SUSE-CU-2025:3781-1: Security update of suse/kiosk/firefox-esr
sle-container-updates at lists.suse.com
sle-container-updates at lists.suse.com
Tue May 27 16:24:31 UTC 2025
SUSE Container Update Advisory: suse/kiosk/firefox-esr
-----------------------------------------------------------------
Container Advisory ID : SUSE-CU-2025:3781-1
Container Tags : suse/kiosk/firefox-esr:128.10 , suse/kiosk/firefox-esr:128.10-45.2 , suse/kiosk/firefox-esr:esr , suse/kiosk/firefox-esr:latest
Container Release : 45.2
Severity : critical
Type : security
References : 1102016 1106881 1129714 1140205 1140754 1149789 1160611 1160612
1160613 1160614 1160615 1162090 1162395 1166066 1172526 1172640
1173578 1179821 1180043 1180044 1180046 1180457 1184774 1186406
1186583 1186586 1186587 1186596 1186597 1186598 1186600 1186603
1186604 1186605 1186607 1186613 1186614 1186615 1186616 1186658
1186660 1186756 1186757 1186758 1186761 1186762 1186763 1186849
1186859 1186861 1186863 1187852 1189142 1189166 1189348 1189350
1189428 1189724 1190718 1190719 1190721 1190722 1190723 1190724
1190726 1190727 1190728 1190729 1190731 1190732 1190733 1190734
1190735 1205435 1206442 1206778 1209934 1210212 1214246 1215231
1215778 1223070 1223235 1223256 1223272 1223304 1223437 1225403
1225879 1227296 1228322 1229582 1233046 1234028 1235091 1235092
1236007 1237358 1237371 1237382 1243303 CVE-2018-14423 CVE-2018-16376
CVE-2018-20846 CVE-2018-21010 CVE-2019-13390 CVE-2019-17539 CVE-2019-2126
CVE-2019-9232 CVE-2019-9325 CVE-2019-9371 CVE-2019-9433 CVE-2019-9721
CVE-2020-0034 CVE-2020-13904 CVE-2020-15389 CVE-2020-20448 CVE-2020-20451
CVE-2020-20891 CVE-2020-20892 CVE-2020-20894 CVE-2020-20895 CVE-2020-20896
CVE-2020-20898 CVE-2020-20899 CVE-2020-20900 CVE-2020-20901 CVE-2020-20902
CVE-2020-21041 CVE-2020-21688 CVE-2020-21697 CVE-2020-22015 CVE-2020-22016
CVE-2020-22017 CVE-2020-22019 CVE-2020-22020 CVE-2020-22021 CVE-2020-22022
CVE-2020-22023 CVE-2020-22025 CVE-2020-22026 CVE-2020-22027 CVE-2020-22031
CVE-2020-22032 CVE-2020-22033 CVE-2020-22034 CVE-2020-22037 CVE-2020-22038
CVE-2020-22039 CVE-2020-22042 CVE-2020-22043 CVE-2020-22044 CVE-2020-22046
CVE-2020-22048 CVE-2020-22049 CVE-2020-22054 CVE-2020-27823 CVE-2020-27824
CVE-2020-27842 CVE-2020-27843 CVE-2020-27845 CVE-2020-35965 CVE-2020-8112
CVE-2021-28429 CVE-2021-29338 CVE-2021-3566 CVE-2021-38090 CVE-2021-38091
CVE-2021-38092 CVE-2021-38093 CVE-2021-38094 CVE-2021-38094 CVE-2021-38114
CVE-2021-38171 CVE-2021-38291 CVE-2022-3109 CVE-2022-3341 CVE-2022-48434
CVE-2023-1999 CVE-2023-4863 CVE-2023-49502 CVE-2023-50010 CVE-2023-51793
CVE-2023-51794 CVE-2023-51798 CVE-2023-5217 CVE-2023-6349 CVE-2024-12361
CVE-2024-31578 CVE-2024-32230 CVE-2024-35365 CVE-2024-35368 CVE-2024-36613
CVE-2024-5197 CVE-2025-0518 CVE-2025-22919 CVE-2025-22921 CVE-2025-4918
CVE-2025-4919
-----------------------------------------------------------------
The container suse/kiosk/firefox-esr was updated. The following patches have been included in this update:
-----------------------------------------------------------------
Advisory ID: SUSE-SU-2020:143-1
Released: Mon Jan 20 16:10:38 2020
Summary: Security update for libvpx
Type: security
Severity: important
References: 1160611,1160612,1160613,1160614,1160615,CVE-2019-2126,CVE-2019-9232,CVE-2019-9325,CVE-2019-9371,CVE-2019-9433
This update for libvpx fixes the following issues:
- CVE-2019-2126: Fixed a double free in ParseContentEncodingEntry() (bsc#1160611).
- CVE-2019-9325: Fixed an out-of-bounds read (bsc#1160612).
- CVE-2019-9232: Fixed an out-of-bounds memory access on fuzzed data (bsc#1160613).
- CVE-2019-9433: Fixed a use-after-free in vp8_deblock() (bsc#1160614).
- CVE-2019-9371: Fixed a resource exhaustion after memory leak (bsc#1160615).
-----------------------------------------------------------------
Advisory ID: SUSE-RU-2020:336-1
Released: Thu Feb 6 12:45:08 2020
Summary: Recommended update for opus
Type: recommended
Severity: moderate
References: 1162395
This update for opus fixes the following issues:
- Fixes an issue with the analysis on files with digital silence (all zeros), especially
on x87 builds (mostly affects 32-bit builds)
- Improved speech/music detection based on a neural network
- Low-bitrate speech improvements
- Added support for immersive audio using ambisonics
- Improved tone quality
This update also improves the security of this software.
-----------------------------------------------------------------
Advisory ID: SUSE-SU-2020:1297-1
Released: Mon May 18 07:42:18 2020
Summary: Security update for libvpx
Type: security
Severity: moderate
References: 1166066,CVE-2020-0034
This update for libvpx fixes the following issues:
- CVE-2020-0034: Fixed an out-of-bounds read on truncated key frames (bsc#1166066).
-----------------------------------------------------------------
Advisory ID: SUSE-RU-2020:2115-1
Released: Tue Aug 4 12:12:10 2020
Summary: Recommended update for opus
Type: recommended
Severity: moderate
References: 1172526
This update for opus fixes the following issues:
- Fix for an issue when the 'CELTDecoder' can be larger than 21 and cauese crash by builds with custom modes or hardening. (bsc#1172526)
-----------------------------------------------------------------
Advisory ID: SUSE-SU-2021:2322-1
Released: Wed Jul 14 17:03:03 2021
Summary: Security update for ffmpeg
Type: security
Severity: important
References: 1172640,1186406,1186583,1186586,1186587,1186596,1186597,1186598,1186600,1186603,1186604,1186605,1186613,1186614,1186615,1186616,1186658,1186660,1186757,1186758,1186762,1186763,CVE-2019-17539,CVE-2020-13904,CVE-2020-20448,CVE-2020-20451,CVE-2020-21041,CVE-2020-22015,CVE-2020-22016,CVE-2020-22017,CVE-2020-22019,CVE-2020-22020,CVE-2020-22021,CVE-2020-22022,CVE-2020-22023,CVE-2020-22025,CVE-2020-22026,CVE-2020-22031,CVE-2020-22032,CVE-2020-22033,CVE-2020-22034,CVE-2020-22038,CVE-2020-22039,CVE-2020-22043,CVE-2020-22044
This update for ffmpeg fixes the following issues:
- CVE-2020-13904: Fixed use-after-free via a crafted EXTINF duration in an m3u8 file (bsc#1172640).
- CVE-2020-21041: Fixed buffer overflow vulnerability via apng_do_inverse_blend in libavcodec/pngenc.c (bsc#1186406).
- CVE-2019-17539: Fixed NULL pointer dereference in avcodec_open2 in libavcodec/utils.c (bsc# 1154065).
- CVE-2020-22026: Fixed buffer overflow vulnerability in config_input() at libavfilter/af_tremolo.c (bsc#1186583).
- CVE-2020-22021: Fixed buffer overflow vulnerability in filter_edges function in libavfilter/vf_yadif.c (bsc#1186586).
- CVE-2020-22020: Fixed buffer overflow vulnerability in build_diff_map() in libavfilter/vf_fieldmatch.c (bsc#1186587).
- CVE-2020-22015: Fixed buffer overflow vulnerability in mov_write_video_tag() due to the out of bounds in libavformat/movenc.c (bsc#1186596).
- CVE-2020-22016: Fixed a heap-based Buffer Overflow vulnerability at libavcodec/get_bits.h when writing .mov files (bsc#1186598).
- CVE-2020-22017: Fixed a heap-based Buffer Overflow vulnerability in ff_fill_rectangle() in libavfilter/drawutils.c (bsc#1186600).
- CVE-2020-22022: Fixed a heap-based Buffer Overflow vulnerability in filter_frame at libavfilter/vf_fieldorder.c (bsc#1186603).
- CVE-2020-22023: Fixed a heap-based Buffer Overflow vulnerability in filter_frame at libavfilter/vf_bitplanenoise.c (bsc#1186604)
- CVE-2020-22025: Fixed a heap-based Buffer Overflow vulnerability in gaussian_blur at libavfilter/vf_edgedetect.c (bsc#1186605).
- CVE-2020-22031: Fixed a heap-based Buffer Overflow vulnerability at libavfilter/vf_w3fdif.c in filter16_complex_low() (bsc#1186613).
- CVE-2020-22032: Fixed a heap-based Buffer Overflow vulnerability at libavfilter/vf_edgedetect.c in gaussian_blur() (bsc#1186614).
- CVE-2020-22034: Fixed a heap-based Buffer Overflow vulnerability at libavfilter/vf_floodfill.c (bsc#1186616).
- CVE-2020-20451: Fixed denial of service issue due to resource management errors via fftools/cmdutils.c (bsc#1186658).
- CVE-2020-20448: Fixed divide by zero issue via libavcodec/ratecontrol.c (bsc#1186660).
- CVE-2020-22038: Fixed denial of service vulnerability due to a memory leak in the ff_v4l2_m2m_create_context function in v4l2_m2m.c (bsc#1186757).
- CVE-2020-22039: Fixed denial of service vulnerability due to a memory leak in the inavi_add_ientry function (bsc#1186758).
- CVE-2020-22043: Fixed denial of service vulnerability due to a memory leak at the fifo_alloc_common function in libavutil/fifo.c (bsc#1186762).
- CVE-2020-22044: Fixed denial of service vulnerability due to a memory leak in the url_open_dyn_buf_internal function in libavformat/aviobuf.c (bsc#1186763).
- CVE-2020-22033,CVE-2020-22019: Fixed a heap-based Buffer Overflow Vulnerability at libavfilter/vf_vmafmotion.c in convolution_y_8bit() and in convolution_y_10bit() in libavfilter/vf_vmafmotion.c (bsc#1186615, bsc#1186597).
-----------------------------------------------------------------
Advisory ID: SUSE-SU-2021:2919-1
Released: Thu Sep 2 10:04:41 2021
Summary: Security update for ffmpeg
Type: security
Severity: important
References: 1129714,1186849,1186859,1186861,1186863,1189142,1189348,1189350,CVE-2019-9721,CVE-2020-21688,CVE-2020-21697,CVE-2020-22046,CVE-2020-22048,CVE-2020-22049,CVE-2020-22054,CVE-2021-38114
This update for ffmpeg fixes the following issues:
- CVE-2019-9721: Fix denial of service in the subtitle decoder in handle_open_brace from libavcodec/htmlsubtitles.c (bsc#1129714).
- CVE-2020-22046: Fix a denial of service vulnerability exists in FFmpeg 4.2 due to a memory leak in the avpriv_float_dsp_allocl function in libavutil/float_dsp.c (bsc#1186849).
- CVE-2020-22048: Fix a denial of service vulnerability exists in FFmpeg 4.2 due to a memory leak in the ff_frame_pool_get function in framepool.c (bsc#1186859).
- CVE-2020-22049: Fix a denial of service vulnerability exists in FFmpeg 4.2 due to a memory leak in the wtvfile_open_sector function in wtvdec.c (bsc#1186861).
- CVE-2020-22054: Fix a denial of service vulnerability exists in FFmpeg 4.2 due to a memory leak in the av_dict_set function in dict.c (bsc#1186863).
- CVE-2020-21688: Fixed a heap-use-after-free in the av_freep function in libavutil/mem.c (bsc#1189348).
- CVE-2020-21697: Fixed a heap-use-after-free in the mpeg_mux_write_packet function in libavformat/mpegenc.c (bsc#1189350).
- CVE-2021-38114: Fixed a not checked return value of the init_vlc function (bsc#1189142).
-----------------------------------------------------------------
Advisory ID: SUSE-SU-2021:3193-1
Released: Thu Sep 23 11:24:50 2021
Summary: Security update for ffmpeg
Type: security
Severity: important
References: 1189724,CVE-2021-38171
This update for ffmpeg fixes the following issues:
- CVE-2021-38171: Fixed adts_decode_extradata in libavformat/adtsenc.c to check the init_get_bits return value (bsc#1189724).
-----------------------------------------------------------------
Advisory ID: SUSE-SU-2021:3293-1
Released: Wed Oct 6 16:47:31 2021
Summary: Security update for ffmpeg
Type: security
Severity: moderate
References: 1186761,CVE-2020-22042
This update for ffmpeg fixes the following issues:
- CVE-2020-22042: Fixed a denial of service vulnerability led by a memory leak in the link_filter_inouts function in libavfilter/graphparser.c. (bsc#1186761)
-----------------------------------------------------------------
Advisory ID: SUSE-SU-2021:3521-1
Released: Tue Oct 26 15:38:44 2021
Summary: Security update for ffmpeg
Type: security
Severity: moderate
References: 1186756,1187852,1189166,1190718,1190719,1190722,1190723,1190726,1190729,1190733,1190734,1190735,CVE-2020-20891,CVE-2020-20892,CVE-2020-20895,CVE-2020-20896,CVE-2020-20899,CVE-2020-20902,CVE-2020-22037,CVE-2020-35965,CVE-2021-3566,CVE-2021-38092,CVE-2021-38093,CVE-2021-38094
This update for ffmpeg fixes the following issues:
- CVE-2021-3566: Fixed information leak (bsc#1189166).
- CVE-2021-38093: Fixed integer overflow vulnerability in filter_robert() (bsc#1190734)
- CVE-2021-38092: Fixed integer overflow vulnerability in filter_prewitt() (bsc#1190733)
- CVE-2021-38094: Fixed integer overflow vulnerability in filter_sobel() (bsc#1190735)
- CVE-2020-22037: Fixed denial of service vulnerability caused by memory leak in avcodec_alloc_context3() (bsc#1186756)
- CVE-2020-35965: Fixed out-of-bounds write in decode_frame() (bsc#1187852)
- CVE-2020-20892: Fixed an issue with filter_frame() (bsc#1190719)
- CVE-2020-20891: Fixed a buffer overflow vulnerability in config_input() (bsc#1190718)
- CVE-2020-20895: Fixed a buffer overflow vulnerability in function filter_vertically_##name (bsc#1190722)
- CVE-2020-20896: Fixed an issue with latm_write_packet() (bsc#1190723)
- CVE-2020-20899: Fixed a buffer overflow vulnerability in config_props() (bsc#1190726)
- CVE-2020-20902: Fixed an out-of-bounds read vulnerabilit long_term_filter() (bsc#1190729)
-----------------------------------------------------------------
Advisory ID: SUSE-OU-2022:885-1
Released: Thu Mar 17 09:47:48 2022
Summary: Optional update for SUSE Package Hub
Type: optional
Severity: moderate
References:
This optional update provides the following changes:
- Provide binaries for non x86_64 architectures directly to SUSE Package Hub.
- There are no visible changes for the final user.
- Affected source packages: freerdp, libgsm
-----------------------------------------------------------------
Advisory ID: SUSE-SU-2022:1296-1
Released: Thu Apr 21 17:28:44 2022
Summary: Security update for openjpeg
Type: security
Severity: important
References: 1102016,1106881,1162090,1173578,1180457,1184774,CVE-2018-14423,CVE-2018-16376,CVE-2020-15389,CVE-2020-27823,CVE-2020-8112,CVE-2021-29338
This update for openjpeg fixes the following issues:
- CVE-2018-14423: Fixed division-by-zero vulnerabilities in the functions pi_next_pcrl, pi_next_cprl,and pi_next_rpcl in lib/openjp3d/pi.c (bsc#1102016).
- CVE-2018-16376: Fixed heap-based buffer overflow function t2_encode_packet in lib/openmj2/t2.c (bsc#1106881).
- CVE-2020-8112: Fixed a heap buffer overflow in opj_t1_clbl_decode_processor in openjp2/t1.c (bsc#1162090).
- CVE-2020-15389: Fixed a use-after-free if a mix of valid and invalid files in a directory operated on by the decompressor (bsc#1173578).
- CVE-2020-27823: Fixed a heap buffer over-write in opj_tcd_dc_level_shift_encode() (bsc#1180457),
- CVE-2021-29338: Fixed an integer Overflow allows remote attackers to crash the application (bsc#1184774).
-----------------------------------------------------------------
Advisory ID: SUSE-SU-2022:4082-1
Released: Fri Nov 18 15:44:06 2022
Summary: Security update for openjpeg
Type: security
Severity: important
References: 1140205,1149789,1179821,1180043,1180044,1180046,CVE-2018-20846,CVE-2018-21010,CVE-2020-27824,CVE-2020-27842,CVE-2020-27843,CVE-2020-27845
This update for openjpeg fixes the following issues:
- CVE-2018-20846: Fixed an Out-of-bounds accesses in pi_next_lrcp, pi_next_rlcp, pi_next_rpcl, pi_next_pcrl, pi_next_rpcl, and pi_next_cprl in openmj2/pi. (bsc#1140205)
- CVE-2018-21010: Fixed a heap buffer overflow in color_apply_icc_profile in bin/common/color.c (bsc#1149789)
- CVE-2020-27824: Fixed an OOB read in opj_dwt_calc_explicit_stepsizes() (bsc#1179821)
- CVE-2020-27842: Fixed null pointer dereference in opj_tgt_reset function in lib/openjp2/tgt.c (bsc#1180043)
- CVE-2020-27843: Fixed an out-of-bounds read in opj_t2_encode_packet function in openjp2/t2.c (bsc#1180044)
- CVE-2020-27845: Fixed a heap-based buffer over-read in functions opj_pi_next_rlcp, opj_pi_next_rpcl and opj_pi_next_lrcp in openjp2/pi.c (bsc#1180046)
-----------------------------------------------------------------
Advisory ID: SUSE-SU-2023:7-1
Released: Mon Jan 2 11:39:38 2023
Summary: Security update for ffmpeg
Type: security
Severity: moderate
References: 1206442,CVE-2022-3109
This update for ffmpeg fixes the following issues:
- CVE-2022-3109: Fixed null pointer dereference in vp3_decode_frame() (bsc#1206442).
-----------------------------------------------------------------
Advisory ID: SUSE-SU-2023:206-1
Released: Mon Jan 30 11:17:59 2023
Summary: Security update for ffmpeg
Type: security
Severity: moderate
References: 1140754,1206778,CVE-2019-13390,CVE-2022-3341
This update for ffmpeg fixes the following issues:
- CVE-2022-3341: Fixed a potential crash when processing a crafted
NUT stream (bsc#1206778).
- CVE-2019-13390: Fixed a potential crash when processing a crafted
AVI stream (bsc#1140754).
-----------------------------------------------------------------
Advisory ID: SUSE-SU-2023:2108-1
Released: Fri May 5 12:26:28 2023
Summary: Security update for ffmpeg
Type: security
Severity: important
References: 1209934,CVE-2022-48434
This update for ffmpeg fixes the following issues:
- CVE-2022-48434: Fixed use after free in libavcodec/pthread_frame.c (bsc#1209934).
-----------------------------------------------------------------
Advisory ID: SUSE-SU-2023:2467-1
Released: Thu Jun 8 09:44:36 2023
Summary: Security update for libwebp
Type: security
Severity: important
References: 1210212,CVE-2023-1999
This update for libwebp fixes the following issues:
- CVE-2023-1999: Fixed a double free (bsc#1210212).
-----------------------------------------------------------------
Advisory ID: SUSE-OU-2023:3146-1
Released: Wed Aug 2 09:45:25 2023
Summary: Optional update for mono-core, ghc, ghc-xml-conduit, gstreamer, poppler and python-mccabe
Type: optional
Severity: low
References:
This optional update provides the following feature:
- Add additional binaries to PackageHub:
mono-core, ghc, ghc-xml-conduit, gstreamer, poppler and python-mccabe.
-----------------------------------------------------------------
Advisory ID: SUSE-SU-2023:3634-1
Released: Mon Sep 18 12:52:38 2023
Summary: Security update for libwebp
Type: security
Severity: critical
References: 1215231,CVE-2023-4863
This update for libwebp fixes the following issues:
- CVE-2023-4863: Fixed heap buffer overflow (bsc#1215231).
-----------------------------------------------------------------
Advisory ID: SUSE-SU-2023:3818-1
Released: Wed Sep 27 18:34:04 2023
Summary: Security update for ffmpeg
Type: security
Severity: moderate
References: 1214246,CVE-2021-28429
This update for ffmpeg fixes the following issues:
- CVE-2021-28429: Fixed Integer overflow vulnerability in av_timecode_make_string in libavutil/timecode.c (bsc#1214246).
-----------------------------------------------------------------
Advisory ID: SUSE-SU-2023:3948-1
Released: Tue Oct 3 19:06:25 2023
Summary: Security update for libvpx
Type: security
Severity: important
References: 1215778,CVE-2023-5217
This update for libvpx fixes the following issues:
- CVE-2023-5217: Fixed a heap buffer overflow (bsc#1215778).
-----------------------------------------------------------------
Advisory ID: SUSE-RU-2023:4111-1
Released: Wed Oct 18 12:50:14 2023
Summary: Recommended update for lame
Type: recommended
Severity: moderate
References:
This update for lame fixes the following issues:
- Add a pkg-config file for libmp3lame
-----------------------------------------------------------------
Advisory ID: SUSE-RU-2024:98-1
Released: Fri Jan 12 09:00:58 2024
Summary: Recommended update for gegl
Type: recommended
Severity: moderate
References:
This update for gegl and its dependencies fixes the following issues:
gegl:
- Allow building against a newer libraw (0.21) (jsc#PED-6351)
celt, fdk-aac-free, ffmpeg-4, ilmbase, ldacBT, lensfun, libass, libbluray, libbs2b,
libcdio-paranoia, libcdio, libdc1394, libgsm, libmfx, libopenmpt, libraw1394, libraw,
libspiro, libva, libvdpau, lilv, metis, openexr, pipewire, pulseaudio, rtkit, SDL2,
serd, sord, sratom, suitesparse, webrtc-audio-processing, wireplumber:
- Deliver missing direct and indirect dependencies of gegl
to SUSE Package Hub 15 SP{4,5} for aarch64, ppc64le, s390x and x86_64
- There are NO code changes
-----------------------------------------------------------------
Advisory ID: SUSE-RU-2024:563-1
Released: Wed Feb 21 05:37:24 2024
Summary: Recommended update for ffmpeg
Type: recommended
Severity: important
References: 1205435
This update for ffmpeg contains the following fixes:
- Added `libavresample3` and `libavformat57` to subpackages for Package Hub SLE-15-SP5 (bsc#1205435)
- Fix RPM package build with new `binutils`
-----------------------------------------------------------------
Advisory ID: SUSE-SU-2024:1468-1
Released: Mon Apr 29 17:58:58 2024
Summary: Security update for ffmpeg
Type: security
Severity: important
References: 1190721,1190724,1190727,1190728,1190731,1190732,1223070,1223235,CVE-2020-20894,CVE-2020-20898,CVE-2020-20900,CVE-2020-20901,CVE-2021-38090,CVE-2021-38091,CVE-2021-38094,CVE-2023-49502,CVE-2024-31578
This update for ffmpeg fixes the following issues:
- CVE-2024-31578: Fixed heap use-after-free via av_hwframe_ctx_init() when vulkan_frames init failed (bsc#1223070)
- CVE-2023-49502: Fixed heap buffer overflow via the ff_bwdif_filter_intra_c function in libavfilter/bwdifdsp.c (bsc#1223235)
Adding references for already fixed issues:
- CVE-2021-38091: Fixed integer overflow in function filter16_sobel in libavfilter/vf_convolution.c (bsc#1190732)
- CVE-2021-38090: Fixed integer overflow in function filter16_roberts in libavfilter/vf_convolution.c (bsc#1190731)
- CVE-2020-20898: Fixed integer overflow vulnerability in function filter16_prewitt in libavfilter/vf_convolution.c (bsc#1190724)
- CVE-2020-20901: Fixed buffer overflow vulnerability in function filter_frame in libavfilter/vf_fieldorder.c (bsc#1190728)
- CVE-2020-20900: Fixed buffer overflow vulnerability in function gaussian_blur in libavfilter/vf_edgedetect.c (bsc#1190727)
- CVE-2020-20894: Fixed buffer Overflow vulnerability in function gaussian_blur in libavfilter/vf_edgedetect.c (bsc#1190721)
-----------------------------------------------------------------
Advisory ID: SUSE-SU-2024:1593-1
Released: Fri May 10 09:21:31 2024
Summary: Security update for ffmpeg
Type: security
Severity: important
References: 1223256,CVE-2023-50010
This update for ffmpeg fixes the following issues:
- CVE-2023-50010: Fixed an arbitrary code execution via the set_encoder_id() (bsc#1223256).
-----------------------------------------------------------------
Advisory ID: SUSE-SU-2024:1908-1
Released: Mon Jun 3 17:27:48 2024
Summary: Security update for ffmpeg
Type: security
Severity: important
References: 1223437,CVE-2023-51794
This update for ffmpeg fixes the following issues:
- CVE-2023-51794: Fixed a heap buffer overflow in libavfilter. (bsc#1223437)
-----------------------------------------------------------------
Advisory ID: SUSE-SU-2024:2408-1
Released: Thu Jul 11 13:51:33 2024
Summary: Security update for libvpx
Type: security
Severity: important
References: 1225403,1225879,CVE-2023-6349,CVE-2024-5197
This update for libvpx fixes the following issues:
- CVE-2024-5197: Fixed interger overflow when calling vpx_img_alloc() or vpx_img_wrap() with large parameters (bsc#1225879).
- CVE-2023-6349: Fixed heap overflow when encoding a frame that has larger dimensions than the originally configured size (bsc#1225403).
-----------------------------------------------------------------
Advisory ID: SUSE-SU-2024:2814-1
Released: Wed Aug 7 12:02:18 2024
Summary: Security update for ffmpeg
Type: security
Severity: moderate
References: 1227296,CVE-2024-32230
This update for ffmpeg fixes the following issues:
- CVE-2024-32230: Fixed buffer overflow due to negative-size-param bug at libavcodec/mpegvideo_enc.c in load_input_picture (bsc#1227296)
-----------------------------------------------------------------
Advisory ID: SUSE-SU-2024:3114-1
Released: Tue Sep 3 17:04:56 2024
Summary: Security update for ffmpeg
Type: security
Severity: moderate
References: 1186607,1189428,1223304,CVE-2020-22027,CVE-2021-38291,CVE-2023-51798
This update for ffmpeg fixes the following issues:
- CVE-2020-22027: Fixed heap-based Buffer Overflow vulnerability exits in deflate16 at libavfilter/vf_neighbor.c (bsc#1186607)
- CVE-2021-38291: Fixed an assertion failure at src/libavutil/mathematics.c (bsc#1189428)
- CVE-2023-51798: Fixed floating point exception(FPE) via the interpolate function (bsc#1223304)
-----------------------------------------------------------------
Advisory ID: SUSE-RU-2024:3130-1
Released: Tue Sep 3 17:41:16 2024
Summary: Recommended update for libwebp
Type: recommended
Severity: moderate
References: 1228322,1229582
This update for libwebp fixes the following issue:
- added libwebp7-32bit to packagehub for Wine. (bsc#1228322 bsc#1229582)
-----------------------------------------------------------------
Advisory ID: SUSE-RU-2024:3992-1
Released: Fri Nov 15 06:06:14 2024
Summary: Recommended update for libvdpau
Type: recommended
Severity: important
References: 1233046
This update for libvdpau fixes the following issues:
- Add libvdpau1-32bit to Desktop Applications 15-SP5 and 15-SP6 (bsc#1233046)
-----------------------------------------------------------------
Advisory ID: SUSE-SU-2025:1450-1
Released: Mon May 5 09:42:40 2025
Summary: Security update for ffmpeg
Type: security
Severity: important
References: 1223272,1234028,1235091,1235092,1236007,1237358,1237371,1237382,CVE-2023-51793,CVE-2024-12361,CVE-2024-35365,CVE-2024-35368,CVE-2024-36613,CVE-2025-0518,CVE-2025-22919,CVE-2025-22921
This update for ffmpeg fixes the following issues:
- CVE-2025-22921: Clear array length when freeing it. (bsc#1237382)
- CVE-2025-0518: Fix memory data leak when use sscanf(). (bsc#1236007)
- CVE-2025-22919: Check for valid sample rate, to fix the invalid sample rate >= 0. (bsc#1237371)
- CVE-2024-12361: Add check for av_packet_new_side_data() to avoid null pointer dereference if allocation fails. (bsc#1237358)
- CVE-2024-36613: Adjust order of operations around block align. (bsc#1235092)
- CVE-2024-35365: Fix double-free on error. (bsc#1235091)
- CVE-2024-35368: Fix double-free on the AVFrame is unreferenced. (bsc#1234028)
- CVE-2023-51793: Fix out of array access. (bsc#1223272).
- CVE-2023-51793: Fixed a heap buffer overflow in the image_copy_plane function in libavutil/imgutils.c (bsc#1223272).
-----------------------------------------------------------------
Advisory ID: SUSE-SU-2025:1701-1
Released: Sat May 24 10:34:21 2025
Summary: Security update for MozillaFirefox
Type: security
Severity: important
References: 1243303,CVE-2025-4918,CVE-2025-4919
This update for MozillaFirefox fixes the following issues:
Update to Firefox Extended Support Release 128.10.1 ESR.
- MFSA 2025-37 (bsc#1243303)
* CVE-2025-4918: Out-of-bounds access when resolving Promise objects
* CVE-2025-4919: Out-of-bounds access when optimizing linear sums
-----------------------------------------------------------------
Advisory ID: SUSE-RU-2025:1714-1
Released: Tue May 27 13:23:20 2025
Summary: Recommended update for ncurses
Type: recommended
Severity: moderate
References:
This update for ncurses fixes the following issues:
- Backport sclp terminfo description entry if for s390 sclp terminal lines
- Add a further sclp entry for qemu s390 based systems
- Make use of dumb
The following package changes have been done:
- glibc-2.38-150600.14.32.1 updated
- libcelt0-2-0.11.3-150000.3.5.1 added
- libdrm2-2.4.118-150600.1.4 added
- libgsm1-1.0.14-150000.3.6.1 added
- libmp3lame0-3.100-150000.3.5.1 added
- libopenjpeg1-1.5.2-150000.4.10.1 added
- libopus0-1.3.1-150000.3.8.1 added
- libtheoradec1-1.1.1-150000.3.3.1 added
- libtwolame0-0.3.13-150000.3.2.2 added
- libva2-2.20.0-150600.1.3 added
- libvpx4-1.6.1-150000.6.16.1 added
- libwebp7-1.0.3-150200.3.12.1 added
- ncurses-utils-6.1-150000.5.30.1 updated
- libtheoraenc1-1.1.1-150000.3.3.1 added
- libva-drm2-2.20.0-150600.1.3 added
- libwebpmux3-1.0.3-150200.3.12.1 added
- libopenssl3-3.1.4-150600.5.27.1 updated
- libxcb-dri3-0-1.13-150000.3.11.1 added
- libvdpau1-1.1.1-150000.3.6.1 added
- libva-x11-2-2.20.0-150600.1.3 added
- libavutil55-3.4.2-150200.11.60.1 added
- libswresample2-3.4.2-150200.11.60.1 added
- libavcodec57-3.4.2-150200.11.60.1 added
- MozillaFirefox-128.10.1-150200.152.182.1 updated
- container:suse-sle15-15.6-33375097a0345d32d31538bda11eb1df6a7d789cc02aea81dd4bf1ae2743e2e7-0 added
- container:registry.suse.com-bci-bci-micro-15.6-33375097a0345d32d31538bda11eb1df6a7d789cc02aea81dd4bf1ae2743e2e7-0 added
- container:registry.suse.com-bci-bci-base-15.6-bade1a0b1412a6bef2cee21fde3f8533d590abd3fa8d77331adac2d2973a3240-0 removed
- libopenssl-3-fips-provider-3.1.4-150600.5.24.1 removed
- patterns-base-fips-20200124-150600.32.6.1 removed
More information about the sle-container-updates
mailing list