August 2024 - openSUSE Updates - openSUSE Mailing Lists

openSUSE-SU-2024:0215-1: moderate: Security update for python-sentry-sdk
by opensuse-security＠opensuse.org 23 Aug '24

23 Aug '24

openSUSE Security Update: Security update for python-sentry-sdk ______________________________________________________________________________ Announcement ID: openSUSE-SU-2024:0215-1 Rating: moderate References: #1228128 Cross-References: CVE-2024-40647 Affected Products: openSUSE Backports SLE-15-SP6 ______________________________________________________________________________ An update that fixes one vulnerability is now available. Description: This update for python-sentry-sdk fixes the following issues: - CVE-2024-40647: Do not leak environment variables to child processes. (bsc#1228128) Patch Instructions: To install this openSUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Backports SLE-15-SP6: zypper in -t patch openSUSE-2024-215=1 Package List: - openSUSE Backports SLE-15-SP6 (noarch): python3-sentry-sdk-0.14.4-bp156.4.3.1 References: https://www.suse.com/security/cve/CVE-2024-40647.html https://bugzilla.suse.com/1228128

1 0

openSUSE-RU-2024:0173-1: moderate: Recommended update for shadowsocks-v2ray-plugin
by maintenance＠opensuse.org 23 Aug '24

23 Aug '24

openSUSE Recommended Update: Recommended update for shadowsocks-v2ray-plugin ______________________________________________________________________________ Announcement ID: openSUSE-RU-2024:0173-1 Rating: moderate References: #1226385 Affected Products: openSUSE Backports SLE-15-SP6 ______________________________________________________________________________ An update that has one recommended fix can now be installed. Description: This update for shadowsocks-v2ray-plugin fixes the following issues: Update version to 5.15.1 * Fixed crash (boo#1226385) Patch Instructions: To install this openSUSE Recommended Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Backports SLE-15-SP6: zypper in -t patch openSUSE-2024-173=1 Package List: - openSUSE Backports SLE-15-SP6 (aarch64 i586 ppc64le s390x x86_64): shadowsocks-v2ray-plugin-5.15.1-bp156.2.3.1 - openSUSE Backports SLE-15-SP6 (noarch): golang-github-teddysun-v2ray-plugin-5.15.1-bp156.2.3.1 References: https://bugzilla.suse.com/1226385

1 0

openSUSE-RU-2024:0240-1: moderate: Recommended update for tryton, trytond, trytond_account_invoice, trytond_purchase
by maintenance＠opensuse.org 23 Aug '24

23 Aug '24

openSUSE Recommended Update: Recommended update for tryton, trytond, trytond_account_invoice, trytond_purchase ______________________________________________________________________________ Announcement ID: openSUSE-RU-2024:0240-1 Rating: moderate References: Affected Products: openSUSE Backports SLE-15-SP6 ______________________________________________________________________________ An update that has 0 recommended fixes can now be installed. Description: This update for tryton, trytond, trytond_account_invoice, trytond_purchase fixes the following issues: Changes in tryton: - Version 6.0.41 - Bugfix Release Changes in trytond: - Version 6.0.50 - Bugfix Release Changes in trytond_purchase: - Version 6.0.17 - Bugfix Release Changes in trytond_account_invoice: - Version 6.0.19 - Bugfix Release Patch Instructions: To install this openSUSE Recommended Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Backports SLE-15-SP6: zypper in -t patch openSUSE-2024-240=1 Package List: - openSUSE Backports SLE-15-SP6 (noarch): tryton-6.0.41-bp156.2.6.1 trytond-6.0.50-bp156.2.6.1 trytond_account_invoice-6.0.19-bp156.2.6.1 trytond_purchase-6.0.17-bp156.2.6.1 References:

1 0

openSUSE-SU-2024:0202-1: moderate: Security update for Botan
by opensuse-security＠opensuse.org 23 Aug '24

23 Aug '24

openSUSE Security Update: Security update for Botan ______________________________________________________________________________ Announcement ID: openSUSE-SU-2024:0202-1 Rating: moderate References: #1227238 #1227607 #1227608 Cross-References: CVE-2024-34702 CVE-2024-34703 CVE-2024-39312 CVSS scores: CVE-2024-34702 (SUSE): 5.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L CVE-2024-34703 (SUSE): 5.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L CVE-2024-39312 (SUSE): 5.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N Affected Products: openSUSE Backports SLE-15-SP6 ______________________________________________________________________________ An update that fixes three vulnerabilities is now available. Description: This update for Botan fixes the following issues: Update to 2.19.5: * Fix multiple Denial of service attacks due to X.509 cert processing: * CVE-2024-34702 - boo#1227238 * CVE-2024-34703 - boo#1227607 * CVE-2024-39312 - boo#1227608 * Fix a crash in OCB * Fix a test failure in compression with certain versions of zlib * Fix some iterator debugging errors in TLS CBC decryption. * Avoid a miscompilation in ARIA when using XCode 14 Patch Instructions: To install this openSUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Backports SLE-15-SP6: zypper in -t patch openSUSE-2024-202=1 Package List: - openSUSE Backports SLE-15-SP6 (aarch64 i586 ppc64le s390x x86_64): Botan-2.19.5-bp156.3.3.1 libbotan-2-19-2.19.5-bp156.3.3.1 libbotan-devel-2.19.5-bp156.3.3.1 python3-botan-2.19.5-bp156.3.3.1 - openSUSE Backports SLE-15-SP6 (aarch64_ilp32): libbotan-2-19-64bit-2.19.5-bp156.3.3.1 libbotan-devel-64bit-2.19.5-bp156.3.3.1 - openSUSE Backports SLE-15-SP6 (x86_64): libbotan-2-19-32bit-2.19.5-bp156.3.3.1 libbotan-devel-32bit-2.19.5-bp156.3.3.1 - openSUSE Backports SLE-15-SP6 (noarch): Botan-doc-2.19.5-bp156.3.3.1 References: https://www.suse.com/security/cve/CVE-2024-34702.html https://www.suse.com/security/cve/CVE-2024-34703.html https://www.suse.com/security/cve/CVE-2024-39312.html https://bugzilla.suse.com/1227238 https://bugzilla.suse.com/1227607 https://bugzilla.suse.com/1227608

1 0

openSUSE-SU-2024:0204-2: important: Security update for chromium
by opensuse-security＠opensuse.org 23 Aug '24

23 Aug '24

openSUSE Security Update: Security update for chromium ______________________________________________________________________________ Announcement ID: openSUSE-SU-2024:0204-2 Rating: important References: #1226170 #1226205 #1226504 #1226933 Cross-References: CVE-2024-5830 CVE-2024-5831 CVE-2024-5832 CVE-2024-5833 CVE-2024-5834 CVE-2024-5835 CVE-2024-5836 CVE-2024-5837 CVE-2024-5838 CVE-2024-5839 CVE-2024-5840 CVE-2024-5841 CVE-2024-5842 CVE-2024-5843 CVE-2024-5844 CVE-2024-5845 CVE-2024-5846 CVE-2024-5847 CVE-2024-6100 CVE-2024-6101 CVE-2024-6102 CVE-2024-6103 CVE-2024-6290 CVE-2024-6291 CVE-2024-6292 CVE-2024-6293 CVSS scores: CVE-2024-5830 (NVD) : 8.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H CVE-2024-5831 (NVD) : 8.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H CVE-2024-5832 (NVD) : 8.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H CVE-2024-5833 (NVD) : 8.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H CVE-2024-5834 (NVD) : 8.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H CVE-2024-5835 (NVD) : 8.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H CVE-2024-5836 (NVD) : 8.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H CVE-2024-5837 (NVD) : 8.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H CVE-2024-5838 (NVD) : 8.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H CVE-2024-5839 (NVD) : 6.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N CVE-2024-5840 (NVD) : 6.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N CVE-2024-5841 (NVD) : 8.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H CVE-2024-5842 (NVD) : 8.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H CVE-2024-5843 (NVD) : 6.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N CVE-2024-5844 (NVD) : 8.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H CVE-2024-5845 (NVD) : 8.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H CVE-2024-5846 (NVD) : 8.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H CVE-2024-5847 (NVD) : 8.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H CVE-2024-6100 (NVD) : 8.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H CVE-2024-6101 (NVD) : 8.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H CVE-2024-6102 (NVD) : 8.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H CVE-2024-6103 (NVD) : 8.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H Affected Products: openSUSE Backports SLE-15-SP6 ______________________________________________________________________________ An update that fixes 26 vulnerabilities is now available. Description: This update for chromium fixes the following issues: Chromium 126.0.6478.126 (boo#1226504, boo#1226205, boo#1226933) * CVE-2024-6290: Use after free in Dawn * CVE-2024-6291: Use after free in Swiftshader * CVE-2024-6292: Use after free in Dawn * CVE-2024-6293: Use after free in Dawn * CVE-2024-6100: Type Confusion in V8 * CVE-2024-6101: Inappropriate implementation in WebAssembly * CVE-2024-6102: Out of bounds memory access in Dawn * CVE-2024-6103: Use after free in Dawn * CVE-2024-5830: Type Confusion in V8 * CVE-2024-5831: Use after free in Dawn * CVE-2024-5832: Use after free in Dawn * CVE-2024-5833: Type Confusion in V8 * CVE-2024-5834: Inappropriate implementation in Dawn * CVE-2024-5835: Heap buffer overflow in Tab Groups * CVE-2024-5836: Inappropriate Implementation in DevTools * CVE-2024-5837: Type Confusion in V8 * CVE-2024-5838: Type Confusion in V8 * CVE-2024-5839: Inappropriate Implementation in Memory Allocator * CVE-2024-5840: Policy Bypass in CORS * CVE-2024-5841: Use after free in V8 * CVE-2024-5842: Use after free in Browser UI * CVE-2024-5843: Inappropriate implementation in Downloads * CVE-2024-5844: Heap buffer overflow in Tab Strip * CVE-2024-5845: Use after free in Audio * CVE-2024-5846: Use after free in PDFium * CVE-2024-5847: Use after free in PDFium - Amend fix_building_widevinecdm_with_chromium.patch to allow Widevine on ARM64 (boo#1226170) Patch Instructions: To install this openSUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Backports SLE-15-SP6: zypper in -t patch openSUSE-2024-204=1 Package List: - openSUSE Backports SLE-15-SP6 (aarch64 x86_64): chromedriver-126.0.6478.126-bp156.2.6.1 chromedriver-debuginfo-126.0.6478.126-bp156.2.6.1 chromium-126.0.6478.126-bp156.2.6.1 chromium-debuginfo-126.0.6478.126-bp156.2.6.1 References: https://www.suse.com/security/cve/CVE-2024-5830.html https://www.suse.com/security/cve/CVE-2024-5831.html https://www.suse.com/security/cve/CVE-2024-5832.html https://www.suse.com/security/cve/CVE-2024-5833.html https://www.suse.com/security/cve/CVE-2024-5834.html https://www.suse.com/security/cve/CVE-2024-5835.html https://www.suse.com/security/cve/CVE-2024-5836.html https://www.suse.com/security/cve/CVE-2024-5837.html https://www.suse.com/security/cve/CVE-2024-5838.html https://www.suse.com/security/cve/CVE-2024-5839.html https://www.suse.com/security/cve/CVE-2024-5840.html https://www.suse.com/security/cve/CVE-2024-5841.html https://www.suse.com/security/cve/CVE-2024-5842.html https://www.suse.com/security/cve/CVE-2024-5843.html https://www.suse.com/security/cve/CVE-2024-5844.html https://www.suse.com/security/cve/CVE-2024-5845.html https://www.suse.com/security/cve/CVE-2024-5846.html https://www.suse.com/security/cve/CVE-2024-5847.html https://www.suse.com/security/cve/CVE-2024-6100.html https://www.suse.com/security/cve/CVE-2024-6101.html https://www.suse.com/security/cve/CVE-2024-6102.html https://www.suse.com/security/cve/CVE-2024-6103.html https://www.suse.com/security/cve/CVE-2024-6290.html https://www.suse.com/security/cve/CVE-2024-6291.html https://www.suse.com/security/cve/CVE-2024-6292.html https://www.suse.com/security/cve/CVE-2024-6293.html https://bugzilla.suse.com/1226170 https://bugzilla.suse.com/1226205 https://bugzilla.suse.com/1226504 https://bugzilla.suse.com/1226933

1 0

openSUSE-RU-2024:0166-1: moderate: Recommended update for gh
by maintenance＠opensuse.org 23 Aug '24

23 Aug '24

openSUSE Recommended Update: Recommended update for gh ______________________________________________________________________________ Announcement ID: openSUSE-RU-2024:0166-1 Rating: moderate References: Affected Products: openSUSE Backports SLE-15-SP6 ______________________________________________________________________________ An update that has 0 recommended fixes can now be installed. Description: This update for gh fixes the following issues: Update to version 2.51.0: * Gracefully degrade when fetching annotations fails due to 403 (#9113) * replaced deprecated --json-result flag with --format=json in the gh at docstring. * Specify rpm repository to avoid conflicts with community repositories * Add `signer-repo` and `signer-workflow` flags to `gh attestation verify` (#9137) * Ensure signed RPMs have attestations Update to version 2.50.0: * Build completions during release on macos * Add build provenance for gh CLI releases (#9087) * Add integration tests for `gh attestation verify` shared workflow use case (#9107) * Update readme about MacOS pkg * Remove `v` prefix when `pkgmacos` is called * Integrate argument array to remove duplicate code * Added native min os version blocking * Fix distribution.xml + min macos version requirements * Fix directory already exists * Add a `gh variable get FOO` command (#9106) * Add comment to pr diff regex * Update regex in changedFilesNames to handle quoted paths * fix: rename the `Attempts` field to `Attempt`; expose in `gh run view` and `gh run ls` (#8905) * Change minimum build script macOS version * Cleanup pkgmacos build script * Removed redundant specifications * feat: add support for stateReason in `gh pr view` (#9080) * Update choice title * Update pkg title * update generated content for man pages and website * williammartin simplifications * remove no-op if clause that returns 'No Aliases' * Conditionalize references, remove redundant alias * list the various alias permutations for the command and subcommands * Remove TODO and add comment on LoginFlow tests * Comment the purpose of the helper config contract * Test git credentials are configured in LoginFlow * Add HelperConfig contract test and FakeHelperConfig * Inject GitCredentialFlow to LoginFlow as test seam * Removed unused param flagDryRun from upgradeFunc * Added summary TTY message to tests * Added TTY message to summarize checking extension upgrades * Add Helper test for Windows * Add tests for gitcredentials Updater * Fix mistaken git installation error check * Move gitcredentials HelperConfig and add tests * Comment the new gitcredentials package * Comment the git credential flow * Remove unnecessary credential setup private method * Use tighter interface in setup-git * Rename gitcredentials Configure to ConfigureOurs * Make gitcredential helper smarter * Move fetching configured helper into gitcredentials * Extract units for configuring and updating git credential helpers * Implement ExportData to filter json fields * fix: rename fields list * feat: add json output for PR checks * Fix doc bug for gh run watch Patch Instructions: To install this openSUSE Recommended Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Backports SLE-15-SP6: zypper in -t patch openSUSE-2024-166=1 Package List: - openSUSE Backports SLE-15-SP6 (aarch64 i586 ppc64le s390x x86_64): gh-2.51.0-bp156.2.3.1 - openSUSE Backports SLE-15-SP6 (noarch): gh-bash-completion-2.51.0-bp156.2.3.1 gh-fish-completion-2.51.0-bp156.2.3.1 gh-zsh-completion-2.51.0-bp156.2.3.1 References:

1 0

openSUSE-RU-2024:0233-1: moderate: Recommended update for virtme
by maintenance＠opensuse.org 23 Aug '24

23 Aug '24

openSUSE Recommended Update: Recommended update for virtme ______________________________________________________________________________ Announcement ID: openSUSE-RU-2024:0233-1 Rating: moderate References: Affected Products: openSUSE Backports SLE-15-SP6 ______________________________________________________________________________ An update that has 0 recommended fixes can now be installed. Description: This update for virtme fixes the following issues: Update to 1.26: * Proper integration with Arch * Inclusion of a vng manpage * The host's /tmp is now also visible from the guest * A new --configitem option that allows to quickly change specific kernel config options (with --build) * Bug fixes Patch Instructions: To install this openSUSE Recommended Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Backports SLE-15-SP6: zypper in -t patch openSUSE-2024-233=1 Package List: - openSUSE Backports SLE-15-SP6 (noarch): virtme-1.26-bp156.2.6.1 References:

1 0

openSUSE-RU-2024:0195-1: moderate: Recommended update for afl
by maintenance＠opensuse.org 23 Aug '24

23 Aug '24

openSUSE Recommended Update: Recommended update for afl ______________________________________________________________________________ Announcement ID: openSUSE-RU-2024:0195-1 Rating: moderate References: Affected Products: openSUSE Backports SLE-15-SP6 ______________________________________________________________________________ An update that has 0 recommended fixes can now be installed. Description: This update for afl fixes the following issues: Updated to 4.21c: * afl-fuzz - fixed a regression in afl-fuzz that resulted in a 5-10% performace loss do a switch from gettimeofday() to clock_gettime() which should be rather three times faster. The reason for this is unknown. - new queue selection algorithm based on 2 core years of queue data analysis. gives a noticable improvement on coverage although the results seem counterintuitive :-) - added AFL_DISABLE_REDUNDANT for huge queues - added `AFL_NO_SYNC` environment variable that does what you think it does - fix AFL_PERSISTENT_RECORD - run custom_post_process after standard trimming - prevent filenames in the queue that have spaces - minor fix for FAST schedules - more frequent stats update when syncing (todo: check performance impact) - now timing of calibration, trimming and syncing is measured seperately, thanks to @eqv! - -V timing is now accurately the fuzz time (without syncing), before long calibration times and syncing could result in now fuzzing being made when the time was already run out until then, thanks to @eqv! - fix -n uninstrumented mode when ending fuzzing - enhanced the ASAN configuration - make afl-fuzz use less memory with cmplog and fix a memleak * afl-cc: - re-enable i386 support that was accidently disabled - fixes for LTO and outdated afl-gcc mode for i386 - fix COMPCOV split compare for old LLVMs - disable xml/curl/g_ string transform functions because we do not check for null pointers ... TODO - ensure shared memory variables are visible in weird build setups - compatability to new LLVM 19 changes * afl-cmin - work with input files that have a space * afl-showmap - fix memory leak on shmem testcase usage (thanks to @ndrewh) - minor fix to collect coverage -C (thanks to @bet4it) * Fixed a shmem mmap bug (that rarely came up on MacOS) * libtokencap: script generate_libtoken_dict.sh added by @a-shvedov Updated to 4.20c: + A new forkserver communication model is now introduced. afl-fuzz is backward compatible to old compiled targets if they are not built for CMPLOG/Redqueen, but new compiled targets will not work with old afl-fuzz versions! + Recompile all targets that are instrumented for CMPLOG/Redqueen! - AFL++ now supports up to 4 billion coverage edges, up from 6 million. - New compile option: `make PERFORMANCE=1` - this will enable special CPU dependent optimizations that make everything more performant - but the binaries will likely won't work on different platforms. Also enables a faster hasher if the CPU requirements are met. - The persistent record feature (see config.h) was expanded to also support replay, thanks to @quarta-qti ! - afl-fuzz: - the new deterministic fuzzing feature is now activated by default, deactivate with -z. Parameters -d and -D are ignored. - small improvements to CMPLOG/redqueen - workround for a bug with MOpt -L when used with -M - in the future we will either remove or rewrite MOpt. - fix for `-t xxx+` feature - -e extension option now saves the queue items, crashes, etc. with the extension too - fixes for trimmming, correct -V time and reading stats on resume by eqv thanks a lot! - afl-cc: - added collision free caller instrumentation to LTO mode. activate with `AFL_LLVM_LTO_CALLER=1`. You can set a max depth to go through single block functions with `AFL_LLVM_LTO_CALLER_DEPTH` (default 0) - fixes for COMPCOV/LAF and most other modules - fix for GCC_PLUGIN cmplog that broke on std::strings - afl-whatsup: - now also displays current average speed - small bugfixes - Fixes for aflpp custom mutator and standalone tool - Minor edits to afl-persistent-config - Prevent temporary files being left behind on aborted afl-whatsup - More CPU benchmarks added to benchmark/ Updated to 4.10c: - afl-fuzz: - default power schedule is now EXPLORE, due a fix in fast schedules explore is slightly better now. - fixed minor issues in the mutation engine, thanks to @futhewo for reporting! - better deterministic fuzzing is now available, benchmarks have shown to improve fuzzing. Enable with -D. Thanks to @kdsjZh for the PR! - afl-cc: - large rewrite by @SonicStark which fixes a few corner cases, thanks! - LTO mode now requires llvm 12+ - workaround for ASAN with gcc_plugin mode - instrumentation: - LLVM 18 support, thanks to @devnexen! - Injection (SQL, LDAP, XSS) fuzzing feature now available, see `instrumentation/README.injections.md` how to activate/use/expand. - compcov/LAF-intel: - floating point splitting bug fix by @hexcoder - due a bug in LLVM 17 integer splitting is disabled there! - when splitting floats was selected, integers were always split as well, fixed to require AFL_LLVM_LAF_SPLIT_COMPARES or _ALL as it should - dynamic instrumentation filtering for LLVM NATIVE, thanks @Mozilla! see utils/dynamic_covfilter/README.md - qemu_mode: - plugins are now activated by default and a new module is included that produces drcov compatible traces for lighthouse/lightkeeper/... thanks to @JRomainG to submitting! - updated Nyx checkout (fixes a bug) and some QOL - updated the custom grammar mutator - document afl-cmin does not work on macOS (but afl-cmin.bash does) Patch Instructions: To install this openSUSE Recommended Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Backports SLE-15-SP6: zypper in -t patch openSUSE-2024-195=1 Package List: - openSUSE Backports SLE-15-SP6 (aarch64 i586 ppc64le s390x x86_64): afl-4.21c-bp156.2.3.1 References:

1 0

openSUSE-SU-2024:0258-2: important: Security update for chromium
by opensuse-security＠opensuse.org 23 Aug '24

23 Aug '24

openSUSE Security Update: Security update for chromium ______________________________________________________________________________ Announcement ID: openSUSE-SU-2024:0258-2 Rating: important References: #1229426 #1229591 Cross-References: CVE-2024-7964 CVE-2024-7965 CVE-2024-7966 CVE-2024-7967 CVE-2024-7968 CVE-2024-7969 CVE-2024-7971 CVE-2024-7972 CVE-2024-7973 CVE-2024-7974 CVE-2024-7975 CVE-2024-7976 CVE-2024-7977 CVE-2024-7978 CVE-2024-7979 CVE-2024-7980 CVE-2024-7981 CVE-2024-8033 CVE-2024-8034 CVE-2024-8035 CVSS scores: CVE-2024-7964 (NVD) : 8.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H CVE-2024-7966 (NVD) : 8.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H CVE-2024-7968 (NVD) : 8.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H CVE-2024-7969 (NVD) : 8.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H CVE-2024-7974 (NVD) : 8.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H CVE-2024-7975 (NVD) : 4.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N CVE-2024-7976 (NVD) : 4.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N CVE-2024-7977 (NVD) : 7.8 CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H CVE-2024-7978 (NVD) : 4.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:N CVE-2024-7981 (NVD) : 4.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N CVE-2024-8033 (NVD) : 4.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N CVE-2024-8034 (NVD) : 4.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N CVE-2024-8035 (NVD) : 4.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N Affected Products: openSUSE Backports SLE-15-SP6 ______________________________________________________________________________ An update that fixes 20 vulnerabilities is now available. Description: This update for chromium fixes the following issues: - Chromium 128.0.6613.84 (boo#1229591) * CVE-2024-7964: Use after free in Passwords * CVE-2024-7965: Inappropriate implementation in V8 * CVE-2024-7966: Out of bounds memory access in Skia * CVE-2024-7967: Heap buffer overflow in Fonts * CVE-2024-7968: Use after free in Autofill * CVE-2024-7969: Type Confusion in V8 * CVE-2024-7971: Type confusion in V8 * CVE-2024-7972: Inappropriate implementation in V8 * CVE-2024-7973: Heap buffer overflow in PDFium * CVE-2024-7974: Insufficient data validation in V8 API * CVE-2024-7975: Inappropriate implementation in Permissions * CVE-2024-7976: Inappropriate implementation in FedCM * CVE-2024-7977: Insufficient data validation in Installer * CVE-2024-7978: Insufficient policy enforcement in Data Transfer * CVE-2024-7979: Insufficient data validation in Installer * CVE-2024-7980: Insufficient data validation in Installer * CVE-2024-7981: Inappropriate implementation in Views * CVE-2024-8033: Inappropriate implementation in WebApp Installs * CVE-2024-8034: Inappropriate implementation in Custom Tabs * CVE-2024-8035: Inappropriate implementation in Extensions * Various fixes from internal audits, fuzzing and other initiatives Patch Instructions: To install this openSUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Backports SLE-15-SP6: zypper in -t patch openSUSE-2024-258=1 Package List: - openSUSE Backports SLE-15-SP6 (aarch64 x86_64): chromedriver-128.0.6613.84-bp156.2.17.1 chromedriver-debuginfo-128.0.6613.84-bp156.2.17.1 chromium-128.0.6613.84-bp156.2.17.1 chromium-debuginfo-128.0.6613.84-bp156.2.17.1 References: https://www.suse.com/security/cve/CVE-2024-7964.html https://www.suse.com/security/cve/CVE-2024-7965.html https://www.suse.com/security/cve/CVE-2024-7966.html https://www.suse.com/security/cve/CVE-2024-7967.html https://www.suse.com/security/cve/CVE-2024-7968.html https://www.suse.com/security/cve/CVE-2024-7969.html https://www.suse.com/security/cve/CVE-2024-7971.html https://www.suse.com/security/cve/CVE-2024-7972.html https://www.suse.com/security/cve/CVE-2024-7973.html https://www.suse.com/security/cve/CVE-2024-7974.html https://www.suse.com/security/cve/CVE-2024-7975.html https://www.suse.com/security/cve/CVE-2024-7976.html https://www.suse.com/security/cve/CVE-2024-7977.html https://www.suse.com/security/cve/CVE-2024-7978.html https://www.suse.com/security/cve/CVE-2024-7979.html https://www.suse.com/security/cve/CVE-2024-7980.html https://www.suse.com/security/cve/CVE-2024-7981.html https://www.suse.com/security/cve/CVE-2024-8033.html https://www.suse.com/security/cve/CVE-2024-8034.html https://www.suse.com/security/cve/CVE-2024-8035.html https://bugzilla.suse.com/1229426 https://bugzilla.suse.com/1229591

1 0

openSUSE-RU-2024:0191-1: moderate: Recommended update for wg-info
by maintenance＠opensuse.org 23 Aug '24

23 Aug '24

openSUSE Recommended Update: Recommended update for wg-info ______________________________________________________________________________ Announcement ID: openSUSE-RU-2024:0191-1 Rating: moderate References: Affected Products: openSUSE Backports SLE-15-SP6 ______________________________________________________________________________ An update that has 0 recommended fixes can now be installed. Description: This update for wg-info fixes the following issues: * Fix regex escaping Patch Instructions: To install this openSUSE Recommended Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Backports SLE-15-SP6: zypper in -t patch openSUSE-2024-191=1 Package List: - openSUSE Backports SLE-15-SP6 (noarch): wg-info-20240702.9b5c479-bp156.2.3.1 References:

1 0