This update for sudo fixes the following issues: NOTE: This update has been retracted as some logic was not correct. CVE-2023-42465: Try to make sudo less vulnerable to ROWHAMMER attacks (bsc#1219026).

This update for wpasupplicant fixes the following issues: CVE-2023-52160: Bypassing WiFi Authentication (bsc#1219975).

This update for timezone fixes the following issues: Update to version 2024a Kazakhstan unifies on UTC+5 Palestine springs forward a week later than previously predicted in 2024 and 2025 Asia/HoChiMinh's 1955-07-01 transition occurred at 01:00 not 00:00 From 1947 through 1949, Toronto's transitions occurred at 02:00 not 00:00 In 1911 Miquelon adopted standard time on June 15, not May 15 The FROM and TO columns of Rule lines can no longer be "minimum" localtime no longer mishandle some timestamps strftime %s now uses tmgmtoff if available Ittoqqortoormiit, Greenland changes time zones on 2024-03-31 Vostok, Antarctica changed time zones on 2023-12-18 Casey, Antarctica changed time zones five times since 2020 Code and data fixes for Palestine timestamps starting in 2072 A new data file zonenow.tab for timestamps starting now Much of Greenland changed its standard time from -03 to -02 on 2023-03-25 localtime.c no longer mishandles TZif files that contain a single transition into a DST regime tzselect no longer creates temporary files tzselect no longer mishandles the following: Spaces and most other special characters in BUGEMAIL, PACKAGE, TZDIR, and VERSION. TZ strings when using mawk 1.4.3, which mishandles regular expressions of the form /X{2,}/ ISO 6709 coordinates when using an awk that lacks the GNU extension of newlines in -v option-arguments Non UTF-8 locales when using an iconv command that lacks the GNU //TRANSLIT extension zic no longer mishandles data for Palestine after the year 2075

This update for sudo fixes the following issues: CVE-2023-42465: Try to make sudo less vulnerable to ROWHAMMER attacks (bsc#1219026).

This update for wicked fixes the following issues: ifreload: VLAN changes require device deletion (bsc#1218927) ifcheck: fix config changed check (bsc#1218926) client: fix exit code for no-carrier status (bsc#1219265) dhcp6: omit the SOREUSEPORT option (bsc#1215692) duid: fix comment for v6time rtnl: fix peer address parsing for non ptp-interfaces system-updater: Parse updater format from XML configuration to ensure install calls can run team: add new options like linkwatchpolicy (jsc#PED-7183) Fix memory leaks in dbus variant destroy and fsm free xpath: allow underscore in node identifier vxlan: don't format unknown rtnl attrs (bsc#1219751)

This update for libssh fixes the following issues: Fix regression parsing IPv6 addresses provided as hostname (bsc#1220385)

This update for libindicator7, libdbusmenu-gtk4 fixes the following issues: Add missing packages to Package Hub 15 SP5 (bsc#1219244, jsc#MSC-751)

This update for nftables fixes the following issues: Enable python311 module (bsc#1219253).

This update for gcc12 fixes the following issues: CVE-2023-4039: Fixed incorrect stack protector for C99 VLAs on Aarch64 (bsc#1214052).

This update for samba fixes the following issues: CVE-2022-2127: Fixed issue where lmresplen was not checked properly in winbinddpamauthcrapsend (bsc#1213174). CVE-2023-34966: Fixed samba spotlight mdssvc RPC Request Infinite Loop Denial-of-Service Vulnerability (bsc#1213173). CVE-2023-34967: Fixed samba spotlight mdssvc RPC Request Type Confusion Denial-of-Service Vulnerability (bsc#1213172). CVE-2023-34968: Fixed spotlight server-side Share Path Disclosure (bsc#1213171). Bugfixes: Fixed trust relationship failure (bsc#1213384).

This update for libxml2 fixes the following issues: CVE-2024-25062: Fixed use-after-free in XMLReader (bsc#1219576).

This update for openssh fixes the following issues: CVE-2023-51385: Limit the use of shell metacharacters in host- and user names to avoid command injection. (bsc#1218215)

This update for mozilla-nss fixes the following issues: Update to NSS 3.90.2: CVE-2023-5388: Fixed timing attack against RSA decryption in TLS (bsc#1216198)

This update for tiff fixes the following issues: CVE-2023-52356: Fixed segfault in TIFFReadRGBATileExt() (bsc#1219213).

This update for docker fixes the following issues: Vendor latest buildkit v0.11 including bugfixes for the following: CVE-2024-23653: BuildKit API doesn't validate entitlement on container creation (bsc#1219438). CVE-2024-23652: Fixed arbitrary deletion of files (bsc#1219268). CVE-2024-23651: Fixed race condition in mount (bsc#1219267).

This update for python3 fixes the following issues: CVE-2023-27043: Fixed incorrectly parses e-mail addresses which contain a special character (bsc#1210638).

This update for suseconnect-ng fixes the following issues: Allow SUSEConnect on read write transactional systems (bsc#1219425)

This update for openssl-3 fixes the following issues: CVE-2023-6129: Fixed vector register clobbering on PowerPC. (bsc#1218690) CVE-2023-6237: Fixed excessive time spent checking invalid RSA public keys. (bsc#1218810) CVE-2024-0727: Denial of service when processing a maliciously formatted PKCS12 file (bsc#1219243).

This update for salt fixes the following issues: Security issues fixed: CVE-2024-22231: Prevent directory traversal when creating syndic cache directory on the master (bsc#1219430) CVE-2024-22232: Prevent directory traversal attacks in the master's servefile method (bsc#1219431) Bugs fixed: Ensure that pillar refresh loads beacons from pillar without restart Fix the aptpkg.py unit test failure Prefer unittest.mock to python-mock in test suite Enable "KeepAlive" probes for Salt SSH executions (bsc#1211649) Revert changes to set Salt configured user early in the stack (bsc#1216284) Align behavior of some modules when using salt-call via symlink (bsc#1215963) Fix gitfs "env" and improve cache cleaning (bsc#1193948) Remove python-boto dependency for the python3-salt-testsuite package for Tumbleweed

This update for libsolv, libzypp fixes the following issues: build for multiple python versions [jsc#PED-6218] applydeltaprm: Create target directory if it does not exist (bsc#1219442) Fix problems with EINTR in ExternalDataSource::getline (bsc#1215698) CheckAccessDeleted: fix runningincontainer detection (bsc#1218782) Detect CURLOPTREDIRPROTOCOLSSTR availability at runtime (bsc#1218831)

This update for python-kiwi fixes the following issues: Fix overwrite of kiwioemunattended: ensure that the overwrite happens in the early initialize method which provides the environment for all code running in the dracut module

Allow install disk overwrite from cmdline (jsc#PED-7180): add rd.kiwi.oem.installdevice=DEVICE, which configures the disk device that should be used in an OEM installation

This update for runc fixes the following issues: Update to runc v1.1.12 (bsc#1218894) The following CVE was already fixed with the previous release. CVE-2024-21626: Fixed container breakout.

This update for python3-M2Crypto fixes the following issues: Packaging changes (bsc#1217782, bsc#1212757) Set OpenSSL 3.0 as the default openssl in Tumbleweed (bsc#1205042)

This update for perl fixes the following issues: CVE-2023-31484: Enable TLS cert verification in CPAN (bsc#1210999).

This update for aaabase fixes the following issues: Set JAVAHOME correctly (bsc#1107342, bsc#1215434)

This update for cpio fixes the following issues: Fixed cpio not extracting correctly when using --no-absolute-filenames option the security fix for CVE-2023-7207 (bsc#1218571, bsc#1219238)

This update for python-instance-billing-flavor-check fixes the following issues: Support proxy setup on the client to access the update infrastructure API (bsc#1218561) Add IPv6 support (bsc#1218739)

This update for runc fixes the following issues: Update to runc v1.1.11: CVE-2024-21626: Fixed container breakout. (bsc#1218894)

This update for libxkbcommon fixes the following issues: enable 32bit libxkbregistry0 and libxkbregistry0-devel for use by Wine. (bsc#1218639)

This update for conmon fixes the following issues: New upstream release 2.1.10 Bug fixes: Fix incorrect free in connsock

logging: Respect log-size-max immediately after open

Add patch for fixing regression in v2.1.9 (https://github.com/containers/conmon/issues/475 and https://github.com/containers/conmon/issues/477)

New upstream release 2.1.9 ### Bug fixes

fix some issues flagged by SAST scan src: fix write after end of buffer src: open all files with OCLOEXEC oom-score: restore oom score before running exit command ### Features Forward more messages on the sd-notify socket

logging: -l passthrough accepts TTYs

[bsc#1215806]

Update to version 2.1.8:

stdio: ignore EIO for terminals (bsc#1217773) ensure console socket buffers are properly sized conmon: drop return after pexit() ctrl: make accept4 failures fatal logging: avoid opening /dev/null for each write oom: restore old OOM score Use default umask 0022 cli: log parsing errors to stderr Changes to build conmon for riscv64 Changes to build conmon for ppc64le Fix closeotherfds on FreeBSD