March 2024

SUSE-SU-2024:0786-1: important: Security update for giflib
by OPENSUSE-SECURITY-UPDATES 07 Mar '24

07 Mar '24

# Security update for giflib Announcement ID: SUSE-SU-2024:0786-1 Rating: important References: * bsc#1198880 * bsc#1200551 * bsc#1217390 Cross-References: * CVE-2021-40633 * CVE-2022-28506 * CVE-2023-48161 CVSS scores: * CVE-2021-40633 ( SUSE ): 3.3 CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:L * CVE-2021-40633 ( NVD ): 8.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H * CVE-2022-28506 ( SUSE ): 3.3 CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:L * CVE-2022-… [View More]28506 ( NVD ): 5.5 CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N * CVE-2023-48161 ( SUSE ): 7.1 CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:H * CVE-2023-48161 ( NVD ): 7.1 CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:H Affected Products: * Basesystem Module 15-SP5 * openSUSE Leap 15.5 * SUSE Enterprise Storage 7.1 * SUSE Linux Enterprise Desktop 15 SP4 LTSS 15-SP4 * SUSE Linux Enterprise Desktop 15 SP5 * SUSE Linux Enterprise High Performance Computing 15 SP2 * SUSE Linux Enterprise High Performance Computing 15 SP2 LTSS 15-SP2 * SUSE Linux Enterprise High Performance Computing 15 SP3 * SUSE Linux Enterprise High Performance Computing 15 SP4 * SUSE Linux Enterprise High Performance Computing 15 SP5 * SUSE Linux Enterprise High Performance Computing ESPOS 15 SP4 * SUSE Linux Enterprise High Performance Computing LTSS 15 SP3 * SUSE Linux Enterprise High Performance Computing LTSS 15 SP4 * SUSE Linux Enterprise Real Time 15 SP5 * SUSE Linux Enterprise Server 15 SP2 * SUSE Linux Enterprise Server 15 SP2 LTSS 15-SP2 * SUSE Linux Enterprise Server 15 SP3 * SUSE Linux Enterprise Server 15 SP3 LTSS 15-SP3 * SUSE Linux Enterprise Server 15 SP4 * SUSE Linux Enterprise Server 15 SP4 LTSS 15-SP4 * SUSE Linux Enterprise Server 15 SP5 * SUSE Linux Enterprise Server for SAP Applications 15 SP2 * SUSE Linux Enterprise Server for SAP Applications 15 SP3 * SUSE Linux Enterprise Server for SAP Applications 15 SP4 * SUSE Linux Enterprise Server for SAP Applications 15 SP5 * SUSE Manager Proxy 4.3 * SUSE Manager Retail Branch Server 4.3 * SUSE Manager Server 4.3 An update that solves three vulnerabilities can now be installed. ## Description: This update for giflib fixes the following issues: Update to version 5.2.2 * Fixes for CVE-2023-48161 (bsc#1217390), CVE-2022-28506 (bsc#1198880) * # 138 Documentation for obsolete utilities still installed * # 139: Typo in "LZW image data" page ("110_2 = 4_10") * # 140: Typo in "LZW image data" page ("LWZ") * # 141: Typo in "Bits and bytes" page ("filed") * Note as already fixed SF issue #143: cannot compile under mingw * # 144: giflib-5.2.1 cannot be build on windows and other platforms using c89 * # 145: Remove manual pages installation for binaries that are not installed too * # 146: [PATCH] Limit installed man pages to binaries, move giflib to section 7 * # 147 [PATCH] Fixes to doc/whatsinagif/ content * # 148: heap Out of Bound Read in gif2rgb.c:298 DumpScreen2RGB * Declared no-info on SF issue #150: There is a denial of service vulnerability in GIFLIB 5.2.1 * Declared Won't-fix on SF issue 149: Out of source builds no longer possible * # 151: A heap-buffer-overflow in gif2rgb.c:294:45 * # 152: Fix some typos on the html documentation and man pages * # 153: Fix segmentation faults due to non correct checking for args * # 154: Recover the giffilter manual page * # 155: Add gifsponge docs * # 157: An OutofMemory-Exception or Memory Leak in gif2rgb * # 158: There is a null pointer problem in gif2rgb * # 159 A heap-buffer-overflow in GIFLIB5.2.1 DumpScreen2RGB() in gif2rgb.c:298:45 * # 163: detected memory leaks in openbsd_reallocarray giflib/openbsd- reallocarray.c * # 164: detected memory leaks in GifMakeMapObject giflib/gifalloc.c * # 166: a read zero page leads segment fault in getarg.c and memory leaks in gif2rgb.c and gifmalloc.c * # 167: Heap-Buffer Overflow during Image Saving in DumpScreen2RGB Function at Line 321 of gif2rgb.c ## Patch Instructions: To install this SUSE update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: * openSUSE Leap 15.5 zypper in -t patch openSUSE-SLE-15.5-2024-786=1 * Basesystem Module 15-SP5 zypper in -t patch SUSE-SLE-Module-Basesystem-15-SP5-2024-786=1 * SUSE Linux Enterprise High Performance Computing 15 SP2 LTSS 15-SP2 zypper in -t patch SUSE-SLE-Product-HPC-15-SP2-LTSS-2024-786=1 * SUSE Linux Enterprise High Performance Computing LTSS 15 SP3 zypper in -t patch SUSE-SLE-Product-HPC-15-SP3-LTSS-2024-786=1 * SUSE Linux Enterprise High Performance Computing ESPOS 15 SP4 zypper in -t patch SUSE-SLE-Product-HPC-15-SP4-ESPOS-2024-786=1 * SUSE Linux Enterprise High Performance Computing LTSS 15 SP4 zypper in -t patch SUSE-SLE-Product-HPC-15-SP4-LTSS-2024-786=1 * SUSE Linux Enterprise Desktop 15 SP4 LTSS 15-SP4 zypper in -t patch SUSE-SLE-Product-SLED-15-SP4-LTSS-2024-786=1 * SUSE Linux Enterprise Server 15 SP2 LTSS 15-SP2 zypper in -t patch SUSE-SLE-Product-SLES-15-SP2-LTSS-2024-786=1 * SUSE Linux Enterprise Server 15 SP3 LTSS 15-SP3 zypper in -t patch SUSE-SLE-Product-SLES-15-SP3-LTSS-2024-786=1 * SUSE Linux Enterprise Server 15 SP4 LTSS 15-SP4 zypper in -t patch SUSE-SLE-Product-SLES-15-SP4-LTSS-2024-786=1 * SUSE Linux Enterprise Server for SAP Applications 15 SP2 zypper in -t patch SUSE-SLE-Product-SLES_SAP-15-SP2-2024-786=1 * SUSE Linux Enterprise Server for SAP Applications 15 SP3 zypper in -t patch SUSE-SLE-Product-SLES_SAP-15-SP3-2024-786=1 * SUSE Linux Enterprise Server for SAP Applications 15 SP4 zypper in -t patch SUSE-SLE-Product-SLES_SAP-15-SP4-2024-786=1 * SUSE Manager Proxy 4.3 zypper in -t patch SUSE-SLE-Product-SUSE-Manager-Proxy-4.3-2024-786=1 * SUSE Manager Retail Branch Server 4.3 zypper in -t patch SUSE-SLE-Product-SUSE-Manager-Retail-Branch- Server-4.3-2024-786=1 * SUSE Manager Server 4.3 zypper in -t patch SUSE-SLE-Product-SUSE-Manager-Server-4.3-2024-786=1 * SUSE Enterprise Storage 7.1 zypper in -t patch SUSE-Storage-7.1-2024-786=1 ## Package List: * openSUSE Leap 15.5 (aarch64 ppc64le s390x x86_64) * giflib-debugsource-5.2.2-150000.4.13.1 * libgif7-debuginfo-5.2.2-150000.4.13.1 * libgif7-5.2.2-150000.4.13.1 * giflib-progs-5.2.2-150000.4.13.1 * giflib-progs-debuginfo-5.2.2-150000.4.13.1 * giflib-devel-5.2.2-150000.4.13.1 * openSUSE Leap 15.5 (x86_64) * libgif7-32bit-5.2.2-150000.4.13.1 * giflib-devel-32bit-5.2.2-150000.4.13.1 * libgif7-32bit-debuginfo-5.2.2-150000.4.13.1 * Basesystem Module 15-SP5 (aarch64 ppc64le s390x x86_64) * libgif7-5.2.2-150000.4.13.1 * giflib-debugsource-5.2.2-150000.4.13.1 * libgif7-debuginfo-5.2.2-150000.4.13.1 * giflib-devel-5.2.2-150000.4.13.1 * SUSE Linux Enterprise High Performance Computing 15 SP2 LTSS 15-SP2 (aarch64 x86_64) * libgif7-5.2.2-150000.4.13.1 * giflib-debugsource-5.2.2-150000.4.13.1 * libgif7-debuginfo-5.2.2-150000.4.13.1 * giflib-devel-5.2.2-150000.4.13.1 * SUSE Linux Enterprise High Performance Computing LTSS 15 SP3 (aarch64 x86_64) * libgif7-5.2.2-150000.4.13.1 * giflib-debugsource-5.2.2-150000.4.13.1 * libgif7-debuginfo-5.2.2-150000.4.13.1 * giflib-devel-5.2.2-150000.4.13.1 * SUSE Linux Enterprise High Performance Computing ESPOS 15 SP4 (aarch64 x86_64) * libgif7-5.2.2-150000.4.13.1 * giflib-debugsource-5.2.2-150000.4.13.1 * libgif7-debuginfo-5.2.2-150000.4.13.1 * giflib-devel-5.2.2-150000.4.13.1 * SUSE Linux Enterprise High Performance Computing LTSS 15 SP4 (aarch64 x86_64) * libgif7-5.2.2-150000.4.13.1 * giflib-debugsource-5.2.2-150000.4.13.1 * libgif7-debuginfo-5.2.2-150000.4.13.1 * giflib-devel-5.2.2-150000.4.13.1 * SUSE Linux Enterprise Desktop 15 SP4 LTSS 15-SP4 (x86_64) * libgif7-5.2.2-150000.4.13.1 * giflib-debugsource-5.2.2-150000.4.13.1 * libgif7-debuginfo-5.2.2-150000.4.13.1 * giflib-devel-5.2.2-150000.4.13.1 * SUSE Linux Enterprise Server 15 SP2 LTSS 15-SP2 (aarch64 ppc64le s390x x86_64) * libgif7-5.2.2-150000.4.13.1 * giflib-debugsource-5.2.2-150000.4.13.1 * libgif7-debuginfo-5.2.2-150000.4.13.1 * giflib-devel-5.2.2-150000.4.13.1 * SUSE Linux Enterprise Server 15 SP3 LTSS 15-SP3 (aarch64 ppc64le s390x x86_64) * libgif7-5.2.2-150000.4.13.1 * giflib-debugsource-5.2.2-150000.4.13.1 * libgif7-debuginfo-5.2.2-150000.4.13.1 * giflib-devel-5.2.2-150000.4.13.1 * SUSE Linux Enterprise Server 15 SP4 LTSS 15-SP4 (aarch64 ppc64le s390x x86_64) * libgif7-5.2.2-150000.4.13.1 * giflib-debugsource-5.2.2-150000.4.13.1 * libgif7-debuginfo-5.2.2-150000.4.13.1 * giflib-devel-5.2.2-150000.4.13.1 * SUSE Linux Enterprise Server for SAP Applications 15 SP2 (ppc64le x86_64) * libgif7-5.2.2-150000.4.13.1 * giflib-debugsource-5.2.2-150000.4.13.1 * libgif7-debuginfo-5.2.2-150000.4.13.1 * giflib-devel-5.2.2-150000.4.13.1 * SUSE Linux Enterprise Server for SAP Applications 15 SP3 (ppc64le x86_64) * libgif7-5.2.2-150000.4.13.1 * giflib-debugsource-5.2.2-150000.4.13.1 * libgif7-debuginfo-5.2.2-150000.4.13.1 * giflib-devel-5.2.2-150000.4.13.1 * SUSE Linux Enterprise Server for SAP Applications 15 SP4 (ppc64le x86_64) * libgif7-5.2.2-150000.4.13.1 * giflib-debugsource-5.2.2-150000.4.13.1 * libgif7-debuginfo-5.2.2-150000.4.13.1 * giflib-devel-5.2.2-150000.4.13.1 * SUSE Manager Proxy 4.3 (x86_64) * libgif7-5.2.2-150000.4.13.1 * giflib-debugsource-5.2.2-150000.4.13.1 * libgif7-debuginfo-5.2.2-150000.4.13.1 * giflib-devel-5.2.2-150000.4.13.1 * SUSE Manager Retail Branch Server 4.3 (x86_64) * libgif7-5.2.2-150000.4.13.1 * giflib-debugsource-5.2.2-150000.4.13.1 * libgif7-debuginfo-5.2.2-150000.4.13.1 * giflib-devel-5.2.2-150000.4.13.1 * SUSE Manager Server 4.3 (ppc64le s390x x86_64) * libgif7-5.2.2-150000.4.13.1 * giflib-debugsource-5.2.2-150000.4.13.1 * libgif7-debuginfo-5.2.2-150000.4.13.1 * giflib-devel-5.2.2-150000.4.13.1 * SUSE Enterprise Storage 7.1 (aarch64 x86_64) * libgif7-5.2.2-150000.4.13.1 * giflib-debugsource-5.2.2-150000.4.13.1 * libgif7-debuginfo-5.2.2-150000.4.13.1 * giflib-devel-5.2.2-150000.4.13.1 ## References: * https://www.suse.com/security/cve/CVE-2021-40633.html * https://www.suse.com/security/cve/CVE-2022-28506.html * https://www.suse.com/security/cve/CVE-2023-48161.html * https://bugzilla.suse.com/show_bug.cgi?id=1198880 * https://bugzilla.suse.com/show_bug.cgi?id=1200551 * https://bugzilla.suse.com/show_bug.cgi?id=1217390 [View Less]

1 0

SUSE-SU-2024:0784-1: important: Security update for python39
by OPENSUSE-SECURITY-UPDATES 06 Mar '24

06 Mar '24

# Security update for python39 Announcement ID: SUSE-SU-2024:0784-1 Rating: important References: * bsc#1196025 * bsc#1210638 * bsc#1212015 * bsc#1214692 * bsc#1215454 * bsc#1219666 * jsc#PED-7886 * jsc#SLE-21253 Cross-References: * CVE-2022-25236 * CVE-2023-27043 * CVE-2023-40217 * CVE-2023-6597 CVSS scores: * CVE-2022-25236 ( SUSE ): 7.5 CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H * CVE-2022-25236 ( NVD ): 9.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/… [View More]I:H/A:H * CVE-2023-27043 ( SUSE ): 5.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N * CVE-2023-27043 ( NVD ): 5.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N * CVE-2023-40217 ( SUSE ): 7.4 CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N * CVE-2023-40217 ( NVD ): 5.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N * CVE-2023-6597 ( SUSE ): 8.4 CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H Affected Products: * openSUSE Leap 15.3 * openSUSE Leap 15.5 * SUSE Enterprise Storage 7.1 * SUSE Linux Enterprise High Performance Computing 15 SP3 * SUSE Linux Enterprise High Performance Computing LTSS 15 SP3 * SUSE Linux Enterprise Server 15 SP3 * SUSE Linux Enterprise Server 15 SP3 LTSS 15-SP3 * SUSE Linux Enterprise Server for SAP Applications 15 SP3 An update that solves four vulnerabilities, contains two features and has two security fixes can now be installed. ## Description: This update for python39 fixes the following issues: * CVE-2023-6597: Fixed symlink bug in cleanup of tempfile.TemporaryDirectory (bsc#1219666). * CVE-2023-27043: Fixed incorrect e-mqil parsing (bsc#1210638). * CVE-2023-40217: Fixed a ssl.SSLSocket TLS bypass vulnerability where data is sent unencrypted (bsc#1214692). * CVE-2022-25236: Fixed an expat vulnerability by supporting expat >= 2.4.4 (bsc#1212015). ## Patch Instructions: To install this SUSE update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: * openSUSE Leap 15.3 zypper in -t patch SUSE-2024-784=1 * openSUSE Leap 15.5 zypper in -t patch openSUSE-SLE-15.5-2024-784=1 * SUSE Linux Enterprise High Performance Computing LTSS 15 SP3 zypper in -t patch SUSE-SLE-Product-HPC-15-SP3-LTSS-2024-784=1 * SUSE Linux Enterprise Server 15 SP3 LTSS 15-SP3 zypper in -t patch SUSE-SLE-Product-SLES-15-SP3-LTSS-2024-784=1 * SUSE Linux Enterprise Server for SAP Applications 15 SP3 zypper in -t patch SUSE-SLE-Product-SLES_SAP-15-SP3-2024-784=1 * SUSE Enterprise Storage 7.1 zypper in -t patch SUSE-Storage-7.1-2024-784=1 ## Package List: * openSUSE Leap 15.3 (aarch64 ppc64le s390x x86_64 i586) * python39-core-debugsource-3.9.18-150300.4.38.1 * python39-tk-debuginfo-3.9.18-150300.4.38.1 * python39-debuginfo-3.9.18-150300.4.38.1 * python39-base-debuginfo-3.9.18-150300.4.38.1 * python39-devel-3.9.18-150300.4.38.1 * python39-curses-3.9.18-150300.4.38.1 * python39-doc-3.9.18-150300.4.38.1 * libpython3_9-1_0-debuginfo-3.9.18-150300.4.38.1 * python39-curses-debuginfo-3.9.18-150300.4.38.1 * python39-dbm-3.9.18-150300.4.38.1 * libpython3_9-1_0-3.9.18-150300.4.38.1 * python39-base-3.9.18-150300.4.38.1 * python39-tk-3.9.18-150300.4.38.1 * python39-idle-3.9.18-150300.4.38.1 * python39-3.9.18-150300.4.38.1 * python39-tools-3.9.18-150300.4.38.1 * python39-doc-devhelp-3.9.18-150300.4.38.1 * python39-testsuite-3.9.18-150300.4.38.1 * python39-debugsource-3.9.18-150300.4.38.1 * python39-dbm-debuginfo-3.9.18-150300.4.38.1 * python39-testsuite-debuginfo-3.9.18-150300.4.38.1 * openSUSE Leap 15.3 (x86_64) * libpython3_9-1_0-32bit-debuginfo-3.9.18-150300.4.38.1 * python39-32bit-debuginfo-3.9.18-150300.4.38.1 * python39-base-32bit-debuginfo-3.9.18-150300.4.38.1 * python39-32bit-3.9.18-150300.4.38.1 * libpython3_9-1_0-32bit-3.9.18-150300.4.38.1 * python39-base-32bit-3.9.18-150300.4.38.1 * openSUSE Leap 15.3 (aarch64_ilp32) * libpython3_9-1_0-64bit-debuginfo-3.9.18-150300.4.38.1 * python39-base-64bit-debuginfo-3.9.18-150300.4.38.1 * libpython3_9-1_0-64bit-3.9.18-150300.4.38.1 * python39-64bit-debuginfo-3.9.18-150300.4.38.1 * python39-base-64bit-3.9.18-150300.4.38.1 * python39-64bit-3.9.18-150300.4.38.1 * openSUSE Leap 15.5 (aarch64 ppc64le s390x x86_64) * python39-core-debugsource-3.9.18-150300.4.38.1 * python39-tk-debuginfo-3.9.18-150300.4.38.1 * python39-debuginfo-3.9.18-150300.4.38.1 * python39-base-debuginfo-3.9.18-150300.4.38.1 * python39-devel-3.9.18-150300.4.38.1 * python39-curses-3.9.18-150300.4.38.1 * python39-doc-3.9.18-150300.4.38.1 * libpython3_9-1_0-debuginfo-3.9.18-150300.4.38.1 * python39-curses-debuginfo-3.9.18-150300.4.38.1 * python39-dbm-3.9.18-150300.4.38.1 * libpython3_9-1_0-3.9.18-150300.4.38.1 * python39-base-3.9.18-150300.4.38.1 * python39-tk-3.9.18-150300.4.38.1 * python39-idle-3.9.18-150300.4.38.1 * python39-3.9.18-150300.4.38.1 * python39-tools-3.9.18-150300.4.38.1 * python39-doc-devhelp-3.9.18-150300.4.38.1 * python39-testsuite-3.9.18-150300.4.38.1 * python39-debugsource-3.9.18-150300.4.38.1 * python39-dbm-debuginfo-3.9.18-150300.4.38.1 * python39-testsuite-debuginfo-3.9.18-150300.4.38.1 * openSUSE Leap 15.5 (x86_64) * libpython3_9-1_0-32bit-debuginfo-3.9.18-150300.4.38.1 * python39-32bit-debuginfo-3.9.18-150300.4.38.1 * python39-base-32bit-debuginfo-3.9.18-150300.4.38.1 * python39-32bit-3.9.18-150300.4.38.1 * libpython3_9-1_0-32bit-3.9.18-150300.4.38.1 * python39-base-32bit-3.9.18-150300.4.38.1 * SUSE Linux Enterprise High Performance Computing LTSS 15 SP3 (aarch64 x86_64) * python39-tk-3.9.18-150300.4.38.1 * python39-core-debugsource-3.9.18-150300.4.38.1 * python39-curses-3.9.18-150300.4.38.1 * python39-tk-debuginfo-3.9.18-150300.4.38.1 * python39-debuginfo-3.9.18-150300.4.38.1 * libpython3_9-1_0-debuginfo-3.9.18-150300.4.38.1 * python39-idle-3.9.18-150300.4.38.1 * python39-debugsource-3.9.18-150300.4.38.1 * python39-dbm-debuginfo-3.9.18-150300.4.38.1 * python39-3.9.18-150300.4.38.1 * python39-base-debuginfo-3.9.18-150300.4.38.1 * python39-curses-debuginfo-3.9.18-150300.4.38.1 * python39-devel-3.9.18-150300.4.38.1 * python39-dbm-3.9.18-150300.4.38.1 * libpython3_9-1_0-3.9.18-150300.4.38.1 * python39-base-3.9.18-150300.4.38.1 * python39-tools-3.9.18-150300.4.38.1 * SUSE Linux Enterprise Server 15 SP3 LTSS 15-SP3 (aarch64 ppc64le s390x x86_64) * python39-tk-3.9.18-150300.4.38.1 * python39-core-debugsource-3.9.18-150300.4.38.1 * python39-curses-3.9.18-150300.4.38.1 * python39-tk-debuginfo-3.9.18-150300.4.38.1 * python39-debuginfo-3.9.18-150300.4.38.1 * libpython3_9-1_0-debuginfo-3.9.18-150300.4.38.1 * python39-idle-3.9.18-150300.4.38.1 * python39-debugsource-3.9.18-150300.4.38.1 * python39-dbm-debuginfo-3.9.18-150300.4.38.1 * python39-3.9.18-150300.4.38.1 * python39-base-debuginfo-3.9.18-150300.4.38.1 * python39-curses-debuginfo-3.9.18-150300.4.38.1 * python39-devel-3.9.18-150300.4.38.1 * python39-dbm-3.9.18-150300.4.38.1 * libpython3_9-1_0-3.9.18-150300.4.38.1 * python39-base-3.9.18-150300.4.38.1 * python39-tools-3.9.18-150300.4.38.1 * SUSE Linux Enterprise Server for SAP Applications 15 SP3 (ppc64le x86_64) * python39-tk-3.9.18-150300.4.38.1 * python39-core-debugsource-3.9.18-150300.4.38.1 * python39-curses-3.9.18-150300.4.38.1 * python39-tk-debuginfo-3.9.18-150300.4.38.1 * python39-debuginfo-3.9.18-150300.4.38.1 * libpython3_9-1_0-debuginfo-3.9.18-150300.4.38.1 * python39-idle-3.9.18-150300.4.38.1 * python39-debugsource-3.9.18-150300.4.38.1 * python39-dbm-debuginfo-3.9.18-150300.4.38.1 * python39-3.9.18-150300.4.38.1 * python39-base-debuginfo-3.9.18-150300.4.38.1 * python39-curses-debuginfo-3.9.18-150300.4.38.1 * python39-devel-3.9.18-150300.4.38.1 * python39-dbm-3.9.18-150300.4.38.1 * libpython3_9-1_0-3.9.18-150300.4.38.1 * python39-base-3.9.18-150300.4.38.1 * python39-tools-3.9.18-150300.4.38.1 * SUSE Enterprise Storage 7.1 (aarch64 x86_64) * python39-tk-3.9.18-150300.4.38.1 * python39-core-debugsource-3.9.18-150300.4.38.1 * python39-curses-3.9.18-150300.4.38.1 * python39-tk-debuginfo-3.9.18-150300.4.38.1 * python39-debuginfo-3.9.18-150300.4.38.1 * libpython3_9-1_0-debuginfo-3.9.18-150300.4.38.1 * python39-idle-3.9.18-150300.4.38.1 * python39-debugsource-3.9.18-150300.4.38.1 * python39-dbm-debuginfo-3.9.18-150300.4.38.1 * python39-3.9.18-150300.4.38.1 * python39-base-debuginfo-3.9.18-150300.4.38.1 * python39-curses-debuginfo-3.9.18-150300.4.38.1 * python39-devel-3.9.18-150300.4.38.1 * python39-dbm-3.9.18-150300.4.38.1 * libpython3_9-1_0-3.9.18-150300.4.38.1 * python39-base-3.9.18-150300.4.38.1 * python39-tools-3.9.18-150300.4.38.1 ## References: * https://www.suse.com/security/cve/CVE-2022-25236.html * https://www.suse.com/security/cve/CVE-2023-27043.html * https://www.suse.com/security/cve/CVE-2023-40217.html * https://www.suse.com/security/cve/CVE-2023-6597.html * https://bugzilla.suse.com/show_bug.cgi?id=1196025 * https://bugzilla.suse.com/show_bug.cgi?id=1210638 * https://bugzilla.suse.com/show_bug.cgi?id=1212015 * https://bugzilla.suse.com/show_bug.cgi?id=1214692 * https://bugzilla.suse.com/show_bug.cgi?id=1215454 * https://bugzilla.suse.com/show_bug.cgi?id=1219666 * https://jira.suse.com/browse/PED-7886 * https://jira.suse.com/browse/SLE-21253 [View Less]

1 0

SUSE-SU-2024:0769-1: critical: Security update for postgresql-jdbc
by OPENSUSE-SECURITY-UPDATES 05 Mar '24

05 Mar '24

# Security update for postgresql-jdbc Announcement ID: SUSE-SU-2024:0769-1 Rating: critical References: * bsc#1220644 Cross-References: * CVE-2024-1597 CVSS scores: * CVE-2024-1597 ( SUSE ): 9.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H Affected Products: * openSUSE Leap 15.3 * SUSE Enterprise Storage 7.1 * SUSE Linux Enterprise High Performance Computing 15 SP3 * SUSE Linux Enterprise High Performance Computing LTSS 15 SP3 * SUSE Linux Enterprise Server … [View More]

1 0

SUSE-SU-2024:0770-1: important: Security update for kernel-firmware-nvidia-gspx-G06, nvidia-open-driver-G06-signed
by OPENSUSE-SECURITY-UPDATES 05 Mar '24

05 Mar '24

# Security update for kernel-firmware-nvidia-gspx-G06, nvidia-open- driver-G06-signed Announcement ID: SUSE-SU-2024:0770-1 Rating: important References: * bsc#1220552 * jsc#PED-7117 Cross-References: * CVE-2022-42265 * CVE-2024-0074 * CVE-2024-0075 CVSS scores: * CVE-2022-42265 ( SUSE ): 5.3 CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L * CVE-2022-42265 ( NVD ): 5.3 CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L * CVE-2024-0074 ( SUSE ): 7.1 CVSS:3.1/AV:L/AC:L/PR:… [View More]L/UI:N/S:U/C:N/I:H/A:H * CVE-2024-0075 ( SUSE ): 5.5 CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H Affected Products: * openSUSE Leap 15.4 * SUSE Linux Enterprise Desktop 15 SP4 LTSS 15-SP4 * SUSE Linux Enterprise High Performance Computing 15 SP4 * SUSE Linux Enterprise High Performance Computing ESPOS 15 SP4 * SUSE Linux Enterprise High Performance Computing LTSS 15 SP4 * SUSE Linux Enterprise Micro 5.3 * SUSE Linux Enterprise Micro 5.4 * SUSE Linux Enterprise Micro for Rancher 5.3 * SUSE Linux Enterprise Micro for Rancher 5.4 * SUSE Linux Enterprise Server 15 SP4 * SUSE Linux Enterprise Server 15 SP4 LTSS 15-SP4 * SUSE Linux Enterprise Server for SAP Applications 15 SP4 * SUSE Manager Proxy 4.3 * SUSE Manager Retail Branch Server 4.3 * SUSE Manager Server 4.3 An update that solves three vulnerabilities and contains one feature can now be installed. ## Description: This update for kernel-firmware-nvidia-gspx-G06, nvidia-open-driver-G06-signed fixes the following issues: Update to 550.54.14 * Added vGPU Host and vGPU Guest support. For vGPU Host, please refer to the README.vgpu packaged in the vGPU Host Package for more details. Security issues fixed: * CVE-2024-0074: A user could trigger a NULL ptr dereference. * CVE-2024-0075: A user could overwrite the end of a buffer, leading to crashes or code execution. * CVE-2022-42265: A unprivileged user could trigger an integer overflow which could lead to crashes or code execution. * create /run/udev/static_node-tags/uaccess/nvidia${devid} symlinks also during modprobing the nvidia module; this changes the issue of not having access to /dev/nvidia${devid}, when gfxcard has been replaced by a different gfx card after installing the driver * provide nvidia-open-driver-G06-kmp (jsc#PED-7117) * this makes it easy to replace the package from nVidia's CUDA repository with this presigned package ## Patch Instructions: To install this SUSE update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: * SUSE Linux Enterprise Micro for Rancher 5.4 zypper in -t patch SUSE-SLE-Micro-5.4-2024-770=1 * SUSE Linux Enterprise Micro 5.4 zypper in -t patch SUSE-SLE-Micro-5.4-2024-770=1 * SUSE Linux Enterprise High Performance Computing ESPOS 15 SP4 zypper in -t patch SUSE-SLE-Product-HPC-15-SP4-ESPOS-2024-770=1 * SUSE Linux Enterprise High Performance Computing LTSS 15 SP4 zypper in -t patch SUSE-SLE-Product-HPC-15-SP4-LTSS-2024-770=1 * SUSE Linux Enterprise Desktop 15 SP4 LTSS 15-SP4 zypper in -t patch SUSE-SLE-Product-SLED-15-SP4-LTSS-2024-770=1 * SUSE Linux Enterprise Server 15 SP4 LTSS 15-SP4 zypper in -t patch SUSE-SLE-Product-SLES-15-SP4-LTSS-2024-770=1 * SUSE Linux Enterprise Server for SAP Applications 15 SP4 zypper in -t patch SUSE-SLE-Product-SLES_SAP-15-SP4-2024-770=1 * SUSE Manager Proxy 4.3 zypper in -t patch SUSE-SLE-Product-SUSE-Manager-Proxy-4.3-2024-770=1 * SUSE Manager Retail Branch Server 4.3 zypper in -t patch SUSE-SLE-Product-SUSE-Manager-Retail-Branch- Server-4.3-2024-770=1 * SUSE Manager Server 4.3 zypper in -t patch SUSE-SLE-Product-SUSE-Manager-Server-4.3-2024-770=1 * openSUSE Leap 15.4 zypper in -t patch SUSE-2024-770=1 * SUSE Linux Enterprise Micro for Rancher 5.3 zypper in -t patch SUSE-SLE-Micro-5.3-2024-770=1 * SUSE Linux Enterprise Micro 5.3 zypper in -t patch SUSE-SLE-Micro-5.3-2024-770=1 ## Package List: * SUSE Linux Enterprise Micro for Rancher 5.4 (aarch64 nosrc x86_64) * kernel-firmware-nvidia-gspx-G06-550.54.14-150400.9.21.1 * SUSE Linux Enterprise Micro for Rancher 5.4 (aarch64 x86_64) * nvidia-open-driver-G06-signed-kmp-default-550.54.14_k5.14.21_150400.24.108-150400.9.50.1 * nvidia-open-driver-G06-signed-debugsource-550.54.14-150400.9.50.1 * nvidia-open-driver-G06-signed-kmp-default-debuginfo-550.54.14_k5.14.21_150400.24.108-150400.9.50.1 * SUSE Linux Enterprise Micro 5.4 (aarch64 nosrc x86_64) * kernel-firmware-nvidia-gspx-G06-550.54.14-150400.9.21.1 * SUSE Linux Enterprise Micro 5.4 (aarch64 x86_64) * nvidia-open-driver-G06-signed-kmp-default-550.54.14_k5.14.21_150400.24.108-150400.9.50.1 * nvidia-open-driver-G06-signed-debugsource-550.54.14-150400.9.50.1 * nvidia-open-driver-G06-signed-kmp-default-debuginfo-550.54.14_k5.14.21_150400.24.108-150400.9.50.1 * SUSE Linux Enterprise High Performance Computing ESPOS 15 SP4 (aarch64 nosrc x86_64) * kernel-firmware-nvidia-gspx-G06-550.54.14-150400.9.21.1 * SUSE Linux Enterprise High Performance Computing ESPOS 15 SP4 (aarch64) * nvidia-open-driver-G06-signed-kmp-64kb-debuginfo-550.54.14_k5.14.21_150400.24.108-150400.9.50.1 * nvidia-open-driver-G06-signed-64kb-devel-550.54.14-150400.9.50.1 * nvidia-open-driver-G06-signed-kmp-64kb-550.54.14_k5.14.21_150400.24.108-150400.9.50.1 * SUSE Linux Enterprise High Performance Computing ESPOS 15 SP4 (aarch64 x86_64) * nvidia-open-driver-G06-signed-kmp-default-550.54.14_k5.14.21_150400.24.108-150400.9.50.1 * nvidia-open-driver-G06-signed-debugsource-550.54.14-150400.9.50.1 * nvidia-open-driver-G06-signed-default-devel-550.54.14-150400.9.50.1 * nvidia-open-driver-G06-signed-kmp-default-debuginfo-550.54.14_k5.14.21_150400.24.108-150400.9.50.1 * SUSE Linux Enterprise High Performance Computing LTSS 15 SP4 (aarch64 nosrc x86_64) * kernel-firmware-nvidia-gspx-G06-550.54.14-150400.9.21.1 * SUSE Linux Enterprise High Performance Computing LTSS 15 SP4 (aarch64) * nvidia-open-driver-G06-signed-kmp-64kb-debuginfo-550.54.14_k5.14.21_150400.24.108-150400.9.50.1 * nvidia-open-driver-G06-signed-64kb-devel-550.54.14-150400.9.50.1 * nvidia-open-driver-G06-signed-kmp-64kb-550.54.14_k5.14.21_150400.24.108-150400.9.50.1 * SUSE Linux Enterprise High Performance Computing LTSS 15 SP4 (aarch64 x86_64) * nvidia-open-driver-G06-signed-kmp-default-550.54.14_k5.14.21_150400.24.108-150400.9.50.1 * nvidia-open-driver-G06-signed-debugsource-550.54.14-150400.9.50.1 * nvidia-open-driver-G06-signed-default-devel-550.54.14-150400.9.50.1 * nvidia-open-driver-G06-signed-kmp-default-debuginfo-550.54.14_k5.14.21_150400.24.108-150400.9.50.1 * SUSE Linux Enterprise Desktop 15 SP4 LTSS 15-SP4 (nosrc x86_64) * kernel-firmware-nvidia-gspx-G06-550.54.14-150400.9.21.1 * SUSE Linux Enterprise Desktop 15 SP4 LTSS 15-SP4 (x86_64) * nvidia-open-driver-G06-signed-kmp-default-550.54.14_k5.14.21_150400.24.108-150400.9.50.1 * nvidia-open-driver-G06-signed-debugsource-550.54.14-150400.9.50.1 * nvidia-open-driver-G06-signed-default-devel-550.54.14-150400.9.50.1 * nvidia-open-driver-G06-signed-kmp-default-debuginfo-550.54.14_k5.14.21_150400.24.108-150400.9.50.1 * SUSE Linux Enterprise Server 15 SP4 LTSS 15-SP4 (aarch64 nosrc x86_64) * kernel-firmware-nvidia-gspx-G06-550.54.14-150400.9.21.1 * SUSE Linux Enterprise Server 15 SP4 LTSS 15-SP4 (aarch64) * nvidia-open-driver-G06-signed-kmp-64kb-debuginfo-550.54.14_k5.14.21_150400.24.108-150400.9.50.1 * nvidia-open-driver-G06-signed-64kb-devel-550.54.14-150400.9.50.1 * nvidia-open-driver-G06-signed-kmp-64kb-550.54.14_k5.14.21_150400.24.108-150400.9.50.1 * SUSE Linux Enterprise Server 15 SP4 LTSS 15-SP4 (aarch64 x86_64) * nvidia-open-driver-G06-signed-kmp-default-550.54.14_k5.14.21_150400.24.108-150400.9.50.1 * nvidia-open-driver-G06-signed-debugsource-550.54.14-150400.9.50.1 * nvidia-open-driver-G06-signed-default-devel-550.54.14-150400.9.50.1 * nvidia-open-driver-G06-signed-kmp-default-debuginfo-550.54.14_k5.14.21_150400.24.108-150400.9.50.1 * SUSE Linux Enterprise Server for SAP Applications 15 SP4 (nosrc x86_64) * kernel-firmware-nvidia-gspx-G06-550.54.14-150400.9.21.1 * SUSE Linux Enterprise Server for SAP Applications 15 SP4 (x86_64) * nvidia-open-driver-G06-signed-kmp-default-550.54.14_k5.14.21_150400.24.108-150400.9.50.1 * nvidia-open-driver-G06-signed-debugsource-550.54.14-150400.9.50.1 * nvidia-open-driver-G06-signed-default-devel-550.54.14-150400.9.50.1 * nvidia-open-driver-G06-signed-kmp-default-debuginfo-550.54.14_k5.14.21_150400.24.108-150400.9.50.1 * SUSE Manager Proxy 4.3 (nosrc x86_64) * kernel-firmware-nvidia-gspx-G06-550.54.14-150400.9.21.1 * SUSE Manager Proxy 4.3 (x86_64) * nvidia-open-driver-G06-signed-kmp-default-550.54.14_k5.14.21_150400.24.108-150400.9.50.1 * nvidia-open-driver-G06-signed-debugsource-550.54.14-150400.9.50.1 * nvidia-open-driver-G06-signed-default-devel-550.54.14-150400.9.50.1 * nvidia-open-driver-G06-signed-kmp-default-debuginfo-550.54.14_k5.14.21_150400.24.108-150400.9.50.1 * SUSE Manager Retail Branch Server 4.3 (nosrc x86_64) * kernel-firmware-nvidia-gspx-G06-550.54.14-150400.9.21.1 * SUSE Manager Retail Branch Server 4.3 (x86_64) * nvidia-open-driver-G06-signed-kmp-default-550.54.14_k5.14.21_150400.24.108-150400.9.50.1 * nvidia-open-driver-G06-signed-debugsource-550.54.14-150400.9.50.1 * nvidia-open-driver-G06-signed-default-devel-550.54.14-150400.9.50.1 * nvidia-open-driver-G06-signed-kmp-default-debuginfo-550.54.14_k5.14.21_150400.24.108-150400.9.50.1 * SUSE Manager Server 4.3 (nosrc x86_64) * kernel-firmware-nvidia-gspx-G06-550.54.14-150400.9.21.1 * SUSE Manager Server 4.3 (x86_64) * nvidia-open-driver-G06-signed-kmp-default-550.54.14_k5.14.21_150400.24.108-150400.9.50.1 * nvidia-open-driver-G06-signed-debugsource-550.54.14-150400.9.50.1 * nvidia-open-driver-G06-signed-default-devel-550.54.14-150400.9.50.1 * nvidia-open-driver-G06-signed-kmp-default-debuginfo-550.54.14_k5.14.21_150400.24.108-150400.9.50.1 * openSUSE Leap 15.4 (aarch64 nosrc x86_64) * kernel-firmware-nvidia-gspx-G06-550.54.14-150400.9.21.1 * openSUSE Leap 15.4 (x86_64) * nvidia-open-driver-G06-signed-kmp-azure-debuginfo-550.54.14_k5.14.21_150400.14.75-150400.9.50.1 * nvidia-open-driver-G06-signed-kmp-azure-550.54.14_k5.14.21_150400.14.75-150400.9.50.1 * nvidia-open-driver-G06-signed-azure-devel-550.54.14-150400.9.50.1 * openSUSE Leap 15.4 (aarch64 x86_64) * nvidia-open-driver-G06-signed-kmp-default-550.54.14_k5.14.21_150400.24.108-150400.9.50.1 * nvidia-open-driver-G06-signed-debugsource-550.54.14-150400.9.50.1 * nvidia-open-driver-G06-signed-default-devel-550.54.14-150400.9.50.1 * nvidia-open-driver-G06-signed-kmp-default-debuginfo-550.54.14_k5.14.21_150400.24.108-150400.9.50.1 * openSUSE Leap 15.4 (aarch64) * nvidia-open-driver-G06-signed-kmp-64kb-debuginfo-550.54.14_k5.14.21_150400.24.108-150400.9.50.1 * nvidia-open-driver-G06-signed-64kb-devel-550.54.14-150400.9.50.1 * nvidia-open-driver-G06-signed-kmp-64kb-550.54.14_k5.14.21_150400.24.108-150400.9.50.1 * SUSE Linux Enterprise Micro for Rancher 5.3 (aarch64 nosrc x86_64) * kernel-firmware-nvidia-gspx-G06-550.54.14-150400.9.21.1 * SUSE Linux Enterprise Micro for Rancher 5.3 (aarch64 x86_64) * nvidia-open-driver-G06-signed-kmp-default-550.54.14_k5.14.21_150400.24.108-150400.9.50.1 * nvidia-open-driver-G06-signed-debugsource-550.54.14-150400.9.50.1 * nvidia-open-driver-G06-signed-kmp-default-debuginfo-550.54.14_k5.14.21_150400.24.108-150400.9.50.1 * SUSE Linux Enterprise Micro 5.3 (aarch64 nosrc x86_64) * kernel-firmware-nvidia-gspx-G06-550.54.14-150400.9.21.1 * SUSE Linux Enterprise Micro 5.3 (aarch64 x86_64) * nvidia-open-driver-G06-signed-kmp-default-550.54.14_k5.14.21_150400.24.108-150400.9.50.1 * nvidia-open-driver-G06-signed-debugsource-550.54.14-150400.9.50.1 * nvidia-open-driver-G06-signed-kmp-default-debuginfo-550.54.14_k5.14.21_150400.24.108-150400.9.50.1 ## References: * https://www.suse.com/security/cve/CVE-2022-42265.html * https://www.suse.com/security/cve/CVE-2024-0074.html * https://www.suse.com/security/cve/CVE-2024-0075.html * https://bugzilla.suse.com/show_bug.cgi?id=1220552 * https://jira.suse.com/browse/PED-7117 [View Less]

1 0

SUSE-SU-2024:0765-1: important: Security update for rubygem-rack
by OPENSUSE-SECURITY-UPDATES 05 Mar '24

05 Mar '24

# Security update for rubygem-rack Announcement ID: SUSE-SU-2024:0765-1 Rating: important References: * bsc#1220239 * bsc#1220242 * bsc#1220248 Cross-References: * CVE-2024-25126 * CVE-2024-26141 * CVE-2024-26146 CVSS scores: * CVE-2024-25126 ( SUSE ): 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H * CVE-2024-26141 ( SUSE ): 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H * CVE-2024-26146 ( SUSE ): 5.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L … [View More]Affected Products: * openSUSE Leap 15.5 * SUSE Linux Enterprise High Availability Extension 15 SP2 * SUSE Linux Enterprise High Availability Extension 15 SP3 * SUSE Linux Enterprise High Availability Extension 15 SP4 * SUSE Linux Enterprise High Availability Extension 15 SP5 * SUSE Linux Enterprise High Performance Computing 15 SP2 * SUSE Linux Enterprise High Performance Computing 15 SP3 * SUSE Linux Enterprise High Performance Computing 15 SP4 * SUSE Linux Enterprise High Performance Computing 15 SP5 * SUSE Linux Enterprise Server 15 SP2 * SUSE Linux Enterprise Server 15 SP2 Business Critical Linux 15-SP2 * SUSE Linux Enterprise Server 15 SP3 * SUSE Linux Enterprise Server 15 SP3 Business Critical Linux 15-SP3 * SUSE Linux Enterprise Server 15 SP4 * SUSE Linux Enterprise Server 15 SP5 * SUSE Linux Enterprise Server for SAP Applications 15 SP2 * SUSE Linux Enterprise Server for SAP Applications 15 SP3 * SUSE Linux Enterprise Server for SAP Applications 15 SP4 * SUSE Linux Enterprise Server for SAP Applications 15 SP5 * SUSE Manager Proxy 4.1 * SUSE Manager Proxy 4.2 * SUSE Manager Proxy 4.3 * SUSE Manager Retail Branch Server 4.1 * SUSE Manager Retail Branch Server 4.2 * SUSE Manager Retail Branch Server 4.3 * SUSE Manager Server 4.1 * SUSE Manager Server 4.2 * SUSE Manager Server 4.3 An update that solves three vulnerabilities can now be installed. ## Description: This update for rubygem-rack fixes the following issues: * CVE-2024-25126: Fixed a denial-of-service vulnerability in Rack Content-Type parsing (bsc#1220239). * CVE-2024-26141: Fixed a denial-of-service vulnerability in Range request header parsing (bsc#1220242). * CVE-2024-26146: Fixed a denial-of-service vulnerability in Rack headers parsing routine (bsc#1220248). ## Patch Instructions: To install this SUSE update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: * openSUSE Leap 15.5 zypper in -t patch openSUSE-SLE-15.5-2024-765=1 * SUSE Linux Enterprise High Availability Extension 15 SP2 zypper in -t patch SUSE-SLE-Product-HA-15-SP2-2024-765=1 * SUSE Linux Enterprise High Availability Extension 15 SP3 zypper in -t patch SUSE-SLE-Product-HA-15-SP3-2024-765=1 * SUSE Linux Enterprise High Availability Extension 15 SP4 zypper in -t patch SUSE-SLE-Product-HA-15-SP4-2024-765=1 * SUSE Linux Enterprise High Availability Extension 15 SP5 zypper in -t patch SUSE-SLE-Product-HA-15-SP5-2024-765=1 ## Package List: * openSUSE Leap 15.5 (aarch64 ppc64le s390x x86_64) * ruby2.5-rubygem-rack-doc-2.0.8-150000.3.21.2 * ruby2.5-rubygem-rack-testsuite-2.0.8-150000.3.21.2 * ruby2.5-rubygem-rack-2.0.8-150000.3.21.2 * SUSE Linux Enterprise High Availability Extension 15 SP2 (aarch64 ppc64le s390x x86_64) * ruby2.5-rubygem-rack-2.0.8-150000.3.21.2 * SUSE Linux Enterprise High Availability Extension 15 SP3 (aarch64 ppc64le s390x x86_64) * ruby2.5-rubygem-rack-2.0.8-150000.3.21.2 * SUSE Linux Enterprise High Availability Extension 15 SP4 (aarch64 ppc64le s390x x86_64) * ruby2.5-rubygem-rack-2.0.8-150000.3.21.2 * SUSE Linux Enterprise High Availability Extension 15 SP5 (aarch64 ppc64le s390x x86_64) * ruby2.5-rubygem-rack-2.0.8-150000.3.21.2 ## References: * https://www.suse.com/security/cve/CVE-2024-25126.html * https://www.suse.com/security/cve/CVE-2024-26141.html * https://www.suse.com/security/cve/CVE-2024-26146.html * https://bugzilla.suse.com/show_bug.cgi?id=1220239 * https://bugzilla.suse.com/show_bug.cgi?id=1220242 * https://bugzilla.suse.com/show_bug.cgi?id=1220248 [View Less]

1 0

SUSE-SU-2024:0763-1: moderate: Security update for python-cryptography
by OPENSUSE-SECURITY-UPDATES 05 Mar '24

05 Mar '24

# Security update for python-cryptography Announcement ID: SUSE-SU-2024:0763-1 Rating: moderate References: * bsc#1220210 Cross-References: * CVE-2024-26130 CVSS scores: * CVE-2024-26130 ( SUSE ): 6.2 CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H Affected Products: * openSUSE Leap 15.4 * openSUSE Leap 15.5 * Python 3 Module 15-SP5 * SUSE Linux Enterprise Desktop 15 SP5 * SUSE Linux Enterprise High Performance Computing 15 SP5 * SUSE Linux Enterprise Server … [View More]

1 0

SUSE-SU-2024:0764-1: important: Security update for wpa_supplicant
by OPENSUSE-SECURITY-UPDATES 05 Mar '24

05 Mar '24

# Security update for wpa_supplicant Announcement ID: SUSE-SU-2024:0764-1 Rating: important References: * bsc#1219975 Cross-References: * CVE-2023-52160 CVSS scores: * CVE-2023-52160 ( SUSE ): 7.5 CVSS:3.1/AV:A/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H * CVE-2023-52160 ( NVD ): 6.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N Affected Products: * Basesystem Module 15-SP5 * openSUSE Leap 15.5 * SUSE Linux Enterprise Desktop 15 SP5 * SUSE Linux Enterprise High … [View More]

1 0

SUSE-SU-2024:0743-1: moderate: Security update for sendmail
by OPENSUSE-SECURITY-UPDATES 04 Mar '24

04 Mar '24

# Security update for sendmail Announcement ID: SUSE-SU-2024:0743-1 Rating: moderate References: * bsc#1218351 Cross-References: * CVE-2023-51765 CVSS scores: * CVE-2023-51765 ( SUSE ): 5.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N * CVE-2023-51765 ( NVD ): 5.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N Affected Products: * Basesystem Module 15-SP5 * openSUSE Leap 15.5 * SUSE Linux Enterprise Desktop 15 SP5 * SUSE Linux Enterprise High Performance … [View More]Computing 15 SP5 * SUSE Linux Enterprise Micro 5.5 * SUSE Linux Enterprise Real Time 15 SP5 * SUSE Linux Enterprise Server 15 SP5 * SUSE Linux Enterprise Server for SAP Applications 15 SP5 * SUSE Package Hub 15 15-SP5 An update that solves one vulnerability can now be installed. ## Description: This update for sendmail fixes the following issues: * CVE-2023-51765: Fixed new SMTP smuggling attack. (bsc#1218351) ## Patch Instructions: To install this SUSE update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: * openSUSE Leap 15.5 zypper in -t patch openSUSE-SLE-15.5-2024-743=1 * Basesystem Module 15-SP5 zypper in -t patch SUSE-SLE-Module-Basesystem-15-SP5-2024-743=1 * SUSE Package Hub 15 15-SP5 zypper in -t patch SUSE-SLE-Module-Packagehub-Subpackages-15-SP5-2024-743=1 ## Package List: * openSUSE Leap 15.5 (noarch) * sendmail-starttls-8.15.2-150000.8.12.1 * libmilter-doc-8.15.2-150000.8.12.1 * openSUSE Leap 15.5 (aarch64 ppc64le s390x x86_64) * sendmail-devel-8.15.2-150000.8.12.1 * rmail-debuginfo-8.15.2-150000.8.12.1 * libmilter1_0-debuginfo-8.15.2-150000.8.12.1 * libmilter1_0-8.15.2-150000.8.12.1 * sendmail-8.15.2-150000.8.12.1 * sendmail-debuginfo-8.15.2-150000.8.12.1 * rmail-8.15.2-150000.8.12.1 * sendmail-debugsource-8.15.2-150000.8.12.1 * Basesystem Module 15-SP5 (aarch64 ppc64le s390x x86_64) * libmilter1_0-debuginfo-8.15.2-150000.8.12.1 * sendmail-debugsource-8.15.2-150000.8.12.1 * sendmail-debuginfo-8.15.2-150000.8.12.1 * libmilter1_0-8.15.2-150000.8.12.1 * SUSE Package Hub 15 15-SP5 (aarch64 ppc64le s390x x86_64) * rmail-debuginfo-8.15.2-150000.8.12.1 * sendmail-debugsource-8.15.2-150000.8.12.1 * rmail-8.15.2-150000.8.12.1 * sendmail-debuginfo-8.15.2-150000.8.12.1 ## References: * https://www.suse.com/security/cve/CVE-2023-51765.html * https://bugzilla.suse.com/show_bug.cgi?id=1218351 [View Less]

1 0

openSUSE-SU-2024:0064-1: moderate: Security update for zabbix
by opensuse-security＠opensuse.org 01 Mar '24

01 Mar '24

openSUSE Security Update: Security update for zabbix ______________________________________________________________________________ Announcement ID: openSUSE-SU-2024:0064-1 Rating: moderate References: #1219775 Cross-References: CVE-2024-22119 CVSS scores: CVE-2024-22119 (NVD) : 5.4 CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N CVE-2024-22119 (SUSE): 5.4 CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N Affected Products: … [View More]

1 0

SUSE-SU-2024:0728-1: important: Security update for nodejs16
by OPENSUSE-SECURITY-UPDATES 01 Mar '24

01 Mar '24

# Security update for nodejs16 Announcement ID: SUSE-SU-2024:0728-1 Rating: important References: * bsc#1219993 * bsc#1219997 * bsc#1220014 * bsc#1220017 * bsc#1220053 Cross-References: * CVE-2023-46809 * CVE-2024-22019 * CVE-2024-22025 * CVE-2024-24758 * CVE-2024-24806 CVSS scores: * CVE-2023-46809 ( SUSE ): 6.8 CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:N * CVE-2024-22019 ( SUSE ): 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H * CVE-2024-24758 ( … [View More]SUSE ): 3.9 CVSS:3.1/AV:N/AC:H/PR:H/UI:R/S:U/C:L/I:L/A:L * CVE-2024-24806 ( SUSE ): 5.9 CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N * CVE-2024-24806 ( NVD ): 7.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L Affected Products: * openSUSE Leap 15.4 * SUSE Linux Enterprise High Performance Computing 15 SP4 * SUSE Linux Enterprise High Performance Computing ESPOS 15 SP4 * SUSE Linux Enterprise High Performance Computing LTSS 15 SP4 * SUSE Linux Enterprise Server 15 SP4 * SUSE Linux Enterprise Server 15 SP4 LTSS 15-SP4 * SUSE Linux Enterprise Server for SAP Applications 15 SP4 * SUSE Manager Server 4.3 An update that solves five vulnerabilities can now be installed. ## Description: This update for nodejs16 fixes the following issues: Security issues fixed: * CVE-2023-46809: Node.js is vulnerable to the Marvin Attack (timing variant of the Bleichenbacher attack against PKCS#1 v1.5 padding) (bsc#1219997). * CVE-2024-22019: http: Reading unprocessed HTTP request with unbounded chunk extension allows DoS attacks (bsc#1219993). * CVE-2024-22025: Denial of Service by resource exhaustion in fetch() brotli decoding (bsc#1220014). * CVE-2024-24758: ignore proxy-authorization header (bsc#1220017). * CVE-2024-24806: fix improper domain lookup that potentially leads to SSRF attacks (bsc#1219724). ## Patch Instructions: To install this SUSE update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: * openSUSE Leap 15.4 zypper in -t patch SUSE-2024-728=1 * SUSE Linux Enterprise High Performance Computing ESPOS 15 SP4 zypper in -t patch SUSE-SLE-Product-HPC-15-SP4-ESPOS-2024-728=1 * SUSE Linux Enterprise High Performance Computing LTSS 15 SP4 zypper in -t patch SUSE-SLE-Product-HPC-15-SP4-LTSS-2024-728=1 * SUSE Linux Enterprise Server 15 SP4 LTSS 15-SP4 zypper in -t patch SUSE-SLE-Product-SLES-15-SP4-LTSS-2024-728=1 * SUSE Linux Enterprise Server for SAP Applications 15 SP4 zypper in -t patch SUSE-SLE-Product-SLES_SAP-15-SP4-2024-728=1 * SUSE Manager Server 4.3 zypper in -t patch SUSE-SLE-Product-SUSE-Manager-Server-4.3-2024-728=1 ## Package List: * openSUSE Leap 15.4 (aarch64 ppc64le s390x x86_64 i586) * nodejs16-debugsource-16.20.2-150400.3.30.1 * nodejs16-16.20.2-150400.3.30.1 * npm16-16.20.2-150400.3.30.1 * nodejs16-debuginfo-16.20.2-150400.3.30.1 * nodejs16-devel-16.20.2-150400.3.30.1 * corepack16-16.20.2-150400.3.30.1 * openSUSE Leap 15.4 (noarch) * nodejs16-docs-16.20.2-150400.3.30.1 * SUSE Linux Enterprise High Performance Computing ESPOS 15 SP4 (aarch64 x86_64) * nodejs16-debugsource-16.20.2-150400.3.30.1 * nodejs16-16.20.2-150400.3.30.1 * npm16-16.20.2-150400.3.30.1 * nodejs16-debuginfo-16.20.2-150400.3.30.1 * nodejs16-devel-16.20.2-150400.3.30.1 * SUSE Linux Enterprise High Performance Computing ESPOS 15 SP4 (noarch) * nodejs16-docs-16.20.2-150400.3.30.1 * SUSE Linux Enterprise High Performance Computing LTSS 15 SP4 (aarch64 x86_64) * nodejs16-debugsource-16.20.2-150400.3.30.1 * nodejs16-16.20.2-150400.3.30.1 * npm16-16.20.2-150400.3.30.1 * nodejs16-debuginfo-16.20.2-150400.3.30.1 * nodejs16-devel-16.20.2-150400.3.30.1 * SUSE Linux Enterprise High Performance Computing LTSS 15 SP4 (noarch) * nodejs16-docs-16.20.2-150400.3.30.1 * SUSE Linux Enterprise Server 15 SP4 LTSS 15-SP4 (aarch64 ppc64le s390x x86_64) * nodejs16-debugsource-16.20.2-150400.3.30.1 * nodejs16-16.20.2-150400.3.30.1 * npm16-16.20.2-150400.3.30.1 * nodejs16-debuginfo-16.20.2-150400.3.30.1 * nodejs16-devel-16.20.2-150400.3.30.1 * SUSE Linux Enterprise Server 15 SP4 LTSS 15-SP4 (noarch) * nodejs16-docs-16.20.2-150400.3.30.1 * SUSE Linux Enterprise Server for SAP Applications 15 SP4 (ppc64le x86_64) * nodejs16-debugsource-16.20.2-150400.3.30.1 * nodejs16-16.20.2-150400.3.30.1 * npm16-16.20.2-150400.3.30.1 * nodejs16-debuginfo-16.20.2-150400.3.30.1 * nodejs16-devel-16.20.2-150400.3.30.1 * SUSE Linux Enterprise Server for SAP Applications 15 SP4 (noarch) * nodejs16-docs-16.20.2-150400.3.30.1 * SUSE Manager Server 4.3 (ppc64le s390x x86_64) * nodejs16-debugsource-16.20.2-150400.3.30.1 * nodejs16-16.20.2-150400.3.30.1 * npm16-16.20.2-150400.3.30.1 * nodejs16-debuginfo-16.20.2-150400.3.30.1 * nodejs16-devel-16.20.2-150400.3.30.1 * SUSE Manager Server 4.3 (noarch) * nodejs16-docs-16.20.2-150400.3.30.1 ## References: * https://www.suse.com/security/cve/CVE-2023-46809.html * https://www.suse.com/security/cve/CVE-2024-22019.html * https://www.suse.com/security/cve/CVE-2024-22025.html * https://www.suse.com/security/cve/CVE-2024-24758.html * https://www.suse.com/security/cve/CVE-2024-24806.html * https://bugzilla.suse.com/show_bug.cgi?id=1219993 * https://bugzilla.suse.com/show_bug.cgi?id=1219997 * https://bugzilla.suse.com/show_bug.cgi?id=1220014 * https://bugzilla.suse.com/show_bug.cgi?id=1220017 * https://bugzilla.suse.com/show_bug.cgi?id=1220053 [View Less]

1 0

SUSE-SU-2024:0729-1: important: Security update for nodejs16
by OPENSUSE-SECURITY-UPDATES 01 Mar '24

01 Mar '24

# Security update for nodejs16 Announcement ID: SUSE-SU-2024:0729-1 Rating: important References: * bsc#1219993 * bsc#1219997 * bsc#1220014 * bsc#1220017 * bsc#1220053 Cross-References: * CVE-2023-46809 * CVE-2024-22019 * CVE-2024-22025 * CVE-2024-24758 * CVE-2024-24806 CVSS scores: * CVE-2023-46809 ( SUSE ): 6.8 CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:N * CVE-2024-22019 ( SUSE ): 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H * CVE-2024-24758 ( … [View More]SUSE ): 3.9 CVSS:3.1/AV:N/AC:H/PR:H/UI:R/S:U/C:L/I:L/A:L * CVE-2024-24806 ( SUSE ): 5.9 CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N * CVE-2024-24806 ( NVD ): 7.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L Affected Products: * openSUSE Leap 15.3 * SUSE Enterprise Storage 7.1 * SUSE Linux Enterprise High Performance Computing 15 SP3 * SUSE Linux Enterprise High Performance Computing LTSS 15 SP3 * SUSE Linux Enterprise Server 15 SP3 * SUSE Linux Enterprise Server 15 SP3 LTSS 15-SP3 * SUSE Linux Enterprise Server for SAP Applications 15 SP3 An update that solves five vulnerabilities can now be installed. ## Description: This update for nodejs16 fixes the following issues: Security issues fixed: * CVE-2023-46809: Node.js is vulnerable to the Marvin Attack (timing variant of the Bleichenbacher attack against PKCS#1 v1.5 padding) (bsc#1219997). * CVE-2024-22019: http: Reading unprocessed HTTP request with unbounded chunk extension allows DoS attacks (bsc#1219993). * CVE-2024-22025: Denial of Service by resource exhaustion in fetch() brotli decoding (bsc#1220014). * CVE-2024-24758: ignore proxy-authorization header (bsc#1220017). * CVE-2024-24806: fix improper domain lookup that potentially leads to SSRF attacks (bsc#1219724). ## Patch Instructions: To install this SUSE update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: * openSUSE Leap 15.3 zypper in -t patch SUSE-2024-729=1 * SUSE Linux Enterprise High Performance Computing LTSS 15 SP3 zypper in -t patch SUSE-SLE-Product-HPC-15-SP3-LTSS-2024-729=1 * SUSE Linux Enterprise Server 15 SP3 LTSS 15-SP3 zypper in -t patch SUSE-SLE-Product-SLES-15-SP3-LTSS-2024-729=1 * SUSE Linux Enterprise Server for SAP Applications 15 SP3 zypper in -t patch SUSE-SLE-Product-SLES_SAP-15-SP3-2024-729=1 * SUSE Enterprise Storage 7.1 zypper in -t patch SUSE-Storage-7.1-2024-729=1 ## Package List: * openSUSE Leap 15.3 (aarch64 ppc64le s390x x86_64 i586) * corepack16-16.20.2-150300.7.33.1 * npm16-16.20.2-150300.7.33.1 * nodejs16-debugsource-16.20.2-150300.7.33.1 * nodejs16-devel-16.20.2-150300.7.33.1 * nodejs16-debuginfo-16.20.2-150300.7.33.1 * nodejs16-16.20.2-150300.7.33.1 * openSUSE Leap 15.3 (noarch) * nodejs16-docs-16.20.2-150300.7.33.1 * SUSE Linux Enterprise High Performance Computing LTSS 15 SP3 (aarch64 x86_64) * npm16-16.20.2-150300.7.33.1 * nodejs16-debugsource-16.20.2-150300.7.33.1 * nodejs16-devel-16.20.2-150300.7.33.1 * nodejs16-debuginfo-16.20.2-150300.7.33.1 * nodejs16-16.20.2-150300.7.33.1 * SUSE Linux Enterprise High Performance Computing LTSS 15 SP3 (noarch) * nodejs16-docs-16.20.2-150300.7.33.1 * SUSE Linux Enterprise Server 15 SP3 LTSS 15-SP3 (aarch64 ppc64le s390x x86_64) * npm16-16.20.2-150300.7.33.1 * nodejs16-debugsource-16.20.2-150300.7.33.1 * nodejs16-devel-16.20.2-150300.7.33.1 * nodejs16-debuginfo-16.20.2-150300.7.33.1 * nodejs16-16.20.2-150300.7.33.1 * SUSE Linux Enterprise Server 15 SP3 LTSS 15-SP3 (noarch) * nodejs16-docs-16.20.2-150300.7.33.1 * SUSE Linux Enterprise Server for SAP Applications 15 SP3 (ppc64le x86_64) * npm16-16.20.2-150300.7.33.1 * nodejs16-debugsource-16.20.2-150300.7.33.1 * nodejs16-devel-16.20.2-150300.7.33.1 * nodejs16-debuginfo-16.20.2-150300.7.33.1 * nodejs16-16.20.2-150300.7.33.1 * SUSE Linux Enterprise Server for SAP Applications 15 SP3 (noarch) * nodejs16-docs-16.20.2-150300.7.33.1 * SUSE Enterprise Storage 7.1 (aarch64 x86_64) * npm16-16.20.2-150300.7.33.1 * nodejs16-debugsource-16.20.2-150300.7.33.1 * nodejs16-devel-16.20.2-150300.7.33.1 * nodejs16-debuginfo-16.20.2-150300.7.33.1 * nodejs16-16.20.2-150300.7.33.1 * SUSE Enterprise Storage 7.1 (noarch) * nodejs16-docs-16.20.2-150300.7.33.1 ## References: * https://www.suse.com/security/cve/CVE-2023-46809.html * https://www.suse.com/security/cve/CVE-2024-22019.html * https://www.suse.com/security/cve/CVE-2024-22025.html * https://www.suse.com/security/cve/CVE-2024-24758.html * https://www.suse.com/security/cve/CVE-2024-24806.html * https://bugzilla.suse.com/show_bug.cgi?id=1219993 * https://bugzilla.suse.com/show_bug.cgi?id=1219997 * https://bugzilla.suse.com/show_bug.cgi?id=1220014 * https://bugzilla.suse.com/show_bug.cgi?id=1220017 * https://bugzilla.suse.com/show_bug.cgi?id=1220053 [View Less]

1 0

Main

Development

Information

Community

Social Media

Other

openSUSE Security Announce