December 2022 - openSUSE Updates - openSUSE Mailing Lists

openSUSE-RU-2022:10233-1: moderate: Recommended update for warewulf4
by maintenance＠opensuse.org 05 Dec '22

05 Dec '22

openSUSE Recommended Update: Recommended update for warewulf4 ______________________________________________________________________________ Announcement ID: openSUSE-RU-2022:10233-1 Rating: moderate References: Affected Products: openSUSE Backports SLE-15-SP3 openSUSE Backports SLE-15-SP4 ______________________________________________________________________________ An update that has 0 recommended fixes can now be installed. Description: This update for warewulf4 fixes the following issues: - fixed symlink dhcpd.conf collision Updated to 4.3.0: * fixed bug which for single node profile set Update to 4.3.0rc6 what should the final release candidate: * using compressed images again, as PXE else would fail Update to v4.3.0rc2 with following major changes: * Provision interface is not tied to 'eth0' any more. The provision interface must be named 'default' now. The file `nodes.yaml' must be changed accordingly. * Creating of '/etc/exports' can now be disabled, so that wwctl configure -a wont overwrite a existing '/etc/exports'. * All configurations files for the host (/etc/exports, /etc/dhcpd.conf, /etc/hosts) are now populated from the (OVERLAYDIR/host/etc/{exports|dhcpd|hosts}.ww . Also other configuration files like prometheus.yml.ww or slurm.conf.ww which depend on the cluster nodes can be placed. Also the new templated functions {{ abort }}, {{ IncludeBlock }} abd {{ no_backup }} are allowed now. * nodes and profiles can now have multiple system and runtime overlays, as a comma separated list. * The overlays of the profile and the nodes are combined. * Simple ipv6 support is now enabled. In warewulf.conf the option ipaddr6/Ipv6net must be set to enable ipv6. If enabled on of these options is set a node will get a derived ipv6 in the scheme ipv6net:ipaddr4. This address can also be overwritten for every node * Multiple files can now created from a single template.ww file with the {{ file FILENAME }} command in the template. The command is expanded to the magic template command {{ /* file FILENAME */}} which is picked up by wwctl and everything which comes after this magic comment will be written to the file FILENAME. This mechanism is leveraged in the configuration files for the network, see ifcfg.xml.ww and ifcgf.ww. * Networks can now have arbitrary keys value pairs in the profiles and on the node, so that things like bridges and mtu sizes can be set * The yaml format for nodes has now sub-keys for ipmi and kernel, old nodes.conf files have to to be changed accordingly * uids and gids of a container now get synced at import time, so that at least users with the same name have the same uid. This is not necessarily needed for warewulf, but services like munge. * backward compatibility for nodes.conf * added file:// uri for importing archived containers Patch Instructions: To install this openSUSE Recommended Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Backports SLE-15-SP4: zypper in -t patch openSUSE-2022-10233=1 - openSUSE Backports SLE-15-SP3: zypper in -t patch openSUSE-2022-10233=1 Package List: - openSUSE Backports SLE-15-SP4 (aarch64 x86_64): warewulf4-4.3.0-bp154.2.3.1 warewulf4-overlay-4.3.0-bp154.2.3.1 warewulf4-slurm-4.3.0-bp154.2.3.1 - openSUSE Backports SLE-15-SP4 (noarch): warewulf4-ipxe-4.3.0-bp154.2.3.1 - openSUSE Backports SLE-15-SP3 (aarch64 x86_64): warewulf4-4.3.0-bp153.5.1 warewulf4-overlay-4.3.0-bp153.5.1 warewulf4-slurm-4.3.0-bp153.5.1 - openSUSE Backports SLE-15-SP3 (noarch): warewulf4-ipxe-4.3.0-bp153.5.1 References:

1 0

SUSE-RU-2022:4315-1: moderate: Recommended update for yast2-bootloader
by maintenance＠opensuse.org 05 Dec '22

05 Dec '22

SUSE Recommended Update: Recommended update for yast2-bootloader ______________________________________________________________________________ Announcement ID: SUSE-RU-2022:4315-1 Rating: moderate References: #1201962 Affected Products: SUSE Enterprise Storage 7.1 SUSE Linux Enterprise Desktop 15-SP3 SUSE Linux Enterprise High Performance Computing 15-SP3 SUSE Linux Enterprise Installer 15-SP3 SUSE Linux Enterprise Module for Basesystem 15-SP3 SUSE Linux Enterprise Server 15-SP3 SUSE Linux Enterprise Server for SAP Applications 15-SP3 SUSE Manager Proxy 4.2 SUSE Manager Retail Branch Server 4.2 SUSE Manager Server 4.2 openSUSE Leap 15.3 ______________________________________________________________________________ An update that has one recommended fix can now be installed. Description: This update for yast2-bootloader fixes the following issues: - Prevent leak of grub2 password to logs (bsc#1201962) Patch Instructions: To install this SUSE Recommended Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 15.3: zypper in -t patch openSUSE-SLE-15.3-2022-4315=1 - SUSE Linux Enterprise Module for Basesystem 15-SP3: zypper in -t patch SUSE-SLE-Module-Basesystem-15-SP3-2022-4315=1 - SUSE Linux Enterprise Installer 15-SP3: zypper in -t patch SUSE-SLE-INSTALLER-15-SP3-2022-4315=1 Package List: - openSUSE Leap 15.3 (aarch64 ppc64le s390x x86_64): yast2-bootloader-4.3.32-150300.3.11.1 - SUSE Linux Enterprise Module for Basesystem 15-SP3 (aarch64 ppc64le s390x x86_64): yast2-bootloader-4.3.32-150300.3.11.1 - SUSE Linux Enterprise Installer 15-SP3 (aarch64 ppc64le s390x x86_64): yast2-bootloader-4.3.32-150300.3.11.1 References: https://bugzilla.suse.com/1201962

1 0

SUSE-RU-2022:4314-1: moderate: Recommended update for Yast2
by maintenance＠opensuse.org 05 Dec '22

05 Dec '22

SUSE Recommended Update: Recommended update for Yast2 ______________________________________________________________________________ Announcement ID: SUSE-RU-2022:4314-1 Rating: moderate References: #1199746 #1201235 #1201435 #1201962 #1202479 #1203866 #1204448 #1204559 Affected Products: SUSE Linux Enterprise Desktop 15-SP4 SUSE Linux Enterprise High Performance Computing 15-SP4 SUSE Linux Enterprise Installer 15-SP4 SUSE Linux Enterprise Module for Basesystem 15-SP4 SUSE Linux Enterprise Server 15-SP4 SUSE Linux Enterprise Server for SAP Applications 15-SP4 SUSE Manager Proxy 4.3 SUSE Manager Retail Branch Server 4.3 SUSE Manager Server 4.3 openSUSE Leap 15.4 ______________________________________________________________________________ An update that has 8 recommended fixes can now be installed. Description: This update for Yast2 fixes the following issues: autoyast2: - Allow empty values in ask/default, ask/selection/label and ask/selection/value elements (bsc#1204448) - Add needed packages for the selected network backend in order to prevent it is not declared in the software section (bsc#1201235, bsc#1201435) yast2-bootloader: - Prevent leak of grub2 password to logs (bsc#1201962) yast2-installation: - Fix copy of entropy pool during installation (bsc#1204559) yast2-network: - Do not assume wicked will be installed by default anymore and return the needed packages by the selected backend when them are not installed (bsc#1201235, bsc#1201435) - Fixed issue when writing the NetworkManager config without a gateway (bsc#1203866) - Activate s390 devices before importing and reading the network configuration or otherwise the related linux devices will not be present and could be ignored (bsc#1199746) - At the end of the installation, force an enablement of the selected network service even when the selected one has not been modified and ensure other backends are disabled (bsc#1202479) Patch Instructions: To install this SUSE Recommended Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 15.4: zypper in -t patch openSUSE-SLE-15.4-2022-4314=1 - SUSE Linux Enterprise Module for Basesystem 15-SP4: zypper in -t patch SUSE-SLE-Module-Basesystem-15-SP4-2022-4314=1 - SUSE Linux Enterprise Installer 15-SP4: zypper in -t patch SUSE-SLE-INSTALLER-15-SP4-2022-4314=1 Package List: - openSUSE Leap 15.4 (aarch64 ppc64le s390x x86_64): yast2-bootloader-4.4.18-150400.3.3.1 - openSUSE Leap 15.4 (noarch): autoyast2-4.4.41-150400.3.13.1 autoyast2-installation-4.4.41-150400.3.13.1 yast2-installation-4.4.57-150400.3.12.1 yast2-network-4.4.53-150400.3.10.1 - SUSE Linux Enterprise Module for Basesystem 15-SP4 (aarch64 ppc64le s390x x86_64): yast2-bootloader-4.4.18-150400.3.3.1 - SUSE Linux Enterprise Module for Basesystem 15-SP4 (noarch): autoyast2-4.4.41-150400.3.13.1 autoyast2-installation-4.4.41-150400.3.13.1 yast2-installation-4.4.57-150400.3.12.1 yast2-network-4.4.53-150400.3.10.1 - SUSE Linux Enterprise Installer 15-SP4 (noarch): autoyast2-4.4.41-150400.3.13.1 autoyast2-installation-4.4.41-150400.3.13.1 yast2-installation-4.4.57-150400.3.12.1 yast2-network-4.4.53-150400.3.10.1 References: https://bugzilla.suse.com/1199746 https://bugzilla.suse.com/1201235 https://bugzilla.suse.com/1201435 https://bugzilla.suse.com/1201962 https://bugzilla.suse.com/1202479 https://bugzilla.suse.com/1203866 https://bugzilla.suse.com/1204448 https://bugzilla.suse.com/1204559

1 0

SUSE-FU-2022:4313-1: important: Feature update for python-cached-property, python-osc-tiny, python-responses
by maintenance＠opensuse.org 05 Dec '22

05 Dec '22

SUSE Feature Update: Feature update for python-cached-property, python-osc-tiny, python-responses ______________________________________________________________________________ Announcement ID: SUSE-FU-2022:4313-1 Rating: important References: PED-1872 PED-1964 Affected Products: SUSE Enterprise Storage 7.1 SUSE Linux Enterprise Desktop 15-SP3 SUSE Linux Enterprise Desktop 15-SP4 SUSE Linux Enterprise High Performance Computing 15-SP3 SUSE Linux Enterprise High Performance Computing 15-SP4 SUSE Linux Enterprise Module for Development Tools 15-SP3 SUSE Linux Enterprise Module for Development Tools 15-SP4 SUSE Linux Enterprise Server 15-SP3 SUSE Linux Enterprise Server 15-SP4 SUSE Linux Enterprise Server for SAP Applications 15-SP3 SUSE Linux Enterprise Server for SAP Applications 15-SP4 SUSE Manager Proxy 4.2 SUSE Manager Proxy 4.3 SUSE Manager Retail Branch Server 4.2 SUSE Manager Retail Branch Server 4.3 SUSE Manager Server 4.2 SUSE Manager Server 4.3 openSUSE Leap 15.3 openSUSE Leap 15.4 ______________________________________________________________________________ An update that has 0 feature fixes and contains two features can now be installed. Description: This update for python-cached-property, python-osc-tiny, python-responses fixes the following issues: python-cached-property: - New package at version 1.5.2 (jsc#PED-1872, jsc#PED-1964) python-responses: - Version update from 0.10.12 to 0.21.0 (jsc#PED-1872, jsc#PED-1964) - Dropped support of Python 2.7, 3.5, 3.6 - For the full list of changes please read the packaged CHANGES file or https://github.com/getsentry/responses/releases python-osc-tiny: - New package at version 0.7.5 (jsc#PED-1872, jsc#PED-1964) Patch Instructions: To install this SUSE Feature Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 15.4: zypper in -t patch openSUSE-SLE-15.4-2022-4313=1 - openSUSE Leap 15.3: zypper in -t patch openSUSE-SLE-15.3-2022-4313=1 - SUSE Linux Enterprise Module for Development Tools 15-SP4: zypper in -t patch SUSE-SLE-Module-Development-Tools-15-SP4-2022-4313=1 - SUSE Linux Enterprise Module for Development Tools 15-SP3: zypper in -t patch SUSE-SLE-Module-Development-Tools-15-SP3-2022-4313=1 Package List: - openSUSE Leap 15.4 (noarch): python3-cached-property-1.5.2-150300.7.3.1 python3-osc-tiny-0.7.5-150300.7.3.1 python3-responses-0.21.0-150300.3.3.1 - openSUSE Leap 15.3 (noarch): python3-cached-property-1.5.2-150300.7.3.1 python3-osc-tiny-0.7.5-150300.7.3.1 python3-responses-0.21.0-150300.3.3.1 - SUSE Linux Enterprise Module for Development Tools 15-SP4 (noarch): python3-cached-property-1.5.2-150300.7.3.1 python3-osc-tiny-0.7.5-150300.7.3.1 python3-responses-0.21.0-150300.3.3.1 - SUSE Linux Enterprise Module for Development Tools 15-SP3 (noarch): python3-cached-property-1.5.2-150300.7.3.1 python3-osc-tiny-0.7.5-150300.7.3.1 python3-responses-0.21.0-150300.3.3.1 References:

1 0

SUSE-FU-2022:4313-1: important: Feature update for python-cached-property, python-osc-tiny, python-responses
by maintenance＠opensuse.org 05 Dec '22

05 Dec '22

SUSE Feature Update: Feature update for python-cached-property, python-osc-tiny, python-responses ______________________________________________________________________________ Announcement ID: SUSE-FU-2022:4313-1 Rating: important References: PED-1872 PED-1964 Affected Products: SUSE Enterprise Storage 7.1 SUSE Linux Enterprise Desktop 15-SP3 SUSE Linux Enterprise Desktop 15-SP4 SUSE Linux Enterprise High Performance Computing 15-SP3 SUSE Linux Enterprise High Performance Computing 15-SP4 SUSE Linux Enterprise Module for Development Tools 15-SP3 SUSE Linux Enterprise Module for Development Tools 15-SP4 SUSE Linux Enterprise Server 15-SP3 SUSE Linux Enterprise Server 15-SP4 SUSE Linux Enterprise Server for SAP Applications 15-SP3 SUSE Linux Enterprise Server for SAP Applications 15-SP4 SUSE Manager Proxy 4.2 SUSE Manager Proxy 4.3 SUSE Manager Retail Branch Server 4.2 SUSE Manager Retail Branch Server 4.3 SUSE Manager Server 4.2 SUSE Manager Server 4.3 openSUSE Leap 15.3 openSUSE Leap 15.4 ______________________________________________________________________________ An update that has 0 feature fixes and contains two features can now be installed. Description: This update for python-cached-property, python-osc-tiny, python-responses fixes the following issues: python-cached-property: - New package at version 1.5.2 (jsc#PED-1872, jsc#PED-1964) python-responses: - Version update from 0.10.12 to 0.21.0 (jsc#PED-1872, jsc#PED-1964) - Dropped support of Python 2.7, 3.5, 3.6 - For the full list of changes please read the packaged CHANGES file or https://github.com/getsentry/responses/releases python-osc-tiny: - New package at version 0.7.5 (jsc#PED-1872, jsc#PED-1964) Patch Instructions: To install this SUSE Feature Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 15.4: zypper in -t patch openSUSE-SLE-15.4-2022-4313=1 - openSUSE Leap 15.3: zypper in -t patch openSUSE-SLE-15.3-2022-4313=1 - SUSE Linux Enterprise Module for Development Tools 15-SP4: zypper in -t patch SUSE-SLE-Module-Development-Tools-15-SP4-2022-4313=1 - SUSE Linux Enterprise Module for Development Tools 15-SP3: zypper in -t patch SUSE-SLE-Module-Development-Tools-15-SP3-2022-4313=1 Package List: - openSUSE Leap 15.4 (noarch): python3-cached-property-1.5.2-150300.7.3.1 python3-osc-tiny-0.7.5-150300.7.3.1 python3-responses-0.21.0-150300.3.3.1 - openSUSE Leap 15.3 (noarch): python3-cached-property-1.5.2-150300.7.3.1 python3-osc-tiny-0.7.5-150300.7.3.1 python3-responses-0.21.0-150300.3.3.1 - SUSE Linux Enterprise Module for Development Tools 15-SP4 (noarch): python3-cached-property-1.5.2-150300.7.3.1 python3-osc-tiny-0.7.5-150300.7.3.1 python3-responses-0.21.0-150300.3.3.1 - SUSE Linux Enterprise Module for Development Tools 15-SP3 (noarch): python3-cached-property-1.5.2-150300.7.3.1 python3-osc-tiny-0.7.5-150300.7.3.1 python3-responses-0.21.0-150300.3.3.1 References:

1 0

openSUSE-SU-2022:10229-1: important: Security update for chromium
by opensuse-security＠opensuse.org 04 Dec '22

04 Dec '22

openSUSE Security Update: Security update for chromium ______________________________________________________________________________ Announcement ID: openSUSE-SU-2022:10229-1 Rating: important References: #1205871 Cross-References: CVE-2022-4174 CVE-2022-4175 CVE-2022-4176 CVE-2022-4177 CVE-2022-4178 CVE-2022-4179 CVE-2022-4180 CVE-2022-4181 CVE-2022-4182 CVE-2022-4183 CVE-2022-4184 CVE-2022-4185 CVE-2022-4186 CVE-2022-4187 CVE-2022-4188 CVE-2022-4189 CVE-2022-4190 CVE-2022-4191 CVE-2022-4192 CVE-2022-4193 CVE-2022-4194 CVE-2022-4195 CVSS scores: CVE-2022-4174 (NVD) : 8.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H CVE-2022-4175 (NVD) : 8.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H CVE-2022-4176 (NVD) : 8.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H CVE-2022-4177 (NVD) : 8.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H CVE-2022-4178 (NVD) : 8.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H CVE-2022-4179 (NVD) : 8.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H CVE-2022-4180 (NVD) : 8.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H CVE-2022-4181 (NVD) : 8.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H CVE-2022-4182 (NVD) : 4.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N CVE-2022-4183 (NVD) : 4.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N CVE-2022-4184 (NVD) : 4.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N CVE-2022-4185 (NVD) : 4.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N CVE-2022-4186 (NVD) : 4.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N CVE-2022-4187 (NVD) : 6.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N CVE-2022-4188 (NVD) : 4.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N CVE-2022-4189 (NVD) : 4.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N CVE-2022-4190 (NVD) : 8.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H CVE-2022-4191 (NVD) : 8.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H CVE-2022-4192 (NVD) : 8.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H CVE-2022-4193 (NVD) : 8.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H CVE-2022-4194 (NVD) : 8.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H CVE-2022-4195 (NVD) : 4.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N Affected Products: openSUSE Backports SLE-15-SP3 openSUSE Backports SLE-15-SP4 ______________________________________________________________________________ An update that fixes 22 vulnerabilities is now available. Description: This update for chromium fixes the following issues: Chromium 108.0.5359.71 (boo#1205871) - CVE-2022-4174: Type Confusion in V8. - CVE-2022-4175: Use after free in Camera Capture. - CVE-2022-4176: Out of bounds write in Lacros Graphics. - CVE-2022-4177: Use after free in Extensions. - CVE-2022-4178: Use after free in Mojo. - CVE-2022-4179: Use after free in Audio. - CVE-2022-4180: Use after free in Mojo. - CVE-2022-4181: Use after free in Forms. - CVE-2022-4182: Inappropriate implementation in Fenced Frames. - CVE-2022-4183: Insufficient policy enforcement in Popup Blocker. - CVE-2022-4184: Insufficient policy enforcement in Autofill. - CVE-2022-4185: Inappropriate implementation in Navigation. - CVE-2022-4186: Insufficient validation of untrusted input in Downloads. - CVE-2022-4187: Insufficient policy enforcement in DevTools. - CVE-2022-4188: Insufficient validation of untrusted input in CORS. - CVE-2022-4189: Insufficient policy enforcement in DevTools. - CVE-2022-4190: Insufficient data validation in Directory. - CVE-2022-4191: Use after free in Sign-In. - CVE-2022-4192: Use after free in Live Caption. - CVE-2022-4193: Insufficient policy enforcement in File System API. - CVE-2022-4194: Use after free in Accessibility. - CVE-2022-4195: Insufficient policy enforcement in Safe Browsing. Patch Instructions: To install this openSUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Backports SLE-15-SP4: zypper in -t patch openSUSE-2022-10229=1 - openSUSE Backports SLE-15-SP3: zypper in -t patch openSUSE-2022-10229=1 Package List: - openSUSE Backports SLE-15-SP4 (aarch64 x86_64): chromedriver-108.0.5359.71-bp154.2.49.1 chromedriver-debuginfo-108.0.5359.71-bp154.2.49.1 chromium-108.0.5359.71-bp154.2.49.1 chromium-debuginfo-108.0.5359.71-bp154.2.49.1 - openSUSE Backports SLE-15-SP3 (aarch64 x86_64): chromedriver-108.0.5359.71-bp153.2.142.1 chromium-108.0.5359.71-bp153.2.142.1 References: https://www.suse.com/security/cve/CVE-2022-4174.html https://www.suse.com/security/cve/CVE-2022-4175.html https://www.suse.com/security/cve/CVE-2022-4176.html https://www.suse.com/security/cve/CVE-2022-4177.html https://www.suse.com/security/cve/CVE-2022-4178.html https://www.suse.com/security/cve/CVE-2022-4179.html https://www.suse.com/security/cve/CVE-2022-4180.html https://www.suse.com/security/cve/CVE-2022-4181.html https://www.suse.com/security/cve/CVE-2022-4182.html https://www.suse.com/security/cve/CVE-2022-4183.html https://www.suse.com/security/cve/CVE-2022-4184.html https://www.suse.com/security/cve/CVE-2022-4185.html https://www.suse.com/security/cve/CVE-2022-4186.html https://www.suse.com/security/cve/CVE-2022-4187.html https://www.suse.com/security/cve/CVE-2022-4188.html https://www.suse.com/security/cve/CVE-2022-4189.html https://www.suse.com/security/cve/CVE-2022-4190.html https://www.suse.com/security/cve/CVE-2022-4191.html https://www.suse.com/security/cve/CVE-2022-4192.html https://www.suse.com/security/cve/CVE-2022-4193.html https://www.suse.com/security/cve/CVE-2022-4194.html https://www.suse.com/security/cve/CVE-2022-4195.html https://bugzilla.suse.com/1205871

1 0

openSUSE-RU-2022:10231-1: Recommended update for tclx
by maintenance＠opensuse.org 04 Dec '22

04 Dec '22

openSUSE Recommended Update: Recommended update for tclx ______________________________________________________________________________ Announcement ID: openSUSE-RU-2022:10231-1 Rating: low References: Affected Products: openSUSE Backports SLE-15-SP4 ______________________________________________________________________________ An update that has 0 recommended fixes can now be installed. Description: This update for tclx fixes the following issues: - Version 8.4.4 presents itself as being 8.6 internally. Adjust installation path, so that it can still be loaded. Patch Instructions: To install this openSUSE Recommended Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Backports SLE-15-SP4: zypper in -t patch openSUSE-2022-10231=1 Package List: - openSUSE Backports SLE-15-SP4 (aarch64 i586 ppc64le s390x x86_64): tclx-8.4.4-bp154.2.3.1 References:

1 0

openSUSE-RU-2022:10232-1: moderate: Recommended update for proteus, tryton, trytond, trytond_currency, trytond_stock
by maintenance＠opensuse.org 04 Dec '22

04 Dec '22

openSUSE Recommended Update: Recommended update for proteus, tryton, trytond, trytond_currency, trytond_stock ______________________________________________________________________________ Announcement ID: openSUSE-RU-2022:10232-1 Rating: moderate References: Affected Products: openSUSE Backports SLE-15-SP4 ______________________________________________________________________________ An update that has 0 recommended fixes can now be installed. Description: This update for proteus, tryton, trytond, trytond_currency, trytond_stock fixes the following issues: Changes in trytond_stock: - Version 6.0.18 - Bugfix Release Changes in trytond_currency: - Version 6.0.3 - Bugfix Release Changes in trytond: - Version 6.0.24 - Bugfix Release Changes in tryton: - Version 6.0.21 - Bugfix Release Changes in proteus: - Version 6.0.7 - Bugfix Release Patch Instructions: To install this openSUSE Recommended Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Backports SLE-15-SP4: zypper in -t patch openSUSE-2022-10232=1 Package List: - openSUSE Backports SLE-15-SP4 (noarch): proteus-6.0.7-bp154.2.3.1 tryton-6.0.21-bp154.2.9.1 trytond-6.0.24-bp154.2.15.1 trytond_currency-6.0.3-bp154.2.3.1 trytond_stock-6.0.18-bp154.2.15.1 References:

1 0

openSUSE-SU-2022:10230-1: moderate: Security update for cherrytree
by opensuse-security＠opensuse.org 04 Dec '22

04 Dec '22

openSUSE Security Update: Security update for cherrytree ______________________________________________________________________________ Announcement ID: openSUSE-SU-2022:10230-1 Rating: moderate References: #1202513 Cross-References: CVE-2022-35133 CVSS scores: CVE-2022-35133 (NVD) : 6.1 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N Affected Products: openSUSE Backports SLE-15-SP4 ______________________________________________________________________________ An update that fixes one vulnerability is now available. Description: cherrytree was updated to version 0.99.49+3: * Legacy_canonicalize_filename: manage empty filename, (gh#giuspen/cherrytree#2118) * added command line option '--anchor AnchorName' that in addition to existing '--node NodeName' allows to open a document focusing an anchor in a node. * Changed non configurable keyboard shortcuts for codebox width and table column width to use parenthesis open instead of backslash, (gh#giuspen/cherrytree#2113). * Fixed crash on double exit from systray icon right click menu, (gh#giuspen/cherrytree#2114). * Added keyboard shortcuts to toolbar tooltips, (gh#giuspen/cherrytree#2106). * Fixed export to HTML crash, (gh#giuspen/cherrytree#2109). * Force turning off portal usage since it does not work on all distros, (gh#giuspen/cherrytree#2111). * Improved dialog confirmation before executing the code. * Additonal changes for core22, (gh#giuspen/cherrytree#2110). * Allow to disable the dialog asking for confirmation before executing the code. * Fixed bulleted list unindent (Shift+Tab) crash, (gh#giuspen/cherrytree#2103). * Add home plug, (gh#giuspen/cherrytree#2101 and gh#giuspen/cherrytree#2102). * Linux menu launcher run cherrytree in a new instance, (gh#giuspen/cherrytree#2077). * Fixed crash on print/export as pdf of a sequence of characters without spaces longer that the page width, such as a very long URL, (gh#giuspen/cherrytree#2045). * Fixed wrongly entering column mode when using keyboard shortcuts with <Ctrl><Alt> such as insert codebox, (gh#giuspen/cherrytree#2075). * Added syntax highlighting support for GDScript. * Fixed tooltip and cursor not reset after hovering link and then navigating to non rich text node. * Support for accent insensitive search - added letters with subordinate dots, (gh#giuspen/cherrytree#1981). * Translation updates. - Developer advised fixed cross-site scripting (XSS) vulnerability that allows attackers to execute arbitrary web scripts or HTML via a crafted payload injected into the Name text field when creating a node, (boo#1202513, gh#giuspen/cherrytree#2099 and CVE-2022-35133). Update to version 0.99.48: * Added support for right to left languages in export to html and pdf (gh#giuspen/cherrytree#2044, gh#giuspen/cherrytree#1668 and gh#giuspen/cherrytree# #698). * In order to support the right to left languages in export to html, the resulting html text lines are no longer LINE<br/> but <p>LINE</p>. * Fixed in export to pdf the link to node+anchor with non ascii anchor name. * Improved detection of missing executables required for rendering LatexBoxes. These dependencies are no longer mandatory (gh#giuspen/cherrytree#2033). * Added help to the user to show again a hidden menubar (gh#giuspen/cherrytree#1927 and gh#giuspen/cherrytree#2054). * Pressing Tab on the very latest table cell now adds a new table line and moves to its first cell. * Fixed issue with relative links to files and folders and documents moved between linux and windows. * In export to html and txt multiple files, now appending the node id to the file names to support multiple nodes with the same name. * Added syntax highlight support for solidity (gh#giuspen/cherrytree#2030). * After issues with the domain giuspen.com, the domain changed to giuspen.net and giuspen.com will eventually go. Update to version 0.99.47+2: * Added support for latex math equations. * Added copy/paste of tree nodes and subnodes between multiple opened files. * Restored support for drag and drop of text selection. Now rich text content is preserved. * Added syntax highlighting for HCL. * Fixed issue at reset toolbar in preferences dialog when menubar in titlebar. * Added command line option (-S/--secondary_session) to run in isolation from a possibly already running main instance. * Updated flatpak script. Update to version 0.99.46+6: * Fixed time created/modified filter on searches for node name and tags. * Changed default keyboard shortcuts using Ctrl+Period to Ctrl+Backslash for clash with latest linux desktops. * Fixed restore window position on Windows and dual screen. * Added strip trailing spaces action to rich text right click menu. * Fixed issue restoring hpaned tree/text position with tree on the right. * Added command line option to pass the password to open an encrypted document. Update to version 0.99.45+10: * added language Arabic * fixed time created/modified filter on searches for node name and tags * just ninja build debug print * added strip trailing spaces action to rich text right click menu * minor improvement to previous commit * fixed copy fromm codebox and pasting to rich text unwanted additional characters Patch Instructions: To install this openSUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Backports SLE-15-SP4: zypper in -t patch openSUSE-2022-10230=1 Package List: - openSUSE Backports SLE-15-SP4 (aarch64 s390x x86_64): cherrytree-0.99.49+3-bp154.2.3.2 - openSUSE Backports SLE-15-SP4 (noarch): cherrytree-lang-0.99.49+3-bp154.2.3.2 References: https://www.suse.com/security/cve/CVE-2022-35133.html https://bugzilla.suse.com/1202513

1 0

openSUSE-RU-2022:10228-1: moderate: Recommended update for rxvt-unicode
by maintenance＠opensuse.org 03 Dec '22

03 Dec '22

openSUSE Recommended Update: Recommended update for rxvt-unicode ______________________________________________________________________________ Announcement ID: openSUSE-RU-2022:10228-1 Rating: moderate References: Affected Products: openSUSE Backports SLE-15-SP3 ______________________________________________________________________________ An update that has 0 recommended fixes can now be installed. Description: This update for rxvt-unicode fixes the following issues: Update to version 9.30: * the background extension did not initialise properly when automatically loaded via the OSC. * new "on_attach" hook type implemented, to initialise late-loading extensions. Update to version 9.29: * libptytty (http://dist.schmorp.de/libptytty/) is now a required external dependency. * enable confirm-paste extension by default, can be disabled by e.g. URxvt.perl-ext: -confirm-paste * Key bindings specified with the -keysym option or with resources of the form URxvt*keysym work again. Such resources, as opposed to * resources of the form URxvt.keysym, were not officially allowed but accepted, so ignoring them is considered a regression. * new option/resource -rm/rewrapMode, which sets the line rewrap mode to auto, never or always. * new option/resource -dpb/disablePasteBrackets, which can be used to disable bracketed paste mode sequences, as more and more programs * abuse these sequences (typically in the name of security, but these sequences are not improving security). Also, bracketed paste mode is now under frills. * add manpage for urclock. * confirm-paste wrongly considered brackets as ctrlchars (patch by Jakub Wilk, debian bug #995244). * if urxvt cannot detect a good estimate for font width (because a font does not contain latin characters at all for example), it will now fall back to xft's max_advance_width, which works well with some fonts. It currently will warn about this. * do not render variation selectors in the default font as boxes, treat them as zero-width characters. * change combining character architecture to allow fonts to handle combining sequences on their own. This could allow future renderers to be more intelligent about these sequences. * use the previous enhancement to allow unicode characters outside of the BMP to be rendered even without --enable-unicode3, as long as an xft with the character is configured. * It's recommended to stay with disabled unicode3 even more now. * freetype/xft have been verified to return nonsensical offsets for combining characters. urxvt tries to compensate to some extent, but diacritics will be slightly off in many cases, and far off in some cases (e.g. input mono). * when checking for overlap/careful handling, take non-basefont character shifts into account. * extensions can now request autoloading on OSC and Perl OSC sequences, implement this for the background, clipboard-osc and overlay-osc extensions. * the background extension will now be autoloaded when the OSC 20 or 705 sequence is received. * added OSC 776 sequence to return character cell width, height and font ascent, which is useful when using urxvt as slave to calculate window size form or to row/column count. * matcher extension documentation now points out some requirements for regular expressions. the default url matching regex will now try to match IRLs in addition to URLs. * The view_start perl method now scrolls to the bottom also when the argument is greater than 0. * eval scroll actions now scroll to the bottom when scrolling down and there are less lines to scroll than the ones requested (reported by Stephen Talley). * allow perl-ext and perl-ext-common to override autoloaded extensions. this allows tabbed to disable itself in subtabs, avoiding recursive loading. * update precompose table to unicode 13.0. * update charset conversion tables to perl 5.32 (this only affected cs_koi8_u_from_unicode). * unicode characters > 0x100000 were not handled correctly w.r.t. font rendering. * replace bitstream vera by dejavu sans, as it has replaced the former almost everywhere. * urxvt will now try tic -x first and only fall back to tic without -x when tic -x fails. * fix urclock not erasing the old date on the clock face, causing overdraw, plus a host of other small fixes and improvements. * shave off over 1K of code size from urclock by replacing the sine table with a slightly less accurate fixed point approximation. * do not specify indentation with =over in pod, this is no longer needed with semi-modern pod tools and gives the formatter more stylistic freedom. * background extension did not set the "size-sensitive" flag when repeat mode wasn't normal. * extensions are now subjected to "use strict 'subs'". * avoid crashing when xft successfully opens a font but then somehow can't lock the face. * locale_decode/encode api methods now pass through undef unchanged. * fix undefined behaviour in the perl hook function, as diagnosed by clang. Patch Instructions: To install this openSUSE Recommended Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Backports SLE-15-SP3: zypper in -t patch openSUSE-2022-10228=1 Package List: - openSUSE Backports SLE-15-SP3 (aarch64 i586 ppc64le s390x x86_64): libptytty-debugsource-2.0-bp153.2.1 libptytty-devel-2.0-bp153.2.1 libptytty0-2.0-bp153.2.1 libptytty0-debuginfo-2.0-bp153.2.1 rxvt-unicode-9.30-bp153.2.6.1 References:

1 0