openSUSE-SU-2025:15383-1: moderate: MozillaThunderbird-140.1.0-1.1 on GA media
openSUSE-SU-2025:15381-1: moderate: python311-starlette-0.47.2-1.1 on GA media
openSUSE-SU-2025:15385-1: moderate: perl-Authen-SASL-2.180.0-2.1 on GA media
openSUSE-SU-2025:15384-1: moderate: apache2-2.4.65-1.1 on GA media
openSUSE-SU-2025:15382-1: moderate: ruby3.4-rubygem-thor-1.4.0-1.1 on GA media
openSUSE-SU-2025:0229-1: important: Security update for gstreamer-plugins-bad
openSUSE-SU-2025:0251-1: important: Security update for pdns-recursor
openSUSE-SU-2025:0220-1: moderate: Security update for libetebase
openSUSE-SU-2025:0267-1: important: Security update for chromium
openSUSE-SU-2025:0187-1: important: Security update for chromium
openSUSE-SU-2025:0206-1: important: Security update for konsole
openSUSE-SU-2025:0221-1: moderate: Security update for libetebase
openSUSE-SU-2025:0271-1: important: Security update for opera
openSUSE-SU-2025:0198-1: moderate: Security update for python-Django
openSUSE-SU-2025:0202-1: important: Security update for chromium
openSUSE-SU-2025:0232-1: important: Security update for chromium
openSUSE-SU-2025:0175-1: important: Security update for chromium
openSUSE-SU-2025:0156-1: moderate: Security update for deepin-feature-enable
openSUSE-SU-2025:0241-1: moderate: Security update for spdlog
openSUSE-SU-2025:0186-1: moderate: Security update for libxmp
openSUSE-SU-2025:15383-1: moderate: MozillaThunderbird-140.1.0-1.1 on GA media
# MozillaThunderbird-140.1.0-1.1 on GA media
Announcement ID: openSUSE-SU-2025:15383-1
Rating: moderate
Cross-References:
* CVE-2025-6427
* CVE-2025-6432
* CVE-2025-6433
* CVE-2025-6434
* CVE-2025-6435
* CVE-2025-6436
* CVE-2025-8027
* CVE-2025-8028
* CVE-2025-8029
* CVE-2025-8030
* CVE-2025-8031
* CVE-2025-8032
* CVE-2025-8033
* CVE-2025-8034
* CVE-2025-8035
* CVE-2025-8036
* CVE-2025-8037
* CVE-2025-8038
* CVE-2025-8039
* CVE-2025-8040
CVSS scores:
* CVE-2025-6427 ( SUSE ): 6.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:L
* CVE-2025-6427 ( SUSE ): 5.3 CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N
* CVE-2025-6432 ( SUSE ): 4.2 CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:L/I:L/A:N
* CVE-2025-6432 ( SUSE ): 2.3 CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:P/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N
* CVE-2025-6433 ( SUSE ): 5.4 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:N
* CVE-2025-6433 ( SUSE ): 5.3 CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N
* CVE-2025-6434 ( SUSE ): 5.4 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:N
* CVE-2025-6434 ( SUSE ): 5.1 CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N
* CVE-2025-6435 ( SUSE ): 7.5 CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H
* CVE-2025-6435 ( SUSE ): 7.5 CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N
* CVE-2025-6436 ( SUSE ): 8.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
* CVE-2025-6436 ( SUSE ): 8.7 CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N
* CVE-2025-8027 ( SUSE ): 7.6 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:H/A:L
* CVE-2025-8027 ( SUSE ): 7 CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:L/VI:H/VA:L/SC:N/SI:N/SA:N
* CVE-2025-8028 ( SUSE ): 7.6 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:H/A:L
* CVE-2025-8028 ( SUSE ): 7 CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:L/VI:H/VA:L/SC:N/SI:N/SA:N
* CVE-2025-8029 ( SUSE ): 5 CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:L/I:L/A:L
* CVE-2025-8029 ( SUSE ): 2.1 CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:A/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N
* CVE-2025-8030 ( SUSE ): 5.3 CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:L
* CVE-2025-8030 ( SUSE ): 4.6 CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:A/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N
* CVE-2025-8031 ( SUSE ): 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
* CVE-2025-8031 ( SUSE ): 8.7 CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N
* CVE-2025-8032 ( SUSE ): 6.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:L
* CVE-2025-8032 ( SUSE ): 5.1 CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N
* CVE-2025-8033 ( SUSE ): 4.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:L
* CVE-2025-8033 ( SUSE ): 5.1 CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N
* CVE-2025-8034 ( SUSE ): 8.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
* CVE-2025-8034 ( SUSE ): 8.6 CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N
* CVE-2025-8035 ( SUSE ): 8.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
* CVE-2025-8035 ( SUSE ): 8.6 CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N
* CVE-2025-8036 ( SUSE ): 6.8 CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:N
* CVE-2025-8036 ( SUSE ): 7.4 CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:A/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N
* CVE-2025-8037 ( SUSE ): 5.4 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:N
* CVE-2025-8037 ( SUSE ): 5.1 CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N
* CVE-2025-8038 ( SUSE ): 5.4 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:N
* CVE-2025-8038 ( SUSE ): 5.1 CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N
* CVE-2025-8039 ( SUSE ): 4.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N
* CVE-2025-8039 ( SUSE ): 5.1 CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N
* CVE-2025-8040 ( SUSE ): 8.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
* CVE-2025-8040 ( SUSE ): 8.6 CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N
Affected Products:
* openSUSE Tumbleweed
An update that solves 20 vulnerabilities can now be installed.
## Description:
These are all security issues fixed in the MozillaThunderbird-140.1.0-1.1 package on the GA media of openSUSE Tumbleweed.
## Package List:
* openSUSE Tumbleweed:
* MozillaThunderbird 140.1.0-1.1
* MozillaThunderbird-openpgp-librnp 140.1.0-1.1
* MozillaThunderbird-translations-common 140.1.0-1.1
* MozillaThunderbird-translations-other 140.1.0-1.1
## References:
* https://www.suse.com/security/cve/CVE-2025-6427.html
* https://www.suse.com/security/cve/CVE-2025-6432.html
* https://www.suse.com/security/cve/CVE-2025-6433.html
* https://www.suse.com/security/cve/CVE-2025-6434.html
* https://www.suse.com/security/cve/CVE-2025-6435.html
* https://www.suse.com/security/cve/CVE-2025-6436.html
* https://www.suse.com/security/cve/CVE-2025-8027.html
* https://www.suse.com/security/cve/CVE-2025-8028.html
* https://www.suse.com/security/cve/CVE-2025-8029.html
* https://www.suse.com/security/cve/CVE-2025-8030.html
* https://www.suse.com/security/cve/CVE-2025-8031.html
* https://www.suse.com/security/cve/CVE-2025-8032.html
* https://www.suse.com/security/cve/CVE-2025-8033.html
* https://www.suse.com/security/cve/CVE-2025-8034.html
* https://www.suse.com/security/cve/CVE-2025-8035.html
* https://www.suse.com/security/cve/CVE-2025-8036.html
* https://www.suse.com/security/cve/CVE-2025-8037.html
* https://www.suse.com/security/cve/CVE-2025-8038.html
* https://www.suse.com/security/cve/CVE-2025-8039.html
* https://www.suse.com/security/cve/CVE-2025-8040.html
openSUSE-SU-2025:15381-1: moderate: python311-starlette-0.47.2-1.1 on GA media
# python311-starlette-0.47.2-1.1 on GA media
Announcement ID: openSUSE-SU-2025:15381-1
Rating: moderate
Cross-References:
* CVE-2025-54121
CVSS scores:
* CVE-2025-54121 ( SUSE ): 5.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L
* CVE-2025-54121 ( SUSE ): 6.9 CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N
Affected Products:
* openSUSE Tumbleweed
An update that solves one vulnerability can now be installed.
## Description:
These are all security issues fixed in the python311-starlette-0.47.2-1.1 package on the GA media of openSUSE Tumbleweed.
## Package List:
* openSUSE Tumbleweed:
* python311-starlette 0.47.2-1.1
* python312-starlette 0.47.2-1.1
* python313-starlette 0.47.2-1.1
## References:
* https://www.suse.com/security/cve/CVE-2025-54121.html
openSUSE-SU-2025:15385-1: moderate: perl-Authen-SASL-2.180.0-2.1 on GA media
# perl-Authen-SASL-2.180.0-2.1 on GA media
Announcement ID: openSUSE-SU-2025:15385-1
Rating: moderate
Cross-References:
* CVE-2025-40918
CVSS scores:
* CVE-2025-40918 ( SUSE ): 5.9 CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:N
* CVE-2025-40918 ( SUSE ): 8.2 CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N
Affected Products:
* openSUSE Tumbleweed
An update that solves one vulnerability can now be installed.
## Description:
These are all security issues fixed in the perl-Authen-SASL-2.180.0-2.1 package on the GA media of openSUSE Tumbleweed.
## Package List:
* openSUSE Tumbleweed:
* perl-Authen-SASL 2.180.0-2.1
## References:
* https://www.suse.com/security/cve/CVE-2025-40918.html
openSUSE-SU-2025:15384-1: moderate: apache2-2.4.65-1.1 on GA media
# apache2-2.4.65-1.1 on GA media
Announcement ID: openSUSE-SU-2025:15384-1
Rating: moderate
Cross-References:
* CVE-2025-54090
CVSS scores:
* CVE-2025-54090 ( SUSE ): 6.3 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L
* CVE-2025-54090 ( SUSE ): 5.3 CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N
Affected Products:
* openSUSE Tumbleweed
An update that solves one vulnerability can now be installed.
## Description:
These are all security issues fixed in the apache2-2.4.65-1.1 package on the GA media of openSUSE Tumbleweed.
## Package List:
* openSUSE Tumbleweed:
* apache2 2.4.65-1.1
## References:
* https://www.suse.com/security/cve/CVE-2025-54090.html
openSUSE-SU-2025:15382-1: moderate: ruby3.4-rubygem-thor-1.4.0-1.1 on GA media
# ruby3.4-rubygem-thor-1.4.0-1.1 on GA media
Announcement ID: openSUSE-SU-2025:15382-1
Rating: moderate
Cross-References:
* CVE-2025-54314
CVSS scores:
* CVE-2025-54314 ( SUSE ): 2.8 CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:C/C:N/I:L/A:N
* CVE-2025-54314 ( SUSE ): 2 CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:N/VC:N/VI:L/VA:N/SC:N/SI:L/SA:N
Affected Products:
* openSUSE Tumbleweed
An update that solves one vulnerability can now be installed.
## Description:
These are all security issues fixed in the ruby3.4-rubygem-thor-1.4.0-1.1 package on the GA media of openSUSE Tumbleweed.
## Package List:
* openSUSE Tumbleweed:
* ruby3.4-rubygem-thor 1.4.0-1.1
## References:
* https://www.suse.com/security/cve/CVE-2025-54314.html
openSUSE-SU-2025:0229-1: important: Security update for gstreamer-plugins-bad
openSUSE Security Update: Security update for gstreamer-plugins-bad
_______________________________
Announcement ID: openSUSE-SU-2025:0229-1
Rating: important
References: #1242809
Cross-References: CVE-2025-3887
CVSS scores:
CVE-2025-3887 (SUSE): 8.6 CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N
Affected Products:
openSUSE Leap 15.6
_______________________________
An update that fixes one vulnerability is now available.
Description:
This update for gstreamer-plugins-bad fixes the following issues:
- CVE-2025-3887: Fixed possible RCE vulnerability via buffer overflow in
H265 Codec Parsing (bsc#1242809).
Patch Instructions:
To install this openSUSE Security Update use the SUSE recommended installation methods
like YaST online_update or "zypper patch".
Alternatively you can run the command listed for your product:
- openSUSE Leap 15.6:
zypper in -t patch openSUSE-2025-229=1
Package List:
- openSUSE Leap 15.6 (aarch64 i586 ppc64le s390x x86_64):
gstreamer-plugins-bad-1.24.0-lp156.3.3.1
gstreamer-plugins-bad-chromaprint-1.24.0-lp156.3.3.1
gstreamer-plugins-bad-chromaprint-debuginfo-1.24.0-lp156.3.3.1
gstreamer-plugins-bad-debuginfo-1.24.0-lp156.3.3.1
gstreamer-plugins-bad-debugsource-1.24.0-lp156.3.3.1
gstreamer-plugins-bad-devel-1.24.0-lp156.3.3.1
gstreamer-plugins-bad-fluidsynth-1.24.0-lp156.3.3.1
gstreamer-plugins-bad-fluidsynth-debuginfo-1.24.0-lp156.3.3.1
gstreamer-transcoder-1.24.0-lp156.3.3.1
gstreamer-transcoder-debuginfo-1.24.0-lp156.3.3.1
gstreamer-transcoder-devel-1.24.0-lp156.3.3.1
libgstadaptivedemux-1_0-0-1.24.0-lp156.3.3.1
libgstadaptivedemux-1_0-0-debuginfo-1.24.0-lp156.3.3.1
libgstanalytics-1_0-0-1.24.0-lp156.3.3.1
libgstanalytics-1_0-0-debuginfo-1.24.0-lp156.3.3.1
libgstbadaudio-1_0-0-1.24.0-lp156.3.3.1
libgstbadaudio-1_0-0-debuginfo-1.24.0-lp156.3.3.1
libgstbasecamerabinsrc-1_0-0-1.24.0-lp156.3.3.1
libgstbasecamerabinsrc-1_0-0-debuginfo-1.24.0-lp156.3.3.1
libgstcodecparsers-1_0-0-1.24.0-lp156.3.3.1
libgstcodecparsers-1_0-0-debuginfo-1.24.0-lp156.3.3.1
libgstcodecs-1_0-0-1.24.0-lp156.3.3.1
libgstcodecs-1_0-0-debuginfo-1.24.0-lp156.3.3.1
libgstcuda-1_0-0-1.24.0-lp156.3.3.1
libgstcuda-1_0-0-debuginfo-1.24.0-lp156.3.3.1
libgstdxva-1_0-0-1.24.0-lp156.3.3.1
libgstdxva-1_0-0-debuginfo-1.24.0-lp156.3.3.1
libgstinsertbin-1_0-0-1.24.0-lp156.3.3.1
libgstinsertbin-1_0-0-debuginfo-1.24.0-lp156.3.3.1
libgstisoff-1_0-0-1.24.0-lp156.3.3.1
libgstisoff-1_0-0-debuginfo-1.24.0-lp156.3.3.1
libgstmpegts-1_0-0-1.24.0-lp156.3.3.1
libgstmpegts-1_0-0-debuginfo-1.24.0-lp156.3.3.1
libgstmse-1_0-0-1.24.0-lp156.3.3.1
libgstmse-1_0-0-debuginfo-1.24.0-lp156.3.3.1
libgstphotography-1_0-0-1.24.0-lp156.3.3.1
libgstphotography-1_0-0-debuginfo-1.24.0-lp156.3.3.1
libgstplay-1_0-0-1.24.0-lp156.3.3.1
libgstplay-1_0-0-debuginfo-1.24.0-lp156.3.3.1
libgstplayer-1_0-0-1.24.0-lp156.3.3.1
libgstplayer-1_0-0-debuginfo-1.24.0-lp156.3.3.1
libgstsctp-1_0-0-1.24.0-lp156.3.3.1
libgstsctp-1_0-0-debuginfo-1.24.0-lp156.3.3.1
libgsttranscoder-1_0-0-1.24.0-lp156.3.3.1
libgsttranscoder-1_0-0-debuginfo-1.24.0-lp156.3.3.1
libgsturidownloader-1_0-0-1.24.0-lp156.3.3.1
libgsturidownloader-1_0-0-debuginfo-1.24.0-lp156.3.3.1
libgstva-1_0-0-1.24.0-lp156.3.3.1
libgstva-1_0-0-debuginfo-1.24.0-lp156.3.3.1
libgstvulkan-1_0-0-1.24.0-lp156.3.3.1
libgstvulkan-1_0-0-debuginfo-1.24.0-lp156.3.3.1
libgstwayland-1_0-0-1.24.0-lp156.3.3.1
libgstwayland-1_0-0-debuginfo-1.24.0-lp156.3.3.1
libgstwebrtc-1_0-0-1.24.0-lp156.3.3.1
libgstwebrtc-1_0-0-debuginfo-1.24.0-lp156.3.3.1
libgstwebrtcnice-1_0-0-1.24.0-lp156.3.3.1
libgstwebrtcnice-1_0-0-debuginfo-1.24.0-lp156.3.3.1
typelib-1_0-CudaGst-1_0-1.24.0-lp156.3.3.1
typelib-1_0-GstAnalytics-1_0-1.24.0-lp156.3.3.1
typelib-1_0-GstBadAudio-1_0-1.24.0-lp156.3.3.1
typelib-1_0-GstCodecs-1_0-1.24.0-lp156.3.3.1
typelib-1_0-GstCuda-1_0-1.24.0-lp156.3.3.1
typelib-1_0-GstDxva-1_0-1.24.0-lp156.3.3.1
typelib-1_0-GstInsertBin-1_0-1.24.0-lp156.3.3.1
typelib-1_0-GstMpegts-1_0-1.24.0-lp156.3.3.1
typelib-1_0-GstMse-1_0-1.24.0-lp156.3.3.1
typelib-1_0-GstPlay-1_0-1.24.0-lp156.3.3.1
typelib-1_0-GstPlayer-1_0-1.24.0-lp156.3.3.1
typelib-1_0-GstTranscoder-1_0-1.24.0-lp156.3.3.1
typelib-1_0-GstVa-1_0-1.24.0-lp156.3.3.1
typelib-1_0-GstVulkan-1_0-1.24.0-lp156.3.3.1
typelib-1_0-GstVulkanWayland-1_0-1.24.0-lp156.3.3.1
typelib-1_0-GstVulkanXCB-1_0-1.24.0-lp156.3.3.1
typelib-1_0-GstWebRTC-1_0-1.24.0-lp156.3.3.1
- openSUSE Leap 15.6 (aarch64_ilp32):
gstreamer-plugins-bad-64bit-1.24.0-lp156.3.3.1
gstreamer-plugins-bad-64bit-debuginfo-1.24.0-lp156.3.3.1
gstreamer-plugins-bad-chromaprint-64bit-1.24.0-lp156.3.3.1
gstreamer-plugins-bad-chromaprint-64bit-debuginfo-1.24.0-lp156.3.3.1
gstreamer-plugins-bad-fluidsynth-64bit-1.24.0-lp156.3.3.1
gstreamer-plugins-bad-fluidsynth-64bit-debuginfo-1.24.0-lp156.3.3.1
libgstadaptivedemux-1_0-0-64bit-1.24.0-lp156.3.3.1
libgstadaptivedemux-1_0-0-64bit-debuginfo-1.24.0-lp156.3.3.1
libgstanalytics-1_0-0-64bit-1.24.0-lp156.3.3.1
libgstanalytics-1_0-0-64bit-debuginfo-1.24.0-lp156.3.3.1
libgstbadaudio-1_0-0-64bit-1.24.0-lp156.3.3.1
libgstbadaudio-1_0-0-64bit-debuginfo-1.24.0-lp156.3.3.1
libgstbasecamerabinsrc-1_0-0-64bit-1.24.0-lp156.3.3.1
libgstbasecamerabinsrc-1_0-0-64bit-debuginfo-1.24.0-lp156.3.3.1
libgstcodecparsers-1_0-0-64bit-1.24.0-lp156.3.3.1
libgstcodecparsers-1_0-0-64bit-debuginfo-1.24.0-lp156.3.3.1
libgstcodecs-1_0-0-64bit-1.24.0-lp156.3.3.1
libgstcodecs-1_0-0-64bit-debuginfo-1.24.0-lp156.3.3.1
libgstcuda-1_0-0-64bit-1.24.0-lp156.3.3.1
libgstcuda-1_0-0-64bit-debuginfo-1.24.0-lp156.3.3.1
libgstdxva-1_0-0-64bit-1.24.0-lp156.3.3.1
libgstdxva-1_0-0-64bit-debuginfo-1.24.0-lp156.3.3.1
libgstinsertbin-1_0-0-64bit-1.24.0-lp156.3.3.1
libgstinsertbin-1_0-0-64bit-debuginfo-1.24.0-lp156.3.3.1
libgstisoff-1_0-0-64bit-1.24.0-lp156.3.3.1
libgstisoff-1_0-0-64bit-debuginfo-1.24.0-lp156.3.3.1
libgstmpegts-1_0-0-64bit-1.24.0-lp156.3.3.1
libgstmpegts-1_0-0-64bit-debuginfo-1.24.0-lp156.3.3.1
libgstmse-1_0-0-64bit-1.24.0-lp156.3.3.1
libgstmse-1_0-0-64bit-debuginfo-1.24.0-lp156.3.3.1
libgstphotography-1_0-0-64bit-1.24.0-lp156.3.3.1
libgstphotography-1_0-0-64bit-debuginfo-1.24.0-lp156.3.3.1
libgstplay-1_0-0-64bit-1.24.0-lp156.3.3.1
libgstplay-1_0-0-64bit-debuginfo-1.24.0-lp156.3.3.1
libgstplayer-1_0-0-64bit-1.24.0-lp156.3.3.1
libgstplayer-1_0-0-64bit-debuginfo-1.24.0-lp156.3.3.1
libgstsctp-1_0-0-64bit-1.24.0-lp156.3.3.1
libgstsctp-1_0-0-64bit-debuginfo-1.24.0-lp156.3.3.1
libgsttranscoder-1_0-0-64bit-1.24.0-lp156.3.3.1
libgsttranscoder-1_0-0-64bit-debuginfo-1.24.0-lp156.3.3.1
libgsturidownloader-1_0-0-64bit-1.24.0-lp156.3.3.1
libgsturidownloader-1_0-0-64bit-debuginfo-1.24.0-lp156.3.3.1
libgstva-1_0-0-64bit-1.24.0-lp156.3.3.1
libgstva-1_0-0-64bit-debuginfo-1.24.0-lp156.3.3.1
libgstvulkan-1_0-0-64bit-1.24.0-lp156.3.3.1
libgstvulkan-1_0-0-64bit-debuginfo-1.24.0-lp156.3.3.1
libgstwayland-1_0-0-64bit-1.24.0-lp156.3.3.1
libgstwayland-1_0-0-64bit-debuginfo-1.24.0-lp156.3.3.1
libgstwebrtc-1_0-0-64bit-1.24.0-lp156.3.3.1
libgstwebrtc-1_0-0-64bit-debuginfo-1.24.0-lp156.3.3.1
libgstwebrtcnice-1_0-0-64bit-1.24.0-lp156.3.3.1
libgstwebrtcnice-1_0-0-64bit-debuginfo-1.24.0-lp156.3.3.1
- openSUSE Leap 15.6 (x86_64):
gstreamer-plugins-bad-32bit-1.24.0-lp156.3.3.1
gstreamer-plugins-bad-32bit-debuginfo-1.24.0-lp156.3.3.1
gstreamer-plugins-bad-chromaprint-32bit-1.24.0-lp156.3.3.1
gstreamer-plugins-bad-chromaprint-32bit-debuginfo-1.24.0-lp156.3.3.1
gstreamer-plugins-bad-fluidsynth-32bit-1.24.0-lp156.3.3.1
gstreamer-plugins-bad-fluidsynth-32bit-debuginfo-1.24.0-lp156.3.3.1
libgstadaptivedemux-1_0-0-32bit-1.24.0-lp156.3.3.1
libgstadaptivedemux-1_0-0-32bit-debuginfo-1.24.0-lp156.3.3.1
libgstanalytics-1_0-0-32bit-1.24.0-lp156.3.3.1
libgstanalytics-1_0-0-32bit-debuginfo-1.24.0-lp156.3.3.1
libgstbadaudio-1_0-0-32bit-1.24.0-lp156.3.3.1
libgstbadaudio-1_0-0-32bit-debuginfo-1.24.0-lp156.3.3.1
libgstbasecamerabinsrc-1_0-0-32bit-1.24.0-lp156.3.3.1
libgstbasecamerabinsrc-1_0-0-32bit-debuginfo-1.24.0-lp156.3.3.1
libgstcodecparsers-1_0-0-32bit-1.24.0-lp156.3.3.1
libgstcodecparsers-1_0-0-32bit-debuginfo-1.24.0-lp156.3.3.1
libgstcodecs-1_0-0-32bit-1.24.0-lp156.3.3.1
libgstcodecs-1_0-0-32bit-debuginfo-1.24.0-lp156.3.3.1
libgstcuda-1_0-0-32bit-1.24.0-lp156.3.3.1
libgstcuda-1_0-0-32bit-debuginfo-1.24.0-lp156.3.3.1
libgstdxva-1_0-0-32bit-1.24.0-lp156.3.3.1
libgstdxva-1_0-0-32bit-debuginfo-1.24.0-lp156.3.3.1
libgstinsertbin-1_0-0-32bit-1.24.0-lp156.3.3.1
libgstinsertbin-1_0-0-32bit-debuginfo-1.24.0-lp156.3.3.1
libgstisoff-1_0-0-32bit-1.24.0-lp156.3.3.1
libgstisoff-1_0-0-32bit-debuginfo-1.24.0-lp156.3.3.1
libgstmpegts-1_0-0-32bit-1.24.0-lp156.3.3.1
libgstmpegts-1_0-0-32bit-debuginfo-1.24.0-lp156.3.3.1
libgstmse-1_0-0-32bit-1.24.0-lp156.3.3.1
libgstmse-1_0-0-32bit-debuginfo-1.24.0-lp156.3.3.1
libgstphotography-1_0-0-32bit-1.24.0-lp156.3.3.1
libgstphotography-1_0-0-32bit-debuginfo-1.24.0-lp156.3.3.1
libgstplay-1_0-0-32bit-1.24.0-lp156.3.3.1
libgstplay-1_0-0-32bit-debuginfo-1.24.0-lp156.3.3.1
libgstplayer-1_0-0-32bit-1.24.0-lp156.3.3.1
libgstplayer-1_0-0-32bit-debuginfo-1.24.0-lp156.3.3.1
libgstsctp-1_0-0-32bit-1.24.0-lp156.3.3.1
libgstsctp-1_0-0-32bit-debuginfo-1.24.0-lp156.3.3.1
libgsttranscoder-1_0-0-32bit-1.24.0-lp156.3.3.1
libgsttranscoder-1_0-0-32bit-debuginfo-1.24.0-lp156.3.3.1
libgsturidownloader-1_0-0-32bit-1.24.0-lp156.3.3.1
libgsturidownloader-1_0-0-32bit-debuginfo-1.24.0-lp156.3.3.1
libgstva-1_0-0-32bit-1.24.0-lp156.3.3.1
libgstva-1_0-0-32bit-debuginfo-1.24.0-lp156.3.3.1
libgstvulkan-1_0-0-32bit-1.24.0-lp156.3.3.1
libgstvulkan-1_0-0-32bit-debuginfo-1.24.0-lp156.3.3.1
libgstwayland-1_0-0-32bit-1.24.0-lp156.3.3.1
libgstwayland-1_0-0-32bit-debuginfo-1.24.0-lp156.3.3.1
libgstwebrtc-1_0-0-32bit-1.24.0-lp156.3.3.1
libgstwebrtc-1_0-0-32bit-debuginfo-1.24.0-lp156.3.3.1
libgstwebrtcnice-1_0-0-32bit-1.24.0-lp156.3.3.1
libgstwebrtcnice-1_0-0-32bit-debuginfo-1.24.0-lp156.3.3.1
- openSUSE Leap 15.6 (noarch):
gstreamer-plugins-bad-lang-1.24.0-lp156.3.3.1
References:
https://www.suse.com/security/cve/CVE-2025-3887.html
https://bugzilla.suse.com/1242809
openSUSE-SU-2025:0251-1: important: Security update for pdns-recursor
openSUSE Security Update: Security update for pdns-recursor
_______________________________
Announcement ID: openSUSE-SU-2025:0251-1
Rating: important
References: #1231292
Cross-References: CVE-2024-25590
Affected Products:
openSUSE Backports SLE-15-SP6
_______________________________
An update that fixes one vulnerability is now available.
Description:
This update for pdns-recursor fixes the following issues:
- update to 5.1.3:
* Implement rfc6303 special zones (mostly v6 reverse mappings)
* Distinguish OS imposed limits from app imposed limits, specifically on
chains.
- update to 5.1.2 (boo#1231292 CVE-2024-25590)
https://doc.powerdns.com/recursor/changelog/5.1.html#change-5.1.2
- update to 5.1.1
https://doc.powerdns.com/recursor/changelog/5.1.html#change-5.1.1
https://doc.powerdns.com/recursor/changelog/5.0.html#change-5.0.8
- update to 5.0.5:
* Do not count RRSIGs using unsupported algorithms toward RRSIGs limit
* Correctly count NSEC3s considered when chasing the closest encloser.
* Let NetmaskGroup parse dont-throttle-netmasks, allowing negations.
* Fix types of two YAML settings (incoming.edns_padding_from,
incoming.proxy_protocol_from) that should be sequences of subnets
* Fix trace=fail regression and add regression test for it
Patch Instructions:
To install this openSUSE Security Update use the SUSE recommended installation methods
like YaST online_update or "zypper patch".
Alternatively you can run the command listed for your product:
- openSUSE Backports SLE-15-SP6:
zypper in -t patch openSUSE-2025-251=1
Package List:
- openSUSE Backports SLE-15-SP6 (aarch64 ppc64le x86_64):
pdns-recursor-5.1.3-bp156.2.3.1
References:
https://www.suse.com/security/cve/CVE-2024-25590.html
https://bugzilla.suse.com/1231292
openSUSE-SU-2025:0220-1: moderate: Security update for libetebase
openSUSE Security Update: Security update for libetebase
_______________________________
Announcement ID: openSUSE-SU-2025:0220-1
Rating: moderate
References: #1242638
Cross-References: CVE-2025-3416
CVSS scores:
CVE-2025-3416 (SUSE): 6.3 CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N
Affected Products:
openSUSE Backports SLE-15-SP7
_______________________________
An update that fixes one vulnerability is now available.
Description:
This update for libetebase fixes the following issues:
Update to version 0.5.8:
* CVE-2025-3416: Fixed rust openssl: Use-After-Free in Md::fetch and
Cipher::fetch in rust-openssl crate (bsc#1242638)
* Deps: run cargo update.
Patch Instructions:
To install this openSUSE Security Update use the SUSE recommended installation methods
like YaST online_update or "zypper patch".
Alternatively you can run the command listed for your product:
- openSUSE Backports SLE-15-SP7:
zypper in -t patch openSUSE-2025-220=1
Package List:
- openSUSE Backports SLE-15-SP7 (aarch64 i586 ppc64le s390x x86_64):
libetebase-devel-0.5.8-bp157.2.3.1
libetebase0-0.5.8-bp157.2.3.1
References:
https://www.suse.com/security/cve/CVE-2025-3416.html
https://bugzilla.suse.com/1242638
openSUSE-SU-2025:0267-1: important: Security update for chromium
openSUSE Security Update: Security update for chromium
_______________________________
Announcement ID: openSUSE-SU-2025:0267-1
Rating: important
References: #1246558
Cross-References: CVE-2025-6558 CVE-2025-7656 CVE-2025-7657
Affected Products:
openSUSE Backports SLE-15-SP7
_______________________________
An update that fixes three vulnerabilities is now available.
Description:
This update for chromium fixes the following issues:
- Chromium 138.0.7204.157 (boo#1246558):
* CVE-2025-7656: Integer overflow in V8
* CVE-2025-6558: Incorrect validation of untrusted input in ANGLE and GPU
* CVE-2025-7657: Use after free in WebRTC
- Chromium 138.0.7204.100:
* tweaks to the Google services settings page
Patch Instructions:
To install this openSUSE Security Update use the SUSE recommended installation methods
like YaST online_update or "zypper patch".
Alternatively you can run the command listed for your product:
- openSUSE Backports SLE-15-SP7:
zypper in -t patch openSUSE-2025-267=1
Package List:
- openSUSE Backports SLE-15-SP7 (aarch64 x86_64):
chromedriver-138.0.7204.157-bp157.2.22.1
chromium-138.0.7204.157-bp157.2.22.1
References:
https://www.suse.com/security/cve/CVE-2025-6558.html
https://www.suse.com/security/cve/CVE-2025-7656.html
https://www.suse.com/security/cve/CVE-2025-7657.html
https://bugzilla.suse.com/1246558
openSUSE-SU-2025:0187-1: important: Security update for chromium
openSUSE Security Update: Security update for chromium
_______________________________
Announcement ID: openSUSE-SU-2025:0187-1
Rating: important
References:
Affected Products:
openSUSE Backports SLE-15-SP6
_______________________________
An update that contains security fixes can now be installed.
Description:
Chromium was updated to 137.0.7151.68 (stable release 2025-06-03)
(boo#1244019)
* CVE-2025-5419: Out of bounds read and write in V8
* CVE-2025-5068: Use after free in Blink
- Google is aware that an exploit for CVE-2025-5419 exists in the wild.
Patch Instructions:
To install this openSUSE Security Update use the SUSE recommended installation methods
like YaST online_update or "zypper patch".
Alternatively you can run the command listed for your product:
- openSUSE Backports SLE-15-SP6:
zypper in -t patch openSUSE-2025-187=1
Package List:
- openSUSE Backports SLE-15-SP6 (aarch64 ppc64le x86_64):
chromedriver-137.0.7151.68-bp156.2.125.2
chromium-137.0.7151.68-bp156.2.125.2
References:
openSUSE-SU-2025:0206-1: important: Security update for konsole
openSUSE Security Update: Security update for konsole
_______________________________
Announcement ID: openSUSE-SU-2025:0206-1
Rating: important
References: #1244569
Cross-References: CVE-2025-49091
Affected Products:
openSUSE Backports SLE-15-SP6
openSUSE Backports SLE-15-SP7
_______________________________
An update that fixes one vulnerability is now available.
Description:
This update for konsole fixes the following issues:
- CVE-2025-49091: Fixed potential remote code execution in a certain
scenario with url open (boo#1244569)
Patch Instructions:
To install this openSUSE Security Update use the SUSE recommended installation methods
like YaST online_update or "zypper patch".
Alternatively you can run the command listed for your product:
- openSUSE Backports SLE-15-SP7:
zypper in -t patch openSUSE-2025-206=1
- openSUSE Backports SLE-15-SP6:
zypper in -t patch openSUSE-2025-206=1
Package List:
- openSUSE Backports SLE-15-SP7 (aarch64 ppc64le s390x x86_64):
konsole-23.08.5-bp157.2.3.1
konsole-debuginfo-23.08.5-bp157.2.3.1
konsole-debugsource-23.08.5-bp157.2.3.1
konsole-part-23.08.5-bp157.2.3.1
konsole-part-debuginfo-23.08.5-bp157.2.3.1
- openSUSE Backports SLE-15-SP7 (noarch):
konsole-part-lang-23.08.5-bp157.2.3.1
konsole-zsh-completion-23.08.5-bp157.2.3.1
- openSUSE Backports SLE-15-SP6 (aarch64 ppc64le s390x x86_64):
konsole-23.08.5-bp156.2.3.1
konsole-part-23.08.5-bp156.2.3.1
- openSUSE Backports SLE-15-SP6 (noarch):
konsole-part-lang-23.08.5-bp156.2.3.1
konsole-zsh-completion-23.08.5-bp156.2.3.1
References:
https://www.suse.com/security/cve/CVE-2025-49091.html
https://bugzilla.suse.com/1244569
openSUSE-SU-2025:0221-1: moderate: Security update for libetebase
openSUSE Security Update: Security update for libetebase
_______________________________
Announcement ID: openSUSE-SU-2025:0221-1
Rating: moderate
References: #1242638
Cross-References: CVE-2025-3416
CVSS scores:
CVE-2025-3416 (SUSE): 6.3 CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N
Affected Products:
openSUSE Backports SLE-15-SP6
_______________________________
An update that fixes one vulnerability is now available.
Description:
This update for libetebase fixes the following issues:
Update to version 0.5.8:
* CVE-2025-3416: Fixed rust openssl: Use-After-Free in Md::fetch and
Cipher::fetch in rust-openssl crate (bsc#1242638)
* Deps: run cargo update.
Patch Instructions:
To install this openSUSE Security Update use the SUSE recommended installation methods
like YaST online_update or "zypper patch".
Alternatively you can run the command listed for your product:
- openSUSE Backports SLE-15-SP6:
zypper in -t patch openSUSE-2025-221=1
Package List:
- openSUSE Backports SLE-15-SP6 (aarch64 i586 ppc64le s390x x86_64):
libetebase-devel-0.5.8-bp156.2.3.1
libetebase0-0.5.8-bp156.2.3.1
References:
https://www.suse.com/security/cve/CVE-2025-3416.html
https://bugzilla.suse.com/1242638
openSUSE-SU-2025:0271-1: important: Security update for opera
openSUSE Security Update: Security update for opera
_______________________________
Announcement ID: openSUSE-SU-2025:0271-1
Rating: important
References:
Cross-References: CVE-2025-6558
Affected Products:
openSUSE Leap 15.6:NonFree
_______________________________
An update that fixes one vulnerability is now available.
Description:
This update for opera fixes the following issues:
Update to 120.0.5543.93:
* DNA-122968 Crash at PasswordBubbleViewBase::ShowBubble
* DNA-122991 Add rate me button on opera://bookmarks page
* DNA-123029 [Color themes] Wallpapers section visibility not updated
correctly in Easy Setup
* DNA-123123 Crash when trying to save file using window.showSaveFilePicker
* DNA-123217 0-day fix for CVE-2025-6558
Patch Instructions:
To install this openSUSE Security Update use the SUSE recommended installation methods
like YaST online_update or "zypper patch".
Alternatively you can run the command listed for your product:
- openSUSE Leap 15.6:NonFree:
zypper in -t patch openSUSE-2025-271=1
Package List:
- openSUSE Leap 15.6:NonFree (x86_64):
opera-120.0.5543.93-lp156.2.41.1
References:
https://www.suse.com/security/cve/CVE-2025-6558.html
openSUSE-SU-2025:0198-1: moderate: Security update for python-Django
openSUSE Security Update: Security update for python-Django
_______________________________
Announcement ID: openSUSE-SU-2025:0198-1
Rating: moderate
References: #1244095
Cross-References: CVE-2025-48432
CVSS scores:
CVE-2025-48432 (SUSE): 6.9 CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:L/VA:N/SC:N/SI:H/SA:N
Affected Products:
openSUSE Backports SLE-15-SP6
_______________________________
An update that fixes one vulnerability is now available.
Description:
This update for python-Django fixes the following issues:
- CVE-2025-48432: Fixed potential log injection via unescaped request path
(boo#1244095).
Patch Instructions:
To install this openSUSE Security Update use the SUSE recommended installation methods
like YaST online_update or "zypper patch".
Alternatively you can run the command listed for your product:
- openSUSE Backports SLE-15-SP6:
zypper in -t patch openSUSE-2025-198=1
Package List:
- openSUSE Backports SLE-15-SP6 (noarch):
python3-Django-2.2.28-bp156.12.1
References:
https://www.suse.com/security/cve/CVE-2025-48432.html
https://bugzilla.suse.com/1244095
openSUSE-SU-2025:0202-1: important: Security update for chromium
openSUSE Security Update: Security update for chromium
_______________________________
Announcement ID: openSUSE-SU-2025:0202-1
Rating: important
References: #1244452
Cross-References: CVE-2025-5958 CVE-2025-5959
CVSS scores:
CVE-2025-5958 (SUSE): 8.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
CVE-2025-5959 (SUSE): 8.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Affected Products:
openSUSE Backports SLE-15-SP6
_______________________________
An update that fixes two vulnerabilities is now available.
Description:
This update for chromium fixes the following issues:
Chromium 137.0.7151.103 (boo#1244452)
- CVE-2025-5958: Use after free in Media
- CVE-2025-5959: Type Confusion in V8
Patch Instructions:
To install this openSUSE Security Update use the SUSE recommended installation methods
like YaST online_update or "zypper patch".
Alternatively you can run the command listed for your product:
- openSUSE Backports SLE-15-SP6:
zypper in -t patch openSUSE-2025-202=1
Package List:
- openSUSE Backports SLE-15-SP6 (aarch64 ppc64le x86_64):
chromedriver-137.0.7151.103-bp156.2.128.1
chromium-137.0.7151.103-bp156.2.128.1
References:
https://www.suse.com/security/cve/CVE-2025-5958.html
https://www.suse.com/security/cve/CVE-2025-5959.html
https://bugzilla.suse.com/1244452
openSUSE-SU-2025:0232-1: important: Security update for chromium
openSUSE Security Update: Security update for chromium
_______________________________
Announcement ID: openSUSE-SU-2025:0232-1
Rating: important
References: #1245332 #1245544
Cross-References: CVE-2025-6554 CVE-2025-6555 CVE-2025-6556
CVE-2025-6557
Affected Products:
openSUSE Backports SLE-15-SP7
_______________________________
An update that fixes four vulnerabilities is now available.
Description:
this update for chromium 138.0.7204.96 (stable released 2025-06-30)
(boo#1245544) fixes the following issues:
* cve-2025-6554: type confusion in v8
* CVE-2025-6555: Use after free in Animation
* CVE-2025-6556: Insufficient policy enforcement in Loader
* CVE-2025-6557: Insufficient data validation in DevTools
Patch Instructions:
To install this openSUSE Security Update use the SUSE recommended installation methods
like YaST online_update or "zypper patch".
Alternatively you can run the command listed for your product:
- openSUSE Backports SLE-15-SP7:
zypper in -t patch openSUSE-2025-232=1
Package List:
- openSUSE Backports SLE-15-SP7 (aarch64 i586 ppc64le s390x x86_64):
gh-2.74.2-bp157.2.3.1
gh-debuginfo-2.74.2-bp157.2.3.1
gn-0.20250520-bp157.2.3.1
gn-debuginfo-0.20250520-bp157.2.3.1
gn-debugsource-0.20250520-bp157.2.3.1
- openSUSE Backports SLE-15-SP7 (aarch64 x86_64):
chromedriver-138.0.7204.96-bp157.2.19.1
chromedriver-debuginfo-138.0.7204.96-bp157.2.19.1
chromium-138.0.7204.96-bp157.2.19.1
chromium-debuginfo-138.0.7204.96-bp157.2.19.1
- openSUSE Backports SLE-15-SP7 (noarch):
gh-bash-completion-2.74.2-bp157.2.3.1
gh-fish-completion-2.74.2-bp157.2.3.1
gh-zsh-completion-2.74.2-bp157.2.3.1
References:
https://www.suse.com/security/cve/CVE-2025-6554.html
https://www.suse.com/security/cve/CVE-2025-6555.html
https://www.suse.com/security/cve/CVE-2025-6556.html
https://www.suse.com/security/cve/CVE-2025-6557.html
https://bugzilla.suse.com/1245332
https://bugzilla.suse.com/1245544
openSUSE-SU-2025:0175-1: important: Security update for chromium
openSUSE Security Update: Security update for chromium
_______________________________
Announcement ID: openSUSE-SU-2025:0175-1
Rating: important
References: #1243741
Cross-References: CVE-2025-5063 CVE-2025-5064 CVE-2025-5065
CVE-2025-5066 CVE-2025-5067 CVE-2025-5280
CVE-2025-5281 CVE-2025-5283
Affected Products:
openSUSE Backports SLE-15-SP7
_______________________________
An update that fixes 8 vulnerabilities is now available.
Description:
This update for chromium fixes the following issues:
Update to version 137.0.7151.55 (stable release 2025-05-27) (boo#1243741)
- CVE-2025-5063: Use after free in Compositing
- CVE-2025-5280: Out of bounds write in V8
- CVE-2025-5064: Inappropriate implementation in Background Fetch API
- CVE-2025-5065: Inappropriate implementation in FileSystemAccess API
- CVE-2025-5066: Inappropriate implementation in Messages
- CVE-2025-5281: Inappropriate implementation in BFCache
- CVE-2025-5283: Use after free in libvpx
- CVE-2025-5067: Inappropriate implementation in Tab Strip
Patch Instructions:
To install this openSUSE Security Update use the SUSE recommended installation methods
like YaST online_update or "zypper patch".
Alternatively you can run the command listed for your product:
- openSUSE Backports SLE-15-SP7:
zypper in -t patch openSUSE-2025-175=1
Package List:
- openSUSE Backports SLE-15-SP7 (aarch64 x86_64):
chromedriver-137.0.7151.55-bp157.2.3.2
chromium-137.0.7151.55-bp157.2.3.2
References:
https://www.suse.com/security/cve/CVE-2025-5063.html
https://www.suse.com/security/cve/CVE-2025-5064.html
https://www.suse.com/security/cve/CVE-2025-5065.html
https://www.suse.com/security/cve/CVE-2025-5066.html
https://www.suse.com/security/cve/CVE-2025-5067.html
https://www.suse.com/security/cve/CVE-2025-5280.html
https://www.suse.com/security/cve/CVE-2025-5281.html
https://www.suse.com/security/cve/CVE-2025-5283.html
https://bugzilla.suse.com/1243741
openSUSE-SU-2025:0156-1: moderate: Security update for deepin-feature-enable
openSUSE Security Update: Security update for deepin-feature-enable
_______________________________
Announcement ID: openSUSE-SU-2025:0156-1
Rating: moderate
References:
Affected Products:
openSUSE Backports SLE-15-SP6
_______________________________
An update that contains security fixes can now be installed.
Description:
This update for deepin-feature-enable fixes the following:
Clear package contents (since it cannot be deleted from the already
published codestream) due to a packaging policy violation: See
https://lists.opensuse.org/archives/list/factory@lists.opensuse.org/thread/
AXUHM4Q4SMFZHEHZL6MEV4VOMO23QIZQ/
for more information.
Patch Instructions:
To install this openSUSE Security Update use the SUSE recommended installation methods
like YaST online_update or "zypper patch".
Alternatively you can run the command listed for your product:
- openSUSE Backports SLE-15-SP6:
zypper in -t patch openSUSE-2025-156=1
Package List:
- openSUSE Backports SLE-15-SP6 (aarch64 i586 ppc64le s390x x86_64):
deepin-feature-enable-1.1-bp156.4.3.1
References:
openSUSE-SU-2025:0241-1: moderate: Security update for spdlog
openSUSE Security Update: Security update for spdlog
_______________________________
Announcement ID: openSUSE-SU-2025:0241-1
Rating: moderate
References: #1244696
Cross-References: CVE-2025-6140
CVSS scores:
CVE-2025-6140 (SUSE): 4.8 CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N
Affected Products:
openSUSE Backports SLE-15-SP7
_______________________________
An update that fixes one vulnerability is now available.
Description:
This update for spdlog fixes the following issues:
- CVE-2025-6140: Fixed input manipulation that may lead to resource
consumption (boo#1244696)
Patch Instructions:
To install this openSUSE Security Update use the SUSE recommended installation methods
like YaST online_update or "zypper patch".
Alternatively you can run the command listed for your product:
- openSUSE Backports SLE-15-SP7:
zypper in -t patch openSUSE-2025-241=1
Package List:
- openSUSE Backports SLE-15-SP7 (aarch64 ppc64le s390x x86_64):
libspdlog1_11-1.11.0-bp157.2.3.1
spdlog-devel-1.11.0-bp157.2.3.1
- openSUSE Backports SLE-15-SP7 (aarch64_ilp32):
libspdlog1_11-64bit-1.11.0-bp157.2.3.1
References:
https://www.suse.com/security/cve/CVE-2025-6140.html
https://bugzilla.suse.com/1244696
openSUSE-SU-2025:0186-1: moderate: Security update for libxmp
openSUSE Security Update: Security update for libxmp
_______________________________
Announcement ID: openSUSE-SU-2025:0186-1
Rating: moderate
References:
Cross-References: CVE-2025-47256
CVSS scores:
CVE-2025-47256 (SUSE): 5.6 CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:C/C:L/I:L/A:L
Affected Products:
openSUSE Backports SLE-15-SP6
_______________________________
An update that fixes one vulnerability is now available.
Description:
This update for libxmp fixes the following issues:
- Update to release 4.6.3
* Fix crashes when xmp_set_position/xmp_set_row is used to set a
negative position/row.
* Fix hangs when xmp_prev_position is used on the first position
of a sequence which is preceded by an S3M/IT skip marker.
* Fix out-of-bounds reads when xmp_next_position is used at the end of a
256 position module.
* Fix hangs when seeking to an end-of-module marker caused by these
positions getting assigned a non-existent sequence.
* Fix stack underflow in Pha Packer loader (CVE-2025-47256).
* Fix broken conversion of ProRunner 2.0 pattern data.
* xmp_set_tempo_factor no longer alters frame time calculation for
xmp_get_frame_info. Frame time is now updated to account for the new
time factor after calling xmp_scan_module.
* Fix loading XMs with some types of harmless pattern truncation.
* Fix Digital Tracker 2.03 position jump effect for 4 channel DTMs.
* Fix pattern loop jump interactions with same row pattern jump/break:
Scream Tracker 3.03b+; Impulse Tracker 1.00 to 1.06 IT; Impulse
Tracker 2.00+ IT/S3M; Modplug Tracker 1.16 IT/XM/S3M; Imago Orpheus
IMF/S3M; Liquid Tracker LIQ/S3M; Poly Tracker; Digital Tracker >=2.02
DTM/MOD; Digital Tracker 2.03 (partial); Digital Tracker 1.9
(partial); Octalyser.
* Fix the pattern loop effect in Astroidea XMF loader.
- Update to release 4.6.2
* Fix MED effect 1Fxy (delay and retrigger). The new implementation
supports both delay and retrigger at the same time and repeats.
* Fix MED effect FF3 (revert change from 4.6.1). The buggy version of
this effect prior to OctaMED v5 is not currently supported.
* Fix MED3 and MED4 time factor and tempos 1-10.
* Fix MED4 effect 9xx (set speed).
* Add support for MED3 and MED4 song files.
* Handle IT modules with edit history but no MIDI configuration.
- Update to release 4.6.1
* Add stereo sample loading support for IT, S3M, XM, MED, LIQ, and
Digital Tracker (partial).
* Add sample preamplification to filter mixers for high sample rates.
* Add support for Ultra Tracker tempo commands.
* Load Ultra Tracker comments instead of skipping them.
* Implement support for Protracker instrument swapping.
* Implement retrigger effects for MED, OctaMED, and Liquid Tracker where
only one retrigger occurs. Liquid Tracker (new format) and Digital
Symphony now allow retrigger values larger than 15.
* Fix loop detection edge cases broken by S3M/IT marker scan bugs.
* Add fix for IT break to module scan.
* Fix restart position for >64k sample and Digital Tracker MODs.
* Reset Invert Loop position when a new instrument is encountered.
* MOD: make presence of invert loop override tracker ID guesses.
* M.K. modules within Amiga limits which use EFx invert loop are now
IDed as Protracker.
* Support for loading Digital Tracker 2.03 DTMs (MOD patterns).
* Support for loading Digital Tracker 1.9 DTMs (VERS/SV19).
* Allow patterns up to 396 rows in Digital Home Studio DTMs.
* Support for Digital Tracker 1.9 "MIDI note" transpose.
* Simulate Digital Tracker effects bugs where possible.
* A bunch of Liquid Tracker (.liq files) bug fixes
* Fix out-of-bounds reads in His Master's Noise Mupp instruments.
* Add compatibility for non-standard Pattern Loop implementations:
Scream Tracker 3.01b; Scream Tracker 3.03b+; Impulse Tracker 1.00;
Impulse Tracker 1.04 to 2.09; Modplug Tracker 1.16; Digital Tracker
>=2.04; Digital Tracker 1.9; Octalyser; Imago Orpheus; Liquid Tracker;
Poly Tracker. (MOD, FT2, and IT 2.10+ were already supported.)
* S3M: Detect PlayerPRO, Velvet Studio and old MPT versions.
Patch Instructions:
To install this openSUSE Security Update use the SUSE recommended installation methods
like YaST online_update or "zypper patch".
Alternatively you can run the command listed for your product:
- openSUSE Backports SLE-15-SP6:
zypper in -t patch openSUSE-2025-186=1
Package List:
- openSUSE Backports SLE-15-SP6 (aarch64 i586 ppc64le s390x x86_64):
libxmp-devel-4.6.3-bp156.2.3.1
libxmp4-4.6.3-bp156.2.3.1
References:
https://www.suse.com/security/cve/CVE-2025-47256.html
