May 2024 - openSUSE Security Announce - openSUSE Mailing Lists

SUSE-SU-2024:1635-1: moderate: Security update for tpm2-0-tss
by OPENSUSE-SECURITY-UPDATES 14 May '24

14 May '24

# Security update for tpm2-0-tss Announcement ID: SUSE-SU-2024:1635-1 Rating: moderate References: * bsc#1223690 Cross-References: * CVE-2024-29040 CVSS scores: * CVE-2024-29040 ( SUSE ): 5.5 CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N Affected Products: * Basesystem Module 15-SP5 * openSUSE Leap 15.4 * openSUSE Leap 15.5 * openSUSE Leap Micro 5.3 * openSUSE Leap Micro 5.4 * SUSE Linux Enterprise Desktop 15 SP5 * SUSE Linux Enterprise High Performance Computing 15 SP5 * SUSE Linux Enterprise Micro 5.3 * SUSE Linux Enterprise Micro 5.4 * SUSE Linux Enterprise Micro 5.5 * SUSE Linux Enterprise Micro for Rancher 5.3 * SUSE Linux Enterprise Micro for Rancher 5.4 * SUSE Linux Enterprise Real Time 15 SP5 * SUSE Linux Enterprise Server 15 SP5 * SUSE Linux Enterprise Server for SAP Applications 15 SP5 An update that solves one vulnerability can now be installed. ## Description: This update for tpm2-0-tss fixes the following issues: * CVE-2024-29040: Fixed quote data validation by Fapi_VerifyQuote (bsc#1223690). ## Patch Instructions: To install this SUSE update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: * openSUSE Leap 15.4 zypper in -t patch SUSE-2024-1635=1 * openSUSE Leap Micro 5.3 zypper in -t patch openSUSE-Leap-Micro-5.3-2024-1635=1 * openSUSE Leap Micro 5.4 zypper in -t patch openSUSE-Leap-Micro-5.4-2024-1635=1 * openSUSE Leap 15.5 zypper in -t patch openSUSE-SLE-15.5-2024-1635=1 * SUSE Linux Enterprise Micro for Rancher 5.3 zypper in -t patch SUSE-SLE-Micro-5.3-2024-1635=1 * SUSE Linux Enterprise Micro 5.3 zypper in -t patch SUSE-SLE-Micro-5.3-2024-1635=1 * SUSE Linux Enterprise Micro for Rancher 5.4 zypper in -t patch SUSE-SLE-Micro-5.4-2024-1635=1 * SUSE Linux Enterprise Micro 5.4 zypper in -t patch SUSE-SLE-Micro-5.4-2024-1635=1 * SUSE Linux Enterprise Micro 5.5 zypper in -t patch SUSE-SLE-Micro-5.5-2024-1635=1 * Basesystem Module 15-SP5 zypper in -t patch SUSE-SLE-Module-Basesystem-15-SP5-2024-1635=1 ## Package List: * openSUSE Leap 15.4 (aarch64 ppc64le s390x x86_64 i586) * libtss2-sys1-debuginfo-3.1.0-150400.3.6.1 * tpm2-0-tss-devel-3.1.0-150400.3.6.1 * libtss2-tcti-swtpm0-debuginfo-3.1.0-150400.3.6.1 * libtss2-tcti-mssim0-3.1.0-150400.3.6.1 * tpm2-0-tss-3.1.0-150400.3.6.1 * libtss2-tctildr0-3.1.0-150400.3.6.1 * tpm2-0-tss-debugsource-3.1.0-150400.3.6.1 * libtss2-tctildr0-debuginfo-3.1.0-150400.3.6.1 * libtss2-esys0-debuginfo-3.1.0-150400.3.6.1 * libtss2-tcti-device0-3.1.0-150400.3.6.1 * libtss2-esys0-3.1.0-150400.3.6.1 * libtss2-rc0-3.1.0-150400.3.6.1 * libtss2-tcti-cmd0-3.1.0-150400.3.6.1 * libtss2-tcti-pcap0-3.1.0-150400.3.6.1 * libtss2-tcti-swtpm0-3.1.0-150400.3.6.1 * libtss2-fapi1-debuginfo-3.1.0-150400.3.6.1 * libtss2-rc0-debuginfo-3.1.0-150400.3.6.1 * libtss2-mu0-3.1.0-150400.3.6.1 * libtss2-mu0-debuginfo-3.1.0-150400.3.6.1 * libtss2-tcti-cmd0-debuginfo-3.1.0-150400.3.6.1 * libtss2-tcti-mssim0-debuginfo-3.1.0-150400.3.6.1 * libtss2-sys1-3.1.0-150400.3.6.1 * libtss2-fapi1-3.1.0-150400.3.6.1 * libtss2-tcti-device0-debuginfo-3.1.0-150400.3.6.1 * libtss2-tcti-pcap0-debuginfo-3.1.0-150400.3.6.1 * openSUSE Leap 15.4 (x86_64) * libtss2-rc0-32bit-3.1.0-150400.3.6.1 * libtss2-esys0-32bit-debuginfo-3.1.0-150400.3.6.1 * libtss2-sys1-32bit-3.1.0-150400.3.6.1 * libtss2-rc0-32bit-debuginfo-3.1.0-150400.3.6.1 * libtss2-fapi1-32bit-debuginfo-3.1.0-150400.3.6.1 * libtss2-tcti-mssim0-32bit-debuginfo-3.1.0-150400.3.6.1 * libtss2-fapi1-32bit-3.1.0-150400.3.6.1 * libtss2-tcti-swtpm0-32bit-debuginfo-3.1.0-150400.3.6.1 * libtss2-tcti-swtpm0-32bit-3.1.0-150400.3.6.1 * libtss2-tctildr0-32bit-debuginfo-3.1.0-150400.3.6.1 * libtss2-mu0-32bit-3.1.0-150400.3.6.1 * libtss2-tcti-device0-32bit-debuginfo-3.1.0-150400.3.6.1 * libtss2-tcti-device0-32bit-3.1.0-150400.3.6.1 * libtss2-mu0-32bit-debuginfo-3.1.0-150400.3.6.1 * libtss2-tcti-cmd0-32bit-3.1.0-150400.3.6.1 * libtss2-esys0-32bit-3.1.0-150400.3.6.1 * libtss2-tcti-cmd0-32bit-debuginfo-3.1.0-150400.3.6.1 * libtss2-sys1-32bit-debuginfo-3.1.0-150400.3.6.1 * libtss2-tctildr0-32bit-3.1.0-150400.3.6.1 * libtss2-tcti-mssim0-32bit-3.1.0-150400.3.6.1 * openSUSE Leap 15.4 (aarch64_ilp32) * libtss2-rc0-64bit-debuginfo-3.1.0-150400.3.6.1 * libtss2-tcti-device0-64bit-debuginfo-3.1.0-150400.3.6.1 * libtss2-mu0-64bit-debuginfo-3.1.0-150400.3.6.1 * libtss2-tcti-swtpm0-64bit-debuginfo-3.1.0-150400.3.6.1 * libtss2-tcti-cmd0-64bit-debuginfo-3.1.0-150400.3.6.1 * libtss2-esys0-64bit-3.1.0-150400.3.6.1 * libtss2-tctildr0-64bit-debuginfo-3.1.0-150400.3.6.1 * libtss2-fapi1-64bit-debuginfo-3.1.0-150400.3.6.1 * libtss2-tcti-mssim0-64bit-3.1.0-150400.3.6.1 * libtss2-tctildr0-64bit-3.1.0-150400.3.6.1 * libtss2-tcti-cmd0-64bit-3.1.0-150400.3.6.1 * libtss2-tcti-mssim0-64bit-debuginfo-3.1.0-150400.3.6.1 * libtss2-tcti-swtpm0-64bit-3.1.0-150400.3.6.1 * libtss2-esys0-64bit-debuginfo-3.1.0-150400.3.6.1 * libtss2-fapi1-64bit-3.1.0-150400.3.6.1 * libtss2-rc0-64bit-3.1.0-150400.3.6.1 * libtss2-mu0-64bit-3.1.0-150400.3.6.1 * libtss2-sys1-64bit-debuginfo-3.1.0-150400.3.6.1 * libtss2-tcti-device0-64bit-3.1.0-150400.3.6.1 * libtss2-sys1-64bit-3.1.0-150400.3.6.1 * openSUSE Leap Micro 5.3 (aarch64 x86_64) * libtss2-mu0-debuginfo-3.1.0-150400.3.6.1 * libtss2-sys1-3.1.0-150400.3.6.1 * libtss2-tctildr0-3.1.0-150400.3.6.1 * tpm2-0-tss-debugsource-3.1.0-150400.3.6.1 * libtss2-rc0-debuginfo-3.1.0-150400.3.6.1 * libtss2-tctildr0-debuginfo-3.1.0-150400.3.6.1 * libtss2-esys0-debuginfo-3.1.0-150400.3.6.1 * libtss2-fapi1-3.1.0-150400.3.6.1 * libtss2-tcti-device0-3.1.0-150400.3.6.1 * libtss2-esys0-3.1.0-150400.3.6.1 * libtss2-sys1-debuginfo-3.1.0-150400.3.6.1 * libtss2-mu0-3.1.0-150400.3.6.1 * libtss2-rc0-3.1.0-150400.3.6.1 * libtss2-tcti-device0-debuginfo-3.1.0-150400.3.6.1 * libtss2-fapi1-debuginfo-3.1.0-150400.3.6.1 * tpm2-0-tss-3.1.0-150400.3.6.1 * openSUSE Leap Micro 5.4 (aarch64 s390x x86_64) * libtss2-mu0-debuginfo-3.1.0-150400.3.6.1 * libtss2-sys1-3.1.0-150400.3.6.1 * libtss2-tctildr0-3.1.0-150400.3.6.1 * tpm2-0-tss-debugsource-3.1.0-150400.3.6.1 * libtss2-rc0-debuginfo-3.1.0-150400.3.6.1 * libtss2-tctildr0-debuginfo-3.1.0-150400.3.6.1 * libtss2-esys0-debuginfo-3.1.0-150400.3.6.1 * libtss2-fapi1-3.1.0-150400.3.6.1 * libtss2-tcti-device0-3.1.0-150400.3.6.1 * libtss2-esys0-3.1.0-150400.3.6.1 * libtss2-sys1-debuginfo-3.1.0-150400.3.6.1 * libtss2-mu0-3.1.0-150400.3.6.1 * libtss2-rc0-3.1.0-150400.3.6.1 * libtss2-tcti-device0-debuginfo-3.1.0-150400.3.6.1 * libtss2-fapi1-debuginfo-3.1.0-150400.3.6.1 * tpm2-0-tss-3.1.0-150400.3.6.1 * openSUSE Leap 15.5 (aarch64 ppc64le s390x x86_64) * libtss2-sys1-debuginfo-3.1.0-150400.3.6.1 * tpm2-0-tss-devel-3.1.0-150400.3.6.1 * libtss2-tcti-swtpm0-debuginfo-3.1.0-150400.3.6.1 * libtss2-tcti-mssim0-3.1.0-150400.3.6.1 * tpm2-0-tss-3.1.0-150400.3.6.1 * libtss2-tctildr0-3.1.0-150400.3.6.1 * tpm2-0-tss-debugsource-3.1.0-150400.3.6.1 * libtss2-tctildr0-debuginfo-3.1.0-150400.3.6.1 * libtss2-esys0-debuginfo-3.1.0-150400.3.6.1 * libtss2-tcti-device0-3.1.0-150400.3.6.1 * libtss2-esys0-3.1.0-150400.3.6.1 * libtss2-rc0-3.1.0-150400.3.6.1 * libtss2-tcti-cmd0-3.1.0-150400.3.6.1 * libtss2-tcti-pcap0-3.1.0-150400.3.6.1 * libtss2-tcti-swtpm0-3.1.0-150400.3.6.1 * libtss2-fapi1-debuginfo-3.1.0-150400.3.6.1 * libtss2-rc0-debuginfo-3.1.0-150400.3.6.1 * libtss2-mu0-3.1.0-150400.3.6.1 * libtss2-mu0-debuginfo-3.1.0-150400.3.6.1 * libtss2-tcti-cmd0-debuginfo-3.1.0-150400.3.6.1 * libtss2-tcti-mssim0-debuginfo-3.1.0-150400.3.6.1 * libtss2-sys1-3.1.0-150400.3.6.1 * libtss2-fapi1-3.1.0-150400.3.6.1 * libtss2-tcti-device0-debuginfo-3.1.0-150400.3.6.1 * libtss2-tcti-pcap0-debuginfo-3.1.0-150400.3.6.1 * openSUSE Leap 15.5 (x86_64) * libtss2-rc0-32bit-3.1.0-150400.3.6.1 * libtss2-esys0-32bit-debuginfo-3.1.0-150400.3.6.1 * libtss2-sys1-32bit-3.1.0-150400.3.6.1 * libtss2-rc0-32bit-debuginfo-3.1.0-150400.3.6.1 * libtss2-fapi1-32bit-debuginfo-3.1.0-150400.3.6.1 * libtss2-tcti-mssim0-32bit-debuginfo-3.1.0-150400.3.6.1 * libtss2-fapi1-32bit-3.1.0-150400.3.6.1 * libtss2-tcti-swtpm0-32bit-debuginfo-3.1.0-150400.3.6.1 * libtss2-tcti-swtpm0-32bit-3.1.0-150400.3.6.1 * libtss2-tctildr0-32bit-debuginfo-3.1.0-150400.3.6.1 * libtss2-mu0-32bit-3.1.0-150400.3.6.1 * libtss2-tcti-device0-32bit-debuginfo-3.1.0-150400.3.6.1 * libtss2-tcti-device0-32bit-3.1.0-150400.3.6.1 * libtss2-mu0-32bit-debuginfo-3.1.0-150400.3.6.1 * libtss2-tcti-cmd0-32bit-3.1.0-150400.3.6.1 * libtss2-esys0-32bit-3.1.0-150400.3.6.1 * libtss2-tcti-cmd0-32bit-debuginfo-3.1.0-150400.3.6.1 * libtss2-sys1-32bit-debuginfo-3.1.0-150400.3.6.1 * libtss2-tctildr0-32bit-3.1.0-150400.3.6.1 * libtss2-tcti-mssim0-32bit-3.1.0-150400.3.6.1 * SUSE Linux Enterprise Micro for Rancher 5.3 (aarch64 s390x x86_64) * libtss2-mu0-debuginfo-3.1.0-150400.3.6.1 * libtss2-sys1-3.1.0-150400.3.6.1 * libtss2-tctildr0-3.1.0-150400.3.6.1 * tpm2-0-tss-debugsource-3.1.0-150400.3.6.1 * libtss2-rc0-debuginfo-3.1.0-150400.3.6.1 * libtss2-tctildr0-debuginfo-3.1.0-150400.3.6.1 * libtss2-esys0-debuginfo-3.1.0-150400.3.6.1 * libtss2-fapi1-3.1.0-150400.3.6.1 * libtss2-tcti-device0-3.1.0-150400.3.6.1 * libtss2-esys0-3.1.0-150400.3.6.1 * libtss2-sys1-debuginfo-3.1.0-150400.3.6.1 * libtss2-mu0-3.1.0-150400.3.6.1 * libtss2-rc0-3.1.0-150400.3.6.1 * libtss2-tcti-device0-debuginfo-3.1.0-150400.3.6.1 * libtss2-fapi1-debuginfo-3.1.0-150400.3.6.1 * tpm2-0-tss-3.1.0-150400.3.6.1 * SUSE Linux Enterprise Micro 5.3 (aarch64 s390x x86_64) * libtss2-mu0-debuginfo-3.1.0-150400.3.6.1 * libtss2-sys1-3.1.0-150400.3.6.1 * libtss2-tctildr0-3.1.0-150400.3.6.1 * tpm2-0-tss-debugsource-3.1.0-150400.3.6.1 * libtss2-rc0-debuginfo-3.1.0-150400.3.6.1 * libtss2-tctildr0-debuginfo-3.1.0-150400.3.6.1 * libtss2-esys0-debuginfo-3.1.0-150400.3.6.1 * libtss2-fapi1-3.1.0-150400.3.6.1 * libtss2-tcti-device0-3.1.0-150400.3.6.1 * libtss2-esys0-3.1.0-150400.3.6.1 * libtss2-sys1-debuginfo-3.1.0-150400.3.6.1 * libtss2-mu0-3.1.0-150400.3.6.1 * libtss2-rc0-3.1.0-150400.3.6.1 * libtss2-tcti-device0-debuginfo-3.1.0-150400.3.6.1 * libtss2-fapi1-debuginfo-3.1.0-150400.3.6.1 * tpm2-0-tss-3.1.0-150400.3.6.1 * SUSE Linux Enterprise Micro for Rancher 5.4 (aarch64 s390x x86_64) * libtss2-mu0-debuginfo-3.1.0-150400.3.6.1 * libtss2-sys1-3.1.0-150400.3.6.1 * libtss2-tctildr0-3.1.0-150400.3.6.1 * tpm2-0-tss-debugsource-3.1.0-150400.3.6.1 * libtss2-rc0-debuginfo-3.1.0-150400.3.6.1 * libtss2-tctildr0-debuginfo-3.1.0-150400.3.6.1 * libtss2-esys0-debuginfo-3.1.0-150400.3.6.1 * libtss2-fapi1-3.1.0-150400.3.6.1 * libtss2-tcti-device0-3.1.0-150400.3.6.1 * libtss2-esys0-3.1.0-150400.3.6.1 * libtss2-sys1-debuginfo-3.1.0-150400.3.6.1 * libtss2-mu0-3.1.0-150400.3.6.1 * libtss2-rc0-3.1.0-150400.3.6.1 * libtss2-tcti-device0-debuginfo-3.1.0-150400.3.6.1 * libtss2-fapi1-debuginfo-3.1.0-150400.3.6.1 * tpm2-0-tss-3.1.0-150400.3.6.1 * SUSE Linux Enterprise Micro 5.4 (aarch64 s390x x86_64) * libtss2-mu0-debuginfo-3.1.0-150400.3.6.1 * libtss2-sys1-3.1.0-150400.3.6.1 * libtss2-tctildr0-3.1.0-150400.3.6.1 * tpm2-0-tss-debugsource-3.1.0-150400.3.6.1 * libtss2-rc0-debuginfo-3.1.0-150400.3.6.1 * libtss2-tctildr0-debuginfo-3.1.0-150400.3.6.1 * libtss2-esys0-debuginfo-3.1.0-150400.3.6.1 * libtss2-fapi1-3.1.0-150400.3.6.1 * libtss2-tcti-device0-3.1.0-150400.3.6.1 * libtss2-esys0-3.1.0-150400.3.6.1 * libtss2-sys1-debuginfo-3.1.0-150400.3.6.1 * libtss2-mu0-3.1.0-150400.3.6.1 * libtss2-rc0-3.1.0-150400.3.6.1 * libtss2-tcti-device0-debuginfo-3.1.0-150400.3.6.1 * libtss2-fapi1-debuginfo-3.1.0-150400.3.6.1 * tpm2-0-tss-3.1.0-150400.3.6.1 * SUSE Linux Enterprise Micro 5.5 (aarch64 s390x x86_64) * libtss2-mu0-debuginfo-3.1.0-150400.3.6.1 * libtss2-sys1-3.1.0-150400.3.6.1 * libtss2-tctildr0-3.1.0-150400.3.6.1 * tpm2-0-tss-debugsource-3.1.0-150400.3.6.1 * libtss2-rc0-debuginfo-3.1.0-150400.3.6.1 * libtss2-tctildr0-debuginfo-3.1.0-150400.3.6.1 * libtss2-esys0-debuginfo-3.1.0-150400.3.6.1 * libtss2-fapi1-3.1.0-150400.3.6.1 * libtss2-tcti-device0-3.1.0-150400.3.6.1 * libtss2-esys0-3.1.0-150400.3.6.1 * libtss2-sys1-debuginfo-3.1.0-150400.3.6.1 * libtss2-mu0-3.1.0-150400.3.6.1 * libtss2-rc0-3.1.0-150400.3.6.1 * libtss2-tcti-device0-debuginfo-3.1.0-150400.3.6.1 * libtss2-fapi1-debuginfo-3.1.0-150400.3.6.1 * tpm2-0-tss-3.1.0-150400.3.6.1 * Basesystem Module 15-SP5 (aarch64 ppc64le s390x x86_64) * libtss2-sys1-debuginfo-3.1.0-150400.3.6.1 * tpm2-0-tss-devel-3.1.0-150400.3.6.1 * libtss2-tcti-swtpm0-debuginfo-3.1.0-150400.3.6.1 * libtss2-tcti-mssim0-3.1.0-150400.3.6.1 * tpm2-0-tss-3.1.0-150400.3.6.1 * libtss2-tctildr0-3.1.0-150400.3.6.1 * tpm2-0-tss-debugsource-3.1.0-150400.3.6.1 * libtss2-tctildr0-debuginfo-3.1.0-150400.3.6.1 * libtss2-esys0-debuginfo-3.1.0-150400.3.6.1 * libtss2-tcti-device0-3.1.0-150400.3.6.1 * libtss2-esys0-3.1.0-150400.3.6.1 * libtss2-rc0-3.1.0-150400.3.6.1 * libtss2-tcti-cmd0-3.1.0-150400.3.6.1 * libtss2-tcti-pcap0-3.1.0-150400.3.6.1 * libtss2-tcti-swtpm0-3.1.0-150400.3.6.1 * libtss2-fapi1-debuginfo-3.1.0-150400.3.6.1 * libtss2-rc0-debuginfo-3.1.0-150400.3.6.1 * libtss2-mu0-3.1.0-150400.3.6.1 * libtss2-mu0-debuginfo-3.1.0-150400.3.6.1 * libtss2-tcti-cmd0-debuginfo-3.1.0-150400.3.6.1 * libtss2-tcti-mssim0-debuginfo-3.1.0-150400.3.6.1 * libtss2-sys1-3.1.0-150400.3.6.1 * libtss2-fapi1-3.1.0-150400.3.6.1 * libtss2-tcti-device0-debuginfo-3.1.0-150400.3.6.1 * libtss2-tcti-pcap0-debuginfo-3.1.0-150400.3.6.1 ## References: * https://www.suse.com/security/cve/CVE-2024-29040.html * https://bugzilla.suse.com/show_bug.cgi?id=1223690

1 0

SUSE-SU-2024:1636-1: moderate: Security update for tpm2.0-tools
by OPENSUSE-SECURITY-UPDATES 14 May '24

14 May '24

# Security update for tpm2.0-tools Announcement ID: SUSE-SU-2024:1636-1 Rating: moderate References: * bsc#1223687 * bsc#1223689 Cross-References: * CVE-2024-29038 * CVE-2024-29039 CVSS scores: * CVE-2024-29038 ( SUSE ): 5.5 CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N * CVE-2024-29039 ( SUSE ): 5.5 CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N Affected Products: * Basesystem Module 15-SP5 * openSUSE Leap 15.4 * openSUSE Leap 15.5 * openSUSE Leap Micro 5.3 * openSUSE Leap Micro 5.4 * SUSE Linux Enterprise Desktop 15 SP5 * SUSE Linux Enterprise High Performance Computing 15 SP5 * SUSE Linux Enterprise Micro 5.3 * SUSE Linux Enterprise Micro 5.4 * SUSE Linux Enterprise Micro 5.5 * SUSE Linux Enterprise Micro for Rancher 5.3 * SUSE Linux Enterprise Micro for Rancher 5.4 * SUSE Linux Enterprise Real Time 15 SP5 * SUSE Linux Enterprise Server 15 SP5 * SUSE Linux Enterprise Server for SAP Applications 15 SP5 An update that solves two vulnerabilities can now be installed. ## Description: This update for tpm2.0-tools fixes the following issues: * CVE-2024-29038: Fixed arbitrary quote data validation by tpm2_checkquote (bsc#1223687). * CVE-2024-29039: Fixed pcr selection value to be compared with the attest (bsc#1223689). ## Patch Instructions: To install this SUSE update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: * Basesystem Module 15-SP5 zypper in -t patch SUSE-SLE-Module-Basesystem-15-SP5-2024-1636=1 * openSUSE Leap 15.4 zypper in -t patch SUSE-2024-1636=1 * openSUSE Leap Micro 5.3 zypper in -t patch openSUSE-Leap-Micro-5.3-2024-1636=1 * openSUSE Leap Micro 5.4 zypper in -t patch openSUSE-Leap-Micro-5.4-2024-1636=1 * openSUSE Leap 15.5 zypper in -t patch openSUSE-SLE-15.5-2024-1636=1 * SUSE Linux Enterprise Micro for Rancher 5.3 zypper in -t patch SUSE-SLE-Micro-5.3-2024-1636=1 * SUSE Linux Enterprise Micro 5.3 zypper in -t patch SUSE-SLE-Micro-5.3-2024-1636=1 * SUSE Linux Enterprise Micro for Rancher 5.4 zypper in -t patch SUSE-SLE-Micro-5.4-2024-1636=1 * SUSE Linux Enterprise Micro 5.4 zypper in -t patch SUSE-SLE-Micro-5.4-2024-1636=1 * SUSE Linux Enterprise Micro 5.5 zypper in -t patch SUSE-SLE-Micro-5.5-2024-1636=1 ## Package List: * Basesystem Module 15-SP5 (aarch64 ppc64le s390x x86_64) * tpm2.0-tools-debugsource-5.2-150400.6.3.1 * tpm2.0-tools-5.2-150400.6.3.1 * tpm2.0-tools-debuginfo-5.2-150400.6.3.1 * openSUSE Leap 15.4 (aarch64 ppc64le s390x x86_64 i586) * tpm2.0-tools-debugsource-5.2-150400.6.3.1 * tpm2.0-tools-5.2-150400.6.3.1 * tpm2.0-tools-debuginfo-5.2-150400.6.3.1 * openSUSE Leap Micro 5.3 (aarch64 x86_64) * tpm2.0-tools-debugsource-5.2-150400.6.3.1 * tpm2.0-tools-5.2-150400.6.3.1 * tpm2.0-tools-debuginfo-5.2-150400.6.3.1 * openSUSE Leap Micro 5.4 (aarch64 s390x x86_64) * tpm2.0-tools-debugsource-5.2-150400.6.3.1 * tpm2.0-tools-5.2-150400.6.3.1 * tpm2.0-tools-debuginfo-5.2-150400.6.3.1 * openSUSE Leap 15.5 (aarch64 ppc64le s390x x86_64) * tpm2.0-tools-debugsource-5.2-150400.6.3.1 * tpm2.0-tools-5.2-150400.6.3.1 * tpm2.0-tools-debuginfo-5.2-150400.6.3.1 * SUSE Linux Enterprise Micro for Rancher 5.3 (aarch64 s390x x86_64) * tpm2.0-tools-debugsource-5.2-150400.6.3.1 * tpm2.0-tools-5.2-150400.6.3.1 * tpm2.0-tools-debuginfo-5.2-150400.6.3.1 * SUSE Linux Enterprise Micro 5.3 (aarch64 s390x x86_64) * tpm2.0-tools-debugsource-5.2-150400.6.3.1 * tpm2.0-tools-5.2-150400.6.3.1 * tpm2.0-tools-debuginfo-5.2-150400.6.3.1 * SUSE Linux Enterprise Micro for Rancher 5.4 (aarch64 s390x x86_64) * tpm2.0-tools-debugsource-5.2-150400.6.3.1 * tpm2.0-tools-5.2-150400.6.3.1 * tpm2.0-tools-debuginfo-5.2-150400.6.3.1 * SUSE Linux Enterprise Micro 5.4 (aarch64 s390x x86_64) * tpm2.0-tools-debugsource-5.2-150400.6.3.1 * tpm2.0-tools-5.2-150400.6.3.1 * tpm2.0-tools-debuginfo-5.2-150400.6.3.1 * SUSE Linux Enterprise Micro 5.5 (aarch64 s390x x86_64) * tpm2.0-tools-debugsource-5.2-150400.6.3.1 * tpm2.0-tools-5.2-150400.6.3.1 * tpm2.0-tools-debuginfo-5.2-150400.6.3.1 ## References: * https://www.suse.com/security/cve/CVE-2024-29038.html * https://www.suse.com/security/cve/CVE-2024-29039.html * https://bugzilla.suse.com/show_bug.cgi?id=1223687 * https://bugzilla.suse.com/show_bug.cgi?id=1223689

1 0

openSUSE-SU-2024:0125-1: important: Security update for python-Pillow
by opensuse-security＠opensuse.org 13 May '24

13 May '24

openSUSE Security Update: Security update for python-Pillow ______________________________________________________________________________ Announcement ID: openSUSE-SU-2024:0125-1 Rating: important References: #1219048 Cross-References: CVE-2023-50447 CVSS scores: CVE-2023-50447 (NVD) : 8.1 CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H CVE-2023-50447 (SUSE): 8.4 CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H Affected Products: openSUSE Backports SLE-15-SP5 ______________________________________________________________________________ An update that fixes one vulnerability is now available. Description: This update for python-Pillow fixes the following issues: - CVE-2023-50447: Fixed arbitrary code execution via the environment parameter (boo#1219048) Patch Instructions: To install this openSUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Backports SLE-15-SP5: zypper in -t patch openSUSE-2024-125=1 Package List: - openSUSE Backports SLE-15-SP5 (aarch64 i586 ppc64le s390x x86_64): python3-Pillow-8.4.0-bp155.3.3.1 python3-Pillow-tk-8.4.0-bp155.3.3.1 References: https://www.suse.com/security/cve/CVE-2023-50447.html https://bugzilla.suse.com/1219048

1 0

SUSE-SU-2024:1624-1: important: Security update for python-Werkzeug
by OPENSUSE-SECURITY-UPDATES 13 May '24

13 May '24

# Security update for python-Werkzeug Announcement ID: SUSE-SU-2024:1624-1 Rating: important References: * bsc#1223979 Cross-References: * CVE-2024-34069 CVSS scores: * CVE-2024-34069 ( SUSE ): 7.5 CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H Affected Products: * Basesystem Module 15-SP5 * openSUSE Leap 15.3 * openSUSE Leap 15.5 * SUSE Enterprise Storage 7.1 * SUSE Linux Enterprise Desktop 15 SP4 LTSS 15-SP4 * SUSE Linux Enterprise Desktop 15 SP5 * SUSE Linux Enterprise High Performance Computing 15 SP3 * SUSE Linux Enterprise High Performance Computing 15 SP4 * SUSE Linux Enterprise High Performance Computing 15 SP5 * SUSE Linux Enterprise High Performance Computing ESPOS 15 SP4 * SUSE Linux Enterprise High Performance Computing LTSS 15 SP3 * SUSE Linux Enterprise High Performance Computing LTSS 15 SP4 * SUSE Linux Enterprise Micro 5.5 * SUSE Linux Enterprise Real Time 15 SP5 * SUSE Linux Enterprise Server 15 SP3 * SUSE Linux Enterprise Server 15 SP3 LTSS 15-SP3 * SUSE Linux Enterprise Server 15 SP4 * SUSE Linux Enterprise Server 15 SP4 LTSS 15-SP4 * SUSE Linux Enterprise Server 15 SP5 * SUSE Linux Enterprise Server for SAP Applications 15 SP3 * SUSE Linux Enterprise Server for SAP Applications 15 SP4 * SUSE Linux Enterprise Server for SAP Applications 15 SP5 * SUSE Manager Proxy 4.3 * SUSE Manager Retail Branch Server 4.3 * SUSE Manager Server 4.3 * SUSE Package Hub 15 15-SP5 An update that solves one vulnerability can now be installed. ## Description: This update for python-Werkzeug fixes the following issues: * CVE-2024-34069: Fixed a remote code execution through debugger when interacting with attacker controlled domain (bsc#1223979). ## Patch Instructions: To install this SUSE update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: * openSUSE Leap 15.3 zypper in -t patch SUSE-2024-1624=1 * openSUSE Leap 15.5 zypper in -t patch openSUSE-SLE-15.5-2024-1624=1 * Basesystem Module 15-SP5 zypper in -t patch SUSE-SLE-Module-Basesystem-15-SP5-2024-1624=1 * SUSE Package Hub 15 15-SP5 zypper in -t patch SUSE-SLE-Module-Packagehub-Subpackages-15-SP5-2024-1624=1 * SUSE Linux Enterprise High Performance Computing LTSS 15 SP3 zypper in -t patch SUSE-SLE-Product-HPC-15-SP3-LTSS-2024-1624=1 * SUSE Linux Enterprise High Performance Computing ESPOS 15 SP4 zypper in -t patch SUSE-SLE-Product-HPC-15-SP4-ESPOS-2024-1624=1 * SUSE Linux Enterprise High Performance Computing LTSS 15 SP4 zypper in -t patch SUSE-SLE-Product-HPC-15-SP4-LTSS-2024-1624=1 * SUSE Linux Enterprise Desktop 15 SP4 LTSS 15-SP4 zypper in -t patch SUSE-SLE-Product-SLED-15-SP4-LTSS-2024-1624=1 * SUSE Linux Enterprise Server 15 SP3 LTSS 15-SP3 zypper in -t patch SUSE-SLE-Product-SLES-15-SP3-LTSS-2024-1624=1 * SUSE Linux Enterprise Server 15 SP4 LTSS 15-SP4 zypper in -t patch SUSE-SLE-Product-SLES-15-SP4-LTSS-2024-1624=1 * SUSE Linux Enterprise Server for SAP Applications 15 SP3 zypper in -t patch SUSE-SLE-Product-SLES_SAP-15-SP3-2024-1624=1 * SUSE Linux Enterprise Server for SAP Applications 15 SP4 zypper in -t patch SUSE-SLE-Product-SLES_SAP-15-SP4-2024-1624=1 * SUSE Manager Proxy 4.3 zypper in -t patch SUSE-SLE-Product-SUSE-Manager-Proxy-4.3-2024-1624=1 * SUSE Manager Retail Branch Server 4.3 zypper in -t patch SUSE-SLE-Product-SUSE-Manager-Retail-Branch- Server-4.3-2024-1624=1 * SUSE Manager Server 4.3 zypper in -t patch SUSE-SLE-Product-SUSE-Manager-Server-4.3-2024-1624=1 * SUSE Enterprise Storage 7.1 zypper in -t patch SUSE-Storage-7.1-2024-1624=1 ## Package List: * openSUSE Leap 15.3 (noarch) * python3-Werkzeug-1.0.1-150300.3.8.1 * python2-Werkzeug-1.0.1-150300.3.8.1 * openSUSE Leap 15.5 (noarch) * python3-Werkzeug-1.0.1-150300.3.8.1 * Basesystem Module 15-SP5 (noarch) * python3-Werkzeug-1.0.1-150300.3.8.1 * SUSE Package Hub 15 15-SP5 (noarch) * python2-Werkzeug-1.0.1-150300.3.8.1 * SUSE Linux Enterprise High Performance Computing LTSS 15 SP3 (noarch) * python3-Werkzeug-1.0.1-150300.3.8.1 * SUSE Linux Enterprise High Performance Computing ESPOS 15 SP4 (noarch) * python3-Werkzeug-1.0.1-150300.3.8.1 * SUSE Linux Enterprise High Performance Computing LTSS 15 SP4 (noarch) * python3-Werkzeug-1.0.1-150300.3.8.1 * SUSE Linux Enterprise Desktop 15 SP4 LTSS 15-SP4 (noarch) * python3-Werkzeug-1.0.1-150300.3.8.1 * SUSE Linux Enterprise Server 15 SP3 LTSS 15-SP3 (noarch) * python3-Werkzeug-1.0.1-150300.3.8.1 * SUSE Linux Enterprise Server 15 SP4 LTSS 15-SP4 (noarch) * python3-Werkzeug-1.0.1-150300.3.8.1 * SUSE Linux Enterprise Server for SAP Applications 15 SP3 (noarch) * python3-Werkzeug-1.0.1-150300.3.8.1 * SUSE Linux Enterprise Server for SAP Applications 15 SP4 (noarch) * python3-Werkzeug-1.0.1-150300.3.8.1 * SUSE Manager Proxy 4.3 (noarch) * python3-Werkzeug-1.0.1-150300.3.8.1 * SUSE Manager Retail Branch Server 4.3 (noarch) * python3-Werkzeug-1.0.1-150300.3.8.1 * SUSE Manager Server 4.3 (noarch) * python3-Werkzeug-1.0.1-150300.3.8.1 * SUSE Enterprise Storage 7.1 (noarch) * python3-Werkzeug-1.0.1-150300.3.8.1 ## References: * https://www.suse.com/security/cve/CVE-2024-34069.html * https://bugzilla.suse.com/show_bug.cgi?id=1223979

1 0

openSUSE-SU-2024:0122-1: important: Security update for opera
by opensuse-security＠opensuse.org 13 May '24

13 May '24

openSUSE Security Update: Security update for opera ______________________________________________________________________________ Announcement ID: openSUSE-SU-2024:0122-1 Rating: important References: Cross-References: CVE-2024-2883 CVE-2024-2885 CVE-2024-2886 CVE-2024-2887 Affected Products: openSUSE Leap 15.6:NonFree ______________________________________________________________________________ An update that fixes four vulnerabilities is now available. Description: Opera was updated to fix the following issues: Update to 109.0.5097.45 * CHR-9416 Updating Chromium on desktop-stable-* branches * DNA-114737 [Search box] It's getting blurred when click on it, also lower corners are not rounded sometimes * DNA-115042 '+' button is not responsive when 30+ tabs opened * DNA-115326 Wrong fonts and padding after intake * DNA-115392 [Badges] Text displayed in red * DNA-115501 'Review your payment' native popup has wrong colors * DNA-115809 Enable #show-duplicate-indicator-on-link on all streams Update to 109.0.5097.38 * CHR-9695 Update Chromium on desktop-stable-123-5097 to 123.0.6312.87 * DNA-115156 [Login and Password suggestion] Suggestions are bolded and highlight doesn`t fill all area * DNA-115313 No video playback on skyshowtime.com * DNA-115639 [Version 109][Detached window] Missing functions names in light mode * DNA-115812 Enable #startpage-opening-animation on all streams * DNA-115836 Lucid mode visual issues on H264 videos - The update to chromium 109.0.5097.38 fixes following issues: CVE-2024-2883, CVE-2024-2885, CVE-2024-2886, CVE-2024-2887 Update to 109.0.5097.33 * CHR-9674 Update Chromium on desktop-stable-123-5097 to 123.0.6312.46 * DNA-115357 [Settings] Search toolbar has wrong position * DNA-115396 Bolded camera icon when camera access is allowed * DNA-115478 AI Prompts in text highlight popup not displayed properly * DNA-115563 Wallet selector not working * DNA-115601 Remove 'moving text' animation in the tab cycler * DNA-115645 Internal pages icons unreadable when highlight * DNA-115717 'Your extension was disabled because it is corrupted' message is displayed to user * DNA-115770 Promote 109 to stable - Complete Opera 109 changelog at: https://blogs.opera.com/desktop/changelog-for-109/ Patch Instructions: To install this openSUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 15.6:NonFree: zypper in -t patch openSUSE-2024-122=1 Package List: - openSUSE Leap 15.6:NonFree (x86_64): opera-109.0.5097.45-lp156.2.3.1 References: https://www.suse.com/security/cve/CVE-2024-2883.html https://www.suse.com/security/cve/CVE-2024-2885.html https://www.suse.com/security/cve/CVE-2024-2886.html https://www.suse.com/security/cve/CVE-2024-2887.html

1 0

openSUSE-SU-2024:0123-1: important: Security update for chromium
by opensuse-security＠opensuse.org 13 May '24

13 May '24

openSUSE Security Update: Security update for chromium ______________________________________________________________________________ Announcement ID: openSUSE-SU-2024:0123-1 Rating: important References: #1221732 #1222035 #1222260 #1222707 #1222958 #1223845 #1223846 #1224045 Cross-References: CVE-2024-2625 CVE-2024-2626 CVE-2024-2627 CVE-2024-2628 CVE-2024-2883 CVE-2024-2885 CVE-2024-2886 CVE-2024-2887 CVE-2024-3156 CVE-2024-3157 CVE-2024-3158 CVE-2024-3159 CVE-2024-3515 CVE-2024-3516 CVE-2024-3832 CVE-2024-3833 CVE-2024-3834 CVE-2024-3837 CVE-2024-3838 CVE-2024-3839 CVE-2024-3840 CVE-2024-3841 CVE-2024-3843 CVE-2024-3844 CVE-2024-3845 CVE-2024-3846 CVE-2024-3847 CVE-2024-4058 CVE-2024-4059 CVE-2024-4060 CVE-2024-4331 CVE-2024-4368 CVE-2024-4558 CVE-2024-4559 CVE-2024-4671 CVSS scores: CVE-2024-2625 (NVD) : 8.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H CVE-2024-2626 (NVD) : 6.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N CVE-2024-2627 (NVD) : 8.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H CVE-2024-2628 (NVD) : 4.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N CVE-2024-3156 (NVD) : 8.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H CVE-2024-3158 (NVD) : 8.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H CVE-2024-3834 (NVD) : 8.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H CVE-2024-3837 (NVD) : 8.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H CVE-2024-3838 (NVD) : 5.5 CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N CVE-2024-3839 (NVD) : 6.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N Affected Products: openSUSE Backports SLE-15-SP5 ______________________________________________________________________________ An update that fixes 35 vulnerabilities is now available. Description: This update for chromium fixes the following issues: - Chromium 124.0.6367.201 * CVE-2024-4671: Use after free in Visuals - Chromium 124.0.6367.155 (boo#1224045) * CVE-2024-4558: Use after free in ANGLE * CVE-2024-4559: Heap buffer overflow in WebAudio - Chromium 124.0.6367.118 (boo#1223846) * CVE-2024-4331: Use after free in Picture In Picture * CVE-2024-4368: Use after free in Dawn - Chromium 124.0.6367.78 (boo#1223845) * CVE-2024-4058: Type Confusion in ANGLE * CVE-2024-4059: Out of bounds read in V8 API * CVE-2024-4060: Use after free in Dawn - Chromium 124.0.6367.60 (boo#1222958) * CVE-2024-3832: Object corruption in V8. * CVE-2024-3833: Object corruption in WebAssembly. * CVE-2024-3834: Use after free in Downloads. Reported by ChaobinZhang * CVE-2024-3837: Use after free in QUIC. * CVE-2024-3838: Inappropriate implementation in Autofill. * CVE-2024-3839: Out of bounds read in Fonts. * CVE-2024-3840: Insufficient policy enforcement in Site Isolation. * CVE-2024-3841: Insufficient data validation in Browser Switcher. * CVE-2024-3843: Insufficient data validation in Downloads. * CVE-2024-3844: Inappropriate implementation in Extensions. * CVE-2024-3845: Inappropriate implementation in Network. * CVE-2024-3846: Inappropriate implementation in Prompts. * CVE-2024-3847: Insufficient policy enforcement in WebUI. - Chromium 123.0.6312.122 (boo#1222707) * CVE-2024-3157: Out of bounds write in Compositing * CVE-2024-3516: Heap buffer overflow in ANGLE * CVE-2024-3515: Use after free in Dawn - Chromium 123.0.6312.105 (boo#1222260) * CVE-2024-3156: Inappropriate implementation in V8 * CVE-2024-3158: Use after free in Bookmarks * CVE-2024-3159: Out of bounds memory access in V8 - Chromium 123.0.6312.86 (boo#1222035) * CVE-2024-2883: Use after free in ANGLE * CVE-2024-2885: Use after free in Dawn * CVE-2024-2886: Use after free in WebCodecs * CVE-2024-2887: Type Confusion in WebAssembly - Chromium 123.0.6312.58 (boo#1221732) * CVE-2024-2625: Object lifecycle issue in V8 * CVE-2024-2626: Out of bounds read in Swiftshader * CVE-2024-2627: Use after free in Canvas * CVE-2024-2628: Inappropriate implementation in Downloads Patch Instructions: To install this openSUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Backports SLE-15-SP5: zypper in -t patch openSUSE-2024-123=1 Package List: - openSUSE Backports SLE-15-SP5 (aarch64 x86_64): chromedriver-124.0.6367.201-bp155.2.78.1 chromium-124.0.6367.201-bp155.2.78.1 References: https://www.suse.com/security/cve/CVE-2024-2625.html https://www.suse.com/security/cve/CVE-2024-2626.html https://www.suse.com/security/cve/CVE-2024-2627.html https://www.suse.com/security/cve/CVE-2024-2628.html https://www.suse.com/security/cve/CVE-2024-2883.html https://www.suse.com/security/cve/CVE-2024-2885.html https://www.suse.com/security/cve/CVE-2024-2886.html https://www.suse.com/security/cve/CVE-2024-2887.html https://www.suse.com/security/cve/CVE-2024-3156.html https://www.suse.com/security/cve/CVE-2024-3157.html https://www.suse.com/security/cve/CVE-2024-3158.html https://www.suse.com/security/cve/CVE-2024-3159.html https://www.suse.com/security/cve/CVE-2024-3515.html https://www.suse.com/security/cve/CVE-2024-3516.html https://www.suse.com/security/cve/CVE-2024-3832.html https://www.suse.com/security/cve/CVE-2024-3833.html https://www.suse.com/security/cve/CVE-2024-3834.html https://www.suse.com/security/cve/CVE-2024-3837.html https://www.suse.com/security/cve/CVE-2024-3838.html https://www.suse.com/security/cve/CVE-2024-3839.html https://www.suse.com/security/cve/CVE-2024-3840.html https://www.suse.com/security/cve/CVE-2024-3841.html https://www.suse.com/security/cve/CVE-2024-3843.html https://www.suse.com/security/cve/CVE-2024-3844.html https://www.suse.com/security/cve/CVE-2024-3845.html https://www.suse.com/security/cve/CVE-2024-3846.html https://www.suse.com/security/cve/CVE-2024-3847.html https://www.suse.com/security/cve/CVE-2024-4058.html https://www.suse.com/security/cve/CVE-2024-4059.html https://www.suse.com/security/cve/CVE-2024-4060.html https://www.suse.com/security/cve/CVE-2024-4331.html https://www.suse.com/security/cve/CVE-2024-4368.html https://www.suse.com/security/cve/CVE-2024-4558.html https://www.suse.com/security/cve/CVE-2024-4559.html https://www.suse.com/security/cve/CVE-2024-4671.html https://bugzilla.suse.com/1221732 https://bugzilla.suse.com/1222035 https://bugzilla.suse.com/1222260 https://bugzilla.suse.com/1222707 https://bugzilla.suse.com/1222958 https://bugzilla.suse.com/1223845 https://bugzilla.suse.com/1223846 https://bugzilla.suse.com/1224045

1 0

SUSE-SU-2024:1607-1: important: Security update for python-Pillow
by OPENSUSE-SECURITY-UPDATES 10 May '24

10 May '24

# Security update for python-Pillow Announcement ID: SUSE-SU-2024:1607-1 Rating: important References: * bsc#1185784 * bsc#1185785 * bsc#1185786 * bsc#1185803 * bsc#1185804 * bsc#1185805 Cross-References: * CVE-2021-25287 * CVE-2021-25288 * CVE-2021-28675 * CVE-2021-28676 * CVE-2021-28677 * CVE-2021-28678 CVSS scores: * CVE-2021-25287 ( SUSE ): 8.2 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:H * CVE-2021-25287 ( NVD ): 9.1 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:H * CVE-2021-25288 ( SUSE ): 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H * CVE-2021-25288 ( NVD ): 9.1 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:H * CVE-2021-28675 ( SUSE ): 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H * CVE-2021-28675 ( NVD ): 5.5 CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H * CVE-2021-28676 ( SUSE ): 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H * CVE-2021-28676 ( NVD ): 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H * CVE-2021-28677 ( SUSE ): 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H * CVE-2021-28677 ( NVD ): 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H * CVE-2021-28678 ( SUSE ): 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H * CVE-2021-28678 ( NVD ): 5.5 CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H Affected Products: * openSUSE Leap 15.3 * openSUSE Leap 15.5 An update that solves six vulnerabilities can now be installed. ## Description: This update for python-Pillow fixes the following issues: * CVE-2021-25287: out-of-bounds read in J2kDecode in j2ku_graya_la (bsc#1185805) * CVE-2021-25288: out-of-bounds read in J2kDecode in j2ku_gray_i (bsc#1185803) * CVE-2021-28675: DoS in PsdImagePlugin (bsc#1185804) * CVE-2021-28676: infinite loop in FliDecode.c can lead to DoS (bsc#1185786) * CVE-2021-28677: DoS in the open phase via a malicious EPS file (bsc#1185785) * CVE-2021-28678: improper check in BlpImagePlugin can lead to DoS (bsc#1185784) ## Patch Instructions: To install this SUSE update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: * openSUSE Leap 15.3 zypper in -t patch SUSE-2024-1607=1 * openSUSE Leap 15.5 zypper in -t patch openSUSE-SLE-15.5-2024-1607=1 ## Package List: * openSUSE Leap 15.3 (aarch64 ppc64le s390x x86_64 i586) * python-Pillow-debuginfo-7.2.0-150300.3.12.1 * python3-Pillow-tk-7.2.0-150300.3.12.1 * python-Pillow-debugsource-7.2.0-150300.3.12.1 * python3-Pillow-7.2.0-150300.3.12.1 * python3-Pillow-tk-debuginfo-7.2.0-150300.3.12.1 * python3-Pillow-debuginfo-7.2.0-150300.3.12.1 * openSUSE Leap 15.5 (aarch64 ppc64le s390x x86_64) * python-Pillow-debuginfo-7.2.0-150300.3.12.1 * python3-Pillow-tk-7.2.0-150300.3.12.1 * python-Pillow-debugsource-7.2.0-150300.3.12.1 * python3-Pillow-7.2.0-150300.3.12.1 * python3-Pillow-tk-debuginfo-7.2.0-150300.3.12.1 * python3-Pillow-debuginfo-7.2.0-150300.3.12.1 ## References: * https://www.suse.com/security/cve/CVE-2021-25287.html * https://www.suse.com/security/cve/CVE-2021-25288.html * https://www.suse.com/security/cve/CVE-2021-28675.html * https://www.suse.com/security/cve/CVE-2021-28676.html * https://www.suse.com/security/cve/CVE-2021-28677.html * https://www.suse.com/security/cve/CVE-2021-28678.html * https://bugzilla.suse.com/show_bug.cgi?id=1185784 * https://bugzilla.suse.com/show_bug.cgi?id=1185785 * https://bugzilla.suse.com/show_bug.cgi?id=1185786 * https://bugzilla.suse.com/show_bug.cgi?id=1185803 * https://bugzilla.suse.com/show_bug.cgi?id=1185804 * https://bugzilla.suse.com/show_bug.cgi?id=1185805

1 0

SUSE-SU-2024:1608-1: important: Security update for python-Werkzeug
by OPENSUSE-SECURITY-UPDATES 10 May '24

10 May '24

# Security update for python-Werkzeug Announcement ID: SUSE-SU-2024:1608-1 Rating: important References: * bsc#1223979 Cross-References: * CVE-2024-34069 CVSS scores: * CVE-2024-34069 ( SUSE ): 7.5 CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H Affected Products: * openSUSE Leap 15.5 * openSUSE Leap 15.6 * SUSE Linux Enterprise High Performance Computing 15 SP2 * SUSE Linux Enterprise High Performance Computing 15 SP2 LTSS 15-SP2 * SUSE Linux Enterprise Server 15 SP2 * SUSE Linux Enterprise Server 15 SP2 LTSS 15-SP2 * SUSE Linux Enterprise Server for SAP Applications 15 SP2 An update that solves one vulnerability can now be installed. ## Description: This update for python-Werkzeug fixes the following issues: * CVE-2024-34069: Fixed a remote code execution through debugger when interacting with attacker controlled domain (bsc#1223979). ## Patch Instructions: To install this SUSE update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: * openSUSE Leap 15.5 zypper in -t patch openSUSE-SLE-15.5-2024-1608=1 * openSUSE Leap 15.6 zypper in -t patch openSUSE-SLE-15.6-2024-1608=1 * SUSE Linux Enterprise High Performance Computing 15 SP2 LTSS 15-SP2 zypper in -t patch SUSE-SLE-Product-HPC-15-SP2-LTSS-2024-1608=1 * SUSE Linux Enterprise Server 15 SP2 LTSS 15-SP2 zypper in -t patch SUSE-SLE-Product-SLES-15-SP2-LTSS-2024-1608=1 * SUSE Linux Enterprise Server for SAP Applications 15 SP2 zypper in -t patch SUSE-SLE-Product-SLES_SAP-15-SP2-2024-1608=1 ## Package List: * openSUSE Leap 15.5 (noarch) * python-Werkzeug-doc-0.14.1-150100.6.9.1 * openSUSE Leap 15.6 (noarch) * python-Werkzeug-doc-0.14.1-150100.6.9.1 * SUSE Linux Enterprise High Performance Computing 15 SP2 LTSS 15-SP2 (noarch) * python3-Werkzeug-0.14.1-150100.6.9.1 * SUSE Linux Enterprise Server 15 SP2 LTSS 15-SP2 (noarch) * python3-Werkzeug-0.14.1-150100.6.9.1 * SUSE Linux Enterprise Server for SAP Applications 15 SP2 (noarch) * python3-Werkzeug-0.14.1-150100.6.9.1 ## References: * https://www.suse.com/security/cve/CVE-2024-34069.html * https://bugzilla.suse.com/show_bug.cgi?id=1223979

1 0

SUSE-SU-2024:1610-1: important: Security update for freerdp
by OPENSUSE-SECURITY-UPDATES 10 May '24

10 May '24

# Security update for freerdp Announcement ID: SUSE-SU-2024:1610-1 Rating: important References: * bsc#1223293 * bsc#1223294 * bsc#1223295 * bsc#1223296 * bsc#1223297 * bsc#1223298 Cross-References: * CVE-2024-32039 * CVE-2024-32040 * CVE-2024-32041 * CVE-2024-32458 * CVE-2024-32459 * CVE-2024-32460 CVSS scores: * CVE-2024-32039 ( SUSE ): 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H * CVE-2024-32040 ( SUSE ): 5.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L * CVE-2024-32041 ( SUSE ): 5.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N * CVE-2024-32458 ( SUSE ): 5.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N * CVE-2024-32459 ( SUSE ): 5.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N * CVE-2024-32460 ( SUSE ): 8.1 CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H Affected Products: * openSUSE Leap 15.4 * openSUSE Leap 15.5 * SUSE Linux Enterprise Desktop 15 SP4 LTSS 15-SP4 * SUSE Linux Enterprise Desktop 15 SP5 * SUSE Linux Enterprise High Performance Computing 15 SP5 * SUSE Linux Enterprise Micro 5.5 * SUSE Linux Enterprise Real Time 15 SP5 * SUSE Linux Enterprise Server 15 SP5 * SUSE Linux Enterprise Server for SAP Applications 15 SP5 * SUSE Linux Enterprise Workstation Extension 15 SP5 * SUSE Package Hub 15 15-SP5 An update that solves six vulnerabilities can now be installed. ## Description: This update for freerdp fixes the following issues: * CVE-2024-32039: Fixed an out-of-bounds write with variables of type uint32 (bsc#1223293) * CVE-2024-32040: Fixed a integer underflow when using the 'NSC' codec (bsc#1223294) * CVE-2024-32041: Fixed an out-of-bounds read in Stream_GetRemainingLength() (bsc#1223295) * CVE-2024-32458: Fixed an out-of-bounds read on pSrcData[] (bsc#1223296) * CVE-2024-32459: Fixed an out-of-bounds read in case SrcSize less than 4 (bsc#1223297) * CVE-2024-32460: Fixed an out-of-bounds read when using '/bpp:32' legacy 'GDI' drawing path (bsc#1223298) ## Patch Instructions: To install this SUSE update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: * openSUSE Leap 15.4 zypper in -t patch SUSE-2024-1610=1 * openSUSE Leap 15.5 zypper in -t patch openSUSE-SLE-15.5-2024-1610=1 * SUSE Package Hub 15 15-SP5 zypper in -t patch SUSE-SLE-Module-Packagehub-Subpackages-15-SP5-2024-1610=1 * SUSE Linux Enterprise Desktop 15 SP4 LTSS 15-SP4 zypper in -t patch SUSE-SLE-Product-SLED-15-SP4-LTSS-2024-1610=1 * SUSE Linux Enterprise Workstation Extension 15 SP5 zypper in -t patch SUSE-SLE-Product-WE-15-SP5-2024-1610=1 ## Package List: * openSUSE Leap 15.4 (aarch64 ppc64le s390x x86_64 i586) * freerdp-debugsource-2.4.0-150400.3.29.1 * libfreerdp2-2.4.0-150400.3.29.1 * freerdp-server-debuginfo-2.4.0-150400.3.29.1 * libwinpr2-debuginfo-2.4.0-150400.3.29.1 * libuwac0-0-2.4.0-150400.3.29.1 * freerdp-debuginfo-2.4.0-150400.3.29.1 * winpr2-devel-2.4.0-150400.3.29.1 * freerdp-2.4.0-150400.3.29.1 * freerdp-wayland-2.4.0-150400.3.29.1 * libuwac0-0-debuginfo-2.4.0-150400.3.29.1 * freerdp-proxy-2.4.0-150400.3.29.1 * freerdp-server-2.4.0-150400.3.29.1 * freerdp-wayland-debuginfo-2.4.0-150400.3.29.1 * libwinpr2-2.4.0-150400.3.29.1 * libfreerdp2-debuginfo-2.4.0-150400.3.29.1 * freerdp-devel-2.4.0-150400.3.29.1 * freerdp-proxy-debuginfo-2.4.0-150400.3.29.1 * uwac0-0-devel-2.4.0-150400.3.29.1 * openSUSE Leap 15.5 (aarch64 ppc64le s390x x86_64) * freerdp-debugsource-2.4.0-150400.3.29.1 * libfreerdp2-2.4.0-150400.3.29.1 * freerdp-server-debuginfo-2.4.0-150400.3.29.1 * libwinpr2-debuginfo-2.4.0-150400.3.29.1 * libuwac0-0-2.4.0-150400.3.29.1 * freerdp-debuginfo-2.4.0-150400.3.29.1 * winpr2-devel-2.4.0-150400.3.29.1 * freerdp-2.4.0-150400.3.29.1 * freerdp-wayland-2.4.0-150400.3.29.1 * libuwac0-0-debuginfo-2.4.0-150400.3.29.1 * freerdp-proxy-2.4.0-150400.3.29.1 * freerdp-server-2.4.0-150400.3.29.1 * freerdp-wayland-debuginfo-2.4.0-150400.3.29.1 * libwinpr2-2.4.0-150400.3.29.1 * libfreerdp2-debuginfo-2.4.0-150400.3.29.1 * freerdp-devel-2.4.0-150400.3.29.1 * freerdp-proxy-debuginfo-2.4.0-150400.3.29.1 * uwac0-0-devel-2.4.0-150400.3.29.1 * SUSE Package Hub 15 15-SP5 (aarch64 ppc64le s390x) * freerdp-debugsource-2.4.0-150400.3.29.1 * libfreerdp2-2.4.0-150400.3.29.1 * freerdp-server-debuginfo-2.4.0-150400.3.29.1 * libwinpr2-debuginfo-2.4.0-150400.3.29.1 * libuwac0-0-2.4.0-150400.3.29.1 * freerdp-debuginfo-2.4.0-150400.3.29.1 * winpr2-devel-2.4.0-150400.3.29.1 * freerdp-2.4.0-150400.3.29.1 * freerdp-wayland-2.4.0-150400.3.29.1 * libuwac0-0-debuginfo-2.4.0-150400.3.29.1 * freerdp-proxy-2.4.0-150400.3.29.1 * freerdp-server-2.4.0-150400.3.29.1 * freerdp-wayland-debuginfo-2.4.0-150400.3.29.1 * libwinpr2-2.4.0-150400.3.29.1 * libfreerdp2-debuginfo-2.4.0-150400.3.29.1 * freerdp-devel-2.4.0-150400.3.29.1 * freerdp-proxy-debuginfo-2.4.0-150400.3.29.1 * uwac0-0-devel-2.4.0-150400.3.29.1 * SUSE Linux Enterprise Desktop 15 SP4 LTSS 15-SP4 (x86_64) * freerdp-debugsource-2.4.0-150400.3.29.1 * libfreerdp2-2.4.0-150400.3.29.1 * libwinpr2-debuginfo-2.4.0-150400.3.29.1 * freerdp-debuginfo-2.4.0-150400.3.29.1 * winpr2-devel-2.4.0-150400.3.29.1 * freerdp-2.4.0-150400.3.29.1 * freerdp-proxy-2.4.0-150400.3.29.1 * libwinpr2-2.4.0-150400.3.29.1 * libfreerdp2-debuginfo-2.4.0-150400.3.29.1 * freerdp-devel-2.4.0-150400.3.29.1 * freerdp-proxy-debuginfo-2.4.0-150400.3.29.1 * SUSE Linux Enterprise Workstation Extension 15 SP5 (x86_64) * freerdp-debugsource-2.4.0-150400.3.29.1 * libfreerdp2-2.4.0-150400.3.29.1 * libwinpr2-debuginfo-2.4.0-150400.3.29.1 * freerdp-debuginfo-2.4.0-150400.3.29.1 * winpr2-devel-2.4.0-150400.3.29.1 * freerdp-2.4.0-150400.3.29.1 * freerdp-proxy-2.4.0-150400.3.29.1 * libwinpr2-2.4.0-150400.3.29.1 * libfreerdp2-debuginfo-2.4.0-150400.3.29.1 * freerdp-devel-2.4.0-150400.3.29.1 * freerdp-proxy-debuginfo-2.4.0-150400.3.29.1 ## References: * https://www.suse.com/security/cve/CVE-2024-32039.html * https://www.suse.com/security/cve/CVE-2024-32040.html * https://www.suse.com/security/cve/CVE-2024-32041.html * https://www.suse.com/security/cve/CVE-2024-32458.html * https://www.suse.com/security/cve/CVE-2024-32459.html * https://www.suse.com/security/cve/CVE-2024-32460.html * https://bugzilla.suse.com/show_bug.cgi?id=1223293 * https://bugzilla.suse.com/show_bug.cgi?id=1223294 * https://bugzilla.suse.com/show_bug.cgi?id=1223295 * https://bugzilla.suse.com/show_bug.cgi?id=1223296 * https://bugzilla.suse.com/show_bug.cgi?id=1223297 * https://bugzilla.suse.com/show_bug.cgi?id=1223298

1 0

SUSE-SU-2024:1605-1: moderate: Security update for tpm2-0-tss
by OPENSUSE-SECURITY-UPDATES 10 May '24

10 May '24

# Security update for tpm2-0-tss Announcement ID: SUSE-SU-2024:1605-1 Rating: moderate References: * bsc#1223690 Cross-References: * CVE-2024-29040 CVSS scores: * CVE-2024-29040 ( SUSE ): 5.5 CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N Affected Products: * openSUSE Leap 15.3 An update that solves one vulnerability can now be installed. ## Description: This update for tpm2-0-tss fixes the following issues: * CVE-2024-29040: Fixed quote data validation by Fapi_VerifyQuote (bsc#1223690). ## Patch Instructions: To install this SUSE update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: * openSUSE Leap 15.3 zypper in -t patch SUSE-2024-1605=1 ## Package List: * openSUSE Leap 15.3 (aarch64 ppc64le s390x x86_64 i586) * libtss2-sys0-2.4.5-150300.3.9.1 * libtss2-esys0-2.4.5-150300.3.9.1 * libtss2-tcti-device0-debuginfo-2.4.5-150300.3.9.1 * tpm2-0-tss-debugsource-2.4.5-150300.3.9.1 * libtss2-fapi0-debuginfo-2.4.5-150300.3.9.1 * libtss2-sys0-debuginfo-2.4.5-150300.3.9.1 * libtss2-tctildr0-debuginfo-2.4.5-150300.3.9.1 * tpm2-0-tss-devel-2.4.5-150300.3.9.1 * tpm2-0-tss-2.4.5-150300.3.9.1 * libtss2-rc0-2.4.5-150300.3.9.1 * libtss2-rc0-debuginfo-2.4.5-150300.3.9.1 * libtss2-esys0-debuginfo-2.4.5-150300.3.9.1 * libtss2-tcti-mssim0-2.4.5-150300.3.9.1 * libtss2-tcti-device0-2.4.5-150300.3.9.1 * libtss2-mu0-debuginfo-2.4.5-150300.3.9.1 * libtss2-tcti-mssim0-debuginfo-2.4.5-150300.3.9.1 * libtss2-fapi0-2.4.5-150300.3.9.1 * libtss2-tctildr0-2.4.5-150300.3.9.1 * libtss2-mu0-2.4.5-150300.3.9.1 * openSUSE Leap 15.3 (x86_64) * libtss2-tcti-device0-32bit-2.4.5-150300.3.9.1 * libtss2-esys0-32bit-2.4.5-150300.3.9.1 * libtss2-tcti-mssim0-32bit-2.4.5-150300.3.9.1 * libtss2-tcti-mssim0-32bit-debuginfo-2.4.5-150300.3.9.1 * libtss2-sys0-32bit-2.4.5-150300.3.9.1 * libtss2-sys0-32bit-debuginfo-2.4.5-150300.3.9.1 * libtss2-mu0-32bit-2.4.5-150300.3.9.1 * libtss2-esys0-32bit-debuginfo-2.4.5-150300.3.9.1 * libtss2-mu0-32bit-debuginfo-2.4.5-150300.3.9.1 * libtss2-tcti-device0-32bit-debuginfo-2.4.5-150300.3.9.1 * openSUSE Leap 15.3 (aarch64_ilp32) * libtss2-tcti-device0-64bit-debuginfo-2.4.5-150300.3.9.1 * libtss2-esys0-64bit-2.4.5-150300.3.9.1 * libtss2-mu0-64bit-debuginfo-2.4.5-150300.3.9.1 * libtss2-esys0-64bit-debuginfo-2.4.5-150300.3.9.1 * libtss2-mu0-64bit-2.4.5-150300.3.9.1 * libtss2-tcti-mssim0-64bit-debuginfo-2.4.5-150300.3.9.1 * libtss2-sys0-64bit-debuginfo-2.4.5-150300.3.9.1 * libtss2-tcti-mssim0-64bit-2.4.5-150300.3.9.1 * libtss2-tcti-device0-64bit-2.4.5-150300.3.9.1 * libtss2-sys0-64bit-2.4.5-150300.3.9.1 ## References: * https://www.suse.com/security/cve/CVE-2024-29040.html * https://bugzilla.suse.com/show_bug.cgi?id=1223690

1 0