February 2024 - openSUSE Security Announce

SUSE-SU-2024:0473-1: important: Security update for tomcat10
by OPENSUSE-SECURITY-UPDATES 14 Feb '24

14 Feb '24

# Security update for tomcat10 Announcement ID: SUSE-SU-2024:0473-1 Rating: important References: * bsc#1219208 Cross-References: * CVE-2024-22029 CVSS scores: * CVE-2024-22029 ( SUSE ): 7.8 CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H Affected Products: * openSUSE Leap 15.5 * SUSE Linux Enterprise High Performance Computing 15 SP5 * SUSE Linux Enterprise Server 15 SP5 * SUSE Linux Enterprise Server for SAP Applications 15 SP5 * Web and Scripting Module 15-SP5 An update that solves one vulnerability can now be installed. ## Description: This update for tomcat10 fixes the following issues: * CVE-2024-22029: Fixed escalation to root from tomcat user via %post script. (bsc#1219208) ## Patch Instructions: To install this SUSE update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: * openSUSE Leap 15.5 zypper in -t patch openSUSE-SLE-15.5-2024-473=1 * Web and Scripting Module 15-SP5 zypper in -t patch SUSE-SLE-Module-Web-Scripting-15-SP5-2024-473=1 ## Package List: * openSUSE Leap 15.5 (noarch) * tomcat10-admin-webapps-10.1.18-150200.5.11.1 * tomcat10-el-5_0-api-10.1.18-150200.5.11.1 * tomcat10-docs-webapp-10.1.18-150200.5.11.1 * tomcat10-jsp-3_1-api-10.1.18-150200.5.11.1 * tomcat10-10.1.18-150200.5.11.1 * tomcat10-lib-10.1.18-150200.5.11.1 * tomcat10-webapps-10.1.18-150200.5.11.1 * tomcat10-embed-10.1.18-150200.5.11.1 * tomcat10-servlet-6_0-api-10.1.18-150200.5.11.1 * tomcat10-jsvc-10.1.18-150200.5.11.1 * Web and Scripting Module 15-SP5 (noarch) * tomcat10-admin-webapps-10.1.18-150200.5.11.1 * tomcat10-el-5_0-api-10.1.18-150200.5.11.1 * tomcat10-jsp-3_1-api-10.1.18-150200.5.11.1 * tomcat10-lib-10.1.18-150200.5.11.1 * tomcat10-10.1.18-150200.5.11.1 * tomcat10-webapps-10.1.18-150200.5.11.1 * tomcat10-servlet-6_0-api-10.1.18-150200.5.11.1 ## References: * https://www.suse.com/security/cve/CVE-2024-22029.html * https://bugzilla.suse.com/show_bug.cgi?id=1219208

1 0

SUSE-SU-2024:0459-1: important: Security update for runc
by OPENSUSE-SECURITY-UPDATES 13 Feb '24

13 Feb '24

# Security update for runc Announcement ID: SUSE-SU-2024:0459-1 Rating: important References: * bsc#1218894 Cross-References: * CVE-2024-21626 CVSS scores: * CVE-2024-21626 ( SUSE ): 8.6 CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H * CVE-2024-21626 ( NVD ): 8.6 CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H Affected Products: * Containers Module 15-SP4 * Containers Module 15-SP5 * openSUSE Leap 15.5 * openSUSE Leap Micro 5.3 * openSUSE Leap Micro 5.4 * SUSE Enterprise Storage 7.1 * SUSE Linux Enterprise High Performance Computing 15 SP2 * SUSE Linux Enterprise High Performance Computing 15 SP2 LTSS 15-SP2 * SUSE Linux Enterprise High Performance Computing 15 SP3 * SUSE Linux Enterprise High Performance Computing 15 SP4 * SUSE Linux Enterprise High Performance Computing 15 SP5 * SUSE Linux Enterprise High Performance Computing ESPOS 15 SP4 * SUSE Linux Enterprise High Performance Computing LTSS 15 SP3 * SUSE Linux Enterprise High Performance Computing LTSS 15 SP4 * SUSE Linux Enterprise Micro 5.1 * SUSE Linux Enterprise Micro 5.2 * SUSE Linux Enterprise Micro 5.3 * SUSE Linux Enterprise Micro 5.4 * SUSE Linux Enterprise Micro 5.5 * SUSE Linux Enterprise Micro for Rancher 5.2 * SUSE Linux Enterprise Micro for Rancher 5.3 * SUSE Linux Enterprise Micro for Rancher 5.4 * SUSE Linux Enterprise Real Time 15 SP4 * SUSE Linux Enterprise Real Time 15 SP5 * SUSE Linux Enterprise Server 15 SP2 * SUSE Linux Enterprise Server 15 SP2 LTSS 15-SP2 * SUSE Linux Enterprise Server 15 SP3 * SUSE Linux Enterprise Server 15 SP3 LTSS 15-SP3 * SUSE Linux Enterprise Server 15 SP4 * SUSE Linux Enterprise Server 15 SP4 LTSS 15-SP4 * SUSE Linux Enterprise Server 15 SP5 * SUSE Linux Enterprise Server for SAP Applications 15 SP2 * SUSE Linux Enterprise Server for SAP Applications 15 SP3 * SUSE Linux Enterprise Server for SAP Applications 15 SP4 * SUSE Linux Enterprise Server for SAP Applications 15 SP5 * SUSE Manager Proxy 4.3 * SUSE Manager Retail Branch Server 4.3 * SUSE Manager Server 4.3 An update that solves one vulnerability can now be installed. ## Description: This update for runc fixes the following issues: * Update to runc v1.1.12 (bsc#1218894) The following CVE was already fixed with the previous release. * CVE-2024-21626: Fixed container breakout. ## Patch Instructions: To install this SUSE update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: * openSUSE Leap Micro 5.3 zypper in -t patch openSUSE-Leap-Micro-5.3-2024-459=1 * openSUSE Leap Micro 5.4 zypper in -t patch openSUSE-Leap-Micro-5.4-2024-459=1 * openSUSE Leap 15.5 zypper in -t patch openSUSE-SLE-15.5-2024-459=1 * SUSE Linux Enterprise Micro for Rancher 5.3 zypper in -t patch SUSE-SLE-Micro-5.3-2024-459=1 * SUSE Linux Enterprise Micro 5.3 zypper in -t patch SUSE-SLE-Micro-5.3-2024-459=1 * SUSE Linux Enterprise Micro for Rancher 5.4 zypper in -t patch SUSE-SLE-Micro-5.4-2024-459=1 * SUSE Linux Enterprise Micro 5.4 zypper in -t patch SUSE-SLE-Micro-5.4-2024-459=1 * SUSE Linux Enterprise Micro 5.5 zypper in -t patch SUSE-SLE-Micro-5.5-2024-459=1 * Containers Module 15-SP4 zypper in -t patch SUSE-SLE-Module-Containers-15-SP4-2024-459=1 * Containers Module 15-SP5 zypper in -t patch SUSE-SLE-Module-Containers-15-SP5-2024-459=1 * SUSE Linux Enterprise High Performance Computing 15 SP2 LTSS 15-SP2 zypper in -t patch SUSE-SLE-Product-HPC-15-SP2-LTSS-2024-459=1 * SUSE Linux Enterprise High Performance Computing LTSS 15 SP3 zypper in -t patch SUSE-SLE-Product-HPC-15-SP3-LTSS-2024-459=1 * SUSE Linux Enterprise High Performance Computing ESPOS 15 SP4 zypper in -t patch SUSE-SLE-Product-HPC-15-SP4-ESPOS-2024-459=1 * SUSE Linux Enterprise High Performance Computing LTSS 15 SP4 zypper in -t patch SUSE-SLE-Product-HPC-15-SP4-LTSS-2024-459=1 * SUSE Linux Enterprise Server 15 SP2 LTSS 15-SP2 zypper in -t patch SUSE-SLE-Product-SLES-15-SP2-LTSS-2024-459=1 * SUSE Linux Enterprise Server 15 SP3 LTSS 15-SP3 zypper in -t patch SUSE-SLE-Product-SLES-15-SP3-LTSS-2024-459=1 * SUSE Linux Enterprise Server 15 SP4 LTSS 15-SP4 zypper in -t patch SUSE-SLE-Product-SLES-15-SP4-LTSS-2024-459=1 * SUSE Linux Enterprise Server for SAP Applications 15 SP2 zypper in -t patch SUSE-SLE-Product-SLES_SAP-15-SP2-2024-459=1 * SUSE Linux Enterprise Server for SAP Applications 15 SP3 zypper in -t patch SUSE-SLE-Product-SLES_SAP-15-SP3-2024-459=1 * SUSE Linux Enterprise Server for SAP Applications 15 SP4 zypper in -t patch SUSE-SLE-Product-SLES_SAP-15-SP4-2024-459=1 * SUSE Enterprise Storage 7.1 zypper in -t patch SUSE-Storage-7.1-2024-459=1 * SUSE Linux Enterprise Micro 5.1 zypper in -t patch SUSE-SUSE-MicroOS-5.1-2024-459=1 * SUSE Linux Enterprise Micro 5.2 zypper in -t patch SUSE-SUSE-MicroOS-5.2-2024-459=1 * SUSE Linux Enterprise Micro for Rancher 5.2 zypper in -t patch SUSE-SUSE-MicroOS-5.2-2024-459=1 ## Package List: * openSUSE Leap Micro 5.3 (aarch64 x86_64) * runc-1.1.12-150000.61.2 * runc-debuginfo-1.1.12-150000.61.2 * openSUSE Leap Micro 5.4 (aarch64 s390x x86_64) * runc-1.1.12-150000.61.2 * runc-debuginfo-1.1.12-150000.61.2 * openSUSE Leap 15.5 (aarch64 ppc64le s390x x86_64) * runc-1.1.12-150000.61.2 * runc-debuginfo-1.1.12-150000.61.2 * SUSE Linux Enterprise Micro for Rancher 5.3 (aarch64 s390x x86_64) * runc-1.1.12-150000.61.2 * runc-debuginfo-1.1.12-150000.61.2 * SUSE Linux Enterprise Micro 5.3 (aarch64 s390x x86_64) * runc-1.1.12-150000.61.2 * runc-debuginfo-1.1.12-150000.61.2 * SUSE Linux Enterprise Micro for Rancher 5.4 (aarch64 s390x x86_64) * runc-1.1.12-150000.61.2 * runc-debuginfo-1.1.12-150000.61.2 * SUSE Linux Enterprise Micro 5.4 (aarch64 s390x x86_64) * runc-1.1.12-150000.61.2 * runc-debuginfo-1.1.12-150000.61.2 * SUSE Linux Enterprise Micro 5.5 (aarch64 s390x x86_64) * runc-1.1.12-150000.61.2 * runc-debuginfo-1.1.12-150000.61.2 * Containers Module 15-SP4 (aarch64 ppc64le s390x) * runc-1.1.12-150000.61.2 * runc-debuginfo-1.1.12-150000.61.2 * Containers Module 15-SP5 (aarch64 ppc64le s390x x86_64) * runc-1.1.12-150000.61.2 * runc-debuginfo-1.1.12-150000.61.2 * SUSE Linux Enterprise High Performance Computing 15 SP2 LTSS 15-SP2 (aarch64 x86_64) * runc-1.1.12-150000.61.2 * runc-debuginfo-1.1.12-150000.61.2 * SUSE Linux Enterprise High Performance Computing LTSS 15 SP3 (aarch64 x86_64) * runc-1.1.12-150000.61.2 * runc-debuginfo-1.1.12-150000.61.2 * SUSE Linux Enterprise High Performance Computing ESPOS 15 SP4 (aarch64 x86_64) * runc-1.1.12-150000.61.2 * runc-debuginfo-1.1.12-150000.61.2 * SUSE Linux Enterprise High Performance Computing LTSS 15 SP4 (aarch64 x86_64) * runc-1.1.12-150000.61.2 * runc-debuginfo-1.1.12-150000.61.2 * SUSE Linux Enterprise Server 15 SP2 LTSS 15-SP2 (aarch64 ppc64le s390x x86_64) * runc-1.1.12-150000.61.2 * runc-debuginfo-1.1.12-150000.61.2 * SUSE Linux Enterprise Server 15 SP3 LTSS 15-SP3 (aarch64 ppc64le s390x x86_64) * runc-1.1.12-150000.61.2 * runc-debuginfo-1.1.12-150000.61.2 * SUSE Linux Enterprise Server 15 SP4 LTSS 15-SP4 (aarch64 ppc64le s390x x86_64) * runc-1.1.12-150000.61.2 * runc-debuginfo-1.1.12-150000.61.2 * SUSE Linux Enterprise Server for SAP Applications 15 SP2 (ppc64le x86_64) * runc-1.1.12-150000.61.2 * runc-debuginfo-1.1.12-150000.61.2 * SUSE Linux Enterprise Server for SAP Applications 15 SP3 (ppc64le x86_64) * runc-1.1.12-150000.61.2 * runc-debuginfo-1.1.12-150000.61.2 * SUSE Linux Enterprise Server for SAP Applications 15 SP4 (ppc64le x86_64) * runc-1.1.12-150000.61.2 * runc-debuginfo-1.1.12-150000.61.2 * SUSE Enterprise Storage 7.1 (aarch64 x86_64) * runc-1.1.12-150000.61.2 * runc-debuginfo-1.1.12-150000.61.2 * SUSE Linux Enterprise Micro 5.1 (aarch64 s390x x86_64) * runc-1.1.12-150000.61.2 * runc-debuginfo-1.1.12-150000.61.2 * SUSE Linux Enterprise Micro 5.2 (aarch64 s390x x86_64) * runc-1.1.12-150000.61.2 * runc-debuginfo-1.1.12-150000.61.2 * SUSE Linux Enterprise Micro for Rancher 5.2 (aarch64 s390x x86_64) * runc-1.1.12-150000.61.2 * runc-debuginfo-1.1.12-150000.61.2 ## References: * https://www.suse.com/security/cve/CVE-2024-21626.html * https://bugzilla.suse.com/show_bug.cgi?id=1218894

1 0

SUSE-SU-2024:0435-1: moderate: Security update for netpbm
by OPENSUSE-SECURITY-UPDATES 08 Feb '24

08 Feb '24

# Security update for netpbm Announcement ID: SUSE-SU-2024:0435-1 Rating: moderate References: * bsc#1022790 * bsc#1022791 Cross-References: * CVE-2017-5849 CVSS scores: * CVE-2017-5849 ( SUSE ): 4.4 CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:L * CVE-2017-5849 ( NVD ): 5.5 CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H Affected Products: * Basesystem Module 15-SP5 * Desktop Applications Module 15-SP5 * openSUSE Leap 15.5 * SUSE Linux Enterprise Desktop 15 SP5 * SUSE Linux Enterprise High Performance Computing 15 SP5 * SUSE Linux Enterprise Real Time 15 SP5 * SUSE Linux Enterprise Server 15 SP5 * SUSE Linux Enterprise Server for SAP Applications 15 SP5 An update that solves one vulnerability and has one security fix can now be installed. ## Description: This update for netpbm fixes the following issues: * CVE-2017-5849: Fixed out-of-bound read and write issue that can occur in function putgreytile() and put1bitbwtile() (bsc#1022790, bsc#1022791). ## Patch Instructions: To install this SUSE update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: * openSUSE Leap 15.5 zypper in -t patch openSUSE-SLE-15.5-2024-435=1 * Basesystem Module 15-SP5 zypper in -t patch SUSE-SLE-Module-Basesystem-15-SP5-2024-435=1 * Desktop Applications Module 15-SP5 zypper in -t patch SUSE-SLE-Module-Desktop-Applications-15-SP5-2024-435=1 ## Package List: * openSUSE Leap 15.5 (aarch64 ppc64le s390x x86_64) * netpbm-10.80.1-150000.3.14.1 * netpbm-debugsource-10.80.1-150000.3.14.1 * libnetpbm11-10.80.1-150000.3.14.1 * libnetpbm11-debuginfo-10.80.1-150000.3.14.1 * libnetpbm-devel-10.80.1-150000.3.14.1 * netpbm-vulnerable-debuginfo-10.80.1-150000.3.14.1 * netpbm-debuginfo-10.80.1-150000.3.14.1 * netpbm-vulnerable-10.80.1-150000.3.14.1 * openSUSE Leap 15.5 (x86_64) * libnetpbm11-32bit-10.80.1-150000.3.14.1 * libnetpbm11-32bit-debuginfo-10.80.1-150000.3.14.1 * Basesystem Module 15-SP5 (aarch64 ppc64le s390x x86_64) * netpbm-10.80.1-150000.3.14.1 * netpbm-debugsource-10.80.1-150000.3.14.1 * libnetpbm11-10.80.1-150000.3.14.1 * libnetpbm11-debuginfo-10.80.1-150000.3.14.1 * netpbm-debuginfo-10.80.1-150000.3.14.1 * Desktop Applications Module 15-SP5 (aarch64 ppc64le s390x x86_64) * netpbm-debugsource-10.80.1-150000.3.14.1 * netpbm-debuginfo-10.80.1-150000.3.14.1 * libnetpbm-devel-10.80.1-150000.3.14.1 ## References: * https://www.suse.com/security/cve/CVE-2017-5849.html * https://bugzilla.suse.com/show_bug.cgi?id=1022790 * https://bugzilla.suse.com/show_bug.cgi?id=1022791

1 0

SUSE-SU-2024:0428-1: important: Security update for the Linux Kernel (Live Patch 20 for SLE 15 SP4)
by OPENSUSE-SECURITY-UPDATES 08 Feb '24

08 Feb '24

# Security update for the Linux Kernel (Live Patch 20 for SLE 15 SP4) Announcement ID: SUSE-SU-2024:0428-1 Rating: important References: * bsc#1217522 * bsc#1218255 Cross-References: * CVE-2023-6176 * CVE-2023-6932 CVSS scores: * CVE-2023-6176 ( SUSE ): 7.8 CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H * CVE-2023-6176 ( NVD ): 4.7 CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:N/I:N/A:H * CVE-2023-6932 ( SUSE ): 7.0 CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H * CVE-2023-6932 ( NVD ): 7.0 CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H Affected Products: * openSUSE Leap 15.4 * SUSE Linux Enterprise High Performance Computing 15 SP4 * SUSE Linux Enterprise Live Patching 15-SP4 * SUSE Linux Enterprise Micro 5.3 * SUSE Linux Enterprise Micro 5.4 * SUSE Linux Enterprise Real Time 15 SP4 * SUSE Linux Enterprise Server 15 SP4 * SUSE Linux Enterprise Server for SAP Applications 15 SP4 An update that solves two vulnerabilities can now be installed. ## Description: This update for the Linux Kernel 5.14.21-150400_24_97 fixes several issues. The following security issues were fixed: * CVE-2023-6932: Fixed a use-after-free vulnerability in the ipv4 igmp component that could lead to local privilege escalation (bsc#1218255). * CVE-2023-6176: Fixed a denial of service in the cryptographic algorithm scatterwalk functionality (bsc#1217522). ## Patch Instructions: To install this SUSE update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: * openSUSE Leap 15.4 zypper in -t patch SUSE-2024-428=1 * SUSE Linux Enterprise Live Patching 15-SP4 zypper in -t patch SUSE-SLE-Module-Live-Patching-15-SP4-2024-428=1 ## Package List: * openSUSE Leap 15.4 (ppc64le s390x x86_64) * kernel-livepatch-5_14_21-150400_24_97-default-2-150400.2.1 * kernel-livepatch-SLE15-SP4_Update_20-debugsource-2-150400.2.1 * kernel-livepatch-5_14_21-150400_24_97-default-debuginfo-2-150400.2.1 * SUSE Linux Enterprise Live Patching 15-SP4 (ppc64le s390x x86_64) * kernel-livepatch-5_14_21-150400_24_97-default-2-150400.2.1 * kernel-livepatch-SLE15-SP4_Update_20-debugsource-2-150400.2.1 * kernel-livepatch-5_14_21-150400_24_97-default-debuginfo-2-150400.2.1 ## References: * https://www.suse.com/security/cve/CVE-2023-6176.html * https://www.suse.com/security/cve/CVE-2023-6932.html * https://bugzilla.suse.com/show_bug.cgi?id=1217522 * https://bugzilla.suse.com/show_bug.cgi?id=1218255

1 0

SUSE-SU-2024:0429-1: important: Security update for the Linux Kernel (Live Patch 21 for SLE 15 SP4)
by OPENSUSE-SECURITY-UPDATES 08 Feb '24

08 Feb '24

# Security update for the Linux Kernel (Live Patch 21 for SLE 15 SP4) Announcement ID: SUSE-SU-2024:0429-1 Rating: important References: * bsc#1218255 Cross-References: * CVE-2023-6932 CVSS scores: * CVE-2023-6932 ( SUSE ): 7.0 CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H * CVE-2023-6932 ( NVD ): 7.0 CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H Affected Products: * openSUSE Leap 15.4 * SUSE Linux Enterprise High Performance Computing 15 SP4 * SUSE Linux Enterprise Live Patching 15-SP4 * SUSE Linux Enterprise Micro 5.3 * SUSE Linux Enterprise Micro 5.4 * SUSE Linux Enterprise Real Time 15 SP4 * SUSE Linux Enterprise Server 15 SP4 * SUSE Linux Enterprise Server for SAP Applications 15 SP4 An update that solves one vulnerability can now be installed. ## Description: This update for the Linux Kernel 5.14.21-150400_24_100 fixes one issue. The following security issue was fixed: * CVE-2023-6932: Fixed a use-after-free vulnerability in the ipv4 igmp component that could lead to local privilege escalation (bsc#1218255). ## Patch Instructions: To install this SUSE update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: * SUSE Linux Enterprise Live Patching 15-SP4 zypper in -t patch SUSE-SLE-Module-Live-Patching-15-SP4-2024-429=1 * openSUSE Leap 15.4 zypper in -t patch SUSE-2024-429=1 ## Package List: * SUSE Linux Enterprise Live Patching 15-SP4 (ppc64le s390x x86_64) * kernel-livepatch-5_14_21-150400_24_100-default-2-150400.2.1 * kernel-livepatch-SLE15-SP4_Update_21-debugsource-2-150400.2.1 * kernel-livepatch-5_14_21-150400_24_100-default-debuginfo-2-150400.2.1 * openSUSE Leap 15.4 (ppc64le s390x x86_64) * kernel-livepatch-5_14_21-150400_24_100-default-2-150400.2.1 * kernel-livepatch-SLE15-SP4_Update_21-debugsource-2-150400.2.1 * kernel-livepatch-5_14_21-150400_24_100-default-debuginfo-2-150400.2.1 ## References: * https://www.suse.com/security/cve/CVE-2023-6932.html * https://bugzilla.suse.com/show_bug.cgi?id=1218255

1 0

SUSE-SU-2024:0421-1: important: Security update for the Linux Kernel (Live Patch 7 for SLE 15 SP4)
by OPENSUSE-SECURITY-UPDATES 07 Feb '24

07 Feb '24

# Security update for the Linux Kernel (Live Patch 7 for SLE 15 SP4) Announcement ID: SUSE-SU-2024:0421-1 Rating: important References: * bsc#1216044 * bsc#1217522 * bsc#1218255 Cross-References: * CVE-2023-5178 * CVE-2023-6176 * CVE-2023-6932 CVSS scores: * CVE-2023-5178 ( SUSE ): 7.2 CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H * CVE-2023-5178 ( NVD ): 9.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H * CVE-2023-6176 ( SUSE ): 7.8 CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H * CVE-2023-6176 ( NVD ): 4.7 CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:N/I:N/A:H * CVE-2023-6932 ( SUSE ): 7.0 CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H * CVE-2023-6932 ( NVD ): 7.0 CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H Affected Products: * openSUSE Leap 15.4 * openSUSE Leap 15.5 * SUSE Linux Enterprise High Performance Computing 15 SP4 * SUSE Linux Enterprise High Performance Computing 15 SP5 * SUSE Linux Enterprise Live Patching 15-SP4 * SUSE Linux Enterprise Live Patching 15-SP5 * SUSE Linux Enterprise Micro 5.3 * SUSE Linux Enterprise Micro 5.4 * SUSE Linux Enterprise Micro 5.5 * SUSE Linux Enterprise Real Time 15 SP4 * SUSE Linux Enterprise Real Time 15 SP5 * SUSE Linux Enterprise Server 15 SP4 * SUSE Linux Enterprise Server 15 SP5 * SUSE Linux Enterprise Server for SAP Applications 15 SP4 * SUSE Linux Enterprise Server for SAP Applications 15 SP5 An update that solves three vulnerabilities can now be installed. ## Description: This update for the Linux Kernel 5.14.21-150400_24_41 fixes several issues. The following security issues were fixed: * CVE-2023-6932: Fixed a use-after-free vulnerability in the ipv4 igmp component that could lead to local privilege escalation (bsc#1218255). * CVE-2023-6176: Fixed a denial of service in the cryptographic algorithm scatterwalk functionality (bsc#1217522). * CVE-2023-5178: Fixed a use-after-free vulnerability in queue intialization setup (bsc#1215768). ## Patch Instructions: To install this SUSE update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: * openSUSE Leap 15.4 zypper in -t patch SUSE-2024-420=1 SUSE-2024-421=1 SUSE-2024-422=1 * SUSE Linux Enterprise Live Patching 15-SP4 zypper in -t patch SUSE-SLE-Module-Live-Patching-15-SP4-2024-422=1 SUSE-SLE- Module-Live-Patching-15-SP4-2024-420=1 SUSE-SLE-Module-Live- Patching-15-SP4-2024-421=1 * openSUSE Leap 15.5 zypper in -t patch SUSE-2024-419=1 * SUSE Linux Enterprise Live Patching 15-SP5 zypper in -t patch SUSE-SLE-Module-Live-Patching-15-SP5-2024-419=1 ## Package List: * openSUSE Leap 15.4 (ppc64le s390x x86_64) * kernel-livepatch-5_14_21-150400_24_81-default-debuginfo-5-150400.2.1 * kernel-livepatch-5_14_21-150400_24_41-default-12-150400.2.2 * kernel-livepatch-SLE15-SP4_Update_18-debugsource-4-150400.2.1 * kernel-livepatch-SLE15-SP4_Update_16-debugsource-5-150400.2.1 * kernel-livepatch-5_14_21-150400_24_88-default-4-150400.2.1 * kernel-livepatch-5_14_21-150400_24_88-default-debuginfo-4-150400.2.1 * kernel-livepatch-SLE15-SP4_Update_7-debugsource-12-150400.2.2 * kernel-livepatch-5_14_21-150400_24_81-default-5-150400.2.1 * kernel-livepatch-5_14_21-150400_24_41-default-debuginfo-12-150400.2.2 * SUSE Linux Enterprise Live Patching 15-SP4 (ppc64le s390x x86_64) * kernel-livepatch-5_14_21-150400_24_81-default-debuginfo-5-150400.2.1 * kernel-livepatch-5_14_21-150400_24_41-default-12-150400.2.2 * kernel-livepatch-SLE15-SP4_Update_18-debugsource-4-150400.2.1 * kernel-livepatch-SLE15-SP4_Update_16-debugsource-5-150400.2.1 * kernel-livepatch-5_14_21-150400_24_88-default-4-150400.2.1 * kernel-livepatch-5_14_21-150400_24_88-default-debuginfo-4-150400.2.1 * kernel-livepatch-SLE15-SP4_Update_7-debugsource-12-150400.2.2 * kernel-livepatch-5_14_21-150400_24_81-default-5-150400.2.1 * kernel-livepatch-5_14_21-150400_24_41-default-debuginfo-12-150400.2.2 * openSUSE Leap 15.5 (ppc64le s390x x86_64) * kernel-livepatch-5_14_21-150500_55_7-default-debuginfo-6-150500.2.1 * kernel-livepatch-5_14_21-150500_55_7-default-6-150500.2.1 * kernel-livepatch-SLE15-SP5_Update_1-debugsource-6-150500.2.1 * SUSE Linux Enterprise Live Patching 15-SP5 (ppc64le s390x x86_64) * kernel-livepatch-5_14_21-150500_55_7-default-debuginfo-6-150500.2.1 * kernel-livepatch-5_14_21-150500_55_7-default-6-150500.2.1 * kernel-livepatch-SLE15-SP5_Update_1-debugsource-6-150500.2.1 ## References: * https://www.suse.com/security/cve/CVE-2023-5178.html * https://www.suse.com/security/cve/CVE-2023-6176.html * https://www.suse.com/security/cve/CVE-2023-6932.html * https://bugzilla.suse.com/show_bug.cgi?id=1216044 * https://bugzilla.suse.com/show_bug.cgi?id=1217522 * https://bugzilla.suse.com/show_bug.cgi?id=1218255

1 0

SUSE-SU-2024:0411-1: important: Security update for the Linux Kernel (Live Patch 35 for SLE 15 SP3)
by OPENSUSE-SECURITY-UPDATES 07 Feb '24

07 Feb '24

# Security update for the Linux Kernel (Live Patch 35 for SLE 15 SP3) Announcement ID: SUSE-SU-2024:0411-1 Rating: important References: * bsc#1217522 * bsc#1218255 Cross-References: * CVE-2023-6176 * CVE-2023-6932 CVSS scores: * CVE-2023-6176 ( SUSE ): 7.8 CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H * CVE-2023-6176 ( NVD ): 4.7 CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:N/I:N/A:H * CVE-2023-6932 ( SUSE ): 7.0 CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H * CVE-2023-6932 ( NVD ): 7.0 CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H Affected Products: * openSUSE Leap 15.3 * SUSE Linux Enterprise High Performance Computing 15 SP3 * SUSE Linux Enterprise Live Patching 15-SP3 * SUSE Linux Enterprise Micro 5.1 * SUSE Linux Enterprise Micro 5.2 * SUSE Linux Enterprise Server 15 SP3 * SUSE Linux Enterprise Server for SAP Applications 15 SP3 An update that solves two vulnerabilities can now be installed. ## Description: This update for the Linux Kernel 5.3.18-150300_59_130 fixes several issues. The following security issues were fixed: * CVE-2023-6932: Fixed a use-after-free vulnerability in the ipv4 igmp component that could lead to local privilege escalation (bsc#1218255). * CVE-2023-6176: Fixed a denial of service in the cryptographic algorithm scatterwalk functionality (bsc#1217522). ## Patch Instructions: To install this SUSE update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: * SUSE Linux Enterprise Live Patching 15-SP3 zypper in -t patch SUSE-SLE-Module-Live-Patching-15-SP3-2024-411=1 SUSE-SLE- Module-Live-Patching-15-SP3-2024-416=1 * openSUSE Leap 15.3 zypper in -t patch SUSE-2024-416=1 SUSE-2024-411=1 ## Package List: * SUSE Linux Enterprise Live Patching 15-SP3 (ppc64le s390x x86_64) * kernel-livepatch-5_3_18-150300_59_115-default-10-150300.2.1 * kernel-livepatch-5_3_18-150300_59_130-default-5-150300.2.1 * openSUSE Leap 15.3 (ppc64le s390x x86_64) * kernel-livepatch-5_3_18-150300_59_130-default-5-150300.2.1 * kernel-livepatch-5_3_18-150300_59_115-default-debuginfo-10-150300.2.1 * kernel-livepatch-5_3_18-150300_59_115-default-10-150300.2.1 * kernel-livepatch-5_3_18-150300_59_130-default-debuginfo-5-150300.2.1 * kernel-livepatch-SLE15-SP3_Update_30-debugsource-10-150300.2.1 * kernel-livepatch-SLE15-SP3_Update_35-debugsource-5-150300.2.1 * openSUSE Leap 15.3 (x86_64) * kernel-livepatch-5_3_18-150300_59_130-preempt-debuginfo-5-150300.2.1 * kernel-livepatch-5_3_18-150300_59_130-preempt-5-150300.2.1 * kernel-livepatch-5_3_18-150300_59_115-preempt-debuginfo-10-150300.2.1 * kernel-livepatch-5_3_18-150300_59_115-preempt-10-150300.2.1 ## References: * https://www.suse.com/security/cve/CVE-2023-6176.html * https://www.suse.com/security/cve/CVE-2023-6932.html * https://bugzilla.suse.com/show_bug.cgi?id=1217522 * https://bugzilla.suse.com/show_bug.cgi?id=1218255

1 0

SUSE-SU-2024:0323-1: critical: Security update for python-uamqp
by OPENSUSE-SECURITY-UPDATES 05 Feb '24

05 Feb '24

# Security update for python-uamqp Announcement ID: SUSE-SU-2024:0323-1 Rating: critical References: * bsc#1219409 Cross-References: * CVE-2024-21646 CVSS scores: * CVE-2024-21646 ( SUSE ): 9.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H * CVE-2024-21646 ( NVD ): 9.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H Affected Products: * openSUSE Leap 15.5 * Public Cloud Module 15-SP2 * Public Cloud Module 15-SP3 * Public Cloud Module 15-SP4 * Public Cloud Module 15-SP5 * SUSE Linux Enterprise High Performance Computing 15 SP2 * SUSE Linux Enterprise High Performance Computing 15 SP3 * SUSE Linux Enterprise High Performance Computing 15 SP4 * SUSE Linux Enterprise High Performance Computing 15 SP5 * SUSE Linux Enterprise Server 15 SP2 * SUSE Linux Enterprise Server 15 SP3 * SUSE Linux Enterprise Server 15 SP4 * SUSE Linux Enterprise Server 15 SP5 * SUSE Linux Enterprise Server for SAP Applications 15 SP2 * SUSE Linux Enterprise Server for SAP Applications 15 SP3 * SUSE Linux Enterprise Server for SAP Applications 15 SP4 * SUSE Linux Enterprise Server for SAP Applications 15 SP5 * SUSE Manager Proxy 4.1 * SUSE Manager Proxy 4.2 * SUSE Manager Proxy 4.3 * SUSE Manager Retail Branch Server 4.1 * SUSE Manager Retail Branch Server 4.2 * SUSE Manager Retail Branch Server 4.3 * SUSE Manager Server 4.1 * SUSE Manager Server 4.2 * SUSE Manager Server 4.3 An update that solves one vulnerability can now be installed. ## Description: This update for python-uamqp fixes the following issues: * CVE-2024-21646: Fix integer overflow which may cause remote code execution (bsc#1219409). ## Patch Instructions: To install this SUSE update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: * openSUSE Leap 15.5 zypper in -t patch openSUSE-SLE-15.5-2024-323=1 * Public Cloud Module 15-SP2 zypper in -t patch SUSE-SLE-Module-Public-Cloud-15-SP2-2024-323=1 * Public Cloud Module 15-SP3 zypper in -t patch SUSE-SLE-Module-Public-Cloud-15-SP3-2024-323=1 * Public Cloud Module 15-SP4 zypper in -t patch SUSE-SLE-Module-Public-Cloud-15-SP4-2024-323=1 * Public Cloud Module 15-SP5 zypper in -t patch SUSE-SLE-Module-Public-Cloud-15-SP5-2024-323=1 ## Package List: * openSUSE Leap 15.5 (aarch64 ppc64le s390x x86_64) * python3-uamqp-debuginfo-1.5.3-150100.4.10.1 * python3-uamqp-1.5.3-150100.4.10.1 * python-uamqp-debugsource-1.5.3-150100.4.10.1 * Public Cloud Module 15-SP2 (aarch64 ppc64le s390x x86_64) * python3-uamqp-debuginfo-1.5.3-150100.4.10.1 * python3-uamqp-1.5.3-150100.4.10.1 * python-uamqp-debugsource-1.5.3-150100.4.10.1 * Public Cloud Module 15-SP3 (aarch64 ppc64le s390x x86_64) * python3-uamqp-debuginfo-1.5.3-150100.4.10.1 * python3-uamqp-1.5.3-150100.4.10.1 * python-uamqp-debugsource-1.5.3-150100.4.10.1 * Public Cloud Module 15-SP4 (aarch64 ppc64le s390x x86_64) * python3-uamqp-debuginfo-1.5.3-150100.4.10.1 * python3-uamqp-1.5.3-150100.4.10.1 * python-uamqp-debugsource-1.5.3-150100.4.10.1 * Public Cloud Module 15-SP5 (aarch64 ppc64le s390x x86_64) * python3-uamqp-debuginfo-1.5.3-150100.4.10.1 * python3-uamqp-1.5.3-150100.4.10.1 * python-uamqp-debugsource-1.5.3-150100.4.10.1 ## References: * https://www.suse.com/security/cve/CVE-2024-21646.html * https://bugzilla.suse.com/show_bug.cgi?id=1219409

1 0

SUSE-SU-2024:0325-1: important: Security update for java-17-openjdk
by OPENSUSE-SECURITY-UPDATES 05 Feb '24

05 Feb '24

# Security update for java-17-openjdk Announcement ID: SUSE-SU-2024:0325-1 Rating: important References: * bsc#1218903 * bsc#1218905 * bsc#1218907 * bsc#1218908 * bsc#1218909 * bsc#1218911 Cross-References: * CVE-2024-20918 * CVE-2024-20919 * CVE-2024-20921 * CVE-2024-20932 * CVE-2024-20945 * CVE-2024-20952 CVSS scores: * CVE-2024-20918 ( SUSE ): 7.4 CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N * CVE-2024-20919 ( SUSE ): 5.9 CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:N * CVE-2024-20921 ( SUSE ): 5.9 CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N * CVE-2024-20932 ( SUSE ): 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N * CVE-2024-20945 ( SUSE ): 4.7 CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:N/A:N * CVE-2024-20952 ( SUSE ): 7.4 CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N Affected Products: * Basesystem Module 15-SP5 * openSUSE Leap 15.4 * openSUSE Leap 15.5 * SUSE Linux Enterprise Desktop 15 SP4 LTSS 15-SP4 * SUSE Linux Enterprise Desktop 15 SP5 * SUSE Linux Enterprise High Performance Computing 15 SP4 * SUSE Linux Enterprise High Performance Computing 15 SP5 * SUSE Linux Enterprise High Performance Computing ESPOS 15 SP4 * SUSE Linux Enterprise High Performance Computing LTSS 15 SP4 * SUSE Linux Enterprise Real Time 15 SP5 * SUSE Linux Enterprise Server 15 SP4 * SUSE Linux Enterprise Server 15 SP4 LTSS 15-SP4 * SUSE Linux Enterprise Server 15 SP5 * SUSE Linux Enterprise Server for SAP Applications 15 SP4 * SUSE Linux Enterprise Server for SAP Applications 15 SP5 * SUSE Manager Proxy 4.3 * SUSE Manager Retail Branch Server 4.3 * SUSE Manager Server 4.3 An update that solves six vulnerabilities can now be installed. ## Description: This update for java-17-openjdk fixes the following issues: Updated to version 17.0.10 (January 2024 CPU): * CVE-2024-20918: Fixed an out of bounds access in the Hotspot JVM due to a missing bounds check (bsc#1218907). * CVE-2024-20919: Fixed a sandbox bypass in the Hotspot JVM class file verifier (bsc#1218903). * CVE-2024-20921: Fixed an incorrect optimization in the Hotspot JVM that could lead to corruption of JVM memory (bsc#1218905). * CVE-2024-20932: Fixed an incorrect handling of ZIP files with duplicate entries (bsc#1218908). * CVE-2024-20945: Fixed a potential private key leak through debug logs (bsc#1218909). * CVE-2024-20952: Fixed an RSA padding issue and timing side-channel attack against TLS (bsc#1218911). Find the full release notes at: https://mail.openjdk.org/pipermail/jdk-updates-dev/2024-January/029089.html ## Patch Instructions: To install this SUSE update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: * openSUSE Leap 15.4 zypper in -t patch SUSE-2024-325=1 * openSUSE Leap 15.5 zypper in -t patch openSUSE-SLE-15.5-2024-325=1 * Basesystem Module 15-SP5 zypper in -t patch SUSE-SLE-Module-Basesystem-15-SP5-2024-325=1 * SUSE Linux Enterprise High Performance Computing ESPOS 15 SP4 zypper in -t patch SUSE-SLE-Product-HPC-15-SP4-ESPOS-2024-325=1 * SUSE Linux Enterprise High Performance Computing LTSS 15 SP4 zypper in -t patch SUSE-SLE-Product-HPC-15-SP4-LTSS-2024-325=1 * SUSE Linux Enterprise Desktop 15 SP4 LTSS 15-SP4 zypper in -t patch SUSE-SLE-Product-SLED-15-SP4-LTSS-2024-325=1 * SUSE Linux Enterprise Server 15 SP4 LTSS 15-SP4 zypper in -t patch SUSE-SLE-Product-SLES-15-SP4-LTSS-2024-325=1 * SUSE Linux Enterprise Server for SAP Applications 15 SP4 zypper in -t patch SUSE-SLE-Product-SLES_SAP-15-SP4-2024-325=1 * SUSE Manager Proxy 4.3 zypper in -t patch SUSE-SLE-Product-SUSE-Manager-Proxy-4.3-2024-325=1 * SUSE Manager Retail Branch Server 4.3 zypper in -t patch SUSE-SLE-Product-SUSE-Manager-Retail-Branch- Server-4.3-2024-325=1 * SUSE Manager Server 4.3 zypper in -t patch SUSE-SLE-Product-SUSE-Manager-Server-4.3-2024-325=1 ## Package List: * openSUSE Leap 15.4 (aarch64 ppc64le s390x x86_64 i586) * java-17-openjdk-jmods-17.0.10.0-150400.3.36.1 * java-17-openjdk-demo-17.0.10.0-150400.3.36.1 * java-17-openjdk-devel-17.0.10.0-150400.3.36.1 * java-17-openjdk-17.0.10.0-150400.3.36.1 * java-17-openjdk-headless-debuginfo-17.0.10.0-150400.3.36.1 * java-17-openjdk-debugsource-17.0.10.0-150400.3.36.1 * java-17-openjdk-src-17.0.10.0-150400.3.36.1 * java-17-openjdk-debuginfo-17.0.10.0-150400.3.36.1 * java-17-openjdk-headless-17.0.10.0-150400.3.36.1 * java-17-openjdk-devel-debuginfo-17.0.10.0-150400.3.36.1 * openSUSE Leap 15.4 (noarch) * java-17-openjdk-javadoc-17.0.10.0-150400.3.36.1 * openSUSE Leap 15.5 (aarch64 ppc64le s390x x86_64) * java-17-openjdk-jmods-17.0.10.0-150400.3.36.1 * java-17-openjdk-demo-17.0.10.0-150400.3.36.1 * java-17-openjdk-devel-17.0.10.0-150400.3.36.1 * java-17-openjdk-17.0.10.0-150400.3.36.1 * java-17-openjdk-headless-debuginfo-17.0.10.0-150400.3.36.1 * java-17-openjdk-debugsource-17.0.10.0-150400.3.36.1 * java-17-openjdk-src-17.0.10.0-150400.3.36.1 * java-17-openjdk-debuginfo-17.0.10.0-150400.3.36.1 * java-17-openjdk-headless-17.0.10.0-150400.3.36.1 * java-17-openjdk-devel-debuginfo-17.0.10.0-150400.3.36.1 * openSUSE Leap 15.5 (noarch) * java-17-openjdk-javadoc-17.0.10.0-150400.3.36.1 * Basesystem Module 15-SP5 (aarch64 ppc64le s390x x86_64) * java-17-openjdk-demo-17.0.10.0-150400.3.36.1 * java-17-openjdk-devel-17.0.10.0-150400.3.36.1 * java-17-openjdk-17.0.10.0-150400.3.36.1 * java-17-openjdk-headless-debuginfo-17.0.10.0-150400.3.36.1 * java-17-openjdk-debugsource-17.0.10.0-150400.3.36.1 * java-17-openjdk-debuginfo-17.0.10.0-150400.3.36.1 * java-17-openjdk-headless-17.0.10.0-150400.3.36.1 * java-17-openjdk-devel-debuginfo-17.0.10.0-150400.3.36.1 * SUSE Linux Enterprise High Performance Computing ESPOS 15 SP4 (aarch64 x86_64) * java-17-openjdk-demo-17.0.10.0-150400.3.36.1 * java-17-openjdk-devel-17.0.10.0-150400.3.36.1 * java-17-openjdk-17.0.10.0-150400.3.36.1 * java-17-openjdk-headless-debuginfo-17.0.10.0-150400.3.36.1 * java-17-openjdk-debugsource-17.0.10.0-150400.3.36.1 * java-17-openjdk-debuginfo-17.0.10.0-150400.3.36.1 * java-17-openjdk-headless-17.0.10.0-150400.3.36.1 * java-17-openjdk-devel-debuginfo-17.0.10.0-150400.3.36.1 * SUSE Linux Enterprise High Performance Computing LTSS 15 SP4 (aarch64 x86_64) * java-17-openjdk-demo-17.0.10.0-150400.3.36.1 * java-17-openjdk-devel-17.0.10.0-150400.3.36.1 * java-17-openjdk-17.0.10.0-150400.3.36.1 * java-17-openjdk-headless-debuginfo-17.0.10.0-150400.3.36.1 * java-17-openjdk-debugsource-17.0.10.0-150400.3.36.1 * java-17-openjdk-debuginfo-17.0.10.0-150400.3.36.1 * java-17-openjdk-headless-17.0.10.0-150400.3.36.1 * java-17-openjdk-devel-debuginfo-17.0.10.0-150400.3.36.1 * SUSE Linux Enterprise Desktop 15 SP4 LTSS 15-SP4 (x86_64) * java-17-openjdk-demo-17.0.10.0-150400.3.36.1 * java-17-openjdk-devel-17.0.10.0-150400.3.36.1 * java-17-openjdk-17.0.10.0-150400.3.36.1 * java-17-openjdk-headless-debuginfo-17.0.10.0-150400.3.36.1 * java-17-openjdk-debugsource-17.0.10.0-150400.3.36.1 * java-17-openjdk-debuginfo-17.0.10.0-150400.3.36.1 * java-17-openjdk-headless-17.0.10.0-150400.3.36.1 * java-17-openjdk-devel-debuginfo-17.0.10.0-150400.3.36.1 * SUSE Linux Enterprise Server 15 SP4 LTSS 15-SP4 (aarch64 ppc64le s390x x86_64) * java-17-openjdk-demo-17.0.10.0-150400.3.36.1 * java-17-openjdk-devel-17.0.10.0-150400.3.36.1 * java-17-openjdk-17.0.10.0-150400.3.36.1 * java-17-openjdk-headless-debuginfo-17.0.10.0-150400.3.36.1 * java-17-openjdk-debugsource-17.0.10.0-150400.3.36.1 * java-17-openjdk-debuginfo-17.0.10.0-150400.3.36.1 * java-17-openjdk-headless-17.0.10.0-150400.3.36.1 * java-17-openjdk-devel-debuginfo-17.0.10.0-150400.3.36.1 * SUSE Linux Enterprise Server for SAP Applications 15 SP4 (ppc64le x86_64) * java-17-openjdk-demo-17.0.10.0-150400.3.36.1 * java-17-openjdk-devel-17.0.10.0-150400.3.36.1 * java-17-openjdk-17.0.10.0-150400.3.36.1 * java-17-openjdk-headless-debuginfo-17.0.10.0-150400.3.36.1 * java-17-openjdk-debugsource-17.0.10.0-150400.3.36.1 * java-17-openjdk-debuginfo-17.0.10.0-150400.3.36.1 * java-17-openjdk-headless-17.0.10.0-150400.3.36.1 * java-17-openjdk-devel-debuginfo-17.0.10.0-150400.3.36.1 * SUSE Manager Proxy 4.3 (x86_64) * java-17-openjdk-demo-17.0.10.0-150400.3.36.1 * java-17-openjdk-devel-17.0.10.0-150400.3.36.1 * java-17-openjdk-17.0.10.0-150400.3.36.1 * java-17-openjdk-headless-debuginfo-17.0.10.0-150400.3.36.1 * java-17-openjdk-debugsource-17.0.10.0-150400.3.36.1 * java-17-openjdk-debuginfo-17.0.10.0-150400.3.36.1 * java-17-openjdk-headless-17.0.10.0-150400.3.36.1 * java-17-openjdk-devel-debuginfo-17.0.10.0-150400.3.36.1 * SUSE Manager Retail Branch Server 4.3 (x86_64) * java-17-openjdk-demo-17.0.10.0-150400.3.36.1 * java-17-openjdk-devel-17.0.10.0-150400.3.36.1 * java-17-openjdk-17.0.10.0-150400.3.36.1 * java-17-openjdk-headless-debuginfo-17.0.10.0-150400.3.36.1 * java-17-openjdk-debugsource-17.0.10.0-150400.3.36.1 * java-17-openjdk-debuginfo-17.0.10.0-150400.3.36.1 * java-17-openjdk-headless-17.0.10.0-150400.3.36.1 * java-17-openjdk-devel-debuginfo-17.0.10.0-150400.3.36.1 * SUSE Manager Server 4.3 (ppc64le s390x x86_64) * java-17-openjdk-demo-17.0.10.0-150400.3.36.1 * java-17-openjdk-devel-17.0.10.0-150400.3.36.1 * java-17-openjdk-17.0.10.0-150400.3.36.1 * java-17-openjdk-headless-debuginfo-17.0.10.0-150400.3.36.1 * java-17-openjdk-debugsource-17.0.10.0-150400.3.36.1 * java-17-openjdk-debuginfo-17.0.10.0-150400.3.36.1 * java-17-openjdk-headless-17.0.10.0-150400.3.36.1 * java-17-openjdk-devel-debuginfo-17.0.10.0-150400.3.36.1 ## References: * https://www.suse.com/security/cve/CVE-2024-20918.html * https://www.suse.com/security/cve/CVE-2024-20919.html * https://www.suse.com/security/cve/CVE-2024-20921.html * https://www.suse.com/security/cve/CVE-2024-20932.html * https://www.suse.com/security/cve/CVE-2024-20945.html * https://www.suse.com/security/cve/CVE-2024-20952.html * https://bugzilla.suse.com/show_bug.cgi?id=1218903 * https://bugzilla.suse.com/show_bug.cgi?id=1218905 * https://bugzilla.suse.com/show_bug.cgi?id=1218907 * https://bugzilla.suse.com/show_bug.cgi?id=1218908 * https://bugzilla.suse.com/show_bug.cgi?id=1218909 * https://bugzilla.suse.com/show_bug.cgi?id=1218911

1 0

SUSE-SU-2024:0305-1: moderate: Security update for cpio
by OPENSUSE-SECURITY-UPDATES 01 Feb '24

01 Feb '24

# Security update for cpio Announcement ID: SUSE-SU-2024:0305-1 Rating: moderate References: * bsc#1218571 * bsc#1219238 Affected Products: * Basesystem Module 15-SP5 * openSUSE Leap 15.4 * openSUSE Leap 15.5 * openSUSE Leap Micro 5.3 * openSUSE Leap Micro 5.4 * SUSE Linux Enterprise Desktop 15 SP5 * SUSE Linux Enterprise High Performance Computing 15 SP5 * SUSE Linux Enterprise Micro 5.3 * SUSE Linux Enterprise Micro 5.4 * SUSE Linux Enterprise Micro 5.5 * SUSE Linux Enterprise Micro for Rancher 5.3 * SUSE Linux Enterprise Micro for Rancher 5.4 * SUSE Linux Enterprise Real Time 15 SP5 * SUSE Linux Enterprise Server 15 SP5 * SUSE Linux Enterprise Server for SAP Applications 15 SP5 An update that has two security fixes can now be installed. ## Description: This update for cpio fixes the following issues: * Fixed cpio not extracting correctly when using --no-absolute-filenames option the security fix for CVE-2023-7207 (bsc#1218571, bsc#1219238) ## Patch Instructions: To install this SUSE update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: * openSUSE Leap 15.4 zypper in -t patch SUSE-2024-305=1 * openSUSE Leap Micro 5.3 zypper in -t patch openSUSE-Leap-Micro-5.3-2024-305=1 * openSUSE Leap Micro 5.4 zypper in -t patch openSUSE-Leap-Micro-5.4-2024-305=1 * openSUSE Leap 15.5 zypper in -t patch openSUSE-SLE-15.5-2024-305=1 * SUSE Linux Enterprise Micro for Rancher 5.3 zypper in -t patch SUSE-SLE-Micro-5.3-2024-305=1 * SUSE Linux Enterprise Micro 5.3 zypper in -t patch SUSE-SLE-Micro-5.3-2024-305=1 * SUSE Linux Enterprise Micro for Rancher 5.4 zypper in -t patch SUSE-SLE-Micro-5.4-2024-305=1 * SUSE Linux Enterprise Micro 5.4 zypper in -t patch SUSE-SLE-Micro-5.4-2024-305=1 * SUSE Linux Enterprise Micro 5.5 zypper in -t patch SUSE-SLE-Micro-5.5-2024-305=1 * Basesystem Module 15-SP5 zypper in -t patch SUSE-SLE-Module-Basesystem-15-SP5-2024-305=1 ## Package List: * openSUSE Leap 15.4 (aarch64 ppc64le s390x x86_64 i586) * cpio-debuginfo-2.13-150400.3.6.1 * cpio-mt-2.13-150400.3.6.1 * cpio-debugsource-2.13-150400.3.6.1 * cpio-mt-debuginfo-2.13-150400.3.6.1 * cpio-2.13-150400.3.6.1 * openSUSE Leap 15.4 (noarch) * cpio-lang-2.13-150400.3.6.1 * openSUSE Leap Micro 5.3 (aarch64 x86_64) * cpio-debuginfo-2.13-150400.3.6.1 * cpio-debugsource-2.13-150400.3.6.1 * cpio-2.13-150400.3.6.1 * openSUSE Leap Micro 5.4 (aarch64 s390x x86_64) * cpio-debuginfo-2.13-150400.3.6.1 * cpio-debugsource-2.13-150400.3.6.1 * cpio-2.13-150400.3.6.1 * openSUSE Leap 15.5 (aarch64 ppc64le s390x x86_64) * cpio-debuginfo-2.13-150400.3.6.1 * cpio-mt-2.13-150400.3.6.1 * cpio-debugsource-2.13-150400.3.6.1 * cpio-mt-debuginfo-2.13-150400.3.6.1 * cpio-2.13-150400.3.6.1 * openSUSE Leap 15.5 (noarch) * cpio-lang-2.13-150400.3.6.1 * SUSE Linux Enterprise Micro for Rancher 5.3 (aarch64 s390x x86_64) * cpio-debuginfo-2.13-150400.3.6.1 * cpio-debugsource-2.13-150400.3.6.1 * cpio-2.13-150400.3.6.1 * SUSE Linux Enterprise Micro 5.3 (aarch64 s390x x86_64) * cpio-debuginfo-2.13-150400.3.6.1 * cpio-debugsource-2.13-150400.3.6.1 * cpio-2.13-150400.3.6.1 * SUSE Linux Enterprise Micro for Rancher 5.4 (aarch64 s390x x86_64) * cpio-debuginfo-2.13-150400.3.6.1 * cpio-debugsource-2.13-150400.3.6.1 * cpio-2.13-150400.3.6.1 * SUSE Linux Enterprise Micro 5.4 (aarch64 s390x x86_64) * cpio-debuginfo-2.13-150400.3.6.1 * cpio-debugsource-2.13-150400.3.6.1 * cpio-2.13-150400.3.6.1 * SUSE Linux Enterprise Micro 5.5 (aarch64 s390x x86_64) * cpio-debuginfo-2.13-150400.3.6.1 * cpio-debugsource-2.13-150400.3.6.1 * cpio-2.13-150400.3.6.1 * Basesystem Module 15-SP5 (aarch64 ppc64le s390x x86_64) * cpio-debuginfo-2.13-150400.3.6.1 * cpio-mt-2.13-150400.3.6.1 * cpio-debugsource-2.13-150400.3.6.1 * cpio-mt-debuginfo-2.13-150400.3.6.1 * cpio-2.13-150400.3.6.1 * Basesystem Module 15-SP5 (noarch) * cpio-lang-2.13-150400.3.6.1 ## References: * https://bugzilla.suse.com/show_bug.cgi?id=1218571 * https://bugzilla.suse.com/show_bug.cgi?id=1219238

1 0