SUSE-SU-2024:2383-1 Security update for skopeo

This update for skopeo fixes the following issues: - CVE-2024-3727: Added missing image digest verification bsc1224123...

SUSE-SU-2024:2368-1 Security update for the Linux Kernel (Live Patch 40 for SLE 15 SP3)

This update for the Linux Kernel 5.3.18-15030059147 fixes several issues. The following security issues were fixed: - CVE-2021-47383: Fixed out-of-bound vmalloc access in imageblit bsc1225211. - CVE-2024-26923: Fixed false-positive lockdep splat for spinlock in unixgc bsc1223683. - CVE-2024-26828...

SUSE-SU-2024:2342-1 Security update for the Linux Kernel (Live Patch 38 for SLE 15 SP3)

This update for the Linux Kernel 5.3.18-15030059141 fixes several issues. The following security issues were fixed: - CVE-2021-47383: Fixed out-of-bound vmalloc access in imageblit bsc1225211. - CVE-2024-26923: Fixed false-positive lockdep splat for spinlock in unixgc bsc1223683. - CVE-2024-26828...

SUSE-SU-2024:2351-1 Security update for the Linux Kernel (Live Patch 48 for SLE 15 SP2)

This update for the Linux Kernel 5.3.18-15020024191 fixes several issues. The following security issues were fixed: - CVE-2021-47383: Fixed out-of-bound vmalloc access in imageblit bsc1225211. - CVE-2024-26923: Fixed false-positive lockdep splat for spinlock in unixgc bsc1223683. - CVE-2024-26828...

SUSE-SU-2024:2304-1 Security update for cockpit

This update for cockpit fixes the following issues: - CVE-2024-6126: Fixed Integer overflow in pamsmclosesession bsc1226040...

SUSE-SU-2024:2295-1 Security update for go1.22

This update for go1.22 fixes the following issues: Updated to version 1.22.5 bsc1218424: - CVE-2024-24791: Fixed a potential denial of service due to improper handling of HTTP 100-continue headers bsc1227314...

SUSE-SU-2024:2290-1 Security update for libxml2

This update for libxml2 fixes the following issues: - CVE-2024-34459: Fixed buffer over-read in xmlHTMLPrintFileContext in xmllint.c bsc1224282...

SUSE-SU-2024:2286-1 Security update for podman

This update for podman fixes the following issues: - CVE-2024-6104: Fixed a potential leak of sensitive information on HTTP log file bsc1227052...

SUSE-SU-2024:2274-1 Security update for python39

This update for python39 fixes the following issues: - CVE-2024-4032: Rearranging definition of private v global IP. bsc1226448 - CVE-2024-0397: Remove a memory race condition in ssl.SSLContext certificate store methods. bsc1226447...

SUSE-SU-2024:2271-1 Security update for openssl-1_1-livepatches

This update for openssl-11-livepatches fixes the following issues: - CVE-2024-4741: Fixed a use-after-free with SSLfreebuffers. bsc1225551...

SUSE-SU-2024:2160-1 Security update for the Linux Kernel (Live Patch 20 for SLE 15 SP4)

This update for the Linux Kernel 5.14.21-1504002497 fixes one issue. The following security issue was fixed: - CVE-2024-26852: Fixed use-after-free in ip6routempathnotify bsc1223059...

SUSE-SU-2024:2107-1 Security update for php-composer2

This update for php-composer2 fixes the following issues: - CVE-2024-35241: Fixed code execution when installing packages in repository with specially crafted branch names bsc1226181. - CVE-2024-35242: Fixed command injection via specially crafted branch names during repository cloning bsc1226182...

SUSE-SU-2024:2035-1 Security update for openssl-1_1

This update for openssl-11 fixes the following issues: - CVE-2024-4741: Fixed a use-after-free with SSLfreebuffers. bsc1225551...

SUSE-SU-2024:2030-1 Security update for libaom

This update for libaom fixes the following issues: - CVE-2024-5171: Fixed heap buffer overflow in imgallochelper caused by integer overflow bsc1226020...

SUSE-SU-2024:2028-1 Security update for tiff

This update for tiff fixes the following issues: - CVE-2023-3164: Fixed a heap buffer overflow in tiffcrop. bsc1212233...

SUSE-SU-2024:2012-1 Security update for MozillaFirefox

This update for MozillaFirefox fixes the following issues: - Update to version 115.12.0 ESR bsc1226027 - CVE-2024-5702: Use-after-free in networking - CVE-2024-5688: Use-after-free in JavaScript object transplant - CVE-2024-5690: External protocol handlers leaked by timing attack - CVE-2024-5691:...

SUSE-SU-2024:2009-1 Security update for curl

This update for curl fixes the following issues: - CVE-2023-27534: Properly resolve when used in a SFTP path. bsc1219273...

SUSE-SU-2024:1986-1 Security update for rmt-server

This update for rmt-server fixes the following issues: - Update to version 2.17 - CVE-2024-28103: Fixed Permissions-Policy that was only served on responses with an HTML related Content-Type. bsc1225997...

SUSE-SU-2024:1985-1 Security update for mariadb

This update for mariadb fixes the following issues: - CVE-2024-21096: Fixed mysqldump unspecified vulnerability bsc1225983. - CVE-2023-22084: Fixed a vulnerability allows high privileged attacker with network access via multiple protocols to compromise the server bsc1217405. - Update to 10.6.18...

SUSE-SU-2024:1948-1 Security update for python-Jinja2

This update for python-Jinja2 fixes the following issues: - CVE-2024-34064: Fixed HTML attribute injection when passing user input as keys to xmlattr filter bsc1223980...

SUSE-SU-2024:1936-1 Security update for go1.21

This update for go1.21 fixes the following issues: go1.21.11 release bsc1212475. - CVE-2024-24789: Fixed mishandling of corrupt central directory record in archive/zip bsc1225973. - CVE-2024-24790: Fixed unexpected behavior from Is methods for IPv4-mapped IPv6 addresses bsc1225974...

SUSE-SU-2024:1872-1 Security update for python-tqdm

This update for python-tqdm fixes the following issues: Update to version 4.66.4: rich: fix completion cli: eval safety CVE-2024-34062, bsc1223880 pandas: add DataFrame.progressmap notebook: fix HTML padding keras: fix resuming training when verbose=2 fix formatnum negative fractions missing...

SUSE-SU-2024:1863-2 Security update for python-Jinja2

This update for python-Jinja2 fixes the following issues: - Fixed HTML attribute injection when passing user input as keys to xmlattr filter CVE-2024-34064, bsc1223980, CVE-2024-22195, bsc1218722...

SUSE-SU-2024:1815-1 Security Beta update for SUSE Manager Client Tools

This update fixes the following issues: grafana: - Packaging improvements: Changed deprecated disabled service mode to manual Drop golang-packaging macros Drop explicit mod=vendor as it is enabled automatically - Update to version 9.5.18: SECURITY CVE-2024-1313: Require same organisation when...

SUSE-SU-2024:1728-1 Security update for glibc

This update for glibc fixes the following issues: - CVE-2024-2961: iconv: ISO-2022-CN-EXT: fix out-of-bound writes when writing escape sequence bsc1222992...

SUSE-SU-2024:1646-1 Security update for the Linux Kernel

The SUSE Linux Enterprise 12 SP5 RT kernel was updated to receive various security bugfixes. The following security bugs were fixed: - CVE-2019-25160: Fixed out-of-bounds memory accesses in netlabel bsc1220394. - CVE-2021-46904: Fixed NULL pointer dereference during tty device unregistration...

SUSE-SU-2024:1598-2 Security update for less

This update for less fixes the following issues: - CVE-2024-32487: Fixed mishandling of \n character in paths when LESSOPEN is set leads to OS command execution. bsc1222849...

SUSE-SU-2024:1540-1 Security update for xen

This update for xen fixes the following issues: - CVE-2024-2201: Mitigation for Native Branch History Injection XSA-456, bsc1222453 - CVE-2023-46842: HVM hypercalls may trigger Xen bug check XSA-454, bsc1221984 - CVE-2024-31142: Fixed incorrect logic for BTC/SRSO mitigations XSA-455, bsc1222302...

SUSE-SU-2024:1470-1 Security update for ffmpeg-4

This update for ffmpeg-4 fixes the following issues: - CVE-2024-31578: Fixed heap use-after-free via avhwframectxinit when vulkanframes init failed bsc1223070 - CVE-2023-49502: Fixed heap buffer overflow via the ffbwdiffilterintrac function in libavfilter/bwdifdsp.c bsc1223235 - CVE-2023-51793:...

SUSE-SU-2024:1468-1 Security update for ffmpeg

This update for ffmpeg fixes the following issues: - CVE-2024-31578: Fixed heap use-after-free via avhwframectxinit when vulkanframes init failed bsc1223070 - CVE-2023-49502: Fixed heap buffer overflow via the ffbwdiffilterintrac function in libavfilter/bwdifdsp.c bsc1223235 Adding references for...

SUSE-SU-2024:1445-1 Security update for php74

This update for php74 fixes the following issues: - CVE-2024-2756: Fixed bypass of security fix applied for CVE-2022-31629 that lead PHP to consider not secure cookies as secure bsc1222857 - CVE-2024-3096: Fixed bypass on null byte leading passwords checked via passwordverify bsc1222858...

SUSE-SU-2024:1415-2 Security update for cockpit-wicked

This update for cockpit-wicked fixes the following issues: - CVE-2023-26364: Fixed denial of service due to improper input validation during CSS parsing bsc1217325 Other fixes: - Update to version 5git8.c06c55b...

SUSE-SU-2024:1376-1 Security update for polkit

This update for polkit fixes the following issues: - Change permissions for rules folders bsc1209282...

SUSE-SU-2024:1365-1 Security update for apache-commons-configuration2

This update for apache-commons-configuration2 fixes the following issues: - CVE-2024-29131: Fixed StackOverflowError adding property in AbstractListDelimiterHandler.flattenIterator bsc1221797. - CVE-2024-29133: Fixed StackOverflowError calling ListDelimiterHandler.flattenObject, int with a cyclic...

SUSE-SU-2024:1362-1 Security update for the Linux Kernel RT (Live Patch 10 for SLE 15 SP5)

This update for the Linux Kernel 5.14.21-1505001335 fixes several issues. The following security issues were fixed: - CVE-2024-26622: Fixed UAF write bug in tomoyowritecontrol bsc1220828. - CVE-2023-52340: Fixed ICMPv6 “Packet Too Big” packets force a DoS of the Linux kernel by forcing 100% CPU...

SUSE-SU-2024:1276-1 Security update for the Linux Kernel (Live Patch 42 for SLE 15 SP3)

This update for the Linux Kernel 5.3.18-15030059153 fixes several issues. The following security issues were fixed: - CVE-2023-6531: Fixed a use-after-free flaw due to a race problem in the unix garbage collector's deletion of SKB races with unixstreamreadgenericon the socket that the SKB is queu...

SUSE-SU-2024:0946-1 Security update for rubygem-rack-1_4

This update for rubygem-rack-14 fixes the following issues: - CVE-2024-25126: Fixed a Denial of Service Vulnerability in Rack Content-Type Parsing bsc1220239 - CVE-2024-26141: Fixed a Denial of Service Vulnerability in Range request header parsing bsc1220242 - CVE-2024-26146: Fixed a Denial of...

SUSE-SU-2024:0900-2 Security update for the Linux Kernel

The SUSE Linux Enterprise 15 SP4 kernel was updated to receive various security bugfixes. The following security bugs were fixed: - CVE-2023-6270: Fixed a use-after-free issue in aoecmdcfgpkts bsc1218562. - CVE-2023-52463: Fixed null pointer dereference in efivarfs bsc1220328. - CVE-2023-52559:...

SUSE-SU-2024:0783-1 Security update for vim

This update for vim fixes the following issues: - CVE-2023-48231: Fixed Use-After-Free in winclose bsc1217316. - CVE-2023-48232: Fixed Floating point Exception in adjustplinesforskipcol bsc1217320. - CVE-2023-48233: Fixed overflow with count for :s command bsc1217321. - CVE-2023-48234: Fixed...

SUSE-SU-2024:0764-2 Security update for wpa_supplicant

This update for wpasupplicant fixes the following issues: - CVE-2023-52160: Bypassing WiFi Authentication bsc1219975...

SUSE-SU-2024:0577-1 Security update for python-aiohttp, python-time-machine

This update for python-aiohttp, python-time-machine fixes the following issues: python-aiohttp was updated to version 3.9.3: Fixed backwards compatibility breakage in 3.9.2 of ssl parameter when set outside of ClientSession e.g. directly in TCPConnector Improved test suite handling of paths and...

SUSE-RU-2024:0560-1 Recommended update for Java

This update for Java fixes the following issues: plexus-archiver was updated from version 4.2.1 to 4.8.0: - Changes of 4.8.0: Security issues fixed: + CVE-2023-37460: Avoid override target symlink by standard file in AbstractUnArchiver bsc1215973 New features and improvements: + Added tzst alias...

SUSE-SU-2024:0543-1 Security update for libssh2_org

This update for libssh2org fixes the following issues: - Always add the KEX pseudo-methods 'ext-info-c' and '[email protected]' when configuring custom method list. bsc1218971, CVE-2023-48795 The strict-kex extension is announced in the list of available KEX methods. However, when the...

SUSE-RU-2024:0511-1 Recommended update for grafana

This update for grafana fixes the following issues: - Fixed changelog entries for the Bugzilla trackers related to previously implemented security fixes no source code changes...

SUSE-SU-2024:0478-1 Security update for the Linux Kernel

The SUSE Linux Enterprise 15 SP2 LTSS kernel was updated to receive various security bugfixes. The following security bugs were fixed: - CVE-2024-1086: Fixed a use-after-free vulnerability inside the nftables component that could have been exploited to achieve local privilege escalation bsc121943...

SUSE-SU-2024:0321-1 Security update for java-11-openjdk

This update for java-11-openjdk fixes the following issues: Updated to version 11.0.22 January 2024 CPU: - CVE-2024-20918: Fixed an out of bounds access in the Hotspot JVM due to a missing bounds check bsc1218907. - CVE-2024-20919: Fixed a sandbox bypass in the Hotspot JVM class file verifier...

SUSE-SU-2024:0224-1 Security update for apache-parent, apache-sshd

This update for apache-parent, apache-sshd fixes the following issues: apache-parent was updated from version 28 to 31: - Version 31: New Features: + Added maven-checkstyle-plugin to pluginManagement Improvements: + Set minimalMavenBuildVersion to 3.6.3 - the minimum used by plugins + Using an SP...

SUSE-SU-2024:0191-1 Security Beta update for SUSE Manager Client Tools

This update fixes the following issues: golang-github-QubitProducts-exporterexporter: - Exclude s390 arch - Adapted to build on Enterprise Linux. - Fix build for RedHat 7 - Require Go = 1.14 also for CentOS - Add support for CentOS - Replace %?systemdrequires with %?systemdordering...

SUSE-SU-2023:4883-1 Security update for the Linux Kernel

The SUSE Linux Enterprise 12 SP5 Azure kernel was updated to receive various security and bugfixes. The following security bugs were fixed: - CVE-2023-0461: Fixed use-after-free in icskulpdata bsc1208787. - CVE-2023-31083: Fixed race condition in hciuartttyioctl bsc1210780. - CVE-2023-39197: Fixe...

SUSE-SU-2023:4863-1 Security update for the Linux Kernel (Live Patch 5 for SLE 15 SP5)

This update for the Linux Kernel 5.14.21-1505005528 fixes several issues. The following security issues were fixed: - CVE-2023-3777: Fixed a use-after-free vulnerability in netfilter: nftables component can be exploited to achieve local privilege escalation. bsc1215097 - CVE-2023-5345: Fixed an...