SUSE-SU-2024:3731-1: important: Security update for MozillaThunderbird
SUSE-SU-2024:3728-1: moderate: Security update for buildah
SUSE-SU-2024:3729-1: moderate: Security update for php8
SUSE-SU-2024:3733-1: moderate: Security update for php7
openSUSE-SU-2024:0337-1: important: Security update for chromium
SUSE-SU-2024:3731-1: important: Security update for MozillaThunderbird
# Security update for MozillaThunderbird
Announcement ID: SUSE-SU-2024:3731-1
Release Date: 2024-10-18T14:29:54Z
Rating: important
References:
* bsc#1231413
Cross-References:
* CVE-2024-9680
CVSS scores:
* CVE-2024-9680 ( SUSE ): 7.3
CVSS:4.0/AV:L/AC:H/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N
* CVE-2024-9680 ( SUSE ): 7.8 CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
* CVE-2024-9680 ( NVD ): 9.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
* CVE-2024-9680 ( NVD ): 9.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Affected Products:
* openSUSE Leap 15.5
* openSUSE Leap 15.6
* SUSE Linux Enterprise Desktop 15 SP4 LTSS 15-SP4
* SUSE Linux Enterprise Desktop 15 SP5
* SUSE Linux Enterprise Desktop 15 SP6
* SUSE Linux Enterprise High Performance Computing 15 SP5
* SUSE Linux Enterprise Micro 5.5
* SUSE Linux Enterprise Real Time 15 SP5
* SUSE Linux Enterprise Real Time 15 SP6
* SUSE Linux Enterprise Server 15 SP5
* SUSE Linux Enterprise Server 15 SP6
* SUSE Linux Enterprise Server for SAP Applications 15 SP5
* SUSE Linux Enterprise Server for SAP Applications 15 SP6
* SUSE Linux Enterprise Workstation Extension 15 SP5
* SUSE Linux Enterprise Workstation Extension 15 SP6
* SUSE Package Hub 15 15-SP5
* SUSE Package Hub 15 15-SP6
An update that solves one vulnerability can now be installed.
## Description:
This update for MozillaThunderbird fixes the following issues:
Update to Mozilla Thunderbird 128.3.1 (MFSA 2024-52, bsc#1231413):
* CVE-2024-9680: Fixed use-after-free in Animation timeline (bmo#1923344)
## Patch Instructions:
To install this SUSE update use the SUSE recommended installation methods like
YaST online_update or "zypper patch".
Alternatively you can run the command listed for your product:
* openSUSE Leap 15.5
zypper in -t patch openSUSE-SLE-15.5-2024-3731=1
* openSUSE Leap 15.6
zypper in -t patch openSUSE-SLE-15.6-2024-3731=1
* SUSE Package Hub 15 15-SP5
zypper in -t patch SUSE-SLE-Module-Packagehub-Subpackages-15-SP5-2024-3731=1
* SUSE Package Hub 15 15-SP6
zypper in -t patch SUSE-SLE-Module-Packagehub-Subpackages-15-SP6-2024-3731=1
* SUSE Linux Enterprise Desktop 15 SP4 LTSS 15-SP4
zypper in -t patch SUSE-SLE-Product-SLED-15-SP4-LTSS-2024-3731=1
* SUSE Linux Enterprise Workstation Extension 15 SP5
zypper in -t patch SUSE-SLE-Product-WE-15-SP5-2024-3731=1
* SUSE Linux Enterprise Workstation Extension 15 SP6
zypper in -t patch SUSE-SLE-Product-WE-15-SP6-2024-3731=1
## Package List:
* openSUSE Leap 15.5 (aarch64 ppc64le s390x x86_64)
* MozillaThunderbird-128.3.1-150200.8.185.1
* MozillaThunderbird-translations-other-128.3.1-150200.8.185.1
* MozillaThunderbird-debugsource-128.3.1-150200.8.185.1
* MozillaThunderbird-translations-common-128.3.1-150200.8.185.1
* MozillaThunderbird-debuginfo-128.3.1-150200.8.185.1
* openSUSE Leap 15.6 (aarch64 ppc64le s390x x86_64)
* MozillaThunderbird-128.3.1-150200.8.185.1
* MozillaThunderbird-translations-other-128.3.1-150200.8.185.1
* MozillaThunderbird-debugsource-128.3.1-150200.8.185.1
* MozillaThunderbird-translations-common-128.3.1-150200.8.185.1
* MozillaThunderbird-debuginfo-128.3.1-150200.8.185.1
* SUSE Package Hub 15 15-SP5 (aarch64 ppc64le s390x)
* MozillaThunderbird-128.3.1-150200.8.185.1
* MozillaThunderbird-translations-other-128.3.1-150200.8.185.1
* MozillaThunderbird-debugsource-128.3.1-150200.8.185.1
* MozillaThunderbird-translations-common-128.3.1-150200.8.185.1
* MozillaThunderbird-debuginfo-128.3.1-150200.8.185.1
* SUSE Package Hub 15 15-SP6 (aarch64 ppc64le s390x)
* MozillaThunderbird-128.3.1-150200.8.185.1
* MozillaThunderbird-translations-other-128.3.1-150200.8.185.1
* MozillaThunderbird-debugsource-128.3.1-150200.8.185.1
* MozillaThunderbird-translations-common-128.3.1-150200.8.185.1
* MozillaThunderbird-debuginfo-128.3.1-150200.8.185.1
* SUSE Linux Enterprise Desktop 15 SP4 LTSS 15-SP4 (x86_64)
* MozillaThunderbird-128.3.1-150200.8.185.1
* MozillaThunderbird-translations-other-128.3.1-150200.8.185.1
* MozillaThunderbird-debugsource-128.3.1-150200.8.185.1
* MozillaThunderbird-translations-common-128.3.1-150200.8.185.1
* MozillaThunderbird-debuginfo-128.3.1-150200.8.185.1
* SUSE Linux Enterprise Workstation Extension 15 SP5 (x86_64)
* MozillaThunderbird-128.3.1-150200.8.185.1
* MozillaThunderbird-translations-other-128.3.1-150200.8.185.1
* MozillaThunderbird-debugsource-128.3.1-150200.8.185.1
* MozillaThunderbird-translations-common-128.3.1-150200.8.185.1
* MozillaThunderbird-debuginfo-128.3.1-150200.8.185.1
* SUSE Linux Enterprise Workstation Extension 15 SP6 (x86_64)
* MozillaThunderbird-128.3.1-150200.8.185.1
* MozillaThunderbird-translations-other-128.3.1-150200.8.185.1
* MozillaThunderbird-debugsource-128.3.1-150200.8.185.1
* MozillaThunderbird-translations-common-128.3.1-150200.8.185.1
* MozillaThunderbird-debuginfo-128.3.1-150200.8.185.1
## References:
* https://www.suse.com/security/cve/CVE-2024-9680.html
* https://bugzilla.suse.com/show_bug.cgi?id=1231413
SUSE-SU-2024:3728-1: moderate: Security update for buildah
# Security update for buildah
Announcement ID: SUSE-SU-2024:3728-1
Release Date: 2024-10-18T13:15:57Z
Rating: moderate
References:
* bsc#1231499
Cross-References:
* CVE-2024-9675
CVSS scores:
* CVE-2024-9675 ( SUSE ): 4.8
CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:N/SC:L/SI:L/SA:N
* CVE-2024-9675 ( SUSE ): 4.4 CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N
* CVE-2024-9675 ( NVD ): 4.4 CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N
Affected Products:
* Containers Module 15-SP5
* Containers Module 15-SP6
* openSUSE Leap 15.5
* openSUSE Leap 15.6
* SUSE Linux Enterprise High Performance Computing 15 SP5
* SUSE Linux Enterprise Real Time 15 SP5
* SUSE Linux Enterprise Real Time 15 SP6
* SUSE Linux Enterprise Server 15 SP5
* SUSE Linux Enterprise Server 15 SP6
* SUSE Linux Enterprise Server for SAP Applications 15 SP5
* SUSE Linux Enterprise Server for SAP Applications 15 SP6
An update that solves one vulnerability can now be installed.
## Description:
This update for buildah fixes the following issues:
* CVE-2024-9675: Fixed arbitrary cache directory mount (bsc#1231499)
## Patch Instructions:
To install this SUSE update use the SUSE recommended installation methods like
YaST online_update or "zypper patch".
Alternatively you can run the command listed for your product:
* openSUSE Leap 15.5
zypper in -t patch SUSE-2024-3728=1 openSUSE-SLE-15.5-2024-3728=1
* openSUSE Leap 15.6
zypper in -t patch openSUSE-SLE-15.6-2024-3728=1
* Containers Module 15-SP5
zypper in -t patch SUSE-SLE-Module-Containers-15-SP5-2024-3728=1
* Containers Module 15-SP6
zypper in -t patch SUSE-SLE-Module-Containers-15-SP6-2024-3728=1
## Package List:
* openSUSE Leap 15.5 (aarch64 ppc64le s390x x86_64 i586)
* buildah-1.35.4-150500.3.16.1
* openSUSE Leap 15.6 (aarch64 ppc64le s390x x86_64)
* buildah-1.35.4-150500.3.16.1
* Containers Module 15-SP5 (aarch64 ppc64le s390x x86_64)
* buildah-1.35.4-150500.3.16.1
* Containers Module 15-SP6 (aarch64 ppc64le s390x x86_64)
* buildah-1.35.4-150500.3.16.1
## References:
* https://www.suse.com/security/cve/CVE-2024-9675.html
* https://bugzilla.suse.com/show_bug.cgi?id=1231499
SUSE-SU-2024:3729-1: moderate: Security update for php8
# Security update for php8
Announcement ID: SUSE-SU-2024:3729-1
Release Date: 2024-10-18T13:23:01Z
Rating: moderate
References:
* bsc#1231358
* bsc#1231360
* bsc#1231382
Cross-References:
* CVE-2024-8925
* CVE-2024-8927
* CVE-2024-9026
CVSS scores:
* CVE-2024-8925 ( SUSE ): 6.3
CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N
* CVE-2024-8925 ( SUSE ): 3.7 CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:N
* CVE-2024-8925 ( NVD ): 3.1 CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:N/I:L/A:N
* CVE-2024-8925 ( NVD ): 5.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N
* CVE-2024-8927 ( SUSE ): 6.9
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N
* CVE-2024-8927 ( SUSE ): 6.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N
* CVE-2024-8927 ( NVD ): 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
* CVE-2024-8927 ( NVD ): 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
* CVE-2024-9026 ( SUSE ): 4.8
CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N
* CVE-2024-9026 ( SUSE ): 3.3 CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N
* CVE-2024-9026 ( NVD ): 3.3 CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N
* CVE-2024-9026 ( NVD ): 3.3 CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N
Affected Products:
* openSUSE Leap 15.6
* SUSE Linux Enterprise Server 15 SP6
* SUSE Linux Enterprise Server for SAP Applications 15 SP6
* Web and Scripting Module 15-SP6
An update that solves three vulnerabilities can now be installed.
## Description:
This update for php8 fixes the following issues:
Update to php 8.2.24:
* CVE-2024-8925: Fixed erroneous parsing of multipart form data in HTTP POST
requests leads to legitimate data not being processed (bsc#1231360)
* CVE-2024-8927: Fixed cgi.force_redirect configuration is bypassable due to
an environment variable collision (bsc#1231358)
* CVE-2024-9026: Fixed pollution of worker output logs in PHP-FPM
(bsc#1231382)
## Patch Instructions:
To install this SUSE update use the SUSE recommended installation methods like
YaST online_update or "zypper patch".
Alternatively you can run the command listed for your product:
* Web and Scripting Module 15-SP6
zypper in -t patch SUSE-SLE-Module-Web-Scripting-15-SP6-2024-3729=1
* openSUSE Leap 15.6
zypper in -t patch SUSE-2024-3729=1 openSUSE-SLE-15.6-2024-3729=1
## Package List:
* Web and Scripting Module 15-SP6 (aarch64 ppc64le s390x x86_64)
* php8-pgsql-debuginfo-8.2.24-150600.3.6.1
* php8-opcache-8.2.24-150600.3.6.1
* php8-ldap-8.2.24-150600.3.6.1
* php8-fpm-debuginfo-8.2.24-150600.3.6.1
* php8-sysvshm-debuginfo-8.2.24-150600.3.6.1
* php8-tidy-8.2.24-150600.3.6.1
* php8-iconv-8.2.24-150600.3.6.1
* php8-fpm-debugsource-8.2.24-150600.3.6.1
* php8-tokenizer-debuginfo-8.2.24-150600.3.6.1
* php8-embed-8.2.24-150600.3.6.1
* php8-odbc-8.2.24-150600.3.6.1
* php8-readline-debuginfo-8.2.24-150600.3.6.1
* php8-dom-debuginfo-8.2.24-150600.3.6.1
* php8-zip-8.2.24-150600.3.6.1
* php8-devel-8.2.24-150600.3.6.1
* php8-sqlite-8.2.24-150600.3.6.1
* php8-embed-debuginfo-8.2.24-150600.3.6.1
* php8-gettext-debuginfo-8.2.24-150600.3.6.1
* php8-sysvsem-debuginfo-8.2.24-150600.3.6.1
* php8-fpm-8.2.24-150600.3.6.1
* php8-pdo-8.2.24-150600.3.6.1
* php8-sysvsem-8.2.24-150600.3.6.1
* php8-snmp-8.2.24-150600.3.6.1
* apache2-mod_php8-debuginfo-8.2.24-150600.3.6.1
* php8-sqlite-debuginfo-8.2.24-150600.3.6.1
* php8-cli-8.2.24-150600.3.6.1
* php8-gmp-debuginfo-8.2.24-150600.3.6.1
* php8-enchant-debuginfo-8.2.24-150600.3.6.1
* php8-sysvshm-8.2.24-150600.3.6.1
* php8-sodium-debuginfo-8.2.24-150600.3.6.1
* php8-bcmath-8.2.24-150600.3.6.1
* php8-mysql-debuginfo-8.2.24-150600.3.6.1
* php8-zlib-8.2.24-150600.3.6.1
* php8-posix-debuginfo-8.2.24-150600.3.6.1
* php8-pcntl-8.2.24-150600.3.6.1
* php8-xmlreader-debuginfo-8.2.24-150600.3.6.1
* php8-shmop-debuginfo-8.2.24-150600.3.6.1
* php8-soap-debuginfo-8.2.24-150600.3.6.1
* php8-tidy-debuginfo-8.2.24-150600.3.6.1
* php8-enchant-8.2.24-150600.3.6.1
* php8-mbstring-8.2.24-150600.3.6.1
* php8-sysvmsg-debuginfo-8.2.24-150600.3.6.1
* php8-intl-debuginfo-8.2.24-150600.3.6.1
* php8-dba-8.2.24-150600.3.6.1
* php8-curl-8.2.24-150600.3.6.1
* php8-fileinfo-8.2.24-150600.3.6.1
* php8-ctype-8.2.24-150600.3.6.1
* php8-8.2.24-150600.3.6.1
* php8-ldap-debuginfo-8.2.24-150600.3.6.1
* php8-sockets-8.2.24-150600.3.6.1
* php8-soap-8.2.24-150600.3.6.1
* php8-readline-8.2.24-150600.3.6.1
* php8-pgsql-8.2.24-150600.3.6.1
* php8-ftp-8.2.24-150600.3.6.1
* php8-sodium-8.2.24-150600.3.6.1
* php8-exif-debuginfo-8.2.24-150600.3.6.1
* php8-xmlwriter-debuginfo-8.2.24-150600.3.6.1
* php8-xmlwriter-8.2.24-150600.3.6.1
* php8-curl-debuginfo-8.2.24-150600.3.6.1
* php8-gmp-8.2.24-150600.3.6.1
* php8-zip-debuginfo-8.2.24-150600.3.6.1
* php8-calendar-debuginfo-8.2.24-150600.3.6.1
* php8-debugsource-8.2.24-150600.3.6.1
* php8-bz2-8.2.24-150600.3.6.1
* php8-shmop-8.2.24-150600.3.6.1
* php8-gd-8.2.24-150600.3.6.1
* php8-mysql-8.2.24-150600.3.6.1
* php8-opcache-debuginfo-8.2.24-150600.3.6.1
* php8-xmlreader-8.2.24-150600.3.6.1
* php8-xsl-8.2.24-150600.3.6.1
* php8-odbc-debuginfo-8.2.24-150600.3.6.1
* php8-debuginfo-8.2.24-150600.3.6.1
* php8-bz2-debuginfo-8.2.24-150600.3.6.1
* php8-fastcgi-debuginfo-8.2.24-150600.3.6.1
* php8-bcmath-debuginfo-8.2.24-150600.3.6.1
* php8-test-8.2.24-150600.3.6.1
* php8-embed-debugsource-8.2.24-150600.3.6.1
* php8-gd-debuginfo-8.2.24-150600.3.6.1
* php8-snmp-debuginfo-8.2.24-150600.3.6.1
* php8-xsl-debuginfo-8.2.24-150600.3.6.1
* php8-phar-debuginfo-8.2.24-150600.3.6.1
* apache2-mod_php8-8.2.24-150600.3.6.1
* php8-fastcgi-debugsource-8.2.24-150600.3.6.1
* php8-iconv-debuginfo-8.2.24-150600.3.6.1
* php8-cli-debuginfo-8.2.24-150600.3.6.1
* php8-ftp-debuginfo-8.2.24-150600.3.6.1
* php8-openssl-8.2.24-150600.3.6.1
* php8-fileinfo-debuginfo-8.2.24-150600.3.6.1
* php8-sockets-debuginfo-8.2.24-150600.3.6.1
* php8-dom-8.2.24-150600.3.6.1
* php8-phar-8.2.24-150600.3.6.1
* php8-pcntl-debuginfo-8.2.24-150600.3.6.1
* php8-exif-8.2.24-150600.3.6.1
* php8-ctype-debuginfo-8.2.24-150600.3.6.1
* php8-sysvmsg-8.2.24-150600.3.6.1
* php8-openssl-debuginfo-8.2.24-150600.3.6.1
* php8-mbstring-debuginfo-8.2.24-150600.3.6.1
* php8-gettext-8.2.24-150600.3.6.1
* php8-intl-8.2.24-150600.3.6.1
* php8-zlib-debuginfo-8.2.24-150600.3.6.1
* php8-dba-debuginfo-8.2.24-150600.3.6.1
* php8-tokenizer-8.2.24-150600.3.6.1
* php8-calendar-8.2.24-150600.3.6.1
* apache2-mod_php8-debugsource-8.2.24-150600.3.6.1
* php8-posix-8.2.24-150600.3.6.1
* php8-pdo-debuginfo-8.2.24-150600.3.6.1
* php8-fastcgi-8.2.24-150600.3.6.1
* openSUSE Leap 15.6 (aarch64 ppc64le s390x x86_64 i586)
* php8-pgsql-debuginfo-8.2.24-150600.3.6.1
* php8-ffi-8.2.24-150600.3.6.1
* php8-opcache-8.2.24-150600.3.6.1
* php8-ldap-8.2.24-150600.3.6.1
* php8-fpm-debuginfo-8.2.24-150600.3.6.1
* php8-sysvshm-debuginfo-8.2.24-150600.3.6.1
* php8-tidy-8.2.24-150600.3.6.1
* php8-iconv-8.2.24-150600.3.6.1
* php8-fpm-debugsource-8.2.24-150600.3.6.1
* php8-tokenizer-debuginfo-8.2.24-150600.3.6.1
* php8-odbc-8.2.24-150600.3.6.1
* php8-embed-8.2.24-150600.3.6.1
* php8-readline-debuginfo-8.2.24-150600.3.6.1
* php8-dom-debuginfo-8.2.24-150600.3.6.1
* php8-zip-8.2.24-150600.3.6.1
* php8-devel-8.2.24-150600.3.6.1
* php8-sqlite-8.2.24-150600.3.6.1
* php8-embed-debuginfo-8.2.24-150600.3.6.1
* php8-gettext-debuginfo-8.2.24-150600.3.6.1
* php8-sysvsem-debuginfo-8.2.24-150600.3.6.1
* php8-fpm-8.2.24-150600.3.6.1
* php8-pdo-8.2.24-150600.3.6.1
* php8-sysvsem-8.2.24-150600.3.6.1
* php8-snmp-8.2.24-150600.3.6.1
* apache2-mod_php8-debuginfo-8.2.24-150600.3.6.1
* php8-sqlite-debuginfo-8.2.24-150600.3.6.1
* php8-cli-8.2.24-150600.3.6.1
* php8-gmp-debuginfo-8.2.24-150600.3.6.1
* php8-enchant-debuginfo-8.2.24-150600.3.6.1
* php8-sysvshm-8.2.24-150600.3.6.1
* php8-sodium-debuginfo-8.2.24-150600.3.6.1
* php8-bcmath-8.2.24-150600.3.6.1
* php8-mysql-debuginfo-8.2.24-150600.3.6.1
* php8-zlib-8.2.24-150600.3.6.1
* php8-posix-debuginfo-8.2.24-150600.3.6.1
* php8-pcntl-8.2.24-150600.3.6.1
* php8-xmlreader-debuginfo-8.2.24-150600.3.6.1
* php8-shmop-debuginfo-8.2.24-150600.3.6.1
* php8-soap-debuginfo-8.2.24-150600.3.6.1
* php8-tidy-debuginfo-8.2.24-150600.3.6.1
* php8-enchant-8.2.24-150600.3.6.1
* php8-mbstring-8.2.24-150600.3.6.1
* php8-sysvmsg-debuginfo-8.2.24-150600.3.6.1
* php8-intl-debuginfo-8.2.24-150600.3.6.1
* php8-dba-8.2.24-150600.3.6.1
* php8-curl-8.2.24-150600.3.6.1
* php8-fileinfo-8.2.24-150600.3.6.1
* php8-ctype-8.2.24-150600.3.6.1
* php8-8.2.24-150600.3.6.1
* php8-ldap-debuginfo-8.2.24-150600.3.6.1
* php8-sockets-8.2.24-150600.3.6.1
* php8-soap-8.2.24-150600.3.6.1
* php8-readline-8.2.24-150600.3.6.1
* php8-pgsql-8.2.24-150600.3.6.1
* php8-ftp-8.2.24-150600.3.6.1
* php8-sodium-8.2.24-150600.3.6.1
* php8-exif-debuginfo-8.2.24-150600.3.6.1
* php8-xmlwriter-debuginfo-8.2.24-150600.3.6.1
* php8-xmlwriter-8.2.24-150600.3.6.1
* php8-curl-debuginfo-8.2.24-150600.3.6.1
* php8-gmp-8.2.24-150600.3.6.1
* php8-zip-debuginfo-8.2.24-150600.3.6.1
* php8-calendar-debuginfo-8.2.24-150600.3.6.1
* php8-debugsource-8.2.24-150600.3.6.1
* php8-bz2-8.2.24-150600.3.6.1
* php8-shmop-8.2.24-150600.3.6.1
* php8-gd-8.2.24-150600.3.6.1
* php8-mysql-8.2.24-150600.3.6.1
* php8-opcache-debuginfo-8.2.24-150600.3.6.1
* php8-xmlreader-8.2.24-150600.3.6.1
* php8-xsl-8.2.24-150600.3.6.1
* php8-odbc-debuginfo-8.2.24-150600.3.6.1
* php8-debuginfo-8.2.24-150600.3.6.1
* php8-bz2-debuginfo-8.2.24-150600.3.6.1
* php8-fastcgi-debuginfo-8.2.24-150600.3.6.1
* php8-bcmath-debuginfo-8.2.24-150600.3.6.1
* php8-test-8.2.24-150600.3.6.1
* php8-ffi-debuginfo-8.2.24-150600.3.6.1
* php8-embed-debugsource-8.2.24-150600.3.6.1
* php8-gd-debuginfo-8.2.24-150600.3.6.1
* php8-snmp-debuginfo-8.2.24-150600.3.6.1
* php8-xsl-debuginfo-8.2.24-150600.3.6.1
* php8-phar-debuginfo-8.2.24-150600.3.6.1
* apache2-mod_php8-8.2.24-150600.3.6.1
* php8-iconv-debuginfo-8.2.24-150600.3.6.1
* php8-fastcgi-debugsource-8.2.24-150600.3.6.1
* php8-cli-debuginfo-8.2.24-150600.3.6.1
* php8-ftp-debuginfo-8.2.24-150600.3.6.1
* php8-openssl-8.2.24-150600.3.6.1
* php8-fileinfo-debuginfo-8.2.24-150600.3.6.1
* php8-sockets-debuginfo-8.2.24-150600.3.6.1
* php8-dom-8.2.24-150600.3.6.1
* php8-phar-8.2.24-150600.3.6.1
* php8-pcntl-debuginfo-8.2.24-150600.3.6.1
* php8-exif-8.2.24-150600.3.6.1
* php8-ctype-debuginfo-8.2.24-150600.3.6.1
* php8-sysvmsg-8.2.24-150600.3.6.1
* php8-openssl-debuginfo-8.2.24-150600.3.6.1
* php8-mbstring-debuginfo-8.2.24-150600.3.6.1
* php8-gettext-8.2.24-150600.3.6.1
* php8-intl-8.2.24-150600.3.6.1
* php8-zlib-debuginfo-8.2.24-150600.3.6.1
* php8-dba-debuginfo-8.2.24-150600.3.6.1
* php8-tokenizer-8.2.24-150600.3.6.1
* php8-calendar-8.2.24-150600.3.6.1
* php8-posix-8.2.24-150600.3.6.1
* apache2-mod_php8-debugsource-8.2.24-150600.3.6.1
* php8-pdo-debuginfo-8.2.24-150600.3.6.1
* php8-fastcgi-8.2.24-150600.3.6.1
* openSUSE Leap 15.6 (noarch)
* php8-fpm-apache-8.2.24-150600.3.6.1
## References:
* https://www.suse.com/security/cve/CVE-2024-8925.html
* https://www.suse.com/security/cve/CVE-2024-8927.html
* https://www.suse.com/security/cve/CVE-2024-9026.html
* https://bugzilla.suse.com/show_bug.cgi?id=1231358
* https://bugzilla.suse.com/show_bug.cgi?id=1231360
* https://bugzilla.suse.com/show_bug.cgi?id=1231382
SUSE-SU-2024:3733-1: moderate: Security update for php7
# Security update for php7
Announcement ID: SUSE-SU-2024:3733-1
Release Date: 2024-10-18T15:48:48Z
Rating: moderate
References:
* bsc#1231358
* bsc#1231360
* bsc#1231382
Cross-References:
* CVE-2024-8925
* CVE-2024-8927
* CVE-2024-9026
CVSS scores:
* CVE-2024-8925 ( SUSE ): 6.3
CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N
* CVE-2024-8925 ( SUSE ): 3.7 CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:N
* CVE-2024-8925 ( NVD ): 3.1 CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:N/I:L/A:N
* CVE-2024-8925 ( NVD ): 5.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N
* CVE-2024-8927 ( SUSE ): 6.9
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N
* CVE-2024-8927 ( SUSE ): 6.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N
* CVE-2024-8927 ( NVD ): 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
* CVE-2024-8927 ( NVD ): 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
* CVE-2024-9026 ( SUSE ): 4.8
CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N
* CVE-2024-9026 ( SUSE ): 3.3 CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N
* CVE-2024-9026 ( NVD ): 3.3 CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N
* CVE-2024-9026 ( NVD ): 3.3 CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N
Affected Products:
* Legacy Module 15-SP5
* Legacy Module 15-SP6
* openSUSE Leap 15.4
* openSUSE Leap 15.5
* openSUSE Leap 15.6
* SUSE Linux Enterprise Desktop 15 SP5
* SUSE Linux Enterprise Desktop 15 SP6
* SUSE Linux Enterprise High Performance Computing 15 SP5
* SUSE Linux Enterprise Micro 5.5
* SUSE Linux Enterprise Real Time 15 SP5
* SUSE Linux Enterprise Real Time 15 SP6
* SUSE Linux Enterprise Server 15 SP5
* SUSE Linux Enterprise Server 15 SP6
* SUSE Linux Enterprise Server for SAP Applications 15 SP5
* SUSE Linux Enterprise Server for SAP Applications 15 SP6
* SUSE Package Hub 15 15-SP5
* SUSE Package Hub 15 15-SP6
An update that solves three vulnerabilities can now be installed.
## Description:
This update for php7 fixes the following issues:
* CVE-2024-8925: Fixed erroneous parsing of multipart form data in HTTP POST
requests leads to legitimate data not being processed (bsc#1231360)
* CVE-2024-8927: Fixed cgi.force_redirect configuration is bypassable due to
an environment variable collision (bsc#1231358)
* CVE-2024-9026: Fixed pollution of worker output logs in PHP-FPM
(bsc#1231382)
## Patch Instructions:
To install this SUSE update use the SUSE recommended installation methods like
YaST online_update or "zypper patch".
Alternatively you can run the command listed for your product:
* openSUSE Leap 15.4
zypper in -t patch SUSE-2024-3733=1
* openSUSE Leap 15.5
zypper in -t patch openSUSE-SLE-15.5-2024-3733=1
* openSUSE Leap 15.6
zypper in -t patch openSUSE-SLE-15.6-2024-3733=1
* Legacy Module 15-SP5
zypper in -t patch SUSE-SLE-Module-Legacy-15-SP5-2024-3733=1
* Legacy Module 15-SP6
zypper in -t patch SUSE-SLE-Module-Legacy-15-SP6-2024-3733=1
* SUSE Package Hub 15 15-SP5
zypper in -t patch SUSE-SLE-Module-Packagehub-Subpackages-15-SP5-2024-3733=1
* SUSE Package Hub 15 15-SP6
zypper in -t patch SUSE-SLE-Module-Packagehub-Subpackages-15-SP6-2024-3733=1
## Package List:
* openSUSE Leap 15.4 (aarch64 ppc64le s390x x86_64 i586)
* apache2-mod_php7-debuginfo-7.4.33-150400.4.40.1
* php7-debuginfo-7.4.33-150400.4.40.1
* php7-dom-debuginfo-7.4.33-150400.4.40.1
* php7-odbc-7.4.33-150400.4.40.1
* php7-sysvshm-debuginfo-7.4.33-150400.4.40.1
* php7-pgsql-debuginfo-7.4.33-150400.4.40.1
* php7-xmlreader-7.4.33-150400.4.40.1
* php7-gd-7.4.33-150400.4.40.1
* php7-pcntl-7.4.33-150400.4.40.1
* php7-pdo-7.4.33-150400.4.40.1
* php7-json-debuginfo-7.4.33-150400.4.40.1
* php7-openssl-debuginfo-7.4.33-150400.4.40.1
* php7-sysvshm-7.4.33-150400.4.40.1
* php7-sqlite-7.4.33-150400.4.40.1
* php7-exif-debuginfo-7.4.33-150400.4.40.1
* apache2-mod_php7-debugsource-7.4.33-150400.4.40.1
* php7-fileinfo-debuginfo-7.4.33-150400.4.40.1
* php7-dba-7.4.33-150400.4.40.1
* php7-opcache-7.4.33-150400.4.40.1
* php7-cli-7.4.33-150400.4.40.1
* php7-ctype-debuginfo-7.4.33-150400.4.40.1
* php7-xmlwriter-7.4.33-150400.4.40.1
* php7-xmlwriter-debuginfo-7.4.33-150400.4.40.1
* php7-fastcgi-debuginfo-7.4.33-150400.4.40.1
* php7-fpm-debuginfo-7.4.33-150400.4.40.1
* php7-snmp-7.4.33-150400.4.40.1
* php7-sqlite-debuginfo-7.4.33-150400.4.40.1
* php7-embed-7.4.33-150400.4.40.1
* php7-soap-7.4.33-150400.4.40.1
* php7-sodium-debuginfo-7.4.33-150400.4.40.1
* php7-fileinfo-7.4.33-150400.4.40.1
* php7-posix-debuginfo-7.4.33-150400.4.40.1
* php7-gettext-7.4.33-150400.4.40.1
* php7-tidy-debuginfo-7.4.33-150400.4.40.1
* php7-shmop-debuginfo-7.4.33-150400.4.40.1
* php7-enchant-debuginfo-7.4.33-150400.4.40.1
* php7-soap-debuginfo-7.4.33-150400.4.40.1
* php7-xmlreader-debuginfo-7.4.33-150400.4.40.1
* php7-iconv-7.4.33-150400.4.40.1
* php7-sysvmsg-debuginfo-7.4.33-150400.4.40.1
* php7-opcache-debuginfo-7.4.33-150400.4.40.1
* php7-tokenizer-debuginfo-7.4.33-150400.4.40.1
* php7-gettext-debuginfo-7.4.33-150400.4.40.1
* php7-embed-debugsource-7.4.33-150400.4.40.1
* php7-calendar-debuginfo-7.4.33-150400.4.40.1
* php7-dba-debuginfo-7.4.33-150400.4.40.1
* php7-xmlrpc-debuginfo-7.4.33-150400.4.40.1
* php7-fpm-7.4.33-150400.4.40.1
* php7-curl-debuginfo-7.4.33-150400.4.40.1
* php7-enchant-7.4.33-150400.4.40.1
* php7-mysql-debuginfo-7.4.33-150400.4.40.1
* php7-bz2-debuginfo-7.4.33-150400.4.40.1
* php7-7.4.33-150400.4.40.1
* php7-gmp-7.4.33-150400.4.40.1
* php7-posix-7.4.33-150400.4.40.1
* php7-ftp-7.4.33-150400.4.40.1
* php7-zip-7.4.33-150400.4.40.1
* php7-readline-debuginfo-7.4.33-150400.4.40.1
* php7-snmp-debuginfo-7.4.33-150400.4.40.1
* php7-exif-7.4.33-150400.4.40.1
* php7-calendar-7.4.33-150400.4.40.1
* php7-sockets-debuginfo-7.4.33-150400.4.40.1
* php7-iconv-debuginfo-7.4.33-150400.4.40.1
* php7-shmop-7.4.33-150400.4.40.1
* php7-zlib-debuginfo-7.4.33-150400.4.40.1
* php7-readline-7.4.33-150400.4.40.1
* php7-sodium-7.4.33-150400.4.40.1
* php7-xsl-7.4.33-150400.4.40.1
* php7-bcmath-debuginfo-7.4.33-150400.4.40.1
* php7-gmp-debuginfo-7.4.33-150400.4.40.1
* php7-intl-debuginfo-7.4.33-150400.4.40.1
* php7-embed-debuginfo-7.4.33-150400.4.40.1
* php7-ftp-debuginfo-7.4.33-150400.4.40.1
* php7-fastcgi-debugsource-7.4.33-150400.4.40.1
* php7-test-7.4.33-150400.4.40.1
* php7-bz2-7.4.33-150400.4.40.1
* php7-phar-7.4.33-150400.4.40.1
* php7-pdo-debuginfo-7.4.33-150400.4.40.1
* php7-odbc-debuginfo-7.4.33-150400.4.40.1
* php7-curl-7.4.33-150400.4.40.1
* php7-pcntl-debuginfo-7.4.33-150400.4.40.1
* php7-intl-7.4.33-150400.4.40.1
* php7-sysvsem-debuginfo-7.4.33-150400.4.40.1
* php7-ldap-7.4.33-150400.4.40.1
* php7-xmlrpc-7.4.33-150400.4.40.1
* php7-cli-debuginfo-7.4.33-150400.4.40.1
* php7-tokenizer-7.4.33-150400.4.40.1
* php7-ldap-debuginfo-7.4.33-150400.4.40.1
* php7-zip-debuginfo-7.4.33-150400.4.40.1
* php7-debugsource-7.4.33-150400.4.40.1
* php7-bcmath-7.4.33-150400.4.40.1
* php7-json-7.4.33-150400.4.40.1
* php7-openssl-7.4.33-150400.4.40.1
* php7-tidy-7.4.33-150400.4.40.1
* php7-mysql-7.4.33-150400.4.40.1
* php7-xsl-debuginfo-7.4.33-150400.4.40.1
* php7-pgsql-7.4.33-150400.4.40.1
* php7-mbstring-debuginfo-7.4.33-150400.4.40.1
* php7-zlib-7.4.33-150400.4.40.1
* php7-sysvsem-7.4.33-150400.4.40.1
* php7-devel-7.4.33-150400.4.40.1
* php7-fpm-debugsource-7.4.33-150400.4.40.1
* php7-gd-debuginfo-7.4.33-150400.4.40.1
* php7-dom-7.4.33-150400.4.40.1
* apache2-mod_php7-7.4.33-150400.4.40.1
* php7-fastcgi-7.4.33-150400.4.40.1
* php7-mbstring-7.4.33-150400.4.40.1
* php7-ctype-7.4.33-150400.4.40.1
* php7-phar-debuginfo-7.4.33-150400.4.40.1
* php7-sockets-7.4.33-150400.4.40.1
* php7-sysvmsg-7.4.33-150400.4.40.1
* openSUSE Leap 15.5 (aarch64 ppc64le s390x x86_64)
* apache2-mod_php7-debuginfo-7.4.33-150400.4.40.1
* php7-debuginfo-7.4.33-150400.4.40.1
* php7-dom-debuginfo-7.4.33-150400.4.40.1
* php7-odbc-7.4.33-150400.4.40.1
* php7-sysvshm-debuginfo-7.4.33-150400.4.40.1
* php7-pgsql-debuginfo-7.4.33-150400.4.40.1
* php7-xmlreader-7.4.33-150400.4.40.1
* php7-gd-7.4.33-150400.4.40.1
* php7-pcntl-7.4.33-150400.4.40.1
* php7-pdo-7.4.33-150400.4.40.1
* php7-json-debuginfo-7.4.33-150400.4.40.1
* php7-openssl-debuginfo-7.4.33-150400.4.40.1
* php7-sysvshm-7.4.33-150400.4.40.1
* php7-sqlite-7.4.33-150400.4.40.1
* php7-exif-debuginfo-7.4.33-150400.4.40.1
* apache2-mod_php7-debugsource-7.4.33-150400.4.40.1
* php7-fileinfo-debuginfo-7.4.33-150400.4.40.1
* php7-dba-7.4.33-150400.4.40.1
* php7-opcache-7.4.33-150400.4.40.1
* php7-cli-7.4.33-150400.4.40.1
* php7-ctype-debuginfo-7.4.33-150400.4.40.1
* php7-xmlwriter-7.4.33-150400.4.40.1
* php7-xmlwriter-debuginfo-7.4.33-150400.4.40.1
* php7-fastcgi-debuginfo-7.4.33-150400.4.40.1
* php7-fpm-debuginfo-7.4.33-150400.4.40.1
* php7-snmp-7.4.33-150400.4.40.1
* php7-sqlite-debuginfo-7.4.33-150400.4.40.1
* php7-embed-7.4.33-150400.4.40.1
* php7-soap-7.4.33-150400.4.40.1
* php7-sodium-debuginfo-7.4.33-150400.4.40.1
* php7-fileinfo-7.4.33-150400.4.40.1
* php7-posix-debuginfo-7.4.33-150400.4.40.1
* php7-gettext-7.4.33-150400.4.40.1
* php7-tidy-debuginfo-7.4.33-150400.4.40.1
* php7-shmop-debuginfo-7.4.33-150400.4.40.1
* php7-enchant-debuginfo-7.4.33-150400.4.40.1
* php7-soap-debuginfo-7.4.33-150400.4.40.1
* php7-xmlreader-debuginfo-7.4.33-150400.4.40.1
* php7-iconv-7.4.33-150400.4.40.1
* php7-sysvmsg-debuginfo-7.4.33-150400.4.40.1
* php7-opcache-debuginfo-7.4.33-150400.4.40.1
* php7-tokenizer-debuginfo-7.4.33-150400.4.40.1
* php7-gettext-debuginfo-7.4.33-150400.4.40.1
* php7-embed-debugsource-7.4.33-150400.4.40.1
* php7-calendar-debuginfo-7.4.33-150400.4.40.1
* php7-dba-debuginfo-7.4.33-150400.4.40.1
* php7-fpm-7.4.33-150400.4.40.1
* php7-xmlrpc-debuginfo-7.4.33-150400.4.40.1
* php7-curl-debuginfo-7.4.33-150400.4.40.1
* php7-enchant-7.4.33-150400.4.40.1
* php7-mysql-debuginfo-7.4.33-150400.4.40.1
* php7-bz2-debuginfo-7.4.33-150400.4.40.1
* php7-7.4.33-150400.4.40.1
* php7-gmp-7.4.33-150400.4.40.1
* php7-posix-7.4.33-150400.4.40.1
* php7-ftp-7.4.33-150400.4.40.1
* php7-zip-7.4.33-150400.4.40.1
* php7-readline-debuginfo-7.4.33-150400.4.40.1
* php7-snmp-debuginfo-7.4.33-150400.4.40.1
* php7-exif-7.4.33-150400.4.40.1
* php7-calendar-7.4.33-150400.4.40.1
* php7-sockets-debuginfo-7.4.33-150400.4.40.1
* php7-iconv-debuginfo-7.4.33-150400.4.40.1
* php7-shmop-7.4.33-150400.4.40.1
* php7-zlib-debuginfo-7.4.33-150400.4.40.1
* php7-readline-7.4.33-150400.4.40.1
* php7-sodium-7.4.33-150400.4.40.1
* php7-xsl-7.4.33-150400.4.40.1
* php7-bcmath-debuginfo-7.4.33-150400.4.40.1
* php7-gmp-debuginfo-7.4.33-150400.4.40.1
* php7-intl-debuginfo-7.4.33-150400.4.40.1
* php7-embed-debuginfo-7.4.33-150400.4.40.1
* php7-ftp-debuginfo-7.4.33-150400.4.40.1
* php7-fastcgi-debugsource-7.4.33-150400.4.40.1
* php7-test-7.4.33-150400.4.40.1
* php7-bz2-7.4.33-150400.4.40.1
* php7-phar-7.4.33-150400.4.40.1
* php7-pdo-debuginfo-7.4.33-150400.4.40.1
* php7-odbc-debuginfo-7.4.33-150400.4.40.1
* php7-curl-7.4.33-150400.4.40.1
* php7-pcntl-debuginfo-7.4.33-150400.4.40.1
* php7-intl-7.4.33-150400.4.40.1
* php7-ldap-7.4.33-150400.4.40.1
* php7-sysvsem-debuginfo-7.4.33-150400.4.40.1
* php7-xmlrpc-7.4.33-150400.4.40.1
* php7-cli-debuginfo-7.4.33-150400.4.40.1
* php7-tokenizer-7.4.33-150400.4.40.1
* php7-ldap-debuginfo-7.4.33-150400.4.40.1
* php7-zip-debuginfo-7.4.33-150400.4.40.1
* php7-debugsource-7.4.33-150400.4.40.1
* php7-bcmath-7.4.33-150400.4.40.1
* php7-json-7.4.33-150400.4.40.1
* php7-openssl-7.4.33-150400.4.40.1
* php7-tidy-7.4.33-150400.4.40.1
* php7-mysql-7.4.33-150400.4.40.1
* php7-xsl-debuginfo-7.4.33-150400.4.40.1
* php7-pgsql-7.4.33-150400.4.40.1
* php7-mbstring-debuginfo-7.4.33-150400.4.40.1
* php7-zlib-7.4.33-150400.4.40.1
* php7-sysvsem-7.4.33-150400.4.40.1
* php7-devel-7.4.33-150400.4.40.1
* php7-fpm-debugsource-7.4.33-150400.4.40.1
* php7-gd-debuginfo-7.4.33-150400.4.40.1
* php7-dom-7.4.33-150400.4.40.1
* apache2-mod_php7-7.4.33-150400.4.40.1
* php7-fastcgi-7.4.33-150400.4.40.1
* php7-mbstring-7.4.33-150400.4.40.1
* php7-ctype-7.4.33-150400.4.40.1
* php7-phar-debuginfo-7.4.33-150400.4.40.1
* php7-sockets-7.4.33-150400.4.40.1
* php7-sysvmsg-7.4.33-150400.4.40.1
* openSUSE Leap 15.6 (aarch64 ppc64le s390x x86_64)
* apache2-mod_php7-debuginfo-7.4.33-150400.4.40.1
* php7-debuginfo-7.4.33-150400.4.40.1
* php7-dom-debuginfo-7.4.33-150400.4.40.1
* php7-odbc-7.4.33-150400.4.40.1
* php7-sysvshm-debuginfo-7.4.33-150400.4.40.1
* php7-pgsql-debuginfo-7.4.33-150400.4.40.1
* php7-xmlreader-7.4.33-150400.4.40.1
* php7-gd-7.4.33-150400.4.40.1
* php7-pcntl-7.4.33-150400.4.40.1
* php7-pdo-7.4.33-150400.4.40.1
* php7-json-debuginfo-7.4.33-150400.4.40.1
* php7-openssl-debuginfo-7.4.33-150400.4.40.1
* php7-sysvshm-7.4.33-150400.4.40.1
* php7-sqlite-7.4.33-150400.4.40.1
* php7-exif-debuginfo-7.4.33-150400.4.40.1
* apache2-mod_php7-debugsource-7.4.33-150400.4.40.1
* php7-fileinfo-debuginfo-7.4.33-150400.4.40.1
* php7-dba-7.4.33-150400.4.40.1
* php7-opcache-7.4.33-150400.4.40.1
* php7-cli-7.4.33-150400.4.40.1
* php7-ctype-debuginfo-7.4.33-150400.4.40.1
* php7-xmlwriter-7.4.33-150400.4.40.1
* php7-xmlwriter-debuginfo-7.4.33-150400.4.40.1
* php7-fastcgi-debuginfo-7.4.33-150400.4.40.1
* php7-fpm-debuginfo-7.4.33-150400.4.40.1
* php7-snmp-7.4.33-150400.4.40.1
* php7-sqlite-debuginfo-7.4.33-150400.4.40.1
* php7-embed-7.4.33-150400.4.40.1
* php7-soap-7.4.33-150400.4.40.1
* php7-sodium-debuginfo-7.4.33-150400.4.40.1
* php7-fileinfo-7.4.33-150400.4.40.1
* php7-posix-debuginfo-7.4.33-150400.4.40.1
* php7-gettext-7.4.33-150400.4.40.1
* php7-tidy-debuginfo-7.4.33-150400.4.40.1
* php7-shmop-debuginfo-7.4.33-150400.4.40.1
* php7-enchant-debuginfo-7.4.33-150400.4.40.1
* php7-soap-debuginfo-7.4.33-150400.4.40.1
* php7-xmlreader-debuginfo-7.4.33-150400.4.40.1
* php7-iconv-7.4.33-150400.4.40.1
* php7-sysvmsg-debuginfo-7.4.33-150400.4.40.1
* php7-opcache-debuginfo-7.4.33-150400.4.40.1
* php7-tokenizer-debuginfo-7.4.33-150400.4.40.1
* php7-gettext-debuginfo-7.4.33-150400.4.40.1
* php7-embed-debugsource-7.4.33-150400.4.40.1
* php7-calendar-debuginfo-7.4.33-150400.4.40.1
* php7-dba-debuginfo-7.4.33-150400.4.40.1
* php7-fpm-7.4.33-150400.4.40.1
* php7-xmlrpc-debuginfo-7.4.33-150400.4.40.1
* php7-curl-debuginfo-7.4.33-150400.4.40.1
* php7-enchant-7.4.33-150400.4.40.1
* php7-mysql-debuginfo-7.4.33-150400.4.40.1
* php7-bz2-debuginfo-7.4.33-150400.4.40.1
* php7-7.4.33-150400.4.40.1
* php7-gmp-7.4.33-150400.4.40.1
* php7-posix-7.4.33-150400.4.40.1
* php7-ftp-7.4.33-150400.4.40.1
* php7-zip-7.4.33-150400.4.40.1
* php7-readline-debuginfo-7.4.33-150400.4.40.1
* php7-snmp-debuginfo-7.4.33-150400.4.40.1
* php7-exif-7.4.33-150400.4.40.1
* php7-calendar-7.4.33-150400.4.40.1
* php7-sockets-debuginfo-7.4.33-150400.4.40.1
* php7-iconv-debuginfo-7.4.33-150400.4.40.1
* php7-shmop-7.4.33-150400.4.40.1
* php7-zlib-debuginfo-7.4.33-150400.4.40.1
* php7-readline-7.4.33-150400.4.40.1
* php7-sodium-7.4.33-150400.4.40.1
* php7-xsl-7.4.33-150400.4.40.1
* php7-bcmath-debuginfo-7.4.33-150400.4.40.1
* php7-gmp-debuginfo-7.4.33-150400.4.40.1
* php7-intl-debuginfo-7.4.33-150400.4.40.1
* php7-embed-debuginfo-7.4.33-150400.4.40.1
* php7-ftp-debuginfo-7.4.33-150400.4.40.1
* php7-fastcgi-debugsource-7.4.33-150400.4.40.1
* php7-test-7.4.33-150400.4.40.1
* php7-bz2-7.4.33-150400.4.40.1
* php7-phar-7.4.33-150400.4.40.1
* php7-pdo-debuginfo-7.4.33-150400.4.40.1
* php7-odbc-debuginfo-7.4.33-150400.4.40.1
* php7-curl-7.4.33-150400.4.40.1
* php7-pcntl-debuginfo-7.4.33-150400.4.40.1
* php7-intl-7.4.33-150400.4.40.1
* php7-ldap-7.4.33-150400.4.40.1
* php7-sysvsem-debuginfo-7.4.33-150400.4.40.1
* php7-xmlrpc-7.4.33-150400.4.40.1
* php7-cli-debuginfo-7.4.33-150400.4.40.1
* php7-tokenizer-7.4.33-150400.4.40.1
* php7-ldap-debuginfo-7.4.33-150400.4.40.1
* php7-zip-debuginfo-7.4.33-150400.4.40.1
* php7-debugsource-7.4.33-150400.4.40.1
* php7-bcmath-7.4.33-150400.4.40.1
* php7-json-7.4.33-150400.4.40.1
* php7-openssl-7.4.33-150400.4.40.1
* php7-tidy-7.4.33-150400.4.40.1
* php7-mysql-7.4.33-150400.4.40.1
* php7-xsl-debuginfo-7.4.33-150400.4.40.1
* php7-pgsql-7.4.33-150400.4.40.1
* php7-mbstring-debuginfo-7.4.33-150400.4.40.1
* php7-zlib-7.4.33-150400.4.40.1
* php7-sysvsem-7.4.33-150400.4.40.1
* php7-devel-7.4.33-150400.4.40.1
* php7-fpm-debugsource-7.4.33-150400.4.40.1
* php7-gd-debuginfo-7.4.33-150400.4.40.1
* php7-dom-7.4.33-150400.4.40.1
* apache2-mod_php7-7.4.33-150400.4.40.1
* php7-fastcgi-7.4.33-150400.4.40.1
* php7-mbstring-7.4.33-150400.4.40.1
* php7-ctype-7.4.33-150400.4.40.1
* php7-phar-debuginfo-7.4.33-150400.4.40.1
* php7-sockets-7.4.33-150400.4.40.1
* php7-sysvmsg-7.4.33-150400.4.40.1
* Legacy Module 15-SP5 (aarch64 ppc64le s390x x86_64)
* apache2-mod_php7-debuginfo-7.4.33-150400.4.40.1
* php7-debuginfo-7.4.33-150400.4.40.1
* php7-dom-debuginfo-7.4.33-150400.4.40.1
* php7-odbc-7.4.33-150400.4.40.1
* php7-sysvshm-debuginfo-7.4.33-150400.4.40.1
* php7-pgsql-debuginfo-7.4.33-150400.4.40.1
* php7-xmlreader-7.4.33-150400.4.40.1
* php7-gd-7.4.33-150400.4.40.1
* php7-pcntl-7.4.33-150400.4.40.1
* php7-pdo-7.4.33-150400.4.40.1
* php7-json-debuginfo-7.4.33-150400.4.40.1
* php7-openssl-debuginfo-7.4.33-150400.4.40.1
* php7-sysvshm-7.4.33-150400.4.40.1
* php7-sqlite-7.4.33-150400.4.40.1
* php7-exif-debuginfo-7.4.33-150400.4.40.1
* apache2-mod_php7-debugsource-7.4.33-150400.4.40.1
* php7-fileinfo-debuginfo-7.4.33-150400.4.40.1
* php7-dba-7.4.33-150400.4.40.1
* php7-opcache-7.4.33-150400.4.40.1
* php7-cli-7.4.33-150400.4.40.1
* php7-ctype-debuginfo-7.4.33-150400.4.40.1
* php7-xmlwriter-7.4.33-150400.4.40.1
* php7-xmlwriter-debuginfo-7.4.33-150400.4.40.1
* php7-fastcgi-debuginfo-7.4.33-150400.4.40.1
* php7-fpm-debuginfo-7.4.33-150400.4.40.1
* php7-snmp-7.4.33-150400.4.40.1
* php7-sqlite-debuginfo-7.4.33-150400.4.40.1
* php7-soap-7.4.33-150400.4.40.1
* php7-sodium-debuginfo-7.4.33-150400.4.40.1
* php7-fileinfo-7.4.33-150400.4.40.1
* php7-posix-debuginfo-7.4.33-150400.4.40.1
* php7-gettext-7.4.33-150400.4.40.1
* php7-tidy-debuginfo-7.4.33-150400.4.40.1
* php7-shmop-debuginfo-7.4.33-150400.4.40.1
* php7-enchant-debuginfo-7.4.33-150400.4.40.1
* php7-soap-debuginfo-7.4.33-150400.4.40.1
* php7-xmlreader-debuginfo-7.4.33-150400.4.40.1
* php7-iconv-7.4.33-150400.4.40.1
* php7-sysvmsg-debuginfo-7.4.33-150400.4.40.1
* php7-opcache-debuginfo-7.4.33-150400.4.40.1
* php7-tokenizer-debuginfo-7.4.33-150400.4.40.1
* php7-gettext-debuginfo-7.4.33-150400.4.40.1
* php7-calendar-debuginfo-7.4.33-150400.4.40.1
* php7-dba-debuginfo-7.4.33-150400.4.40.1
* php7-fpm-7.4.33-150400.4.40.1
* php7-xmlrpc-debuginfo-7.4.33-150400.4.40.1
* php7-curl-debuginfo-7.4.33-150400.4.40.1
* php7-enchant-7.4.33-150400.4.40.1
* php7-mysql-debuginfo-7.4.33-150400.4.40.1
* php7-bz2-debuginfo-7.4.33-150400.4.40.1
* php7-7.4.33-150400.4.40.1
* php7-gmp-7.4.33-150400.4.40.1
* php7-posix-7.4.33-150400.4.40.1
* php7-ftp-7.4.33-150400.4.40.1
* php7-zip-7.4.33-150400.4.40.1
* php7-readline-debuginfo-7.4.33-150400.4.40.1
* php7-snmp-debuginfo-7.4.33-150400.4.40.1
* php7-exif-7.4.33-150400.4.40.1
* php7-calendar-7.4.33-150400.4.40.1
* php7-sockets-debuginfo-7.4.33-150400.4.40.1
* php7-iconv-debuginfo-7.4.33-150400.4.40.1
* php7-shmop-7.4.33-150400.4.40.1
* php7-zlib-debuginfo-7.4.33-150400.4.40.1
* php7-readline-7.4.33-150400.4.40.1
* php7-sodium-7.4.33-150400.4.40.1
* php7-xsl-7.4.33-150400.4.40.1
* php7-bcmath-debuginfo-7.4.33-150400.4.40.1
* php7-gmp-debuginfo-7.4.33-150400.4.40.1
* php7-intl-debuginfo-7.4.33-150400.4.40.1
* php7-ftp-debuginfo-7.4.33-150400.4.40.1
* php7-fastcgi-debugsource-7.4.33-150400.4.40.1
* php7-bz2-7.4.33-150400.4.40.1
* php7-phar-7.4.33-150400.4.40.1
* php7-pdo-debuginfo-7.4.33-150400.4.40.1
* php7-odbc-debuginfo-7.4.33-150400.4.40.1
* php7-curl-7.4.33-150400.4.40.1
* php7-pcntl-debuginfo-7.4.33-150400.4.40.1
* php7-intl-7.4.33-150400.4.40.1
* php7-ldap-7.4.33-150400.4.40.1
* php7-sysvsem-debuginfo-7.4.33-150400.4.40.1
* php7-xmlrpc-7.4.33-150400.4.40.1
* php7-cli-debuginfo-7.4.33-150400.4.40.1
* php7-tokenizer-7.4.33-150400.4.40.1
* php7-ldap-debuginfo-7.4.33-150400.4.40.1
* php7-zip-debuginfo-7.4.33-150400.4.40.1
* php7-debugsource-7.4.33-150400.4.40.1
* php7-bcmath-7.4.33-150400.4.40.1
* php7-json-7.4.33-150400.4.40.1
* php7-openssl-7.4.33-150400.4.40.1
* php7-tidy-7.4.33-150400.4.40.1
* php7-mysql-7.4.33-150400.4.40.1
* php7-xsl-debuginfo-7.4.33-150400.4.40.1
* php7-pgsql-7.4.33-150400.4.40.1
* php7-mbstring-debuginfo-7.4.33-150400.4.40.1
* php7-zlib-7.4.33-150400.4.40.1
* php7-sysvsem-7.4.33-150400.4.40.1
* php7-devel-7.4.33-150400.4.40.1
* php7-fpm-debugsource-7.4.33-150400.4.40.1
* php7-gd-debuginfo-7.4.33-150400.4.40.1
* php7-dom-7.4.33-150400.4.40.1
* apache2-mod_php7-7.4.33-150400.4.40.1
* php7-fastcgi-7.4.33-150400.4.40.1
* php7-mbstring-7.4.33-150400.4.40.1
* php7-ctype-7.4.33-150400.4.40.1
* php7-phar-debuginfo-7.4.33-150400.4.40.1
* php7-sockets-7.4.33-150400.4.40.1
* php7-sysvmsg-7.4.33-150400.4.40.1
* Legacy Module 15-SP6 (aarch64 ppc64le s390x x86_64)
* apache2-mod_php7-debuginfo-7.4.33-150400.4.40.1
* php7-debuginfo-7.4.33-150400.4.40.1
* php7-dom-debuginfo-7.4.33-150400.4.40.1
* php7-odbc-7.4.33-150400.4.40.1
* php7-sysvshm-debuginfo-7.4.33-150400.4.40.1
* php7-pgsql-debuginfo-7.4.33-150400.4.40.1
* php7-xmlreader-7.4.33-150400.4.40.1
* php7-gd-7.4.33-150400.4.40.1
* php7-pcntl-7.4.33-150400.4.40.1
* php7-pdo-7.4.33-150400.4.40.1
* php7-json-debuginfo-7.4.33-150400.4.40.1
* php7-openssl-debuginfo-7.4.33-150400.4.40.1
* php7-sysvshm-7.4.33-150400.4.40.1
* php7-sqlite-7.4.33-150400.4.40.1
* php7-exif-debuginfo-7.4.33-150400.4.40.1
* apache2-mod_php7-debugsource-7.4.33-150400.4.40.1
* php7-fileinfo-debuginfo-7.4.33-150400.4.40.1
* php7-dba-7.4.33-150400.4.40.1
* php7-opcache-7.4.33-150400.4.40.1
* php7-cli-7.4.33-150400.4.40.1
* php7-ctype-debuginfo-7.4.33-150400.4.40.1
* php7-xmlwriter-7.4.33-150400.4.40.1
* php7-xmlwriter-debuginfo-7.4.33-150400.4.40.1
* php7-fastcgi-debuginfo-7.4.33-150400.4.40.1
* php7-fpm-debuginfo-7.4.33-150400.4.40.1
* php7-snmp-7.4.33-150400.4.40.1
* php7-sqlite-debuginfo-7.4.33-150400.4.40.1
* php7-soap-7.4.33-150400.4.40.1
* php7-sodium-debuginfo-7.4.33-150400.4.40.1
* php7-fileinfo-7.4.33-150400.4.40.1
* php7-posix-debuginfo-7.4.33-150400.4.40.1
* php7-gettext-7.4.33-150400.4.40.1
* php7-tidy-debuginfo-7.4.33-150400.4.40.1
* php7-shmop-debuginfo-7.4.33-150400.4.40.1
* php7-enchant-debuginfo-7.4.33-150400.4.40.1
* php7-soap-debuginfo-7.4.33-150400.4.40.1
* php7-xmlreader-debuginfo-7.4.33-150400.4.40.1
* php7-iconv-7.4.33-150400.4.40.1
* php7-sysvmsg-debuginfo-7.4.33-150400.4.40.1
* php7-opcache-debuginfo-7.4.33-150400.4.40.1
* php7-tokenizer-debuginfo-7.4.33-150400.4.40.1
* php7-gettext-debuginfo-7.4.33-150400.4.40.1
* php7-calendar-debuginfo-7.4.33-150400.4.40.1
* php7-dba-debuginfo-7.4.33-150400.4.40.1
* php7-fpm-7.4.33-150400.4.40.1
* php7-xmlrpc-debuginfo-7.4.33-150400.4.40.1
* php7-curl-debuginfo-7.4.33-150400.4.40.1
* php7-enchant-7.4.33-150400.4.40.1
* php7-mysql-debuginfo-7.4.33-150400.4.40.1
* php7-bz2-debuginfo-7.4.33-150400.4.40.1
* php7-7.4.33-150400.4.40.1
* php7-gmp-7.4.33-150400.4.40.1
* php7-posix-7.4.33-150400.4.40.1
* php7-ftp-7.4.33-150400.4.40.1
* php7-zip-7.4.33-150400.4.40.1
* php7-readline-debuginfo-7.4.33-150400.4.40.1
* php7-snmp-debuginfo-7.4.33-150400.4.40.1
* php7-exif-7.4.33-150400.4.40.1
* php7-calendar-7.4.33-150400.4.40.1
* php7-sockets-debuginfo-7.4.33-150400.4.40.1
* php7-iconv-debuginfo-7.4.33-150400.4.40.1
* php7-shmop-7.4.33-150400.4.40.1
* php7-zlib-debuginfo-7.4.33-150400.4.40.1
* php7-readline-7.4.33-150400.4.40.1
* php7-sodium-7.4.33-150400.4.40.1
* php7-xsl-7.4.33-150400.4.40.1
* php7-bcmath-debuginfo-7.4.33-150400.4.40.1
* php7-gmp-debuginfo-7.4.33-150400.4.40.1
* php7-intl-debuginfo-7.4.33-150400.4.40.1
* php7-ftp-debuginfo-7.4.33-150400.4.40.1
* php7-fastcgi-debugsource-7.4.33-150400.4.40.1
* php7-bz2-7.4.33-150400.4.40.1
* php7-phar-7.4.33-150400.4.40.1
* php7-pdo-debuginfo-7.4.33-150400.4.40.1
* php7-odbc-debuginfo-7.4.33-150400.4.40.1
* php7-curl-7.4.33-150400.4.40.1
* php7-pcntl-debuginfo-7.4.33-150400.4.40.1
* php7-intl-7.4.33-150400.4.40.1
* php7-ldap-7.4.33-150400.4.40.1
* php7-sysvsem-debuginfo-7.4.33-150400.4.40.1
* php7-xmlrpc-7.4.33-150400.4.40.1
* php7-cli-debuginfo-7.4.33-150400.4.40.1
* php7-tokenizer-7.4.33-150400.4.40.1
* php7-ldap-debuginfo-7.4.33-150400.4.40.1
* php7-zip-debuginfo-7.4.33-150400.4.40.1
* php7-debugsource-7.4.33-150400.4.40.1
* php7-bcmath-7.4.33-150400.4.40.1
* php7-json-7.4.33-150400.4.40.1
* php7-openssl-7.4.33-150400.4.40.1
* php7-tidy-7.4.33-150400.4.40.1
* php7-mysql-7.4.33-150400.4.40.1
* php7-xsl-debuginfo-7.4.33-150400.4.40.1
* php7-pgsql-7.4.33-150400.4.40.1
* php7-mbstring-debuginfo-7.4.33-150400.4.40.1
* php7-zlib-7.4.33-150400.4.40.1
* php7-sysvsem-7.4.33-150400.4.40.1
* php7-devel-7.4.33-150400.4.40.1
* php7-fpm-debugsource-7.4.33-150400.4.40.1
* php7-gd-debuginfo-7.4.33-150400.4.40.1
* php7-dom-7.4.33-150400.4.40.1
* apache2-mod_php7-7.4.33-150400.4.40.1
* php7-fastcgi-7.4.33-150400.4.40.1
* php7-mbstring-7.4.33-150400.4.40.1
* php7-ctype-7.4.33-150400.4.40.1
* php7-phar-debuginfo-7.4.33-150400.4.40.1
* php7-sockets-7.4.33-150400.4.40.1
* php7-sysvmsg-7.4.33-150400.4.40.1
* SUSE Package Hub 15 15-SP5 (aarch64 ppc64le s390x x86_64)
* php7-embed-debuginfo-7.4.33-150400.4.40.1
* php7-embed-debugsource-7.4.33-150400.4.40.1
* php7-embed-7.4.33-150400.4.40.1
* SUSE Package Hub 15 15-SP6 (aarch64 ppc64le s390x x86_64)
* php7-embed-debuginfo-7.4.33-150400.4.40.1
* php7-embed-debugsource-7.4.33-150400.4.40.1
* php7-embed-7.4.33-150400.4.40.1
## References:
* https://www.suse.com/security/cve/CVE-2024-8925.html
* https://www.suse.com/security/cve/CVE-2024-8927.html
* https://www.suse.com/security/cve/CVE-2024-9026.html
* https://bugzilla.suse.com/show_bug.cgi?id=1231358
* https://bugzilla.suse.com/show_bug.cgi?id=1231360
* https://bugzilla.suse.com/show_bug.cgi?id=1231382
openSUSE-SU-2024:0337-1: important: Security update for chromium
openSUSE Security Update: Security update for chromium
_______________________________
Announcement ID: openSUSE-SU-2024:0337-1
Rating: important
References: #1231694
Cross-References: CVE-2024-9954 CVE-2024-9955 CVE-2024-9956
CVE-2024-9957 CVE-2024-9958 CVE-2024-9959
CVE-2024-9960 CVE-2024-9961 CVE-2024-9962
CVE-2024-9963 CVE-2024-9964 CVE-2024-9965
CVE-2024-9966
Affected Products:
openSUSE Backports SLE-15-SP5
openSUSE Backports SLE-15-SP6
_______________________________
An update that fixes 13 vulnerabilities is now available.
Description:
This update for chromium fixes the following issues:
Chromium 130.0.6723.58 (boo#1231694)
* CVE-2024-9954: Use after free in AI
* CVE-2024-9955: Use after free in Web Authentication
* CVE-2024-9956: Inappropriate implementation in Web Authentication
* CVE-2024-9957: Use after free in UI
* CVE-2024-9958: Inappropriate implementation in PictureInPicture
* CVE-2024-9959: Use after free in DevTools
* CVE-2024-9960: Use after free in Dawn
* CVE-2024-9961: Use after free in Parcel Tracking
* CVE-2024-9962: Inappropriate implementation in Permissions
* CVE-2024-9963: Insufficient data validation in Downloads
* CVE-2024-9964: Inappropriate implementation in Payments
* CVE-2024-9965: Insufficient data validation in DevTools
* CVE-2024-9966: Inappropriate implementation in Navigations
Patch Instructions:
To install this openSUSE Security Update use the SUSE recommended installation methods
like YaST online_update or "zypper patch".
Alternatively you can run the command listed for your product:
- openSUSE Backports SLE-15-SP6:
zypper in -t patch openSUSE-2024-337=1
- openSUSE Backports SLE-15-SP5:
zypper in -t patch openSUSE-2024-337=1
Package List:
- openSUSE Backports SLE-15-SP6 (aarch64 x86_64):
chromedriver-130.0.6723.58-bp156.2.41.1
chromedriver-debuginfo-130.0.6723.58-bp156.2.41.1
chromium-130.0.6723.58-bp156.2.41.1
chromium-debuginfo-130.0.6723.58-bp156.2.41.1
- openSUSE Backports SLE-15-SP5 (aarch64 x86_64):
chromedriver-130.0.6723.58-bp155.2.129.1
chromium-130.0.6723.58-bp155.2.129.1
References:
https://www.suse.com/security/cve/CVE-2024-9954.html
https://www.suse.com/security/cve/CVE-2024-9955.html
https://www.suse.com/security/cve/CVE-2024-9956.html
https://www.suse.com/security/cve/CVE-2024-9957.html
https://www.suse.com/security/cve/CVE-2024-9958.html
https://www.suse.com/security/cve/CVE-2024-9959.html
https://www.suse.com/security/cve/CVE-2024-9960.html
https://www.suse.com/security/cve/CVE-2024-9961.html
https://www.suse.com/security/cve/CVE-2024-9962.html
https://www.suse.com/security/cve/CVE-2024-9963.html
https://www.suse.com/security/cve/CVE-2024-9964.html
https://www.suse.com/security/cve/CVE-2024-9965.html
https://www.suse.com/security/cve/CVE-2024-9966.html
https://bugzilla.suse.com/1231694
