This update for suseconnect-ng contains the following fix: Update to version 1.6.0: Disable EULA display for addons. (bsc#1218649 and bsc#1217961)

This update for grub2 and efibootmgr fixes the following issues: grub2: Deliver missing grub2-arm64-efi and grub2-powerpc-ieee1275 to SUSE Manager 4.3 (no source changes) (bsc#1217237) efibootmgr: Deliver missing efibootmgr to SUSE Manager 4.3 (no source changes) (bsc#1217237)

This update for libssh fixes the following issues: Security fixes: CVE-2023-6004: Fixed command injection using proxycommand (bsc#1218209) CVE-2023-48795: Fixed potential downgrade attack using strict kex (bsc#1218126) CVE-2023-6918: Fixed missing checks for return values of MD functions (bsc#1218186) CVE-2023-1667: Fixed NULL dereference during rekeying with algorithm guessing (bsc#1211188) CVE-2023-2283: Fixed possible authorization bypass in pkiverifydatasignature under low-memory conditions (bsc#1211190) Other fixes: Update to version 0.9.8

Allow @ in usernames when parsing from URI composes

Update to version 0.9.7

Fix several memory leaks in GSSAPI handling code

This update for bluez fixes the following issues: CVE-2023-50229: Fixed an out of bounds write in the primary version counter for the Phone Book Access Profile implementation (bsc#1218300). CVE-2023-50230: Fixed an out of bounds write in the secondary version counter for the Phone Book Access Profile implementation (bsc#1218301).

This update for runc fixes the following issues: Update to runc v1.1.11: CVE-2024-21626: Fixed container breakout. (bsc#1218894)

This update for perl fixes the following issues: CVE-2023-31484: Enable TLS cert verification in CPAN (bsc#1210999).

This update for runc fixes the following issues: Update to runc v1.1.12 (bsc#1218894) The following CVE was already fixed with the previous release. CVE-2024-21626: Fixed container breakout.

This update for libsolv, libzypp fixes the following issues: build for multiple python versions [jsc#PED-6218] applydeltaprm: Create target directory if it does not exist (bsc#1219442) Fix problems with EINTR in ExternalDataSource::getline (bsc#1215698) CheckAccessDeleted: fix runningincontainer detection (bsc#1218782) Detect CURLOPTREDIRPROTOCOLSSTR availability at runtime (bsc#1218831)

This update for salt fixes the following issues: Security issues fixed: CVE-2024-22231: Prevent directory traversal when creating syndic cache directory on the master (bsc#1219430) CVE-2024-22232: Prevent directory traversal attacks in the master's servefile method (bsc#1219431) Bugs fixed: Ensure that pillar refresh loads beacons from pillar without restart Fix the aptpkg.py unit test failure Prefer unittest.mock to python-mock in test suite Enable "KeepAlive" probes for Salt SSH executions (bsc#1211649) Revert changes to set Salt configured user early in the stack (bsc#1216284) Align behavior of some modules when using salt-call via symlink (bsc#1215963) Fix gitfs "env" and improve cache cleaning (bsc#1193948) Remove python-boto dependency for the python3-salt-testsuite package for Tumbleweed

This update for suseconnect-ng fixes the following issues: Allow SUSEConnect on read write transactional systems (bsc#1219425)

This update for docker fixes the following issues: Vendor latest buildkit v0.11 including bugfixes for the following: CVE-2024-23653: BuildKit API doesn't validate entitlement on container creation (bsc#1219438). CVE-2024-23652: Fixed arbitrary deletion of files (bsc#1219268). CVE-2024-23651: Fixed race condition in mount (bsc#1219267).

This update for mozilla-nss fixes the following issues: Update to NSS 3.90.2: CVE-2023-5388: Fixed timing attack against RSA decryption in TLS (bsc#1216198)

This update for openssh fixes the following issues: CVE-2023-51385: Limit the use of shell metacharacters in host- and user names to avoid command injection. (bsc#1218215)

This update for rpm fixes the following issues: backport lua support for rpm.execute to ease migrating from SLE Micro 5.5 to 6.0 (bsc#1216752)

This update for samba fixes the following issues: CVE-2022-2127: Fixed issue where lmresplen was not checked properly in winbinddpamauthcrapsend (bsc#1213174). CVE-2023-34966: Fixed samba spotlight mdssvc RPC Request Infinite Loop Denial-of-Service Vulnerability (bsc#1213173). CVE-2023-34967: Fixed samba spotlight mdssvc RPC Request Type Confusion Denial-of-Service Vulnerability (bsc#1213172). CVE-2023-34968: Fixed spotlight server-side Share Path Disclosure (bsc#1213171). Bugfixes: Fixed trust relationship failure (bsc#1213384).

This update for gcc12 fixes the following issues: CVE-2023-4039: Fixed incorrect stack protector for C99 VLAs on Aarch64 (bsc#1214052).

This update for libssh fixes the following issues: Fix regression parsing IPv6 addresses provided as hostname (bsc#1220385)

This update for sudo fixes the following issues: CVE-2023-42465: Try to make sudo less vulnerable to ROWHAMMER attacks (bsc#1219026).

This update for wpasupplicant fixes the following issues: CVE-2023-52160: Bypassing WiFi Authentication (bsc#1219975).

This update for sudo fixes the following issues: NOTE: This update has been retracted as some logic was not correct. CVE-2023-42465: Try to make sudo less vulnerable to ROWHAMMER attacks (bsc#1219026).

This update for dracut fixes the following issues: Protect against broken links pointing to themselves Exit if resolving executable dependencies fails (bsc#1214081)

This update for libssh2org fixes the following issues: CVE-2020-22218: Fixed a bug in libssh2packetadd() which allows to access out of bounds memory. (bsc#1214527)

This update for perl-Bootloader fixes the following issues: bootloaderentry script can have an optional 'force-default' argument (bsc#1215064) skip warning about unsupported options when in compat mode

This update for libxml2 fixes the following issues: CVE-2023-39615: Fixed crafted xml can cause global buffer overflow (bsc#1214768).

This update for cups fixes the following issues: CVE-2023-4504: Fixed heap overflow in OpenPrinting CUPS Postscript Parsing (bsc#1215204). CVE-2023-32360: Fixed Information leak through Cups-Get-Document operation (bsc#1214254).

This update of runc fixes the following issues: Update to runc v1.1.8. Upstream changelog is available from <https://github.com/opencontainers/runc/releases/tag/v1.1.8>. rebuild the package with the go 1.21 security release (bsc#1212475).

This update for vim fixes the following issues: Security fixes: CVE-2023-4733: Fixed use-after-free in function buflistaltfpos (bsc#1215004). CVE-2023-4734: Fixed segmentation fault in function ffullcommand (bsc#1214925). CVE-2023-4735: Fixed out of bounds write in ops.c (bsc#1214924). CVE-2023-4738: Fixed heap buffer overflow in vimregsubboth (bsc#1214922). CVE-2023-4752: Fixed heap use-after-free in function inscomplgetexp (bsc#1215006). CVE-2023-4781: Fixed heap buffer overflow in function vimregsubboth (bsc#1215033). Other fixes: Update to version 9.0 with patch level 1894, for the complete list of changes see https://github.com/vim/vim/compare/v9.0.1443...v9.0.1894 Use app icons generated from vimlogo.eps in the source tarball; add higher resolution icons of sizes 128x128, 256x256, and 512x512 as png sources

This update for libeconf fixes the following issues: Update to version 0.5.2. CVE-2023-30078, CVE-2023-32181: Fixed a stack-buffer-overflow vulnerability in "econfwriteFile" function (bsc#1211078). CVE-2023-30079, CVE-2023-22652: Fixed a stack-buffer-overflow vulnerability in "readfile" function. (bsc#1211078)

This update for suse-module-tools fixes the following issues: Update to version 15.4.17: cert-script: warn only once about non-writable efivarfs cert-script: skip cert handling if efivarfs is not writable (bsc#1213428, bsc#1201066)

This update for nghttp2 fixes the following issues: CVE-2023-35945: Fixed memory leak when PUSHPROMISE or HEADERS frame cannot be sent (bsc#1215713).