This update for openssl-11 fixes the following issues: CVE-2024-0727: Denial of service when processing a maliciously formatted PKCS12 file (bsc#1219243).

This update for openssl-100 fixes the following issues: CVE-2024-0727: Denial of service when processing a maliciously formatted PKCS12 file (bsc#1219243).

This update for sudo fixes the following issues: NOTE: This update has been retracted as some sudo functionality was changed incorrectly. CVE-2023-42465: Try to make sudo less vulnerable to ROWHAMMER attacks (bsc#1219026).

This update for sudo fixes the following issues: CVE-2023-42465: Try to make sudo less vulnerable to ROWHAMMER attacks (bsc#1219026).

This update for go1.21 fixes the following issues: Upgrade go to version 1.21.8 CVE-2023-45289: net/http, net/http/cookiejar: incorrect forwarding of sensitive headers and cookies on HTTP redirect (bsc#1221000) CVE-2023-45290: net/http: memory exhaustion in Request.ParseMultipartForm (bsc#1221001) CVE-2024-24783: crypto/x509: Verify panics on certificates with an unknown public key algorithm (bsc#1220999) CVE-2024-24784: net/mail: comments in display names are incorrectly handled (bsc#1221002) CVE-2024-24785: html/template: errors returned from MarshalJSON methods may break template escaping (bsc#1221003)

This update for gstreamer-plugins-bad fixes the following issues: CVE-2023-44446: Fixed use-after-free remote code execution vulnerability via MXF file (bsc#1217213).

This update for python3 fixes the following issues: CVE-2023-40217: Fixed bypass TLS handshake on closed sockets (bsc#1214692). CVE-2023-6597: Fixed symlink bug in cleanup (bsc#1219666).

This update for go1.20 fixes the following issues: go1.20.14 (released 2024-02-06) includes fixes to the crypto/x509 package. (bsc#1206346) go#64760 staticlockranking builders failing on release branches on LUCI go#65322 crypto: rollback BoringCrypto fips-20220613 update go#65379 crypto/x509: TestIssue51759 consistently failing on gotip-darwin-amd6410.15 LUCI builder

This update for go1.21 fixes the following issues: go1.21.7 (released 2024-02-06) includes fixes to the compiler, the go command, the runtime, and the crypto/x509 package. (bsc#1212475)

go#63209 runtime: "fatal: morestack on g0" on amd64 after upgrade to Go 1.21

go#63768 runtime: pinner.Pin doesn't panic when it says it will go#64497 cmd/go: flag modcacherw does not take effect in the target package go#64761 staticlockranking builders failing on release branches on LUCI go#64935 runtime: "traceback: unexpected SPWRITE function runtime.systemstack" go#65023 x/tools/go/analysis/unitchecker,slices: TestVetStdlib failing due to vet errors in panic tests go#65053 cmd/compile: //go:build file version ignored when calling generic fn which has related type params go#65323 crypto: rollback BoringCrypto fips-20220613 update go#65351 cmd/go: go generate fails silently when run on a package in a nested workspace module go#65380 crypto/x509: TestIssue51759 consistently failing on gotip-darwin-amd6410.15 LUCI builder go#65449 runtime/trace: frame pointer unwinding crash on arm64 during async preemption

This update for freerdp fixes the following issues: CVE-2024-22211: Fixed am integer overflow in freerdpbitmapplanarcontextreset() (bsc#1219049).

This update for libqt5-qtsvg fixes the following issues: CVE-2021-45930: Fixed an out-of-bounds write that may have let to a denial-of-service (bsc#1196654). CVE-2023-32573: Fixed missing initialization of QtSvg QSvgFont munitsPerEm variable (bsc#1211298).

This update for openssh fixes the following issues: CVE-2023-51385: Fixed a command injection via user name or host name metacharacters (bsc#1218215).

Remember the state of sshd service during update / removal, to allow cut-over to a different openssh package. bsc#1220110

This update for tiff fixes the following issues: CVE-2023-52356: Fixed segfault in TIFFReadRGBATileExt() (bsc#1219213).

This update for mozilla-nss fixes the following issues: Update to NSS 3.90.2: CVE-2023-5388: Fixed timing attack against RSA decryption in TLS (bsc#1216198)

This update for MozillaFirefox fixes the following issues: Update to Firefox Extended Support Release 115.8.0 ESR (MFSA 2024-06) (bsc#1220048): CVE-2024-1546: Out-of-bounds memory read in networking channels CVE-2024-1547: Alert dialog could have been spoofed on another site CVE-2024-1548: Fullscreen Notification could have been hidden by select element CVE-2024-1549: Custom cursor could obscure the permission dialog CVE-2024-1550: Mouse cursor re-positioned unexpectedly could have led to unintended permission grants CVE-2024-1551: Multipart HTTP Responses would accept the Set-Cookie header in response parts CVE-2024-1552: Incorrect code generation on 32-bit ARM devices

CVE-2024-1553: Memory safety bugs fixed in Firefox 123, Firefox ESR 115.8, and Thunderbird 115.8

Recommend libfido2-udev on codestreams that exist, in order to try to get security keys (e.g. Yubikeys) work out of the box. (bsc#1184272)

This update for libssh fixes the following issues: Update to version 0.9.8 (jsc#PED-7719): Fix CVE-2023-6004: Command injection using proxycommand (bsc#1218209) Fix CVE-2023-48795: Potential downgrade attack using strict kex (bsc#1218126) Fix CVE-2023-6918: Missing checks for return values of MD functions (bsc#1218186) Allow @ in usernames when parsing from URI composes Update to version 0.9.7 Fix CVE-2023-1667: a NULL dereference during rekeying with algorithm guessing (bsc#1211188) Fix CVE-2023-2283: a possible authorization bypass in pkiverifydatasignature under low-memory conditions (bsc#1211190) Fix several memory leaks in GSSAPI handling code Update to version 0.9.6 (bsc#1189608, CVE-2021-3634) https://git.libssh.org/projects/libssh.git/tag/?h=libssh-0.9.6 Update to version 0.9.5 (bsc#1174713, CVE-2020-16135): CVE-2020-16135: Avoid null pointer dereference in sftpserver (T232) Improve handling of library initialization (T222) Fix parsing of subsecond times in SFTP (T219) Make the documentation reproducible Remove deprecated API usage in OpenSSL Fix regression of sshchannelpolltimeout() returning SSHAGAIN Define version in one place (T226) Prevent invalid free when using different C runtimes than OpenSSL (T229) Compatibility improvements to testsuite Update to version 0.9.4: https://www.libssh.org/2020/04/09/libssh-0-9-4-and-libssh-0-8-9-security-release/ Fix possible Denial of Service attack when using AES-CTR-ciphers CVE-2020-1730 (bsc#1168699) Update to version 0.9.3: Fixed CVE-2019-14889 - SCP: Unsanitized location leads to command execution (bsc#1158095) SSH-01-003 Client: Missing NULL check leads to crash in erroneous state SSH-01-006 General: Various unchecked Null-derefs cause DOS SSH-01-007 PKI Gcrypt: Potential UAF/double free with RSA pubkeys SSH-01-010 SSH: Deprecated hash function in fingerprinting SSH-01-013 Conf-Parsing: Recursive wildcards in hostnames lead to DOS SSH-01-014 Conf-Parsing: Integer underflow leads to OOB array access SSH-01-001 State Machine: Initial machine states should be set explicitly SSH-01-002 Kex: Differently bound macros used to iterate same array SSH-01-005 Code-Quality: Integer sign confusion during assignments SSH-01-008 SCP: Protocol Injection via unescaped File Names SSH-01-009 SSH: Update documentation which RFCs are implemented SSH-01-012 PKI: Information leak via uninitialized stack buffer Update to version 0.9.2: Fixed libssh-config.cmake Fixed issues with rsa algorithm negotiation (T191) Fixed detection of OpenSSL ed25519 support (T197) Update to version 0.9.1: Added support for Ed25519 via OpenSSL Added support for X25519 via OpenSSL Added support for localuser in Match keyword Fixed Match keyword to be case sensitive Fixed compilation with LibreSSL Fixed error report of channel open (T75) Fixed sftp documentation (T137) Fixed knownhosts parsing (T156) Fixed build issue with MinGW (T157) Fixed build with gcc 9 (T164) Fixed deprecation issues (T165) Fixed knownhosts directory creation (T166) Update to verion 0.9.0: Added support for AES-GCM Added improved rekeying support Added performance improvements Disabled blowfish support by default Fixed several ssh config parsing issues Added support for DH Group Exchange KEX Added support for Encrypt-then-MAC mode Added support for parsing server side configuration file Added support for ECDSA/Ed25519 certificates Added FIPS 140-2 compatibility Improved knownhosts parsing Improved documentation

Improved OpenSSL API usage for KEX, DH, and signatures

Add libssh client and server config files

This update for postgresql14 fixes the following issues: Upgrade to 14.11: CVE-2024-0985: Tighten security restrictions within REFRESH MATERIALIZED VIEW CONCURRENTLY (bsc#1219679).

This update for postgresql13 fixes the following issues: Upgrade to 13.14: CVE-2024-0985: Tighten security restrictions within REFRESH MATERIALIZED VIEW CONCURRENTLY (bsc#1219679).

This update of glibc fixes the following issues: Security issue fixed: CVE-2023-4813: Fixed a potential use-after-free in gaihinet() (bsc#1215286, BZ #28931) Other issues fixed: S390: Fix relocation of nlcurrentLCCATETORYused in static build (bsc#1215504, BZ #19860) added GB18030-2022 charmap (jsc#PED-4908, BZ #30243)

This update for postgresql15 fixes the following issues: Upgrade to 15.6: CVE-2024-0985: Tighten security restrictions within REFRESH MATERIALIZED VIEW CONCURRENTLY (bsc#1219679).

The SUSE Linux Enterprise 12 SP5 kernel was updated to receive various security bugfixes. The following security bugs were fixed: CVE-2024-1086: Fixed a use-after-free vulnerability inside the nftables component that could have been exploited to achieve local privilege escalation (bsc#1219434). CVE-2024-0340: Fixed information disclosure in vhost/vhost.c:vhostnewmsg() (bsc#1218689). CVE-2023-51780: Fixed a use-after-free in dovccioctl in net/atm/ioctl.c, because of a vccrecvmsg race condition (bsc#1218730). CVE-2023-46838: Fixed an issue with Xen netback processing of zero-length transmit fragment (bsc#1218836). CVE-2021-33631: Fixed an integer overflow in ext4writeinlinedataend() (bsc#1219412). CVE-2023-47233: Fixed a use-after-free in the device unplugging (disconnect the USB by hotplug) code inside the brcm80211 component (bsc#1216702). CVE-2023-51043: Fixed use-after-free during a race condition between a nonblocking atomic commit and a driver unload in drivers/gpu/drm/drmatomic.c (bsc#1219120). CVE-2024-0775: Fixed use-after-free in ext4remount in fs/ext4/super.c that could allow a local user to cause an information leak problem while freeing the old quota file names before a potential failure (bsc#1219053). CVE-2023-6040: Fixed an out-of-bounds access vulnerability while creating a new netfilter table, lack of a safeguard against invalid nftables family (pf) values within nftablesnewtable function (bsc#1218752). CVE-2023-51782: Fixed use-after-free in roseioctl in net/rose/afrose.c because of a roseaccept race condition (bsc#1218757). CVE-2023-6610: Fixed an out of bounds read in the SMB client when printing debug information (bsc#1217946). CVE-2023-6535: Fixed a NULL pointer dereference in nvmettcpexecuterequest (bsc#1217988). CVE-2023-6536: Fixed a NULL pointer dereference in nvmetreqcomplete (bsc#1217989). CVE-2023-6356: Fixed a NULL pointer dereference in nvmettcpbuildpduiovec (bsc#1217987). CVE-2023-51042: Fixed use-after-free in amdgpucswaitallfences in drivers/gpu/drm/amd/amdgpu/amdgpucs.c (bsc#1219128). The following non-security bugs were fixed: 9p: missing chunk of "fs/9p: Do not update file type when updating file attributes" (git-fixes). ACPICA: Avoid cache flush inside virtual machines (git-fixes). GFS2: Flush the GFS2 delete workqueue before stopping the kernel threads (git-fixes). KVM: s390: vsie: Fix STFLE interpretive execution identification (git-fixes bsc#1219022). UAPI: ndctl: Fix g++-unsupported initialisation in headers (git-fixes). USB: serial: option: add Fibocom to DELL custom modem FM101R-GL (git-fixes). USB: serial: option: add Telit LE910C4-WWX 0x1035 composition (git-fixes). USB: serial: option: add entry for Sierra EM9191 with new firmware (git-fixes). USB: serial: option: fix FM101R-GL defines (git-fixes). acpi/nfit: Require opt-in for read-only label configurations (git-fixes). acpi/nfit: improve bounds checking for 'func' (git-fixes). affs: fix basic permission bits to actually work (git-fixes). aio: fix mremap after fork null-deref (git-fixes). asix: Add check for usbnetgetendpoints (git-fixes). bnxten: Log unknown link speed appropriately (git-fixes). build: Limit kernel-source build to architectures for which the kernel binary is built (bsc#1108281). ceph: fix incorrect revoked caps assert in cephfillfilesize() (bsc#1219445). chardev: fix error handling in cdevdeviceadd() (git-fixes). configfs: fix a deadlock in configfssymlink() (git-fixes). configfs: fix a race in configfs{,un}registersubsystem() (git-fixes). configfs: fix a use-after-free in configfsopenfile (git-fixes). configfs: fix configitem refcnt leak in configfsrmdir() (git-fixes). configfs: fix memleak in configfsreleasebinfile (git-fixes). configfs: new object reprsenting tree fragments (git-fixes). configfs: provide exclusion between IO and removals (git-fixes). configfs: stash the data we need into configfsbuffer at open time (git-fixes). docs: Store the old kernel changelog entries in kernel-docs package (bsc#1218713). ext4: Avoid freeing inodes on dirty list (bsc#1216989). ext4: silence the warning when evicting inode with dioreadnolock (bsc#1206889). fat: add ratelimit to fatentbread() (git-fixes). fs/exofs: fix potential memory leak in mount option parsing (git-fixes). fs/fat/fatent.c: add condresched() to fatcountfreeclusters() (git-fixes). fs/fat/file.c: issue flush after the writeback of FAT (git-fixes). fs/file.c: initialize initfiles.resizewait (git-fixes). fs: do not audit the capability check in simplexattrlist() (git-fixes). fs: ocfs2: namei: check return value of ocfs2addentry() (git-fixes). fs: orangefs: fix error return code of orangefsrevalidatelookup() (git-fixes). fs: ratelimit findgetblockslow() failure message (git-fixes). fs: warn about impending deprecation of mandatory locks (git-fixes). gfs2: Allow locknolock mount to specify jid=X (git-fixes). gfs2: Check sbbsizeshift after reading superblock (git-fixes). gfs2: Do not call dlm after protocol is unmounted (git-fixes). gfs2: Do not set GFS2RDFUPTODATE when the lvb is updated (git-fixes). gfs2: Do not skip dlm unlock if glock had an lvb (git-fixes). gfs2: Fix inode height consistency check (git-fixes). gfs2: Fix lrucount going negative (git-fixes). gfs2: Fix marking bitmaps non-full (git-fixes). gfs2: Fix possible data races in gfs2showoptions() (git-fixes). gfs2: Fix sign extension bug in gfs2updatestats (git-fixes). gfs2: Fix use-after-free in gfs2glockshrinkscan (git-fixes). gfs2: Free rdbits later in gfs2clearrgrpd to fix use-after-free (git-fixes). gfs2: Make sure FITRIM minlen is rounded up to fs block size (git-fixes). gfs2: Special-case rindex for gfs2grow (git-fixes). gfs2: Wake up when sdglockdisposal becomes zero (git-fixes). gfs2: add validation checks for size of superblock (git-fixes). gfs2: assign rgrp glock before computebitstructs (git-fixes). gfs2: check for empty rgrp tree in gfs2riupdate (git-fixes). gfs2: check for live vs. read-only file system in gfs2fitrim (git-fixes). gfs2: clear bufintr when ending a transaction in sweepbhforrgrps (git-fixes). gfs2: fix use-after-free on transaction ail lists (git-fixes). gfs2: ignore negated quota changes (git-fixes). gfs2: initialize transaction trailXlists earlier (git-fixes). gfs2: report "already frozen/thawed" errors (git-fixes). gfs2: take jdata unstuff into account in dogrow (git-fixes). gfs2atomicopen(): fix OEXCL|OCREAT handling on cold dcache (git-fixes). gtp: change NETUDPTUNNEL dependency to select (git-fixes). helpnext should increase position index (git-fixes). iomap: sub-block dio needs to zeroout beyond EOF (git-fixes). kernfs: Separate kernfsprcontbuf and renamelock (git-fixes). kernfs: bring names in comments in line with code (git-fixes). kernfs: fix use-after-free in kernfsremove (git-fixes). libceph: use kernelconnect() (bsc#1219446). libnvdimm/btt: Fix LBA masking during 'free list' population (git-fixes). libnvdimm/btt: Fix a kmemdup failure check (git-fixes). libnvdimm/btt: Remove unnecessary code in bttfreelistinit (git-fixes). libnvdimm/btt: fix variable 'rc' set but not used (git-fixes). libnvdimm/namespace: Fix a potential NULL pointer dereference (git-fixes). libnvdimm/ofpmem: Use devmkstrdup instead of kstrdup and check its return value (git-fixes). libnvdimm/pmem: Delete include of nd-core.h (git-fixes). libnvdimm/pmem: fix a possible OOB access when read and write pmem (git-fixes). libnvdimm/region: Fix label activation vs errors (git-fixes). libnvdimm: Fix compilation warnings with W=1 (git-fixes). libnvdimm: Out of bounds read in ndioctl() (git-fixes). libnvdimm: Validate command family indices (git-fixes). libnvdimm: cover up changes in struct nvdimmbusdescriptor (git-fixes). locks: print a warning when mount fails due to lack of "mand" support (git-fixes). mce: fix setmcenospec to always unmap the whole page (git-fixes). mlx4: handle non-napi callers to napipoll (git-fixes). mlxsw: spectrum: Avoid -Wformat-truncation warnings (git-fixes). mlxsw: spectrum: Properly cleanup LAG uppers when removing port from LAG (git-fixes). mlxsw: spectrum: Set LAG port collector only when active (git-fixes). mm,mremap: bail out earlier in mremapto under map pressure (bsc#1123986). net/mlx5: Do not call timecounter cyc2time directly from 1PPS flow (git-fixes). net: (cpts) fix a missing check of clkprepare (git-fixes). net: dsa: bcmsf2: Propagate error value from mdiowrite (git-fixes). net: dsa: mv88e6xxx: Work around mv886e6161 SERDES missing MIIPHYSID2 (git-fixes). net: dsa: mv88e6xxx: avoid error message on remove from VLAN 0 (git-fixed). net: dsa: qca8k: Enable delay for RGMIIID mode (git-fixes). net: ethernet: ti: fix possible object reference leak (git-fixes). net: fec: Do not use netdev messages too early (git-fixes). net: ks8851: Delay requesting IRQ until opened (git-fixes). net: ks8851: Reassert reset pin if chip ID check fails (git-fixes). net: ks8851: Set initial carrier state to down (git-fixes). net: macb: Add null check for PCLK and HCLK (git-fixed). net: mv643xxeth: disable clk on error path in mv643xxethsharedprobe() (git-fixes). net: mvneta: fix double free of txq->buf (git-fixes). net: phy: sfp: warn the user when no txdisable pin is available (git-fixes). net: phylink: avoid resolving link state too early (git-fixes). net: sfp: do not probe SFP module before we're attached (git-fixes). net: stmmac: Disable EEE mode earlier in XMIT callback (git-fixes). net: stmmac: Fallback to Platform Data clock in Watchdog conversion (git-fixes). net: stmmac: do not overwrite discardframe status (git-fixes). net: stmmac: dwmac-rk: fix error handling in rkgmacpowerup() (git-fixes). net: stmmac: dwmac1000: Clear unused address entries (git-fixed). net: stmmac: dwmac1000: fix out-of-bounds mac address reg setting (git-fixes). net: stmmac: dwmac4/5: Clear unused address entries (git-fixes). net: systemport: Fix reception of BPDUs (git-fixes). net: xilinx: fix possible object reference leak (git-fixed). nfs: NFS 4.0 LOCK calls getting constant NFS4ERRBADSEQID (bsc#1218968). nfsd: drop stmutex and rpmutex before calling movetocloselru() (bsc#1217525). nvdimm/btt: do not call delgendisk() if not needed (git-fixes). nvdimm: Allow overwrite in the presence of disabled dimms (git-fixes). nvdimm: Fix badblocks clear off-by-one error (git-fixes). nvmet-tcp: fix a crash in nvmetreqcomplete() (git-fixes). orangefs: Fix kmemleak in orangefspreparedebugfshelpstring() (git-fixes). orangefs: Fix sysfs not cleanup when dev init failed (git-fixes). orangefs: fix orangefs df output (git-fixes). orangefs: rate limit the client not running info message (git-fixes). powerpc/powernv: Add a null pointer check in opaleventinit() (bsc#1065729). powerpc/powernv: Add a null pointer check in opalpowercapinit() (bsc#1181674 ltc#189159 git-fixes). powerpc/pseries/memhotplug: Quieten some DLPAR operations (bsc#1065729). powerpc/pseries/memhp: Fix access beyond end of drmem array (bsc#1065729). powerpc: Do not clobber f0/vs0 during fp|altivec register save (bsc#1065729). preserve KABI for struct platstmmacenetdata (git-fixes). preserve KABI for struct sfpsocketops (git-fixes). proc: fix /proc//mapfiles lookup (git-fixes). pstore/ram: Check start of empty przs during init (git-fixes). pstore/ram: Fix error return code in ramoopsprobe() (git-fixes). pstore/ram: Run without kernel crash dump region (git-fixes). pstore: Avoid kcore oops by vmap()ing with VMIOREMAP (git-fixes). pstore: ramcore: fix possible overflow in persistentraminitecc() (git-fixes). r8169: fix data corruption issue on RTL8402 (git-fixes). reiserfs: Check the return value from getblk() (git-fixes). reiserfs: Replace 1-element array with C99 style flex-array (git-fixes). s390/dasd: fix double module refcount decrement (bsc#1141539). scripts/gitsort/gitsort.py: Add 'perf-tools' branch scsi: qla0xxx: Fix system crash due to bad pointer access (git-fixes). sfc: initialise found bitmap in efxef10mtdprobe (git-fixes). statfs: enforce statfs[64] structure initialization (git-fixes). tracing/trigger: Fix to return error if failed to alloc snapshot (git-fixes). usb: xhci: xhci-ring: Use sysdev for mapping bounce buffer (git-fixes). veth: Fixing transmit return status for dropped packets (git-fixes). vfs: make freezesuper abort when syncfilesystem returns error (git-fixes). writeback: Export inodeiolistdel() (bsc#1216989). x86/CPU/AMD: Check vendor in the AMD microcode callback (git-fixes). x86/alternatives: Sync core before enabling interrupts (git-fixes). x86/asm: Ensure asm/proto.h can be included stand-alone (git-fixes). x86/bugs: Add "unknown" reporting for MMIO Stale Data (git-fixes). x86/build: Treat R386PLT32 relocation as R386PC32 (git-fixes). x86/build: Turn off -fcf-protection for realmode targets (git-fixes). x86/cpu/hygon: Fix the CPU topology evaluation for real (git-fixes). x86/cpu: Add another Alder Lake CPU to the Intel family (git-fixes). x86/fpu: Use Alignof to avoid undefined behavior in TYPEALIGN (git-fixes). x86/kvm/lapic: always disable MMIO interface in x2APIC mode (git-fixes). x86/kvm: Do not try to disable kvmclock if it was not enabled (git-fixes). x86/lib: Fix overflow when counting digits (git-fixes). x86/mce: relocate set{clear}mcenospec() functions (git-fixes). x86/microcode/AMD: Track patch allocation size explicitly (git-fixes). x86/microcode/intel: Do not retry microcode reloading on the APs (git-fixes). x86/mm: Add a x86haspatwp() helper (git-fixes). x86/pat: Fix x86haspatwp() (git-fixes). x86/pat: Pass valid address to sanitizephys() (git-fixes). x86/pm: Add enumeration check before spec MSRs save/restore setup (git-fixes). x86/pm: Fix false positive kmemleak report in msrbuildcontext() (git-fixes). x86/purgatory: Do not generate debug info for purgatory.ro (git-fixes). x86/resctrl: Fix to restore to original value when re-enabling hardware prefetch register (git-fixes). x86/topology: Fix duplicated core ID within a package (git-fixes). x86/topology: Fix multiple packages shown on a single-package system (git-fixes). x86/unwind/orc: Fix unreliable stack dump with gcov (git-fixes). x86/unwind/orc: Unwind ftrace trampolines with correct ORC entry (git-fixes). x86: Clear .brk area at early boot (git-fixes). x86: Fix getwchan() for !STACKTRACE (git-fixes). x86: Fix getwchan() to support the ORC unwinder (git-fixes). x86: Mark stopthiscpu() noreturn (git-fixes). x86: Pin task-stack in getwchan() (git-fixes). x86: alwaysinline {rd,wr}msr() (git-fixes).

This update for python3 fixes the following issues: CVE-2023-27043: Fixed incorrectly parses e-mail addresses which contain a special character (bsc#1210638).

This update for netpbm fixes the following issues: CVE-2017-5849: Fixed out-of-bound read and write issue that can occur in function putgreytile() and put1bitbwtile() (bsc#1022790, bsc#1022791).

This update for python36 fixes the following issues: CVE-2023-27043: Fixed incorrectly parses e-mail addresses which contain a special character (bsc#1210638).

This update for gdb fixes the following issues: Drop libdebuginfod1 BuildRequires/Recommends. The former isn't needed because there's a build requirement on libdebuginfod-devel already, which will pull the shared library. And the latter, because it's bogus since RPM auto generated dependency will take care of that requirement. gdb was released in 13.2: This version of GDB includes the following changes and enhancements:

Support for the following new targets has been added in both GDB and GDBserver: GNU/Linux/LoongArch (gdbserver) loongarch--linux GNU/Linux/CSKY (gdbserver) csky-linux

The Windows native target now supports target async.

Floating-point support has now been added on LoongArch GNU/Linux.

New commands: set print nibbles [on|off] show print nibbles

This controls whether the 'print/t' command will display binary values in groups of four bits, known as "nibbles". The default is 'off'. Various styling-related commands. See the gdb/NEWS file for more details. Various maintenance commands. These are normally aimed at GDB experts or developers. See the gdb/NEWS file for more details.

Python API improvements: New Python API for instruction disassembly.

The new attribute 'locations' of gdb.Breakpoint returns a list of gdb.BreakpointLocation objects specifying the locations where the breakpoint is inserted into the debuggee. New Python type gdb.BreakpointLocation. New function gdb.formataddress(ADDRESS, PROGSPACE, ARCHITECTURE) that formats ADDRESS as 'address ' New function gdb.currentlanguage that returns the name of the current language. Unlike gdb.parameter('language'), this will never return 'auto'. New function gdb.printoptions that returns a dictionary of the prevailing print options, in the form accepted by gdb.Value.formatstring. New method gdb.Frame.language that returns the name of the frame's language. gdb.Value.formatstring now uses the format provided by 'print', if it is called during a 'print' or other similar operation. gdb.Value.formatstring now accepts the 'summary' keyword. This can be used to request a shorter representation of a value, the way that 'set print frame-arguments scalars' does. The gdb.registerwindowtype method now restricts the set of acceptable window names. The first character of a window's name must start with a character in the set [a-zA-Z], every subsequent character of a window's name must be in the set [-.a-zA-Z0-9].

GDB/MI changes:

MI version 1 is deprecated, and will be removed in GDB 14. The async record stating the stopped reason 'breakpoint-hit' now contains an optional field locno.

Miscellaneous improvements: gdb now supports zstd compressed debug sections (ELFCOMPRESSZSTD) for ELF. New convenience variable $inferiorthreadcount contains the number of live threads in the current inferior. New convenience variables $hitbpnum and $hitlocno, set to the breakpoint number and the breakpoint location number of the breakpoint last hit. The "info breakpoints" now displays enabled breakpoint locations of disabled breakpoints as in the "y-" state. The format of 'disassemble /r' and 'record instruction-history /r' has changed to match the layout of GNU objdump when disassembling.

A new format "/b" has been introduce to provide the old behavior of "/r". The TUI no longer styles the source and assembly code highlighted by the current position indicator by default. You can however re-enable styling using the new "set style tui-current-position" command. It is now possible to use the "document" command to document user-defined commands. Support for memory tag data for AArch64 MTE.

Support Removal notices: DBX mode has been removed. Support for building against Python version 2 has been removed. It is now only possible to build GDB against Python 3. Support for the following commands has been removed:

set debug aix-solib on|off show debug aix-solib set debug solib-frv on|off show debug solib-frv

Use the "set/show debug solib" commands instead. See the NEWS file for a more complete and detailed list of what this release includes.

This update for gstreamer fixes the following issues: CVE-2023-40474: Fixed an integer overflow during MXF file parsing (bsc#1215796).

This update for xerces-c fixes the following issues: CVE-2018-1311: fixed use-after-free triggered during the scanning of external DTDs potentially leading to DOS. (bsc#1159552)

This update for jasper fixes the following issues: CVE-2023-51257: Fixed an out of bounds write in the JPC encoder (bsc#1218802).

This update for xorg-x11-server fixes the following issues: CVE-2024-0408: Fixed SELinux unlabeled GLX PBuffer. (bsc#1218845) CVE-2024-0409: Fixed SELinux context corruption. (bsc#1218846)

This update for MozillaFirefox fixes the following issues: Update to Firefox Extended Support Release 115.7.0 ESR (MFSA 2024-02) (bsc#1218955): CVE-2024-0741: Out of bounds write in ANGLE CVE-2024-0742: Failure to update user input timestamp CVE-2024-0746: Crash when listing printers on Linux CVE-2024-0747: Bypass of Content Security Policy when directive unsafe-inline was set CVE-2024-0749: Phishing site popup could show local origin in address bar CVE-2024-0750: Potential permissions request bypass via clickjacking CVE-2024-0751: Privilege escalation through devtools CVE-2024-0753: HSTS policy on subdomain could bypass policy of upper domain CVE-2024-0755: Memory safety bugs fixed in Firefox 122, Firefox ESR 115.7, and Thunderbird 115.7