This update for openssl-100 fixes the following issues: CVE-2022-4304: Reworked the fix for the Timing-Oracle in RSA decryption. The previous fix for this timing side channel turned out to cause a severe 2-3x performance regression in the typical use case (bsc#1207534).

This update for libsolv, libzypp fixes the following issues: build for multiple python versions [jsc#PED-6218] applydeltaprm: Create target directory if it does not exist (bsc#1219442) Fix problems with EINTR in ExternalDataSource::getline (bsc#1215698) CheckAccessDeleted: fix runningincontainer detection (bsc#1218782) Detect CURLOPTREDIRPROTOCOLSSTR availability at runtime (bsc#1218831)

This update for salt fixes the following issues: Security issues fixed: CVE-2024-22231: Prevent directory traversal when creating syndic cache directory on the master (bsc#1219430) CVE-2024-22232: Prevent directory traversal attacks in the master's servefile method (bsc#1219431) Bugs fixed: Ensure that pillar refresh loads beacons from pillar without restart Fix the aptpkg.py unit test failure Prefer unittest.mock to python-mock in test suite Enable "KeepAlive" probes for Salt SSH executions (bsc#1211649) Revert changes to set Salt configured user early in the stack (bsc#1216284) Align behavior of some modules when using salt-call via symlink (bsc#1215963) Fix gitfs "env" and improve cache cleaning (bsc#1193948) Remove python-boto dependency for the python3-salt-testsuite package for Tumbleweed

This update for java-11-openjdk fixes the following issues: Updated to version 11.0.22 (January 2024 CPU): CVE-2024-20918: Fixed an out of bounds access in the Hotspot JVM due to a missing bounds check (bsc#1218907). CVE-2024-20919: Fixed a sandbox bypass in the Hotspot JVM class file verifier (bsc#1218903). CVE-2024-20921: Fixed an incorrect optimization in the Hotspot JVM that could lead to corruption of JVM memory (bsc#1218905). CVE-2024-20926: Fixed arbitrary Java code execution in Nashorn (bsc#1218906). CVE-2024-20945: Fixed a potential private key leak through debug logs (bsc#1218909). CVE-2024-20952: Fixed an RSA padding issue and timing side-channel attack against TLS (bsc#1218911). Find the full release notes at: https://mail.openjdk.org/pipermail/jdk-updates-dev/2024-January/029215.html

This update for runc fixes the following issues: Update to runc v1.1.11: CVE-2024-21626: Fixed container breakout. (bsc#1218894)

This update for mdmonitor fixes the following issues: Update to version 6.6+11+gcbb8940: Fix deadlock because of locking itself (bsc#1197160) Remove the obsolete mddev from mdlist (bsc#1193465) Flush the log file after writing each message Fix locking of dev->lock in lookupmdcomponent() (bsc#1197160) Replace pselect with ppoll (bsc#1161872) Add systemd service file for systemd with increased TaskMax and LimitNOFILE (bsc#1104770) Fix crash on MonitorStatus (bsc#1096363, bsc#1081286) Ignore NewArray message if does not exists yet (bsc#1091619) Fix crash in displaymdstatus (bsc#1081286) Ignore inactive arrays (bsc#1068175, bsc#1079253) Store alias in struct mddev to avoid lookup errors (bsc#1068175,bsc#1079253)

This update for MozillaFirefox fixes the following issues: Update to Firefox Extended Support Release 115.7.0 ESR (MFSA 2024-02) (bsc#1218955): CVE-2024-0741: Out of bounds write in ANGLE CVE-2024-0742: Failure to update user input timestamp CVE-2024-0746: Crash when listing printers on Linux CVE-2024-0747: Bypass of Content Security Policy when directive unsafe-inline was set CVE-2024-0749: Phishing site popup could show local origin in address bar CVE-2024-0750: Potential permissions request bypass via clickjacking CVE-2024-0751: Privilege escalation through devtools CVE-2024-0753: HSTS policy on subdomain could bypass policy of upper domain CVE-2024-0755: Memory safety bugs fixed in Firefox 122, Firefox ESR 115.7, and Thunderbird 115.7

This update for bluez fixes the following issues: CVE-2021-41229: Fix leaking buffers stored in cstates cache (bsc#1192760). CVE-2023-50229: Fixed an out of bounds write in the primary version counter for the Phone Book Access Profile implementation (bsc#1218300). CVE-2023-50230: Fixed an out of bounds write in the secondary version counter for the Phone Book Access Profile implementation (bsc#1218301).

This update for pam fixes the following issues: CVE-2024-22365: Fixed a local denial of service during PAM login due to a missing check during path manipulation (bsc#1218475). Check localtimer() return value to fix crashing (bsc#1217000)

This update for suseconnect-ng fixes the following issues: Update to version 1.5.0 Configure docker credentials for registry authentication Feature: Support usage from Agama + Cockpit for ALP Micro system registration (bsc#1218364) Add --json output option

This update for sanlock fixes the following issues: Update to sanlock 3.8.5 (jsc#PED-7338) python: Replace distutils with setuptools sanlock: fix memory leak of lockspace renewalhistory sanlock: fix pthreadcreate error check sanlock: use helper to set maxsectorskb Add support for 4k sector size (bsc#1215229) Dropped patches: sanlock-oldblkid, suse-fix-link-errors, sanlock-python3 Add hardening to systemd services (bsc#1181400)

The SUSE Linux Enterprise 15 SP1 kernel was updated to receive various security and bugfixes. The following security bugs were fixed: CVE-2020-26555: Fixed Bluetooth legacy BR/EDR PIN code pairing in Bluetooth Core Specification 1.0B that may permit an unauthenticated nearby device to spoof the BDADDR of the peer device to complete pairing without knowledge of the PIN (bsc#1179610 bsc#1215237). CVE-2022-2586: Fixed a use-after-free which can be triggered when a nft table is deleted (bsc#1202095). CVE-2023-51779: Fixed a use-after-free because of a btsockioctl race condition in btsockrecvmsg (bsc#1218559). CVE-2023-6121: Fixed an out-of-bounds read vulnerability in the NVMe-oF/TCP subsystem that could lead to information leak (bsc#1217250). CVE-2023-6606: Fixed an out-of-bounds read vulnerability in smbCalcSize in fs/smb/client/netmisc.c that could allow a local attacker to crash the system or leak internal kernel information (bsc#1217947). CVE-2023-6610: Fixed an out-of-bounds read vulnerability in smb2dumpdetail in fs/smb/client/smb2ops.c that could allow a local attacker to crash the system or leak internal kernel information (bsc#1217946). CVE-2023-6931: Fixed a heap out-of-bounds write vulnerability in the Linux kernel's Performance Events system component that could lead to local privilege escalation. (bsc#1218258). CVE-2023-6932: Fixed a use-after-free vulnerability in the Linux kernel's ipv4: igmp component that could lead to local privilege escalation (bsc#1218253). The following non-security bugs were fixed: doc/README.SUSE: Add how to update the config for module signing (jsc#PED-5021) doc/README.SUSE: Remove how to build modules using kernel-source (jsc#PED-5021) doc/README.SUSE: Simplify the list of references (jsc#PED-5021)

This update for Java fixes the following issues: apache-commons-daemon was updated from version 1.3.2 to 1.3.4: Version 1.3.4: Procrun: Configured stack size now applies to the main thread when running in JVM mode. Fixes DAEMON-451. Procrun: If the specified log directory does not exist, attempt to create any missing parent directories, as well as the specified directory, when the service starts. Fixes DAEMON-452. Procrun: Allow Windows service dependencies to be managed by Procrun or by 'sc config ...'. Fixes DAEMON-458. jsvc: Fix DaemonController.reload() only working the first time it is called. Fixes DAEMON-459. Thanks to Klaus Malorny. jsvc: Remove incorrent definition 'supportedos' which defined in psupport.m4 file to fix jsvc build error on riscv64. Version 1.3.3: Procrun: ensure all child processes are cleaned up if the service does not stop cleanly. Procrun: Fix creation of duplicate ACL entries on some Windows platforms. Updates: Bump actions/cache from 3.0.8 to 3.0.11. Bump actions/checkout from 3.0.2 to 3.1.0. Bump actions/setup-java from 3.5.1 to 3.6.0. Bump spotbugs-maven-plugin from 4.7.2.0 to 4.7.3.0. aqute-bnd was updated from version 5.2.0 to 6.3.1: For the full list of changes please consult the following: https://github.com/bndtools/bnd/wiki/Changes-in-6.3.1 https://github.com/bndtools/bnd/wiki/Changes-in-6.3.0 https://github.com/bndtools/bnd/wiki/Changes-in-6.2.0 https://github.com/bndtools/bnd/wiki/Changes-in-6.1.0 https://github.com/bndtools/bnd/wiki/Changes-in-6.0.0 https://github.com/bndtools/bnd/wiki/Changes-in-5.3.0 tomcat-jakartaee-migration: New package implementation of tomcat-jakartaee-migration at version 1.0.7 libtcnative-1-0 was updated from version 1.2.22 to 1.2.38: Changes of version 1.2.22 to 1.2.38: Align default pass phrase prompt with HTTPd. Fix memory leak in SNI processing. Update the recommended minimum version of OpenSSL to 1.1.1v. Update the recommended minimum version of APR to 1.7.4. Document the TLS rengotiation behaviour. Add HOWTO-RELEASE.txt that describes the release process. Refactor library initialization so it is compatible with Tomcat 10.1.x onwards where a number of Java classes have been removed. Map the OpenSSL 3.x FIPS behaviour to the OpenSSL 1.x API to allow clients to determine if the FIPS provider is being used when Tomcat Native is compiled against OpenSSL 3.x. Fix crash when attempting to read TLS session ID after a handshake failure. Enable downloaddeps.sh to be called from any directory. Fix release script so it works with the current git layout. Correct previous fix that enabled building to continue with OpenSSL 3.x. Remove remaining reference to pkg-config which is no longer included in the Tomcat Native distribution. Additional changes required to provided support for using OpenSSL Engines that use proprietary key formats. Correct handling of WINVER in make file to use correct constant for Windows 7. Add constants for Windows 8, Windows 8.1 and Windows 10. Rename WINNT to WIN2k as it is used for Windows 2000 upwards, not Windows NT upwards. Add a patch for APR that fixes an issue where some Windows systems in some configurations would only listen on IPv6 addresses on dual stack systems even though configured to listen on both IPv6 and IPv4 addresses. Correct a regression in the fix for 65181 that prevented an error message from being displayed if an invalid key file was provided and no OpenSSL Engine was configured. Improve support for using OpenSSL Engines that use proprietary key formats. Enable building to continue against OpenSSL 3.x and 1.1.1. Incomplete name mangling fix for C++ compilers in tcnapi.h. Improve OS-specific header include for native thread id. Disable keylog callback support for LibreSSL. Add support for SSLContext.addChainCertificateRaw() with LibreSSL 2.9.1 and up. Add support for HP-UX's lwpself() in our sslthreadid(void). Remove default option passed for rpath to linker on HP-UX. Add an option to allow the OCSP responder check to be bypassed. Note that if OCSP is enabled, a missing responder is now treated as an error. Fix compilation with LibreSSL. libtcnative does not compile with OpenSSL < 1.1.0 and APR w/o threading support. Correct configure message for OpenSSL libdir. Clean up install target. configure output for OpenSSL wrong/incomplete sometimes. Drop obsolete build time workarounds for HP-UX. Add support for FreeBSD's pthreadgetthreadidnp() in our sslthreadid(void). Introduce tcngetthreadid(void) to reduce code duplication. Fix linking against OpenSSL in non-standard locations on FreeBSD.

This update for wireshark fixes the following issues: Updated to Wireshark 3.6.20:

CVE-2024-0208: Fixed a crash in the GVCP dissector (bsc#1218504).

CVE-2024-0209: Fixed a crash in the IEEE 1609.2 dissector (bsc#1218505).

This update for libzypp, zypper fixes the following issues: Expand RepoVars in URLs downloading a .repo file (bsc#1212160) CheckAccessDeleted: fix 'running in container' filter (bsc#1218291) Open rpmdb just once during execution of %posttrans scripts (bsc#1216412) tools/DownloadFiles: use standard zypp progress bar Fix ProgressBar's calculation of the printed tag position Fix usage of deprecated CURL features Stop using boost version 1 timer library (bsc#1215294) Fix search/info commands ignoring --ignore-unknown (bsc#1217593) Make sure reboot-needed is remembered until next boot (bsc#1217873)

This update for mozilla-nss fixes the following issues: Mozilla NSS was updated to NSS 3.90.1: regenerate NameConstraints test certificates. add OSXSAVE and XCR0 tests to AVX2 detection.

This update for procps fixes the following issues: Update procps to 3.3.17 (jsc#PED-3244 jsc#PED-6369)

For support up to 2048 CPU as well (bsc#1185417)

Allow -´ as leading character to ignore possible errors on systctl entries (bsc#1209122) Get the first CPU summary correct (bsc#1121753) Enable pidof for SLE-15 as this is provided by sysvinit-tools Use a check on syscall NRpidfdopen to decide if the pwait tool and its manual page will be build Do not truncate output of w with option -n Prefer logind over utmp (jsc#PED-3144) Don't install translated man pages for non-installed binaries (uptime, kill). Fix directory for Ukrainian man pages translations.

Move localized man pages to lang package.

Update to procps-ng-3.3.17

library: Incremented to 8:3:0 (no removals or additions, internal changes only)

all: properly handle utf8 cmdline translations kill: Pass int to signalled process pgrep: Pass int to signalled process pgrep: Check sanity of SGARGMAX pgrep: Add older than selection pidof: Quiet mode pidof: show worker threads ps.1: Mention stime alias ps: check also match on truncated 16 char comm names ps: Add exe output option ps: A lot more sorting available pwait: New command waits for a process sysctl: Match systemd directory order sysctl: Document directory order top: ensure config file backward compatibility top: add command line 'e' for symmetry with 'E' top: add '4' toggle for two abreast cpu display top: add '!' toggle for combining multiple cpus top: fix potential SEGV involving -p switch vmstat: Wide mode gives wider proc columns watch: Add environment variable for interval watch: Add no linewrap option watch: Support more colors

free,uptime,slabtop: complain about extra ops

Package translations in procps-lang.

Fix pgrep: cannot allocate 4611686018427387903 bytes when ulimit -s is unlimited.

Enable pidof by default

Update to procps-ng-3.3.16

library: Increment to 8:2:0 No removals or functions Internal changes only, so revision is incremented. Previous version should have been 8:1:0 not 8:0:1

docs: Use correct symbols for -h option in free.1

docs: ps.1 now warns about command name length docs: install translated man pages pgrep: Match on runstate snice: Fix matching on pid top: can now exploit 256-color terminals top: preserves 'other filters' in configuration file top: can now collapse/expand forest view children top: parent %CPU time includes collapsed children top: improve xterm support for vim navigation keys top: avoid segmentation fault at program termination "ps -C" does not allow anymore an argument longer than 15 characters (bsc#1158830)

This update for webkit2gtk3 fixes the following issues: CVE-2023-42890: Fixed processing malicious web content may lead to arbitrary code execution (bsc#1218033). CVE-2023-42883: Fixed processing a malicious image may lead to a denial-of-service (bsc#1218032). CVE-2023-41074: Fixed use-after-free in the MediaRecorder API of the WebKit GStreamer-based ports (bsc#1215870). CVE-2023-39928: Fixed use-after-free in the MediaRecorder API of the WebKit GStreamer-based ports (bsc#1215868). CVE-2023-40451, CVE-2023-41074: Update to version 2.42.4 (bsc#1215868).

This update for libssh2org fixes the following issues: CVE-2023-48795: Fixed prefix truncation breaking ssh channel integrity (Terrapin Attack) (bsc#1218127).

This update for gstreamer fixes the following issues: CVE-2023-40474: Fixed GStreamer MXF File Parsing Integer Overflow (bsc#1215796).

This update for gnutls fixes the following issues: CVE-2023-0361: Fixed a Bleichenbacher oracle in the TLS RSA key exchange (bsc#1208143). CVE-2023-5981: Fixed timing side-channel inside RSA-PSK key exchange (bsc#1217277).

This update for gstreamer-plugins-bad fixes the following issues: CVE-2023-40475: Fixed GStreamer MXF File Parsing Integer Overflow (bsc#1215792).

This update for docker, rootlesskit fixes the following issues: docker: Update to Docker 24.0.7-ce. See upstream changelong online at https://docs.docker.com/engine/release-notes/24.0/#2407>. bsc#1217513

Deny containers access to /sys/devices/virtual/powercap by default.

CVE-2020-8694 bsc#1170415 CVE-2020-8695 bsc#1170446 CVE-2020-12912 bsc#1178760

Update to Docker 24.0.6-ce. See upstream changelong online at https://docs.docker.com/engine/release-notes/24.0/#2406 . bsc#1215323

Add a docker.socket unit file, but with socket activation effectively disabled to ensure that Docker will always run even if you start the socket individually. Users should probably just ignore this unit file. bsc#1210141

Update to Docker 24.0.5-ce. See upstream changelong online at https://docs.docker.com/engine/release-notes/24.0/#2405 . bsc#1213229 This update ships docker-rootless support in the docker-rootless-extra package. (jsc#PED-6180) rootlesskit: new package, for docker rootless support. (jsc#PED-6180)

This update for MozillaFirefox fixes the following issues: Firefox Extended Support Release 115.6.0 ESR changelog-entry (bsc#1217974) CVE-2023-6856: Heap-buffer-overflow affecting WebGL DrawElementsInstanced method with Mesa VM driver (bmo#1843782). CVE-2023-6857: Symlinks may resolve to smaller than expected buffers (bmo#1796023). CVE-2023-6858: Heap buffer overflow in nsTextFragment (bmo#1826791). CVE-2023-6859: Use-after-free in PRGetIdentitiesLayer (bmo#1840144). CVE-2023-6860: Potential sandbox escape due to VideoBridge lack of texture validation (bmo#1854669). CVE-2023-6861: Heap buffer overflow affected nsWindow::PickerOpen(void) in headless mode (bmo#1864118). CVE-2023-6862: Use-after-free in nsDNSService (bsc#1868042). CVE-2023-6863: Undefined behavior in ShutdownObserver() (bmo#1868901). CVE-2023-6864: Memory safety bugs fixed in Firefox 121, Firefox ESR 115.6, and Thunderbird 115.6. CVE-2023-6865: Potential exposure of uninitialized data in EncryptingOutputStream (bmo#1864123). CVE-2023-6867: Clickjacking permission prompts using the popup transition (bmo#1863863). Fixed: Various security fixes and other quality improvements MFSA 2023-50 (bsc#1217230) CVE-2023-6204 (bmo#1841050) Out-of-bound memory access in WebGL2 blitFramebuffer CVE-2023-6205 (bmo#1854076) Use-after-free in MessagePort::Entangled CVE-2023-6206 (bmo#1857430) Clickjacking permission prompts using the fullscreen transition CVE-2023-6207 (bmo#1861344) Use-after-free in ReadableByteStreamQueueEntry::Buffer CVE-2023-6208 (bmo#1855345) Using Selection API would copy contents into X11 primary selection. CVE-2023-6209 (bmo#1858570) Incorrect parsing of relative URLs starting with "///" CVE-2023-6212 (bmo#1658432, bmo#1820983, bmo#1829252, bmo#1856072, bmo#1856091, bmo#1859030, bmo#1860943, bmo#1862782) Memory safety bugs fixed in Firefox 120, Firefox ESR 115.5, and Thunderbird 115.5

This update for ghostscript fixes the following issues: CVE-2023-46751: Fixed dangling pointer in gdevprnopenprinterseekable() (bsc#1217871).

This update for openssh fixes the following issues: CVE-2023-48795: Fixed prefix truncation breaking ssh channel integrity (bsc#1217950).

The SUSE Linux Enterprise 15 SP1 kernel was updated to receive various security and bugfixes. The following security bugs were fixed: CVE-2023-0461: Fixed use-after-free in icskulpdata (bsc#1208787). CVE-2023-39197: Fixed a out-of-bounds read in nfconntrackdccppacket() (bsc#1216976). CVE-2023-45863: Fixed a out-of-bounds write in fillkobjpath() (bsc#1216058). CVE-2023-5717: Fixed a heap out-of-bounds write vulnerability in the Performance Events component (bsc#1216584). CVE-2023-45871: Fixed an issue in the IGB driver, where the buffer size may not be adequate for frames larger than the MTU (bsc#1216259). CVE-2023-39198: Fixed a race condition leading to use-after-free in qxlmodedumbcreate() (bsc#1216965). CVE-2023-31083: Fixed race condition in hciuartttyioctl (bsc#1210780).

This update for tiff fixes the following issues: CVE-2023-2731: Fix null pointer deference in LZWDecode() (bsc#1211478). CVE-2023-1916: Fix out-of-bounds read in extractImageSection() (bsc#1210231). CVE-2023-26965: Fix heap-based use after free in loadImage() (bsc#1212398). CVE-2022-40090: Fix infinite loop in TIFFReadDirectory() (bsc#1214680).

This update for squid fixes the following issues: CVE-2023-49285: Fixed buffer over read bug on HTTP Message processing flow (bsc#1217813) CVE-2023-49286: Fixed Denial of Service vulnerability in helper process management (bsc#1217815) Fix X-Forwarded-For Stack Overflow (bsc#1217654)

This update for webkit2gtk3 fixes the following issues: Update to version 2.42.3 (bsc#1217844): Fix flickering while playing videos with DMA-BUF sink. Fix color picker being triggered in the inspector when typing "tan". Do not special case the "sans" font family name. Fix build failure with libxml2 version 2.12.0 due to an API change. Fix several crashes and rendering issues. Security fixes: CVE-2023-42916, CVE-2023-42917.