September 2023 - openSUSE Updates - openSUSE Mailing Lists

SUSE-SU-2023:3792-1: moderate: Security update for ImageMagick
by maintenance＠opensuse.org 26 Sep '23

26 Sep '23

# Security update for ImageMagick Announcement ID: SUSE-SU-2023:3792-1 Rating: moderate References: * #1214578 Cross-References: * CVE-2020-21679 CVSS scores: * CVE-2020-21679 ( NVD ): 5.5 CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H Affected Products: * openSUSE Leap 15.4 An update that solves one vulnerability can now be installed. ## Description: This update for ImageMagick fixes the following issues: * CVE-2020-21679: Fixed a buffer overflow in WritePCXImage function in pcx.c which may allow a remote attackers to cause a denial of service. (bsc#1214578) ## Patch Instructions: To install this SUSE update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: * openSUSE Leap 15.4 zypper in -t patch openSUSE-SLE-15.4-2023-3792=1 ## Package List: * openSUSE Leap 15.4 (x86_64) * libMagick++-7_Q16HDRI4-32bit-debuginfo-7.0.7.34-150200.10.54.1 * libMagick++-7_Q16HDRI4-32bit-7.0.7.34-150200.10.54.1 * libMagickWand-7_Q16HDRI6-32bit-debuginfo-7.0.7.34-150200.10.54.1 * libMagickWand-7_Q16HDRI6-32bit-7.0.7.34-150200.10.54.1 * libMagickCore-7_Q16HDRI6-32bit-7.0.7.34-150200.10.54.1 * libMagickCore-7_Q16HDRI6-32bit-debuginfo-7.0.7.34-150200.10.54.1 * openSUSE Leap 15.4 (aarch64 ppc64le s390x x86_64) * libMagickCore-7_Q16HDRI6-7.0.7.34-150200.10.54.1 * libMagickWand-7_Q16HDRI6-debuginfo-7.0.7.34-150200.10.54.1 * libMagick++-7_Q16HDRI4-debuginfo-7.0.7.34-150200.10.54.1 * libMagickCore-7_Q16HDRI6-debuginfo-7.0.7.34-150200.10.54.1 * libMagickWand-7_Q16HDRI6-7.0.7.34-150200.10.54.1 * libMagick++-7_Q16HDRI4-7.0.7.34-150200.10.54.1 ## References: * https://www.suse.com/security/cve/CVE-2020-21679.html * https://bugzilla.suse.com/show_bug.cgi?id=1214578

1 0

SUSE-RU-2023:3797-1: moderate: Recommended update for saptune
by maintenance＠opensuse.org 26 Sep '23

26 Sep '23

# Recommended update for saptune Announcement ID: SUSE-RU-2023:3797-1 Rating: moderate References: * #1193714 * #1194688 * #1199527 * PED-2194 * PED-2195 * PED-2196 * PED-2199 * PED-4118 * SLE-23696 * SLE-23722 * SLE-23724 * SLE-23725 * SLE-23726 * SLE-23727 * SLE-23729 * SLE-23779 * SLE-23824 * SLE-23885 * SLE-24530 * SLE-24928 Affected Products: * openSUSE Leap 15.4 * openSUSE Leap 15.5 * SAP Applications Module 15-SP2 * SAP Applications Module 15-SP1 * SAP Applications Module 15-SP3 * SAP Applications Module 15-SP4 * SAP Applications Module 15-SP5 * SUSE Linux Enterprise Server for SAP Applications 15 SP1 * SUSE Linux Enterprise Server for SAP Applications 15 SP2 * SUSE Linux Enterprise Server for SAP Applications 15 SP3 * SUSE Linux Enterprise Server for SAP Applications 15 SP4 * SUSE Linux Enterprise Server for SAP Applications 15 SP5 An update that contains 17 features and has three fixes can now be installed. ## Description: This update for saptune fixes the following issues: * update package version of saptune to 3.1.0 * Machine readable interfaces for saptune add json output support. * Enhance the identification of the cloud service provider. (jsc#SLE-23779) * Add a command line syntax check. * Colorized and filtered output for 'saptune note verify'. (jsc#SLE-23727) * Add action 'saptune solution change' to switch to a new solution even that another solution was already applied. (jsc#PED-2196) * Introduce a Trento naming convention for custom solutions in the saptune man page to support trento checks. (jsc#PED-4118) * Deprecate action 'saptune note|solution simulate'. (jsc#PED-2199) * Deprecate support for the v1 vendor or custom specific Note definition file format. (jsc#SLE-23725) * Detect virtualization environment by 'systemd-detect-virt' and add the information to 'saptune status'. (jsc#SLE-23885) * Enhance saptune with the new action 'check' to directly call the external check script '/usr/sbin/saptune_check'. (jsc#SLE-23726) * De-deprecate the MAXDB solution definition. It is still active supported by SAP, and add solution NETWEAVER+MAXDB. (jsc#SLE-23724) * Support inline comments in the Note definition files. (jsc#SLE-23729) * Rework Note representation in 'saptune status' output. (jsc#SLE-24530) * Fix problem with 'verify' output, if a sysctl parameter is empty on the system. (bsc#1199527) * Add hint to the manual page of saptune(8) regarding 'missing' line feed for 'saptune note applied' and 'saptune note enabled'. (bsc#1193714) * Rework the version section to make it clear, which information needs to be provided. (jsc#SLE-23722) * Add more information to 'saptune status': Differ between 'enabled' and 'applied' Solutions and add the related Notes. Differ between Notes and Solutions in the staging area. rename 'system state' line to 'systemd system state' to prevent misunderstandings. Add virtualisation information. * Add tuning state to 'saptune status' output. The check of the tuning state can be skipped by using the flag '\--non-compliance-check'. In this case the tuning state will be reported as unknown (checking disabled) 'saptune status' will exit with a return code of '4', if the saptune service is enabled, the system is tuned, but the tuning state is 'not compliant'. (jsc#SLE-24928) * Add support for the IBM Power architecture to the vendor and model section tagging. (jsc#SLE-23824) Implement the following SAP Notes: 1868829. 3024346, 1557506, 1656250, 1805750, 2161991, 2205917, 2382421, 2534844, 1984787, 2578899, 2684254, 1680803 * Solution 'SAP-ASE' changed - remove SAP Note 1410736. The best practice document (version 3.1) for ASE was changed and the SAP Note 1410736 is no longer referenced. Instead the parameter 'net.ipv4.tcp_keepalive_time' is set in SAP Note 1680803 (the ASE SAP Note) directly. * Check in preinstall and posttrans of the package installation, if the active tuned profile is still 'saptune', even that this profile no longer exists. If yes, try to remove it. (bsc#1194688) ## Patch Instructions: To install this SUSE update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: * openSUSE Leap 15.4 zypper in -t patch openSUSE-SLE-15.4-2023-3797=1 * openSUSE Leap 15.5 zypper in -t patch openSUSE-SLE-15.5-2023-3797=1 * SAP Applications Module 15-SP1 zypper in -t patch SUSE-SLE-Module-SAP-Applications-15-SP1-2023-3797=1 * SAP Applications Module 15-SP2 zypper in -t patch SUSE-SLE-Module-SAP-Applications-15-SP2-2023-3797=1 * SAP Applications Module 15-SP3 zypper in -t patch SUSE-SLE-Module-SAP-Applications-15-SP3-2023-3797=1 * SAP Applications Module 15-SP4 zypper in -t patch SUSE-SLE-Module-SAP-Applications-15-SP4-2023-3797=1 * SAP Applications Module 15-SP5 zypper in -t patch SUSE-SLE-Module-SAP-Applications-15-SP5-2023-3797=1 ## Package List: * openSUSE Leap 15.4 (ppc64le x86_64) * saptune-debuginfo-3.1.0-150100.8.27.1 * saptune-3.1.0-150100.8.27.1 * openSUSE Leap 15.5 (ppc64le x86_64) * saptune-debuginfo-3.1.0-150100.8.27.1 * saptune-3.1.0-150100.8.27.1 * SAP Applications Module 15-SP1 (ppc64le x86_64) * saptune-debuginfo-3.1.0-150100.8.27.1 * saptune-3.1.0-150100.8.27.1 * SAP Applications Module 15-SP2 (ppc64le x86_64) * saptune-debuginfo-3.1.0-150100.8.27.1 * saptune-3.1.0-150100.8.27.1 * SAP Applications Module 15-SP3 (ppc64le x86_64) * saptune-debuginfo-3.1.0-150100.8.27.1 * saptune-3.1.0-150100.8.27.1 * SAP Applications Module 15-SP4 (ppc64le x86_64) * saptune-debuginfo-3.1.0-150100.8.27.1 * saptune-3.1.0-150100.8.27.1 * SAP Applications Module 15-SP5 (ppc64le x86_64) * saptune-debuginfo-3.1.0-150100.8.27.1 * saptune-3.1.0-150100.8.27.1 ## References: * https://bugzilla.suse.com/show_bug.cgi?id=1193714 * https://bugzilla.suse.com/show_bug.cgi?id=1194688 * https://bugzilla.suse.com/show_bug.cgi?id=1199527 * https://jira.suse.com/browse/PED-2194 * https://jira.suse.com/browse/PED-2195 * https://jira.suse.com/browse/PED-2196 * https://jira.suse.com/browse/PED-2199 * https://jira.suse.com/browse/PED-4118 * https://jira.suse.com/browse/SLE-23696 * https://jira.suse.com/browse/SLE-23722 * https://jira.suse.com/browse/SLE-23724 * https://jira.suse.com/browse/SLE-23725 * https://jira.suse.com/browse/SLE-23726 * https://jira.suse.com/browse/SLE-23727 * https://jira.suse.com/browse/SLE-23729 * https://jira.suse.com/browse/SLE-23779 * https://jira.suse.com/browse/SLE-23824 * https://jira.suse.com/browse/SLE-23885 * https://jira.suse.com/browse/SLE-24530 * https://jira.suse.com/browse/SLE-24928

1 0

openSUSE-SU-2023:0275-1: important: Security update for cacti, cacti-spine
by opensuse-security＠opensuse.org 26 Sep '23

26 Sep '23

openSUSE Security Update: Security update for cacti, cacti-spine ______________________________________________________________________________ Announcement ID: openSUSE-SU-2023:0275-1 Rating: important References: #1215040 #1215042 #1215043 #1215044 #1215045 #1215047 #1215050 #1215051 #1215052 #1215053 #1215054 #1215055 #1215056 #1215058 #1215059 #1215081 #1215082 Cross-References: CVE-2023-30534 CVE-2023-39357 CVE-2023-39358 CVE-2023-39359 CVE-2023-39360 CVE-2023-39361 CVE-2023-39362 CVE-2023-39364 CVE-2023-39365 CVE-2023-39366 CVE-2023-39510 CVE-2023-39511 CVE-2023-39512 CVE-2023-39513 CVE-2023-39514 CVE-2023-39515 CVE-2023-39516 CVSS scores: CVE-2023-30534 (NVD) : 4.3 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N CVE-2023-39357 (NVD) : 8.8 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H CVE-2023-39358 (NVD) : 8.8 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H CVE-2023-39359 (NVD) : 8.8 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H CVE-2023-39360 (NVD) : 6.1 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N CVE-2023-39361 (NVD) : 9.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H CVE-2023-39362 (NVD) : 7.2 CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H CVE-2023-39364 (NVD) : 3.5 CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:L/I:N/A:N CVE-2023-39365 (NVD) : 4.6 CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:L/I:N/A:L CVE-2023-39366 (NVD) : 6.1 CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:U/C:H/I:H/A:N CVE-2023-39510 (NVD) : 6.1 CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:U/C:H/I:H/A:N CVE-2023-39511 (NVD) : 6.1 CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:U/C:H/I:H/A:N CVE-2023-39512 (NVD) : 6.1 CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:U/C:H/I:H/A:N CVE-2023-39513 (NVD) : 6.1 CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:U/C:H/I:H/A:N CVE-2023-39514 (NVD) : 6.1 CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:U/C:H/I:H/A:N CVE-2023-39515 (NVD) : 6.1 CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:U/C:H/I:H/A:N CVE-2023-39516 (NVD) : 6.1 CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:U/C:H/I:H/A:N Affected Products: SUSE Linux Enterprise High Performance Computing 12 SUSE Linux Enterprise Server 12 SUSE Linux Enterprise Server 12-SP3 SUSE Linux Enterprise Server 12-SP4 SUSE Linux Enterprise Server 12-SP5 SUSE Linux Enterprise Server for SAP Applications 12 SUSE Linux Enterprise Server for SAP Applications 12-SP3 SUSE Linux Enterprise Server for SAP Applications 12-SP4 SUSE Linux Enterprise Server for SAP Applications 12-SP5 SUSE Package Hub for SUSE Linux Enterprise 12 openSUSE Backports SLE-15-SP4 openSUSE Backports SLE-15-SP5 ______________________________________________________________________________ An update that fixes 17 vulnerabilities is now available. Description: This update for cacti, cacti-spine fixes the following issues: cacti-spine 1.2.25: * Spine should see if script to be executed is executable * Enhance number recognition * When polling devices, sort by larger number of items first * Log format may be corrupted when timeout occurs * Compile warning appears due to GCC flag on RHEL7/RHEL8 * Downed device detection only checks one of the two uptime OIDs * Compile error appears due to execinfo.h on FreeBSD * Bootstrap shell script contains some PHP cruft * Padding is not always removed from the start of non-numeric strings * Improve SNMP result handling for non-numeric results * Further improve SNMP result handling for non-numeric results * Remove check for the max_oids column which has been present since Cacti v1.0 * Minimize Sorting when fetching poller records for maximum performance * Spine should see if script to be executed is executable cacti-spine 1.2.24: * Fix segfault when ignoring older OIDs cacti 1.2.25: * CVE-2023-30534: Protect against Insecure deserialization of filter data (boo#1215082) * CVE-2023-39360: Cross-Site Scripting vulnerability when creating new graphs (boo#1215044) * CVE-2023-39361: Unauthenticated SQL Injection when viewing graphs (boo#1215045) * CVE-2023-39357: SQL Injection when saving data with sql_save() (boo#1215040) * CVE-2023-39362: Authenticated command injection when using SNMP options (boo#1215047) * CVE-2023-39359: Authenticated SQL injection vulnerability when managing graphs (boo#1215043) * CVE-2023-39358: Authenticated SQL injection vulnerability when managing reports (boo#1215042) * CVE-2023-39365: SQL Injection when using regular expressions (boo#1215051) * CVE-2023-39364: redirect in change password functionality (boo#1215050) * CVE-2023-39366: Cross-Site Scripting vulnerability with Device Name when managing Data Sources (boo#1215052) * CVE-2023-39510: Cross-Site Scripting vulnerability with Device Name when administrating Reports (boo#1215053) * CVE-2023-39511: Cross-Site Scripting vulnerability with Device Name when editing Graphs whilst managing Reports (boo#1215081) * CVE-2023-39512: Cross-Site Scripting vulnerability with Device Name when managing Data Sources (boo#1215054) * CVE-2023-39513: Cross-Site Scripting vulnerability with Device Name when debugging data queries (boo#1215055) * CVE-2023-39514: Cross-Site Scripting vulnerability with Data Source Name when managing Graphs (boo#1215056) * CVE-2023-39515: Cross-Site Scripting vulnerability with Data Source Name when debugging Data Queries (boo#1215058) * CVE-2023-39516: Cross-Site Scripting vulnerability with Data Source Information when managing Data Sources (boo#1215059) * When rebuilding the Poller Cache from command line, allow it to be multi-threaded * When searching tree or list views, the URL does not update after changes * When creating a Data Source Template with a specific snmp port, the port is not always applied * When a Data Query references a file, the filename should be trimmed to remove spurious spaces * THold plugin may not always install or upgrade properly * RRD file structures are not always updated properly, if there are more Data Sources in the Data Template than the Graph Template * When reindexing devices, errors may sometimes be shown * Boost may loose data when the database server is overloaded * Boost can sometimes output unexpected or invalid values * Boost should not attempt to start if there are no items to process * Rebuilding the poller cache does not always work as expected * Host CPU items may not work poll as expected when on a remote data collector where hmib is also enabled * When creating new graphs, invalid offset errors may be generated * When importing packages, SQL errors may be generated * When managing plugins from command line, the --plugin option is not properly handled * When automating an install of Cacti, error messages can be appear * When performing automated install of a plugin, warnings can be thrown * Automation references the wrong table name causing errors * Data Source Info Mode produces invalid recommendations * Data Source Debug 'Run All' generates too many log messages * The description of rebuild poller cache in utilities does not display properly * When reindexing a device, debug information may not always display properly * Upon displaying a form with errors, the session error fields variable isn't cleared * MariaDB clusters will no longer support exclusive locks * RRDtool can fail to update when sources in Data Template and Graph Template data sources do not match * Compatibility improvements for Boost under PHP 8.x * When searching the tree, increase the time before querying for items * Device Location drop down does not always populate correctly * When viewing Realtime graphs, undefined variable errors may be reported * SNMP Uptime is not always ignored for spikekills * Improve detection of downed Devices * When reporting missing functions from Plugins, ensure messages do not occur too often * When starting the Cacti daemon, database errors may be reported when there is no problem * When reporting from RRDcheck, ensure prefix is in the correct casing * Improve Orphaned Data Source options and display * Parsing the PHP Configuration may sometimes produce errors * Security processes attempt to check for a user lockout even if there is no user logged in * When attempting to edit a tree, the search filter for Graphs remains disabled * When reindexing, a Data Source that could be un-orphaned may not always be unorphaned * When parsing a date value, there could be more than 30 chars * Untemplated Data Sources can fail to update due to lack of an assigned Graph * When processing items to check, do not include disabled hosts * When saving a Data Source Template, SQL errors may be reported * When importing a Template, errors may be recorded * Some display strings have invalid formatting that cannot be parsed * When filtering with regular expressions, the 'does not match' option does not always function as expected * When enabling a plugin, sometimes it can appear as if nothing happens * Ensure the Rows Per Page option shows limitations set by configuration * Plugins are unable to modify fields in the setting 'Change Device Settings' * When reporting emails being sent, ensure BCC addresses are also included * Improve compatibility of SNMP class trim handling under PHP 8.x * When importing legacy Data Query Templates, the Template can become unusable * Provide ability to raise an event when extending the settings form * Prevent unsupported SQL Mode flags from being set * The DSStats summary does not always display expected values * When performing a fresh install, device classification may be missing. * Duplication functions for Graph/Template and Data Source/Template do not return and id * Duplication of Device Templates should be an API call * Unable to convert database to latin1 instead of utf8 if desired * When creating Graphs, the process may become slower over time as more items exist * When a bulk walk size is set to automatic, this is not always set to the optimal value * Update copyright notice on import packages * When viewing Orphan Graphs, SQL errors may be reported * When reindexing hosts from command line, ensure only one process runs at once * When a Data Query has no Graphs, it may not be deletable * When duplicating a Graph Template, provide an option to not duplicate Data Query association * When duplicating a Data Template errors can appear in the Cacti log * When importing a Package, previewing makes unexpected changes to Cacti Templates * When enabling boost on a fresh install, an error may be reported * Improve compatibility for backtrace logging under PHP 8.x * Improve compatibility for Advanced Ping under PHP 8.x * Provide new templates for Fortigate and Aruba Cluster to be available during install * Provide new template for SNMP Printer to be available during install * When importing devices, allow a device classification to be known * Extend length of maximum name in settings table * Extend length of maximum name in user settings table * Data Queries do not have a Duplication function * Upgrade d3.js v7.8.2 and billboard.js v3.7.4 * Upgrade ua-parser.js to version 1.0.35 * Update Cisco Device Template to include HSRP graph template * New hook for device template change 'device_template_change' cacti 1.2.24 * Fix: Unable to import Local Linux Machine template * Fix multiple charting and display issues * Compatibility changes for SNMP under PHP 8.2, and other PHP compatibility updates * Fix multiple issues editing settings * timeout fixes for Basic Auth * multiple data poller bug fixes Patch Instructions: To install this openSUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Backports SLE-15-SP5: zypper in -t patch openSUSE-2023-275=1 - openSUSE Backports SLE-15-SP4: zypper in -t patch openSUSE-2023-275=1 - SUSE Package Hub for SUSE Linux Enterprise 12: zypper in -t patch openSUSE-2023-275=1 Package List: - openSUSE Backports SLE-15-SP5 (aarch64 i586 ppc64le s390x x86_64): cacti-spine-1.2.25-bp155.2.3.1 cacti-spine-debuginfo-1.2.25-bp155.2.3.1 cacti-spine-debugsource-1.2.25-bp155.2.3.1 - openSUSE Backports SLE-15-SP5 (noarch): cacti-1.2.25-bp155.2.3.1 - openSUSE Backports SLE-15-SP4 (aarch64 i586 ppc64le s390x x86_64): cacti-spine-1.2.25-bp154.2.9.1 - openSUSE Backports SLE-15-SP4 (noarch): cacti-1.2.25-bp154.2.9.1 - SUSE Package Hub for SUSE Linux Enterprise 12 (aarch64 ppc64le s390x x86_64): cacti-spine-1.2.25-29.1 - SUSE Package Hub for SUSE Linux Enterprise 12 (noarch): cacti-1.2.25-35.1 References: https://www.suse.com/security/cve/CVE-2023-30534.html https://www.suse.com/security/cve/CVE-2023-39357.html https://www.suse.com/security/cve/CVE-2023-39358.html https://www.suse.com/security/cve/CVE-2023-39359.html https://www.suse.com/security/cve/CVE-2023-39360.html https://www.suse.com/security/cve/CVE-2023-39361.html https://www.suse.com/security/cve/CVE-2023-39362.html https://www.suse.com/security/cve/CVE-2023-39364.html https://www.suse.com/security/cve/CVE-2023-39365.html https://www.suse.com/security/cve/CVE-2023-39366.html https://www.suse.com/security/cve/CVE-2023-39510.html https://www.suse.com/security/cve/CVE-2023-39511.html https://www.suse.com/security/cve/CVE-2023-39512.html https://www.suse.com/security/cve/CVE-2023-39513.html https://www.suse.com/security/cve/CVE-2023-39514.html https://www.suse.com/security/cve/CVE-2023-39515.html https://www.suse.com/security/cve/CVE-2023-39516.html https://bugzilla.suse.com/1215040 https://bugzilla.suse.com/1215042 https://bugzilla.suse.com/1215043 https://bugzilla.suse.com/1215044 https://bugzilla.suse.com/1215045 https://bugzilla.suse.com/1215047 https://bugzilla.suse.com/1215050 https://bugzilla.suse.com/1215051 https://bugzilla.suse.com/1215052 https://bugzilla.suse.com/1215053 https://bugzilla.suse.com/1215054 https://bugzilla.suse.com/1215055 https://bugzilla.suse.com/1215056 https://bugzilla.suse.com/1215058 https://bugzilla.suse.com/1215059 https://bugzilla.suse.com/1215081 https://bugzilla.suse.com/1215082

1 0

openSUSE-SU-2023:0275-1: important: Security update for cacti, cacti-spine
by opensuse-security＠opensuse.org 26 Sep '23

26 Sep '23

openSUSE Security Update: Security update for cacti, cacti-spine ______________________________________________________________________________ Announcement ID: openSUSE-SU-2023:0275-1 Rating: important References: #1215040 #1215042 #1215043 #1215044 #1215045 #1215047 #1215050 #1215051 #1215052 #1215053 #1215054 #1215055 #1215056 #1215058 #1215059 #1215081 #1215082 Cross-References: CVE-2023-30534 CVE-2023-39357 CVE-2023-39358 CVE-2023-39359 CVE-2023-39360 CVE-2023-39361 CVE-2023-39362 CVE-2023-39364 CVE-2023-39365 CVE-2023-39366 CVE-2023-39510 CVE-2023-39511 CVE-2023-39512 CVE-2023-39513 CVE-2023-39514 CVE-2023-39515 CVE-2023-39516 CVSS scores: CVE-2023-30534 (NVD) : 4.3 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N CVE-2023-39357 (NVD) : 8.8 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H CVE-2023-39358 (NVD) : 8.8 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H CVE-2023-39359 (NVD) : 8.8 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H CVE-2023-39360 (NVD) : 6.1 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N CVE-2023-39361 (NVD) : 9.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H CVE-2023-39362 (NVD) : 7.2 CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H CVE-2023-39364 (NVD) : 3.5 CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:L/I:N/A:N CVE-2023-39365 (NVD) : 4.6 CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:L/I:N/A:L CVE-2023-39366 (NVD) : 6.1 CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:U/C:H/I:H/A:N CVE-2023-39510 (NVD) : 6.1 CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:U/C:H/I:H/A:N CVE-2023-39511 (NVD) : 6.1 CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:U/C:H/I:H/A:N CVE-2023-39512 (NVD) : 6.1 CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:U/C:H/I:H/A:N CVE-2023-39513 (NVD) : 6.1 CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:U/C:H/I:H/A:N CVE-2023-39514 (NVD) : 6.1 CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:U/C:H/I:H/A:N CVE-2023-39515 (NVD) : 6.1 CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:U/C:H/I:H/A:N CVE-2023-39516 (NVD) : 6.1 CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:U/C:H/I:H/A:N Affected Products: SUSE Linux Enterprise High Performance Computing 12 SUSE Linux Enterprise Server 12 SUSE Linux Enterprise Server 12-SP3 SUSE Linux Enterprise Server 12-SP4 SUSE Linux Enterprise Server 12-SP5 SUSE Linux Enterprise Server for SAP Applications 12 SUSE Linux Enterprise Server for SAP Applications 12-SP3 SUSE Linux Enterprise Server for SAP Applications 12-SP4 SUSE Linux Enterprise Server for SAP Applications 12-SP5 SUSE Package Hub for SUSE Linux Enterprise 12 ______________________________________________________________________________ An update that fixes 17 vulnerabilities is now available. Description: This update for cacti, cacti-spine fixes the following issues: cacti-spine 1.2.25: * Spine should see if script to be executed is executable * Enhance number recognition * When polling devices, sort by larger number of items first * Log format may be corrupted when timeout occurs * Compile warning appears due to GCC flag on RHEL7/RHEL8 * Downed device detection only checks one of the two uptime OIDs * Compile error appears due to execinfo.h on FreeBSD * Bootstrap shell script contains some PHP cruft * Padding is not always removed from the start of non-numeric strings * Improve SNMP result handling for non-numeric results * Further improve SNMP result handling for non-numeric results * Remove check for the max_oids column which has been present since Cacti v1.0 * Minimize Sorting when fetching poller records for maximum performance * Spine should see if script to be executed is executable cacti-spine 1.2.24: * Fix segfault when ignoring older OIDs cacti 1.2.25: * CVE-2023-30534: Protect against Insecure deserialization of filter data (boo#1215082) * CVE-2023-39360: Cross-Site Scripting vulnerability when creating new graphs (boo#1215044) * CVE-2023-39361: Unauthenticated SQL Injection when viewing graphs (boo#1215045) * CVE-2023-39357: SQL Injection when saving data with sql_save() (boo#1215040) * CVE-2023-39362: Authenticated command injection when using SNMP options (boo#1215047) * CVE-2023-39359: Authenticated SQL injection vulnerability when managing graphs (boo#1215043) * CVE-2023-39358: Authenticated SQL injection vulnerability when managing reports (boo#1215042) * CVE-2023-39365: SQL Injection when using regular expressions (boo#1215051) * CVE-2023-39364: redirect in change password functionality (boo#1215050) * CVE-2023-39366: Cross-Site Scripting vulnerability with Device Name when managing Data Sources (boo#1215052) * CVE-2023-39510: Cross-Site Scripting vulnerability with Device Name when administrating Reports (boo#1215053) * CVE-2023-39511: Cross-Site Scripting vulnerability with Device Name when editing Graphs whilst managing Reports (boo#1215081) * CVE-2023-39512: Cross-Site Scripting vulnerability with Device Name when managing Data Sources (boo#1215054) * CVE-2023-39513: Cross-Site Scripting vulnerability with Device Name when debugging data queries (boo#1215055) * CVE-2023-39514: Cross-Site Scripting vulnerability with Data Source Name when managing Graphs (boo#1215056) * CVE-2023-39515: Cross-Site Scripting vulnerability with Data Source Name when debugging Data Queries (boo#1215058) * CVE-2023-39516: Cross-Site Scripting vulnerability with Data Source Information when managing Data Sources (boo#1215059) * When rebuilding the Poller Cache from command line, allow it to be multi-threaded * When searching tree or list views, the URL does not update after changes * When creating a Data Source Template with a specific snmp port, the port is not always applied * When a Data Query references a file, the filename should be trimmed to remove spurious spaces * THold plugin may not always install or upgrade properly * RRD file structures are not always updated properly, if there are more Data Sources in the Data Template than the Graph Template * When reindexing devices, errors may sometimes be shown * Boost may loose data when the database server is overloaded * Boost can sometimes output unexpected or invalid values * Boost should not attempt to start if there are no items to process * Rebuilding the poller cache does not always work as expected * Host CPU items may not work poll as expected when on a remote data collector where hmib is also enabled * When creating new graphs, invalid offset errors may be generated * When importing packages, SQL errors may be generated * When managing plugins from command line, the --plugin option is not properly handled * When automating an install of Cacti, error messages can be appear * When performing automated install of a plugin, warnings can be thrown * Automation references the wrong table name causing errors * Data Source Info Mode produces invalid recommendations * Data Source Debug 'Run All' generates too many log messages * The description of rebuild poller cache in utilities does not display properly * When reindexing a device, debug information may not always display properly * Upon displaying a form with errors, the session error fields variable isn't cleared * MariaDB clusters will no longer support exclusive locks * RRDtool can fail to update when sources in Data Template and Graph Template data sources do not match * Compatibility improvements for Boost under PHP 8.x * When searching the tree, increase the time before querying for items * Device Location drop down does not always populate correctly * When viewing Realtime graphs, undefined variable errors may be reported * SNMP Uptime is not always ignored for spikekills * Improve detection of downed Devices * When reporting missing functions from Plugins, ensure messages do not occur too often * When starting the Cacti daemon, database errors may be reported when there is no problem * When reporting from RRDcheck, ensure prefix is in the correct casing * Improve Orphaned Data Source options and display * Parsing the PHP Configuration may sometimes produce errors * Security processes attempt to check for a user lockout even if there is no user logged in * When attempting to edit a tree, the search filter for Graphs remains disabled * When reindexing, a Data Source that could be un-orphaned may not always be unorphaned * When parsing a date value, there could be more than 30 chars * Untemplated Data Sources can fail to update due to lack of an assigned Graph * When processing items to check, do not include disabled hosts * When saving a Data Source Template, SQL errors may be reported * When importing a Template, errors may be recorded * Some display strings have invalid formatting that cannot be parsed * When filtering with regular expressions, the 'does not match' option does not always function as expected * When enabling a plugin, sometimes it can appear as if nothing happens * Ensure the Rows Per Page option shows limitations set by configuration * Plugins are unable to modify fields in the setting 'Change Device Settings' * When reporting emails being sent, ensure BCC addresses are also included * Improve compatibility of SNMP class trim handling under PHP 8.x * When importing legacy Data Query Templates, the Template can become unusable * Provide ability to raise an event when extending the settings form * Prevent unsupported SQL Mode flags from being set * The DSStats summary does not always display expected values * When performing a fresh install, device classification may be missing. * Duplication functions for Graph/Template and Data Source/Template do not return and id * Duplication of Device Templates should be an API call * Unable to convert database to latin1 instead of utf8 if desired * When creating Graphs, the process may become slower over time as more items exist * When a bulk walk size is set to automatic, this is not always set to the optimal value * Update copyright notice on import packages * When viewing Orphan Graphs, SQL errors may be reported * When reindexing hosts from command line, ensure only one process runs at once * When a Data Query has no Graphs, it may not be deletable * When duplicating a Graph Template, provide an option to not duplicate Data Query association * When duplicating a Data Template errors can appear in the Cacti log * When importing a Package, previewing makes unexpected changes to Cacti Templates * When enabling boost on a fresh install, an error may be reported * Improve compatibility for backtrace logging under PHP 8.x * Improve compatibility for Advanced Ping under PHP 8.x * Provide new templates for Fortigate and Aruba Cluster to be available during install * Provide new template for SNMP Printer to be available during install * When importing devices, allow a device classification to be known * Extend length of maximum name in settings table * Extend length of maximum name in user settings table * Data Queries do not have a Duplication function * Upgrade d3.js v7.8.2 and billboard.js v3.7.4 * Upgrade ua-parser.js to version 1.0.35 * Update Cisco Device Template to include HSRP graph template * New hook for device template change 'device_template_change' cacti 1.2.24 * Fix: Unable to import Local Linux Machine template * Fix multiple charting and display issues * Compatibility changes for SNMP under PHP 8.2, and other PHP compatibility updates * Fix multiple issues editing settings * timeout fixes for Basic Auth * multiple data poller bug fixes Patch Instructions: To install this openSUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - SUSE Package Hub for SUSE Linux Enterprise 12: zypper in -t patch openSUSE-2023-275=1 Package List: - SUSE Package Hub for SUSE Linux Enterprise 12 (aarch64 ppc64le s390x x86_64): cacti-spine-1.2.25-29.1 - SUSE Package Hub for SUSE Linux Enterprise 12 (noarch): cacti-1.2.25-35.1 References: https://www.suse.com/security/cve/CVE-2023-30534.html https://www.suse.com/security/cve/CVE-2023-39357.html https://www.suse.com/security/cve/CVE-2023-39358.html https://www.suse.com/security/cve/CVE-2023-39359.html https://www.suse.com/security/cve/CVE-2023-39360.html https://www.suse.com/security/cve/CVE-2023-39361.html https://www.suse.com/security/cve/CVE-2023-39362.html https://www.suse.com/security/cve/CVE-2023-39364.html https://www.suse.com/security/cve/CVE-2023-39365.html https://www.suse.com/security/cve/CVE-2023-39366.html https://www.suse.com/security/cve/CVE-2023-39510.html https://www.suse.com/security/cve/CVE-2023-39511.html https://www.suse.com/security/cve/CVE-2023-39512.html https://www.suse.com/security/cve/CVE-2023-39513.html https://www.suse.com/security/cve/CVE-2023-39514.html https://www.suse.com/security/cve/CVE-2023-39515.html https://www.suse.com/security/cve/CVE-2023-39516.html https://bugzilla.suse.com/1215040 https://bugzilla.suse.com/1215042 https://bugzilla.suse.com/1215043 https://bugzilla.suse.com/1215044 https://bugzilla.suse.com/1215045 https://bugzilla.suse.com/1215047 https://bugzilla.suse.com/1215050 https://bugzilla.suse.com/1215051 https://bugzilla.suse.com/1215052 https://bugzilla.suse.com/1215053 https://bugzilla.suse.com/1215054 https://bugzilla.suse.com/1215055 https://bugzilla.suse.com/1215056 https://bugzilla.suse.com/1215058 https://bugzilla.suse.com/1215059 https://bugzilla.suse.com/1215081 https://bugzilla.suse.com/1215082

1 0

SUSE-SU-2023:3790-1: important: Security update for wire
by maintenance＠opensuse.org 26 Sep '23

26 Sep '23

# Security update for wire Announcement ID: SUSE-SU-2023:3790-1 Rating: important References: * #1212475 Affected Products: * openSUSE Leap 15.4 * openSUSE Leap 15.5 An update that has one security fix can now be installed. ## Description: This update of wire fixes the following issues: * rebuild the package with the go 1.21 security release (bsc#1212475). ## Patch Instructions: To install this SUSE update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: * openSUSE Leap 15.4 zypper in -t patch openSUSE-SLE-15.4-2023-3790=1 * openSUSE Leap 15.5 zypper in -t patch openSUSE-SLE-15.5-2023-3790=1 ## Package List: * openSUSE Leap 15.4 (aarch64 ppc64le s390x x86_64) * wire-debuginfo-0.5.0-150000.1.14.1 * wire-0.5.0-150000.1.14.1 * openSUSE Leap 15.5 (aarch64 ppc64le s390x x86_64) * wire-debuginfo-0.5.0-150000.1.14.1 * wire-0.5.0-150000.1.14.1 ## References: * https://bugzilla.suse.com/show_bug.cgi?id=1212475

1 0

SUSE-SU-2023:3791-1: moderate: Security update for postfix
by maintenance＠opensuse.org 26 Sep '23

26 Sep '23

# Security update for postfix Announcement ID: SUSE-SU-2023:3791-1 Rating: moderate References: * #1211196 * #1215372 Cross-References: * CVE-2023-32182 CVSS scores: * CVE-2023-32182 ( SUSE ): 5.5 CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N * CVE-2023-32182 ( NVD ): 5.9 CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L Affected Products: * openSUSE Leap 15.4 An update that solves one vulnerability and has one security fix can now be installed. ## Description: This update for postfix fixes the following issues: Security fixes: * CVE-2023-32182: Fixed config_postfix SUSE specific script using potentially bad /tmp file (bsc#1211196). Other fixes: * postfix: config.postfix causes too tight permission on main.cf (bsc#1215372). ## Patch Instructions: To install this SUSE update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: * openSUSE Leap 15.4 zypper in -t patch openSUSE-SLE-15.4-2023-3791=1 ## Package List: * openSUSE Leap 15.4 (aarch64 ppc64le s390x x86_64) * postfix-lmdb-debuginfo-3.4.7-150200.3.12.2 * postfix-lmdb-3.4.7-150200.3.12.2 ## References: * https://www.suse.com/security/cve/CVE-2023-32182.html * https://bugzilla.suse.com/show_bug.cgi?id=1211196 * https://bugzilla.suse.com/show_bug.cgi?id=1215372

1 0

openSUSE-RU-2023:0274-1: moderate: Recommended update for sushi
by maintenance＠opensuse.org 26 Sep '23

26 Sep '23

openSUSE Recommended Update: Recommended update for sushi ______________________________________________________________________________ Announcement ID: openSUSE-RU-2023:0274-1 Rating: moderate References: #1211546 Affected Products: openSUSE Backports SLE-15-SP5 ______________________________________________________________________________ An update that has one recommended fix can now be installed. Description: This update for sushi fixes the following issues: - Revert the version to sushi 41.2 to work with GNOME 41. Patch Instructions: To install this openSUSE Recommended Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Backports SLE-15-SP5: zypper in -t patch openSUSE-2023-274=1 Package List: - openSUSE Backports SLE-15-SP5 (aarch64 i586 ppc64le s390x x86_64): sushi-41.2-bp155.2.5.1 sushi-debuginfo-41.2-bp155.2.5.1 sushi-debugsource-41.2-bp155.2.5.1 - openSUSE Backports SLE-15-SP5 (noarch): sushi-lang-41.2-bp155.2.5.1 References: https://bugzilla.suse.com/1211546

1 0

SUSE-SU-2023:3778-1: moderate: Security update for wireshark
by maintenance＠opensuse.org 26 Sep '23

26 Sep '23

# Security update for wireshark Announcement ID: SUSE-SU-2023:3778-1 Rating: moderate References: * #1214560 * #1214561 * #1214562 * #1214652 Cross-References: * CVE-2023-2906 * CVE-2023-4511 * CVE-2023-4512 * CVE-2023-4513 CVSS scores: * CVE-2023-2906 ( SUSE ): 5.3 CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:L * CVE-2023-2906 ( NVD ): 6.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H * CVE-2023-4511 ( SUSE ): 5.3 CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:L * CVE-2023-4511 ( NVD ): 5.3 CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:L * CVE-2023-4512 ( SUSE ): 5.3 CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:L * CVE-2023-4512 ( NVD ): 5.3 CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:L * CVE-2023-4513 ( SUSE ): 5.3 CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:L * CVE-2023-4513 ( NVD ): 5.3 CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:L Affected Products: * Basesystem Module 15-SP4 * Basesystem Module 15-SP5 * Desktop Applications Module 15-SP4 * Desktop Applications Module 15-SP5 * openSUSE Leap 15.4 * openSUSE Leap 15.5 * SUSE Linux Enterprise Desktop 15 SP4 * SUSE Linux Enterprise Desktop 15 SP5 * SUSE Linux Enterprise High Performance Computing 15 SP4 * SUSE Linux Enterprise High Performance Computing 15 SP5 * SUSE Linux Enterprise Real Time 15 SP4 * SUSE Linux Enterprise Real Time 15 SP5 * SUSE Linux Enterprise Server 15 SP4 * SUSE Linux Enterprise Server 15 SP5 * SUSE Linux Enterprise Server for SAP Applications 15 SP4 * SUSE Linux Enterprise Server for SAP Applications 15 SP5 * SUSE Manager Proxy 4.2 * SUSE Manager Proxy 4.3 * SUSE Manager Retail Branch Server 4.2 * SUSE Manager Retail Branch Server 4.3 * SUSE Manager Server 4.2 * SUSE Manager Server 4.3 An update that solves four vulnerabilities can now be installed. ## Description: This update for wireshark fixes the following issues: * Wireshark update to v3.6.16. * CVE-2023-4512: Fixed a bug in CBOR dissector which could lead to crash. (bsc#1214561) * CVE-2023-4511: Fixed a bug in BT SDP dissector which could lead to an infinite loop. (bsc#1214560) * CVE-2023-4513: Fixed a bug in BT SDP dissector which could lead to a memory leak. (bsc#1214562) * CVE-2023-2906: Fixed a bug in CP2179 dissector which could lead to crash. (bsc#1214652) ## Patch Instructions: To install this SUSE update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: * openSUSE Leap 15.4 zypper in -t patch openSUSE-SLE-15.4-2023-3778=1 * openSUSE Leap 15.5 zypper in -t patch openSUSE-SLE-15.5-2023-3778=1 * Basesystem Module 15-SP4 zypper in -t patch SUSE-SLE-Module-Basesystem-15-SP4-2023-3778=1 * Basesystem Module 15-SP5 zypper in -t patch SUSE-SLE-Module-Basesystem-15-SP5-2023-3778=1 * Desktop Applications Module 15-SP4 zypper in -t patch SUSE-SLE-Module-Desktop-Applications-15-SP4-2023-3778=1 * Desktop Applications Module 15-SP5 zypper in -t patch SUSE-SLE-Module-Desktop-Applications-15-SP5-2023-3778=1 * SUSE Manager Proxy 4.2 zypper in -t patch SUSE-SLE-Product-SUSE-Manager-Proxy-4.2-2023-3778=1 * SUSE Manager Retail Branch Server 4.2 zypper in -t patch SUSE-SLE-Product-SUSE-Manager-Retail-Branch- Server-4.2-2023-3778=1 * SUSE Manager Server 4.2 zypper in -t patch SUSE-SLE-Product-SUSE-Manager-Server-4.2-2023-3778=1 ## Package List: * openSUSE Leap 15.4 (aarch64 ppc64le s390x x86_64) * wireshark-devel-3.6.16-150000.3.100.1 * wireshark-ui-qt-debuginfo-3.6.16-150000.3.100.1 * libwsutil13-debuginfo-3.6.16-150000.3.100.1 * libwiretap12-3.6.16-150000.3.100.1 * libwsutil13-3.6.16-150000.3.100.1 * wireshark-3.6.16-150000.3.100.1 * libwireshark15-debuginfo-3.6.16-150000.3.100.1 * wireshark-ui-qt-3.6.16-150000.3.100.1 * wireshark-debugsource-3.6.16-150000.3.100.1 * libwireshark15-3.6.16-150000.3.100.1 * libwiretap12-debuginfo-3.6.16-150000.3.100.1 * wireshark-debuginfo-3.6.16-150000.3.100.1 * openSUSE Leap 15.5 (aarch64 ppc64le s390x x86_64) * wireshark-devel-3.6.16-150000.3.100.1 * wireshark-ui-qt-debuginfo-3.6.16-150000.3.100.1 * libwsutil13-debuginfo-3.6.16-150000.3.100.1 * libwiretap12-3.6.16-150000.3.100.1 * libwsutil13-3.6.16-150000.3.100.1 * wireshark-3.6.16-150000.3.100.1 * libwireshark15-debuginfo-3.6.16-150000.3.100.1 * wireshark-ui-qt-3.6.16-150000.3.100.1 * wireshark-debugsource-3.6.16-150000.3.100.1 * libwireshark15-3.6.16-150000.3.100.1 * libwiretap12-debuginfo-3.6.16-150000.3.100.1 * wireshark-debuginfo-3.6.16-150000.3.100.1 * Basesystem Module 15-SP4 (aarch64 ppc64le s390x x86_64) * libwsutil13-debuginfo-3.6.16-150000.3.100.1 * libwiretap12-3.6.16-150000.3.100.1 * libwsutil13-3.6.16-150000.3.100.1 * wireshark-3.6.16-150000.3.100.1 * libwireshark15-debuginfo-3.6.16-150000.3.100.1 * wireshark-debugsource-3.6.16-150000.3.100.1 * libwireshark15-3.6.16-150000.3.100.1 * libwiretap12-debuginfo-3.6.16-150000.3.100.1 * wireshark-debuginfo-3.6.16-150000.3.100.1 * Basesystem Module 15-SP5 (aarch64 ppc64le s390x x86_64) * libwsutil13-debuginfo-3.6.16-150000.3.100.1 * libwiretap12-3.6.16-150000.3.100.1 * libwsutil13-3.6.16-150000.3.100.1 * wireshark-3.6.16-150000.3.100.1 * libwireshark15-debuginfo-3.6.16-150000.3.100.1 * wireshark-debugsource-3.6.16-150000.3.100.1 * libwireshark15-3.6.16-150000.3.100.1 * libwiretap12-debuginfo-3.6.16-150000.3.100.1 * wireshark-debuginfo-3.6.16-150000.3.100.1 * Desktop Applications Module 15-SP4 (aarch64 ppc64le s390x x86_64) * wireshark-ui-qt-debuginfo-3.6.16-150000.3.100.1 * wireshark-debuginfo-3.6.16-150000.3.100.1 * wireshark-ui-qt-3.6.16-150000.3.100.1 * wireshark-debugsource-3.6.16-150000.3.100.1 * wireshark-devel-3.6.16-150000.3.100.1 * Desktop Applications Module 15-SP5 (aarch64 ppc64le s390x x86_64) * wireshark-ui-qt-debuginfo-3.6.16-150000.3.100.1 * wireshark-debuginfo-3.6.16-150000.3.100.1 * wireshark-ui-qt-3.6.16-150000.3.100.1 * wireshark-debugsource-3.6.16-150000.3.100.1 * wireshark-devel-3.6.16-150000.3.100.1 * SUSE Manager Proxy 4.2 (x86_64) * libwsutil13-debuginfo-3.6.16-150000.3.100.1 * libwiretap12-3.6.16-150000.3.100.1 * libwsutil13-3.6.16-150000.3.100.1 * wireshark-3.6.16-150000.3.100.1 * libwireshark15-debuginfo-3.6.16-150000.3.100.1 * wireshark-debugsource-3.6.16-150000.3.100.1 * libwireshark15-3.6.16-150000.3.100.1 * libwiretap12-debuginfo-3.6.16-150000.3.100.1 * wireshark-debuginfo-3.6.16-150000.3.100.1 * SUSE Manager Retail Branch Server 4.2 (x86_64) * libwsutil13-debuginfo-3.6.16-150000.3.100.1 * libwiretap12-3.6.16-150000.3.100.1 * libwsutil13-3.6.16-150000.3.100.1 * wireshark-3.6.16-150000.3.100.1 * libwireshark15-debuginfo-3.6.16-150000.3.100.1 * wireshark-debugsource-3.6.16-150000.3.100.1 * libwireshark15-3.6.16-150000.3.100.1 * libwiretap12-debuginfo-3.6.16-150000.3.100.1 * wireshark-debuginfo-3.6.16-150000.3.100.1 * SUSE Manager Server 4.2 (ppc64le s390x x86_64) * libwsutil13-debuginfo-3.6.16-150000.3.100.1 * libwiretap12-3.6.16-150000.3.100.1 * libwsutil13-3.6.16-150000.3.100.1 * wireshark-3.6.16-150000.3.100.1 * libwireshark15-debuginfo-3.6.16-150000.3.100.1 * wireshark-debugsource-3.6.16-150000.3.100.1 * libwireshark15-3.6.16-150000.3.100.1 * libwiretap12-debuginfo-3.6.16-150000.3.100.1 * wireshark-debuginfo-3.6.16-150000.3.100.1 ## References: * https://www.suse.com/security/cve/CVE-2023-2906.html * https://www.suse.com/security/cve/CVE-2023-4511.html * https://www.suse.com/security/cve/CVE-2023-4512.html * https://www.suse.com/security/cve/CVE-2023-4513.html * https://bugzilla.suse.com/show_bug.cgi?id=1214560 * https://bugzilla.suse.com/show_bug.cgi?id=1214561 * https://bugzilla.suse.com/show_bug.cgi?id=1214562 * https://bugzilla.suse.com/show_bug.cgi?id=1214652

1 0

SUSE-RU-2023:3780-1: moderate: Recommended update hidapi
by maintenance＠opensuse.org 26 Sep '23

26 Sep '23

# Recommended update hidapi Announcement ID: SUSE-RU-2023:3780-1 Rating: moderate References: * #1214535 Affected Products: * Basesystem Module 15-SP4 * Basesystem Module 15-SP5 * openSUSE Leap 15.4 * openSUSE Leap 15.5 * SUSE Linux Enterprise Desktop 15 SP4 * SUSE Linux Enterprise Desktop 15 SP5 * SUSE Linux Enterprise High Performance Computing 15 SP4 * SUSE Linux Enterprise High Performance Computing 15 SP5 * SUSE Linux Enterprise Micro 5.3 * SUSE Linux Enterprise Micro 5.4 * SUSE Linux Enterprise Micro for Rancher 5.3 * SUSE Linux Enterprise Micro for Rancher 5.4 * SUSE Linux Enterprise Real Time 15 SP4 * SUSE Linux Enterprise Real Time 15 SP5 * SUSE Linux Enterprise Server 15 SP4 * SUSE Linux Enterprise Server 15 SP5 * SUSE Linux Enterprise Server for SAP Applications 15 SP4 * SUSE Linux Enterprise Server for SAP Applications 15 SP5 * SUSE Manager Proxy 4.2 * SUSE Manager Proxy 4.3 * SUSE Manager Retail Branch Server 4.2 * SUSE Manager Retail Branch Server 4.3 * SUSE Manager Server 4.2 * SUSE Manager Server 4.3 An update that has one fix can now be installed. ## Description: This update for hidapi ships the missing libhidapi-raw0 library to SLE and Leap Micro 5.3 and 5.4. ## Patch Instructions: To install this SUSE update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: * SUSE Linux Enterprise Micro for Rancher 5.3 zypper in -t patch SUSE-SLE-Micro-5.3-2023-3780=1 * SUSE Linux Enterprise Micro 5.3 zypper in -t patch SUSE-SLE-Micro-5.3-2023-3780=1 * SUSE Linux Enterprise Micro for Rancher 5.4 zypper in -t patch SUSE-SLE-Micro-5.4-2023-3780=1 * SUSE Linux Enterprise Micro 5.4 zypper in -t patch SUSE-SLE-Micro-5.4-2023-3780=1 * Basesystem Module 15-SP4 zypper in -t patch SUSE-SLE-Module-Basesystem-15-SP4-2023-3780=1 * Basesystem Module 15-SP5 zypper in -t patch SUSE-SLE-Module-Basesystem-15-SP5-2023-3780=1 * SUSE Manager Proxy 4.2 zypper in -t patch SUSE-SLE-Product-SUSE-Manager-Proxy-4.2-2023-3780=1 * SUSE Manager Retail Branch Server 4.2 zypper in -t patch SUSE-SLE-Product-SUSE-Manager-Retail-Branch- Server-4.2-2023-3780=1 * SUSE Manager Server 4.2 zypper in -t patch SUSE-SLE-Product-SUSE-Manager-Server-4.2-2023-3780=1 * openSUSE Leap 15.4 zypper in -t patch openSUSE-SLE-15.4-2023-3780=1 * openSUSE Leap 15.5 zypper in -t patch openSUSE-SLE-15.5-2023-3780=1 ## Package List: * SUSE Linux Enterprise Micro for Rancher 5.3 (aarch64 s390x x86_64) * hidapi-debugsource-0.10.1-150300.3.2.1 * libhidapi-hidraw0-0.10.1-150300.3.2.1 * libhidapi-hidraw0-debuginfo-0.10.1-150300.3.2.1 * SUSE Linux Enterprise Micro 5.3 (aarch64 s390x x86_64) * hidapi-debugsource-0.10.1-150300.3.2.1 * libhidapi-hidraw0-0.10.1-150300.3.2.1 * libhidapi-hidraw0-debuginfo-0.10.1-150300.3.2.1 * SUSE Linux Enterprise Micro for Rancher 5.4 (aarch64 s390x x86_64) * hidapi-debugsource-0.10.1-150300.3.2.1 * libhidapi-hidraw0-0.10.1-150300.3.2.1 * libhidapi-hidraw0-debuginfo-0.10.1-150300.3.2.1 * SUSE Linux Enterprise Micro 5.4 (aarch64 s390x x86_64) * hidapi-debugsource-0.10.1-150300.3.2.1 * libhidapi-hidraw0-0.10.1-150300.3.2.1 * libhidapi-hidraw0-debuginfo-0.10.1-150300.3.2.1 * Basesystem Module 15-SP4 (aarch64 ppc64le s390x x86_64) * libhidapi-libusb0-debuginfo-0.10.1-150300.3.2.1 * libhidapi-hidraw0-0.10.1-150300.3.2.1 * hidapi-debuginfo-0.10.1-150300.3.2.1 * hidapi-debugsource-0.10.1-150300.3.2.1 * libhidapi-devel-0.10.1-150300.3.2.1 * libhidapi-hidraw0-debuginfo-0.10.1-150300.3.2.1 * libhidapi-libusb0-0.10.1-150300.3.2.1 * Basesystem Module 15-SP5 (aarch64 ppc64le s390x x86_64) * libhidapi-libusb0-debuginfo-0.10.1-150300.3.2.1 * libhidapi-hidraw0-0.10.1-150300.3.2.1 * hidapi-debuginfo-0.10.1-150300.3.2.1 * hidapi-debugsource-0.10.1-150300.3.2.1 * libhidapi-devel-0.10.1-150300.3.2.1 * libhidapi-hidraw0-debuginfo-0.10.1-150300.3.2.1 * libhidapi-libusb0-0.10.1-150300.3.2.1 * SUSE Manager Proxy 4.2 (x86_64) * libhidapi-libusb0-debuginfo-0.10.1-150300.3.2.1 * libhidapi-hidraw0-0.10.1-150300.3.2.1 * hidapi-debuginfo-0.10.1-150300.3.2.1 * hidapi-debugsource-0.10.1-150300.3.2.1 * libhidapi-devel-0.10.1-150300.3.2.1 * libhidapi-hidraw0-debuginfo-0.10.1-150300.3.2.1 * libhidapi-libusb0-0.10.1-150300.3.2.1 * SUSE Manager Retail Branch Server 4.2 (x86_64) * libhidapi-libusb0-debuginfo-0.10.1-150300.3.2.1 * libhidapi-hidraw0-0.10.1-150300.3.2.1 * hidapi-debuginfo-0.10.1-150300.3.2.1 * hidapi-debugsource-0.10.1-150300.3.2.1 * libhidapi-devel-0.10.1-150300.3.2.1 * libhidapi-hidraw0-debuginfo-0.10.1-150300.3.2.1 * libhidapi-libusb0-0.10.1-150300.3.2.1 * SUSE Manager Server 4.2 (ppc64le s390x x86_64) * libhidapi-libusb0-debuginfo-0.10.1-150300.3.2.1 * libhidapi-hidraw0-0.10.1-150300.3.2.1 * hidapi-debuginfo-0.10.1-150300.3.2.1 * hidapi-debugsource-0.10.1-150300.3.2.1 * libhidapi-devel-0.10.1-150300.3.2.1 * libhidapi-hidraw0-debuginfo-0.10.1-150300.3.2.1 * libhidapi-libusb0-0.10.1-150300.3.2.1 * openSUSE Leap 15.4 (aarch64 ppc64le s390x x86_64) * libhidapi-libusb0-debuginfo-0.10.1-150300.3.2.1 * libhidapi-hidraw0-0.10.1-150300.3.2.1 * hidapi-debuginfo-0.10.1-150300.3.2.1 * hidapi-debugsource-0.10.1-150300.3.2.1 * libhidapi-devel-0.10.1-150300.3.2.1 * libhidapi-hidraw0-debuginfo-0.10.1-150300.3.2.1 * libhidapi-libusb0-0.10.1-150300.3.2.1 * openSUSE Leap 15.5 (aarch64 ppc64le s390x x86_64) * libhidapi-libusb0-debuginfo-0.10.1-150300.3.2.1 * libhidapi-hidraw0-0.10.1-150300.3.2.1 * hidapi-debuginfo-0.10.1-150300.3.2.1 * hidapi-debugsource-0.10.1-150300.3.2.1 * libhidapi-devel-0.10.1-150300.3.2.1 * libhidapi-hidraw0-debuginfo-0.10.1-150300.3.2.1 * libhidapi-libusb0-0.10.1-150300.3.2.1 ## References: * https://bugzilla.suse.com/show_bug.cgi?id=1214535

1 0

SUSE-SU-2023:3784-1: important: Security update for the Linux Kernel RT (Live Patch 1 for SLE 15 SP5)
by maintenance＠opensuse.org 26 Sep '23

26 Sep '23

# Security update for the Linux Kernel RT (Live Patch 1 for SLE 15 SP5) Announcement ID: SUSE-SU-2023:3784-1 Rating: important References: * #1210619 * #1213064 * #1213587 * #1214123 * #1215119 Cross-References: * CVE-2023-1829 * CVE-2023-31248 * CVE-2023-3609 * CVE-2023-3776 * CVE-2023-4273 CVSS scores: * CVE-2023-1829 ( SUSE ): 7.8 CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H * CVE-2023-1829 ( NVD ): 7.8 CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H * CVE-2023-31248 ( SUSE ): 7.8 CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H * CVE-2023-31248 ( NVD ): 7.8 CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H * CVE-2023-3609 ( SUSE ): 7.0 CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H * CVE-2023-3609 ( NVD ): 7.8 CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H * CVE-2023-3776 ( SUSE ): 7.0 CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H * CVE-2023-3776 ( NVD ): 7.8 CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H * CVE-2023-4273 ( SUSE ): 7.8 CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H * CVE-2023-4273 ( NVD ): 6.0 CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:N Affected Products: * openSUSE Leap 15.5 * SUSE Linux Enterprise High Performance Computing 15 SP4 * SUSE Linux Enterprise High Performance Computing 15 SP5 * SUSE Linux Enterprise Live Patching 15-SP4 * SUSE Linux Enterprise Live Patching 15-SP5 * SUSE Linux Enterprise Micro 5.3 * SUSE Linux Enterprise Micro 5.4 * SUSE Linux Enterprise Micro 5.5 * SUSE Linux Enterprise Real Time 15 SP4 * SUSE Linux Enterprise Real Time 15 SP5 * SUSE Linux Enterprise Server 15 SP4 * SUSE Linux Enterprise Server 15 SP5 * SUSE Linux Enterprise Server for SAP Applications 15 SP4 * SUSE Linux Enterprise Server for SAP Applications 15 SP5 An update that solves five vulnerabilities can now be installed. ## Description: This update for the Linux Kernel 5.14.21-150500_13_5 fixes several issues. The following security issues were fixed: * CVE-2023-3776: Fixed improper refcount update in cls_fw leads to use-after- free (bsc#1215119). * CVE-2023-1829: Fixed a use-after-free vulnerability in the control index filter (tcindex) (bsc#1210619). * CVE-2023-4273: Fixed a flaw in the exFAT driver of the Linux kernel that alloawed a local privileged attacker to overflow the kernel stack (bsc#1214123). * CVE-2023-3609: Fixed reference counter leak leading to overflow in net/sched (bsc#1213587). * CVE-2023-31248: Fixed an use-after-free vulnerability in nft_chain_lookup_byid that could allow a local attacker to escalate their privilege (bsc#1213064). ## Patch Instructions: To install this SUSE update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: * SUSE Linux Enterprise Live Patching 15-SP4 zypper in -t patch SUSE-SLE-Module-Live-Patching-15-SP4-2023-3784=1 * openSUSE Leap 15.5 zypper in -t patch SUSE-2023-3787=1 * SUSE Linux Enterprise Live Patching 15-SP5 zypper in -t patch SUSE-SLE-Module-Live-Patching-15-SP5-2023-3787=1 ## Package List: * SUSE Linux Enterprise Live Patching 15-SP4 (x86_64) * kernel-livepatch-5_14_21-150400_15_37-rt-3-150400.2.1 * kernel-livepatch-5_14_21-150400_15_37-rt-debuginfo-3-150400.2.1 * kernel-livepatch-SLE15-SP4-RT_Update_8-debugsource-3-150400.2.1 * openSUSE Leap 15.5 (x86_64) * kernel-livepatch-SLE15-SP5-RT_Update_1-debugsource-3-150500.2.1 * kernel-livepatch-5_14_21-150500_13_5-rt-debuginfo-3-150500.2.1 * kernel-livepatch-5_14_21-150500_13_5-rt-3-150500.2.1 * SUSE Linux Enterprise Live Patching 15-SP5 (x86_64) * kernel-livepatch-SLE15-SP5-RT_Update_1-debugsource-3-150500.2.1 * kernel-livepatch-5_14_21-150500_13_5-rt-debuginfo-3-150500.2.1 * kernel-livepatch-5_14_21-150500_13_5-rt-3-150500.2.1 ## References: * https://www.suse.com/security/cve/CVE-2023-1829.html * https://www.suse.com/security/cve/CVE-2023-31248.html * https://www.suse.com/security/cve/CVE-2023-3609.html * https://www.suse.com/security/cve/CVE-2023-3776.html * https://www.suse.com/security/cve/CVE-2023-4273.html * https://bugzilla.suse.com/show_bug.cgi?id=1210619 * https://bugzilla.suse.com/show_bug.cgi?id=1213064 * https://bugzilla.suse.com/show_bug.cgi?id=1213587 * https://bugzilla.suse.com/show_bug.cgi?id=1214123 * https://bugzilla.suse.com/show_bug.cgi?id=1215119

1 0