This update for glib2 fixes the following issues: CVE-2021-28153: Fixed an issue where symlink targets would be incorrectly created as empty files (bsc#1183533).

This update for bind fixes the following issues: CVE-2023-2828: Fixed denial-of-service against recursive resolvers related to cache-cleaning algorithm (bsc#1212544).

This update for perl fixes the following issues: CVE-2023-31484: Enable TLS cert verification in CPAN (bsc#1210999).

This update for ecj fixes the following issues: Upgradeded ecj to eclipse version 4.23, to be compatible with Java 17 tomcat webapps (jsc#PED-2979) Use the bundled javax17api.jar stubs, but don't distribute them

This update for google-guice fixes the following issues: google-guice was updated from version 4.1 to 5.1.0: Changes of version 4.2: Added Java 9 and JPMS support Multibindings are now in the Guice core artifact. The multibindings artifact is empty to prevent confusion during upgrading and will be removed in a later release. Improved the performance of guice provisioning (by about 20%) by changing the way errors are reported. Guice will no longer report multiple errors during provisioning (Guice still reports multiple errors during injector creation). Improved error messages for a missing binding. AbstractModule.configure() is non-abstract to allow modules with only @Provides/@ProvidesIntoSet/... methods. Added a CheckedProviders class. Changed the way Singletons work to not rely on ThreadLocals nor WeakReferences. Added MapBinderBinding.getEntries(Iterable). Deprecated ProvisionListener.ProvisionInvocation .getDependencyChain(). Ensure that Struts interceptors are populated even if they are created after the injector (Fixes #1081, #1075). Added support for multibindings with annotations in the Guice DaggerMethodScanner.

Changes of version 4.2.1: Added Java 10 support (updated cglib & asm). Minor updates to the testlib extension.

Changes of version 4.2.2: Added Java 11 support (updated cglib & asm)

Changes of version 4.2.3: Added Java 14 support (updated asm). Added Injector.getElements API, to expose all Element SPI types from the Injector. Added Injector.getAllMembersInjectorInjectionPoints API, to expose injection points created by arbitrary members injection. Added getAlternateKeys to Multibinder SPI types (MultibinderBinding, MapBinderBinding, OptionalBinderBinding), to explicitly list the other keys these bindings are available as. Scan for (and bind) @Provides-like methods in a consistent ordering, rather than relying on the non-deterministic Class.getDeclaredMembers ordering. Updated DaggerAdapter to work with newer dagger code. Fixed a subtle bug with eager singleton evaluation. Updated @RequestScope's scope annotation to the JSR330 @Scope, so it can be reused by non-Guice DI systems. Clarified the error message when an injectable constructor is missing. Added deprecated overloads to various Modules methods, to make it clearer when calling them is unnecessary. Added factory methods to Modules for common Binder configuration methods, to make it easier to configure them.

Changes of version 5.0.1: Added Java 15 support (updated asm and bug fixes). Removed cglib as a core dependency. Improved error messages. Improved support for using Guice with Kotlin. Added a mechanism to restrict who can bind types or annotations, to allow library authors to control their bindings. Removed no-aop build variant. Fixed 'illegal reflective access' warnings.

Changes of version 5.1.0: Added support for Java 17.

Generate the ant build system using the maven pom files.

This update for perl-Spreadsheet-ParseExcel fixes the following issues: CVE-2023-7101: Fixed a command injection issue when parsing an untrusted spreadsheet (bsc#1218414).

This update for pam fixes the following issues: CVE-2024-22365: Fixed a local denial of service during PAM login due to a missing check during path manipulation (bsc#1218475). Check localtimer() return value to fix crashing (bsc#1217000)

This update for osgi-annotation, osgi-compendium, osgi-core fixes the following issues: Regenerate the bundle manifest to correspond to what maven-bundle-plugin generates during the maven build

This update for replacer, velocity fixes the following issues: replacer: Port from commons-lang to commons-lang3 velocity: Reduce considerably the dependencies graph Port from apache-commons-lang to apache-commons-lang3 Make JDK's own logging provider as default

This update for Java fixes the following issues: apache-commons-daemon was updated from version 1.3.2 to 1.3.4: Version 1.3.4: Procrun: Configured stack size now applies to the main thread when running in JVM mode. Fixes DAEMON-451. Procrun: If the specified log directory does not exist, attempt to create any missing parent directories, as well as the specified directory, when the service starts. Fixes DAEMON-452. Procrun: Allow Windows service dependencies to be managed by Procrun or by 'sc config ...'. Fixes DAEMON-458. jsvc: Fix DaemonController.reload() only working the first time it is called. Fixes DAEMON-459. Thanks to Klaus Malorny. jsvc: Remove incorrent definition 'supportedos' which defined in psupport.m4 file to fix jsvc build error on riscv64. Version 1.3.3: Procrun: ensure all child processes are cleaned up if the service does not stop cleanly. Procrun: Fix creation of duplicate ACL entries on some Windows platforms. Updates: Bump actions/cache from 3.0.8 to 3.0.11. Bump actions/checkout from 3.0.2 to 3.1.0. Bump actions/setup-java from 3.5.1 to 3.6.0. Bump spotbugs-maven-plugin from 4.7.2.0 to 4.7.3.0. aqute-bnd was updated from version 5.2.0 to 6.3.1: For the full list of changes please consult the following: https://github.com/bndtools/bnd/wiki/Changes-in-6.3.1 https://github.com/bndtools/bnd/wiki/Changes-in-6.3.0 https://github.com/bndtools/bnd/wiki/Changes-in-6.2.0 https://github.com/bndtools/bnd/wiki/Changes-in-6.1.0 https://github.com/bndtools/bnd/wiki/Changes-in-6.0.0 https://github.com/bndtools/bnd/wiki/Changes-in-5.3.0 tomcat-jakartaee-migration: New package implementation of tomcat-jakartaee-migration at version 1.0.7 libtcnative-1-0 was updated from version 1.2.22 to 1.2.38: Changes of version 1.2.22 to 1.2.38: Align default pass phrase prompt with HTTPd. Fix memory leak in SNI processing. Update the recommended minimum version of OpenSSL to 1.1.1v. Update the recommended minimum version of APR to 1.7.4. Document the TLS rengotiation behaviour. Add HOWTO-RELEASE.txt that describes the release process. Refactor library initialization so it is compatible with Tomcat 10.1.x onwards where a number of Java classes have been removed. Map the OpenSSL 3.x FIPS behaviour to the OpenSSL 1.x API to allow clients to determine if the FIPS provider is being used when Tomcat Native is compiled against OpenSSL 3.x. Fix crash when attempting to read TLS session ID after a handshake failure. Enable downloaddeps.sh to be called from any directory. Fix release script so it works with the current git layout. Correct previous fix that enabled building to continue with OpenSSL 3.x. Remove remaining reference to pkg-config which is no longer included in the Tomcat Native distribution. Additional changes required to provided support for using OpenSSL Engines that use proprietary key formats. Correct handling of WINVER in make file to use correct constant for Windows 7. Add constants for Windows 8, Windows 8.1 and Windows 10. Rename WINNT to WIN2k as it is used for Windows 2000 upwards, not Windows NT upwards. Add a patch for APR that fixes an issue where some Windows systems in some configurations would only listen on IPv6 addresses on dual stack systems even though configured to listen on both IPv6 and IPv4 addresses. Correct a regression in the fix for 65181 that prevented an error message from being displayed if an invalid key file was provided and no OpenSSL Engine was configured. Improve support for using OpenSSL Engines that use proprietary key formats. Enable building to continue against OpenSSL 3.x and 1.1.1. Incomplete name mangling fix for C++ compilers in tcnapi.h. Improve OS-specific header include for native thread id. Disable keylog callback support for LibreSSL. Add support for SSLContext.addChainCertificateRaw() with LibreSSL 2.9.1 and up. Add support for HP-UX's lwpself() in our sslthreadid(void). Remove default option passed for rpath to linker on HP-UX. Add an option to allow the OCSP responder check to be bypassed. Note that if OCSP is enabled, a missing responder is now treated as an error. Fix compilation with LibreSSL. libtcnative does not compile with OpenSSL < 1.1.0 and APR w/o threading support. Correct configure message for OpenSSL libdir. Clean up install target. configure output for OpenSSL wrong/incomplete sometimes. Drop obsolete build time workarounds for HP-UX. Add support for FreeBSD's pthreadgetthreadidnp() in our sslthreadid(void). Introduce tcngetthreadid(void) to reduce code duplication. Fix linking against OpenSSL in non-standard locations on FreeBSD.

This update for eclipse-jgit, jsch fixes the following issues: Security fix: - CVE-2023-4759: Fixed an arbitrary file overwrite which might have occurred with a specially crafted git repository and a case-insensitive filesystem. (bsc#1215298) Other fixes: jsch was updated to version 0.2.9: - Added support for various algorithms - Migrated from com.jcraft:jsch to com.github.mwiede:jsch fork (bsc#1211955): Alias to the old artifact since the new one is drop-in replacement Keep the old OSGi bundle symbolic name to avoid extensive patching of eclipse stack - Updated to version 0.2.9: For the full list of changes please consult the upstream changelogs below for each version updated: + https://github.com/mwiede/jsch/releases/tag/jsch-0.2.9 + https://github.com/mwiede/jsch/releases/tag/jsch-0.2.8 + https://github.com/mwiede/jsch/releases/tag/jsch-0.2.7 + https://github.com/mwiede/jsch/releases/tag/jsch-0.2.6 + https://github.com/mwiede/jsch/releases/tag/jsch-0.2.5 + https://github.com/mwiede/jsch/releases/tag/jsch-0.2.4 + https://github.com/mwiede/jsch/releases/tag/jsch-0.2.3 + https://github.com/mwiede/jsch/releases/tag/jsch-0.2.2 + https://github.com/mwiede/jsch/releases/tag/jsch-0.2.1 + https://github.com/mwiede/jsch/releases/tag/jsch-0.2.0 + https://github.com/mwiede/jsch/releases/tag/jsch-0.1.71 + https://github.com/mwiede/jsch/releases/tag/jsch-0.1.70 + https://github.com/mwiede/jsch/releases/tag/jsch-0.1.69 + https://github.com/mwiede/jsch/releases/tag/jsch-0.1.68 + https://github.com/mwiede/jsch/releases/tag/jsch-0.1.67 + https://github.com/mwiede/jsch/releases/tag/jsch-0.1.66 + https://github.com/mwiede/jsch/releases/tag/jsch-0.1.65 + https://github.com/mwiede/jsch/releases/tag/jsch-0.1.64 + https://github.com/mwiede/jsch/releases/tag/jsch-0.1.63 + https://github.com/mwiede/jsch/releases/tag/jsch-0.1.62 + https://github.com/mwiede/jsch/releases/tag/jsch-0.1.61 + https://github.com/mwiede/jsch/releases/tag/jsch-0.1.60 + https://github.com/mwiede/jsch/releases/tag/jsch-0.1.59 + https://github.com/mwiede/jsch/releases/tag/jsch-0.1.58 + https://github.com/mwiede/jsch/releases/tag/jsch-0.1.57 + https://github.com/mwiede/jsch/releases/tag/jsch-0.1.56 eclipse-jgit: Craft the jgit script from the real Main class of the jar file instead of using a jar launcher (bsc#1209646)

This update for libsolv, zypper, libzypp fixes the following issues: Expand RepoVars in URLs downloading a .repo file (bsc#1212160) Fix search/info commands ignoring --ignore-unknown (bsc#1217593) CheckAccessDeleted: fix 'running in container' filter (bsc#1218291) Open rpmdb just once during execution of %posttrans scripts (bsc#1216412) Make sure reboot-needed is remembered until next boot (bsc#1217873) Stop using boost version 1 timer library (bsc#1215294) Updated to version 0.7.27 Add zstd support for the installcheck tool Add putinowndirpool cache to make file list handling in repowrite much faster Do not use deprecated headerUnload with newer rpm versions Support complex deps in SOLVABLEPREREQIGNOREINST Fix minimization not prefering installed packages in some cases Reduce memory usage in repoupdateinfoxml Fix lock-step interfering with architecture selection Fix choice rule handing for package downgrades Fix complex dependencies with an "else" part sometimes leading to unsolved dependencies

This update for postfix fixes the following issues: CVE-2023-51764: Fixed SMTP smuggling attack (bsc#1218304).

This update for webkit2gtk3 fixes the following issues: CVE-2023-42890: Fixed processing malicious web content may lead to arbitrary code execution (bsc#1218033). CVE-2023-42883: Fixed processing a malicious image may lead to a denial-of-service (bsc#1218032). CVE-2023-41074: Fixed use-after-free in the MediaRecorder API of the WebKit GStreamer-based ports (bsc#1215870). CVE-2023-40451, CVE-2023-41074: Update to version 2.42.4 (bsc#1215868).

This update for gstreamer-plugins-bad fixes the following issues: CVE-2023-44446: Fixed GStreamer MXF File Parsing Use-After-Free (bsc#1217213). CVE-2023-40475: Fixed GStreamer MXF File Parsing Integer Overflow (bsc#1215792).

This update for docker, rootlesskit fixes the following issues: docker: Update to Docker 24.0.7-ce. See upstream changelong online at https://docs.docker.com/engine/release-notes/24.0/#2407>. bsc#1217513

Deny containers access to /sys/devices/virtual/powercap by default.

CVE-2020-8694 bsc#1170415 CVE-2020-8695 bsc#1170446 CVE-2020-12912 bsc#1178760

Update to Docker 24.0.6-ce. See upstream changelong online at https://docs.docker.com/engine/release-notes/24.0/#2406 . bsc#1215323

Add a docker.socket unit file, but with socket activation effectively disabled to ensure that Docker will always run even if you start the socket individually. Users should probably just ignore this unit file. bsc#1210141

Update to Docker 24.0.5-ce. See upstream changelong online at https://docs.docker.com/engine/release-notes/24.0/#2405 . bsc#1213229 This update ships docker-rootless support in the docker-rootless-extra package. (jsc#PED-6180) rootlesskit: new package, for docker rootless support. (jsc#PED-6180)

This update for MozillaFirefox fixes the following issues: Firefox Extended Support Release 115.6.0 ESR changelog-entry (bsc#1217974). CVE-2023-6856: Heap-buffer-overflow affecting WebGL DrawElementsInstanced method with Mesa VM driver (bmo#1843782). CVE-2023-6857: Symlinks may resolve to smaller than expected buffers (bmo#1796023). CVE-2023-6858: Heap buffer overflow in nsTextFragment (bmo#1826791). CVE-2023-6859: Use-after-free in PRGetIdentitiesLayer (bmo#1840144). CVE-2023-6860: Potential sandbox escape due to VideoBridge lack of texture validation (bmo#1854669). CVE-2023-6861: Heap buffer overflow affected nsWindow::PickerOpen(void) in headless mode (bmo#1864118). CVE-2023-6862: Use-after-free in nsDNSService (bsc#1868042). CVE-2023-6863: Undefined behavior in ShutdownObserver() (bmo#1868901). CVE-2023-6864: Memory safety bugs fixed in Firefox 121, Firefox ESR 115.6, and Thunderbird 115.6. CVE-2023-6865: Potential exposure of uninitialized data in EncryptingOutputStream (bmo#1864123).

CVE-2023-6867: Clickjacking permission prompts using the popup transition (bmo#1863863).

Fixed: Various security fixes and other quality improvements MFSA 2023-50 (bsc#1217230)

CVE-2023-6204 (bmo#1841050) Out-of-bound memory access in WebGL2 blitFramebuffer CVE-2023-6205 (bmo#1854076) Use-after-free in MessagePort::Entangled CVE-2023-6206 (bmo#1857430) Clickjacking permission prompts using the fullscreen transition CVE-2023-6207 (bmo#1861344) Use-after-free in ReadableByteStreamQueueEntry::Buffer CVE-2023-6208 (bmo#1855345) Using Selection API would copy contents into X11 primary selection. CVE-2023-6209 (bmo#1858570) Incorrect parsing of relative URLs starting with "///" CVE-2023-6212 (bmo#1658432, bmo#1820983, bmo#1829252, bmo#1856072, bmo#1856091, bmo#1859030, bmo#1860943, bmo#1862782) Memory safety bugs fixed in Firefox 120, Firefox ESR 115.5, and Thunderbird 115.5

This update for mariadb fixes the following issues: CVE-2023-22084: Fixed an easily exploitable vulnerability that allowed high privileged attacker with network access via multiple protocols to compromise MySQL Server (bsc#1217405).

This update for webkit2gtk3 fixes the following issues: Update to version 2.42.3 (bsc#1217844): Fix flickering while playing videos with DMA-BUF sink. Fix color picker being triggered in the inspector when typing "tan". Do not special case the "sans" font family name. Fix build failure with libxml2 version 2.12.0 due to an API change. Fix several crashes and rendering issues. Security fixes: CVE-2023-42916, CVE-2023-42917.

The SUSE Linux Enterprise 15 SP3 kernel was updated to receive various security and bugfixes. The following security bugs were fixed: CVE-2023-39197: Fixed a out-of-bounds read in nfconntrackdccppacket() (bsc#1216976). CVE-2023-6176: Fixed a denial of service in the cryptographic algorithm scatterwalk functionality (bsc#1217332). CVE-2023-45863: Fixed a out-of-bounds write in fillkobjpath() (bsc#1216058). CVE-2023-45871: Fixed an issue in the IGB driver, where the buffer size may not be adequate for frames larger than the MTU (bsc#1216259). CVE-2023-39198: Fixed a race condition leading to use-after-free in qxlmodedumbcreate() (bsc#1216965). CVE-2023-31083: Fixed race condition in hciuartttyioctl (bsc#1210780). CVE-2023-5717: Fixed a heap out-of-bounds write vulnerability in the Performance Events component (bsc#1216584). The following non-security bugs were fixed: ALSA: hda: Disable power-save on KONTRON SinglePC (bsc#1217140). Call flushdelayedfput() from nfsd main-loop (bsc#1217408). net: mana: Configure hwc timeout from hardware (bsc#1214037). net: mana: Fix MANA VF unload when hardware is unresponsive (bsc#1214764). powerpc: Do not clobber f0/vs0 during fp|altivec register save (bsc#1217780).

This update for podman fixes the following issues: Build against latest stable Go version (bsc#1210299)

This update for wireless-regdb fixes the following issues: Update all regulatory rules(v.20230901) for various countries (bsc#1029961)

This update for suse-build-key fixes the following issues: This update runs a import-suse-build-key script. The previous libzypp-post-script based installation is replaced with a systemd timer and service (bsc#1217215 bsc#1216410 jsc#PED-2777). - suse-build-key-import.service - suse-build-key-import.timer It imports the future SUSE Linux Enterprise 15 4096 bit RSA key primary and reserve keys. After successful import the timer is disabled. To manually import them you can also run: rpm --import /usr/lib/rpm/gnupg/keys/gpg-pubkey-3fa1d6ce-63c9481c.asc rpm --import /usr/lib/rpm/gnupg/keys/gpg-pubkey-d588dc46-63c939db.asc

This update for kernel-firmware fixes the following issues: Update AMD ucode to 20231030 (bsc#1215831): CVE-2022-23820: Failure to validate the AMD SMM communication buffer may allow an attacker to corrupt the SMRAM potentially leading to arbitrary code execution. CVE-2021-46774: Insufficient input validation in ABL may enable a privileged attacker to perform arbitrary DRAM writes, potentially resulting in code execution and privilege escalation. CVE-2023-20533: Insufficient DRAM address validation in System Management Unit (SMU) may allow an attacker using DMA to read/write from/to invalid DRAM address potentially resulting in denial-of-service. 0 CVE-2023-20519: A Use-After-Free vulnerability in the management of an SNP guest context page may allow a malicious hypervisor to masquerade as the guest's migration agent resulting in a potential loss of guest integrity. CVE-2023-20566: Improper address validation in ASP with SNP enabled may potentially allow an attacker to compromise guest memory integrity. CVE-2023-20521: TOCTOU in the ASP Bootloader may allow an attacker with physical access to tamper with SPI ROM records after memory content verification, potentially leading to loss of confidentiality or a denial of service. CVE-2021-46766: Improper clearing of sensitive data in the ASP Bootloader may expose secret keys to a privileged attacker accessing ASP SRAM, potentially leading to a loss of confidentiality. CVE-2022-23830: SMM configuration may not be immutable, as intended, when SNP is enabled resulting in a potential limited loss of guest memory integrity. CVE-2023-20526: Insufficient input validation in the ASP Bootloader may enable a privileged attacker with physical access to expose the contents of ASP memory potentially leading to a loss of confidentiality. CVE-2021-26345: Failure to validate the value in APCB may allow an attacker with physical access to tamper with the APCB token to force an out-of-bounds memory read potentially resulting in a denial of service. CVE-2023-20592: Issue with INVD instruction aka CacheWarpAttack (bsc#1215823).

This update for scap-security-guide fixes the following issues: scap-security-guide was updated to 0.1.70 (jsc#ECO-3319) Add openembedded distro support Remove DRAFT wording for OpenShift STIG Remove test-function-checkplaybookfileremovedandadded test scap-security-guide: Add Poky support Also various SUSE profile bug fixes have been applied.

This update for javapackages-tools fixes the following issues: Add requirement for python-xml as it is needed by some scripts Ensure reproducibility of built binaries Minor bug fixes

This update of icu fixes the following issue: missing 32bit libraries in SLES 15 SP3 were added, required by xerces-c 32bit.

This update for python-apache-libcloud fixes the following issues: listnodes() function in the Azure ARM driver does not handle pagination and does not return all the VMs for a subscription (bsc#1214808)

This update for gstreamer-plugins-bad fixes the following issues: CVE-2023-40474: Fixed integer overflow causing out of bounds writes when handling invalid uncompressed video (bsc#1215796). CVE-2023-40476: Fixed possible overflow using maxsublayersminus1 (bsc#1215793).

This update for vim fixes the following issues: CVE-2023-5344: Heap-based Buffer Overflow in vim prior to 9.0.1969 (bsc#1215940) CVE-2023-5441: segfault in exmode when redrawing (bsc#1216001) CVE-2023-5535: use-after-free from bufcontentschanged() (bsc#1216167) CVE-2023-46246: Integer Overflow in :history command (bsc#1216696)