This update for postgresql-jdbc fixes the following issues: CVE-2024-1597: Fixed SQL Injection via line comment generation (bsc#1220644).

This update for MozillaFirefox fixes the following issues: Firefox Extended Support Release 115.2.1 ESR (bsc#1215245). CVE-2023-4863: Fixed heap buffer overflow in libwebp (MFSA 2023-40) (bsc#1215231). The following non-security bug was fixed: Fix i586 build by reducing debug info to -g1 (bsc#1210168).

Maintenance update for SUSE Manager 4.3.7 Release Notes: This is a codestream only update

This update for regionServiceClientConfigGCE fixes the following issue: Update to version 4.0.1 (bsc#1217538)

This update for regionServiceClientConfigEC2 fixes the following issue: Update to version 4.1.1 (bsc#1217536)

This update for regionServiceClientConfigAzure fixes the following issue: Update to version 2.0.1 (bsc#1217537)

This update for gstreamer-plugins-bad fixes the following issues: CVE-2023-44446: Fixed GStreamer MXF File Parsing Use-After-Free (bsc#1217213). CVE-2023-40475: Fixed GStreamer MXF File Parsing Integer Overflow (bsc#1215792).

This update for postfix fixes the following issues: CVE-2023-51764: Fixed SMTP smuggling attack (bsc#1218304).

This update for webkit2gtk3 fixes the following issues: CVE-2023-42890: Fixed processing malicious web content may lead to arbitrary code execution (bsc#1218033). CVE-2023-42883: Fixed processing a malicious image may lead to a denial-of-service (bsc#1218032). CVE-2023-41074: Fixed use-after-free in the MediaRecorder API of the WebKit GStreamer-based ports (bsc#1215870). CVE-2023-40451, CVE-2023-41074: Update to version 2.42.4 (bsc#1218032, bsc#1215868).

This update for python-paramiko fixes the following issues: CVE-2023-48795: Fixed prefix truncation breaking ssh channel integrity aka Terrapin Attack (bsc#bsc#1218168).

Update to 3.4.0.

This update for SAPHanaSR-ScaleOut fixes the following issues: SAPHanaSR-ScaleOut was updated to version 0.185.2: Fixed cluster state in SAPHanaSR-manageAttr by supporting the different behaviour of 'crmadmin -q -S' in different pacemaker versions (bsc#1217830) Inside SAPHanaSR-hookHelper use the full path for the cibadmin command to support non root users in special user environments (bsc#1216484) If the SAPHanaSrMultiTarget hook has successfully reported a SR event to the cluster a still existing fall-back state file will be removed to prevent an override of an already reported SR state. (bsc#1215693) Updated man pages: SAPHanaSR-ScaleOutbasiccluster.7 SAPHanaSRmaintenanceexamples.7 ocfsuseSAPHanaTopology.7 ocfsuseSAPHanaController.7 SAPHanaSR-showAttr.8

This update for gstreamer-plugins-bad fixes the following issues: ZDI-CAN-22300: Fixed a buffer overflow in the AV1 video plugin (bsc#1218534).

This update for eclipse-jgit, jsch fixes the following issues: Security fix: - CVE-2023-4759: Fixed an arbitrary file overwrite which might have occurred with a specially crafted git repository and a case-insensitive filesystem. (bsc#1215298) Other fixes: jsch was updated to version 0.2.9: - Added support for various algorithms - Migrated from com.jcraft:jsch to com.github.mwiede:jsch fork (bsc#1211955): Alias to the old artifact since the new one is drop-in replacement Keep the old OSGi bundle symbolic name to avoid extensive patching of eclipse stack - Updated to version 0.2.9: For the full list of changes please consult the upstream changelogs below for each version updated: + https://github.com/mwiede/jsch/releases/tag/jsch-0.2.9 + https://github.com/mwiede/jsch/releases/tag/jsch-0.2.8 + https://github.com/mwiede/jsch/releases/tag/jsch-0.2.7 + https://github.com/mwiede/jsch/releases/tag/jsch-0.2.6 + https://github.com/mwiede/jsch/releases/tag/jsch-0.2.5 + https://github.com/mwiede/jsch/releases/tag/jsch-0.2.4 + https://github.com/mwiede/jsch/releases/tag/jsch-0.2.3 + https://github.com/mwiede/jsch/releases/tag/jsch-0.2.2 + https://github.com/mwiede/jsch/releases/tag/jsch-0.2.1 + https://github.com/mwiede/jsch/releases/tag/jsch-0.2.0 + https://github.com/mwiede/jsch/releases/tag/jsch-0.1.71 + https://github.com/mwiede/jsch/releases/tag/jsch-0.1.70 + https://github.com/mwiede/jsch/releases/tag/jsch-0.1.69 + https://github.com/mwiede/jsch/releases/tag/jsch-0.1.68 + https://github.com/mwiede/jsch/releases/tag/jsch-0.1.67 + https://github.com/mwiede/jsch/releases/tag/jsch-0.1.66 + https://github.com/mwiede/jsch/releases/tag/jsch-0.1.65 + https://github.com/mwiede/jsch/releases/tag/jsch-0.1.64 + https://github.com/mwiede/jsch/releases/tag/jsch-0.1.63 + https://github.com/mwiede/jsch/releases/tag/jsch-0.1.62 + https://github.com/mwiede/jsch/releases/tag/jsch-0.1.61 + https://github.com/mwiede/jsch/releases/tag/jsch-0.1.60 + https://github.com/mwiede/jsch/releases/tag/jsch-0.1.59 + https://github.com/mwiede/jsch/releases/tag/jsch-0.1.58 + https://github.com/mwiede/jsch/releases/tag/jsch-0.1.57 + https://github.com/mwiede/jsch/releases/tag/jsch-0.1.56 eclipse-jgit: Craft the jgit script from the real Main class of the jar file instead of using a jar launcher (bsc#1209646)

This update for grub2 and efibootmgr fixes the following issues: grub2: Deliver missing grub2-arm64-efi and grub2-powerpc-ieee1275 to SUSE Manager 4.3 (no source changes) (bsc#1217237) efibootmgr: Deliver missing efibootmgr to SUSE Manager 4.3 (no source changes) (bsc#1217237)

The SUSE Linux Enterprise 15 SP4 kernel was updated to receive various security bugfixes. The following security bugs were fixed: CVE-2023-6531: Fixed a use-after-free flaw due to a race problem in the unix garbage collector's deletion of SKB races with unixstreamreadgeneric()on the socket that the SKB is queued on (bsc#1218447). CVE-2023-6610: Fixed an out of bounds read in the SMB client when printing debug information (bsc#1217946). CVE-2023-51779: Fixed a use-after-free because of a btsockioctl race condition in btsockrecvmsg (bsc#1218559). CVE-2020-26555: Fixed an issue during BR/EDR PIN code pairing in the Bluetooth subsystem that would allow replay attacks (bsc#1179610 bsc#1215237). CVE-2023-6606: Fixed an out of bounds read in the SMB client when receiving a malformed length from a server (bsc#1217947). CVE-2023-6546: Fixed a race condition in the GSM 0710 tty multiplexor via the GSMIOCSETCONF ioctl that could lead to local privilege escalation (bsc#1218335). CVE-2023-6931: Fixed an out of bounds write in the Performance Events subsystem when adding a new event (bsc#1218258). CVE-2023-6932: Fixed a use-after-free issue when receiving an IGMP query packet due to reference count mismanagement (bsc#1218253). CVE-2023-6622: Fixed a null pointer dereference vulnerability in nftdynsetinit() that could allow a local attacker with CAPNETADMIN user privilege to trigger a denial of service (bsc#1217938). CVE-2023-6121: Fixed an information leak via dmesg when receiving a crafted packet in the NVMe-oF/TCP subsystem (bsc#1217250). The following non-security bugs were fixed: Reviewed and added more information to README.SUSE (jsc#PED-5021). Enabled multibuild for kernel packages (JSC-SLE#5501, boo#1211226, bsc#1218184). Drop drm/bridge lt9611uxc patches that have been reverted on stable trees KVM: s390/mm: Properly reset no-dat (bsc#1218056). KVM: s390: vsie: fix wrong VIR 37 when MSO is used (bsc#1217933). KVM: x86: Mask LVTPC when handling a PMI (jsc#PED-7322). NFS: Fix ODIRECT locking issues (bsc#1211162). NFS: Fix a few more clearbit() instances that need release semantics (bsc#1211162). NFS: Fix a potential data corruption (bsc#1211162). NFS: Fix a use after free in nfsdirectjoingroup() (bsc#1211162). NFS: Fix error handling for ODIRECT write scheduling (bsc#1211162). NFS: More ODIRECT accounting fixes for error paths (bsc#1211162). NFS: More fixes for nfsdirectwriterescheduleio() (bsc#1211162). NFS: Use the correct commit info in nfsjoinpagegroup() (bsc#1211162). NLM: Defend against filelock changes after vfstestlock() (bsc#1217692). Updated SPI patches for NVIDIA Grace enablement (bsc#1212584 jsc#PED-3459) block: fix revalidate performance regression (bsc#1216057). bpf: Adjust insufficient default bpfjitlimit (bsc#1218234). ceph: fix incorrect revoked caps assert in cephfillfilesize() (bsc#1217980). ceph: fix type promotion bug on 32bit systems (bsc#1217982). clocksource: Add a Kconfig option for WATCHDOGMAXSKEW (bsc#1215885 bsc#1217217). clocksource: Enable TSC watchdog checking of HPET and PMTMR only when requested (bsc#1215885 bsc#1217217). clocksource: Handle negative skews in "skew is too large" messages (bsc#1215885 bsc#1217217). clocksource: Improve "skew is too large" messages (bsc#1215885 bsc#1217217). clocksource: Improve read-back-delay message (bsc#1215885 bsc#1217217). clocksource: Loosen clocksource watchdog constraints (bsc#1215885 bsc#1217217). clocksource: Print clocksource name when clocksource is tested unstable (bsc#1215885 bsc#1217217). clocksource: Verify HPET and PMTMR when TSC unverified (bsc#1215885 bsc#1217217). dmblkioctl: implement path failover for SGIO (bsc#1183045, bsc#1216776). fuse: dax: set fc->dax to NULL in fusedaxconnfree() (bsc#1218659). libceph: use kernelconnect() (bsc#1217981). mm: kmem: drop GFPNOFAIL when allocating objcg vectors (bsc#1218515). net/smc: Fix pos miscalculation in statistics (bsc#1218139). net/tg3: fix race condition in tg3resettask() (bsc#1217801). nfs: only issue commit in DIO codepath if we have uncommitted data (bsc#1211162). remove unnecessary WARNONONCE() (bsc#1214823 bsc#1218569). s390/vx: fix save/restore of fpu kernel context (bsc#1218357). scsi: lpfc: use unsigned type for numsge (bsc#1214747). swiotlb: fix a braino in the alignment check fix (bsc#1216559). swiotlb: fix slot alignment checks (bsc#1216559). tracing: Disable preemption when using the filter buffer (bsc#1217036). tracing: Fix a possible race when disabling buffered events (bsc#1217036). tracing: Fix a warning when allocating buffered events fails (bsc#1217036). tracing: Fix incomplete locking when disabling buffered events (bsc#1217036). tracing: Fix warning in tracebufferedeventdisable() (bsc#1217036). tracing: Use thiscpuread() in traceeventbufferlockreserver() (bsc#1217036). uapi: propagate structgroup() attributes to the container union (jsc#SLE-18978). vsprintf/kallsyms: Prevent invalid data when printing symbol (bsc#1217602). x86/entry/ia32: Ensure s32 is sign extended to s64 (bsc#1193285). x86/platform/uv: Use alternate source for socket to node data (bsc#1215696 bsc#1217790). x86/tsc: Add option to force frequency recalibration with HW timer (bsc#1215885 bsc#1217217). x86/tsc: Be consistent about usetscdelay() (bsc#1215885 bsc#1217217). x86/tsc: Extend watchdog check exemption to 4-Sockets platform (bsc#1215885 bsc#1217217).

This update for bluez fixes the following issues: CVE-2023-50229: Fixed an out of bounds write in the primary version counter for the Phone Book Access Profile implementation (bsc#1218300). CVE-2023-50230: Fixed an out of bounds write in the secondary version counter for the Phone Book Access Profile implementation (bsc#1218301).

This update for perl fixes the following issues: CVE-2023-31484: Enable TLS cert verification in CPAN (bsc#1210999).

This update for java-17-openjdk fixes the following issues: Updated to version 17.0.10 (January 2024 CPU): CVE-2024-20918: Fixed an out of bounds access in the Hotspot JVM due to a missing bounds check (bsc#1218907). CVE-2024-20919: Fixed a sandbox bypass in the Hotspot JVM class file verifier (bsc#1218903). CVE-2024-20921: Fixed an incorrect optimization in the Hotspot JVM that could lead to corruption of JVM memory (bsc#1218905). CVE-2024-20932: Fixed an incorrect handling of ZIP files with duplicate entries (bsc#1218908). CVE-2024-20945: Fixed a potential private key leak through debug logs (bsc#1218909). CVE-2024-20952: Fixed an RSA padding issue and timing side-channel attack against TLS (bsc#1218911). Find the full release notes at: https://mail.openjdk.org/pipermail/jdk-updates-dev/2024-January/029089.html

This update for salt fixes the following issues: Security issues fixed: CVE-2024-22231: Prevent directory traversal when creating syndic cache directory on the master (bsc#1219430) CVE-2024-22232: Prevent directory traversal attacks in the master's servefile method (bsc#1219431) Bugs fixed: Ensure that pillar refresh loads beacons from pillar without restart Fix the aptpkg.py unit test failure Prefer unittest.mock to python-mock in test suite Enable "KeepAlive" probes for Salt SSH executions (bsc#1211649) Revert changes to set Salt configured user early in the stack (bsc#1216284) Align behavior of some modules when using salt-call via symlink (bsc#1215963) Fix gitfs "env" and improve cache cleaning (bsc#1193948) Remove python-boto dependency for the python3-salt-testsuite package for Tumbleweed

This update for dpdk fixes the following issues: Fixed a regression caused by incomplete fix for CVE-2022-2132 (bsc#1219187).

This update for csp-billing-adapter, csp-billing-adapter-local contains the following fixes: Changes for csp-billing-adapter-local: - Update to version 0.5.0: Attempt to backup archive before saving Add getarchivelocation function Add metering archive hook implementations Changes for csp-billing-adapter: - Update to version 0.9.0: Add metering archive feature

This update for php-composer2 fixes the following issues: CVE-2024-24821: Fixed potential arbitrary code execution when Composer is invoked within a directory with tampered files (bsc#1219757).

This update for bind fixes the following issues: Update to release 9.16.48: Feature Changes: The IP addresses for B.ROOT-SERVERS.NET have been updated to 170.247.170.2 and 2801:1b8:10::b. Security Fixes: Validating DNS messages containing a lot of DNSSEC signatures could cause excessive CPU load, leading to a denial-of-service condition. This has been fixed. (CVE-2023-50387) [bsc#1219823] Preparing an NSEC3 closest encloser proof could cause excessive CPU load, leading to a denial-of-service condition. This has been fixed. (CVE-2023-50868) [bsc#1219826] Parsing DNS messages with many different names could cause excessive CPU load. This has been fixed. (CVE-2023-4408) [bsc#1219851] Specific queries could cause named to crash with an assertion failure when nxdomain-redirect was enabled. This has been fixed. (CVE-2023-5517) [bsc#1219852] A bad interaction between DNS64 and serve-stale could cause named to crash with an assertion failure, when both of these features were enabled. This has been fixed. (CVE-2023-5679) [bsc#1219853] Query patterns that continuously triggered cache database maintenance could cause an excessive amount of memory to be allocated, exceeding max-cache-size and potentially leading to all available memory on the host running named being exhausted. This has been fixed. (CVE-2023-6516) [bsc#1219854] Removed Features: Support for using AES as the DNS COOKIE algorithm (cookie-algorithm aes;) has been deprecated and will be removed in a future release. Please use the current default, SipHash-2-4, instead.

This update for samba fixes the following issues: CVE-2022-2127: Fixed issue where lmresplen was not checked properly in winbinddpamauthcrapsend (bsc#1213174). CVE-2023-34966: Fixed samba spotlight mdssvc RPC Request Infinite Loop Denial-of-Service Vulnerability (bsc#1213173). CVE-2023-34967: Fixed samba spotlight mdssvc RPC Request Type Confusion Denial-of-Service Vulnerability (bsc#1213172). CVE-2023-34968: Fixed spotlight server-side Share Path Disclosure (bsc#1213171). Bugfixes: Fixed trust relationship failure (bsc#1213384).

This update for gcc12 fixes the following issues: CVE-2023-4039: Fixed incorrect stack protector for C99 VLAs on Aarch64 (bsc#1214052).

This update for nodejs18 fixes the following issues: Update to 18.19.1: (security updates) CVE-2024-21892: Code injection and privilege escalation through Linux capabilities (bsc#1219992). CVE-2024-22019: http: Reading unprocessed HTTP request with unbounded chunk extension allows DoS attacks (bsc#1219993). CVE-2023-46809: Node.js is vulnerable to the Marvin Attack (timing variant of the Bleichenbacher attack against PKCS#1 v1.5 padding) (bsc#1219997). CVE-2024-22025: Denial of Service by resource exhaustion in fetch() brotli decoding (bsc#1220014). CVE-2024-24758: undici version 5.28.3 (bsc#1220017). CVE-2024-24806: libuv version 1.48.0 (bsc#1219724). Update to LTS version 18.19.0 deps: npm updates to 10.x esm: Leverage loaders when resolving subsequent loaders import.meta.resolve unflagged --experimental-default-type flag to flip module defaults

This update for nodejs16 fixes the following issues: Security issues fixed: CVE-2023-46809: Node.js is vulnerable to the Marvin Attack (timing variant of the Bleichenbacher attack against PKCS#1 v1.5 padding) (bsc#1219997). CVE-2024-22019: http: Reading unprocessed HTTP request with unbounded chunk extension allows DoS attacks (bsc#1219993). CVE-2024-22025: Denial of Service by resource exhaustion in fetch() brotli decoding (bsc#1220014). CVE-2024-24758: ignore proxy-authorization header (bsc#1220017). CVE-2024-24806: fix improper domain lookup that potentially leads to SSRF attacks (bsc#1219724).

This update for openssl-100 fixes the following issues: CVE-2023-2650: Fixed possible denial of service translating ASN.1 object identifiers (bsc#1211430).

This update for MozillaFirefox fixes the following issues: Firefox was updated to Extended Support Release 115.2.0 ESR (MFSA 2023-36) (bsc#1214606). CVE-2023-4574: Fixed memory corruption in IPC ColorPickerShownCallback (bmo#1846688) CVE-2023-4575: Fixed memory corruption in IPC FilePickerShownCallback (bmo#1846689) CVE-2023-4576: Fixed integer Overflow in RecordedSourceSurfaceCreation (bmo#1846694) CVE-2023-4577: Fixed memory corruption in JIT UpdateRegExpStatics (bmo#1847397) CVE-2023-4051: Fixed full screen notification obscured by file open dialog (bmo#1821884) CVE-2023-4578: Fixed Out of Memory Exception in SpiderMonkey could have triggered an (bmo#1839007) CVE-2023-4053: Fixed full screen notification obscured by external program (bmo#1839079) CVE-2023-4580: Fixed push notifications saved to disk unencrypted (bmo#1843046) CVE-2023-4581: Fixed XLL file extensions downloadable without warnings (bmo#1843758) CVE-2023-4582: Fixed buffer Overflow in WebGL glGetProgramiv (bmo#1773874) CVE-2023-4583: Fixed browsing Context potentially not cleared when closing Private Window (bmo#1842030) CVE-2023-4584: Fixed memory safety bugs fixed in Firefox 117, Firefox ESR 102.15, Firefox ESR 115.2, Thunderbird 102.15, and Thunderbird 115.2 (bmo#1843968, bmo#1845205, bmo#1846080, bmo#1846526, bmo#1847529) CVE-2023-4585: Fixed memory safety bugs fixed in Firefox 117, Firefox ESR 115.2, and Thunderbird 115.2(bmo#1751583, bmo#1833504, bmo#1841082, bmo#1847904, bmo#1848999).