- openSUSE Security Announce

SUSE-SU-2024:3964-1: moderate: Security update for python-wxPython
by OPENSUSE-SECURITY-UPDATES 11 Nov '24

11 Nov '24

# Security update for python-wxPython Announcement ID: SUSE-SU-2024:3964-1 Release Date: 2024-11-09T16:39:54Z Rating: moderate References: * bsc#1228252 * bsc#1232590 Cross-References: * CVE-2024-50602 CVSS scores: * CVE-2024-50602 ( SUSE ): 5.6 CVSS:4.0/AV:L/AC:L/AT:P/PR:N/UI:A/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N * CVE-2024-50602 ( SUSE ): 5.5 CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H * CVE-2024-50602 ( NVD ): 5.9 CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H Affected Products: * openSUSE Leap 15.4 * openSUSE Leap 15.6 An update that solves one vulnerability and has one security fix can now be installed. ## Description: This update for python-wxPython fixes the following issues: Security issue fixed: * CVE-2024-50602: Fixed a denial of service in the vendored libexpat's XML_ResumeParser function (bsc#1232590). Non-security issues fixed: * rebuilt for python 3.11 (bsc#1228252). * add repack script, do not include packaging/ dir in sources * Reduce complexity by not rewriting subpackages at all. * Appease factory-auto bot about package src name. * Add additional patches fixing the situation with Python 3.10 compatibility. * Split out the TW python3 flavors into multibuild using the python_subpackage_only mechanism: Multiple python3 flavors sequentially require too much space and time in one build. ## Patch Instructions: To install this SUSE update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: * openSUSE Leap 15.4 zypper in -t patch SUSE-2024-3964=1 * openSUSE Leap 15.6 zypper in -t patch openSUSE-SLE-15.6-2024-3964=1 ## Package List: * openSUSE Leap 15.4 (aarch64 ppc64le s390x x86_64 i586) * python311-wxPython-debugsource-4.1.1-150400.3.8.1 * python311-wxPython-lang-4.1.1-150400.3.8.1 * python311-wxPython-debuginfo-4.1.1-150400.3.8.1 * python311-wxPython-4.1.1-150400.3.8.1 * openSUSE Leap 15.6 (aarch64 ppc64le s390x x86_64) * python311-wxPython-debugsource-4.1.1-150400.3.8.1 * python311-wxPython-lang-4.1.1-150400.3.8.1 * python311-wxPython-debuginfo-4.1.1-150400.3.8.1 * python311-wxPython-4.1.1-150400.3.8.1 ## References: * https://www.suse.com/security/cve/CVE-2024-50602.html * https://bugzilla.suse.com/show_bug.cgi?id=1228252 * https://bugzilla.suse.com/show_bug.cgi?id=1232590

1 0

openSUSE-SU-2024:14481-1: moderate: coredns-1.11.3+git129.387f34d-1.1 on GA media
by meissner＠suse.com 10 Nov '24

10 Nov '24

# coredns-1.11.3+git129.387f34d-1.1 on GA media Announcement ID: openSUSE-SU-2024:14481-1 Rating: moderate Cross-References: * CVE-2024-51744 CVSS scores: * CVE-2024-51744 ( SUSE ): 3.1 CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:L/I:N/A:N * CVE-2024-51744 ( SUSE ): 2.1 CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:A/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N Affected Products: * openSUSE Tumbleweed An update that solves one vulnerability can now be installed. ## Description: These are all security issues fixed in the coredns-1.11.3+git129.387f34d-1.1 package on the GA media of openSUSE Tumbleweed. ## Package List: * openSUSE Tumbleweed: * coredns 1.11.3+git129.387f34d-1.1 * coredns-extras 1.11.3+git129.387f34d-1.1 ## References: * https://www.suse.com/security/cve/CVE-2024-51744.html

1 0

openSUSE-SU-2024:14482-1: moderate: govulncheck-vulndb-0.0.20241108T172500-1.1 on GA media
by meissner＠suse.com 10 Nov '24

10 Nov '24

# govulncheck-vulndb-0.0.20241108T172500-1.1 on GA media Announcement ID: openSUSE-SU-2024:14482-1 Rating: moderate Cross-References: * CVE-2024-10975 * CVE-2024-45794 Affected Products: * openSUSE Tumbleweed An update that solves 2 vulnerabilities can now be installed. ## Description: These are all security issues fixed in the govulncheck-vulndb-0.0.20241108T172500-1.1 package on the GA media of openSUSE Tumbleweed. ## Package List: * openSUSE Tumbleweed: * govulncheck-vulndb 0.0.20241108T172500-1.1 ## References: * https://www.suse.com/security/cve/CVE-2024-10975.html * https://www.suse.com/security/cve/CVE-2024-45794.html

1 0

openSUSE-SU-2024:0364-1: important: Security update for virtualbox
by opensuse-security＠opensuse.org 10 Nov '24

10 Nov '24

openSUSE Security Update: Security update for virtualbox ______________________________________________________________________________ Announcement ID: openSUSE-SU-2024:0364-1 Rating: important References: #1231225 #1231735 #1231736 #1231737 #1231738 Cross-References: CVE-2024-21248 CVE-2024-21259 CVE-2024-21263 CVE-2024-21273 Affected Products: openSUSE Backports SLE-15-SP6 openSUSE Leap 15.6 ______________________________________________________________________________ An update that solves four vulnerabilities and has one errata is now available. Description: This update for virtualbox fixes the following issues: Update to release 7.1.4: * NAT: Fixed DHCP problems with certain guests when domain is empty * VMSVGA: Improved flickering, black screen and other screen update issues with recent Linux kernels * Linux Guest Additions: Introduce initial support for kernel 6.12 * EFI: Added missing LsiLogic MPT SCSI driver again to fix booting from devices attached to this device if the EFI firmware is used (7.1.0 regression) * EFI: Restored broken network boot support (7.1.0 regression) * Adressed CVE-2024-21248 [boo#1231735], CVE-2024-21273 [boo#1231736], CVE-2024-21259 [boo#1231737], CVE-2024-21263 [boo#1231738] - Make the Extension Pack work with our compiler flags and RT_NOEXCEPT choices. [boo#1231225] Update to release 7.1: * The GUI now offers a selection between Basic and Experienced user level with reduced or full UI functionality. * VRDE: If user does not set up TLS with custom certificates, enable it with self-signed certificate, including issuing a new one before the old one expires * NAT: New engine with IPv6 support. * Linux host and guest: Added Wayland support for Clipboard sharing. - Changed license from Gpl-2.0 to Gpl-3.0 Version bump to VirtualBox 7.0.20 (released July 16 2024 by Oracle)) This is a maintenance release. The following items were fixed and/or added: - TPM: Fixed errors appearing the event viewer with Windows guests - macOS Hosts: Fixed passing USB devices to the VM (bug #21218) - Audio: Fixed recording with HDA emulation after newer Windows 10 / 11 guests got rebooted - USB: Fixed a deadlock in OHCI triggered when saving the current state of a VM or taking a snapshot (bug #22059) - Linux Guest and Host: Introduced initial support for OpenSuse 15.6 kernel - Linux Guest and Host: Introduced initial support for RHEL 9.5 kernel (bug #22099) - Guest Additions: Shared Clipboard: Fixed issue when extra new lines were pasted when copying text between Win and X11 (bug #21716) - UEFI Secure Boot: Add new Microsoft certificates to list for new VMs Patch Instructions: To install this openSUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 15.6: zypper in -t patch openSUSE-2024-364=1 - openSUSE Backports SLE-15-SP6: zypper in -t patch openSUSE-2024-364=1 Package List: - openSUSE Leap 15.6 (x86_64): python3-virtualbox-7.1.4-lp156.2.4.1 python3-virtualbox-debuginfo-7.1.4-lp156.2.4.1 virtualbox-7.1.4-lp156.2.4.1 virtualbox-debuginfo-7.1.4-lp156.2.4.1 virtualbox-debugsource-7.1.4-lp156.2.4.1 virtualbox-devel-7.1.4-lp156.2.4.1 virtualbox-guest-tools-7.1.4-lp156.2.4.1 virtualbox-guest-tools-debuginfo-7.1.4-lp156.2.4.1 virtualbox-kmp-debugsource-7.1.4-lp156.2.4.1 virtualbox-kmp-default-7.1.4_k6.4.0_150600.23.25-lp156.2.4.1 virtualbox-kmp-default-debuginfo-7.1.4_k6.4.0_150600.23.25-lp156.2.4.1 virtualbox-qt-7.1.4-lp156.2.4.1 virtualbox-qt-debuginfo-7.1.4-lp156.2.4.1 virtualbox-vnc-7.1.4-lp156.2.4.1 virtualbox-websrv-7.1.4-lp156.2.4.1 virtualbox-websrv-debuginfo-7.1.4-lp156.2.4.1 - openSUSE Leap 15.6 (noarch): virtualbox-guest-desktop-icons-7.1.4-lp156.2.4.1 virtualbox-guest-source-7.1.4-lp156.2.4.1 virtualbox-host-source-7.1.4-lp156.2.4.1 - openSUSE Backports SLE-15-SP6 (aarch64 ppc64le x86_64): kbuild-0.1.9998+svn3613-bp156.2.3.1 kbuild-debuginfo-0.1.9998+svn3613-bp156.2.3.1 kbuild-debugsource-0.1.9998+svn3613-bp156.2.3.1 References: https://www.suse.com/security/cve/CVE-2024-21248.html https://www.suse.com/security/cve/CVE-2024-21259.html https://www.suse.com/security/cve/CVE-2024-21263.html https://www.suse.com/security/cve/CVE-2024-21273.html https://bugzilla.suse.com/1231225 https://bugzilla.suse.com/1231735 https://bugzilla.suse.com/1231736 https://bugzilla.suse.com/1231737 https://bugzilla.suse.com/1231738

1 0

openSUSE-SU-2024:14478-1: moderate: httpcomponents-client-4.5.14-1.1 on GA media
by meissner＠suse.com 09 Nov '24

09 Nov '24

# httpcomponents-client-4.5.14-1.1 on GA media Announcement ID: openSUSE-SU-2024:14478-1 Rating: moderate Cross-References: * CVE-2020-13956 CVSS scores: * CVE-2020-13956 ( SUSE ): 5.4 CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:L/I:L/A:N Affected Products: * openSUSE Tumbleweed An update that solves one vulnerability can now be installed. ## Description: These are all security issues fixed in the httpcomponents-client-4.5.14-1.1 package on the GA media of openSUSE Tumbleweed. ## Package List: * openSUSE Tumbleweed: * httpcomponents-client 4.5.14-1.1 * httpcomponents-client-cache 4.5.14-1.1 * httpcomponents-client-javadoc 4.5.14-1.1 ## References: * https://www.suse.com/security/cve/CVE-2020-13956.html

1 0

openSUSE-SU-2024:14479-1: moderate: ruby3.3-rubygem-rails-7.0-7.0.8.6-1.1 on GA media
by meissner＠suse.com 09 Nov '24

09 Nov '24

# ruby3.3-rubygem-rails-7.0-7.0.8.6-1.1 on GA media Announcement ID: openSUSE-SU-2024:14479-1 Rating: moderate Cross-References: * CVE-2024-41128 * CVE-2024-47887 * CVE-2024-47888 * CVE-2024-47889 CVSS scores: * CVE-2024-41128 ( SUSE ): 5.9 CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H * CVE-2024-47887 ( SUSE ): 5.9 CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H * CVE-2024-47889 ( SUSE ): 5.9 CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H Affected Products: * openSUSE Tumbleweed An update that solves 4 vulnerabilities can now be installed. ## Description: These are all security issues fixed in the ruby3.3-rubygem-rails-7.0-7.0.8.6-1.1 package on the GA media of openSUSE Tumbleweed. ## Package List: * openSUSE Tumbleweed: * ruby3.3-rubygem-rails-7.0 7.0.8.6-1.1 ## References: * https://www.suse.com/security/cve/CVE-2024-41128.html * https://www.suse.com/security/cve/CVE-2024-47887.html * https://www.suse.com/security/cve/CVE-2024-47888.html * https://www.suse.com/security/cve/CVE-2024-47889.html

1 0

openSUSE-SU-2024:0358-1: moderate: Security update for qbittorrent
by opensuse-security＠opensuse.org 08 Nov '24

08 Nov '24

openSUSE Security Update: Security update for qbittorrent ______________________________________________________________________________ Announcement ID: openSUSE-SU-2024:0358-1 Rating: moderate References: #1232731 Cross-References: CVE-2024-51774 Affected Products: openSUSE Backports SLE-15-SP6 ______________________________________________________________________________ An update that fixes one vulnerability is now available. Description: This update for qbittorrent fixes the following issues: - Update to version 5.0.1 (fixes boo#1232731 CVE-2024-51774) Added features: * Add "Simple pread/pwrite" disk IO type Bug fixes: * Don't ignore SSL errors (boo#1232731 CVE-2024-51774) * Don't try to apply Mark-of-the-Web to nonexistent files * Disable "Move to trash" option by default * Disable the ability to create torrents with a piece size of 256MiB * Allow to choose Qt style * Always notify user about duplicate torrent * Correctly handle "torrent finished after move" event * Correctly apply filename filter when `!qB` extension is enabled * Improve color scheme change detection * Fix button state for SSL certificate check Web UI: * Fix CSS that results in hidden torrent list in some browsers * Use proper text color to highlight items in all filter lists * Fix 'rename files' dialog cannot be opened more than once * Fix UI of Advanced Settings to show all settings * Free resources allocated by web session once it is destructed Search: * Import correct libraries Other changes: * Sync flag icons with upstream Patch Instructions: To install this openSUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Backports SLE-15-SP6: zypper in -t patch openSUSE-2024-358=1 Package List: - openSUSE Backports SLE-15-SP6 (aarch64 ppc64le s390x x86_64): qbittorrent-5.0.1-bp156.3.6.1 qbittorrent-nox-5.0.1-bp156.3.6.1 References: https://www.suse.com/security/cve/CVE-2024-51774.html https://bugzilla.suse.com/1232731

1 0

openSUSE-SU-2024:14471-1: moderate: ruby3.3-rubygem-actionmailer-7.0-7.0.8.6-1.1 on GA media
by meissner＠suse.com 08 Nov '24

08 Nov '24

# ruby3.3-rubygem-actionmailer-7.0-7.0.8.6-1.1 on GA media Announcement ID: openSUSE-SU-2024:14471-1 Rating: moderate Cross-References: * CVE-2024-47889 CVSS scores: * CVE-2024-47889 ( SUSE ): 5.9 CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H Affected Products: * openSUSE Tumbleweed An update that solves one vulnerability can now be installed. ## Description: These are all security issues fixed in the ruby3.3-rubygem-actionmailer-7.0-7.0.8.6-1.1 package on the GA media of openSUSE Tumbleweed. ## Package List: * openSUSE Tumbleweed: * ruby3.3-rubygem-actionmailer-7.0 7.0.8.6-1.1 ## References: * https://www.suse.com/security/cve/CVE-2024-47889.html

1 0

openSUSE-SU-2024:14474-1: moderate: ruby3.3-rubygem-puma-6.4.3-1.1 on GA media
by meissner＠suse.com 08 Nov '24

08 Nov '24

# ruby3.3-rubygem-puma-6.4.3-1.1 on GA media Announcement ID: openSUSE-SU-2024:14474-1 Rating: moderate Cross-References: * CVE-2024-45614 CVSS scores: * CVE-2024-45614 ( SUSE ): 5.4 CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:L/I:L/A:N * CVE-2024-45614 ( SUSE ): 6.3 CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N Affected Products: * openSUSE Tumbleweed An update that solves one vulnerability can now be installed. ## Description: These are all security issues fixed in the ruby3.3-rubygem-puma-6.4.3-1.1 package on the GA media of openSUSE Tumbleweed. ## Package List: * openSUSE Tumbleweed: * ruby3.3-rubygem-puma 6.4.3-1.1 ## References: * https://www.suse.com/security/cve/CVE-2024-45614.html

1 0

openSUSE-SU-2024:14473-1: moderate: ruby3.3-rubygem-actiontext-7.0-7.0.8.6-1.1 on GA media
by meissner＠suse.com 08 Nov '24

08 Nov '24

# ruby3.3-rubygem-actiontext-7.0-7.0.8.6-1.1 on GA media Announcement ID: openSUSE-SU-2024:14473-1 Rating: moderate Cross-References: * CVE-2024-47888 Affected Products: * openSUSE Tumbleweed An update that solves one vulnerability can now be installed. ## Description: These are all security issues fixed in the ruby3.3-rubygem-actiontext-7.0-7.0.8.6-1.1 package on the GA media of openSUSE Tumbleweed. ## Package List: * openSUSE Tumbleweed: * ruby3.3-rubygem-actiontext-7.0 7.0.8.6-1.1 ## References: * https://www.suse.com/security/cve/CVE-2024-47888.html

1 0