826h-p4c3-477p * GO-2024-3339 GHSA-8wcc-m6j2-qxvm * GO-2024-3340 GHSA-v647-h8jj-fw5r * Update to version 0.0.20241213T205935 2024-12-13T20:59:35Z. (jsc#PED-11136) Go CVE Numbering Authority IDs added or updated with aliases: * GO-2022-0635 GHSA-7f33-f4f5-xwgw * GO-2022-0646 GHSA-f5pg-7wfw-84q9 * GO-2022-0828 GHSA-fx8w-mjvm-hvpc * GO-2023-2170 GHSA-q78c-gwqw-jcmc * GO-2023-2330 GHSA-7fxm-f474-hf8w * GO-2024-2901 GHSA-8hqg-whrw-pv92 * GO-2024-3104 GHSA-846m-99qv-67mg * GO-2024-3122 GHSA-q3hw-3gm4-w5cr * GO-2024-3140 GHSA-xxxw-3j6h-q7h6 * GO-2024-3169 GHSA-fhqq-8f65-5xfc * GO-2024-3186 GHSA-586p-749j-fhwp * GO-2024-3205 GHSA-xhr3-wf7j-h255 * GO-2024-3218 GHSA-mqr9-hjr8-2m9w * GO-2024-3245 GHSA-95j2-w8x7-hm88 * GO-2024-3248 GHSA-p26r-gfgc-c47h * GO-2024-3259 GHSA-p7mv-53f2-4cwj * GO-2024-3265 GHSA-gppm-hq3p-h4rp * GO-2024-3268 GHSA-r864-28pw-8682 * GO-2024-3279 GHSA-7225-m954-23v7 * GO-2024-3282 GHSA-r4pg-vg54-wxx4 * GO-2024-3286 GHSA-27wf-5967-98gx * GO-2024-3293 * GO-2024-3295 GHSA-55v3-xh23-96gh * GO-2024-3302 GHSA-px8v-pp82-rcvr * GO-2024-3306 GHSA-7mwh-q3xm-qh6p * GO-2024-3312 GHSA-4c49-9fpc-hc3v * GO-2024-3313 GHSA-jpmc-7p9c-4rxf * GO-2024-3314 GHSA-c2xf-9v2r-r2rx * GO-2024-3315 * GO-2024-3319 GHSA-vmg2-r3xv-r3xf * GO-2024-3321 GHSA-v778-237x-gjrc * GO-2024-3323 GHSA-25w9-wqfq-gwqx * GO-2024-3324 GHSA-4pjc-pwgq-q9jp * GO-2024-3325 GHSA-c7xh-gjv4-4jgv * GO-2024-3326 GHSA-fqj6-whhx-47p7 * GO-2024-3327 GHSA-xx68-37v4-4596 * GO-2024-3330 GHSA-7prj-hgx4-2xc3 ## Patch Instructions: To install this SUSE update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: * openSUSE Leap 15.5 zypper in -t patch openSUSE-SLE-15.5-2024-4433=1 * openSUSE Leap 15.6 zypper in -t patch openSUSE-SLE-15.6-2024-4433=1 * SUSE Package Hub 15 15-SP5 zypper in -t patch SUSE-SLE-Module-Packagehub-Subpackages-15-SP5-2024-4433=1 * SUSE Package Hub 15 15-SP6 zypper in -t patch SUSE-SLE-Module-Packagehub-Subpackages-15-SP6-2024-4433=1 ## Package List: * openSUSE Leap 15.5 (noarch) * govulncheck-vulndb-0.0.20241218T202206-150000.1.23.1 * openSUSE Leap 15.6 (noarch) * govulncheck-vulndb-0.0.20241218T202206-150000.1.23.1 * SUSE Package Hub 15 15-SP5 (noarch) * govulncheck-vulndb-0.0.20241218T202206-150000.1.23.1 * SUSE Package Hub 15 15-SP6 (noarch) * govulncheck-vulndb-0.0.20241218T202206-150000.1.23.1 ## References: * https://jira.suse.com/browse/PED-11136

1 0

openSUSE-SU-2024:0417-1: important: Security update for chromium
by opensuse-security＠opensuse.org 28 Dec '24

28 Dec '24

openSUSE Security Update: Security update for chromium ______________________________________________________________________________ Announcement ID: openSUSE-SU-2024:0417-1 Rating: important References: Affected Products: openSUSE Backports SLE-15-SP5 openSUSE Backports SLE-15-SP6 ______________________________________________________________________________ An update that contains security fixes can now be installed. Description: This security update for Chromium to version 131.0.6778.204 (boo#1234704) fixes: * CVE-2024-12692: Type Confusion in V8 * CVE-2024-12693: Out of bounds memory access in V8 * CVE-2024-12694: Use after free in Compositing * CVE-2024-12695: Out of bounds write in V8 * Various fixes from internal audits, fuzzing and other initiatives Patch Instructions: To install this openSUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Backports SLE-15-SP6: zypper in -t patch openSUSE-2024-417=1 - openSUSE Backports SLE-15-SP5: zypper in -t patch openSUSE-2024-417=1 Package List: - openSUSE Backports SLE-15-SP6 (aarch64 x86_64): chromedriver-131.0.6778.204-bp156.2.65.1 chromedriver-debuginfo-131.0.6778.204-bp156.2.65.1 chromium-131.0.6778.204-bp156.2.65.1 chromium-debuginfo-131.0.6778.204-bp156.2.65.1 - openSUSE Backports SLE-15-SP5 (aarch64 x86_64): chromedriver-131.0.6778.204-bp155.2.153.1 chromium-131.0.6778.204-bp155.2.153.1 References:

1 0

SUSE-SU-2024:4428-1: moderate: Security update for python-grpcio
by OPENSUSE-SECURITY-UPDATES 27 Dec '24

27 Dec '24

# Security update for python-grpcio Announcement ID: SUSE-SU-2024:4428-1 Release Date: 2024-12-27T10:16:24Z Rating: moderate References: * bsc#1228919 * bsc#1233821 Cross-References: * CVE-2024-11407 * CVE-2024-7246 CVSS scores: * CVE-2024-11407 ( SUSE ): 6.9 CVSS:4.0/AV:N/AC:H/AT:P/PR:L/UI:P/VC:N/VI:N/VA:H/SC:N/SI:N/SA:H/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:N/AU:N/R:A/V:X/RE:L/U:Green * CVE-2024-11407 ( SUSE ): 5.8 CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:C/C:N/I:N/A:H * CVE-2024-11407 ( NVD ): 6.9 CVSS:4.0/AV:N/AC:H/AT:P/PR:L/UI:P/VC:N/VI:N/VA:H/SC:N/SI:N/SA:H/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:N/AU:N/R:A/V:X/RE:L/U:Green * CVE-2024-7246 ( SUSE ): 6.3 CVSS:4.0/AV:N/AC:H/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:L * CVE-2024-7246 ( SUSE ): 5.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:N/A:L Affected Products: * openSUSE Leap 15.4 * Public Cloud Module 15-SP4 * SUSE Linux Enterprise High Performance Computing 15 SP4 * SUSE Linux Enterprise Server 15 SP4 * SUSE Linux Enterprise Server for SAP Applications 15 SP4 * SUSE Manager Proxy 4.3 * SUSE Manager Retail Branch Server 4.3 * SUSE Manager Server 4.3 An update that solves two vulnerabilities can now be installed. ## Description: This update for python-grpcio fixes the following issues: * CVE-2024-11407: data corruption on servers with transmit zero copy enabled. (bsc#1233821) * CVE-2024-7246: HPACK table poisoning by gRPC clients communicating with a HTTP/2 proxy. (bsc#1228919) ## Patch Instructions: To install this SUSE update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: * openSUSE Leap 15.4 zypper in -t patch SUSE-2024-4428=1 * Public Cloud Module 15-SP4 zypper in -t patch SUSE-SLE-Module-Public-Cloud-15-SP4-2024-4428=1 ## Package List: * openSUSE Leap 15.4 (aarch64 ppc64le s390x x86_64 i586) * python-grpcio-debugsource-1.60.1-150400.9.10.1 * python311-grpcio-1.60.1-150400.9.10.1 * python311-grpcio-debuginfo-1.60.1-150400.9.10.1 * Public Cloud Module 15-SP4 (aarch64 ppc64le s390x x86_64) * python-grpcio-debugsource-1.60.1-150400.9.10.1 * python311-grpcio-1.60.1-150400.9.10.1 * python311-grpcio-debuginfo-1.60.1-150400.9.10.1 ## References: * https://www.suse.com/security/cve/CVE-2024-11407.html * https://www.suse.com/security/cve/CVE-2024-7246.html * https://bugzilla.suse.com/show_bug.cgi?id=1228919 * https://bugzilla.suse.com/show_bug.cgi?id=1233821

1 0

SUSE-SU-2024:4429-1: moderate: Security update for python-grpcio
by OPENSUSE-SECURITY-UPDATES 27 Dec '24

27 Dec '24

# Security update for python-grpcio Announcement ID: SUSE-SU-2024:4429-1 Release Date: 2024-12-27T10:16:46Z Rating: moderate References: * bsc#1228919 * bsc#1233821 Cross-References: * CVE-2024-11407 * CVE-2024-7246 CVSS scores: * CVE-2024-11407 ( SUSE ): 6.9 CVSS:4.0/AV:N/AC:H/AT:P/PR:L/UI:P/VC:N/VI:N/VA:H/SC:N/SI:N/SA:H/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:N/AU:N/R:A/V:X/RE:L/U:Green * CVE-2024-11407 ( SUSE ): 5.8 CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:C/C:N/I:N/A:H * CVE-2024-11407 ( NVD ): 6.9 CVSS:4.0/AV:N/AC:H/AT:P/PR:L/UI:P/VC:N/VI:N/VA:H/SC:N/SI:N/SA:H/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:N/AU:N/R:A/V:X/RE:L/U:Green * CVE-2024-7246 ( SUSE ): 6.3 CVSS:4.0/AV:N/AC:H/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:L * CVE-2024-7246 ( SUSE ): 5.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:N/A:L Affected Products: * openSUSE Leap 15.5 * Public Cloud Module 15-SP5 * Python 3 Module 15-SP5 * SUSE Linux Enterprise Desktop 15 SP5 * SUSE Linux Enterprise High Performance Computing 15 SP5 * SUSE Linux Enterprise Server 15 SP5 * SUSE Linux Enterprise Server for SAP Applications 15 SP5 An update that solves two vulnerabilities can now be installed. ## Description: This update for python-grpcio fixes the following issues: * CVE-2024-11407: data corruption on servers with transmit zero copy enabled. (bsc#1233821) * CVE-2024-7246: HPACK table poisoning by gRPC clients communicating with a HTTP/2 proxy. (bsc#1228919) ## Patch Instructions: To install this SUSE update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: * openSUSE Leap 15.5 zypper in -t patch SUSE-2024-4429=1 openSUSE-SLE-15.5-2024-4429=1 * Public Cloud Module 15-SP5 zypper in -t patch SUSE-SLE-Module-Public-Cloud-15-SP5-2024-4429=1 * Python 3 Module 15-SP5 zypper in -t patch SUSE-SLE-Module-Python3-15-SP5-2024-4429=1 ## Package List: * openSUSE Leap 15.5 (aarch64 ppc64le s390x x86_64 i586) * python311-grpcio-debuginfo-1.60.1-150500.12.6.1 * python-grpcio-debugsource-1.60.1-150500.12.6.1 * python311-grpcio-1.60.1-150500.12.6.1 * Public Cloud Module 15-SP5 (aarch64 ppc64le s390x x86_64) * python311-grpcio-debuginfo-1.60.1-150500.12.6.1 * python-grpcio-debugsource-1.60.1-150500.12.6.1 * python311-grpcio-1.60.1-150500.12.6.1 * Python 3 Module 15-SP5 (aarch64 ppc64le s390x x86_64) * python311-grpcio-debuginfo-1.60.1-150500.12.6.1 * python-grpcio-debugsource-1.60.1-150500.12.6.1 * python311-grpcio-1.60.1-150500.12.6.1 ## References: * https://www.suse.com/security/cve/CVE-2024-11407.html * https://www.suse.com/security/cve/CVE-2024-7246.html * https://bugzilla.suse.com/show_bug.cgi?id=1228919 * https://bugzilla.suse.com/show_bug.cgi?id=1233821

1 0

SUSE-SU-2024:4421-1: moderate: Security update for poppler
by OPENSUSE-SECURITY-UPDATES 24 Dec '24

24 Dec '24

# Security update for poppler Announcement ID: SUSE-SU-2024:4421-1 Release Date: 2024-12-24T12:40:42Z Rating: moderate References: * bsc#1234795 Cross-References: * CVE-2024-56378 CVSS scores: * CVE-2024-56378 ( SUSE ): 4.8 CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:L/SC:N/SI:N/SA:N * CVE-2024-56378 ( SUSE ): 4.4 CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:L Affected Products: * openSUSE Leap 15.4 An update that solves one vulnerability can now be installed. ## Description: This update for poppler fixes the following issues: * CVE-2024-56378: Fixed out-of-bounds read vulnerability within the JBIG2Bitmap::combine function in JBIG2Stream.cc (bsc#1234795) ## Patch Instructions: To install this SUSE update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: * openSUSE Leap 15.4 zypper in -t patch SUSE-2024-4421=1 ## Package List: * openSUSE Leap 15.4 (aarch64 ppc64le s390x x86_64 i586) * libpoppler-qt5-1-debuginfo-22.01.0-150400.3.25.1 * libpoppler117-debuginfo-22.01.0-150400.3.25.1 * poppler-debugsource-22.01.0-150400.3.25.1 * libpoppler-glib8-22.01.0-150400.3.25.1 * libpoppler-cpp0-debuginfo-22.01.0-150400.3.25.1 * libpoppler-glib8-debuginfo-22.01.0-150400.3.25.1 * typelib-1_0-Poppler-0_18-22.01.0-150400.3.25.1 * libpoppler-qt6-3-debuginfo-22.01.0-150400.3.25.1 * poppler-tools-debuginfo-22.01.0-150400.3.25.1 * libpoppler-qt5-1-22.01.0-150400.3.25.1 * libpoppler-glib-devel-22.01.0-150400.3.25.1 * libpoppler117-22.01.0-150400.3.25.1 * poppler-tools-22.01.0-150400.3.25.1 * libpoppler-qt6-3-22.01.0-150400.3.25.1 * libpoppler-qt6-devel-22.01.0-150400.3.25.1 * poppler-qt6-debugsource-22.01.0-150400.3.25.1 * libpoppler-qt5-devel-22.01.0-150400.3.25.1 * poppler-qt5-debugsource-22.01.0-150400.3.25.1 * libpoppler-devel-22.01.0-150400.3.25.1 * libpoppler-cpp0-22.01.0-150400.3.25.1 * openSUSE Leap 15.4 (x86_64) * libpoppler-qt5-1-32bit-22.01.0-150400.3.25.1 * libpoppler-qt5-1-32bit-debuginfo-22.01.0-150400.3.25.1 * libpoppler-cpp0-32bit-debuginfo-22.01.0-150400.3.25.1 * libpoppler117-32bit-debuginfo-22.01.0-150400.3.25.1 * libpoppler117-32bit-22.01.0-150400.3.25.1 * libpoppler-glib8-32bit-22.01.0-150400.3.25.1 * libpoppler-cpp0-32bit-22.01.0-150400.3.25.1 * libpoppler-glib8-32bit-debuginfo-22.01.0-150400.3.25.1 * openSUSE Leap 15.4 (aarch64_ilp32) * libpoppler117-64bit-22.01.0-150400.3.25.1 * libpoppler-glib8-64bit-debuginfo-22.01.0-150400.3.25.1 * libpoppler-glib8-64bit-22.01.0-150400.3.25.1 * libpoppler-qt5-1-64bit-22.01.0-150400.3.25.1 * libpoppler-qt5-1-64bit-debuginfo-22.01.0-150400.3.25.1 * libpoppler117-64bit-debuginfo-22.01.0-150400.3.25.1 * libpoppler-cpp0-64bit-debuginfo-22.01.0-150400.3.25.1 * libpoppler-cpp0-64bit-22.01.0-150400.3.25.1 ## References: * https://www.suse.com/security/cve/CVE-2024-56378.html * https://bugzilla.suse.com/show_bug.cgi?id=1234795

1 0

SUSE-SU-2024:4422-1: moderate: Security update for poppler
by OPENSUSE-SECURITY-UPDATES 24 Dec '24

24 Dec '24

# Security update for poppler Announcement ID: SUSE-SU-2024:4422-1 Release Date: 2024-12-24T12:40:53Z Rating: moderate References: * bsc#1234795 Cross-References: * CVE-2024-56378 CVSS scores: * CVE-2024-56378 ( SUSE ): 4.8 CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:L/SC:N/SI:N/SA:N * CVE-2024-56378 ( SUSE ): 4.4 CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:L Affected Products: * openSUSE Leap 15.5 An update that solves one vulnerability can now be installed. ## Description: This update for poppler fixes the following issues: * CVE-2024-56378: out-of-bounds read within JBIG2Bitmap::combine, which can lead to an application crash. (bsc#1234795) ## Patch Instructions: To install this SUSE update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: * openSUSE Leap 15.5 zypper in -t patch SUSE-2024-4422=1 openSUSE-SLE-15.5-2024-4422=1 ## Package List: * openSUSE Leap 15.5 (aarch64 ppc64le s390x x86_64 i586) * libpoppler-devel-23.01.0-150500.3.14.1 * libpoppler126-debuginfo-23.01.0-150500.3.14.1 * poppler-qt5-debugsource-23.01.0-150500.3.14.1 * libpoppler-qt6-3-23.01.0-150500.3.14.1 * libpoppler-glib8-23.01.0-150500.3.14.1 * libpoppler-qt6-devel-23.01.0-150500.3.14.1 * libpoppler126-23.01.0-150500.3.14.1 * typelib-1_0-Poppler-0_18-23.01.0-150500.3.14.1 * poppler-qt6-debugsource-23.01.0-150500.3.14.1 * libpoppler-qt5-1-debuginfo-23.01.0-150500.3.14.1 * poppler-tools-23.01.0-150500.3.14.1 * libpoppler-qt6-3-debuginfo-23.01.0-150500.3.14.1 * libpoppler-cpp0-debuginfo-23.01.0-150500.3.14.1 * libpoppler-glib-devel-23.01.0-150500.3.14.1 * poppler-tools-debuginfo-23.01.0-150500.3.14.1 * libpoppler-cpp0-23.01.0-150500.3.14.1 * libpoppler-qt5-1-23.01.0-150500.3.14.1 * poppler-debugsource-23.01.0-150500.3.14.1 * libpoppler-glib8-debuginfo-23.01.0-150500.3.14.1 * libpoppler-qt5-devel-23.01.0-150500.3.14.1 * openSUSE Leap 15.5 (x86_64) * libpoppler126-32bit-debuginfo-23.01.0-150500.3.14.1 * libpoppler-cpp0-32bit-debuginfo-23.01.0-150500.3.14.1 * libpoppler-qt5-1-32bit-debuginfo-23.01.0-150500.3.14.1 * libpoppler-cpp0-32bit-23.01.0-150500.3.14.1 * libpoppler126-32bit-23.01.0-150500.3.14.1 * libpoppler-qt5-1-32bit-23.01.0-150500.3.14.1 * libpoppler-glib8-32bit-23.01.0-150500.3.14.1 * libpoppler-glib8-32bit-debuginfo-23.01.0-150500.3.14.1 * openSUSE Leap 15.5 (aarch64_ilp32) * libpoppler126-64bit-debuginfo-23.01.0-150500.3.14.1 * libpoppler-qt5-1-64bit-23.01.0-150500.3.14.1 * libpoppler-qt5-1-64bit-debuginfo-23.01.0-150500.3.14.1 * libpoppler-cpp0-64bit-debuginfo-23.01.0-150500.3.14.1 * libpoppler126-64bit-23.01.0-150500.3.14.1 * libpoppler-cpp0-64bit-23.01.0-150500.3.14.1 * libpoppler-glib8-64bit-debuginfo-23.01.0-150500.3.14.1 * libpoppler-glib8-64bit-23.01.0-150500.3.14.1 ## References: * https://www.suse.com/security/cve/CVE-2024-56378.html * https://bugzilla.suse.com/show_bug.cgi?id=1234795

1 0