May 2022 - openSUSE Updates - openSUSE Mailing Lists

openSUSE-SU-2022:0145-1: moderate: Security update for cacti, cacti-spine
by opensuse-security＠opensuse.org 24 May '22

24 May '22

openSUSE Security Update: Security update for cacti, cacti-spine ______________________________________________________________________________ Announcement ID: openSUSE-SU-2022:0145-1 Rating: moderate References: #1192408 #1196692 Cross-References: CVE-2022-0730 CVSS scores: CVE-2022-0730 (NVD) : 9.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H Affected Products: openSUSE Backports SLE-15-SP3 ______________________________________________________________________________ An update that solves one vulnerability and has one errata is now available. Description: This update for cacti, cacti-spine fixes the following issues: cacti-spine was updated to 1.2.20: * Add support for newer versions of MySQL/MariaDB * When checking for uptime of device, don't assume a non-response is always fatal * Fix description and command trunctation issues * Improve spine performance when only one snmp agent port is in use cacti-spine 1.2.19: * Fix 1ssues with polling loop may skip some datasources * Fix ping no longer works due to hostname changes * Fix RRD steps are not always calculated correctly * Fix unable to build when DES no longer supported * Fix IPv6 devices are not properly parsed * Reduce a number of compiler warnings * Fix compiler warnings due to lack of return in thread_mutex_trylock * Fix Spine will not look at non-timetics uptime when sysUpTimeInstance overflows * Improve performance of Cacti poller on heavily loaded systems cacti-spine 1.2.20: * Add support for newer versions of MySQL/MariaDB * When checking for uptime of device, don't assume a non-response is always fatal * Fix description and command trunctation issues * Improve spine performance when only one snmp agent port is in use cacti was updated to 1.2.20: * Security fix for CVE-2022-0730, boo#1196692 Under certain ldap conditions, Cacti authentication can be bypassed with certain credential types. * Security fix: Device, Graph, Graph Template, and Graph Items may be vulnerable to XSS issues * Security fix: Lockout policies are not properly applied to LDAP and Domain Users * Security fix: When using 'remember me' option, incorrect realm may be selected * Security fix: User and Group maintenance are vulnerable to SQL attacks * Security fix: Color Templates are vulnerable to XSS attack * Features: * When creating a Data Source Profile, allow additional choices for Heartbeat * Change select all options to use Font Awesome icons * Improve spine performance by storing the total number of system snmp_ports in use * Prevent Template User Accounts from being Removed * When managing by users, allow filtering by Realm * Allow plugins to supply template account names * When viewing logs, additional message types should be filterable * When creating a Graph Template Item, allow filtering by Data Template * Allow language handler to be selected via UI * Updated Device packages for Synology, Citrix NetScaler, Cisco ASA/Cisco * Add Advanced Ping Graph Template to initial Installable templates * Add LDAP Debug Mode option * Allow Reports to include devices not on a Tree * Allow Basic Authentication to display custom failure message * Fix: When replicating data during installation/upgrade, system may appear to hang * Fix: Graph Template Items may have duplicated entries * Fix: Unable to Save Graph Settings * Fix: Script Server may crash if an OID is missing or unavailable * Fix: When system-wide polling is disabled, remote pollers may fail to sync changed settings * Fix: When updating poller name, duplicate name protection may be over zealous * Fix: Titles may show "Missing Datasource" incorectly * Fix: Checking for MIB Cache can cause crashes * Fix: Polling cycles may not always complete as expected * Fix: When viewing graph data, non-numeric values may appear * Fix: Utilities view has calculation errors when there are no data sources * Fix: When editing Reports, drag and drop may not function as intended * Fix: When data drive is full, viewing a Graph can result in errors * Various other bug fixes cacti 1.2.19: * Further fixes for grave character security protection (boo#1192408) * Fix Over aggressive escaping causing menu visibility issues on Create Device page * Add SHA256 and AES256 security levels for SNMP polling * Import graph template(Preview Only) show color_id new value as a blank area * Fix Editing graphs errors due to missing sequence * Fix 2hen hovering over a Tree Graph, row shows same highlighting as Graph Edit screen * Fix 2hen RealTime is not active, console errors may appear * Fix race conditions may occur when multiple RRDtool processes are running * Fix errors creating graphs from templates * Fix errors when duplicating reports * Fix Boost may be blocked by overflowing poller_output table * Fix Template import may be blocked due to unmet dependency warnings with snmp ports * Fix Newer MySQL versions may error if committing a transaction when not in one * Fix SNMP Agent may not find a cache item * Fix Correct issues running under PHP 8.x * Fix When polling is disabled, boost may crash and creates many arch tables * Fix When poller runs, memory tables may not always be present * Fix Timezones may sometimes be incorrectly calculated * Fix Allow monitoring IPv6 with interface graphs * Fix When a data source uses a Data Input Method, those without a mapping should be flagged * Fix When RRDfile is not yet created, errors may appear when displaying the graph * Fix Cacti missing key indexes that result in Preset pages slowdowns * Fix Data Sources page shows no name when Data Source has no name cache * Fix db_update_table function can not alter table from signed to unsigned * Fix data remains in poller_output table even if it's flushed to rrd files * Fix Parameter list for lib/database.php:db_connect_real() is not correct in 3 places * Fix Offset is a reserved word in MariaDB 10.6 affecting Report * Fix Rendering large trees slowed due to lack of permission caching * Fix Error on interpretation of snmpUtime, when to big * Fix Applying right axis formatting creates an error-image * Fix Unable to Save Graph Settings from the Graphs pages * Fix Graph Template Cache is nullified too often when Graph Automation is running * Fix When Adding a Data Query to a Device, no Progress Spinner is shown * Fix New Browser Breaks Plugins that depend on non UTC date time data * Fix errors when testing remote poller connectivity * Fix errors when renaming poller * Fix Removing spikes by Variance does not appear to be working beyond the first RRA * Fix LDAP API lacks timeout options leading to bad login experiences * Add a normal/wrap class for general use * Limit File Types available for Template Import operations * Fix Cacti does not provide an option of providing a client side certificate for LDAP/AD authentication * Support Stronger Encryption Available Starting in Net-SNMP v5.8 * Allow Cacti to use multiple possible LDAP servers * Add a 15 minute polling/sampling interval * Provide additional admin email notifications * Add warnings for undesired changes to plugin hook return values * When creating a Graph, make testing the Data Sources optional by Template * Update phpseclib to 2.0.33 * Update jstree.js to 3.3.12 * Improve performance of Cacti poller on heavily loaded systems * MariaDB recommendations need some tuning for recent updates Patch Instructions: To install this openSUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Backports SLE-15-SP3: zypper in -t patch openSUSE-2022-145=1 Package List: - openSUSE Backports SLE-15-SP3 (aarch64 i586 ppc64le s390x x86_64): cacti-spine-1.2.20-bp153.2.9.1 - openSUSE Backports SLE-15-SP3 (noarch): cacti-1.2.20-bp153.2.9.1 References: https://www.suse.com/security/cve/CVE-2022-0730.html https://bugzilla.suse.com/1192408 https://bugzilla.suse.com/1196692

1 0

SUSE-RU-2022:1821-1: Recommended update for read-only-root-fs
by maintenance＠opensuse.org 24 May '22

24 May '22

SUSE Recommended Update: Recommended update for read-only-root-fs ______________________________________________________________________________ Announcement ID: SUSE-RU-2022:1821-1 Rating: low References: #1156421 #1161264 #1176052 Affected Products: SUSE Linux Enterprise Module for Transactional Server 15-SP3 SUSE Linux Enterprise Module for Transactional Server 15-SP4 openSUSE Leap 15.3 openSUSE Leap 15.4 ______________________________________________________________________________ An update that has three recommended fixes can now be installed. Description: This update for read-only-root-fs fixes the following issues: - Add required mount for /etc for systemd udevd. - Workaround for /var being RO during systemd journal flush. (bsc#1156421) - Better check for already existing etc overlay. (bsc#1161264) - Adjust btrfs maintenance sysconfig to not use the read-only root filesystem. (bsc#1176052) Patch Instructions: To install this SUSE Recommended Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 15.4: zypper in -t patch openSUSE-SLE-15.4-2022-1821=1 - openSUSE Leap 15.3: zypper in -t patch openSUSE-SLE-15.3-2022-1821=1 - SUSE Linux Enterprise Module for Transactional Server 15-SP4: zypper in -t patch SUSE-SLE-Module-Transactional-Server-15-SP4-2022-1821=1 - SUSE Linux Enterprise Module for Transactional Server 15-SP3: zypper in -t patch SUSE-SLE-Module-Transactional-Server-15-SP3-2022-1821=1 Package List: - openSUSE Leap 15.4 (noarch): read-only-root-fs-1.0+git20190206.586e9f1-150100.3.3.1 read-only-root-fs-volatile-1.0+git20190206.586e9f1-150100.3.3.1 - openSUSE Leap 15.3 (noarch): read-only-root-fs-1.0+git20190206.586e9f1-150100.3.3.1 read-only-root-fs-volatile-1.0+git20190206.586e9f1-150100.3.3.1 - SUSE Linux Enterprise Module for Transactional Server 15-SP4 (noarch): read-only-root-fs-1.0+git20190206.586e9f1-150100.3.3.1 read-only-root-fs-volatile-1.0+git20190206.586e9f1-150100.3.3.1 - SUSE Linux Enterprise Module for Transactional Server 15-SP3 (noarch): read-only-root-fs-1.0+git20190206.586e9f1-150100.3.3.1 read-only-root-fs-volatile-1.0+git20190206.586e9f1-150100.3.3.1 References: https://bugzilla.suse.com/1156421 https://bugzilla.suse.com/1161264 https://bugzilla.suse.com/1176052

1 0

SUSE-RU-2022:1820-1: Recommended update for rzsz
by maintenance＠opensuse.org 23 May '22

23 May '22

SUSE Recommended Update: Recommended update for rzsz ______________________________________________________________________________ Announcement ID: SUSE-RU-2022:1820-1 Rating: low References: #1197852 Affected Products: SUSE Linux Enterprise Desktop 15-SP3 SUSE Linux Enterprise Desktop 15-SP4 SUSE Linux Enterprise High Performance Computing 15-SP3 SUSE Linux Enterprise High Performance Computing 15-SP4 SUSE Linux Enterprise Module for Basesystem 15-SP3 SUSE Linux Enterprise Module for Basesystem 15-SP4 SUSE Linux Enterprise Server 15-SP3 SUSE Linux Enterprise Server 15-SP4 SUSE Linux Enterprise Server for SAP Applications 15-SP3 SUSE Linux Enterprise Server for SAP Applications 15-SP4 SUSE Manager Proxy 4.2 SUSE Manager Server 4.2 openSUSE Leap 15.3 openSUSE Leap 15.4 ______________________________________________________________________________ An update that has one recommended fix can now be installed. Description: This update for rzsz fixes the following issue: - Fix build with the latest gettext (bsc#1197852) Patch Instructions: To install this SUSE Recommended Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 15.4: zypper in -t patch openSUSE-SLE-15.4-2022-1820=1 - openSUSE Leap 15.3: zypper in -t patch openSUSE-SLE-15.3-2022-1820=1 - SUSE Linux Enterprise Module for Basesystem 15-SP4: zypper in -t patch SUSE-SLE-Module-Basesystem-15-SP4-2022-1820=1 - SUSE Linux Enterprise Module for Basesystem 15-SP3: zypper in -t patch SUSE-SLE-Module-Basesystem-15-SP3-2022-1820=1 Package List: - openSUSE Leap 15.4 (aarch64 ppc64le s390x x86_64): rzsz-0.12.21~rc-150000.3.3.2 rzsz-debuginfo-0.12.21~rc-150000.3.3.2 rzsz-debugsource-0.12.21~rc-150000.3.3.2 - openSUSE Leap 15.3 (aarch64 ppc64le s390x x86_64): rzsz-0.12.21~rc-150000.3.3.2 rzsz-debuginfo-0.12.21~rc-150000.3.3.2 rzsz-debugsource-0.12.21~rc-150000.3.3.2 - SUSE Linux Enterprise Module for Basesystem 15-SP4 (aarch64 ppc64le s390x x86_64): rzsz-0.12.21~rc-150000.3.3.2 rzsz-debuginfo-0.12.21~rc-150000.3.3.2 rzsz-debugsource-0.12.21~rc-150000.3.3.2 - SUSE Linux Enterprise Module for Basesystem 15-SP3 (aarch64 ppc64le s390x x86_64): rzsz-0.12.21~rc-150000.3.3.2 rzsz-debuginfo-0.12.21~rc-150000.3.3.2 rzsz-debugsource-0.12.21~rc-150000.3.3.2 References: https://bugzilla.suse.com/1197852

1 0

SUSE-RU-2022:1814-1: moderate: Recommended update for sapconf
by maintenance＠opensuse.org 23 May '22

23 May '22

SUSE Recommended Update: Recommended update for sapconf ______________________________________________________________________________ Announcement ID: SUSE-RU-2022:1814-1 Rating: moderate References: #1185702 #1188743 #1192841 Affected Products: SUSE Linux Enterprise High Performance Computing 15-SP3 SUSE Linux Enterprise High Performance Computing 15-SP4 SUSE Linux Enterprise Module for Server Applications 15-SP3 SUSE Linux Enterprise Module for Server Applications 15-SP4 SUSE Linux Enterprise Server 15-SP3 SUSE Linux Enterprise Server 15-SP4 SUSE Linux Enterprise Server for SAP Applications 15-SP3 SUSE Linux Enterprise Server for SAP Applications 15-SP4 SUSE Manager Proxy 4.2 SUSE Manager Server 4.2 openSUSE Leap 15.3 openSUSE Leap 15.4 ______________________________________________________________________________ An update that has three recommended fixes can now be installed. Description: This update for sapconf fixes the following issues: Version update from 5.0.3 to 5.0.4: - Change block device handling to handle multipath devices correctly. Only the DM multipath devices (mpath) will be used for the settings, but not its paths (bsc#1188743) - Fixed wrong comparison used for setting force_latency (bsc#1185702) - SAP Note 1771258 v6 updates nofile values to 1048576 (bsc#1192841) Patch Instructions: To install this SUSE Recommended Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 15.4: zypper in -t patch openSUSE-SLE-15.4-2022-1814=1 - openSUSE Leap 15.3: zypper in -t patch openSUSE-SLE-15.3-2022-1814=1 - SUSE Linux Enterprise Module for Server Applications 15-SP4: zypper in -t patch SUSE-SLE-Module-Server-Applications-15-SP4-2022-1814=1 - SUSE Linux Enterprise Module for Server Applications 15-SP3: zypper in -t patch SUSE-SLE-Module-Server-Applications-15-SP3-2022-1814=1 Package List: - openSUSE Leap 15.4 (noarch): sapconf-5.0.4-150000.7.21.1 - openSUSE Leap 15.3 (noarch): sapconf-5.0.4-150000.7.21.1 - SUSE Linux Enterprise Module for Server Applications 15-SP4 (noarch): sapconf-5.0.4-150000.7.21.1 - SUSE Linux Enterprise Module for Server Applications 15-SP3 (noarch): sapconf-5.0.4-150000.7.21.1 References: https://bugzilla.suse.com/1185702 https://bugzilla.suse.com/1188743 https://bugzilla.suse.com/1192841

1 0

SUSE-RU-2022:1812-1: moderate: Recommended update for rmt-server
by maintenance＠opensuse.org 23 May '22

23 May '22

SUSE Recommended Update: Recommended update for rmt-server ______________________________________________________________________________ Announcement ID: SUSE-RU-2022:1812-1 Rating: moderate References: #1188578 #1191552 #1195318 Affected Products: SUSE Linux Enterprise High Performance Computing 15-SP3 SUSE Linux Enterprise Module for Public Cloud 15-SP3 SUSE Linux Enterprise Module for Server Applications 15-SP3 SUSE Linux Enterprise Server 15-SP3 SUSE Linux Enterprise Server for SAP Applications 15-SP3 SUSE Manager Proxy 4.2 SUSE Manager Server 4.2 openSUSE Leap 15.3 ______________________________________________________________________________ An update that has three recommended fixes can now be installed. Description: This update for rmt-server fixes the following issues: Version 2.8.0 - Forwarding information of registered systems to SCC more efficiently in batches - Syncing the systems' most recent last seen timestamps to SCC - Optional '--no-confirmation' switch to skip user confirmation when cleaning repository data - Fix "rmt-cli systems list --csv -a" for RMTs with millions of systems (bsc#1191552) - Enable nginx configs to serve on IPv6 - Enable users with old versions of RMT to sync systems with SCC by default - Fix build using ruby 3.x (bsc#1195318). Version 2.7.1 - Remove products with a negative ID during migration - Changes to RMT/connect API: RMT returns HTTP status code 422 whenever a system tries to register/activate a product with an expired subscription. - Mirror metadata retry. This fixes bsc#1188578 - Update the way allowed paths are checked SUMA requested a new feature where it is possible to validate all versions of the same product and arch (that are allowed to that system) - De-register BYOS systems using RMT as a proxy from SCC - De-activate a single product from a BYOS proxy system Patch Instructions: To install this SUSE Recommended Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 15.3: zypper in -t patch openSUSE-SLE-15.3-2022-1812=1 - SUSE Linux Enterprise Module for Server Applications 15-SP3: zypper in -t patch SUSE-SLE-Module-Server-Applications-15-SP3-2022-1812=1 - SUSE Linux Enterprise Module for Public Cloud 15-SP3: zypper in -t patch SUSE-SLE-Module-Public-Cloud-15-SP3-2022-1812=1 Package List: - openSUSE Leap 15.3 (aarch64 ppc64le s390x x86_64): rmt-server-2.8.0-150300.3.15.1 rmt-server-config-2.8.0-150300.3.15.1 rmt-server-debuginfo-2.8.0-150300.3.15.1 rmt-server-debugsource-2.8.0-150300.3.15.1 rmt-server-pubcloud-2.8.0-150300.3.15.1 - SUSE Linux Enterprise Module for Server Applications 15-SP3 (aarch64 ppc64le s390x x86_64): rmt-server-2.8.0-150300.3.15.1 rmt-server-config-2.8.0-150300.3.15.1 rmt-server-debuginfo-2.8.0-150300.3.15.1 rmt-server-debugsource-2.8.0-150300.3.15.1 - SUSE Linux Enterprise Module for Public Cloud 15-SP3 (aarch64 ppc64le s390x x86_64): rmt-server-debuginfo-2.8.0-150300.3.15.1 rmt-server-debugsource-2.8.0-150300.3.15.1 rmt-server-pubcloud-2.8.0-150300.3.15.1 References: https://bugzilla.suse.com/1188578 https://bugzilla.suse.com/1191552 https://bugzilla.suse.com/1195318

1 0

SUSE-SU-2022:1803-1: moderate: Security update for libarchive
by opensuse-security＠opensuse.org 23 May '22

23 May '22

SUSE Security Update: Security update for libarchive ______________________________________________________________________________ Announcement ID: SUSE-SU-2022:1803-1 Rating: moderate References: #1197634 Cross-References: CVE-2022-26280 CVSS scores: CVE-2022-26280 (NVD) : 9.1 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:H CVE-2022-26280 (SUSE): 7.4 CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:H Affected Products: SUSE Linux Enterprise Desktop 15-SP3 SUSE Linux Enterprise High Performance Computing 15-SP3 SUSE Linux Enterprise Module for Basesystem 15-SP3 SUSE Linux Enterprise Module for Development Tools 15-SP3 SUSE Linux Enterprise Server 15-SP3 SUSE Linux Enterprise Server for SAP Applications 15-SP3 SUSE Manager Proxy 4.2 SUSE Manager Server 4.2 openSUSE Leap 15.3 ______________________________________________________________________________ An update that fixes one vulnerability is now available. Description: This update for libarchive fixes the following issues: - CVE-2022-26280: Fixed out-of-bounds read via the component zipx_lzma_alone_init (bsc#1197634). Patch Instructions: To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 15.3: zypper in -t patch openSUSE-SLE-15.3-2022-1803=1 - SUSE Linux Enterprise Module for Development Tools 15-SP3: zypper in -t patch SUSE-SLE-Module-Development-Tools-15-SP3-2022-1803=1 - SUSE Linux Enterprise Module for Basesystem 15-SP3: zypper in -t patch SUSE-SLE-Module-Basesystem-15-SP3-2022-1803=1 Package List: - openSUSE Leap 15.3 (aarch64 ppc64le s390x x86_64): bsdtar-3.4.2-150200.4.6.1 bsdtar-debuginfo-3.4.2-150200.4.6.1 libarchive-debugsource-3.4.2-150200.4.6.1 libarchive-devel-3.4.2-150200.4.6.1 libarchive13-3.4.2-150200.4.6.1 libarchive13-debuginfo-3.4.2-150200.4.6.1 - openSUSE Leap 15.3 (x86_64): libarchive13-32bit-3.4.2-150200.4.6.1 libarchive13-32bit-debuginfo-3.4.2-150200.4.6.1 - SUSE Linux Enterprise Module for Development Tools 15-SP3 (aarch64 ppc64le s390x x86_64): bsdtar-3.4.2-150200.4.6.1 bsdtar-debuginfo-3.4.2-150200.4.6.1 libarchive-debugsource-3.4.2-150200.4.6.1 - SUSE Linux Enterprise Module for Basesystem 15-SP3 (aarch64 ppc64le s390x x86_64): libarchive-debugsource-3.4.2-150200.4.6.1 libarchive-devel-3.4.2-150200.4.6.1 libarchive13-3.4.2-150200.4.6.1 libarchive13-debuginfo-3.4.2-150200.4.6.1 References: https://www.suse.com/security/cve/CVE-2022-26280.html https://bugzilla.suse.com/1197634

1 0

SUSE-RU-2022:1802-1: important: Recommended updates for autoyast2, yast2-installation, yast2-samba-client, yast2-storage-ng, yast2-schema
by maintenance＠opensuse.org 23 May '22

23 May '22

SUSE Recommended Update: Recommended updates for autoyast2, yast2-installation, yast2-samba-client, yast2-storage-ng, yast2-schema ______________________________________________________________________________ Announcement ID: SUSE-RU-2022:1802-1 Rating: important References: #1196595 #1197655 #1197692 #1197936 #1198294 #1199000 #1199165 Affected Products: SUSE Linux Enterprise Desktop 15-SP3 SUSE Linux Enterprise High Performance Computing 15-SP3 SUSE Linux Enterprise Installer 15-SP3 SUSE Linux Enterprise Module for Basesystem 15-SP3 SUSE Linux Enterprise Server 15-SP3 SUSE Linux Enterprise Server for SAP Applications 15-SP3 SUSE Manager Proxy 4.2 SUSE Manager Server 4.2 openSUSE Leap 15.3 openSUSE Leap 15.4 ______________________________________________________________________________ An update that has 7 recommended fixes can now be installed. Description: These updates for YaST fix the following issues: autoyast2: - Respect general/signature-handling settings during the 2nd stage (bsc#1197655) - Fix detection of disk serial and size in the "disks" ERB helper (bsc#1199000) - Fix rules validation when using a dialog (bsc#1199165) yast2-installation: - Revert changes introduced in v4.3.50 because they cause some ordering cycle issues (bsc#1198294) - AutoYaST: move custom file creation past user creation so that the element files/file/file_owner actually has an effect (bsc#1196595) yast2-samba-client: - Use translation macro for range settings expert details text (bsc#1197936) yast2-schema: - Fix rules validation when using a dialog (bsc#1199165) yast2-storage-ng: - Fix fstab entry filesystem matching allowing the use of quotes surrounding the device UUID or label (bsc#1197692) Patch Instructions: To install this SUSE Recommended Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 15.4: zypper in -t patch openSUSE-SLE-15.4-2022-1802=1 - openSUSE Leap 15.3: zypper in -t patch openSUSE-SLE-15.3-2022-1802=1 - SUSE Linux Enterprise Module for Basesystem 15-SP3: zypper in -t patch SUSE-SLE-Module-Basesystem-15-SP3-2022-1802=1 - SUSE Linux Enterprise Installer 15-SP3: zypper in -t patch SUSE-SLE-INSTALLER-15-SP3-2022-1802=1 Package List: - openSUSE Leap 15.4 (aarch64 ppc64le s390x x86_64): yast2-schema-4.3.29-150300.3.15.1 - openSUSE Leap 15.3 (aarch64 ppc64le s390x x86_64): yast2-schema-4.3.29-150300.3.15.1 yast2-storage-ng-4.3.60-150300.3.21.1 - openSUSE Leap 15.3 (noarch): autoyast2-4.3.102-150300.3.47.1 autoyast2-installation-4.3.102-150300.3.47.1 yast2-installation-4.3.52-150300.3.30.1 yast2-samba-client-4.3.5-150300.3.9.1 - SUSE Linux Enterprise Module for Basesystem 15-SP3 (aarch64 ppc64le s390x x86_64): yast2-schema-4.3.29-150300.3.15.1 yast2-storage-ng-4.3.60-150300.3.21.1 - SUSE Linux Enterprise Module for Basesystem 15-SP3 (noarch): autoyast2-4.3.102-150300.3.47.1 autoyast2-installation-4.3.102-150300.3.47.1 yast2-installation-4.3.52-150300.3.30.1 yast2-samba-client-4.3.5-150300.3.9.1 - SUSE Linux Enterprise Installer 15-SP3 (aarch64 ppc64le s390x x86_64): yast2-schema-4.3.29-150300.3.15.1 yast2-storage-ng-4.3.60-150300.3.21.1 - SUSE Linux Enterprise Installer 15-SP3 (noarch): autoyast2-4.3.102-150300.3.47.1 autoyast2-installation-4.3.102-150300.3.47.1 yast2-installation-4.3.52-150300.3.30.1 References: https://bugzilla.suse.com/1196595 https://bugzilla.suse.com/1197655 https://bugzilla.suse.com/1197692 https://bugzilla.suse.com/1197936 https://bugzilla.suse.com/1198294 https://bugzilla.suse.com/1199000 https://bugzilla.suse.com/1199165

1 0

openSUSE-SU-2022:0143-1: critical: Security update for librecad
by opensuse-security＠opensuse.org 23 May '22

23 May '22

openSUSE Security Update: Security update for librecad ______________________________________________________________________________ Announcement ID: openSUSE-SU-2022:0143-1 Rating: critical References: #1195105 #1195122 Cross-References: CVE-2021-45341 CVE-2021-45342 CVSS scores: CVE-2021-45341 (NVD) : 8.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H CVE-2021-45342 (NVD) : 7.8 CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H Affected Products: openSUSE Backports SLE-15-SP3 ______________________________________________________________________________ An update that fixes two vulnerabilities is now available. Description: This update for librecad fixes the following issues: - CVE-2021-45341: Fixed a buffer overflow vulnerability in LibreCAD that allowed an attacker to achieve remote code execution via a crafted JWW document [boo#1195105] - CVE-2021-45342: Fixed a buffer overflow vulnerability in jwwlib in LibreCAD allows an attacker to achieve remote code execution via a crafted JWW document [boo#1195122] Patch Instructions: To install this openSUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Backports SLE-15-SP3: zypper in -t patch openSUSE-2022-143=1 Package List: - openSUSE Backports SLE-15-SP3 (aarch64 ppc64le s390x x86_64): librecad-2.2.0~rc3-bp153.2.9.1 - openSUSE Backports SLE-15-SP3 (noarch): librecad-parts-2.2.0~rc3-bp153.2.9.1 References: https://www.suse.com/security/cve/CVE-2021-45341.html https://www.suse.com/security/cve/CVE-2021-45342.html https://bugzilla.suse.com/1195105 https://bugzilla.suse.com/1195122

1 0

openSUSE-SU-2022:0142-1: moderate: Security update for libxls
by opensuse-security＠opensuse.org 21 May '22

21 May '22

openSUSE Security Update: Security update for libxls ______________________________________________________________________________ Announcement ID: openSUSE-SU-2022:0142-1 Rating: moderate References: #1192323 Cross-References: CVE-2021-27836 Affected Products: openSUSE Backports SLE-15-SP3 ______________________________________________________________________________ An update that fixes one vulnerability is now available. Description: This update for libxls fixes the following issues: - CVE-2021-27836: Fixed possible NULL pointer dereference via crafted XLS (boo#1192323) Patch Instructions: To install this openSUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Backports SLE-15-SP3: zypper in -t patch openSUSE-2022-142=1 Package List: - openSUSE Backports SLE-15-SP3 (aarch64 i586 ppc64le s390x x86_64): libxls-devel-1.6.2-bp153.2.6.1 libxls-tools-1.6.2-bp153.2.6.1 libxlsreader8-1.6.2-bp153.2.6.1 References: https://www.suse.com/security/cve/CVE-2021-27836.html https://bugzilla.suse.com/1192323

1 0

SUSE-SU-2022:1768-1: Security update for php7
by opensuse-security＠opensuse.org 20 May '22

20 May '22

SUSE Security Update: Security update for php7 ______________________________________________________________________________ Announcement ID: SUSE-SU-2022:1768-1 Rating: low References: #1197644 Affected Products: SUSE Linux Enterprise High Performance Computing 15-SP3 SUSE Linux Enterprise Module for Packagehub Subpackages 15-SP3 SUSE Linux Enterprise Module for Web Scripting 15-SP3 SUSE Linux Enterprise Server 15-SP3 SUSE Linux Enterprise Server for SAP Applications 15-SP3 SUSE Manager Proxy 4.2 SUSE Manager Server 4.2 openSUSE Leap 15.3 openSUSE Leap 15.4 ______________________________________________________________________________ An update that contains security fixes can now be installed. Description: This update for php7 fixes the following issues: - Fixed filter_var bypass vulnerability (bsc#1197644). Patch Instructions: To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 15.4: zypper in -t patch openSUSE-SLE-15.4-2022-1768=1 - openSUSE Leap 15.3: zypper in -t patch openSUSE-SLE-15.3-2022-1768=1 - SUSE Linux Enterprise Module for Web Scripting 15-SP3: zypper in -t patch SUSE-SLE-Module-Web-Scripting-15-SP3-2022-1768=1 - SUSE Linux Enterprise Module for Packagehub Subpackages 15-SP3: zypper in -t patch SUSE-SLE-Module-Packagehub-Subpackages-15-SP3-2022-1768=1 Package List: - openSUSE Leap 15.4 (aarch64 ppc64le s390x x86_64): php7-firebird-7.4.6-150200.3.38.2 php7-firebird-debuginfo-7.4.6-150200.3.38.2 - openSUSE Leap 15.3 (aarch64 ppc64le s390x x86_64): apache2-mod_php7-7.4.6-150200.3.38.2 apache2-mod_php7-debuginfo-7.4.6-150200.3.38.2 php7-7.4.6-150200.3.38.2 php7-bcmath-7.4.6-150200.3.38.2 php7-bcmath-debuginfo-7.4.6-150200.3.38.2 php7-bz2-7.4.6-150200.3.38.2 php7-bz2-debuginfo-7.4.6-150200.3.38.2 php7-calendar-7.4.6-150200.3.38.2 php7-calendar-debuginfo-7.4.6-150200.3.38.2 php7-ctype-7.4.6-150200.3.38.2 php7-ctype-debuginfo-7.4.6-150200.3.38.2 php7-curl-7.4.6-150200.3.38.2 php7-curl-debuginfo-7.4.6-150200.3.38.2 php7-dba-7.4.6-150200.3.38.2 php7-dba-debuginfo-7.4.6-150200.3.38.2 php7-debuginfo-7.4.6-150200.3.38.2 php7-debugsource-7.4.6-150200.3.38.2 php7-devel-7.4.6-150200.3.38.2 php7-dom-7.4.6-150200.3.38.2 php7-dom-debuginfo-7.4.6-150200.3.38.2 php7-embed-7.4.6-150200.3.38.2 php7-embed-debuginfo-7.4.6-150200.3.38.2 php7-enchant-7.4.6-150200.3.38.2 php7-enchant-debuginfo-7.4.6-150200.3.38.2 php7-exif-7.4.6-150200.3.38.2 php7-exif-debuginfo-7.4.6-150200.3.38.2 php7-fastcgi-7.4.6-150200.3.38.2 php7-fastcgi-debuginfo-7.4.6-150200.3.38.2 php7-fileinfo-7.4.6-150200.3.38.2 php7-fileinfo-debuginfo-7.4.6-150200.3.38.2 php7-firebird-7.4.6-150200.3.38.2 php7-firebird-debuginfo-7.4.6-150200.3.38.2 php7-fpm-7.4.6-150200.3.38.2 php7-fpm-debuginfo-7.4.6-150200.3.38.2 php7-ftp-7.4.6-150200.3.38.2 php7-ftp-debuginfo-7.4.6-150200.3.38.2 php7-gd-7.4.6-150200.3.38.2 php7-gd-debuginfo-7.4.6-150200.3.38.2 php7-gettext-7.4.6-150200.3.38.2 php7-gettext-debuginfo-7.4.6-150200.3.38.2 php7-gmp-7.4.6-150200.3.38.2 php7-gmp-debuginfo-7.4.6-150200.3.38.2 php7-iconv-7.4.6-150200.3.38.2 php7-iconv-debuginfo-7.4.6-150200.3.38.2 php7-intl-7.4.6-150200.3.38.2 php7-intl-debuginfo-7.4.6-150200.3.38.2 php7-json-7.4.6-150200.3.38.2 php7-json-debuginfo-7.4.6-150200.3.38.2 php7-ldap-7.4.6-150200.3.38.2 php7-ldap-debuginfo-7.4.6-150200.3.38.2 php7-mbstring-7.4.6-150200.3.38.2 php7-mbstring-debuginfo-7.4.6-150200.3.38.2 php7-mysql-7.4.6-150200.3.38.2 php7-mysql-debuginfo-7.4.6-150200.3.38.2 php7-odbc-7.4.6-150200.3.38.2 php7-odbc-debuginfo-7.4.6-150200.3.38.2 php7-opcache-7.4.6-150200.3.38.2 php7-opcache-debuginfo-7.4.6-150200.3.38.2 php7-openssl-7.4.6-150200.3.38.2 php7-openssl-debuginfo-7.4.6-150200.3.38.2 php7-pcntl-7.4.6-150200.3.38.2 php7-pcntl-debuginfo-7.4.6-150200.3.38.2 php7-pdo-7.4.6-150200.3.38.2 php7-pdo-debuginfo-7.4.6-150200.3.38.2 php7-pgsql-7.4.6-150200.3.38.2 php7-pgsql-debuginfo-7.4.6-150200.3.38.2 php7-phar-7.4.6-150200.3.38.2 php7-phar-debuginfo-7.4.6-150200.3.38.2 php7-posix-7.4.6-150200.3.38.2 php7-posix-debuginfo-7.4.6-150200.3.38.2 php7-readline-7.4.6-150200.3.38.2 php7-readline-debuginfo-7.4.6-150200.3.38.2 php7-shmop-7.4.6-150200.3.38.2 php7-shmop-debuginfo-7.4.6-150200.3.38.2 php7-snmp-7.4.6-150200.3.38.2 php7-snmp-debuginfo-7.4.6-150200.3.38.2 php7-soap-7.4.6-150200.3.38.2 php7-soap-debuginfo-7.4.6-150200.3.38.2 php7-sockets-7.4.6-150200.3.38.2 php7-sockets-debuginfo-7.4.6-150200.3.38.2 php7-sodium-7.4.6-150200.3.38.2 php7-sodium-debuginfo-7.4.6-150200.3.38.2 php7-sqlite-7.4.6-150200.3.38.2 php7-sqlite-debuginfo-7.4.6-150200.3.38.2 php7-sysvmsg-7.4.6-150200.3.38.2 php7-sysvmsg-debuginfo-7.4.6-150200.3.38.2 php7-sysvsem-7.4.6-150200.3.38.2 php7-sysvsem-debuginfo-7.4.6-150200.3.38.2 php7-sysvshm-7.4.6-150200.3.38.2 php7-sysvshm-debuginfo-7.4.6-150200.3.38.2 php7-test-7.4.6-150200.3.38.2 php7-tidy-7.4.6-150200.3.38.2 php7-tidy-debuginfo-7.4.6-150200.3.38.2 php7-tokenizer-7.4.6-150200.3.38.2 php7-tokenizer-debuginfo-7.4.6-150200.3.38.2 php7-xmlreader-7.4.6-150200.3.38.2 php7-xmlreader-debuginfo-7.4.6-150200.3.38.2 php7-xmlrpc-7.4.6-150200.3.38.2 php7-xmlrpc-debuginfo-7.4.6-150200.3.38.2 php7-xmlwriter-7.4.6-150200.3.38.2 php7-xmlwriter-debuginfo-7.4.6-150200.3.38.2 php7-xsl-7.4.6-150200.3.38.2 php7-xsl-debuginfo-7.4.6-150200.3.38.2 php7-zip-7.4.6-150200.3.38.2 php7-zip-debuginfo-7.4.6-150200.3.38.2 php7-zlib-7.4.6-150200.3.38.2 php7-zlib-debuginfo-7.4.6-150200.3.38.2 - SUSE Linux Enterprise Module for Web Scripting 15-SP3 (aarch64 ppc64le s390x x86_64): apache2-mod_php7-7.4.6-150200.3.38.2 apache2-mod_php7-debuginfo-7.4.6-150200.3.38.2 php7-7.4.6-150200.3.38.2 php7-bcmath-7.4.6-150200.3.38.2 php7-bcmath-debuginfo-7.4.6-150200.3.38.2 php7-bz2-7.4.6-150200.3.38.2 php7-bz2-debuginfo-7.4.6-150200.3.38.2 php7-calendar-7.4.6-150200.3.38.2 php7-calendar-debuginfo-7.4.6-150200.3.38.2 php7-ctype-7.4.6-150200.3.38.2 php7-ctype-debuginfo-7.4.6-150200.3.38.2 php7-curl-7.4.6-150200.3.38.2 php7-curl-debuginfo-7.4.6-150200.3.38.2 php7-dba-7.4.6-150200.3.38.2 php7-dba-debuginfo-7.4.6-150200.3.38.2 php7-debuginfo-7.4.6-150200.3.38.2 php7-debugsource-7.4.6-150200.3.38.2 php7-devel-7.4.6-150200.3.38.2 php7-dom-7.4.6-150200.3.38.2 php7-dom-debuginfo-7.4.6-150200.3.38.2 php7-enchant-7.4.6-150200.3.38.2 php7-enchant-debuginfo-7.4.6-150200.3.38.2 php7-exif-7.4.6-150200.3.38.2 php7-exif-debuginfo-7.4.6-150200.3.38.2 php7-fastcgi-7.4.6-150200.3.38.2 php7-fastcgi-debuginfo-7.4.6-150200.3.38.2 php7-fileinfo-7.4.6-150200.3.38.2 php7-fileinfo-debuginfo-7.4.6-150200.3.38.2 php7-fpm-7.4.6-150200.3.38.2 php7-fpm-debuginfo-7.4.6-150200.3.38.2 php7-ftp-7.4.6-150200.3.38.2 php7-ftp-debuginfo-7.4.6-150200.3.38.2 php7-gd-7.4.6-150200.3.38.2 php7-gd-debuginfo-7.4.6-150200.3.38.2 php7-gettext-7.4.6-150200.3.38.2 php7-gettext-debuginfo-7.4.6-150200.3.38.2 php7-gmp-7.4.6-150200.3.38.2 php7-gmp-debuginfo-7.4.6-150200.3.38.2 php7-iconv-7.4.6-150200.3.38.2 php7-iconv-debuginfo-7.4.6-150200.3.38.2 php7-intl-7.4.6-150200.3.38.2 php7-intl-debuginfo-7.4.6-150200.3.38.2 php7-json-7.4.6-150200.3.38.2 php7-json-debuginfo-7.4.6-150200.3.38.2 php7-ldap-7.4.6-150200.3.38.2 php7-ldap-debuginfo-7.4.6-150200.3.38.2 php7-mbstring-7.4.6-150200.3.38.2 php7-mbstring-debuginfo-7.4.6-150200.3.38.2 php7-mysql-7.4.6-150200.3.38.2 php7-mysql-debuginfo-7.4.6-150200.3.38.2 php7-odbc-7.4.6-150200.3.38.2 php7-odbc-debuginfo-7.4.6-150200.3.38.2 php7-opcache-7.4.6-150200.3.38.2 php7-opcache-debuginfo-7.4.6-150200.3.38.2 php7-openssl-7.4.6-150200.3.38.2 php7-openssl-debuginfo-7.4.6-150200.3.38.2 php7-pcntl-7.4.6-150200.3.38.2 php7-pcntl-debuginfo-7.4.6-150200.3.38.2 php7-pdo-7.4.6-150200.3.38.2 php7-pdo-debuginfo-7.4.6-150200.3.38.2 php7-pgsql-7.4.6-150200.3.38.2 php7-pgsql-debuginfo-7.4.6-150200.3.38.2 php7-phar-7.4.6-150200.3.38.2 php7-phar-debuginfo-7.4.6-150200.3.38.2 php7-posix-7.4.6-150200.3.38.2 php7-posix-debuginfo-7.4.6-150200.3.38.2 php7-readline-7.4.6-150200.3.38.2 php7-readline-debuginfo-7.4.6-150200.3.38.2 php7-shmop-7.4.6-150200.3.38.2 php7-shmop-debuginfo-7.4.6-150200.3.38.2 php7-snmp-7.4.6-150200.3.38.2 php7-snmp-debuginfo-7.4.6-150200.3.38.2 php7-soap-7.4.6-150200.3.38.2 php7-soap-debuginfo-7.4.6-150200.3.38.2 php7-sockets-7.4.6-150200.3.38.2 php7-sockets-debuginfo-7.4.6-150200.3.38.2 php7-sodium-7.4.6-150200.3.38.2 php7-sodium-debuginfo-7.4.6-150200.3.38.2 php7-sqlite-7.4.6-150200.3.38.2 php7-sqlite-debuginfo-7.4.6-150200.3.38.2 php7-sysvmsg-7.4.6-150200.3.38.2 php7-sysvmsg-debuginfo-7.4.6-150200.3.38.2 php7-sysvsem-7.4.6-150200.3.38.2 php7-sysvsem-debuginfo-7.4.6-150200.3.38.2 php7-sysvshm-7.4.6-150200.3.38.2 php7-sysvshm-debuginfo-7.4.6-150200.3.38.2 php7-tidy-7.4.6-150200.3.38.2 php7-tidy-debuginfo-7.4.6-150200.3.38.2 php7-tokenizer-7.4.6-150200.3.38.2 php7-tokenizer-debuginfo-7.4.6-150200.3.38.2 php7-xmlreader-7.4.6-150200.3.38.2 php7-xmlreader-debuginfo-7.4.6-150200.3.38.2 php7-xmlrpc-7.4.6-150200.3.38.2 php7-xmlrpc-debuginfo-7.4.6-150200.3.38.2 php7-xmlwriter-7.4.6-150200.3.38.2 php7-xmlwriter-debuginfo-7.4.6-150200.3.38.2 php7-xsl-7.4.6-150200.3.38.2 php7-xsl-debuginfo-7.4.6-150200.3.38.2 php7-zip-7.4.6-150200.3.38.2 php7-zip-debuginfo-7.4.6-150200.3.38.2 php7-zlib-7.4.6-150200.3.38.2 php7-zlib-debuginfo-7.4.6-150200.3.38.2 - SUSE Linux Enterprise Module for Packagehub Subpackages 15-SP3 (aarch64 ppc64le s390x x86_64): php7-debuginfo-7.4.6-150200.3.38.2 php7-debugsource-7.4.6-150200.3.38.2 php7-embed-7.4.6-150200.3.38.2 php7-embed-debuginfo-7.4.6-150200.3.38.2 References: https://bugzilla.suse.com/1197644

1 0