This update for suseconnect-ng contains the following fixes: Update to version 1.6.0:

Disable EULA display for addons. (bsc#1218649 and bsc#1217961)

Update to version 1.5.0:

Configure docker credentials for registry authentication Feature: Support usage from Agama + Cockpit for ALP Micro system registration. (bsc#1218364) Add --json output option

This update for MozillaFirefox fixes the following issues: Firefox Extended Support Release 115.2.1 ESR (bsc#1215245). CVE-2023-4863: Fixed heap buffer overflow in libwebp (MFSA 2023-40) (bsc#1215231). The following non-security bug was fixed: Fix i586 build by reducing debug info to -g1 (bsc#1210168).

This update for libwebp fixes the following issues: CVE-2023-4863: Fixed a heap buffer overflow (bsc#1215231).

This update for LibreOffice fixes the following issues: libreoffice: Version update from 7.3.6.2 to 7.5.4.1 (jsc#PED-3561, jsc#PED-3550, jsc#PED-1785): For the highlights of changes of version 7.5 please consult the official release notes: https://wiki.documentfoundation.org/ReleaseNotes/7.5 For the highlights of changes of version 7.4 please consult the official release notes: https://wiki.documentfoundation.org/ReleaseNotes/7.4 Security issues fixed: CVE-2023-0950: Fixed stack underflow in ScInterpreter (bsc#1209242) CVE-2023-2255: Fixed vulnerability where remote documents could be loaded without prompt via IFrame (bsc#1211746)

Bug fixes: Fix PPTX shadow effect for table offset (bsc#1204040) Fix ability to set the default tab size for each text object (bsc#1198666) Fix PPTX extra vertical space between different text formats (bsc#1200085) Do not use binutils-gold as the package is unmaintainedd and will be removed in the future (bsc#1210687)

Updated bundled dependencies: boost version update from 1770 to 1800 curl version update from 7.83.1 to 8.0.1 icu4c-data version update from 701 to 721 icu4c version update from 701 to 721 pdfium version update from 4699 to 5408 poppler version update from 21.11.0 to 22.12.0 poppler-data version update from 0.4.10 to 0.4.11 skia version from m97-a7230803d64ae9d44f4e128244480111a3ae967 to m103-b301ff025004c9cd82816c86c547588e6c24b466

New build dependencies: fixmath-devel libwebp-devel zlib-devel dragonbox-devel at-spi2-core-devel libtiff-devel dragonbox: New package at version 1.1.3 (jsc#PED-1785) New dependency for LibreOffice 7.4 fixmath: New package at version 2022.07.20 (jsc#PED-1785) New dependency for LibreOffice 7.4 libmwaw: Version update from 0.3.20 to 0.3.21 (jsc#PED-1785): Add debug code to read some private rsrc data Allow to read some MacWrite which does not have printer informations Add a parser for Scoop files Add a parser for ScriptWriter files Add a parser for ReadySetGo 1-4 files xmlsec1: Version update from 1.2.28 to 1.2.37 required by LibreOffice 7.5.2.2 (jsc#PED-3561, jsc#PED-3550): Retired the XMLSec mailing list "xmlsec@aleksey.com" and the XMLSec Online Signature Verifier. Migration to OpenSSL 3.0 API Note that OpenSSL engines are disabled by default when XMLSec library is compiled against OpenSSL 3.0. To re-enable OpenSSL engines, use --enable-openssl3-engines configure flag (there will be a lot of deprecation warnings). The OpenSSL before 1.1.0 and LibreSSL before 2.7.0 are now deprecated and will be removed in the future versions of XMLSec Library. Refactored all the integer casts to ensure cast-safety. Fixed all warnings and enabled -Werror and -pedantic flags on CI builds. Added configure flag to use sizet for xmlSecSize (currently disabled by default for backward compatibility). Support for OpenSSL compiled with OPENSSLNOERR. Full support for LibreSSL 3.5.0 and above Several other small fixes Fix decrypting session key for two recipients Added --privkey-openssl-engine option to enhance openssl engine support Remove MD5 for NSS 3.59 and above Fix PKCS12parse return code handling Fix OpenSSL lookup xmlSecX509DataGetNodeContent(): don't return 0 for non-empty elements - fix for LibreOffice Unload error strings in OpenSSL shutdown. Make userData available when executing preExecCallback function Add an option to use secure memset. Enabled XMLPARSEHUGE for all xml parsers. Various build and tests fixes and improvements. Move remaining private header files away from xmlsec/include/ folder Other packaging changes: Relax the crypto policies for the test-suite. It allows the tests using certificates with small key lengths to pass. Pass --disable-md5 to configure: The cryptographic strength of the MD5 algorithm is sufficiently doubtful that its use is discouraged at this time. It is not listed as an algorithm in [XMLDSIG-CORE1] https://www.w3.org/TR/xmlsec-algorithms/#bib-XMLDSIG-CORE1

The SUSE Linux Enterprise 12 SP5 kernel was updated to receive various security bugfixes. The following security bugs were fixed: CVE-2022-2586: Fixed a use-after-free which can be triggered when a nft table is deleted (bsc#1202095). CVE-2023-6121: Fixed an information leak via dmesg when receiving a crafted packet in the NVMe-oF/TCP subsystem (bsc#1217250). CVE-2023-6606: Fixed an out of bounds read in the SMB client when receiving a malformed length from a server (bsc#1217947). CVE-2023-6610: Fixed an out of bounds read in the SMB client when printing debug information (bsc#1217946). CVE-2023-6931: Fixed an out of bounds write in the Performance Events subsystem when adding a new event (bsc#1214158 bsc#1218258). CVE-2023-6932: Fixed a use-after-free issue when receiving an IGMP query packet due to reference count mismanagement (bsc#1218253). CVE-2020-26555: Fixed an issue during BR/EDR PIN code pairing in the Bluetooth subsystem that would allow replay attacks (bsc#1179610 bsc#1215237). CVE-2023-51779: Fixed a use-after-free issue due to a race condition during Bluetooth message reception (bsc#1218559). The following non-security bugs were fixed: Enabled the LLC counters for “perf” (perf stat) on the Ice-Lake and Rocket-Lake CPUs (jsc#PED-5023 bsc#1211439). Reviewed and added more information to README.SUSE (jsc#PED-5021). Enabled multibuild for kernel packages (JSC-SLE#5501, boo#1211226, bsc#1218184). Fix termination state for idrforeachentryul() (bsc#1109837). KVM: s390/mm: Properly reset no-dat (bsc#1218057). KVM: s390: vsie: fix wrong VIR 37 when MSO is used (bsc#1217936). PCI: Disable ATS for specific Intel IPU E2000 devices (bsc#1218622). gve: Add XDP DROP and TX support for GQI-QPL format (bsc#1214479). gve: Add XDP REDIRECT support for GQI-QPL format (bsc#1214479). gve: Changes to add new TX queues (bsc#1214479). gve: Control path for DQO-QPL (bsc#1214479). gve: Do not fully free QPL pages on prefill errors (bsc#1214479). gve: Fix gve interrupt names (bsc#1214479). gve: Fixes for napipoll when budget is 0 (bsc#1214479). gve: RX path for DQO-QPL (bsc#1214479). gve: Set default duplex configuration to full (bsc#1214479). gve: Tx path for DQO-QPL (bsc#1214479). gve: Unify duplicate GQ min pkt desc size constants (bsc#1214479). gve: XDP support GQI-QPL: helper function changes (bsc#1214479). gve: fix fraglist chaining (bsc#1214479). gve: trivial spell fix Recive to Receive (bsc#1214479). gve: unify driver name usage (bsc#1214479). net/tg3: fix race condition in tg3resettask() (bsc#1217801). net/tg3: resolve deadlock in tg3resettask() during EEH (bsc#1217801). s390/vx: fix save/restore of fpu kernel context (bsc#1218362). tracing: Fix a possible race when disabling buffered events (bsc#1217036). tracing: Fix a warning when allocating buffered events fails (bsc#1217036). tracing: Fix incomplete locking when disabling buffered events (bsc#1217036). tracing: Fix warning in tracebufferedeventdisable() (bsc#1217036).

This update for xorg-x11-server fixes the following issues: CVE-2023-6816: Fixed heap buffer overflow in DeviceFocusEvent and ProcXIQueryPointer (bsc#1218582) CVE-2024-0229: Fixed reattaching to different master device may lead to out-of-bounds memory access (bsc#1218583) CVE-2024-21885: Fixed heap buffer overflow in XISendDeviceHierarchyEvent (bsc#1218584) CVE-2024-21886: Fixed heap buffer overflow in DisableDevice (bsc#1218585)

This update for MozillaFirefox fixes the following issues: Update to Firefox Extended Support Release 115.7.0 ESR (MFSA 2024-02) (bsc#1218955): CVE-2024-0741: Out of bounds write in ANGLE CVE-2024-0742: Failure to update user input timestamp CVE-2024-0746: Crash when listing printers on Linux CVE-2024-0747: Bypass of Content Security Policy when directive unsafe-inline was set CVE-2024-0749: Phishing site popup could show local origin in address bar CVE-2024-0750: Potential permissions request bypass via clickjacking CVE-2024-0751: Privilege escalation through devtools CVE-2024-0753: HSTS policy on subdomain could bypass policy of upper domain CVE-2024-0755: Memory safety bugs fixed in Firefox 122, Firefox ESR 115.7, and Thunderbird 115.7

This update for java-11-openjdk fixes the following issues: Updated to version 11.0.22 (January 2024 CPU): CVE-2024-20918: Fixed an out of bounds access in the Hotspot JVM due to a missing bounds check (bsc#1218907). CVE-2024-20919: Fixed a sandbox bypass in the Hotspot JVM class file verifier (bsc#1218903). CVE-2024-20921: Fixed an incorrect optimization in the Hotspot JVM that could lead to corruption of JVM memory (bsc#1218905). CVE-2024-20926: Fixed arbitrary Java code execution in Nashorn (bsc#1218906). CVE-2024-20945: Fixed a potential private key leak through debug logs (bsc#1218909). CVE-2024-20952: Fixed an RSA padding issue and timing side-channel attack against TLS (bsc#1218911). Find the full release notes at: https://mail.openjdk.org/pipermail/jdk-updates-dev/2024-January/029215.html

This update for xerces-c fixes the following issues: CVE-2018-1311: fixed use-after-free triggered during the scanning of external DTDs potentially leading to DOS. (bsc#1159552)

This update for squid fixes the following issues: CVE-2023-50269: fixed X-Forwarded-For Stack Overflow. (bsc#1217654) CVE-2024-23638: fixed Denial of Service attack against Cache Manager error responses. (bsc#1219131)

This update for gstreamer fixes the following issues: CVE-2023-40474: Fixed an integer overflow during MXF file parsing (bsc#1215796).

The SUSE Linux Enterprise 12 SP5 kernel was updated to receive various security bugfixes. The following security bugs were fixed: CVE-2024-1086: Fixed a use-after-free vulnerability inside the nftables component that could have been exploited to achieve local privilege escalation (bsc#1219434). CVE-2024-0340: Fixed information disclosure in vhost/vhost.c:vhostnewmsg() (bsc#1218689). CVE-2023-51780: Fixed a use-after-free in dovccioctl in net/atm/ioctl.c, because of a vccrecvmsg race condition (bsc#1218730). CVE-2023-46838: Fixed an issue with Xen netback processing of zero-length transmit fragment (bsc#1218836). CVE-2021-33631: Fixed an integer overflow in ext4writeinlinedataend() (bsc#1219412). CVE-2023-47233: Fixed a use-after-free in the device unplugging (disconnect the USB by hotplug) code inside the brcm80211 component (bsc#1216702). CVE-2023-51043: Fixed use-after-free during a race condition between a nonblocking atomic commit and a driver unload in drivers/gpu/drm/drmatomic.c (bsc#1219120). CVE-2024-0775: Fixed use-after-free in ext4remount in fs/ext4/super.c that could allow a local user to cause an information leak problem while freeing the old quota file names before a potential failure (bsc#1219053). CVE-2023-6040: Fixed an out-of-bounds access vulnerability while creating a new netfilter table, lack of a safeguard against invalid nftables family (pf) values within nftablesnewtable function (bsc#1218752). CVE-2023-51782: Fixed use-after-free in roseioctl in net/rose/afrose.c because of a roseaccept race condition (bsc#1218757). CVE-2023-6610: Fixed an out of bounds read in the SMB client when printing debug information (bsc#1217946). CVE-2023-6535: Fixed a NULL pointer dereference in nvmettcpexecuterequest (bsc#1217988). CVE-2023-6536: Fixed a NULL pointer dereference in nvmetreqcomplete (bsc#1217989). CVE-2023-6356: Fixed a NULL pointer dereference in nvmettcpbuildpduiovec (bsc#1217987). CVE-2023-51042: Fixed use-after-free in amdgpucswaitallfences in drivers/gpu/drm/amd/amdgpu/amdgpucs.c (bsc#1219128). The following non-security bugs were fixed: 9p: missing chunk of "fs/9p: Do not update file type when updating file attributes" (git-fixes). ACPICA: Avoid cache flush inside virtual machines (git-fixes). GFS2: Flush the GFS2 delete workqueue before stopping the kernel threads (git-fixes). KVM: s390: vsie: Fix STFLE interpretive execution identification (git-fixes bsc#1219022). UAPI: ndctl: Fix g++-unsupported initialisation in headers (git-fixes). USB: serial: option: add Fibocom to DELL custom modem FM101R-GL (git-fixes). USB: serial: option: add Telit LE910C4-WWX 0x1035 composition (git-fixes). USB: serial: option: add entry for Sierra EM9191 with new firmware (git-fixes). USB: serial: option: fix FM101R-GL defines (git-fixes). acpi/nfit: Require opt-in for read-only label configurations (git-fixes). acpi/nfit: improve bounds checking for 'func' (git-fixes). affs: fix basic permission bits to actually work (git-fixes). aio: fix mremap after fork null-deref (git-fixes). asix: Add check for usbnetgetendpoints (git-fixes). bnxten: Log unknown link speed appropriately (git-fixes). build: Limit kernel-source build to architectures for which the kernel binary is built (bsc#1108281). ceph: fix incorrect revoked caps assert in cephfillfilesize() (bsc#1219445). chardev: fix error handling in cdevdeviceadd() (git-fixes). configfs: fix a deadlock in configfssymlink() (git-fixes). configfs: fix a race in configfs{,un}registersubsystem() (git-fixes). configfs: fix a use-after-free in configfsopenfile (git-fixes). configfs: fix configitem refcnt leak in configfsrmdir() (git-fixes). configfs: fix memleak in configfsreleasebinfile (git-fixes). configfs: new object reprsenting tree fragments (git-fixes). configfs: provide exclusion between IO and removals (git-fixes). configfs: stash the data we need into configfsbuffer at open time (git-fixes). docs: Store the old kernel changelog entries in kernel-docs package (bsc#1218713). ext4: Avoid freeing inodes on dirty list (bsc#1216989). ext4: silence the warning when evicting inode with dioreadnolock (bsc#1206889). fat: add ratelimit to fatentbread() (git-fixes). fs/exofs: fix potential memory leak in mount option parsing (git-fixes). fs/fat/fatent.c: add condresched() to fatcountfreeclusters() (git-fixes). fs/fat/file.c: issue flush after the writeback of FAT (git-fixes). fs/file.c: initialize initfiles.resizewait (git-fixes). fs: do not audit the capability check in simplexattrlist() (git-fixes). fs: ocfs2: namei: check return value of ocfs2addentry() (git-fixes). fs: orangefs: fix error return code of orangefsrevalidatelookup() (git-fixes). fs: ratelimit findgetblockslow() failure message (git-fixes). fs: warn about impending deprecation of mandatory locks (git-fixes). gfs2: Allow locknolock mount to specify jid=X (git-fixes). gfs2: Check sbbsizeshift after reading superblock (git-fixes). gfs2: Do not call dlm after protocol is unmounted (git-fixes). gfs2: Do not set GFS2RDFUPTODATE when the lvb is updated (git-fixes). gfs2: Do not skip dlm unlock if glock had an lvb (git-fixes). gfs2: Fix inode height consistency check (git-fixes). gfs2: Fix lrucount going negative (git-fixes). gfs2: Fix marking bitmaps non-full (git-fixes). gfs2: Fix possible data races in gfs2showoptions() (git-fixes). gfs2: Fix sign extension bug in gfs2updatestats (git-fixes). gfs2: Fix use-after-free in gfs2glockshrinkscan (git-fixes). gfs2: Free rdbits later in gfs2clearrgrpd to fix use-after-free (git-fixes). gfs2: Make sure FITRIM minlen is rounded up to fs block size (git-fixes). gfs2: Special-case rindex for gfs2grow (git-fixes). gfs2: Wake up when sdglockdisposal becomes zero (git-fixes). gfs2: add validation checks for size of superblock (git-fixes). gfs2: assign rgrp glock before computebitstructs (git-fixes). gfs2: check for empty rgrp tree in gfs2riupdate (git-fixes). gfs2: check for live vs. read-only file system in gfs2fitrim (git-fixes). gfs2: clear bufintr when ending a transaction in sweepbhforrgrps (git-fixes). gfs2: fix use-after-free on transaction ail lists (git-fixes). gfs2: ignore negated quota changes (git-fixes). gfs2: initialize transaction trailXlists earlier (git-fixes). gfs2: report "already frozen/thawed" errors (git-fixes). gfs2: take jdata unstuff into account in dogrow (git-fixes). gfs2atomicopen(): fix OEXCL|OCREAT handling on cold dcache (git-fixes). gtp: change NETUDPTUNNEL dependency to select (git-fixes). helpnext should increase position index (git-fixes). iomap: sub-block dio needs to zeroout beyond EOF (git-fixes). kernfs: Separate kernfsprcontbuf and renamelock (git-fixes). kernfs: bring names in comments in line with code (git-fixes). kernfs: fix use-after-free in kernfsremove (git-fixes). libceph: use kernelconnect() (bsc#1219446). libnvdimm/btt: Fix LBA masking during 'free list' population (git-fixes). libnvdimm/btt: Fix a kmemdup failure check (git-fixes). libnvdimm/btt: Remove unnecessary code in bttfreelistinit (git-fixes). libnvdimm/btt: fix variable 'rc' set but not used (git-fixes). libnvdimm/namespace: Fix a potential NULL pointer dereference (git-fixes). libnvdimm/ofpmem: Use devmkstrdup instead of kstrdup and check its return value (git-fixes). libnvdimm/pmem: Delete include of nd-core.h (git-fixes). libnvdimm/pmem: fix a possible OOB access when read and write pmem (git-fixes). libnvdimm/region: Fix label activation vs errors (git-fixes). libnvdimm: Fix compilation warnings with W=1 (git-fixes). libnvdimm: Out of bounds read in ndioctl() (git-fixes). libnvdimm: Validate command family indices (git-fixes). libnvdimm: cover up changes in struct nvdimmbusdescriptor (git-fixes). locks: print a warning when mount fails due to lack of "mand" support (git-fixes). mce: fix setmcenospec to always unmap the whole page (git-fixes). mlx4: handle non-napi callers to napipoll (git-fixes). mlxsw: spectrum: Avoid -Wformat-truncation warnings (git-fixes). mlxsw: spectrum: Properly cleanup LAG uppers when removing port from LAG (git-fixes). mlxsw: spectrum: Set LAG port collector only when active (git-fixes). mm,mremap: bail out earlier in mremapto under map pressure (bsc#1123986). net/mlx5: Do not call timecounter cyc2time directly from 1PPS flow (git-fixes). net: (cpts) fix a missing check of clkprepare (git-fixes). net: dsa: bcmsf2: Propagate error value from mdiowrite (git-fixes). net: dsa: mv88e6xxx: Work around mv886e6161 SERDES missing MIIPHYSID2 (git-fixes). net: dsa: mv88e6xxx: avoid error message on remove from VLAN 0 (git-fixed). net: dsa: qca8k: Enable delay for RGMIIID mode (git-fixes). net: ethernet: ti: fix possible object reference leak (git-fixes). net: fec: Do not use netdev messages too early (git-fixes). net: ks8851: Delay requesting IRQ until opened (git-fixes). net: ks8851: Reassert reset pin if chip ID check fails (git-fixes). net: ks8851: Set initial carrier state to down (git-fixes). net: macb: Add null check for PCLK and HCLK (git-fixed). net: mv643xxeth: disable clk on error path in mv643xxethsharedprobe() (git-fixes). net: mvneta: fix double free of txq->buf (git-fixes). net: phy: sfp: warn the user when no txdisable pin is available (git-fixes). net: phylink: avoid resolving link state too early (git-fixes). net: sfp: do not probe SFP module before we're attached (git-fixes). net: stmmac: Disable EEE mode earlier in XMIT callback (git-fixes). net: stmmac: Fallback to Platform Data clock in Watchdog conversion (git-fixes). net: stmmac: do not overwrite discardframe status (git-fixes). net: stmmac: dwmac-rk: fix error handling in rkgmacpowerup() (git-fixes). net: stmmac: dwmac1000: Clear unused address entries (git-fixed). net: stmmac: dwmac1000: fix out-of-bounds mac address reg setting (git-fixes). net: stmmac: dwmac4/5: Clear unused address entries (git-fixes). net: systemport: Fix reception of BPDUs (git-fixes). net: xilinx: fix possible object reference leak (git-fixed). nfs: NFS 4.0 LOCK calls getting constant NFS4ERRBADSEQID (bsc#1218968). nfsd: drop stmutex and rpmutex before calling movetocloselru() (bsc#1217525). nvdimm/btt: do not call delgendisk() if not needed (git-fixes). nvdimm: Allow overwrite in the presence of disabled dimms (git-fixes). nvdimm: Fix badblocks clear off-by-one error (git-fixes). nvmet-tcp: fix a crash in nvmetreqcomplete() (git-fixes). orangefs: Fix kmemleak in orangefspreparedebugfshelpstring() (git-fixes). orangefs: Fix sysfs not cleanup when dev init failed (git-fixes). orangefs: fix orangefs df output (git-fixes). orangefs: rate limit the client not running info message (git-fixes). powerpc/powernv: Add a null pointer check in opaleventinit() (bsc#1065729). powerpc/powernv: Add a null pointer check in opalpowercapinit() (bsc#1181674 ltc#189159 git-fixes). powerpc/pseries/memhotplug: Quieten some DLPAR operations (bsc#1065729). powerpc/pseries/memhp: Fix access beyond end of drmem array (bsc#1065729). powerpc: Do not clobber f0/vs0 during fp|altivec register save (bsc#1065729). preserve KABI for struct platstmmacenetdata (git-fixes). preserve KABI for struct sfpsocketops (git-fixes). proc: fix /proc//mapfiles lookup (git-fixes). pstore/ram: Check start of empty przs during init (git-fixes). pstore/ram: Fix error return code in ramoopsprobe() (git-fixes). pstore/ram: Run without kernel crash dump region (git-fixes). pstore: Avoid kcore oops by vmap()ing with VMIOREMAP (git-fixes). pstore: ramcore: fix possible overflow in persistentraminitecc() (git-fixes). r8169: fix data corruption issue on RTL8402 (git-fixes). reiserfs: Check the return value from getblk() (git-fixes). reiserfs: Replace 1-element array with C99 style flex-array (git-fixes). s390/dasd: fix double module refcount decrement (bsc#1141539). scripts/gitsort/gitsort.py: Add 'perf-tools' branch scsi: qla0xxx: Fix system crash due to bad pointer access (git-fixes). sfc: initialise found bitmap in efxef10mtdprobe (git-fixes). statfs: enforce statfs[64] structure initialization (git-fixes). tracing/trigger: Fix to return error if failed to alloc snapshot (git-fixes). usb: xhci: xhci-ring: Use sysdev for mapping bounce buffer (git-fixes). veth: Fixing transmit return status for dropped packets (git-fixes). vfs: make freezesuper abort when syncfilesystem returns error (git-fixes). writeback: Export inodeiolistdel() (bsc#1216989). x86/CPU/AMD: Check vendor in the AMD microcode callback (git-fixes). x86/alternatives: Sync core before enabling interrupts (git-fixes). x86/asm: Ensure asm/proto.h can be included stand-alone (git-fixes). x86/bugs: Add "unknown" reporting for MMIO Stale Data (git-fixes). x86/build: Treat R386PLT32 relocation as R386PC32 (git-fixes). x86/build: Turn off -fcf-protection for realmode targets (git-fixes). x86/cpu/hygon: Fix the CPU topology evaluation for real (git-fixes). x86/cpu: Add another Alder Lake CPU to the Intel family (git-fixes). x86/fpu: Use Alignof to avoid undefined behavior in TYPEALIGN (git-fixes). x86/kvm/lapic: always disable MMIO interface in x2APIC mode (git-fixes). x86/kvm: Do not try to disable kvmclock if it was not enabled (git-fixes). x86/lib: Fix overflow when counting digits (git-fixes). x86/mce: relocate set{clear}mcenospec() functions (git-fixes). x86/microcode/AMD: Track patch allocation size explicitly (git-fixes). x86/microcode/intel: Do not retry microcode reloading on the APs (git-fixes). x86/mm: Add a x86haspatwp() helper (git-fixes). x86/pat: Fix x86haspatwp() (git-fixes). x86/pat: Pass valid address to sanitizephys() (git-fixes). x86/pm: Add enumeration check before spec MSRs save/restore setup (git-fixes). x86/pm: Fix false positive kmemleak report in msrbuildcontext() (git-fixes). x86/purgatory: Do not generate debug info for purgatory.ro (git-fixes). x86/resctrl: Fix to restore to original value when re-enabling hardware prefetch register (git-fixes). x86/topology: Fix duplicated core ID within a package (git-fixes). x86/topology: Fix multiple packages shown on a single-package system (git-fixes). x86/unwind/orc: Fix unreliable stack dump with gcov (git-fixes). x86/unwind/orc: Unwind ftrace trampolines with correct ORC entry (git-fixes). x86: Clear .brk area at early boot (git-fixes). x86: Fix getwchan() for !STACKTRACE (git-fixes). x86: Fix getwchan() to support the ORC unwinder (git-fixes). x86: Mark stopthiscpu() noreturn (git-fixes). x86: Pin task-stack in getwchan() (git-fixes). x86: alwaysinline {rd,wr}msr() (git-fixes).

This update for postgresql15 fixes the following issues: Upgrade to 15.6: CVE-2024-0985: Tighten security restrictions within REFRESH MATERIALIZED VIEW CONCURRENTLY (bsc#1219679).

This update for perl fixes the following issues: CVE-2023-31484: Enable TLS cert verification in CPAN (bsc#1210999).

This update for libssh fixes the following issues: Update to version 0.9.8 (jsc#PED-7719): Fix CVE-2023-6004: Command injection using proxycommand (bsc#1218209) Fix CVE-2023-48795: Potential downgrade attack using strict kex (bsc#1218126) Fix CVE-2023-6918: Missing checks for return values of MD functions (bsc#1218186) Allow @ in usernames when parsing from URI composes Update to version 0.9.7 Fix CVE-2023-1667: a NULL dereference during rekeying with algorithm guessing (bsc#1211188) Fix CVE-2023-2283: a possible authorization bypass in pkiverifydatasignature under low-memory conditions (bsc#1211190) Fix several memory leaks in GSSAPI handling code Update to version 0.9.6 (bsc#1189608, CVE-2021-3634) https://git.libssh.org/projects/libssh.git/tag/?h=libssh-0.9.6 Update to version 0.9.5 (bsc#1174713, CVE-2020-16135): CVE-2020-16135: Avoid null pointer dereference in sftpserver (T232) Improve handling of library initialization (T222) Fix parsing of subsecond times in SFTP (T219) Make the documentation reproducible Remove deprecated API usage in OpenSSL Fix regression of sshchannelpolltimeout() returning SSHAGAIN Define version in one place (T226) Prevent invalid free when using different C runtimes than OpenSSL (T229) Compatibility improvements to testsuite Update to version 0.9.4: https://www.libssh.org/2020/04/09/libssh-0-9-4-and-libssh-0-8-9-security-release/ Fix possible Denial of Service attack when using AES-CTR-ciphers CVE-2020-1730 (bsc#1168699) Update to version 0.9.3: Fixed CVE-2019-14889 - SCP: Unsanitized location leads to command execution (bsc#1158095) SSH-01-003 Client: Missing NULL check leads to crash in erroneous state SSH-01-006 General: Various unchecked Null-derefs cause DOS SSH-01-007 PKI Gcrypt: Potential UAF/double free with RSA pubkeys SSH-01-010 SSH: Deprecated hash function in fingerprinting SSH-01-013 Conf-Parsing: Recursive wildcards in hostnames lead to DOS SSH-01-014 Conf-Parsing: Integer underflow leads to OOB array access SSH-01-001 State Machine: Initial machine states should be set explicitly SSH-01-002 Kex: Differently bound macros used to iterate same array SSH-01-005 Code-Quality: Integer sign confusion during assignments SSH-01-008 SCP: Protocol Injection via unescaped File Names SSH-01-009 SSH: Update documentation which RFCs are implemented SSH-01-012 PKI: Information leak via uninitialized stack buffer Update to version 0.9.2: Fixed libssh-config.cmake Fixed issues with rsa algorithm negotiation (T191) Fixed detection of OpenSSL ed25519 support (T197) Update to version 0.9.1: Added support for Ed25519 via OpenSSL Added support for X25519 via OpenSSL Added support for localuser in Match keyword Fixed Match keyword to be case sensitive Fixed compilation with LibreSSL Fixed error report of channel open (T75) Fixed sftp documentation (T137) Fixed knownhosts parsing (T156) Fixed build issue with MinGW (T157) Fixed build with gcc 9 (T164) Fixed deprecation issues (T165) Fixed knownhosts directory creation (T166) Update to verion 0.9.0: Added support for AES-GCM Added improved rekeying support Added performance improvements Disabled blowfish support by default Fixed several ssh config parsing issues Added support for DH Group Exchange KEX Added support for Encrypt-then-MAC mode Added support for parsing server side configuration file Added support for ECDSA/Ed25519 certificates Added FIPS 140-2 compatibility Improved knownhosts parsing Improved documentation

Improved OpenSSL API usage for KEX, DH, and signatures

Add libssh client and server config files

This update for mozilla-nss fixes the following issues: Update to NSS 3.90.2: CVE-2023-5388: Fixed timing attack against RSA decryption in TLS (bsc#1216198)

This update for suseconnect-ng fixes the following issues: Allow SUSEConnect on read write transactional systems (bsc#1219425)

This update for MozillaFirefox fixes the following issues: Update to Firefox Extended Support Release 115.8.0 ESR (MFSA 2024-06) (bsc#1220048): CVE-2024-1546: Out-of-bounds memory read in networking channels CVE-2024-1547: Alert dialog could have been spoofed on another site CVE-2024-1548: Fullscreen Notification could have been hidden by select element CVE-2024-1549: Custom cursor could obscure the permission dialog CVE-2024-1550: Mouse cursor re-positioned unexpectedly could have led to unintended permission grants CVE-2024-1551: Multipart HTTP Responses would accept the Set-Cookie header in response parts CVE-2024-1552: Incorrect code generation on 32-bit ARM devices

CVE-2024-1553: Memory safety bugs fixed in Firefox 123, Firefox ESR 115.8, and Thunderbird 115.8

Recommend libfido2-udev on codestreams that exist, in order to try to get security keys (e.g. Yubikeys) work out of the box. (bsc#1184272)

This update for postgresql14 fixes the following issues: Upgrade to 14.11: CVE-2024-0985: Tighten security restrictions within REFRESH MATERIALIZED VIEW CONCURRENTLY (bsc#1219679).

This update for postgresql13 fixes the following issues: Upgrade to 13.14: CVE-2024-0985: Tighten security restrictions within REFRESH MATERIALIZED VIEW CONCURRENTLY (bsc#1219679).

This update for openssh fixes the following issues: CVE-2023-51385: Fixed a command injection via user name or host name metacharacters (bsc#1218215).

Remember the state of sshd service during update / removal, to allow cut-over to a different openssh package. bsc#1220110

This update for apache2-modauthopenidc fixes the following issues: CVE-2024-24814: Fixed a denial of service when using OIDCSessionType client-cookie and manipulating cookies (bsc#1219911).

This update for java-180-openjdk fixes the following issues: CVE-2024-20952: Fixed RSA padding issue and timing side-channel attack against TLS (8317547) (bsc#1218911). CVE-2024-20921: Fixed range check loop optimization issue (8314307) (bsc#1218905). CVE-2024-20926: Fixed rbitrary Java code execution in Nashorn (8314284) (bsc#1218906). CVE-2024-20919: Fixed JVM class file verifier flaw allows unverified byte code execution (8314295) (bsc#1218903). CVE-2024-20918: Fixed array out-of-bounds access due to missing range check in C1 compiler (8314468) (bsc#1218907). CVE-2024-20945: Fixed logging of digital signature private keys (8316976) (bsc#1218909). Update to version jdk8u402 (icedtea-3.30.0).

This update for vim fixes the following issues: CVE-2023-48231: Fixed Use-After-Free in winclose() (bsc#1217316). CVE-2023-48232: Fixed Floating point Exception in adjustplinesforskipcol() (bsc#1217320). CVE-2023-48233: Fixed overflow with count for :s command (bsc#1217321). CVE-2023-48234: Fixed overflow in nvzgetcount (bsc#1217324). CVE-2023-48235: Fixed overflow in ex address parsing (bsc#1217326). CVE-2023-48236: Fixed overflow in getnumber (bsc#1217329). CVE-2023-48237: Fixed overflow in shiftline (bsc#1217330). CVE-2023-48706: Fixed heap-use-after-free in exsubstitute (bsc#1217432). CVE-2024-22667: Fixed stack-based buffer overflow in didsetlangmap function in map.c (bsc#1219581). CVE-2023-4750: Fixed heap use-after-free in function btquickfix (bsc#1215005). Updated to version 9.1 with patch level 0111: https://github.com/vim/vim/compare/v9.0.2103...v9.1.0111

This update for sudo fixes the following issues: CVE-2023-42465: Try to make sudo less vulnerable to ROWHAMMER attacks (bsc#1219026).

This update for python3 fixes the following issues: CVE-2023-40217: Fixed bypass TLS handshake on closed sockets (bsc#1214692). CVE-2023-6597: Fixed symlink bug in cleanup (bsc#1219666).

This update for gstreamer-plugins-bad fixes the following issues: CVE-2023-44446: Fixed use-after-free remote code execution vulnerability via MXF file (bsc#1217213).

This update for wpasupplicant fixes the following issues: CVE-2023-52160: Bypassing WiFi Authentication (bsc#1219975).

This update for sudo fixes the following issues: NOTE: This update has been retracted as some sudo functionality was changed incorrectly. CVE-2023-42465: Try to make sudo less vulnerable to ROWHAMMER attacks (bsc#1219026).

This update for openssl-100 fixes the following issues: CVE-2023-2650: Fixed possible denial of service translating ASN.1 object identifiers (bsc#1211430).