March 2024 - openSUSE Security Announce

SUSE-SU-2024:0812-1: important: Security update for go1.22
by OPENSUSE-SECURITY-UPDATES 08 Mar '24

08 Mar '24

# Security update for go1.22 Announcement ID: SUSE-SU-2024:0812-1 Rating: important References: * bsc#1218424 * bsc#1219988 * bsc#1220999 * bsc#1221000 * bsc#1221001 * bsc#1221002 * bsc#1221003 Cross-References: * CVE-2023-45289 * CVE-2023-45290 * CVE-2024-24783 * CVE-2024-24784 * CVE-2024-24785 CVSS scores: * CVE-2023-45289 ( SUSE ): 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N * CVE-2023-45290 ( SUSE ): 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H * CVE-2024-24783 ( SUSE ): 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H * CVE-2024-24784 ( SUSE ): 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N * CVE-2024-24785 ( SUSE ): 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N Affected Products: * Development Tools Module 15-SP5 * openSUSE Leap 15.5 * SUSE Linux Enterprise Desktop 15 SP5 * SUSE Linux Enterprise High Performance Computing 15 SP5 * SUSE Linux Enterprise Real Time 15 SP5 * SUSE Linux Enterprise Server 15 SP5 * SUSE Linux Enterprise Server for SAP Applications 15 SP5 An update that solves five vulnerabilities and has two security fixes can now be installed. ## Description: This update for go1.22 fixes the following issues: * Upgrade go to version 1.22.1 * CVE-2023-45289: net/http, net/http/cookiejar: incorrect forwarding of sensitive headers and cookies on HTTP redirect (bsc#1221000) * CVE-2023-45290: net/http: memory exhaustion in Request.ParseMultipartForm (bsc#1221001) * CVE-2024-24783: crypto/x509: Verify panics on certificates with an unknown public key algorithm (bsc#1220999) * CVE-2024-24784: net/mail: comments in display names are incorrectly handled (bsc#1221002) * CVE-2024-24785: html/template: errors returned from MarshalJSON methods may break template escaping (bsc#1221003) ## Patch Instructions: To install this SUSE update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: * openSUSE Leap 15.5 zypper in -t patch openSUSE-SLE-15.5-2024-812=1 * Development Tools Module 15-SP5 zypper in -t patch SUSE-SLE-Module-Development-Tools-15-SP5-2024-812=1 ## Package List: * openSUSE Leap 15.5 (aarch64 ppc64le s390x x86_64) * go1.22-1.22.1-150000.1.9.1 * go1.22-doc-1.22.1-150000.1.9.1 * go1.22-race-1.22.1-150000.1.9.1 * Development Tools Module 15-SP5 (aarch64 ppc64le s390x x86_64) * go1.22-1.22.1-150000.1.9.1 * go1.22-doc-1.22.1-150000.1.9.1 * go1.22-race-1.22.1-150000.1.9.1 ## References: * https://www.suse.com/security/cve/CVE-2023-45289.html * https://www.suse.com/security/cve/CVE-2023-45290.html * https://www.suse.com/security/cve/CVE-2024-24783.html * https://www.suse.com/security/cve/CVE-2024-24784.html * https://www.suse.com/security/cve/CVE-2024-24785.html * https://bugzilla.suse.com/show_bug.cgi?id=1218424 * https://bugzilla.suse.com/show_bug.cgi?id=1219988 * https://bugzilla.suse.com/show_bug.cgi?id=1220999 * https://bugzilla.suse.com/show_bug.cgi?id=1221000 * https://bugzilla.suse.com/show_bug.cgi?id=1221001 * https://bugzilla.suse.com/show_bug.cgi?id=1221002 * https://bugzilla.suse.com/show_bug.cgi?id=1221003

1 0

SUSE-SU-2024:0808-1: important: Security update for xmlgraphics-batik
by OPENSUSE-SECURITY-UPDATES 08 Mar '24

08 Mar '24

# Security update for xmlgraphics-batik Announcement ID: SUSE-SU-2024:0808-1 Rating: important References: * bsc#1204704 * bsc#1204709 Cross-References: * CVE-2022-41704 * CVE-2022-42890 * CVE-2022-44729 * CVE-2022-44730 CVSS scores: * CVE-2022-41704 ( SUSE ): 5.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N * CVE-2022-41704 ( NVD ): 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N * CVE-2022-42890 ( SUSE ): 5.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N * CVE-2022-42890 ( NVD ): 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N * CVE-2022-44729 ( NVD ): 7.1 CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:H * CVE-2022-44730 ( NVD ): 4.4 CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:N Affected Products: * Development Tools Module 15-SP5 * openSUSE Leap 15.5 * SUSE Linux Enterprise Desktop 15 SP5 * SUSE Linux Enterprise High Performance Computing 15 SP5 * SUSE Linux Enterprise Real Time 15 SP5 * SUSE Linux Enterprise Server 15 SP5 * SUSE Linux Enterprise Server for SAP Applications 15 SP5 An update that solves four vulnerabilities can now be installed. ## Description: This update for xmlgraphics-batik fixes the following issues: * CVE-2022-41704: Fixed information disclosure vulnerability in Apache Batik (bsc#1204704). * CVE-2022-42890: Fixed information disclosure vulnerability in Apache Batik (bsc#1204709). * CVE-2022-44730: Fixed Server-Side Request Forgery. * CVE-2022-44729: Fixed Server-Side Request Forgery. Upgrade to version 1.17. ## Patch Instructions: To install this SUSE update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: * openSUSE Leap 15.5 zypper in -t patch openSUSE-SLE-15.5-2024-808=1 * Development Tools Module 15-SP5 zypper in -t patch SUSE-SLE-Module-Development-Tools-15-SP5-2024-808=1 ## Package List: * openSUSE Leap 15.5 (noarch) * xmlgraphics-batik-1.17-150200.4.7.1 * xmlgraphics-batik-svgpp-1.17-150200.4.7.1 * xmlgraphics-batik-ttf2svg-1.17-150200.4.7.1 * xmlgraphics-batik-squiggle-1.17-150200.4.7.1 * xmlgraphics-batik-javadoc-1.17-150200.4.7.1 * xmlgraphics-batik-slideshow-1.17-150200.4.7.1 * xmlgraphics-batik-rasterizer-1.17-150200.4.7.1 * xmlgraphics-batik-css-1.17-150200.4.7.1 * xmlgraphics-batik-demo-1.17-150200.4.7.1 * Development Tools Module 15-SP5 (noarch) * xmlgraphics-batik-css-1.17-150200.4.7.1 * xmlgraphics-batik-1.17-150200.4.7.1 ## References: * https://www.suse.com/security/cve/CVE-2022-41704.html * https://www.suse.com/security/cve/CVE-2022-42890.html * https://www.suse.com/security/cve/CVE-2022-44729.html * https://www.suse.com/security/cve/CVE-2022-44730.html * https://bugzilla.suse.com/show_bug.cgi?id=1204704 * https://bugzilla.suse.com/show_bug.cgi?id=1204709

1 0

SUSE-SU-2024:0793-1: important: Security update for gstreamer-plugins-bad
by OPENSUSE-SECURITY-UPDATES 07 Mar '24

07 Mar '24

# Security update for gstreamer-plugins-bad Announcement ID: SUSE-SU-2024:0793-1 Rating: important References: * bsc#1217213 Cross-References: * CVE-2023-44446 CVSS scores: * CVE-2023-44446 ( SUSE ): 8.0 CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H Affected Products: * openSUSE Leap 15.3 * SUSE Enterprise Storage 7.1 * SUSE Linux Enterprise High Performance Computing 15 SP3 * SUSE Linux Enterprise High Performance Computing LTSS 15 SP3 * SUSE Linux Enterprise Server 15 SP3 * SUSE Linux Enterprise Server 15 SP3 LTSS 15-SP3 * SUSE Linux Enterprise Server for SAP Applications 15 SP3 An update that solves one vulnerability can now be installed. ## Description: This update for gstreamer-plugins-bad fixes the following issues: * CVE-2023-44446: Fixed use-after-free remote code execution vulnerability via MXF file (bsc#1217213). ## Patch Instructions: To install this SUSE update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: * openSUSE Leap 15.3 zypper in -t patch SUSE-2024-793=1 * SUSE Linux Enterprise High Performance Computing LTSS 15 SP3 zypper in -t patch SUSE-SLE-Product-HPC-15-SP3-LTSS-2024-793=1 * SUSE Linux Enterprise Server 15 SP3 LTSS 15-SP3 zypper in -t patch SUSE-SLE-Product-SLES-15-SP3-LTSS-2024-793=1 * SUSE Linux Enterprise Server for SAP Applications 15 SP3 zypper in -t patch SUSE-SLE-Product-SLES_SAP-15-SP3-2024-793=1 * SUSE Enterprise Storage 7.1 zypper in -t patch SUSE-Storage-7.1-2024-793=1 ## Package List: * openSUSE Leap 15.3 (aarch64 ppc64le s390x x86_64 i586) * libgstsctp-1_0-0-debuginfo-1.16.3-150300.9.18.1 * libgstbadaudio-1_0-0-1.16.3-150300.9.18.1 * libgstbadaudio-1_0-0-debuginfo-1.16.3-150300.9.18.1 * typelib-1_0-GstPlayer-1_0-1.16.3-150300.9.18.1 * libgstmpegts-1_0-0-debuginfo-1.16.3-150300.9.18.1 * gstreamer-plugins-bad-devel-1.16.3-150300.9.18.1 * libgstwayland-1_0-0-debuginfo-1.16.3-150300.9.18.1 * libgstmpegts-1_0-0-1.16.3-150300.9.18.1 * libgstplayer-1_0-0-debuginfo-1.16.3-150300.9.18.1 * libgstadaptivedemux-1_0-0-1.16.3-150300.9.18.1 * libgstisoff-1_0-0-debuginfo-1.16.3-150300.9.18.1 * libgstphotography-1_0-0-debuginfo-1.16.3-150300.9.18.1 * libgstbasecamerabinsrc-1_0-0-1.16.3-150300.9.18.1 * typelib-1_0-GstMpegts-1_0-1.16.3-150300.9.18.1 * typelib-1_0-GstWebRTC-1_0-1.16.3-150300.9.18.1 * libgsturidownloader-1_0-0-debuginfo-1.16.3-150300.9.18.1 * libgstinsertbin-1_0-0-1.16.3-150300.9.18.1 * libgstwebrtc-1_0-0-1.16.3-150300.9.18.1 * gstreamer-plugins-bad-doc-1.16.3-150300.9.18.1 * libgstplayer-1_0-0-1.16.3-150300.9.18.1 * libgstwayland-1_0-0-1.16.3-150300.9.18.1 * libgstisoff-1_0-0-1.16.3-150300.9.18.1 * libgstcodecparsers-1_0-0-debuginfo-1.16.3-150300.9.18.1 * gstreamer-plugins-bad-chromaprint-1.16.3-150300.9.18.1 * libgsturidownloader-1_0-0-1.16.3-150300.9.18.1 * libgstinsertbin-1_0-0-debuginfo-1.16.3-150300.9.18.1 * libgstwebrtc-1_0-0-debuginfo-1.16.3-150300.9.18.1 * gstreamer-plugins-bad-debugsource-1.16.3-150300.9.18.1 * libgstsctp-1_0-0-1.16.3-150300.9.18.1 * gstreamer-plugins-bad-chromaprint-debuginfo-1.16.3-150300.9.18.1 * libgstphotography-1_0-0-1.16.3-150300.9.18.1 * libgstbasecamerabinsrc-1_0-0-debuginfo-1.16.3-150300.9.18.1 * gstreamer-plugins-bad-1.16.3-150300.9.18.1 * libgstadaptivedemux-1_0-0-debuginfo-1.16.3-150300.9.18.1 * gstreamer-plugins-bad-debuginfo-1.16.3-150300.9.18.1 * typelib-1_0-GstInsertBin-1_0-1.16.3-150300.9.18.1 * libgstcodecparsers-1_0-0-1.16.3-150300.9.18.1 * openSUSE Leap 15.3 (x86_64) * libgstinsertbin-1_0-0-32bit-debuginfo-1.16.3-150300.9.18.1 * libgstisoff-1_0-0-32bit-debuginfo-1.16.3-150300.9.18.1 * libgstcodecparsers-1_0-0-32bit-debuginfo-1.16.3-150300.9.18.1 * libgstinsertbin-1_0-0-32bit-1.16.3-150300.9.18.1 * libgstadaptivedemux-1_0-0-32bit-debuginfo-1.16.3-150300.9.18.1 * libgstplayer-1_0-0-32bit-1.16.3-150300.9.18.1 * libgsturidownloader-1_0-0-32bit-1.16.3-150300.9.18.1 * libgstadaptivedemux-1_0-0-32bit-1.16.3-150300.9.18.1 * libgstbadaudio-1_0-0-32bit-1.16.3-150300.9.18.1 * libgstplayer-1_0-0-32bit-debuginfo-1.16.3-150300.9.18.1 * libgstisoff-1_0-0-32bit-1.16.3-150300.9.18.1 * libgstmpegts-1_0-0-32bit-1.16.3-150300.9.18.1 * libgstmpegts-1_0-0-32bit-debuginfo-1.16.3-150300.9.18.1 * libgstsctp-1_0-0-32bit-1.16.3-150300.9.18.1 * libgstbadaudio-1_0-0-32bit-debuginfo-1.16.3-150300.9.18.1 * libgstbasecamerabinsrc-1_0-0-32bit-debuginfo-1.16.3-150300.9.18.1 * libgstphotography-1_0-0-32bit-debuginfo-1.16.3-150300.9.18.1 * gstreamer-plugins-bad-32bit-1.16.3-150300.9.18.1 * gstreamer-plugins-bad-chromaprint-32bit-debuginfo-1.16.3-150300.9.18.1 * libgstphotography-1_0-0-32bit-1.16.3-150300.9.18.1 * libgstbasecamerabinsrc-1_0-0-32bit-1.16.3-150300.9.18.1 * libgstwebrtc-1_0-0-32bit-debuginfo-1.16.3-150300.9.18.1 * gstreamer-plugins-bad-32bit-debuginfo-1.16.3-150300.9.18.1 * libgsturidownloader-1_0-0-32bit-debuginfo-1.16.3-150300.9.18.1 * libgstcodecparsers-1_0-0-32bit-1.16.3-150300.9.18.1 * gstreamer-plugins-bad-chromaprint-32bit-1.16.3-150300.9.18.1 * libgstwayland-1_0-0-32bit-1.16.3-150300.9.18.1 * libgstwayland-1_0-0-32bit-debuginfo-1.16.3-150300.9.18.1 * libgstsctp-1_0-0-32bit-debuginfo-1.16.3-150300.9.18.1 * libgstwebrtc-1_0-0-32bit-1.16.3-150300.9.18.1 * openSUSE Leap 15.3 (noarch) * gstreamer-plugins-bad-lang-1.16.3-150300.9.18.1 * openSUSE Leap 15.3 (aarch64_ilp32) * libgstsctp-1_0-0-64bit-debuginfo-1.16.3-150300.9.18.1 * libgstcodecparsers-1_0-0-64bit-debuginfo-1.16.3-150300.9.18.1 * gstreamer-plugins-bad-64bit-debuginfo-1.16.3-150300.9.18.1 * libgstinsertbin-1_0-0-64bit-debuginfo-1.16.3-150300.9.18.1 * libgstadaptivedemux-1_0-0-64bit-debuginfo-1.16.3-150300.9.18.1 * libgstadaptivedemux-1_0-0-64bit-1.16.3-150300.9.18.1 * libgstmpegts-1_0-0-64bit-debuginfo-1.16.3-150300.9.18.1 * gstreamer-plugins-bad-chromaprint-64bit-debuginfo-1.16.3-150300.9.18.1 * libgstphotography-1_0-0-64bit-1.16.3-150300.9.18.1 * libgsturidownloader-1_0-0-64bit-1.16.3-150300.9.18.1 * libgstmpegts-1_0-0-64bit-1.16.3-150300.9.18.1 * libgstwebrtc-1_0-0-64bit-debuginfo-1.16.3-150300.9.18.1 * libgstplayer-1_0-0-64bit-1.16.3-150300.9.18.1 * libgstplayer-1_0-0-64bit-debuginfo-1.16.3-150300.9.18.1 * gstreamer-plugins-bad-64bit-1.16.3-150300.9.18.1 * libgstphotography-1_0-0-64bit-debuginfo-1.16.3-150300.9.18.1 * libgstwayland-1_0-0-64bit-1.16.3-150300.9.18.1 * libgstwebrtc-1_0-0-64bit-1.16.3-150300.9.18.1 * libgstbasecamerabinsrc-1_0-0-64bit-1.16.3-150300.9.18.1 * libgstisoff-1_0-0-64bit-debuginfo-1.16.3-150300.9.18.1 * libgstbasecamerabinsrc-1_0-0-64bit-debuginfo-1.16.3-150300.9.18.1 * gstreamer-plugins-bad-chromaprint-64bit-1.16.3-150300.9.18.1 * libgstbadaudio-1_0-0-64bit-1.16.3-150300.9.18.1 * libgstinsertbin-1_0-0-64bit-1.16.3-150300.9.18.1 * libgstsctp-1_0-0-64bit-1.16.3-150300.9.18.1 * libgstbadaudio-1_0-0-64bit-debuginfo-1.16.3-150300.9.18.1 * libgstisoff-1_0-0-64bit-1.16.3-150300.9.18.1 * libgstwayland-1_0-0-64bit-debuginfo-1.16.3-150300.9.18.1 * libgstcodecparsers-1_0-0-64bit-1.16.3-150300.9.18.1 * libgsturidownloader-1_0-0-64bit-debuginfo-1.16.3-150300.9.18.1 * SUSE Linux Enterprise High Performance Computing LTSS 15 SP3 (aarch64 x86_64) * libgstsctp-1_0-0-debuginfo-1.16.3-150300.9.18.1 * libgstbadaudio-1_0-0-1.16.3-150300.9.18.1 * libgstbadaudio-1_0-0-debuginfo-1.16.3-150300.9.18.1 * typelib-1_0-GstPlayer-1_0-1.16.3-150300.9.18.1 * libgstmpegts-1_0-0-debuginfo-1.16.3-150300.9.18.1 * gstreamer-plugins-bad-devel-1.16.3-150300.9.18.1 * libgstwayland-1_0-0-debuginfo-1.16.3-150300.9.18.1 * libgstmpegts-1_0-0-1.16.3-150300.9.18.1 * libgstplayer-1_0-0-debuginfo-1.16.3-150300.9.18.1 * libgstadaptivedemux-1_0-0-1.16.3-150300.9.18.1 * libgstisoff-1_0-0-debuginfo-1.16.3-150300.9.18.1 * libgstphotography-1_0-0-debuginfo-1.16.3-150300.9.18.1 * libgstbasecamerabinsrc-1_0-0-1.16.3-150300.9.18.1 * typelib-1_0-GstMpegts-1_0-1.16.3-150300.9.18.1 * typelib-1_0-GstWebRTC-1_0-1.16.3-150300.9.18.1 * libgsturidownloader-1_0-0-debuginfo-1.16.3-150300.9.18.1 * libgstinsertbin-1_0-0-1.16.3-150300.9.18.1 * libgstwebrtc-1_0-0-1.16.3-150300.9.18.1 * libgstplayer-1_0-0-1.16.3-150300.9.18.1 * libgstwayland-1_0-0-1.16.3-150300.9.18.1 * libgstisoff-1_0-0-1.16.3-150300.9.18.1 * libgstcodecparsers-1_0-0-debuginfo-1.16.3-150300.9.18.1 * gstreamer-plugins-bad-chromaprint-1.16.3-150300.9.18.1 * libgsturidownloader-1_0-0-1.16.3-150300.9.18.1 * libgstinsertbin-1_0-0-debuginfo-1.16.3-150300.9.18.1 * libgstwebrtc-1_0-0-debuginfo-1.16.3-150300.9.18.1 * gstreamer-plugins-bad-debugsource-1.16.3-150300.9.18.1 * libgstsctp-1_0-0-1.16.3-150300.9.18.1 * gstreamer-plugins-bad-chromaprint-debuginfo-1.16.3-150300.9.18.1 * libgstphotography-1_0-0-1.16.3-150300.9.18.1 * libgstbasecamerabinsrc-1_0-0-debuginfo-1.16.3-150300.9.18.1 * gstreamer-plugins-bad-1.16.3-150300.9.18.1 * libgstadaptivedemux-1_0-0-debuginfo-1.16.3-150300.9.18.1 * gstreamer-plugins-bad-debuginfo-1.16.3-150300.9.18.1 * typelib-1_0-GstInsertBin-1_0-1.16.3-150300.9.18.1 * libgstcodecparsers-1_0-0-1.16.3-150300.9.18.1 * SUSE Linux Enterprise High Performance Computing LTSS 15 SP3 (noarch) * gstreamer-plugins-bad-lang-1.16.3-150300.9.18.1 * SUSE Linux Enterprise Server 15 SP3 LTSS 15-SP3 (aarch64 ppc64le s390x x86_64) * libgstsctp-1_0-0-debuginfo-1.16.3-150300.9.18.1 * libgstbadaudio-1_0-0-1.16.3-150300.9.18.1 * libgstbadaudio-1_0-0-debuginfo-1.16.3-150300.9.18.1 * typelib-1_0-GstPlayer-1_0-1.16.3-150300.9.18.1 * libgstmpegts-1_0-0-debuginfo-1.16.3-150300.9.18.1 * gstreamer-plugins-bad-devel-1.16.3-150300.9.18.1 * libgstwayland-1_0-0-debuginfo-1.16.3-150300.9.18.1 * libgstmpegts-1_0-0-1.16.3-150300.9.18.1 * libgstplayer-1_0-0-debuginfo-1.16.3-150300.9.18.1 * libgstadaptivedemux-1_0-0-1.16.3-150300.9.18.1 * libgstisoff-1_0-0-debuginfo-1.16.3-150300.9.18.1 * libgstphotography-1_0-0-debuginfo-1.16.3-150300.9.18.1 * libgstbasecamerabinsrc-1_0-0-1.16.3-150300.9.18.1 * typelib-1_0-GstMpegts-1_0-1.16.3-150300.9.18.1 * typelib-1_0-GstWebRTC-1_0-1.16.3-150300.9.18.1 * libgsturidownloader-1_0-0-debuginfo-1.16.3-150300.9.18.1 * libgstinsertbin-1_0-0-1.16.3-150300.9.18.1 * libgstwebrtc-1_0-0-1.16.3-150300.9.18.1 * libgstplayer-1_0-0-1.16.3-150300.9.18.1 * libgstwayland-1_0-0-1.16.3-150300.9.18.1 * libgstisoff-1_0-0-1.16.3-150300.9.18.1 * libgstcodecparsers-1_0-0-debuginfo-1.16.3-150300.9.18.1 * gstreamer-plugins-bad-chromaprint-1.16.3-150300.9.18.1 * libgsturidownloader-1_0-0-1.16.3-150300.9.18.1 * libgstinsertbin-1_0-0-debuginfo-1.16.3-150300.9.18.1 * libgstwebrtc-1_0-0-debuginfo-1.16.3-150300.9.18.1 * gstreamer-plugins-bad-debugsource-1.16.3-150300.9.18.1 * libgstsctp-1_0-0-1.16.3-150300.9.18.1 * gstreamer-plugins-bad-chromaprint-debuginfo-1.16.3-150300.9.18.1 * libgstphotography-1_0-0-1.16.3-150300.9.18.1 * libgstbasecamerabinsrc-1_0-0-debuginfo-1.16.3-150300.9.18.1 * gstreamer-plugins-bad-1.16.3-150300.9.18.1 * libgstadaptivedemux-1_0-0-debuginfo-1.16.3-150300.9.18.1 * gstreamer-plugins-bad-debuginfo-1.16.3-150300.9.18.1 * typelib-1_0-GstInsertBin-1_0-1.16.3-150300.9.18.1 * libgstcodecparsers-1_0-0-1.16.3-150300.9.18.1 * SUSE Linux Enterprise Server 15 SP3 LTSS 15-SP3 (noarch) * gstreamer-plugins-bad-lang-1.16.3-150300.9.18.1 * SUSE Linux Enterprise Server for SAP Applications 15 SP3 (ppc64le x86_64) * libgstsctp-1_0-0-debuginfo-1.16.3-150300.9.18.1 * libgstbadaudio-1_0-0-1.16.3-150300.9.18.1 * libgstbadaudio-1_0-0-debuginfo-1.16.3-150300.9.18.1 * typelib-1_0-GstPlayer-1_0-1.16.3-150300.9.18.1 * libgstmpegts-1_0-0-debuginfo-1.16.3-150300.9.18.1 * gstreamer-plugins-bad-devel-1.16.3-150300.9.18.1 * libgstwayland-1_0-0-debuginfo-1.16.3-150300.9.18.1 * libgstmpegts-1_0-0-1.16.3-150300.9.18.1 * libgstplayer-1_0-0-debuginfo-1.16.3-150300.9.18.1 * libgstadaptivedemux-1_0-0-1.16.3-150300.9.18.1 * libgstisoff-1_0-0-debuginfo-1.16.3-150300.9.18.1 * libgstphotography-1_0-0-debuginfo-1.16.3-150300.9.18.1 * libgstbasecamerabinsrc-1_0-0-1.16.3-150300.9.18.1 * typelib-1_0-GstMpegts-1_0-1.16.3-150300.9.18.1 * typelib-1_0-GstWebRTC-1_0-1.16.3-150300.9.18.1 * libgsturidownloader-1_0-0-debuginfo-1.16.3-150300.9.18.1 * libgstinsertbin-1_0-0-1.16.3-150300.9.18.1 * libgstwebrtc-1_0-0-1.16.3-150300.9.18.1 * libgstplayer-1_0-0-1.16.3-150300.9.18.1 * libgstwayland-1_0-0-1.16.3-150300.9.18.1 * libgstisoff-1_0-0-1.16.3-150300.9.18.1 * libgstcodecparsers-1_0-0-debuginfo-1.16.3-150300.9.18.1 * gstreamer-plugins-bad-chromaprint-1.16.3-150300.9.18.1 * libgsturidownloader-1_0-0-1.16.3-150300.9.18.1 * libgstinsertbin-1_0-0-debuginfo-1.16.3-150300.9.18.1 * libgstwebrtc-1_0-0-debuginfo-1.16.3-150300.9.18.1 * gstreamer-plugins-bad-debugsource-1.16.3-150300.9.18.1 * libgstsctp-1_0-0-1.16.3-150300.9.18.1 * gstreamer-plugins-bad-chromaprint-debuginfo-1.16.3-150300.9.18.1 * libgstphotography-1_0-0-1.16.3-150300.9.18.1 * libgstbasecamerabinsrc-1_0-0-debuginfo-1.16.3-150300.9.18.1 * gstreamer-plugins-bad-1.16.3-150300.9.18.1 * libgstadaptivedemux-1_0-0-debuginfo-1.16.3-150300.9.18.1 * gstreamer-plugins-bad-debuginfo-1.16.3-150300.9.18.1 * typelib-1_0-GstInsertBin-1_0-1.16.3-150300.9.18.1 * libgstcodecparsers-1_0-0-1.16.3-150300.9.18.1 * SUSE Linux Enterprise Server for SAP Applications 15 SP3 (noarch) * gstreamer-plugins-bad-lang-1.16.3-150300.9.18.1 * SUSE Enterprise Storage 7.1 (aarch64 x86_64) * libgstsctp-1_0-0-debuginfo-1.16.3-150300.9.18.1 * libgstbadaudio-1_0-0-1.16.3-150300.9.18.1 * libgstbadaudio-1_0-0-debuginfo-1.16.3-150300.9.18.1 * typelib-1_0-GstPlayer-1_0-1.16.3-150300.9.18.1 * libgstmpegts-1_0-0-debuginfo-1.16.3-150300.9.18.1 * gstreamer-plugins-bad-devel-1.16.3-150300.9.18.1 * libgstwayland-1_0-0-debuginfo-1.16.3-150300.9.18.1 * libgstmpegts-1_0-0-1.16.3-150300.9.18.1 * libgstplayer-1_0-0-debuginfo-1.16.3-150300.9.18.1 * libgstadaptivedemux-1_0-0-1.16.3-150300.9.18.1 * libgstisoff-1_0-0-debuginfo-1.16.3-150300.9.18.1 * libgstphotography-1_0-0-debuginfo-1.16.3-150300.9.18.1 * libgstbasecamerabinsrc-1_0-0-1.16.3-150300.9.18.1 * typelib-1_0-GstMpegts-1_0-1.16.3-150300.9.18.1 * typelib-1_0-GstWebRTC-1_0-1.16.3-150300.9.18.1 * libgsturidownloader-1_0-0-debuginfo-1.16.3-150300.9.18.1 * libgstinsertbin-1_0-0-1.16.3-150300.9.18.1 * libgstwebrtc-1_0-0-1.16.3-150300.9.18.1 * libgstplayer-1_0-0-1.16.3-150300.9.18.1 * libgstwayland-1_0-0-1.16.3-150300.9.18.1 * libgstisoff-1_0-0-1.16.3-150300.9.18.1 * libgstcodecparsers-1_0-0-debuginfo-1.16.3-150300.9.18.1 * gstreamer-plugins-bad-chromaprint-1.16.3-150300.9.18.1 * libgsturidownloader-1_0-0-1.16.3-150300.9.18.1 * libgstinsertbin-1_0-0-debuginfo-1.16.3-150300.9.18.1 * libgstwebrtc-1_0-0-debuginfo-1.16.3-150300.9.18.1 * gstreamer-plugins-bad-debugsource-1.16.3-150300.9.18.1 * libgstsctp-1_0-0-1.16.3-150300.9.18.1 * gstreamer-plugins-bad-chromaprint-debuginfo-1.16.3-150300.9.18.1 * libgstphotography-1_0-0-1.16.3-150300.9.18.1 * libgstbasecamerabinsrc-1_0-0-debuginfo-1.16.3-150300.9.18.1 * gstreamer-plugins-bad-1.16.3-150300.9.18.1 * libgstadaptivedemux-1_0-0-debuginfo-1.16.3-150300.9.18.1 * gstreamer-plugins-bad-debuginfo-1.16.3-150300.9.18.1 * typelib-1_0-GstInsertBin-1_0-1.16.3-150300.9.18.1 * libgstcodecparsers-1_0-0-1.16.3-150300.9.18.1 * SUSE Enterprise Storage 7.1 (noarch) * gstreamer-plugins-bad-lang-1.16.3-150300.9.18.1 ## References: * https://www.suse.com/security/cve/CVE-2023-44446.html * https://bugzilla.suse.com/show_bug.cgi?id=1217213

1 0

SUSE-SU-2024:0794-1: important: Security update for sudo
by OPENSUSE-SECURITY-UPDATES 07 Mar '24

07 Mar '24

# Security update for sudo Announcement ID: SUSE-SU-2024:0794-1 Rating: important References: * bsc#1219026 * bsc#1220389 Cross-References: * CVE-2023-42465 CVSS scores: * CVE-2023-42465 ( SUSE ): 7.0 CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H * CVE-2023-42465 ( NVD ): 7.0 CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H Affected Products: * Basesystem Module 15-SP5 * openSUSE Leap 15.5 * SUSE Linux Enterprise Desktop 15 SP5 * SUSE Linux Enterprise High Performance Computing 15 SP5 * SUSE Linux Enterprise Micro 5.5 * SUSE Linux Enterprise Real Time 15 SP5 * SUSE Linux Enterprise Server 15 SP5 * SUSE Linux Enterprise Server for SAP Applications 15 SP5 An update that solves one vulnerability and has one security fix can now be installed. ## Description: This update for sudo fixes the following issues: * CVE-2023-42465: Try to make sudo less vulnerable to ROWHAMMER attacks (bsc#1219026). ## Patch Instructions: To install this SUSE update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: * openSUSE Leap 15.5 zypper in -t patch SUSE-2024-794=1 openSUSE-SLE-15.5-2024-794=1 * SUSE Linux Enterprise Micro 5.5 zypper in -t patch SUSE-SLE-Micro-5.5-2024-794=1 * Basesystem Module 15-SP5 zypper in -t patch SUSE-SLE-Module-Basesystem-15-SP5-2024-794=1 ## Package List: * openSUSE Leap 15.5 (aarch64 ppc64le s390x x86_64 i586) * sudo-test-1.9.12p1-150500.7.7.1 * sudo-plugin-python-debuginfo-1.9.12p1-150500.7.7.1 * sudo-plugin-python-1.9.12p1-150500.7.7.1 * sudo-debuginfo-1.9.12p1-150500.7.7.1 * sudo-1.9.12p1-150500.7.7.1 * sudo-debugsource-1.9.12p1-150500.7.7.1 * sudo-devel-1.9.12p1-150500.7.7.1 * SUSE Linux Enterprise Micro 5.5 (aarch64 s390x x86_64) * sudo-debuginfo-1.9.12p1-150500.7.7.1 * sudo-debugsource-1.9.12p1-150500.7.7.1 * sudo-1.9.12p1-150500.7.7.1 * Basesystem Module 15-SP5 (aarch64 ppc64le s390x x86_64) * sudo-plugin-python-debuginfo-1.9.12p1-150500.7.7.1 * sudo-plugin-python-1.9.12p1-150500.7.7.1 * sudo-debuginfo-1.9.12p1-150500.7.7.1 * sudo-1.9.12p1-150500.7.7.1 * sudo-debugsource-1.9.12p1-150500.7.7.1 * sudo-devel-1.9.12p1-150500.7.7.1 ## References: * https://www.suse.com/security/cve/CVE-2023-42465.html * https://bugzilla.suse.com/show_bug.cgi?id=1219026 * https://bugzilla.suse.com/show_bug.cgi?id=1220389

1 0

SUSE-SU-2024:0786-1: important: Security update for giflib
by OPENSUSE-SECURITY-UPDATES 07 Mar '24

07 Mar '24

# Security update for giflib Announcement ID: SUSE-SU-2024:0786-1 Rating: important References: * bsc#1198880 * bsc#1200551 * bsc#1217390 Cross-References: * CVE-2021-40633 * CVE-2022-28506 * CVE-2023-48161 CVSS scores: * CVE-2021-40633 ( SUSE ): 3.3 CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:L * CVE-2021-40633 ( NVD ): 8.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H * CVE-2022-28506 ( SUSE ): 3.3 CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:L * CVE-2022-28506 ( NVD ): 5.5 CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N * CVE-2023-48161 ( SUSE ): 7.1 CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:H * CVE-2023-48161 ( NVD ): 7.1 CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:H Affected Products: * Basesystem Module 15-SP5 * openSUSE Leap 15.5 * SUSE Enterprise Storage 7.1 * SUSE Linux Enterprise Desktop 15 SP4 LTSS 15-SP4 * SUSE Linux Enterprise Desktop 15 SP5 * SUSE Linux Enterprise High Performance Computing 15 SP2 * SUSE Linux Enterprise High Performance Computing 15 SP2 LTSS 15-SP2 * SUSE Linux Enterprise High Performance Computing 15 SP3 * SUSE Linux Enterprise High Performance Computing 15 SP4 * SUSE Linux Enterprise High Performance Computing 15 SP5 * SUSE Linux Enterprise High Performance Computing ESPOS 15 SP4 * SUSE Linux Enterprise High Performance Computing LTSS 15 SP3 * SUSE Linux Enterprise High Performance Computing LTSS 15 SP4 * SUSE Linux Enterprise Real Time 15 SP5 * SUSE Linux Enterprise Server 15 SP2 * SUSE Linux Enterprise Server 15 SP2 LTSS 15-SP2 * SUSE Linux Enterprise Server 15 SP3 * SUSE Linux Enterprise Server 15 SP3 LTSS 15-SP3 * SUSE Linux Enterprise Server 15 SP4 * SUSE Linux Enterprise Server 15 SP4 LTSS 15-SP4 * SUSE Linux Enterprise Server 15 SP5 * SUSE Linux Enterprise Server for SAP Applications 15 SP2 * SUSE Linux Enterprise Server for SAP Applications 15 SP3 * SUSE Linux Enterprise Server for SAP Applications 15 SP4 * SUSE Linux Enterprise Server for SAP Applications 15 SP5 * SUSE Manager Proxy 4.3 * SUSE Manager Retail Branch Server 4.3 * SUSE Manager Server 4.3 An update that solves three vulnerabilities can now be installed. ## Description: This update for giflib fixes the following issues: Update to version 5.2.2 * Fixes for CVE-2023-48161 (bsc#1217390), CVE-2022-28506 (bsc#1198880) * # 138 Documentation for obsolete utilities still installed * # 139: Typo in "LZW image data" page ("110_2 = 4_10") * # 140: Typo in "LZW image data" page ("LWZ") * # 141: Typo in "Bits and bytes" page ("filed") * Note as already fixed SF issue #143: cannot compile under mingw * # 144: giflib-5.2.1 cannot be build on windows and other platforms using c89 * # 145: Remove manual pages installation for binaries that are not installed too * # 146: [PATCH] Limit installed man pages to binaries, move giflib to section 7 * # 147 [PATCH] Fixes to doc/whatsinagif/ content * # 148: heap Out of Bound Read in gif2rgb.c:298 DumpScreen2RGB * Declared no-info on SF issue #150: There is a denial of service vulnerability in GIFLIB 5.2.1 * Declared Won't-fix on SF issue 149: Out of source builds no longer possible * # 151: A heap-buffer-overflow in gif2rgb.c:294:45 * # 152: Fix some typos on the html documentation and man pages * # 153: Fix segmentation faults due to non correct checking for args * # 154: Recover the giffilter manual page * # 155: Add gifsponge docs * # 157: An OutofMemory-Exception or Memory Leak in gif2rgb * # 158: There is a null pointer problem in gif2rgb * # 159 A heap-buffer-overflow in GIFLIB5.2.1 DumpScreen2RGB() in gif2rgb.c:298:45 * # 163: detected memory leaks in openbsd_reallocarray giflib/openbsd- reallocarray.c * # 164: detected memory leaks in GifMakeMapObject giflib/gifalloc.c * # 166: a read zero page leads segment fault in getarg.c and memory leaks in gif2rgb.c and gifmalloc.c * # 167: Heap-Buffer Overflow during Image Saving in DumpScreen2RGB Function at Line 321 of gif2rgb.c ## Patch Instructions: To install this SUSE update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: * openSUSE Leap 15.5 zypper in -t patch openSUSE-SLE-15.5-2024-786=1 * Basesystem Module 15-SP5 zypper in -t patch SUSE-SLE-Module-Basesystem-15-SP5-2024-786=1 * SUSE Linux Enterprise High Performance Computing 15 SP2 LTSS 15-SP2 zypper in -t patch SUSE-SLE-Product-HPC-15-SP2-LTSS-2024-786=1 * SUSE Linux Enterprise High Performance Computing LTSS 15 SP3 zypper in -t patch SUSE-SLE-Product-HPC-15-SP3-LTSS-2024-786=1 * SUSE Linux Enterprise High Performance Computing ESPOS 15 SP4 zypper in -t patch SUSE-SLE-Product-HPC-15-SP4-ESPOS-2024-786=1 * SUSE Linux Enterprise High Performance Computing LTSS 15 SP4 zypper in -t patch SUSE-SLE-Product-HPC-15-SP4-LTSS-2024-786=1 * SUSE Linux Enterprise Desktop 15 SP4 LTSS 15-SP4 zypper in -t patch SUSE-SLE-Product-SLED-15-SP4-LTSS-2024-786=1 * SUSE Linux Enterprise Server 15 SP2 LTSS 15-SP2 zypper in -t patch SUSE-SLE-Product-SLES-15-SP2-LTSS-2024-786=1 * SUSE Linux Enterprise Server 15 SP3 LTSS 15-SP3 zypper in -t patch SUSE-SLE-Product-SLES-15-SP3-LTSS-2024-786=1 * SUSE Linux Enterprise Server 15 SP4 LTSS 15-SP4 zypper in -t patch SUSE-SLE-Product-SLES-15-SP4-LTSS-2024-786=1 * SUSE Linux Enterprise Server for SAP Applications 15 SP2 zypper in -t patch SUSE-SLE-Product-SLES_SAP-15-SP2-2024-786=1 * SUSE Linux Enterprise Server for SAP Applications 15 SP3 zypper in -t patch SUSE-SLE-Product-SLES_SAP-15-SP3-2024-786=1 * SUSE Linux Enterprise Server for SAP Applications 15 SP4 zypper in -t patch SUSE-SLE-Product-SLES_SAP-15-SP4-2024-786=1 * SUSE Manager Proxy 4.3 zypper in -t patch SUSE-SLE-Product-SUSE-Manager-Proxy-4.3-2024-786=1 * SUSE Manager Retail Branch Server 4.3 zypper in -t patch SUSE-SLE-Product-SUSE-Manager-Retail-Branch- Server-4.3-2024-786=1 * SUSE Manager Server 4.3 zypper in -t patch SUSE-SLE-Product-SUSE-Manager-Server-4.3-2024-786=1 * SUSE Enterprise Storage 7.1 zypper in -t patch SUSE-Storage-7.1-2024-786=1 ## Package List: * openSUSE Leap 15.5 (aarch64 ppc64le s390x x86_64) * giflib-debugsource-5.2.2-150000.4.13.1 * libgif7-debuginfo-5.2.2-150000.4.13.1 * libgif7-5.2.2-150000.4.13.1 * giflib-progs-5.2.2-150000.4.13.1 * giflib-progs-debuginfo-5.2.2-150000.4.13.1 * giflib-devel-5.2.2-150000.4.13.1 * openSUSE Leap 15.5 (x86_64) * libgif7-32bit-5.2.2-150000.4.13.1 * giflib-devel-32bit-5.2.2-150000.4.13.1 * libgif7-32bit-debuginfo-5.2.2-150000.4.13.1 * Basesystem Module 15-SP5 (aarch64 ppc64le s390x x86_64) * libgif7-5.2.2-150000.4.13.1 * giflib-debugsource-5.2.2-150000.4.13.1 * libgif7-debuginfo-5.2.2-150000.4.13.1 * giflib-devel-5.2.2-150000.4.13.1 * SUSE Linux Enterprise High Performance Computing 15 SP2 LTSS 15-SP2 (aarch64 x86_64) * libgif7-5.2.2-150000.4.13.1 * giflib-debugsource-5.2.2-150000.4.13.1 * libgif7-debuginfo-5.2.2-150000.4.13.1 * giflib-devel-5.2.2-150000.4.13.1 * SUSE Linux Enterprise High Performance Computing LTSS 15 SP3 (aarch64 x86_64) * libgif7-5.2.2-150000.4.13.1 * giflib-debugsource-5.2.2-150000.4.13.1 * libgif7-debuginfo-5.2.2-150000.4.13.1 * giflib-devel-5.2.2-150000.4.13.1 * SUSE Linux Enterprise High Performance Computing ESPOS 15 SP4 (aarch64 x86_64) * libgif7-5.2.2-150000.4.13.1 * giflib-debugsource-5.2.2-150000.4.13.1 * libgif7-debuginfo-5.2.2-150000.4.13.1 * giflib-devel-5.2.2-150000.4.13.1 * SUSE Linux Enterprise High Performance Computing LTSS 15 SP4 (aarch64 x86_64) * libgif7-5.2.2-150000.4.13.1 * giflib-debugsource-5.2.2-150000.4.13.1 * libgif7-debuginfo-5.2.2-150000.4.13.1 * giflib-devel-5.2.2-150000.4.13.1 * SUSE Linux Enterprise Desktop 15 SP4 LTSS 15-SP4 (x86_64) * libgif7-5.2.2-150000.4.13.1 * giflib-debugsource-5.2.2-150000.4.13.1 * libgif7-debuginfo-5.2.2-150000.4.13.1 * giflib-devel-5.2.2-150000.4.13.1 * SUSE Linux Enterprise Server 15 SP2 LTSS 15-SP2 (aarch64 ppc64le s390x x86_64) * libgif7-5.2.2-150000.4.13.1 * giflib-debugsource-5.2.2-150000.4.13.1 * libgif7-debuginfo-5.2.2-150000.4.13.1 * giflib-devel-5.2.2-150000.4.13.1 * SUSE Linux Enterprise Server 15 SP3 LTSS 15-SP3 (aarch64 ppc64le s390x x86_64) * libgif7-5.2.2-150000.4.13.1 * giflib-debugsource-5.2.2-150000.4.13.1 * libgif7-debuginfo-5.2.2-150000.4.13.1 * giflib-devel-5.2.2-150000.4.13.1 * SUSE Linux Enterprise Server 15 SP4 LTSS 15-SP4 (aarch64 ppc64le s390x x86_64) * libgif7-5.2.2-150000.4.13.1 * giflib-debugsource-5.2.2-150000.4.13.1 * libgif7-debuginfo-5.2.2-150000.4.13.1 * giflib-devel-5.2.2-150000.4.13.1 * SUSE Linux Enterprise Server for SAP Applications 15 SP2 (ppc64le x86_64) * libgif7-5.2.2-150000.4.13.1 * giflib-debugsource-5.2.2-150000.4.13.1 * libgif7-debuginfo-5.2.2-150000.4.13.1 * giflib-devel-5.2.2-150000.4.13.1 * SUSE Linux Enterprise Server for SAP Applications 15 SP3 (ppc64le x86_64) * libgif7-5.2.2-150000.4.13.1 * giflib-debugsource-5.2.2-150000.4.13.1 * libgif7-debuginfo-5.2.2-150000.4.13.1 * giflib-devel-5.2.2-150000.4.13.1 * SUSE Linux Enterprise Server for SAP Applications 15 SP4 (ppc64le x86_64) * libgif7-5.2.2-150000.4.13.1 * giflib-debugsource-5.2.2-150000.4.13.1 * libgif7-debuginfo-5.2.2-150000.4.13.1 * giflib-devel-5.2.2-150000.4.13.1 * SUSE Manager Proxy 4.3 (x86_64) * libgif7-5.2.2-150000.4.13.1 * giflib-debugsource-5.2.2-150000.4.13.1 * libgif7-debuginfo-5.2.2-150000.4.13.1 * giflib-devel-5.2.2-150000.4.13.1 * SUSE Manager Retail Branch Server 4.3 (x86_64) * libgif7-5.2.2-150000.4.13.1 * giflib-debugsource-5.2.2-150000.4.13.1 * libgif7-debuginfo-5.2.2-150000.4.13.1 * giflib-devel-5.2.2-150000.4.13.1 * SUSE Manager Server 4.3 (ppc64le s390x x86_64) * libgif7-5.2.2-150000.4.13.1 * giflib-debugsource-5.2.2-150000.4.13.1 * libgif7-debuginfo-5.2.2-150000.4.13.1 * giflib-devel-5.2.2-150000.4.13.1 * SUSE Enterprise Storage 7.1 (aarch64 x86_64) * libgif7-5.2.2-150000.4.13.1 * giflib-debugsource-5.2.2-150000.4.13.1 * libgif7-debuginfo-5.2.2-150000.4.13.1 * giflib-devel-5.2.2-150000.4.13.1 ## References: * https://www.suse.com/security/cve/CVE-2021-40633.html * https://www.suse.com/security/cve/CVE-2022-28506.html * https://www.suse.com/security/cve/CVE-2023-48161.html * https://bugzilla.suse.com/show_bug.cgi?id=1198880 * https://bugzilla.suse.com/show_bug.cgi?id=1200551 * https://bugzilla.suse.com/show_bug.cgi?id=1217390

1 0

SUSE-SU-2024:0784-1: important: Security update for python39
by OPENSUSE-SECURITY-UPDATES 06 Mar '24

06 Mar '24

# Security update for python39 Announcement ID: SUSE-SU-2024:0784-1 Rating: important References: * bsc#1196025 * bsc#1210638 * bsc#1212015 * bsc#1214692 * bsc#1215454 * bsc#1219666 * jsc#PED-7886 * jsc#SLE-21253 Cross-References: * CVE-2022-25236 * CVE-2023-27043 * CVE-2023-40217 * CVE-2023-6597 CVSS scores: * CVE-2022-25236 ( SUSE ): 7.5 CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H * CVE-2022-25236 ( NVD ): 9.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H * CVE-2023-27043 ( SUSE ): 5.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N * CVE-2023-27043 ( NVD ): 5.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N * CVE-2023-40217 ( SUSE ): 7.4 CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N * CVE-2023-40217 ( NVD ): 5.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N * CVE-2023-6597 ( SUSE ): 8.4 CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H Affected Products: * openSUSE Leap 15.3 * openSUSE Leap 15.5 * SUSE Enterprise Storage 7.1 * SUSE Linux Enterprise High Performance Computing 15 SP3 * SUSE Linux Enterprise High Performance Computing LTSS 15 SP3 * SUSE Linux Enterprise Server 15 SP3 * SUSE Linux Enterprise Server 15 SP3 LTSS 15-SP3 * SUSE Linux Enterprise Server for SAP Applications 15 SP3 An update that solves four vulnerabilities, contains two features and has two security fixes can now be installed. ## Description: This update for python39 fixes the following issues: * CVE-2023-6597: Fixed symlink bug in cleanup of tempfile.TemporaryDirectory (bsc#1219666). * CVE-2023-27043: Fixed incorrect e-mqil parsing (bsc#1210638). * CVE-2023-40217: Fixed a ssl.SSLSocket TLS bypass vulnerability where data is sent unencrypted (bsc#1214692). * CVE-2022-25236: Fixed an expat vulnerability by supporting expat >= 2.4.4 (bsc#1212015). ## Patch Instructions: To install this SUSE update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: * openSUSE Leap 15.3 zypper in -t patch SUSE-2024-784=1 * openSUSE Leap 15.5 zypper in -t patch openSUSE-SLE-15.5-2024-784=1 * SUSE Linux Enterprise High Performance Computing LTSS 15 SP3 zypper in -t patch SUSE-SLE-Product-HPC-15-SP3-LTSS-2024-784=1 * SUSE Linux Enterprise Server 15 SP3 LTSS 15-SP3 zypper in -t patch SUSE-SLE-Product-SLES-15-SP3-LTSS-2024-784=1 * SUSE Linux Enterprise Server for SAP Applications 15 SP3 zypper in -t patch SUSE-SLE-Product-SLES_SAP-15-SP3-2024-784=1 * SUSE Enterprise Storage 7.1 zypper in -t patch SUSE-Storage-7.1-2024-784=1 ## Package List: * openSUSE Leap 15.3 (aarch64 ppc64le s390x x86_64 i586) * python39-core-debugsource-3.9.18-150300.4.38.1 * python39-tk-debuginfo-3.9.18-150300.4.38.1 * python39-debuginfo-3.9.18-150300.4.38.1 * python39-base-debuginfo-3.9.18-150300.4.38.1 * python39-devel-3.9.18-150300.4.38.1 * python39-curses-3.9.18-150300.4.38.1 * python39-doc-3.9.18-150300.4.38.1 * libpython3_9-1_0-debuginfo-3.9.18-150300.4.38.1 * python39-curses-debuginfo-3.9.18-150300.4.38.1 * python39-dbm-3.9.18-150300.4.38.1 * libpython3_9-1_0-3.9.18-150300.4.38.1 * python39-base-3.9.18-150300.4.38.1 * python39-tk-3.9.18-150300.4.38.1 * python39-idle-3.9.18-150300.4.38.1 * python39-3.9.18-150300.4.38.1 * python39-tools-3.9.18-150300.4.38.1 * python39-doc-devhelp-3.9.18-150300.4.38.1 * python39-testsuite-3.9.18-150300.4.38.1 * python39-debugsource-3.9.18-150300.4.38.1 * python39-dbm-debuginfo-3.9.18-150300.4.38.1 * python39-testsuite-debuginfo-3.9.18-150300.4.38.1 * openSUSE Leap 15.3 (x86_64) * libpython3_9-1_0-32bit-debuginfo-3.9.18-150300.4.38.1 * python39-32bit-debuginfo-3.9.18-150300.4.38.1 * python39-base-32bit-debuginfo-3.9.18-150300.4.38.1 * python39-32bit-3.9.18-150300.4.38.1 * libpython3_9-1_0-32bit-3.9.18-150300.4.38.1 * python39-base-32bit-3.9.18-150300.4.38.1 * openSUSE Leap 15.3 (aarch64_ilp32) * libpython3_9-1_0-64bit-debuginfo-3.9.18-150300.4.38.1 * python39-base-64bit-debuginfo-3.9.18-150300.4.38.1 * libpython3_9-1_0-64bit-3.9.18-150300.4.38.1 * python39-64bit-debuginfo-3.9.18-150300.4.38.1 * python39-base-64bit-3.9.18-150300.4.38.1 * python39-64bit-3.9.18-150300.4.38.1 * openSUSE Leap 15.5 (aarch64 ppc64le s390x x86_64) * python39-core-debugsource-3.9.18-150300.4.38.1 * python39-tk-debuginfo-3.9.18-150300.4.38.1 * python39-debuginfo-3.9.18-150300.4.38.1 * python39-base-debuginfo-3.9.18-150300.4.38.1 * python39-devel-3.9.18-150300.4.38.1 * python39-curses-3.9.18-150300.4.38.1 * python39-doc-3.9.18-150300.4.38.1 * libpython3_9-1_0-debuginfo-3.9.18-150300.4.38.1 * python39-curses-debuginfo-3.9.18-150300.4.38.1 * python39-dbm-3.9.18-150300.4.38.1 * libpython3_9-1_0-3.9.18-150300.4.38.1 * python39-base-3.9.18-150300.4.38.1 * python39-tk-3.9.18-150300.4.38.1 * python39-idle-3.9.18-150300.4.38.1 * python39-3.9.18-150300.4.38.1 * python39-tools-3.9.18-150300.4.38.1 * python39-doc-devhelp-3.9.18-150300.4.38.1 * python39-testsuite-3.9.18-150300.4.38.1 * python39-debugsource-3.9.18-150300.4.38.1 * python39-dbm-debuginfo-3.9.18-150300.4.38.1 * python39-testsuite-debuginfo-3.9.18-150300.4.38.1 * openSUSE Leap 15.5 (x86_64) * libpython3_9-1_0-32bit-debuginfo-3.9.18-150300.4.38.1 * python39-32bit-debuginfo-3.9.18-150300.4.38.1 * python39-base-32bit-debuginfo-3.9.18-150300.4.38.1 * python39-32bit-3.9.18-150300.4.38.1 * libpython3_9-1_0-32bit-3.9.18-150300.4.38.1 * python39-base-32bit-3.9.18-150300.4.38.1 * SUSE Linux Enterprise High Performance Computing LTSS 15 SP3 (aarch64 x86_64) * python39-tk-3.9.18-150300.4.38.1 * python39-core-debugsource-3.9.18-150300.4.38.1 * python39-curses-3.9.18-150300.4.38.1 * python39-tk-debuginfo-3.9.18-150300.4.38.1 * python39-debuginfo-3.9.18-150300.4.38.1 * libpython3_9-1_0-debuginfo-3.9.18-150300.4.38.1 * python39-idle-3.9.18-150300.4.38.1 * python39-debugsource-3.9.18-150300.4.38.1 * python39-dbm-debuginfo-3.9.18-150300.4.38.1 * python39-3.9.18-150300.4.38.1 * python39-base-debuginfo-3.9.18-150300.4.38.1 * python39-curses-debuginfo-3.9.18-150300.4.38.1 * python39-devel-3.9.18-150300.4.38.1 * python39-dbm-3.9.18-150300.4.38.1 * libpython3_9-1_0-3.9.18-150300.4.38.1 * python39-base-3.9.18-150300.4.38.1 * python39-tools-3.9.18-150300.4.38.1 * SUSE Linux Enterprise Server 15 SP3 LTSS 15-SP3 (aarch64 ppc64le s390x x86_64) * python39-tk-3.9.18-150300.4.38.1 * python39-core-debugsource-3.9.18-150300.4.38.1 * python39-curses-3.9.18-150300.4.38.1 * python39-tk-debuginfo-3.9.18-150300.4.38.1 * python39-debuginfo-3.9.18-150300.4.38.1 * libpython3_9-1_0-debuginfo-3.9.18-150300.4.38.1 * python39-idle-3.9.18-150300.4.38.1 * python39-debugsource-3.9.18-150300.4.38.1 * python39-dbm-debuginfo-3.9.18-150300.4.38.1 * python39-3.9.18-150300.4.38.1 * python39-base-debuginfo-3.9.18-150300.4.38.1 * python39-curses-debuginfo-3.9.18-150300.4.38.1 * python39-devel-3.9.18-150300.4.38.1 * python39-dbm-3.9.18-150300.4.38.1 * libpython3_9-1_0-3.9.18-150300.4.38.1 * python39-base-3.9.18-150300.4.38.1 * python39-tools-3.9.18-150300.4.38.1 * SUSE Linux Enterprise Server for SAP Applications 15 SP3 (ppc64le x86_64) * python39-tk-3.9.18-150300.4.38.1 * python39-core-debugsource-3.9.18-150300.4.38.1 * python39-curses-3.9.18-150300.4.38.1 * python39-tk-debuginfo-3.9.18-150300.4.38.1 * python39-debuginfo-3.9.18-150300.4.38.1 * libpython3_9-1_0-debuginfo-3.9.18-150300.4.38.1 * python39-idle-3.9.18-150300.4.38.1 * python39-debugsource-3.9.18-150300.4.38.1 * python39-dbm-debuginfo-3.9.18-150300.4.38.1 * python39-3.9.18-150300.4.38.1 * python39-base-debuginfo-3.9.18-150300.4.38.1 * python39-curses-debuginfo-3.9.18-150300.4.38.1 * python39-devel-3.9.18-150300.4.38.1 * python39-dbm-3.9.18-150300.4.38.1 * libpython3_9-1_0-3.9.18-150300.4.38.1 * python39-base-3.9.18-150300.4.38.1 * python39-tools-3.9.18-150300.4.38.1 * SUSE Enterprise Storage 7.1 (aarch64 x86_64) * python39-tk-3.9.18-150300.4.38.1 * python39-core-debugsource-3.9.18-150300.4.38.1 * python39-curses-3.9.18-150300.4.38.1 * python39-tk-debuginfo-3.9.18-150300.4.38.1 * python39-debuginfo-3.9.18-150300.4.38.1 * libpython3_9-1_0-debuginfo-3.9.18-150300.4.38.1 * python39-idle-3.9.18-150300.4.38.1 * python39-debugsource-3.9.18-150300.4.38.1 * python39-dbm-debuginfo-3.9.18-150300.4.38.1 * python39-3.9.18-150300.4.38.1 * python39-base-debuginfo-3.9.18-150300.4.38.1 * python39-curses-debuginfo-3.9.18-150300.4.38.1 * python39-devel-3.9.18-150300.4.38.1 * python39-dbm-3.9.18-150300.4.38.1 * libpython3_9-1_0-3.9.18-150300.4.38.1 * python39-base-3.9.18-150300.4.38.1 * python39-tools-3.9.18-150300.4.38.1 ## References: * https://www.suse.com/security/cve/CVE-2022-25236.html * https://www.suse.com/security/cve/CVE-2023-27043.html * https://www.suse.com/security/cve/CVE-2023-40217.html * https://www.suse.com/security/cve/CVE-2023-6597.html * https://bugzilla.suse.com/show_bug.cgi?id=1196025 * https://bugzilla.suse.com/show_bug.cgi?id=1210638 * https://bugzilla.suse.com/show_bug.cgi?id=1212015 * https://bugzilla.suse.com/show_bug.cgi?id=1214692 * https://bugzilla.suse.com/show_bug.cgi?id=1215454 * https://bugzilla.suse.com/show_bug.cgi?id=1219666 * https://jira.suse.com/browse/PED-7886 * https://jira.suse.com/browse/SLE-21253

1 0

SUSE-SU-2024:0769-1: critical: Security update for postgresql-jdbc
by OPENSUSE-SECURITY-UPDATES 05 Mar '24

05 Mar '24

# Security update for postgresql-jdbc Announcement ID: SUSE-SU-2024:0769-1 Rating: critical References: * bsc#1220644 Cross-References: * CVE-2024-1597 CVSS scores: * CVE-2024-1597 ( SUSE ): 9.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H Affected Products: * openSUSE Leap 15.3 * SUSE Enterprise Storage 7.1 * SUSE Linux Enterprise High Performance Computing 15 SP3 * SUSE Linux Enterprise High Performance Computing LTSS 15 SP3 * SUSE Linux Enterprise Server 15 SP3 * SUSE Linux Enterprise Server 15 SP3 LTSS 15-SP3 * SUSE Linux Enterprise Server for SAP Applications 15 SP3 An update that solves one vulnerability can now be installed. ## Description: This update for postgresql-jdbc fixes the following issues: * CVE-2024-1597: Fixed SQL Injection via line comment generation (bsc#1220644). ## Patch Instructions: To install this SUSE update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: * openSUSE Leap 15.3 zypper in -t patch SUSE-2024-769=1 * SUSE Linux Enterprise High Performance Computing LTSS 15 SP3 zypper in -t patch SUSE-SLE-Product-HPC-15-SP3-LTSS-2024-769=1 * SUSE Linux Enterprise Server 15 SP3 LTSS 15-SP3 zypper in -t patch SUSE-SLE-Product-SLES-15-SP3-LTSS-2024-769=1 * SUSE Linux Enterprise Server for SAP Applications 15 SP3 zypper in -t patch SUSE-SLE-Product-SLES_SAP-15-SP3-2024-769=1 * SUSE Enterprise Storage 7.1 zypper in -t patch SUSE-Storage-7.1-2024-769=1 ## Package List: * openSUSE Leap 15.3 (noarch) * postgresql-jdbc-42.2.25-150300.3.14.1 * postgresql-jdbc-javadoc-42.2.25-150300.3.14.1 * SUSE Linux Enterprise High Performance Computing LTSS 15 SP3 (noarch) * postgresql-jdbc-42.2.25-150300.3.14.1 * SUSE Linux Enterprise Server 15 SP3 LTSS 15-SP3 (noarch) * postgresql-jdbc-42.2.25-150300.3.14.1 * SUSE Linux Enterprise Server for SAP Applications 15 SP3 (noarch) * postgresql-jdbc-42.2.25-150300.3.14.1 * SUSE Enterprise Storage 7.1 (noarch) * postgresql-jdbc-42.2.25-150300.3.14.1 ## References: * https://www.suse.com/security/cve/CVE-2024-1597.html * https://bugzilla.suse.com/show_bug.cgi?id=1220644

1 0

SUSE-SU-2024:0770-1: important: Security update for kernel-firmware-nvidia-gspx-G06, nvidia-open-driver-G06-signed
by OPENSUSE-SECURITY-UPDATES 05 Mar '24

05 Mar '24

# Security update for kernel-firmware-nvidia-gspx-G06, nvidia-open- driver-G06-signed Announcement ID: SUSE-SU-2024:0770-1 Rating: important References: * bsc#1220552 * jsc#PED-7117 Cross-References: * CVE-2022-42265 * CVE-2024-0074 * CVE-2024-0075 CVSS scores: * CVE-2022-42265 ( SUSE ): 5.3 CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L * CVE-2022-42265 ( NVD ): 5.3 CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L * CVE-2024-0074 ( SUSE ): 7.1 CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:H * CVE-2024-0075 ( SUSE ): 5.5 CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H Affected Products: * openSUSE Leap 15.4 * SUSE Linux Enterprise Desktop 15 SP4 LTSS 15-SP4 * SUSE Linux Enterprise High Performance Computing 15 SP4 * SUSE Linux Enterprise High Performance Computing ESPOS 15 SP4 * SUSE Linux Enterprise High Performance Computing LTSS 15 SP4 * SUSE Linux Enterprise Micro 5.3 * SUSE Linux Enterprise Micro 5.4 * SUSE Linux Enterprise Micro for Rancher 5.3 * SUSE Linux Enterprise Micro for Rancher 5.4 * SUSE Linux Enterprise Server 15 SP4 * SUSE Linux Enterprise Server 15 SP4 LTSS 15-SP4 * SUSE Linux Enterprise Server for SAP Applications 15 SP4 * SUSE Manager Proxy 4.3 * SUSE Manager Retail Branch Server 4.3 * SUSE Manager Server 4.3 An update that solves three vulnerabilities and contains one feature can now be installed. ## Description: This update for kernel-firmware-nvidia-gspx-G06, nvidia-open-driver-G06-signed fixes the following issues: Update to 550.54.14 * Added vGPU Host and vGPU Guest support. For vGPU Host, please refer to the README.vgpu packaged in the vGPU Host Package for more details. Security issues fixed: * CVE-2024-0074: A user could trigger a NULL ptr dereference. * CVE-2024-0075: A user could overwrite the end of a buffer, leading to crashes or code execution. * CVE-2022-42265: A unprivileged user could trigger an integer overflow which could lead to crashes or code execution. * create /run/udev/static_node-tags/uaccess/nvidia${devid} symlinks also during modprobing the nvidia module; this changes the issue of not having access to /dev/nvidia${devid}, when gfxcard has been replaced by a different gfx card after installing the driver * provide nvidia-open-driver-G06-kmp (jsc#PED-7117) * this makes it easy to replace the package from nVidia's CUDA repository with this presigned package ## Patch Instructions: To install this SUSE update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: * SUSE Linux Enterprise Micro for Rancher 5.4 zypper in -t patch SUSE-SLE-Micro-5.4-2024-770=1 * SUSE Linux Enterprise Micro 5.4 zypper in -t patch SUSE-SLE-Micro-5.4-2024-770=1 * SUSE Linux Enterprise High Performance Computing ESPOS 15 SP4 zypper in -t patch SUSE-SLE-Product-HPC-15-SP4-ESPOS-2024-770=1 * SUSE Linux Enterprise High Performance Computing LTSS 15 SP4 zypper in -t patch SUSE-SLE-Product-HPC-15-SP4-LTSS-2024-770=1 * SUSE Linux Enterprise Desktop 15 SP4 LTSS 15-SP4 zypper in -t patch SUSE-SLE-Product-SLED-15-SP4-LTSS-2024-770=1 * SUSE Linux Enterprise Server 15 SP4 LTSS 15-SP4 zypper in -t patch SUSE-SLE-Product-SLES-15-SP4-LTSS-2024-770=1 * SUSE Linux Enterprise Server for SAP Applications 15 SP4 zypper in -t patch SUSE-SLE-Product-SLES_SAP-15-SP4-2024-770=1 * SUSE Manager Proxy 4.3 zypper in -t patch SUSE-SLE-Product-SUSE-Manager-Proxy-4.3-2024-770=1 * SUSE Manager Retail Branch Server 4.3 zypper in -t patch SUSE-SLE-Product-SUSE-Manager-Retail-Branch- Server-4.3-2024-770=1 * SUSE Manager Server 4.3 zypper in -t patch SUSE-SLE-Product-SUSE-Manager-Server-4.3-2024-770=1 * openSUSE Leap 15.4 zypper in -t patch SUSE-2024-770=1 * SUSE Linux Enterprise Micro for Rancher 5.3 zypper in -t patch SUSE-SLE-Micro-5.3-2024-770=1 * SUSE Linux Enterprise Micro 5.3 zypper in -t patch SUSE-SLE-Micro-5.3-2024-770=1 ## Package List: * SUSE Linux Enterprise Micro for Rancher 5.4 (aarch64 nosrc x86_64) * kernel-firmware-nvidia-gspx-G06-550.54.14-150400.9.21.1 * SUSE Linux Enterprise Micro for Rancher 5.4 (aarch64 x86_64) * nvidia-open-driver-G06-signed-kmp-default-550.54.14_k5.14.21_150400.24.108-150400.9.50.1 * nvidia-open-driver-G06-signed-debugsource-550.54.14-150400.9.50.1 * nvidia-open-driver-G06-signed-kmp-default-debuginfo-550.54.14_k5.14.21_150400.24.108-150400.9.50.1 * SUSE Linux Enterprise Micro 5.4 (aarch64 nosrc x86_64) * kernel-firmware-nvidia-gspx-G06-550.54.14-150400.9.21.1 * SUSE Linux Enterprise Micro 5.4 (aarch64 x86_64) * nvidia-open-driver-G06-signed-kmp-default-550.54.14_k5.14.21_150400.24.108-150400.9.50.1 * nvidia-open-driver-G06-signed-debugsource-550.54.14-150400.9.50.1 * nvidia-open-driver-G06-signed-kmp-default-debuginfo-550.54.14_k5.14.21_150400.24.108-150400.9.50.1 * SUSE Linux Enterprise High Performance Computing ESPOS 15 SP4 (aarch64 nosrc x86_64) * kernel-firmware-nvidia-gspx-G06-550.54.14-150400.9.21.1 * SUSE Linux Enterprise High Performance Computing ESPOS 15 SP4 (aarch64) * nvidia-open-driver-G06-signed-kmp-64kb-debuginfo-550.54.14_k5.14.21_150400.24.108-150400.9.50.1 * nvidia-open-driver-G06-signed-64kb-devel-550.54.14-150400.9.50.1 * nvidia-open-driver-G06-signed-kmp-64kb-550.54.14_k5.14.21_150400.24.108-150400.9.50.1 * SUSE Linux Enterprise High Performance Computing ESPOS 15 SP4 (aarch64 x86_64) * nvidia-open-driver-G06-signed-kmp-default-550.54.14_k5.14.21_150400.24.108-150400.9.50.1 * nvidia-open-driver-G06-signed-debugsource-550.54.14-150400.9.50.1 * nvidia-open-driver-G06-signed-default-devel-550.54.14-150400.9.50.1 * nvidia-open-driver-G06-signed-kmp-default-debuginfo-550.54.14_k5.14.21_150400.24.108-150400.9.50.1 * SUSE Linux Enterprise High Performance Computing LTSS 15 SP4 (aarch64 nosrc x86_64) * kernel-firmware-nvidia-gspx-G06-550.54.14-150400.9.21.1 * SUSE Linux Enterprise High Performance Computing LTSS 15 SP4 (aarch64) * nvidia-open-driver-G06-signed-kmp-64kb-debuginfo-550.54.14_k5.14.21_150400.24.108-150400.9.50.1 * nvidia-open-driver-G06-signed-64kb-devel-550.54.14-150400.9.50.1 * nvidia-open-driver-G06-signed-kmp-64kb-550.54.14_k5.14.21_150400.24.108-150400.9.50.1 * SUSE Linux Enterprise High Performance Computing LTSS 15 SP4 (aarch64 x86_64) * nvidia-open-driver-G06-signed-kmp-default-550.54.14_k5.14.21_150400.24.108-150400.9.50.1 * nvidia-open-driver-G06-signed-debugsource-550.54.14-150400.9.50.1 * nvidia-open-driver-G06-signed-default-devel-550.54.14-150400.9.50.1 * nvidia-open-driver-G06-signed-kmp-default-debuginfo-550.54.14_k5.14.21_150400.24.108-150400.9.50.1 * SUSE Linux Enterprise Desktop 15 SP4 LTSS 15-SP4 (nosrc x86_64) * kernel-firmware-nvidia-gspx-G06-550.54.14-150400.9.21.1 * SUSE Linux Enterprise Desktop 15 SP4 LTSS 15-SP4 (x86_64) * nvidia-open-driver-G06-signed-kmp-default-550.54.14_k5.14.21_150400.24.108-150400.9.50.1 * nvidia-open-driver-G06-signed-debugsource-550.54.14-150400.9.50.1 * nvidia-open-driver-G06-signed-default-devel-550.54.14-150400.9.50.1 * nvidia-open-driver-G06-signed-kmp-default-debuginfo-550.54.14_k5.14.21_150400.24.108-150400.9.50.1 * SUSE Linux Enterprise Server 15 SP4 LTSS 15-SP4 (aarch64 nosrc x86_64) * kernel-firmware-nvidia-gspx-G06-550.54.14-150400.9.21.1 * SUSE Linux Enterprise Server 15 SP4 LTSS 15-SP4 (aarch64) * nvidia-open-driver-G06-signed-kmp-64kb-debuginfo-550.54.14_k5.14.21_150400.24.108-150400.9.50.1 * nvidia-open-driver-G06-signed-64kb-devel-550.54.14-150400.9.50.1 * nvidia-open-driver-G06-signed-kmp-64kb-550.54.14_k5.14.21_150400.24.108-150400.9.50.1 * SUSE Linux Enterprise Server 15 SP4 LTSS 15-SP4 (aarch64 x86_64) * nvidia-open-driver-G06-signed-kmp-default-550.54.14_k5.14.21_150400.24.108-150400.9.50.1 * nvidia-open-driver-G06-signed-debugsource-550.54.14-150400.9.50.1 * nvidia-open-driver-G06-signed-default-devel-550.54.14-150400.9.50.1 * nvidia-open-driver-G06-signed-kmp-default-debuginfo-550.54.14_k5.14.21_150400.24.108-150400.9.50.1 * SUSE Linux Enterprise Server for SAP Applications 15 SP4 (nosrc x86_64) * kernel-firmware-nvidia-gspx-G06-550.54.14-150400.9.21.1 * SUSE Linux Enterprise Server for SAP Applications 15 SP4 (x86_64) * nvidia-open-driver-G06-signed-kmp-default-550.54.14_k5.14.21_150400.24.108-150400.9.50.1 * nvidia-open-driver-G06-signed-debugsource-550.54.14-150400.9.50.1 * nvidia-open-driver-G06-signed-default-devel-550.54.14-150400.9.50.1 * nvidia-open-driver-G06-signed-kmp-default-debuginfo-550.54.14_k5.14.21_150400.24.108-150400.9.50.1 * SUSE Manager Proxy 4.3 (nosrc x86_64) * kernel-firmware-nvidia-gspx-G06-550.54.14-150400.9.21.1 * SUSE Manager Proxy 4.3 (x86_64) * nvidia-open-driver-G06-signed-kmp-default-550.54.14_k5.14.21_150400.24.108-150400.9.50.1 * nvidia-open-driver-G06-signed-debugsource-550.54.14-150400.9.50.1 * nvidia-open-driver-G06-signed-default-devel-550.54.14-150400.9.50.1 * nvidia-open-driver-G06-signed-kmp-default-debuginfo-550.54.14_k5.14.21_150400.24.108-150400.9.50.1 * SUSE Manager Retail Branch Server 4.3 (nosrc x86_64) * kernel-firmware-nvidia-gspx-G06-550.54.14-150400.9.21.1 * SUSE Manager Retail Branch Server 4.3 (x86_64) * nvidia-open-driver-G06-signed-kmp-default-550.54.14_k5.14.21_150400.24.108-150400.9.50.1 * nvidia-open-driver-G06-signed-debugsource-550.54.14-150400.9.50.1 * nvidia-open-driver-G06-signed-default-devel-550.54.14-150400.9.50.1 * nvidia-open-driver-G06-signed-kmp-default-debuginfo-550.54.14_k5.14.21_150400.24.108-150400.9.50.1 * SUSE Manager Server 4.3 (nosrc x86_64) * kernel-firmware-nvidia-gspx-G06-550.54.14-150400.9.21.1 * SUSE Manager Server 4.3 (x86_64) * nvidia-open-driver-G06-signed-kmp-default-550.54.14_k5.14.21_150400.24.108-150400.9.50.1 * nvidia-open-driver-G06-signed-debugsource-550.54.14-150400.9.50.1 * nvidia-open-driver-G06-signed-default-devel-550.54.14-150400.9.50.1 * nvidia-open-driver-G06-signed-kmp-default-debuginfo-550.54.14_k5.14.21_150400.24.108-150400.9.50.1 * openSUSE Leap 15.4 (aarch64 nosrc x86_64) * kernel-firmware-nvidia-gspx-G06-550.54.14-150400.9.21.1 * openSUSE Leap 15.4 (x86_64) * nvidia-open-driver-G06-signed-kmp-azure-debuginfo-550.54.14_k5.14.21_150400.14.75-150400.9.50.1 * nvidia-open-driver-G06-signed-kmp-azure-550.54.14_k5.14.21_150400.14.75-150400.9.50.1 * nvidia-open-driver-G06-signed-azure-devel-550.54.14-150400.9.50.1 * openSUSE Leap 15.4 (aarch64 x86_64) * nvidia-open-driver-G06-signed-kmp-default-550.54.14_k5.14.21_150400.24.108-150400.9.50.1 * nvidia-open-driver-G06-signed-debugsource-550.54.14-150400.9.50.1 * nvidia-open-driver-G06-signed-default-devel-550.54.14-150400.9.50.1 * nvidia-open-driver-G06-signed-kmp-default-debuginfo-550.54.14_k5.14.21_150400.24.108-150400.9.50.1 * openSUSE Leap 15.4 (aarch64) * nvidia-open-driver-G06-signed-kmp-64kb-debuginfo-550.54.14_k5.14.21_150400.24.108-150400.9.50.1 * nvidia-open-driver-G06-signed-64kb-devel-550.54.14-150400.9.50.1 * nvidia-open-driver-G06-signed-kmp-64kb-550.54.14_k5.14.21_150400.24.108-150400.9.50.1 * SUSE Linux Enterprise Micro for Rancher 5.3 (aarch64 nosrc x86_64) * kernel-firmware-nvidia-gspx-G06-550.54.14-150400.9.21.1 * SUSE Linux Enterprise Micro for Rancher 5.3 (aarch64 x86_64) * nvidia-open-driver-G06-signed-kmp-default-550.54.14_k5.14.21_150400.24.108-150400.9.50.1 * nvidia-open-driver-G06-signed-debugsource-550.54.14-150400.9.50.1 * nvidia-open-driver-G06-signed-kmp-default-debuginfo-550.54.14_k5.14.21_150400.24.108-150400.9.50.1 * SUSE Linux Enterprise Micro 5.3 (aarch64 nosrc x86_64) * kernel-firmware-nvidia-gspx-G06-550.54.14-150400.9.21.1 * SUSE Linux Enterprise Micro 5.3 (aarch64 x86_64) * nvidia-open-driver-G06-signed-kmp-default-550.54.14_k5.14.21_150400.24.108-150400.9.50.1 * nvidia-open-driver-G06-signed-debugsource-550.54.14-150400.9.50.1 * nvidia-open-driver-G06-signed-kmp-default-debuginfo-550.54.14_k5.14.21_150400.24.108-150400.9.50.1 ## References: * https://www.suse.com/security/cve/CVE-2022-42265.html * https://www.suse.com/security/cve/CVE-2024-0074.html * https://www.suse.com/security/cve/CVE-2024-0075.html * https://bugzilla.suse.com/show_bug.cgi?id=1220552 * https://jira.suse.com/browse/PED-7117

1 0

SUSE-SU-2024:0765-1: important: Security update for rubygem-rack
by OPENSUSE-SECURITY-UPDATES 05 Mar '24

05 Mar '24

# Security update for rubygem-rack Announcement ID: SUSE-SU-2024:0765-1 Rating: important References: * bsc#1220239 * bsc#1220242 * bsc#1220248 Cross-References: * CVE-2024-25126 * CVE-2024-26141 * CVE-2024-26146 CVSS scores: * CVE-2024-25126 ( SUSE ): 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H * CVE-2024-26141 ( SUSE ): 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H * CVE-2024-26146 ( SUSE ): 5.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L Affected Products: * openSUSE Leap 15.5 * SUSE Linux Enterprise High Availability Extension 15 SP2 * SUSE Linux Enterprise High Availability Extension 15 SP3 * SUSE Linux Enterprise High Availability Extension 15 SP4 * SUSE Linux Enterprise High Availability Extension 15 SP5 * SUSE Linux Enterprise High Performance Computing 15 SP2 * SUSE Linux Enterprise High Performance Computing 15 SP3 * SUSE Linux Enterprise High Performance Computing 15 SP4 * SUSE Linux Enterprise High Performance Computing 15 SP5 * SUSE Linux Enterprise Server 15 SP2 * SUSE Linux Enterprise Server 15 SP2 Business Critical Linux 15-SP2 * SUSE Linux Enterprise Server 15 SP3 * SUSE Linux Enterprise Server 15 SP3 Business Critical Linux 15-SP3 * SUSE Linux Enterprise Server 15 SP4 * SUSE Linux Enterprise Server 15 SP5 * SUSE Linux Enterprise Server for SAP Applications 15 SP2 * SUSE Linux Enterprise Server for SAP Applications 15 SP3 * SUSE Linux Enterprise Server for SAP Applications 15 SP4 * SUSE Linux Enterprise Server for SAP Applications 15 SP5 * SUSE Manager Proxy 4.1 * SUSE Manager Proxy 4.2 * SUSE Manager Proxy 4.3 * SUSE Manager Retail Branch Server 4.1 * SUSE Manager Retail Branch Server 4.2 * SUSE Manager Retail Branch Server 4.3 * SUSE Manager Server 4.1 * SUSE Manager Server 4.2 * SUSE Manager Server 4.3 An update that solves three vulnerabilities can now be installed. ## Description: This update for rubygem-rack fixes the following issues: * CVE-2024-25126: Fixed a denial-of-service vulnerability in Rack Content-Type parsing (bsc#1220239). * CVE-2024-26141: Fixed a denial-of-service vulnerability in Range request header parsing (bsc#1220242). * CVE-2024-26146: Fixed a denial-of-service vulnerability in Rack headers parsing routine (bsc#1220248). ## Patch Instructions: To install this SUSE update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: * openSUSE Leap 15.5 zypper in -t patch openSUSE-SLE-15.5-2024-765=1 * SUSE Linux Enterprise High Availability Extension 15 SP2 zypper in -t patch SUSE-SLE-Product-HA-15-SP2-2024-765=1 * SUSE Linux Enterprise High Availability Extension 15 SP3 zypper in -t patch SUSE-SLE-Product-HA-15-SP3-2024-765=1 * SUSE Linux Enterprise High Availability Extension 15 SP4 zypper in -t patch SUSE-SLE-Product-HA-15-SP4-2024-765=1 * SUSE Linux Enterprise High Availability Extension 15 SP5 zypper in -t patch SUSE-SLE-Product-HA-15-SP5-2024-765=1 ## Package List: * openSUSE Leap 15.5 (aarch64 ppc64le s390x x86_64) * ruby2.5-rubygem-rack-doc-2.0.8-150000.3.21.2 * ruby2.5-rubygem-rack-testsuite-2.0.8-150000.3.21.2 * ruby2.5-rubygem-rack-2.0.8-150000.3.21.2 * SUSE Linux Enterprise High Availability Extension 15 SP2 (aarch64 ppc64le s390x x86_64) * ruby2.5-rubygem-rack-2.0.8-150000.3.21.2 * SUSE Linux Enterprise High Availability Extension 15 SP3 (aarch64 ppc64le s390x x86_64) * ruby2.5-rubygem-rack-2.0.8-150000.3.21.2 * SUSE Linux Enterprise High Availability Extension 15 SP4 (aarch64 ppc64le s390x x86_64) * ruby2.5-rubygem-rack-2.0.8-150000.3.21.2 * SUSE Linux Enterprise High Availability Extension 15 SP5 (aarch64 ppc64le s390x x86_64) * ruby2.5-rubygem-rack-2.0.8-150000.3.21.2 ## References: * https://www.suse.com/security/cve/CVE-2024-25126.html * https://www.suse.com/security/cve/CVE-2024-26141.html * https://www.suse.com/security/cve/CVE-2024-26146.html * https://bugzilla.suse.com/show_bug.cgi?id=1220239 * https://bugzilla.suse.com/show_bug.cgi?id=1220242 * https://bugzilla.suse.com/show_bug.cgi?id=1220248

1 0

SUSE-SU-2024:0763-1: moderate: Security update for python-cryptography
by OPENSUSE-SECURITY-UPDATES 05 Mar '24

05 Mar '24

# Security update for python-cryptography Announcement ID: SUSE-SU-2024:0763-1 Rating: moderate References: * bsc#1220210 Cross-References: * CVE-2024-26130 CVSS scores: * CVE-2024-26130 ( SUSE ): 6.2 CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H Affected Products: * openSUSE Leap 15.4 * openSUSE Leap 15.5 * Python 3 Module 15-SP5 * SUSE Linux Enterprise Desktop 15 SP5 * SUSE Linux Enterprise High Performance Computing 15 SP5 * SUSE Linux Enterprise Server 15 SP5 * SUSE Linux Enterprise Server for SAP Applications 15 SP5 An update that solves one vulnerability can now be installed. ## Description: This update for python-cryptography fixes the following issues: * CVE-2024-26130: Fixed NULL pointer dereference in pkcs12.serialize_key_and_certificates() (bsc#1220210). ## Patch Instructions: To install this SUSE update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: * openSUSE Leap 15.4 zypper in -t patch SUSE-2024-763=1 * openSUSE Leap 15.5 zypper in -t patch openSUSE-SLE-15.5-2024-763=1 * Python 3 Module 15-SP5 zypper in -t patch SUSE-SLE-Module-Python3-15-SP5-2024-763=1 ## Package List: * openSUSE Leap 15.4 (aarch64 ppc64le s390x x86_64 i586) * python-cryptography-debugsource-41.0.3-150400.16.15.1 * python311-cryptography-debuginfo-41.0.3-150400.16.15.1 * python311-cryptography-41.0.3-150400.16.15.1 * openSUSE Leap 15.5 (aarch64 ppc64le s390x x86_64) * python-cryptography-debugsource-41.0.3-150400.16.15.1 * python311-cryptography-debuginfo-41.0.3-150400.16.15.1 * python311-cryptography-41.0.3-150400.16.15.1 * Python 3 Module 15-SP5 (aarch64 ppc64le s390x x86_64) * python-cryptography-debugsource-41.0.3-150400.16.15.1 * python311-cryptography-debuginfo-41.0.3-150400.16.15.1 * python311-cryptography-41.0.3-150400.16.15.1 ## References: * https://www.suse.com/security/cve/CVE-2024-26130.html * https://bugzilla.suse.com/show_bug.cgi?id=1220210

1 0