SUSE-CU-2022:3068-1: Security update of suse/sle-micro/5.2/toolbox

[sle-security-updates at lists.suse.com]

SUSE Container Update Advisory: suse/sle-micro/5.2/toolbox
-----------------------------------------------------------------
Container Advisory ID : SUSE-CU-2022:3068-1
Container Tags        : suse/sle-micro/5.2/toolbox:11.1 , suse/sle-micro/5.2/toolbox:11.1-6.2.139 , suse/sle-micro/5.2/toolbox:latest
Container Release     : 6.2.139
Severity              : important
Type                  : security
References            : 1190818 1199944 1203201 1204986 CVE-2022-1664 CVE-2022-43995
-----------------------------------------------------------------

The container suse/sle-micro/5.2/toolbox was updated. The following patches have been included in this update:

-----------------------------------------------------------------
Advisory ID: SUSE-SU-2022:4077-1
Released:    Fri Nov 18 15:05:28 2022
Summary:     Security update for sudo
Type:        security
Severity:    important
References:  1190818,1203201,1204986,CVE-2022-43995
This update for sudo fixes the following issues:

- CVE-2022-43995: Fixed a potential heap-based buffer over-read when entering a passwor dof seven characters or fewer and using the crypt() password backend (bsc#1204986).

- Fix wrong information output in the error message (bsc#1190818).
- Make sure SIGCHLD is not ignored when sudo is executed; fixes race condition (bsc#1203201).

-----------------------------------------------------------------
Advisory ID: SUSE-SU-2022:4081-1
Released:    Fri Nov 18 15:40:46 2022
Summary:     Security update for dpkg
Type:        security
Severity:    low
References:  1199944,CVE-2022-1664
This update for dpkg fixes the following issues:

- CVE-2022-1664: Fixed a directory traversal vulnerability in Dpkg::Source::Archive (bsc#1199944).


The following package changes have been done:

- sudo-1.9.5p2-150300.3.13.1 updated
- update-alternatives-1.19.0.4-150000.4.4.1 updated