SUSE-SU-2025:0719-1: moderate: Recommended update for Maven
openSUSE-SU-2025:14833-1: moderate: ffmpeg-4-4.4.5-3.1 on GA media
openSUSE-SU-2025:14836-1: moderate: libiniparser-devel-4.2.6-1.1 on GA media
openSUSE-SU-2025:14835-1: moderate: gnutls-3.8.9-1.1 on GA media
openSUSE-SU-2025:14834-1: moderate: ffmpeg-7-7.1-3.1 on GA media
SUSE-SU-2025:0723-1: moderate: Security update for vim
SUSE-SU-2025:0729-1: important: Security update for xwayland
SUSE-SU-2025:0730-1: important: Security update for xorg-x11-server
SUSE-SU-2025:0731-1: important: Security update for xorg-x11-server
SUSE-SU-2025:0732-1: important: Security update for xorg-x11-server
SUSE-SU-2025:0719-1: moderate: Recommended update for Maven
# Recommended update for Maven
Announcement ID: SUSE-SU-2025:0719-1
Release Date: 2025-02-26T07:26:09Z
Rating: moderate
References:
Cross-References:
* CVE-2020-13936
CVSS scores:
* CVE-2020-13936 ( SUSE ): 8.8 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
* CVE-2020-13936 ( NVD ): 8.8 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Affected Products:
* Development Tools Module 15-SP6
* openSUSE Leap 15.6
* SUSE Enterprise Storage 7.1
* SUSE Linux Enterprise Desktop 15 SP6
* SUSE Linux Enterprise High Performance Computing 15 SP3
* SUSE Linux Enterprise High Performance Computing 15 SP4
* SUSE Linux Enterprise High Performance Computing 15 SP5
* SUSE Linux Enterprise High Performance Computing ESPOS 15 SP4
* SUSE Linux Enterprise High Performance Computing ESPOS 15 SP5
* SUSE Linux Enterprise High Performance Computing LTSS 15 SP3
* SUSE Linux Enterprise High Performance Computing LTSS 15 SP4
* SUSE Linux Enterprise High Performance Computing LTSS 15 SP5
* SUSE Linux Enterprise Real Time 15 SP6
* SUSE Linux Enterprise Server 15 SP3
* SUSE Linux Enterprise Server 15 SP3 LTSS
* SUSE Linux Enterprise Server 15 SP4
* SUSE Linux Enterprise Server 15 SP4 LTSS
* SUSE Linux Enterprise Server 15 SP5
* SUSE Linux Enterprise Server 15 SP5 LTSS
* SUSE Linux Enterprise Server 15 SP6
* SUSE Linux Enterprise Server for SAP Applications 15 SP3
* SUSE Linux Enterprise Server for SAP Applications 15 SP4
* SUSE Linux Enterprise Server for SAP Applications 15 SP5
* SUSE Linux Enterprise Server for SAP Applications 15 SP6
An update that solves one vulnerability can now be installed.
## Description:
This update for Maven fixes the following issues:
maven-dependency-analyzer was updated from version 1.13.2 to 1.15.1:
* Key changes across versions:
* Bug fixes and improved support of dynamic types
* Dependency upgrades (ASM, Maven core, and notably the removal of commons-io)
* Improved error handling by logging instead of failing
* Improved dependency usage tracking
maven-dependency-plugin was updated from version 3.6.0 to 3.8.1:
* Key changes across versions:
* Dependency upgrades on maven-dependency-analyzer and Doxia
* Deprecated dependency:sources in favor of dependency:resolve-sources
* Documentation improvements
* New dependency analysis goal to check for invalid exclusions
* New JSON output option for dependency:tree
* Performance improvements
* Several bug fixes addressing:
* The handling of silent parameters
* The display of the optional flag in the tree
* The clarity of some error messages
maven-doxia-sitetools was updated from version 1.11.1 to 2.0.0:
* Key changes across versions:
* New features:
* Passing the input filename to the parser
* Adding a timezone field to the site descriptor
* Configuring parsers per markup
* Improvements:
* Clarifying site descriptor properties
* Requiring a skin if a site descriptor (site.xml) has been provided
* Optimization of resource handling
* Overhauled locale support
* Refinined menu item display
* Use of Maven Resolver for artifact resolution
* Enhanced Velocity context population
* Automating anchor creation
* Internal changes:
* Migration from Plexus to Sisu
* Upgraded to Java 8
* Removal of deprecated components and features (such as Maven 1.x support, Google-related properties)
* Simplified the site model
* Improved the DocumentRenderer interface/DocumentRenderingContext class API
* Several bug fixes addressing:
* The Plexus to Sisu migration
* Decoration model injection
* Anchor creation
* XML character escaping
* Handling of 0-byte site descriptors
maven-doxia was updated from version 1.12.0 to 2.0.0:
* Key changes across versions:
* Improved HTML5 Support:
* Obsolete attributes and elements were removed
* CSS styles are now used for styling
* XHTML5 is now the default HTML implementation, and XHTML(4) is deprecated
* Improved Markdown Support:
* A new Markdown sink allows converting content to Markdown.
* Support for various Markdown features like blockquotes, footnotes, and metadata has been added
* General Improvements:
* Dependencies were updated
* Doxia was upgraded to Java 8
* Logging and Doxia ID generation were streamlined
* Migration from Plexus to Sisu
* Removed deprecated modules and code
* Several bug fixes addressing:
* HTML5 incorrect output such as tables, styling and missing or improperly handled attributes
* Markdown formatting issues
* Issues with plexus migration
* Incorrect generation of unique IDs
* Incorrect anchor generation for document titles
* Ignored element classes
maven-invoker-plugin was updated from version 3.2.2 to 3.8.1:
* Key changes across versions:
* Commons-lang3 was removed
* Custom Maven executables, external POM files, and more CLI options are now
supported
* Deprecated code was cleaned up
* Doxia was updated, improving HTML generation and adding Markdown support
* Groovy was updated, adding support for JDK 19
* Improved Reporting and Time Handling
* Enhanced syntax support for invoker properties and Maven options
* Java 8 is now the minimum supported version
* Maven 3.6.3 is now the minimum supported version
* Several dependencies were updated or removed
* Snapshot update behavior can be controlled
* Several bug fixes addressing issues with:
* Dependency resolution
* Environment variables
* File handling
* Report generation
* Threading
maven-invoker was updated from version 3.1.0 to 3.3.0:
* Key changes across versions:
* Added several CLI options.
* Added support to disable snapshot updates.
* Added test for inherited environment
* Custom Maven executables
* Deprecated code was removed
* External POM files
* Fixed issues with builder IDs
* Improved timeout handling
* Java 8 is now a requirement
* Tests were migrated to JUnit 5
maven-javadoc-plugin was updated from version 3.6.0 to 3.11.1:
* Key changes across versions:
* Addressed test cleanup and inconsistent default value
* Automatic release detection for older JDKs
* Clarified documentation
* Dependency upgrades of org.codehaus.plexus:plexus-java and Doxia
* Deprecated the "old" parameter
* Improvements include handling of Java 12+ links, user settings with invoker,
and default author value.
* Simplified integration tests.
* Upgraded maven-plugin parent
* Various bug fixes related to:
* Toolchains issues
* Empty JAR creation
* JDK 10 compatibility
* Reactor build failures
* Unit test issues
* Null pointer exception
* Issues with skipped reports
* Stale file detection
* Log4j dependency dowload
* Test repository creation
maven-parent was updated from version 40 to 43:
* Key changes across versions:
* Potentially breaking changes:
* Removed dependency on `maven-plugin-annotations` to better support Maven 4 plugins
* Removed `checkstyle.violation.ignore`
* Improved Java 21 support
* Empty Surefire and PMD reports are now skipped
* Disabled annotation processing by compiler
* Various code cleanup and project restructuring tasks
maven-plugin-tools was updated from version 3.13.0 to 3.15.1:
* Key changes across versions:
* Doxia and Velocity Engine upgrades
* New report-no-fork goal 'report-no-fork' which will not invoke process-
classes
* Deprecation of o.a.m.plugins.annotations.Component
* Improved Maven 3 and Maven 4 support
maven-reporting-api was updated from version 3.1.1 to 4.0.0:
* Key changes across versions:
* API: Allow MavenReportRenderer.render() and MavenReport.canGenerateReport()
to throw exceptions
* Require locales to be non-null
* Improve the MavenReport interface and AbstractMavenReport class
* Removed unused default-report.xml file
maven-reporting-implementation was updated from version 3.2.0 to 4.0.0:
* Key changes across versions include:
* Addressed issues with duplicate calls to canGenerateReport()
* New features such markup output support, flexible section handling and
verbatim source rendering
* Numerous improvements to skinning, rendering, parameter handling, timestamp
population and logging
* Upgrade to Java 8
maven-surefire was updated from version 3.2.5 to 3.5.2:
* Key changes across versions include:
* Addressed issues with JUnit5 test reporting, serialization, classpath
handling and compatibility with newer JDKs.
* Refined handling of system properties, commons-io usage, parallel test
execution and report generation.
* Updated Doxia and commons-compress dependencies
* Improved documentation, including FAQ fixes
plexus-velocity was updated to version 2.1.0:
* Upgraded Velocity Engine to 2.3
* Moved to JUnit5
velocity-engine:
* New package velocity-engine-core implemented at version 2.4
## Patch Instructions:
To install this SUSE update use the SUSE recommended installation methods like
YaST online_update or "zypper patch".
Alternatively you can run the command listed for your product:
* openSUSE Leap 15.6
zypper in -t patch openSUSE-SLE-15.6-2025-719=1
* Development Tools Module 15-SP6
zypper in -t patch SUSE-SLE-Module-Development-Tools-15-SP6-2025-719=1
* SUSE Linux Enterprise High Performance Computing LTSS 15 SP3
zypper in -t patch SUSE-SLE-Product-HPC-15-SP3-LTSS-2025-719=1
* SUSE Linux Enterprise High Performance Computing ESPOS 15 SP4
zypper in -t patch SUSE-SLE-Product-HPC-15-SP4-ESPOS-2025-719=1
* SUSE Linux Enterprise High Performance Computing LTSS 15 SP4
zypper in -t patch SUSE-SLE-Product-HPC-15-SP4-LTSS-2025-719=1
* SUSE Linux Enterprise High Performance Computing ESPOS 15 SP5
zypper in -t patch SUSE-SLE-Product-HPC-15-SP5-ESPOS-2025-719=1
* SUSE Linux Enterprise High Performance Computing LTSS 15 SP5
zypper in -t patch SUSE-SLE-Product-HPC-15-SP5-LTSS-2025-719=1
* SUSE Linux Enterprise Server 15 SP3 LTSS
zypper in -t patch SUSE-SLE-Product-SLES-15-SP3-LTSS-2025-719=1
* SUSE Linux Enterprise Server 15 SP4 LTSS
zypper in -t patch SUSE-SLE-Product-SLES-15-SP4-LTSS-2025-719=1
* SUSE Linux Enterprise Server 15 SP5 LTSS
zypper in -t patch SUSE-SLE-Product-SLES-15-SP5-LTSS-2025-719=1
* SUSE Linux Enterprise Server for SAP Applications 15 SP3
zypper in -t patch SUSE-SLE-Product-SLES_SAP-15-SP3-2025-719=1
* SUSE Linux Enterprise Server for SAP Applications 15 SP4
zypper in -t patch SUSE-SLE-Product-SLES_SAP-15-SP4-2025-719=1
* SUSE Linux Enterprise Server for SAP Applications 15 SP5
zypper in -t patch SUSE-SLE-Product-SLES_SAP-15-SP5-2025-719=1
* SUSE Enterprise Storage 7.1
zypper in -t patch SUSE-Storage-7.1-2025-719=1
## Package List:
* openSUSE Leap 15.6 (noarch)
* maven-doxia-module-apt-2.0.0-150200.4.18.11
* maven-invoker-plugin-3.8.1-150200.3.6.2
* maven-plugin-tools-ant-3.15.1-150200.3.15.12
* maven-surefire-javadoc-3.5.2-150200.3.9.20.12
* maven-plugin-annotations-3.15.1-150200.3.15.12
* plexus-velocity-2.1.0-150200.3.10.3
* maven-surefire-provider-junit5-3.5.2-150200.3.9.20.2
* maven-parent-43-150200.3.8.2
* maven-reporting-impl-4.0.0-150200.4.9.12
* maven-failsafe-plugin-bootstrap-3.5.2-150200.3.9.20.12
* maven-plugin-tools-generators-3.15.1-150200.3.15.12
* maven-surefire-report-parser-3.5.2-150200.3.9.20.12
* maven-plugin-tools-beanshell-3.15.1-150200.3.15.12
* velocity-engine-core-javadoc-2.4-150200.5.3.3
* maven-plugin-tools-model-3.15.1-150200.3.15.12
* maven-invoker-plugin-javadoc-3.8.1-150200.3.6.2
* maven-reporting-impl-javadoc-4.0.0-150200.4.9.12
* velocity-engine-core-2.4-150200.5.3.3
* maven-plugin-tools-annotations-3.15.1-150200.3.15.12
* maven-surefire-provider-junit-3.5.2-150200.3.9.20.12
* maven-javadoc-plugin-3.11.1-150200.4.21.2
* maven-dependency-analyzer-javadoc-1.15.1-150200.3.10.3
* maven-doxia-module-xdoc-2.0.0-150200.4.18.11
* maven-plugin-plugin-bootstrap-3.15.1-150200.3.15.2
* maven-doxia-javadoc-2.0.0-150200.4.18.11
* maven-reporting-api-4.0.0-150200.3.10.12
* plexus-velocity-javadoc-2.1.0-150200.3.10.3
* maven-surefire-report-plugin-bootstrap-3.5.2-150200.3.9.20.12
* maven-plugin-plugin-3.15.1-150200.3.15.2
* maven-doxia-sitetools-2.0.0-150200.3.18.3
* maven-doxia-core-2.0.0-150200.4.18.11
* maven-doxia-test-docs-2.0.0-150200.4.18.11
* maven-script-beanshell-3.15.1-150200.3.15.12
* maven-surefire-plugin-bootstrap-3.5.2-150200.3.9.20.12
* maven-surefire-provider-junit5-javadoc-3.5.2-150200.3.9.20.2
* maven-dependency-plugin-3.8.1-150200.3.10.2
* maven-surefire-3.5.2-150200.3.9.20.12
* maven-invoker-javadoc-3.3.0-150200.3.7.5
* maven-doxia-sink-api-2.0.0-150200.4.18.11
* maven-doxia-module-fml-2.0.0-150200.4.18.11
* maven-plugin-tools-java-3.15.1-150200.3.15.12
* maven-dependency-analyzer-1.15.1-150200.3.10.3
* maven-plugin-tools-api-3.15.1-150200.3.15.12
* maven-plugin-plugin-javadoc-3.15.1-150200.3.15.2
* maven-surefire-report-plugin-3.5.2-150200.3.9.20.2
* maven-dependency-plugin-javadoc-3.8.1-150200.3.10.2
* maven-javadoc-plugin-bootstrap-3.11.1-150200.4.21.2
* maven-surefire-plugins-javadoc-3.5.2-150200.3.9.20.2
* maven-doxia-sitetools-javadoc-2.0.0-150200.3.18.3
* maven-plugin-tools-javadoc-3.15.1-150200.3.15.12
* maven-failsafe-plugin-3.5.2-150200.3.9.20.2
* maven-reporting-api-javadoc-4.0.0-150200.3.10.12
* maven-script-ant-3.15.1-150200.3.15.12
* maven-surefire-provider-testng-3.5.2-150200.3.9.20.12
* maven-javadoc-plugin-javadoc-3.11.1-150200.4.21.2
* maven-doxia-module-xhtml5-2.0.0-150200.4.18.11
* maven-invoker-3.3.0-150200.3.7.5
* maven-surefire-plugin-3.5.2-150200.3.9.20.2
* Development Tools Module 15-SP6 (noarch)
* maven-surefire-plugin-3.5.2-150200.3.9.20.2
* maven-surefire-3.5.2-150200.3.9.20.12
* maven-invoker-3.3.0-150200.3.7.5
* maven-plugin-annotations-3.15.1-150200.3.15.12
* SUSE Linux Enterprise High Performance Computing LTSS 15 SP3 (noarch)
* maven-doxia-module-apt-2.0.0-150200.4.18.11
* maven-surefire-provider-junit-3.5.2-150200.3.9.20.12
* maven-javadoc-plugin-3.11.1-150200.4.21.2
* maven-plugin-annotations-3.15.1-150200.3.15.12
* plexus-velocity-2.1.0-150200.3.10.3
* maven-doxia-module-xdoc-2.0.0-150200.4.18.11
* maven-surefire-3.5.2-150200.3.9.20.12
* maven-surefire-plugin-3.5.2-150200.3.9.20.2
* maven-invoker-3.3.0-150200.3.7.5
* maven-reporting-api-4.0.0-150200.3.10.12
* maven-surefire-provider-testng-3.5.2-150200.3.9.20.12
* velocity-engine-core-2.4-150200.5.3.3
* maven-doxia-sitetools-2.0.0-150200.3.18.3
* maven-doxia-module-xhtml5-2.0.0-150200.4.18.11
* maven-doxia-sink-api-2.0.0-150200.4.18.11
* maven-doxia-core-2.0.0-150200.4.18.11
* maven-doxia-module-fml-2.0.0-150200.4.18.11
* SUSE Linux Enterprise High Performance Computing ESPOS 15 SP4 (noarch)
* maven-doxia-module-apt-2.0.0-150200.4.18.11
* maven-surefire-provider-junit-3.5.2-150200.3.9.20.12
* maven-javadoc-plugin-3.11.1-150200.4.21.2
* maven-plugin-annotations-3.15.1-150200.3.15.12
* plexus-velocity-2.1.0-150200.3.10.3
* maven-doxia-module-xdoc-2.0.0-150200.4.18.11
* maven-surefire-3.5.2-150200.3.9.20.12
* maven-surefire-plugin-3.5.2-150200.3.9.20.2
* maven-invoker-3.3.0-150200.3.7.5
* maven-reporting-api-4.0.0-150200.3.10.12
* maven-surefire-provider-testng-3.5.2-150200.3.9.20.12
* velocity-engine-core-2.4-150200.5.3.3
* maven-doxia-sitetools-2.0.0-150200.3.18.3
* maven-doxia-module-xhtml5-2.0.0-150200.4.18.11
* maven-doxia-sink-api-2.0.0-150200.4.18.11
* maven-doxia-core-2.0.0-150200.4.18.11
* maven-doxia-module-fml-2.0.0-150200.4.18.11
* SUSE Linux Enterprise High Performance Computing LTSS 15 SP4 (noarch)
* maven-doxia-module-apt-2.0.0-150200.4.18.11
* maven-surefire-provider-junit-3.5.2-150200.3.9.20.12
* maven-javadoc-plugin-3.11.1-150200.4.21.2
* maven-plugin-annotations-3.15.1-150200.3.15.12
* plexus-velocity-2.1.0-150200.3.10.3
* maven-doxia-module-xdoc-2.0.0-150200.4.18.11
* maven-surefire-3.5.2-150200.3.9.20.12
* maven-surefire-plugin-3.5.2-150200.3.9.20.2
* maven-invoker-3.3.0-150200.3.7.5
* maven-reporting-api-4.0.0-150200.3.10.12
* maven-surefire-provider-testng-3.5.2-150200.3.9.20.12
* velocity-engine-core-2.4-150200.5.3.3
* maven-doxia-sitetools-2.0.0-150200.3.18.3
* maven-doxia-module-xhtml5-2.0.0-150200.4.18.11
* maven-doxia-sink-api-2.0.0-150200.4.18.11
* maven-doxia-core-2.0.0-150200.4.18.11
* maven-doxia-module-fml-2.0.0-150200.4.18.11
* SUSE Linux Enterprise High Performance Computing ESPOS 15 SP5 (noarch)
* maven-doxia-module-apt-2.0.0-150200.4.18.11
* maven-surefire-provider-junit-3.5.2-150200.3.9.20.12
* maven-javadoc-plugin-3.11.1-150200.4.21.2
* maven-plugin-annotations-3.15.1-150200.3.15.12
* plexus-velocity-2.1.0-150200.3.10.3
* maven-doxia-module-xdoc-2.0.0-150200.4.18.11
* maven-surefire-3.5.2-150200.3.9.20.12
* maven-surefire-plugin-3.5.2-150200.3.9.20.2
* maven-invoker-3.3.0-150200.3.7.5
* maven-reporting-api-4.0.0-150200.3.10.12
* maven-surefire-provider-testng-3.5.2-150200.3.9.20.12
* velocity-engine-core-2.4-150200.5.3.3
* maven-doxia-sitetools-2.0.0-150200.3.18.3
* maven-doxia-module-xhtml5-2.0.0-150200.4.18.11
* maven-doxia-sink-api-2.0.0-150200.4.18.11
* maven-doxia-core-2.0.0-150200.4.18.11
* maven-doxia-module-fml-2.0.0-150200.4.18.11
* SUSE Linux Enterprise High Performance Computing LTSS 15 SP5 (noarch)
* maven-doxia-module-apt-2.0.0-150200.4.18.11
* maven-surefire-provider-junit-3.5.2-150200.3.9.20.12
* maven-javadoc-plugin-3.11.1-150200.4.21.2
* maven-plugin-annotations-3.15.1-150200.3.15.12
* plexus-velocity-2.1.0-150200.3.10.3
* maven-doxia-module-xdoc-2.0.0-150200.4.18.11
* maven-surefire-3.5.2-150200.3.9.20.12
* maven-surefire-plugin-3.5.2-150200.3.9.20.2
* maven-invoker-3.3.0-150200.3.7.5
* maven-reporting-api-4.0.0-150200.3.10.12
* maven-surefire-provider-testng-3.5.2-150200.3.9.20.12
* velocity-engine-core-2.4-150200.5.3.3
* maven-doxia-sitetools-2.0.0-150200.3.18.3
* maven-doxia-module-xhtml5-2.0.0-150200.4.18.11
* maven-doxia-sink-api-2.0.0-150200.4.18.11
* maven-doxia-core-2.0.0-150200.4.18.11
* maven-doxia-module-fml-2.0.0-150200.4.18.11
* SUSE Linux Enterprise Server 15 SP3 LTSS (noarch)
* maven-doxia-module-apt-2.0.0-150200.4.18.11
* maven-surefire-provider-junit-3.5.2-150200.3.9.20.12
* maven-javadoc-plugin-3.11.1-150200.4.21.2
* maven-plugin-annotations-3.15.1-150200.3.15.12
* plexus-velocity-2.1.0-150200.3.10.3
* maven-doxia-module-xdoc-2.0.0-150200.4.18.11
* maven-surefire-3.5.2-150200.3.9.20.12
* maven-surefire-plugin-3.5.2-150200.3.9.20.2
* maven-invoker-3.3.0-150200.3.7.5
* maven-reporting-api-4.0.0-150200.3.10.12
* maven-surefire-provider-testng-3.5.2-150200.3.9.20.12
* velocity-engine-core-2.4-150200.5.3.3
* maven-doxia-sitetools-2.0.0-150200.3.18.3
* maven-doxia-module-xhtml5-2.0.0-150200.4.18.11
* maven-doxia-sink-api-2.0.0-150200.4.18.11
* maven-doxia-core-2.0.0-150200.4.18.11
* maven-doxia-module-fml-2.0.0-150200.4.18.11
* SUSE Linux Enterprise Server 15 SP4 LTSS (noarch)
* maven-doxia-module-apt-2.0.0-150200.4.18.11
* maven-surefire-provider-junit-3.5.2-150200.3.9.20.12
* maven-javadoc-plugin-3.11.1-150200.4.21.2
* maven-plugin-annotations-3.15.1-150200.3.15.12
* plexus-velocity-2.1.0-150200.3.10.3
* maven-doxia-module-xdoc-2.0.0-150200.4.18.11
* maven-surefire-3.5.2-150200.3.9.20.12
* maven-surefire-plugin-3.5.2-150200.3.9.20.2
* maven-invoker-3.3.0-150200.3.7.5
* maven-reporting-api-4.0.0-150200.3.10.12
* maven-surefire-provider-testng-3.5.2-150200.3.9.20.12
* velocity-engine-core-2.4-150200.5.3.3
* maven-doxia-sitetools-2.0.0-150200.3.18.3
* maven-doxia-module-xhtml5-2.0.0-150200.4.18.11
* maven-doxia-sink-api-2.0.0-150200.4.18.11
* maven-doxia-core-2.0.0-150200.4.18.11
* maven-doxia-module-fml-2.0.0-150200.4.18.11
* SUSE Linux Enterprise Server 15 SP5 LTSS (noarch)
* maven-doxia-module-apt-2.0.0-150200.4.18.11
* maven-surefire-provider-junit-3.5.2-150200.3.9.20.12
* maven-javadoc-plugin-3.11.1-150200.4.21.2
* maven-plugin-annotations-3.15.1-150200.3.15.12
* plexus-velocity-2.1.0-150200.3.10.3
* maven-doxia-module-xdoc-2.0.0-150200.4.18.11
* maven-surefire-3.5.2-150200.3.9.20.12
* maven-surefire-plugin-3.5.2-150200.3.9.20.2
* maven-invoker-3.3.0-150200.3.7.5
* maven-reporting-api-4.0.0-150200.3.10.12
* maven-surefire-provider-testng-3.5.2-150200.3.9.20.12
* velocity-engine-core-2.4-150200.5.3.3
* maven-doxia-sitetools-2.0.0-150200.3.18.3
* maven-doxia-module-xhtml5-2.0.0-150200.4.18.11
* maven-doxia-sink-api-2.0.0-150200.4.18.11
* maven-doxia-core-2.0.0-150200.4.18.11
* maven-doxia-module-fml-2.0.0-150200.4.18.11
* SUSE Linux Enterprise Server for SAP Applications 15 SP3 (noarch)
* maven-doxia-module-apt-2.0.0-150200.4.18.11
* maven-surefire-provider-junit-3.5.2-150200.3.9.20.12
* maven-javadoc-plugin-3.11.1-150200.4.21.2
* maven-plugin-annotations-3.15.1-150200.3.15.12
* plexus-velocity-2.1.0-150200.3.10.3
* maven-doxia-module-xdoc-2.0.0-150200.4.18.11
* maven-surefire-3.5.2-150200.3.9.20.12
* maven-surefire-plugin-3.5.2-150200.3.9.20.2
* maven-invoker-3.3.0-150200.3.7.5
* maven-reporting-api-4.0.0-150200.3.10.12
* maven-surefire-provider-testng-3.5.2-150200.3.9.20.12
* velocity-engine-core-2.4-150200.5.3.3
* maven-doxia-sitetools-2.0.0-150200.3.18.3
* maven-doxia-module-xhtml5-2.0.0-150200.4.18.11
* maven-doxia-sink-api-2.0.0-150200.4.18.11
* maven-doxia-core-2.0.0-150200.4.18.11
* maven-doxia-module-fml-2.0.0-150200.4.18.11
* SUSE Linux Enterprise Server for SAP Applications 15 SP4 (noarch)
* maven-doxia-module-apt-2.0.0-150200.4.18.11
* maven-surefire-provider-junit-3.5.2-150200.3.9.20.12
* maven-javadoc-plugin-3.11.1-150200.4.21.2
* maven-plugin-annotations-3.15.1-150200.3.15.12
* plexus-velocity-2.1.0-150200.3.10.3
* maven-doxia-module-xdoc-2.0.0-150200.4.18.11
* maven-surefire-3.5.2-150200.3.9.20.12
* maven-surefire-plugin-3.5.2-150200.3.9.20.2
* maven-invoker-3.3.0-150200.3.7.5
* maven-reporting-api-4.0.0-150200.3.10.12
* maven-surefire-provider-testng-3.5.2-150200.3.9.20.12
* velocity-engine-core-2.4-150200.5.3.3
* maven-doxia-sitetools-2.0.0-150200.3.18.3
* maven-doxia-module-xhtml5-2.0.0-150200.4.18.11
* maven-doxia-sink-api-2.0.0-150200.4.18.11
* maven-doxia-core-2.0.0-150200.4.18.11
* maven-doxia-module-fml-2.0.0-150200.4.18.11
* SUSE Linux Enterprise Server for SAP Applications 15 SP5 (noarch)
* maven-doxia-module-apt-2.0.0-150200.4.18.11
* maven-surefire-provider-junit-3.5.2-150200.3.9.20.12
* maven-javadoc-plugin-3.11.1-150200.4.21.2
* maven-plugin-annotations-3.15.1-150200.3.15.12
* plexus-velocity-2.1.0-150200.3.10.3
* maven-doxia-module-xdoc-2.0.0-150200.4.18.11
* maven-surefire-3.5.2-150200.3.9.20.12
* maven-surefire-plugin-3.5.2-150200.3.9.20.2
* maven-invoker-3.3.0-150200.3.7.5
* maven-reporting-api-4.0.0-150200.3.10.12
* maven-surefire-provider-testng-3.5.2-150200.3.9.20.12
* velocity-engine-core-2.4-150200.5.3.3
* maven-doxia-sitetools-2.0.0-150200.3.18.3
* maven-doxia-module-xhtml5-2.0.0-150200.4.18.11
* maven-doxia-sink-api-2.0.0-150200.4.18.11
* maven-doxia-core-2.0.0-150200.4.18.11
* maven-doxia-module-fml-2.0.0-150200.4.18.11
* SUSE Enterprise Storage 7.1 (noarch)
* maven-doxia-module-apt-2.0.0-150200.4.18.11
* maven-surefire-provider-junit-3.5.2-150200.3.9.20.12
* maven-javadoc-plugin-3.11.1-150200.4.21.2
* maven-plugin-annotations-3.15.1-150200.3.15.12
* plexus-velocity-2.1.0-150200.3.10.3
* maven-doxia-module-xdoc-2.0.0-150200.4.18.11
* maven-surefire-3.5.2-150200.3.9.20.12
* maven-surefire-plugin-3.5.2-150200.3.9.20.2
* maven-invoker-3.3.0-150200.3.7.5
* maven-reporting-api-4.0.0-150200.3.10.12
* maven-surefire-provider-testng-3.5.2-150200.3.9.20.12
* velocity-engine-core-2.4-150200.5.3.3
* maven-doxia-sitetools-2.0.0-150200.3.18.3
* maven-doxia-module-xhtml5-2.0.0-150200.4.18.11
* maven-doxia-sink-api-2.0.0-150200.4.18.11
* maven-doxia-core-2.0.0-150200.4.18.11
* maven-doxia-module-fml-2.0.0-150200.4.18.11
## References:
* https://www.suse.com/security/cve/CVE-2020-13936.html
openSUSE-SU-2025:14833-1: moderate: ffmpeg-4-4.4.5-3.1 on GA media
# ffmpeg-4-4.4.5-3.1 on GA media
Announcement ID: openSUSE-SU-2025:14833-1
Rating: moderate
Cross-References:
* CVE-2024-12361
* CVE-2024-36613
* CVE-2025-0518
* CVE-2025-22919
* CVE-2025-22921
* CVE-2025-25473
CVSS scores:
* CVE-2024-12361 ( SUSE ): 4 CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L
* CVE-2024-12361 ( SUSE ): 5.1 CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N
* CVE-2024-36613 ( SUSE ): 3.9 CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:L/I:N/A:L
* CVE-2024-36613 ( SUSE ): 4.8 CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:A/VC:L/VI:N/VA:L/SC:N/SI:N/SA:N
* CVE-2025-0518 ( SUSE ): 4.3 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N
* CVE-2025-22919 ( SUSE ): 3.3 CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:L
* CVE-2025-22919 ( SUSE ): 4.8 CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:P/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N
* CVE-2025-22921 ( SUSE ): 3.3 CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:L
* CVE-2025-22921 ( SUSE ): 4.8 CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:P/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N
* CVE-2025-25473 ( SUSE ): 0 CVSS:3.1/AV:L/AC:H/PR:N/UI:R/S:U/C:N/I:N/A:N
* CVE-2025-25473 ( SUSE ): 0 CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:N/SC:N/SI:N/SA:N
Affected Products:
* openSUSE Tumbleweed
An update that solves 6 vulnerabilities can now be installed.
## Description:
These are all security issues fixed in the ffmpeg-4-4.4.5-3.1 package on the GA media of openSUSE Tumbleweed.
## Package List:
* openSUSE Tumbleweed:
* ffmpeg-4 4.4.5-3.1
* ffmpeg-4-libavcodec-devel 4.4.5-3.1
* ffmpeg-4-libavdevice-devel 4.4.5-3.1
* ffmpeg-4-libavfilter-devel 4.4.5-3.1
* ffmpeg-4-libavformat-devel 4.4.5-3.1
* ffmpeg-4-libavresample-devel 4.4.5-3.1
* ffmpeg-4-libavutil-devel 4.4.5-3.1
* ffmpeg-4-libpostproc-devel 4.4.5-3.1
* ffmpeg-4-libswresample-devel 4.4.5-3.1
* ffmpeg-4-libswscale-devel 4.4.5-3.1
* ffmpeg-4-private-devel 4.4.5-3.1
* libavcodec58_134 4.4.5-3.1
* libavcodec58_134-32bit 4.4.5-3.1
* libavdevice58_13 4.4.5-3.1
* libavdevice58_13-32bit 4.4.5-3.1
* libavfilter7_110 4.4.5-3.1
* libavfilter7_110-32bit 4.4.5-3.1
* libavformat58_76 4.4.5-3.1
* libavformat58_76-32bit 4.4.5-3.1
* libavresample4_0 4.4.5-3.1
* libavresample4_0-32bit 4.4.5-3.1
* libavutil56_70 4.4.5-3.1
* libavutil56_70-32bit 4.4.5-3.1
* libpostproc55_9 4.4.5-3.1
* libpostproc55_9-32bit 4.4.5-3.1
* libswresample3_9 4.4.5-3.1
* libswresample3_9-32bit 4.4.5-3.1
* libswscale5_9 4.4.5-3.1
* libswscale5_9-32bit 4.4.5-3.1
## References:
* https://www.suse.com/security/cve/CVE-2024-12361.html
* https://www.suse.com/security/cve/CVE-2024-36613.html
* https://www.suse.com/security/cve/CVE-2025-0518.html
* https://www.suse.com/security/cve/CVE-2025-22919.html
* https://www.suse.com/security/cve/CVE-2025-22921.html
* https://www.suse.com/security/cve/CVE-2025-25473.html
openSUSE-SU-2025:14836-1: moderate: libiniparser-devel-4.2.6-1.1 on GA media
# libiniparser-devel-4.2.6-1.1 on GA media
Announcement ID: openSUSE-SU-2025:14836-1
Rating: moderate
Cross-References:
* CVE-2025-0633
CVSS scores:
* CVE-2025-0633 ( SUSE ): 5.1 CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:L
* CVE-2025-0633 ( SUSE ): 5.1 CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:L/SC:N/SI:N/SA:N
Affected Products:
* openSUSE Tumbleweed
An update that solves one vulnerability can now be installed.
## Description:
These are all security issues fixed in the libiniparser-devel-4.2.6-1.1 package on the GA media of openSUSE Tumbleweed.
## Package List:
* openSUSE Tumbleweed:
* libiniparser-devel 4.2.6-1.1
* libiniparser4 4.2.6-1.1
## References:
* https://www.suse.com/security/cve/CVE-2025-0633.html
openSUSE-SU-2025:14835-1: moderate: gnutls-3.8.9-1.1 on GA media
# gnutls-3.8.9-1.1 on GA media
Announcement ID: openSUSE-SU-2025:14835-1
Rating: moderate
Cross-References:
* CVE-2024-12133
* CVE-2024-12243
CVSS scores:
* CVE-2024-12133 ( SUSE ): 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
* CVE-2024-12133 ( SUSE ): 8.2 CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N
* CVE-2024-12243 ( SUSE ): 5.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L
* CVE-2024-12243 ( SUSE ): 5.3 CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N
Affected Products:
* openSUSE Tumbleweed
An update that solves 2 vulnerabilities can now be installed.
## Description:
These are all security issues fixed in the gnutls-3.8.9-1.1 package on the GA media of openSUSE Tumbleweed.
## Package List:
* openSUSE Tumbleweed:
* gnutls 3.8.9-1.1
* libgnutls-dane-devel 3.8.9-1.1
* libgnutls-dane0 3.8.9-1.1
* libgnutls-devel 3.8.9-1.1
* libgnutls-devel-32bit 3.8.9-1.1
* libgnutls-devel-doc 3.8.9-1.1
* libgnutls30 3.8.9-1.1
* libgnutls30-32bit 3.8.9-1.1
* libgnutlsxx-devel 3.8.9-1.1
* libgnutlsxx30 3.8.9-1.1
## References:
* https://www.suse.com/security/cve/CVE-2024-12133.html
* https://www.suse.com/security/cve/CVE-2024-12243.html
openSUSE-SU-2025:14834-1: moderate: ffmpeg-7-7.1-3.1 on GA media
# ffmpeg-7-7.1-3.1 on GA media
Announcement ID: openSUSE-SU-2025:14834-1
Rating: moderate
Cross-References:
* CVE-2024-12361
* CVE-2024-35365
* CVE-2024-36613
* CVE-2025-0518
* CVE-2025-22919
* CVE-2025-22920
* CVE-2025-22921
* CVE-2025-25473
CVSS scores:
* CVE-2024-12361 ( SUSE ): 4 CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L
* CVE-2024-12361 ( SUSE ): 5.1 CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N
* CVE-2024-35365 ( SUSE ): 4.6 CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:U/C:L/I:L/A:L
* CVE-2024-35365 ( SUSE ): 2 CVSS:4.0/AV:N/AC:H/AT:N/PR:L/UI:A/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N
* CVE-2024-36613 ( SUSE ): 3.9 CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:L/I:N/A:L
* CVE-2024-36613 ( SUSE ): 4.8 CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:A/VC:L/VI:N/VA:L/SC:N/SI:N/SA:N
* CVE-2025-0518 ( SUSE ): 4.3 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N
* CVE-2025-22919 ( SUSE ): 3.3 CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:L
* CVE-2025-22919 ( SUSE ): 4.8 CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:P/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N
* CVE-2025-22920 ( SUSE ): 3.3 CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:L
* CVE-2025-22920 ( SUSE ): 4.8 CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:P/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N
* CVE-2025-22921 ( SUSE ): 3.3 CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:L
* CVE-2025-22921 ( SUSE ): 4.8 CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:P/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N
* CVE-2025-25473 ( SUSE ): 0 CVSS:3.1/AV:L/AC:H/PR:N/UI:R/S:U/C:N/I:N/A:N
* CVE-2025-25473 ( SUSE ): 0 CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:N/SC:N/SI:N/SA:N
Affected Products:
* openSUSE Tumbleweed
An update that solves 8 vulnerabilities can now be installed.
## Description:
These are all security issues fixed in the ffmpeg-7-7.1-3.1 package on the GA media of openSUSE Tumbleweed.
## Package List:
* openSUSE Tumbleweed:
* ffmpeg-7 7.1-3.1
* ffmpeg-7-libavcodec-devel 7.1-3.1
* ffmpeg-7-libavdevice-devel 7.1-3.1
* ffmpeg-7-libavfilter-devel 7.1-3.1
* ffmpeg-7-libavformat-devel 7.1-3.1
* ffmpeg-7-libavutil-devel 7.1-3.1
* ffmpeg-7-libpostproc-devel 7.1-3.1
* ffmpeg-7-libswresample-devel 7.1-3.1
* ffmpeg-7-libswscale-devel 7.1-3.1
* libavcodec61 7.1-3.1
* libavcodec61-32bit 7.1-3.1
* libavdevice61 7.1-3.1
* libavdevice61-32bit 7.1-3.1
* libavfilter10 7.1-3.1
* libavfilter10-32bit 7.1-3.1
* libavformat61 7.1-3.1
* libavformat61-32bit 7.1-3.1
* libavutil59 7.1-3.1
* libavutil59-32bit 7.1-3.1
* libpostproc58 7.1-3.1
* libpostproc58-32bit 7.1-3.1
* libswresample5 7.1-3.1
* libswresample5-32bit 7.1-3.1
* libswscale8 7.1-3.1
* libswscale8-32bit 7.1-3.1
## References:
* https://www.suse.com/security/cve/CVE-2024-12361.html
* https://www.suse.com/security/cve/CVE-2024-35365.html
* https://www.suse.com/security/cve/CVE-2024-36613.html
* https://www.suse.com/security/cve/CVE-2025-0518.html
* https://www.suse.com/security/cve/CVE-2025-22919.html
* https://www.suse.com/security/cve/CVE-2025-22920.html
* https://www.suse.com/security/cve/CVE-2025-22921.html
* https://www.suse.com/security/cve/CVE-2025-25473.html
SUSE-SU-2025:0723-1: moderate: Security update for vim
# Security update for vim
Announcement ID: SUSE-SU-2025:0723-1
Release Date: 2025-02-26T13:29:54Z
Rating: moderate
References:
* bsc#1229685
* bsc#1229822
* bsc#1230078
* bsc#1235695
* bsc#1236151
* bsc#1237137
Cross-References:
* CVE-2024-43790
* CVE-2024-43802
* CVE-2024-45306
* CVE-2025-1215
* CVE-2025-22134
* CVE-2025-24014
CVSS scores:
* CVE-2024-43790 ( SUSE ): 2.0
CVSS:4.0/AV:L/AC:H/AT:N/PR:N/UI:P/VC:L/VI:L/VA:L/SC:L/SI:L/SA:L
* CVE-2024-43790 ( SUSE ): 4.5 CVSS:3.1/AV:L/AC:H/PR:N/UI:R/S:U/C:L/I:L/A:L
* CVE-2024-43802 ( SUSE ): 4.6
CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:A/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N
* CVE-2024-43802 ( SUSE ): 4.5 CVSS:3.1/AV:L/AC:H/PR:N/UI:R/S:U/C:L/I:L/A:L
* CVE-2024-45306 ( SUSE ): 4.1
CVSS:4.0/AV:L/AC:H/AT:N/PR:L/UI:A/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N
* CVE-2024-45306 ( SUSE ): 4.4 CVSS:3.1/AV:L/AC:H/PR:L/UI:R/S:U/C:N/I:N/A:H
* CVE-2024-45306 ( NVD ): 5.5 CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H
* CVE-2024-45306 ( NVD ): 4.5 CVSS:3.1/AV:L/AC:H/PR:N/UI:R/S:U/C:L/I:L/A:L
* CVE-2025-1215 ( SUSE ): 2.4
CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:P/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N
* CVE-2025-1215 ( SUSE ): 2.8 CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:N/I:N/A:L
* CVE-2025-1215 ( NVD ): 2.4
CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:P/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
* CVE-2025-1215 ( NVD ): 2.8 CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:N/I:N/A:L
* CVE-2025-22134 ( SUSE ): 1.0
CVSS:4.0/AV:L/AC:H/AT:P/PR:L/UI:A/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N
* CVE-2025-22134 ( SUSE ): 4.2 CVSS:3.1/AV:L/AC:H/PR:L/UI:R/S:U/C:L/I:L/A:L
* CVE-2025-22134 ( NVD ): 4.2 CVSS:3.1/AV:L/AC:H/PR:L/UI:R/S:U/C:L/I:L/A:L
* CVE-2025-24014 ( SUSE ): 1.0
CVSS:4.0/AV:L/AC:H/AT:P/PR:L/UI:A/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N
* CVE-2025-24014 ( SUSE ): 4.2 CVSS:3.1/AV:L/AC:H/PR:L/UI:R/S:U/C:L/I:L/A:L
* CVE-2025-24014 ( NVD ): 4.2 CVSS:3.1/AV:L/AC:H/PR:L/UI:R/S:U/C:L/I:L/A:L
Affected Products:
* Basesystem Module 15-SP6
* Desktop Applications Module 15-SP6
* openSUSE Leap 15.5
* openSUSE Leap 15.6
* SUSE Linux Enterprise Desktop 15 SP6
* SUSE Linux Enterprise Micro 5.5
* SUSE Linux Enterprise Real Time 15 SP6
* SUSE Linux Enterprise Server 15 SP6
* SUSE Linux Enterprise Server for SAP Applications 15 SP6
An update that solves six vulnerabilities can now be installed.
## Description:
This update for vim fixes the following issues:
Update to version 9.1.1101:
* CVE-2024-43790: possible out-of-bounds read when performing a search command
(bsc#1229685).
* CVE-2024-43802: heap buffer overflow due to incorrect flushing of the
typeahead buffer (bsc#1229822).
* CVE-2024-45306: heap buffer overflow when cursor position is invalid
(bsc#1230078).
* CVE-2025-22134: heap buffer overflow when switching to other buffers using
the :all command with active visual mode (bsc#1235695).
* CVE-2025-24014: NULL pointer dereference may lead to segmentation fault when
in silent Ex mode (bsc#1236151).
* CVE-2025-1215: memory corruption when manipulating the --log argument
(bsc#1237137).
## Patch Instructions:
To install this SUSE update use the SUSE recommended installation methods like
YaST online_update or "zypper patch".
Alternatively you can run the command listed for your product:
* openSUSE Leap 15.5
zypper in -t patch SUSE-2025-723=1
* openSUSE Leap 15.6
zypper in -t patch openSUSE-SLE-15.6-2025-723=1
* SUSE Linux Enterprise Micro 5.5
zypper in -t patch SUSE-SLE-Micro-5.5-2025-723=1
* Basesystem Module 15-SP6
zypper in -t patch SUSE-SLE-Module-Basesystem-15-SP6-2025-723=1
* Desktop Applications Module 15-SP6
zypper in -t patch SUSE-SLE-Module-Desktop-Applications-15-SP6-2025-723=1
## Package List:
* openSUSE Leap 15.5 (aarch64 ppc64le s390x x86_64 i586)
* vim-9.1.1101-150500.20.21.1
* vim-small-debuginfo-9.1.1101-150500.20.21.1
* vim-debuginfo-9.1.1101-150500.20.21.1
* gvim-debuginfo-9.1.1101-150500.20.21.1
* gvim-9.1.1101-150500.20.21.1
* vim-small-9.1.1101-150500.20.21.1
* vim-debugsource-9.1.1101-150500.20.21.1
* openSUSE Leap 15.5 (noarch)
* vim-data-common-9.1.1101-150500.20.21.1
* vim-data-9.1.1101-150500.20.21.1
* openSUSE Leap 15.6 (aarch64 ppc64le s390x x86_64)
* vim-9.1.1101-150500.20.21.1
* vim-small-debuginfo-9.1.1101-150500.20.21.1
* vim-debuginfo-9.1.1101-150500.20.21.1
* gvim-debuginfo-9.1.1101-150500.20.21.1
* gvim-9.1.1101-150500.20.21.1
* vim-small-9.1.1101-150500.20.21.1
* vim-debugsource-9.1.1101-150500.20.21.1
* openSUSE Leap 15.6 (noarch)
* vim-data-common-9.1.1101-150500.20.21.1
* vim-data-9.1.1101-150500.20.21.1
* SUSE Linux Enterprise Micro 5.5 (noarch)
* vim-data-common-9.1.1101-150500.20.21.1
* SUSE Linux Enterprise Micro 5.5 (aarch64 ppc64le s390x x86_64)
* vim-small-debuginfo-9.1.1101-150500.20.21.1
* vim-small-9.1.1101-150500.20.21.1
* vim-debugsource-9.1.1101-150500.20.21.1
* vim-debuginfo-9.1.1101-150500.20.21.1
* Basesystem Module 15-SP6 (aarch64 ppc64le s390x x86_64)
* vim-9.1.1101-150500.20.21.1
* vim-small-debuginfo-9.1.1101-150500.20.21.1
* vim-debuginfo-9.1.1101-150500.20.21.1
* vim-small-9.1.1101-150500.20.21.1
* vim-debugsource-9.1.1101-150500.20.21.1
* Basesystem Module 15-SP6 (noarch)
* vim-data-common-9.1.1101-150500.20.21.1
* vim-data-9.1.1101-150500.20.21.1
* Desktop Applications Module 15-SP6 (aarch64 ppc64le s390x x86_64)
* vim-debuginfo-9.1.1101-150500.20.21.1
* gvim-9.1.1101-150500.20.21.1
* vim-debugsource-9.1.1101-150500.20.21.1
* gvim-debuginfo-9.1.1101-150500.20.21.1
## References:
* https://www.suse.com/security/cve/CVE-2024-43790.html
* https://www.suse.com/security/cve/CVE-2024-43802.html
* https://www.suse.com/security/cve/CVE-2024-45306.html
* https://www.suse.com/security/cve/CVE-2025-1215.html
* https://www.suse.com/security/cve/CVE-2025-22134.html
* https://www.suse.com/security/cve/CVE-2025-24014.html
* https://bugzilla.suse.com/show_bug.cgi?id=1229685
* https://bugzilla.suse.com/show_bug.cgi?id=1229822
* https://bugzilla.suse.com/show_bug.cgi?id=1230078
* https://bugzilla.suse.com/show_bug.cgi?id=1235695
* https://bugzilla.suse.com/show_bug.cgi?id=1236151
* https://bugzilla.suse.com/show_bug.cgi?id=1237137
SUSE-SU-2025:0729-1: important: Security update for xwayland
# Security update for xwayland
Announcement ID: SUSE-SU-2025:0729-1
Release Date: 2025-02-26T14:14:35Z
Rating: important
References:
* bsc#1237427
* bsc#1237429
* bsc#1237430
* bsc#1237431
* bsc#1237432
* bsc#1237433
* bsc#1237434
* bsc#1237435
Cross-References:
* CVE-2025-26594
* CVE-2025-26595
* CVE-2025-26596
* CVE-2025-26597
* CVE-2025-26598
* CVE-2025-26599
* CVE-2025-26600
* CVE-2025-26601
CVSS scores:
* CVE-2025-26594 ( SUSE ): 7.3
CVSS:4.0/AV:L/AC:H/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:L/SI:L/SA:L
* CVE-2025-26594 ( SUSE ): 7.8 CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:H
* CVE-2025-26594 ( NVD ): 7.8 CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
* CVE-2025-26595 ( SUSE ): 6.8
CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N
* CVE-2025-26595 ( SUSE ): 5.5 CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N
* CVE-2025-26595 ( NVD ): 7.8 CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
* CVE-2025-26596 ( SUSE ): 6.8
CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N
* CVE-2025-26596 ( SUSE ): 5.5 CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
* CVE-2025-26596 ( NVD ): 7.8 CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
* CVE-2025-26597 ( SUSE ): 6.8
CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N
* CVE-2025-26597 ( SUSE ): 5.5 CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N
* CVE-2025-26597 ( NVD ): 7.8 CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
* CVE-2025-26598 ( SUSE ): 5.8
CVSS:4.0/AV:L/AC:H/AT:N/PR:L/UI:N/VC:N/VI:H/VA:L/SC:N/SI:N/SA:N
* CVE-2025-26598 ( SUSE ): 5.3 CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:N/I:H/A:L
* CVE-2025-26598 ( NVD ): 7.8 CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
* CVE-2025-26599 ( SUSE ): 5.8
CVSS:4.0/AV:L/AC:H/AT:N/PR:L/UI:N/VC:N/VI:H/VA:L/SC:N/SI:N/SA:N
* CVE-2025-26599 ( SUSE ): 5.3 CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:N/I:H/A:L
* CVE-2025-26599 ( NVD ): 7.8 CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
* CVE-2025-26600 ( SUSE ): 7.3
CVSS:4.0/AV:L/AC:H/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N
* CVE-2025-26600 ( SUSE ): 7.0 CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H
* CVE-2025-26600 ( NVD ): 7.8 CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
* CVE-2025-26601 ( SUSE ): 7.3
CVSS:4.0/AV:L/AC:H/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N
* CVE-2025-26601 ( SUSE ): 7.0 CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H
* CVE-2025-26601 ( NVD ): 7.8 CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Affected Products:
* openSUSE Leap 15.6
* SUSE Linux Enterprise Desktop 15 SP6
* SUSE Linux Enterprise Server 15 SP6
* SUSE Linux Enterprise Server for SAP Applications 15 SP6
* SUSE Linux Enterprise Workstation Extension 15 SP6
An update that solves eight vulnerabilities can now be installed.
## Description:
This update for xwayland fixes the following issues:
* CVE-2025-26594: Use-after-free of the root cursor (bsc#1237427).
* CVE-2025-26595: Buffer overflow in XkbVModMaskText() (bsc#1237429).
* CVE-2025-26596: Heap overflow in XkbWriteKeySyms() (bsc#1237430).
* CVE-2025-26597: Buffer overflow in XkbChangeTypesOfKey() (bsc#1237431).
* CVE-2025-26598: Out-of-bounds write in CreatePointerBarrierClient()
(bsc#1237432).
* CVE-2025-26599: Use of uninitialized pointer in compRedirectWindow()
(bsc#1237433).
* CVE-2025-26600: Use-after-free in PlayReleasedEvents() (bsc#1237434).
* CVE-2025-26601: Use-after-free in SyncInitTrigger() (bsc#1237435).
## Patch Instructions:
To install this SUSE update use the SUSE recommended installation methods like
YaST online_update or "zypper patch".
Alternatively you can run the command listed for your product:
* openSUSE Leap 15.6
zypper in -t patch openSUSE-SLE-15.6-2025-729=1 SUSE-2025-729=1
* SUSE Linux Enterprise Workstation Extension 15 SP6
zypper in -t patch SUSE-SLE-Product-WE-15-SP6-2025-729=1
## Package List:
* openSUSE Leap 15.6 (aarch64 ppc64le s390x x86_64 i586)
* xwayland-devel-24.1.1-150600.5.9.1
* xwayland-24.1.1-150600.5.9.1
* xwayland-debuginfo-24.1.1-150600.5.9.1
* xwayland-debugsource-24.1.1-150600.5.9.1
* SUSE Linux Enterprise Workstation Extension 15 SP6 (x86_64)
* xwayland-24.1.1-150600.5.9.1
* xwayland-debuginfo-24.1.1-150600.5.9.1
* xwayland-debugsource-24.1.1-150600.5.9.1
## References:
* https://www.suse.com/security/cve/CVE-2025-26594.html
* https://www.suse.com/security/cve/CVE-2025-26595.html
* https://www.suse.com/security/cve/CVE-2025-26596.html
* https://www.suse.com/security/cve/CVE-2025-26597.html
* https://www.suse.com/security/cve/CVE-2025-26598.html
* https://www.suse.com/security/cve/CVE-2025-26599.html
* https://www.suse.com/security/cve/CVE-2025-26600.html
* https://www.suse.com/security/cve/CVE-2025-26601.html
* https://bugzilla.suse.com/show_bug.cgi?id=1237427
* https://bugzilla.suse.com/show_bug.cgi?id=1237429
* https://bugzilla.suse.com/show_bug.cgi?id=1237430
* https://bugzilla.suse.com/show_bug.cgi?id=1237431
* https://bugzilla.suse.com/show_bug.cgi?id=1237432
* https://bugzilla.suse.com/show_bug.cgi?id=1237433
* https://bugzilla.suse.com/show_bug.cgi?id=1237434
* https://bugzilla.suse.com/show_bug.cgi?id=1237435
SUSE-SU-2025:0730-1: important: Security update for xorg-x11-server
# Security update for xorg-x11-server
Announcement ID: SUSE-SU-2025:0730-1
Release Date: 2025-02-26T14:29:29Z
Rating: important
References:
* bsc#1237427
* bsc#1237429
* bsc#1237430
* bsc#1237431
* bsc#1237432
* bsc#1237433
* bsc#1237434
* bsc#1237435
Cross-References:
* CVE-2025-26594
* CVE-2025-26595
* CVE-2025-26596
* CVE-2025-26597
* CVE-2025-26598
* CVE-2025-26599
* CVE-2025-26600
* CVE-2025-26601
CVSS scores:
* CVE-2025-26594 ( SUSE ): 7.3
CVSS:4.0/AV:L/AC:H/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:L/SI:L/SA:L
* CVE-2025-26594 ( SUSE ): 7.8 CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:H
* CVE-2025-26594 ( NVD ): 7.8 CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
* CVE-2025-26595 ( SUSE ): 6.8
CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N
* CVE-2025-26595 ( SUSE ): 5.5 CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N
* CVE-2025-26595 ( NVD ): 7.8 CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
* CVE-2025-26596 ( SUSE ): 6.8
CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N
* CVE-2025-26596 ( SUSE ): 5.5 CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
* CVE-2025-26596 ( NVD ): 7.8 CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
* CVE-2025-26597 ( SUSE ): 6.8
CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N
* CVE-2025-26597 ( SUSE ): 5.5 CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N
* CVE-2025-26597 ( NVD ): 7.8 CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
* CVE-2025-26598 ( SUSE ): 5.8
CVSS:4.0/AV:L/AC:H/AT:N/PR:L/UI:N/VC:N/VI:H/VA:L/SC:N/SI:N/SA:N
* CVE-2025-26598 ( SUSE ): 5.3 CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:N/I:H/A:L
* CVE-2025-26598 ( NVD ): 7.8 CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
* CVE-2025-26599 ( SUSE ): 5.8
CVSS:4.0/AV:L/AC:H/AT:N/PR:L/UI:N/VC:N/VI:H/VA:L/SC:N/SI:N/SA:N
* CVE-2025-26599 ( SUSE ): 5.3 CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:N/I:H/A:L
* CVE-2025-26599 ( NVD ): 7.8 CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
* CVE-2025-26600 ( SUSE ): 7.3
CVSS:4.0/AV:L/AC:H/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N
* CVE-2025-26600 ( SUSE ): 7.0 CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H
* CVE-2025-26600 ( NVD ): 7.8 CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
* CVE-2025-26601 ( SUSE ): 7.3
CVSS:4.0/AV:L/AC:H/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N
* CVE-2025-26601 ( SUSE ): 7.0 CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H
* CVE-2025-26601 ( NVD ): 7.8 CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Affected Products:
* Basesystem Module 15-SP6
* Development Tools Module 15-SP6
* openSUSE Leap 15.6
* SUSE Linux Enterprise Desktop 15 SP6
* SUSE Linux Enterprise Real Time 15 SP6
* SUSE Linux Enterprise Server 15 SP6
* SUSE Linux Enterprise Server for SAP Applications 15 SP6
An update that solves eight vulnerabilities can now be installed.
## Description:
This update for xorg-x11-server fixes the following issues:
* CVE-2025-26594: Use-after-free of the root cursor (bsc#1237427).
* CVE-2025-26595: Buffer overflow in XkbVModMaskText() (bsc#1237429).
* CVE-2025-26596: Heap overflow in XkbWriteKeySyms() (bsc#1237430).
* CVE-2025-26597: Buffer overflow in XkbChangeTypesOfKey() (bsc#1237431).
* CVE-2025-26598: Out-of-bounds write in CreatePointerBarrierClient()
(bsc#1237432).
* CVE-2025-26599: Use of uninitialized pointer in compRedirectWindow()
(bsc#1237433).
* CVE-2025-26600: Use-after-free in PlayReleasedEvents() (bsc#1237434).
* CVE-2025-26601: Use-after-free in SyncInitTrigger() (bsc#1237435).
## Patch Instructions:
To install this SUSE update use the SUSE recommended installation methods like
YaST online_update or "zypper patch".
Alternatively you can run the command listed for your product:
* openSUSE Leap 15.6
zypper in -t patch SUSE-2025-730=1 openSUSE-SLE-15.6-2025-730=1
* Basesystem Module 15-SP6
zypper in -t patch SUSE-SLE-Module-Basesystem-15-SP6-2025-730=1
* Development Tools Module 15-SP6
zypper in -t patch SUSE-SLE-Module-Development-Tools-15-SP6-2025-730=1
## Package List:
* openSUSE Leap 15.6 (aarch64 ppc64le s390x x86_64 i586)
* xorg-x11-server-extra-debuginfo-21.1.11-150600.5.6.1
* xorg-x11-server-sdk-21.1.11-150600.5.6.1
* xorg-x11-server-source-21.1.11-150600.5.6.1
* xorg-x11-server-Xvfb-21.1.11-150600.5.6.1
* xorg-x11-server-extra-21.1.11-150600.5.6.1
* xorg-x11-server-debugsource-21.1.11-150600.5.6.1
* xorg-x11-server-21.1.11-150600.5.6.1
* xorg-x11-server-Xvfb-debuginfo-21.1.11-150600.5.6.1
* xorg-x11-server-debuginfo-21.1.11-150600.5.6.1
* Basesystem Module 15-SP6 (aarch64 ppc64le s390x x86_64)
* xorg-x11-server-extra-debuginfo-21.1.11-150600.5.6.1
* xorg-x11-server-Xvfb-21.1.11-150600.5.6.1
* xorg-x11-server-extra-21.1.11-150600.5.6.1
* xorg-x11-server-debugsource-21.1.11-150600.5.6.1
* xorg-x11-server-21.1.11-150600.5.6.1
* xorg-x11-server-Xvfb-debuginfo-21.1.11-150600.5.6.1
* xorg-x11-server-debuginfo-21.1.11-150600.5.6.1
* Development Tools Module 15-SP6 (aarch64 ppc64le s390x x86_64)
* xorg-x11-server-debuginfo-21.1.11-150600.5.6.1
* xorg-x11-server-debugsource-21.1.11-150600.5.6.1
* xorg-x11-server-sdk-21.1.11-150600.5.6.1
## References:
* https://www.suse.com/security/cve/CVE-2025-26594.html
* https://www.suse.com/security/cve/CVE-2025-26595.html
* https://www.suse.com/security/cve/CVE-2025-26596.html
* https://www.suse.com/security/cve/CVE-2025-26597.html
* https://www.suse.com/security/cve/CVE-2025-26598.html
* https://www.suse.com/security/cve/CVE-2025-26599.html
* https://www.suse.com/security/cve/CVE-2025-26600.html
* https://www.suse.com/security/cve/CVE-2025-26601.html
* https://bugzilla.suse.com/show_bug.cgi?id=1237427
* https://bugzilla.suse.com/show_bug.cgi?id=1237429
* https://bugzilla.suse.com/show_bug.cgi?id=1237430
* https://bugzilla.suse.com/show_bug.cgi?id=1237431
* https://bugzilla.suse.com/show_bug.cgi?id=1237432
* https://bugzilla.suse.com/show_bug.cgi?id=1237433
* https://bugzilla.suse.com/show_bug.cgi?id=1237434
* https://bugzilla.suse.com/show_bug.cgi?id=1237435
SUSE-SU-2025:0731-1: important: Security update for xorg-x11-server
# Security update for xorg-x11-server
Announcement ID: SUSE-SU-2025:0731-1
Release Date: 2025-02-26T14:30:17Z
Rating: important
References:
* bsc#1237427
* bsc#1237429
* bsc#1237430
* bsc#1237431
* bsc#1237432
* bsc#1237433
* bsc#1237434
* bsc#1237435
Cross-References:
* CVE-2025-26594
* CVE-2025-26595
* CVE-2025-26596
* CVE-2025-26597
* CVE-2025-26598
* CVE-2025-26599
* CVE-2025-26600
* CVE-2025-26601
CVSS scores:
* CVE-2025-26594 ( SUSE ): 7.3
CVSS:4.0/AV:L/AC:H/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:L/SI:L/SA:L
* CVE-2025-26594 ( SUSE ): 7.8 CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:H
* CVE-2025-26594 ( NVD ): 7.8 CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
* CVE-2025-26595 ( SUSE ): 6.8
CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N
* CVE-2025-26595 ( SUSE ): 5.5 CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N
* CVE-2025-26595 ( NVD ): 7.8 CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
* CVE-2025-26596 ( SUSE ): 6.8
CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N
* CVE-2025-26596 ( SUSE ): 5.5 CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
* CVE-2025-26596 ( NVD ): 7.8 CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
* CVE-2025-26597 ( SUSE ): 6.8
CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N
* CVE-2025-26597 ( SUSE ): 5.5 CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N
* CVE-2025-26597 ( NVD ): 7.8 CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
* CVE-2025-26598 ( SUSE ): 5.8
CVSS:4.0/AV:L/AC:H/AT:N/PR:L/UI:N/VC:N/VI:H/VA:L/SC:N/SI:N/SA:N
* CVE-2025-26598 ( SUSE ): 5.3 CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:N/I:H/A:L
* CVE-2025-26598 ( NVD ): 7.8 CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
* CVE-2025-26599 ( SUSE ): 5.8
CVSS:4.0/AV:L/AC:H/AT:N/PR:L/UI:N/VC:N/VI:H/VA:L/SC:N/SI:N/SA:N
* CVE-2025-26599 ( SUSE ): 5.3 CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:N/I:H/A:L
* CVE-2025-26599 ( NVD ): 7.8 CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
* CVE-2025-26600 ( SUSE ): 7.3
CVSS:4.0/AV:L/AC:H/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N
* CVE-2025-26600 ( SUSE ): 7.0 CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H
* CVE-2025-26600 ( NVD ): 7.8 CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
* CVE-2025-26601 ( SUSE ): 7.3
CVSS:4.0/AV:L/AC:H/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N
* CVE-2025-26601 ( SUSE ): 7.0 CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H
* CVE-2025-26601 ( NVD ): 7.8 CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Affected Products:
* openSUSE Leap 15.5
* SUSE Linux Enterprise High Performance Computing 15 SP5
* SUSE Linux Enterprise High Performance Computing ESPOS 15 SP5
* SUSE Linux Enterprise High Performance Computing LTSS 15 SP5
* SUSE Linux Enterprise Server 15 SP5
* SUSE Linux Enterprise Server 15 SP5 LTSS
* SUSE Linux Enterprise Server for SAP Applications 15 SP5
An update that solves eight vulnerabilities can now be installed.
## Description:
This update for xorg-x11-server fixes the following issues:
* CVE-2025-26594: Use-after-free of the root cursor (bsc#1237427).
* CVE-2025-26595: Buffer overflow in XkbVModMaskText() (bsc#1237429).
* CVE-2025-26596: Heap overflow in XkbWriteKeySyms() (bsc#1237430).
* CVE-2025-26597: Buffer overflow in XkbChangeTypesOfKey() (bsc#1237431).
* CVE-2025-26598: Out-of-bounds write in CreatePointerBarrierClient()
(bsc#1237432).
* CVE-2025-26599: Use of uninitialized pointer in compRedirectWindow()
(bsc#1237433).
* CVE-2025-26600: Use-after-free in PlayReleasedEvents() (bsc#1237434).
* CVE-2025-26601: Use-after-free in SyncInitTrigger() (bsc#1237435).
## Patch Instructions:
To install this SUSE update use the SUSE recommended installation methods like
YaST online_update or "zypper patch".
Alternatively you can run the command listed for your product:
* SUSE Linux Enterprise High Performance Computing LTSS 15 SP5
zypper in -t patch SUSE-SLE-Product-HPC-15-SP5-LTSS-2025-731=1
* SUSE Linux Enterprise Server 15 SP5 LTSS
zypper in -t patch SUSE-SLE-Product-SLES-15-SP5-LTSS-2025-731=1
* SUSE Linux Enterprise Server for SAP Applications 15 SP5
zypper in -t patch SUSE-SLE-Product-SLES_SAP-15-SP5-2025-731=1
* openSUSE Leap 15.5
zypper in -t patch SUSE-2025-731=1
* SUSE Linux Enterprise High Performance Computing ESPOS 15 SP5
zypper in -t patch SUSE-SLE-Product-HPC-15-SP5-ESPOS-2025-731=1
## Package List:
* SUSE Linux Enterprise High Performance Computing LTSS 15 SP5 (aarch64
x86_64)
* xorg-x11-server-Xvfb-debuginfo-21.1.4-150500.7.32.1
* xorg-x11-server-extra-21.1.4-150500.7.32.1
* xorg-x11-server-21.1.4-150500.7.32.1
* xorg-x11-server-debuginfo-21.1.4-150500.7.32.1
* xorg-x11-server-sdk-21.1.4-150500.7.32.1
* xorg-x11-server-debugsource-21.1.4-150500.7.32.1
* xorg-x11-server-extra-debuginfo-21.1.4-150500.7.32.1
* xorg-x11-server-Xvfb-21.1.4-150500.7.32.1
* SUSE Linux Enterprise Server 15 SP5 LTSS (aarch64 ppc64le s390x x86_64)
* xorg-x11-server-Xvfb-debuginfo-21.1.4-150500.7.32.1
* xorg-x11-server-extra-21.1.4-150500.7.32.1
* xorg-x11-server-21.1.4-150500.7.32.1
* xorg-x11-server-debuginfo-21.1.4-150500.7.32.1
* xorg-x11-server-sdk-21.1.4-150500.7.32.1
* xorg-x11-server-debugsource-21.1.4-150500.7.32.1
* xorg-x11-server-extra-debuginfo-21.1.4-150500.7.32.1
* xorg-x11-server-Xvfb-21.1.4-150500.7.32.1
* SUSE Linux Enterprise Server for SAP Applications 15 SP5 (ppc64le x86_64)
* xorg-x11-server-Xvfb-debuginfo-21.1.4-150500.7.32.1
* xorg-x11-server-extra-21.1.4-150500.7.32.1
* xorg-x11-server-21.1.4-150500.7.32.1
* xorg-x11-server-debuginfo-21.1.4-150500.7.32.1
* xorg-x11-server-sdk-21.1.4-150500.7.32.1
* xorg-x11-server-debugsource-21.1.4-150500.7.32.1
* xorg-x11-server-extra-debuginfo-21.1.4-150500.7.32.1
* xorg-x11-server-Xvfb-21.1.4-150500.7.32.1
* openSUSE Leap 15.5 (aarch64 ppc64le s390x x86_64 i586)
* xorg-x11-server-Xvfb-debuginfo-21.1.4-150500.7.32.1
* xorg-x11-server-extra-21.1.4-150500.7.32.1
* xorg-x11-server-source-21.1.4-150500.7.32.1
* xorg-x11-server-21.1.4-150500.7.32.1
* xorg-x11-server-debuginfo-21.1.4-150500.7.32.1
* xorg-x11-server-sdk-21.1.4-150500.7.32.1
* xorg-x11-server-debugsource-21.1.4-150500.7.32.1
* xorg-x11-server-extra-debuginfo-21.1.4-150500.7.32.1
* xorg-x11-server-Xvfb-21.1.4-150500.7.32.1
* SUSE Linux Enterprise High Performance Computing ESPOS 15 SP5 (aarch64
x86_64)
* xorg-x11-server-Xvfb-debuginfo-21.1.4-150500.7.32.1
* xorg-x11-server-extra-21.1.4-150500.7.32.1
* xorg-x11-server-21.1.4-150500.7.32.1
* xorg-x11-server-debuginfo-21.1.4-150500.7.32.1
* xorg-x11-server-sdk-21.1.4-150500.7.32.1
* xorg-x11-server-debugsource-21.1.4-150500.7.32.1
* xorg-x11-server-extra-debuginfo-21.1.4-150500.7.32.1
* xorg-x11-server-Xvfb-21.1.4-150500.7.32.1
## References:
* https://www.suse.com/security/cve/CVE-2025-26594.html
* https://www.suse.com/security/cve/CVE-2025-26595.html
* https://www.suse.com/security/cve/CVE-2025-26596.html
* https://www.suse.com/security/cve/CVE-2025-26597.html
* https://www.suse.com/security/cve/CVE-2025-26598.html
* https://www.suse.com/security/cve/CVE-2025-26599.html
* https://www.suse.com/security/cve/CVE-2025-26600.html
* https://www.suse.com/security/cve/CVE-2025-26601.html
* https://bugzilla.suse.com/show_bug.cgi?id=1237427
* https://bugzilla.suse.com/show_bug.cgi?id=1237429
* https://bugzilla.suse.com/show_bug.cgi?id=1237430
* https://bugzilla.suse.com/show_bug.cgi?id=1237431
* https://bugzilla.suse.com/show_bug.cgi?id=1237432
* https://bugzilla.suse.com/show_bug.cgi?id=1237433
* https://bugzilla.suse.com/show_bug.cgi?id=1237434
* https://bugzilla.suse.com/show_bug.cgi?id=1237435
SUSE-SU-2025:0732-1: important: Security update for xorg-x11-server
# Security update for xorg-x11-server
Announcement ID: SUSE-SU-2025:0732-1
Release Date: 2025-02-26T14:31:33Z
Rating: important
References:
* bsc#1237427
* bsc#1237429
* bsc#1237430
* bsc#1237431
* bsc#1237432
* bsc#1237433
* bsc#1237434
* bsc#1237435
Cross-References:
* CVE-2025-26594
* CVE-2025-26595
* CVE-2025-26596
* CVE-2025-26597
* CVE-2025-26598
* CVE-2025-26599
* CVE-2025-26600
* CVE-2025-26601
CVSS scores:
* CVE-2025-26594 ( SUSE ): 7.3
CVSS:4.0/AV:L/AC:H/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:L/SI:L/SA:L
* CVE-2025-26594 ( SUSE ): 7.8 CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:H
* CVE-2025-26594 ( NVD ): 7.8 CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
* CVE-2025-26595 ( SUSE ): 6.8
CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N
* CVE-2025-26595 ( SUSE ): 5.5 CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N
* CVE-2025-26595 ( NVD ): 7.8 CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
* CVE-2025-26596 ( SUSE ): 6.8
CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N
* CVE-2025-26596 ( SUSE ): 5.5 CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
* CVE-2025-26596 ( NVD ): 7.8 CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
* CVE-2025-26597 ( SUSE ): 6.8
CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N
* CVE-2025-26597 ( SUSE ): 5.5 CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N
* CVE-2025-26597 ( NVD ): 7.8 CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
* CVE-2025-26598 ( SUSE ): 5.8
CVSS:4.0/AV:L/AC:H/AT:N/PR:L/UI:N/VC:N/VI:H/VA:L/SC:N/SI:N/SA:N
* CVE-2025-26598 ( SUSE ): 5.3 CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:N/I:H/A:L
* CVE-2025-26598 ( NVD ): 7.8 CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
* CVE-2025-26599 ( SUSE ): 5.8
CVSS:4.0/AV:L/AC:H/AT:N/PR:L/UI:N/VC:N/VI:H/VA:L/SC:N/SI:N/SA:N
* CVE-2025-26599 ( SUSE ): 5.3 CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:N/I:H/A:L
* CVE-2025-26599 ( NVD ): 7.8 CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
* CVE-2025-26600 ( SUSE ): 7.3
CVSS:4.0/AV:L/AC:H/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N
* CVE-2025-26600 ( SUSE ): 7.0 CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H
* CVE-2025-26600 ( NVD ): 7.8 CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
* CVE-2025-26601 ( SUSE ): 7.3
CVSS:4.0/AV:L/AC:H/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N
* CVE-2025-26601 ( SUSE ): 7.0 CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H
* CVE-2025-26601 ( NVD ): 7.8 CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Affected Products:
* openSUSE Leap 15.4
* SUSE Linux Enterprise High Performance Computing 15 SP4
* SUSE Linux Enterprise High Performance Computing ESPOS 15 SP4
* SUSE Linux Enterprise High Performance Computing LTSS 15 SP4
* SUSE Linux Enterprise Server 15 SP4
* SUSE Linux Enterprise Server 15 SP4 LTSS
* SUSE Linux Enterprise Server for SAP Applications 15 SP4
* SUSE Manager Proxy 4.3
* SUSE Manager Retail Branch Server 4.3
* SUSE Manager Server 4.3
An update that solves eight vulnerabilities can now be installed.
## Description:
This update for xorg-x11-server fixes the following issues:
* CVE-2025-26594: Use-after-free of the root cursor (bsc#1237427).
* CVE-2025-26595: Buffer overflow in XkbVModMaskText() (bsc#1237429).
* CVE-2025-26596: Heap overflow in XkbWriteKeySyms() (bsc#1237430).
* CVE-2025-26597: Buffer overflow in XkbChangeTypesOfKey() (bsc#1237431).
* CVE-2025-26598: Out-of-bounds write in CreatePointerBarrierClient()
(bsc#1237432).
* CVE-2025-26599: Use of uninitialized pointer in compRedirectWindow()
(bsc#1237433).
* CVE-2025-26600: Use-after-free in PlayReleasedEvents() (bsc#1237434).
* CVE-2025-26601: Use-after-free in SyncInitTrigger() (bsc#1237435).
## Patch Instructions:
To install this SUSE update use the SUSE recommended installation methods like
YaST online_update or "zypper patch".
Alternatively you can run the command listed for your product:
* openSUSE Leap 15.4
zypper in -t patch SUSE-2025-732=1
* SUSE Linux Enterprise High Performance Computing ESPOS 15 SP4
zypper in -t patch SUSE-SLE-Product-HPC-15-SP4-ESPOS-2025-732=1
* SUSE Linux Enterprise High Performance Computing LTSS 15 SP4
zypper in -t patch SUSE-SLE-Product-HPC-15-SP4-LTSS-2025-732=1
* SUSE Linux Enterprise Server 15 SP4 LTSS
zypper in -t patch SUSE-SLE-Product-SLES-15-SP4-LTSS-2025-732=1
* SUSE Linux Enterprise Server for SAP Applications 15 SP4
zypper in -t patch SUSE-SLE-Product-SLES_SAP-15-SP4-2025-732=1
* SUSE Manager Proxy 4.3
zypper in -t patch SUSE-SLE-Product-SUSE-Manager-Proxy-4.3-2025-732=1
* SUSE Manager Retail Branch Server 4.3
zypper in -t patch SUSE-SLE-Product-SUSE-Manager-Retail-Branch-
Server-4.3-2025-732=1
* SUSE Manager Server 4.3
zypper in -t patch SUSE-SLE-Product-SUSE-Manager-Server-4.3-2025-732=1
## Package List:
* openSUSE Leap 15.4 (aarch64 ppc64le s390x x86_64 i586)
* xorg-x11-server-extra-1.20.3-150400.38.54.1
* xorg-x11-server-1.20.3-150400.38.54.1
* xorg-x11-server-debuginfo-1.20.3-150400.38.54.1
* xorg-x11-server-extra-debuginfo-1.20.3-150400.38.54.1
* xorg-x11-server-sdk-1.20.3-150400.38.54.1
* xorg-x11-server-debugsource-1.20.3-150400.38.54.1
* xorg-x11-server-source-1.20.3-150400.38.54.1
* SUSE Linux Enterprise High Performance Computing ESPOS 15 SP4 (aarch64
x86_64)
* xorg-x11-server-extra-1.20.3-150400.38.54.1
* xorg-x11-server-1.20.3-150400.38.54.1
* xorg-x11-server-debuginfo-1.20.3-150400.38.54.1
* xorg-x11-server-extra-debuginfo-1.20.3-150400.38.54.1
* xorg-x11-server-sdk-1.20.3-150400.38.54.1
* xorg-x11-server-debugsource-1.20.3-150400.38.54.1
* SUSE Linux Enterprise High Performance Computing LTSS 15 SP4 (aarch64
x86_64)
* xorg-x11-server-extra-1.20.3-150400.38.54.1
* xorg-x11-server-1.20.3-150400.38.54.1
* xorg-x11-server-debuginfo-1.20.3-150400.38.54.1
* xorg-x11-server-extra-debuginfo-1.20.3-150400.38.54.1
* xorg-x11-server-sdk-1.20.3-150400.38.54.1
* xorg-x11-server-debugsource-1.20.3-150400.38.54.1
* SUSE Linux Enterprise Server 15 SP4 LTSS (aarch64 ppc64le s390x x86_64)
* xorg-x11-server-extra-1.20.3-150400.38.54.1
* xorg-x11-server-1.20.3-150400.38.54.1
* xorg-x11-server-debuginfo-1.20.3-150400.38.54.1
* xorg-x11-server-extra-debuginfo-1.20.3-150400.38.54.1
* xorg-x11-server-sdk-1.20.3-150400.38.54.1
* xorg-x11-server-debugsource-1.20.3-150400.38.54.1
* SUSE Linux Enterprise Server for SAP Applications 15 SP4 (ppc64le x86_64)
* xorg-x11-server-extra-1.20.3-150400.38.54.1
* xorg-x11-server-1.20.3-150400.38.54.1
* xorg-x11-server-debuginfo-1.20.3-150400.38.54.1
* xorg-x11-server-extra-debuginfo-1.20.3-150400.38.54.1
* xorg-x11-server-sdk-1.20.3-150400.38.54.1
* xorg-x11-server-debugsource-1.20.3-150400.38.54.1
* SUSE Manager Proxy 4.3 (x86_64)
* xorg-x11-server-extra-1.20.3-150400.38.54.1
* xorg-x11-server-1.20.3-150400.38.54.1
* xorg-x11-server-debuginfo-1.20.3-150400.38.54.1
* xorg-x11-server-extra-debuginfo-1.20.3-150400.38.54.1
* xorg-x11-server-debugsource-1.20.3-150400.38.54.1
* SUSE Manager Retail Branch Server 4.3 (x86_64)
* xorg-x11-server-extra-1.20.3-150400.38.54.1
* xorg-x11-server-1.20.3-150400.38.54.1
* xorg-x11-server-debuginfo-1.20.3-150400.38.54.1
* xorg-x11-server-extra-debuginfo-1.20.3-150400.38.54.1
* xorg-x11-server-debugsource-1.20.3-150400.38.54.1
* SUSE Manager Server 4.3 (ppc64le s390x x86_64)
* xorg-x11-server-extra-1.20.3-150400.38.54.1
* xorg-x11-server-1.20.3-150400.38.54.1
* xorg-x11-server-debuginfo-1.20.3-150400.38.54.1
* xorg-x11-server-extra-debuginfo-1.20.3-150400.38.54.1
* xorg-x11-server-debugsource-1.20.3-150400.38.54.1
## References:
* https://www.suse.com/security/cve/CVE-2025-26594.html
* https://www.suse.com/security/cve/CVE-2025-26595.html
* https://www.suse.com/security/cve/CVE-2025-26596.html
* https://www.suse.com/security/cve/CVE-2025-26597.html
* https://www.suse.com/security/cve/CVE-2025-26598.html
* https://www.suse.com/security/cve/CVE-2025-26599.html
* https://www.suse.com/security/cve/CVE-2025-26600.html
* https://www.suse.com/security/cve/CVE-2025-26601.html
* https://bugzilla.suse.com/show_bug.cgi?id=1237427
* https://bugzilla.suse.com/show_bug.cgi?id=1237429
* https://bugzilla.suse.com/show_bug.cgi?id=1237430
* https://bugzilla.suse.com/show_bug.cgi?id=1237431
* https://bugzilla.suse.com/show_bug.cgi?id=1237432
* https://bugzilla.suse.com/show_bug.cgi?id=1237433
* https://bugzilla.suse.com/show_bug.cgi?id=1237434
* https://bugzilla.suse.com/show_bug.cgi?id=1237435
