This update for gstreamer-plugins-bad fixes the following issues: CVE-2023-44446: Fixed GStreamer MXF File Parsing Use-After-Free (bsc#1217213). CVE-2023-40475: Fixed GStreamer MXF File Parsing Integer Overflow (bsc#1215792).

This update for webkit2gtk3 fixes the following issues: CVE-2023-42890: Fixed processing malicious web content may lead to arbitrary code execution (bsc#1218033). CVE-2023-42883: Fixed processing a malicious image may lead to a denial-of-service (bsc#1218032). CVE-2023-41074: Fixed use-after-free in the MediaRecorder API of the WebKit GStreamer-based ports (bsc#1215870). CVE-2023-40451, CVE-2023-41074: Update to version 2.42.4 (bsc#1218032, bsc#1215868).

This update for gstreamer-plugins-bad fixes the following issues: ZDI-CAN-22300: Fixed a buffer overflow in the AV1 video plugin (bsc#1218534).

This update for grub2 and efibootmgr fixes the following issues: grub2: Deliver missing grub2-arm64-efi and grub2-powerpc-ieee1275 to SUSE Manager 4.3 (no source changes) (bsc#1217237) efibootmgr: Deliver missing efibootmgr to SUSE Manager 4.3 (no source changes) (bsc#1217237)

This update for xorg-x11-server fixes the following issues: Security fixes: CVE-2023-6816: Fixed heap buffer overflow in DeviceFocusEvent and ProcXIQueryPointer (bsc#1218582) CVE-2024-0229: Fixed reattaching to different master device may lead to out-of-bounds memory access (bsc#1218583) CVE-2024-21885: Fixed heap buffer overflow in XISendDeviceHierarchyEvent (bsc#1218584) CVE-2024-21886: Fixed heap buffer overflow in DisableDevice (bsc#1218585) Other: Fix vmware graphics driver crash (bsc#1218176) Fix xserver crash when Xinerama is enabled (bsc#1218240)

This update for libssh fixes the following issues: Security fixes: CVE-2023-6004: Fixed command injection using proxycommand (bsc#1218209) CVE-2023-48795: Fixed potential downgrade attack using strict kex (bsc#1218126) CVE-2023-6918: Fixed missing checks for return values of MD functions (bsc#1218186) CVE-2023-1667: Fixed NULL dereference during rekeying with algorithm guessing (bsc#1211188) CVE-2023-2283: Fixed possible authorization bypass in pkiverifydatasignature under low-memory conditions (bsc#1211190) Other fixes: Update to version 0.9.8

Allow @ in usernames when parsing from URI composes

Update to version 0.9.7

Fix several memory leaks in GSSAPI handling code

This update for xwayland fixes the following issues: CVE-2023-6816: Fixed heap buffer overflow in DeviceFocusEvent and ProcXIQueryPointer (bsc#1218582) CVE-2024-0229: Fixed reattaching to different master device may lead to out-of-bounds memory access (bsc#1218583) CVE-2024-0408: Fixed SELinux unlabeled GLX PBuffer. (bsc#1218845) CVE-2024-0409: Fixed SELinux context corruption. (bsc#1218846) CVE-2024-21885: Fixed heap buffer overflow in XISendDeviceHierarchyEvent (bsc#1218584) CVE-2024-21886: Fixed heap buffer overflow in DisableDevice (bsc#1218585)

This update for bluez fixes the following issues: CVE-2023-50229: Fixed an out of bounds write in the primary version counter for the Phone Book Access Profile implementation (bsc#1218300). CVE-2023-50230: Fixed an out of bounds write in the secondary version counter for the Phone Book Access Profile implementation (bsc#1218301).

This update for python-Pillow fixes the following issues: CVE-2023-50447: Fixed arbitrary code execution via the environment parameter. (bsc#1219048)

This update for java-17-openjdk fixes the following issues: Updated to version 17.0.10 (January 2024 CPU): CVE-2024-20918: Fixed an out of bounds access in the Hotspot JVM due to a missing bounds check (bsc#1218907). CVE-2024-20919: Fixed a sandbox bypass in the Hotspot JVM class file verifier (bsc#1218903). CVE-2024-20921: Fixed an incorrect optimization in the Hotspot JVM that could lead to corruption of JVM memory (bsc#1218905). CVE-2024-20932: Fixed an incorrect handling of ZIP files with duplicate entries (bsc#1218908). CVE-2024-20945: Fixed a potential private key leak through debug logs (bsc#1218909). CVE-2024-20952: Fixed an RSA padding issue and timing side-channel attack against TLS (bsc#1218911). Find the full release notes at: https://mail.openjdk.org/pipermail/jdk-updates-dev/2024-January/029089.html

This update for libavif fixes the following issues: CVE-2023-6704: Fixed use after free by not storing colorproperties until alpha item is found (bsc#1218303).

This update for rekor fixes the following issues: update to 1.3.5 (jsc#SLE-23476): Additional unique index correction Remove timestamp from checkpoint Drop conditional when verifying entry checkpoint Fix panic for DSSE canonicalization Change Redis value for locking mechanism give log timestamps nanosecond precision

output trace in slog and override correlation header name

bumped embedded golang.org/x/crypto/ssh to fix the Terrapin attack CVE-2023-48795 (bsc#1218207) Updated to 1.3.4: add mysql indexstorage backend add s3 storage for attestations fix: Do not check for pubsub.topics.get on initialization fix optional field in cose schema Update ranges.go update indexstorage interface to reduce roundtrips use a single validator library in rekor-cli Remove go-playground/validator dependency from pkg/pki Updated to rekor 1.3.3 (jsc#SLE-23476): Update signer flag description update trillian to 1.5.3 adds redisauth Add method to get artifact hash for an entry make e2e tests more usable with docker-compose install go at correct version for codeql Updated to rekor 1.3.2 (jsc#SLE-23476): Updated to rekor 1.3.1 (jsc#SLE-23476): New Features: enable GCP cloud profiling on rekor-server (#1746) move index storage into interface (#1741) add info to readme to denote additional documentation sources (#1722) Add type of ed25519 key for TUF (#1677) Allow parsing base64-encoded TUF metadata and root content (#1671) Quality Enhancements: disable quota in trillian in test harness (#1680) Bug Fixes: Update contact for code of conduct (#1720) Fix panic when parsing SSH SK pubkeys (#1712) Correct index creation (#1708) docs: fixzes a small typo on the readme (#1686) chore: fix backfill-redis Makefile target (#1685) Updated to rekor 1.3.0 (jsc#SLE-23476): Update openapi.yaml (#1655) pass transient errors through retrieveLogEntry (#1653) return full entryID on HTTP 409 responses (#1650) feat: Support publishing new log entries to Pub/Sub topics (#1580) Change values of Identity.Raw, add fingerprints (#1628) Extract all subjects from SANs for x509 verifier (#1632) Fix type comment for Identity struct (#1619) Refactor Identities API (#1611) Refactor Verifiers to return multiple keys (#1601) Update checkpoint link (#1597) Use correct log index in inclusion proof (#1599) remove instrumentation library (#1595) Updated to rekor 1.2.2 (jsc#SLE-23476): pass down error with message instead of nil

swap killswitch for 'docker-compose restart'

CVE-2023-48795: Fixed Terrapin attack in embedded golang.org/x/crypto/ssh (bsc#1218207).

This update for squid fixes the following issues: CVE-2023-50269: fixed X-Forwarded-For Stack Overflow. (bsc#1217654) CVE-2024-23638: fixed Denial of Service attack against Cache Manager error responses. (bsc#1219131)

This update for libsolv, libzypp fixes the following issues: build for multiple python versions [jsc#PED-6218] applydeltaprm: Create target directory if it does not exist (bsc#1219442) Fix problems with EINTR in ExternalDataSource::getline (bsc#1215698) CheckAccessDeleted: fix runningincontainer detection (bsc#1218782) Detect CURLOPTREDIRPROTOCOLSSTR availability at runtime (bsc#1218831)

This update for salt fixes the following issues: Security issues fixed: CVE-2024-22231: Prevent directory traversal when creating syndic cache directory on the master (bsc#1219430) CVE-2024-22232: Prevent directory traversal attacks in the master's servefile method (bsc#1219431) Bugs fixed: Ensure that pillar refresh loads beacons from pillar without restart Fix the aptpkg.py unit test failure Prefer unittest.mock to python-mock in test suite Enable "KeepAlive" probes for Salt SSH executions (bsc#1211649) Revert changes to set Salt configured user early in the stack (bsc#1216284) Align behavior of some modules when using salt-call via symlink (bsc#1215963) Fix gitfs "env" and improve cache cleaning (bsc#1193948) Remove python-boto dependency for the python3-salt-testsuite package for Tumbleweed

This update for python-aiohttp, python-time-machine fixes the following issues: python-aiohttp was updated to version 3.9.3: Fixed backwards compatibility breakage (in 3.9.2) of ssl parameter when set outside of ClientSession (e.g. directly in TCPConnector) Improved test suite handling of paths and temp files to consistently use pathlib and pytest fixtures. From version 3.9.2 (bsc#1219341, CVE-2024-23334, bsc#1219342, CVE-2024-23829): Fixed server-side websocket connection leak. Fixed web.FileResponse doing blocking I/O in the event loop. Fixed double compress when compression enabled and compressed file exists in server file responses. Added runtime type check for ClientSession timeout parameter. Fixed an unhandled exception in the Python HTTP parser on header lines starting with a colon. Improved validation of paths for static resources requests to the server. Added support for passing :py:data:True to ssl parameter in ClientSession while deprecating :py:data:None. Fixed an unhandled exception in the Python HTTP parser on header lines starting with a colon. Fixed examples of fallbackcharsetresolver function in the :doc:clientadvanced document. The Sphinx setup was updated to avoid showing the empty changelog draft section in the tagged release documentation builds on Read The Docs. The changelog categorization was made clearer. The contributors can now mark their fragment files more accurately. Updated :ref:contributing/Tests coverage <aiohttp-contributing> section to show how we use codecov.

Replaced all tmpdir fixtures with tmppath in test suite.

Disable broken tests with openssl 3.2 and python < 3.11 bsc#1217782 update to 3.9.1: Fixed importing aiohttp under PyPy on Windows. Fixed async concurrency safety in websocket compressor. Fixed ClientResponse.close() releasing the connection instead of closing. Fixed a regression where connection may get closed during upgrade. -- by :user:Dreamsorcerer Fixed messages being reported as upgraded without an Upgrade header in Python parser. -- by :user:Dreamsorcerer update to 3.9.0: (bsc#1217684, CVE-2023-49081, bsc#1217682, CVE-2023-49082) Introduced AppKey for static typing support of Application storage. Added a graceful shutdown period which allows pending tasks to complete before the application's cleanup is called. Added handlercancellation parameter to cancel web handler on client disconnection. This (optionally) reintroduces a feature removed in a previous release. Recommended for those looking for an extra level of protection against denial-of-service attacks. Added support for setting response header parameters maxlinesize and maxfieldsize. Added autodecompress parameter to ClientSession.request to override ClientSession.autodecompress. Changed raiseforstatus to allow a coroutine. Added client brotli compression support (optional with runtime check). Added clientmaxsize to BaseRequest.clone() to allow overriding the request body size. -- :user:anesabml. Added a middleware type alias aiohttp.typedefs.Middleware. Exported HTTPMove which can be used to catch any redirection request that has a location -- :user:dreamsorcerer. Changed the path parameter in web.runapp() to accept a pathlib.Path object. Performance: Skipped filtering CookieJar when the jar is empty or all cookies have expired. Performance: Only check origin if insecure scheme and there are origins to treat as secure, in CookieJar.filtercookies(). Performance: Used timestamp instead of datetime to achieve faster cookie expiration in CookieJar. Added support for passing a custom server name parameter to HTTPS connection. Added support for using Basic Auth credentials from :file:.netrc file when making HTTP requests with the :py:class:~aiohttp.ClientSession trustenv argument is set to True. -- by :user:yuvipanda. Turned access log into no-op when the logger is disabled. Added typing information to RawResponseMessage. -- by :user:Gobot1234 Removed async-timeout for Python 3.11+ (replaced with asyncio.timeout() on newer releases). Added support for brotlicffi as an alternative to brotli (fixing Brotli support on PyPy). Added WebSocketResponse.getextrainfo() to access a protocol transport's extra info. Allow link argument to be set to None/empty in HTTP 451 exception. Fixed client timeout not working when incoming data is always available without waiting. -- by :user:Dreamsorcerer. Fixed readuntil to work with a delimiter of more than one character. Added repr to EmptyStreamReader to avoid AttributeError. Fixed bug when using TCPConnector with ttldnscache=0. Fixed response returned from expect handler being thrown away. -- by :user:Dreamsorcerer Avoided raising UnicodeDecodeError in multipart and in HTTP headers parsing. Changed sockread timeout to start after writing has finished, avoiding read timeouts caused by an unfinished write. -- by :user:dtrifiro Fixed missing query in tracing method URLs when using yarl 1.9+. Changed max 32-bit timestamp to an aware datetime object, for consistency with the non-32-bit one, and to avoid a DeprecationWarning on Python 3.12. Fixed EmptyStreamReader.iterchunks() never ending. Fixed a rare RuntimeError: await wasn&#x27;t used with future exception. Fixed issue with insufficient HTTP method and version validation. Added check to validate that absolute URIs have schemes. Fixed unhandled exception when Python HTTP parser encounters unpaired Unicode surrogates. Updated parser to disallow invalid characters in header field names and stop accepting LF as a request line separator. Fixed Python HTTP parser not treating 204/304/1xx as an empty body. Ensure empty body response for 1xx/204/304 per RFC 9112 sec 6.3. Fixed an issue when a client request is closed before completing a chunked payload. -- by :user:Dreamsorcerer Edge Case Handling for ResponseParser for missing reason value. Fixed ClientWebSocketResponse.closecode being erroneously set to None when there are concurrent async tasks receiving data and closing the connection. Added HTTP method validation. Fixed arbitrary sequence types being allowed to inject values via version parameter. -- by :user:Dreamsorcerer Performance: Fixed increase in latency with small messages from websocket compression changes. Improved Documentation Fixed the ClientResponse.release's type in the doc. Changed from comethod to method. Added information on behavior of baseurl parameter in ClientSession. Completed trustenv parameter description to honor wssproxy, wsproxy or noproxy env. Dropped Python 3.6 support. Dropped Python 3.7 support. -- by :user:Dreamsorcerer Removed support for abandoned tokio event loop. Made print argument in runapp() optional. Improved performance of ceiltimeout in some cases. Changed importing Gunicorn to happen on-demand, decreasing import time by ~53%. -- :user:Dreamsorcerer Improved import time by replacing http.server with http.HTTPStatus. Fixed annotation of ssl parameter to disallow True. update to 3.8.6 (bsc#1217181, CVE-2023-47627): Security bugfixes https://github.com/aio-libs/aiohttp/security/advisories/GHSA- pjjw-qhg8-p2p9. https://github.com/aio-libs/aiohttp/security/advisories/GHSA- gfw2-4jvh-wgfg. Added fallbackcharsetresolver parameter in ClientSession to allow a user-supplied character set detection function. Character set detection will no longer be included in 3.9 as a default. If this feature is needed, please use fallbackcharsetresolver the client Fixed PermissionError when .netrc is unreadable due to permissions. Fixed output of parsing errors Fixed sorting in filtercookies to use cookie with longest path. Release 3.8.0 (2021-10-31) (bsc#1217174, CVE-2023-47641)

This update for openblas contains the following fixes: Added libopenblaspthreads0 to Package Hub SLE-15-SP4 on architecture s390 (no source changes) (bsc#1217608)

This update for mozilla-nss fixes the following issues: Update to NSS 3.90.2: CVE-2023-5388: Fixed timing attack against RSA decryption in TLS (bsc#1216198)

This update for bind fixes the following issues: Update to release 9.16.48: Feature Changes: The IP addresses for B.ROOT-SERVERS.NET have been updated to 170.247.170.2 and 2801:1b8:10::b. Security Fixes: Validating DNS messages containing a lot of DNSSEC signatures could cause excessive CPU load, leading to a denial-of-service condition. This has been fixed. (CVE-2023-50387) [bsc#1219823] Preparing an NSEC3 closest encloser proof could cause excessive CPU load, leading to a denial-of-service condition. This has been fixed. (CVE-2023-50868) [bsc#1219826] Parsing DNS messages with many different names could cause excessive CPU load. This has been fixed. (CVE-2023-4408) [bsc#1219851] Specific queries could cause named to crash with an assertion failure when nxdomain-redirect was enabled. This has been fixed. (CVE-2023-5517) [bsc#1219852] A bad interaction between DNS64 and serve-stale could cause named to crash with an assertion failure, when both of these features were enabled. This has been fixed. (CVE-2023-5679) [bsc#1219853] Query patterns that continuously triggered cache database maintenance could cause an excessive amount of memory to be allocated, exceeding max-cache-size and potentially leading to all available memory on the host running named being exhausted. This has been fixed. (CVE-2023-6516) [bsc#1219854] Removed Features: Support for using AES as the DNS COOKIE algorithm (cookie-algorithm aes;) has been deprecated and will be removed in a future release. Please use the current default, SipHash-2-4, instead.

This update for python310 fixes the following issues: CVE-2023-27043: Fixed incorrectly parser of e-mail addresses which contain a special character (bsc#1210638).

This update for rpm fixes the following issues: backport lua support for rpm.execute to ease migrating from SLE Micro 5.5 to 6.0 (bsc#1216752)

This update for samba fixes the following issues: CVE-2022-2127: Fixed issue where lmresplen was not checked properly in winbinddpamauthcrapsend (bsc#1213174). CVE-2023-34966: Fixed samba spotlight mdssvc RPC Request Infinite Loop Denial-of-Service Vulnerability (bsc#1213173). CVE-2023-34967: Fixed samba spotlight mdssvc RPC Request Type Confusion Denial-of-Service Vulnerability (bsc#1213172). CVE-2023-34968: Fixed spotlight server-side Share Path Disclosure (bsc#1213171). Bugfixes: Fixed trust relationship failure (bsc#1213384).

This update for python311 fixes the following issues: python was updated to version 3.11.4: CVE-2023-24329: Fixed blocklist bypass via the urllib.parse component when supplying a URL that starts with blank characters (bsc#1208471). CVE-2007-4559: Fixed python tarfile module directory traversal (bsc#1203750). Fixed a security in flaw in uu.decode() that could allow for directory traversal based on the input if no outfile was specified. Do not expose the local on-disk location in directory indexes produced by http.client.SimpleHTTPRequestHandler. Bugfixes: trace.main now uses io.opencode() for files to be executed instead of raw open().

This update for freerdp fixes the following issues: CVE-2024-22211: Fixed am integer overflow in freerdpbitmapplanarcontextreset() (bsc#1219049).

This update for nodejs18 fixes the following issues: Update to 18.19.1: (security updates) CVE-2024-21892: Code injection and privilege escalation through Linux capabilities (bsc#1219992). CVE-2024-22019: http: Reading unprocessed HTTP request with unbounded chunk extension allows DoS attacks (bsc#1219993). CVE-2023-46809: Node.js is vulnerable to the Marvin Attack (timing variant of the Bleichenbacher attack against PKCS#1 v1.5 padding) (bsc#1219997). CVE-2024-22025: Denial of Service by resource exhaustion in fetch() brotli decoding (bsc#1220014). CVE-2024-24758: undici version 5.28.3 (bsc#1220017). CVE-2024-24806: libuv version 1.48.0 (bsc#1219724). Update to LTS version 18.19.0 deps: npm updates to 10.x esm: Leverage loaders when resolving subsequent loaders import.meta.resolve unflagged --experimental-default-type flag to flip module defaults

This update for nodejs16 fixes the following issues: Security issues fixed: CVE-2023-46809: Node.js is vulnerable to the Marvin Attack (timing variant of the Bleichenbacher attack against PKCS#1 v1.5 padding) (bsc#1219997). CVE-2024-22019: http: Reading unprocessed HTTP request with unbounded chunk extension allows DoS attacks (bsc#1219993). CVE-2024-22025: Denial of Service by resource exhaustion in fetch() brotli decoding (bsc#1220014). CVE-2024-24758: ignore proxy-authorization header (bsc#1220017). CVE-2024-24806: fix improper domain lookup that potentially leads to SSRF attacks (bsc#1219724).

This update for libssh fixes the following issues: Fix regression parsing IPv6 addresses provided as hostname (bsc#1220385)

This update for python311 fixes the following issues: CVE-2023-6597: Fixed symlink bug in cleanup of tempfile.TemporaryDirectory (bsc#1219666). CVE-2023-27043: Fixed incorrect e-mqil parsing (bsc#1210638). CVE-2022-25236: Fixed an expat vulnerability by supporting expat >= 2.4.4 (bsc#1212015).

This update for sudo fixes the following issues: CVE-2023-42465: Try to make sudo less vulnerable to ROWHAMMER attacks (bsc#1219026).

This update for python310 fixes the following issues: CVE-2023-6597: Fixed symlink bug in cleanup of tempfile.TemporaryDirectory (bsc#1219666).