SUSE-RU-2024:0792-1: Recommended update for timezone
This update for timezone fixes the following issues: Update to version 2024a Kazakhstan unifies on UTC+5 Palestine springs forward a week later than previously predicted in 2024 and 2025 Asia/HoChiMinh's 1955-07-01 transition occurred at 01:00 not 00:00 From 1947 through 1949, Toronto's transitions occurred at 02:00 not 00:00 In 1911 Miquelon adopted standard time on June 15, not May 15 The FROM and TO columns of Rule lines can no longer be "minimum" localtime no longer mishandle some timestamps strftime %s now uses tmgmtoff if available Ittoqqortoormiit, Greenland changes time zones on 2024-03-31 Vostok, Antarctica changed time zones on 2023-12-18 Casey, Antarctica changed time zones five times since 2020 Code and data fixes for Palestine timestamps starting in 2072 A new data file zonenow.tab for timestamps starting now Much of Greenland changed its standard time from -03 to -02 on 2023-03-25 localtime.c no longer mishandles TZif files that contain a single transition into a DST regime tzselect no longer creates temporary files tzselect no longer mishandles the following: Spaces and most other special characters in BUGEMAIL, PACKAGE, TZDIR, and VERSION. TZ strings when using mawk 1.4.3, which mishandles regular expressions of the form /X{2,}/ ISO 6709 coordinates when using an awk that lacks the GNU extension of newlines in -v option-arguments Non UTF-8 locales when using an iconv command that lacks the GNU //TRANSLIT extension zic no longer mishandles data for Palestine after the year 2075
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
suse/timezoneto a version that resolves this vulnerability.Fixed in 2024a-150000.75.28.1 - Upgrade
Upgrade
suse/timezone-debugsourceto a version that resolves this vulnerability.Fixed in 2024a-150000.75.28.1 - Upgrade
Upgrade
suse/timezone-debuginfoto a version that resolves this vulnerability.Fixed in 2024a-150000.75.28.1 - Upgrade
Upgrade
suse/timezone-javato a version that resolves this vulnerability.Fixed in 2024a-150000.75.28.1 - Upgrade
Upgrade
timezoneto a version that resolves this vulnerability.Fixed in 2024a - Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Patch SUSE-SLE-Micro-5.3-2024-792=1 - Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Patch SUSE-SLE-Micro-5.4-2024-792=1 - Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Patch SUSE-SLE-Micro-5.5-2024-792=1 - Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Patch SUSE-SLE-Module-Basesystem-15-SP5-2024-792=1 - Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Patch SUSE-SLE-Product-HPC-15-SP2-LTSS-2024-792=1 - Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Patch SUSE-SLE-Product-HPC-15-SP3-LTSS-2024-792=1 - Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Patch SUSE-SLE-Product-HPC-15-SP4-ESPOS-2024-792=1 - Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Patch SUSE-SLE-Product-HPC-15-SP4-LTSS-2024-792=1 - Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Patch SUSE-SLE-Product-SLED-15-SP4-LTSS-2024-792=1 - Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Patch SUSE-SLE-Product-SLES-15-SP2-LTSS-2024-792=1 - Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Patch SUSE-SLE-Product-SLES-15-SP3-LTSS-2024-792=1 - Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Patch SUSE-SLE-Product-SLES-15-SP4-LTSS-2024-792=1 - Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Patch SUSE-SLE-Product-SLES_SAP-15-SP2-2024-792=1 - Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Patch SUSE-SLE-Product-SLES_SAP-15-SP3-2024-792=1 - Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Patch SUSE-SLE-Product-SLES_SAP-15-SP4-2024-792=1 - Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Patch SUSE-SLE-Product-SUSE-Manager-Proxy-4.3-2024-792=1 - Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Patch SUSE-SLE-Product-SUSE-Manager-Retail-Branch-Server-4.3-2024-792=1 - Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Patch SUSE-SLE-Product-SUSE-Manager-Server-4.3-2024-792=1 - Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Patch SUSE-SUSE-MicroOS-5.1-2024-792=1 - Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Patch SUSE-SUSE-MicroOS-5.2-2024-792=1 - Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Patch SUSE-Storage-7.1-2024-792=1 - Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Patch openSUSE-Leap-Micro-5.3-2024-792=1 - Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Patch openSUSE-Leap-Micro-5.4-2024-792=1 - Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Patch openSUSE-SLE-15.5-2024-792=1
Event History
Frequently Asked Questions
Which systems should be prioritized for this update?
Prioritize affected SUSE openSUSE Leap Micro 5.3 and 5.4, and openSUSE Leap 15.5 systems that rely on timezone data for scheduling, logging, timestamp conversion, or daylight-saving transitions. The update includes changes affecting Kazakhstan, Palestine, Greenland, Antarctica, Vietnam, Toronto, and Miquelon historical or current timezone behavior.
Are systems affected even if they do not use the specifically named time zones?
Yes. The update also includes timezone-library and utility fixes, including localtime handling of certain timestamps and TZif files, strftime %s behavior, and tzselect handling of temporary files and special characters in environment-related values. Exposure depends on use of the affected timezone components and functions, not only on the named geographic zones.
How can I determine whether a host is in scope?
Check whether the host runs SUSE openSUSE Leap Micro 5.3, Leap Micro 5.4, or openSUSE Leap 15.5 on one of the listed architectures, and whether the timezone packages are installed. The affected package set includes timezone, timezone-debugsource, timezone-debuginfo, and timezone-java.