This update for gcc12 fixes the following issues: CVE-2023-4039: Fixed incorrect stack protector for C99 VLAs on Aarch64 (bsc#1214052).

This update for samba fixes the following issues: CVE-2022-2127: Fixed issue where lmresplen was not checked properly in winbinddpamauthcrapsend (bsc#1213174). CVE-2023-34966: Fixed samba spotlight mdssvc RPC Request Infinite Loop Denial-of-Service Vulnerability (bsc#1213173). CVE-2023-34967: Fixed samba spotlight mdssvc RPC Request Type Confusion Denial-of-Service Vulnerability (bsc#1213172). CVE-2023-34968: Fixed spotlight server-side Share Path Disclosure (bsc#1213171). Bugfixes: Fixed trust relationship failure (bsc#1213384).

This update for poppler fixes the following issues: CVE-2022-27337: Fixed a logic error in the Hints::Hints function which can cause denial of service (bsc#1199272).

This update for bind fixes the following issues: CVE-2023-2828: Fixed denial-of-service against recursive resolvers related to cache-cleaning algorithm (bsc#1212544).

This update for perl fixes the following issues: CVE-2023-31484: Enable TLS cert verification in CPAN (bsc#1210999).

This update for Java fixes the following issues: apache-commons-daemon was updated from version 1.3.2 to 1.3.4: Version 1.3.4: Procrun: Configured stack size now applies to the main thread when running in JVM mode. Fixes DAEMON-451. Procrun: If the specified log directory does not exist, attempt to create any missing parent directories, as well as the specified directory, when the service starts. Fixes DAEMON-452. Procrun: Allow Windows service dependencies to be managed by Procrun or by 'sc config ...'. Fixes DAEMON-458. jsvc: Fix DaemonController.reload() only working the first time it is called. Fixes DAEMON-459. Thanks to Klaus Malorny. jsvc: Remove incorrent definition 'supportedos' which defined in psupport.m4 file to fix jsvc build error on riscv64. Version 1.3.3: Procrun: ensure all child processes are cleaned up if the service does not stop cleanly. Procrun: Fix creation of duplicate ACL entries on some Windows platforms. Updates: Bump actions/cache from 3.0.8 to 3.0.11. Bump actions/checkout from 3.0.2 to 3.1.0. Bump actions/setup-java from 3.5.1 to 3.6.0. Bump spotbugs-maven-plugin from 4.7.2.0 to 4.7.3.0. aqute-bnd was updated from version 5.2.0 to 6.3.1: For the full list of changes please consult the following: https://github.com/bndtools/bnd/wiki/Changes-in-6.3.1 https://github.com/bndtools/bnd/wiki/Changes-in-6.3.0 https://github.com/bndtools/bnd/wiki/Changes-in-6.2.0 https://github.com/bndtools/bnd/wiki/Changes-in-6.1.0 https://github.com/bndtools/bnd/wiki/Changes-in-6.0.0 https://github.com/bndtools/bnd/wiki/Changes-in-5.3.0 tomcat-jakartaee-migration: New package implementation of tomcat-jakartaee-migration at version 1.0.7 libtcnative-1-0 was updated from version 1.2.22 to 1.2.38: Changes of version 1.2.22 to 1.2.38: Align default pass phrase prompt with HTTPd. Fix memory leak in SNI processing. Update the recommended minimum version of OpenSSL to 1.1.1v. Update the recommended minimum version of APR to 1.7.4. Document the TLS rengotiation behaviour. Add HOWTO-RELEASE.txt that describes the release process. Refactor library initialization so it is compatible with Tomcat 10.1.x onwards where a number of Java classes have been removed. Map the OpenSSL 3.x FIPS behaviour to the OpenSSL 1.x API to allow clients to determine if the FIPS provider is being used when Tomcat Native is compiled against OpenSSL 3.x. Fix crash when attempting to read TLS session ID after a handshake failure. Enable downloaddeps.sh to be called from any directory. Fix release script so it works with the current git layout. Correct previous fix that enabled building to continue with OpenSSL 3.x. Remove remaining reference to pkg-config which is no longer included in the Tomcat Native distribution. Additional changes required to provided support for using OpenSSL Engines that use proprietary key formats. Correct handling of WINVER in make file to use correct constant for Windows 7. Add constants for Windows 8, Windows 8.1 and Windows 10. Rename WINNT to WIN2k as it is used for Windows 2000 upwards, not Windows NT upwards. Add a patch for APR that fixes an issue where some Windows systems in some configurations would only listen on IPv6 addresses on dual stack systems even though configured to listen on both IPv6 and IPv4 addresses. Correct a regression in the fix for 65181 that prevented an error message from being displayed if an invalid key file was provided and no OpenSSL Engine was configured. Improve support for using OpenSSL Engines that use proprietary key formats. Enable building to continue against OpenSSL 3.x and 1.1.1. Incomplete name mangling fix for C++ compilers in tcnapi.h. Improve OS-specific header include for native thread id. Disable keylog callback support for LibreSSL. Add support for SSLContext.addChainCertificateRaw() with LibreSSL 2.9.1 and up. Add support for HP-UX's lwpself() in our sslthreadid(void). Remove default option passed for rpath to linker on HP-UX. Add an option to allow the OCSP responder check to be bypassed. Note that if OCSP is enabled, a missing responder is now treated as an error. Fix compilation with LibreSSL. libtcnative does not compile with OpenSSL < 1.1.0 and APR w/o threading support. Correct configure message for OpenSSL libdir. Clean up install target. configure output for OpenSSL wrong/incomplete sometimes. Drop obsolete build time workarounds for HP-UX. Add support for FreeBSD's pthreadgetthreadidnp() in our sslthreadid(void). Introduce tcngetthreadid(void) to reduce code duplication. Fix linking against OpenSSL in non-standard locations on FreeBSD.

This update for ceph fixes the following issues: Fix FTBFS on gcc 13 (bsc#1201088) Fix FTBFS on s390x (bsc#1211090) ceph-volume: Fix regression in activate (bsc#1210243, bsc#1210314) cephadm: Fix NFS haproxy failover if active node disappears (bsc#1209621) cephadm: Mount host /etc/hosts for daemon containers in podman deployments (bsc#1210719) cmake: Patch boost source to support python 3.11 (bsc#1210944) mgr: Don't dump global config holding gil (bsc#1199880) mgr/cephadm: Fix handling of mgr upgrades with 3 or more mgrs (bsc#1210153) mgr/dashboard: allow to pass controls on iscsi disk create (bsc#1208820) mgr/dashboard: Fix SSO error: 'str' object has no attribute 'decode' (bsc#1210784)

This update for tar fixes the following issues: CVE-2023-39804: Fixed extension attributes in PAX archives incorrect hanling (bsc#1217969).

This update for python-instance-billing-flavor-check fixes the following issues: Run the command as sudo only (bsc#1217696, bsc#1217695) Handle exception for Python 3.4

This update for libxcrypt fixes the following issues: fix variable name for datamember [bsc#1215496] added patches fix https://github.com/besser82/libxcrypt/commit/b212d601549a0fc84cbbcaf21b931f903787d7e2

This update for net-snmp fixes the following issues: Update to net-snmp-5.9.4 (bsc#1214364). libsnmp:

Remove the SNMPSWIPEMEM() macro Remove this macro since it is not used in the Net-SNMP code base. DISPLAY-HINT fixes Miscellanious improvements to the transports Handle multiple oldEngineID configuration lines fixes for DNS names longer than 63 characters

agent:

Added a ignoremount configuration option for the HOST-MIB disallow SETs with a NULL varbind fix the --enable-minimalist build

apps:

snmpset: allow SET with NULL varbind for testing snmptrapd: improved MySQL logging code

general:

configure: Remove -Wno-deprecated as it is no longer needed miscellanious ther bug fixes, build fixes and cleanups

Re-add support for hostname netgroups that was removed accidentally and previously added with FATE#316305 (bsc#1207697). '@hostgroup' can be specified for multiple hosts

Hardening systemd services setting "ProtectHome=true" caused home directory size and allocation to be listed incorrectly (bsc#1206044).

This update for gnustep-base fixes the following issues: Build against ICU 73.

This update for polkit fixes the following issues: Change permissions for rules folders (bsc#1209282)

This update for procps fixes the following issues: Update procps to 3.3.17 (jsc#PED-3244 jsc#PED-6369)

For support up to 2048 CPU as well (bsc#1185417)

Allow -´ as leading character to ignore possible errors on systctl entries (bsc#1209122) Get the first CPU summary correct (bsc#1121753) Enable pidof for SLE-15 as this is provided by sysvinit-tools Use a check on syscall NRpidfdopen to decide if the pwait tool and its manual page will be build Do not truncate output of w with option -n Prefer logind over utmp (jsc#PED-3144) Don't install translated man pages for non-installed binaries (uptime, kill). Fix directory for Ukrainian man pages translations.

Move localized man pages to lang package.

Update to procps-ng-3.3.17

library: Incremented to 8:3:0 (no removals or additions, internal changes only)

all: properly handle utf8 cmdline translations kill: Pass int to signalled process pgrep: Pass int to signalled process pgrep: Check sanity of SGARGMAX pgrep: Add older than selection pidof: Quiet mode pidof: show worker threads ps.1: Mention stime alias ps: check also match on truncated 16 char comm names ps: Add exe output option ps: A lot more sorting available pwait: New command waits for a process sysctl: Match systemd directory order sysctl: Document directory order top: ensure config file backward compatibility top: add command line 'e' for symmetry with 'E' top: add '4' toggle for two abreast cpu display top: add '!' toggle for combining multiple cpus top: fix potential SEGV involving -p switch vmstat: Wide mode gives wider proc columns watch: Add environment variable for interval watch: Add no linewrap option watch: Support more colors

free,uptime,slabtop: complain about extra ops

Package translations in procps-lang.

Fix pgrep: cannot allocate 4611686018427387903 bytes when ulimit -s is unlimited.

Enable pidof by default

Update to procps-ng-3.3.16

library: Increment to 8:2:0 No removals or functions Internal changes only, so revision is incremented. Previous version should have been 8:1:0 not 8:0:1

docs: Use correct symbols for -h option in free.1

docs: ps.1 now warns about command name length docs: install translated man pages pgrep: Match on runstate snice: Fix matching on pid top: can now exploit 256-color terminals top: preserves 'other filters' in configuration file top: can now collapse/expand forest view children top: parent %CPU time includes collapsed children top: improve xterm support for vim navigation keys top: avoid segmentation fault at program termination "ps -C" does not allow anymore an argument longer than 15 characters (bsc#1158830)

This update for postfix fixes the following issues: CVE-2023-51764: Fixed SMTP smuggling attack (bsc#1218304).

This update for webkit2gtk3 fixes the following issues: CVE-2023-42890: Fixed processing malicious web content may lead to arbitrary code execution (bsc#1218033). CVE-2023-42883: Fixed processing a malicious image may lead to a denial-of-service (bsc#1218032). CVE-2023-41074: Fixed use-after-free in the MediaRecorder API of the WebKit GStreamer-based ports (bsc#1215870). CVE-2023-40451, CVE-2023-41074: Update to version 2.42.4 (bsc#1218032, bsc#1215868).

This update for gstreamer-plugins-bad fixes the following issues: CVE-2023-44446: Fixed GStreamer MXF File Parsing Use-After-Free (bsc#1217213). CVE-2023-40475: Fixed GStreamer MXF File Parsing Integer Overflow (bsc#1215792).

This update for libssh2org fixes the following issues: CVE-2023-48795: Fixed prefix truncation breaking ssh channel integrity (Terrapin Attack) (bsc#1218127).

This update for gnutls fixes the following issues: CVE-2023-5981: Fixed timing side-channel inside RSA-PSK key exchange (bsc#1217277).

This update for xorg-x11-server fixes the following issues: CVE-2023-6377: Fixed out-of-bounds memory write in XKB button actions (bsc#1217765).

This update for libqt5-qtbase fixes the following issues: CVE-2023-37369: Fixed buffer overflow in QXmlStreamReader (bsc#1214327).

libq5-qtbase was rebuild against icu 73. jsc#PED-6193

This update for ghostscript fixes the following issues: CVE-2023-46751: Fixed dangling pointer in gdevprnopenprinterseekable() (bsc#1217871).

This update for openssh fixes the following issues: CVE-2023-48795: Fixed prefix truncation breaking ssh channel integrity (bsc#1217950). the following non-security bug was fixed: Fix the 'no route to host' error when connecting via ProxyJump

This update for avahi fixes the following issues: CVE-2023-38472: Fixed reachable assertion in avahirdataparse (bsc#1216853).

This update for ncurses fixes the following issues: CVE-2023-50495: Fixed a segmentation fault via ncwrapentry() (bsc#1218014) Modify reset command to avoid altering clocal if the terminal uses a modem (bsc#1201384)

This update for gstreamer-plugins-bad fixes the following issues: CVE-2023-44429: Fixed GStreamer AV1 Codec Parsing Heap-based Buffer Overflow (bsc#1217211).

This update for tiff fixes the following issues: CVE-2023-2731: Fix null pointer deference in LZWDecode() (bsc#1211478). CVE-2023-1916: Fix out-of-bounds read in extractImageSection() (bsc#1210231). CVE-2023-26965: Fix heap-based use after free in loadImage() (bsc#1212398). CVE-2022-40090: Fix infinite loop in TIFFReadDirectory() (bsc#1214680).

This update for cosign fixes the following issues: Updated to 2.2.1 (jsc#SLE-23879) Enhancements: CVE-2023-46737: Possible endless data attack from attacker-controlled registry (bsc#1216933) feat: Support basic auth and bearer auth login to registry (#3310) add support for ignoring certificates with pkcs11 (#3334) Support ReplaceOp in Signatures (#3315) feat: added ability to get image digest back via triangulate (#3255) feat: add --only flag in cosign copy to copy sign, att & sbom (#3247) feat: add support attaching a Rekor bundle to a container (#3246) feat: add support outputting rekor response on signing (#3248) feat: improve dockerfile verify subcommand (#3264) Add guard flag for experimental OCI 1.1 verify. (#3272) Deprecate SBOM attachments (#3256) feat: dedent line in cosign copy doc (#3244) feat: add platform flag to cosign copy command (#3234) Add SLSA 1.0 attestation support to cosign. Closes #2860 (#3219) attest: pass OCI remote opts to att resolver. (#3225) Bug Fixes: Merge pull request from GHSA-vfp6-jrw2-99g9 fix: allow cosign download sbom when image is absent (#3245) ci: add a OCI registry test for referrers support (#3253) Fix ReplaceSignatures (#3292) Stop using deprecated intoto.ProvenanceStatement (#3243) Fixes #3236, disable SCT checking for a cosign verification when using .. (#3237) fix: update error in SignedEntity to be more descriptive (#3233) Fail timestamp verification if no root is provided (#3224) Documentation: Add some docs about verifying in an air-gapped environment (#3321) Update CONTRIBUTING.md (#3268) docs: improves the Contribution guidelines (#3257) Remove security policy (#3230) Others: Set go to min 1.21 and update dependencies (#3327) Update contact for code of conduct (#3266) Update .ko.yaml (#3240) Updated to 2.2.0 (jsc#SLE-23879) Enhancements switch to uploading DSSE types to rekor instead of intoto (#3113) add 'cosign sign' command-line parameters for mTLS (#3052) improve error messages around bundle != payload hash (#3146) make VerifyImageAttestation function public (#3156) Switch to cryptoutils function for SANS (#3185) Handle HTTP11REQUIRED errors in github provider (#3172) Bug Fixes Fix nondeterminsitic timestamps (#3121) Documentation doc: Add example of sign-blob with key in env var (#3152) add deprecation notice for cosign-releases GCS bucket (#3148) update doc links (#3186) Updated to 2.1.1 (jsc#SLE-23879) Bug Fixes wait for the workers become available again to continue the execution (#3084) fix help text when in a container (#3082) Updated to 2.1.0 (jsc#SLE-23879) Breaking Change: The predicate is now a required flag in the attest commands, set via the --type flag. Enhancements Verify sigs and attestations in parallel (#3066) Deep inspect attestations when filtering download (#3031) refactor bundle validation code, add support for DSSE rekor type (#3016) Allow overriding remote options (#3049) feat: adds no cert found on sig exit code (#3038) Make predicate a required flag in attest commands (#3033) Added support for attaching Time stamp authority Response in attach command (#3001) Add sign --sign-container-identity CLI (#2984) Feature: Allow cosign to sign digests before they are uploaded. (#2959) accepts attachment-tag-prefix for cosign copy (#3014) Feature: adds '--allow-insecure-registry' for cosign load (#3000) download attestation: support --platform flag (#2980) Cleanup: Add Digest to the SignedEntity interface. (#2960) verify command: support keyless verification using only a provided certificate chain with non-fulcio roots (#2845) verify: use workers to limit the paralellism when verifying images with --max-workers flag (#3069) Bug Fixes Fix pkg/cosign/errors (#3050) Fix: update doc to refer to github-actions oidc provider (#3040) Fix: prefer GitHub OIDC provider if enabled (#3044) Fix --sig-only in cosign copy (#3074) Documentation Fix links to sigstore/docs in markdown files (#3064) Update to 2.0.2 (jsc#SLE-23879) Enhancements Update sigstore/sigstore to v1.6.2 to pick up TUF CDN change (#2891) feat: Make cosign copy faster (#2901) remove sget (#2885) Require a payload to be provided with a signature (#2785)

Bug Fixes cmd: Change error message from KeyParseError to PubKeyParseError for verify-blob. (#2876) Use SOURCEDATEEPOCH for OCI CreatedAt times (#2878)

Documentation Remove experimental warning from Fulcio flags (#2923) add missing oidc provider (#2922) Add zot as a supported registry (#2920) deprecates kmssupport docs (#2900) chore(docs) deprecate note for usage docs (#2906) adds note of deprecation for examples.md docs (#2899)

This update for webkit2gtk3 fixes the following issues: Update to version 2.42.3 (bsc#1217844): Fix flickering while playing videos with DMA-BUF sink. Fix color picker being triggered in the inspector when typing "tan". Do not special case the "sans" font family name. Fix build failure with libxml2 version 2.12.0 due to an API change. Fix several crashes and rendering issues. Security fixes: CVE-2023-42916, CVE-2023-42917.

This update for python3-cryptography fixes the following issues: CVE-2023-49083: Fixed a NULL pointer dereference when loading certificates from a PKCS#7 bundle (bsc#1217592).