Libsoup, LibXML, Govulncheck-Vulndb, Mozilla Thunderbird, Glib2, Mozjs60, and Ruby2.5 updates for SUSE

SUSE 5306 Published by

SUSE Linux has been updated with several security enhancements, featuring moderate updates for Libsoup, LibXML, Govulncheck-Vulndb, Mozilla Thunderbird, Glib2, Mozjs60, and Ruby2.5:

openSUSE-SU-2025:15018-1: moderate: libsoup-2_4-1-2.74.3-8.1 on GA media
openSUSE-SU-2025:15019-1: moderate: libxml2-2-2.13.8-1.1 on GA media
openSUSE-SU-2025:15017-1: moderate: govulncheck-vulndb-0.0.20250422T181640-1.1 on GA media
SUSE-SU-2025:1366-1: important: Security update for MozillaThunderbird
SUSE-SU-2025:1367-1: moderate: Security update for glib2
SUSE-SU-2025:1365-1: moderate: Security update for mozjs60
SUSE-SU-2025:1369-1: important: Security update for ruby2.5




openSUSE-SU-2025:15018-1: moderate: libsoup-2_4-1-2.74.3-8.1 on GA media


# libsoup-2_4-1-2.74.3-8.1 on GA media

Announcement ID: openSUSE-SU-2025:15018-1
Rating: moderate

Cross-References:

* CVE-2025-2784
* CVE-2025-32050
* CVE-2025-32052
* CVE-2025-32053

CVSS scores:

* CVE-2025-2784 ( SUSE ): 7 CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:H
* CVE-2025-2784 ( SUSE ): 8.3 CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:N/VC:L/VI:L/VA:H/SC:N/SI:N/SA:N
* CVE-2025-32050 ( SUSE ): 5.9 CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H
* CVE-2025-32050 ( SUSE ): 6 CVSS:4.0/AV:N/AC:H/AT:P/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N
* CVE-2025-32052 ( SUSE ): 6.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:L
* CVE-2025-32052 ( SUSE ): 6.9 CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:L/SC:N/SI:N/SA:N
* CVE-2025-32053 ( SUSE ): 6.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:L
* CVE-2025-32053 ( SUSE ): 6.3 CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:L/VI:N/VA:L/SC:N/SI:N/SA:N

Affected Products:

* openSUSE Tumbleweed

An update that solves 4 vulnerabilities can now be installed.

## Description:

These are all security issues fixed in the libsoup-2_4-1-2.74.3-8.1 package on the GA media of openSUSE Tumbleweed.

## Package List:

* openSUSE Tumbleweed:
* libsoup-2_4-1 2.74.3-8.1
* libsoup-2_4-1-32bit 2.74.3-8.1
* libsoup2-devel 2.74.3-8.1
* libsoup2-devel-32bit 2.74.3-8.1
* libsoup2-lang 2.74.3-8.1
* typelib-1_0-Soup-2_4 2.74.3-8.1

## References:

* https://www.suse.com/security/cve/CVE-2025-2784.html
* https://www.suse.com/security/cve/CVE-2025-32050.html
* https://www.suse.com/security/cve/CVE-2025-32052.html
* https://www.suse.com/security/cve/CVE-2025-32053.html



openSUSE-SU-2025:15019-1: moderate: libxml2-2-2.13.8-1.1 on GA media


# libxml2-2-2.13.8-1.1 on GA media

Announcement ID: openSUSE-SU-2025:15019-1
Rating: moderate

Cross-References:

* CVE-2025-32414
* CVE-2025-32415

CVSS scores:

* CVE-2025-32414 ( SUSE ): 5.6 CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:C/C:L/I:L/A:L
* CVE-2025-32414 ( SUSE ): 2.1 CVSS:4.0/AV:L/AC:H/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:L/SI:L/SA:L
* CVE-2025-32415 ( SUSE ): 2.9 CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:L

Affected Products:

* openSUSE Tumbleweed

An update that solves 2 vulnerabilities can now be installed.

## Description:

These are all security issues fixed in the libxml2-2-2.13.8-1.1 package on the GA media of openSUSE Tumbleweed.

## Package List:

* openSUSE Tumbleweed:
* libxml2-2 2.13.8-1.1
* libxml2-2-32bit 2.13.8-1.1
* libxml2-devel 2.13.8-1.1
* libxml2-devel-32bit 2.13.8-1.1
* libxml2-doc 2.13.8-1.1
* libxml2-tools 2.13.8-1.1

## References:

* https://www.suse.com/security/cve/CVE-2025-32414.html
* https://www.suse.com/security/cve/CVE-2025-32415.html



openSUSE-SU-2025:15017-1: moderate: govulncheck-vulndb-0.0.20250422T181640-1.1 on GA media


# govulncheck-vulndb-0.0.20250422T181640-1.1 on GA media

Announcement ID: openSUSE-SU-2025:15017-1
Rating: moderate

Cross-References:

* CVE-2019-15119
* CVE-2025-1386
* CVE-2025-2424
* CVE-2025-24358
* CVE-2025-2475
* CVE-2025-24839
* CVE-2025-24866
* CVE-2025-2564
* CVE-2025-27538
* CVE-2025-27571
* CVE-2025-27936
* CVE-2025-30206
* CVE-2025-31363
* CVE-2025-32093
* CVE-2025-32431
* CVE-2025-32445
* CVE-2025-32793
* CVE-2025-32963
* CVE-2025-3801
* CVE-2025-43970
* CVE-2025-43971
* CVE-2025-43972
* CVE-2025-43973

CVSS scores:

* CVE-2025-1386 ( SUSE ): 5.3 CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:N/A:N
* CVE-2025-24358 ( SUSE ): 5.3 CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:N/I:H/A:N
* CVE-2025-24358 ( SUSE ): 6 CVSS:4.0/AV:N/AC:H/AT:N/PR:N/UI:P/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N

Affected Products:

* openSUSE Tumbleweed

An update that solves 23 vulnerabilities can now be installed.

## Description:

These are all security issues fixed in the govulncheck-vulndb-0.0.20250422T181640-1.1 package on the GA media of openSUSE Tumbleweed.

## Package List:

* openSUSE Tumbleweed:
* govulncheck-vulndb 0.0.20250422T181640-1.1

## References:

* https://www.suse.com/security/cve/CVE-2019-15119.html
* https://www.suse.com/security/cve/CVE-2025-1386.html
* https://www.suse.com/security/cve/CVE-2025-2424.html
* https://www.suse.com/security/cve/CVE-2025-24358.html
* https://www.suse.com/security/cve/CVE-2025-2475.html
* https://www.suse.com/security/cve/CVE-2025-24839.html
* https://www.suse.com/security/cve/CVE-2025-24866.html
* https://www.suse.com/security/cve/CVE-2025-2564.html
* https://www.suse.com/security/cve/CVE-2025-27538.html
* https://www.suse.com/security/cve/CVE-2025-27571.html
* https://www.suse.com/security/cve/CVE-2025-27936.html
* https://www.suse.com/security/cve/CVE-2025-30206.html
* https://www.suse.com/security/cve/CVE-2025-31363.html
* https://www.suse.com/security/cve/CVE-2025-32093.html
* https://www.suse.com/security/cve/CVE-2025-32431.html
* https://www.suse.com/security/cve/CVE-2025-32445.html
* https://www.suse.com/security/cve/CVE-2025-32793.html
* https://www.suse.com/security/cve/CVE-2025-32963.html
* https://www.suse.com/security/cve/CVE-2025-3801.html
* https://www.suse.com/security/cve/CVE-2025-43970.html
* https://www.suse.com/security/cve/CVE-2025-43971.html
* https://www.suse.com/security/cve/CVE-2025-43972.html
* https://www.suse.com/security/cve/CVE-2025-43973.html



SUSE-SU-2025:1366-1: important: Security update for MozillaThunderbird


# Security update for MozillaThunderbird

Announcement ID: SUSE-SU-2025:1366-1
Release Date: 2025-04-24T12:42:13Z
Rating: important
References:

* bsc#1241277

Cross-References:

* CVE-2025-2830
* CVE-2025-3522
* CVE-2025-3523

CVSS scores:

* CVE-2025-2830 ( SUSE ): 4.6
CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:A/VC:N/VI:N/VA:N/SC:H/SI:N/SA:N
* CVE-2025-2830 ( SUSE ): 6.1 CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:H/I:N/A:N
* CVE-2025-2830 ( NVD ): 6.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:L
* CVE-2025-3522 ( SUSE ): 5.9
CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:A/VC:L/VI:H/VA:L/SC:N/SI:N/SA:N
* CVE-2025-3522 ( SUSE ): 7.4 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:N/A:N
* CVE-2025-3522 ( NVD ): 6.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:L
* CVE-2025-3523 ( SUSE ): 6.1
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:N/VI:N/VA:N/SC:H/SI:N/SA:N
* CVE-2025-3523 ( SUSE ): 6.4 CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:L/I:H/A:L
* CVE-2025-3523 ( NVD ): 6.4 CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:L/I:H/A:L

Affected Products:

* openSUSE Leap 15.6
* SUSE Linux Enterprise Desktop 15 SP6
* SUSE Linux Enterprise Real Time 15 SP6
* SUSE Linux Enterprise Server 15 SP6
* SUSE Linux Enterprise Server for SAP Applications 15 SP6
* SUSE Linux Enterprise Workstation Extension 15 SP6
* SUSE Package Hub 15 15-SP6

An update that solves three vulnerabilities can now be installed.

## Description:

This update for MozillaThunderbird fixes the following issues:

* Mozilla Thunderbird 128.9.2 (bsc#1241277)
* CVE-2025-3522: Leak of hashed Window credentials via crafted attachment URL
* CVE-2025-2830: Information Disclosure of /tmp directory listing
* CVE-2025-3523: User Interface (UI) Misrepresentation of attachment URL

## Patch Instructions:

To install this SUSE update use the SUSE recommended installation methods like
YaST online_update or "zypper patch".
Alternatively you can run the command listed for your product:

* openSUSE Leap 15.6
zypper in -t patch openSUSE-SLE-15.6-2025-1366=1

* SUSE Package Hub 15 15-SP6
zypper in -t patch SUSE-SLE-Module-Packagehub-Subpackages-15-SP6-2025-1366=1

* SUSE Linux Enterprise Workstation Extension 15 SP6
zypper in -t patch SUSE-SLE-Product-WE-15-SP6-2025-1366=1

## Package List:

* openSUSE Leap 15.6 (aarch64 ppc64le s390x x86_64)
* MozillaThunderbird-debuginfo-128.9.2-150200.8.209.1
* MozillaThunderbird-translations-common-128.9.2-150200.8.209.1
* MozillaThunderbird-translations-other-128.9.2-150200.8.209.1
* MozillaThunderbird-debugsource-128.9.2-150200.8.209.1
* MozillaThunderbird-128.9.2-150200.8.209.1
* SUSE Package Hub 15 15-SP6 (aarch64 ppc64le s390x)
* MozillaThunderbird-debuginfo-128.9.2-150200.8.209.1
* MozillaThunderbird-translations-common-128.9.2-150200.8.209.1
* MozillaThunderbird-translations-other-128.9.2-150200.8.209.1
* MozillaThunderbird-debugsource-128.9.2-150200.8.209.1
* MozillaThunderbird-128.9.2-150200.8.209.1
* SUSE Linux Enterprise Workstation Extension 15 SP6 (x86_64)
* MozillaThunderbird-debuginfo-128.9.2-150200.8.209.1
* MozillaThunderbird-translations-common-128.9.2-150200.8.209.1
* MozillaThunderbird-translations-other-128.9.2-150200.8.209.1
* MozillaThunderbird-debugsource-128.9.2-150200.8.209.1
* MozillaThunderbird-128.9.2-150200.8.209.1

## References:

* https://www.suse.com/security/cve/CVE-2025-2830.html
* https://www.suse.com/security/cve/CVE-2025-3522.html
* https://www.suse.com/security/cve/CVE-2025-3523.html
* https://bugzilla.suse.com/show_bug.cgi?id=1241277



SUSE-SU-2025:1367-1: moderate: Security update for glib2


# Security update for glib2

Announcement ID: SUSE-SU-2025:1367-1
Release Date: 2025-04-24T14:38:56Z
Rating: moderate
References:

* bsc#1240897

Cross-References:

* CVE-2025-3360

CVSS scores:

* CVE-2025-3360 ( SUSE ): 8.2
CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N
* CVE-2025-3360 ( SUSE ): 5.9 CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H
* CVE-2025-3360 ( NVD ): 3.7 CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:L

Affected Products:

* Basesystem Module 15-SP6
* openSUSE Leap 15.6
* SUSE Linux Enterprise Desktop 15 SP6
* SUSE Linux Enterprise Real Time 15 SP6
* SUSE Linux Enterprise Server 15 SP6
* SUSE Linux Enterprise Server for SAP Applications 15 SP6

An update that solves one vulnerability can now be installed.

## Description:

This update for glib2 fixes the following issues:

* CVE-2025-3360: Fixed integer overflow and buffer underread when parsing a
very long and invalid ISO 8601 timestamp with g_date_time_new_from_iso8601()
(bsc#1240897)

## Patch Instructions:

To install this SUSE update use the SUSE recommended installation methods like
YaST online_update or "zypper patch".
Alternatively you can run the command listed for your product:

* openSUSE Leap 15.6
zypper in -t patch SUSE-2025-1367=1 openSUSE-SLE-15.6-2025-1367=1

* Basesystem Module 15-SP6
zypper in -t patch SUSE-SLE-Module-Basesystem-15-SP6-2025-1367=1

## Package List:

* openSUSE Leap 15.6 (noarch)
* gio-branding-upstream-2.78.6-150600.4.11.1
* glib2-lang-2.78.6-150600.4.11.1
* openSUSE Leap 15.6 (aarch64 ppc64le s390x x86_64 i586)
* libgmodule-2_0-0-2.78.6-150600.4.11.1
* glib2-devel-debuginfo-2.78.6-150600.4.11.1
* libgio-2_0-0-2.78.6-150600.4.11.1
* glib2-debugsource-2.78.6-150600.4.11.1
* glib2-tools-debuginfo-2.78.6-150600.4.11.1
* libgthread-2_0-0-debuginfo-2.78.6-150600.4.11.1
* glib2-tests-devel-debuginfo-2.78.6-150600.4.11.1
* libgmodule-2_0-0-debuginfo-2.78.6-150600.4.11.1
* libglib-2_0-0-debuginfo-2.78.6-150600.4.11.1
* glib2-devel-static-2.78.6-150600.4.11.1
* glib2-devel-2.78.6-150600.4.11.1
* libgio-2_0-0-debuginfo-2.78.6-150600.4.11.1
* libgobject-2_0-0-debuginfo-2.78.6-150600.4.11.1
* libgthread-2_0-0-2.78.6-150600.4.11.1
* libgobject-2_0-0-2.78.6-150600.4.11.1
* glib2-tests-devel-2.78.6-150600.4.11.1
* glib2-tools-2.78.6-150600.4.11.1
* libglib-2_0-0-2.78.6-150600.4.11.1
* glib2-doc-2.78.6-150600.4.11.1
* openSUSE Leap 15.6 (x86_64)
* glib2-devel-32bit-2.78.6-150600.4.11.1
* glib2-tools-32bit-2.78.6-150600.4.11.1
* libglib-2_0-0-32bit-debuginfo-2.78.6-150600.4.11.1
* libgio-2_0-0-32bit-debuginfo-2.78.6-150600.4.11.1
* libgthread-2_0-0-32bit-2.78.6-150600.4.11.1
* glib2-tools-32bit-debuginfo-2.78.6-150600.4.11.1
* libglib-2_0-0-32bit-2.78.6-150600.4.11.1
* libgthread-2_0-0-32bit-debuginfo-2.78.6-150600.4.11.1
* libgmodule-2_0-0-32bit-debuginfo-2.78.6-150600.4.11.1
* libgobject-2_0-0-32bit-2.78.6-150600.4.11.1
* libgmodule-2_0-0-32bit-2.78.6-150600.4.11.1
* libgobject-2_0-0-32bit-debuginfo-2.78.6-150600.4.11.1
* libgio-2_0-0-32bit-2.78.6-150600.4.11.1
* glib2-devel-32bit-debuginfo-2.78.6-150600.4.11.1
* openSUSE Leap 15.6 (aarch64_ilp32)
* libgobject-2_0-0-64bit-debuginfo-2.78.6-150600.4.11.1
* libgthread-2_0-0-64bit-debuginfo-2.78.6-150600.4.11.1
* glib2-devel-64bit-2.78.6-150600.4.11.1
* libgmodule-2_0-0-64bit-2.78.6-150600.4.11.1
* glib2-devel-64bit-debuginfo-2.78.6-150600.4.11.1
* glib2-tools-64bit-2.78.6-150600.4.11.1
* libgmodule-2_0-0-64bit-debuginfo-2.78.6-150600.4.11.1
* libgobject-2_0-0-64bit-2.78.6-150600.4.11.1
* libglib-2_0-0-64bit-debuginfo-2.78.6-150600.4.11.1
* libgio-2_0-0-64bit-2.78.6-150600.4.11.1
* libglib-2_0-0-64bit-2.78.6-150600.4.11.1
* libgio-2_0-0-64bit-debuginfo-2.78.6-150600.4.11.1
* libgthread-2_0-0-64bit-2.78.6-150600.4.11.1
* glib2-tools-64bit-debuginfo-2.78.6-150600.4.11.1
* Basesystem Module 15-SP6 (aarch64 ppc64le s390x x86_64)
* libgmodule-2_0-0-2.78.6-150600.4.11.1
* glib2-devel-debuginfo-2.78.6-150600.4.11.1
* libgio-2_0-0-2.78.6-150600.4.11.1
* glib2-debugsource-2.78.6-150600.4.11.1
* glib2-tools-debuginfo-2.78.6-150600.4.11.1
* libgthread-2_0-0-debuginfo-2.78.6-150600.4.11.1
* libgmodule-2_0-0-debuginfo-2.78.6-150600.4.11.1
* libglib-2_0-0-debuginfo-2.78.6-150600.4.11.1
* glib2-devel-2.78.6-150600.4.11.1
* libgio-2_0-0-debuginfo-2.78.6-150600.4.11.1
* libgthread-2_0-0-2.78.6-150600.4.11.1
* libgobject-2_0-0-2.78.6-150600.4.11.1
* glib2-tools-2.78.6-150600.4.11.1
* libgobject-2_0-0-debuginfo-2.78.6-150600.4.11.1
* libglib-2_0-0-2.78.6-150600.4.11.1
* Basesystem Module 15-SP6 (noarch)
* glib2-lang-2.78.6-150600.4.11.1
* Basesystem Module 15-SP6 (x86_64)
* libglib-2_0-0-32bit-debuginfo-2.78.6-150600.4.11.1
* libgio-2_0-0-32bit-debuginfo-2.78.6-150600.4.11.1
* libglib-2_0-0-32bit-2.78.6-150600.4.11.1
* libgmodule-2_0-0-32bit-debuginfo-2.78.6-150600.4.11.1
* libgobject-2_0-0-32bit-2.78.6-150600.4.11.1
* libgmodule-2_0-0-32bit-2.78.6-150600.4.11.1
* libgobject-2_0-0-32bit-debuginfo-2.78.6-150600.4.11.1
* libgio-2_0-0-32bit-2.78.6-150600.4.11.1

## References:

* https://www.suse.com/security/cve/CVE-2025-3360.html
* https://bugzilla.suse.com/show_bug.cgi?id=1240897



SUSE-SU-2025:1365-1: moderate: Security update for mozjs60


# Security update for mozjs60

Announcement ID: SUSE-SU-2025:1365-1
Release Date: 2025-04-24T12:07:43Z
Rating: moderate
References:

* bsc#1234837

Cross-References:

* CVE-2024-56431

CVSS scores:

* CVE-2024-56431 ( SUSE ): 8.2
CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N
* CVE-2024-56431 ( SUSE ): 5.9 CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H
* CVE-2024-56431 ( NVD ): 9.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Affected Products:

* Basesystem Module 15-SP6
* Desktop Applications Module 15-SP6
* openSUSE Leap 15.6
* SUSE Linux Enterprise Desktop 15 SP6
* SUSE Linux Enterprise Micro 5.1
* SUSE Linux Enterprise Micro 5.2
* SUSE Linux Enterprise Micro 5.3
* SUSE Linux Enterprise Micro 5.4
* SUSE Linux Enterprise Micro for Rancher 5.2
* SUSE Linux Enterprise Micro for Rancher 5.3
* SUSE Linux Enterprise Micro for Rancher 5.4
* SUSE Linux Enterprise Real Time 15 SP6
* SUSE Linux Enterprise Server 15 SP6
* SUSE Linux Enterprise Server for SAP Applications 15 SP6

An update that solves one vulnerability can now be installed.

## Description:

This update for mozjs60 fixes the following issues:

* CVE-2024-56431: Fixed a negative shift in huffdec.c (bsc#1234837).

## Patch Instructions:

To install this SUSE update use the SUSE recommended installation methods like
YaST online_update or "zypper patch".
Alternatively you can run the command listed for your product:

* openSUSE Leap 15.6
zypper in -t patch openSUSE-SLE-15.6-2025-1365=1

* SUSE Linux Enterprise Micro for Rancher 5.3
zypper in -t patch SUSE-SLE-Micro-5.3-2025-1365=1

* SUSE Linux Enterprise Micro 5.3
zypper in -t patch SUSE-SLE-Micro-5.3-2025-1365=1

* SUSE Linux Enterprise Micro for Rancher 5.4
zypper in -t patch SUSE-SLE-Micro-5.4-2025-1365=1

* SUSE Linux Enterprise Micro 5.4
zypper in -t patch SUSE-SLE-Micro-5.4-2025-1365=1

* Basesystem Module 15-SP6
zypper in -t patch SUSE-SLE-Module-Basesystem-15-SP6-2025-1365=1

* Desktop Applications Module 15-SP6
zypper in -t patch SUSE-SLE-Module-Desktop-Applications-15-SP6-2025-1365=1

* SUSE Linux Enterprise Micro 5.1
zypper in -t patch SUSE-SUSE-MicroOS-5.1-2025-1365=1

* SUSE Linux Enterprise Micro 5.2
zypper in -t patch SUSE-SUSE-MicroOS-5.2-2025-1365=1

* SUSE Linux Enterprise Micro for Rancher 5.2
zypper in -t patch SUSE-SUSE-MicroOS-5.2-2025-1365=1

## Package List:

* openSUSE Leap 15.6 (aarch64 ppc64le s390x x86_64)
* libmozjs-60-debuginfo-60.9.0-150200.6.3.1
* mozjs60-60.9.0-150200.6.3.1
* mozjs60-debuginfo-60.9.0-150200.6.3.1
* mozjs60-devel-60.9.0-150200.6.3.1
* libmozjs-60-60.9.0-150200.6.3.1
* mozjs60-debugsource-60.9.0-150200.6.3.1
* SUSE Linux Enterprise Micro for Rancher 5.3 (aarch64 s390x x86_64)
* libmozjs-60-debuginfo-60.9.0-150200.6.3.1
* mozjs60-debuginfo-60.9.0-150200.6.3.1
* mozjs60-debugsource-60.9.0-150200.6.3.1
* libmozjs-60-60.9.0-150200.6.3.1
* SUSE Linux Enterprise Micro 5.3 (aarch64 s390x x86_64)
* libmozjs-60-debuginfo-60.9.0-150200.6.3.1
* mozjs60-debuginfo-60.9.0-150200.6.3.1
* mozjs60-debugsource-60.9.0-150200.6.3.1
* libmozjs-60-60.9.0-150200.6.3.1
* SUSE Linux Enterprise Micro for Rancher 5.4 (aarch64 s390x x86_64)
* libmozjs-60-debuginfo-60.9.0-150200.6.3.1
* mozjs60-debuginfo-60.9.0-150200.6.3.1
* mozjs60-debugsource-60.9.0-150200.6.3.1
* libmozjs-60-60.9.0-150200.6.3.1
* SUSE Linux Enterprise Micro 5.4 (aarch64 s390x x86_64)
* libmozjs-60-debuginfo-60.9.0-150200.6.3.1
* mozjs60-debuginfo-60.9.0-150200.6.3.1
* mozjs60-debugsource-60.9.0-150200.6.3.1
* libmozjs-60-60.9.0-150200.6.3.1
* Basesystem Module 15-SP6 (aarch64 ppc64le s390x x86_64)
* libmozjs-60-debuginfo-60.9.0-150200.6.3.1
* mozjs60-debuginfo-60.9.0-150200.6.3.1
* mozjs60-debugsource-60.9.0-150200.6.3.1
* libmozjs-60-60.9.0-150200.6.3.1
* Desktop Applications Module 15-SP6 (aarch64 ppc64le s390x x86_64)
* mozjs60-debuginfo-60.9.0-150200.6.3.1
* mozjs60-devel-60.9.0-150200.6.3.1
* mozjs60-debugsource-60.9.0-150200.6.3.1
* SUSE Linux Enterprise Micro 5.1 (aarch64 s390x x86_64)
* libmozjs-60-debuginfo-60.9.0-150200.6.3.1
* mozjs60-debuginfo-60.9.0-150200.6.3.1
* mozjs60-debugsource-60.9.0-150200.6.3.1
* libmozjs-60-60.9.0-150200.6.3.1
* SUSE Linux Enterprise Micro 5.2 (aarch64 s390x x86_64)
* libmozjs-60-debuginfo-60.9.0-150200.6.3.1
* mozjs60-debuginfo-60.9.0-150200.6.3.1
* mozjs60-debugsource-60.9.0-150200.6.3.1
* libmozjs-60-60.9.0-150200.6.3.1
* SUSE Linux Enterprise Micro for Rancher 5.2 (aarch64 s390x x86_64)
* libmozjs-60-debuginfo-60.9.0-150200.6.3.1
* mozjs60-debuginfo-60.9.0-150200.6.3.1
* mozjs60-debugsource-60.9.0-150200.6.3.1
* libmozjs-60-60.9.0-150200.6.3.1

## References:

* https://www.suse.com/security/cve/CVE-2024-56431.html
* https://bugzilla.suse.com/show_bug.cgi?id=1234837



SUSE-SU-2025:1369-1: important: Security update for ruby2.5


# Security update for ruby2.5

Announcement ID: SUSE-SU-2025:1369-1
Release Date: 2025-04-24T17:12:13Z
Rating: important
References:

* bsc#1230930
* bsc#1235773
* bsc#1237804
* bsc#1237806

Cross-References:

* CVE-2024-47220
* CVE-2025-27219
* CVE-2025-27220

CVSS scores:

* CVE-2024-47220 ( SUSE ): 8.3
CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:L/VA:N/SC:N/SI:N/SA:N
* CVE-2024-47220 ( SUSE ): 8.2 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:N
* CVE-2024-47220 ( NVD ): 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N
* CVE-2025-27219 ( SUSE ): 6.9
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N
* CVE-2025-27219 ( SUSE ): 5.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L
* CVE-2025-27219 ( NVD ): 5.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:N/A:L
* CVE-2025-27219 ( NVD ): 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
* CVE-2025-27220 ( SUSE ): 6.9
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N
* CVE-2025-27220 ( SUSE ): 5.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L
* CVE-2025-27220 ( NVD ): 4.0 CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:N/I:N/A:L
* CVE-2025-27220 ( NVD ): 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Affected Products:

* Basesystem Module 15-SP6
* openSUSE Leap 15.6
* SUSE Enterprise Storage 7.1
* SUSE Linux Enterprise Desktop 15 SP6
* SUSE Linux Enterprise High Performance Computing 15 SP3
* SUSE Linux Enterprise High Performance Computing 15 SP4
* SUSE Linux Enterprise High Performance Computing 15 SP5
* SUSE Linux Enterprise High Performance Computing ESPOS 15 SP4
* SUSE Linux Enterprise High Performance Computing ESPOS 15 SP5
* SUSE Linux Enterprise High Performance Computing LTSS 15 SP3
* SUSE Linux Enterprise High Performance Computing LTSS 15 SP4
* SUSE Linux Enterprise High Performance Computing LTSS 15 SP5
* SUSE Linux Enterprise Real Time 15 SP6
* SUSE Linux Enterprise Server 15 SP3
* SUSE Linux Enterprise Server 15 SP3 LTSS
* SUSE Linux Enterprise Server 15 SP4
* SUSE Linux Enterprise Server 15 SP4 LTSS
* SUSE Linux Enterprise Server 15 SP5
* SUSE Linux Enterprise Server 15 SP5 LTSS
* SUSE Linux Enterprise Server 15 SP6
* SUSE Linux Enterprise Server for SAP Applications 15 SP3
* SUSE Linux Enterprise Server for SAP Applications 15 SP4
* SUSE Linux Enterprise Server for SAP Applications 15 SP5
* SUSE Linux Enterprise Server for SAP Applications 15 SP6
* SUSE Manager Proxy 4.3
* SUSE Manager Retail Branch Server 4.3
* SUSE Manager Server 4.3

An update that solves three vulnerabilities and has one security fix can now be
installed.

## Description:

This update for ruby2.5 fixes the following issues:

* CVE-2025-27219: Fixed denial of service in CGI::Cookie.parse (bsc#1237804)
* CVE-2025-27220: Fixed ReDoS in CGI::Util#escapeElement (bsc#1237806)

Other fixes: \- Improved fix for CVE-2024-47220 (bsc#1230930, bsc#1235773)

## Patch Instructions:

To install this SUSE update use the SUSE recommended installation methods like
YaST online_update or "zypper patch".
Alternatively you can run the command listed for your product:

* SUSE Linux Enterprise Server 15 SP5 LTSS
zypper in -t patch SUSE-SLE-Product-SLES-15-SP5-LTSS-2025-1369=1

* SUSE Linux Enterprise Server for SAP Applications 15 SP3
zypper in -t patch SUSE-SLE-Product-SLES_SAP-15-SP3-2025-1369=1

* SUSE Linux Enterprise Server for SAP Applications 15 SP4
zypper in -t patch SUSE-SLE-Product-SLES_SAP-15-SP4-2025-1369=1

* SUSE Linux Enterprise Server for SAP Applications 15 SP5
zypper in -t patch SUSE-SLE-Product-SLES_SAP-15-SP5-2025-1369=1

* SUSE Manager Proxy 4.3
zypper in -t patch SUSE-SLE-Product-SUSE-Manager-Proxy-4.3-2025-1369=1

* SUSE Manager Retail Branch Server 4.3
zypper in -t patch SUSE-SLE-Product-SUSE-Manager-Retail-Branch-
Server-4.3-2025-1369=1

* SUSE Manager Server 4.3
zypper in -t patch SUSE-SLE-Product-SUSE-Manager-Server-4.3-2025-1369=1

* SUSE Enterprise Storage 7.1
zypper in -t patch SUSE-Storage-7.1-2025-1369=1

* openSUSE Leap 15.6
zypper in -t patch openSUSE-SLE-15.6-2025-1369=1

* Basesystem Module 15-SP6
zypper in -t patch SUSE-SLE-Module-Basesystem-15-SP6-2025-1369=1

* SUSE Linux Enterprise High Performance Computing LTSS 15 SP3
zypper in -t patch SUSE-SLE-Product-HPC-15-SP3-LTSS-2025-1369=1

* SUSE Linux Enterprise High Performance Computing ESPOS 15 SP4
zypper in -t patch SUSE-SLE-Product-HPC-15-SP4-ESPOS-2025-1369=1

* SUSE Linux Enterprise High Performance Computing LTSS 15 SP4
zypper in -t patch SUSE-SLE-Product-HPC-15-SP4-LTSS-2025-1369=1

* SUSE Linux Enterprise High Performance Computing ESPOS 15 SP5
zypper in -t patch SUSE-SLE-Product-HPC-15-SP5-ESPOS-2025-1369=1

* SUSE Linux Enterprise High Performance Computing LTSS 15 SP5
zypper in -t patch SUSE-SLE-Product-HPC-15-SP5-LTSS-2025-1369=1

* SUSE Linux Enterprise Server 15 SP3 LTSS
zypper in -t patch SUSE-SLE-Product-SLES-15-SP3-LTSS-2025-1369=1

* SUSE Linux Enterprise Server 15 SP4 LTSS
zypper in -t patch SUSE-SLE-Product-SLES-15-SP4-LTSS-2025-1369=1

## Package List:

* SUSE Linux Enterprise Server 15 SP5 LTSS (aarch64 ppc64le s390x x86_64)
* ruby2.5-devel-extra-2.5.9-150000.4.41.1
* ruby2.5-stdlib-2.5.9-150000.4.41.1
* ruby2.5-stdlib-debuginfo-2.5.9-150000.4.41.1
* libruby2_5-2_5-debuginfo-2.5.9-150000.4.41.1
* libruby2_5-2_5-2.5.9-150000.4.41.1
* ruby2.5-debugsource-2.5.9-150000.4.41.1
* ruby2.5-debuginfo-2.5.9-150000.4.41.1
* ruby2.5-devel-2.5.9-150000.4.41.1
* ruby2.5-2.5.9-150000.4.41.1
* SUSE Linux Enterprise Server for SAP Applications 15 SP3 (ppc64le x86_64)
* ruby2.5-devel-extra-2.5.9-150000.4.41.1
* ruby2.5-stdlib-2.5.9-150000.4.41.1
* ruby2.5-stdlib-debuginfo-2.5.9-150000.4.41.1
* libruby2_5-2_5-debuginfo-2.5.9-150000.4.41.1
* libruby2_5-2_5-2.5.9-150000.4.41.1
* ruby2.5-debugsource-2.5.9-150000.4.41.1
* ruby2.5-debuginfo-2.5.9-150000.4.41.1
* ruby2.5-devel-2.5.9-150000.4.41.1
* ruby2.5-2.5.9-150000.4.41.1
* SUSE Linux Enterprise Server for SAP Applications 15 SP4 (ppc64le x86_64)
* ruby2.5-devel-extra-2.5.9-150000.4.41.1
* ruby2.5-stdlib-2.5.9-150000.4.41.1
* ruby2.5-stdlib-debuginfo-2.5.9-150000.4.41.1
* libruby2_5-2_5-debuginfo-2.5.9-150000.4.41.1
* libruby2_5-2_5-2.5.9-150000.4.41.1
* ruby2.5-debugsource-2.5.9-150000.4.41.1
* ruby2.5-debuginfo-2.5.9-150000.4.41.1
* ruby2.5-devel-2.5.9-150000.4.41.1
* ruby2.5-2.5.9-150000.4.41.1
* SUSE Linux Enterprise Server for SAP Applications 15 SP5 (ppc64le x86_64)
* ruby2.5-devel-extra-2.5.9-150000.4.41.1
* ruby2.5-stdlib-2.5.9-150000.4.41.1
* ruby2.5-stdlib-debuginfo-2.5.9-150000.4.41.1
* libruby2_5-2_5-debuginfo-2.5.9-150000.4.41.1
* libruby2_5-2_5-2.5.9-150000.4.41.1
* ruby2.5-debugsource-2.5.9-150000.4.41.1
* ruby2.5-debuginfo-2.5.9-150000.4.41.1
* ruby2.5-devel-2.5.9-150000.4.41.1
* ruby2.5-2.5.9-150000.4.41.1
* SUSE Manager Proxy 4.3 (x86_64)
* ruby2.5-devel-extra-2.5.9-150000.4.41.1
* ruby2.5-stdlib-2.5.9-150000.4.41.1
* ruby2.5-stdlib-debuginfo-2.5.9-150000.4.41.1
* libruby2_5-2_5-debuginfo-2.5.9-150000.4.41.1
* libruby2_5-2_5-2.5.9-150000.4.41.1
* ruby2.5-debugsource-2.5.9-150000.4.41.1
* ruby2.5-debuginfo-2.5.9-150000.4.41.1
* ruby2.5-devel-2.5.9-150000.4.41.1
* ruby2.5-2.5.9-150000.4.41.1
* SUSE Manager Retail Branch Server 4.3 (x86_64)
* ruby2.5-devel-extra-2.5.9-150000.4.41.1
* ruby2.5-stdlib-2.5.9-150000.4.41.1
* ruby2.5-stdlib-debuginfo-2.5.9-150000.4.41.1
* libruby2_5-2_5-debuginfo-2.5.9-150000.4.41.1
* libruby2_5-2_5-2.5.9-150000.4.41.1
* ruby2.5-debugsource-2.5.9-150000.4.41.1
* ruby2.5-debuginfo-2.5.9-150000.4.41.1
* ruby2.5-devel-2.5.9-150000.4.41.1
* ruby2.5-2.5.9-150000.4.41.1
* SUSE Manager Server 4.3 (ppc64le s390x x86_64)
* ruby2.5-devel-extra-2.5.9-150000.4.41.1
* ruby2.5-stdlib-2.5.9-150000.4.41.1
* ruby2.5-stdlib-debuginfo-2.5.9-150000.4.41.1
* libruby2_5-2_5-debuginfo-2.5.9-150000.4.41.1
* libruby2_5-2_5-2.5.9-150000.4.41.1
* ruby2.5-debugsource-2.5.9-150000.4.41.1
* ruby2.5-debuginfo-2.5.9-150000.4.41.1
* ruby2.5-devel-2.5.9-150000.4.41.1
* ruby2.5-2.5.9-150000.4.41.1
* SUSE Enterprise Storage 7.1 (aarch64 x86_64)
* ruby2.5-devel-extra-2.5.9-150000.4.41.1
* ruby2.5-stdlib-2.5.9-150000.4.41.1
* ruby2.5-stdlib-debuginfo-2.5.9-150000.4.41.1
* libruby2_5-2_5-debuginfo-2.5.9-150000.4.41.1
* libruby2_5-2_5-2.5.9-150000.4.41.1
* ruby2.5-debugsource-2.5.9-150000.4.41.1
* ruby2.5-debuginfo-2.5.9-150000.4.41.1
* ruby2.5-devel-2.5.9-150000.4.41.1
* ruby2.5-2.5.9-150000.4.41.1
* openSUSE Leap 15.6 (aarch64 ppc64le s390x x86_64)
* ruby2.5-devel-extra-2.5.9-150000.4.41.1
* ruby2.5-stdlib-2.5.9-150000.4.41.1
* ruby2.5-stdlib-debuginfo-2.5.9-150000.4.41.1
* libruby2_5-2_5-debuginfo-2.5.9-150000.4.41.1
* libruby2_5-2_5-2.5.9-150000.4.41.1
* ruby2.5-debugsource-2.5.9-150000.4.41.1
* ruby2.5-debuginfo-2.5.9-150000.4.41.1
* ruby2.5-doc-2.5.9-150000.4.41.1
* ruby2.5-devel-2.5.9-150000.4.41.1
* ruby2.5-2.5.9-150000.4.41.1
* openSUSE Leap 15.6 (noarch)
* ruby2.5-doc-ri-2.5.9-150000.4.41.1
* Basesystem Module 15-SP6 (aarch64 ppc64le s390x x86_64)
* ruby2.5-devel-extra-2.5.9-150000.4.41.1
* ruby2.5-stdlib-2.5.9-150000.4.41.1
* ruby2.5-stdlib-debuginfo-2.5.9-150000.4.41.1
* libruby2_5-2_5-debuginfo-2.5.9-150000.4.41.1
* libruby2_5-2_5-2.5.9-150000.4.41.1
* ruby2.5-debugsource-2.5.9-150000.4.41.1
* ruby2.5-debuginfo-2.5.9-150000.4.41.1
* ruby2.5-devel-2.5.9-150000.4.41.1
* ruby2.5-2.5.9-150000.4.41.1
* SUSE Linux Enterprise High Performance Computing LTSS 15 SP3 (aarch64
x86_64)
* ruby2.5-devel-extra-2.5.9-150000.4.41.1
* ruby2.5-stdlib-2.5.9-150000.4.41.1
* ruby2.5-stdlib-debuginfo-2.5.9-150000.4.41.1
* libruby2_5-2_5-debuginfo-2.5.9-150000.4.41.1
* libruby2_5-2_5-2.5.9-150000.4.41.1
* ruby2.5-debugsource-2.5.9-150000.4.41.1
* ruby2.5-debuginfo-2.5.9-150000.4.41.1
* ruby2.5-devel-2.5.9-150000.4.41.1
* ruby2.5-2.5.9-150000.4.41.1
* SUSE Linux Enterprise High Performance Computing ESPOS 15 SP4 (aarch64
x86_64)
* ruby2.5-devel-extra-2.5.9-150000.4.41.1
* ruby2.5-stdlib-2.5.9-150000.4.41.1
* ruby2.5-stdlib-debuginfo-2.5.9-150000.4.41.1
* libruby2_5-2_5-debuginfo-2.5.9-150000.4.41.1
* libruby2_5-2_5-2.5.9-150000.4.41.1
* ruby2.5-debugsource-2.5.9-150000.4.41.1
* ruby2.5-debuginfo-2.5.9-150000.4.41.1
* ruby2.5-devel-2.5.9-150000.4.41.1
* ruby2.5-2.5.9-150000.4.41.1
* SUSE Linux Enterprise High Performance Computing LTSS 15 SP4 (aarch64
x86_64)
* ruby2.5-devel-extra-2.5.9-150000.4.41.1
* ruby2.5-stdlib-2.5.9-150000.4.41.1
* ruby2.5-stdlib-debuginfo-2.5.9-150000.4.41.1
* libruby2_5-2_5-debuginfo-2.5.9-150000.4.41.1
* libruby2_5-2_5-2.5.9-150000.4.41.1
* ruby2.5-debugsource-2.5.9-150000.4.41.1
* ruby2.5-debuginfo-2.5.9-150000.4.41.1
* ruby2.5-devel-2.5.9-150000.4.41.1
* ruby2.5-2.5.9-150000.4.41.1
* SUSE Linux Enterprise High Performance Computing ESPOS 15 SP5 (aarch64
x86_64)
* ruby2.5-devel-extra-2.5.9-150000.4.41.1
* ruby2.5-stdlib-2.5.9-150000.4.41.1
* ruby2.5-stdlib-debuginfo-2.5.9-150000.4.41.1
* libruby2_5-2_5-debuginfo-2.5.9-150000.4.41.1
* libruby2_5-2_5-2.5.9-150000.4.41.1
* ruby2.5-debugsource-2.5.9-150000.4.41.1
* ruby2.5-debuginfo-2.5.9-150000.4.41.1
* ruby2.5-devel-2.5.9-150000.4.41.1
* ruby2.5-2.5.9-150000.4.41.1
* SUSE Linux Enterprise High Performance Computing LTSS 15 SP5 (aarch64
x86_64)
* ruby2.5-devel-extra-2.5.9-150000.4.41.1
* ruby2.5-stdlib-2.5.9-150000.4.41.1
* ruby2.5-stdlib-debuginfo-2.5.9-150000.4.41.1
* libruby2_5-2_5-debuginfo-2.5.9-150000.4.41.1
* libruby2_5-2_5-2.5.9-150000.4.41.1
* ruby2.5-debugsource-2.5.9-150000.4.41.1
* ruby2.5-debuginfo-2.5.9-150000.4.41.1
* ruby2.5-devel-2.5.9-150000.4.41.1
* ruby2.5-2.5.9-150000.4.41.1
* SUSE Linux Enterprise Server 15 SP3 LTSS (aarch64 ppc64le s390x x86_64)
* ruby2.5-devel-extra-2.5.9-150000.4.41.1
* ruby2.5-stdlib-2.5.9-150000.4.41.1
* ruby2.5-stdlib-debuginfo-2.5.9-150000.4.41.1
* libruby2_5-2_5-debuginfo-2.5.9-150000.4.41.1
* libruby2_5-2_5-2.5.9-150000.4.41.1
* ruby2.5-debugsource-2.5.9-150000.4.41.1
* ruby2.5-debuginfo-2.5.9-150000.4.41.1
* ruby2.5-devel-2.5.9-150000.4.41.1
* ruby2.5-2.5.9-150000.4.41.1
* SUSE Linux Enterprise Server 15 SP4 LTSS (aarch64 ppc64le s390x x86_64)
* ruby2.5-devel-extra-2.5.9-150000.4.41.1
* ruby2.5-stdlib-2.5.9-150000.4.41.1
* ruby2.5-stdlib-debuginfo-2.5.9-150000.4.41.1
* libruby2_5-2_5-debuginfo-2.5.9-150000.4.41.1
* libruby2_5-2_5-2.5.9-150000.4.41.1
* ruby2.5-debugsource-2.5.9-150000.4.41.1
* ruby2.5-debuginfo-2.5.9-150000.4.41.1
* ruby2.5-devel-2.5.9-150000.4.41.1
* ruby2.5-2.5.9-150000.4.41.1

## References:

* https://www.suse.com/security/cve/CVE-2024-47220.html
* https://www.suse.com/security/cve/CVE-2025-27219.html
* https://www.suse.com/security/cve/CVE-2025-27220.html
* https://bugzilla.suse.com/show_bug.cgi?id=1230930
* https://bugzilla.suse.com/show_bug.cgi?id=1235773
* https://bugzilla.suse.com/show_bug.cgi?id=1237804
* https://bugzilla.suse.com/show_bug.cgi?id=1237806


Thunderbird, OpenIDC, OpenStack updates for RHEL

Linux kernel, OpenSSH, Twig updates for Ubuntu

Windows

Linux

macOS

Community

  • dhamu
    Hello Phil, I have a Linux Tutorial website that curre ...
  • StephanX
    Hi friends, i am new in the Linux universe but i try to ...
  • Philipp
    I would try the XanMod kernel: https://xanmod.org  I ...