SUSE-IU-2022:1196-1 SUSE Image security@suse.de SUSE Security Team SUSE Image SUSE-IU-2022:1196-1 Interim 1 1 2023-07-01T06:35:16Z current 2022-11-08T01:00:00Z 2022-11-08T01:00:00Z cve-database/bin/generate-cvrf-publiccloud.pl 2021-02-18T01:00:00Z Image update for SUSE-IU-2022:1196-1 / google/sles-12-sp4-byos-v20221108-x86-64 This image update for google/sles-12-sp4-byos-v20221108-x86-64 contains the following changes: Package bind was updated: - Security Fixes: * Previously, there was no limit to the number of database lookups performed while processing large delegations, which could be abused to severely impact the performance of named running as a recursive resolver. This has been fixed. [bsc#1203614, CVE-2022-2795, bind-CVE-2022-2795.patch] * A memory leak was fixed that could be externally triggered in the DNSSEC verification code for the ECDSA algorithm. [bsc#1203619, CVE-2022-38177, bind-CVE-2022-38177.patch] * Memory leaks were fixed that could be externally triggered in the DNSSEC verification code for the EdDSA algorithm. [bsc#1203620, CVE-2022-38178, bind-CVE-2022-38178.patch] Package ca-certificates-mozilla was updated: - Updated to 2.56 state of Mozilla SSL root CAs (bsc#1202868) Added: - Certainly Root E1 - Certainly Root R1 - DigiCert SMIME ECC P384 Root G5 - DigiCert SMIME RSA4096 Root G5 - DigiCert TLS ECC P384 Root G5 - DigiCert TLS RSA4096 Root G5 - E-Tugra Global Root CA ECC v3 - E-Tugra Global Root CA RSA v3 Removed: - Hellenic Academic and Research Institutions RootCA 2011 - Updated to 2.54 state of Mozilla SSL root CAs (bsc#1199079) Added: - Autoridad de Certificacion Firmaprofesional CIF A62634068 - D-TRUST BR Root CA 1 2020 - D-TRUST EV Root CA 1 2020 - GlobalSign ECC Root CA R4 - GTS Root R1 - GTS Root R2 - GTS Root R3 - GTS Root R4 - HiPKI Root CA - G1 - ISRG Root X2 - Telia Root CA v2 - vTrus ECC Root CA - vTrus Root CA Removed: - Cybertrust Global Root - DST Root CA X3 - DigiNotar PKIoverheid CA Organisatie - G2 - GlobalSign ECC Root CA R4 - GlobalSign Root CA R2 - GTS Root R1 - GTS Root R2 - GTS Root R3 - GTS Root R4 - updated to 2.50 state of the Mozilla NSS Certificate store (bsc#1188006) - Added CAs: + HARICA Client ECC Root CA 2021 + HARICA Client RSA Root CA 2021 + HARICA TLS ECC Root CA 2021 + HARICA TLS RSA Root CA 2021 + TunTrust Root CA - Updated to 2.46 state of the Mozilla NSS Certificate store (bsc#1181994) - Added new root CAs: - NAVER Global Root Certification Authority - Removed old root CA: - GeoTrust Global CA - GeoTrust Primary Certification Authority - GeoTrust Primary Certification Authority - G3 - GeoTrust Universal CA - GeoTrust Universal CA 2 - thawte Primary Root CA - thawte Primary Root CA - G2 - thawte Primary Root CA - G3 - VeriSign Class 3 Public Primary Certification Authority - G4 - VeriSign Class 3 Public Primary Certification Authority - G5 Package cifs-utils was updated: - CVE-2022-29869: mount.cifs: fix verbose messages on option parsing (bsc#1198976, CVE-2022-29869) * add cifs-utils-CVE-2022-29869.patch Package cloud-regionsrv-client was updated: - Follow up fix to 10.0.4 (bsc#1202706) - While the source code was updated to support SLE Micro the spec file was not updated for the new locations of the cache and the certs. Update the spec file to be consistent with the code implementation. - Update to version 10.0.5 (bsc#1201612) - Handle exception when trying to deregister a system form the server - Update to version 10.0.4 (bsc#1199668) - Store the update server certs in the /etc path instead of /usr to accomodate read only setup of SLE-Micro Package cronie was updated: - Allow to define the logger info and warning priority, fixes jsc#SLE-24577 * run-crons * sysconfig.cron Package curl was updated: - Security Fix: [bsc#1204383, CVE-2022-32221] * POST following PUT confusion * Add curl-CVE-2022-32221.patch - Security fix: [bsc#1202593, CVE-2022-35252] * Control codes in cookie denial of service * Add curl-CVE-2022-35252.patch - Security fix: [bsc#1200735, CVE-2022-32206] * HTTP compression denial of service * Add curl-CVE-2022-32206.patch - Security fix: [bsc#1200737, CVE-2022-32208] * FTP-KRB bad message verification * Add curl-CVE-2022-32208.patch - Securiy fix: [bsc#1199224, CVE-2022-27782] * TLS and SSH connection too eager reuse * Add curl-CVE-2022-27782.patch - Securiy fix: [bsc#1199223, CVE-2022-27781] * CERTINFO never-ending busy-loop * Add curl-CVE-2022-27781.patch Package dbus-1 was updated: - Fix a potential crash that could be triggered by an invalid signature. (CVE-2022-42010, bsc#1204111) * fix-upstream-CVE-2022-42010.patch - Fix an out of bounds read caused by a fixed length array (CVE-2022-42011, bsc#1204112) * fix-upstream-CVE-2022-42011.patch - A message in non-native endianness with out-of-band Unix file descriptors would cause a use-after-free and possible memory corruption CVE-2022-42012, bsc#1204113) * fix-upstream-CVE-2022-42012.patch - Disable asserts (bsc#1087072) - Refreshed patches * dbus-do-autolaunch.patch * increase-backlog.patch * fix-upstream-timeout-reset-2.patch * fix-upstream-CVE-2020-12049_2.patch Package dbus-1-x11 was updated: - Fix a potential crash that could be triggered by an invalid signature. (CVE-2022-42010, bsc#1204111) * fix-upstream-CVE-2022-42010.patch - Fix an out of bounds read caused by a fixed length array (CVE-2022-42011, bsc#1204112) * fix-upstream-CVE-2022-42011.patch - A message in non-native endianness with out-of-band Unix file descriptors would cause a use-after-free and possible memory corruption CVE-2022-42012, bsc#1204113) * fix-upstream-CVE-2022-42012.patch - Disable asserts (bsc#1087072) - Refreshed patches * dbus-do-autolaunch.patch * increase-backlog.patch * fix-upstream-timeout-reset-2.patch * fix-upstream-CVE-2020-12049_2.patch Package dracut was updated: - Fix vrev so package gets properly updated when comming from older products eg. SLE-12.3 Package expat was updated: - Security fix: * (CVE-2022-43680, bsc#1204708) use-after free caused by overeager destruction of a shared DTD in XML_ExternalEntityParserCreate in out-of-memory situations - Added patch expat-CVE-2022-43680.patch - Security fix: * (CVE-2022-40674, bsc#1203438) use-after-free in the doContent function in xmlparse.c - Added patch expat-CVE-2022-40674.patch Package google-guest-agent was updated: - Update to version 20220204.00 (bsc#1195437, bsc#1195438) * remove han from owners (#154) * Remove extra slash from metadata URL. (#151) - from version 20220104.00 * List IPv6 routes (#150) - from version 20211228.00 * add add or remove route integration test, utils (#147) - from version 20211214.00 * add malformed ssh key unit test (#142) Package google-guest-configs was updated: - Update to version 20220211.00 (bsc#1195437, bsc#1195438) * Set NVMe-PD IO timeout to 4294967295. (#32) Package google-guest-oslogin was updated: - Update to version 20220205.00 (bsc#1195437, bsc#1195438) * Fix build for EL9. (#82) - from version 20211213.00 * Reauth error (#81) - Rename Source0 field to Source - Update URL in Source field to point to upstream tarball Package google-osconfig-agent was updated: - Update to version 20220209.00 (bsc#1195437, bsc#1195438) * Update licences, remove deprecated centos-8 tests (#414) - Update to version 20220204.00 * Add DisableLocalLogging option (#413) - from version 20220107.00 * OS assignment example: Copy file from bucket Package gpg2 was updated: - Security fix [CVE-2022-34903, bsc#1201225] - Vulnerable to status injection - Added patch gnupg-CVE-2022-34903.patch Package grub2 was updated: - fs/xfs: add bigtime incompat feature support (bsc#1203387) * grub2-fs-xfs-Add-bigtime-incompat-feature-support.patch Package icu was updated: - Backport icu-CVE-2020-21913.patch: backport commit 727505bdd from upstream, use LocalMemory for cmd to prevent use after free (bsc#1193951 CVE-2020-21913). Package json-c was updated: - Added CVE-2020-12762.patch (bsc#1171479, CVE-2020-12762)- Added gcc7-fix.patch - Update to upstream release 0.12.1 - Removed upstream fixed json-c-0.12-unused_variable_size.patch - Added fix-set-but-not-used.patch - json-c 0.12 Fixes for security issues contained in this release have been previously patched into this package, but listed for completeness: * Address security issues: * CVE-2013-6371: hash collision denial of service * CVE-2013-6370: buffer overflow if size_t is larger than int - Further changes: * Avoid potential overflow in json_object_get_double * Eliminate the mc_abort() function and MC_ABORT macro. * Make the json_tokener_errors array local. It has been deprecated for a while, and json_tokener_error_desc() should be used instead. * change the floating point output format to %.17g so values with more than 6 digits show up in the output. * Remove the old libjson.so name compatibility support. The library is only created as libjson-c.so now and headers are only installed into the ${prefix}/json-c directory. * When supported by the linker, add the -Bsymbolic-functions flag. * Make strict mode more strict: * number must not start with 0 * no single-quote strings * no comments * trailing char not allowed * only allow lowercase literals * Added a json_object_new_double_s() convenience function to allow an exact string representation of a double to be specified when creating the object and use it in json_tokener_parse_ex() so a re-serialized object more exactly matches the input. * Add support NaN and Infinity - packaging changes: * json-c-hash-dos-and-overflow-random-seed-4e.patch is upstream * Move from json-c-lfs.patch which removed warning errors and autoconf call to json-c-0.12-unused_variable_size.patch from upstream which fixes the warning * except for SLE 11 where autoreconf call is required * add licence file to main package Package kernel-default was updated: - net: mana: Add rmb after checking owner bits (git-fixes).- commit cf3a26a - net: mana: Add the Linux MANA PF driver (bug#1201309, jsc#PED-529). - commit a1ccfcd - media: dvb-core: Fix UAF due to refcount races at releasing (CVE-2022-41218 bsc#1202960). - commit 231362a - media: em28xx: initialize refcount before kref_get (CVE-2022-3239 bsc#1203552). - commit 477c587 - x86/bugs: Reenable retbleed=off While for older kernels the return thunks are statically built in and cannot be dynamically patched out, retbleed=off should still be possible to do so that the mitigation can still be disabled on Intel who don't use the return thunks but IBRS. - Update patches.suse/x86-bugs-Add-AMD-retbleed-boot-parameter.patch (bsc#1199657 CVE-2022-29900 CVE-2022-29901 bsc#1203271). - Update patches.suse/x86-bugs-Enable-STIBP-for-JMP2RET.patch (bsc#1199657 CVE-2022-29900 CVE-2022-29901 bsc#1203271). - commit e2cf3a6 patches.suse/netfilter-nf_conntrack_irc-Fix-forged-IP-logic.patch. - commit a2eaeb6 - dm verity: set DM_TARGET_IMMUTABLE feature flag (CVE-2022-2503, bsc#1202677). - commit b644c0f - mm: Force TLB flush for PFNMAP mappings before unlink_file_vma() (CVE-2022-39188, bsc#1203107). - commit 7df6276 - netfilter: nf_conntrack_irc: Tighten matching on DCC message (CVE-2022-2663 bsc#1202097). - netfilter: nf_conntrack_irc: Fix forged IP logic (CVE-2022-2663 bsc#1202097). - commit 7253cd6 - Update patches.suse/x86-speculation-Add-RSB-VM-Exit-protections.patch. - Update patches.suse/x86-speculation-change-fill_return_buffer-to-work-with-objtool.patch. Add missing objtool annotations from upstream commits to fix bsc#1202396. - commit 04338d1 - objtool: Track original function across branches (bsc#1202396). - Refresh patches.suse/objtool-clean-instruction-state-before-each-function-validation.patch. - Refresh patches.suse/objtool-make-bp-scratch-register-warning-more-robust.patch. - commit c9a2efe - objtool: Don't use ignore flag for fake jumps (bsc#1202396). - Refresh patches.suse/objtool-add-is_static_jump-helper.patch. - commit d008d3c - objtool: Add --backtrace support (bsc#1202396). - Refresh patches.suse/objtool-clean-instruction-state-before-each-function-validation.patch. - commit 923b23e - objtool: Set insn-&gt;func for alternatives (bsc#1202396). - Refresh patches.suse/objtool-add-is_static_jump-helper.patch. - Refresh patches.suse/objtool-add-relocation-check-for-alternative-sections.patch. - commit 881bd07 - mm/rmap: Fix anon_vma-&gt;degree ambiguity leading to double-reuse (git-fixes, bsc#1203098). kABI: Fix kABI after &quot;/mm/rmap: Fix anon_vma-&gt;degree ambiguity leading to double-reuse&quot;/ (git-fixes, bsc#1203098). - commit 9b79372 - mm/rmap.c: don't reuse anon_vma if we just want a copy (git-fixes, bsc#1203098). - commit d3fffdb - objtool: Allow no-op CFI ops in alternatives (bsc#1202396). - commit 28f1746 - objtool: Add support for intra-function calls (bsc#1202396). - commit 93bc738 - objtool: Remove INSN_STACK (bsc#1202396). - commit 6e91884 - objtool: Make handle_insn_ops() unconditional (bsc#1202396). - commit 53607e4 - objtool: Rework allocating stack_ops on decode (bsc#1202396). - commit 63057c7 - objtool: Fix ORC vs alternatives (bsc#1202396). - commit 7738c2e - objtool: Uniquely identify alternative instruction groups (bsc#1202396). - commit 67086e3 - objtool: Remove check preventing branches within alternative (bsc#1202396). - commit 139d41d - objtool: Fix !CFI insn_state propagation (bsc#1202396). - commit 56f9880 - objtool: Rename struct cfi_state (bsc#1202396). - commit b354131 - objtool: Support multiple stack_op per instruction (bsc#1202396). - commit 48c54a4 - objtool: Support conditional retpolines (bsc#1202396). - commit 65f3866 - objtool: Convert insn type to enum (bsc#1202396). - commit b962b87 - objtool: Rename elf_open() to prevent conflict with libelf from elftoolchain (bsc#1202396). - commit 7bee2f3 - objtool: Use Elf_Scn typedef instead of assuming struct name (bsc#1202396). - commit 882e170 - rpm/kernel-source.spec.in: simplify finding of broken symlinks &quot;/find -xtype l&quot;/ will report them, so use that to make the search a bit faster (without using shell). - commit 13bbc51 - mkspec: eliminate @NOSOURCE@ macro This should be alsways used with @SOURCES@, just include the content there. - commit 403d89f - kernel-source: include the kernel signature file We assume that the upstream tarball is used for released kernels. Then we can also include the signature file and keyring in the kernel-source src.rpm. Because of mkspec code limitation exclude the signature and keyring from binary packages always - mkspec does not parse spec conditionals. - commit e76c4ca - kernel-binary: move @NOSOURCE@ to @SOURCES@ as in other packages - commit 4b42fb2 - dtb: Do not include sources in src.rpm - refer to kernel-source Same as other kernel binary packages there is no need to carry duplicate sources in dtb packages. - commit 1bd288c - objtool: Fix sibling call detection (bsc#1202396). - commit 07f4371 - objtool: Rewrite alt-&gt;skip_orig (bsc#1202396). - commit 5c9e381 - af_key: Do not call xfrm_probe_algs in parallel (bsc#1202898 CVE-2022-3028). - commit e68eb5b - Update patch reference for net rds fix (CVE-2022-21385 bsc#1202897) - commit c9ac9a2 - Update patch reference for net rds fix (CVE-2022-21385 bsc#1202897) - commit d995183 - cifs: fix error paths in cifs_tree_connect() (bsc#1177440). - commit cf9a74a - cifs: report error instead of invalid when revalidating a dentry fails (bsc#1177440). - commit a3f2294 - Backport causes crashes on all arches so revert the patch until I find the root cause - commit 83c44b2 - check sk_peer_cred pointer before put_cred() call - commit 78087f4 - tpm: fix reference counting for struct tpm_chip (CVE-2022-2977 bsc#1202672). - commit 743f12e - net: handle kABI change in struct sock (bsc#1194535 CVE-2021-4203). - commit c37013b - Drop the unused function after porting on 4.12 - commit a8cf8a3 - fuse: handle kABI change in struct sock (bsc#1194535 CVE-2021-4203). - commit cb0be42 - af_unix: fix races in sk_peer_pid and sk_peer_cred accesses (bsc#1194535 CVE-2021-4203). - commit cfbed38 - cifs: fix uninitialized pointer in error case in dfs_cache_get_tgt_share (bsc#1188944). - commit adb8007 - cifs: skip trailing separators of prefix paths (bsc#1188944). - commit bb8e115 - net_sched: cls_route: disallow handle of 0 (bsc#1202393). - net_sched: cls_route: remove from list when handle is 0 (CVE-2022-2588 bsc#1202096). - commit 05c19f7 - lightnvm: Remove lightnvm implemenation (bsc#1191881 bsc#1201420 ZDI-CAN-17325). - commit 30cd9be - ext4: make sure ext4_append() always allocates new block (bsc#1198577 CVE-2022-1184). - commit bc8c541 - ext4: check if directory block is within i_size (bsc#1198577 CVE-2022-1184). - commit b9efa04 - ext4: Fix check for block being out of directory size (bsc#1198577 CVE-2022-1184). - commit be40637 - rpm/kernel-binary.spec.in: move vdso to a separate package (bsc#1202385) We do the move only on 15.5+. - commit 9c7ade3 - rpm/kernel-binary.spec.in: simplify find for usrmerged The type test and print line are the same for both cases. The usrmerged case only ignores more, so refactor it to make it more obvious. - commit 583c9be - xfrm: xfrm_policy: fix a possible double xfrm_pols_put() in xfrm_bundle_lookup() (bsc#1201948 CVE-2022-36879). - commit 6a240fe - net/packet: fix slab-out-of-bounds access in packet_recvmsg() (CVE-2022-20368 bsc#1202346). - commit bcc8988 - media: v4l2-mem2mem: Apply DST_QUEUE_OFF_BASE on MMAP buffers across ioctls (bsc#1202347 CVE-2022-20369). - commit 0cf8c8f - x86/speculation: Add LFENCE to RSB fill sequence (bsc#1201726 CVE-2022-26373). - commit b4f64d8 - x86/speculation: Add RSB VM Exit protections (bsc#1201726 CVE-2022-26373). - commit 679800f - x86/speculation: Fill RSB on vmexit for IBRS (bsc#1201726 CVE-2022-26373). - commit 1a1bc6e - x86/speculation: Change FILL_RETURN_BUFFER to work with objtool (bsc#1201726 CVE-2022-26373). - commit 2e32661 - openvswitch: fix OOB access in reserve_sfa_size() (CVE-2022-2639 bsc#1202154). - commit 0d36370 - ipv4: avoid using shared IP generator for connected sockets (CVE-2020-36516 bsc#1196616). - ipv4: tcp: send zero IPID in SYNACK messages (CVE-2020-36516 bsc#1196616). - commit df5e606 - Fix parsing of rpm/macros.kernel-source on SLE12 (bsc#1201019). - commit 9816878 - cifs: use the expiry output of dns_query to schedule next resolution (bsc#1201926). - commit 9e72b3d - cifs: fix potential use-after-free in cifs_echo_request() (bsc#1201926). - commit 63d5cc7 - cifs: fix memory leak of smb3_fs_context_dup::server_hostname (bsc#1201926). - commit 696ce53 - cifs: To match file servers, make sure the server hostname matches (bsc#1201926). - commit 265867f - KVM: emulate: do not adjust size of fastop and setcc subroutines (bsc#1201930). - commit f527a88 - kvm/emulate: Fix SETcc emulation function offsets with SLS (bsc#1201930). - commit 30c285c - netfilter: nf_queue: do not allow packet truncation below transport header offset (bsc#1201940 CVE-2022-36946). - commit 06aa700 - cifs: set a minimum of 120s for next dns resolution (bsc#1201926). - commit 40bb64c - cifs: On cifs_reconnect, resolve the hostname again (bsc#1201926). - commit a466ab8 - cifs: Simplify reconnect code when dfs upcall is enabled (bsc#1201926). - commit 9d203d0 - kABI workaround for including mm.h in fs/sysfs/file.c (bsc#1200598 CVE-2022-20166). - commit fe1fe6b - mm: and drivers core: Convert hugetlb_report_node_meminfo to sysfs_emit (bsc#1200598 CVE-2022-20166). - commit 3d23964 - drivers core: Miscellaneous changes for sysfs_emit (bsc#1200598 CVE-2022-20166). - commit c8e2e5b - drivers core: Remove strcat uses around sysfs_emit and neaten (bsc#1200598 CVE-2022-20166). - commit 5cd9512 - drivers core: Use sysfs_emit and sysfs_emit_at for show(device * ...) functions (bsc#1200598 CVE-2022-20166). - commit 7554520 - x86/entry: Remove skip_r11rcx (bsc#1199657 CVE-2022-29900 - Refresh patches.suse/x86-entry-add-kernel-ibrs-implementation.patch. - commit b1071b3 - sysfs: Add sysfs_emit and sysfs_emit_at to format sysfs output (bsc#1200598 CVE-2022-20166). - commit c5a70d7 - x86/kexec: Disable RET on kexec (bsc#1199657 CVE-2022-29900 CVE-2022-29901). - commit 191d646 - commit 5c77536 - Refresh patches.suse/sched-topology-Improve-load-balancing-on-AMD-EPYC.patch. - commit 8397b0e - commit be4f5a3 - commit 95c7c85 - commit e0da5e4 - commit be2020e - commit f577c84 - commit 169cc5b - commit 25a7fe5 - commit bba8676 - commit 8791bc4 - commit 031a8ba - commit a8a6605 - Re-backport an upstream commit Backport fdf82a7856b3 (&quot;/x86/speculation: Protect against userspace-userspace spectreRSB&quot;/) properly in order to get rid of the now-unused is_skylake_era() symbol. - Refresh patches.suse/x86-intel-aggregate-big-core-client-naming.patch. - Refresh patches.suse/x86-intel-aggregate-big-core-mobile-naming.patch. - Refresh patches.suse/x86-speculation-add-eibrs-retpoline-options.patch. - Refresh patches.suse/x86-speculation-enable-cross-hyperthread-spectre-v2-stibp-mitigation.patch. - Refresh patches.suse/x86-speculation-reorder-the-spec_v2-code.patch. - commit ecf8345 - commit c458857 - commit ef21bc9 - commit c195904 - commit 38fd246 - commit 8246682 - x86/bugs: Add AMD retbleed= boot parameter (bsc#1199657 CVE-2022-29900 CVE-2022-29901). - Update config files. - commit 3a343bc - commit fd68631 - commit 407dacc - commit fe1b3c3 - commit acfc9e6 - commit 9f9f050 - commit 5ea2bf6 - commit ce6827b - commit 01c7d45 - commit 19e5ab2 - x86: Add straight-line-speculation mitigation (bsc#1201050 CVE-2021-26341). - Update config files. - Refresh patches.suse/x86-speculation-rename-retpoline_amd-to-retpoline_lfence.patch. - commit fe797ea - Sort in CPU vuln fixes And remove the homegrown IBRS functionality - will be replaced by the upstream one. - Refresh patches.suse/0001-x86-entry-64-compat-Fix-stack-switching-for-XEN-PV.patch. - Refresh patches.suse/KVM-x86-speculation-Disable-Fill-buffer-clear-within-guests.patch. - Refresh patches.suse/documentation-hw-vuln-update-spectre-doc.patch. - Refresh patches.suse/x86-bugs-Group-MDS-TAA-Processor-MMIO-Stale-Data-mitigations.patch. - Refresh patches.suse/x86-cpu-add-a-steppings-field-to-struct-x86_cpu_id.patch. - Refresh patches.suse/x86-cpu-add-table-argument-to-cpu_matches.patch. - Refresh patches.suse/x86-speculation-Add-a-common-function-for-MD_CLEAR-mitigation-update.patch. - Refresh patches.suse/x86-speculation-add-eibrs-retpoline-options.patch. - Refresh patches.suse/x86-speculation-add-special-register-buffer-data-sampling-srbds-mitigation.patch. - Refresh patches.suse/x86-speculation-add-srbds-vulnerability-and-mitigation-documentation.patch. - Refresh patches.suse/x86-speculation-include-unprivileged-ebpf-status-in-spectre-v2-mitigation-reporting.patch. - Refresh patches.suse/x86-speculation-mmio-Add-mitigation-for-Processor-MMIO-Stale-Data.patch. - Refresh patches.suse/x86-speculation-mmio-Add-sysfs-reporting-for-Processor-MMIO-Stale-Data.patch. - Refresh patches.suse/x86-speculation-mmio-Enable-CPU-Fill-buffer-clearing-on-idle.patch. - Refresh patches.suse/x86-speculation-mmio-Enumerate-Processor-MMIO-Stale-Data-bug.patch. - Refresh patches.suse/x86-speculation-mmio-Reuse-SRBDS-mitigation-for-SBDS.patch. - Refresh patches.suse/x86-speculation-rename-retpoline_amd-to-retpoline_lfence.patch. - Refresh patches.suse/x86-speculation-restore-speculation-related-msrs-during-s3-resume.patch. - Refresh patches.suse/x86-speculation-srbds-Update-SRBDS-mitigation-selection.patch. - Refresh patches.suse/x86-speculation-use-generic-retpoline-by-default-on-amd.patch. - Delete patches.suse/0001-x86-speculation-Add-basic-IBRS-support-infrastructur.patch. - Delete patches.suse/0002-x86-speculation-Add-inlines-to-control-Indirect-Bran.patch. - Delete patches.suse/0003-x86-idle-Control-Indirect-Branch-Speculation-in-idle.patch. - Delete patches.suse/0004-x86-enter-Create-macros-to-restrict-unrestrict-Indir.patch. - Delete patches.suse/0005-x86-enter-Use-IBRS-on-syscall-and-interrupts.patch. - Delete patches.suse/IBRS-forbid-shooting-in-foot.patch. - commit 44b7026 - CVE Mitigation for CVE-2022-29900 and CVE-2022-29901 (bsc#1199657 CVE-2022-29900 CVE-2022-29901). - commit 1ca4472 - x86: Prepare inline-asm for straight-line-speculation (bsc#1201050 CVE-2021-26341). - commit 6c064d3 - x86: Prepare asm files for straight-line-speculation (bsc#1201050 CVE-2021-26341). - commit b57e26a - x86/lib/atomic64_386_32: Rename things (bsc#1201050 CVE-2021-26341). - commit 010d7d0 - vt: vt_ioctl: fix race in VT_RESIZEX (bsc#1200910 CVE-2020-36558). - commit 3c76a1f - vt: vt_ioctl: fix VT_DISALLOCATE freeing in-use virtual console (bsc#1201429 CVE-2020-36557). - commit f15e18d - kernel-obs-build: include qemu_fw_cfg (boo#1201705) - commit e2263d4 - vt: drop old FONT ioctls (bsc#1201636 CVE-2021-33656). - commit 704434f - Refresh patches.suse/fbcon-Prevent-that-screen-size-is-smaller-than-font-.patch Fix the build error due to missing is_console_locked() - commit 39e2064 - fbmem: Check virtual screen sizes in fb_set_var() (CVE-2021-33655 bsc#1201635). - fbcon: Prevent that screen size is smaller than font size (CVE-2021-33655 bsc#1201635). - fbcon: Disallow setting font bigger than screen size (CVE-2021-33655 bsc#1201635). - commit c1a0922 - rpm/kernel-binary.spec.in: Require dwarves &gt;= 1.22 on SLE15-SP3 or newer Dwarves 1.22 or newer is required to build kernels with BTF information embedded in modules. - commit ee19e9d - pty: do tty_flip_buffer_push without port-&gt;lock in pty_write (bsc#1198829 CVE-2022-1462). - commit c0b9f34 - tty: use new tty_insert_flip_string_and_push_buffer() in pty_write() (bsc#1198829 CVE-2022-1462). - tty: extract tty_flip_buffer_commit() from tty_flip_buffer_push() (bsc#1198829 CVE-2022-1462). - commit 1b70eb4 - rpm/check-for-config-changes: ignore GCC12/CC_NO_ARRAY_BOUNDS Upstream commit f0be87c42cbd (gcc-12: disable '-Warray-bounds' universally for now) added two new compiler-dependent configs: * CC_NO_ARRAY_BOUNDS * GCC12_NO_ARRAY_BOUNDS Ignore them -- they are unset by dummy tools (they depend on gcc version == 12), but set as needed during real compilation. - commit a14607c - kernel-binary.spec: check s390x vmlinux location As a side effect of mainline commit edd4a8667355 (&quot;/s390/boot: get rid of startup archive&quot;/), vmlinux on s390x moved from &quot;/compressed&quot;/ subdirectory directly into arch/s390/boot. As the specfile is shared among branches, check both locations and let objcopy use one that exists. - commit cd15543 - Add missing recommends of kernel-install-tools to kernel-source-vanilla (bsc#1200442) - commit 93b1375 - kernel-binary.spec: Support radio selection for debuginfo. To disable debuginfo on 5.18 kernel a radio selection needs to be switched to a different selection. This requires disabling the currently active option and selecting NONE as debuginfo type. - commit 43b5dd3 - Add dtb-starfive - commit 85335b1 - rpm/kernel-obs-build.spec.in: Also depend on dracut-systemd (bsc#1195775) - commit 5d4e32c - pahole 1.22 required for full BTF features. also recommend pahole for kernel-source to make the kernel buildable with standard config - commit 364f54b - use jobs not processors in the constraints jobs is the number of vcpus available to the build, while processors is the total processor count of the machine the VM is running on. - commit a6e141d - rpm/constraints.in: skip SLOW_DISK workers for kernel-source - commit e84694f - rpm/*.spec.in: remove backtick usage - commit 87ca1fb - rpm/kernel-obs-build.spec.in: add systemd-initrd and terminfo dracut module (bsc#1195775) - commit d9a821b - rpm/kernel-obs-build.spec.in: use default dracut modules (bsc#1195926, bsc#1198484) Let's iron out the reduced initrd optimisation in Tumbleweed. Build full blown dracut initrd with systemd for SLE15 SP4. - commit ea76821 - Add dtb-microchip - commit c797107 - rpm/kernel-source.spec.in: temporary workaround for a build failure Upstream c6x architecture removal left a dangling link behind which triggers openSUSE post-build check in kernel-source, failing kernel-source build. A fix deleting the danglink link has been submitted but it did not make it into 5.12-rc1. Unfortunately we cannot add it as a patch as patch utility does not handle symlink removal. Add a temporary band-aid which deletes all dangling symlinks after unpacking the kernel source tarball. [jslaby] It's not that temporary as we are dragging this for quite some time in master. The reason is that this can happen any time again, so let's have this in packaging instead. - commit 52a1ad7 - powerpc/pci: Fix broken INTx configuration via OF (bsc#1172145 ltc#184630 bsc#1200770 ltc#198666). - powerpc/pci: Use of_irq_parse_and_map_pci() helper (bsc#1172145 ltc#184630 bsc#1200770 ltc#198666). - commit 0d4a2e4 - powerpc/pci: Remove LSI mappings on device teardown (bsc#1172145 ltc#184630 bsc#1200770 ltc#198666). - commit ab4cfbd Package keyutils was updated: - Apply default TTL to DNS records from getaddrinfo() (upstream): * dns-Apply-a-default-TTL-to-records-obtained-from-get.patch Package less was updated: - Fix Startup terminal initialization, bsc#1200738 * bsc1200738.patch Package libcroco was updated: - Add libcroco-CVE-2020-12825.patch: limit recursion in block and any productions (boo#1171685 CVE-2020-12825). Package libgcrypt was updated: - FIPS: Auto-initialize drbg if needed. [bsc#1200095] * Add a _gcry_drbg_init() to _gcry_drbg_randomize() and to _gcry_drbg_add_bytes() to fix a crash in FIPS mode. * Add libgcrypt-FIPS-Autoinitialize-drbg-if-needed.patch Package libksba was updated: - Security fix: [bsc#1204357, CVE-2022-3515] * Detect a possible overflow directly in the TLV parser. * Add libksba-CVE-2022-3515.patch Package libnl-1_1 was updated: - Fix elevation of privilege vulnerability (bsc#1020123, CVE-2017-0386). Add: libnl-1_1-fix-elevation-of-privilege-vulnerability.patch Package libnl3 was updated: - Fix elevation of privilege vulnerability (bsc#1020123, CVE-2017-0386). Add: libnl3-fix-elevation-of-privilege-vulnerability.patch Package libtasn1 was updated: - Add libtasn1-CVE-2021-46848.patch: Fixed off-by-one array size check that affects asn1_encode_simple_der (CVE-2021-46848, bsc#1204690). Package libtirpc was updated: - fix CVE-2021-46828: libtirpc: DoS vulnerability with lots of connections (bsc#1201680) - backport 0001-Fix-DoS-vulnerability-in-libtirpc.patch - exclude ipv6 addresses in client protocol 2 code (bsc#1200800) - update 0001-rpcb_clnt.c-config-to-try-protocolversion-2-first.patch Package libxml2 was updated: - Security fixes: * [CVE-2022-40303, bsc#1204366] Fix integer overflows with XML_PARSE_HUGE + Added patch libxml2-CVE-2022-40303.patch * [CVE-2022-40304, bsc#1204367] Fix dict corruption caused by entity reference cycles + Added patch libxml2-CVE-2022-40304.patch - Security fix: [bsc#1201978, CVE-2016-3709] * Cross-site scripting vulnerability after commit 960f0e2 * Add libxml2-CVE-2016-3709.patch Package logrotate was updated: - Security fix: (bsc#1192449) related to (bsc#1191281, CVE-2021-3864) * enforce stricter parsing to avoid CVE-2021-3864 * Added patch logrotate-enforce-stricter-parsing-and-extra-tests.patch - Fix &quot;/logrotate emits unintended warning: keyword size not properly separated, found 0x3d&quot;/ (bsc#1200278, bsc#1200802): * Added patch logrotate-dont_warn_on_size=_syntax.patch Package mozilla-nspr was updated: - update to version 4.34 * add an API that returns a preferred loopback IP on hosts that have two IP stacks available. - update to 4.33: * fixes to build system and export of private symbols Package mozilla-nss was updated: - update to NSS 3.79.1 (bsc#1202645) * bmo#1366464 - compare signature and signatureAlgorithm fields in legacy certificate verifier. * bmo#1771498 - Uninitialized value in cert_ComputeCertType. * bmo#1759794 - protect SFTKSlot needLogin with slotLock. * bmo#1760998 - avoid data race on primary password change. * bmo#1330271 - check for null template in sec_asn1{d,e}_push_state. - Update nss-fips-approved-crypto-non-ec.patch to unapprove the rest of the DSA ciphers, keeping signature verification only (bsc#1201298). - Update nss-fips-constructor-self-tests.patch to fix compiler warning. - Update nss-fips-constructor-self-tests.patch to add on-demand integrity tests through sftk_FIPSRepeatIntegrityCheck() (bsc#1198980). - Update nss-fips-approved-crypto-non-ec.patch to mark algorithms as approved/non-approved according to security policy (bsc#1191546, bsc#1201298). - Update nss-fips-approved-crypto-non-ec.patch to remove hard disabling of unapproved algorithms. This requirement is now fulfilled by the service level indicator (bsc#1200325). - Remove nss-fips-tls-allow-md5-prf.patch, since we no longer need the workaround in FIPS mode (bsc#1200325). - Remove nss-fips-tests-skip.patch. This is no longer needed since we removed the code to short-circuit broken hashes and moved to using the SLI. - Remove upstreamed patches: * nss-fips-version-indicators.patch * nss-fips-tests-pin-paypalee-cert.patch - update to NSS 3.79 - bmo#205717 - Use PK11_GetSlotInfo instead of raw C_GetSlotInfo calls. - bmo#1766907 - Update mercurial in clang-format docker image. - bmo#1454072 - Use of uninitialized pointer in lg_init after alloc fail. - bmo#1769295 - selfserv and tstclnt should use PR_GetPrefLoopbackAddrInfo. - bmo#1753315 - Add SECMOD_LockedModuleHasRemovableSlots. - bmo#1387919 - Fix secasn1d parsing of indefinite SEQUENCE inside indefinite GROUP. - bmo#1765753 - Added RFC8422 compliant TLS &lt;= 1.2 undefined/compressed ECPointFormat extension alerts. - bmo#1765753 - TLS 1.3 Server: Send protocol_version alert on unsupported ClientHello.legacy_version. - bmo#1764788 - Correct invalid record inner and outer content type alerts. - bmo#1757075 - NSS does not properly import or export pkcs12 files with large passwords and pkcs5v2 encoding. - bmo#1766978 - improve error handling after nssCKFWInstance_CreateObjectHandle. - bmo#1767590 - Initialize pointers passed to NSS_CMSDigestContext_FinishMultiple. - bmo#1769302 - NSS 3.79 should depend on NSPR 4.34 - update to NSS 3.78.1 * bmo#1767590 - Initialize pointers passed to NSS_CMSDigestContext_FinishMultiple - update to NSS 3.78 bmo#1755264 - Added TLS 1.3 zero-length inner plaintext checks and tests, zero-length record/fragment handling tests. bmo#1294978 - Reworked overlong record size checks and added TLS1.3 specific boundaries. bmo#1763120 - Add ECH Grease Support to tstclnt bmo#1765003 - Add a strict variant of moz::pkix::CheckCertHostname. bmo#1166338 - Change SSL_REUSE_SERVER_ECDHE_KEY default to false. bmo#1760813 - Make SEC_PKCS12EnableCipher succeed bmo#1762489 - Update zlib in NSS to 1.2.12. - update to NSS 3.77 * Bug 1762244 - resolve mpitests build failure on Windows. * bmo#1761779 - Fix link to TLS page on wireshark wiki * bmo#1754890 - Add two D-TRUST 2020 root certificates. * bmo#1751298 - Add Telia Root CA v2 root certificate. * bmo#1751305 - Remove expired explicitly distrusted certificates from certdata.txt. * bmo#1005084 - support specific RSA-PSS parameters in mozilla::pkix * bmo#1753535 - Remove obsolete stateEnd check in SEC_ASN1DecoderUpdate. * bmo#1756271 - Remove token member from NSSSlot struct. * bmo#1602379 - Provide secure variants of mpp_pprime and mpp_make_prime. * bmo#1757279 - Support UTF-8 library path in the module spec string. * bmo#1396616 - Update nssUTF8_Length to RFC 3629 and fix buffer overrun. * bmo#1760827 - Add a CI Target for gcc-11. * bmo#1760828 - Change to makefiles for gcc-4.8. * bmo#1741688 - Update googletest to 1.11.0 * bmo#1759525 - Add SetTls13GreaseEchSize to experimental API. * bmo#1755264 - TLS 1.3 Illegal legacy_version handling/alerts. * bmo#1755904 - Fix calculation of ECH HRR Transcript. * bmo#1758741 - Allow ld path to be set as environment variable. * bmo#1760653 - Ensure we don't read uninitialized memory in ssl gtests. * bmo#1758478 - Fix DataBuffer Move Assignment. * bmo#1552254 - internal_error alert on Certificate Request with sha1+ecdsa in TLS 1.3 * bmo#1755092 - rework signature verification in mozilla::pkix - Require nss-util in nss.pc and subsequently remove -lnssutil3 - update to NSS 3.76.1 NSS 3.76.1 * bmo#1756271 - Remove token member from NSSSlot struct. NSS 3.76 * bmo#1755555 - Hold tokensLock through nssToken_GetSlot calls in nssTrustDomain_GetActiveSlots. * bmo#1370866 - Check return value of PK11Slot_GetNSSToken. * bmo#1747957 - Use Wycheproof JSON for RSASSA-PSS * bmo#1679803 - Add SHA256 fingerprint comments to old certdata.txt entries. * bmo#1753505 - Avoid truncating files in nss-release-helper.py. * bmo#1751157 - Throw illegal_parameter alert for illegal extensions in handshake message. - Add nss-util pkgconfig and config files (copied from RH/Fedora) - update to NSS 3.75 * bmo#1749030 - This patch adds gcc-9 and gcc-10 to the CI. * bmo#1749794 - Make DottedOIDToCode.py compatible with python3. * bmo#1749475 - Avoid undefined shift in SSL_CERT_IS while fuzzing. * bmo#1748386 - Remove redundant key type check. * bmo#1749869 - Update ABI expectations to match ECH changes. * bmo#1748386 - Enable CKM_CHACHA20. * bmo#1747327 - check return on NSS_NoDB_Init and NSS_Shutdown. * bmo#1747310 - real move assignment operator. * bmo#1748245 - Run ECDSA test vectors from bltest as part of the CI tests. * bmo#1743302 - Add ECDSA test vectors to the bltest command line tool. * bmo#1747772 - Allow to build using clang's integrated assembler. * bmo#1321398 - Allow to override python for the build. * bmo#1747317 - test HKDF output rather than input. * bmo#1747316 - Use ASSERT macros to end failed tests early. * bmo#1747310 - move assignment operator for DataBuffer. * bmo#1712879 - Add test cases for ECH compression and unexpected extensions in SH. * bmo#1725938 - Update tests for ECH-13. * bmo#1725938 - Tidy up error handling. * bmo#1728281 - Add tests for ECH HRR Changes. * bmo#1728281 - Server only sends GREASE HRR extension if enabled by preference. * bmo#1725938 - Update generation of the Associated Data for ECH-13. * bmo#1712879 - When ECH is accepted, reject extensions which were only advertised in the Outer Client Hello. * bmo#1712879 - Allow for compressed, non-contiguous, extensions. * bmo#1712879 - Scramble the PSK extension in CHOuter. * bmo#1712647 - Split custom extension handling for ECH. * bmo#1728281 - Add ECH-13 HRR Handling. * bmo#1677181 - Client side ECH padding. * bmo#1725938 - Stricter ClientHelloInner Decompression. * bmo#1725938 - Remove ECH_inner extension, use new enum format. * bmo#1725938 - Update the version number for ECH-13 and adjust the ECHConfig size. - update to NSS 3.74 * bmo#966856 - mozilla::pkix: support SHA-2 hashes in CertIDs in OCSP responses * bmo#1553612 - Ensure clients offer consistent ciphersuites after HRR * bmo#1721426 - NSS does not properly restrict server keys based on policy * bmo#1733003 - Set nssckbi version number to 2.54 * bmo#1735407 - Replace Google Trust Services LLC (GTS) R4 root certificate * bmo#1735407 - Replace Google Trust Services LLC (GTS) R3 root certificate * bmo#1735407 - Replace Google Trust Services LLC (GTS) R2 root certificate * bmo#1735407 - Replace Google Trust Services LLC (GTS) R1 root certificate * bmo#1735407 - Replace GlobalSign ECC Root CA R4 * bmo#1733560 - Remove Expired Root Certificates - DST Root CA X3 * bmo#1740807 - Remove Expiring Cybertrust Global Root and GlobalSign root certificates * bmo#1741930 - Add renewed Autoridad de Certificacion Firmaprofesional CIF A62634068 root certificate * bmo#1740095 - Add iTrusChina ECC root certificate * bmo#1740095 - Add iTrusChina RSA root certificate * bmo#1738805 - Add ISRG Root X2 root certificate * bmo#1733012 - Add Chunghwa Telecom's HiPKI Root CA - G1 root certificate * bmo#1738028 - Avoid a clang 13 unused variable warning in opt build * bmo#1735028 - Check for missing signedData field * bmo#1737470 - Ensure DER encoded signatures are within size limits - enable key logging option (boo#1195040) - update to NSS 3.73.1: * Add SHA-2 support to mozilla::pkix's OSCP implementation - update to NSS 3.73 * bmo#1735028 - check for missing signedData field. * bmo#1737470 - Ensure DER encoded signatures are within size limits. * bmo#1729550 - NSS needs FiPS 140-3 version indicators. * bmo#1692132 - pkix_CacheCert_Lookup doesn't return cached certs * bmo#1738600 - sunset Coverity from NSS MFSA 2021-51 (bsc#1193170) * CVE-2021-43527 (bmo#1737470) Memory corruption via DER-encoded DSA and RSA-PSS signatures - update to NSS 3.72 * Remove newline at the end of coreconf.dep * bmo#1731911 - Fix nsinstall parallel failure. * bmo#1729930 - Increase KDF cache size to mitigate perf regression in about:logins - update to NSS 3.71 * bmo#1717716 - Set nssckbi version number to 2.52. * bmo#1667000 - Respect server requirements of tlsfuzzer/test-tls13-signature-algorithms.py * bmo#1373716 - Import of PKCS#12 files with Camellia encryption is not supported * bmo#1717707 - Add HARICA Client ECC Root CA 2021. * bmo#1717707 - Add HARICA Client RSA Root CA 2021. * bmo#1717707 - Add HARICA TLS ECC Root CA 2021. * bmo#1717707 - Add HARICA TLS RSA Root CA 2021. * bmo#1728394 - Add TunTrust Root CA certificate to NSS. - update to NSS 3.70 * bmo#1726022 - Update test case to verify fix. * bmo#1714579 - Explicitly disable downgrade check in TlsConnectStreamTls13.EchOuterWith12Max * bmo#1714579 - Explicitly disable downgrade check in TlsConnectTest.DisableFalseStartOnFallback * bmo#1681975 - Avoid using a lookup table in nssb64d. * bmo#1724629 - Use HW accelerated SHA2 on AArch64 Big Endian. * bmo#1714579 - Change default value of enableHelloDowngradeCheck to true. * bmo#1726022 - Cache additional PBE entries. * bmo#1709750 - Read HPKE vectors from official JSON. - Update to NSS 3.69.1 * bmo#1722613 (Backout) - Disable DTLS 1.0 and 1.1 by default * bmo#1720226 (Backout) - integrity checks in key4.db not happening on private components with AES_CBC NSS 3.69 * bmo#1722613 - Disable DTLS 1.0 and 1.1 by default (backed out again) * bmo#1720226 - integrity checks in key4.db not happening on private components with AES_CBC (backed out again) * bmo#1720235 - SSL handling of signature algorithms ignores environmental invalid algorithms. * bmo#1721476 - sqlite 3.34 changed it's open semantics, causing nss failures. (removed obsolete nss-btrfs-sqlite.patch) * bmo#1720230 - Gtest update changed the gtest reports, losing gtest details in all.sh reports. * bmo#1720228 - NSS incorrectly accepting 1536 bit DH primes in FIPS mode * bmo#1720232 - SQLite calls could timeout in starvation situations. * bmo#1720225 - Coverity/cpp scanner errors found in nss 3.67 * bmo#1709817 - Import the NSS documentation from MDN in nss/doc. * bmo#1720227 - NSS using a tempdir to measure sql performance not active - add nss-fips-stricter-dh.patch - updated existing patches with latest SLE - Update nss-fips-constructor-self-tests.patch to scan LD_LIBRARY_PATH for external libraries to be checksummed. - Run test suite at build time, and make it pass (bsc#1198486). Based on work by Marcus Meissner. - Add nss-fips-tests-skip.patch to skip algorithms that are hard disabled in FIPS mode. - Add nss-fips-tests-pin-paypalee-cert.patch to prevent expired PayPalEE cert from failing the tests. - Add nss-fips-tests-enable-fips.patch, which enables FIPS during test certificate creation and disables the library checksum validation during same. - Update nss-fips-constructor-self-tests.patch to allow checksumming to be disabled, but only if we entered FIPS mode due to NSS_FIPS being set, not if it came from /proc. - Add nss-fips-pbkdf-kat-compliance.patch (bsc#1192079). This makes the PBKDF known answer test compliant with NIST SP800-132. - Update FIPS validation string to version-release format. - Update nss-fips-approved-crypto-non-ec.patch to remove XCBC MAC from list of FIPS approved algorithms. - Enable NSS_ENABLE_FIPS_INDICATORS and set NSS_FIPS_MODULE_ID for build. - Update nss-fips-approved-crypto-non-ec.patch to claim 3DES unapproved in FIPS mode (bsc#1192080). - Update nss-fips-constructor-self-tests.patch to allow testing of unapproved algorithms (bsc#1192228). - Add nss-fips-version-indicators.patch (bmo#1729550, bsc#1192086). This adds FIPS version indicators. - Add nss-fips-180-3-csp-clearing.patch (bmo#1697303, bsc#1192087). Most of the relevant changes are already upstream since NSS 3.60. Package ncurses was updated: - Add patch ncurses-bnc1198627.patch * Fix bsc#1198627: CVE-2022-29458: ncurses: segfaulting OOB read Package openldap2 was updated: - bsc#1198341 - Prevent memory reuse which may lead to instability * 0226-Change-malloc-to-use-calloc-to-prevent-memory-reuse-.patch Package patterns-sles was updated: - downgrade requires of libopenssl-1_1-hmac to avoid explicit pulling in perhaps unwanted openssl 1.1.1 (bsc#1196307) Package python was updated: - Add patch CVE-2021-28861-double-slash-path.patch: * BaseHTTPServer: Fix an open redirection vulnerability in the HTTP server when an URI path starts with //. (bsc#1202624, CVE-2021-28861) Package python-M2Crypto was updated: - Add CVE-2020-25657-Bleichenbacher-attack.patch (CVE-2020-25657, bsc#1178829), which mitigates the Bleichenbacher timing attacks in the RSA decryption API. - Add python-M2Crypto.keyring to verify GPG signature of tarball. Package python-base was updated: - Add patch CVE-2021-28861-double-slash-path.patch: * BaseHTTPServer: Fix an open redirection vulnerability in the HTTP server when an URI path starts with //. (bsc#1202624, CVE-2021-28861) Package python3 was updated: - Add patch CVE-2021-28861-double-slash-path.patch: * http.server: Fix an open redirection vulnerability in the HTTP server when an URI path starts with //. (bsc#1202624, CVE-2021-28861) Package python3-base was updated: - Add patch CVE-2021-28861-double-slash-path.patch: * http.server: Fix an open redirection vulnerability in the HTTP server when an URI path starts with //. (bsc#1202624, CVE-2021-28861) Package python3-lxml was updated: - Add patch CVE-2020-27783.patch to fix CVE-2020-27783 mXSS due to the use of improper parser Fix bsc#1179534 Package rsync was updated: - Add support for --trust-sender parameter (patch by Jie Gong in bsc#1202970). (related to CVE-2022-29154, bsc#1201840) * Added patch rsync-CVE-2022-29154-trust-sender-1.patch * Added patch rsync-CVE-2022-29154-trust-sender-2.patch - Apply &quot;/rsync-CVE-2022-29154.patch&quot;/ to fix a security vulnerability in the do_server_recv() function. [bsc#1201840, CVE-2022-29154] - Run rsync's regression test suite as part of the build. Package salt was updated: - Fix state.apply in test mode with file state module on user/group checking (bsc#1202167) - Added: * fix-state.apply-in-test-mode-with-file-state-module-.patch - Make zypperpkg to retry if RPM lock is temporarily unavailable (bsc#1200596) - Added: * retry-if-rpm-lock-is-temporarily-unavailable-547-551.patch - Add support for gpgautoimport in zypperpkg module - Fix salt.states.file.managed() for follow_symlinks=True and test=True (bsc#1199372) - Added: * fix-salt.states.file.managed-for-follow_symlinks-tru.patch * add-support-for-gpgautoimport-to-refresh_db-in-the-z.patch - Add support for name, pkgs and diff_attr parameters to upgrade function for zypper and yum (bsc#1198489) - Added: * add-support-for-name-pkgs-and-diff_attr-parameters-t.patch - Unify logic on using multiple requisites and add onfail_all (bsc#1198738) - Normalize package names once with pkg.installed/removed using yum (bsc#1195895) - Added: * normalize-package-names-once-with-pkg.installed-remo.patch * unify-logic-on-using-multiple-requisites-and-add-onf.patch - Fix handling of a sign-in response by a syndic node (bsc#1199906) - Added: * fix-handling-of-a-sign-in-response-by-a-syndic-node-.patch - Remove redundant overrides causing confusing DEBUG logging (bsc#1189501) - Added: * remove-redundand-overrides-causing-confusing-debug-l.patch - Fix PAM auth issue due missing check for PAM_ACCT_MGM return value (CVE-2022-22967) (bsc#1200566) Package samba was updated: - CVE-2022-32742:SMB1 code does not correct verify SMB1write, SMB1write_and_close, SMB1write_and_unlock lengths; (bso#15085); (bsc#1201496). Package sqlite3 was updated: - update to 3.39.3: * Use a statement journal on DML statement affecting two or more database rows if the statement makes use of a SQL functions that might abort. * Use a mutex to protect the PRAGMA temp_store_directory and PRAGMA data_store_directory statements, even though they are decremented and documented as not being threadsafe. - update to 3.39.2: * Fix a performance regression in the query planner associated with rearranging the order of FROM clause terms in the presences of a LEFT JOIN. * Apply fixes for CVE-2022-35737, Chromium bugs 1343348 and 1345947, forum post 3607259d3c, and other minor problems discovered by internal testing. [boo#1201783] - update to 3.39.1: * Fix an incorrect result from a query that uses a view that contains a compound SELECT in which only one arm contains a RIGHT JOIN and where the view is not the first FROM clause term of the query that contains the view * Fix a long-standing problem with ALTER TABLE RENAME that can only arise if the sqlite3_limit(SQLITE_LIMIT_SQL_LENGTH) is set to a very small value. * Fix a long-standing problem in FTS3 that can only arise when compiled with the SQLITE_ENABLE_FTS3_PARENTHESIS compile-time option. * Fix the initial-prefix optimization for the REGEXP extension so that it works correctly even if the prefix contains characters that require a 3-byte UTF8 encoding. * Enhance the sqlite_stmt virtual table so that it buffers all of its output. - update to 3.39.0: * Add (long overdue) support for RIGHT and FULL OUTER JOIN * Add new binary comparison operators IS NOT DISTINCT FROM and IS DISTINCT FROM that are equivalent to IS and IS NOT, respective, for compatibility with PostgreSQL and SQL standards * Add a new return code (value &quot;/3&quot;/) from the sqlite3_vtab_distinct() interface that indicates a query that has both DISTINCT and ORDER BY clauses * Added the sqlite3_db_name() interface * The unix os interface resolves all symbolic links in database filenames to create a canonical name for the database before the file is opened * Defer materializing views until the materialization is actually needed, thus avoiding unnecessary work if the materialization turns out to never be used * The HAVING clause of a SELECT statement is now allowed on any aggregate query, even queries that do not have a GROUP BY clause * Many microoptimizations collectively reduce CPU cycles by about 2.3%. - drop sqlite-src-3380100-atof1.patch, included upstream - add sqlite-src-3390000-func7-pg-181.patch to skip float precision related test failures on 32 bit - update to 3.38.5: * Fix a blunder in the CLI of the 3.38.4 release - includes changes from 3.38.4: * fix a byte-code problem in the Bloom filter pull-down optimization added by release 3.38.0 in which an error in the byte code causes the byte code engine to enter an infinite loop when the pull-down optimization encounters a NULL key - update to 3.38.3: * Fix a case of the query planner be overly aggressive with optimizing automatic-index and Bloom-filter construction, using inappropriate ON clause terms to restrict the size of the automatic-index or Bloom filter, and resulting in missing rows in the output. * Other minor patches. See the timeline for details. - update to 3.38.2: * Fix a problem with the Bloom filter optimization that might cause an incorrect answer when doing a LEFT JOIN with a WHERE clause constraint that says that one of the columns on the right table of the LEFT JOIN is NULL. * Other minor patches. - Remove obsolete configure flags - Package the Tcl bindings here again so that we only ship one copy of SQLite (bsc#1195773). - update to 3.38.1: * Fix problems with the new Bloom filter optimization that might cause some obscure queries to get an incorrect answer. * Fix the localtime modifier of the date and time functions so that it preserves fractional seconds. * Fix the sqlite_offset SQL function so that it works correctly even in corner cases such as when the argument is a virtual column or the column of a view. * Fix row value IN operator constraints on virtual tables so that they work correctly even if the virtual table implementation relies on bytecode to filter rows that do not satisfy the constraint. * Other minor fixes to assert() statements, test cases, and documentation. See the source code timeline for details. - add upstream patch to run atof1 tests only on x86_64 sqlite-src-3380100-atof1.patch - update to 3.38.0 * Add the -&gt; and -&gt;&gt; operators for easier processing of JSON * The JSON functions are now built-ins * Enhancements to date and time functions * Rename the printf() SQL function to format() for better compatibility, with alias for backwards compatibility. * Add the sqlite3_error_offset() interface for helping localize an SQL error to a specific character in the input SQL text * Enhance the interface to virtual tables * CLI columnar output modes are enhanced to correctly handle tabs and newlines embedded in text, and add options like &quot;/--wrap N&quot;/, &quot;/--wordwrap on&quot;/, and &quot;/--quote&quot;/ to the columnar output modes. * Query planner enhancements using a Bloom filter to speed up large analytic queries, and a balanced merge tree to evaluate UNION or UNION ALL compound SELECT statements that have an ORDER BY clause. * The ALTER TABLE statement is changed to silently ignores entries in the sqlite_schema table that do not parse when PRAGMA writable_schema=ON - update to 3.37.2: * Fix a bug introduced in version 3.35.0 (2021-03-12) that can cause database corruption if a SAVEPOINT is rolled back while in PRAGMA temp_store=MEMORY mode, and other changes are made, and then the outer transaction commits * Fix a long-standing problem with ON DELETE CASCADE and ON UPDATE CASCADE in which a cache of the bytecode used to implement the cascading change was not being reset following a local DDL change - update to 3.37.1: * Fix a bug introduced by the UPSERT enhancements of version 3.35.0 that can cause incorrect byte-code to be generated for some obscure but valid SQL, possibly resulting in a NULL- pointer dereference. * Fix an OOB read that can occur in FTS5 when reading corrupt database files. * Improved robustness of the --safe option in the CLI. * Other minor fixes to assert() statements and test cases. - SQLite3 3.37.0: * STRICT tables provide a prescriptive style of data type management, for developers who prefer that kind of thing. * When adding columns that contain a CHECK constraint or a generated column containing a NOT NULL constraint, the ALTER TABLE ADD COLUMN now checks new constraints against preexisting rows in the database and will only proceed if no constraints are violated. * Added the PRAGMA table_list statement. * Add the .connection command, allowing the CLI to keep multiple database connections open at the same time. * Add the --safe command-line option that disables dot-commands and SQL statements that might cause side-effects that extend beyond the single database file named on the command-line. * CLI: Performance improvements when reading SQL statements that span many lines. * Added the sqlite3_autovacuum_pages() interface. * The sqlite3_deserialize() does not and has never worked for the TEMP database. That limitation is now noted in the documentation. * The query planner now omits ORDER BY clauses on subqueries and views if removing those clauses does not change the semantics of the query. * The generate_series table-valued function extension is modified so that the first parameter (&quot;/START&quot;/) is now required. This is done as a way to demonstrate how to write table-valued functions with required parameters. The legacy behavior is available using the -DZERO_ARGUMENT_GENERATE_SERIES compile-time option. * Added new sqlite3_changes64() and sqlite3_total_changes64() interfaces. * Added the SQLITE_OPEN_EXRESCODE flag option to sqlite3_open_v2(). * Use less memory to hold the database schema. * bsc#1189802, CVE-2021-36690: Fix an issue with the SQLite Expert extension when a column has no collating sequence. Package sudo was updated: - Modified sudo-sudoers.patch * bsc#1177578 * Removed redundant and confusing 'secure_path' settings in sudo-sudoers file. Package systemd-presets-branding-SLE was updated: Package telnet was updated: - Fix CVE-2022-39028, NULL pointer dereference in telnetd (CVE-2022-39028, bsc#1203759) CVE-2022-39028.patch Package timezone was updated: - Update to reflect new Chile DST change, bsc#1202310 * bsc1202310.patch Package unzip was updated: - Fix CVE-2022-0530, SIGSEGV during the conversion of an utf-8 string to a local string (CVE-2022-0530, bsc#1196177) * CVE-2022-0530.patch - Fix CVE-2022-0529, Heap out-of-bound writes and reads during conversion of wide string to local string (CVE-2022-0529, bsc#1196180) * CVE-2022-0529.patch Package update-alternatives was updated: Package util-linux was updated: - mesg: use only stat() to get the current terminal status (bsc#1200842, util-linux-mesg-use-only-stat.patch). - agetty: Resolve tty name even if stdin is specified (bsc#1197178, util-linux-agetty-resolve-tty-if-stdin-is-specified.patch). - libmount: When moving a mount point, update all sub mount entries in utab (bsc#1198731, util-linux-libmount-moving-mount-point-sub-mounts.patch, util-linux-libmount-fix-and-improve-utab-on-ms_move.patch). Package util-linux-systemd was updated: - mesg: use only stat() to get the current terminal status (bsc#1200842, util-linux-mesg-use-only-stat.patch). - agetty: Resolve tty name even if stdin is specified (bsc#1197178, util-linux-agetty-resolve-tty-if-stdin-is-specified.patch). - libmount: When moving a mount point, update all sub mount entries in utab (bsc#1198731, util-linux-libmount-moving-mount-point-sub-mounts.patch, util-linux-libmount-fix-and-improve-utab-on-ms_move.patch). Package which was updated: - https urls, added signature (but did not find the public key)- Use %license instead of %doc [bsc#1082318] - Move installinfo scriptlet to preun so it won't fail - Cleanup spec file with spec-cleaner - Correct usage of info scriplets - GNU which 2.21: * Upgraded code from bash to version 4.3 (now uses eaccess). * Fixed a bug related to getgroups / sysconfig that caused Which not to see more than 64 groups for a single user * Build system maintenance. - Update project and source URL to GNU project Package xfsprogs was updated: - mkfs: validate extent size hint parameters (bsc#1138247) - add xfsprogs-xfs-move-inode-extent-size-hint-validation-to-libxfs.patch - add xfsprogs-xfs_repair-use-libxfs-extsize-cowextsize-validation-.patch - add xfsprogs-mkfs-validate-extent-size-hint-parameters.patch - xfs_repair: Fix root inode's parent when it's bogus for sf directory (bsc#1138227) - add xfsprogs-xfs_repair-Fix-root-inode-s-parent-when-it-s-bogus-f.patch Package zlib was updated: - Fix heap-based buffer over-read or buffer overflow in inflate via large gzip header extra field (bsc#1202175, CVE-2022-37434, CVE-2022-37434-extra-header-1.patch, CVE-2022-37434-extra-header-2.patch). The CVRF data is provided by SUSE under the Creative Commons License 4.0 with Attribution (CC-BY-4.0). https://publiccloudimagechangeinfo.suse.com/google/sles-12-sp4-byos-v20221108-x86-64/ Public Cloud Image Info https://www.suse.com/support/security/rating/ SUSE Security Ratings Public Cloud Image google/sles-12-sp4-byos-v20221108-x86-64 bind-utils-9.11.22-3.43.1 ca-certificates-mozilla-2.56-12.37.1 cifs-utils-6.9-13.23.1 cloud-regionsrv-client-10.0.5-52.80.1 cloud-regionsrv-client-plugin-gce-1.0.0-52.80.1 cron-4.2-59.19.1 cronie-1.4.11-59.19.1 curl-7.60.0-4.43.1 dbus-1-1.8.22-29.24.1 dbus-1-x11-1.8.22-29.24.1 dracut-44.2-118.1 expat-2.1.0-21.28.1 google-guest-agent-20220204.0-1.26.1 google-guest-configs-20220211.0-1.17.2 google-guest-oslogin-20220205.0-1.26.2 google-osconfig-agent-20220209.0-1.17.1 gpg2-2.0.24-9.11.1 grub2-2.02-146.1 grub2-i386-pc-2.02-146.1 grub2-x86_64-efi-2.02-146.1 kernel-default-4.12.14-95.111.1 keyutils-1.5.9-5.3.1 less-458-7.9.1 libbind9-161-9.11.22-3.43.1 libblkid1-2.29.2-9.20.1 libcroco-0_6-3-0.6.11-12.6.45 libcurl4-7.60.0-4.43.1 libdbus-1-3-1.8.22-29.24.1 libdcerpc-binding0-4.6.16+git.324.6bba9ddab76-3.73.1 libdcerpc0-4.6.16+git.324.6bba9ddab76-3.73.1 libdns1110-9.11.22-3.43.1 libexpat1-2.1.0-21.28.1 libfdisk1-2.29.2-9.20.1 libgcrypt20-1.6.1-16.83.1 libicu52_1-52.1-8.13.1 libicu52_1-data-52.1-8.13.1 libirs161-9.11.22-3.43.1 libisc1107-9.11.22-3.43.1 libisccc161-9.11.22-3.43.1 libisccfg163-9.11.22-3.43.1 libjson-c2-0.12.1-4.3.1 libkeyutils1-1.5.9-5.3.1 libksba8-1.3.0-24.3.1 libldap-2_4-2-2.4.41-22.13.1 liblwres161-9.11.22-3.43.1 libmount1-2.29.2-9.20.1 libncurses5-5.9-78.1 libncurses6-5.9-78.1 libndr-krb5pac0-4.6.16+git.324.6bba9ddab76-3.73.1 libndr-nbt0-4.6.16+git.324.6bba9ddab76-3.73.1 libndr-standard0-4.6.16+git.324.6bba9ddab76-3.73.1 libndr0-4.6.16+git.324.6bba9ddab76-3.73.1 libnetapi0-4.6.16+git.324.6bba9ddab76-3.73.1 libnl-config-3.2.23-4.7.1 libnl1-1.1.4-6.3.1 libnl3-200-3.2.23-4.7.1 libpython2_7-1_0-2.7.18-33.14.1 libpython3_4m1_0-3.4.10-25.96.1 libsamba-credentials0-4.6.16+git.324.6bba9ddab76-3.73.1 libsamba-errors0-4.6.16+git.324.6bba9ddab76-3.73.1 libsamba-hostconfig0-4.6.16+git.324.6bba9ddab76-3.73.1 libsamba-passdb0-4.6.16+git.324.6bba9ddab76-3.73.1 libsamba-util0-4.6.16+git.324.6bba9ddab76-3.73.1 libsamdb0-4.6.16+git.324.6bba9ddab76-3.73.1 libsmartcols1-2.29.2-9.20.1 libsmbconf0-4.6.16+git.324.6bba9ddab76-3.73.1 libsmbldap0-4.6.16+git.324.6bba9ddab76-3.73.1 libsqlite3-0-3.39.3-9.23.1 libtasn1-4.9-3.13.1 libtasn1-6-4.9-3.13.1 libtevent-util0-4.6.16+git.324.6bba9ddab76-3.73.1 libtirpc-netconfig-1.0.1-17.24.1 libtirpc3-1.0.1-17.24.1 libuuid1-2.29.2-9.20.1 libwbclient0-4.6.16+git.324.6bba9ddab76-3.73.1 libxml2-2-2.9.4-46.59.2 libz1-1.2.11-3.9.1 logrotate-3.11.0-2.20.1 mozilla-nspr-4.34-19.21.1 mozilla-nss-certs-3.79.1-58.78.1 ncurses-utils-5.9-78.1 openldap2-client-2.4.41-22.13.1 patterns-sles-Minimal-12-7.6.1 python-2.7.18-33.14.2 python-base-2.7.18-33.14.1 python-bind-9.11.22-3.43.1 python-xml-2.7.18-33.14.1 python2-salt-3000-71.2 python3-3.4.10-25.96.1 python3-M2Crypto-0.29.0-23.8.1 python3-base-3.4.10-25.96.1 python3-cssselect-0.8-3.7.1 python3-lxml-3.6.1-3.3.1 rsync-3.1.0-13.24.1 salt-3000-71.2 salt-minion-3000-71.2 samba-libs-4.6.16+git.324.6bba9ddab76-3.73.1 sudo-1.8.20p2-3.26.1 systemd-presets-branding-SLE-12.2-10.6.1 telnet-1.2-167.10.1 terminfo-5.9-78.1 terminfo-base-5.9-78.1 timezone-2022a-74.61.1 unzip-6.0-33.16.1 update-alternatives-1.18.4-16.3.5 util-linux-2.29.2-9.20.1 util-linux-systemd-2.29.2-9.20.1 which-2.21-1.8.1 xfsprogs-4.15.0-3.18.1 bind-utils-9.11.22-3.43.1 as a component of Public Cloud Image google/sles-12-sp4-byos-v20221108-x86-64 ca-certificates-mozilla-2.56-12.37.1 as a component of Public Cloud Image google/sles-12-sp4-byos-v20221108-x86-64 cifs-utils-6.9-13.23.1 as a component of Public Cloud Image google/sles-12-sp4-byos-v20221108-x86-64 cloud-regionsrv-client-10.0.5-52.80.1 as a component of Public Cloud Image google/sles-12-sp4-byos-v20221108-x86-64 cloud-regionsrv-client-plugin-gce-1.0.0-52.80.1 as a component of Public Cloud Image google/sles-12-sp4-byos-v20221108-x86-64 cron-4.2-59.19.1 as a component of Public Cloud Image google/sles-12-sp4-byos-v20221108-x86-64 cronie-1.4.11-59.19.1 as a component of Public Cloud Image google/sles-12-sp4-byos-v20221108-x86-64 curl-7.60.0-4.43.1 as a component of Public Cloud Image google/sles-12-sp4-byos-v20221108-x86-64 dbus-1-1.8.22-29.24.1 as a component of Public Cloud Image google/sles-12-sp4-byos-v20221108-x86-64 dbus-1-x11-1.8.22-29.24.1 as a component of Public Cloud Image google/sles-12-sp4-byos-v20221108-x86-64 dracut-44.2-118.1 as a component of Public Cloud Image google/sles-12-sp4-byos-v20221108-x86-64 expat-2.1.0-21.28.1 as a component of Public Cloud Image google/sles-12-sp4-byos-v20221108-x86-64 google-guest-agent-20220204.0-1.26.1 as a component of Public Cloud Image google/sles-12-sp4-byos-v20221108-x86-64 google-guest-configs-20220211.0-1.17.2 as a component of Public Cloud Image google/sles-12-sp4-byos-v20221108-x86-64 google-guest-oslogin-20220205.0-1.26.2 as a component of Public Cloud Image google/sles-12-sp4-byos-v20221108-x86-64 google-osconfig-agent-20220209.0-1.17.1 as a component of Public Cloud Image google/sles-12-sp4-byos-v20221108-x86-64 gpg2-2.0.24-9.11.1 as a component of Public Cloud Image google/sles-12-sp4-byos-v20221108-x86-64 grub2-2.02-146.1 as a component of Public Cloud Image google/sles-12-sp4-byos-v20221108-x86-64 grub2-i386-pc-2.02-146.1 as a component of Public Cloud Image google/sles-12-sp4-byos-v20221108-x86-64 grub2-x86_64-efi-2.02-146.1 as a component of Public Cloud Image google/sles-12-sp4-byos-v20221108-x86-64 kernel-default-4.12.14-95.111.1 as a component of Public Cloud Image google/sles-12-sp4-byos-v20221108-x86-64 keyutils-1.5.9-5.3.1 as a component of Public Cloud Image google/sles-12-sp4-byos-v20221108-x86-64 less-458-7.9.1 as a component of Public Cloud Image google/sles-12-sp4-byos-v20221108-x86-64 libbind9-161-9.11.22-3.43.1 as a component of Public Cloud Image google/sles-12-sp4-byos-v20221108-x86-64 libblkid1-2.29.2-9.20.1 as a component of Public Cloud Image google/sles-12-sp4-byos-v20221108-x86-64 libcroco-0_6-3-0.6.11-12.6.45 as a component of Public Cloud Image google/sles-12-sp4-byos-v20221108-x86-64 libcurl4-7.60.0-4.43.1 as a component of Public Cloud Image google/sles-12-sp4-byos-v20221108-x86-64 libdbus-1-3-1.8.22-29.24.1 as a component of Public Cloud Image google/sles-12-sp4-byos-v20221108-x86-64 libdcerpc-binding0-4.6.16+git.324.6bba9ddab76-3.73.1 as a component of Public Cloud Image google/sles-12-sp4-byos-v20221108-x86-64 libdcerpc0-4.6.16+git.324.6bba9ddab76-3.73.1 as a component of Public Cloud Image google/sles-12-sp4-byos-v20221108-x86-64 libdns1110-9.11.22-3.43.1 as a component of Public Cloud Image google/sles-12-sp4-byos-v20221108-x86-64 libexpat1-2.1.0-21.28.1 as a component of Public Cloud Image google/sles-12-sp4-byos-v20221108-x86-64 libfdisk1-2.29.2-9.20.1 as a component of Public Cloud Image google/sles-12-sp4-byos-v20221108-x86-64 libgcrypt20-1.6.1-16.83.1 as a component of Public Cloud Image google/sles-12-sp4-byos-v20221108-x86-64 libicu52_1-52.1-8.13.1 as a component of Public Cloud Image google/sles-12-sp4-byos-v20221108-x86-64 libicu52_1-data-52.1-8.13.1 as a component of Public Cloud Image google/sles-12-sp4-byos-v20221108-x86-64 libirs161-9.11.22-3.43.1 as a component of Public Cloud Image google/sles-12-sp4-byos-v20221108-x86-64 libisc1107-9.11.22-3.43.1 as a component of Public Cloud Image google/sles-12-sp4-byos-v20221108-x86-64 libisccc161-9.11.22-3.43.1 as a component of Public Cloud Image google/sles-12-sp4-byos-v20221108-x86-64 libisccfg163-9.11.22-3.43.1 as a component of Public Cloud Image google/sles-12-sp4-byos-v20221108-x86-64 libjson-c2-0.12.1-4.3.1 as a component of Public Cloud Image google/sles-12-sp4-byos-v20221108-x86-64 libkeyutils1-1.5.9-5.3.1 as a component of Public Cloud Image google/sles-12-sp4-byos-v20221108-x86-64 libksba8-1.3.0-24.3.1 as a component of Public Cloud Image google/sles-12-sp4-byos-v20221108-x86-64 libldap-2_4-2-2.4.41-22.13.1 as a component of Public Cloud Image google/sles-12-sp4-byos-v20221108-x86-64 liblwres161-9.11.22-3.43.1 as a component of Public Cloud Image google/sles-12-sp4-byos-v20221108-x86-64 libmount1-2.29.2-9.20.1 as a component of Public Cloud Image google/sles-12-sp4-byos-v20221108-x86-64 libncurses5-5.9-78.1 as a component of Public Cloud Image google/sles-12-sp4-byos-v20221108-x86-64 libncurses6-5.9-78.1 as a component of Public Cloud Image google/sles-12-sp4-byos-v20221108-x86-64 libndr-krb5pac0-4.6.16+git.324.6bba9ddab76-3.73.1 as a component of Public Cloud Image google/sles-12-sp4-byos-v20221108-x86-64 libndr-nbt0-4.6.16+git.324.6bba9ddab76-3.73.1 as a component of Public Cloud Image google/sles-12-sp4-byos-v20221108-x86-64 libndr-standard0-4.6.16+git.324.6bba9ddab76-3.73.1 as a component of Public Cloud Image google/sles-12-sp4-byos-v20221108-x86-64 libndr0-4.6.16+git.324.6bba9ddab76-3.73.1 as a component of Public Cloud Image google/sles-12-sp4-byos-v20221108-x86-64 libnetapi0-4.6.16+git.324.6bba9ddab76-3.73.1 as a component of Public Cloud Image google/sles-12-sp4-byos-v20221108-x86-64 libnl-config-3.2.23-4.7.1 as a component of Public Cloud Image google/sles-12-sp4-byos-v20221108-x86-64 libnl1-1.1.4-6.3.1 as a component of Public Cloud Image google/sles-12-sp4-byos-v20221108-x86-64 libnl3-200-3.2.23-4.7.1 as a component of Public Cloud Image google/sles-12-sp4-byos-v20221108-x86-64 libpython2_7-1_0-2.7.18-33.14.1 as a component of Public Cloud Image google/sles-12-sp4-byos-v20221108-x86-64 libpython3_4m1_0-3.4.10-25.96.1 as a component of Public Cloud Image google/sles-12-sp4-byos-v20221108-x86-64 libsamba-credentials0-4.6.16+git.324.6bba9ddab76-3.73.1 as a component of Public Cloud Image google/sles-12-sp4-byos-v20221108-x86-64 libsamba-errors0-4.6.16+git.324.6bba9ddab76-3.73.1 as a component of Public Cloud Image google/sles-12-sp4-byos-v20221108-x86-64 libsamba-hostconfig0-4.6.16+git.324.6bba9ddab76-3.73.1 as a component of Public Cloud Image google/sles-12-sp4-byos-v20221108-x86-64 libsamba-passdb0-4.6.16+git.324.6bba9ddab76-3.73.1 as a component of Public Cloud Image google/sles-12-sp4-byos-v20221108-x86-64 libsamba-util0-4.6.16+git.324.6bba9ddab76-3.73.1 as a component of Public Cloud Image google/sles-12-sp4-byos-v20221108-x86-64 libsamdb0-4.6.16+git.324.6bba9ddab76-3.73.1 as a component of Public Cloud Image google/sles-12-sp4-byos-v20221108-x86-64 libsmartcols1-2.29.2-9.20.1 as a component of Public Cloud Image google/sles-12-sp4-byos-v20221108-x86-64 libsmbconf0-4.6.16+git.324.6bba9ddab76-3.73.1 as a component of Public Cloud Image google/sles-12-sp4-byos-v20221108-x86-64 libsmbldap0-4.6.16+git.324.6bba9ddab76-3.73.1 as a component of Public Cloud Image google/sles-12-sp4-byos-v20221108-x86-64 libsqlite3-0-3.39.3-9.23.1 as a component of Public Cloud Image google/sles-12-sp4-byos-v20221108-x86-64 libtasn1-4.9-3.13.1 as a component of Public Cloud Image google/sles-12-sp4-byos-v20221108-x86-64 libtasn1-6-4.9-3.13.1 as a component of Public Cloud Image google/sles-12-sp4-byos-v20221108-x86-64 libtevent-util0-4.6.16+git.324.6bba9ddab76-3.73.1 as a component of Public Cloud Image google/sles-12-sp4-byos-v20221108-x86-64 libtirpc-netconfig-1.0.1-17.24.1 as a component of Public Cloud Image google/sles-12-sp4-byos-v20221108-x86-64 libtirpc3-1.0.1-17.24.1 as a component of Public Cloud Image google/sles-12-sp4-byos-v20221108-x86-64 libuuid1-2.29.2-9.20.1 as a component of Public Cloud Image google/sles-12-sp4-byos-v20221108-x86-64 libwbclient0-4.6.16+git.324.6bba9ddab76-3.73.1 as a component of Public Cloud Image google/sles-12-sp4-byos-v20221108-x86-64 libxml2-2-2.9.4-46.59.2 as a component of Public Cloud Image google/sles-12-sp4-byos-v20221108-x86-64 libz1-1.2.11-3.9.1 as a component of Public Cloud Image google/sles-12-sp4-byos-v20221108-x86-64 logrotate-3.11.0-2.20.1 as a component of Public Cloud Image google/sles-12-sp4-byos-v20221108-x86-64 mozilla-nspr-4.34-19.21.1 as a component of Public Cloud Image google/sles-12-sp4-byos-v20221108-x86-64 mozilla-nss-certs-3.79.1-58.78.1 as a component of Public Cloud Image google/sles-12-sp4-byos-v20221108-x86-64 ncurses-utils-5.9-78.1 as a component of Public Cloud Image google/sles-12-sp4-byos-v20221108-x86-64 openldap2-client-2.4.41-22.13.1 as a component of Public Cloud Image google/sles-12-sp4-byos-v20221108-x86-64 patterns-sles-Minimal-12-7.6.1 as a component of Public Cloud Image google/sles-12-sp4-byos-v20221108-x86-64 python-2.7.18-33.14.2 as a component of Public Cloud Image google/sles-12-sp4-byos-v20221108-x86-64 python-base-2.7.18-33.14.1 as a component of Public Cloud Image google/sles-12-sp4-byos-v20221108-x86-64 python-bind-9.11.22-3.43.1 as a component of Public Cloud Image google/sles-12-sp4-byos-v20221108-x86-64 python-xml-2.7.18-33.14.1 as a component of Public Cloud Image google/sles-12-sp4-byos-v20221108-x86-64 python2-salt-3000-71.2 as a component of Public Cloud Image google/sles-12-sp4-byos-v20221108-x86-64 python3-3.4.10-25.96.1 as a component of Public Cloud Image google/sles-12-sp4-byos-v20221108-x86-64 python3-M2Crypto-0.29.0-23.8.1 as a component of Public Cloud Image google/sles-12-sp4-byos-v20221108-x86-64 python3-base-3.4.10-25.96.1 as a component of Public Cloud Image google/sles-12-sp4-byos-v20221108-x86-64 python3-cssselect-0.8-3.7.1 as a component of Public Cloud Image google/sles-12-sp4-byos-v20221108-x86-64 python3-lxml-3.6.1-3.3.1 as a component of Public Cloud Image google/sles-12-sp4-byos-v20221108-x86-64 rsync-3.1.0-13.24.1 as a component of Public Cloud Image google/sles-12-sp4-byos-v20221108-x86-64 salt-3000-71.2 as a component of Public Cloud Image google/sles-12-sp4-byos-v20221108-x86-64 salt-minion-3000-71.2 as a component of Public Cloud Image google/sles-12-sp4-byos-v20221108-x86-64 samba-libs-4.6.16+git.324.6bba9ddab76-3.73.1 as a component of Public Cloud Image google/sles-12-sp4-byos-v20221108-x86-64 sudo-1.8.20p2-3.26.1 as a component of Public Cloud Image google/sles-12-sp4-byos-v20221108-x86-64 systemd-presets-branding-SLE-12.2-10.6.1 as a component of Public Cloud Image google/sles-12-sp4-byos-v20221108-x86-64 telnet-1.2-167.10.1 as a component of Public Cloud Image google/sles-12-sp4-byos-v20221108-x86-64 terminfo-5.9-78.1 as a component of Public Cloud Image google/sles-12-sp4-byos-v20221108-x86-64 terminfo-base-5.9-78.1 as a component of Public Cloud Image google/sles-12-sp4-byos-v20221108-x86-64 timezone-2022a-74.61.1 as a component of Public Cloud Image google/sles-12-sp4-byos-v20221108-x86-64 unzip-6.0-33.16.1 as a component of Public Cloud Image google/sles-12-sp4-byos-v20221108-x86-64 update-alternatives-1.18.4-16.3.5 as a component of Public Cloud Image google/sles-12-sp4-byos-v20221108-x86-64 util-linux-2.29.2-9.20.1 as a component of Public Cloud Image google/sles-12-sp4-byos-v20221108-x86-64 util-linux-systemd-2.29.2-9.20.1 as a component of Public Cloud Image google/sles-12-sp4-byos-v20221108-x86-64 which-2.21-1.8.1 as a component of Public Cloud Image google/sles-12-sp4-byos-v20221108-x86-64 xfsprogs-4.15.0-3.18.1 as a component of Public Cloud Image google/sles-12-sp4-byos-v20221108-x86-64 Buffer overflow in the printbuf APIs in json-c before 0.12 allows remote attackers to cause a denial of service via unspecified vectors. CVE-2013-6370 Public Cloud Image google/sles-12-sp4-byos-v20221108-x86-64:libjson-c2-0.12.1-4.3.1 moderate 5 AV:N/AC:L/Au:N/C:N/I:N/A:P The hash functionality in json-c before 0.12 allows context-dependent attackers to cause a denial of service (CPU consumption) via crafted JSON data, involving collisions. CVE-2013-6371 Public Cloud Image google/sles-12-sp4-byos-v20221108-x86-64:libjson-c2-0.12.1-4.3.1 moderate 5 AV:N/AC:L/Au:N/C:N/I:N/A:P Possible cross-site scripting vulnerability in libxml after commit 960f0e2. CVE-2016-3709 Public Cloud Image google/sles-12-sp4-byos-v20221108-x86-64:libxml2-2-2.9.4-46.59.2 moderate An elevation of privilege vulnerability in the libnl library could enable a local malicious application to execute arbitrary code within the context of a privileged process. This issue is rated as High because it could be used to gain local access to elevated capabilities, which are not normally accessible to a third-party application. Product: Android. Versions: 5.0.2, 5.1.1, 6.0, 6.0.1, 7.0, 7.1. Android ID: A-32255299. CVE-2017-0386 Public Cloud Image google/sles-12-sp4-byos-v20221108-x86-64:libnl-config-3.2.23-4.7.1 Public Cloud Image google/sles-12-sp4-byos-v20221108-x86-64:libnl1-1.1.4-6.3.1 Public Cloud Image google/sles-12-sp4-byos-v20221108-x86-64:libnl3-200-3.2.23-4.7.1 moderate 9.3 AV:N/AC:M/Au:N/C:C/I:C/A:C An issue was discovered in dbus >= 1.3.0 before 1.12.18. The DBusServer in libdbus, as used in dbus-daemon, leaks file descriptors when a message exceeds the per-message file descriptor limit. A local attacker with access to the D-Bus system bus or another system service's private AF_UNIX socket could use this to make the system service reach its file descriptor limit, denying service to subsequent D-Bus clients. CVE-2020-12049 Public Cloud Image google/sles-12-sp4-byos-v20221108-x86-64:dbus-1-1.8.22-29.24.1 Public Cloud Image google/sles-12-sp4-byos-v20221108-x86-64:dbus-1-x11-1.8.22-29.24.1 Public Cloud Image google/sles-12-sp4-byos-v20221108-x86-64:libdbus-1-3-1.8.22-29.24.1 moderate 4.9 AV:L/AC:L/Au:N/C:N/I:N/A:C json-c through 0.14 has an integer overflow and out-of-bounds write via a large JSON file, as demonstrated by printbuf_memappend. CVE-2020-12762 Public Cloud Image google/sles-12-sp4-byos-v20221108-x86-64:libjson-c2-0.12.1-4.3.1 important 6.8 AV:N/AC:M/Au:N/C:P/I:P/A:P libcroco through 0.6.13 has excessive recursion in cr_parser_parse_any_core in cr-parser.c, leading to stack consumption. CVE-2020-12825 Public Cloud Image google/sles-12-sp4-byos-v20221108-x86-64:libcroco-0_6-3-0.6.11-12.6.45 moderate 5.8 AV:N/AC:M/Au:N/C:N/I:P/A:P International Components for Unicode (ICU-20850) v66.1 was discovered to contain a use after free bug in the pkg_createWithAssemblyCode function in the file tools/pkgdata/pkgdata.cpp. CVE-2020-21913 Public Cloud Image google/sles-12-sp4-byos-v20221108-x86-64:libicu52_1-52.1-8.13.1 Public Cloud Image google/sles-12-sp4-byos-v20221108-x86-64:libicu52_1-data-52.1-8.13.1 moderate 4.3 AV:N/AC:M/Au:N/C:N/I:N/A:P A flaw was found in all released versions of m2crypto, where they are vulnerable to Bleichenbacher timing attacks in the RSA decryption API via the timed processing of valid PKCS#1 v1.5 Ciphertext. The highest threat from this vulnerability is to confidentiality. CVE-2020-25657 Public Cloud Image google/sles-12-sp4-byos-v20221108-x86-64:python3-M2Crypto-0.29.0-23.8.1 important 4.3 AV:N/AC:M/Au:N/C:P/I:N/A:N A XSS vulnerability was discovered in python-lxml's clean module. The module's parser didn't properly imitate browsers, which caused different behaviors between the sanitizer and the user's page. A remote attacker could exploit this flaw to run arbitrary HTML/JS code. CVE-2020-27783 Public Cloud Image google/sles-12-sp4-byos-v20221108-x86-64:python3-lxml-3.6.1-3.3.1 moderate 4.3 AV:N/AC:M/Au:N/C:N/I:P/A:N An issue was discovered in the Linux kernel through 5.16.11. The mixed IPID assignment method with the hash-based IPID assignment policy allows an off-path attacker to inject data into a victim's TCP session or terminate that session. CVE-2020-36516 Public Cloud Image google/sles-12-sp4-byos-v20221108-x86-64:kernel-default-4.12.14-95.111.1 important 4.9 AV:N/AC:M/Au:S/C:N/I:P/A:P A race condition in the Linux kernel before 5.6.2 between the VT_DISALLOCATE ioctl and closing/opening of ttys could lead to a use-after-free. CVE-2020-36557 Public Cloud Image google/sles-12-sp4-byos-v20221108-x86-64:kernel-default-4.12.14-95.111.1 important A race condition in the Linux kernel before 5.5.7 involving VT_RESIZEX could lead to a NULL pointer dereference and general protection fault. CVE-2020-36558 Public Cloud Image google/sles-12-sp4-byos-v20221108-x86-64:kernel-default-4.12.14-95.111.1 important Some AMD CPUs may transiently execute beyond unconditional direct branches, which may potentially result in data leakage. CVE-2021-26341 Public Cloud Image google/sles-12-sp4-byos-v20221108-x86-64:kernel-default-4.12.14-95.111.1 moderate 2.1 AV:L/AC:L/Au:N/C:P/I:N/A:N ** DISPUTED ** Python 3.x through 3.10 has an open redirection vulnerability in lib/http/server.py due to no protection against multiple (/) at the beginning of URI path which may leads to information disclosure. NOTE: this is disputed by a third party because the http.server.html documentation page states "Warning: http.server is not recommended for production. It only implements basic security checks." CVE-2021-28861 Public Cloud Image google/sles-12-sp4-byos-v20221108-x86-64:libpython2_7-1_0-2.7.18-33.14.1 Public Cloud Image google/sles-12-sp4-byos-v20221108-x86-64:libpython3_4m1_0-3.4.10-25.96.1 Public Cloud Image google/sles-12-sp4-byos-v20221108-x86-64:python-2.7.18-33.14.2 Public Cloud Image google/sles-12-sp4-byos-v20221108-x86-64:python-base-2.7.18-33.14.1 Public Cloud Image google/sles-12-sp4-byos-v20221108-x86-64:python-xml-2.7.18-33.14.1 Public Cloud Image google/sles-12-sp4-byos-v20221108-x86-64:python3-3.4.10-25.96.1 Public Cloud Image google/sles-12-sp4-byos-v20221108-x86-64:python3-base-3.4.10-25.96.1 important When sending malicous data to kernel by ioctl cmd FBIOPUT_VSCREENINFO,kernel will write memory out of bounds. CVE-2021-33655 Public Cloud Image google/sles-12-sp4-byos-v20221108-x86-64:kernel-default-4.12.14-95.111.1 important When setting font with malicous data by ioctl cmd PIO_FONT,kernel will write memory out of bounds. CVE-2021-33656 Public Cloud Image google/sles-12-sp4-byos-v20221108-x86-64:kernel-default-4.12.14-95.111.1 moderate ** DISPUTED ** A segmentation fault can occur in the sqlite3.exe command-line component of SQLite 3.36.0 via the idxGetTableInfo function when there is a crafted SQL query. NOTE: the vendor disputes the relevance of this report because a sqlite3.exe user already has full privileges (e.g., is intentionally allowed to execute commands). This report does NOT imply any problem in the SQLite library. CVE-2021-36690 Public Cloud Image google/sles-12-sp4-byos-v20221108-x86-64:libsqlite3-0-3.39.3-9.23.1 moderate 5 AV:N/AC:L/Au:N/C:N/I:N/A:P A flaw was found in the way the dumpable flag setting was handled when certain SUID binaries executed its descendants. The prerequisite is a SUID binary that sets real UID equal to effective UID, and real GID equal to effective GID. The descendant will then have a dumpable value set to 1. As a result, if the descendant process crashes and core_pattern is set to a relative value, its core dump is stored in the current directory with uid:gid permissions. An unprivileged local user with eligible root SUID binary could use this flaw to place core dumps into root-owned directories, potentially resulting in escalation of privileges. CVE-2021-3864 Public Cloud Image google/sles-12-sp4-byos-v20221108-x86-64:logrotate-3.11.0-2.20.1 important A use-after-free read flaw was found in sock_getsockopt() in net/core/sock.c due to SO_PEERCRED and SO_PEERGROUPS race with listen() (and connect()) in the Linux kernel. In this flaw, an attacker with a user privileges may crash the system or leak internal kernel information. CVE-2021-4203 Public Cloud Image google/sles-12-sp4-byos-v20221108-x86-64:kernel-default-4.12.14-95.111.1 moderate 4.9 AV:N/AC:M/Au:S/C:P/I:N/A:P NSS (Network Security Services) versions prior to 3.73 or 3.68.1 ESR are vulnerable to a heap overflow when handling DER-encoded DSA or RSA-PSS signatures. Applications using NSS for handling signatures encoded within CMS, S/MIME, PKCS \#7, or PKCS \#12 are likely to be impacted. Applications using NSS for certificate validation or other TLS, X.509, OCSP or CRL functionality may be impacted, depending on how they configure NSS. *Note: This vulnerability does NOT impact Mozilla Firefox.* However, email clients and PDF viewers that use NSS for signature verification, such as Thunderbird, LibreOffice, Evolution and Evince are believed to be impacted. This vulnerability affects NSS < 3.73 and NSS < 3.68.1. CVE-2021-43527 Public Cloud Image google/sles-12-sp4-byos-v20221108-x86-64:mozilla-nss-certs-3.79.1-58.78.1 important 7.5 AV:N/AC:L/Au:N/C:P/I:P/A:P In libtirpc before 1.3.3rc1, remote attackers could exhaust the file descriptors of a process that uses libtirpc because idle TCP connections are mishandled. This can, in turn, lead to an svc_run infinite loop without accepting new connections. CVE-2021-46828 Public Cloud Image google/sles-12-sp4-byos-v20221108-x86-64:libtirpc-netconfig-1.0.1-17.24.1 Public Cloud Image google/sles-12-sp4-byos-v20221108-x86-64:libtirpc3-1.0.1-17.24.1 important GNU Libtasn1 before 4.19.0 has an ETYPE_OK off-by-one array size check that affects asn1_encode_simple_der. CVE-2021-46848 Public Cloud Image google/sles-12-sp4-byos-v20221108-x86-64:libtasn1-4.9-3.13.1 Public Cloud Image google/sles-12-sp4-byos-v20221108-x86-64:libtasn1-6-4.9-3.13.1 critical A flaw was found in Unzip. The vulnerability occurs during the conversion of a wide string to a local string that leads to a heap of out-of-bound write. This flaw allows an attacker to input a specially crafted zip file, leading to a crash or code execution. CVE-2022-0529 Public Cloud Image google/sles-12-sp4-byos-v20221108-x86-64:unzip-6.0-33.16.1 moderate 4.3 AV:N/AC:M/Au:N/C:N/I:N/A:P A flaw was found in Unzip. The vulnerability occurs during the conversion of a wide string to a local string that leads to a heap of out-of-bound write. This flaw allows an attacker to input a specially crafted zip file, leading to a crash or code execution. CVE-2022-0530 Public Cloud Image google/sles-12-sp4-byos-v20221108-x86-64:unzip-6.0-33.16.1 moderate 4.3 AV:N/AC:M/Au:N/C:N/I:N/A:P A use-after-free flaw was found in fs/ext4/namei.c:dx_insert_block() in the Linux kernel’s filesystem sub-component. This flaw allows a local attacker with a user privilege to cause a denial of service. CVE-2022-1184 Public Cloud Image google/sles-12-sp4-byos-v20221108-x86-64:kernel-default-4.12.14-95.111.1 moderate An out-of-bounds read flaw was found in the Linux kernel’s TeleTYpe subsystem. The issue occurs in how a user triggers a race condition using ioctls TIOCSPTLCK and TIOCGPTPEER and TIOCSTI and TCXONC with leakage of memory in the flush_to_ldisc function. This flaw allows a local user to crash the system or read unauthorized random data from memory. CVE-2022-1462 Public Cloud Image google/sles-12-sp4-byos-v20221108-x86-64:kernel-default-4.12.14-95.111.1 moderate 3.3 AV:L/AC:M/Au:N/C:P/I:N/A:P In various methods of kernel base drivers, there is a possible out of bounds write due to a heap buffer overflow. This could lead to local escalation of privilege with System execution privileges needed. User interaction is not needed for exploitation.Product: AndroidVersions: Android kernelAndroid ID: A-182388481References: Upstream kernel CVE-2022-20166 Public Cloud Image google/sles-12-sp4-byos-v20221108-x86-64:kernel-default-4.12.14-95.111.1 moderate 4.6 AV:L/AC:L/Au:N/C:P/I:P/A:P Product: AndroidVersions: Android kernelAndroid ID: A-224546354References: Upstream kernel CVE-2022-20368 Public Cloud Image google/sles-12-sp4-byos-v20221108-x86-64:kernel-default-4.12.14-95.111.1 moderate In v4l2_m2m_querybuf of v4l2-mem2mem.c, there is a possible out of bounds write due to improper input validation. This could lead to local escalation of privilege with System execution privileges needed. User interaction is not needed for exploitation.Product: AndroidVersions: Android kernelAndroid ID: A-223375145References: Upstream kernel CVE-2022-20369 Public Cloud Image google/sles-12-sp4-byos-v20221108-x86-64:kernel-default-4.12.14-95.111.1 moderate A flaw in net_rds_alloc_sgs() in Oracle Linux kernels allows unprivileged local users to crash the machine. CVSS 3.1 Base Score 6.2 (Availability impacts). CVSS Vector (CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H) CVE-2022-21385 Public Cloud Image google/sles-12-sp4-byos-v20221108-x86-64:kernel-default-4.12.14-95.111.1 moderate An issue was discovered in SaltStack Salt in versions before 3002.9, 3003.5, 3004.2. PAM auth fails to reject locked accounts, which allows a previously authorized user whose account is locked still run Salt commands when their account is locked. This affects both local shell accounts with an active session and salt-api users that authenticate via PAM eauth. CVE-2022-22967 important 6.5 AV:N/AC:L/Au:S/C:P/I:P/A:P Dm-verity is used for extending root-of-trust to root filesystems. LoadPin builds on this property to restrict module/firmware loads to just the trusted root filesystem. Device-mapper table reloads currently allow users with root privileges to switch out the target with an equivalent dm-linear target and bypass verification till reboot. This allows root to bypass LoadPin and can be used to load untrusted and unverified kernel modules and firmware, which implies arbitrary kernel execution and persistence for peripherals that do not verify firmware updates. We recommend upgrading past commit 4caae58406f8ceb741603eee460d79bacca9b1b5 CVE-2022-2503 Public Cloud Image google/sles-12-sp4-byos-v20221108-x86-64:kernel-default-4.12.14-95.111.1 moderate ** RESERVED ** This candidate has been reserved by an organization or individual that will use it when announcing a new security problem. When the candidate has been publicized, the details for this candidate will be provided. CVE-2022-2588 Public Cloud Image google/sles-12-sp4-byos-v20221108-x86-64:kernel-default-4.12.14-95.111.1 important Non-transparent sharing of return predictor targets between contexts in some Intel(R) Processors may allow an authorized user to potentially enable information disclosure via local access. CVE-2022-26373 Public Cloud Image google/sles-12-sp4-byos-v20221108-x86-64:kernel-default-4.12.14-95.111.1 moderate An integer coercion error was found in the openvswitch kernel module. Given a sufficiently large number of actions, while copying and reserving memory for a new action of a new flow, the reserve_sfa_size() function does not return -EMSGSIZE as expected, potentially leading to an out-of-bounds write access. This flaw allows a local user to crash or potentially escalate their privileges on the system. CVE-2022-2639 Public Cloud Image google/sles-12-sp4-byos-v20221108-x86-64:kernel-default-4.12.14-95.111.1 moderate An issue was found in the Linux kernel in nf_conntrack_irc where the message handling can be confused and incorrectly matches the message. A firewall may be able to be bypassed when users are using unencrypted IRC with nf_conntrack_irc configured. CVE-2022-2663 Public Cloud Image google/sles-12-sp4-byos-v20221108-x86-64:kernel-default-4.12.14-95.111.1 moderate libcurl provides the `CURLOPT_CERTINFO` option to allow applications torequest details to be returned about a server's certificate chain.Due to an erroneous function, a malicious server could make libcurl built withNSS get stuck in a never-ending busy-loop when trying to retrieve thatinformation. CVE-2022-27781 Public Cloud Image google/sles-12-sp4-byos-v20221108-x86-64:curl-7.60.0-4.43.1 Public Cloud Image google/sles-12-sp4-byos-v20221108-x86-64:libcurl4-7.60.0-4.43.1 low 5 AV:N/AC:L/Au:N/C:N/I:N/A:P libcurl would reuse a previously created connection even when a TLS or SSHrelated option had been changed that should have prohibited reuse.libcurl keeps previously used connections in a connection pool for subsequenttransfers to reuse if one of them matches the setup. However, several TLS andSSH settings were left out from the configuration match checks, making themmatch too easily. CVE-2022-27782 Public Cloud Image google/sles-12-sp4-byos-v20221108-x86-64:curl-7.60.0-4.43.1 Public Cloud Image google/sles-12-sp4-byos-v20221108-x86-64:libcurl4-7.60.0-4.43.1 important 5 AV:N/AC:L/Au:N/C:N/I:P/A:N By flooding the target resolver with queries exploiting this flaw an attacker can significantly impair the resolver's performance, effectively denying legitimate clients access to the DNS resolution service. CVE-2022-2795 Public Cloud Image google/sles-12-sp4-byos-v20221108-x86-64:bind-utils-9.11.22-3.43.1 Public Cloud Image google/sles-12-sp4-byos-v20221108-x86-64:libbind9-161-9.11.22-3.43.1 Public Cloud Image google/sles-12-sp4-byos-v20221108-x86-64:libdns1110-9.11.22-3.43.1 Public Cloud Image google/sles-12-sp4-byos-v20221108-x86-64:libirs161-9.11.22-3.43.1 Public Cloud Image google/sles-12-sp4-byos-v20221108-x86-64:libisc1107-9.11.22-3.43.1 Public Cloud Image google/sles-12-sp4-byos-v20221108-x86-64:libisccc161-9.11.22-3.43.1 Public Cloud Image google/sles-12-sp4-byos-v20221108-x86-64:libisccfg163-9.11.22-3.43.1 Public Cloud Image google/sles-12-sp4-byos-v20221108-x86-64:liblwres161-9.11.22-3.43.1 Public Cloud Image google/sles-12-sp4-byos-v20221108-x86-64:python-bind-9.11.22-3.43.1 moderate An issue was discovered in rsync before 3.2.5 that allows malicious remote servers to write arbitrary files inside the directories of connecting peers. The server chooses which files/directories are sent to the client. However, the rsync client performs insufficient validation of file names. A malicious rsync server (or Man-in-The-Middle attacker) can overwrite arbitrary files in the rsync client target directory and subdirectories (for example, overwrite the .ssh/authorized_keys file). CVE-2022-29154 Public Cloud Image google/sles-12-sp4-byos-v20221108-x86-64:rsync-3.1.0-13.24.1 important ncurses 6.3 before patch 20220416 has an out-of-bounds read and segmentation violation in convert_strings in tinfo/read_entry.c in the terminfo library. CVE-2022-29458 Public Cloud Image google/sles-12-sp4-byos-v20221108-x86-64:libncurses5-5.9-78.1 Public Cloud Image google/sles-12-sp4-byos-v20221108-x86-64:libncurses6-5.9-78.1 Public Cloud Image google/sles-12-sp4-byos-v20221108-x86-64:ncurses-utils-5.9-78.1 Public Cloud Image google/sles-12-sp4-byos-v20221108-x86-64:terminfo-5.9-78.1 Public Cloud Image google/sles-12-sp4-byos-v20221108-x86-64:terminfo-base-5.9-78.1 moderate 5.8 AV:N/AC:M/Au:N/C:P/I:N/A:P A flaw was found in the Linux kernel implementation of proxied virtualized TPM devices. On a system where virtualized TPM devices are configured (this is not the default) a local attacker can create a use-after-free and create a situation where it may be possible to escalate privileges on the system. CVE-2022-2977 Public Cloud Image google/sles-12-sp4-byos-v20221108-x86-64:kernel-default-4.12.14-95.111.1 moderate cifs-utils through 6.14, with verbose logging, can cause an information leak when a file contains = (equal sign) characters but is not a valid credentials file. CVE-2022-29869 Public Cloud Image google/sles-12-sp4-byos-v20221108-x86-64:cifs-utils-6.9-13.23.1 moderate 4.3 AV:N/AC:M/Au:N/C:P/I:N/A:N Mis-trained branch predictions for return instructions may allow arbitrary speculative code execution under certain microarchitecture-dependent conditions. CVE-2022-29900 Public Cloud Image google/sles-12-sp4-byos-v20221108-x86-64:kernel-default-4.12.14-95.111.1 moderate 2.1 AV:L/AC:L/Au:N/C:P/I:N/A:N Intel microprocessor generations 6 to 8 are affected by a new Spectre variant that is able to bypass their retpoline mitigation in the kernel to leak arbitrary data. An attacker with unprivileged user access can hijack return instructions to achieve arbitrary speculative code execution under certain microarchitecture-dependent conditions. CVE-2022-29901 Public Cloud Image google/sles-12-sp4-byos-v20221108-x86-64:kernel-default-4.12.14-95.111.1 moderate 1.9 AV:L/AC:M/Au:N/C:P/I:N/A:N A race condition was found in the Linux kernel's IP framework for transforming packets (XFRM subsystem) when multiple calls to xfrm_probe_algs occurred simultaneously. This flaw could allow a local attacker to potentially trigger an out-of-bounds write or leak kernel heap memory by performing an out-of-bounds read and copying it into a socket. CVE-2022-3028 Public Cloud Image google/sles-12-sp4-byos-v20221108-x86-64:kernel-default-4.12.14-95.111.1 moderate curl < 7.84.0 supports "chained" HTTP compression algorithms, meaning that a serverresponse can be compressed multiple times and potentially with different algorithms. The number of acceptable "links" in this "decompression chain" was unbounded, allowing a malicious server to insert a virtually unlimited number of compression steps.The use of such a decompression chain could result in a "malloc bomb", makingcurl end up spending enormous amounts of allocated heap memory, or trying toand returning out of memory errors. CVE-2022-32206 Public Cloud Image google/sles-12-sp4-byos-v20221108-x86-64:curl-7.60.0-4.43.1 Public Cloud Image google/sles-12-sp4-byos-v20221108-x86-64:libcurl4-7.60.0-4.43.1 moderate 4.3 AV:N/AC:M/Au:N/C:N/I:N/A:P When curl < 7.84.0 does FTP transfers secured by krb5, it handles message verification failures wrongly. This flaw makes it possible for a Man-In-The-Middle attack to go unnoticed and even allows it to inject data to the client. CVE-2022-32208 Public Cloud Image google/sles-12-sp4-byos-v20221108-x86-64:curl-7.60.0-4.43.1 Public Cloud Image google/sles-12-sp4-byos-v20221108-x86-64:libcurl4-7.60.0-4.43.1 moderate 4.3 AV:N/AC:M/Au:N/C:P/I:N/A:N When doing HTTP(S) transfers, libcurl might erroneously use the read callback (`CURLOPT_READFUNCTION`) to ask for data to send, even when the `CURLOPT_POSTFIELDS` option has been set, if the same handle previously was used to issue a `PUT` request which used that callback. This flaw may surprise the application and cause it to misbehave and either send off the wrong data or use memory after free or similar in the subsequent `POST` request. The problem exists in the logic for a reused handle when it is changed from a PUT to a POST. CVE-2022-32221 Public Cloud Image google/sles-12-sp4-byos-v20221108-x86-64:curl-7.60.0-4.43.1 Public Cloud Image google/sles-12-sp4-byos-v20221108-x86-64:libcurl4-7.60.0-4.43.1 important A flaw use after free in the Linux kernel video4linux driver was found in the way user triggers em28xx_usb_probe() for the Empia 28xx based TV cards. A local user could use this flaw to crash the system or potentially escalate their privileges on the system. CVE-2022-3239 Public Cloud Image google/sles-12-sp4-byos-v20221108-x86-64:kernel-default-4.12.14-95.111.1 moderate A flaw was found in Samba. Some SMB1 write requests were not correctly range-checked to ensure the client had sent enough data to fulfill the write, allowing server memory contents to be written into the file (or printer) instead of client-supplied data. The client cannot control the area of the server memory written to the file (or printer). CVE-2022-32742 Public Cloud Image google/sles-12-sp4-byos-v20221108-x86-64:libdcerpc-binding0-4.6.16+git.324.6bba9ddab76-3.73.1 Public Cloud Image google/sles-12-sp4-byos-v20221108-x86-64:libdcerpc0-4.6.16+git.324.6bba9ddab76-3.73.1 Public Cloud Image google/sles-12-sp4-byos-v20221108-x86-64:libndr-krb5pac0-4.6.16+git.324.6bba9ddab76-3.73.1 Public Cloud Image google/sles-12-sp4-byos-v20221108-x86-64:libndr-nbt0-4.6.16+git.324.6bba9ddab76-3.73.1 Public Cloud Image google/sles-12-sp4-byos-v20221108-x86-64:libndr-standard0-4.6.16+git.324.6bba9ddab76-3.73.1 Public Cloud Image google/sles-12-sp4-byos-v20221108-x86-64:libndr0-4.6.16+git.324.6bba9ddab76-3.73.1 Public Cloud Image google/sles-12-sp4-byos-v20221108-x86-64:libnetapi0-4.6.16+git.324.6bba9ddab76-3.73.1 Public Cloud Image google/sles-12-sp4-byos-v20221108-x86-64:libsamba-credentials0-4.6.16+git.324.6bba9ddab76-3.73.1 Public Cloud Image google/sles-12-sp4-byos-v20221108-x86-64:libsamba-errors0-4.6.16+git.324.6bba9ddab76-3.73.1 Public Cloud Image google/sles-12-sp4-byos-v20221108-x86-64:libsamba-hostconfig0-4.6.16+git.324.6bba9ddab76-3.73.1 Public Cloud Image google/sles-12-sp4-byos-v20221108-x86-64:libsamba-passdb0-4.6.16+git.324.6bba9ddab76-3.73.1 Public Cloud Image google/sles-12-sp4-byos-v20221108-x86-64:libsamba-util0-4.6.16+git.324.6bba9ddab76-3.73.1 Public Cloud Image google/sles-12-sp4-byos-v20221108-x86-64:libsamdb0-4.6.16+git.324.6bba9ddab76-3.73.1 Public Cloud Image google/sles-12-sp4-byos-v20221108-x86-64:libsmbconf0-4.6.16+git.324.6bba9ddab76-3.73.1 Public Cloud Image google/sles-12-sp4-byos-v20221108-x86-64:libsmbldap0-4.6.16+git.324.6bba9ddab76-3.73.1 Public Cloud Image google/sles-12-sp4-byos-v20221108-x86-64:libtevent-util0-4.6.16+git.324.6bba9ddab76-3.73.1 Public Cloud Image google/sles-12-sp4-byos-v20221108-x86-64:libwbclient0-4.6.16+git.324.6bba9ddab76-3.73.1 Public Cloud Image google/sles-12-sp4-byos-v20221108-x86-64:samba-libs-4.6.16+git.324.6bba9ddab76-3.73.1 important GnuPG through 2.3.6, in unusual situations where an attacker possesses any secret-key information from a victim's keyring and other constraints (e.g., use of GPGME) are met, allows signature forgery via injection into the status line. CVE-2022-34903 Public Cloud Image google/sles-12-sp4-byos-v20221108-x86-64:gpg2-2.0.24-9.11.1 moderate 5.8 AV:N/AC:M/Au:N/C:P/I:P/A:N A vulnerability was found in the Libksba library due to an integer overflow within the CRL parser. The vulnerability can be exploited remotely for code execution on the target system by passing specially crafted data to the application, for example, a malicious S/MIME attachment. CVE-2022-3515 Public Cloud Image google/sles-12-sp4-byos-v20221108-x86-64:libksba8-1.3.0-24.3.1 critical When curl is used to retrieve and parse cookies from a HTTP(S) server, itaccepts cookies using control codes that when later are sent back to a HTTPserver might make the server return 400 responses. Effectively allowing a"sister site" to deny service to all siblings. CVE-2022-35252 Public Cloud Image google/sles-12-sp4-byos-v20221108-x86-64:curl-7.60.0-4.43.1 Public Cloud Image google/sles-12-sp4-byos-v20221108-x86-64:libcurl4-7.60.0-4.43.1 low SQLite 1.0.12 through 3.39.x before 3.39.2 sometimes allows an array-bounds overflow if billions of bytes are used in a string argument to a C API. CVE-2022-35737 Public Cloud Image google/sles-12-sp4-byos-v20221108-x86-64:libsqlite3-0-3.39.3-9.23.1 moderate An issue was discovered in the Linux kernel through 5.18.14. xfrm_expand_policies in net/xfrm/xfrm_policy.c can cause a refcount to be dropped twice. CVE-2022-36879 Public Cloud Image google/sles-12-sp4-byos-v20221108-x86-64:kernel-default-4.12.14-95.111.1 moderate nfqnl_mangle in net/netfilter/nfnetlink_queue.c in the Linux kernel through 5.18.14 allows remote attackers to cause a denial of service (panic) because, in the case of an nf_queue verdict with a one-byte nfta_payload attribute, an skb_pull can encounter a negative skb->len. CVE-2022-36946 Public Cloud Image google/sles-12-sp4-byos-v20221108-x86-64:kernel-default-4.12.14-95.111.1 important zlib through 1.2.12 has a heap-based buffer over-read or buffer overflow in inflate in inflate.c via a large gzip header extra field. NOTE: only applications that call inflateGetHeader are affected. Some common applications bundle the affected zlib source code but may be unable to call inflateGetHeader (e.g., see the nodejs/node reference). CVE-2022-37434 Public Cloud Image google/sles-12-sp4-byos-v20221108-x86-64:libz1-1.2.11-3.9.1 important By spoofing the target resolver with responses that have a malformed ECDSA signature, an attacker can trigger a small memory leak. It is possible to gradually erode available memory to the point where named crashes for lack of resources. CVE-2022-38177 Public Cloud Image google/sles-12-sp4-byos-v20221108-x86-64:bind-utils-9.11.22-3.43.1 Public Cloud Image google/sles-12-sp4-byos-v20221108-x86-64:libbind9-161-9.11.22-3.43.1 Public Cloud Image google/sles-12-sp4-byos-v20221108-x86-64:libdns1110-9.11.22-3.43.1 Public Cloud Image google/sles-12-sp4-byos-v20221108-x86-64:libirs161-9.11.22-3.43.1 Public Cloud Image google/sles-12-sp4-byos-v20221108-x86-64:libisc1107-9.11.22-3.43.1 Public Cloud Image google/sles-12-sp4-byos-v20221108-x86-64:libisccc161-9.11.22-3.43.1 Public Cloud Image google/sles-12-sp4-byos-v20221108-x86-64:libisccfg163-9.11.22-3.43.1 Public Cloud Image google/sles-12-sp4-byos-v20221108-x86-64:liblwres161-9.11.22-3.43.1 Public Cloud Image google/sles-12-sp4-byos-v20221108-x86-64:python-bind-9.11.22-3.43.1 important By spoofing the target resolver with responses that have a malformed EdDSA signature, an attacker can trigger a small memory leak. It is possible to gradually erode available memory to the point where named crashes for lack of resources. CVE-2022-38178 Public Cloud Image google/sles-12-sp4-byos-v20221108-x86-64:bind-utils-9.11.22-3.43.1 Public Cloud Image google/sles-12-sp4-byos-v20221108-x86-64:libbind9-161-9.11.22-3.43.1 Public Cloud Image google/sles-12-sp4-byos-v20221108-x86-64:libdns1110-9.11.22-3.43.1 Public Cloud Image google/sles-12-sp4-byos-v20221108-x86-64:libirs161-9.11.22-3.43.1 Public Cloud Image google/sles-12-sp4-byos-v20221108-x86-64:libisc1107-9.11.22-3.43.1 Public Cloud Image google/sles-12-sp4-byos-v20221108-x86-64:libisccc161-9.11.22-3.43.1 Public Cloud Image google/sles-12-sp4-byos-v20221108-x86-64:libisccfg163-9.11.22-3.43.1 Public Cloud Image google/sles-12-sp4-byos-v20221108-x86-64:liblwres161-9.11.22-3.43.1 Public Cloud Image google/sles-12-sp4-byos-v20221108-x86-64:python-bind-9.11.22-3.43.1 important telnetd in GNU Inetutils through 2.3, MIT krb5-appl through 1.0.3, and derivative works has a NULL pointer dereference via 0xff 0xf7 or 0xff 0xf8. In a typical installation, the telnetd application would crash but the telnet service would remain available through inetd. However, if the telnetd application has many crashes within a short time interval, the telnet service would become unavailable after inetd logs a "telnet/tcp server failing (looping), service terminated" error. NOTE: MIT krb5-appl is not supported upstream but is shipped by a few Linux distributions. The affected code was removed from the supported MIT Kerberos 5 (aka krb5) product many years ago, at version 1.8. CVE-2022-39028 Public Cloud Image google/sles-12-sp4-byos-v20221108-x86-64:telnet-1.2-167.10.1 important An issue was discovered in include/asm-generic/tlb.h in the Linux kernel before 5.19. Because of a race condition (unmap_mapping_range versus munmap), a device driver can free a page while it still has stale TLB entries. This only occurs in situations with VM_PFNMAP VMAs. CVE-2022-39188 Public Cloud Image google/sles-12-sp4-byos-v20221108-x86-64:kernel-default-4.12.14-95.111.1 moderate An issue was discovered in libxml2 before 2.10.3. When parsing a multi-gigabyte XML document with the XML_PARSE_HUGE parser option enabled, several integer counters can overflow. This results in an attempt to access an array at a negative 2GB offset, typically leading to a segmentation fault. CVE-2022-40303 Public Cloud Image google/sles-12-sp4-byos-v20221108-x86-64:libxml2-2-2.9.4-46.59.2 important An issue was discovered in libxml2 before 2.10.3. Certain invalid XML entity definitions can corrupt a hash table key, potentially leading to subsequent logic errors. In one case, a double-free can be provoked. CVE-2022-40304 Public Cloud Image google/sles-12-sp4-byos-v20221108-x86-64:libxml2-2-2.9.4-46.59.2 important libexpat before 2.4.9 has a use-after-free in the doContent function in xmlparse.c. CVE-2022-40674 Public Cloud Image google/sles-12-sp4-byos-v20221108-x86-64:expat-2.1.0-21.28.1 Public Cloud Image google/sles-12-sp4-byos-v20221108-x86-64:libexpat1-2.1.0-21.28.1 important In drivers/media/dvb-core/dmxdev.c in the Linux kernel through 5.19.10, there is a use-after-free caused by refcount races, affecting dvb_demux_open and dvb_dmxdev_release. CVE-2022-41218 Public Cloud Image google/sles-12-sp4-byos-v20221108-x86-64:kernel-default-4.12.14-95.111.1 important An issue was discovered in D-Bus before 1.12.24, 1.13.x and 1.14.x before 1.14.4, and 1.15.x before 1.15.2. An authenticated attacker can cause dbus-daemon and other programs that use libdbus to crash when receiving a message with certain invalid type signatures. CVE-2022-42010 Public Cloud Image google/sles-12-sp4-byos-v20221108-x86-64:dbus-1-1.8.22-29.24.1 Public Cloud Image google/sles-12-sp4-byos-v20221108-x86-64:dbus-1-x11-1.8.22-29.24.1 Public Cloud Image google/sles-12-sp4-byos-v20221108-x86-64:libdbus-1-3-1.8.22-29.24.1 low An issue was discovered in D-Bus before 1.12.24, 1.13.x and 1.14.x before 1.14.4, and 1.15.x before 1.15.2. An authenticated attacker can cause dbus-daemon and other programs that use libdbus to crash when receiving a message where an array length is inconsistent with the size of the element type. CVE-2022-42011 Public Cloud Image google/sles-12-sp4-byos-v20221108-x86-64:dbus-1-1.8.22-29.24.1 Public Cloud Image google/sles-12-sp4-byos-v20221108-x86-64:dbus-1-x11-1.8.22-29.24.1 Public Cloud Image google/sles-12-sp4-byos-v20221108-x86-64:libdbus-1-3-1.8.22-29.24.1 moderate An issue was discovered in D-Bus before 1.12.24, 1.13.x and 1.14.x before 1.14.4, and 1.15.x before 1.15.2. An authenticated attacker can cause dbus-daemon and other programs that use libdbus to crash by sending a message with attached file descriptors in an unexpected format. CVE-2022-42012 Public Cloud Image google/sles-12-sp4-byos-v20221108-x86-64:dbus-1-1.8.22-29.24.1 Public Cloud Image google/sles-12-sp4-byos-v20221108-x86-64:dbus-1-x11-1.8.22-29.24.1 Public Cloud Image google/sles-12-sp4-byos-v20221108-x86-64:libdbus-1-3-1.8.22-29.24.1 moderate In libexpat through 2.4.9, there is a use-after free caused by overeager destruction of a shared DTD in XML_ExternalEntityParserCreate in out-of-memory situations. CVE-2022-43680 Public Cloud Image google/sles-12-sp4-byos-v20221108-x86-64:expat-2.1.0-21.28.1 Public Cloud Image google/sles-12-sp4-byos-v20221108-x86-64:libexpat1-2.1.0-21.28.1 important