SUSE-SU-2023:4183-1 Security update for xen

This update for xen fixes the following issues: - CVE-2023-34323: Fixed a potential crash in C Xenstored due to an incorrect assertion XSA-440 bsc1215744. - CVE-2023-34326: Fixed a missing IOMMU TLB flush on x86 AMD systems with IOMMU hardware and PCI passthrough enabled XSA-442 bsc1215746. -...

SUSE-SU-2023:4129-1 Security update for tomcat

This update for tomcat fixes the following issues: Tomcat was updated to version 9.0.82 jscPED-6376, jscPED-6377: - Security issues fixed: CVE-2023-41080: Avoid protocol relative redirects in FORM authentication. bsc1214666 CVE-2023-44487: Fix HTTP/2 Rapid Reset Attack. bsc1216182 - Update to...

SUSE-SU-2023:3535-1 Security update for glib2

This update for glib2 fixes the following issues: - CVE-2021-28153: Fixed an issue where symlink targets would be incorrectly created as empty files. bsc1183533 - CVE-2023-32665: Fixed GVariant deserialisation which does not match spec for non-normal data. bsc1211945 - CVE-2023-32643: Fixed a...

SUSE-SU-2023:3391-1 Security update for the Linux Kernel

The SUSE Linux Enterprise 15 SP3 kernel was updated to receive various security and bugfixes. The following security bugs were fixed: - CVE-2022-40982: Fixed transient execution attack called 'Gather Data Sampling' bsc1206418. - CVE-2023-0459: Fixed information leak in uaccessbeginnospec...

SUSE-SU-2023:1295-1 Security update for sqlite3

This update for sqlite3 fixes the following issues: - CVE-2022-46908: Properly implement the azProhibitedFunctions protection mechanism, when relying on --safe for execution of an untrusted CLI script bsc1206337...

SUSE-SU-2023:2731-1 Security update for the Linux Kernel (Live Patch 10 for SLE 15 SP4)

This update for the Linux Kernel 5.14.21-1504002455 fixes several issues. The following security issues were fixed: - CVE-2023-31436: Fixed an out-of-bounds write in qfqchangeclass because lmax can exceed QFQMINLMAX bsc1210989. - CVE-2023-28466: Fixed race condition that could lead to...

SUSE-SU-2023:2378-1 Security update for openstack-heat, openstack-swift, python-Werkzeug

This update for openstack-heat, openstack-swift, python-Werkzeug contains the following fixes: Security fixes included in this update: openstack-heat: - CVE-2023-1625: Fixed an issue where parameter values marked as 'hidden' would be shown in the stack's environment bsc1209774. openstack-swift: -...

SUSE-SU-2023:2141-1 Security update for the Linux Kernel

The SUSE Linux Enterprise 15 SP4 Azure kernel was updated to receive various security and bugfixes. The following security bugs were fixed: - CVE-2023-2235: A use-after-free vulnerability in the Performance Events system can be exploited to achieve local privilege escalation bsc1210986. -...

SUSE-SU-2023:0774-1 Security update for the Linux Kernel

The SUSE Linux Enterprise 15 SP4 Azure kernel was updated to receive various security and bugfixes. - CVE-2022-3523: Fixed use after free related to device private page handling bsc1204363. - CVE-2022-36280: Fixed out-of-bounds memory access vulnerability found in vmwgfx driver bsc1203332. -...

SUSE-SU-2023:0748-1 Security update for python310

This update for python310 fixes the following issues: - CVE-2023-24329: Fixed blocklist bypass via the urllib.parse component when supplying a URL that starts with blank characters bsc1208471. Update to 3.10.10: - Add provides for readline and sqlite3 to the main Python package. - Disable NIS for...

SUSE-SU-2023:0673-1 Security update for nodejs16

This update for nodejs16 fixes the following issues: Update to LTS version 16.19.1: - CVE-2023-23918: Fixed permissions policies that could have been bypassed via process.mainModule bsc1208481. - CVE-2023-23919: Fixed OpenSSL error handling issues in nodejs crypto library bsc1208483. -...

SUSE-SU-2023:0212-1 Security update for nginx

This update for nginx fixes the following issues: - CVE-2022-41741: Handle duplicated atoms in mp4 streams, to mitigate out-of-bound reads. bsc1204526 - CVE-2022-41742: Handle duplicated atoms in mp4 streams, to mitigate out-of-bound reads. bsc1204527...

SUSE-SU-2022:4281-1 Security update for python3

This update for python3 fixes the following issues: - CVE-2022-37454: Fixed a buffer overflow in hashlib.sha3 implementations. bsc1204577 - CVE-2020-10735: Fixed a bug to limit amount of digits converting text to int and vice vera. bsc1203125 The following non-security bug was fixed: - Fixed a...

SUSE-SU-2022:3936-1 Security update for libarchive

This update for libarchive fixes the following issues: - CVE-2021-31566: Fixed vulnerability where libarchive modifies file flags of symlink target bsc1192426 - Fixed issue where processing fixup entries may follow symbolic links bsc1192427...

SUSE-SU-2022:3880-1 Security update for spacewalk-java

This update for spacewalk-java fixes the following issues: - CVE-2022-31255: Fix directory path traversal vulnerability bsc1204543 - CVE-2022-43754: Fix reflected cross site scripting vulnerability bsc1204741 - CVE-2022-43753: Fix arbitrary file disclosure vulnerability bsc1204716...

SUSE-SU-2022:3767-1 Recommended update for bind

This update for bind fixes the following issues: Update to release 9.16.33: - CVE-2022-2795: Fixed potential performance degredation due to missing database lookup limits when processing large delegations bsc1203614. - CVE-2022-3080: Fixed assertion failure when there was a stale CNAME in the cac...

SUSE-SU-2022:3665-1 Security update for xen

This update for xen fixes the following issues: - CVE-2022-33746: Fixed DoS due to excessively long P2M pool freeing bsc1203806. - CVE-2022-33748: Fixed DoS due to race in locking bsc1203807. - CVE-2022-26365: Fixed issue where Linux Block and Network PV device frontends don't zero memory regions...

SUSE-SU-2022:0134-2 Security update for python-numpy

This update for python-numpy fixes the following issues: - CVE-2021-33430: Fixed buffer overflow that could lead to DoS in PyArrayNewFromDescrint function of ctors.c bsc1193913. - CVE-2021-41496: Fixed buffer overflow that could lead to DoS in arrayfrompyobj function of fortranobject.c bsc1193907...

SUSE-SU-2022:3590-1 Security update for python-Babel

This update for python-Babel fixes the following issues: - CVE-2021-42771: Fixed relative path traversal bsc1185768...

SUSE-SU-2022:3383-1 Security update for vsftpd

This update for vsftpd fixes the following issues: - CVE-2021-3618: Enforced security checks against ALPACA attack PM-3322, bsc1187686, bsc1187678. Bugfixes: - Fixed a seccomp failure in FIPS mode when SSL was enabled bsc1052900. - Allowed wait4 to be called so that the broker can wait for its...

SUSE-SU-2022:2809-1 Security update for the Linux Kernel

The SUSE Linux Enterprise 15 SP2 kernel was updated to receive various security and bugfixes. The following security bugs were fixed: - CVE-2020-36557: Fixed a race condition between the VTDISALLOCATE ioctl and closing/opening of ttys could lead to a use-after-free bnc1201429. - CVE-2020-36558:...

SUSE-SU-2022:2803-1 Security update for the Linux Kernel

The SUSE Linux Enterprise 15 SP4 kernel was updated to receive various security and bugfixes. The following security bugs were fixed: - CVE-2021-33655: Fixed out of bounds write with ioctl FBIOPUTVSCREENINFO bnc1201635. - CVE-2022-2585: Fixed use-after-free in POSIX CPU timer bnc1202094. -...

SUSE-SU-2022:2533-2 Security update for mozilla-nss

This update for mozilla-nss fixes the following issues: Various FIPS 140-3 related fixes were backported from SUSE Linux Enterprise 15 SP4: - Makes the PBKDF known answer test compliant with NIST SP800-132. bsc1192079. - FIPS: Add on-demand integrity tests through sftkFIPSRepeatIntegrityCheck...

SUSE-SU-2022:2425-1 Security update for nodejs14

This update for nodejs14 fixes the following issues: - CVE-2022-32212: Fixed DNS rebinding in --inspect via invalid IP addresses bsc1201328. - CVE-2022-32213: Fixed HTTP request smuggling due to flawed parsing of Transfer-Encoding bsc1201325. - CVE-2022-32214: Fixed HTTP request smuggling due to...

SUSE-SU-2022:2379-1 Security update for the Linux Kernel

The SUSE Linux Enterprise 12 SP2 kernel was updated to receive various security and bugfixes. The following security bugs were fixed: - CVE-2022-29900, CVE-2022-29901: Fixed the RETBLEED attack, a new Spectre like Branch Target Buffer attack, that can leak arbitrary kernel information bsc1199657....

SUSE-SU-2022:2275-1 Security update for php7

This update for php7 fixes the following issues: - CVE-2022-31625: Fixed uninitialized pointers free in Postgres extension. bsc1200645 - CVE-2022-31626: Fixed buffer overflow via user-supplied password when using pdomysql extension with mysqlnd driver. bsc1200628...

SUSE-SU-2022:2263-1 Security update for ImageMagick

This update for ImageMagick fixes the following issues: - CVE-2019-17540: Fixed heap-based buffer overflow in ReadPSInfo in coders/ps.c. bsc1153866 - CVE-2022-32545: Fixed an outside the range of representable values of type. bsc1200388 - CVE-2022-32546: Fixed an outside the range of representabl...

SUSE-SU-2022:2030-1 Security update for webkit2gtk3

This update for webkit2gtk3 fixes the following issues: Update to version 2.36.3 bsc1200106 - CVE-2022-30293: Fixed heap-based buffer overflow in WebCore::TextureMapperLayer::setContentsLayer bsc1199287. - CVE-2022-26700: Fixed memory corruption issue that may lead to code execution when processi...

SUSE-SU-2022:2004-1 Security update for go1.17

This update for go1.17 fixes the following issues: Update to go1.17.11 released 2022-06-01 bsc1190649: - CVE-2022-30634: Fixed crypto/rand rand.Read hangs with extremely large buffers bsc1200134. - CVE-2022-30629: Fixed crypto/tls session tickets lack random ticketageadd bsc1200135. -...

SUSE-SU-2022:2003-1 Security update for mariadb

This update for mariadb fixes the following issues: Update to 10.5.16 bsc1199928: - CVE-2021-46669 bsc1199928 - CVE-2022-27376 bsc1198628 - CVE-2022-27377 bsc1198603 - CVE-2022-27378 bsc1198604 - CVE-2022-27379 bsc1198605 - CVE-2022-27380 bsc1198606 - CVE-2022-27381 bsc1198607 - CVE-2022-27382...

SUSE-SU-2022:0906-1 Security update for MozillaThunderbird

This update for MozillaThunderbird fixes the following issues: Updated to version 91.7 bsc1196900: - CVE-2022-26381: Fixed an invalid memory access due to text reflow when SVG objects were present. - CVE-2022-26383: Fixed an issue where, when resizing a popup after requesting fullscreen access, t...

SUSE-SU-2022:0871-1 Security update for java-1_8_0-openjdk

This update for java-180-openjdk fixes the following issues: Update to version jdk8u322 icedtea-3.22.0 Including the following security fixes: - CVE-2022-21248, bsc1194926: Enhance cross VM serialization - CVE-2022-21283, bsc1194937: Better String matching - CVE-2022-21293, bsc1194935: Improve...

SUSE-SU-2022:0569-1 Security update for nodejs14

This update for nodejs14 fixes the following issues: - CVE-2021-23343: Fixed ReDoS via splitDeviceRe, splitTailRe and splitPathRe bsc1192153. - CVE-2021-32803: Fixed insufficient symlink protection in node-tar allowing arbitrary file creation and overwrite bsc1191963. - CVE-2021-32804: Fixed...

SUSE-SU-2022:0271-1 Security update for samba

This update for samba fixes the following issues: - CVE-2021-44142: Fixed out-of-Bound Read/Write on Samba vfsfruit module. bsc1194859...

SUSE-SU-2022:0179-1 Security update for expat

This update for expat fixes the following issues: - CVE-2021-45960: Fixed left shift in the storeAtts function in xmlparse.c that can lead to realloc misbehavior bsc1194251. - CVE-2021-46143: Fixed integer overflow in mgroupSize in doProlog bsc1194362. - CVE-2022-22822: Fixed integer overflow in...

SUSE-SU-2022:0091-2 Security update for apache2

This update for apache2 fixes the following issues: Apache2 was updated to the current stable version 2.4.51 jscSLE-22733 jscSLE-22849 It fixes all CVEs and selected bugs represented by patches found between 2.4.23 and 2.4.51. See https://downloads.apache.org/httpd/CHANGES2.4 for a complete chang...

SUSE-FU-2022:0039-1 Feature update for zxing-cpp libreoffice

This feature update for zxing-cpp and libreoffice fixes the following issues: Update LibreOffice from version 7.1.3.2 to 7.2.3.2 jscSLE-18213: - Fix external URL connections issues when WebDav is built using libserf. bsc1187173, bsc1186871 - Fix an issue with PPTX where one column becomes two...

SUSE-SU-2021:3723-1 Security update for the Linux Kernel

The SUSE Linux Enterprise 12 SP5 Real Time kernel was updated to receive various security and bugfixes. The following security bugs were fixed: - CVE-2021-3655: Fixed a missing size validations on inbound SCTP packets, which may have allowed the kernel to read uninitialized memory bsc1188563. -...

SUSE-SU-2021:3463-1 Security update for util-linux

This update for util-linux fixes the following issues: - CVE-2021-37600: Fixed an integer overflow which could lead to buffer overflow in getsemelements. bsc1188921 - Prevent outdated pam files bsc1082293, bsc1081947c68. - Do not trim read-only volumes bsc1106214. - libmount: To prevent incorrect...

SUSE-SU-2021:3004-2 Security update for libtpms

This update for libtpms fixes the following issues: - CVE-2021-3746: Fixed out-of-bounds access via specially crafted TPM 2 command packets bsc1189935...

SUSE-SU-2021:0653-1 Security update for glibc

This update for glibc fixes the following issues: - Fix buffer overrun in EUC-KR conversion module CVE-2019-25013, bsc1182117, BZ 24973 - x86: Harden printf against non-normal long double values CVE-2020-29573, bsc1179721, BZ 26649 - gconv: Fix assertion failure in ISO-2022-JP-3 module...

SUSE-SU-2021:14604-1 Security update for dnsmasq

This update for dnsmasq fixes the following issues: Security issues fixed: - CVE-2020-25684, CVE-2020-25685, CVE-2020-25686: Fixed multiple Cache Poisoning attacks bsc1177077. - CVE-2020-25681, CVE-2020-25682, CVE-2020-25683, CVE-2020-25687: Fixed multiple potential Heap-based overflows when DNSS...

SUSE-SU-2020:3877-1 Security update for slurm_18_08

This update for slurm1808 fixes the following issues: Security issues fixed: - CVE-2020-27745: Fixed a potential buffer overflow from use of unpackmem bsc1178890. - CVE-2020-27746: Fixed a potential leak of the magic cookie when sent as an argument to the xauth command bsc1178891...

SUSE-SU-2020:3690-1 Security update for the Linux Kernel (Live Patch 18 for SLE 15 SP1)

This update for the Linux Kernel 4.12.14-19767 fixes several issues. The following security issues were fixed: - CVE-2020-25668: Fixed a concurrency use-after-free in confontop bsc1178622. - CVE-2020-25705: Fixed a flaw which could have allowed an off-path remote user to effectively bypass source...

SUSE-SU-2020:3507-1 Security update for the Linux Kernel

The SUSE Linux Enterprise 15 SP1 kernel was updated to receive various security and bugfixes. The following security bugs were fixed: - CVE-2020-25705: A flaw in the way reply ICMP packets are limited in was found that allowed to quickly scan open UDP ports. This flaw allowed an off-path remote...

SUSE-SU-2020:3376-1 Security update for wireshark

This update for wireshark fixes the following issues: - wireshark was updated to 3.2.8: - CVE-2020-26575: Fixed an issue where FBZERO dissector was entering in infinite loop bsc1177406 - CVE-2020-28030: Fixed an issue where GQUIC dissector was crashing bsc1178291 Infinite memory allocation while...

SUSE-SU-2020:3360-1 Security update for tcpdump

This update for tcpdump fixes the following issues: - CVE-2020-8037: Fixed an issue where PPP decapsulator did not allocate the right buffer size bsc1178466. The previous update of tcpdump already fixed variuous Buffer overflow/overread vulnerabilities bsc1153098, bsc1153332 - CVE-2017-16808 AoE ...

SUSE-SU-2020:3333-1 Security update for gdm

This update for gdm fixes the following issues: - Exit with failure if loading existing users fails bsc1178150 CVE-2020-16125...

SUSE-SU-2020:3263-1 Security update for gcc10

This update for gcc10 fixes the following issues: This update provides the GCC10 compiler suite and runtime libraries. The base SUSE Linux Enterprise libraries libgccs1, libstdc++6 are replaced by the gcc10 variants. The new compiler variants are available with '-10' suffix, you can specify them...

SUSE-SU-2020:3231-1 Security update for yast2-multipath

This update for yast2-multipath to version 3.2.2 fixes the following issues: - CVE-2018-17955: Use random file name instead of static names bsc1117592...