March 2022 - openSUSE Updates - openSUSE Mailing Lists

openSUSE-RU-2022:1047-1: moderate: Recommended update for pam
by maintenance＠opensuse.org 30 Mar '22

30 Mar '22

openSUSE Recommended Update: Recommended update for pam ______________________________________________________________________________ Announcement ID: openSUSE-RU-2022:1047-1 Rating: moderate References: #1196093 #1197024 Affected Products: openSUSE Leap 15.3 openSUSE Leap 15.4 ______________________________________________________________________________ An update that has two recommended fixes can now be installed. Description: This update for pam fixes the following issues: - Define _pam_vendordir as the variable is needed by systemd and others. (bsc#1196093) - Between allocating the variable "ai" and free'ing them, there are two "return NO" were we don't free this variable. This patch inserts freaddrinfo() calls before the "return NO;"s. (bsc#1197024) Patch Instructions: To install this openSUSE Recommended Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 15.4: zypper in -t patch openSUSE-SLE-15.4-2022-1047=1 - openSUSE Leap 15.3: zypper in -t patch openSUSE-SLE-15.3-2022-1047=1 Package List: - openSUSE Leap 15.4 (aarch64 ppc64le s390x x86_64): pam-1.3.0-150000.6.55.3 pam-debuginfo-1.3.0-150000.6.55.3 pam-debugsource-1.3.0-150000.6.55.3 pam-devel-1.3.0-150000.6.55.3 pam-extra-1.3.0-150000.6.55.3 pam-extra-debuginfo-1.3.0-150000.6.55.3 - openSUSE Leap 15.4 (x86_64): pam-32bit-1.3.0-150000.6.55.3 pam-32bit-debuginfo-1.3.0-150000.6.55.3 pam-devel-32bit-1.3.0-150000.6.55.3 pam-extra-32bit-1.3.0-150000.6.55.3 pam-extra-32bit-debuginfo-1.3.0-150000.6.55.3 - openSUSE Leap 15.4 (noarch): pam-doc-1.3.0-150000.6.55.3 - openSUSE Leap 15.3 (aarch64 ppc64le s390x x86_64): pam-1.3.0-150000.6.55.3 pam-debuginfo-1.3.0-150000.6.55.3 pam-debugsource-1.3.0-150000.6.55.3 pam-devel-1.3.0-150000.6.55.3 pam-extra-1.3.0-150000.6.55.3 pam-extra-debuginfo-1.3.0-150000.6.55.3 - openSUSE Leap 15.3 (noarch): pam-doc-1.3.0-150000.6.55.3 - openSUSE Leap 15.3 (x86_64): pam-32bit-1.3.0-150000.6.55.3 pam-32bit-debuginfo-1.3.0-150000.6.55.3 pam-devel-32bit-1.3.0-150000.6.55.3 pam-extra-32bit-1.3.0-150000.6.55.3 pam-extra-32bit-debuginfo-1.3.0-150000.6.55.3 References: https://bugzilla.suse.com/1196093 https://bugzilla.suse.com/1197024

1 0

openSUSE-SU-2022:1061-1: important: Security update for zlib
by opensuse-security＠opensuse.org 30 Mar '22

30 Mar '22

openSUSE Security Update: Security update for zlib ______________________________________________________________________________ Announcement ID: openSUSE-SU-2022:1061-1 Rating: important References: #1197459 Cross-References: CVE-2018-25032 CVSS scores: CVE-2018-25032 (SUSE): 8.1 CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H Affected Products: openSUSE Leap 15.3 openSUSE Leap 15.4 ______________________________________________________________________________ An update that fixes one vulnerability is now available. Description: This update for zlib fixes the following issues: - CVE-2018-25032: Fixed memory corruption on deflate (bsc#1197459). Patch Instructions: To install this openSUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 15.4: zypper in -t patch openSUSE-SLE-15.4-2022-1061=1 - openSUSE Leap 15.3: zypper in -t patch openSUSE-SLE-15.3-2022-1061=1 Package List: - openSUSE Leap 15.4 (aarch64 ppc64le s390x x86_64): libminizip1-1.2.11-150000.3.30.1 libminizip1-debuginfo-1.2.11-150000.3.30.1 libz1-1.2.11-150000.3.30.1 libz1-debuginfo-1.2.11-150000.3.30.1 minizip-devel-1.2.11-150000.3.30.1 zlib-debugsource-1.2.11-150000.3.30.1 zlib-devel-1.2.11-150000.3.30.1 zlib-devel-static-1.2.11-150000.3.30.1 - openSUSE Leap 15.4 (x86_64): libminizip1-32bit-1.2.11-150000.3.30.1 libminizip1-32bit-debuginfo-1.2.11-150000.3.30.1 libz1-32bit-1.2.11-150000.3.30.1 libz1-32bit-debuginfo-1.2.11-150000.3.30.1 zlib-devel-32bit-1.2.11-150000.3.30.1 zlib-devel-static-32bit-1.2.11-150000.3.30.1 - openSUSE Leap 15.3 (aarch64 ppc64le s390x x86_64): libminizip1-1.2.11-150000.3.30.1 libminizip1-debuginfo-1.2.11-150000.3.30.1 libz1-1.2.11-150000.3.30.1 libz1-debuginfo-1.2.11-150000.3.30.1 minizip-devel-1.2.11-150000.3.30.1 zlib-debugsource-1.2.11-150000.3.30.1 zlib-devel-1.2.11-150000.3.30.1 zlib-devel-static-1.2.11-150000.3.30.1 - openSUSE Leap 15.3 (x86_64): libminizip1-32bit-1.2.11-150000.3.30.1 libminizip1-32bit-debuginfo-1.2.11-150000.3.30.1 libz1-32bit-1.2.11-150000.3.30.1 libz1-32bit-debuginfo-1.2.11-150000.3.30.1 zlib-devel-32bit-1.2.11-150000.3.30.1 zlib-devel-static-32bit-1.2.11-150000.3.30.1 References: https://www.suse.com/security/cve/CVE-2018-25032.html https://bugzilla.suse.com/1197459

1 0

openSUSE-RU-2022:0093-1: important: Recommended update for helm
by maintenance＠opensuse.org 30 Mar '22

30 Mar '22

openSUSE Recommended Update: Recommended update for helm ______________________________________________________________________________ Announcement ID: openSUSE-RU-2022:0093-1 Rating: important References: #1192489 SLE-21196 Affected Products: openSUSE Backports SLE-15-SP3 openSUSE Leap 15.3 ______________________________________________________________________________ An update that has one recommended fix and contains one feature can now be installed. Description: This update for helm fixes the following issues: Helm was updated to version 3.8.0 (jsc#SLE-21196): * OCI registry support for charts is now generally available. It has graduated out of being an experiment. Some changes over Helm 3.7 include: * When setting a chart in the dependencies as OCI the version can be set to a range, like other dependencies * SemVer tags that include build information can be pushed and used. OCI registries don't support + as a tag character. Helm translates the + to _ when stored as a tag * helm registry login now follows the same structure as the Docker CLI for storing credentials. The same location for registry configuration can be passed to both Helm and the Docker CLI * A --list-repo-url flag has been added to helm search hub to quickly show the repositories URL. * Release names are validated during installation * Added support for installing Helm on Windows via Cygwin * Added support for Kubernetes 1.23 Update to version 3.6.3: * Ensure RawPath match Path when resolving reference * Set Helm as manager for managedFields * fix(dep update): helm dep update is not respecting the "version" stipulated in the requirements * fix(doc): fix kube client interface doc. (#9882) * use TLS client information from repo config when downloading a chart * Adding test for user/pass without repo on Helm install * Fix the url being set by WithURL on the getters * tweak basic handling * keep existing behavior of returning ErrReleaseNotFound when release(s) failed to decode * fix(sql storage): Query() should return ErrReleaseNotFound immediately when no records are found * Add Test cases for repository-config without file extension * Correctly determine repository-config lockfile path * Fixed Test * Added test for lint mode * Fail message is now the same as the required message. Fixed #8973 Helm function 'fail' should not fail when doing 'helm lint' * fix helm dep build/update doesn't inherit --insecure-skip-tls-verify from helm repo add Update to version 3.6.2: * Fix the url being set by WithURL on the getters * Adding test for user/pass without repo on Helm install Update to version 3.6.1: * tweak basic handling Update to version 3.6.0: * bump version to v3.6.0 * chore: update testdata to use the new ingress template * feat: add networking.k8s.io/v1 support to ingress template * Moving myself to maintainer emeritus * upgrade to kubernetes 1.21 * Fix capabilities changes leaking into other tests * Add tests for template --kube-version * feat(helm): Support setting --kube-version * fix(ci) update ci to use main branch * Update references to default branch name as it has changed to main * Add ReadyChecker to decouple ready check logic from --wait * chore(deps): Bump github.com/deislabs/oras from v0.10.0 to v0.11.1 and drop replace * Add/update deprecation notices * Wrap validation error instead of recreating * Move default to avoid nil check * Add name validation rules for object kinds * Improve description for version flag. * chore: Spelling (#9410) * chore(deps): Bump k8s.io/klog/v2 from 2.5.0 to 2.8.0 * chore(deps): Bump github.com/containerd/containerd from 1.4.3 to 1.4.4 * chore(deps): Bump github.com/lib/pq from 1.9.0 to 1.10.0 * Bump github.com/spf13/cobra from 1.1.1 to 1.1.3 * Cleanup mpodule dependencies * feat(comp): Uninstall accepts multiple releases * new key for technosophos (#9478) * chore(deps): Bump github.com/sirupsen/logrus from 1.7.0 to 1.8.1 * add flag trimpath in the go build command * stick to 0.20.4 * updated unit tests to conform with helm best practices * corrected order of helm lint coalescing of multiple values files * upgrade to v0.21.0-beta.0 * Fix the example for --time-format flag * Use kube libraries v0.20.4 * Added s390x support to get script * add test to ensure OCIGetter registryClient is set * initialize registry client in oci getter * feat(comp): Add descriptions for output format * feat(comp): Add descriptions for --version comp * feat(comp): Add descriptions for revision comp * feat(comp): Add descriptions for kube-context comp * feat(comp): Add descriptions for plugin completion * feat(comp): Add descriptions for release name comp * feat(comp): Improve completion for plugin commands * fix(cmd): Show that flags can be used for zsh/fish * use relative linking * formatting * more words * keep it concise * docs(CONTRIBUTING): writing a HIP * update test expectation for new template error string * Add darwin/arm64 (Apple Silicon) support * fix windows tests * fix(test): Increase golangci-lint timeout * fix(helm): get/get-helm-3 whitespace support in runAsRoot * fix release sha256 * feat(comp): Completion for the docs --type flag * Bump github.com/jmoiron/sqlx from 1.2.0 to 1.3.1 * Updating golangci-lint to 1.36.0 * chore(go.mod): bump Masterminds/{spring,goutils} and deislabs/oras * fix(*): Validate metadata semver and printable characters * Bump github.com/mitchellh/copystructure from 1.0.0 to 1.1.1 * closes #9312 * Fix-9253: Change the deprecated charts repo URL in release notes * Fix `helm list --offset` cli help string * Define GPG_PUBRING to make pubring configurable * Bump github.com/mattn/go-shellwords from 1.0.10 to 1.0.11 * Bump k8s.io/klog/v2 from 2.4.0 to 2.5.0 * Upgrade to oras v0.9.0 (#9269) * use kube libraries v0.20.2 * print warning message instead of debug message when ~/.config exists but is not accessible * Update default ingress values section to correspond with template * chore(Makefile): add target to generate golden files * Fix dep build with OCI based charts * Fix typo in comment * bump version to * fix(Makefile): rebuild the binary if go.mod has changed * fix(pkg/storage): If storage.Create fails to clean up recent release versions, return an error * test(pkg/storage): Verify that storage.Create returns an error if it fails to clean up least-recent release versions * Bump github.com/containerd/containerd from 1.3.4 to 1.4.3 * Improve the console output for resource policy keep to align with helm2. Update to version 3.5.4: * Add/update deprecation notices * Wrap validation error instead of recreating * Move default to avoid nil check * Add name validation rules for object kinds * Use kube libraries v0.20.4 Update to version 3.5.3: * Fix the example for --time-format flag * Improve the console output for resource policy keep to align with helm2. * test(pkg/storage): Verify that storage.Create returns an error if it fails to clean up least-recent release versions * fix(pkg/storage): If storage.Create fails to clean up recent release versions, return an error * fix(test): Increase golangci-lint timeout * fix release sha256 * Fix-9253: Change the deprecated charts repo URL in release notes * Update default ingress values section to correspond with template * use kube libraries v0.20.2 Patch Instructions: To install this openSUSE Recommended Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 15.3: zypper in -t patch openSUSE-SLE-15.3-2022-93=1 - openSUSE Backports SLE-15-SP3: zypper in -t patch openSUSE-2022-93=1 Package List: - openSUSE Leap 15.3 (aarch64 ppc64le s390x x86_64): libopenssl-1_1-devel-1.1.1d-11.38.1 libopenssl1_1-1.1.1d-11.38.1 libopenssl1_1-debuginfo-1.1.1d-11.38.1 libopenssl1_1-hmac-1.1.1d-11.38.1 openssl-1_1-1.1.1d-11.38.1 openssl-1_1-debuginfo-1.1.1d-11.38.1 openssl-1_1-debugsource-1.1.1d-11.38.1 - openSUSE Leap 15.3 (noarch): openssl-1_1-doc-1.1.1d-11.38.1 - openSUSE Leap 15.3 (x86_64): libopenssl-1_1-devel-32bit-1.1.1d-11.38.1 libopenssl1_1-32bit-1.1.1d-11.38.1 libopenssl1_1-32bit-debuginfo-1.1.1d-11.38.1 libopenssl1_1-hmac-32bit-1.1.1d-11.38.1 - openSUSE Backports SLE-15-SP3 (i586 ppc64le s390x x86_64): helm-3.8.0-bp153.2.3.4 - openSUSE Backports SLE-15-SP3 (noarch): helm-bash-completion-3.8.0-bp153.2.3.4 helm-fish-completion-3.8.0-bp153.2.3.4 helm-zsh-completion-3.8.0-bp153.2.3.4 References: https://bugzilla.suse.com/1192489

1 0

openSUSE-SU-2022:1059-1: important: Security update for salt
by opensuse-security＠opensuse.org 30 Mar '22

30 Mar '22

openSUSE Security Update: Security update for salt ______________________________________________________________________________ Announcement ID: openSUSE-SU-2022:1059-1 Rating: important References: #1197417 Cross-References: CVE-2022-22934 CVE-2022-22935 CVE-2022-22936 CVE-2022-22941 CVSS scores: CVE-2022-22934 (SUSE): 7.5 CVSS:3.1/AV:A/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H CVE-2022-22935 (SUSE): 6.5 CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H CVE-2022-22936 (SUSE): 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H CVE-2022-22941 (SUSE): 7.5 CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H Affected Products: openSUSE Leap 15.3 ______________________________________________________________________________ An update that fixes four vulnerabilities is now available. Description: This update for salt fixes the following issues: - CVE-2022-22935: Sign authentication replies to prevent MiTM (bsc#1197417) - CVE-2022-22934: Sign pillar data to prevent MiTM attacks. (bsc#1197417) - CVE-2022-22936: Prevent job and fileserver replays (bsc#1197417) - CVE-2022-22941: Fixed targeting bug, especially visible when using syndic and user auth. (bsc#1197417) Patch Instructions: To install this openSUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 15.3: zypper in -t patch openSUSE-SLE-15.3-2022-1059=1 Package List: - openSUSE Leap 15.3 (aarch64 ppc64le s390x x86_64): python3-salt-3002.2-150300.53.10.1 salt-3002.2-150300.53.10.1 salt-api-3002.2-150300.53.10.1 salt-cloud-3002.2-150300.53.10.1 salt-doc-3002.2-150300.53.10.1 salt-master-3002.2-150300.53.10.1 salt-minion-3002.2-150300.53.10.1 salt-proxy-3002.2-150300.53.10.1 salt-ssh-3002.2-150300.53.10.1 salt-standalone-formulas-configuration-3002.2-150300.53.10.1 salt-syndic-3002.2-150300.53.10.1 salt-transactional-update-3002.2-150300.53.10.1 - openSUSE Leap 15.3 (noarch): salt-bash-completion-3002.2-150300.53.10.1 salt-fish-completion-3002.2-150300.53.10.1 salt-zsh-completion-3002.2-150300.53.10.1 References: https://www.suse.com/security/cve/CVE-2022-22934.html https://www.suse.com/security/cve/CVE-2022-22935.html https://www.suse.com/security/cve/CVE-2022-22936.html https://www.suse.com/security/cve/CVE-2022-22941.html https://bugzilla.suse.com/1197417

1 0

openSUSE-RU-2022:1046-1: moderate: Recommended update for firewalld
by maintenance＠opensuse.org 30 Mar '22

30 Mar '22

openSUSE Recommended Update: Recommended update for firewalld ______________________________________________________________________________ Announcement ID: openSUSE-RU-2022:1046-1 Rating: moderate References: #1191837 Affected Products: openSUSE Leap 15.3 ______________________________________________________________________________ An update that has one recommended fix can now be installed. Description: This update for firewalld fixes the following issues: - Fixed ability to setting the default zone to external during installation (bsc#1191837) Patch Instructions: To install this openSUSE Recommended Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 15.3: zypper in -t patch openSUSE-SLE-15.3-2022-1046=1 Package List: - openSUSE Leap 15.3 (noarch): firewall-applet-0.9.3-150300.3.3.1 firewall-config-0.9.3-150300.3.3.1 firewall-macros-0.9.3-150300.3.3.1 firewalld-0.9.3-150300.3.3.1 firewalld-lang-0.9.3-150300.3.3.1 python3-firewall-0.9.3-150300.3.3.1 References: https://bugzilla.suse.com/1191837

1 0

openSUSE-RU-2022:0094-1: moderate: Recommended update for kiwi-templates-JeOS
by maintenance＠opensuse.org 30 Mar '22

30 Mar '22

openSUSE Recommended Update: Recommended update for kiwi-templates-JeOS ______________________________________________________________________________ Announcement ID: openSUSE-RU-2022:0094-1 Rating: moderate References: #1194484 Affected Products: openSUSE Leap 15.3 ______________________________________________________________________________ An update that has one recommended fix can now be installed. Description: This update for kiwi-templates-JeOS fixes the following issues: - Add rw to the default boot options to fix /etc/machine-id setup (boo#1194484, see also gh#OSInside/kiwi#1650) - Don't delete the dbus machine-id, it's a symlink Patch Instructions: To install this openSUSE Recommended Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 15.3: zypper in -t patch openSUSE-2022-94=1 Package List: - openSUSE Leap 15.3 (noarch): kiwi-templates-JeOS-15.3-lp153.7.3.1 References: https://bugzilla.suse.com/1194484

1 0

openSUSE-SU-2022:1037-1: important: Security update for the Linux Kernel
by opensuse-security＠opensuse.org 30 Mar '22

30 Mar '22

openSUSE Security Update: Security update for the Linux Kernel ______________________________________________________________________________ Announcement ID: openSUSE-SU-2022:1037-1 Rating: important References: #1176447 #1176774 #1178134 #1179439 #1181147 #1191428 #1192273 #1193731 #1193787 #1193864 #1194463 #1194516 #1195211 #1195254 #1195403 #1195612 #1195897 #1195905 #1195939 #1195949 #1195987 #1196079 #1196095 #1196132 #1196155 #1196299 #1196301 #1196433 #1196468 #1196472 #1196627 #1196723 #1196779 #1196830 #1196836 #1196866 #1196868 Cross-References: CVE-2021-0920 CVE-2021-39657 CVE-2021-44879 CVE-2022-0487 CVE-2022-0617 CVE-2022-0644 CVE-2022-24448 CVE-2022-24958 CVE-2022-24959 CVE-2022-25258 CVE-2022-25636 CVE-2022-26490 CVSS scores: CVE-2021-0920 (NVD) : 6.4 CVSS:3.1/AV:L/AC:H/PR:H/UI:N/S:U/C:H/I:H/A:H CVE-2021-0920 (SUSE): 7.8 CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H CVE-2021-39657 (SUSE): 3.3 CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L CVE-2021-44879 (NVD) : 5.5 CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H CVE-2021-44879 (SUSE): 5.5 CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H CVE-2022-0487 (NVD) : 5.5 CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N CVE-2022-0487 (SUSE): 7 CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H CVE-2022-0617 (NVD) : 5.5 CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H CVE-2022-0617 (SUSE): 5.5 CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H CVE-2022-0644 (SUSE): 5.5 CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H CVE-2022-24448 (NVD) : 3.3 CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N CVE-2022-24448 (SUSE): 5.5 CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N CVE-2022-24958 (NVD) : 7.8 CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H CVE-2022-24958 (SUSE): 5.5 CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H CVE-2022-24959 (NVD) : 5.5 CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H CVE-2022-24959 (SUSE): 5.5 CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H CVE-2022-25258 (NVD) : 4.6 CVSS:3.1/AV:P/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H CVE-2022-25258 (SUSE): 7.8 CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H CVE-2022-25636 (NVD) : 7.8 CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H CVE-2022-25636 (SUSE): 7.8 CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H CVE-2022-26490 (NVD) : 7.8 CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H CVE-2022-26490 (SUSE): 6.8 CVSS:3.1/AV:A/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:H Affected Products: openSUSE Leap 15.3 ______________________________________________________________________________ An update that solves 12 vulnerabilities and has 25 fixes is now available. Description: The SUSE Linux Enterprise 15 SP3 kernel was updated to receive various security and bugfixes. The following security bugs were fixed: - CVE-2022-25636: Fixed an issue which allowed a local users to gain privileges because of a heap out-of-bounds write in nf_dup_netdev.c, related to nf_tables_offload (bsc#1196299). - CVE-2022-26490: Fixed a buffer overflow in the st21nfca driver. An attacker with adjacent NFC access could trigger crash the system or corrupt system memory (bsc#1196830). - CVE-2022-0487: A use-after-free vulnerability was found in rtsx_usb_ms_drv_remove() in drivers/memstick/host/rtsx_usb_ms.c (bsc#1194516). - CVE-2022-24448: Fixed an issue if an application sets the O_DIRECTORY flag, and tries to open a regular file, nfs_atomic_open() performs a regular lookup. If a regular file is found, ENOTDIR should have occured, but the server instead returned uninitialized data in the file descriptor (bsc#1195612). - CVE-2022-0617: Fixed a null pointer dereference in UDF file system functionality. A local user could crash the system by triggering udf_file_write_iter() via a malicious UDF image. (bsc#1196079) - CVE-2022-0644: Fixed a denial of service by a local user. A assertion failure could be triggered in kernel_read_file_from_fd(). (bsc#1196155) - CVE-2022-25258: The USB Gadget subsystem lacked certain validation of interface OS descriptor requests, which could have lead to memory corruption (bsc#1196096). - CVE-2022-24958: drivers/usb/gadget/legacy/inode.c mishandled dev->buf release (bsc#1195905). - CVE-2022-24959: Fixed a memory leak in yam_siocdevprivate() in drivers/net/hamradio/yam.c (bsc#1195897). - CVE-2021-44879: In gc_data_segment() in fs/f2fs/gc.c, special files were not considered, which lead to a move_data_page NULL pointer dereference (bsc#1195987). - CVE-2021-0920: Fixed a local privilege escalation due to a use-after-free vulnerability in unix_scm_to_skb of af_unix (bsc#1193731). - CVE-2021-39657: Fixed an information leak in the Universal Flash Storage subsystem (bsc#1193864). The following non-security bugs were fixed: - ALSA: intel_hdmi: Fix reference to PCM buffer address (git-fixes). - ARM: 9182/1: mmu: fix returns from early_param() and __setup() functions (git-fixes). - ARM: Fix kgdb breakpoint for Thumb2 (git-fixes). - ASoC: cs4265: Fix the duplicated control name (git-fixes). - ASoC: ops: Shift tested values in snd_soc_put_volsw() by +min (git-fixes). - ASoC: rt5668: do not block workqueue if card is unbound (git-fixes). - ASoC: rt5682: do not block workqueue if card is unbound (git-fixes). - Bluetooth: btusb: Add missing Chicony device for Realtek RTL8723BE (bsc#1196779). - EDAC/altera: Fix deferred probing (bsc#1178134). - HID: add mapping for KEY_ALL_APPLICATIONS (git-fixes). - HID: add mapping for KEY_DICTATE (git-fixes). - Hand over the maintainership to SLE15-SP3 maintainers - IB/hfi1: Correct guard on eager buffer deallocation (git-fixes). - IB/hfi1: Fix early init panic (git-fixes). - IB/hfi1: Fix leak of rcvhdrtail_dummy_kvaddr (git-fixes). - IB/hfi1: Insure use of smp_processor_id() is preempt disabled (git-fixes). - IB/rdmavt: Validate remote_addr during loopback atomic tests (git-fixes). - Input: clear BTN_RIGHT/MIDDLE on buttonpads (git-fixes). - Input: elan_i2c - fix regulator enable count imbalance after suspend/resume (git-fixes). - Input: elan_i2c - move regulator_[en|dis]able() out of elan_[en|dis]able_power() (git-fixes). - RDMA/bnxt_re: Scan the whole bitmap when checking if "disabling RCFW with pending cmd-bit" (git-fixes). - RDMA/cma: Do not change route.addr.src_addr outside state checks (bsc#1181147). - RDMA/cma: Let cma_resolve_ib_dev() continue search even after empty entry (git-fixes). - RDMA/cma: Remove open coding of overflow checking for private_data_len (git-fixes). - RDMA/core: Do not infoleak GRH fields (git-fixes). - RDMA/core: Let ib_find_gid() continue search even after empty entry (git-fixes). - RDMA/cxgb4: Set queue pair state when being queried (git-fixes). - RDMA/hns: Validate the pkey index (git-fixes). - RDMA/ib_srp: Fix a deadlock (git-fixes). - RDMA/mlx4: Do not continue event handler after memory allocation failure (git-fixes). - RDMA/rtrs-clt: Fix possible double free in error case (jsc#SLE-15176). - RDMA/rxe: Fix a typo in opcode name (git-fixes). - RDMA/siw: Fix broken RDMA Read Fence/Resume logic (git-fixes). - RDMA/uverbs: Check for null return of kmalloc_array (git-fixes). - RDMA/uverbs: Remove the unnecessary assignment (git-fixes). - Revert "USB: serial: ch341: add new Product ID for CH341A" (git-fixes). - SUNRPC: avoid race between mod_timer() and del_timer_sync() (bnc#1195403). - USB: gadget: validate endpoint index for xilinx udc (git-fixes). - USB: gadget: validate interface OS descriptor requests (git-fixes). - USB: hub: Clean up use of port initialization schemes and retries (git-fixes). - USB: serial: option: add Telit LE910R1 compositions (git-fixes). - USB: serial: option: add support for DW5829e (git-fixes). - USB: zaurus: support another broken Zaurus (git-fixes). - arm64: dts: rockchip: Switch RK3399-Gru DP to SPDIF output (git-fixes). - asix: fix uninit-value in asix_mdio_read() (git-fixes). - ata: pata_hpt37x: disable primary channel on HPT371 (git-fixes). - batman-adv: Do not expect inter-netns unique iflink indices (git-fixes). - batman-adv: Request iflink once in batadv-on-batadv check (git-fixes). - batman-adv: Request iflink once in batadv_get_real_netdevice (git-fixes). - blk-mq: do not free tags if the tag_set is used by other device in queue initialztion (bsc#1193787). - bnxt_en: Fix active FEC reporting to ethtool (jsc#SLE-16649). - bnxt_en: Fix incorrect multicast rx mask setting when not requested (git-fixes). - bnxt_en: Fix occasional ethtool -t loopback test failures (git-fixes). - bnxt_en: Fix offline ethtool selftest with RDMA enabled (git-fixes). - bonding: force carrier update when releasing slave (git-fixes). - can: gs_usb: change active_channels's type from atomic_t to u8 (git-fixes). - cgroup-v1: Correct privileges check in release_agent writes (bsc#1196723). - cgroup/cpuset: Fix "suspicious RCU usage" lockdep warning (bsc#1196868). - clk: jz4725b: fix mmc0 clock gating (git-fixes). - cpufreq: schedutil: Use kobject release() method to free (git-fixes) - cpuset: Fix the bug that subpart_cpus updated wrongly in update_cpumask() (bsc#1196866). - cputime, cpuacct: Include guest time in user time in (git-fixes) - dma-direct: Fix potential NULL pointer dereference (bsc#1196472 ltc#192278). - dma-mapping: Allow mixing bypass and mapped DMA operation (bsc#1196472 ltc#192278). - dmaengine: shdma: Fix runtime PM imbalance on error (git-fixes). - drm/amdgpu: disable MMHUB PG for Picasso (git-fixes). - drm/edid: Always set RGB444 (git-fixes). - drm/i915/dg1: Wait for pcode/uncore handshake at startup (bsc#1195211). - drm/i915/gen11+: Only load DRAM information from pcode (bsc#1195211). - drm/i915: Nuke not needed members of dram_info (bsc#1195211). - drm/i915: Remove memory frequency calculation (bsc#1195211). - drm/i915: Rename is_16gb_dimm to wm_lv_0_adjust_needed (bsc#1195211). - efivars: Respect "block" flag in efivar_entry_set_safe() (git-fixes). - exfat: fix i_blocks for files truncated over 4 GiB (git-fixes). - exfat: fix incorrect loading of i_blocks for large files (git-fixes). - firmware: arm_scmi: Remove space in MODULE_ALIAS name (git-fixes). - gpio: rockchip: Reset int_bothedge when changing trigger (git-fixes). - gpio: tegra186: Fix chip_data type confusion (git-fixes). - gtp: remove useless rcu_read_lock() (git-fixes). - hamradio: fix macro redefine warning (git-fixes). - i2c: bcm2835: Avoid clock stretching timeouts (git-fixes). - iavf: Fix missing check for running netdev (git-fixes). - ice: initialize local variable 'tlv' (jsc#SLE-12878). - igc: igc_read_phy_reg_gpy: drop premature return (git-fixes). - igc: igc_write_phy_reg_gpy: drop premature return (git-fixes). - iio: Fix error handling for PM (git-fixes). - iio: adc: ad7124: fix mask used for setting AIN_BUFP & AIN_BUFM bits (git-fixes). - iio: adc: men_z188_adc: Fix a resource leak in an error handling path (git-fixes). - ixgbe: xsk: change !netif_carrier_ok() handling in ixgbe_xmit_zc() (git-fixes). - mac80211: fix forwarded mesh frames AC & queue selection (git-fixes). - mac80211_hwsim: initialize ieee80211_tx_info at hw_scan_work (git-fixes). - mac80211_hwsim: report NOACK frames in tx_status (git-fixes). - mask out added spinlock in rndis_params (git-fixes). - net/mlx5: Fix possible deadlock on rule deletion (git-fixes). - net/mlx5: Fix wrong limitation of metadata match on ecpf (git-fixes). - net/mlx5: Update the list of the PCI supported devices (git-fixes). - net/mlx5: Update the list of the PCI supported devices (git-fixes). - net/mlx5e: Fix modify header actions memory leak (git-fixes). - net/mlx5e: Fix page DMA map/unmap attributes (bsc#1196468). - net/mlx5e: Fix wrong return value on ioctl EEPROM query failure (git-fixes). - net/mlx5e: TC, Reject rules with drop and modify hdr action (git-fixes). - net/mlx5e: TC, Reject rules with forward and drop actions (git-fixes). - net/mlx5e: kTLS, Use CHECKSUM_UNNECESSARY for device-offloaded packets (jsc#SLE-15172). - net/sched: act_ct: Fix flow table lookup after ct clear or switching zones (jsc#SLE-15172). - net: dsa: mv88e6xxx: MV88E6097 does not support jumbo configuration (git-fixes). - net: ethernet: ti: cpsw: disable PTPv1 hw timestamping advertisement (git-fixes). - net: fix up skbs delta_truesize in UDP GRO frag_list (bsc#1176447). - net: hns3: Clear the CMDQ registers before unmapping BAR region (git-fixes). - net: sfc: Replace in_interrupt() usage (git-fixes). - net: tipc: validate domain record count on input (bsc#1195254). - net: usb: cdc_mbim: avoid altsetting toggling for Telit FN990 (git-fixes). - netfilter: nf_tables: fix memory leak during stateful obj update (bsc#1176447). - netsec: ignore 'phy-mode' device property on ACPI systems (git-fixes). - nfp: flower: Fix a potential leak in nfp_tunnel_add_shared_mac() (git-fixes). - nl80211: Handle nla_memdup failures in handle_nan_filter (git-fixes). - ntb: intel: fix port config status offset for SPR (git-fixes). - nvme-multipath: use vmalloc for ANA log buffer (bsc#1193787). - nvme-rdma: fix possible use-after-free in transport error_recovery work (git-fixes). - nvme-tcp: fix possible use-after-free in transport error_recovery work (git-fixes). - nvme: fix a possible use-after-free in controller reset during load (git-fixes). - powerpc/dma: Fallback to dma_ops when persistent memory present (bsc#1196472 ltc#192278). Update config files. - powerpc/fadump: register for fadump as early as possible (bsc#1179439 ltc#190038). - powerpc/mm: Remove dcache flush from memory remove (bsc#1196433 ltc#196449). - powerpc/powernv/memtrace: Fix dcache flushing (bsc#1196433 ltc#196449). - powerpc/pseries/iommu: Fix window size for direct mapping with pmem (bsc#1196472 ltc#192278). - sched/core: Mitigate race (git-fixes) - scsi: bnx2fc: Flush destroy_work queue before calling bnx2fc_interface_put() (git-fixes). - scsi: bnx2fc: Make bnx2fc_recv_frame() mp safe (git-fixes). - scsi: lpfc: Terminate string in lpfc_debugfs_nvmeio_trc_write() (git-fixes). - scsi: nsp_cs: Check of ioremap return value (git-fixes). - scsi: qedf: Fix potential dereference of NULL pointer (git-fixes). - scsi: smartpqi: Add PCI IDs (bsc#1196627). - scsi: ufs: Fix race conditions related to driver data (git-fixes). - selftests: mlxsw: tc_police_scale: Make test more robust (bsc#1176774). - soc: fsl: Correct MAINTAINERS database (QUICC ENGINE LIBRARY) (git-fixes). - soc: fsl: Correct MAINTAINERS database (SOC) (git-fixes). - soc: fsl: qe: Check of ioremap return value (git-fixes). - spi: spi-zynq-qspi: Fix a NULL pointer dereference in zynq_qspi_exec_mem_op() (git-fixes). - sr9700: sanity check for packet length (bsc#1196836). - tracing: Fix return value of __setup handlers (git-fixes). - tty: n_gsm: fix encoding of control signal octet bit DV (git-fixes). - tty: n_gsm: fix proper link termination after failed open (git-fixes). - usb: dwc2: use well defined macros for power_down (git-fixes). - usb: dwc3: gadget: Let the interrupt handler disable bottom halves (git-fixes). - usb: dwc3: pci: Fix Bay Trail phy GPIO mappings (git-fixes). - usb: gadget: rndis: add spinlock for rndis response list (git-fixes). - usb: hub: Fix usb enumeration issue due to address0 race (git-fixes). - vrf: Fix fast path output packet handling with async Netfilter rules (git-fixes). - xhci: Prevent futile URB re-submissions due to incorrect return value (git-fixes). - xhci: re-initialize the HC during resume if HCE was set (git-fixes). Special Instructions and Notes: Please reboot the system after installing this update. Patch Instructions: To install this openSUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 15.3: zypper in -t patch openSUSE-SLE-15.3-2022-1037=1 Package List: - openSUSE Leap 15.3 (x86_64): cluster-md-kmp-azure-5.3.18-150300.38.50.1 cluster-md-kmp-azure-debuginfo-5.3.18-150300.38.50.1 dlm-kmp-azure-5.3.18-150300.38.50.1 dlm-kmp-azure-debuginfo-5.3.18-150300.38.50.1 gfs2-kmp-azure-5.3.18-150300.38.50.1 gfs2-kmp-azure-debuginfo-5.3.18-150300.38.50.1 kernel-azure-5.3.18-150300.38.50.1 kernel-azure-debuginfo-5.3.18-150300.38.50.1 kernel-azure-debugsource-5.3.18-150300.38.50.1 kernel-azure-devel-5.3.18-150300.38.50.1 kernel-azure-devel-debuginfo-5.3.18-150300.38.50.1 kernel-azure-extra-5.3.18-150300.38.50.1 kernel-azure-extra-debuginfo-5.3.18-150300.38.50.1 kernel-azure-livepatch-devel-5.3.18-150300.38.50.1 kernel-azure-optional-5.3.18-150300.38.50.1 kernel-azure-optional-debuginfo-5.3.18-150300.38.50.1 kernel-syms-azure-5.3.18-150300.38.50.1 kselftests-kmp-azure-5.3.18-150300.38.50.1 kselftests-kmp-azure-debuginfo-5.3.18-150300.38.50.1 ocfs2-kmp-azure-5.3.18-150300.38.50.1 ocfs2-kmp-azure-debuginfo-5.3.18-150300.38.50.1 reiserfs-kmp-azure-5.3.18-150300.38.50.1 reiserfs-kmp-azure-debuginfo-5.3.18-150300.38.50.1 - openSUSE Leap 15.3 (noarch): kernel-devel-azure-5.3.18-150300.38.50.1 kernel-source-azure-5.3.18-150300.38.50.1 References: https://www.suse.com/security/cve/CVE-2021-0920.html https://www.suse.com/security/cve/CVE-2021-39657.html https://www.suse.com/security/cve/CVE-2021-44879.html https://www.suse.com/security/cve/CVE-2022-0487.html https://www.suse.com/security/cve/CVE-2022-0617.html https://www.suse.com/security/cve/CVE-2022-0644.html https://www.suse.com/security/cve/CVE-2022-24448.html https://www.suse.com/security/cve/CVE-2022-24958.html https://www.suse.com/security/cve/CVE-2022-24959.html https://www.suse.com/security/cve/CVE-2022-25258.html https://www.suse.com/security/cve/CVE-2022-25636.html https://www.suse.com/security/cve/CVE-2022-26490.html https://bugzilla.suse.com/1176447 https://bugzilla.suse.com/1176774 https://bugzilla.suse.com/1178134 https://bugzilla.suse.com/1179439 https://bugzilla.suse.com/1181147 https://bugzilla.suse.com/1191428 https://bugzilla.suse.com/1192273 https://bugzilla.suse.com/1193731 https://bugzilla.suse.com/1193787 https://bugzilla.suse.com/1193864 https://bugzilla.suse.com/1194463 https://bugzilla.suse.com/1194516 https://bugzilla.suse.com/1195211 https://bugzilla.suse.com/1195254 https://bugzilla.suse.com/1195403 https://bugzilla.suse.com/1195612 https://bugzilla.suse.com/1195897 https://bugzilla.suse.com/1195905 https://bugzilla.suse.com/1195939 https://bugzilla.suse.com/1195949 https://bugzilla.suse.com/1195987 https://bugzilla.suse.com/1196079 https://bugzilla.suse.com/1196095 https://bugzilla.suse.com/1196132 https://bugzilla.suse.com/1196155 https://bugzilla.suse.com/1196299 https://bugzilla.suse.com/1196301 https://bugzilla.suse.com/1196433 https://bugzilla.suse.com/1196468 https://bugzilla.suse.com/1196472 https://bugzilla.suse.com/1196627 https://bugzilla.suse.com/1196723 https://bugzilla.suse.com/1196779 https://bugzilla.suse.com/1196830 https://bugzilla.suse.com/1196836 https://bugzilla.suse.com/1196866 https://bugzilla.suse.com/1196868

1 0

openSUSE-SU-2022:1039-1: important: Security update for the Linux Kernel
by opensuse-security＠opensuse.org 30 Mar '22

30 Mar '22

openSUSE Security Update: Security update for the Linux Kernel ______________________________________________________________________________ Announcement ID: openSUSE-SU-2022:1039-1 Rating: important References: #1176447 #1176774 #1178134 #1179439 #1181147 #1191428 #1192273 #1193731 #1193787 #1193864 #1194463 #1194516 #1194943 #1195051 #1195211 #1195254 #1195353 #1195403 #1195612 #1195897 #1195905 #1195939 #1195949 #1195987 #1196079 #1196095 #1196130 #1196132 #1196155 #1196299 #1196301 #1196433 #1196468 #1196472 #1196488 #1196627 #1196723 #1196779 #1196830 #1196836 #1196866 #1196868 #1196956 #1196959 Cross-References: CVE-2021-0920 CVE-2021-39657 CVE-2021-39698 CVE-2021-44879 CVE-2021-45402 CVE-2022-0487 CVE-2022-0617 CVE-2022-0644 CVE-2022-23036 CVE-2022-23037 CVE-2022-23038 CVE-2022-23039 CVE-2022-23040 CVE-2022-23041 CVE-2022-23042 CVE-2022-24448 CVE-2022-24958 CVE-2022-24959 CVE-2022-25258 CVE-2022-25636 CVE-2022-26490 CVE-2022-26966 CVSS scores: CVE-2021-0920 (NVD) : 6.4 CVSS:3.1/AV:L/AC:H/PR:H/UI:N/S:U/C:H/I:H/A:H CVE-2021-0920 (SUSE): 7.8 CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H CVE-2021-39657 (SUSE): 3.3 CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L CVE-2021-39698 (NVD) : 7.8 CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H CVE-2021-39698 (SUSE): 7.4 CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H CVE-2021-44879 (NVD) : 5.5 CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H CVE-2021-44879 (SUSE): 5.5 CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H CVE-2021-45402 (NVD) : 5.5 CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N CVE-2021-45402 (SUSE): 6.1 CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:L CVE-2022-0487 (NVD) : 5.5 CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N CVE-2022-0487 (SUSE): 7 CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H CVE-2022-0617 (NVD) : 5.5 CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H CVE-2022-0617 (SUSE): 5.5 CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H CVE-2022-0644 (SUSE): 5.5 CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H CVE-2022-23036 (NVD) : 7 CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H CVE-2022-23036 (SUSE): 7.5 CVSS:3.1/AV:L/AC:H/PR:H/UI:N/S:C/C:H/I:H/A:H CVE-2022-23037 (NVD) : 7 CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H CVE-2022-23037 (SUSE): 7.5 CVSS:3.1/AV:L/AC:H/PR:H/UI:N/S:C/C:H/I:H/A:H CVE-2022-23038 (NVD) : 7 CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H CVE-2022-23038 (SUSE): 7.5 CVSS:3.1/AV:L/AC:H/PR:H/UI:N/S:C/C:H/I:H/A:H CVE-2022-23039 (NVD) : 7 CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H CVE-2022-23039 (SUSE): 7.5 CVSS:3.1/AV:L/AC:H/PR:H/UI:N/S:C/C:H/I:H/A:H CVE-2022-23040 (NVD) : 7 CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H CVE-2022-23040 (SUSE): 7.5 CVSS:3.1/AV:L/AC:H/PR:H/UI:N/S:C/C:H/I:H/A:H CVE-2022-23041 (NVD) : 7 CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H CVE-2022-23041 (SUSE): 7.5 CVSS:3.1/AV:L/AC:H/PR:H/UI:N/S:C/C:H/I:H/A:H CVE-2022-23042 (NVD) : 7 CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H CVE-2022-23042 (SUSE): 7.5 CVSS:3.1/AV:L/AC:H/PR:H/UI:N/S:C/C:H/I:H/A:H CVE-2022-24448 (NVD) : 3.3 CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N CVE-2022-24448 (SUSE): 5.5 CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N CVE-2022-24958 (NVD) : 7.8 CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H CVE-2022-24958 (SUSE): 5.5 CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H CVE-2022-24959 (NVD) : 5.5 CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H CVE-2022-24959 (SUSE): 5.5 CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H CVE-2022-25258 (NVD) : 4.6 CVSS:3.1/AV:P/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H CVE-2022-25258 (SUSE): 7.8 CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H CVE-2022-25636 (NVD) : 7.8 CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H CVE-2022-25636 (SUSE): 7.8 CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H CVE-2022-26490 (NVD) : 7.8 CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H CVE-2022-26490 (SUSE): 6.8 CVSS:3.1/AV:A/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:H CVE-2022-26966 (NVD) : 5.5 CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N CVE-2022-26966 (SUSE): 4.6 CVSS:3.1/AV:P/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N Affected Products: openSUSE Leap 15.3 openSUSE Leap 15.4 ______________________________________________________________________________ An update that solves 22 vulnerabilities and has 22 fixes is now available. Description: The SUSE Linux Enterprise 15 SP3 kernel was updated to receive various security and bugfixes. The following security bugs were fixed: - CVE-2022-25636: Fixed an issue which allowed a local users to gain privileges because of a heap out-of-bounds write in nf_dup_netdev.c, related to nf_tables_offload (bsc#1196299). - CVE-2022-26490: Fixed a buffer overflow in the st21nfca driver. An attacker with adjacent NFC access could trigger crash the system or corrupt system memory (bsc#1196830). - CVE-2022-0487: A use-after-free vulnerability was found in rtsx_usb_ms_drv_remove() in drivers/memstick/host/rtsx_usb_ms.c (bsc#1194516). - CVE-2022-24448: Fixed an issue if an application sets the O_DIRECTORY flag, and tries to open a regular file, nfs_atomic_open() performs a regular lookup. If a regular file is found, ENOTDIR should have occured, but the server instead returned uninitialized data in the file descriptor (bsc#1195612). - CVE-2022-0617: Fixed a null pointer dereference in UDF file system functionality. A local user could crash the system by triggering udf_file_write_iter() via a malicious UDF image. (bsc#1196079) - CVE-2022-0644: Fixed a denial of service by a local user. A assertion failure could be triggered in kernel_read_file_from_fd(). (bsc#1196155) - CVE-2022-25258: The USB Gadget subsystem lacked certain validation of interface OS descriptor requests, which could have lead to memory corruption (bsc#1196096). - CVE-2022-24958: drivers/usb/gadget/legacy/inode.c mishandled dev->buf release (bsc#1195905). - CVE-2022-24959: Fixed a memory leak in yam_siocdevprivate() in drivers/net/hamradio/yam.c (bsc#1195897). - CVE-2021-44879: In gc_data_segment() in fs/f2fs/gc.c, special files were not considered, which lead to a move_data_page NULL pointer dereference (bsc#1195987). - CVE-2021-0920: Fixed a local privilege escalation due to a use-after-free vulnerability in unix_scm_to_skb of af_unix (bsc#1193731). - CVE-2021-39657: Fixed an information leak in the Universal Flash Storage subsystem (bsc#1193864). - CVE-2022-26966: Fixed an issue in drivers/net/usb/sr9700.c, which allowed attackers to obtain sensitive information from heap memory via crafted frame lengths from a device (bsc#1196836). - CVE-2021-39698: Fixed a possible memory corruption due to a use after free in aio_poll_complete_work. This could lead to local escalation of privilege with no additional execution privileges needed. (bsc#1196956) - CVE-2021-45402: The check_alu_op function in kernel/bpf/verifier.c did not properly update bounds while handling the mov32 instruction, which allowed local users to obtain potentially sensitive address information (bsc#1196130). - CVE-2022-23036,CVE-2022-23037,CVE-2022-23038,CVE-2022-23039,CVE-2022-23040, CVE-2022-23041,CVE-2022-23042: Fixed multiple issues which could have lead to read/write access to memory pages or denial of service. These issues are related to the Xen PV device frontend drivers. (bsc#1196488) The following non-security bugs were fixed: - ALSA: intel_hdmi: Fix reference to PCM buffer address (git-fixes). - ARM: 9182/1: mmu: fix returns from early_param() and __setup() functions (git-fixes). - ARM: Fix kgdb breakpoint for Thumb2 (git-fixes). - ASoC: cs4265: Fix the duplicated control name (git-fixes). - ASoC: ops: Shift tested values in snd_soc_put_volsw() by +min (git-fixes). - ASoC: rt5668: do not block workqueue if card is unbound (git-fixes). - ASoC: rt5682: do not block workqueue if card is unbound (git-fixes). - Bluetooth: btusb: Add missing Chicony device for Realtek RTL8723BE (bsc#1196779). - EDAC/altera: Fix deferred probing (bsc#1178134). - EDAC: Fix calculation of returned address and next offset in edac_align_ptr() (bsc#1178134). - HID: add mapping for KEY_ALL_APPLICATIONS (git-fixes). - HID: add mapping for KEY_DICTATE (git-fixes). - Hand over the maintainership to SLE15-SP3 maintainers - IB/hfi1: Correct guard on eager buffer deallocation (git-fixes). - IB/hfi1: Fix early init panic (git-fixes). - IB/hfi1: Fix leak of rcvhdrtail_dummy_kvaddr (git-fixes). - IB/hfi1: Insure use of smp_processor_id() is preempt disabled (git-fixes). - IB/rdmavt: Validate remote_addr during loopback atomic tests (git-fixes). - Input: clear BTN_RIGHT/MIDDLE on buttonpads (git-fixes). - Input: elan_i2c - fix regulator enable count imbalance after suspend/resume (git-fixes). - Input: elan_i2c - move regulator_[en|dis]able() out of elan_[en|dis]able_power() (git-fixes). - NFC: port100: fix use-after-free in port100_send_complete (git-fixes). - RDMA/bnxt_re: Scan the whole bitmap when checking if "disabling RCFW with pending cmd-bit" (git-fixes). - RDMA/cma: Do not change route.addr.src_addr outside state checks (bsc#1181147). - RDMA/cma: Let cma_resolve_ib_dev() continue search even after empty entry (git-fixes). - RDMA/cma: Remove open coding of overflow checking for private_data_len (git-fixes). - RDMA/core: Do not infoleak GRH fields (git-fixes). - RDMA/core: Let ib_find_gid() continue search even after empty entry (git-fixes). - RDMA/cxgb4: Set queue pair state when being queried (git-fixes). - RDMA/hns: Validate the pkey index (git-fixes). - RDMA/ib_srp: Fix a deadlock (git-fixes). - RDMA/mlx4: Do not continue event handler after memory allocation failure (git-fixes). - RDMA/rtrs-clt: Fix possible double free in error case (jsc#SLE-15176). - RDMA/rxe: Fix a typo in opcode name (git-fixes). - RDMA/siw: Fix broken RDMA Read Fence/Resume logic (git-fixes). - RDMA/uverbs: Check for null return of kmalloc_array (git-fixes). - RDMA/uverbs: Remove the unnecessary assignment (git-fixes). - Revert "USB: serial: ch341: add new Product ID for CH341A" (git-fixes). - SUNRPC: avoid race between mod_timer() and del_timer_sync() (bnc#1195403). - USB: gadget: validate endpoint index for xilinx udc (git-fixes). - USB: gadget: validate interface OS descriptor requests (git-fixes). - USB: hub: Clean up use of port initialization schemes and retries (git-fixes). - USB: serial: option: add Telit LE910R1 compositions (git-fixes). - USB: serial: option: add support for DW5829e (git-fixes). - USB: zaurus: support another broken Zaurus (git-fixes). - arm64: dts: rockchip: Switch RK3399-Gru DP to SPDIF output (git-fixes). - asix: fix uninit-value in asix_mdio_read() (git-fixes). - ata: pata_hpt37x: disable primary channel on HPT371 (git-fixes). - ax25: Fix NULL pointer dereference in ax25_kill_by_device (git-fixes). - batman-adv: Do not expect inter-netns unique iflink indices (git-fixes). - batman-adv: Request iflink once in batadv-on-batadv check (git-fixes). - batman-adv: Request iflink once in batadv_get_real_netdevice (git-fixes). - blk-mq: do not free tags if the tag_set is used by other device in queue initialztion (bsc#1193787). - bnxt_en: Fix active FEC reporting to ethtool (jsc#SLE-16649). - bnxt_en: Fix incorrect multicast rx mask setting when not requested (git-fixes). - bnxt_en: Fix occasional ethtool -t loopback test failures (git-fixes). - bnxt_en: Fix offline ethtool selftest with RDMA enabled (git-fixes). - bonding: force carrier update when releasing slave (git-fixes). - build initrd without systemd This reduces the size of the initrd by over 25%, which improves startup time of the virtual machine by 0.5-0.6s on very fast machines, more on slower ones. - can: gs_usb: change active_channels's type from atomic_t to u8 (git-fixes). - cgroup-v1: Correct privileges check in release_agent writes (bsc#1196723). - cgroup/cpuset: Fix "suspicious RCU usage" lockdep warning (bsc#1196868). - clk: jz4725b: fix mmc0 clock gating (git-fixes). - constraints: Also adjust disk requirement for x86 and s390. - constraints: Increase disk space for aarch64 - cpufreq: schedutil: Use kobject release() method to free (git-fixes) - cpuset: Fix the bug that subpart_cpus updated wrongly in update_cpumask() (bsc#1196866). - cputime, cpuacct: Include guest time in user time in (git-fixes) - dma-direct: Fix potential NULL pointer dereference (bsc#1196472 ltc#192278). - dma-mapping: Allow mixing bypass and mapped DMA operation (bsc#1196472 ltc#192278). - dmaengine: shdma: Fix runtime PM imbalance on error (git-fixes). - drm/amdgpu: disable MMHUB PG for Picasso (git-fixes). - drm/edid: Always set RGB444 (git-fixes). - drm/i915/dg1: Wait for pcode/uncore handshake at startup (bsc#1195211). - drm/i915/gen11+: Only load DRAM information from pcode (bsc#1195211). - drm/i915: Nuke not needed members of dram_info (bsc#1195211). - drm/i915: Remove memory frequency calculation (bsc#1195211). - drm/i915: Rename is_16gb_dimm to wm_lv_0_adjust_needed (bsc#1195211). - drm/sun4i: mixer: Fix P010 and P210 format numbers (git-fixes). - efivars: Respect "block" flag in efivar_entry_set_safe() (git-fixes). - exfat: fix i_blocks for files truncated over 4 GiB (git-fixes). - exfat: fix incorrect loading of i_blocks for large files (git-fixes). - firmware: arm_scmi: Remove space in MODULE_ALIAS name (git-fixes). - fix rpm build warning tumbleweed rpm is adding these warnings to the log: It's not recommended to have unversioned Obsoletes: Obsoletes: microcode_ctl - gianfar: ethtool: Fix refcount leak in gfar_get_ts_info (git-fixes). - gpio: rockchip: Reset int_bothedge when changing trigger (git-fixes). - gpio: tegra186: Fix chip_data type confusion (git-fixes). - gpio: ts4900: Do not set DAT and OE together (git-fixes). - gpiolib: acpi: Convert ACPI value of debounce to microseconds (git-fixes). - gtp: remove useless rcu_read_lock() (git-fixes). - hamradio: fix macro redefine warning (git-fixes). - i2c: bcm2835: Avoid clock stretching timeouts (git-fixes). - iavf: Fix missing check for running netdev (git-fixes). - ice: initialize local variable 'tlv' (jsc#SLE-12878). - igc: igc_read_phy_reg_gpy: drop premature return (git-fixes). - igc: igc_write_phy_reg_gpy: drop premature return (git-fixes). - iio: Fix error handling for PM (git-fixes). - iio: adc: ad7124: fix mask used for setting AIN_BUFP & AIN_BUFM bits (git-fixes). - iio: adc: men_z188_adc: Fix a resource leak in an error handling path (git-fixes). - ixgbe: xsk: change !netif_carrier_ok() handling in ixgbe_xmit_zc() (git-fixes). - kernel-binary.spec.in: Move 20-kernel-default-extra.conf to the correctr directory (bsc#1195051). - kernel-binary.spec: Also exclude the kernel signing key from devel package. There is a check in OBS that fails when it is included. Also the key is not reproducible. Fixes: bb988d4625a3 ("kernel-binary: Do not include sourcedir in certificate path.") - kernel-binary.spec: Do not use the default certificate path (bsc#1194943). Using the the default path is broken since Linux 5.17 - kernel-binary: Do not include sourcedir in certificate path. The certs macro runs before build directory is set up so it creates the aggregate of supplied certificates in the source directory. Using this file directly as the certificate in kernel config works but embeds the source directory path in the kernel config. To avoid this symlink the certificate to the build directory and use relative path to refer to it. Also fabricate a certificate in the same location in build directory when none is provided. - kernel-obs-build: include 9p (boo#1195353) To be able to share files between host and the qemu vm of the build script, the 9p and 9p_virtio kernel modules need to be included in the initrd of kernel-obs-build. - mac80211: fix forwarded mesh frames AC & queue selection (git-fixes). - mac80211_hwsim: initialize ieee80211_tx_info at hw_scan_work (git-fixes). - mac80211_hwsim: report NOACK frames in tx_status (git-fixes). - mask out added spinlock in rndis_params (git-fixes). - mmc: meson: Fix usage of meson_mmc_post_req() (git-fixes). - net/mlx5: Fix possible deadlock on rule deletion (git-fixes). - net/mlx5: Fix wrong limitation of metadata match on ecpf (git-fixes). - net/mlx5: Update the list of the PCI supported devices (git-fixes). - net/mlx5: Update the list of the PCI supported devices (git-fixes). - net/mlx5e: Fix modify header actions memory leak (git-fixes). - net/mlx5e: Fix page DMA map/unmap attributes (bsc#1196468). - net/mlx5e: Fix wrong return value on ioctl EEPROM query failure (git-fixes). - net/mlx5e: TC, Reject rules with drop and modify hdr action (git-fixes). - net/mlx5e: TC, Reject rules with forward and drop actions (git-fixes). - net/mlx5e: kTLS, Use CHECKSUM_UNNECESSARY for device-offloaded packets (jsc#SLE-15172). - net/sched: act_ct: Fix flow table lookup after ct clear or switching zones (jsc#SLE-15172). - net: dsa: mv88e6xxx: MV88E6097 does not support jumbo configuration (git-fixes). - net: ethernet: ti: cpsw: disable PTPv1 hw timestamping advertisement (git-fixes). - net: fix up skbs delta_truesize in UDP GRO frag_list (bsc#1176447). - net: hns3: Clear the CMDQ registers before unmapping BAR region (git-fixes). - net: phy: DP83822: clear MISR2 register to disable interrupts (git-fixes). - net: sfc: Replace in_interrupt() usage (git-fixes). - net: tipc: validate domain record count on input (bsc#1195254). - net: usb: cdc_mbim: avoid altsetting toggling for Telit FN990 (git-fixes). - netfilter: nf_tables: fix memory leak during stateful obj update (bsc#1176447). - netsec: ignore 'phy-mode' device property on ACPI systems (git-fixes). - nfp: flower: Fix a potential leak in nfp_tunnel_add_shared_mac() (git-fixes). - nl80211: Handle nla_memdup failures in handle_nan_filter (git-fixes). - ntb: intel: fix port config status offset for SPR (git-fixes). - nvme-multipath: use vmalloc for ANA log buffer (bsc#1193787). - nvme-rdma: fix possible use-after-free in transport error_recovery work (git-fixes). - nvme-tcp: fix possible use-after-free in transport error_recovery work (git-fixes). - nvme: fix a possible use-after-free in controller reset during load (git-fixes). - powerpc/dma: Fallback to dma_ops when persistent memory present (bsc#1196472 ltc#192278). Update config files. - powerpc/fadump: register for fadump as early as possible (bsc#1179439 ltc#190038). - powerpc/mm: Remove dcache flush from memory remove (bsc#1196433 ltc#196449). - powerpc/powernv/memtrace: Fix dcache flushing (bsc#1196433 ltc#196449). - powerpc/pseries/iommu: Fix window size for direct mapping with pmem (bsc#1196472 ltc#192278). - rpm/*.spec.in: Use https:// urls - rpm/arch-symbols,guards,*driver: Replace Novell with SUSE. - rpm/check-for-config-changes: Ignore PAHOLE_VERSION. - rpm/kernel-docs.spec.in: use %%license for license declarations Limited to SLE15+ to avoid compatibility nightmares. - rpm/kernel-source.spec.in: call fdupes per subpackage It is a waste of time to do a global fdupes when we have subpackages. - rpm: SC2006: Use $(...) notation instead of legacy backticked `...`. - sched/core: Mitigate race (git-fixes) - scsi: bnx2fc: Flush destroy_work queue before calling bnx2fc_interface_put() (git-fixes). - scsi: bnx2fc: Make bnx2fc_recv_frame() mp safe (git-fixes). - scsi: lpfc: Terminate string in lpfc_debugfs_nvmeio_trc_write() (git-fixes). - scsi: nsp_cs: Check of ioremap return value (git-fixes). - scsi: qedf: Fix potential dereference of NULL pointer (git-fixes). - scsi: smartpqi: Add PCI IDs (bsc#1196627). - scsi: ufs: Fix race conditions related to driver data (git-fixes). - selftests: mlxsw: tc_police_scale: Make test more robust (bsc#1176774). - soc: fsl: Correct MAINTAINERS database (QUICC ENGINE LIBRARY) (git-fixes). - soc: fsl: Correct MAINTAINERS database (SOC) (git-fixes). - soc: fsl: qe: Check of ioremap return value (git-fixes). - spi: spi-zynq-qspi: Fix a NULL pointer dereference in zynq_qspi_exec_mem_op() (git-fixes). - sr9700: sanity check for packet length (bsc#1196836). - staging: gdm724x: fix use after free in gdm_lte_rx() (git-fixes). - tracing: Fix return value of __setup handlers (git-fixes). - tty: n_gsm: fix encoding of control signal octet bit DV (git-fixes). - tty: n_gsm: fix proper link termination after failed open (git-fixes). - usb: dwc2: Fix Stalling a Non-Isochronous OUT EP (git-fixes). - usb: dwc2: gadget: Fix GOUTNAK flow for Slave mode (git-fixes). - usb: dwc2: gadget: Fix kill_all_requests race (git-fixes). - usb: dwc2: use well defined macros for power_down (git-fixes). - usb: dwc3: gadget: Let the interrupt handler disable bottom halves (git-fixes). - usb: dwc3: meson-g12a: Disable the regulator in the error handling path of the probe (git-fixes). - usb: dwc3: pci: Fix Bay Trail phy GPIO mappings (git-fixes). - usb: gadget: rndis: add spinlock for rndis response list (git-fixes). - usb: host: xen-hcd: add missing unlock in error path (git-fixes). - usb: hub: Fix locking issues with address0_mutex (git-fixes). - usb: hub: Fix usb enumeration issue due to address0 race (git-fixes). - vrf: Fix fast path output packet handling with async Netfilter rules (git-fixes). - xen/usb: do not use gnttab_end_foreign_access() in xenhcd_gnttab_done() (bsc#1196488, XSA-396). - xhci: Prevent futile URB re-submissions due to incorrect return value (git-fixes). - xhci: re-initialize the HC during resume if HCE was set (git-fixes). Special Instructions and Notes: Please reboot the system after installing this update. Patch Instructions: To install this openSUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 15.4: zypper in -t patch openSUSE-SLE-15.4-2022-1039=1 - openSUSE Leap 15.3: zypper in -t patch openSUSE-SLE-15.3-2022-1039=1 Package List: - openSUSE Leap 15.4 (aarch64 x86_64): cluster-md-kmp-preempt-5.3.18-150300.59.60.4 cluster-md-kmp-preempt-debuginfo-5.3.18-150300.59.60.4 dlm-kmp-preempt-5.3.18-150300.59.60.4 dlm-kmp-preempt-debuginfo-5.3.18-150300.59.60.4 gfs2-kmp-preempt-5.3.18-150300.59.60.4 gfs2-kmp-preempt-debuginfo-5.3.18-150300.59.60.4 kernel-preempt-5.3.18-150300.59.60.4 kernel-preempt-debuginfo-5.3.18-150300.59.60.4 kernel-preempt-debugsource-5.3.18-150300.59.60.4 kernel-preempt-devel-5.3.18-150300.59.60.4 kernel-preempt-devel-debuginfo-5.3.18-150300.59.60.4 kernel-preempt-extra-5.3.18-150300.59.60.4 kernel-preempt-extra-debuginfo-5.3.18-150300.59.60.4 kernel-preempt-livepatch-devel-5.3.18-150300.59.60.4 kernel-preempt-optional-5.3.18-150300.59.60.4 kernel-preempt-optional-debuginfo-5.3.18-150300.59.60.4 kselftests-kmp-preempt-5.3.18-150300.59.60.4 kselftests-kmp-preempt-debuginfo-5.3.18-150300.59.60.4 ocfs2-kmp-preempt-5.3.18-150300.59.60.4 ocfs2-kmp-preempt-debuginfo-5.3.18-150300.59.60.4 reiserfs-kmp-preempt-5.3.18-150300.59.60.4 reiserfs-kmp-preempt-debuginfo-5.3.18-150300.59.60.4 - openSUSE Leap 15.4 (aarch64): dtb-al-5.3.18-150300.59.60.4 dtb-zte-5.3.18-150300.59.60.4 - openSUSE Leap 15.3 (aarch64 ppc64le s390x x86_64): cluster-md-kmp-default-5.3.18-150300.59.60.4 cluster-md-kmp-default-debuginfo-5.3.18-150300.59.60.4 dlm-kmp-default-5.3.18-150300.59.60.4 dlm-kmp-default-debuginfo-5.3.18-150300.59.60.4 gfs2-kmp-default-5.3.18-150300.59.60.4 gfs2-kmp-default-debuginfo-5.3.18-150300.59.60.4 kernel-default-5.3.18-150300.59.60.4 kernel-default-base-5.3.18-150300.59.60.4.150300.18.37.5 kernel-default-base-rebuild-5.3.18-150300.59.60.4.150300.18.37.5 kernel-default-debuginfo-5.3.18-150300.59.60.4 kernel-default-debugsource-5.3.18-150300.59.60.4 kernel-default-devel-5.3.18-150300.59.60.4 kernel-default-devel-debuginfo-5.3.18-150300.59.60.4 kernel-default-extra-5.3.18-150300.59.60.4 kernel-default-extra-debuginfo-5.3.18-150300.59.60.4 kernel-default-livepatch-5.3.18-150300.59.60.4 kernel-default-livepatch-devel-5.3.18-150300.59.60.4 kernel-default-optional-5.3.18-150300.59.60.4 kernel-default-optional-debuginfo-5.3.18-150300.59.60.4 kernel-obs-build-5.3.18-150300.59.60.4 kernel-obs-build-debugsource-5.3.18-150300.59.60.4 kernel-obs-qa-5.3.18-150300.59.60.4 kernel-syms-5.3.18-150300.59.60.4 kselftests-kmp-default-5.3.18-150300.59.60.4 kselftests-kmp-default-debuginfo-5.3.18-150300.59.60.4 ocfs2-kmp-default-5.3.18-150300.59.60.4 ocfs2-kmp-default-debuginfo-5.3.18-150300.59.60.4 reiserfs-kmp-default-5.3.18-150300.59.60.4 reiserfs-kmp-default-debuginfo-5.3.18-150300.59.60.4 - openSUSE Leap 15.3 (ppc64le x86_64): kernel-debug-5.3.18-150300.59.60.4 kernel-debug-debuginfo-5.3.18-150300.59.60.4 kernel-debug-debugsource-5.3.18-150300.59.60.4 kernel-debug-devel-5.3.18-150300.59.60.4 kernel-debug-devel-debuginfo-5.3.18-150300.59.60.4 kernel-debug-livepatch-devel-5.3.18-150300.59.60.4 kernel-kvmsmall-5.3.18-150300.59.60.4 kernel-kvmsmall-debuginfo-5.3.18-150300.59.60.4 kernel-kvmsmall-debugsource-5.3.18-150300.59.60.4 kernel-kvmsmall-devel-5.3.18-150300.59.60.4 kernel-kvmsmall-devel-debuginfo-5.3.18-150300.59.60.4 kernel-kvmsmall-livepatch-devel-5.3.18-150300.59.60.4 - openSUSE Leap 15.3 (aarch64 x86_64): cluster-md-kmp-preempt-5.3.18-150300.59.60.4 cluster-md-kmp-preempt-debuginfo-5.3.18-150300.59.60.4 dlm-kmp-preempt-5.3.18-150300.59.60.4 dlm-kmp-preempt-debuginfo-5.3.18-150300.59.60.4 gfs2-kmp-preempt-5.3.18-150300.59.60.4 gfs2-kmp-preempt-debuginfo-5.3.18-150300.59.60.4 kernel-preempt-5.3.18-150300.59.60.4 kernel-preempt-debuginfo-5.3.18-150300.59.60.4 kernel-preempt-debugsource-5.3.18-150300.59.60.4 kernel-preempt-devel-5.3.18-150300.59.60.4 kernel-preempt-devel-debuginfo-5.3.18-150300.59.60.4 kernel-preempt-extra-5.3.18-150300.59.60.4 kernel-preempt-extra-debuginfo-5.3.18-150300.59.60.4 kernel-preempt-livepatch-devel-5.3.18-150300.59.60.4 kernel-preempt-optional-5.3.18-150300.59.60.4 kernel-preempt-optional-debuginfo-5.3.18-150300.59.60.4 kselftests-kmp-preempt-5.3.18-150300.59.60.4 kselftests-kmp-preempt-debuginfo-5.3.18-150300.59.60.4 ocfs2-kmp-preempt-5.3.18-150300.59.60.4 ocfs2-kmp-preempt-debuginfo-5.3.18-150300.59.60.4 reiserfs-kmp-preempt-5.3.18-150300.59.60.4 reiserfs-kmp-preempt-debuginfo-5.3.18-150300.59.60.4 - openSUSE Leap 15.3 (aarch64): cluster-md-kmp-64kb-5.3.18-150300.59.60.4 cluster-md-kmp-64kb-debuginfo-5.3.18-150300.59.60.4 dlm-kmp-64kb-5.3.18-150300.59.60.4 dlm-kmp-64kb-debuginfo-5.3.18-150300.59.60.4 dtb-al-5.3.18-150300.59.60.4 dtb-allwinner-5.3.18-150300.59.60.4 dtb-altera-5.3.18-150300.59.60.4 dtb-amd-5.3.18-150300.59.60.4 dtb-amlogic-5.3.18-150300.59.60.4 dtb-apm-5.3.18-150300.59.60.4 dtb-arm-5.3.18-150300.59.60.4 dtb-broadcom-5.3.18-150300.59.60.4 dtb-cavium-5.3.18-150300.59.60.4 dtb-exynos-5.3.18-150300.59.60.4 dtb-freescale-5.3.18-150300.59.60.4 dtb-hisilicon-5.3.18-150300.59.60.4 dtb-lg-5.3.18-150300.59.60.4 dtb-marvell-5.3.18-150300.59.60.4 dtb-mediatek-5.3.18-150300.59.60.4 dtb-nvidia-5.3.18-150300.59.60.4 dtb-qcom-5.3.18-150300.59.60.4 dtb-renesas-5.3.18-150300.59.60.4 dtb-rockchip-5.3.18-150300.59.60.4 dtb-socionext-5.3.18-150300.59.60.4 dtb-sprd-5.3.18-150300.59.60.4 dtb-xilinx-5.3.18-150300.59.60.4 dtb-zte-5.3.18-150300.59.60.4 gfs2-kmp-64kb-5.3.18-150300.59.60.4 gfs2-kmp-64kb-debuginfo-5.3.18-150300.59.60.4 kernel-64kb-5.3.18-150300.59.60.4 kernel-64kb-debuginfo-5.3.18-150300.59.60.4 kernel-64kb-debugsource-5.3.18-150300.59.60.4 kernel-64kb-devel-5.3.18-150300.59.60.4 kernel-64kb-devel-debuginfo-5.3.18-150300.59.60.4 kernel-64kb-extra-5.3.18-150300.59.60.4 kernel-64kb-extra-debuginfo-5.3.18-150300.59.60.4 kernel-64kb-livepatch-devel-5.3.18-150300.59.60.4 kernel-64kb-optional-5.3.18-150300.59.60.4 kernel-64kb-optional-debuginfo-5.3.18-150300.59.60.4 kselftests-kmp-64kb-5.3.18-150300.59.60.4 kselftests-kmp-64kb-debuginfo-5.3.18-150300.59.60.4 ocfs2-kmp-64kb-5.3.18-150300.59.60.4 ocfs2-kmp-64kb-debuginfo-5.3.18-150300.59.60.4 reiserfs-kmp-64kb-5.3.18-150300.59.60.4 reiserfs-kmp-64kb-debuginfo-5.3.18-150300.59.60.4 - openSUSE Leap 15.3 (noarch): kernel-devel-5.3.18-150300.59.60.4 kernel-docs-5.3.18-150300.59.60.4 kernel-docs-html-5.3.18-150300.59.60.4 kernel-macros-5.3.18-150300.59.60.4 kernel-source-5.3.18-150300.59.60.4 kernel-source-vanilla-5.3.18-150300.59.60.4 - openSUSE Leap 15.3 (s390x): kernel-zfcpdump-5.3.18-150300.59.60.4 kernel-zfcpdump-debuginfo-5.3.18-150300.59.60.4 kernel-zfcpdump-debugsource-5.3.18-150300.59.60.4 References: https://www.suse.com/security/cve/CVE-2021-0920.html https://www.suse.com/security/cve/CVE-2021-39657.html https://www.suse.com/security/cve/CVE-2021-39698.html https://www.suse.com/security/cve/CVE-2021-44879.html https://www.suse.com/security/cve/CVE-2021-45402.html https://www.suse.com/security/cve/CVE-2022-0487.html https://www.suse.com/security/cve/CVE-2022-0617.html https://www.suse.com/security/cve/CVE-2022-0644.html https://www.suse.com/security/cve/CVE-2022-23036.html https://www.suse.com/security/cve/CVE-2022-23037.html https://www.suse.com/security/cve/CVE-2022-23038.html https://www.suse.com/security/cve/CVE-2022-23039.html https://www.suse.com/security/cve/CVE-2022-23040.html https://www.suse.com/security/cve/CVE-2022-23041.html https://www.suse.com/security/cve/CVE-2022-23042.html https://www.suse.com/security/cve/CVE-2022-24448.html https://www.suse.com/security/cve/CVE-2022-24958.html https://www.suse.com/security/cve/CVE-2022-24959.html https://www.suse.com/security/cve/CVE-2022-25258.html https://www.suse.com/security/cve/CVE-2022-25636.html https://www.suse.com/security/cve/CVE-2022-26490.html https://www.suse.com/security/cve/CVE-2022-26966.html https://bugzilla.suse.com/1176447 https://bugzilla.suse.com/1176774 https://bugzilla.suse.com/1178134 https://bugzilla.suse.com/1179439 https://bugzilla.suse.com/1181147 https://bugzilla.suse.com/1191428 https://bugzilla.suse.com/1192273 https://bugzilla.suse.com/1193731 https://bugzilla.suse.com/1193787 https://bugzilla.suse.com/1193864 https://bugzilla.suse.com/1194463 https://bugzilla.suse.com/1194516 https://bugzilla.suse.com/1194943 https://bugzilla.suse.com/1195051 https://bugzilla.suse.com/1195211 https://bugzilla.suse.com/1195254 https://bugzilla.suse.com/1195353 https://bugzilla.suse.com/1195403 https://bugzilla.suse.com/1195612 https://bugzilla.suse.com/1195897 https://bugzilla.suse.com/1195905 https://bugzilla.suse.com/1195939 https://bugzilla.suse.com/1195949 https://bugzilla.suse.com/1195987 https://bugzilla.suse.com/1196079 https://bugzilla.suse.com/1196095 https://bugzilla.suse.com/1196130 https://bugzilla.suse.com/1196132 https://bugzilla.suse.com/1196155 https://bugzilla.suse.com/1196299 https://bugzilla.suse.com/1196301 https://bugzilla.suse.com/1196433 https://bugzilla.suse.com/1196468 https://bugzilla.suse.com/1196472 https://bugzilla.suse.com/1196488 https://bugzilla.suse.com/1196627 https://bugzilla.suse.com/1196723 https://bugzilla.suse.com/1196779 https://bugzilla.suse.com/1196830 https://bugzilla.suse.com/1196836 https://bugzilla.suse.com/1196866 https://bugzilla.suse.com/1196868 https://bugzilla.suse.com/1196956 https://bugzilla.suse.com/1196959

1 0

openSUSE-SU-2022:1040-1: moderate: Security update for protobuf
by opensuse-security＠opensuse.org 30 Mar '22

30 Mar '22

openSUSE Security Update: Security update for protobuf ______________________________________________________________________________ Announcement ID: openSUSE-SU-2022:1040-1 Rating: moderate References: #1195258 Cross-References: CVE-2021-22570 CVSS scores: CVE-2021-22570 (NVD) : 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H CVE-2021-22570 (SUSE): 5.5 CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H Affected Products: openSUSE Leap 15.3 openSUSE Leap 15.4 ______________________________________________________________________________ An update that fixes one vulnerability is now available. Description: This update for protobuf fixes the following issues: - CVE-2021-22570: Fix incorrect parsing of nullchar in the proto symbol (bsc#1195258). Patch Instructions: To install this openSUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 15.4: zypper in -t patch openSUSE-SLE-15.4-2022-1040=1 - openSUSE Leap 15.3: zypper in -t patch openSUSE-SLE-15.3-2022-1040=1 Package List: - openSUSE Leap 15.4 (aarch64 ppc64le s390x x86_64): libprotobuf-lite20-3.9.2-4.12.1 libprotobuf-lite20-debuginfo-3.9.2-4.12.1 libprotobuf20-3.9.2-4.12.1 libprotobuf20-debuginfo-3.9.2-4.12.1 libprotoc20-3.9.2-4.12.1 libprotoc20-debuginfo-3.9.2-4.12.1 protobuf-debugsource-3.9.2-4.12.1 protobuf-devel-3.9.2-4.12.1 protobuf-devel-debuginfo-3.9.2-4.12.1 protobuf-java-3.9.2-4.12.1 python2-protobuf-3.9.2-4.12.1 python3-protobuf-3.9.2-4.12.1 - openSUSE Leap 15.4 (x86_64): libprotobuf-lite20-32bit-3.9.2-4.12.1 libprotobuf-lite20-32bit-debuginfo-3.9.2-4.12.1 libprotobuf20-32bit-3.9.2-4.12.1 libprotobuf20-32bit-debuginfo-3.9.2-4.12.1 libprotoc20-32bit-3.9.2-4.12.1 libprotoc20-32bit-debuginfo-3.9.2-4.12.1 - openSUSE Leap 15.4 (noarch): protobuf-source-3.9.2-4.12.1 - openSUSE Leap 15.3 (aarch64 ppc64le s390x x86_64): libprotobuf-lite20-3.9.2-4.12.1 libprotobuf-lite20-debuginfo-3.9.2-4.12.1 libprotobuf20-3.9.2-4.12.1 libprotobuf20-debuginfo-3.9.2-4.12.1 libprotoc20-3.9.2-4.12.1 libprotoc20-debuginfo-3.9.2-4.12.1 protobuf-debugsource-3.9.2-4.12.1 protobuf-devel-3.9.2-4.12.1 protobuf-devel-debuginfo-3.9.2-4.12.1 protobuf-java-3.9.2-4.12.1 python2-protobuf-3.9.2-4.12.1 python3-protobuf-3.9.2-4.12.1 - openSUSE Leap 15.3 (x86_64): libprotobuf-lite20-32bit-3.9.2-4.12.1 libprotobuf-lite20-32bit-debuginfo-3.9.2-4.12.1 libprotobuf20-32bit-3.9.2-4.12.1 libprotobuf20-32bit-debuginfo-3.9.2-4.12.1 libprotoc20-32bit-3.9.2-4.12.1 libprotoc20-32bit-debuginfo-3.9.2-4.12.1 - openSUSE Leap 15.3 (noarch): protobuf-source-3.9.2-4.12.1 References: https://www.suse.com/security/cve/CVE-2021-22570.html https://bugzilla.suse.com/1195258

1 0

openSUSE-RU-2022:1033-1: moderate: Recommended update for java-11-openjdk
by maintenance＠opensuse.org 30 Mar '22

30 Mar '22

openSUSE Recommended Update: Recommended update for java-11-openjdk ______________________________________________________________________________ Announcement ID: openSUSE-RU-2022:1033-1 Rating: moderate References: Affected Products: openSUSE Leap 15.3 openSUSE Leap 15.4 ______________________________________________________________________________ An update that has 0 recommended fixes can now be installed. Description: This update for java-11-openjdk fixes the following issues: - Build failure on Solaris. - Unable to connect to https://google.com using java.net.HttpClient. Patch Instructions: To install this openSUSE Recommended Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 15.4: zypper in -t patch openSUSE-SLE-15.4-2022-1033=1 - openSUSE Leap 15.3: zypper in -t patch openSUSE-SLE-15.3-2022-1033=1 Package List: - openSUSE Leap 15.4 (aarch64 ppc64le s390x x86_64): java-11-openjdk-11.0.14.1-3.77.5 java-11-openjdk-accessibility-11.0.14.1-3.77.5 java-11-openjdk-accessibility-debuginfo-11.0.14.1-3.77.5 java-11-openjdk-debugsource-11.0.14.1-3.77.5 java-11-openjdk-demo-11.0.14.1-3.77.5 java-11-openjdk-devel-11.0.14.1-3.77.5 java-11-openjdk-headless-11.0.14.1-3.77.5 java-11-openjdk-jmods-11.0.14.1-3.77.5 java-11-openjdk-src-11.0.14.1-3.77.5 - openSUSE Leap 15.4 (noarch): java-11-openjdk-javadoc-11.0.14.1-3.77.5 - openSUSE Leap 15.3 (aarch64 ppc64le s390x x86_64): java-11-openjdk-11.0.14.1-3.77.5 java-11-openjdk-accessibility-11.0.14.1-3.77.5 java-11-openjdk-accessibility-debuginfo-11.0.14.1-3.77.5 java-11-openjdk-debugsource-11.0.14.1-3.77.5 java-11-openjdk-demo-11.0.14.1-3.77.5 java-11-openjdk-devel-11.0.14.1-3.77.5 java-11-openjdk-headless-11.0.14.1-3.77.5 java-11-openjdk-jmods-11.0.14.1-3.77.5 java-11-openjdk-src-11.0.14.1-3.77.5 - openSUSE Leap 15.3 (noarch): java-11-openjdk-javadoc-11.0.14.1-3.77.5 References:

1 0