August 2024 - openSUSE Security Announce

openSUSE-SU-2024:0161-1: moderate: Security update for plasma5-workspace
by opensuse-security＠opensuse.org 23 Aug '24

23 Aug '24

openSUSE Security Update: Security update for plasma5-workspace ______________________________________________________________________________ Announcement ID: openSUSE-SU-2024:0161-1 Rating: moderate References: #1225774 #1226110 Cross-References: CVE-2024-36041 CVSS scores: CVE-2024-36041 (NVD) : 7.8 CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H Affected Products: openSUSE Backports SLE-15-SP6 ______________________________________________________________________________ An update that solves one vulnerability and has one errata is now available. Description: plasma5-workspace was updated to fix the following issue: - Fixed ksmserver authentication (CVE-2024-36041, boo#1225774). - Fixed a regression introduced by the preceding change (kde#487912, boo#1226110): Patch Instructions: To install this openSUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Backports SLE-15-SP6: zypper in -t patch openSUSE-2024-161=1 Package List: - openSUSE Backports SLE-15-SP6 (aarch64 ppc64le x86_64): gmenudbusmenuproxy-5.27.11-bp156.3.3.1 plasma5-session-wayland-5.27.11-bp156.3.3.1 plasma5-workspace-5.27.11-bp156.3.3.1 plasma5-workspace-devel-5.27.11-bp156.3.3.1 plasma5-workspace-libs-5.27.11-bp156.3.3.1 xembedsniproxy-5.27.11-bp156.3.3.1 - openSUSE Backports SLE-15-SP6 (noarch): plasma5-session-5.27.11-bp156.3.3.1 plasma5-workspace-lang-5.27.11-bp156.3.3.1 References: https://www.suse.com/security/cve/CVE-2024-36041.html https://bugzilla.suse.com/1225774 https://bugzilla.suse.com/1226110

1 0

openSUSE-SU-2024:0203-1: critical: Security update for znc
by opensuse-security＠opensuse.org 23 Aug '24

23 Aug '24

openSUSE Security Update: Security update for znc ______________________________________________________________________________ Announcement ID: openSUSE-SU-2024:0203-1 Rating: critical References: #1227393 Cross-References: CVE-2024-39844 Affected Products: openSUSE Backports SLE-15-SP6 ______________________________________________________________________________ An update that fixes one vulnerability is now available. Description: This update for znc fixes the following issues: Update to 1.9.1 (boo#1227393, CVE-2024-39844) * This is a security release to fix CVE-2024-39844: remote code execution vulnerability in modtcl. To mitigate this for existing installations, simply unload the modtcl module for every user, if it's loaded. Note that only users with admin rights can load modtcl at all. * Improve tooltips in webadmin. Patch Instructions: To install this openSUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Backports SLE-15-SP6: zypper in -t patch openSUSE-2024-203=1 Package List: - openSUSE Backports SLE-15-SP6 (aarch64 i586 ppc64le s390x x86_64): znc-1.9.1-bp156.2.3.1 znc-devel-1.9.1-bp156.2.3.1 znc-perl-1.9.1-bp156.2.3.1 znc-python3-1.9.1-bp156.2.3.1 znc-tcl-1.9.1-bp156.2.3.1 - openSUSE Backports SLE-15-SP6 (noarch): znc-lang-1.9.1-bp156.2.3.1 References: https://www.suse.com/security/cve/CVE-2024-39844.html https://bugzilla.suse.com/1227393

1 0

openSUSE-SU-2024:0150-2: moderate: Security update for libhtp
by opensuse-security＠opensuse.org 23 Aug '24

23 Aug '24

openSUSE Security Update: Security update for libhtp ______________________________________________________________________________ Announcement ID: openSUSE-SU-2024:0150-2 Rating: moderate References: #1220403 Cross-References: CVE-2024-23837 Affected Products: openSUSE Backports SLE-15-SP6 ______________________________________________________________________________ An update that fixes one vulnerability is now available. Description: This update for libhtp fixes the following issues: - CVE-2024-23837: excessive processing time of HTTP headers can lead to denial of service (boo#1220403) Patch Instructions: To install this openSUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Backports SLE-15-SP6: zypper in -t patch openSUSE-2024-150=1 Package List: - openSUSE Backports SLE-15-SP6 (aarch64 i586 ppc64le s390x x86_64): libhtp-debugsource-0.5.42-bp156.3.3.1 libhtp-devel-0.5.42-bp156.3.3.1 libhtp2-0.5.42-bp156.3.3.1 libhtp2-debuginfo-0.5.42-bp156.3.3.1 References: https://www.suse.com/security/cve/CVE-2024-23837.html https://bugzilla.suse.com/1220403

1 0

openSUSE-SU-2024:0224-2: moderate: Security update for keybase-client
by opensuse-security＠opensuse.org 23 Aug '24

23 Aug '24

openSUSE Security Update: Security update for keybase-client ______________________________________________________________________________ Announcement ID: openSUSE-SU-2024:0224-2 Rating: moderate References: #1227167 Cross-References: CVE-2024-24792 Affected Products: openSUSE Backports SLE-15-SP6 ______________________________________________________________________________ An update that fixes one vulnerability is now available. Description: This update for keybase-client fixes the following issues: - Update the Image dependency to address CVE-2024-24792 (boo#1227167). Patch Instructions: To install this openSUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Backports SLE-15-SP6: zypper in -t patch openSUSE-2024-224=1 Package List: - openSUSE Backports SLE-15-SP6 (aarch64 i586 ppc64le s390x x86_64): kbfs-6.2.8-bp156.2.6.1 kbfs-debuginfo-6.2.8-bp156.2.6.1 kbfs-git-6.2.8-bp156.2.6.1 kbfs-git-debuginfo-6.2.8-bp156.2.6.1 kbfs-tool-6.2.8-bp156.2.6.1 kbfs-tool-debuginfo-6.2.8-bp156.2.6.1 keybase-client-6.2.8-bp156.2.6.1 keybase-client-debuginfo-6.2.8-bp156.2.6.1 References: https://www.suse.com/security/cve/CVE-2024-24792.html https://bugzilla.suse.com/1227167

1 0

openSUSE-SU-2024:0168-1: important: Security update for gdcm
by opensuse-security＠opensuse.org 23 Aug '24

23 Aug '24

openSUSE Security Update: Security update for gdcm ______________________________________________________________________________ Announcement ID: openSUSE-SU-2024:0168-1 Rating: important References: #1223398 Cross-References: CVE-2024-22373 CVSS scores: CVE-2024-22373 (SUSE): 8.1 CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H Affected Products: openSUSE Backports SLE-15-SP6 ______________________________________________________________________________ An update that fixes one vulnerability is now available. Description: This update for gdcm fixes the following issues: - CVE-2024-22373: Fixed out-of-bounds write vulnerability in JPEG2000Codec::DecodeByStreamsCommon (boo#1223398). Patch Instructions: To install this openSUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Backports SLE-15-SP6: zypper in -t patch openSUSE-2024-168=1 Package List: - openSUSE Backports SLE-15-SP6 (aarch64 ppc64le s390x x86_64): gdcm-3.0.24-bp156.2.4.1 gdcm-applications-3.0.24-bp156.2.4.1 gdcm-devel-3.0.24-bp156.2.4.1 gdcm-examples-3.0.24-bp156.2.4.1 libgdcm3_0-3.0.24-bp156.2.4.1 libsocketxx1_2-3.0.24-bp156.2.4.1 python3-gdcm-3.0.24-bp156.2.4.1 References: https://www.suse.com/security/cve/CVE-2024-22373.html https://bugzilla.suse.com/1223398

1 0

openSUSE-SU-2024:0212-2: important: Security update for chromium
by opensuse-security＠opensuse.org 23 Aug '24

23 Aug '24

openSUSE Security Update: Security update for chromium ______________________________________________________________________________ Announcement ID: openSUSE-SU-2024:0212-2 Rating: important References: #1227979 Cross-References: CVE-2024-6772 CVE-2024-6773 CVE-2024-6774 CVE-2024-6775 CVE-2024-6776 CVE-2024-6777 CVE-2024-6778 CVE-2024-6779 Affected Products: openSUSE Backports SLE-15-SP6 ______________________________________________________________________________ An update that fixes 8 vulnerabilities is now available. Description: This update for chromium fixes the following issues: Chromium 126.0.6478.182 (boo#1227979): - CVE-2024-6772: Inappropriate implementation in V8 - CVE-2024-6773: Type Confusion in V8 - CVE-2024-6774: Use after free in Screen Capture - CVE-2024-6775: Use after free in Media Stream - CVE-2024-6776: Use after free in Audio - CVE-2024-6777: Use after free in Navigation - CVE-2024-6778: Race in DevTools - CVE-2024-6779: Out of bounds memory access in V8 Patch Instructions: To install this openSUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Backports SLE-15-SP6: zypper in -t patch openSUSE-2024-212=1 Package List: - openSUSE Backports SLE-15-SP6 (aarch64 x86_64): chromedriver-126.0.6478.182-bp156.2.11.1 chromedriver-debuginfo-126.0.6478.182-bp156.2.11.1 chromium-126.0.6478.182-bp156.2.11.1 chromium-debuginfo-126.0.6478.182-bp156.2.11.1 References: https://www.suse.com/security/cve/CVE-2024-6772.html https://www.suse.com/security/cve/CVE-2024-6773.html https://www.suse.com/security/cve/CVE-2024-6774.html https://www.suse.com/security/cve/CVE-2024-6775.html https://www.suse.com/security/cve/CVE-2024-6776.html https://www.suse.com/security/cve/CVE-2024-6777.html https://www.suse.com/security/cve/CVE-2024-6778.html https://www.suse.com/security/cve/CVE-2024-6779.html https://bugzilla.suse.com/1227979

1 0

openSUSE-SU-2024:0258-1: important: Security update for chromium
by opensuse-security＠opensuse.org 23 Aug '24

23 Aug '24

openSUSE Security Update: Security update for chromium ______________________________________________________________________________ Announcement ID: openSUSE-SU-2024:0258-1 Rating: important References: #1229426 #1229591 Cross-References: CVE-2024-7964 CVE-2024-7965 CVE-2024-7966 CVE-2024-7967 CVE-2024-7968 CVE-2024-7969 CVE-2024-7971 CVE-2024-7972 CVE-2024-7973 CVE-2024-7974 CVE-2024-7975 CVE-2024-7976 CVE-2024-7977 CVE-2024-7978 CVE-2024-7979 CVE-2024-7980 CVE-2024-7981 CVE-2024-8033 CVE-2024-8034 CVE-2024-8035 CVSS scores: CVE-2024-7964 (NVD) : 8.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H CVE-2024-7966 (NVD) : 8.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H CVE-2024-7968 (NVD) : 8.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H CVE-2024-7969 (NVD) : 8.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H CVE-2024-7974 (NVD) : 8.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H CVE-2024-7975 (NVD) : 4.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N CVE-2024-7976 (NVD) : 4.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N CVE-2024-7977 (NVD) : 7.8 CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H CVE-2024-7978 (NVD) : 4.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:N CVE-2024-7981 (NVD) : 4.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N CVE-2024-8033 (NVD) : 4.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N CVE-2024-8034 (NVD) : 4.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N CVE-2024-8035 (NVD) : 4.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N Affected Products: openSUSE Backports SLE-15-SP5 ______________________________________________________________________________ An update that fixes 20 vulnerabilities is now available. Description: This update for chromium fixes the following issues: - Chromium 128.0.6613.84 (boo#1229591) * CVE-2024-7964: Use after free in Passwords * CVE-2024-7965: Inappropriate implementation in V8 * CVE-2024-7966: Out of bounds memory access in Skia * CVE-2024-7967: Heap buffer overflow in Fonts * CVE-2024-7968: Use after free in Autofill * CVE-2024-7969: Type Confusion in V8 * CVE-2024-7971: Type confusion in V8 * CVE-2024-7972: Inappropriate implementation in V8 * CVE-2024-7973: Heap buffer overflow in PDFium * CVE-2024-7974: Insufficient data validation in V8 API * CVE-2024-7975: Inappropriate implementation in Permissions * CVE-2024-7976: Inappropriate implementation in FedCM * CVE-2024-7977: Insufficient data validation in Installer * CVE-2024-7978: Insufficient policy enforcement in Data Transfer * CVE-2024-7979: Insufficient data validation in Installer * CVE-2024-7980: Insufficient data validation in Installer * CVE-2024-7981: Inappropriate implementation in Views * CVE-2024-8033: Inappropriate implementation in WebApp Installs * CVE-2024-8034: Inappropriate implementation in Custom Tabs * CVE-2024-8035: Inappropriate implementation in Extensions * Various fixes from internal audits, fuzzing and other initiatives Patch Instructions: To install this openSUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Backports SLE-15-SP5: zypper in -t patch openSUSE-2024-258=1 Package List: - openSUSE Backports SLE-15-SP5 (aarch64 x86_64): chromedriver-128.0.6613.84-bp155.2.105.1 chromium-128.0.6613.84-bp155.2.105.1 References: https://www.suse.com/security/cve/CVE-2024-7964.html https://www.suse.com/security/cve/CVE-2024-7965.html https://www.suse.com/security/cve/CVE-2024-7966.html https://www.suse.com/security/cve/CVE-2024-7967.html https://www.suse.com/security/cve/CVE-2024-7968.html https://www.suse.com/security/cve/CVE-2024-7969.html https://www.suse.com/security/cve/CVE-2024-7971.html https://www.suse.com/security/cve/CVE-2024-7972.html https://www.suse.com/security/cve/CVE-2024-7973.html https://www.suse.com/security/cve/CVE-2024-7974.html https://www.suse.com/security/cve/CVE-2024-7975.html https://www.suse.com/security/cve/CVE-2024-7976.html https://www.suse.com/security/cve/CVE-2024-7977.html https://www.suse.com/security/cve/CVE-2024-7978.html https://www.suse.com/security/cve/CVE-2024-7979.html https://www.suse.com/security/cve/CVE-2024-7980.html https://www.suse.com/security/cve/CVE-2024-7981.html https://www.suse.com/security/cve/CVE-2024-8033.html https://www.suse.com/security/cve/CVE-2024-8034.html https://www.suse.com/security/cve/CVE-2024-8035.html https://bugzilla.suse.com/1229426 https://bugzilla.suse.com/1229591

1 0

SUSE-SU-2024:3001-1: important: Security update for xen
by OPENSUSE-SECURITY-UPDATES 23 Aug '24

23 Aug '24

# Security update for xen Announcement ID: SUSE-SU-2024:3001-1 Rating: important References: * bsc#1228574 * bsc#1228575 Cross-References: * CVE-2024-31145 * CVE-2024-31146 CVSS scores: * CVE-2024-31145 ( SUSE ): 7.5 CVSS:3.1/AV:L/AC:H/PR:H/UI:N/S:C/C:H/I:H/A:H * CVE-2024-31146 ( SUSE ): 0.0 CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:N Affected Products: * openSUSE Leap 15.3 * SUSE Enterprise Storage 7.1 * SUSE Linux Enterprise High Performance Computing 15 SP3 * SUSE Linux Enterprise High Performance Computing LTSS 15 SP3 * SUSE Linux Enterprise Micro 5.1 * SUSE Linux Enterprise Micro 5.2 * SUSE Linux Enterprise Micro for Rancher 5.2 * SUSE Linux Enterprise Server 15 SP3 * SUSE Linux Enterprise Server 15 SP3 LTSS 15-SP3 * SUSE Linux Enterprise Server for SAP Applications 15 SP3 An update that solves two vulnerabilities can now be installed. ## Description: This update for xen fixes the following issues: * CVE-2024-31145: Fixed error handling in x86 IOMMU identity mapping (XSA-460, bsc#1228574) * CVE-2024-31146: Fixed PCI device pass-through with shared resources (XSA-461, bsc#1228575) ## Special Instructions and Notes: * Please reboot the system after installing this update. ## Patch Instructions: To install this SUSE update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: * openSUSE Leap 15.3 zypper in -t patch SUSE-2024-3001=1 * SUSE Linux Enterprise High Performance Computing LTSS 15 SP3 zypper in -t patch SUSE-SLE-Product-HPC-15-SP3-LTSS-2024-3001=1 * SUSE Linux Enterprise Server 15 SP3 LTSS 15-SP3 zypper in -t patch SUSE-SLE-Product-SLES-15-SP3-LTSS-2024-3001=1 * SUSE Linux Enterprise Server for SAP Applications 15 SP3 zypper in -t patch SUSE-SLE-Product-SLES_SAP-15-SP3-2024-3001=1 * SUSE Enterprise Storage 7.1 zypper in -t patch SUSE-Storage-7.1-2024-3001=1 * SUSE Linux Enterprise Micro 5.1 zypper in -t patch SUSE-SUSE-MicroOS-5.1-2024-3001=1 * SUSE Linux Enterprise Micro 5.2 zypper in -t patch SUSE-SUSE-MicroOS-5.2-2024-3001=1 * SUSE Linux Enterprise Micro for Rancher 5.2 zypper in -t patch SUSE-SUSE-MicroOS-5.2-2024-3001=1 ## Package List: * openSUSE Leap 15.3 (aarch64 x86_64 i586) * xen-libs-4.14.6_18-150300.3.78.1 * xen-libs-debuginfo-4.14.6_18-150300.3.78.1 * xen-tools-domU-4.14.6_18-150300.3.78.1 * xen-devel-4.14.6_18-150300.3.78.1 * xen-tools-domU-debuginfo-4.14.6_18-150300.3.78.1 * xen-debugsource-4.14.6_18-150300.3.78.1 * openSUSE Leap 15.3 (x86_64) * xen-libs-32bit-debuginfo-4.14.6_18-150300.3.78.1 * xen-libs-32bit-4.14.6_18-150300.3.78.1 * openSUSE Leap 15.3 (aarch64 x86_64) * xen-4.14.6_18-150300.3.78.1 * xen-tools-debuginfo-4.14.6_18-150300.3.78.1 * xen-tools-4.14.6_18-150300.3.78.1 * xen-doc-html-4.14.6_18-150300.3.78.1 * openSUSE Leap 15.3 (noarch) * xen-tools-xendomains-wait-disk-4.14.6_18-150300.3.78.1 * openSUSE Leap 15.3 (aarch64_ilp32) * xen-libs-64bit-4.14.6_18-150300.3.78.1 * xen-libs-64bit-debuginfo-4.14.6_18-150300.3.78.1 * SUSE Linux Enterprise High Performance Computing LTSS 15 SP3 (x86_64) * xen-libs-4.14.6_18-150300.3.78.1 * xen-libs-debuginfo-4.14.6_18-150300.3.78.1 * xen-tools-domU-4.14.6_18-150300.3.78.1 * xen-devel-4.14.6_18-150300.3.78.1 * xen-tools-domU-debuginfo-4.14.6_18-150300.3.78.1 * xen-tools-4.14.6_18-150300.3.78.1 * xen-4.14.6_18-150300.3.78.1 * xen-tools-debuginfo-4.14.6_18-150300.3.78.1 * xen-debugsource-4.14.6_18-150300.3.78.1 * SUSE Linux Enterprise High Performance Computing LTSS 15 SP3 (noarch) * xen-tools-xendomains-wait-disk-4.14.6_18-150300.3.78.1 * SUSE Linux Enterprise Server 15 SP3 LTSS 15-SP3 (x86_64) * xen-libs-4.14.6_18-150300.3.78.1 * xen-libs-debuginfo-4.14.6_18-150300.3.78.1 * xen-tools-domU-4.14.6_18-150300.3.78.1 * xen-devel-4.14.6_18-150300.3.78.1 * xen-tools-domU-debuginfo-4.14.6_18-150300.3.78.1 * xen-tools-4.14.6_18-150300.3.78.1 * xen-4.14.6_18-150300.3.78.1 * xen-tools-debuginfo-4.14.6_18-150300.3.78.1 * xen-debugsource-4.14.6_18-150300.3.78.1 * SUSE Linux Enterprise Server 15 SP3 LTSS 15-SP3 (noarch) * xen-tools-xendomains-wait-disk-4.14.6_18-150300.3.78.1 * SUSE Linux Enterprise Server for SAP Applications 15 SP3 (x86_64) * xen-libs-4.14.6_18-150300.3.78.1 * xen-libs-debuginfo-4.14.6_18-150300.3.78.1 * xen-tools-domU-4.14.6_18-150300.3.78.1 * xen-devel-4.14.6_18-150300.3.78.1 * xen-tools-domU-debuginfo-4.14.6_18-150300.3.78.1 * xen-tools-4.14.6_18-150300.3.78.1 * xen-4.14.6_18-150300.3.78.1 * xen-tools-debuginfo-4.14.6_18-150300.3.78.1 * xen-debugsource-4.14.6_18-150300.3.78.1 * SUSE Linux Enterprise Server for SAP Applications 15 SP3 (noarch) * xen-tools-xendomains-wait-disk-4.14.6_18-150300.3.78.1 * SUSE Enterprise Storage 7.1 (x86_64) * xen-libs-4.14.6_18-150300.3.78.1 * xen-libs-debuginfo-4.14.6_18-150300.3.78.1 * xen-tools-domU-4.14.6_18-150300.3.78.1 * xen-devel-4.14.6_18-150300.3.78.1 * xen-tools-domU-debuginfo-4.14.6_18-150300.3.78.1 * xen-tools-4.14.6_18-150300.3.78.1 * xen-4.14.6_18-150300.3.78.1 * xen-tools-debuginfo-4.14.6_18-150300.3.78.1 * xen-debugsource-4.14.6_18-150300.3.78.1 * SUSE Enterprise Storage 7.1 (noarch) * xen-tools-xendomains-wait-disk-4.14.6_18-150300.3.78.1 * SUSE Linux Enterprise Micro 5.1 (x86_64) * xen-libs-4.14.6_18-150300.3.78.1 * xen-libs-debuginfo-4.14.6_18-150300.3.78.1 * xen-debugsource-4.14.6_18-150300.3.78.1 * SUSE Linux Enterprise Micro 5.2 (x86_64) * xen-libs-4.14.6_18-150300.3.78.1 * xen-libs-debuginfo-4.14.6_18-150300.3.78.1 * xen-debugsource-4.14.6_18-150300.3.78.1 * SUSE Linux Enterprise Micro for Rancher 5.2 (x86_64) * xen-libs-4.14.6_18-150300.3.78.1 * xen-libs-debuginfo-4.14.6_18-150300.3.78.1 * xen-debugsource-4.14.6_18-150300.3.78.1 ## References: * https://www.suse.com/security/cve/CVE-2024-31145.html * https://www.suse.com/security/cve/CVE-2024-31146.html * https://bugzilla.suse.com/show_bug.cgi?id=1228574 * https://bugzilla.suse.com/show_bug.cgi?id=1228575

1 0

SUSE-SU-2024:3003-1: important: Security update for MozillaFirefox
by OPENSUSE-SECURITY-UPDATES 23 Aug '24

23 Aug '24

# Security update for MozillaFirefox Announcement ID: SUSE-SU-2024:3003-1 Rating: important References: * bsc#1226316 * bsc#1228648 Cross-References: * CVE-2024-6600 * CVE-2024-6601 * CVE-2024-6602 * CVE-2024-6603 * CVE-2024-6604 * CVE-2024-6605 * CVE-2024-6606 * CVE-2024-6607 * CVE-2024-6608 * CVE-2024-6609 * CVE-2024-6610 * CVE-2024-6611 * CVE-2024-6612 * CVE-2024-6613 * CVE-2024-6614 * CVE-2024-6615 * CVE-2024-7518 * CVE-2024-7519 * CVE-2024-7520 * CVE-2024-7521 * CVE-2024-7522 * CVE-2024-7524 * CVE-2024-7525 * CVE-2024-7526 * CVE-2024-7527 * CVE-2024-7528 * CVE-2024-7529 * CVE-2024-7531 CVSS scores: * CVE-2024-6600 ( SUSE ): 6.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:L * CVE-2024-6601 ( SUSE ): 4.7 CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:L/I:L/A:N * CVE-2024-6602 ( SUSE ): 6.1 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:N/I:L/A:L * CVE-2024-6603 ( SUSE ): 5.4 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:L * CVE-2024-6604 ( SUSE ): 8.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H * CVE-2024-6605 ( SUSE ): 8.1 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:N * CVE-2024-6606 ( SUSE ): 8.2 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:N/A:L * CVE-2024-6607 ( SUSE ): 5.4 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:N * CVE-2024-6608 ( SUSE ): 4.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:L * CVE-2024-6609 ( SUSE ): 4.7 CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:N/I:L/A:L * CVE-2024-6610 ( SUSE ): 4.7 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:N/I:N/A:L * CVE-2024-6611 ( SUSE ): 4.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:N * CVE-2024-6612 ( SUSE ): 3.1 CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:L/I:N/A:N * CVE-2024-6614 ( SUSE ): 4.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N * CVE-2024-6615 ( SUSE ): 8.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H * CVE-2024-7518 ( SUSE ): 7.4 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:N/A:N * CVE-2024-7518 ( NVD ): 6.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N * CVE-2024-7519 ( SUSE ): 7.5 CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H * CVE-2024-7519 ( NVD ): 9.6 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H * CVE-2024-7520 ( SUSE ): 8.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H * CVE-2024-7520 ( NVD ): 8.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H * CVE-2024-7521 ( SUSE ): 8.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H * CVE-2024-7521 ( NVD ): 8.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H * CVE-2024-7522 ( SUSE ): 7.1 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:L * CVE-2024-7522 ( NVD ): 8.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H * CVE-2024-7524 ( SUSE ): 8.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H * CVE-2024-7525 ( SUSE ): 7.1 CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:U/C:H/I:H/A:H * CVE-2024-7525 ( NVD ): 8.1 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:N * CVE-2024-7526 ( SUSE ): 7.1 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:L * CVE-2024-7526 ( NVD ): 6.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N * CVE-2024-7527 ( SUSE ): 8.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H * CVE-2024-7527 ( NVD ): 8.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H * CVE-2024-7528 ( SUSE ): 8.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H * CVE-2024-7528 ( NVD ): 8.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H * CVE-2024-7529 ( SUSE ): 8.1 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:N * CVE-2024-7529 ( NVD ): 6.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N * CVE-2024-7531 ( SUSE ): 4.2 CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:L/I:N/A:L * CVE-2024-7531 ( NVD ): 6.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N Affected Products: * Desktop Applications Module 15-SP5 * Desktop Applications Module 15-SP6 * openSUSE Leap 15.5 * openSUSE Leap 15.6 * SUSE Enterprise Storage 7.1 * SUSE Linux Enterprise Desktop 15 SP4 LTSS 15-SP4 * SUSE Linux Enterprise Desktop 15 SP5 * SUSE Linux Enterprise Desktop 15 SP6 * SUSE Linux Enterprise High Performance Computing 15 SP2 * SUSE Linux Enterprise High Performance Computing 15 SP2 LTSS 15-SP2 * SUSE Linux Enterprise High Performance Computing 15 SP3 * SUSE Linux Enterprise High Performance Computing 15 SP4 * SUSE Linux Enterprise High Performance Computing 15 SP5 * SUSE Linux Enterprise High Performance Computing ESPOS 15 SP4 * SUSE Linux Enterprise High Performance Computing LTSS 15 SP3 * SUSE Linux Enterprise High Performance Computing LTSS 15 SP4 * SUSE Linux Enterprise Real Time 15 SP5 * SUSE Linux Enterprise Real Time 15 SP6 * SUSE Linux Enterprise Server 15 SP2 * SUSE Linux Enterprise Server 15 SP2 LTSS 15-SP2 * SUSE Linux Enterprise Server 15 SP3 * SUSE Linux Enterprise Server 15 SP3 LTSS 15-SP3 * SUSE Linux Enterprise Server 15 SP4 * SUSE Linux Enterprise Server 15 SP4 LTSS 15-SP4 * SUSE Linux Enterprise Server 15 SP5 * SUSE Linux Enterprise Server 15 SP6 * SUSE Linux Enterprise Server for SAP Applications 15 SP2 * SUSE Linux Enterprise Server for SAP Applications 15 SP3 * SUSE Linux Enterprise Server for SAP Applications 15 SP4 * SUSE Linux Enterprise Server for SAP Applications 15 SP5 * SUSE Linux Enterprise Server for SAP Applications 15 SP6 An update that solves 28 vulnerabilities can now be installed. ## Description: This update for MozillaFirefox fixes the following issues: Update to Firefox Extended Support Release 128.1.0 ESR (MFSA 2024-35, bsc#1228648) \- CVE-2024-7518: Fullscreen notification dialog can be obscured by document \- CVE-2024-7519: Out of bounds memory access in graphics shared memory handling \- CVE-2024-7520: Type confusion in WebAssembly \- CVE-2024-7521: Incomplete WebAssembly exception handing \- CVE-2024-7522: Out of bounds read in editor component \- CVE-2024-7524: CSP strict-dynamic bypass using web- compatibility shims \- CVE-2024-7525: Missing permission check when creating a StreamFilter \- CVE-2024-7526: Uninitialized memory used by WebGL \- CVE-2024-7527: Use-after-free in JavaScript garbage collection \- CVE-2024-7528: Use-after-free in IndexedDB \- CVE-2024-7529: Document content could partially obscure security prompts \- CVE-2024-7531: PK11_Encrypt using CKM_CHACHA20 can reveal plaintext on Intel ## Patch Instructions: To install this SUSE update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: * openSUSE Leap 15.6 zypper in -t patch openSUSE-SLE-15.6-2024-3003=1 * Desktop Applications Module 15-SP5 zypper in -t patch SUSE-SLE-Module-Desktop-Applications-15-SP5-2024-3003=1 * Desktop Applications Module 15-SP6 zypper in -t patch SUSE-SLE-Module-Desktop-Applications-15-SP6-2024-3003=1 * SUSE Linux Enterprise High Performance Computing 15 SP2 LTSS 15-SP2 zypper in -t patch SUSE-SLE-Product-HPC-15-SP2-LTSS-2024-3003=1 * SUSE Linux Enterprise High Performance Computing LTSS 15 SP3 zypper in -t patch SUSE-SLE-Product-HPC-15-SP3-LTSS-2024-3003=1 * SUSE Linux Enterprise High Performance Computing ESPOS 15 SP4 zypper in -t patch SUSE-SLE-Product-HPC-15-SP4-ESPOS-2024-3003=1 * SUSE Linux Enterprise High Performance Computing LTSS 15 SP4 zypper in -t patch SUSE-SLE-Product-HPC-15-SP4-LTSS-2024-3003=1 * SUSE Linux Enterprise Desktop 15 SP4 LTSS 15-SP4 zypper in -t patch SUSE-SLE-Product-SLED-15-SP4-LTSS-2024-3003=1 * SUSE Linux Enterprise Server 15 SP2 LTSS 15-SP2 zypper in -t patch SUSE-SLE-Product-SLES-15-SP2-LTSS-2024-3003=1 * SUSE Linux Enterprise Server 15 SP3 LTSS 15-SP3 zypper in -t patch SUSE-SLE-Product-SLES-15-SP3-LTSS-2024-3003=1 * SUSE Linux Enterprise Server 15 SP4 LTSS 15-SP4 zypper in -t patch SUSE-SLE-Product-SLES-15-SP4-LTSS-2024-3003=1 * SUSE Linux Enterprise Server for SAP Applications 15 SP2 zypper in -t patch SUSE-SLE-Product-SLES_SAP-15-SP2-2024-3003=1 * SUSE Linux Enterprise Server for SAP Applications 15 SP3 zypper in -t patch SUSE-SLE-Product-SLES_SAP-15-SP3-2024-3003=1 * SUSE Linux Enterprise Server for SAP Applications 15 SP4 zypper in -t patch SUSE-SLE-Product-SLES_SAP-15-SP4-2024-3003=1 * SUSE Enterprise Storage 7.1 zypper in -t patch SUSE-Storage-7.1-2024-3003=1 * openSUSE Leap 15.5 zypper in -t patch openSUSE-SLE-15.5-2024-3003=1 ## Package List: * openSUSE Leap 15.6 (aarch64 ppc64le s390x x86_64) * MozillaFirefox-translations-common-128.1.0-150200.152.146.1 * MozillaFirefox-translations-other-128.1.0-150200.152.146.1 * MozillaFirefox-branding-SLE-128-150200.9.16.1 * MozillaFirefox-branding-upstream-128.1.0-150200.152.146.1 * MozillaFirefox-debugsource-128.1.0-150200.152.146.1 * MozillaFirefox-debuginfo-128.1.0-150200.152.146.1 * MozillaFirefox-128.1.0-150200.152.146.1 * openSUSE Leap 15.6 (noarch) * MozillaFirefox-devel-128.1.0-150200.152.146.1 * Desktop Applications Module 15-SP5 (aarch64 ppc64le s390x x86_64) * MozillaFirefox-translations-common-128.1.0-150200.152.146.1 * MozillaFirefox-translations-other-128.1.0-150200.152.146.1 * MozillaFirefox-branding-SLE-128-150200.9.16.1 * MozillaFirefox-debugsource-128.1.0-150200.152.146.1 * MozillaFirefox-debuginfo-128.1.0-150200.152.146.1 * MozillaFirefox-128.1.0-150200.152.146.1 * Desktop Applications Module 15-SP5 (noarch) * MozillaFirefox-devel-128.1.0-150200.152.146.1 * Desktop Applications Module 15-SP6 (aarch64 ppc64le s390x x86_64) * MozillaFirefox-translations-common-128.1.0-150200.152.146.1 * MozillaFirefox-translations-other-128.1.0-150200.152.146.1 * MozillaFirefox-branding-SLE-128-150200.9.16.1 * MozillaFirefox-debugsource-128.1.0-150200.152.146.1 * MozillaFirefox-debuginfo-128.1.0-150200.152.146.1 * MozillaFirefox-128.1.0-150200.152.146.1 * Desktop Applications Module 15-SP6 (noarch) * MozillaFirefox-devel-128.1.0-150200.152.146.1 * SUSE Linux Enterprise High Performance Computing 15 SP2 LTSS 15-SP2 (aarch64 x86_64) * MozillaFirefox-translations-common-128.1.0-150200.152.146.1 * MozillaFirefox-translations-other-128.1.0-150200.152.146.1 * MozillaFirefox-branding-SLE-128-150200.9.16.1 * MozillaFirefox-debugsource-128.1.0-150200.152.146.1 * MozillaFirefox-debuginfo-128.1.0-150200.152.146.1 * MozillaFirefox-128.1.0-150200.152.146.1 * SUSE Linux Enterprise High Performance Computing 15 SP2 LTSS 15-SP2 (noarch) * MozillaFirefox-devel-128.1.0-150200.152.146.1 * SUSE Linux Enterprise High Performance Computing LTSS 15 SP3 (aarch64 x86_64) * MozillaFirefox-translations-common-128.1.0-150200.152.146.1 * MozillaFirefox-translations-other-128.1.0-150200.152.146.1 * MozillaFirefox-branding-SLE-128-150200.9.16.1 * MozillaFirefox-debugsource-128.1.0-150200.152.146.1 * MozillaFirefox-debuginfo-128.1.0-150200.152.146.1 * MozillaFirefox-128.1.0-150200.152.146.1 * SUSE Linux Enterprise High Performance Computing LTSS 15 SP3 (noarch) * MozillaFirefox-devel-128.1.0-150200.152.146.1 * SUSE Linux Enterprise High Performance Computing ESPOS 15 SP4 (aarch64 x86_64) * MozillaFirefox-translations-common-128.1.0-150200.152.146.1 * MozillaFirefox-translations-other-128.1.0-150200.152.146.1 * MozillaFirefox-branding-SLE-128-150200.9.16.1 * MozillaFirefox-debugsource-128.1.0-150200.152.146.1 * MozillaFirefox-debuginfo-128.1.0-150200.152.146.1 * MozillaFirefox-128.1.0-150200.152.146.1 * SUSE Linux Enterprise High Performance Computing ESPOS 15 SP4 (noarch) * MozillaFirefox-devel-128.1.0-150200.152.146.1 * SUSE Linux Enterprise High Performance Computing LTSS 15 SP4 (aarch64 x86_64) * MozillaFirefox-translations-common-128.1.0-150200.152.146.1 * MozillaFirefox-translations-other-128.1.0-150200.152.146.1 * MozillaFirefox-branding-SLE-128-150200.9.16.1 * MozillaFirefox-debugsource-128.1.0-150200.152.146.1 * MozillaFirefox-debuginfo-128.1.0-150200.152.146.1 * MozillaFirefox-128.1.0-150200.152.146.1 * SUSE Linux Enterprise High Performance Computing LTSS 15 SP4 (noarch) * MozillaFirefox-devel-128.1.0-150200.152.146.1 * SUSE Linux Enterprise Desktop 15 SP4 LTSS 15-SP4 (x86_64) * MozillaFirefox-translations-common-128.1.0-150200.152.146.1 * MozillaFirefox-translations-other-128.1.0-150200.152.146.1 * MozillaFirefox-branding-SLE-128-150200.9.16.1 * MozillaFirefox-debugsource-128.1.0-150200.152.146.1 * MozillaFirefox-debuginfo-128.1.0-150200.152.146.1 * MozillaFirefox-128.1.0-150200.152.146.1 * SUSE Linux Enterprise Desktop 15 SP4 LTSS 15-SP4 (noarch) * MozillaFirefox-devel-128.1.0-150200.152.146.1 * SUSE Linux Enterprise Server 15 SP2 LTSS 15-SP2 (aarch64 ppc64le s390x x86_64) * MozillaFirefox-translations-common-128.1.0-150200.152.146.1 * MozillaFirefox-translations-other-128.1.0-150200.152.146.1 * MozillaFirefox-branding-SLE-128-150200.9.16.1 * MozillaFirefox-debugsource-128.1.0-150200.152.146.1 * MozillaFirefox-debuginfo-128.1.0-150200.152.146.1 * MozillaFirefox-128.1.0-150200.152.146.1 * SUSE Linux Enterprise Server 15 SP2 LTSS 15-SP2 (noarch) * MozillaFirefox-devel-128.1.0-150200.152.146.1 * SUSE Linux Enterprise Server 15 SP3 LTSS 15-SP3 (aarch64 ppc64le s390x x86_64) * MozillaFirefox-translations-common-128.1.0-150200.152.146.1 * MozillaFirefox-translations-other-128.1.0-150200.152.146.1 * MozillaFirefox-branding-SLE-128-150200.9.16.1 * MozillaFirefox-debugsource-128.1.0-150200.152.146.1 * MozillaFirefox-debuginfo-128.1.0-150200.152.146.1 * MozillaFirefox-128.1.0-150200.152.146.1 * SUSE Linux Enterprise Server 15 SP3 LTSS 15-SP3 (noarch) * MozillaFirefox-devel-128.1.0-150200.152.146.1 * SUSE Linux Enterprise Server 15 SP4 LTSS 15-SP4 (aarch64 ppc64le s390x x86_64) * MozillaFirefox-translations-common-128.1.0-150200.152.146.1 * MozillaFirefox-translations-other-128.1.0-150200.152.146.1 * MozillaFirefox-branding-SLE-128-150200.9.16.1 * MozillaFirefox-debugsource-128.1.0-150200.152.146.1 * MozillaFirefox-debuginfo-128.1.0-150200.152.146.1 * MozillaFirefox-128.1.0-150200.152.146.1 * SUSE Linux Enterprise Server 15 SP4 LTSS 15-SP4 (noarch) * MozillaFirefox-devel-128.1.0-150200.152.146.1 * SUSE Linux Enterprise Server for SAP Applications 15 SP2 (ppc64le x86_64) * MozillaFirefox-translations-common-128.1.0-150200.152.146.1 * MozillaFirefox-translations-other-128.1.0-150200.152.146.1 * MozillaFirefox-branding-SLE-128-150200.9.16.1 * MozillaFirefox-debugsource-128.1.0-150200.152.146.1 * MozillaFirefox-debuginfo-128.1.0-150200.152.146.1 * MozillaFirefox-128.1.0-150200.152.146.1 * SUSE Linux Enterprise Server for SAP Applications 15 SP2 (noarch) * MozillaFirefox-devel-128.1.0-150200.152.146.1 * SUSE Linux Enterprise Server for SAP Applications 15 SP3 (ppc64le x86_64) * MozillaFirefox-translations-common-128.1.0-150200.152.146.1 * MozillaFirefox-translations-other-128.1.0-150200.152.146.1 * MozillaFirefox-branding-SLE-128-150200.9.16.1 * MozillaFirefox-debugsource-128.1.0-150200.152.146.1 * MozillaFirefox-debuginfo-128.1.0-150200.152.146.1 * MozillaFirefox-128.1.0-150200.152.146.1 * SUSE Linux Enterprise Server for SAP Applications 15 SP3 (noarch) * MozillaFirefox-devel-128.1.0-150200.152.146.1 * SUSE Linux Enterprise Server for SAP Applications 15 SP4 (ppc64le x86_64) * MozillaFirefox-translations-common-128.1.0-150200.152.146.1 * MozillaFirefox-translations-other-128.1.0-150200.152.146.1 * MozillaFirefox-branding-SLE-128-150200.9.16.1 * MozillaFirefox-debugsource-128.1.0-150200.152.146.1 * MozillaFirefox-debuginfo-128.1.0-150200.152.146.1 * MozillaFirefox-128.1.0-150200.152.146.1 * SUSE Linux Enterprise Server for SAP Applications 15 SP4 (noarch) * MozillaFirefox-devel-128.1.0-150200.152.146.1 * SUSE Enterprise Storage 7.1 (aarch64 x86_64) * MozillaFirefox-translations-common-128.1.0-150200.152.146.1 * MozillaFirefox-translations-other-128.1.0-150200.152.146.1 * MozillaFirefox-branding-SLE-128-150200.9.16.1 * MozillaFirefox-debugsource-128.1.0-150200.152.146.1 * MozillaFirefox-debuginfo-128.1.0-150200.152.146.1 * MozillaFirefox-128.1.0-150200.152.146.1 * SUSE Enterprise Storage 7.1 (noarch) * MozillaFirefox-devel-128.1.0-150200.152.146.1 * openSUSE Leap 15.5 (aarch64 ppc64le s390x x86_64) * MozillaFirefox-translations-common-128.1.0-150200.152.146.1 * MozillaFirefox-translations-other-128.1.0-150200.152.146.1 * MozillaFirefox-branding-SLE-128-150200.9.16.1 * MozillaFirefox-branding-upstream-128.1.0-150200.152.146.1 * MozillaFirefox-debugsource-128.1.0-150200.152.146.1 * MozillaFirefox-debuginfo-128.1.0-150200.152.146.1 * MozillaFirefox-128.1.0-150200.152.146.1 * openSUSE Leap 15.5 (noarch) * MozillaFirefox-devel-128.1.0-150200.152.146.1 ## References: * https://www.suse.com/security/cve/CVE-2024-6600.html * https://www.suse.com/security/cve/CVE-2024-6601.html * https://www.suse.com/security/cve/CVE-2024-6602.html * https://www.suse.com/security/cve/CVE-2024-6603.html * https://www.suse.com/security/cve/CVE-2024-6604.html * https://www.suse.com/security/cve/CVE-2024-6605.html * https://www.suse.com/security/cve/CVE-2024-6606.html * https://www.suse.com/security/cve/CVE-2024-6607.html * https://www.suse.com/security/cve/CVE-2024-6608.html * https://www.suse.com/security/cve/CVE-2024-6609.html * https://www.suse.com/security/cve/CVE-2024-6610.html * https://www.suse.com/security/cve/CVE-2024-6611.html * https://www.suse.com/security/cve/CVE-2024-6612.html * https://www.suse.com/security/cve/CVE-2024-6613.html * https://www.suse.com/security/cve/CVE-2024-6614.html * https://www.suse.com/security/cve/CVE-2024-6615.html * https://www.suse.com/security/cve/CVE-2024-7518.html * https://www.suse.com/security/cve/CVE-2024-7519.html * https://www.suse.com/security/cve/CVE-2024-7520.html * https://www.suse.com/security/cve/CVE-2024-7521.html * https://www.suse.com/security/cve/CVE-2024-7522.html * https://www.suse.com/security/cve/CVE-2024-7524.html * https://www.suse.com/security/cve/CVE-2024-7525.html * https://www.suse.com/security/cve/CVE-2024-7526.html * https://www.suse.com/security/cve/CVE-2024-7527.html * https://www.suse.com/security/cve/CVE-2024-7528.html * https://www.suse.com/security/cve/CVE-2024-7529.html * https://www.suse.com/security/cve/CVE-2024-7531.html * https://bugzilla.suse.com/show_bug.cgi?id=1226316 * https://bugzilla.suse.com/show_bug.cgi?id=1228648

1 0

openSUSE-SU-2024:0257-1: moderate: Security update for roundcubemail
by opensuse-security＠opensuse.org 21 Aug '24

21 Aug '24

openSUSE Security Update: Security update for roundcubemail ______________________________________________________________________________ Announcement ID: openSUSE-SU-2024:0257-1 Rating: moderate References: #1216895 Cross-References: CVE-2023-47272 CVSS scores: CVE-2023-47272 (NVD) : 6.1 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N Affected Products: openSUSE Backports SLE-15-SP5 ______________________________________________________________________________ An update that fixes one vulnerability is now available. Description: This update for roundcubemail fixes the following issues: Update to 1.6.7 This is a security update to the stable version 1.6 of Roundcube Webmail. It provides a fix to a recently reported XSS vulnerabilities: * Fix cross-site scripting (XSS) vulnerability in handling SVG animate attributes. Reported by Valentin T. and Lutz Wolf of CrowdStrike. * Fix cross-site scripting (XSS) vulnerability in handling list columns from user preferences. Reported by Huy Nguyễn Phạm Nhật. * Fix command injection via crafted im_convert_path/im_identify_path on Windows. Reported by Huy Nguyễn Phạm Nhật. CHANGELOG * Makefile: Use phpDocumentor v3.4 for the Framework docs (#9313) * Fix bug where HTML entities in URLs were not decoded on HTML to plain text conversion (#9312) * Fix bug in collapsing/expanding folders with some special characters in names (#9324) * Fix PHP8 warnings (#9363, #9365, #9429) * Fix missing field labels in CSV import, for some locales (#9393) * Fix cross-site scripting (XSS) vulnerability in handling SVG animate attributes * Fix cross-site scripting (XSS) vulnerability in handling list columns from user preferences * Fix command injection via crafted im_convert_path/im_identify_path on Windows Update to 1.6.6: * Fix regression in handling LDAP search_fields configuration parameter (#9210) * Enigma: Fix finding of a private key when decrypting a message using GnuPG v2.3 * Fix page jump menu flickering on click (#9196) * Update to TinyMCE 5.10.9 security release (#9228) * Fix PHP8 warnings (#9235, #9238, #9242, #9306) * Fix saving other encryption settings besides enigma's (#9240) * Fix unneeded php command use in installto.sh and deluser.sh scripts (#9237) * Fix TinyMCE localization installation (#9266) * Fix bug where trailing non-ascii characters in email addresses could have been removed in recipient input (#9257) * Fix IMAP GETMETADATA command with options - RFC5464 Update to 1.6.5 (boo#1216895): * Fix cross-site scripting (XSS) vulnerability in setting Content-Type/Content-Disposition for attachment preview/download CVE-2023-47272 Other changes: * Fix PHP8 fatal error when parsing a malformed BODYSTRUCTURE (#9171) * Fix duplicated Inbox folder on IMAP servers that do not use Inbox folder with all capital letters (#9166) * Fix PHP warnings (#9174) * Fix UI issue when dealing with an invalid managesieve_default_headers value (#9175) * Fix bug where images attached to application/smil messages weren't displayed (#8870) * Fix PHP string replacement error in utils/error.php (#9185) * Fix regression where smtp_user did not allow pre/post strings before/after %u placeholder (#9162) Patch Instructions: To install this openSUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Backports SLE-15-SP5: zypper in -t patch openSUSE-2024-257=1 Package List: - openSUSE Backports SLE-15-SP5 (noarch): roundcubemail-1.6.7-bp155.2.9.1 References: https://www.suse.com/security/cve/CVE-2023-47272.html https://bugzilla.suse.com/1216895

1 0