This update for libwebp fixes the following issues: CVE-2023-4863: Fixed heap buffer overflow (bsc#1215231).

This update for gstreamer-plugins-bad fixes the following issues: CVE-2023-44446: Fixed GStreamer MXF File Parsing Use-After-Free (bsc#1217213). CVE-2023-40475: Fixed GStreamer MXF File Parsing Integer Overflow (bsc#1215792).

This update for webkit2gtk3 fixes the following issues: CVE-2023-42890: Fixed processing malicious web content may lead to arbitrary code execution (bsc#1218033). CVE-2023-42883: Fixed processing a malicious image may lead to a denial-of-service (bsc#1218032). CVE-2023-41074: Fixed use-after-free in the MediaRecorder API of the WebKit GStreamer-based ports (bsc#1215870). CVE-2023-40451, CVE-2023-41074: Update to version 2.42.4 (bsc#1218032, bsc#1215868).

This update for gstreamer-plugins-bad fixes the following issues: ZDI-CAN-22300: Fixed a buffer overflow in the AV1 video plugin (bsc#1218534).

This update for libssh fixes the following issues: Security fixes: CVE-2023-6004: Fixed command injection using proxycommand (bsc#1218209) CVE-2023-48795: Fixed potential downgrade attack using strict kex (bsc#1218126) CVE-2023-6918: Fixed missing checks for return values of MD functions (bsc#1218186) CVE-2023-1667: Fixed NULL dereference during rekeying with algorithm guessing (bsc#1211188) CVE-2023-2283: Fixed possible authorization bypass in pkiverifydatasignature under low-memory conditions (bsc#1211190) Other fixes: Update to version 0.9.8

Allow @ in usernames when parsing from URI composes

Update to version 0.9.7

Fix several memory leaks in GSSAPI handling code

This update for bluez fixes the following issues: CVE-2023-50229: Fixed an out of bounds write in the primary version counter for the Phone Book Access Profile implementation (bsc#1218300). CVE-2023-50230: Fixed an out of bounds write in the secondary version counter for the Phone Book Access Profile implementation (bsc#1218301).

This update for perl fixes the following issues: CVE-2023-31484: Enable TLS cert verification in CPAN (bsc#1210999).

This update for libavif fixes the following issues: CVE-2023-6704: Fixed use after free by not storing colorproperties until alpha item is found (bsc#1218303).

This update for mozilla-nss fixes the following issues: Update to NSS 3.90.2: CVE-2023-5388: Fixed timing attack against RSA decryption in TLS (bsc#1216198)

This update for python310 fixes the following issues: CVE-2023-27043: Fixed incorrectly parser of e-mail addresses which contain a special character (bsc#1210638).

This update for rpm fixes the following issues: backport lua support for rpm.execute to ease migrating from SLE Micro 5.5 to 6.0 (bsc#1216752)

This update for samba fixes the following issues: CVE-2022-2127: Fixed issue where lmresplen was not checked properly in winbinddpamauthcrapsend (bsc#1213174). CVE-2023-34966: Fixed samba spotlight mdssvc RPC Request Infinite Loop Denial-of-Service Vulnerability (bsc#1213173). CVE-2023-34967: Fixed samba spotlight mdssvc RPC Request Type Confusion Denial-of-Service Vulnerability (bsc#1213172). CVE-2023-34968: Fixed spotlight server-side Share Path Disclosure (bsc#1213171). Bugfixes: Fixed trust relationship failure (bsc#1213384).

This update for gcc12 fixes the following issues: CVE-2023-4039: Fixed incorrect stack protector for C99 VLAs on Aarch64 (bsc#1214052).

This update for python311 fixes the following issues: python was updated to version 3.11.4: CVE-2023-24329: Fixed blocklist bypass via the urllib.parse component when supplying a URL that starts with blank characters (bsc#1208471). CVE-2007-4559: Fixed python tarfile module directory traversal (bsc#1203750). Fixed a security in flaw in uu.decode() that could allow for directory traversal based on the input if no outfile was specified. Do not expose the local on-disk location in directory indexes produced by http.client.SimpleHTTPRequestHandler. Bugfixes: trace.main now uses io.opencode() for files to be executed instead of raw open().

This update for libssh fixes the following issues: Fix regression parsing IPv6 addresses provided as hostname (bsc#1220385)

This update for kernel-firmware-nvidia-gspx-G06, nvidia-open-driver-G06-signed fixes the following issues: Update to 550.54.14 Added vGPU Host and vGPU Guest support. For vGPU Host, please refer to the README.vgpu packaged in the vGPU Host Package for more details. Security issues fixed: CVE-2024-0074: A user could trigger a NULL ptr dereference. CVE-2024-0075: A user could overwrite the end of a buffer, leading to crashes or code execution.

CVE-2022-42265: A unprivileged user could trigger an integer overflow which could lead to crashes or code execution.

create /run/udev/staticnode-tags/uaccess/nvidia${devid} symlinks also during modprobing the nvidia module; this changes the issue of not having access to /dev/nvidia${devid}, when gfxcard has been replaced by a different gfx card after installing the driver

provide nvidia-open-driver-G06-kmp (jsc#PED-7117)

this makes it easy to replace the package from nVidia's CUDA repository with this presigned package

This update for python311 fixes the following issues: CVE-2023-6597: Fixed symlink bug in cleanup of tempfile.TemporaryDirectory (bsc#1219666). CVE-2023-27043: Fixed incorrect e-mqil parsing (bsc#1210638). CVE-2022-25236: Fixed an expat vulnerability by supporting expat >= 2.4.4 (bsc#1212015).

This update for python310 fixes the following issues: CVE-2023-6597: Fixed symlink bug in cleanup of tempfile.TemporaryDirectory (bsc#1219666).

This update for open-vm-tools fixes the following issues: CVE-2023-20900: Fixed SAML token signature bypass vulnerability (bsc#1214566). This update also ships a open-vm-tools-containerinfo plugin. (jsc#PED-3421)

This update for openssl-100 fixes the following issues: CVE-2023-2650: Fixed possible denial of service translating ASN.1 object identifiers (bsc#1211430).

This update for c-ares fixes the following issues: Update to version 1.19.1: CVE-2023-32067: 0-byte UDP payload causes Denial of Service (bsc#1211604) CVE-2023-31147: Insufficient randomness in generation of DNS query IDs (bsc#1211605) CVE-2023-31130: Buffer Underwrite in aresinetnetpton() (bsc#1211606) CVE-2023-31124: AutoTools does not set CARESRANDOMFILE during cross compilation (bsc#1211607) Fix uninitialized memory warning in test aresgetaddrinfo() should allow a port of 0 Fix memory leak in aressend() on error Fix comment style in aresdata.h Fix typo in aresinitoptions.3 Sync axpthread.m4 with upstream Sync axcxxcompilestdcxx11.m4 with upstream to fix uclibc support

This update for libssh2org fixes the following issues: CVE-2020-22218: Fixed a bug in libssh2packetadd() which allows to access out of bounds memory. (bsc#1214527)

This update for webkit2gtk3 fixes the following issues: Provide/obsolete WebKit2GTK-%{apiver}-lang (bsc#1214093)

Have the lang package provide libwebkit2gtk3-lang (bsc#1214093)

Adjustments of update version 2.40.5 (bsc#1213905 bsc#1213379 bsc#1213581):

Added missing CVE references: CVE-2023-32393, CVE-2023-37450

This update for libxml2 fixes the following issues: CVE-2023-39615: Fixed crafted xml can cause global buffer overflow (bsc#1214768).

The SUSE Linux Enterprise 15 SP1 kernel was updated to receive various security and bugfixes. The following security bugs were fixed: CVE-2022-36402: Fixed an integer overflow vulnerability in vmwgfx driver in that allowed a local attacker with a user account on the system to gain privilege, causing a denial of service (bsc#1203517). CVE-2023-2007: Fixed a flaw in the DPT I2O Controller driver that could allow an attacker to escalate privileges and execute arbitrary code in the context of the kernel (bsc#1210448). CVE-2023-20588: Fixed a division-by-zero error on some AMD processors that can potentially return speculative data resulting in loss of confidentiality (bsc#1213927). CVE-2023-3772: Fixed a flaw in XFRM subsystem that may have allowed a malicious user with CAPNETADMIN privileges to directly dereference a NULL pointer leading to a possible kernel crash and denial of service (bsc#1213666). CVE-2023-3812: Fixed an out-of-bounds memory access flaw in the TUN/TAP device driver functionality that could allow a local user to crash or potentially escalate their privileges on the system (bsc#1213543). CVE-2023-3863: Fixed a use-after-free flaw was found in nfcllcpfindlocal that allowed a local user with special privileges to impact a kernel information leak issue (bsc#1213601). CVE-2023-4128: Fixed a use-after-free flaw in net/sched/clsfw.c that allowed a local attacker to perform a local privilege escalation due to incorrect handling of the existing filter, leading to a kernel information leak issue (bsc#1214149). CVE-2023-4132: Fixed use-after-free vulnerability was found in the siano smsusb module that allowed a local user to crash the system, causing a denial of service condition (bsc#1213969). CVE-2023-4134: Fixed use-after-free in cyttsp4watchdogwork() (bsc#1213971). CVE-2023-4385: Fixed a NULL pointer dereference flaw in dbFree that may have allowed a local attacker to crash the system due to a missing sanity check (bsc#1214348). CVE-2023-4387: Fixed use-after-free flaw in vmxnet3rqallocrxbuf that could allow a local attacker to crash the system due to a double-free (bsc#1214350). CVE-2023-4459: Fixed a NULL pointer dereference flaw in vmxnet3rqcleanup that may have allowed a local attacker with normal user privilege to cause a denial of service (bsc#1214451). The following non-security bugs were fixed: kabi/severities: Ignore newly added SRSO mitigation functions x86/cpu/kvm: Provide UNTRAINRETVM (git-fixes). x86/cpu: Cleanup the untrain mess (git-fixes). x86/cpu: Fix x86returnthunk symbol type (git-fixes). x86/cpu: Fix up srsosaferet() and x86returnthunk() (git-fixes). x86/cpu: Rename original retbleed methods (git-fixes). x86/cpu: Rename srso(.)alias to srsoalias\1 (git-fixes). x86/retpoline,kprobes: Fix position of thunk sections with CONFIGLTOCLANG (git-fixes). x86/retpoline,kprobes: Skip optprobe check for indirect jumps with retpolines and IBT (git-fixes). x86/retpoline: Do not clobber RFLAGS during srsosaferet() (git-fixes). x86/speculation: Add cpushowgds() prototype (git-fixes). x86/speculation: Mark all Skylake CPUs as vulnerable to GDS (git-fixes). x86/srso: Correct the mitigation status when SMT is disabled (git-fixes). x86/srso: Disable the mitigation on unaffected configurations (git-fixes). x86/srso: Explain the untraining sequences a bit more (git-fixes). x86/srso: Fix build breakage with the LLVM linker (git-fixes). x86: Move gdsucodemitigated() declaration to header (git-fixes).

This update for cups fixes the following issues: CVE-2023-4504: Fixed heap overflow in OpenPrinting CUPS Postscript Parsing (bsc#1215204). CVE-2023-32360: Fixed Information leak through Cups-Get-Document operation (bsc#1214254).

This update for python39 fixes the following issues: Update to 3.9.18:

CVE-2023-40217: Fixed TLS handshake bypass on closed sockets (bsc#1214692). The following non-security bugs were fixed: making marshalling of set and frozenset deterministic (bsc#1211765). stabilizing FLAGREF usage (required for reproduceability (bsc#1213463).

This update for webkit2gtk3 fixes the following issues: Expand lang sub-package in spec file unconditionally to handle previous name change from WebKit2GTK-lang to WebKitGTK-lang. This change affected the automatic generated Requires tag on WebKit2GTK-%{apiver}, then getting out of sync of what's being required and what's being provided. Now, any sub-package that was providing WebKit2GTK-%{apiver} will provide WebKitGTK-%{apiver} instead (bsc#1214835, bsc#1214640, bsc#1214093).

Require libwaylandclient0 >= 1.20. 15.4 originally had 1.19.0, but webkitgtk uses a function added in 1.20.0, so we need to ensure that the wayland update is pulled in (bsc#1215072).

Update to version 2.40.5 (bsc#1213905 bsc#1213379 bsc#1213581 bsc#1215230): CVE-2023-38594, CVE-2023-38595, CVE-2023-38597, CVE-2023-38599, CVE-2023-38600, CVE-2023-38611, CVE-2023-40397, CVE-2023-37450, CVE-2023-28198, CVE-2023-32370

This update for python fixes the following issues: CVE-2023-40217: Fixed TLS handshake bypass on closed sockets (bsc#1214692).

This update for python311 fixes the following issues: Update to 3.11.5. CVE-2023-40217: Fixed TLS handshake bypass on closed sockets (bsc#1214692). CVE-2023-41105: Fixed input truncation on null bytes in os.path.normpath (bsc#1214693).