SUSE-SU-2025:4395-1: moderate: Security update for govulncheck-vulndb
SUSE-SU-2025:4397-1: important: Security update for MozillaThunderbird
SUSE-SU-2025:4395-1: moderate: Security update for govulncheck-vulndb
# Security update for govulncheck-vulndb
Announcement ID: SUSE-SU-2025:4395-1
Release Date: 2025-12-15T11:15:31Z
Rating: moderate
References:
* jsc#PED-11136
Affected Products:
* openSUSE Leap 15.6
* SUSE Linux Enterprise Desktop 15 SP6
* SUSE Linux Enterprise Real Time 15 SP6
* SUSE Linux Enterprise Server 15 SP6
* SUSE Linux Enterprise Server for SAP Applications 15 SP6
* SUSE Package Hub 15 15-SP6
An update that contains one feature can now be installed.
## Description:
This update for govulncheck-vulndb fixes the following issues:
* Update to version 0.0.20251209T172047 2025-12-09T17:20:47Z (jsc#PED-11136).
Go CVE Numbering Authority IDs added or updated with aliases: * GO-2025-4006
CVE-2025-61725 * GO-2025-4176 CVE-2025-65105 GHSA-j3rw-fx6g-q46j * GO-2025-4177
CVE-2025-64750 GHSA-wwrx-w7c9-rf87 * GO-2025-4178 CVE-2025-13870
GHSA-58w6-w55x-6wq8 * GO-2025-4179 CVE-2025-64443 GHSA-46gc-mwh4-cc5r *
GO-2025-4180 CVE-2025-44005 GHSA-h8cp-697h-8c8p * GO-2025-4181 CVE-2025-66406
GHSA-j7c9-79x7-8hpr * GO-2025-4182 CVE-2025-66411 GHSA-jf75-p25m-pw74 *
GO-2025-4183 CVE-2017-18870 GHSA-9j9j-mm2r-9rfm * GO-2025-4184 CVE-2017-18871
GHSA-jc6w-8r7f-vmp5 * GO-2025-4185 CVE-2017-18902 GHSA-jwfv-5hwq-f97r *
GO-2025-4186 CVE-2017-18875 GHSA-9rr5-q43r-ccv4 * GO-2025-4187 CVE-2017-18876
GHSA-hjqh-j6rj-gh8q * GO-2025-4189 CVE-2017-18879 GHSA-498j-wxww-j897 *
GO-2025-4190 CVE-2017-18877 GHSA-9x8x-w6g5-hx4w * GO-2025-4192 CVE-2025-66564
GHSA-4qg8-fj49-pxjh * GO-2025-4193 CVE-2025-66506 GHSA-f83f-xpx7-ffpw *
GO-2025-4197 CVE-2017-18884 GHSA-876j-jfqf-m7j7 * GO-2025-4198 CVE-2017-18883
GHSA-w8cc-3h7q-jhc3
* Update to version 0.0.20251203T174324 2025-12-03T17:43:24Z (jsc#PED-11136).
Go CVE Numbering Authority IDs added or updated with aliases: * GO-2025-4155
CVE-2025-61729 * GO-2025-4163 CVE-2025-60638 GHSA-f2hj-vpp9-6vm2 * GO-2025-4164
CVE-2025-60632 GHSA-vgq7-9r5r-j9v3 * GO-2025-4171 CVE-2025-66410 GHSA-
jrhg-82w2-vvj7 * GO-2025-4172 CVE-2025-12756 GHSA-p6gj-jc38-x2m7 * GO-2025-4174
CVE-2025-13353 GHSA-69jw-4jj8-fcxm * GO-2025-4175 CVE-2025-61727
* Update to version 0.0.20251125T181218 2025-11-25T18:12:18Z (jsc#PED-11136).
Go CVE Numbering Authority IDs added or updated with aliases: * GO-2025-4133
CVE-2025-55074 GHSA-9hh7-6558-qfp2 * GO-2025-4138 CVE-2025-65025
GHSA-h3mw-4f23-gwpw * GO-2025-4139 CVE-2025-65026 GHSA-hcpf-qv9m-vfgp *
GO-2025-4146 CVE-2018-21258 GHSA-5mh6-p63g-3mv5 * GO-2025-4147
GHSA-6xvf-4vh9-mw47 * GO-2025-4149 CVE-2025-13425 GHSA-f786-75f3-74xj *
GO-2025-4150 CVE-2025-64751 GHSA-2c64-vmv2-hgfc * GO-2025-4151 CVE-2025-65111
GHSA-9m7r-g8hg-x3vr * GO-2025-4152 CVE-2025-13357 GHSA-gmm6-j2g5-r52m *
GO-2025-4153 CVE-2025-41115 GHSA-w62r-7c53-fmc5 * GO-2025-4156 CVE-2025-64761
GHSA-7ff4-jw48-3436 * GO-2025-4157 GHSA-2fcv-qww3-9v6h * GO-2025-4158 GHSA-
rj4j-2jph-gg43 * GO-2025-4159 GHSA-xq4h-wqm2-668w * GO-2025-4160 CVE-2025-65965
GHSA-6gxw-85q2-q646
## Patch Instructions:
To install this SUSE update use the SUSE recommended installation methods like
YaST online_update or "zypper patch".
Alternatively you can run the command listed for your product:
* openSUSE Leap 15.6
zypper in -t patch openSUSE-SLE-15.6-2025-4395=1
* SUSE Package Hub 15 15-SP6
zypper in -t patch SUSE-SLE-Module-Packagehub-Subpackages-15-SP6-2025-4395=1
## Package List:
* openSUSE Leap 15.6 (noarch)
* govulncheck-vulndb-0.0.20251209T172047-150000.1.127.1
* SUSE Package Hub 15 15-SP6 (noarch)
* govulncheck-vulndb-0.0.20251209T172047-150000.1.127.1
## References:
* https://jira.suse.com/browse/PED-11136
SUSE-SU-2025:4397-1: important: Security update for MozillaThunderbird
# Security update for MozillaThunderbird
Announcement ID: SUSE-SU-2025:4397-1
Release Date: 2025-12-15T11:26:47Z
Rating: important
References:
* bsc#1254551
Cross-References:
* CVE-2025-14321
* CVE-2025-14322
* CVE-2025-14323
* CVE-2025-14324
* CVE-2025-14325
* CVE-2025-14328
* CVE-2025-14329
* CVE-2025-14330
* CVE-2025-14331
* CVE-2025-14333
CVSS scores:
* CVE-2025-14321 ( SUSE ): 8.6
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N
* CVE-2025-14321 ( SUSE ): 8.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
* CVE-2025-14321 ( NVD ): 9.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
* CVE-2025-14321 ( NVD ): 9.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
* CVE-2025-14322 ( SUSE ): 8.6
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N
* CVE-2025-14322 ( SUSE ): 8.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
* CVE-2025-14322 ( NVD ): 8.0 CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:H/I:H/A:N
* CVE-2025-14323 ( SUSE ): 8.6
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N
* CVE-2025-14323 ( SUSE ): 8.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
* CVE-2025-14323 ( NVD ): 8.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
* CVE-2025-14324 ( SUSE ): 8.6
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N
* CVE-2025-14324 ( SUSE ): 8.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
* CVE-2025-14324 ( NVD ): 9.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
* CVE-2025-14324 ( NVD ): 9.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
* CVE-2025-14325 ( SUSE ): 8.6
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N
* CVE-2025-14325 ( SUSE ): 8.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
* CVE-2025-14325 ( NVD ): 7.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L
* CVE-2025-14328 ( SUSE ): 5.1
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N
* CVE-2025-14328 ( SUSE ): 6.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:L
* CVE-2025-14328 ( NVD ): 8.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
* CVE-2025-14329 ( SUSE ): 5.1
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N
* CVE-2025-14329 ( SUSE ): 6.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:L
* CVE-2025-14329 ( NVD ): 8.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
* CVE-2025-14330 ( SUSE ): 5.1
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N
* CVE-2025-14330 ( SUSE ): 6.1 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
* CVE-2025-14330 ( NVD ): 9.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
* CVE-2025-14330 ( NVD ): 9.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
* CVE-2025-14331 ( SUSE ): 5.1
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N
* CVE-2025-14331 ( SUSE ): 5.4 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:N
* CVE-2025-14331 ( NVD ): 6.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N
* CVE-2025-14331 ( NVD ): 6.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N
* CVE-2025-14333 ( SUSE ): 8.6
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N
* CVE-2025-14333 ( SUSE ): 8.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
* CVE-2025-14333 ( NVD ): 8.1 CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H
* CVE-2025-14333 ( NVD ): 8.1 CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H
Affected Products:
* openSUSE Leap 15.6
* SUSE Linux Enterprise Desktop 15 SP6
* SUSE Linux Enterprise Desktop 15 SP7
* SUSE Linux Enterprise Real Time 15 SP6
* SUSE Linux Enterprise Real Time 15 SP7
* SUSE Linux Enterprise Server 15 SP6
* SUSE Linux Enterprise Server 15 SP7
* SUSE Linux Enterprise Server for SAP Applications 15 SP6
* SUSE Linux Enterprise Server for SAP Applications 15 SP7
* SUSE Linux Enterprise Workstation Extension 15 SP6
* SUSE Linux Enterprise Workstation Extension 15 SP7
* SUSE Package Hub 15 15-SP6
* SUSE Package Hub 15 15-SP7
An update that solves 10 vulnerabilities can now be installed.
## Description:
This update for MozillaThunderbird fixes the following issues:
Update to Mozilla Thunderbird 140.6 (bsc#1254551).
* MFSA 2025-96
* CVE-2025-14321: use-after-free in the WebRTC: Signaling component.
* CVE-2025-14322: sandbox escape due to incorrect boundary conditions in the
Graphics: CanvasWebGL component.
* CVE-2025-14323: privilege escalation in the DOM: Notifications component.
* CVE-2025-14324: JIT miscompilation in the JavaScript Engine: JIT component.
* CVE-2025-14325: JIT miscompilation in the JavaScript Engine: JIT component.
* CVE-2025-14328: privilege escalation in the Netmonitor component.
* CVE-2025-14329: privilege escalation in the Netmonitor component.
* CVE-2025-14330: JIT miscompilation in the JavaScript Engine: JIT component.
* CVE-2025-14331: same-origin policy bypass in the Request Handling component.
* CVE-2025-14333: memory safety bugs.
## Patch Instructions:
To install this SUSE update use the SUSE recommended installation methods like
YaST online_update or "zypper patch".
Alternatively you can run the command listed for your product:
* openSUSE Leap 15.6
zypper in -t patch openSUSE-SLE-15.6-2025-4397=1
* SUSE Package Hub 15 15-SP6
zypper in -t patch SUSE-SLE-Module-Packagehub-Subpackages-15-SP6-2025-4397=1
* SUSE Package Hub 15 15-SP7
zypper in -t patch SUSE-SLE-Module-Packagehub-Subpackages-15-SP7-2025-4397=1
* SUSE Linux Enterprise Workstation Extension 15 SP6
zypper in -t patch SUSE-SLE-Product-WE-15-SP6-2025-4397=1
* SUSE Linux Enterprise Workstation Extension 15 SP7
zypper in -t patch SUSE-SLE-Product-WE-15-SP7-2025-4397=1
## Package List:
* openSUSE Leap 15.6 (aarch64 ppc64le s390x x86_64)
* MozillaThunderbird-debugsource-140.6.0-150200.8.248.1
* MozillaThunderbird-debuginfo-140.6.0-150200.8.248.1
* MozillaThunderbird-translations-other-140.6.0-150200.8.248.1
* MozillaThunderbird-140.6.0-150200.8.248.1
* MozillaThunderbird-translations-common-140.6.0-150200.8.248.1
* SUSE Package Hub 15 15-SP6 (aarch64 ppc64le s390x)
* MozillaThunderbird-debugsource-140.6.0-150200.8.248.1
* MozillaThunderbird-debuginfo-140.6.0-150200.8.248.1
* MozillaThunderbird-translations-other-140.6.0-150200.8.248.1
* MozillaThunderbird-140.6.0-150200.8.248.1
* MozillaThunderbird-translations-common-140.6.0-150200.8.248.1
* SUSE Package Hub 15 15-SP7 (aarch64 ppc64le s390x)
* MozillaThunderbird-debugsource-140.6.0-150200.8.248.1
* MozillaThunderbird-debuginfo-140.6.0-150200.8.248.1
* MozillaThunderbird-translations-other-140.6.0-150200.8.248.1
* MozillaThunderbird-140.6.0-150200.8.248.1
* MozillaThunderbird-translations-common-140.6.0-150200.8.248.1
* SUSE Linux Enterprise Workstation Extension 15 SP6 (x86_64)
* MozillaThunderbird-debugsource-140.6.0-150200.8.248.1
* MozillaThunderbird-debuginfo-140.6.0-150200.8.248.1
* MozillaThunderbird-translations-other-140.6.0-150200.8.248.1
* MozillaThunderbird-140.6.0-150200.8.248.1
* MozillaThunderbird-translations-common-140.6.0-150200.8.248.1
* SUSE Linux Enterprise Workstation Extension 15 SP7 (x86_64)
* MozillaThunderbird-debugsource-140.6.0-150200.8.248.1
* MozillaThunderbird-debuginfo-140.6.0-150200.8.248.1
* MozillaThunderbird-translations-other-140.6.0-150200.8.248.1
* MozillaThunderbird-140.6.0-150200.8.248.1
* MozillaThunderbird-translations-common-140.6.0-150200.8.248.1
## References:
* https://www.suse.com/security/cve/CVE-2025-14321.html
* https://www.suse.com/security/cve/CVE-2025-14322.html
* https://www.suse.com/security/cve/CVE-2025-14323.html
* https://www.suse.com/security/cve/CVE-2025-14324.html
* https://www.suse.com/security/cve/CVE-2025-14325.html
* https://www.suse.com/security/cve/CVE-2025-14328.html
* https://www.suse.com/security/cve/CVE-2025-14329.html
* https://www.suse.com/security/cve/CVE-2025-14330.html
* https://www.suse.com/security/cve/CVE-2025-14331.html
* https://www.suse.com/security/cve/CVE-2025-14333.html
* https://bugzilla.suse.com/show_bug.cgi?id=1254551
