This update for MozillaFirefox fixes the following issues: Firefox Extended Support Release 115.2.1 ESR (bsc#1215245). CVE-2023-4863: Fixed heap buffer overflow in libwebp (MFSA 2023-40) (bsc#1215231). The following non-security bug was fixed: Fix i586 build by reducing debug info to -g1 (bsc#1210168).
This update for webkit2gtk3 fixes the following issues: CVE-2023-42890: Fixed processing malicious web content may lead to arbitrary code execution (bsc#1218033). CVE-2023-42883: Fixed processing a malicious image may lead to a denial-of-service (bsc#1218032). CVE-2023-41074: Fixed use-after-free in the MediaRecorder API of the WebKit GStreamer-based ports (bsc#1215870). CVE-2023-40451, CVE-2023-41074: Update to version 2.42.4 (bsc#1215868).
This update for eclipse-jgit, jsch fixes the following issues: Security fix: - CVE-2023-4759: Fixed an arbitrary file overwrite which might have occurred with a specially crafted git repository and a case-insensitive filesystem. (bsc#1215298) Other fixes: jsch was updated to version 0.2.9: - Added support for various algorithms - Migrated from com.jcraft:jsch to com.github.mwiede:jsch fork (bsc#1211955): Alias to the old artifact since the new one is drop-in replacement Keep the old OSGi bundle symbolic name to avoid extensive patching of eclipse stack - Updated to version 0.2.9: For the full list of changes please consult the upstream changelogs below for each version updated: + https://github.com/mwiede/jsch/releases/tag/jsch-0.2.9 + https://github.com/mwiede/jsch/releases/tag/jsch-0.2.8 + https://github.com/mwiede/jsch/releases/tag/jsch-0.2.7 + https://github.com/mwiede/jsch/releases/tag/jsch-0.2.6 + https://github.com/mwiede/jsch/releases/tag/jsch-0.2.5 + https://github.com/mwiede/jsch/releases/tag/jsch-0.2.4 + https://github.com/mwiede/jsch/releases/tag/jsch-0.2.3 + https://github.com/mwiede/jsch/releases/tag/jsch-0.2.2 + https://github.com/mwiede/jsch/releases/tag/jsch-0.2.1 + https://github.com/mwiede/jsch/releases/tag/jsch-0.2.0 + https://github.com/mwiede/jsch/releases/tag/jsch-0.1.71 + https://github.com/mwiede/jsch/releases/tag/jsch-0.1.70 + https://github.com/mwiede/jsch/releases/tag/jsch-0.1.69 + https://github.com/mwiede/jsch/releases/tag/jsch-0.1.68 + https://github.com/mwiede/jsch/releases/tag/jsch-0.1.67 + https://github.com/mwiede/jsch/releases/tag/jsch-0.1.66 + https://github.com/mwiede/jsch/releases/tag/jsch-0.1.65 + https://github.com/mwiede/jsch/releases/tag/jsch-0.1.64 + https://github.com/mwiede/jsch/releases/tag/jsch-0.1.63 + https://github.com/mwiede/jsch/releases/tag/jsch-0.1.62 + https://github.com/mwiede/jsch/releases/tag/jsch-0.1.61 + https://github.com/mwiede/jsch/releases/tag/jsch-0.1.60 + https://github.com/mwiede/jsch/releases/tag/jsch-0.1.59 + https://github.com/mwiede/jsch/releases/tag/jsch-0.1.58 + https://github.com/mwiede/jsch/releases/tag/jsch-0.1.57 + https://github.com/mwiede/jsch/releases/tag/jsch-0.1.56 eclipse-jgit: Craft the jgit script from the real Main class of the jar file instead of using a jar launcher (bsc#1209646)
The SUSE Linux Enterprise 15 SP2 kernel was updated to receive various security and bugfixes. The following security bugs were fixed: CVE-2020-26555: Fixed Bluetooth legacy BR/EDR PIN code pairing in Bluetooth Core Specification 1.0B that may permit an unauthenticated nearby device to spoof the BDADDR of the peer device to complete pairing without knowledge of the PIN (bsc#1179610 bsc#1215237). CVE-2023-51779: Fixed a use-after-free because of a btsockioctl race condition in btsockrecvmsg (bsc#1218559). CVE-2023-6121: Fixed an out-of-bounds read vulnerability in the NVMe-oF/TCP subsystem that could lead to information leak (bsc#1217250). CVE-2023-6606: Fixed an out of bounds read in the SMB client when receiving a malformed length from a server (bsc#1217947). CVE-2023-6610: Fixed an out of bounds read in the SMB client when printing debug information (bsc#1217946). CVE-2023-6931: Fixed a heap out-of-bounds write vulnerability in the Linux kernel's Performance Events system component that could lead to local privilege escalation. (bsc#1218258). CVE-2023-6932: Fixed a use-after-free vulnerability in the Linux kernel's ipv4: igmp component that could lead to local privilege escalation (bsc#1218253). The following non-security bugs were fixed: doc/README.SUSE: Add how to update the config for module signing (jsc#PED-5021) doc/README.SUSE: Remove how to build modules using kernel-source (jsc#PED-5021) doc/README.SUSE: Simplify the list of references (jsc#PED-5021) iouring: fix 32-bit compatability with sendmsg/recvmsg (bsc#1217709).
This update for perl-Spreadsheet-ParseExcel fixes the following issues: CVE-2023-7101: Fixed a command injection issue when parsing an untrusted spreadsheet (bsc#1218414).
This update for MozillaFirefox fixes the following issues: Update to Firefox Extended Support Release 115.7.0 ESR (MFSA2024-02) (bsc#1218955): CVE-2024-0741: Out of bounds write in ANGLE CVE-2024-0742: Failure to update user input timestamp CVE-2024-0746: Crash when listing printers on Linux CVE-2024-0747: Bypass of Content Security Policy when directive unsafe-inline was set CVE-2024-0749: Phishing site popup could show local origin in address bar CVE-2024-0750: Potential permissions request bypass via clickjacking CVE-2024-0751: Privilege escalation through devtools CVE-2024-0753: HSTS policy on subdomain could bypass policy of upper domain CVE-2024-0755: Memory safety bugs fixed in Firefox 122, Firefox ESR 115.7, and Thunderbird 115.7
This update for apache-parent, apache-sshd fixes the following issues: apache-parent was updated from version 28 to 31: Version 31: New Features: Added maven-checkstyle-plugin to pluginManagement
Improvements: Set minimalMavenBuildVersion to 3.6.3 - the minimum used by plugins Using an SPDX identifier as the license name is recommended by Maven Use properties to define the versions of plugins
Bugs fixed: Updated documentation for previous changes apache-sshd was updated from version 2.7.0 to 2.12.0: Security issues fixed: CVE-2023-48795: Implemented OpenSSH "strict key exchange" protocol in apache-sshd version 2.12.0 (bsc#1218189)
CVE-2022-45047: Java unsafe deserialization vulnerability fixed in apache-sshd version 2.9.2 (bsc#1205463)
Other changes in version 2.12.0:
Bugs fixed: SCP client fails silently when error signalled due to missing file or lacking permissions Ignore unknown key types from agent or in OpenSSH host keys extension
New Features: Support GIT protocol-v2
Other changes in version 2.11.0: Bugs fixed: Added configurable timeout(s) to DefaultSftpClient Compare file keys in ModifiableFileWatcher. Fixed channel pool in SftpFileSystem. Use correct default OpenOptions in SftpFileSystemProvider.newFileChannel(). Use correct lock modes for SFTP FileChannel.lock(). ScpClient: support issuing commands to a server that uses a non-UTF-8 locale. SftpInputStreamAsync: fix reporting EOF on zero-length reads. Work-around a bug in WSFTP <= 12.9 SFTP clients. (Regression in 2.10.0) SFTP performance fix: override FilterOutputStream.write(byte[], int, int). Fixed a race condition to ensure SSHMSGCHANNELEOF is always sent before SSHMSGCHANNELCLOSE. Fixed error handling while flushing queued packets at end of KEX. Fixed wrong log level on closing an Nio2Session. Fixed detection of Android O/S from system properties. Consider all applicable host keys from the knownhosts files. SftpFileSystem: do not close user session. ChannelAsyncOutputStream: remove write future when done. SSHD-1332 (Regression in 2.10.0) Resolve ~ in IdentityFile file names in HostConfigEntry.
New Features: Use KeepAliveHandler global request instance in client as well Publish snapshot maven artifacts to the Apache Snapshots maven repository. Bundle sshd-contrib has support classes for the HAProxy protocol V2.
Other changes in version 2.10.0: Bugs fixed: Connection attempt not canceled when a connection timeout occurs Possible OOM in ChannelPipedInputStream SftpRemotePathChannel.transferFrom(...) ignores position argument Rooted file system can leak informations Failed to establish an SSH connection because the server identifier exceeds the int range
Improvements: Password in clear in SSHD server's logs
Other changes in version 2.9.2: Bugs fixed: SFTP worker threads got stuck while processing PUT methods against one specific SFTP server Use the maximum packet size of the communication partner ExplicitPortForwardingTracker does not unbind auto-allocated one Default SshClient FD leak because Selector not closed Reading again from exhausted ChannelExec#getInvertedOut() throws IOException instead of returning -1 Keeping error streams and input streams separate after ChannelExec#setRedirectErrorStream(true) is called Nio2Session.shutdownOutput() should wait for writes in progress
Test: Research intermittent failure in unit tests using various I/O service factories
Other changes in version 2.9.1: Bugs fixed: ClientSession.auth().verify() is terminated with timeout 2.9.0 release broken on Java 8 Infinite loop in org.apache.sshd.sftp.client.impl.SftpInputStreamAsync#doRead Deadlock during session exit Race condition is logged in ChannelAsyncOutputStream
Other changes in version 2.9.0: Bugs fixed: Deadlock on disconnection at the end of key-exchange Remote port forwarding mode does not handle EOF properly Public key authentication: wrong signature algorithm used (ed25519 key with ssh-rsa signature) Client fails window adjust above Integer.MAXVALUE class loader fails to load org.apache.sshd.common.cipher.BaseGCMCipher Shell is not getting closed if the command has already closed the OutputStream it is using. Sometimes async write listener is not called Unhandled SSHMSGCHANNELWINDOWADJUST leeds to SocketTimeoutException different host key algorithm used on rekey than used for the initial connection OpenSSH certificate is not properly encoded when critical options are included TCP/IP remote port forwarding with wildcard IP addresses doesn't work with OpenSSH UserAuthPublicKey: uses ssh-rsa signatures for RSA keys from an agent
New Features: Added support for Argon2 encrypted PUTTY key files Added support for merged inverted output and error streams of remote process
Improvements: Added support for "limits@openssh.com" SFTP extension Support host-based pubkey authentication in the client Send environment variable and open subsystem at the same time for SSH session
Other changes in version 2.8.0: Bugs fixed: Fixed wrong server key algorithm choice Expiration of OpenSshCertificates needs to compare timestamps as unsigned long SFTP Get downloads empty file from servers which supports EOF indication after data skip() doesn't work properly in SftpInputStreamAsync OpenMode and CopyMode is not honored as expected in version > 4 of SFTP api SftpTransferTest sometimes hangs (failure during rekeying) Race condition in KEX Fix the ciphers supported documentation Update tarLongFileMode to use POSIX WinsCP transfer failure to Apache SSHD Server Pubkey auth: keys from ssh-agent are used even if HostConfigEntry.isIdentitiesOnly() is true Support RSA SHA2 signatures via SSH agent NOTICE: wrong copyright year range Wrong creationTime in writeAttrs for SFTP sshd-netty logs all traffic on INFO level
New Features: Add support for chacha20-poly1305@openssh.com Parsing of ~/.ssh/config Host patterns fails with extra whitespace Support generating OpenSSH client certificates
Improvements: Add support for curve25519-sha256@libssh.org key exchange OpenSSH certificates: check certificate type OpenSSHCertificatesTest: certificates expire in 2030 Display IdleTimeOut in more user-friendly format sendChunkIfRemoteWindowIsSmallerThanPacketSize flag in ChannelAsyncOutputStream constructor configurable from outside using variable/config file Intercepting the server exception message from server in SSHD client Implement RFC 8332 server-sig-algs on the server Slow performance listing huge number of files on Apache SSHD server SFTP: too many LSTAT calls Support key constraints when adding a key to an SSH agent Add SFTP server side file custom attributes hook
This update for webkit2gtk3 fixes the following issues: CVE-2024-23222: Fixed type confusion that may lead to arbitrary code execution. (bsc#1219113)
This update for bouncycastle, jsch fixes the following issues: Updated jsch to version 0.2.15:
CVE-2023-48795: Fixed a prefix truncation issue that could lead to disclosure of sensitive information (bsc#1218134).
Updated bouncycastle to version 1.77.
This update for suse-build-key fixes the following issues: This update runs a import-suse-build-key script. The previous libzypp-post-script based installation is replaced with a systemd timer and service (bsc#1217215 bsc#1216410 jsc#PED-2777). - suse-build-key-import.service - suse-build-key-import.timer It imports the future SUSE Linux Enterprise 15 4096 bit RSA key primary and reserve keys. After successful import the timer is disabled. To manually import them you can also run: rpm --import /usr/lib/rpm/gnupg/keys/gpg-pubkey-3fa1d6ce-63c9481c.asc rpm --import /usr/lib/rpm/gnupg/keys/gpg-pubkey-d588dc46-63c939db.asc Bugfix added since last update: run rpm commands in import script only when libzypp is not active. bsc#1219189 bsc#1219123
The SUSE Linux Enterprise 15 SP2 LTSS kernel was updated to receive various security bugfixes. The following security bugs were fixed: CVE-2024-1086: Fixed a use-after-free vulnerability inside the nftables component that could have been exploited to achieve local privilege escalation (bsc#1219434). CVE-2024-0775: Fixed use-after-free in ext4remount in fs/ext4/super.c that could allow a local user to cause an information leak problem while freeing the old quota file names before a potential failure (bsc#1219053). CVE-2024-0565: Fixed an out-of-bounds memory read flaw in receiveencryptedstandard in fs/smb/client/smb2ops.c (bsc#1218832). CVE-2023-6915: Fixed a NULL pointer dereference problem in idafree in lib/idr.c (bsc#1218804). CVE-2023-6536: Fixed a NULL pointer dereference in nvmetreqcomplete (bsc#1217989). CVE-2023-6535: Fixed a NULL pointer dereference in nvmettcpexecuterequest (bsc#1217988). CVE-2023-6356: Fixed a NULL pointer dereference in nvmettcpbuildpduiovec (bsc#1217987). CVE-2023-6040: Fixed an out-of-bounds access vulnerability while creating a new netfilter table, lack of a safeguard against invalid nftables family (pf) values within nftablesnewtable function (bsc#1218752). CVE-2023-51782: Fixed use-after-free in roseioctl in net/rose/afrose.c because of a roseaccept race condition (bsc#1218757). CVE-2023-51780: Fixed a use-after-free in dovccioctl in net/atm/ioctl.c, because of a vccrecvmsg race condition (bsc#1218730). CVE-2023-51043: Fixed use-after-free during a race condition between a nonblocking atomic commit and a driver unload in drivers/gpu/drm/drmatomic.c (bsc#1219120). CVE-2023-4921: Fixed a use-after-free vulnerability in the QFQ network scheduler which could be exploited to achieve local privilege escalation (bsc#1215275). CVE-2023-47233: Fixed a use-after-free in the device unplugging (disconnect the USB by hotplug) code inside the brcm80211 component (bsc#1216702). CVE-2023-46838: Fixed an issue with Xen netback processing of zero-length transmit fragment (bsc#1218836). CVE-2021-33631: Fixed an integer overflow in ext4writeinlinedataend() (bsc#1219412). The following non-security bugs were fixed: build: Limit kernel-source build to architectures for which the kernel binary is built (bsc#1108281). docs: Store the old kernel changelog entries in kernel-docs package (bsc#1218713) mkspec: Include constraints for both multibuild and plain package always rpm/kernel-docs.spec.in: fix build with 6.8 Since upstream commit f061c9f7d058 rpm/kernel-source.rpmlintrc: add action-ebpf Upstream commit a79d8ba734bd rpm/mkspec: use kernel-source: prefix for constraints on multibuild Otherwise the constraints are not applied with multibuild enabled. x86/entry/ia32: Ensure s32 is sign extended to s64 (bsc#1193285).
This update for tomcat fixes the following issues: Updated to Tomcat 9.0.85: CVE-2023-45648: Improve trailer header parsing (bsc#1216118). CVE-2023-42794: FileUpload: remove tmp files to avoid DoS on Windows (bsc#1216120). CVE-2023-42795: Improve handling of failures during recycle() methods (bsc#1216119). CVE-2023-46589: Fixed HTTP request smuggling due to incorrect headers parsing (bsc#1217649) CVE-2024-22029: Fixed escalation to root from tomcat user via %post script. (bsc#1219208) The following non-security issues were fixed: Fixed the file permissions for server.xml (bsc#1217768, bsc#1217402). Find the full release notes at: https://tomcat.apache.org/tomcat-9.0-doc/changelog.html
This update for salt fixes the following issues: Security issues fixed: CVE-2024-22231: Prevent directory traversal when creating syndic cache directory on the master (bsc#1219430) CVE-2024-22232: Prevent directory traversal attacks in the master's servefile method (bsc#1219431) Bugs fixed: Ensure that pillar refresh loads beacons from pillar without restart Fix the aptpkg.py unit test failure Prefer unittest.mock to python-mock in test suite Enable "KeepAlive" probes for Salt SSH executions (bsc#1211649) Revert changes to set Salt configured user early in the stack (bsc#1216284) Align behavior of some modules when using salt-call via symlink (bsc#1215963) Fix gitfs "env" and improve cache cleaning (bsc#1193948) Remove python-boto dependency for the python3-salt-testsuite package for Tumbleweed
This update for webkit2gtk3 fixes the following issues: Update to version 2.42.5 (bsc#1219604): CVE-2024-23222: Fixed processing maliciously crafted web content that may have led to arbitrary code execution (bsc#1219113). CVE-2024-23206: Fixed fingerprint user via maliciously crafted webpages (bsc#1219604). CVE-2024-23213: Fixed processing web content that may have led to arbitrary code execution (bsc#1219604). CVE-2023-40414: Fixed processing web content that may have led to arbitrary code execution (bsc#1219604). CVE-2014-1745: Fixed denial-of-service or potentially disclose memory contents while processing maliciously crafted files (bsc#1219604). CVE-2023-42833: Fixed processing web content that may have led to arbitrary code execution (bsc#1219604).
This update for postgresql12 fixes the following issues: Upgrade to 12.18: CVE-2024-0985: Tighten security restrictions within REFRESH MATERIALIZED VIEW CONCURRENTLY (bsc#1219679).
This update for postgresql13 fixes the following issues: Upgrade to 13.14: CVE-2024-0985: Tighten security restrictions within REFRESH MATERIALIZED VIEW CONCURRENTLY (bsc#1219679).
This update for docker fixes the following issues: Vendor latest buildkit v0.11 including bugfixes for the following: CVE-2024-23653: BuildKit API doesn't validate entitlement on container creation (bsc#1219438). CVE-2024-23652: Fixed arbitrary deletion of files (bsc#1219268). CVE-2024-23651: Fixed race condition in mount (bsc#1219267).
This update for MozillaFirefox fixes the following issues: Update to Firefox Extended Support Release 115.8.0 ESR (MFSA 2024-06) (bsc#1220048): CVE-2024-1546: Out-of-bounds memory read in networking channels CVE-2024-1547: Alert dialog could have been spoofed on another site CVE-2024-1548: Fullscreen Notification could have been hidden by select element CVE-2024-1549: Custom cursor could obscure the permission dialog CVE-2024-1550: Mouse cursor re-positioned unexpectedly could have led to unintended permission grants CVE-2024-1551: Multipart HTTP Responses would accept the Set-Cookie header in response parts CVE-2024-1552: Incorrect code generation on 32-bit ARM devices
CVE-2024-1553: Memory safety bugs fixed in Firefox 123, Firefox ESR 115.8, and Thunderbird 115.8
Recommend libfido2-udev on codestreams that exist, in order to try to get security keys (e.g. Yubikeys) work out of the box. (bsc#1184272)
This update for nodejs14 fixes the following issues: Security issues fixed: CVE-2023-46809: Node.js is vulnerable to the Marvin Attack (timing variant of the Bleichenbacher attack against PKCS#1 v1.5 padding) (bsc#1219997). CVE-2024-22019: http: Reading unprocessed HTTP request with unbounded chunk extension allows DoS attacks (bsc#1219993). CVE-2024-22025: Denial of Service by resource exhaustion in fetch() brotli decoding (bsc#1220014). CVE-2024-24806: fix improper domain lookup that potentially leads to SSRF attacks (bsc#1219724).
This update for nodejs12 fixes the following issues: Security issues fixed: CVE-2023-46809: Node.js is vulnerable to the Marvin Attack (timing variant of the Bleichenbacher attack against PKCS#1 v1.5 padding) (bsc#1219997). CVE-2024-22019: http: Reading unprocessed HTTP request with unbounded chunk extension allows DoS attacks (bsc#1219993). CVE-2024-22025: Denial of Service by resource exhaustion in fetch() brotli decoding (bsc#1220014). CVE-2024-24806: fix improper domain lookup that potentially leads to SSRF attacks (bsc#1219724).
This update for gstreamer-plugins-bad fixes the following issues: CVE-2023-44446: Fixed use-after-free remote code execution vulnerability via MXF file (bsc#1217213).
This update for jetty-minimal fixes the following issues: CVE-2024-22201: Fixed denial-of-service via HTTP/2 connection leak (bsc#1220437).
This update for xen fixes the following issues: Update to Xen 4.13.5 bug fix release (bsc#1027519). CVE-2023-20569: Fixed x86/AMD Speculative Return Stack Overflow (XSA-434) (bsc#1214082). CVE-2022-40982: Fixed x86/Intel Gather Data Sampling (XSA-435) (bsc#1214083). CVE-2023-20593: Fixed x86/AMD Zenbleed (XSA-433) (bsc#1213616).
This update for MozillaFirefox fixes the following issues: Firefox was updated to Extended Support Release 115.2.0 ESR (MFSA 2023-36) (bsc#1214606). CVE-2023-4574: Fixed memory corruption in IPC ColorPickerShownCallback (bmo#1846688) CVE-2023-4575: Fixed memory corruption in IPC FilePickerShownCallback (bmo#1846689) CVE-2023-4576: Fixed integer Overflow in RecordedSourceSurfaceCreation (bmo#1846694) CVE-2023-4577: Fixed memory corruption in JIT UpdateRegExpStatics (bmo#1847397) CVE-2023-4051: Fixed full screen notification obscured by file open dialog (bmo#1821884) CVE-2023-4578: Fixed Out of Memory Exception in SpiderMonkey could have triggered an (bmo#1839007) CVE-2023-4053: Fixed full screen notification obscured by external program (bmo#1839079) CVE-2023-4580: Fixed push notifications saved to disk unencrypted (bmo#1843046) CVE-2023-4581: Fixed XLL file extensions downloadable without warnings (bmo#1843758) CVE-2023-4582: Fixed buffer Overflow in WebGL glGetProgramiv (bmo#1773874) CVE-2023-4583: Fixed browsing Context potentially not cleared when closing Private Window (bmo#1842030) CVE-2023-4584: Fixed memory safety bugs fixed in Firefox 117, Firefox ESR 102.15, Firefox ESR 115.2, Thunderbird 102.15, and Thunderbird 115.2 (bmo#1843968, bmo#1845205, bmo#1846080, bmo#1846526, bmo#1847529) CVE-2023-4585: Fixed memory safety bugs fixed in Firefox 117, Firefox ESR 115.2, and Thunderbird 115.2(bmo#1751583, bmo#1833504, bmo#1841082, bmo#1847904, bmo#1848999).
The SUSE Linux Enterprise 15 SP2 kernel was updated to receive various security and bugfixes. The following security bugs were fixed: CVE-2023-2007: Fixed a flaw in the DPT I2O Controller driver that could allow an attacker to escalate privileges and execute arbitrary code in the context of the kernel (bsc#1210448). CVE-2023-3772: Fixed a flaw in XFRM subsystem that may have allowed a malicious user with CAPNETADMIN privileges to directly dereference a NULL pointer leading to a possible kernel crash and denial of service (bsc#1213666). CVE-2023-3863: Fixed a use-after-free flaw was found in nfcllcpfindlocal that allowed a local user with special privileges to impact a kernel information leak issue (bsc#1213601). CVE-2023-4128: Fixed a use-after-free flaw in net/sched/clsfw.c that allowed a local attacker to perform a local privilege escalation due to incorrect handling of the existing filter, leading to a kernel information leak issue (bsc#1214149). CVE-2023-4132: Fixed use-after-free vulnerability was found in the siano smsusb module that allowed a local user to crash the system, causing a denial of service condition (bsc#1213969). CVE-2023-4134: Fixed use-after-free in cyttsp4watchdogwork() (bsc#1213971). CVE-2023-4273: Fixed a flaw in the exFAT driver of the Linux kernel that alloawed a local privileged attacker to overflow the kernel stack (bsc#1214120). CVE-2023-4385: Fixed a NULL pointer dereference flaw in dbFree that may have allowed a local attacker to crash the system due to a missing sanity check (bsc#1214348). CVE-2023-4387: Fixed use-after-free flaw in vmxnet3rqallocrxbuf that could allow a local attacker to crash the system due to a double-free (bsc#1214350). CVE-2023-4459: Fixed a NULL pointer dereference flaw in vmxnet3rqcleanup that may have allowed a local attacker with normal user privilege to cause a denial of service (bsc#1214451). CVE-2022-36402: Fixed an integer overflow vulnerability in vmwgfx driver in that allowed a local attacker with a user account on the system to gain privilege, causing a denial of service (bsc#1203517). CVE-2023-20588: Fixed a division-by-zero error on some AMD processors that can potentially return speculative data resulting in loss of confidentiality (bsc#1213927). CVE-2023-21400: Fixed several memory corruptions due to improper locking in iouring (bsc#1213272). The following non-security bugs were fixed: kabi/severities: Ignore newly added SRSO mitigation functions x86/cpu/kvm: Provide UNTRAINRETVM (git-fixes). x86/cpu: Cleanup the untrain mess (git-fixes). x86/cpu: Rename original retbleed methods (git-fixes). x86/cpu: Rename srso(.)alias to srsoalias\1 (git-fixes). x86/retpoline: Do not clobber RFLAGS during srsosaferet() (git-fixes). x86/speculation: Add cpushowgds() prototype (git-fixes). x86/speculation: Mark all Skylake CPUs as vulnerable to GDS (git-fixes). x86/srso: Correct the mitigation status when SMT is disabled (git-fixes). x86/srso: Disable the mitigation on unaffected configurations (git-fixes). x86/srso: Explain the untraining sequences a bit more (git-fixes). x86: Move gdsucodemitigated() declaration to header (git-fixes).
This update for qemu fixes the following issues: CVE-2022-26354: Fixed a memory leak due to a missing virtqueue detach on error. (bsc#1198712) CVE-2021-3929: Fixed an use-after-free in nvme DMA reentrancy issue. (bsc#1193880) CVE-2023-0330: Fixed a stack overflow due to a DMA reentrancy issue. (bsc#1207205) CVE-2020-13754: Fixed a DoS due to an OOB access during mmio operations. (bsc#1172382) CVE-2023-3354: Fixed a remote unauthenticated DoS due to an improper I/O watch removal in VNC TLS handshake. (bsc#1212850) CVE-2023-3180: Fixed a heap buffer overflow in virtiocryptosymophelper(). (bsc#1213925) CVE-2021-3638: Fixed an out-of-bounds write due to an inconsistent check in ati2dblt(). (bsc#1188609) CVE-2021-3750: Fixed an use-after-free in DMA reentrancy issue. (bsc#1190011) CVE-2023-2861: Fixed improper access control on special files in 9pfs (bsc#1212968). CVE-2022-1050: Fixed use-after-free issue in pvrdmaexeccmd() (bsc#1197653). The following non-security bug was fixed: Prepare for binutils update to 2.41 update (bsc#1215311).
This update for MozillaFirefox fixes the following issues: Update to Firefox Extended Support Release 115.3.0 ESR (MFSA 2023-42, bsc#1215575): Security fixes: CVE-2023-5168: Out-of-bounds write in FilterNodeD2D1 (bmo#1846683). CVE-2023-5169: Out-of-bounds write in PathOps (bmo#1846685). CVE-2023-5171: Use-after-free in Ion Compiler (bmo#1851599). CVE-2023-5174: Double-free in process spawning on Windows (bmo#1848454). CVE-2023-5176: Memory safety bugs fixed in Firefox 118, Firefox ESR 115.3, and Thunderbird 115.3 (bmo#1836353, bmo#1842674, bmo#1843824, bmo#1843962, bmo#1848890, bmo#1850180, bmo#1850983, bmo#1851195). Other fixes: Fix broken build with newer binutils (bsc#1215309)
This update for xen fixes the following issues: CVE-2023-20588: Fixed AMD CPU transitional execution leak via division by zero (XSA-439) (bsc#1215474). CVE-2023-34322: Fixed top-level shadow reference dropped too early for 64-bit PV guests (XSA-438) (bsc#1215145). CVE-2023-20593: Fixed AMD Zenbleed (XSA-433) (bsc#1213616). CVE-2022-40982: Fixed Intel Gather Data Sampling (XSA-435) (bsc#1214083).
This update for vim fixes the following issues: Security fixes: CVE-2023-4733: Fixed use-after-free in function buflistaltfpos (bsc#1215004). CVE-2023-4734: Fixed segmentation fault in function ffullcommand (bsc#1214925). CVE-2023-4735: Fixed out of bounds write in ops.c (bsc#1214924). CVE-2023-4738: Fixed heap buffer overflow in vimregsubboth (bsc#1214922). CVE-2023-4752: Fixed heap use-after-free in function inscomplgetexp (bsc#1215006). CVE-2023-4781: Fixed heap buffer overflow in function vimregsubboth (bsc#1215033). Other fixes: Update to version 9.0 with patch level 1894, for the complete list of changes see https://github.com/vim/vim/compare/v9.0.1443...v9.0.1894 Use app icons generated from vimlogo.eps in the source tarball; add higher resolution icons of sizes 128x128, 256x256, and 512x512 as png sources
This update for MozillaFirefox fixes the following issues: Mozilla Firefox was updated to 115.3.1 ESR, fixing a security issue: MFSA 2023-44 (bsc#1215814) CVE-2023-5217: Fixed a heap buffer overflow in libvpx