This update for cpio fixes the following issues: CVE-2023-7207: Fixed path traversal vulnerability (bsc#1218571, bsc#1219238)

This update for wpasupplicant fixes the following issues: CVE-2023-52160: Bypassing WiFi Authentication (bsc#1219975).

This update for timezone fixes the following issues: Update to version 2024a Kazakhstan unifies on UTC+5 Palestine springs forward a week later than previously predicted in 2024 and 2025 Asia/HoChiMinh's 1955-07-01 transition occurred at 01:00 not 00:00 From 1947 through 1949, Toronto's transitions occurred at 02:00 not 00:00 In 1911 Miquelon adopted standard time on June 15, not May 15 The FROM and TO columns of Rule lines can no longer be "minimum" localtime no longer mishandle some timestamps strftime %s now uses tmgmtoff if available Ittoqqortoormiit, Greenland changes time zones on 2024-03-31 Vostok, Antarctica changed time zones on 2023-12-18 Casey, Antarctica changed time zones five times since 2020 Code and data fixes for Palestine timestamps starting in 2072 A new data file zonenow.tab for timestamps starting now Much of Greenland changed its standard time from -03 to -02 on 2023-03-25 localtime.c no longer mishandles TZif files that contain a single transition into a DST regime tzselect no longer creates temporary files tzselect no longer mishandles the following: Spaces and most other special characters in BUGEMAIL, PACKAGE, TZDIR, and VERSION. TZ strings when using mawk 1.4.3, which mishandles regular expressions of the form /X{2,}/ ISO 6709 coordinates when using an awk that lacks the GNU extension of newlines in -v option-arguments Non UTF-8 locales when using an iconv command that lacks the GNU //TRANSLIT extension zic no longer mishandles data for Palestine after the year 2075

This update for gstreamer-plugins-bad fixes the following issues: CVE-2023-44446: Fixed use-after-free remote code execution vulnerability via MXF file (bsc#1217213).

This update for giflib fixes the following issues: Update to version 5.2.2 Fixes for CVE-2023-48161 (bsc#1217390), CVE-2022-28506 (bsc#1198880)

138 Documentation for obsolete utilities still installed

139: Typo in "LZW image data" page ("1102 = 410")

140: Typo in "LZW image data" page ("LWZ")

141: Typo in "Bits and bytes" page ("filed")

Note as already fixed SF issue #143: cannot compile under mingw

144: giflib-5.2.1 cannot be build on windows and other platforms using c89

145: Remove manual pages installation for binaries that are not installed too

146: [PATCH] Limit installed man pages to binaries, move giflib to section 7

147 [PATCH] Fixes to doc/whatsinagif/ content

148: heap Out of Bound Read in gif2rgb.c:298 DumpScreen2RGB

Declared no-info on SF issue #150: There is a denial of service vulnerability in GIFLIB 5.2.1 Declared Won't-fix on SF issue 149: Out of source builds no longer possible

151: A heap-buffer-overflow in gif2rgb.c:294:45

152: Fix some typos on the html documentation and man pages

153: Fix segmentation faults due to non correct checking for args

154: Recover the giffilter manual page

155: Add gifsponge docs

157: An OutofMemory-Exception or Memory Leak in gif2rgb

158: There is a null pointer problem in gif2rgb

159 A heap-buffer-overflow in GIFLIB5.2.1 DumpScreen2RGB() in gif2rgb.c:298:45

163: detected memory leaks in openbsdreallocarray giflib/openbsd-reallocarray.c

164: detected memory leaks in GifMakeMapObject giflib/gifalloc.c

166: a read zero page leads segment fault in getarg.c and memory leaks in gif2rgb.c and gifmalloc.c

167: Heap-Buffer Overflow during Image Saving in DumpScreen2RGB Function at Line 321 of gif2rgb.c

This update for python39 fixes the following issues: CVE-2023-6597: Fixed symlink bug in cleanup of tempfile.TemporaryDirectory (bsc#1219666). CVE-2023-27043: Fixed incorrect e-mqil parsing (bsc#1210638). CVE-2023-40217: Fixed a ssl.SSLSocket TLS bypass vulnerability where data is sent unencrypted (bsc#1214692). CVE-2022-25236: Fixed an expat vulnerability by supporting expat >= 2.4.4 (bsc#1212015).

This update for apache2-modauthopenidc fixes the following issues: CVE-2024-24814: Fixed a denial of service when using OIDCSessionType client-cookie and manipulating cookies (bsc#1219911).

This update for nodejs16 fixes the following issues: Security issues fixed: CVE-2023-46809: Node.js is vulnerable to the Marvin Attack (timing variant of the Bleichenbacher attack against PKCS#1 v1.5 padding) (bsc#1219997). CVE-2024-22019: http: Reading unprocessed HTTP request with unbounded chunk extension allows DoS attacks (bsc#1219993). CVE-2024-22025: Denial of Service by resource exhaustion in fetch() brotli decoding (bsc#1220014). CVE-2024-24758: ignore proxy-authorization header (bsc#1220017). CVE-2024-24806: fix improper domain lookup that potentially leads to SSRF attacks (bsc#1219724).

This update for nodejs14 fixes the following issues: Security issues fixed: CVE-2023-46809: Node.js is vulnerable to the Marvin Attack (timing variant of the Bleichenbacher attack against PKCS#1 v1.5 padding) (bsc#1219997). CVE-2024-22019: http: Reading unprocessed HTTP request with unbounded chunk extension allows DoS attacks (bsc#1219993). CVE-2024-22025: Denial of Service by resource exhaustion in fetch() brotli decoding (bsc#1220014). CVE-2024-24806: fix improper domain lookup that potentially leads to SSRF attacks (bsc#1219724).

This update for nodejs12 fixes the following issues: Security issues fixed: CVE-2023-46809: Node.js is vulnerable to the Marvin Attack (timing variant of the Bleichenbacher attack against PKCS#1 v1.5 padding) (bsc#1219997). CVE-2024-22019: http: Reading unprocessed HTTP request with unbounded chunk extension allows DoS attacks (bsc#1219993). CVE-2024-22025: Denial of Service by resource exhaustion in fetch() brotli decoding (bsc#1220014). CVE-2024-24806: fix improper domain lookup that potentially leads to SSRF attacks (bsc#1219724).

This update for gcc7 fixes the following issues: Add support for -fmin-function-alignment. [bsc#1214934] Use %{targetcpu} to determine host and build.

This update for glib2 fixes the following issues: CVE-2021-28153: Fixed an issue where symlink targets would be incorrectly created as empty files (bsc#1183533).

This update for rabbitmq-c fixes the following issues: CVE-2023-35789: Fixed insecure credentials submission (bsc#1212499).

This update for bind fixes the following issues: CVE-2023-2828: Fixed denial-of-service against recursive resolvers related to cache-cleaning algorithm (bsc#1212544).

This update for openssl-100 fixes the following issues: CVE-2022-4304: Reworked the fix for the Timing-Oracle in RSA decryption. The previous fix for this timing side channel turned out to cause a severe 2-3x performance regression in the typical use case (bsc#1207534).

This update for java-180-ibm fixes the following issues: Update to Java 8.0 Service Refresh 8 Fix Pack 20: [bsc#1219843] Security fixes: CVE-2023-33850: Fixed information disclosure vulnerability due to the consumed GSKit library (bsc#1219843). CVE-2024-20932: Fixed incorrect handling of ZIP files with duplicate entries (bsc#1218908). CVE-2024-20952: Fixed RSA padding issue and timing side-channel attack against TLS (bsc#1218911). CVE-2024-20918: Fixed array out-of-bounds access due to missing range check in C1 compiler (bsc#1218907). CVE-2024-20921: Fixed range check loop optimization issue (bsc#1218905). CVE-2024-20919: Fixed JVM class file verifier flaw allows unverified bytecode execution (bsc#1218903). CVE-2024-20926: Fixed arbitrary Java code execution in Nashorn (bsc#1218906). CVE-2024-20945: Fixed logging of digital signature private keys (bsc#1218909).

This update for MozillaFirefox fixes the following issues: Update to Firefox Extended Support Release 115.8.0 ESR (MFSA 2024-06) (bsc#1220048): CVE-2024-1546: Out-of-bounds memory read in networking channels CVE-2024-1547: Alert dialog could have been spoofed on another site CVE-2024-1548: Fullscreen Notification could have been hidden by select element CVE-2024-1549: Custom cursor could obscure the permission dialog CVE-2024-1550: Mouse cursor re-positioned unexpectedly could have led to unintended permission grants CVE-2024-1551: Multipart HTTP Responses would accept the Set-Cookie header in response parts CVE-2024-1552: Incorrect code generation on 32-bit ARM devices

CVE-2024-1553: Memory safety bugs fixed in Firefox 123, Firefox ESR 115.8, and Thunderbird 115.8

Recommend libfido2-udev on codestreams that exist, in order to try to get security keys (e.g. Yubikeys) work out of the box. (bsc#1184272)

This update for openssh fixes the following issues: CVE-2023-51385: Limit the use of shell metacharacters in host- and user names to avoid command injection. (bsc#1218215)

This update for docker fixes the following issues: Vendor latest buildkit v0.11 including bugfixes for the following: CVE-2024-23653: BuildKit API doesn't validate entitlement on container creation (bsc#1219438). CVE-2024-23652: Fixed arbitrary deletion of files (bsc#1219268). CVE-2024-23651: Fixed race condition in mount (bsc#1219267).

This update for mozilla-nss fixes the following issues: Update to NSS 3.90.2: CVE-2023-5388: Fixed timing attack against RSA decryption in TLS (bsc#1216198)

This update for ffmpeg contains the following fixes: Added libavresample3 and libavformat57 to subpackages for Package Hub SLE-15-SP5 (bsc#1205435) Fix RPM package build with new binutils

This update for suseconnect-ng fixes the following issues: Allow SUSEConnect on read write transactional systems (bsc#1219425)

This update for python-base contains the following fixes: Added python-xml to Package Hub SLE-15-SP4 (no source changes) (bsc#1212263, ijsc#MSC-724)

This update for dpdk fixes the following issues: Fixed a regression caused by incomplete fix for CVE-2022-2132 (bsc#1219187).

This update for openvswitch fixes the following issues: CVE-2024-22563: Fixed memory leak via the function xmalloc in /lib/util.c (bsc#1219059).

This update for libssh fixes the following issues: Update to version 0.9.8 (jsc#PED-7719): Fix CVE-2023-6004: Command injection using proxycommand (bsc#1218209) Fix CVE-2023-48795: Potential downgrade attack using strict kex (bsc#1218126) Fix CVE-2023-6918: Missing checks for return values of MD functions (bsc#1218186) Allow @ in usernames when parsing from URI composes Update to version 0.9.7: Fix CVE-2023-1667: a NULL dereference during rekeying with algorithm guessing (bsc#1211188) Fix CVE-2023-2283: a possible authorization bypass in pkiverifydatasignature under low-memory conditions (bsc#1211190) Fix several memory leaks in GSSAPI handling code Update to version 0.9.6 (bsc#1189608, CVE-2021-3634): https://git.libssh.org/projects/libssh.git/tag/?h=libssh-0.9.6 Update to 0.9.5 (bsc#1174713, CVE-2020-16135): CVE-2020-16135: Avoid null pointer dereference in sftpserver (T232) Improve handling of library initialization (T222) Fix parsing of subsecond times in SFTP (T219) Make the documentation reproducible Remove deprecated API usage in OpenSSL Fix regression of sshchannelpolltimeout() returning SSHAGAIN Define version in one place (T226) Prevent invalid free when using different C runtimes than OpenSSL (T229) Compatibility improvements to testsuite Update to version 0.9.4 https://www.libssh.org/2020/04/09/libssh-0-9-4-and-libssh-0-8-9-security-release/ Fix possible Denial of Service attack when using AES-CTR-ciphers CVE-2020-1730 (bsc#1168699) Update to version 0.9.3 Fixed CVE-2019-14889 - SCP: Unsanitized location leads to command execution (bsc#1158095) SSH-01-003 Client: Missing NULL check leads to crash in erroneous state SSH-01-006 General: Various unchecked Null-derefs cause DOS SSH-01-007 PKI Gcrypt: Potential UAF/double free with RSA pubkeys SSH-01-010 SSH: Deprecated hash function in fingerprinting SSH-01-013 Conf-Parsing: Recursive wildcards in hostnames lead to DOS SSH-01-014 Conf-Parsing: Integer underflow leads to OOB array access SSH-01-001 State Machine: Initial machine states should be set explicitly SSH-01-002 Kex: Differently bound macros used to iterate same array SSH-01-005 Code-Quality: Integer sign confusion during assignments SSH-01-008 SCP: Protocol Injection via unescaped File Names SSH-01-009 SSH: Update documentation which RFCs are implemented SSH-01-012 PKI: Information leak via uninitialized stack buffer Update to version 0.9.2 Fixed libssh-config.cmake Fixed issues with rsa algorithm negotiation (T191) Fixed detection of OpenSSL ed25519 support (T197) Update to version 0.9.1 Added support for Ed25519 via OpenSSL Added support for X25519 via OpenSSL Added support for localuser in Match keyword Fixed Match keyword to be case sensitive Fixed compilation with LibreSSL Fixed error report of channel open (T75) Fixed sftp documentation (T137) Fixed knownhosts parsing (T156) Fixed build issue with MinGW (T157) Fixed build with gcc 9 (T164) Fixed deprecation issues (T165)

Fixed knownhosts directory creation (T166)

Split out configuration to separate package to not mess up the library packaging and coinstallation Update to verion 0.9.0 Added support for AES-GCM Added improved rekeying support Added performance improvements Disabled blowfish support by default Fixed several ssh config parsing issues Added support for DH Group Exchange KEX Added support for Encrypt-then-MAC mode Added support for parsing server side configuration file Added support for ECDSA/Ed25519 certificates Added FIPS 140-2 compatibility Improved knownhosts parsing Improved documentation

Improved OpenSSL API usage for KEX, DH, and signatures

Add libssh client and server config files

This update for postgresql13 fixes the following issues: Upgrade to 13.14: CVE-2024-0985: Tighten security restrictions within REFRESH MATERIALIZED VIEW CONCURRENTLY (bsc#1219679).

This update for postgresql12 fixes the following issues: Upgrade to 12.18: CVE-2024-0985: Tighten security restrictions within REFRESH MATERIALIZED VIEW CONCURRENTLY (bsc#1219679).

This update for webkit2gtk3 fixes the following issues: Update to version 2.42.5 (bsc#1219604): CVE-2024-23222: Fixed processing maliciously crafted web content that may have led to arbitrary code execution (bsc#1219113). CVE-2024-23206: Fixed fingerprint user via maliciously crafted webpages (bsc#1219604). CVE-2024-23213: Fixed processing web content that may have led to arbitrary code execution (bsc#1219604). CVE-2023-40414: Fixed processing web content that may have led to arbitrary code execution (bsc#1219604). CVE-2014-1745: Fixed denial-of-service or potentially disclose memory contents while processing maliciously crafted files (bsc#1219604). CVE-2023-42833: Fixed processing web content that may have led to arbitrary code execution (bsc#1219604).

This update for salt fixes the following issues: Security issues fixed: CVE-2024-22231: Prevent directory traversal when creating syndic cache directory on the master (bsc#1219430) CVE-2024-22232: Prevent directory traversal attacks in the master's servefile method (bsc#1219431) Bugs fixed: Ensure that pillar refresh loads beacons from pillar without restart Fix the aptpkg.py unit test failure Prefer unittest.mock to python-mock in test suite Enable "KeepAlive" probes for Salt SSH executions (bsc#1211649) Revert changes to set Salt configured user early in the stack (bsc#1216284) Align behavior of some modules when using salt-call via symlink (bsc#1215963) Fix gitfs "env" and improve cache cleaning (bsc#1193948) Remove python-boto dependency for the python3-salt-testsuite package for Tumbleweed