SUSE-SU-2024:3518-1 Security update for MozillaFirefox

This update for MozillaFirefox fixes the following issues: Update to Firefox Extended Support Release 128.3.0 ESR MFSA-2024-47, bsc1230979: - CVE-2024-8900: Clipboard write permission bypass - CVE-2024-9392: Compromised content process can bypass site isolation - CVE-2024-9393: Cross-origin acces...

SUSE-SU-2024:3158-2 Security update for postgresql16

This update for postgresql16 fixes the following issues: - Upgrade to 15.8 bsc1229013 - CVE-2024-7348: PostgreSQL relation replacement during pgdump executes arbitrary SQL. bsc1229013...

SUSE-SU-2024:3353-1 Security update for python36

This update for python36 fixes the following issues: - CVE-2024-5642: Fixed invalid value sent to underlying OpenSSL API may cause a buffer overread when NPN is used bsc1227233...

SUSE-SU-2024:3351-1 Security update for python3

This update for python3 fixes the following issues: - CVE-2024-5642: buffer overread when NPN is used and invalid values are sent to the OpenSSL API. bsc1227233...

SUSE-SU-2024:3345-1 Security update for python-azure-identity

This update for python-azure-identity fixes the following issues: - CVE-2024-35255: Fixed an Azure identity libraries elevation of privilege vulnerability. bsc1230100...

SUSE-SU-2024:3250-1 Security update for wireshark

This update for wireshark fixes the following issues: - CVE-2024-8250: Fixed NTLMSSP dissector crash bsc1229907...

SUSE-SU-2024:3218-1 Security update for 389-ds

This update for 389-ds fixes the following issues: - Update to version 2.0.20 - CVE-2024-3657: DOS via via specially crafted kerberos AS-REQ request. bsc1225512 - CVE-2024-5953: Malformed userPassword hashes may cause a denial of service. bsc1226277 - CVE-2024-2199: Malformed userPassword may cau...

SUSE-SU-2024:3200-1 Security update for python311

This update for python311 fixes the following issues: - CVE-2024-6923: Fixed email header injection due to unquoted newlines bsc1228780 Other fixes: - %profileopt variable is set according to the variable %doprofiling bsc1227999 - Stop using %%defattr, it seems to be breaking proper executable...

SUSE-SU-2024:3192-1 Security update for postgresql16

This update for postgresql16 fixes the following issues: - Upgrade to 13.16 bsc1229013 - CVE-2024-7348: PostgreSQL relation replacement during pgdump executes arbitrary SQL. bsc1229013...

SUSE-SU-2024:3040-1 Security update for the Linux Kernel (Live Patch 47 for SLE 12 SP5)

This update for the Linux Kernel 4.12.14-122173 fixes one issue. The following security issue was fixed: - CVE-2021-47378: Fixed use-after-free by destroying cm id before destroying qp bsc1225202...

SUSE-SU-2024:3030-1 Security update for the Linux Kernel (Live Patch 35 for SLE 15 SP3)

This update for the Linux Kernel 5.3.18-15030059130 fixes several issues. The following security issues were fixed: - CVE-2021-47402: Fixed use-after-free in flwalk bsc1225301 - CVE-2021-47378: Fixed use-after-free by destroying cm id before destroying qp bsc1225202...

SUSE-SU-2024:3014-1 Security update for the Linux Kernel (Live Patch 49 for SLE 12 SP5)

This update for the Linux Kernel 4.12.14-122179 fixes one issue. The following security issue was fixed: - CVE-2021-47378: Fixed use-after-free by destroying cm id before destroying qp bsc1225202...

SUSE-SU-2024:2978-1 Security update for unixODBC

This update for unixODBC fixes the following issues: - CVE-2024-1013: Fixed out of bounds stack write due to pointer-to-integer types conversion on 64-bit architectures bsc1228143...

SUSE-SU-2024:2946-1 Security update for libqt5-qtbase

This update for libqt5-qtbase fixes the following issues: - CVE-2023-37369: Fixed a buffer overflow in QXmlStreamReader QTBUG-91889, bsc1214327. - CVE-2023-45935: Fixed NULL pointer dereference in QXcbConnection::initializeAllAtoms due to anomalous behavior from the X server bsc1222120 -...

SUSE-SU-2024:2943-1 Security update for kernel-firmware

This update for kernel-firmware fixes the following issues: - CVE-2023-31315: Fixed validation in a model specific register MSR that lead to modification of SMM configuration by malicious program with ring0 access bsc1229069...

SUSE-SU-2024:2938-1 Security update for curl

This update for curl fixes the following issues: - CVE-2024-7264: Fixed out-of-bounds read in ASN.1 date parser GTime2str bsc1228535...

SUSE-SU-2024:2900-1 Security update for python-setuptools

This update for python-setuptools fixes the following issues: - CVE-2024-6345: Fixed code execution via download functions in the packageindex module bsc1228105...

SUSE-SU-2024:2882-1 Security update for libqt5-qtbase

This update for libqt5-qtbase fixes the following issues: - CVE-2023-45935: Fixed NULL pointer dereference in QXcbConnection::initializeAllAtoms due to anomalous behavior from the X server bsc1222120 - CVE-2024-39936: Fixed information leakage due to process HTTP2 communication before encrypted c...

SUSE-SU-2024:2874-1 Security update for the Linux Kernel (Live Patch 0 for SLE 15 SP6)

This update for the Linux Kernel 6.4.0-15060021 fixes several issues. The following security issues were fixed: - CVE-2024-26923: Fixed false-positive lockdep splat for spinlock in unixgc bsc1223683. - CVE-2024-27398: Fixed use-after-free bugs caused by scosocktimeout bsc1225013. - CVE-2024-35950...

SUSE-SU-2024:2873-1 Security update for qt6-base

This update for qt6-base fixes the following issues: - CVE-2024-33861: Fixed an invalid pointer being passed as a callback which coud lead to modification of the stack bsc1223917 - CVE-2024-39936: Fixed information leakage due to process HTTP2 communication before encrypted can be responded to...

SUSE-SU-2024:2861-1 Security update for python-Django

This update for python-Django fixes the following issues: - Fixed code in CVE-2024-41990 patch...

SUSE-SU-2024:2792-1 Security update for the Linux Kernel (Live Patch 44 for SLE 15 SP3)

This update for the Linux Kernel 5.3.18-15030059161 fixes several issues. The following security issues were fixed: - CVE-2024-27398: Fixed use-after-free bug caused by scosocktimeout bsc1225013. - CVE-2024-35950: drm/client: Fully protect modes with dev-modeconfig.mutex bsc1225310. -...

SUSE-SU-2024:2761-1 Security update for openssl-3-livepatches

This update for openssl-3-livepatches fixes the following issues: - CVE-2024-5535: Fixed SSLselectnextproto buffer overread bsc1227147...

SUSE-SU-2024:2631-1 Security update for freerdp

This update for freerdp fixes the following issues: - CVE-2024-22211: Fixed integer overflow in freerdpbitmapplanarcontextreset that could lead to heap-buffer overflow bsc1219049 - CVE-2024-32658: Fixed out-of-bounds read in Interleaved RLE Bitmap Codec in FreeRDP based clients bsc1223353 -...

SUSE-SU-2024:2474-1 Security update for the Linux Kernel (Live Patch 13 for SLE 15 SP5)

This update for the Linux Kernel 5.14.21-1505005562 fixes several issues. The following security issues were fixed: - CVE-2024-26923: Fixed false-positive lockdep splat for spinlock in unixgc bsc1223683. - CVE-2024-26828: Fixed underflow in parseserverinterfaces bsc1223363...

SUSE-SU-2024:2472-1 Security update for the Linux Kernel (Live Patch 11 for SLE 15 SP5)

This update for the Linux Kernel 5.14.21-1505005552 fixes several issues. The following security issues were fixed: - CVE-2024-26923: Fixed false-positive lockdep splat for spinlock in unixgc bsc1223683. - CVE-2024-26930: Fixed double free of the ha-vpmap pointer bsc1223681. - CVE-2024-26828: Fix...

SUSE-SU-2024:2468-1 Security update for traceroute

This update for traceroute fixes the following issues: - CVE-2023-46316: wrapper scripts do not properly parse command lines bsc1216591...

SUSE-SU-2024:2303-1 Security update for krb5

This update for krb5 fixes the following issues: - CVE-2024-37370: Fixed confidential GSS krb5 wrap tokens with invalid fields were errouneously accepted bsc1227186. - CVE-2024-37371: Fixed invalid memory read when processing message tokens with invalid length fields bsc1227187...

SUSE-SU-2024:2297-1 Security update for emacs

This update for emacs fixes the following issues: - CVE-2024-30203: Fixed denial of service via MIME contents bsc1222053. - CVE-2024-30204: Fixed denial of service via LaTeX preview in e-mail attachments bsc1222052. - CVE-2024-30204: Fixed Org mode considers contents of remote files to be trusted...

SUSE-SU-2024:2294-1 Security update for go1.21

This update for go1.21 fixes the following issues: Updated to version 1.21.12 bsc1212475: - CVE-2024-24791: Fixed a potential denial of service due to improper handling of HTTP 100-continue headers bsc1227314...

SUSE-SU-2024:2217-1 Security update for the Linux Kernel (Live Patch 5 for SLE 15 SP5)

This update for the Linux Kernel 5.14.21-1505005528 fixes several issues. The following security issues were fixed: - CVE-2023-52628: Fixed 4-byte stack OOB write in nftables bsc1222118. - CVE-2024-26852: Fixed use-after-free in ip6routempathnotify bsc1223059...

SUSE-SU-2024:2207-1 Security update for the Linux Kernel (Live Patch 10 for SLE 15 SP5)

This update for the Linux Kernel 5.14.21-1505005549 fixes several issues. The following security issues were fixed: - CVE-2024-26852: Fixed use-after-free in ip6routempathnotify bsc1223059. - CVE-2024-26610: Fixed memory corruption in wifi/iwlwifi bsc1221302. - CVE-2022-48651: Fixed an out-of-bou...

SUSE-SU-2024:2171-1 Security update for libarchive

This update for libarchive fixes the following issues: - CVE-2024-20696: Fixed heap based out-of-bounds write bsc1225971...

SUSE-SU-2024:2123-1 Security update for the Linux Kernel (Live Patch 41 for SLE 15 SP2)

This update for the Linux Kernel 5.3.18-15020024166 fixes several issues. The following security issues were fixed: - CVE-2021-46955: Fixed an out-of-bounds read with openvswitch, when fragmenting IPv4 packets bsc1220537. - CVE-2024-26852: Fixed use-after-free in ip6routempathnotify bsc1223059...

SUSE-SU-2024:2096-1 Security update for the Linux Kernel RT (Live Patch 6 for SLE 15 SP5)

This update for the Linux Kernel 5.14.21-1505001321 fixes one issue. The following security issue was fixed: - CVE-2024-26852: Fixed use-after-free in ip6routempathnotify bsc1223059...

SUSE-SU-2024:2080-1 Security update for libzypp, zypper

This update for libzypp, zypper fixes the following issues: - CVE-2017-9271: Fixed proxy credentials written to log files bsc1050625. The following non-security bugs were fixed: - clean: Do not report an error if no repos are defined at all bsc1223971...

SUSE-SU-2024:2060-1 Security update for less

This update for less fixes the following issues: - CVE-2024-32487: Fixed OS command injection via a newline character in the file name. bsc1222849...

SUSE-SU-2024:1486-2 Security update for cosign

This update for cosign fixes the following issues: - CVE-2024-29902: Fixed denial of service on host machine via remote image with a malicious attachments bsc1222835 - CVE-2024-29903: Fixed denial of service on host machine via malicious software artifacts bsc1222837 Other fixes: - Updated to 2.2...

SUSE-SU-2024:1949-1 Security update for openssl-1_1

This update for openssl-11 fixes the following issues: - CVE-2024-2511: Fixed unconstrained session cache growth in TLSv1.3 bsc1222548...

SUSE-SU-2024:1941-1 Security update for sssd

This update for sssd fixes the following issues: - CVE-2023-3758: Fixed race condition during authorization leads to GPO policies functioning inconsistently bsc1223100. The following non-security bugs were fixed: - Use the name from the cached entries when updating them to avoid capitalization...

SUSE-SU-2024:1864-1 Security update for python-Jinja2

This update for python-Jinja2 fixes the following issues: - Fixed HTML attribute injection when passing user input as keys to xmlattr filter CVE-2024-34064, bsc1223980, CVE-2024-22195, bsc1218722...

SUSE-SU-2024:1863-1 Security update for python-Jinja2

This update for python-Jinja2 fixes the following issues: - Fixed HTML attribute injection when passing user input as keys to xmlattr filter CVE-2024-34064, bsc1223980, CVE-2024-22195, bsc1218722...

SUSE-SU-2024:1854-1 Security update for git

This update for git fixes the following issues: - CVE-2024-32002: Fixed case confusion with recursive clones on case-insensitive filesystems that support symbolic links bsc1224168 - CVE-2024-32004: Fixed arbitrary code execution during local clones bsc1224170 - CVE-2024-32020: Fixed file...

SUSE-SU-2024:1793-1 Security update for java-1_8_0-openj9

This update for java-180-openj9 fixes the following issues: Update to OpenJDK 8u412 build 08 with OpenJ9 0.44.0 virtual machine: - CVE-2024-21094: Fixed C2 compilation failure with 'Exceeded noderegs array' bsc1222986. - CVE-2024-21011: Fixed long Exception message leading to crash bsc1222979. -...

SUSE-SU-2024:1762-2 Security update for perl

This update for perl fixes the following issues: Security issues fixed: - CVE-2018-6913: Fixed space calculation issues in pppack.c bsc1082216 - CVE-2018-6798: Fixed heap buffer overflow in regexec.c bsc1082233 Non-security issue fixed: - make Net::FTP work with TLS 1.3 bsc1213638...

SUSE-SU-2024:1738-1 Security update for the Linux Kernel (Live Patch 43 for SLE 15 SP3)

This update for the Linux Kernel 5.3.18-15030059158 fixes several issues. The following security issues were fixed: - CVE-2024-26610: Fixed memory corruption in wifi/iwlwifi bsc1221302. - CVE-2022-48651: Fixed an out-of-bound bug in ipvlan caused by unset skb-macheader bsc1223514. - CVE-2023-1829...

SUSE-SU-2024:1657-1 Security update for python3

This update for python3 fixes the following issues: - CVE-2023-52425: Fixed etree XMLPullParser tests for Expat =2.6.0 with reparse deferral bsc1219559...

SUSE-SU-2024:1647-1 Security update for the Linux Kernel

The SUSE Linux Enterprise 15 SP4 RT kernel was updated to receive various security bugfixes. The following security bugs were fixed: - CVE-2024-27389: Fixed pstore inode handling with dinvalidate bsc1223705. - CVE-2024-27043: Fixed a use-after-free in edia/dvbdev in different places bsc1223824. -...

SUSE-SU-2024:1642-1 Security update for the Linux Kernel

The SUSE Linux Enterprise 15 SP3 kernel was updated to receive various security bugfixes. The following security bugs were fixed: - CVE-2024-26840: Fixed a memory leak in cachefilesaddcache bsc1222976. - CVE-2021-47113: Abort btrfs renameexchange if we fail to insert the second ref bsc1221543. -...

SUSE-SU-2024:1582-1 Security update for the Linux Kernel (Live Patch 0 for SLE 15 SP5)

This update for the Linux Kernel 5.14.21-15050053 fixes several issues. The following security issues were fixed: - CVE-2024-0775: Fixed a use-after-free flaw was found in the ext4remount in fs/ext4/super.c in ext4 bsc1219079. - CVE-2023-5717: Fixed a heap out-of-bounds write vulnerability perf...