SUSE-SU-2023:4983-1: moderate: Security update for gnutls
SUSE-SU-2023:4988-1: low: Security update for python-pip
SUSE-SU-2023:4981-1: important: Security update for postfix
SUSE-SU-2023:4974-1: moderate: Security update for distribution
SUSE-SU-2023:4965-1: moderate: Security update for ppp
SUSE-SU-2023:4958-1: moderate: Security update for tinyxml
SUSE-SU-2023:4949-1: important: Security update for xorg-x11-server
SUSE-SU-2023:4957-1: moderate: Security update for libcryptopp
SUSE-SU-2023:4983-1: moderate: Security update for gnutls
# Security update for gnutls
Announcement ID: SUSE-SU-2023:4983-1
Rating: moderate
References:
* bsc#1217277
Cross-References:
* CVE-2023-5981
CVSS scores:
* CVE-2023-5981 ( SUSE ): 5.9 CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N
* CVE-2023-5981 ( NVD ): 5.9 CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N
Affected Products:
* Basesystem Module 15-SP4
* Basesystem Module 15-SP5
* openSUSE Leap 15.4
* openSUSE Leap 15.5
* openSUSE Leap Micro 5.4
* SUSE Linux Enterprise Desktop 15 SP4
* SUSE Linux Enterprise Desktop 15 SP5
* SUSE Linux Enterprise High Performance Computing 15 SP4
* SUSE Linux Enterprise High Performance Computing 15 SP5
* SUSE Linux Enterprise Micro 5.4
* SUSE Linux Enterprise Micro 5.5
* SUSE Linux Enterprise Micro for Rancher 5.4
* SUSE Linux Enterprise Real Time 15 SP4
* SUSE Linux Enterprise Real Time 15 SP5
* SUSE Linux Enterprise Server 15 SP4
* SUSE Linux Enterprise Server 15 SP5
* SUSE Linux Enterprise Server for SAP Applications 15 SP4
* SUSE Linux Enterprise Server for SAP Applications 15 SP5
* SUSE Manager Proxy 4.3
* SUSE Manager Retail Branch Server 4.3
* SUSE Manager Server 4.3
An update that solves one vulnerability can now be installed.
## Description:
This update for gnutls fixes the following issues:
* CVE-2023-5981: Fixed timing side-channel inside RSA-PSK key exchange
(bsc#1217277).
## Patch Instructions:
To install this SUSE update use the SUSE recommended installation methods like
YaST online_update or "zypper patch".
Alternatively you can run the command listed for your product:
* openSUSE Leap 15.4
zypper in -t patch openSUSE-SLE-15.4-2023-4983=1 SUSE-2023-4983=1
* openSUSE Leap Micro 5.4
zypper in -t patch openSUSE-Leap-Micro-5.4-2023-4983=1
* openSUSE Leap 15.5
zypper in -t patch openSUSE-SLE-15.5-2023-4983=1
* SUSE Linux Enterprise Micro for Rancher 5.4
zypper in -t patch SUSE-SLE-Micro-5.4-2023-4983=1
* SUSE Linux Enterprise Micro 5.4
zypper in -t patch SUSE-SLE-Micro-5.4-2023-4983=1
* SUSE Linux Enterprise Micro 5.5
zypper in -t patch SUSE-SLE-Micro-5.5-2023-4983=1
* Basesystem Module 15-SP4
zypper in -t patch SUSE-SLE-Module-Basesystem-15-SP4-2023-4983=1
* Basesystem Module 15-SP5
zypper in -t patch SUSE-SLE-Module-Basesystem-15-SP5-2023-4983=1
## Package List:
* openSUSE Leap 15.4 (aarch64 ppc64le s390x x86_64 i586)
* libgnutlsxx-devel-3.7.3-150400.4.38.1
* libgnutlsxx28-3.7.3-150400.4.38.1
* gnutls-debugsource-3.7.3-150400.4.38.1
* libgnutls30-hmac-3.7.3-150400.4.38.1
* libgnutlsxx28-debuginfo-3.7.3-150400.4.38.1
* gnutls-debuginfo-3.7.3-150400.4.38.1
* libgnutls30-3.7.3-150400.4.38.1
* gnutls-guile-debuginfo-3.7.3-150400.4.38.1
* gnutls-guile-3.7.3-150400.4.38.1
* libgnutls-devel-3.7.3-150400.4.38.1
* gnutls-3.7.3-150400.4.38.1
* libgnutls30-debuginfo-3.7.3-150400.4.38.1
* openSUSE Leap 15.4 (x86_64)
* libgnutls-devel-32bit-3.7.3-150400.4.38.1
* libgnutls30-32bit-debuginfo-3.7.3-150400.4.38.1
* libgnutls30-32bit-3.7.3-150400.4.38.1
* libgnutls30-hmac-32bit-3.7.3-150400.4.38.1
* openSUSE Leap 15.4 (aarch64_ilp32)
* libgnutls30-64bit-3.7.3-150400.4.38.1
* libgnutls30-hmac-64bit-3.7.3-150400.4.38.1
* libgnutls-devel-64bit-3.7.3-150400.4.38.1
* libgnutls30-64bit-debuginfo-3.7.3-150400.4.38.1
* openSUSE Leap Micro 5.4 (aarch64 s390x x86_64)
* gnutls-debugsource-3.7.3-150400.4.38.1
* libgnutls30-hmac-3.7.3-150400.4.38.1
* gnutls-debuginfo-3.7.3-150400.4.38.1
* libgnutls30-3.7.3-150400.4.38.1
* gnutls-3.7.3-150400.4.38.1
* libgnutls30-debuginfo-3.7.3-150400.4.38.1
* openSUSE Leap 15.5 (aarch64 ppc64le s390x x86_64)
* libgnutlsxx-devel-3.7.3-150400.4.38.1
* libgnutlsxx28-3.7.3-150400.4.38.1
* gnutls-debugsource-3.7.3-150400.4.38.1
* libgnutls30-hmac-3.7.3-150400.4.38.1
* libgnutlsxx28-debuginfo-3.7.3-150400.4.38.1
* gnutls-debuginfo-3.7.3-150400.4.38.1
* libgnutls30-3.7.3-150400.4.38.1
* gnutls-guile-debuginfo-3.7.3-150400.4.38.1
* gnutls-guile-3.7.3-150400.4.38.1
* libgnutls-devel-3.7.3-150400.4.38.1
* gnutls-3.7.3-150400.4.38.1
* libgnutls30-debuginfo-3.7.3-150400.4.38.1
* openSUSE Leap 15.5 (x86_64)
* libgnutls-devel-32bit-3.7.3-150400.4.38.1
* libgnutls30-32bit-debuginfo-3.7.3-150400.4.38.1
* libgnutls30-32bit-3.7.3-150400.4.38.1
* libgnutls30-hmac-32bit-3.7.3-150400.4.38.1
* SUSE Linux Enterprise Micro for Rancher 5.4 (aarch64 s390x x86_64)
* gnutls-debugsource-3.7.3-150400.4.38.1
* libgnutls30-hmac-3.7.3-150400.4.38.1
* gnutls-debuginfo-3.7.3-150400.4.38.1
* libgnutls30-3.7.3-150400.4.38.1
* gnutls-3.7.3-150400.4.38.1
* libgnutls30-debuginfo-3.7.3-150400.4.38.1
* SUSE Linux Enterprise Micro 5.4 (aarch64 s390x x86_64)
* gnutls-debugsource-3.7.3-150400.4.38.1
* libgnutls30-hmac-3.7.3-150400.4.38.1
* gnutls-debuginfo-3.7.3-150400.4.38.1
* libgnutls30-3.7.3-150400.4.38.1
* gnutls-3.7.3-150400.4.38.1
* libgnutls30-debuginfo-3.7.3-150400.4.38.1
* SUSE Linux Enterprise Micro 5.5 (aarch64 s390x x86_64)
* gnutls-debugsource-3.7.3-150400.4.38.1
* libgnutls30-hmac-3.7.3-150400.4.38.1
* gnutls-debuginfo-3.7.3-150400.4.38.1
* libgnutls30-3.7.3-150400.4.38.1
* gnutls-3.7.3-150400.4.38.1
* libgnutls30-debuginfo-3.7.3-150400.4.38.1
* Basesystem Module 15-SP4 (aarch64 ppc64le s390x x86_64)
* libgnutlsxx-devel-3.7.3-150400.4.38.1
* libgnutlsxx28-3.7.3-150400.4.38.1
* gnutls-debugsource-3.7.3-150400.4.38.1
* libgnutls30-hmac-3.7.3-150400.4.38.1
* libgnutlsxx28-debuginfo-3.7.3-150400.4.38.1
* gnutls-debuginfo-3.7.3-150400.4.38.1
* libgnutls30-3.7.3-150400.4.38.1
* libgnutls-devel-3.7.3-150400.4.38.1
* gnutls-3.7.3-150400.4.38.1
* libgnutls30-debuginfo-3.7.3-150400.4.38.1
* Basesystem Module 15-SP4 (x86_64)
* libgnutls30-32bit-debuginfo-3.7.3-150400.4.38.1
* libgnutls30-32bit-3.7.3-150400.4.38.1
* libgnutls30-hmac-32bit-3.7.3-150400.4.38.1
* Basesystem Module 15-SP5 (aarch64 ppc64le s390x x86_64)
* libgnutlsxx-devel-3.7.3-150400.4.38.1
* libgnutlsxx28-3.7.3-150400.4.38.1
* gnutls-debugsource-3.7.3-150400.4.38.1
* libgnutls30-hmac-3.7.3-150400.4.38.1
* libgnutlsxx28-debuginfo-3.7.3-150400.4.38.1
* gnutls-debuginfo-3.7.3-150400.4.38.1
* libgnutls30-3.7.3-150400.4.38.1
* libgnutls-devel-3.7.3-150400.4.38.1
* gnutls-3.7.3-150400.4.38.1
* libgnutls30-debuginfo-3.7.3-150400.4.38.1
* Basesystem Module 15-SP5 (x86_64)
* libgnutls30-32bit-debuginfo-3.7.3-150400.4.38.1
* libgnutls30-32bit-3.7.3-150400.4.38.1
* libgnutls30-hmac-32bit-3.7.3-150400.4.38.1
## References:
* https://www.suse.com/security/cve/CVE-2023-5981.html
* https://bugzilla.suse.com/show_bug.cgi?id=1217277
SUSE-SU-2023:4988-1: low: Security update for python-pip
# Security update for python-pip
Announcement ID: SUSE-SU-2023:4988-1
Rating: low
References:
* bsc#1217353
Cross-References:
* CVE-2023-5752
CVSS scores:
* CVE-2023-5752 ( SUSE ): 3.3 CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N
* CVE-2023-5752 ( NVD ): 5.5 CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N
Affected Products:
* openSUSE Leap 15.4
* openSUSE Leap 15.5
* Python 3 Module 15-SP4
* Python 3 Module 15-SP5
* SUSE Linux Enterprise Desktop 15 SP4
* SUSE Linux Enterprise Desktop 15 SP5
* SUSE Linux Enterprise High Performance Computing 15 SP4
* SUSE Linux Enterprise High Performance Computing 15 SP5
* SUSE Linux Enterprise Server 15 SP4
* SUSE Linux Enterprise Server 15 SP5
* SUSE Linux Enterprise Server for SAP Applications 15 SP4
* SUSE Linux Enterprise Server for SAP Applications 15 SP5
* SUSE Manager Proxy 4.3
* SUSE Manager Retail Branch Server 4.3
* SUSE Manager Server 4.3
An update that solves one vulnerability can now be installed.
## Description:
This update for python-pip fixes the following issues:
* CVE-2023-5752: Fixed injection of arbitrary configuration through Mercurial
parameter (bsc#1217353).
## Patch Instructions:
To install this SUSE update use the SUSE recommended installation methods like
YaST online_update or "zypper patch".
Alternatively you can run the command listed for your product:
* openSUSE Leap 15.4
zypper in -t patch SUSE-2023-4988=1 openSUSE-SLE-15.4-2023-4988=1
* openSUSE Leap 15.5
zypper in -t patch openSUSE-SLE-15.5-2023-4988=1
* Python 3 Module 15-SP4
zypper in -t patch SUSE-SLE-Module-Python3-15-SP4-2023-4988=1
* Python 3 Module 15-SP5
zypper in -t patch SUSE-SLE-Module-Python3-15-SP5-2023-4988=1
## Package List:
* openSUSE Leap 15.4 (noarch)
* python311-pip-22.3.1-150400.17.12.1
* openSUSE Leap 15.5 (noarch)
* python311-pip-22.3.1-150400.17.12.1
* Python 3 Module 15-SP4 (noarch)
* python311-pip-22.3.1-150400.17.12.1
* Python 3 Module 15-SP5 (noarch)
* python311-pip-22.3.1-150400.17.12.1
## References:
* https://www.suse.com/security/cve/CVE-2023-5752.html
* https://bugzilla.suse.com/show_bug.cgi?id=1217353
SUSE-SU-2023:4981-1: important: Security update for postfix
# Security update for postfix
Announcement ID: SUSE-SU-2023:4981-1
Rating: important
References:
* bsc#1218304
* bsc#1218314
Cross-References:
* CVE-2023-51764
CVSS scores:
* CVE-2023-51764 ( SUSE ): 5.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N
Affected Products:
* Basesystem Module 15-SP5
* Legacy Module 15-SP5
* openSUSE Leap 15.5
* Server Applications Module 15-SP5
* SUSE Linux Enterprise Desktop 15 SP5
* SUSE Linux Enterprise High Performance Computing 15 SP5
* SUSE Linux Enterprise Real Time 15 SP5
* SUSE Linux Enterprise Server 15 SP5
* SUSE Linux Enterprise Server for SAP Applications 15 SP5
An update that solves one vulnerability and has one security fix can now be
installed.
## Description:
This update for postfix fixes the following issues:
* CVE-2023-51764: Fixed new SMTP smuggling attack (bsc#1218304).
## Patch Instructions:
To install this SUSE update use the SUSE recommended installation methods like
YaST online_update or "zypper patch".
Alternatively you can run the command listed for your product:
* openSUSE Leap 15.5
zypper in -t patch SUSE-2023-4981=1 openSUSE-SLE-15.5-2023-4981=1
* Basesystem Module 15-SP5
zypper in -t patch SUSE-SLE-Module-Basesystem-15-SP5-2023-4981=1
* Legacy Module 15-SP5
zypper in -t patch SUSE-SLE-Module-Legacy-15-SP5-2023-4981=1
* Server Applications Module 15-SP5
zypper in -t patch SUSE-SLE-Module-Server-Applications-15-SP5-2023-4981=1
## Package List:
* openSUSE Leap 15.5 (aarch64 ppc64le s390x x86_64 i586)
* postfix-bdb-debugsource-3.7.3-150500.3.11.1
* postfix-debugsource-3.7.3-150500.3.11.1
* postfix-3.7.3-150500.3.11.1
* postfix-debuginfo-3.7.3-150500.3.11.1
* postfix-ldap-debuginfo-3.7.3-150500.3.11.1
* postfix-postgresql-3.7.3-150500.3.11.1
* postfix-bdb-debuginfo-3.7.3-150500.3.11.1
* postfix-ldap-3.7.3-150500.3.11.1
* postfix-postgresql-debuginfo-3.7.3-150500.3.11.1
* postfix-bdb-lmdb-debuginfo-3.7.3-150500.3.11.1
* postfix-bdb-3.7.3-150500.3.11.1
* postfix-bdb-lmdb-3.7.3-150500.3.11.1
* postfix-devel-3.7.3-150500.3.11.1
* postfix-mysql-3.7.3-150500.3.11.1
* postfix-mysql-debuginfo-3.7.3-150500.3.11.1
* openSUSE Leap 15.5 (noarch)
* postfix-doc-3.7.3-150500.3.11.1
* Basesystem Module 15-SP5 (aarch64 ppc64le s390x x86_64)
* postfix-debugsource-3.7.3-150500.3.11.1
* postfix-3.7.3-150500.3.11.1
* postfix-debuginfo-3.7.3-150500.3.11.1
* postfix-ldap-debuginfo-3.7.3-150500.3.11.1
* postfix-ldap-3.7.3-150500.3.11.1
* postfix-devel-3.7.3-150500.3.11.1
* Basesystem Module 15-SP5 (noarch)
* postfix-doc-3.7.3-150500.3.11.1
* Legacy Module 15-SP5 (aarch64 ppc64le s390x x86_64)
* postfix-bdb-debugsource-3.7.3-150500.3.11.1
* postfix-bdb-debuginfo-3.7.3-150500.3.11.1
* postfix-bdb-lmdb-debuginfo-3.7.3-150500.3.11.1
* postfix-bdb-3.7.3-150500.3.11.1
* postfix-bdb-lmdb-3.7.3-150500.3.11.1
* Server Applications Module 15-SP5 (aarch64 ppc64le s390x x86_64)
* postfix-debuginfo-3.7.3-150500.3.11.1
* postfix-debugsource-3.7.3-150500.3.11.1
* postfix-mysql-3.7.3-150500.3.11.1
* postfix-mysql-debuginfo-3.7.3-150500.3.11.1
## References:
* https://www.suse.com/security/cve/CVE-2023-51764.html
* https://bugzilla.suse.com/show_bug.cgi?id=1218304
* https://bugzilla.suse.com/show_bug.cgi?id=1218314
SUSE-SU-2023:4974-1: moderate: Security update for distribution
# Security update for distribution
Announcement ID: SUSE-SU-2023:4974-1
Rating: moderate
References:
* bsc#1216491
Affected Products:
* Containers Module 15-SP4
* Containers Module 15-SP5
* openSUSE Leap 15.4
* openSUSE Leap 15.5
* SUSE Linux Enterprise High Performance Computing 15 SP4
* SUSE Linux Enterprise High Performance Computing 15 SP5
* SUSE Linux Enterprise Real Time 15 SP4
* SUSE Linux Enterprise Real Time 15 SP5
* SUSE Linux Enterprise Server 15 SP4
* SUSE Linux Enterprise Server 15 SP5
* SUSE Linux Enterprise Server for SAP Applications 15 SP4
* SUSE Linux Enterprise Server for SAP Applications 15 SP5
* SUSE Manager Proxy 4.3
* SUSE Manager Retail Branch Server 4.3
* SUSE Manager Server 4.3
An update that has one security fix can now be installed.
## Description:
This update for distribution fixes the following issues:
distribution was updated to 2.8.3 (bsc#1216491):
* Pass `BUILDTAGS` argument to `go build`
* Enable Go build tags
* `reference`: replace deprecated function `SplitHostname`
* Dont parse errors as JSON unless Content-Type is set to JSON
* update to go 1.20.8
* Set `Content-Type` header in registry client `ReadFrom`
* deprecate reference package, migrate to github.com/distribution/reference
* `digestset`: deprecate package in favor of `go-digest/digestset`
* Do not close HTTP request body in HTTP handler
## Patch Instructions:
To install this SUSE update use the SUSE recommended installation methods like
YaST online_update or "zypper patch".
Alternatively you can run the command listed for your product:
* openSUSE Leap 15.4
zypper in -t patch openSUSE-SLE-15.4-2023-4974=1 SUSE-2023-4974=1
* openSUSE Leap 15.5
zypper in -t patch openSUSE-SLE-15.5-2023-4974=1
* Containers Module 15-SP4
zypper in -t patch SUSE-SLE-Module-Containers-15-SP4-2023-4974=1
* Containers Module 15-SP5
zypper in -t patch SUSE-SLE-Module-Containers-15-SP5-2023-4974=1
## Package List:
* openSUSE Leap 15.4 (aarch64 ppc64le s390x x86_64 i586)
* distribution-registry-2.8.3-150400.9.24.1
* openSUSE Leap 15.5 (aarch64 ppc64le s390x x86_64)
* distribution-registry-2.8.3-150400.9.24.1
* Containers Module 15-SP4 (aarch64 ppc64le s390x x86_64)
* distribution-registry-2.8.3-150400.9.24.1
* Containers Module 15-SP5 (aarch64 ppc64le s390x x86_64)
* distribution-registry-2.8.3-150400.9.24.1
## References:
* https://bugzilla.suse.com/show_bug.cgi?id=1216491
SUSE-SU-2023:4965-1: moderate: Security update for ppp
# Security update for ppp
Announcement ID: SUSE-SU-2023:4965-1
Rating: moderate
References:
* bsc#1218251
Cross-References:
* CVE-2022-4603
CVSS scores:
* CVE-2022-4603 ( SUSE ): 4.3 CVSS:3.1/AV:A/AC:H/PR:L/UI:R/S:U/C:L/I:L/A:L
* CVE-2022-4603 ( NVD ): 6.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H
Affected Products:
* Desktop Applications Module 15-SP5
* openSUSE Leap 15.4
* openSUSE Leap 15.5
* openSUSE Leap Micro 5.3
* openSUSE Leap Micro 5.4
* SUSE Linux Enterprise Desktop 15 SP5
* SUSE Linux Enterprise High Performance Computing 15 SP5
* SUSE Linux Enterprise Micro 5.3
* SUSE Linux Enterprise Micro 5.4
* SUSE Linux Enterprise Micro 5.5
* SUSE Linux Enterprise Micro for Rancher 5.3
* SUSE Linux Enterprise Micro for Rancher 5.4
* SUSE Linux Enterprise Real Time 15 SP4
* SUSE Linux Enterprise Real Time 15 SP5
* SUSE Linux Enterprise Server 15 SP5
* SUSE Linux Enterprise Server for SAP Applications 15 SP5
An update that solves one vulnerability can now be installed.
## Description:
This update for ppp fixes the following issues:
* CVE-2022-4603: Fixed improper validation of array index of the component
pppdump (bsc#1218251).
## Patch Instructions:
To install this SUSE update use the SUSE recommended installation methods like
YaST online_update or "zypper patch".
Alternatively you can run the command listed for your product:
* SUSE Linux Enterprise Micro for Rancher 5.4
zypper in -t patch SUSE-SLE-Micro-5.4-2023-4965=1
* SUSE Linux Enterprise Micro 5.4
zypper in -t patch SUSE-SLE-Micro-5.4-2023-4965=1
* SUSE Linux Enterprise Micro 5.5
zypper in -t patch SUSE-SLE-Micro-5.5-2023-4965=1
* Desktop Applications Module 15-SP5
zypper in -t patch SUSE-SLE-Module-Desktop-Applications-15-SP5-2023-4965=1
* SUSE Linux Enterprise Real Time 15 SP4
zypper in -t patch SUSE-SLE-Product-RT-15-SP4-2023-4965=1
* openSUSE Leap Micro 5.3
zypper in -t patch openSUSE-Leap-Micro-5.3-2023-4965=1
* openSUSE Leap Micro 5.4
zypper in -t patch openSUSE-Leap-Micro-5.4-2023-4965=1
* openSUSE Leap 15.4
zypper in -t patch openSUSE-SLE-15.4-2023-4965=1
* openSUSE Leap 15.5
zypper in -t patch openSUSE-SLE-15.5-2023-4965=1
* SUSE Linux Enterprise Micro for Rancher 5.3
zypper in -t patch SUSE-SLE-Micro-5.3-2023-4965=1
* SUSE Linux Enterprise Micro 5.3
zypper in -t patch SUSE-SLE-Micro-5.3-2023-4965=1
## Package List:
* SUSE Linux Enterprise Micro for Rancher 5.4 (aarch64 s390x x86_64)
* ppp-debuginfo-2.4.7-150000.5.13.1
* ppp-debugsource-2.4.7-150000.5.13.1
* ppp-2.4.7-150000.5.13.1
* SUSE Linux Enterprise Micro 5.4 (aarch64 s390x x86_64)
* ppp-debuginfo-2.4.7-150000.5.13.1
* ppp-debugsource-2.4.7-150000.5.13.1
* ppp-2.4.7-150000.5.13.1
* SUSE Linux Enterprise Micro 5.5 (aarch64 s390x x86_64)
* ppp-debuginfo-2.4.7-150000.5.13.1
* ppp-debugsource-2.4.7-150000.5.13.1
* ppp-2.4.7-150000.5.13.1
* Desktop Applications Module 15-SP5 (aarch64 ppc64le s390x x86_64)
* ppp-debuginfo-2.4.7-150000.5.13.1
* ppp-debugsource-2.4.7-150000.5.13.1
* ppp-2.4.7-150000.5.13.1
* ppp-devel-2.4.7-150000.5.13.1
* SUSE Linux Enterprise Real Time 15 SP4 (x86_64)
* ppp-debuginfo-2.4.7-150000.5.13.1
* ppp-debugsource-2.4.7-150000.5.13.1
* ppp-2.4.7-150000.5.13.1
* ppp-devel-2.4.7-150000.5.13.1
* openSUSE Leap Micro 5.3 (aarch64 s390x x86_64)
* ppp-debuginfo-2.4.7-150000.5.13.1
* ppp-debugsource-2.4.7-150000.5.13.1
* ppp-2.4.7-150000.5.13.1
* openSUSE Leap Micro 5.4 (aarch64 s390x x86_64)
* ppp-debuginfo-2.4.7-150000.5.13.1
* ppp-debugsource-2.4.7-150000.5.13.1
* ppp-2.4.7-150000.5.13.1
* openSUSE Leap 15.4 (aarch64 ppc64le s390x x86_64)
* ppp-debuginfo-2.4.7-150000.5.13.1
* ppp-debugsource-2.4.7-150000.5.13.1
* ppp-2.4.7-150000.5.13.1
* ppp-devel-2.4.7-150000.5.13.1
* openSUSE Leap 15.4 (noarch)
* ppp-modem-2.4.7-150000.5.13.1
* openSUSE Leap 15.5 (aarch64 ppc64le s390x x86_64)
* ppp-debuginfo-2.4.7-150000.5.13.1
* ppp-debugsource-2.4.7-150000.5.13.1
* ppp-2.4.7-150000.5.13.1
* ppp-devel-2.4.7-150000.5.13.1
* openSUSE Leap 15.5 (noarch)
* ppp-modem-2.4.7-150000.5.13.1
* SUSE Linux Enterprise Micro for Rancher 5.3 (aarch64 s390x x86_64)
* ppp-debuginfo-2.4.7-150000.5.13.1
* ppp-debugsource-2.4.7-150000.5.13.1
* ppp-2.4.7-150000.5.13.1
* SUSE Linux Enterprise Micro 5.3 (aarch64 s390x x86_64)
* ppp-debuginfo-2.4.7-150000.5.13.1
* ppp-debugsource-2.4.7-150000.5.13.1
* ppp-2.4.7-150000.5.13.1
## References:
* https://www.suse.com/security/cve/CVE-2022-4603.html
* https://bugzilla.suse.com/show_bug.cgi?id=1218251
SUSE-SU-2023:4958-1: moderate: Security update for tinyxml
# Security update for tinyxml
Announcement ID: SUSE-SU-2023:4958-1
Rating: moderate
References:
* bsc#1218040
Cross-References:
* CVE-2023-34194
CVSS scores:
* CVE-2023-34194 ( SUSE ): 5.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L
* CVE-2023-34194 ( NVD ): 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Affected Products:
* openSUSE Leap 15.4
* openSUSE Leap 15.5
* SUSE Linux Enterprise Desktop 15 SP5
* SUSE Linux Enterprise High Performance Computing 15 SP5
* SUSE Linux Enterprise Micro 5.5
* SUSE Linux Enterprise Real Time 15 SP5
* SUSE Linux Enterprise Server 15 SP5
* SUSE Linux Enterprise Server for SAP Applications 15 SP5
* SUSE Package Hub 15 15-SP5
An update that solves one vulnerability can now be installed.
## Description:
This update for tinyxml fixes the following issues:
* CVE-2023-34194: Fixed reachable assertion may lead to denial of service
(bsc#1218040).
## Patch Instructions:
To install this SUSE update use the SUSE recommended installation methods like
YaST online_update or "zypper patch".
Alternatively you can run the command listed for your product:
* openSUSE Leap 15.5
zypper in -t patch openSUSE-SLE-15.5-2023-4958=1
* SUSE Package Hub 15 15-SP5
zypper in -t patch SUSE-SLE-Module-Packagehub-Subpackages-15-SP5-2023-4958=1
* openSUSE Leap 15.4
zypper in -t patch openSUSE-SLE-15.4-2023-4958=1
## Package List:
* openSUSE Leap 15.5 (aarch64 ppc64le s390x x86_64)
* libtinyxml0-2.6.2-150000.3.6.1
* libtinyxml0-debuginfo-2.6.2-150000.3.6.1
* tinyxml-devel-2.6.2-150000.3.6.1
* tinyxml-debugsource-2.6.2-150000.3.6.1
* tinyxml-docs-2.6.2-150000.3.6.1
* SUSE Package Hub 15 15-SP5 (aarch64 ppc64le s390x x86_64)
* libtinyxml0-2.6.2-150000.3.6.1
* libtinyxml0-debuginfo-2.6.2-150000.3.6.1
* tinyxml-devel-2.6.2-150000.3.6.1
* tinyxml-debugsource-2.6.2-150000.3.6.1
* tinyxml-docs-2.6.2-150000.3.6.1
* openSUSE Leap 15.4 (aarch64 ppc64le s390x x86_64)
* libtinyxml0-2.6.2-150000.3.6.1
* libtinyxml0-debuginfo-2.6.2-150000.3.6.1
* tinyxml-devel-2.6.2-150000.3.6.1
* tinyxml-debugsource-2.6.2-150000.3.6.1
* tinyxml-docs-2.6.2-150000.3.6.1
## References:
* https://www.suse.com/security/cve/CVE-2023-34194.html
* https://bugzilla.suse.com/show_bug.cgi?id=1218040
SUSE-SU-2023:4949-1: important: Security update for xorg-x11-server
# Security update for xorg-x11-server
Announcement ID: SUSE-SU-2023:4949-1
Rating: important
References:
* bsc#1217765
Cross-References:
* CVE-2023-6377
CVSS scores:
* CVE-2023-6377 ( SUSE ): 8.4 CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
* CVE-2023-6377 ( NVD ): 7.8 CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Affected Products:
* Basesystem Module 15-SP4
* Development Tools Module 15-SP4
* openSUSE Leap 15.4
* SUSE Linux Enterprise Desktop 15 SP4
* SUSE Linux Enterprise High Performance Computing 15 SP4
* SUSE Linux Enterprise Real Time 15 SP4
* SUSE Linux Enterprise Server 15 SP4
* SUSE Linux Enterprise Server for SAP Applications 15 SP4
* SUSE Manager Proxy 4.3
* SUSE Manager Retail Branch Server 4.3
* SUSE Manager Server 4.3
An update that solves one vulnerability can now be installed.
## Description:
This update for xorg-x11-server fixes the following issues:
* CVE-2023-6377: Fixed out-of-bounds memory write in XKB button actions
(bsc#1217765).
## Patch Instructions:
To install this SUSE update use the SUSE recommended installation methods like
YaST online_update or "zypper patch".
Alternatively you can run the command listed for your product:
* Basesystem Module 15-SP4
zypper in -t patch SUSE-SLE-Module-Basesystem-15-SP4-2023-4949=1
* Development Tools Module 15-SP4
zypper in -t patch SUSE-SLE-Module-Development-Tools-15-SP4-2023-4949=1
* openSUSE Leap 15.4
zypper in -t patch SUSE-2023-4949=1 openSUSE-SLE-15.4-2023-4949=1
## Package List:
* Basesystem Module 15-SP4 (aarch64 ppc64le s390x x86_64)
* xorg-x11-server-1.20.3-150400.38.35.1
* xorg-x11-server-extra-1.20.3-150400.38.35.1
* xorg-x11-server-debugsource-1.20.3-150400.38.35.1
* xorg-x11-server-debuginfo-1.20.3-150400.38.35.1
* xorg-x11-server-extra-debuginfo-1.20.3-150400.38.35.1
* Development Tools Module 15-SP4 (aarch64 ppc64le s390x x86_64)
* xorg-x11-server-sdk-1.20.3-150400.38.35.1
* xorg-x11-server-debugsource-1.20.3-150400.38.35.1
* xorg-x11-server-debuginfo-1.20.3-150400.38.35.1
* openSUSE Leap 15.4 (aarch64 ppc64le s390x x86_64 i586)
* xorg-x11-server-1.20.3-150400.38.35.1
* xorg-x11-server-extra-1.20.3-150400.38.35.1
* xorg-x11-server-debugsource-1.20.3-150400.38.35.1
* xorg-x11-server-sdk-1.20.3-150400.38.35.1
* xorg-x11-server-debuginfo-1.20.3-150400.38.35.1
* xorg-x11-server-extra-debuginfo-1.20.3-150400.38.35.1
* xorg-x11-server-source-1.20.3-150400.38.35.1
## References:
* https://www.suse.com/security/cve/CVE-2023-6377.html
* https://bugzilla.suse.com/show_bug.cgi?id=1217765
SUSE-SU-2023:4957-1: moderate: Security update for libcryptopp
# Security update for libcryptopp
Announcement ID: SUSE-SU-2023:4957-1
Rating: moderate
References:
* bsc#1218219
Cross-References:
* CVE-2023-50980
CVSS scores:
* CVE-2023-50980 ( SUSE ): 5.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L
Affected Products:
* openSUSE Leap 15.4
An update that solves one vulnerability can now be installed.
## Description:
This update for libcryptopp fixes the following issues:
* CVE-2023-50980: Fixed DoS via malformed DER public key file (bsc#1218219).
## Patch Instructions:
To install this SUSE update use the SUSE recommended installation methods like
YaST online_update or "zypper patch".
Alternatively you can run the command listed for your product:
* openSUSE Leap 15.4
zypper in -t patch openSUSE-SLE-15.4-2023-4957=1
## Package List:
* openSUSE Leap 15.4 (x86_64)
* libcryptopp5_6_5-32bit-debuginfo-5.6.5-150000.1.9.1
* libcryptopp5_6_5-32bit-5.6.5-150000.1.9.1
* openSUSE Leap 15.4 (aarch64 ppc64le s390x x86_64)
* libcryptopp5_6_5-debuginfo-5.6.5-150000.1.9.1
* libcryptopp5_6_5-5.6.5-150000.1.9.1
## References:
* https://www.suse.com/security/cve/CVE-2023-50980.html
* https://bugzilla.suse.com/show_bug.cgi?id=1218219
