SUSE-IU-2022:1048-1: Security update of suse-sles-15-sp3-chost-byos-v20220818-hvm-ssd-x86_64
sle-security-updates at lists.suse.com
sle-security-updates at lists.suse.com
Sat Aug 20 11:42:09 UTC 2022
SUSE Image Update Advisory: suse-sles-15-sp3-chost-byos-v20220818-hvm-ssd-x86_64
-----------------------------------------------------------------
Image Advisory ID : SUSE-IU-2022:1048-1
Image Tags : suse-sles-15-sp3-chost-byos-v20220818-hvm-ssd-x86_64:20220818
Image Release :
Severity : important
Type : security
References : 1027519 1033084 1033085 1033086 1033087 1033088 1033089 1033090
1065729 1082318 1104264 1106390 1107066 1107067 1111973 1112723
1112726 1123685 1125007 1137373 1164384 1177461 1179195 1180814
1181658 1184339 1184924 1184970 1185762 1192449 1192761 1192764
1193629 1194013 1194550 1194708 1195157 1195463 1195504 1195775
1195916 1196125 1196224 1196696 1196850 1196901 1197362 1197570
1197684 1197754 1198020 1198043 1198197 1198255 1198507 1198627
1198732 1198828 1198924 1198976 1199042 1199235 1199247 1199482
1199487 1199489 1199657 1199734 1199948 1199965 1199966 1200170
1200217 1200263 1200278 1200343 1200442 1200549 1200556 1200571
1200599 1200600 1200604 1200605 1200608 1200619 1200622 1200657
1200692 1200802 1200806 1200807 1200809 1200810 1200813 1200816
1200820 1200821 1200822 1200825 1200828 1200829 1200855 1200925
1200964 1201050 1201080 1201143 1201147 1201149 1201160 1201171
1201177 1201193 1201222 1201225 1201394 1201469 1201490 1201492
1201493 1201495 1201496 1201560 1201640 1201644 1201664 1201672
1201673 1201676 1202436 CVE-2017-7607 CVE-2017-7608 CVE-2017-7609
CVE-2017-7610 CVE-2017-7611 CVE-2017-7612 CVE-2017-7613 CVE-2018-16062
CVE-2018-16402 CVE-2018-16403 CVE-2018-18310 CVE-2018-18520 CVE-2018-18521
CVE-2019-20454 CVE-2019-7146 CVE-2019-7148 CVE-2019-7149 CVE-2019-7150
CVE-2019-7664 CVE-2019-7665 CVE-2020-29651 CVE-2021-26341 CVE-2021-4157
CVE-2022-1012 CVE-2022-1587 CVE-2022-1679 CVE-2022-20132 CVE-2022-20141
CVE-2022-20154 CVE-2022-2031 CVE-2022-21123 CVE-2022-21125 CVE-2022-21166
CVE-2022-23816 CVE-2022-23825 CVE-2022-26362 CVE-2022-26363 CVE-2022-26364
CVE-2022-29458 CVE-2022-29869 CVE-2022-29900 CVE-2022-29900 CVE-2022-29901
CVE-2022-32742 CVE-2022-32744 CVE-2022-32745 CVE-2022-32746 CVE-2022-33745
CVE-2022-33981 CVE-2022-34903 CVE-2022-34918
-----------------------------------------------------------------
The container suse-sles-15-sp3-chost-byos-v20220818-hvm-ssd-x86_64 was updated. The following patches have been included in this update:
-----------------------------------------------------------------
Advisory ID: SUSE-RU-2022:2455-1
Released: Wed Jul 20 15:29:00 2022
Summary: Recommended update for perl-Bootloader
Type: recommended
Severity: moderate
References: 1192764,1198197,1198828
This update for perl-Bootloader fixes the following issues:
- fix sysconfig parsing (bsc#1198828)
- grub2/install: reset error code when passing through recover code (bsc#1198197)
- grub2 install: Support secure boot on powerpc (bsc#1192764, jsc#SLE-18271)
-----------------------------------------------------------------
Advisory ID: SUSE-RU-2022:2470-1
Released: Thu Jul 21 04:40:14 2022
Summary: Recommended update for systemd
Type: recommended
Severity: important
References: 1137373,1181658,1194708,1195157,1197570,1198507,1198732,1200170
This update for systemd fixes the following issues:
- Allow control characters in environment variable values (bsc#1200170)
- Call pam_loginuid when creating user at .service (bsc#1198507)
- Fix parsing error in s390 udev rules conversion script (bsc#1198732)
- Fix issues with multipath setup (bsc#1137373, bsc#1181658, bsc#1194708, bsc#1195157, bsc#1197570)
- Flagsify EscapeStyle and make ESCAPE_BACKSLASH_ONELINE implicit
- Revert 'basic/env-util: (mostly) follow POSIX for what variable names are allowed'
- basic/env-util: (mostly) follow POSIX for what variable names are allowed
- basic/env-util: make function shorter
- basic/escape: add mode where empty arguments are still shown as ''
- basic/escape: always escape newlines in shell_escape()
- basic/escape: escape control characters, but not utf-8, in shell quoting
- basic/escape: use consistent location for '*' in function declarations
- basic/string-util: inline iterator variable declarations
- basic/string-util: simplify how str_realloc() is used
- basic/string-util: split out helper function
- core/device: device_coldplug(): don't set DEVICE_DEAD
- core/device: do not downgrade device state if it is already enumerated
- core/device: drop unnecessary condition
- string-util: explicitly cast character to unsigned
- string-util: fix build error on aarch64
- test-env-util: Verify that \r is disallowed in env var values
- test-env-util: print function headers
-----------------------------------------------------------------
Advisory ID: SUSE-RU-2022:2494-1
Released: Thu Jul 21 15:16:42 2022
Summary: Recommended update for glibc
Type: recommended
Severity: important
References: 1200855,1201560,1201640
This update for glibc fixes the following issues:
- Remove tunables from static tls surplus patch which caused crashes (bsc#1200855)
- i386: Disable check_consistency for GCC 5 and above (bsc#1201640, BZ #25788)
-----------------------------------------------------------------
Advisory ID: SUSE-SU-2022:2546-1
Released: Mon Jul 25 14:43:22 2022
Summary: Security update for gpg2
Type: security
Severity: important
References: 1196125,1201225,CVE-2022-34903
This update for gpg2 fixes the following issues:
- CVE-2022-34903: Fixed a status injection vulnerability (bsc#1201225).
- Use AES as default cipher instead of 3DES when we are in FIPS mode. (bsc#1196125)
-----------------------------------------------------------------
Advisory ID: SUSE-SU-2022:2547-1
Released: Mon Jul 25 19:57:38 2022
Summary: Security update for logrotate
Type: security
Severity: important
References: 1192449,1200278,1200802
This update for logrotate fixes the following issues:
Security issues fixed:
- Improved coredump handing for SUID binaries (bsc#1192449).
Non-security issues fixed:
- Fixed 'logrotate emits unintended warning: keyword size not properly separated, found 0x3d' (bsc#1200278, bsc#1200802).
-----------------------------------------------------------------
Advisory ID: SUSE-SU-2022:2549-1
Released: Tue Jul 26 13:58:28 2022
Summary: Security update for the Linux Kernel
Type: security
Severity: important
References: 1065729,1179195,1180814,1184924,1185762,1192761,1193629,1194013,1195504,1195775,1196901,1197362,1197754,1198020,1198924,1199482,1199487,1199489,1199657,1200217,1200263,1200343,1200442,1200571,1200599,1200600,1200604,1200605,1200608,1200619,1200622,1200692,1200806,1200807,1200809,1200810,1200813,1200816,1200820,1200821,1200822,1200825,1200828,1200829,1200925,1201050,1201080,1201143,1201147,1201149,1201160,1201171,1201177,1201193,1201222,1201644,1201664,1201672,1201673,1201676,CVE-2021-26341,CVE-2021-4157,CVE-2022-1012,CVE-2022-1679,CVE-2022-20132,CVE-2022-20141,CVE-2022-20154,CVE-2022-29900,CVE-2022-29901,CVE-2022-33981,CVE-2022-34918
The SUSE Linux Enterprise 15 SP3 kernel was updated to receive various security and bugfixes.
The following security bugs were fixed:
- CVE-2022-29900, CVE-2022-29901: Fixed the RETBLEED attack, a new Spectre like Branch Target Buffer attack, that can leak arbitrary kernel information (bsc#1199657).
- CVE-2022-34918: Fixed a buffer overflow with nft_set_elem_init() that could be used by a local attacker to escalate privileges (bnc#1201171).
- CVE-2021-26341: Some AMD CPUs may transiently execute beyond unconditional direct branches, which may potentially result in data leakage (bsc#1201050).
- CVE-2022-1679: Fixed a use-after-free in the Atheros wireless driver in the way a user forces the ath9k_htc_wait_for_target function to fail with some input messages (bsc#1199487).
- CVE-2022-20132: Fixed out of bounds read due to improper input validation in lg_probe and related functions of hid-lg.c (bsc#1200619).
- CVE-2022-1012: Fixed information leak caused by small table perturb size in the TCP source port generation algorithm (bsc#1199482).
- CVE-2022-33981: Fixed use-after-free in floppy driver (bsc#1200692)
- CVE-2022-20141: Fixed a possible use after free due to improper locking in ip_check_mc_rcu() (bsc#1200604).
- CVE-2021-4157: Fixed an out of memory bounds write flaw in the NFS subsystem, related to the replication of files with NFS. A user could potentially crash the system or escalate privileges on the system (bsc#1194013).
- CVE-2022-20154: Fixed a use after free due to a race condition in lock_sock_nested of sock.c. This could lead to local escalation of privilege with System execution privileges needed (bsc#1200599).
The following non-security bugs were fixed:
- ALSA: hda/conexant: Fix missing beep setup (git-fixes).
- ALSA: hda/realtek - Add HW8326 support (git-fixes).
- ALSA: hda/realtek: Add quirk for Clevo PD70PNT (git-fixes).
- ALSA: hda/realtek - ALC897 headset MIC no sound (git-fixes).
- ALSA: hda/via: Fix missing beep setup (git-fixes).
- arm64: dts: rockchip: Move drive-impedance-ohm to emmc phy on rk3399 (git-fixes)
- arm64: ftrace: fix branch range checks (git-fixes)
- ASoC: cs35l36: Update digital volume TLV (git-fixes).
- ASoC: cs42l52: Correct TLV for Bypass Volume (git-fixes).
- ASoC: cs42l52: Fix TLV scales for mixer controls (git-fixes).
- ASoC: cs42l56: Correct typo in minimum level for SX volume controls (git-fixes).
- ASoC: cs53l30: Correct number of volume levels on SX controls (git-fixes).
- ASoC: es8328: Fix event generation for deemphasis control (git-fixes).
- ASoC: nau8822: Add operation for internal PLL off and on (git-fixes).
- ASoC: wm8962: Fix suspend while playing music (git-fixes).
- ASoC: wm_adsp: Fix event generation for wm_adsp_fw_put() (git-fixes).
- ata: libata: add qc->flags in ata_qc_complete_template tracepoint (git-fixes).
- ata: libata-core: fix NULL pointer deref in ata_host_alloc_pinfo() (git-fixes).
- bcache: avoid journal no-space deadlock by reserving 1 journal bucket (git-fixes).
- bcache: avoid unnecessary soft lockup in kworker update_writeback_rate() (bsc#1197362).
- bcache: fixup multiple threads crash (git-fixes).
- bcache: improve multithreaded bch_btree_check() (git-fixes).
- bcache: improve multithreaded bch_sectors_dirty_init() (git-fixes).
- bcache: memset on stack variables in bch_btree_check() and bch_sectors_dirty_init() (git-fixes).
- bcache: remove incremental dirty sector counting for bch_sectors_dirty_init() (git-fixes).
- bio: fix page leak bio_add_hw_page failure (git-fixes).
- blk-cgroup: fix a hd_struct leak in blkcg_fill_root_iostats (git-fixes).
- blk-iolatency: Fix inflight count imbalances and IO hangs on offline (bsc#1200825).
- blk-mq: clear active_queues before clearing BLK_MQ_F_TAG_QUEUE_SHARED (bsc#1200263).
- blk-mq: do not update io_ticks with passthrough requests (bsc#1200816).
- blk-mq: drop workarounds for cpu hotplug queue management (bsc#1185762)
- blk-mq: update hctx->dispatch_busy in case of real scheduler (git-fixes).
- block: advance iov_iter on bio_add_hw_page failure (git-fixes).
- block: do not merge across cgroup boundaries if blkcg is enabled (bsc#1198020).
- block: Fix handling of offline queues in blk_mq_alloc_request_hctx() (bsc#1185762).
- block: Fix kABI in blk-merge.c (bsc#1198020).
- block/keyslot-manager: prevent crash when num_slots=1 (git-fixes).
- bus: fsl-mc-bus: fix KASAN use-after-free in fsl_mc_bus_remove() (git-fixes).
- caif_virtio: fix race between virtio_device_ready() and ndo_open() (git-fixes).
- ceph: add some lockdep assertions around snaprealm handling (bsc#1201147).
- ceph: clean up locking annotation for ceph_get_snap_realm and __lookup_snap_realm (bsc#1201149).
- certs/blacklist_hashes.c: fix const confusion in certs blacklist (git-fixes).
- cifs: add WARN_ON for when chan_count goes below minimum (bsc#1200217).
- cifs: adjust DebugData to use chans_need_reconnect for conn status (bsc#1200217).
- cifs: alloc_path_with_tree_prefix: do not append sep. if the path is empty (bsc#1200217).
- cifs: avoid parallel session setups on same channel (bsc#1200217).
- cifs: avoid race during socket reconnect between send and recv (bsc#1200217).
- cifs: call cifs_reconnect when a connection is marked (bsc#1200217).
- cifs: call helper functions for marking channels for reconnect (bsc#1200217).
- cifs: change smb2_query_info_compound to use a cached fid, if available (bsc#1200217).
- cifs: check for smb1 in open_cached_dir() (bsc#1200217).
- cifs: check reconnects for channels of active tcons too (bsc#1200217).
- cifs: Check the IOCB_DIRECT flag, not O_DIRECT (bsc#1200217).
- cifs: cifs_ses_mark_for_reconnect should also update reconnect bits (bsc#1200217).
- cifs: clean up an inconsistent indenting (bsc#1200217).
- cifs: destage any unwritten data to the server before calling copychunk_write (bsc#1200217).
- cifs: do not build smb1ops if legacy support is disabled (bsc#1200217).
- cifs: do not call cifs_dfs_query_info_nonascii_quirk() if nodfs was set (bsc#1200217).
- cifs: do not use tcpStatus after negotiate completes (bsc#1200217).
- cifs: do not use uninitialized data in the owner/group sid (bsc#1200217).
- cifs: fix confusing unneeded warning message on smb2.1 and earlier (bsc#1200217).
- cifs: fix double free race when mount fails in cifs_get_root() (bsc#1200217).
- cifs: fix FILE_BOTH_DIRECTORY_INFO definition (bsc#1200217).
- cifs: fix handlecache and multiuser (bsc#1200217).
- cifs: fix hang on cifs_get_next_mid() (bsc#1200217).
- cifs: fix incorrect use of list iterator after the loop (bsc#1200217).
- cifs: fix minor compile warning (bsc#1200217).
- cifs: fix missed refcounting of ipc tcon (bsc#1200217).
- cifs: fix ntlmssp auth when there is no key exchange (bsc#1200217).
- cifs: fix NULL ptr dereference in refresh_mounts() (bsc#1200217).
- cifs: fix potential deadlock in direct reclaim (bsc#1200217).
- cifs: fix potential double free during failed mount (bsc#1200217).
- cifs: fix potential race with cifsd thread (bsc#1200217).
- cifs: fix set of group SID via NTSD xattrs (bsc#1200217).
- cifs: fix signed integer overflow when fl_end is OFFSET_MAX (bsc#1200217).
- cifs: Fix smb311_update_preauth_hash() kernel-doc comment (bsc#1200217).
- cifs: fix the cifs_reconnect path for DFS (bsc#1200217).
- cifs: fix the connection state transitions with multichannel (bsc#1200217).
- cifs: fix uninitialized pointer in error case in dfs_cache_get_tgt_share (bsc#1200217).
- cifs: fix workstation_name for multiuser mounts (bsc#1200217).
- cifs: force new session setup and tcon for dfs (bsc#1200217).
- cifs: free ntlmsspblob allocated in negotiate (bsc#1200217).
- cifs: ignore resource_id while getting fscache super cookie (bsc#1200217).
- cifs: maintain a state machine for tcp/smb/tcon sessions (bsc#1200217).
- cifs: make status checks in version independent callers (bsc#1200217).
- cifs: mark sessions for reconnection in helper function (bsc#1200217).
- cifs: modefromsids must add an ACE for authenticated users (bsc#1200217).
- cifs: move definition of cifs_fattr earlier in cifsglob.h (bsc#1200217).
- cifs: move superblock magic defitions to magic.h (bsc#1200217).
- cifs: potential buffer overflow in handling symlinks (bsc#1200217).
- cifs: print TIDs as hex (bsc#1200217).
- cifs: protect all accesses to chan_* with chan_lock (bsc#1200217).
- cifs: quirk for STATUS_OBJECT_NAME_INVALID returned for non-ASCII dfs refs (bsc#1200217).
- cifs: reconnect only the connection and not smb session where possible (bsc#1200217).
- cifs: release cached dentries only if mount is complete (bsc#1200217).
- cifs: remove check of list iterator against head past the loop body (bsc#1200217).
- cifs: remove redundant assignment to pointer p (bsc#1200217).
- cifs: remove repeated debug message on cifs_put_smb_ses() (bsc#1200217).
- cifs: remove repeated state change in dfs tree connect (bsc#1200217).
- cifs: remove unused variable ses_selected (bsc#1200217).
- cifs: return ENOENT for DFS lookup_cache_entry() (bsc#1200217).
- cifs: return the more nuanced writeback error on close() (bsc#1200217).
- cifs: sanitize multiple delimiters in prepath (bsc#1200217).
- cifs: serialize all mount attempts (bsc#1200217).
- cifs: set the CREATE_NOT_FILE when opening the directory in use_cached_dir() (bsc#1200217).
- cifs: skip trailing separators of prefix paths (bsc#1200217).
- cifs: smbd: fix typo in comment (bsc#1200217).
- cifs: Split the smb3_add_credits tracepoint (bsc#1200217).
- cifs: take cifs_tcp_ses_lock for status checks (bsc#1200217).
- cifs: track individual channel status using chans_need_reconnect (bsc#1200217).
- cifs: unlock chan_lock before calling cifs_put_tcp_session (bsc#1200217).
- cifs: update internal module number (bsc#1193629).
- cifs: update internal module number (bsc#1200217).
- cifs: update tcpStatus during negotiate and sess setup (bsc#1200217).
- cifs: use a different reconnect helper for non-cifsd threads (bsc#1200217).
- cifs: use correct lock type in cifs_reconnect() (bsc#1200217).
- cifs: Use kzalloc instead of kmalloc/memset (bsc#1200217).
- cifs: use new enum for ses_status (bsc#1200217).
- cifs: use the chans_need_reconnect bitmap for reconnect status (bsc#1200217).
- cifs: verify that tcon is valid before dereference in cifs_kill_sb (bsc#1200217).
- cifs: version operations for smb20 unneeded when legacy support disabled (bsc#1200217).
- cifs: wait for tcon resource_id before getting fscache super (bsc#1200217).
- cifs: we do not need a spinlock around the tree access during umount (bsc#1200217).
- cifs: when extending a file with falloc we should make files not-sparse (bsc#1200217).
- drivers: cpufreq: Add missing of_node_put() in qoriq-cpufreq.c (git-fixes).
- drm/i915/reset: Fix error_state_read ptr + offset use (git-fixes).
- drm/i915: Update TGL and RKL DMC firmware versions (bsc#1198924).
- drm/msm: Fix double pm_runtime_disable() call (git-fixes).
- drm/msm/mdp4: Fix refcount leak in mdp4_modeset_init_intf (git-fixes).
- drm/sun4i: Fix crash during suspend after component bind failure (git-fixes).
- exec: Force single empty string when argv is empty (bsc#1200571).
- ext4: add check to prevent attempting to resize an fs with sparse_super2 (bsc#1197754).
- ext4: fix bug_on ext4_mb_use_inode_pa (bsc#1200810).
- ext4: fix bug_on in __es_tree_search (bsc#1200809).
- ext4: fix race condition between ext4_write and ext4_convert_inline_data (bsc#1200807).
- ext4: limit length to bitmap_maxbytes - blocksize in punch_hole (bsc#1200806).
- ext4: make variable 'count' signed (bsc#1200820).
- Fix a warning about a malformed kernel doc comment in cifs (bsc#1200217).
- fuse: annotate lock in fuse_reverse_inval_entry() (bsc#1201143).
- gpio: winbond: Fix error code in winbond_gpio_get() (git-fixes).
- gtp: use icmp_ndo_send helper (git-fixes).
- hwmon: (ibmaem) do not call platform_device_del() if platform_device_add() fails (git-fixes).
- i2c: designware: Use standard optional ref clock implementation (git-fixes).
- ibmvnic: Properly dispose of all skbs during a failover (bsc#1200925).
- iio:accel:bma180: rearrange iio trigger get and register (git-fixes).
- iio: accel: mma8452: ignore the return value of reset operation (git-fixes).
- iio: adc: axp288: Override TS pin bias current for some models (git-fixes).
- iio: adc: vf610: fix conversion mode sysfs node name (git-fixes).
- iio:chemical:ccs811: rearrange iio trigger get and register (git-fixes).
- iio: gyro: mpu3050: Fix the error handling in mpu3050_power_up() (git-fixes).
- iio: trigger: sysfs: fix use-after-free on remove (git-fixes).
- init: Initialize noop_backing_dev_info early (bsc#1200822).
- inotify: show inotify mask flags in proc fdinfo (bsc#1200600).
- iomap: iomap_write_failed fix (bsc#1200829).
- ipvs: add sysctl_run_estimation to support disable estimation (bsc#1195504).
- jfs: fix divide error in dbNextAG (bsc#1200828).
- kABI fix of sysctl_run_estimation (git-fixes).
- kabi: nvme workaround header include (bsc#1201193).
- kabi/severities: ignore KABI for NVMe target (bsc#1192761)
- linux/dim: Fix divide by 0 in RDMA DIM (git-fixes).
- md: fix update super 1.0 on rdev size change (git-fixes).
- move devm_allocate to end of structure for kABI (git-fixes).
- mtd: rawnand: gpmi: Fix setting busy timeout setting (git-fixes).
- net: ax25: Fix deadlock caused by skb_recv_datagram in ax25_recvmsg (git-fixes).
- net: ethernet: stmmac: Disable hardware multicast filter (git-fixes).
- net: ieee802154: ca8210: Stop leaking skb's (git-fixes).
- net: lantiq: Add locking for TX DMA channel (git-fixes).
- net: rose: fix UAF bugs caused by timer handler (git-fixes).
- net: stmmac: reset Tx desc base address before restarting Tx (git-fixes).
- net: usb: ax88179_178a: Fix packet receiving (git-fixes).
- nfc: nfcmrvl: Fix irq_of_parse_and_map() return value (git-fixes).
- nfc: nfcmrvl: Fix memory leak in nfcmrvl_play_deferred (git-fixes).
- NFC: nxp-nci: Do not issue a zero length i2c_master_read() (git-fixes).
- NFS: Do not report EINTR/ERESTARTSYS as mapping errors (git-fixes).
- NFS: Do not report errors from nfs_pageio_complete() more than once (git-fixes).
- NFS: Do not report flush errors in nfs_write_end() (git-fixes).
- NFS: Further fixes to the writeback error handling (git-fixes).
- NFS: Memory allocation failures are not server fatal errors (git-fixes).
- NFSv4/pNFS: Do not fail I/O when we fail to allocate the pNFS layout (git-fixes).
- nvdimm: Fix firmware activation deadlock scenarios (git-fixes).
- nvdimm/region: Fix default alignment for small regions (git-fixes).
- nvme: add CNTRLTYPE definitions for 'identify controller' (bsc#1192761).
- nvme: Add connect option 'discovery' (bsc#1192761).
- nvme: add new discovery log page entry definitions (bsc#1192761).
- nvme: display correct subsystem NQN (bsc#1192761).
- nvme: expose subsystem type in sysfs attribute 'subsystype' (bsc#1192761).
- nvme: kabi fix nvme subsystype change (bsc#1192761)
- nvmet: add nvmet_is_disc_subsys() helper (bsc#1192761).
- nvmet: add nvmet_req_subsys() helper (bsc#1192761).
- nvme-tcp: fix H2CData PDU send accounting (again) (git-fixes).
- nvmet: do not check iosqes,iocqes for discovery controllers (bsc#1192761).
- nvmet: fix freeing unallocated p2pmem (git-fixes).
- nvmet: make discovery NQN configurable (bsc#1192761).
- nvmet-rdma: Fix NULL deref when SEND is completed with error (git-fixes).
- nvmet-rdma: Fix NULL deref when setting pi_enable and traddr INADDR_ANY (git-fixes).
- nvmet: register discovery subsystem as 'current' (bsc#1192761).
- nvmet: set 'CNTRLTYPE' in the identify controller data (bsc#1192761).
- nvmet: switch check for subsystem type (bsc#1192761).
- phy: aquantia: Fix AN when higher speeds than 1G are not advertised (git-fixes).
- pNFS: Do not keep retrying if the server replied NFS4ERR_LAYOUTUNAVAILABLE (git-fixes).
- powerpc/idle: Fix return value of __setup() handler (bsc#1065729).
- powerpc/perf: Fix the threshold compare group constraint for power9 (bsc#1065729).
- powerpc/rtas: Allow ibm,platform-dump RTAS call with null buffer address (bsc#1200343 ltc#198477).
- random: Add and use pr_fmt() (bsc#1184924).
- random: remove unnecessary unlikely() (bsc#1184924).
- regmap-irq: Fix a bug in regmap_irq_enable() for type_in_mask chips (git-fixes).
- Revert 'block: Fix a lockdep complaint triggered by request queue flushing' (git-fixes).
- scsi: core: Show SCMD_LAST in text form (git-fixes).
- scsi: ibmvfc: Allocate/free queue resource only during probe/remove (jsc#SLE-15442 bsc#1180814 ltc#187461 git-fixes).
- scsi: ibmvfc: Store vhost pointer during subcrq allocation (jsc#SLE-15442 bsc#1180814 ltc#187461 git-fixes).
- scsi: lpfc: Add more logging of cmd and cqe information for aborted NVMe cmds (bsc#1201193).
- scsi: lpfc: Address NULL pointer dereference after starget_to_rport() (bsc#1201193).
- scsi: lpfc: Add support for ATTO Fibre Channel devices (bsc#1201193).
- scsi: lpfc: Add support for VMID tagging of NVMe I/Os (bsc#1201193).
- scsi: lpfc: Allow reduced polling rate for nvme_admin_async_event cmd completion (bsc#1201193).
- scsi: lpfc: Commonize VMID code location (bsc#1201193).
- scsi: lpfc: Correct BDE type for XMIT_SEQ64_WQE in lpfc_ct_reject_event() (bsc#1201193).
- scsi: lpfc: Fix port stuck in bypassed state after LIP in PT2PT topology (bsc#1201193).
- scsi: lpfc: Resolve NULL ptr dereference after an ELS LOGO is aborted (bsc#1201193).
- scsi: lpfc: Resolve some cleanup issues following abort path refactoring (bsc#1201193).
- scsi: lpfc: Resolve some cleanup issues following SLI path refactoring (bsc#1201193).
- scsi: lpfc: Rework lpfc_vmid_get_appid() to be protocol independent (bsc#1201193).
- scsi: lpfc: Update lpfc version to 14.2.0.4 (bsc#1201193).
- scsi: nvme: Added a new sysfs attribute appid_store (bsc#1201193).
- scsi: nvme-fc: Add new routine nvme_fc_io_getuuid() (bsc#1201193).
- scsi: qla2xxx: Add a new v2 dport diagnostic feature (bsc#1201160).
- scsi: qla2xxx: Add debug prints in the device remove path (bsc#1201160).
- scsi: qla2xxx: edif: Add bsg interface to read doorbell events (bsc#1201160).
- scsi: qla2xxx: edif: Add retry for ELS passthrough (bsc#1201160).
- scsi: qla2xxx: edif: bsg refactor (bsc#1201160).
- scsi: qla2xxx: edif: Fix I/O timeout due to over-subscription (bsc#1201160).
- scsi: qla2xxx: edif: Fix n2n discovery issue with secure target (bsc#1201160).
- scsi: qla2xxx: edif: Fix n2n login retry for secure device (bsc#1201160).
- scsi: qla2xxx: edif: Fix no login after app start (bsc#1201160).
- scsi: qla2xxx: edif: Fix no logout on delete for N2N (bsc#1201160).
- scsi: qla2xxx: edif: Fix potential stuck session in sa update (bsc#1201160).
- scsi: qla2xxx: edif: Fix session thrash (bsc#1201160).
- scsi: qla2xxx: edif: Fix slow session teardown (bsc#1201160).
- scsi: qla2xxx: edif: Reduce disruption due to multiple app start (bsc#1201160).
- scsi: qla2xxx: edif: Reduce Initiator-Initiator thrashing (bsc#1201160).
- scsi: qla2xxx: edif: Reduce N2N thrashing at app_start time (bsc#1201160).
- scsi: qla2xxx: edif: Remove old doorbell interface (bsc#1201160).
- scsi: qla2xxx: edif: Send LOGO for unexpected IKE message (bsc#1201160).
- scsi: qla2xxx: edif: Synchronize NPIV deletion with authentication application (bsc#1201160).
- scsi: qla2xxx: edif: Tear down session if keys have been removed (bsc#1201160).
- scsi: qla2xxx: edif: Wait for app to ack on sess down (bsc#1201160).
- scsi: qla2xxx: Fix crash due to stale SRB access around I/O timeouts (bsc#1201160).
- scsi: qla2xxx: Fix erroneous mailbox timeout after PCI error injection (bsc#1201160).
- scsi: qla2xxx: Fix excessive I/O error messages by default (bsc#1201160).
- scsi: qla2xxx: Fix losing FCP-2 targets during port perturbation tests (bsc#1201160).
- scsi: qla2xxx: Fix losing FCP-2 targets on long port disable with I/Os (bsc#1201160).
- scsi: qla2xxx: Fix losing target when it reappears during delete (bsc#1201160).
- scsi: qla2xxx: Remove setting of 'req' and 'rsp' parameters (bsc#1201160).
- scsi: qla2xxx: Remove unused 'ql_dm_tgt_ex_pct' parameter (bsc#1201160).
- scsi: qla2xxx: Turn off multi-queue for 8G adapters (bsc#1201160).
- scsi: qla2xxx: Update version to 10.02.07.500-k (bsc#1201160).
- scsi: qla2xxx: Update version to 10.02.07.600-k (bsc#1201160).
- scsi: qla2xxx: Update version to 10.02.07.700-k (bsc#1201160).
- scsi: qla2xxx: Wind down adapter after PCIe error (bsc#1201160).
- scsi: sd: sd_zbc: Do not pass GFP_NOIO to kvcalloc (git-fixes).
- scsi: sd: sd_zbc: Fix handling of host-aware ZBC disks (git-fixes).
- scsi: sd: sd_zbc: Fix ZBC disk initialization (git-fixes).
- scsi: sd: Signal drive managed SMR disks (git-fixes).
- scsi: sd_zbc: Do not limit max_zone_append sectors to (git-fixes).
- scsi: sd_zbc: Ensure buffer size is aligned to SECTOR_SIZE (git-fixes).
- scsi: sd_zbc: Improve zone revalidation (git-fixes).
- scsi: sd_zbc: Remove unused inline functions (git-fixes).
- scsi: sd_zbc: Support disks with more than 2**32 logical (git-fixes).
- scsi: smartpqi: create module parameters for LUN reset (bsc#1179195 bsc#1200622).
- smb3: add mount parm nosparse (bsc#1200217).
- smb3: add trace point for lease not found issue (bsc#1200217).
- smb3: add trace point for oplock not found (bsc#1200217).
- smb3: check for null tcon (bsc#1200217).
- smb3: cleanup and clarify status of tree connections (bsc#1200217).
- smb3: do not set rc when used and unneeded in query_info_compound (bsc#1200217).
- SMB3: EBADF/EIO errors in rename/open caused by race condition in smb2_compound_op (bsc#1200217).
- smb3: fix incorrect session setup check for multiuser mounts (bsc#1200217).
- smb3: fix ksmbd bigendian bug in oplock break, and move its struct to smbfs_common (bsc#1200217).
- smb3: fix snapshot mount option (bsc#1200217).
- smb3 improve error message when mount options conflict with posix (bsc#1200217).
- smb3: move defines for ioctl protocol header and SMB2 sizes to smbfs_common (bsc#1200217).
- smb3: move defines for query info and query fsinfo to smbfs_common (bsc#1200217).
- smb3: move more common protocol header definitions to smbfs_common (bsc#1200217).
- smb3: send NTLMSSP version information (bsc#1200217).
- soc: bcm: brcmstb: pm: pm-arm: Fix refcount leak in brcmstb_pm_probe (git-fixes).
- spi: Fix use-after-free with devm_spi_alloc_* (git-fixes).
- SUNRPC: Fix the calculation of xdr->end in xdr_get_next_encode_buffer() (git-fixes).
- sunvnet: use icmp_ndo_send helper (git-fixes).
- tty: goldfish: Fix free_irq() on remove (git-fixes).
- usb: chipidea: udc: check request status before setting device address (git-fixes).
- usb: dwc2: Fix memory leak in dwc2_hcd_init (git-fixes).
- usb: gadget: lpc32xx_udc: Fix refcount leak in lpc32xx_udc_probe (git-fixes).
- usb: gadget: u_ether: fix regression in setting fixed MAC address (git-fixes).
- usbnet: fix memory allocation in helpers (git-fixes).
- USB: serial: io_ti: add Agilent E5805A support (git-fixes).
- USB: serial: option: add Quectel EM05-G modem (git-fixes).
- USB: serial: option: add Quectel RM500K module support (git-fixes).
- USB: serial: option: add support for Cinterion MV31 with new baseline (git-fixes).
- USB: serial: option: add Telit LE910Cx 0x1250 composition (git-fixes).
- usb: xhci: Workaround for S3 issue on AMD SNPS 3.0 xHC (git-fixes).
- veth: fix races around rq->rx_notify_masked (git-fixes).
- virtio-mmio: fix missing put_device() when vm_cmdline_parent registration failed (git-fixes).
- virtio-net: fix race between ndo_open() and virtio_device_ready() (git-fixes).
- virtio_net: fix xdp_rxq_info bug after suspend/resume (git-fixes).
- virtio-pci: Remove wrong address verification in vp_del_vqs() (git-fixes).
- vmxnet3: fix minimum vectors alloc issue (bsc#1199489).
- writeback: Avoid skipping inode writeback (bsc#1200813).
- writeback: Fix inode->i_io_list not be protected by inode->i_lock error (bsc#1200821).
- xhci: Add reset resume quirk for AMD xhci controller (git-fixes).
- x86/entry: Remove skip_r11rcx (bsc#1201644).
-----------------------------------------------------------------
Advisory ID: SUSE-RU-2022:2572-1
Released: Thu Jul 28 04:22:33 2022
Summary: Recommended update for libzypp, zypper
Type: recommended
Severity: moderate
References: 1194550,1197684,1199042
This update for libzypp, zypper fixes the following issues:
libzypp:
- appdata plugin: Pass path to the repodata/ directory inside the cache (bsc#1197684)
- zypp-rpm: flush rpm script output buffer before sending endOfScriptTag
- PluginRepoverification: initial version hooked into repo::Downloader and repo refresh
- Immediately start monitoring the download.transfer_timeout. Do not wait until the first data arrived (bsc#1199042)
- singletrans: no dry-run commit if doing just download-only
- Work around cases where sat repo.start points to an invalid solvable. May happen if (wrong arch) solvables were
removed at the beginning of the repo.
- Fix misplaced #endif SINGLE_RPMTRANS_AS_DEFAULT_FOR_ZYPPER
zypper:
- Basic JobReport for 'cmdout/monitor'
- versioncmp: if verbose, also print the edition 'parts' which are compared
- Make sure MediaAccess is closed on exception (bsc#1194550)
- Display plus-content hint conditionally
- Honor the NO_COLOR environment variable when auto-detecting whether to use color
- Define table columns which should be sorted natural [case insensitive]
- lr/ls: Use highlight color on name and alias as well
-----------------------------------------------------------------
Advisory ID: SUSE-SU-2022:2586-1
Released: Fri Jul 29 12:01:06 2022
Summary: Security update for ldb, samba
Type: security
Severity: important
References: 1196224,1198255,1199247,1199734,1200556,1200964,1201490,1201492,1201493,1201495,1201496,CVE-2022-2031,CVE-2022-32742,CVE-2022-32744,CVE-2022-32745,CVE-2022-32746
This update for ldb, samba fixes the following issues:
- CVE-2022-32746: Fixed a use-after-free occurring in database audit logging (bsc#1201490).
- CVE-2022-32745: Fixed a remote server crash with an LDAP add or modify request (bsc#1201492).
- CVE-2022-2031: Fixed AD restrictions bypass associated with changing passwords (bsc#1201495).
- CVE-2022-32742: Fixed a memory leak in SMB1 (bsc#1201496).
- CVE-2022-32744: Fixed an arbitrary password change request for any AD user (bsc#1201493).
The following security bugs were fixed:
samba was updated to 4.15.8:
* Use pathref fd instead of io fd in vfs_default_durable_cookie;
(bso#15042);
* Setting fruit:resource = stream in vfs_fruit causes a panic;
(bso#15099);
* Add support for bind 9.18; (bso#14986);
* logging dsdb audit to specific files does not work; (bso#15076);
* vfs_gpfs with vfs_shadowcopy2 fail to restore file if original
file had been deleted; (bso#15069);
* netgroups support removed; (bso#15087); (bsc#1199247);
* net ads info shows LDAP Server: 0.0.0.0 depending on contacted
server; (bso#14674); (bsc#1199734);
* waf produces incorrect names for python extensions with Python
3.11; (bso#15071);
* smbclient commands del & deltree fail with
NT_STATUS_OBJECT_PATH_NOT_FOUND with DFS; (bso#15100);
(bsc#1200556);
* vfs_gpfs recalls=no option prevents listing files; (bso#15055);
* waf produces incorrect names for python extensions with Python
3.11; (bso#15071);
* Compile error in source3/utils/regedit_hexedit.c; (bso#15091);
* ldconfig: /lib64/libsmbconf.so.0 is not a symbolic link;
(bso#15108);
* smbd doesn't handle UPNs for looking up names; (bso#15054);
* Out-by-4 error in smbd read reply max_send clamp; (bso#14443);
- Move pdb backends from package samba-libs to package
samba-client-libs and remove samba-libs requirement from
samba-winbind; (bsc#1200964); (bsc#1198255);
- Use the canonical realm name to refresh the Kerberos tickets;
(bsc#1196224); (bso#14979);
- Fix smbclient commands del & deltree failing with
NT_STATUS_OBJECT_PATH_NOT_FOUND with DFS; (bso#15100);
(bsc#1200556).
ldb was updated to version 2.4.3
* Fix build problems, waf produces incorrect names for python extensions; (bso#15071);
-----------------------------------------------------------------
Advisory ID: SUSE-SU-2022:2599-1
Released: Fri Jul 29 16:13:17 2022
Summary: Security update for xen
Type: security
Severity: important
References: 1027519,1199965,1199966,1200549,1201394,1201469,CVE-2022-21123,CVE-2022-21125,CVE-2022-21166,CVE-2022-23816,CVE-2022-23825,CVE-2022-26362,CVE-2022-26363,CVE-2022-26364,CVE-2022-29900,CVE-2022-33745
This update for xen fixes the following issues:
- CVE-2022-26363, CVE-2022-26364: Fixed insufficient care with non-coherent mappings (XSA-402) (bsc#1199966).
- CVE-2022-21123, CVE-2022-21125, CVE-2022-21166: Fixed MMIO stale data vulnerabilities on x86 (XSA-404) (bsc#1200549).
- CVE-2022-26362: Fixed a race condition in typeref acquisition (XSA-401) (bsc#1199965).
- CVE-2022-33745: Fixed insufficient TLB flush for x86 PV guests in shadow mode (XSA-408) (bsc#1201394).
- CVE-2022-23816, CVE-2022-23825, CVE-2022-29900: Fixed RETBLEED vulnerability, arbitrary speculative code execution with return instructions (XSA-407) (bsc#1201469).
Fixed several upstream bugs (bsc#1027519).
-----------------------------------------------------------------
Advisory ID: SUSE-SU-2022:2614-1
Released: Mon Aug 1 10:41:04 2022
Summary: Security update for dwarves and elfutils
Type: security
Severity: moderate
References: 1033084,1033085,1033086,1033087,1033088,1033089,1033090,1082318,1104264,1106390,1107066,1107067,1111973,1112723,1112726,1123685,1125007,CVE-2017-7607,CVE-2017-7608,CVE-2017-7609,CVE-2017-7610,CVE-2017-7611,CVE-2017-7612,CVE-2017-7613,CVE-2018-16062,CVE-2018-16402,CVE-2018-16403,CVE-2018-18310,CVE-2018-18520,CVE-2018-18521,CVE-2019-7146,CVE-2019-7148,CVE-2019-7149,CVE-2019-7150,CVE-2019-7664,CVE-2019-7665
This update for dwarves and elfutils fixes the following issues:
elfutils was updated to version 0.177 (jsc#SLE-24501):
- elfclassify: New tool to analyze ELF objects.
- readelf: Print DW_AT_data_member_location as decimal offset.
Decode DW_AT_discr_list block attributes.
- libdw: Add DW_AT_GNU_numerator, DW_AT_GNU_denominator and DW_AT_GNU_bias.
- libdwelf: Add dwelf_elf_e_machine_string.
dwelf_elf_begin now only returns NULL when there is an error
reading or decompressing a file. If the file is not an ELF file
an ELF handle of type ELF_K_NONE is returned.
- backends: Add support for C-SKY.
Update to version 0.176:
- build: Add new --enable-install-elfh option.
Do NOT use this for system installs (it overrides glibc elf.h).
- backends: riscv improved core file and return value location support.
- Fixes:
- CVE-2019-7146, CVE-2019-7148, CVE-2019-7149, CVE-2019-7664 - CVE-2019-7150: dwfl_segment_report_module doesn't check whether the dyn data read from core file is truncated (bsc#1123685)
- CVE-2019-7665: NT_PLATFORM core file note should be a zero terminated string (CVE is a bit misleading, as this is not a bug in libelf as described) (bsc#1125007)
Update to version 0.175:
- readelf: Handle mutliple .debug_macro sections.
Recognize and parse GNU Property, NT_VERSION and
GNU Build Attribute ELF Notes.
- strip: Handle SHT_GROUP correctly.
Add strip --reloc-debug-sections-only option.
Handle relocations against GNU compressed sections.
- libdwelf: New function dwelf_elf_begin.
- libcpu: Recognize bpf jump variants BPF_JLT, BPF_JLE, BPF_JSLT
and BPF_JSLE.
backends: RISCV handles ADD/SUB relocations.
Handle SHT_X86_64_UNWIND.
- CVE-2018-18521: arlib: Divide-by-zero vulnerabilities in the function arlib_add_symbols() used by eu-ranlib (bsc#1112723)
- CVE-2018-18310: Invalid Address Read problem in dwfl_segment_report_module.c (bsc#1111973)
- CVE-2018-18520: eu-size: Bad handling of ar files inside are files (bsc#1112726)
Update to version 0.174:
- libelf, libdw and all tools now handle extended shnum and
shstrndx correctly.
- elfcompress: Don't rewrite input file if no section data needs
updating. Try harder to keep same file mode bits
(suid) on rewrite.
- strip: Handle mixed (out of order) allocated/non-allocated sections.
- unstrip: Handle SHT_GROUP sections.
- backends: RISCV and M68K now have backend implementations to
generate CFI based backtraces.
- Fixes:
- CVE-2018-16402: libelf: denial of service/double free on an attempt to decompress the same section twice (bsc#1107066) Double-free crash in nm and readelf
- CVE-2018-16403: heap buffer overflow in readelf (bsc#1107067)
- CVE-2018-16062: heap-buffer-overflow in /elfutils/libdw/dwarf_getaranges.c:156 (bsc#1106390)
Update to version 0.173:
- More fixes for crashes and hangs found by afl-fuzz. In particular various
functions now detect and break infinite loops caused by bad DIE tree cycles.
- readelf: Will now lookup the size and signedness of constant value types
to display them correctly (and not just how they were encoded).
- libdw: New function dwarf_next_lines to read CU-less .debug_line data.
dwarf_begin_elf now accepts ELF files containing just .debug_line
or .debug_frame sections (which can be read without needing a DIE
tree from the .debug_info section).
Removed dwarf_getscn_info, which was never implemented.
- backends: Handle BPF simple relocations.
The RISCV backends now handles ABI specific CFI and knows about
RISCV register types and names.
Update to version 0.172:
- Various bug fixes in libdw and eu-readelf dealing with bad DWARF5 data.
Thanks to running the afl fuzzer on eu-readelf and various testcases.
Update to version 0.171:
- DWARF5 and split dwarf, including GNU DebugFission, are supported now.
Data can be read from the new DWARF sections .debug_addr, .debug_line_str,
.debug_loclists, .debug_str_offsets and .debug_rnglists. Plus the new
DWARF5 and GNU DebugFission encodings of the existing .debug sections.
Also in split DWARF .dwo (DWARF object) files. This support is mostly
handled by existing functions (dwarf_getlocation*, dwarf_getsrclines,
dwarf_ranges, dwarf_form*, etc.) now returning the data from the new
sections and data formats. But some new functions have been added
to more easily get information about skeleton and split compile units
(dwarf_get_units and dwarf_cu_info), handle new attribute data
(dwarf_getabbrevattr_data) and to keep references to Dwarf_Dies
that might come from different sections or files (dwarf_die_addr_die).
- Not yet supported are .dwp (Dwarf Package) and .sup (Dwarf Supplementary)
files, the .debug_names index, the .debug_cu_index and .debug_tu_index
sections. Only a single .debug_info (and .debug_types) section are
currently handled.
- readelf: Handle all new DWARF5 sections.
--debug-dump=info+ will show split unit DIEs when found.
--dwarf-skeleton can be used when inspecting a .dwo file.
Recognizes GNU locviews with --debug-dump=loc.
- libdw: New functions dwarf_die_addr_die, dwarf_get_units,
dwarf_getabbrevattr_data and dwarf_cu_info.
libdw will now try to resolve the alt file on first use of
an alt attribute FORM when not set yet with dwarf_set_alt.
dwarf_aggregate_size() now works with multi-dimensional arrays.
- libdwfl: Use process_vm_readv when available instead of ptrace.
backends: Add a RISC-V backend.
There were various improvements to build on Windows.
The sha1 and md5 implementations have been removed, they weren't used.
Update to version 0.170:
- libdw: Added new DWARF5 attribute, tag, character encoding, language code,
calling convention, defaulted member function and macro constants
to dwarf.h.
New functions dwarf_default_lower_bound and dwarf_line_file.
dwarf_peel_type now handles DWARF5 immutable, packed and shared tags.
dwarf_getmacros now handles DWARF5 .debug_macro sections.
- strip: Add -R, --remove-section=SECTION and --keep-section=SECTION.
- backends: The bpf disassembler is now always build on all platforms.
Update to version 0.169:
- backends: Add support for EM_PPC64 GNU_ATTRIBUTES.
Frame pointer unwinding fallback support for i386, x86_64, aarch64.
- translations: Update Polish translation.
- CVE-2017-7611: elfutils: DoS (heap-based buffer over-read and application crash) via a crafted ELF file (bsc#1033088)
- CVE-2017-7610: elflint: heap-based buffer overflow in check_group (bsc#1033087)
- CVE-2017-7609: memory allocation failure in __libelf_decompress (bsc#1033086)
- CVE-2017-7607: heap-based buffer overflow in handle_gnu_hashi (readelf.c) (bsc#1033084)
- CVE-2017-7608: heap-based buffer overflow in ebl_object_note_type_name (eblobjnotetypename.c) (bsc#1033085)
- CVE-2017-7613: elfutils: denial of service (memory consumption) via a crafted ELF file (bsc#1033090)
- CVE-2017-7612: elfutils: denial of service (heap-based buffer over-read and application crash) via a crafted ELF file (bsc#1033089)
- Don't make elfutils recommend elfutils-lang as elfutils-lang
already supplements elfutils.
dwarves is shipped new in version 1.22 to provide tooling for use by the Linux Kernel BTF verification framework.
-----------------------------------------------------------------
Advisory ID: SUSE-RU-2022:2628-1
Released: Tue Aug 2 12:21:23 2022
Summary: Recommended update for apparmor
Type: recommended
Severity: important
References: 1195463,1196850
This update for apparmor fixes the following issues:
- Add new rule to fix reported 'DENIED' audit records with Apparmor profile 'usr.sbin.smbd' (bsc#1196850)
- Add new rule to allow reading of openssl.cnf (bsc#1195463)
-----------------------------------------------------------------
Advisory ID: SUSE-RU-2022:2644-1
Released: Wed Aug 3 12:34:12 2022
Summary: Recommended update for dracut
Type: recommended
Severity: moderate
References: 1177461,1184970
This update for dracut fixes the following issues:
- Fix(nfs): /var is not mounted during the transactional-update run (bsc#1184970)
- Fix(nfs): give /run/rpcbind ownership to rpc user (bsc#1177461)
-----------------------------------------------------------------
Advisory ID: SUSE-SU-2022:2649-1
Released: Wed Aug 3 15:06:21 2022
Summary: Security update for pcre2
Type: security
Severity: important
References: 1164384,1199235,CVE-2019-20454,CVE-2022-1587
This update for pcre2 fixes the following issues:
- CVE-2019-20454: Fixed out-of-bounds read in JIT mode when \X is used in non-UTF mode (bsc#1164384).
- CVE-2022-1587: Fixed out-of-bounds read due to bug in recursions (bsc#1199235).
-----------------------------------------------------------------
Advisory ID: SUSE-RU-2022:2678-1
Released: Fri Aug 5 04:01:19 2022
Summary: Recommended update for hwinfo
Type: recommended
Severity: important
References: 1184339,1198043,1199948
This update for hwinfo fixes the following issues:
- Keep NVMe's namespace output consistency when the option `nvme_core.multipath=1` (bsc#1199948)
- Fix bug in determining serial console device name (bsc#1198043)
- Don't rely on select() updating its timeout argument (bsc#1184339)
- Fix logic around CD-ROM detection
- Prevent closing of the open CD-ROM tray after read
- Always read numerical 32bit serial number from EDID header. Override this with ASCII serial number from display
descriptor, if available.
- Display numerical 32bit serial number for monitors without serial number display descriptor
- Fix timezone issue in SOURCE_DATE_EPOCH code
- Recognize loongarch64 architecture
- Update PCI and USB ids
-----------------------------------------------------------------
Advisory ID: SUSE-SU-2022:2717-1
Released: Tue Aug 9 12:54:16 2022
Summary: Security update for ncurses
Type: security
Severity: moderate
References: 1198627,CVE-2022-29458
This update for ncurses fixes the following issues:
- CVE-2022-29458: Fixed segfaulting out-of-bounds read in convert_strings in tinfo/read_entry.c (bsc#1198627).
-----------------------------------------------------------------
Advisory ID: SUSE-RU-2022:2735-1
Released: Wed Aug 10 04:31:41 2022
Summary: Recommended update for tar
Type: recommended
Severity: moderate
References: 1200657
This update for tar fixes the following issues:
- Fix race condition while creating intermediate subdirectories (bsc#1200657)
-----------------------------------------------------------------
Advisory ID: SUSE-SU-2022:2801-1
Released: Fri Aug 12 16:28:11 2022
Summary: Security update for cifs-utils
Type: security
Severity: moderate
References: 1198976,CVE-2022-29869
This update for cifs-utils fixes the following issues:
- CVE-2022-29869: Fixed verbose messages on option parsing causing information leak (bsc#1198976).
-----------------------------------------------------------------
Advisory ID: SUSE-SU-2022:2831-1
Released: Wed Aug 17 14:41:04 2022
Summary: Recommended update for aws-efs-utils, python-ansi2html, python-py, python-pytest-html, python-pytest-metadata, python-pytest-rerunfailures, python-coverage, python-oniconfig, python-unittest-mixins
Type: security
Severity: moderate
References: 1195916,1196696,CVE-2020-29651
This update for aws-efs-utils, python-ansi2html, python-py, python-pytest-html, python-pytest-metadata, python-pytest-rerunfailures fixes the following issues:
- Update in SLE-15 (bsc#1196696, bsc#1195916, jsc#SLE-23972)
- Remove redundant python3 dependency from Requires
- Update regular expression to fix python shebang
- Style is enforced upstream and triggers unnecessary build version requirements
- Allow specifying fs_id in cloudwatch log group name
- Includes fix for stunnel path
- Added hardening to systemd service(s).
- Raise minimal pytest version
- Fix typo in the ansi2html Requires
- Cleanup with spec-cleaner
- Make sure the tests are really executed
- Remove useless devel dependency
- Multiprocessing support in Python 3.8 was broken, but is now fixed
- Bumpy the URL to point to github rather than to docs
-----------------------------------------------------------------
Advisory ID: SUSE-RU-2022:2844-1
Released: Thu Aug 18 14:41:25 2022
Summary: Recommended update for tar
Type: recommended
Severity: important
References: 1202436
This update for tar fixes the following issues:
- A regression in a previous update lead to potential deadlocks when extracting an archive. (bsc#1202436)
The following package changes have been done:
- apparmor-abstractions-2.13.6-150300.3.15.1 updated
- apparmor-parser-2.13.6-150300.3.15.1 updated
- cifs-utils-6.9-150100.5.18.1 updated
- dracut-049.1+suse.238.gd8dbb075-150200.3.60.1 updated
- elfutils-0.177-150300.11.3.1 updated
- glibc-locale-base-2.31-150300.37.1 updated
- glibc-locale-2.31-150300.37.1 updated
- glibc-2.31-150300.37.1 updated
- gpg2-2.2.27-150300.3.5.1 updated
- hwinfo-21.82-150300.3.3.1 updated
- kernel-default-5.3.18-150300.59.87.1 updated
- libapparmor1-2.13.6-150300.3.15.1 updated
- libasm1-0.177-150300.11.3.1 updated
- libdw1-0.177-150300.11.3.1 updated
- libebl-plugins-0.177-150300.11.3.1 updated
- libelf1-0.177-150300.11.3.1 updated
- libldb2-2.4.3-150300.3.20.1 updated
- libncurses6-6.1-150000.5.12.1 updated
- libpcre2-8-0-10.31-150000.3.12.1 updated
- libsystemd0-246.16-150300.7.48.1 updated
- libudev1-246.16-150300.7.48.1 updated
- libzypp-17.30.2-150200.39.1 updated
- logrotate-3.13.0-150000.4.7.1 updated
- ncurses-utils-6.1-150000.5.12.1 updated
- perl-Bootloader-0.939-150300.3.6.1 updated
- python3-apipkg-1.4-150000.3.2.1 added
- python3-iniconfig-1.1.1-150000.1.3.1 added
- python3-py-1.10.0-150000.5.9.2 updated
- samba-client-libs-4.15.8+git.500.d5910280cc7-150300.3.37.1 updated
- systemd-sysvinit-246.16-150300.7.48.1 updated
- systemd-246.16-150300.7.48.1 updated
- tar-1.34-150000.3.18.1 updated
- terminfo-base-6.1-150000.5.12.1 updated
- terminfo-6.1-150000.5.12.1 updated
- udev-246.16-150300.7.48.1 updated
- xen-libs-4.14.5_04-150300.3.32.1 updated
- xen-tools-domU-4.14.5_04-150300.3.32.1 updated
- zypper-1.14.53-150200.33.1 updated
More information about the sle-security-updates
mailing list