This update for libwebp fixes the following issues: CVE-2023-4863: Fixed heap buffer overflow (bsc#1215231).

This update for gstreamer-plugins-bad fixes the following issues: CVE-2023-44446: Fixed GStreamer MXF File Parsing Use-After-Free (bsc#1217213). CVE-2023-40475: Fixed GStreamer MXF File Parsing Integer Overflow (bsc#1215792).

This update for postfix fixes the following issues: CVE-2023-51764: Fixed SMTP smuggling attack (bsc#1218304).

This update for webkit2gtk3 fixes the following issues: CVE-2023-42890: Fixed processing malicious web content may lead to arbitrary code execution (bsc#1218033). CVE-2023-42883: Fixed processing a malicious image may lead to a denial-of-service (bsc#1218032). CVE-2023-41074: Fixed use-after-free in the MediaRecorder API of the WebKit GStreamer-based ports (bsc#1215870). CVE-2023-40451, CVE-2023-41074: Update to version 2.42.4 (bsc#1218032, bsc#1215868).

This update for perl fixes the following issues: CVE-2023-31484: Enable TLS cert verification in CPAN (bsc#1210999).

This update for samba fixes the following issues: CVE-2022-2127: Fixed issue where lmresplen was not checked properly in winbinddpamauthcrapsend (bsc#1213174). CVE-2023-34966: Fixed samba spotlight mdssvc RPC Request Infinite Loop Denial-of-Service Vulnerability (bsc#1213173). CVE-2023-34967: Fixed samba spotlight mdssvc RPC Request Type Confusion Denial-of-Service Vulnerability (bsc#1213172). CVE-2023-34968: Fixed spotlight server-side Share Path Disclosure (bsc#1213171). Bugfixes: Fixed trust relationship failure (bsc#1213384).

This update for gcc12 fixes the following issues: CVE-2023-4039: Fixed incorrect stack protector for C99 VLAs on Aarch64 (bsc#1214052).

This update for bind fixes the following issues: CVE-2023-2828: Fixed denial-of-service against recursive resolvers related to cache-cleaning algorithm (bsc#1212544).

This update for c-ares fixes the following issues: Update to version 1.19.1: CVE-2023-32067: 0-byte UDP payload causes Denial of Service (bsc#1211604) CVE-2023-31147: Insufficient randomness in generation of DNS query IDs (bsc#1211605) CVE-2023-31130: Buffer Underwrite in aresinetnetpton() (bsc#1211606) CVE-2023-31124: AutoTools does not set CARESRANDOMFILE during cross compilation (bsc#1211607) Fix uninitialized memory warning in test aresgetaddrinfo() should allow a port of 0 Fix memory leak in aressend() on error Fix comment style in aresdata.h Fix typo in aresinitoptions.3 Sync axpthread.m4 with upstream Sync axcxxcompilestdcxx11.m4 with upstream to fix uclibc support

This update for dracut fixes the following issues: Protect against broken links pointing to themselves Exit if resolving executable dependencies fails (bsc#1214081)

This update of rekor fixes the following issues: rebuild the package with the go 1.21 security release (bsc#1212475).

This update for libssh2org fixes the following issues: CVE-2020-22218: Fixed a bug in libssh2packetadd() which allows to access out of bounds memory. (bsc#1214527)

This update of geoipupdate fixes the following issues: rebuild the package with the go 1.21 security release (bsc#1212475).

This update for webkit2gtk3 fixes the following issues: Provide/obsolete WebKit2GTK-%{apiver}-lang (bsc#1214093)

Have the lang package provide libwebkit2gtk3-lang (bsc#1214093)

Adjustments of update version 2.40.5 (bsc#1213905 bsc#1213379 bsc#1213581):

Added missing CVE references: CVE-2023-32393, CVE-2023-37450

This update of skopeo fixes the following issues: rebuild the package with the go 1.21 security release (bsc#1212475).

This update for java-17-openjdk fixes the following issues: Fix a regression where the validation would reject valid zip64 (zip with 64-bit offset extensions)

This update for perl-Bootloader fixes the following issues: bootloaderentry script can have an optional 'force-default' argument (bsc#1215064) skip warning about unsupported options when in compat mode

This update for java-11-openjdk fixes the following issues: Fix a regression where the validation would reject valid zip64 (zip with 64-bit offset extensions)

This update for libxml2 fixes the following issues: CVE-2023-39615: Fixed crafted xml can cause global buffer overflow (bsc#1214768).

This update for cups fixes the following issues: CVE-2023-4504: Fixed heap overflow in OpenPrinting CUPS Postscript Parsing (bsc#1215204). CVE-2023-32360: Fixed Information leak through Cups-Get-Document operation (bsc#1214254).

This update for bind fixes the following issues: Update to release 9.16.44: CVE-2023-3341: Fixed stack exhaustion flaw in control channel code may cause named to terminate unexpectedly (bsc#1215472).

This update for webkit2gtk3 fixes the following issues: Expand lang sub-package in spec file unconditionally to handle previous name change from WebKit2GTK-lang to WebKitGTK-lang. This change affected the automatic generated Requires tag on WebKit2GTK-%{apiver}, then getting out of sync of what's being required and what's being provided. Now, any sub-package that was providing WebKit2GTK-%{apiver} will provide WebKitGTK-%{apiver} instead (bsc#1214835, bsc#1214640, bsc#1214093).

Require libwaylandclient0 >= 1.20. 15.4 originally had 1.19.0, but webkitgtk uses a function added in 1.20.0, so we need to ensure that the wayland update is pulled in (bsc#1215072).

Update to version 2.40.5 (bsc#1213905 bsc#1213379 bsc#1213581 bsc#1215230): CVE-2023-38594, CVE-2023-38595, CVE-2023-38597, CVE-2023-38599, CVE-2023-38600, CVE-2023-38611, CVE-2023-40397, CVE-2023-37450, CVE-2023-28198, CVE-2023-32370

This update for Golang Prometheus fixes the following issues: golang-github-prometheus-alertmanager: CVE-2023-29409: Restrict RSA keys in certificates to less than or equal to 8192 bits to avoid DoSing client/server while validating signatures for extremely large RSA keys. (bsc#1213880) There are no direct source changes. The CVE is fixed rebuilding the sources with the patched Go version. golang-github-prometheus-nodeexporter: CVE-2023-29409: Restrict RSA keys in certificates to less than or equal to 8192 bits to avoid DoSing client/server while validating signatures for extremely large RSA keys. (bsc#1213880) There are no direct source changes. The CVE is fixed rebuilding the sources with the patched Go version.

This update for vim fixes the following issues: Security fixes: CVE-2023-4733: Fixed use-after-free in function buflistaltfpos (bsc#1215004). CVE-2023-4734: Fixed segmentation fault in function ffullcommand (bsc#1214925). CVE-2023-4735: Fixed out of bounds write in ops.c (bsc#1214924). CVE-2023-4738: Fixed heap buffer overflow in vimregsubboth (bsc#1214922). CVE-2023-4752: Fixed heap use-after-free in function inscomplgetexp (bsc#1215006). CVE-2023-4781: Fixed heap buffer overflow in function vimregsubboth (bsc#1215033). Other fixes: Update to version 9.0 with patch level 1894, for the complete list of changes see https://github.com/vim/vim/compare/v9.0.1443...v9.0.1894 Use app icons generated from vimlogo.eps in the source tarball; add higher resolution icons of sizes 128x128, 256x256, and 512x512 as png sources

This update for libvpx fixes the following issues: CVE-2023-5217: Fixed a heap buffer overflow (bsc#1215778).

This update for libeconf fixes the following issues: Update to version 0.5.2. CVE-2023-30078, CVE-2023-32181: Fixed a stack-buffer-overflow vulnerability in "econfwriteFile" function (bsc#1211078). CVE-2023-30079, CVE-2023-22652: Fixed a stack-buffer-overflow vulnerability in "readfile" function. (bsc#1211078)

This update for ghostscript fixes the following issues: CVE-2023-43115: Fixed remote code execution via crafted PostScript documents in gdevijs.c (bsc#1215466).

This update for suse-module-tools fixes the following issues: Update to version 15.4.17: cert-script: warn only once about non-writable efivarfs cert-script: skip cert handling if efivarfs is not writable (bsc#1213428, bsc#1201066)

This update for nghttp2 fixes the following issues: CVE-2023-35945: Fixed memory leak when PUSHPROMISE or HEADERS frame cannot be sent (bsc#1215713).

This update for poppler fixes the following issues: CVE-2020-23804: Fixed uncontrolled recursion in pdfinfo and pdftops (bsc#1215422). CVE-2020-36024: Fixed NULL Pointer Deference in FoFiType1C:convertToType1 (bsc#1214257). CVE-2022-37050: Fixed denial-of-service via savePageAs in PDFDoc.c (bsc#1214622). CVE-2022-37051: Fixed abort in main() in pdfunite.cc (bsc#1214621). CVE-2022-38349: Fixed reachable assertion in Object.h that will lead to denial of service (bsc#1214618).