This update for glib2 fixes the following issues: CVE-2021-28153: Fixed an issue where symlink targets would be incorrectly created as empty files (bsc#1183533).

This update for rabbitmq-c fixes the following issues: CVE-2023-35789: Fixed insecure credentials submission (bsc#1212499).

This update for bind fixes the following issues: CVE-2023-2828: Fixed denial-of-service against recursive resolvers related to cache-cleaning algorithm (bsc#1212544).

This update for openssl-100 fixes the following issues: CVE-2022-4304: Reworked the fix for the Timing-Oracle in RSA decryption. The previous fix for this timing side channel turned out to cause a severe 2-3x performance regression in the typical use case (bsc#1207534).

This update for sccache fixes the following issues: CVE-2023-1521: Fixed possible code injection via LDPRELOAD to sccache server (bsc#1212407). CVE-2022-31394: Fixed a denial-of-service vulnerability via header list size (bsc#1208553).

This update for perl fixes the following issues: CVE-2023-31484: Enable TLS cert verification in CPAN (bsc#1210999).

This update for mdmonitor fixes the following issues: Update to version 6.6+11+gcbb8940: Fix deadlock because of locking itself (bsc#1197160) Remove the obsolete mddev from mdlist (bsc#1193465) Flush the log file after writing each message Fix locking of dev->lock in lookupmdcomponent() (bsc#1197160) Replace pselect with ppoll (bsc#1161872) Add systemd service file for systemd with increased TaskMax and LimitNOFILE (bsc#1104770) Fix crash on MonitorStatus (bsc#1096363, bsc#1081286) Ignore NewArray message if does not exists yet (bsc#1091619) Fix crash in displaymdstatus (bsc#1081286) Ignore inactive arrays (bsc#1068175, bsc#1079253) Store alias in struct mddev to avoid lookup errors (bsc#1068175,bsc#1079253)

This update for pam fixes the following issues: CVE-2024-22365: Fixed a local denial of service during PAM login due to a missing check during path manipulation (bsc#1218475). Check localtimer() return value to fix crashing (bsc#1217000)

This update for xorg-x11-server fixes the following issues: CVE-2023-6816: Fixed heap buffer overflow in DeviceFocusEvent and ProcXIQueryPointer (bsc#1218582) CVE-2024-0229: Fixed reattaching to different master device may lead to out-of-bounds memory access (bsc#1218583) CVE-2024-21885: Fixed heap buffer overflow in XISendDeviceHierarchyEvent (bsc#1218584) CVE-2024-21886: Fixed heap buffer overflow in DisableDevice (bsc#1218585)

This update for suseconnect-ng fixes the following issues: Update to version 1.5.0 Configure docker credentials for registry authentication Feature: Support usage from Agama + Cockpit for ALP Micro system registration (bsc#1218364) Add --json output option

This update for sanlock fixes the following issues: Update to sanlock 3.8.5 (jsc#PED-7338) python: Replace distutils with setuptools sanlock: fix memory leak of lockspace renewalhistory sanlock: fix pthreadcreate error check sanlock: use helper to set maxsectorskb Add support for 4k sector size (bsc#1215229) Dropped patches: sanlock-oldblkid, suse-fix-link-errors, sanlock-python3 Add hardening to systemd services (bsc#1181400)

This update for Java fixes the following issues: apache-commons-daemon was updated from version 1.3.2 to 1.3.4: Version 1.3.4: Procrun: Configured stack size now applies to the main thread when running in JVM mode. Fixes DAEMON-451. Procrun: If the specified log directory does not exist, attempt to create any missing parent directories, as well as the specified directory, when the service starts. Fixes DAEMON-452. Procrun: Allow Windows service dependencies to be managed by Procrun or by 'sc config ...'. Fixes DAEMON-458. jsvc: Fix DaemonController.reload() only working the first time it is called. Fixes DAEMON-459. Thanks to Klaus Malorny. jsvc: Remove incorrent definition 'supportedos' which defined in psupport.m4 file to fix jsvc build error on riscv64. Version 1.3.3: Procrun: ensure all child processes are cleaned up if the service does not stop cleanly. Procrun: Fix creation of duplicate ACL entries on some Windows platforms. Updates: Bump actions/cache from 3.0.8 to 3.0.11. Bump actions/checkout from 3.0.2 to 3.1.0. Bump actions/setup-java from 3.5.1 to 3.6.0. Bump spotbugs-maven-plugin from 4.7.2.0 to 4.7.3.0. aqute-bnd was updated from version 5.2.0 to 6.3.1: For the full list of changes please consult the following: https://github.com/bndtools/bnd/wiki/Changes-in-6.3.1 https://github.com/bndtools/bnd/wiki/Changes-in-6.3.0 https://github.com/bndtools/bnd/wiki/Changes-in-6.2.0 https://github.com/bndtools/bnd/wiki/Changes-in-6.1.0 https://github.com/bndtools/bnd/wiki/Changes-in-6.0.0 https://github.com/bndtools/bnd/wiki/Changes-in-5.3.0 tomcat-jakartaee-migration: New package implementation of tomcat-jakartaee-migration at version 1.0.7 libtcnative-1-0 was updated from version 1.2.22 to 1.2.38: Changes of version 1.2.22 to 1.2.38: Align default pass phrase prompt with HTTPd. Fix memory leak in SNI processing. Update the recommended minimum version of OpenSSL to 1.1.1v. Update the recommended minimum version of APR to 1.7.4. Document the TLS rengotiation behaviour. Add HOWTO-RELEASE.txt that describes the release process. Refactor library initialization so it is compatible with Tomcat 10.1.x onwards where a number of Java classes have been removed. Map the OpenSSL 3.x FIPS behaviour to the OpenSSL 1.x API to allow clients to determine if the FIPS provider is being used when Tomcat Native is compiled against OpenSSL 3.x. Fix crash when attempting to read TLS session ID after a handshake failure. Enable downloaddeps.sh to be called from any directory. Fix release script so it works with the current git layout. Correct previous fix that enabled building to continue with OpenSSL 3.x. Remove remaining reference to pkg-config which is no longer included in the Tomcat Native distribution. Additional changes required to provided support for using OpenSSL Engines that use proprietary key formats. Correct handling of WINVER in make file to use correct constant for Windows 7. Add constants for Windows 8, Windows 8.1 and Windows 10. Rename WINNT to WIN2k as it is used for Windows 2000 upwards, not Windows NT upwards. Add a patch for APR that fixes an issue where some Windows systems in some configurations would only listen on IPv6 addresses on dual stack systems even though configured to listen on both IPv6 and IPv4 addresses. Correct a regression in the fix for 65181 that prevented an error message from being displayed if an invalid key file was provided and no OpenSSL Engine was configured. Improve support for using OpenSSL Engines that use proprietary key formats. Enable building to continue against OpenSSL 3.x and 1.1.1. Incomplete name mangling fix for C++ compilers in tcnapi.h. Improve OS-specific header include for native thread id. Disable keylog callback support for LibreSSL. Add support for SSLContext.addChainCertificateRaw() with LibreSSL 2.9.1 and up. Add support for HP-UX's lwpself() in our sslthreadid(void). Remove default option passed for rpath to linker on HP-UX. Add an option to allow the OCSP responder check to be bypassed. Note that if OCSP is enabled, a missing responder is now treated as an error. Fix compilation with LibreSSL. libtcnative does not compile with OpenSSL < 1.1.0 and APR w/o threading support. Correct configure message for OpenSSL libdir. Clean up install target. configure output for OpenSSL wrong/incomplete sometimes. Drop obsolete build time workarounds for HP-UX. Add support for FreeBSD's pthreadgetthreadidnp() in our sslthreadid(void). Introduce tcngetthreadid(void) to reduce code duplication. Fix linking against OpenSSL in non-standard locations on FreeBSD.

This update for ceph fixes the following issues: Fix FTBFS on gcc 13 (bsc#1201088) Fix FTBFS on s390x (bsc#1211090) ceph-volume: Fix regression in activate (bsc#1210243, bsc#1210314) cephadm: Fix NFS haproxy failover if active node disappears (bsc#1209621) cephadm: Mount host /etc/hosts for daemon containers in podman deployments (bsc#1210719) cmake: Patch boost source to support python 3.11 (bsc#1210944) mgr: Don't dump global config holding gil (bsc#1199880) mgr/cephadm: Fix handling of mgr upgrades with 3 or more mgrs (bsc#1210153) mgr/dashboard: allow to pass controls on iscsi disk create (bsc#1208820) mgr/dashboard: Fix SSO error: 'str' object has no attribute 'decode' (bsc#1210784)

This update for pesign fixes the following issue: Create pesign-systemd subpackage to remove systemd dependency (jsc#PED-7256)

This update for wireshark fixes the following issues: Updated to Wireshark 3.6.20:

CVE-2024-0208: Fixed a crash in the GVCP dissector (bsc#1218504).

CVE-2024-0209: Fixed a crash in the IEEE 1609.2 dissector (bsc#1218505).

This update for libxcrypt fixes the following issues: fix variable name for datamember [bsc#1215496] added patches fix https://github.com/besser82/libxcrypt/commit/b212d601549a0fc84cbbcaf21b931f903787d7e2

This update for raptor fixes the following issues: rebuild to use ICU 73 (jsc#PED-6193)

This update for libsolv, zypper, libzypp fixes the following issues: Expand RepoVars in URLs downloading a .repo file (bsc#1212160) Fix search/info commands ignoring --ignore-unknown (bsc#1217593) CheckAccessDeleted: fix 'running in container' filter (bsc#1218291) Open rpmdb just once during execution of %posttrans scripts (bsc#1216412) Make sure reboot-needed is remembered until next boot (bsc#1217873) Stop using boost version 1 timer library (bsc#1215294) Updated to version 0.7.27 Add zstd support for the installcheck tool Add putinowndirpool cache to make file list handling in repowrite much faster Do not use deprecated headerUnload with newer rpm versions Support complex deps in SOLVABLEPREREQIGNOREINST Fix minimization not prefering installed packages in some cases Reduce memory usage in repoupdateinfoxml Fix lock-step interfering with architecture selection Fix choice rule handing for package downgrades Fix complex dependencies with an "else" part sometimes leading to unsolved dependencies

This update for mozilla-nss fixes the following issues: Mozilla NSS was updated to NSS 3.90.1: regenerate NameConstraints test certificates. add OSXSAVE and XCR0 tests to AVX2 detection.

This update for net-snmp fixes the following issues: Update to net-snmp-5.9.4 (bsc#1214364). libsnmp:

Remove the SNMPSWIPEMEM() macro Remove this macro since it is not used in the Net-SNMP code base. DISPLAY-HINT fixes Miscellanious improvements to the transports Handle multiple oldEngineID configuration lines fixes for DNS names longer than 63 characters

agent:

Added a ignoremount configuration option for the HOST-MIB disallow SETs with a NULL varbind fix the --enable-minimalist build

apps:

snmpset: allow SET with NULL varbind for testing snmptrapd: improved MySQL logging code

general:

configure: Remove -Wno-deprecated as it is no longer needed miscellanious ther bug fixes, build fixes and cleanups

Re-add support for hostname netgroups that was removed accidentally and previously added with FATE#316305 (bsc#1207697). '@hostgroup' can be specified for multiple hosts

Hardening systemd services setting "ProtectHome=true" caused home directory size and allocation to be listed incorrectly (bsc#1206044).

This update for gnustep-base fixes the following issues: Build against ICU 73.

This update for samba fixes the following issues: Add "net offlinejoin composeodj" command (bsc#1214076)

This update for procps fixes the following issues: Update procps to 3.3.17 (jsc#PED-3244 jsc#PED-6369)

For support up to 2048 CPU as well (bsc#1185417)

Allow -´ as leading character to ignore possible errors on systctl entries (bsc#1209122) Get the first CPU summary correct (bsc#1121753) Enable pidof for SLE-15 as this is provided by sysvinit-tools Use a check on syscall NRpidfdopen to decide if the pwait tool and its manual page will be build Do not truncate output of w with option -n Prefer logind over utmp (jsc#PED-3144) Don't install translated man pages for non-installed binaries (uptime, kill). Fix directory for Ukrainian man pages translations.

Move localized man pages to lang package.

Update to procps-ng-3.3.17

library: Incremented to 8:3:0 (no removals or additions, internal changes only)

all: properly handle utf8 cmdline translations kill: Pass int to signalled process pgrep: Pass int to signalled process pgrep: Check sanity of SGARGMAX pgrep: Add older than selection pidof: Quiet mode pidof: show worker threads ps.1: Mention stime alias ps: check also match on truncated 16 char comm names ps: Add exe output option ps: A lot more sorting available pwait: New command waits for a process sysctl: Match systemd directory order sysctl: Document directory order top: ensure config file backward compatibility top: add command line 'e' for symmetry with 'E' top: add '4' toggle for two abreast cpu display top: add '!' toggle for combining multiple cpus top: fix potential SEGV involving -p switch vmstat: Wide mode gives wider proc columns watch: Add environment variable for interval watch: Add no linewrap option watch: Support more colors

free,uptime,slabtop: complain about extra ops

Package translations in procps-lang.

Fix pgrep: cannot allocate 4611686018427387903 bytes when ulimit -s is unlimited.

Enable pidof by default

Update to procps-ng-3.3.16

library: Increment to 8:2:0 No removals or functions Internal changes only, so revision is incremented. Previous version should have been 8:1:0 not 8:0:1

docs: Use correct symbols for -h option in free.1

docs: ps.1 now warns about command name length docs: install translated man pages pgrep: Match on runstate snice: Fix matching on pid top: can now exploit 256-color terminals top: preserves 'other filters' in configuration file top: can now collapse/expand forest view children top: parent %CPU time includes collapsed children top: improve xterm support for vim navigation keys top: avoid segmentation fault at program termination "ps -C" does not allow anymore an argument longer than 15 characters (bsc#1158830)

This update for postfix fixes the following issues: CVE-2023-51764: Fixed SMTP smuggling attack (bsc#1218304).

This update for webkit2gtk3 fixes the following issues: CVE-2023-42890: Fixed processing malicious web content may lead to arbitrary code execution (bsc#1218033). CVE-2023-42883: Fixed processing a malicious image may lead to a denial-of-service (bsc#1218032). CVE-2023-41074: Fixed use-after-free in the MediaRecorder API of the WebKit GStreamer-based ports (bsc#1215870). CVE-2023-40451, CVE-2023-41074: Update to version 2.42.4 (bsc#1215868).

This update for libssh2org fixes the following issues: CVE-2023-48795: Fixed prefix truncation breaking ssh channel integrity (Terrapin Attack) (bsc#1218127).

This update for gnutls fixes the following issues: CVE-2023-5981: Fixed timing side-channel inside RSA-PSK key exchange (bsc#1217277).

This update for gstreamer-plugins-bad fixes the following issues: CVE-2023-44446: Fixed GStreamer MXF File Parsing Use-After-Free (bsc#1217213). CVE-2023-40475: Fixed GStreamer MXF File Parsing Integer Overflow (bsc#1215792).

This update for xorg-x11-server fixes the following issues: CVE-2023-6377: Fixed out-of-bounds memory write in XKB button actions (bsc#1217765).

This update for docker, rootlesskit fixes the following issues: docker: Update to Docker 24.0.7-ce. See upstream changelong online at https://docs.docker.com/engine/release-notes/24.0/#2407>. bsc#1217513

Deny containers access to /sys/devices/virtual/powercap by default.

CVE-2020-8694 bsc#1170415 CVE-2020-8695 bsc#1170446 CVE-2020-12912 bsc#1178760

Update to Docker 24.0.6-ce. See upstream changelong online at https://docs.docker.com/engine/release-notes/24.0/#2406 . bsc#1215323

Add a docker.socket unit file, but with socket activation effectively disabled to ensure that Docker will always run even if you start the socket individually. Users should probably just ignore this unit file. bsc#1210141

Update to Docker 24.0.5-ce. See upstream changelong online at https://docs.docker.com/engine/release-notes/24.0/#2405 . bsc#1213229 This update ships docker-rootless support in the docker-rootless-extra package. (jsc#PED-6180) rootlesskit: new package, for docker rootless support. (jsc#PED-6180)