Marcus Updateinfo to OVAL Converter 5.5 2023-10-19T04:39:08 openSUSE Leap 15.5 Directory traversal vulnerability in the (1) extract and (2) extractall functions in the tarfile module in Python allows user-assisted remote attackers to overwrite arbitrary files via a .. (dot dot) sequence in filenames in a TAR archive, a related issue to CVE-2001-1267. Moderate CVE-2007-4559 SUSE bug 1203750 SUSE bug 1204077 cpe:/o:opensuse:leap:15.5 openSUSE Leap 15.5 CRLF injection vulnerability in xterm allows user-assisted attackers to execute arbitrary commands via LF (aka \n) characters surrounding a command name within a Device Control Request Status String (DECRQSS) escape sequence in a text file, a related issue to CVE-2003-0063 and CVE-2003-0071. Critical CVE-2008-2383 SUSE bug 462917 SUSE bug 464884 cpe:/o:opensuse:leap:15.5 openSUSE Leap 15.5 An issue has been found in dnsdist before 1.2.0 in the way EDNS0 OPT records are handled when parsing responses from a backend. When dnsdist is configured to add EDNS Client Subnet to a query, the response may contain an EDNS0 OPT record that has to be removed before forwarding the response to the initial client. On a 32-bit system, the pointer arithmetic used when parsing the received response to remove that record might trigger an undefined behavior leading to a crash. Important CVE-2016-7069 SUSE bug 1054799 cpe:/o:opensuse:leap:15.5 openSUSE Leap 15.5 dnsdist version 1.1.0 is vulnerable to a flaw in authentication mechanism for REST API potentially allowing CSRF attack. Important CVE-2017-7557 SUSE bug 1054802 cpe:/o:opensuse:leap:15.5 openSUSE Leap 15.5 An issue has been found in PowerDNS DNSDist before 1.3.3 allowing a remote attacker to craft a DNS query with trailing data such that the addition of a record by dnsdist, for example an OPT record when adding EDNS Client Subnet, might result in the trailing data being smuggled to the backend as a valid record while not seen by dnsdist. This is an issue when dnsdist is deployed as a DNS Firewall and used to filter some records that should not be received by the backend. This issue occurs only when either the 'useClientSubnet' or the experimental 'addXPF' parameters are used when declaring a new backend. Moderate CVE-2018-14663 SUSE bug 1114511 cpe:/o:opensuse:leap:15.5 openSUSE Leap 15.5 re2c before 2.0 has uncontrolled recursion that causes stack consumption in find_fixed_tags. Moderate CVE-2018-21232 SUSE bug 1170890 cpe:/o:opensuse:leap:15.5 openSUSE Leap 15.5 paraparser in ReportLab before 3.5.31 allows remote code execution because start_unichar in paraparser.py evaluates untrusted user input in a unichar element in a crafted XML document with '<unichar code="' followed by arbitrary Python code, a similar issue to CVE-2019-17626. Important CVE-2019-19450 SUSE bug 1215560 cpe:/o:opensuse:leap:15.5 openSUSE Leap 15.5 An issue was discovered in International Components for Unicode (ICU) for C/C++ through 66.1. An integer overflow, leading to a heap-based buffer overflow, exists in the UnicodeString::doAppend() function in common/unistr.cpp. Important CVE-2020-10531 SUSE bug 1166844 SUSE bug 1175778 cpe:/o:opensuse:leap:15.5 openSUSE Leap 15.5 ** DISPUTED ** Trustwave ModSecurity 3.x through 3.0.4 allows denial of service via a special request. NOTE: The discoverer reports "Trustwave has signaled they are disputing our claims." The CVE suggests that there is a security issue with how ModSecurity handles regular expressions that can result in a Denial of Service condition. The vendor does not consider this as a security issue because1) there is no default configuration issue here. An attacker would need to know that a rule using a potentially problematic regular expression was in place, 2) the attacker would need to know the basic nature of the regular expression itself to exploit any resource issues. It's well known that regular expression usage can be taxing on system resources regardless of the use case. It is up to the administrator to decide on when it is appropriate to trade resources for potential security benefit. Moderate CVE-2020-15598 cpe:/o:opensuse:leap:15.5 openSUSE Leap 15.5 Buffer Overflow vulnerability in function ID3_Support::ID3v2Frame::getFrameValue in exempi 2.5.0 and earlier allows remote attackers to cause a denial of service via opening of crafted audio file with ID3V2 frame. Moderate CVE-2020-18651 SUSE bug 1214486 cpe:/o:opensuse:leap:15.5 openSUSE Leap 15.5 Buffer Overflow vulnerability in WEBP_Support.cpp in exempi 2.5.0 and earlier allows remote attackers to cause a denial of service via opening of crafted webp file. Moderate CVE-2020-18652 SUSE bug 1214488 cpe:/o:opensuse:leap:15.5 openSUSE Leap 15.5 An issue was discovered in binutils libbfd.c 2.36 relating to the auxiliary symbol data allows attackers to read or write to system memory or cause a denial of service. Important CVE-2020-19726 SUSE bug 1214565 cpe:/o:opensuse:leap:15.5 openSUSE Leap 15.5 International Components for Unicode (ICU-20850) v66.1 was discovered to contain a use after free bug in the pkg_createWithAssemblyCode function in the file tools/pkgdata/pkgdata.cpp. Moderate CVE-2020-21913 SUSE bug 1193951 cpe:/o:opensuse:leap:15.5 openSUSE Leap 15.5 An issue was discovered in function _libssh2_packet_add in libssh2 1.10.0 allows attackers to access out of bounds memory. Important CVE-2020-22218 SUSE bug 1214527 cpe:/o:opensuse:leap:15.5 openSUSE Leap 15.5 Buffer Overflow vulnerability in function bitwriter_grow_ in flac before 1.4.0 allows remote attackers to run arbitrary code via crafted input to the encoder. Moderate CVE-2020-22219 SUSE bug 1214615 cpe:/o:opensuse:leap:15.5 openSUSE Leap 15.5 Buffer Overflow vulnerability in LibRaw::stretch() function in libraw\src\postprocessing\aspect_ratio.cpp. Moderate CVE-2020-22628 SUSE bug 1215308 cpe:/o:opensuse:leap:15.5 openSUSE Leap 15.5 The 802.11 standard that underpins Wi-Fi Protected Access (WPA, WPA2, and WPA3) and Wired Equivalent Privacy (WEP) doesn't require that the A-MSDU flag in the plaintext QoS header field is authenticated. Against devices that support receiving non-SSP A-MSDU frames (which is mandatory as part of 802.11n), an adversary can abuse this to inject arbitrary network packets. Moderate CVE-2020-24588 SUSE bug 1185861 SUSE bug 1192868 SUSE bug 1199701 cpe:/o:opensuse:leap:15.5 openSUSE Leap 15.5 A privilege escalation flaw was found in the Xorg-x11-server due to a lack of authentication for X11 clients. This flaw allows an attacker to take control of an X application by impersonating the server it is expecting to connect to. Low CVE-2020-25697 SUSE bug 1178613 cpe:/o:opensuse:leap:15.5 openSUSE Leap 15.5 ** RESERVED ** This candidate has been reserved by an organization or individual that will use it when announcing a new security problem. When the candidate has been publicized, the details for this candidate will be provided. Low CVE-2020-25720 SUSE bug 1213386 cpe:/o:opensuse:leap:15.5 openSUSE Leap 15.5 libdwarf before 20201017 has a one-byte out-of-bounds read because of an invalid pointer dereference via an invalid line table in a crafted object. Moderate CVE-2020-27545 SUSE bug 1193102 cpe:/o:opensuse:leap:15.5 openSUSE Leap 15.5 A buffer overflow can occur when calculating the quantile value using the Statistics Library of GSL (GNU Scientific Library), versions 2.5 and 2.6. Processing a maliciously crafted input data for gsl_stats_quantile_from_sorted_data of the library may lead to unexpected application termination or arbitrary code execution. Moderate CVE-2020-35357 SUSE bug 1214681 cpe:/o:opensuse:leap:15.5 openSUSE Leap 15.5 All versions of package trim are vulnerable to Regular Expression Denial of Service (ReDoS) via trim(). Important CVE-2020-7753 cpe:/o:opensuse:leap:15.5 openSUSE Leap 15.5 A temp directory creation vulnerability exists in all versions of Guava, allowing an attacker with access to the machine to potentially access data in a temporary directory created by the Guava API com.google.common.io.Files.createTempDir(). By default, on unix-like systems, the created directory is world-readable (readable by an attacker with access to the system). The method in question has been marked @Deprecated in versions 30.0 and later and should not be used. For Android developers, we recommend choosing a temporary directory API provided by Android, such as context.getCacheDir(). For other Java developers, we recommend migrating to the Java 7 API java.nio.file.Files.createTempDirectory() which explicitly configures permissions of 700, or configuring the Java runtime's java.io.tmpdir system property to point to a location whose permissions are appropriately configured. Low CVE-2020-8908 SUSE bug 1179926 cpe:/o:opensuse:leap:15.5 openSUSE Leap 15.5 A buffer overflow exists in the Brotli library versions prior to 1.0.8 where an attacker controlling the input length of a "one-shot" decompression request to a script can trigger a crash, which happens when copying over chunks of data larger than 2 GiB. It is recommended to update your Brotli library to 1.0.8 or later. If one cannot update, we recommend to use the "streaming" API as opposed to the "one-shot" API, and impose chunk size limits. Moderate CVE-2020-8927 SUSE bug 1175825 cpe:/o:opensuse:leap:15.5 openSUSE Leap 15.5 CairoSVG is a Python (pypi) package. CairoSVG is an SVG converter based on Cairo. In CairoSVG before version 2.5.1, there is a regular expression denial of service (REDoS) vulnerability. When processing SVG files, the python package CairoSVG uses two regular expressions which are vulnerable to Regular Expression Denial of Service (REDoS). If an attacker provides a malicious SVG, it can make cairosvg get stuck processing the file for a very long time. This is fixed in version 2.5.1. See Referenced GitHub advisory for more information. Moderate CVE-2021-21236 SUSE bug 1180648 cpe:/o:opensuse:leap:15.5 openSUSE Leap 15.5 Integer overflow vulnerability in av_timecode_make_string in libavutil/timecode.c in FFmpeg version 4.3.2, allows local attackers to cause a denial of service (DoS) via crafted .mov file. Moderate CVE-2021-28429 SUSE bug 1214246 cpe:/o:opensuse:leap:15.5 openSUSE Leap 15.5 The Net::Netmask module before 2.0000 for Perl does not properly consider extraneous zero characters at the beginning of an IP address string, which (in some situations) allows attackers to bypass access control that is based on IP addresses. Important CVE-2021-29424 SUSE bug 1184425 cpe:/o:opensuse:leap:15.5 openSUSE Leap 15.5 An issue was discovered in GNU libiberty, as distributed in GNU Binutils 2.36. It is a stack-overflow issue in demangle_type in rust-demangle.c. Low CVE-2021-32256 SUSE bug 1213458 cpe:/o:opensuse:leap:15.5 openSUSE Leap 15.5 When instructing cloud-init to set a random password for a new user account, versions before 21.2 would write that password to the world-readable log file /var/log/cloud-init-output.log. This could allow a local user to log in as another user. Moderate CVE-2021-3429 SUSE bug 1184758 cpe:/o:opensuse:leap:15.5 openSUSE Leap 15.5 ansi-regex is vulnerable to Inefficient Regular Expression Complexity Important CVE-2021-3807 SUSE bug 1192154 cpe:/o:opensuse:leap:15.5 openSUSE Leap 15.5 json-schema is vulnerable to Improperly Controlled Modification of Object Prototype Attributes ('Prototype Pollution') Important CVE-2021-3918 SUSE bug 1192696 cpe:/o:opensuse:leap:15.5 openSUSE Leap 15.5 mitmproxy is an interactive, SSL/TLS-capable intercepting proxy. In mitmproxy 7.0.2 and below, a malicious client or server is able to perform HTTP request smuggling attacks through mitmproxy. This means that a malicious client/server could smuggle a request/response through mitmproxy as part of another request/response's HTTP message body. While a smuggled request is still captured as part of another request's body, it does not appear in the request list and does not go through the usual mitmproxy event hooks, where users may have implemented custom access control checks or input sanitization. Unless one uses mitmproxy to protect an HTTP/1 service, no action is required. The vulnerability has been fixed in mitmproxy 7.0.3 and above. Important CVE-2021-39214 SUSE bug 1190603 cpe:/o:opensuse:leap:15.5 openSUSE Leap 15.5 ModSecurity 3.x through 3.0.5 mishandles excessively nested JSON objects. Crafted JSON objects with nesting tens-of-thousands deep could result in the web server being unable to service legitimate requests. Even a moderately large (e.g., 300KB) HTTP request can occupy one of the limited NGINX worker processes for minutes and consume almost all of the available CPU on the machine. Modsecurity 2 is similarly vulnerable: the affected versions include 2.8.0 through 2.9.4. Important CVE-2021-42717 SUSE bug 1195450 cpe:/o:opensuse:leap:15.5 openSUSE Leap 15.5 In Async before 2.6.4 and 3.x before 3.2.2, a malicious user can obtain privileges via the mapValues() method, aka lib/internal/iterator.js createObjectIterator prototype pollution. Important CVE-2021-43138 SUSE bug 1200480 cpe:/o:opensuse:leap:15.5 openSUSE Leap 15.5 An issue was discovered in the tokio crate before 1.8.4, and 1.9.x through 1.13.x before 1.13.1, for Rust. In certain circumstances involving a closed oneshot channel, there is a data race and memory corruption. Low CVE-2021-45710 SUSE bug 1194119 cpe:/o:opensuse:leap:15.5 openSUSE Leap 15.5 Qt SVG in Qt 5.0.0 through 5.15.2 and 6.0.0 through 6.2.1 has an out-of-bounds write in QtPrivate::QCommonArrayOps<QPainterPath::Element>::growAppend (called from QPainterPath::addPath and QPathClipper::intersect). Moderate CVE-2021-45930 SUSE bug 1196654 cpe:/o:opensuse:leap:15.5 openSUSE Leap 15.5 An issue was discovered IW44Image.cpp in djvulibre 3.5.28 in allows attackers to cause a denial of service via divide by zero. Low CVE-2021-46310 SUSE bug 1214670 cpe:/o:opensuse:leap:15.5 openSUSE Leap 15.5 An issue was discovered IW44EncodeCodec.cpp in djvulibre 3.5.28 in allows attackers to cause a denial of service via divide by zero. Low CVE-2021-46312 SUSE bug 1214672 cpe:/o:opensuse:leap:15.5 openSUSE Leap 15.5 follow-redirects is vulnerable to Exposure of Private Personal Information to an Unauthorized Actor Moderate CVE-2022-0155 cpe:/o:opensuse:leap:15.5 openSUSE Leap 15.5 Acceptance of some invalid Transfer-Encoding headers in the HTTP/1 client in net/http before Go 1.17.12 and Go 1.18.4 allows HTTP request smuggling if combined with an intermediate server that also improperly fails to reject the header as invalid. Moderate CVE-2022-1705 SUSE bug 1201434 cpe:/o:opensuse:leap:15.5 openSUSE Leap 15.5 Uncontrolled recursion in the Parse functions in go/parser before Go 1.17.12 and Go 1.18.4 allow an attacker to cause a panic due to stack exhaustion via deeply nested types or declarations. Moderate CVE-2022-1962 SUSE bug 1201448 cpe:/o:opensuse:leap:15.5 openSUSE Leap 15.5 Sensitive data could be exposed in world readable logs of cloud-init before version 22.3 when schema failures are reported. This leak could include hashed passwords. Moderate CVE-2022-2084 SUSE bug 1210652 cpe:/o:opensuse:leap:15.5 openSUSE Leap 15.5 An out-of-bounds read vulnerability was found in Samba due to insufficient length checks in winbindd_pam_auth_crap.c. When performing NTLM authentication, the client replies to cryptographic challenges back to the server. These replies have variable lengths, and Winbind fails to check the lan manager response length. When Winbind is used for NTLM authentication, a maliciously crafted request can trigger an out-of-bounds read in Winbind, possibly resulting in a crash. Moderate CVE-2022-2127 SUSE bug 1213174 cpe:/o:opensuse:leap:15.5 openSUSE Leap 15.5 A regression exists in the Linux Kernel within KVM: nVMX that allowed for speculative execution attacks.?L2 can carry out Spectre v2 attacks on L1 due to L1 thinking it doesn't need retpolines or IBPB?after running L2 due to KVM (L0) advertising eIBRS support to L1. An attacker at L2 with code execution can execute code on an indirect branch on the host machine. We recommend upgrading to Kernel 6.2 or past commit?2e7eab81425a Moderate CVE-2022-2196 SUSE bug 1206992 cpe:/o:opensuse:leap:15.5 openSUSE Leap 15.5 rails-html-sanitizer is responsible for sanitizing HTML fragments in Rails applications. Certain configurations of rails-html-sanitizer < 1.4.4 use an inefficient regular expression that is susceptible to excessive backtracking when attempting to sanitize certain SVG attributes. This may lead to a denial of service through CPU resource consumption. This issue has been patched in version 1.4.4. Moderate CVE-2022-23517 SUSE bug 1206433 cpe:/o:opensuse:leap:15.5 openSUSE Leap 15.5 rails-html-sanitizer is responsible for sanitizing HTML fragments in Rails applications. Versions >= 1.0.3, < 1.4.4 are vulnerable to cross-site scripting via data URIs when used in combination with Loofah >= 2.1.0. This issue is patched in version 1.4.4. Important CVE-2022-23518 SUSE bug 1206434 cpe:/o:opensuse:leap:15.5 openSUSE Leap 15.5 rails-html-sanitizer is responsible for sanitizing HTML fragments in Rails applications. Prior to version 1.4.4, a possible XSS vulnerability with certain configurations of Rails::Html::Sanitizer may allow an attacker to inject content if the application developer has overridden the sanitizer's allowed tags in either of the following ways: allow both "math" and "style" elements, or allow both "svg" and "style" elements. Code is only impacted if allowed tags are being overridden. . This issue is fixed in version 1.4.4. All users overriding the allowed tags to include "math" or "svg" and "style" should either upgrade or use the following workaround immediately: Remove "style" from the overridden allowed tags, or remove "math" and "svg" from the overridden allowed tags. Important CVE-2022-23519 SUSE bug 1206435 cpe:/o:opensuse:leap:15.5 openSUSE Leap 15.5 rails-html-sanitizer is responsible for sanitizing HTML fragments in Rails applications. Prior to version 1.4.4, there is a possible XSS vulnerability with certain configurations of Rails::Html::Sanitizer due to an incomplete fix of CVE-2022-32209. Rails::Html::Sanitizer may allow an attacker to inject content if the application developer has overridden the sanitizer's allowed tags to allow both "select" and "style" elements. Code is only impacted if allowed tags are being overridden. This issue is patched in version 1.4.4. All users overriding the allowed tags to include both "select" and "style" should either upgrade or use this workaround: Remove either "select" or "style" from the overridden allowed tags. NOTE: Code is _not_ impacted if allowed tags are overridden using either the :tags option to the Action View helper method sanitize or the :tags option to the instance method SafeListSanitizer#sanitize. Moderate CVE-2022-23520 SUSE bug 1206436 cpe:/o:opensuse:leap:15.5 openSUSE Leap 15.5 encoding/pem in Go before 1.17.9 and 1.18.x before 1.18.1 has a Decode stack overflow via a large amount of PEM data. Moderate CVE-2022-24675 SUSE bug 1198423 cpe:/o:opensuse:leap:15.5 openSUSE Leap 15.5 regex is an implementation of regular expressions for the Rust language. The regex crate features built-in mitigations to prevent denial of service attacks caused by untrusted regexes, or untrusted input matched by trusted regexes. Those (tunable) mitigations already provide sane defaults to prevent attacks. This guarantee is documented and it's considered part of the crate's API. Unfortunately a bug was discovered in the mitigations designed to prevent untrusted regexes to take an arbitrary amount of time during parsing, and it's possible to craft regexes that bypass such mitigations. This makes it possible to perform denial of service attacks by sending specially crafted regexes to services accepting user-controlled, untrusted regexes. All versions of the regex crate before or equal to 1.5.4 are affected by this issue. The fix is include starting from regex 1.5.5. All users accepting user-controlled regexes are recommended to upgrade immediately to the latest version of the regex crate. Unfortunately there is no fixed set of problematic regexes, as there are practically infinite regexes that could be crafted to exploit this vulnerability. Because of this, it us not recommend to deny known problematic regexes. Moderate CVE-2022-24713 SUSE bug 1196972 cpe:/o:opensuse:leap:15.5 openSUSE Leap 15.5 ** RESERVED ** This candidate has been reserved by an organization or individual that will use it when announcing a new security problem. When the candidate has been publicized, the details for this candidate will be provided. Moderate CVE-2022-24805 SUSE bug 1201103 cpe:/o:opensuse:leap:15.5 openSUSE Leap 15.5 ** RESERVED ** This candidate has been reserved by an organization or individual that will use it when announcing a new security problem. When the candidate has been publicized, the details for this candidate will be provided. Moderate CVE-2022-24806 SUSE bug 1201103 cpe:/o:opensuse:leap:15.5 openSUSE Leap 15.5 ** RESERVED ** This candidate has been reserved by an organization or individual that will use it when announcing a new security problem. When the candidate has been publicized, the details for this candidate will be provided. Moderate CVE-2022-24807 SUSE bug 1201103 cpe:/o:opensuse:leap:15.5 openSUSE Leap 15.5 ** RESERVED ** This candidate has been reserved by an organization or individual that will use it when announcing a new security problem. When the candidate has been publicized, the details for this candidate will be provided. Moderate CVE-2022-24808 SUSE bug 1201103 cpe:/o:opensuse:leap:15.5 openSUSE Leap 15.5 ** RESERVED ** This candidate has been reserved by an organization or individual that will use it when announcing a new security problem. When the candidate has been publicized, the details for this candidate will be provided. Moderate CVE-2022-24809 SUSE bug 1201103 cpe:/o:opensuse:leap:15.5 openSUSE Leap 15.5 ** RESERVED ** This candidate has been reserved by an organization or individual that will use it when announcing a new security problem. When the candidate has been publicized, the details for this candidate will be provided. Moderate CVE-2022-24810 SUSE bug 1201103 cpe:/o:opensuse:leap:15.5 openSUSE Leap 15.5 Netty is an open-source, asynchronous event-driven network application framework. The package `io.netty:netty-codec-http` prior to version 4.1.77.Final contains an insufficient fix for CVE-2021-21290. When Netty's multipart decoders are used local information disclosure can occur via the local system temporary directory if temporary storing uploads on the disk is enabled. This only impacts applications running on Java version 6 and lower. Additionally, this vulnerability impacts code running on Unix-like systems, and very old versions of Mac OSX and Windows as they all share the system temporary directory between all users. Version 4.1.77.Final contains a patch for this vulnerability. As a workaround, specify one's own `java.io.tmpdir` when starting the JVM or use DefaultHttpDataFactory.setBaseDir(...) to set the directory to something that is only readable by the current user. Moderate CVE-2022-24823 SUSE bug 1199338 cpe:/o:opensuse:leap:15.5 openSUSE Leap 15.5 Redis is an in-memory database that persists on disk. A specially crafted Lua script executing in Redis can trigger a heap overflow in the cjson library, and result with heap corruption and potentially remote code execution. The problem exists in all versions of Redis with Lua scripting support, starting from 2.6, and affects only authenticated and authorized users. The problem is fixed in versions 7.0.12, 6.2.13, and 6.0.20. Moderate CVE-2022-24834 SUSE bug 1213193 cpe:/o:opensuse:leap:15.5 openSUSE Leap 15.5 This affects versions of the package http-cache-semantics before 4.1.1. The issue can be exploited via malicious request header values sent to a server, when that server reads the cache policy from the request using this library. Important CVE-2022-25881 SUSE bug 1208744 cpe:/o:opensuse:leap:15.5 openSUSE Leap 15.5 Certificate.Verify in crypto/x509 in Go 1.18.x before 1.18.1 can be caused to panic on macOS when presented with certain malformed certificates. This allows a remote TLS server to cause a TLS client to panic. Moderate CVE-2022-27536 SUSE bug 1198427 cpe:/o:opensuse:leap:15.5 openSUSE Leap 15.5 In net/http in Go before 1.18.6 and 1.19.x before 1.19.1, attackers can cause a denial of service because an HTTP/2 connection can hang during closing if shutdown were preempted by a fatal error. Important CVE-2022-27664 SUSE bug 1203185 SUSE bug 1203293 cpe:/o:opensuse:leap:15.5 openSUSE Leap 15.5 Uncontrolled recursion in Decoder.Skip in encoding/xml before Go 1.17.12 and Go 1.18.4 allows an attacker to cause a panic due to stack exhaustion via a deeply nested XML document. Moderate CVE-2022-28131 SUSE bug 1201443 cpe:/o:opensuse:leap:15.5 openSUSE Leap 15.5 The generic P-256 feature in crypto/elliptic in Go before 1.17.9 and 1.18.x before 1.18.1 allows a panic via long scalar input. Moderate CVE-2022-28327 SUSE bug 1198424 cpe:/o:opensuse:leap:15.5 openSUSE Leap 15.5 Reader.Read does not set a limit on the maximum size of file headers. A maliciously crafted archive could cause Read to allocate unbounded amounts of memory, potentially causing resource exhaustion or panics. After fix, Reader.Read limits the maximum size of header blocks to 1 MiB. Important CVE-2022-2879 SUSE bug 1204024 cpe:/o:opensuse:leap:15.5 openSUSE Leap 15.5 Requests forwarded by ReverseProxy include the raw query parameters from the inbound request, including unparsable parameters rejected by net/http. This could permit query parameter smuggling when a Go proxy forwards a parameter with an unparsable value. After fix, ReverseProxy sanitizes the query parameters in the forwarded query when the outbound request's Form field is set after the ReverseProxy. Director function returns, indicating that the proxy has parsed the query parameters. Proxies which do not parse query parameters continue to forward the original query parameters unchanged. Important CVE-2022-2880 SUSE bug 1204025 SUSE bug 1204076 cpe:/o:opensuse:leap:15.5 openSUSE Leap 15.5 Go before 1.17.10 and 1.18.x before 1.18.2 has Incorrect Privilege Assignment. When called with a non-zero flags parameter, the Faccessat function could incorrectly report that a file is accessible. Moderate CVE-2022-29526 SUSE bug 1199413 cpe:/o:opensuse:leap:15.5 openSUSE Leap 15.5 Incorrect conversion of certain invalid paths to valid, absolute paths in Clean in path/filepath before Go 1.17.11 and Go 1.18.3 on Windows allows potential directory traversal attack. Moderate CVE-2022-29804 SUSE bug 1200137 cpe:/o:opensuse:leap:15.5 openSUSE Leap 15.5 Azure Storage Library Information Disclosure Vulnerability Moderate CVE-2022-30187 SUSE bug 1202088 SUSE bug 1203582 SUSE bug 1205790 cpe:/o:opensuse:leap:15.5 openSUSE Leap 15.5 Code injection in Cmd.Start in os/exec before Go 1.17.11 and Go 1.18.3 allows execution of any binaries in the working directory named either "..com" or "..exe" by calling Cmd.Run, Cmd.Start, Cmd.Output, or Cmd.CombinedOutput when Cmd.Path is unset. Moderate CVE-2022-30580 SUSE bug 1200136 cpe:/o:opensuse:leap:15.5 openSUSE Leap 15.5 Non-random values for ticket_age_add in session tickets in crypto/tls before Go 1.17.11 and Go 1.18.3 allow an attacker that can observe TLS handshakes to correlate successive connections by comparing ticket ages during session resumption. Low CVE-2022-30629 SUSE bug 1200135 cpe:/o:opensuse:leap:15.5 openSUSE Leap 15.5 Uncontrolled recursion in Glob in io/fs before Go 1.17.12 and Go 1.18.4 allows an attacker to cause a panic due to stack exhaustion via a path which contains a large number of path separators. Moderate CVE-2022-30630 SUSE bug 1201447 cpe:/o:opensuse:leap:15.5 openSUSE Leap 15.5 Uncontrolled recursion in Reader.Read in compress/gzip before Go 1.17.12 and Go 1.18.4 allows an attacker to cause a panic due to stack exhaustion via an archive containing a large number of concatenated 0-length compressed files. Moderate CVE-2022-30631 SUSE bug 1201437 cpe:/o:opensuse:leap:15.5 openSUSE Leap 15.5 Uncontrolled recursion in Glob in path/filepath before Go 1.17.12 and Go 1.18.4 allows an attacker to cause a panic due to stack exhaustion via a path containing a large number of path separators. Moderate CVE-2022-30632 SUSE bug 1201445 cpe:/o:opensuse:leap:15.5 openSUSE Leap 15.5 Uncontrolled recursion in Unmarshal in encoding/xml before Go 1.17.12 and Go 1.18.4 allows an attacker to cause a panic due to stack exhaustion via unmarshalling an XML document into a Go struct which has a nested field that uses the 'any' field tag. Moderate CVE-2022-30633 SUSE bug 1201440 cpe:/o:opensuse:leap:15.5 openSUSE Leap 15.5 Infinite loop in Read in crypto/rand before Go 1.17.11 and Go 1.18.3 on Windows allows attacker to cause an indefinite hang by passing a buffer larger than 1 << 32 - 1 bytes. Low CVE-2022-30634 SUSE bug 1200134 cpe:/o:opensuse:leap:15.5 openSUSE Leap 15.5 Uncontrolled recursion in Decoder.Decode in encoding/gob before Go 1.17.12 and Go 1.18.4 allows an attacker to cause a panic due to stack exhaustion via a message which contains deeply nested structures. Moderate CVE-2022-30635 SUSE bug 1201444 cpe:/o:opensuse:leap:15.5 openSUSE Leap 15.5 NonFree Insufficient data validation in Mojo in Google Chrome prior to 105.0.5195.102 allowed a remote attacker who had compromised the renderer process to potentially perform a sandbox escape via a crafted HTML page. Critical CVE-2022-3075 SUSE bug 1203102 openSUSE Leap 15.5 Grafana is an open-source platform for monitoring and observability. Versions on the 8.x and 9.x branch prior to 9.0.3, 8.5.9, 8.4.10, and 8.3.10 are vulnerable to stored cross-site scripting via the Unified Alerting feature of Grafana. An attacker can exploit this vulnerability to escalate privilege from editor to admin by tricking an authenticated admin to click on a link. Versions 9.0.3, 8.5.9, 8.4.10, and 8.3.10 contain a patch. As a workaround, it is possible to disable alerting or use legacy alerting. Important CVE-2022-31097 SUSE bug 1201535 cpe:/o:opensuse:leap:15.5 openSUSE Leap 15.5 Grafana is an open-source platform for monitoring and observability. In versions 5.3 until 9.0.3, 8.5.9, 8.4.10, and 8.3.10, it is possible for a malicious user who has authorization to log into a Grafana instance via a configured OAuth IdP which provides a login name to take over the account of another user in that Grafana instance. This can occur when the malicious user is authorized to log in to Grafana via OAuth, the malicious user's external user id is not already associated with an account in Grafana, the malicious user's email address is not already associated with an account in Grafana, and the malicious user knows the Grafana username of the target user. If these conditions are met, the malicious user can set their username in the OAuth provider to that of the target user, then go through the OAuth flow to log in to Grafana. Due to the way that external and internal user accounts are linked together during login, if the conditions above are all met then the malicious user will be able to log in to the target user's Grafana account. Versions 9.0.3, 8.5.9, 8.4.10, and 8.3.10 contain a patch for this issue. As a workaround, concerned users can disable OAuth login to their Grafana instance, or ensure that all users authorized to log in via OAuth have a corresponding user account in Grafana linked to their email address. Important CVE-2022-31107 SUSE bug 1201539 cpe:/o:opensuse:leap:15.5 openSUSE Leap 15.5 A Incorrect Default Permissions vulnerability in rmt-server-regsharing service of SUSE Linux Enterprise Server for SAP 15, SUSE Linux Enterprise Server for SAP 15-SP1, SUSE Manager Server 4.1; openSUSE Leap 15.3, openSUSE Leap 15.4 allows local attackers with access to the _rmt user to escalate to root. This issue affects: SUSE Linux Enterprise Server for SAP 15 rmt-server versions prior to 2.10. SUSE Linux Enterprise Server for SAP 15-SP1 rmt-server versions prior to 2.10. SUSE Manager Server 4.1 rmt-server versions prior to 2.10. openSUSE Leap 15.3 rmt-server versions prior to 2.10. openSUSE Leap 15.4 rmt-server versions prior to 2.10. Important CVE-2022-31254 SUSE bug 1204285 SUSE bug 1207670 cpe:/o:opensuse:leap:15.5 openSUSE Leap 15.5 Hyperium Hyper before 0.14.19 does not allow for customization of the max_header_list_size method in the H2 third-party software, allowing attackers to perform HTTP2 attacks. Moderate CVE-2022-31394 SUSE bug 1208551 cpe:/o:opensuse:leap:15.5 openSUSE Leap 15.5 NonFree Use after free in PDF in Google Chrome prior to 105.0.5195.125 allowed a remote attacker to potentially exploit heap corruption via a crafted PDF file. (Chromium security severity: High) Important CVE-2022-3196 SUSE bug 1203419 openSUSE Leap 15.5 NonFree Use after free in PDF in Google Chrome prior to 105.0.5195.125 allowed a remote attacker to potentially exploit heap corruption via a crafted PDF file. (Chromium security severity: High) Important CVE-2022-3197 SUSE bug 1203419 openSUSE Leap 15.5 NonFree Use after free in PDF in Google Chrome prior to 105.0.5195.125 allowed a remote attacker to potentially exploit heap corruption via a crafted PDF file. (Chromium security severity: High) Important CVE-2022-3198 SUSE bug 1203419 openSUSE Leap 15.5 NonFree Use after free in Frames in Google Chrome prior to 105.0.5195.125 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page. (Chromium security severity: High) Important CVE-2022-3199 SUSE bug 1203419 openSUSE Leap 15.5 NonFree Heap buffer overflow in Internals in Google Chrome prior to 105.0.5195.125 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page. (Chromium security severity: High) Important CVE-2022-3200 SUSE bug 1203419 openSUSE Leap 15.5 NonFree Insufficient validation of untrusted input in DevTools in Google Chrome on Chrome OS prior to 105.0.5195.125 allowed an attacker who convinced a user to install a malicious extension to bypass navigation restrictions via a crafted HTML page. (Chromium security severity: High) Important CVE-2022-3201 SUSE bug 1203419 SUSE bug 1203808 openSUSE Leap 15.5 Improper exposure of client IP addresses in net/http before Go 1.17.12 and Go 1.18.4 can be triggered by calling httputil.ReverseProxy.ServeHTTP with a Request.Header map containing a nil value for the X-Forwarded-For header, which causes ReverseProxy to set the client IP as the value of the X-Forwarded-For header. Moderate CVE-2022-32148 SUSE bug 1201436 cpe:/o:opensuse:leap:15.5 openSUSE Leap 15.5 An attacker may cause a denial of service by crafting an Accept-Language header which ParseAcceptLanguage will take significant time to parse. Important CVE-2022-32149 SUSE bug 1204501 cpe:/o:opensuse:leap:15.5 openSUSE Leap 15.5 A too-short encoded message can cause a panic in Float.GobDecode and Rat GobDecode in math/big in Go before 1.17.13 and 1.18.5, potentially allowing a denial of service. Moderate CVE-2022-32189 SUSE bug 1202035 cpe:/o:opensuse:leap:15.5 openSUSE Leap 15.5 A OS Command Injection vulnerability exists in Node.js versions <14.20.0, <16.20.0, <18.5.0 due to an insufficient IsAllowedHost check that can easily be bypassed because IsIPAddress does not properly check if an IP address is invalid before making DBS requests allowing rebinding attacks. Important CVE-2022-32212 SUSE bug 1201328 cpe:/o:opensuse:leap:15.5 openSUSE Leap 15.5 The llhttp parser <v14.20.1, <v16.17.1 and <v18.9.1 in the http module in Node.js does not correctly parse and validate Transfer-Encoding headers and can lead to HTTP Request Smuggling (HRS). Moderate CVE-2022-32213 SUSE bug 1201325 cpe:/o:opensuse:leap:15.5 openSUSE Leap 15.5 The llhttp parser <v14.20.1, <v16.17.1 and <v18.9.1 in the http module in Node.js does not strictly use the CRLF sequence to delimit HTTP requests. This can lead to HTTP Request Smuggling (HRS). Moderate CVE-2022-32214 SUSE bug 1201326 cpe:/o:opensuse:leap:15.5 openSUSE Leap 15.5 The llhttp parser <v14.20.1, <v16.17.1 and <v18.9.1 in the http module in Node.js does not correctly handle multi-line Transfer-Encoding headers. This can lead to HTTP Request Smuggling (HRS). Moderate CVE-2022-32215 SUSE bug 1201327 cpe:/o:opensuse:leap:15.5 openSUSE Leap 15.5 LibreDWG v0.12.4.4608 was discovered to contain a heap-use-after-free via the function decode_preR13_section at decode_r11.c. Important CVE-2022-33025 SUSE bug 1200898 cpe:/o:opensuse:leap:15.5 openSUSE Leap 15.5 Incorrect calculation in microcode keying mechanism for some 3rd Generation Intel(R) Xeon(R) Scalable Processors may allow a privileged user to potentially enable information disclosure via local access. Moderate CVE-2022-33972 SUSE bug 1208479 cpe:/o:opensuse:leap:15.5 openSUSE Leap 15.5 NonFree Use after free in Skia in Google Chrome prior to 106.0.5249.119 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page. (Chromium security severity: High) Important CVE-2022-3445 SUSE bug 1204223 openSUSE Leap 15.5 NonFree Heap buffer overflow in WebSQL in Google Chrome prior to 106.0.5249.119 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page. (Chromium security severity: High) Important CVE-2022-3446 SUSE bug 1204223 openSUSE Leap 15.5 NonFree Inappropriate implementation in Custom Tabs in Google Chrome on Android prior to 106.0.5249.119 allowed a remote attacker to spoof the contents of the Omnibox (URL bar) via a crafted HTML page. (Chromium security severity: High) Important CVE-2022-3447 SUSE bug 1204223 openSUSE Leap 15.5 NonFree Use after free in Permissions API in Google Chrome prior to 106.0.5249.119 allowed a remote attacker who convinced a user to engage in specific UI gestures to potentially exploit heap corruption via a crafted HTML page. (Chromium security severity: High) Important CVE-2022-3448 SUSE bug 1204223 openSUSE Leap 15.5 NonFree Use after free in Safe Browsing in Google Chrome prior to 106.0.5249.119 allowed an attacker who convinced a user to install a malicious extension to potentially exploit heap corruption via a crafted Chrome Extension. (Chromium security severity: High) Important CVE-2022-3449 SUSE bug 1204223 openSUSE Leap 15.5 NonFree Use after free in Peer Connection in Google Chrome prior to 106.0.5249.119 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page. (Chromium security severity: High) Important CVE-2022-3450 SUSE bug 1204223 openSUSE Leap 15.5 An issue was discovered in Binutils readelf 2.38.50, reachable assertion failure in function display_debug_names allows attackers to cause a denial of service. Low CVE-2022-35205 SUSE bug 1214579 cpe:/o:opensuse:leap:15.5 openSUSE Leap 15.5 Null pointer dereference vulnerability in Binutils readelf 2.38.50 via function read_and_display_attr_value in file dwarf.c. Moderate CVE-2022-35206 SUSE bug 1214567 cpe:/o:opensuse:leap:15.5 openSUSE Leap 15.5 A vulnerability was found in Linux Kernel. It has been classified as problematic. Affected is an unknown function of the file mm/memory.c of the component Driver Handler. The manipulation leads to use after free. It is possible to launch the attack remotely. It is recommended to apply a patch to fix this issue. The identifier of this vulnerability is VDB-211020. Moderate CVE-2022-3523 SUSE bug 1204363 cpe:/o:opensuse:leap:15.5 openSUSE Leap 15.5 A weak randomness in WebCrypto keygen vulnerability exists in Node.js 18 due to a change with EntropySource() in SecretKeyGenTraits::DoKeyGen() in src/crypto/crypto_keygen.cc. There are two problems with this: 1) It does not check the return value, it assumes EntropySource() always succeeds, but it can (and sometimes will) fail. 2) The random data returned byEntropySource() may not be cryptographically strong and therefore not suitable as keying material. Important CVE-2022-35255 SUSE bug 1203831 cpe:/o:opensuse:leap:15.5 openSUSE Leap 15.5 The llhttp parser in the http module in Node v18.7.0 does not correctly handle header fields that are not terminated with CLRF. This may result in HTTP Request Smuggling. Moderate CVE-2022-35256 SUSE bug 1203832 cpe:/o:opensuse:leap:15.5 openSUSE Leap 15.5 A vulnerability, which was classified as problematic, was found in Linux Kernel. This affects the function tcp_getsockopt/tcp_setsockopt of the component TCP Handler. The manipulation leads to race condition. It is recommended to apply a patch to fix this issue. The identifier VDB-211089 was assigned to this vulnerability. Moderate CVE-2022-3566 SUSE bug 1204405 cpe:/o:opensuse:leap:15.5 openSUSE Leap 15.5 Grafana is an open-source platform for monitoring and observability. Versions prior to 9.1.6 and 8.5.13 are vulnerable to an escalation from admin to server admin when auth proxy is used, allowing an admin to take over the server admin account and gain full control of the grafana instance. All installations should be upgraded as soon as possible. As a workaround deactivate auth proxy following the instructions at: https://grafana.com/docs/grafana/latest/setup-grafana/configure-security/configure-authentication/auth-proxy/ Moderate CVE-2022-35957 SUSE bug 1203597 cpe:/o:opensuse:leap:15.5 openSUSE Leap 15.5 Redis is an in-memory database that persists on disk. Authenticated users can use string matching commands (like `SCAN` or `KEYS`) with a specially crafted pattern to trigger a denial-of-service attack on Redis, causing it to hang and consume 100% CPU time. The problem is fixed in Redis versions 6.0.18, 6.2.11, 7.0.9. Important CVE-2022-36021 SUSE bug 1208790 SUSE bug 1208793 cpe:/o:opensuse:leap:15.5 openSUSE Leap 15.5 Grafana is an open-source platform for monitoring and observability. In versions prior to 8.5.13, 9.0.9, and 9.1.6, Grafana is subject to Improper Preservation of Permissions resulting in privilege escalation on some folders where Admin is the only used permission. The vulnerability impacts Grafana instances where RBAC was disabled and enabled afterwards, as the migrations which are translating legacy folder permissions to RBAC permissions do not account for the scenario where the only user permission in the folder is Admin, as a result RBAC adds permissions for Editors and Viewers which allow them to edit and view folders accordingly. This issue has been patched in versions 8.5.13, 9.0.9, and 9.1.6. A workaround when the impacted folder/dashboard is known is to remove the additional permissions manually. Moderate CVE-2022-36062 SUSE bug 1203596 cpe:/o:opensuse:leap:15.5 openSUSE Leap 15.5 An out-of-bounds(OOB) memory access vulnerability was found in vmwgfx driver in drivers/gpu/vmxgfx/vmxgfx_kms.c in GPU component in the Linux kernel with device file '/dev/dri/renderD128 (or Dxxx)'. This flaw allows a local attacker with a user account on the system to gain privilege, causing a denial of service(DoS). Moderate CVE-2022-36280 SUSE bug 1203332 cpe:/o:opensuse:leap:15.5 openSUSE Leap 15.5 An integer overflow vulnerability was found in vmwgfx driver in drivers/gpu/vmxgfx/vmxgfx_execbuf.c in GPU component of Linux kernel with device file '/dev/dri/renderD128 (or Dxxx)'. This flaw allows a local attacker with a user account on the system to gain privilege, causing a denial of service(DoS). Moderate CVE-2022-36402 SUSE bug 1203517 cpe:/o:opensuse:leap:15.5 openSUSE Leap 15.5 In Erlang/OTP before 23.3.4.15, 24.x before 24.3.4.2, and 25.x before 25.0.2, there is a Client Authentication Bypass in certain client-certification situations for SSL, TLS, and DTLS. Critical CVE-2022-37026 SUSE bug 1205318 SUSE bug 1207113 cpe:/o:opensuse:leap:15.5 openSUSE Leap 15.5 NonFree Type confusion in V8 in Google Chrome prior to 107.0.5304.87 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page. (Chromium security severity: High) Important CVE-2022-3723 SUSE bug 1204819 openSUSE Leap 15.5 A NULL pointer dereference vulnerability was found in vmwgfx driver in drivers/gpu/vmxgfx/vmxgfx_execbuf.c in GPU component of Linux kernel with device file '/dev/dri/renderD128 (or Dxxx)'. This flaw allows a local attacker with a user account on the system to gain privilege, causing a denial of service(DoS). Moderate CVE-2022-38096 SUSE bug 1203331 cpe:/o:opensuse:leap:15.5 openSUSE Leap 15.5 A use-after-free(UAF) vulnerability was found in function 'vmw_cmd_res_check' in drivers/gpu/vmxgfx/vmxgfx_execbuf.c in Linux kernel's vmwgfx driver with device file '/dev/dri/renderD128 (or Dxxx)'. This flaw allows a local attacker with a user account on the system to gain privilege, causing a denial of service(DoS). Moderate CVE-2022-38457 SUSE bug 1203330 cpe:/o:opensuse:leap:15.5 openSUSE Leap 15.5 NonFree Use after free in V8 in Google Chrome prior to 107.0.5304.106 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page. (Chromium security severity: High) Critical CVE-2022-3885 SUSE bug 1205221 openSUSE Leap 15.5 NonFree Use after free in Speech Recognition in Google Chrome prior to 107.0.5304.106 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page. (Chromium security severity: High) Critical CVE-2022-3886 SUSE bug 1205221 openSUSE Leap 15.5 NonFree Use after free in Web Workers in Google Chrome prior to 107.0.5304.106 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page. (Chromium security severity: High) Critical CVE-2022-3887 SUSE bug 1205221 openSUSE Leap 15.5 NonFree Use after free in WebCodecs in Google Chrome prior to 107.0.5304.106 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page. (Chromium security severity: High) Critical CVE-2022-3888 SUSE bug 1205221 openSUSE Leap 15.5 NonFree Type confusion in V8 in Google Chrome prior to 107.0.5304.106 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page. (Chromium security severity: High) Critical CVE-2022-3889 SUSE bug 1205221 openSUSE Leap 15.5 Nexcloud desktop is the Desktop sync client for Nextcloud. An attacker can inject arbitrary HyperText Markup Language into the Desktop Client application in the notifications. It is recommended that the Nextcloud Desktop client is upgraded to 3.6.1. There are no known workarounds for this issue. Moderate CVE-2022-39331 SUSE bug 1205798 cpe:/o:opensuse:leap:15.5 openSUSE Leap 15.5 Nexcloud desktop is the Desktop sync client for Nextcloud. An attacker can inject arbitrary HyperText Markup Language into the Desktop Client application via user status and information. It is recommended that the Nextcloud Desktop client is upgraded to 3.6.1. There are no known workarounds for this issue. Moderate CVE-2022-39332 SUSE bug 1205799 cpe:/o:opensuse:leap:15.5 openSUSE Leap 15.5 Nexcloud desktop is the Desktop sync client for Nextcloud. An attacker can inject arbitrary HyperText Markup Language into the Desktop Client application. It is recommended that the Nextcloud Desktop client is upgraded to 3.6.1. There are no known workarounds for this issue. Moderate CVE-2022-39333 SUSE bug 1205800 cpe:/o:opensuse:leap:15.5 openSUSE Leap 15.5 Nextcloud also ships a CLI utility called nextcloudcmd which is sometimes used for automated scripting and headless servers. Versions of nextcloudcmd prior to 3.6.1 would incorrectly trust invalid TLS certificates, which may enable a Man-in-the-middle attack that exposes sensitive data or credentials to a network attacker. This affects the CLI only. It does not affect the standard GUI desktop Nextcloud clients, and it does not affect the Nextcloud server. Low CVE-2022-39334 SUSE bug 1205801 cpe:/o:opensuse:leap:15.5 openSUSE Leap 15.5 A use-after-free(UAF) vulnerability was found in function 'vmw_execbuf_tie_context' in drivers/gpu/vmxgfx/vmxgfx_execbuf.c in Linux kernel's vmwgfx driver with device file '/dev/dri/renderD128 (or Dxxx)'. This flaw allows a local attacker with a user account on the system to gain privilege, causing a denial of service(DoS). Moderate CVE-2022-40133 SUSE bug 1203329 cpe:/o:opensuse:leap:15.5 openSUSE Leap 15.5 IBM SDK, Java Technology Edition 7.1.5.18 and 8.0.8.0 could allow a remote attacker to execute arbitrary code on the system, caused by an unsafe deserialization flaw. By sending specially-crafted data, an attacker could exploit this vulnerability to execute arbitrary code on the system. IBM X-Force ID: 236069. Important CVE-2022-40609 SUSE bug 1213934 SUSE bug 1214431 cpe:/o:opensuse:leap:15.5 openSUSE Leap 15.5 Information exposure through microarchitectural state after transient execution in certain vector execution units for some Intel(R) Processors may allow an authenticated user to potentially enable information disclosure via local access. Moderate CVE-2022-40982 SUSE bug 1206418 SUSE bug 1215674 cpe:/o:opensuse:leap:15.5 openSUSE Leap 15.5 In Django 3.2 before 3.2.16, 4.0 before 4.0.8, and 4.1 before 4.1.2, internationalized URLs were subject to a potential denial of service attack via the locale parameter, which is treated as a regular expression. Important CVE-2022-41323 SUSE bug 1203793 cpe:/o:opensuse:leap:15.5 openSUSE Leap 15.5 Integer overflow vulnerability in pcre2test before 10.41 allows attackers to cause a denial of service or other unspecified impacts via negative input. Moderate CVE-2022-41409 SUSE bug 1213514 cpe:/o:opensuse:leap:15.5 openSUSE Leap 15.5 Programs which compile regular expressions from untrusted sources may be vulnerable to memory exhaustion or denial of service. The parsed regexp representation is linear in the size of the input, but in some cases the constant factor can be as high as 40,000, making relatively small regexps consume much larger amounts of memory. After fix, each regexp being parsed is limited to a 256 MB memory footprint. Regular expressions whose representation would use more space than that are rejected. Normal use of regular expressions is unaffected. Moderate CVE-2022-41715 SUSE bug 1204023 SUSE bug 1208441 cpe:/o:opensuse:leap:15.5 openSUSE Leap 15.5 Due to unsanitized NUL values, attackers may be able to maliciously set environment variables on Windows. In syscall.StartProcess and os/exec.Cmd, invalid environment variable values containing NUL values are not properly checked for. A malicious environment variable value can exploit this behavior to set a value for a different environment variable. For example, the environment variable string "A=B\x00C=D" sets the variables "A=B" and "C=D". Low CVE-2022-41716 SUSE bug 1204941 cpe:/o:opensuse:leap:15.5 openSUSE Leap 15.5 An attacker can cause excessive memory growth in a Go server accepting HTTP/2 requests. HTTP/2 server connections contain a cache of HTTP header keys sent by the client. While the total number of entries in this cache is capped, an attacker sending very large keys can cause the server to allocate approximately 64 MiB per open connection. Important CVE-2022-41717 SUSE bug 1206135 cpe:/o:opensuse:leap:15.5 openSUSE Leap 15.5 On Windows, restricted files can be accessed via os.DirFS and http.Dir. The os.DirFS function and http.Dir type provide access to a tree of files rooted at a given directory. These functions permit access to Windows device files under that root. For example, os.DirFS("C:/tmp").Open("COM1") opens the COM1 device. Both os.DirFS and http.Dir only provide read-only filesystem access. In addition, on Windows, an os.DirFS for the directory (the root of the current drive) can permit a maliciously crafted path to escape from the drive and access any path on the system. With fix applied, the behavior of os.DirFS("") has changed. Previously, an empty root was treated equivalently to "/", so os.DirFS("").Open("tmp") would open the path "/tmp". This now returns an error. Important CVE-2022-41720 SUSE bug 1206134 cpe:/o:opensuse:leap:15.5 openSUSE Leap 15.5 A maliciously crafted HTTP/2 stream could cause excessive CPU consumption in the HPACK decoder, sufficient to cause a denial of service from a small number of small requests. Important CVE-2022-41723 SUSE bug 1208270 SUSE bug 1215588 cpe:/o:opensuse:leap:15.5 openSUSE Leap 15.5 Large handshake records may cause panics in crypto/tls. Both clients and servers may send large TLS handshake records which cause servers and clients, respectively, to panic when attempting to construct responses. This affects all TLS 1.3 clients, TLS 1.2 clients which explicitly enable session resumption (by setting Config.ClientSessionCache to a non-nil value), and TLS 1.3 servers which request client certificates (by setting Config.ClientAuth >= RequestClientCert). Important CVE-2022-41724 SUSE bug 1208271 cpe:/o:opensuse:leap:15.5 openSUSE Leap 15.5 A denial of service is possible from excessive resource consumption in net/http and mime/multipart. Multipart form parsing with mime/multipart.Reader.ReadForm can consume largely unlimited amounts of memory and disk files. This also affects form parsing in the net/http package with the Request methods FormFile, FormValue, ParseMultipartForm, and PostFormValue. ReadForm takes a maxMemory parameter, and is documented as storing "up to maxMemory bytes +10MB (reserved for non-file parts) in memory". File parts which cannot be stored in memory are stored on disk in temporary files. The unconfigurable 10MB reserved for non-file parts is excessively large and can potentially open a denial of service vector on its own. However, ReadForm did not properly account for all memory consumed by a parsed form, such as map entry overhead, part names, and MIME headers, permitting a maliciously crafted form to consume well over 10MB. In addition, ReadForm contained no limit on the number of disk files created, permitting a relatively small request body to create a large number of disk temporary files. With fix, ReadForm now properly accounts for various forms of memory overhead, and should now stay within its documented limit of 10MB + maxMemory bytes of memory consumption. Users should still be aware that this limit is high and may still be hazardous. In addition, ReadForm now creates at most one on-disk temporary file, combining multiple form parts into a single temporary file. The mime/multipart.File interface type's documentation states, "If stored on disk, the File's underlying concrete type will be an *os.File.". This is no longer the case when a form contains more than one file part, due to this coalescing of parts into a single file. The previous behavior of using distinct files for each form part may be reenabled with the environment variable GODEBUG=multipartfiles=distinct. Users should be aware that multipart.ReadForm and the http.Request methods that call it do not limit the amount of disk consumed by temporary files. Callers can limit the size of form data with http.MaxBytesReader. Moderate CVE-2022-41725 SUSE bug 1208272 cpe:/o:opensuse:leap:15.5 openSUSE Leap 15.5 Unauthorized error injection in Intel(R) SGX or Intel(R) TDX for some Intel(R) Xeon(R) Processors may allow a privileged user to potentially enable escalation of privilege via local access. Important CVE-2022-41804 SUSE bug 1215580 cpe:/o:opensuse:leap:15.5 openSUSE Leap 15.5 Netty project is an event-driven asynchronous network application framework. In versions prior to 4.1.86.Final, a StackOverflowError can be raised when parsing a malformed crafted message due to an infinite recursion. This issue is patched in version 4.1.86.Final. There is no workaround, except using a custom HaProxyMessageDecoder. Important CVE-2022-41881 SUSE bug 1206360 cpe:/o:opensuse:leap:15.5 openSUSE Leap 15.5 Netty project is an event-driven asynchronous network application framework. Starting in version 4.1.83.Final and prior to 4.1.86.Final, when calling `DefaultHttpHeadesr.set` with an _iterator_ of values, header value validation was not performed, allowing malicious header values in the iterator to perform HTTP Response Splitting. This issue has been patched in version 4.1.86.Final. Integrators can work around the issue by changing the `DefaultHttpHeaders.set(CharSequence, Iterator<?>)` call, into a `remove()` call, and call `add()` in a loop over the iterator of values. Important CVE-2022-41915 SUSE bug 1206379 cpe:/o:opensuse:leap:15.5 openSUSE Leap 15.5 x86 shadow paging arbitrary pointer dereference In environments where host assisted address translation is necessary but Hardware Assisted Paging (HAP) is unavailable, Xen will run guests in so called shadow mode. Due to too lax a check in one of the hypervisor routines used for shadow page handling it is possible for a guest with a PCI device passed through to cause the hypervisor to access an arbitrary pointer partially under guest control. Important CVE-2022-42335 SUSE bug 1210315 cpe:/o:opensuse:leap:15.5 openSUSE Leap 15.5 Mishandling of guest SSBD selection on AMD hardware The current logic to set SSBD on AMD Family 17h and Hygon Family 18h processors requires that the setting of SSBD is coordinated at a core level, as the setting is shared between threads. Logic was introduced to keep track of how many threads require SSBD active in order to coordinate it, such logic relies on using a per-core counter of threads that have SSBD active. When running on the mentioned hardware, it's possible for a guest to under or overflow the thread counter, because each write to VIRT_SPEC_CTRL.SSBD by the guest gets propagated to the helper that does the per-core active accounting. Underflowing the counter causes the value to get saturated, and thus attempts for guests running on the same core to set SSBD won't have effect because the hypervisor assumes it's already active. Low CVE-2022-42336 SUSE bug 1211433 cpe:/o:opensuse:leap:15.5 openSUSE Leap 15.5 NonFree Type confusion in V8 in Google Chrome prior to 108.0.5359.94 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page. (Chromium security severity: High) Important CVE-2022-4262 SUSE bug 1205999 openSUSE Leap 15.5 A flaw was found in the Linux kernel Traffic Control (TC) subsystem. Using a specific networking configuration (redirecting egress packets to ingress using TC action "mirred") a local unprivileged user could trigger a CPU soft lockup (ABBA deadlock) when the transport protocol in use (TCP or SCTP) does a retransmission, resulting in a denial of service condition. Moderate CVE-2022-4269 SUSE bug 1206024 cpe:/o:opensuse:leap:15.5 openSUSE Leap 15.5 An illegal memory access flaw was found in the binutils package. Parsing an ELF file containing corrupt symbol version information may result in a denial of service. This issue is the result of an incomplete fix for CVE-2020-16599. Moderate CVE-2022-4285 SUSE bug 1206080 cpe:/o:opensuse:leap:15.5 openSUSE Leap 15.5 A timing based side channel exists in the OpenSSL RSA Decryption implementation which could be sufficient to recover a plaintext across a network in a Bleichenbacher style attack. To achieve a successful decryption an attacker would have to be able to send a very large number of trial messages for decryption. The vulnerability affects all RSA padding modes: PKCS#1 v1.5, RSA-OEAP and RSASVE. For example, in a TLS connection, RSA is commonly used by a client to send an encrypted pre-master secret to the server. An attacker that had observed a genuine connection between a client and a server could use this flaw to send trial messages to the server and record the time taken to process them. After a sufficiently large number of messages the attacker could recover the pre-master secret used for the original connection and thus be able to decrypt the application data sent over that connection. Moderate CVE-2022-4304 SUSE bug 1207534 SUSE bug 1210067 SUSE bug 1213146 SUSE bug 1213289 SUSE bug 1215014 cpe:/o:opensuse:leap:15.5 openSUSE Leap 15.5 An out-of-bounds read in Organization Specific TLV was found in various versions of OpenvSwitch. Important CVE-2022-4337 SUSE bug 1206581 cpe:/o:opensuse:leap:15.5 openSUSE Leap 15.5 An integer underflow in Organization Specific TLV was found in various versions of OpenvSwitch. Important CVE-2022-4338 SUSE bug 1206580 cpe:/o:opensuse:leap:15.5 openSUSE Leap 15.5 A OS Command Injection vulnerability exists in Node.js versions <14.21.1, <16.18.1, <18.12.1, <19.0.1 due to an insufficient IsAllowedHost check that can easily be bypassed because IsIPAddress does not properly check if an IP address is invalid before making DBS requests allowing rebinding attacks.The fix for this issue in https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2022-32212 was incomplete and this new CVE is to complete the fix. Important CVE-2022-43548 SUSE bug 1205119 cpe:/o:opensuse:leap:15.5 openSUSE Leap 15.5 NonFree Use after free in Blink Media in Google Chrome prior to 108.0.5359.124 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page. (Chromium security severity: High) Important CVE-2022-4436 SUSE bug 1206403 openSUSE Leap 15.5 NonFree Use after free in Mojo IPC in Google Chrome prior to 108.0.5359.124 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page. (Chromium security severity: High) Important CVE-2022-4437 SUSE bug 1206403 openSUSE Leap 15.5 NonFree Use after free in Blink Frames in Google Chrome prior to 108.0.5359.124 allowed a remote attacker who convinced the user to engage in specific UI interactions to potentially exploit heap corruption via a crafted HTML page. (Chromium security severity: High) Important CVE-2022-4438 SUSE bug 1206403 openSUSE Leap 15.5 NonFree Use after free in Aura in Google Chrome on Windows prior to 108.0.5359.124 allowed a remote attacker who convinced the user to engage in specific UI interactions to potentially exploit heap corruption via specific UI interactions. (Chromium security severity: High) Important CVE-2022-4439 SUSE bug 1206403 openSUSE Leap 15.5 NonFree Use after free in Profiles in Google Chrome prior to 108.0.5359.124 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page. (Chromium security severity: Medium) Important CVE-2022-4440 SUSE bug 1206403 openSUSE Leap 15.5 Heap buffer overflow vulnerability in binutils readelf before 2.40 via function find_section_in_set in file readelf.c. Important CVE-2022-44840 SUSE bug 1214580 cpe:/o:opensuse:leap:15.5 openSUSE Leap 15.5 A Cleartext Storage of Sensitive Information vulnerability in suppportutils of SUSE Linux Enterprise Server 12, SUSE Linux Enterprise Server 15, SUSE Linux Enterprise Server 15 SP3 allows attackers that get access to the support logs to gain knowledge of the stored credentials This issue affects: SUSE Linux Enterprise Server 12 supportutils version 3.0.10-95.51.1CWE-312: Cleartext Storage of Sensitive Information and prior versions. SUSE Linux Enterprise Server 15 supportutils version 3.1.21-150000.5.44.1 and prior versions. SUSE Linux Enterprise Server 15 SP3 supportutils version 3.1.21-150300.7.35.15.1 and prior versions. Moderate CVE-2022-45154 SUSE bug 1207598 cpe:/o:opensuse:leap:15.5 openSUSE Leap 15.5 Heap buffer overflow vulnerability in binutils readelf before 2.40 via function display_debug_section in file readelf.c. Important CVE-2022-45703 SUSE bug 1214604 cpe:/o:opensuse:leap:15.5 openSUSE Leap 15.5 An issue was discovered in the Linux kernel through 6.0.9. drivers/media/dvb-core/dvbdev.c has a use-after-free, related to dvb_register_device dynamically allocating fops. Moderate CVE-2022-45884 SUSE bug 1205756 cpe:/o:opensuse:leap:15.5 openSUSE Leap 15.5 An issue was discovered in the Linux kernel through 6.0.9. drivers/media/dvb-core/dvb_frontend.c has a race condition that can cause a use-after-free when a device is disconnected. Moderate CVE-2022-45885 SUSE bug 1205758 cpe:/o:opensuse:leap:15.5 openSUSE Leap 15.5 An issue was discovered in the Linux kernel through 6.0.9. drivers/media/dvb-core/dvb_net.c has a .disconnect versus dvb_device_open race condition that leads to a use-after-free. Moderate CVE-2022-45886 SUSE bug 1205760 cpe:/o:opensuse:leap:15.5 openSUSE Leap 15.5 An issue was discovered in the Linux kernel through 6.0.9. drivers/media/usb/ttusb-dec/ttusb_dec.c has a memory leak because of the lack of a dvb_frontend_detach call. Moderate CVE-2022-45887 SUSE bug 1205762 cpe:/o:opensuse:leap:15.5 openSUSE Leap 15.5 An issue was discovered in the Linux kernel through 6.0.10. In drivers/media/dvb-core/dvb_ca_en50221.c, a use-after-free can occur is there is a disconnect after an open, because of the lack of a wait_event. Important CVE-2022-45919 SUSE bug 1205803 SUSE bug 1208912 SUSE bug 1214128 SUSE bug 1215674 cpe:/o:opensuse:leap:15.5 openSUSE Leap 15.5 Prometheus Exporter Toolkit is a utility package to build exporters. Prior to versions 0.7.2 and 0.8.2, if someone has access to a Prometheus web.yml file and users' bcrypted passwords, they can bypass security by poisoning the built-in authentication cache. Versions 0.7.2 and 0.8.2 contain a fix for the issue. There is no workaround, but attacker must have access to the hashed password to use this functionality. Important CVE-2022-46146 SUSE bug 1208046 cpe:/o:opensuse:leap:15.5 openSUSE Leap 15.5 Syncthing is an open source, continuous file synchronization program. In versions prior to 1.23.5 a compromised instance with shared folders could sync malicious files which contain arbitrary HTML and JavaScript in the name. If the owner of another device looks over the shared folder settings and moves the mouse over the latest sync, a script could be executed to change settings for shared folders or add devices automatically. Additionally adding a new device with a malicious name could embed HTML or JavaScript inside parts of the page. As a result the webUI may be subject to a stored cross site scripting attack. This issue has been addressed in version 1.23.5. Users are advised to upgrade. Users unable to upgrade should avoid sharing folders with untrusted users. Moderate CVE-2022-46165 SUSE bug 1212085 cpe:/o:opensuse:leap:15.5 openSUSE Leap 15.5 MariaDB Server before 10.3.34 thru 10.9.3 is vulnerable to Denial of Service. It is possible for function spider_db_mbase::print_warnings to dereference a null pointer. Low CVE-2022-47015 SUSE bug 1207404 cpe:/o:opensuse:leap:15.5 openSUSE Leap 15.5 A double-free flaw was found in the Linux kernel’s TUN/TAP device driver functionality in how a user registers the device when the register_netdevice function fails (NETDEV_REGISTER notifier). This flaw allows a local user to crash or potentially escalate their privileges on the system. Important CVE-2022-4744 SUSE bug 1209635 SUSE bug 1209672 SUSE bug 1211833 cpe:/o:opensuse:leap:15.5 openSUSE Leap 15.5 An issue was discovered in Binutils addr2line before 2.39.3, function parse_module contains multiple out of bound reads which may cause a denial of service or other unspecified impacts. Important CVE-2022-47673 SUSE bug 1214625 cpe:/o:opensuse:leap:15.5 openSUSE Leap 15.5 An issue was discovered Binutils objdump before 2.39.3 allows attackers to cause a denial of service or other unspecified impacts via function bfd_mach_o_get_synthetic_symtab in match-o.c. Important CVE-2022-47695 SUSE bug 1214624 cpe:/o:opensuse:leap:15.5 openSUSE Leap 15.5 An issue was discovered Binutils objdump before 2.39.3 allows attackers to cause a denial of service or other unspecified impacts via function compare_symbols. Important CVE-2022-47696 SUSE bug 1214623 cpe:/o:opensuse:leap:15.5 openSUSE Leap 15.5 GNU Binutils before 2.40 was discovered to contain an excessive memory consumption vulnerability via the function load_separate_debug_files at dwarf2.c. The attacker could supply a crafted ELF file and cause a DNS attack. Moderate CVE-2022-48063 SUSE bug 1214620 cpe:/o:opensuse:leap:15.5 openSUSE Leap 15.5 GNU Binutils before 2.40 was discovered to contain an excessive memory consumption vulnerability via the function bfd_dwarf2_find_nearest_line_with_alt at dwarf2.c. The attacker could supply a crafted ELF file and cause a DNS attack. Low CVE-2022-48064 SUSE bug 1214619 cpe:/o:opensuse:leap:15.5 openSUSE Leap 15.5 GNU Binutils before 2.40 was discovered to contain a memory leak vulnerability var the function find_abstract_instance in dwarf2.c. Moderate CVE-2022-48065 SUSE bug 1214611 cpe:/o:opensuse:leap:15.5 openSUSE Leap 15.5 There is a stack overflow vulnerability in ash.c:6030 in busybox before 1.35. In the environment of Internet of Vehicles, this vulnerability can be executed from command to arbitrary code execution. Important CVE-2022-48174 SUSE bug 1214538 cpe:/o:opensuse:leap:15.5 openSUSE Leap 15.5 The issue was addressed with improved bounds checks. This issue is fixed in tvOS 15.6, watchOS 8.7, iOS 15.6 and iPadOS 15.6, macOS Monterey 12.5, Safari 15.6. Processing web content may lead to arbitrary code execution. Important CVE-2022-48503 SUSE bug 1212863 cpe:/o:opensuse:leap:15.5 openSUSE Leap 15.5 The current implementation of the prctl syscall does not issue an IBPB immediately during the syscall. The ib_prctl_set ?function updates the Thread Information Flags (TIFs) for the task and updates the SPEC_CTRL MSR on the function __speculation_ctrl_update, but the IBPB is only issued on the next schedule, when the TIF bits are checked. This leaves the victim vulnerable to values already injected on the BTB, prior to the prctl syscall. ?The patch that added the support for the conditional mitigation via prctl (ib_prctl_set) dates back to the kernel 4.9.176. We recommend upgrading past commit?a664ec9158eeddd75121d39c9a0758016097fa96 Moderate CVE-2023-0045 SUSE bug 1207773 cpe:/o:opensuse:leap:15.5 openSUSE Leap 15.5 A NULL pointer dereference vulnerability in the Linux kernel NVMe functionality, in nvmet_setup_auth(), allows an attacker to perform a Pre-Auth Denial of Service (DoS) attack on a remote machine. Affected versions v6.0-rc1 to v6.0-rc3, fixed in v6.0-rc4. Moderate CVE-2023-0122 SUSE bug 1207050 cpe:/o:opensuse:leap:15.5 openSUSE Leap 15.5 A buffer overflow vulnerability was found in the Netfilter subsystem in the Linux Kernel. This issue could allow the leakage of both stack and heap addresses, and potentially allow Local Privilege Escalation to the root user via arbitrary code execution. Important CVE-2023-0179 SUSE bug 1207034 SUSE bug 1207139 SUSE bug 1215208 cpe:/o:opensuse:leap:15.5 openSUSE Leap 15.5 A vulnerability in the lsi53c895a device affects the latest version of qemu. A DMA-MMIO reentrancy problem may lead to memory corruption bugs like stack overflow or use-after-free. Moderate CVE-2023-0330 SUSE bug 1207205 cpe:/o:opensuse:leap:15.5 openSUSE Leap 15.5 A flaw was found in the Linux kernel, where unauthorized access to the execution of the setuid file with capabilities was found in the Linux kernel’s OverlayFS subsystem in how a user copies a capable file from a nosuid mount into another mount. This uid mapping bug allows a local user to escalate their privileges on the system. Important CVE-2023-0386 SUSE bug 1209615 SUSE bug 1210499 cpe:/o:opensuse:leap:15.5 openSUSE Leap 15.5 A NULL pointer dereference flaw was found in rawv6_push_pending_frames in net/ipv6/raw.c in the network subcomponent in the Linux kernel. This flaw causes the system to crash. Moderate CVE-2023-0394 SUSE bug 1207168 cpe:/o:opensuse:leap:15.5 openSUSE Leap 15.5 Copy_from_user on 64-bit versions of the Linux kernel does not implement the __uaccess_begin_nospec allowing a user to bypass the "access_ok" check and pass a kernel pointer to copy_from_user(). This would allow an attacker to leak information. We recommend upgrading beyond commit?74e19ef0ff8061ef55957c3abd71614ef0f42f47 Moderate CVE-2023-0459 SUSE bug 1211738 SUSE bug 1215674 cpe:/o:opensuse:leap:15.5 openSUSE Leap 15.5 There is a use-after-free vulnerability in the Linux Kernel which can be exploited to achieve local privilege escalation. To reach the vulnerability kernel configuration flag CONFIG_TLS?or CONFIG_XFRM_ESPINTCP?has to be configured, but the operation does not require any privilege. There is a use-after-free bug of icsk_ulp_data?of a struct inet_connection_sock. When CONFIG_TLS?is enabled, user can install a tls context (struct tls_context) on a connected tcp socket. The context is not cleared if this socket is disconnected and reused as a listener. If a new socket is created from the listener, the context is inherited and vulnerable. The setsockopt?TCP_ULP?operation does not require any privilege. We recommend upgrading past commit?2c02d41d71f90a5168391b6a5f2954112ba2307c Important CVE-2023-0461 SUSE bug 1208787 SUSE bug 1208911 SUSE bug 1211833 cpe:/o:opensuse:leap:15.5 openSUSE Leap 15.5 A use-after-free flaw was found in io_uring/filetable.c in io_install_fixed_file in the io_uring subcomponent in the Linux Kernel during call cleanup. This flaw may lead to a denial of service. Moderate CVE-2023-0469 SUSE bug 1207521 cpe:/o:opensuse:leap:15.5 openSUSE Leap 15.5 NonFree Use after free in WebTransport in Google Chrome prior to 109.0.5414.119 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page. (Chromium security severity: High) Important CVE-2023-0471 SUSE bug 1207512 openSUSE Leap 15.5 NonFree Use after free in WebRTC in Google Chrome prior to 109.0.5414.119 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page. (Chromium security severity: High) Important CVE-2023-0472 SUSE bug 1207512 openSUSE Leap 15.5 NonFree Type Confusion in ServiceWorker API in Google Chrome prior to 109.0.5414.119 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page. (Chromium security severity: Medium) Important CVE-2023-0473 SUSE bug 1207512 openSUSE Leap 15.5 NonFree Use after free in GuestView in Google Chrome prior to 109.0.5414.119 allowed an attacker who convinced a user to install a malicious extension to potentially exploit heap corruption via a Chrome web app. (Chromium security severity: Medium) Important CVE-2023-0474 SUSE bug 1207512 openSUSE Leap 15.5 A use-after-free flaw was found in qdisc_graft in net/sched/sch_api.c in the Linux Kernel due to a race problem. This flaw leads to a denial of service issue. If patch ebda44da44f6 ("net: sched: fix race condition in qdisc_graft()") not applied yet, then kernel could be affected. Important CVE-2023-0590 SUSE bug 1207795 SUSE bug 1207822 SUSE bug 1211495 SUSE bug 1211833 cpe:/o:opensuse:leap:15.5 openSUSE Leap 15.5 A flaw possibility of memory leak in the Linux kernel cpu_entry_area mapping of X86 CPU data to memory was found in the way user can guess location of exception stack(s) or other important data. A local user could use this flaw to get access to some important data with expected location in memory. Moderate CVE-2023-0597 SUSE bug 1207845 SUSE bug 1212395 SUSE bug 1213271 cpe:/o:opensuse:leap:15.5 openSUSE Leap 15.5 Due to failure in validating the length provided by an attacker-crafted MSMMS packet, Wireshark version 4.0.5 and prior, in an unusual configuration, is susceptible to a heap-based buffer overflow, and possibly code execution in the context of the process running Wireshark Low CVE-2023-0667 SUSE bug 1212084 cpe:/o:opensuse:leap:15.5 openSUSE Leap 15.5 Due to failure in validating the length provided by an attacker-crafted IEEE-C37.118 packet, Wireshark version 4.0.5 and prior, by default, is susceptible to a heap-based buffer overflow, and possibly code execution in the context of the process running Wireshark. Moderate CVE-2023-0668 SUSE bug 1211710 cpe:/o:opensuse:leap:15.5 openSUSE Leap 15.5 ** DISPUTED ** A vulnerability was found in GNU C Library 2.38. It has been declared as critical. This vulnerability affects the function __monstartup of the file gmon.c of the component Call Graph Monitor. The manipulation leads to buffer overflow. It is recommended to apply a patch to fix this issue. VDB-220246 is the identifier assigned to this vulnerability. NOTE: The real existence of this vulnerability is still doubted at the moment. The inputs that induce this vulnerability are basically addresses of the running application that is built with gmon enabled. It's basically trusted input or input that needs an actual security flaw to be compromised or controlled. Low CVE-2023-0687 SUSE bug 1207975 cpe:/o:opensuse:leap:15.5 openSUSE Leap 15.5 NonFree Type confusion in V8 in Google Chrome prior to 110.0.5481.77 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page. (Chromium security severity: High) Important CVE-2023-0696 SUSE bug 1208029 openSUSE Leap 15.5 NonFree Inappropriate implementation in Full screen mode in Google Chrome on Android prior to 110.0.5481.77 allowed a remote attacker to spoof the contents of the security UI via a crafted HTML page. (Chromium security severity: High) Important CVE-2023-0697 SUSE bug 1208029 openSUSE Leap 15.5 NonFree Out of bounds read in WebRTC in Google Chrome prior to 110.0.5481.77 allowed a remote attacker to perform an out of bounds memory read via a crafted HTML page. (Chromium security severity: High) Important CVE-2023-0698 SUSE bug 1208029 openSUSE Leap 15.5 NonFree Use after free in GPU in Google Chrome prior to 110.0.5481.77 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page and browser shutdown. (Chromium security severity: Medium) Important CVE-2023-0699 SUSE bug 1208029 openSUSE Leap 15.5 NonFree Inappropriate implementation in Download in Google Chrome prior to 110.0.5481.77 allowed a remote attacker to potentially spoof the contents of the Omnibox (URL bar) via a crafted HTML page. (Chromium security severity: Medium) Important CVE-2023-0700 SUSE bug 1208029 openSUSE Leap 15.5 NonFree Heap buffer overflow in WebUI in Google Chrome prior to 110.0.5481.77 allowed a remote attacker who convinced a user to engage in specific UI interactions to potentially exploit heap corruption via UI interaction . (Chromium security severity: Medium) Important CVE-2023-0701 SUSE bug 1208029 openSUSE Leap 15.5 NonFree Type confusion in Data Transfer in Google Chrome prior to 110.0.5481.77 allowed a remote attacker who convinced a user to engage in specific UI interactions to potentially exploit heap corruption via a crafted HTML page. (Chromium security severity: Medium) Important CVE-2023-0702 SUSE bug 1208029 openSUSE Leap 15.5 NonFree Type confusion in DevTools in Google Chrome prior to 110.0.5481.77 allowed a remote attacker who convinced a user to engage in specific UI interactions to potentially exploit heap corruption via UI interactions. (Chromium security severity: Medium) Important CVE-2023-0703 SUSE bug 1208029 openSUSE Leap 15.5 NonFree Insufficient policy enforcement in DevTools in Google Chrome prior to 110.0.5481.77 allowed a remote attacker to bypass same origin policy and proxy settings via a crafted HTML page. (Chromium security severity: Low) Important CVE-2023-0704 SUSE bug 1208029 openSUSE Leap 15.5 NonFree Integer overflow in Core in Google Chrome prior to 110.0.5481.77 allowed a remote attacker who had one a race condition to potentially exploit heap corruption via a crafted HTML page. (Chromium security severity: Low) Important CVE-2023-0705 SUSE bug 1208029 openSUSE Leap 15.5 LibTIFF 4.4.0 has an out-of-bounds read in tiffcrop in tools/tiffcrop.c:3488, allowing attackers to cause a denial-of-service via a crafted tiff file. For users that compile libtiff from sources, the fix is available with commit afaabc3e. Low CVE-2023-0795 SUSE bug 1208226 cpe:/o:opensuse:leap:15.5 openSUSE Leap 15.5 LibTIFF 4.4.0 has an out-of-bounds read in tiffcrop in tools/tiffcrop.c:3592, allowing attackers to cause a denial-of-service via a crafted tiff file. For users that compile libtiff from sources, the fix is available with commit afaabc3e. Low CVE-2023-0796 SUSE bug 1208227 cpe:/o:opensuse:leap:15.5 openSUSE Leap 15.5 LibTIFF 4.4.0 has an out-of-bounds read in tiffcrop in libtiff/tif_unix.c:368, invoked by tools/tiffcrop.c:2903 and tools/tiffcrop.c:6921, allowing attackers to cause a denial-of-service via a crafted tiff file. For users that compile libtiff from sources, the fix is available with commit afaabc3e. Low CVE-2023-0797 SUSE bug 1208228 cpe:/o:opensuse:leap:15.5 openSUSE Leap 15.5 LibTIFF 4.4.0 has an out-of-bounds read in tiffcrop in tools/tiffcrop.c:3400, allowing attackers to cause a denial-of-service via a crafted tiff file. For users that compile libtiff from sources, the fix is available with commit afaabc3e. Low CVE-2023-0798 SUSE bug 1208229 cpe:/o:opensuse:leap:15.5 openSUSE Leap 15.5 LibTIFF 4.4.0 has an out-of-bounds read in tiffcrop in tools/tiffcrop.c:3701, allowing attackers to cause a denial-of-service via a crafted tiff file. For users that compile libtiff from sources, the fix is available with commit afaabc3e. Low CVE-2023-0799 SUSE bug 1208230 cpe:/o:opensuse:leap:15.5 openSUSE Leap 15.5 LibTIFF 4.4.0 has an out-of-bounds write in tiffcrop in tools/tiffcrop.c:3502, allowing attackers to cause a denial-of-service via a crafted tiff file. For users that compile libtiff from sources, the fix is available with commit 33aee127. Low CVE-2023-0800 SUSE bug 1208231 cpe:/o:opensuse:leap:15.5 openSUSE Leap 15.5 LibTIFF 4.4.0 has an out-of-bounds write in tiffcrop in libtiff/tif_unix.c:368, invoked by tools/tiffcrop.c:2903 and tools/tiffcrop.c:6778, allowing attackers to cause a denial-of-service via a crafted tiff file. For users that compile libtiff from sources, the fix is available with commit 33aee127. Low CVE-2023-0801 SUSE bug 1208232 cpe:/o:opensuse:leap:15.5 openSUSE Leap 15.5 LibTIFF 4.4.0 has an out-of-bounds write in tiffcrop in tools/tiffcrop.c:3724, allowing attackers to cause a denial-of-service via a crafted tiff file. For users that compile libtiff from sources, the fix is available with commit 33aee127. Low CVE-2023-0802 SUSE bug 1208233 cpe:/o:opensuse:leap:15.5 openSUSE Leap 15.5 LibTIFF 4.4.0 has an out-of-bounds write in tiffcrop in tools/tiffcrop.c:3516, allowing attackers to cause a denial-of-service via a crafted tiff file. For users that compile libtiff from sources, the fix is available with commit 33aee127. Low CVE-2023-0803 SUSE bug 1208234 cpe:/o:opensuse:leap:15.5 openSUSE Leap 15.5 LibTIFF 4.4.0 has an out-of-bounds write in tiffcrop in tools/tiffcrop.c:3609, allowing attackers to cause a denial-of-service via a crafted tiff file. For users that compile libtiff from sources, the fix is available with commit 33aee127. Low CVE-2023-0804 SUSE bug 1208236 cpe:/o:opensuse:leap:15.5 openSUSE Leap 15.5 NonFree Use after free in Web Payments API in Google Chrome on Android prior to 110.0.5481.177 allowed a remote attacker who had compromised the renderer process to potentially exploit heap corruption via a crafted HTML page. (Chromium security severity: High) Important CVE-2023-0927 SUSE bug 1208589 openSUSE Leap 15.5 NonFree Use after free in SwiftShader in Google Chrome prior to 110.0.5481.177 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page. (Chromium security severity: High) Important CVE-2023-0928 SUSE bug 1208589 openSUSE Leap 15.5 NonFree Use after free in Vulkan in Google Chrome prior to 110.0.5481.177 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page. (Chromium security severity: High) Important CVE-2023-0929 SUSE bug 1208589 openSUSE Leap 15.5 NonFree Heap buffer overflow in Video in Google Chrome prior to 110.0.5481.177 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page. (Chromium security severity: High) Important CVE-2023-0930 SUSE bug 1208589 openSUSE Leap 15.5 NonFree Use after free in Video in Google Chrome prior to 110.0.5481.177 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page. (Chromium security severity: High) Important CVE-2023-0931 SUSE bug 1208589 openSUSE Leap 15.5 NonFree Use after free in WebRTC in Google Chrome on Windows prior to 110.0.5481.177 allowed a remote attacker who convinced the user to engage in specific UI interactions to potentially exploit heap corruption via a crafted HTML page. (Chromium security severity: High) Important CVE-2023-0932 SUSE bug 1208589 openSUSE Leap 15.5 NonFree Integer overflow in PDF in Google Chrome prior to 110.0.5481.177 allowed a remote attacker to potentially exploit heap corruption via a crafted PDF file. (Chromium security severity: Medium) Important CVE-2023-0933 SUSE bug 1208589 openSUSE Leap 15.5 NonFree Use after free in Prompts in Google Chrome prior to 110.0.5481.177 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page. (Chromium security severity: Critical) Important CVE-2023-0941 SUSE bug 1208589 openSUSE Leap 15.5 Improper Validation of Array Index vulnerability in the spreadsheet component of The Document Foundation LibreOffice allows an attacker to craft a spreadsheet document that will cause an array index underflow when loaded. In the affected versions of LibreOffice certain malformed spreadsheet formulas, such as AGGREGATE, could be created with less parameters passed to the formula interpreter than it expected, leading to an array index underflow, in which case there is a risk that arbitrary code could be executed. This issue affects: The Document Foundation LibreOffice 7.4 versions prior to 7.4.6; 7.5 versions prior to 7.5.1. Important CVE-2023-0950 SUSE bug 1209242 cpe:/o:opensuse:leap:15.5 openSUSE Leap 15.5 A flaw was found in the Linux Kernel. The tls_is_tx_ready() incorrectly checks for list emptiness, potentially accessing a type confused entry to the list_head, leaking the last byte of the confused field that overlaps with rec->tx_ready. Low CVE-2023-1075 SUSE bug 1208598 cpe:/o:opensuse:leap:15.5 openSUSE Leap 15.5 A flaw was found in the Linux Kernel. The tun/tap sockets have their socket UID hardcoded to 0 due to a type confusion in their initialization function. While it will be often correct, as tuntap devices require CAP_NET_ADMIN, it may not always be the case, e.g., a non-root user only having that capability. This would make tun/tap sockets being incorrectly treated in filtering/routing decisions, possibly bypassing network filters. Moderate CVE-2023-1076 SUSE bug 1208599 SUSE bug 1214019 cpe:/o:opensuse:leap:15.5 openSUSE Leap 15.5 In the Linux kernel, pick_next_rt_entity() may return a type confused entry, not detected by the BUG_ON condition, as the confused entry will not be NULL, but list_head.The buggy error condition would lead to a type confused entry with the list head,which would then be used as a type confused sched_rt_entity,causing memory corruption. Important CVE-2023-1077 SUSE bug 1208600 SUSE bug 1208839 SUSE bug 1213841 SUSE bug 1213842 cpe:/o:opensuse:leap:15.5 openSUSE Leap 15.5 A flaw was found in the Linux Kernel in RDS (Reliable Datagram Sockets) protocol. The rds_rm_zerocopy_callback() uses list_entry() on the head of a list causing a type confusion. Local user can trigger this with rds_message_put(). Type confusion leads to `struct rds_msg_zcopy_info *info` actually points to something else that is potentially controlled by local user. It is known how to trigger this, which causes an out of bounds access, and a lock corruption. Important CVE-2023-1078 SUSE bug 1208601 SUSE bug 1208603 cpe:/o:opensuse:leap:15.5 openSUSE Leap 15.5 A flaw was found in the Linux kernel. A use-after-free may be triggered in asus_kbd_backlight_set when plugging/disconnecting in a malicious USB device, which advertises itself as an Asus device. Similarly to the previous known CVE-2023-25012, but in asus devices, the work_struct may be scheduled by the LED controller while the device is disconnecting, triggering a use-after-free on the struct asus_kbd_leds *led structure. A malicious USB device may exploit the issue to cause memory corruption with controlled data. Moderate CVE-2023-1079 SUSE bug 1208604 cpe:/o:opensuse:leap:15.5 openSUSE Leap 15.5 In nf_tables_updtable, if nf_tables_table_enable returns an error, nft_trans_destroy is called to free the transaction object. nft_trans_destroy() calls list_del(), but the transaction was never placed on a list -- the list head is all zeroes, this results in a NULL pointer dereference. Moderate CVE-2023-1095 SUSE bug 1208777 cpe:/o:opensuse:leap:15.5 openSUSE Leap 15.5 A flaw use after free in the Linux kernel integrated infrared receiver/transceiver driver was found in the way user detaching rc device. A local user could use this flaw to crash the system or potentially escalate their privileges on the system. Moderate CVE-2023-1118 SUSE bug 1208837 SUSE bug 1208910 SUSE bug 1210423 SUSE bug 1211495 SUSE bug 1213841 SUSE bug 1213842 cpe:/o:opensuse:leap:15.5 openSUSE Leap 15.5 ** RESERVED ** This candidate has been reserved by an organization or individual that will use it when announcing a new security problem. When the candidate has been publicized, the details for this candidate will be provided. Moderate CVE-2023-1192 SUSE bug 1208995 cpe:/o:opensuse:leap:15.5 openSUSE Leap 15.5 A hash collision flaw was found in the IPv6 connection lookup table in the Linux kernel’s IPv6 functionality when a user makes a new kind of SYN flood attack. A user located in the local network or with a high bandwidth connection can increase the CPU usage of the server that accepts IPV6 connections up to 95%. Moderate CVE-2023-1206 SUSE bug 1212703 cpe:/o:opensuse:leap:15.5 openSUSE Leap 15.5 NonFree Use after free in Swiftshader in Google Chrome prior to 111.0.5563.64 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page. (Chromium security severity: High) Important CVE-2023-1213 SUSE bug 1209040 openSUSE Leap 15.5 NonFree Type confusion in V8 in Google Chrome prior to 111.0.5563.64 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page. (Chromium security severity: High) Important CVE-2023-1214 SUSE bug 1209040 openSUSE Leap 15.5 NonFree Type confusion in CSS in Google Chrome prior to 111.0.5563.64 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page. (Chromium security severity: High) Important CVE-2023-1215 SUSE bug 1209040 openSUSE Leap 15.5 NonFree Use after free in DevTools in Google Chrome prior to 111.0.5563.64 allowed a remote attacker who had convienced the user to engage in direct UI interaction to potentially exploit heap corruption via a crafted HTML page. (Chromium security severity: High) Important CVE-2023-1216 SUSE bug 1209040 openSUSE Leap 15.5 NonFree Stack buffer overflow in Crash reporting in Google Chrome on Windows prior to 111.0.5563.64 allowed a remote attacker who had compromised the renderer process to obtain potentially sensitive information from process memory via a crafted HTML page. (Chromium security severity: High) Important CVE-2023-1217 SUSE bug 1209040 openSUSE Leap 15.5 NonFree Use after free in WebRTC in Google Chrome prior to 111.0.5563.64 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page. (Chromium security severity: High) Important CVE-2023-1218 SUSE bug 1209040 openSUSE Leap 15.5 NonFree Heap buffer overflow in Metrics in Google Chrome prior to 111.0.5563.64 allowed a remote attacker who had compromised the renderer process to potentially exploit heap corruption via a crafted HTML page. (Chromium security severity: High) Important CVE-2023-1219 SUSE bug 1209040 openSUSE Leap 15.5 NonFree Heap buffer overflow in UMA in Google Chrome prior to 111.0.5563.64 allowed a remote attacker who had compromised the renderer process to potentially exploit heap corruption via a crafted HTML page. (Chromium security severity: High) Important CVE-2023-1220 SUSE bug 1209040 openSUSE Leap 15.5 NonFree Insufficient policy enforcement in Extensions API in Google Chrome prior to 111.0.5563.64 allowed an attacker who convinced a user to install a malicious extension to bypass navigation restrictions via a crafted Chrome Extension. (Chromium security severity: Medium) Important CVE-2023-1221 SUSE bug 1209040 openSUSE Leap 15.5 NonFree Heap buffer overflow in Web Audio API in Google Chrome prior to 111.0.5563.64 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page. (Chromium security severity: Medium) Important CVE-2023-1222 SUSE bug 1209040 openSUSE Leap 15.5 NonFree Insufficient policy enforcement in Autofill in Google Chrome on Android prior to 111.0.5563.64 allowed a remote attacker to leak cross-origin data via a crafted HTML page. (Chromium security severity: Medium) Important CVE-2023-1223 SUSE bug 1209040 openSUSE Leap 15.5 NonFree Insufficient policy enforcement in Web Payments API in Google Chrome prior to 111.0.5563.64 allowed a remote attacker to bypass navigation restrictions via a crafted HTML page. (Chromium security severity: Medium) Important CVE-2023-1224 SUSE bug 1209040 openSUSE Leap 15.5 NonFree Insufficient policy enforcement in Navigation in Google Chrome on iOS prior to 111.0.5563.64 allowed a remote attacker to bypass same origin policy via a crafted HTML page. (Chromium security severity: Medium) Important CVE-2023-1225 SUSE bug 1209040 openSUSE Leap 15.5 NonFree Insufficient policy enforcement in Web Payments API in Google Chrome prior to 111.0.5563.64 allowed a remote attacker to bypass content security policy via a crafted HTML page. (Chromium security severity: Medium) Important CVE-2023-1226 SUSE bug 1209040 openSUSE Leap 15.5 NonFree Use after free in Core in Google Chrome on Lacros prior to 111.0.5563.64 allowed a remote attacker who convinced a user to engage in specific UI interaction to potentially exploit heap corruption via crafted UI interaction. (Chromium security severity: Medium) Important CVE-2023-1227 SUSE bug 1209040 openSUSE Leap 15.5 NonFree Insufficient policy enforcement in Intents in Google Chrome on Android prior to 111.0.5563.64 allowed a remote attacker to bypass navigation restrictions via a crafted HTML page. (Chromium security severity: Medium) Important CVE-2023-1228 SUSE bug 1209040 openSUSE Leap 15.5 NonFree Inappropriate implementation in Permission prompts in Google Chrome prior to 111.0.5563.64 allowed a remote attacker to bypass navigation restrictions via a crafted HTML page. (Chromium security severity: Medium) Important CVE-2023-1229 SUSE bug 1209040 openSUSE Leap 15.5 NonFree Inappropriate implementation in WebApp Installs in Google Chrome on Android prior to 111.0.5563.64 allowed an attacker who convinced a user to install a malicious WebApp to spoof the contents of the PWA installer via a crafted HTML page. (Chromium security severity: Medium) Important CVE-2023-1230 SUSE bug 1209040 openSUSE Leap 15.5 NonFree Inappropriate implementation in Autofill in Google Chrome on Android prior to 111.0.5563.64 allowed a remote attacker to potentially spoof the contents of the omnibox via a crafted HTML page. (Chromium security severity: Medium) Important CVE-2023-1231 SUSE bug 1209040 openSUSE Leap 15.5 NonFree Insufficient policy enforcement in Resource Timing in Google Chrome prior to 111.0.5563.64 allowed a remote attacker to obtain potentially sensitive information from API via a crafted HTML page. (Chromium security severity: Low) Important CVE-2023-1232 SUSE bug 1209040 openSUSE Leap 15.5 NonFree Insufficient policy enforcement in Resource Timing in Google Chrome prior to 111.0.5563.64 allowed an attacker who convinced a user to install a malicious extension to obtain potentially sensitive information from API via a crafted Chrome Extension. (Chromium security severity: Low) Important CVE-2023-1233 SUSE bug 1209040 openSUSE Leap 15.5 NonFree Inappropriate implementation in Intents in Google Chrome on Android prior to 111.0.5563.64 allowed a remote attacker to perform domain spoofing via a crafted HTML page. (Chromium security severity: Low) Important CVE-2023-1234 SUSE bug 1209040 openSUSE Leap 15.5 NonFree Type confusion in DevTools in Google Chrome prior to 111.0.5563.64 allowed a remote attacker who had compromised the renderer process to potentially exploit heap corruption via a crafted UI interaction. (Chromium security severity: Low) Important CVE-2023-1235 SUSE bug 1209040 openSUSE Leap 15.5 NonFree Inappropriate implementation in Internals in Google Chrome prior to 111.0.5563.64 allowed a remote attacker to spoof the origin of an iframe via a crafted HTML page. (Chromium security severity: Low) Important CVE-2023-1236 SUSE bug 1209040 openSUSE Leap 15.5 A use-after-free flaw was found in the Linux kernel’s core dump subsystem. This flaw allows a local user to crash the system. Only if patch 390031c94211 ("coredump: Use the vma snapshot in fill_files_note") not applied yet, then kernel could be affected. Moderate CVE-2023-1249 SUSE bug 1209039 cpe:/o:opensuse:leap:15.5 openSUSE Leap 15.5 Issue summary: The AES-XTS cipher decryption implementation for 64 bit ARM platform contains a bug that could cause it to read past the input buffer, leading to a crash. Impact summary: Applications that use the AES-XTS algorithm on the 64 bit ARM platform can crash in rare circumstances. The AES-XTS algorithm is usually used for disk encryption. The AES-XTS cipher decryption implementation for 64 bit ARM platform will read past the end of the ciphertext buffer if the ciphertext size is 4 mod 5 in 16 byte blocks, e.g. 144 bytes or 1024 bytes. If the memory after the ciphertext buffer is unmapped, this will trigger a crash which results in a denial of service. If an attacker can control the size and location of the ciphertext buffer being decrypted by an application using AES-XTS on 64 bit ARM, the application is affected. This is fairly unlikely making this issue a Low severity one. Moderate CVE-2023-1255 SUSE bug 1210714 cpe:/o:opensuse:leap:15.5 openSUSE Leap 15.5 A slab-out-of-bound read problem was found in brcmf_get_assoc_ies in drivers/net/wireless/broadcom/brcm80211/brcmfmac/cfg80211.c in the Linux Kernel. This issue could occur when assoc_info->req_len data is bigger than the size of the buffer, defined as WL_EXTRA_BUF_MAX, leading to a denial of service. Low CVE-2023-1380 SUSE bug 1209287 cpe:/o:opensuse:leap:15.5 openSUSE Leap 15.5 A data race flaw was found in the Linux kernel, between where con is allocated and con->sock is set. This issue leads to a NULL pointer dereference when accessing con->sock->sk in net/tipc/topsrv.c in the tipc protocol in the Linux kernel. Moderate CVE-2023-1382 SUSE bug 1209288 cpe:/o:opensuse:leap:15.5 openSUSE Leap 15.5 Grafana is an open-source platform for monitoring and observability. Starting with the 9.1 branch, Grafana introduced the ability to search for a JWT in the URL query parameter auth_token and use it as the authentication token. By enabling the "url_login" configuration option (disabled by default), a JWT might be sent to data sources. If an attacker has access to the data source, the leaked token could be used to authenticate to Grafana. Moderate CVE-2023-1387 SUSE bug 1210907 cpe:/o:opensuse:leap:15.5 openSUSE Leap 15.5 Grafana is an open-source platform for monitoring and observability.? Grafana had a stored XSS vulnerability in the Graphite FunctionDescription tooltip. The stored XSS vulnerability was possible due the value of the Function Description was not properly sanitized. An attacker needs to have control over the Graphite data source in order to manipulate a function description and a Grafana admin needs to configure the data source, later a Grafana user needs to select a tampered function and hover over the description.? Users may upgrade to version 8.5.22, 9.2.15 and 9.3.11 to receive a fix. Moderate CVE-2023-1410 SUSE bug 1209645 cpe:/o:opensuse:leap:15.5 openSUSE Leap 15.5 A flaw was found in KVM. When calling the KVM_GET_DEBUGREGS ioctl, on 32-bit systems, there might be some uninitialized portions of the kvm_debugregs structure that could be copied to userspace, causing an information leak. Low CVE-2023-1513 SUSE bug 1209532 cpe:/o:opensuse:leap:15.5 openSUSE Leap 15.5 ** RESERVED ** This candidate has been reserved by an organization or individual that will use it when announcing a new security problem. When the candidate has been publicized, the details for this candidate will be provided. Important CVE-2023-1521 SUSE bug 1212407 cpe:/o:opensuse:leap:15.5 openSUSE Leap 15.5 NonFree Use after free in Passwords in Google Chrome prior to 111.0.5563.110 allowed a remote attacker who had compromised the renderer process to potentially exploit heap corruption via a crafted HTML page. (Chromium security severity: High) Critical CVE-2023-1528 SUSE bug 1209598 openSUSE Leap 15.5 NonFree Out of bounds memory access in WebHID in Google Chrome prior to 111.0.5563.110 allowed a remote attacker to potentially exploit heap corruption via a malicious HID device. (Chromium security severity: High) Critical CVE-2023-1529 SUSE bug 1209598 openSUSE Leap 15.5 NonFree Use after free in PDF in Google Chrome prior to 111.0.5563.110 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page. (Chromium security severity: High) Critical CVE-2023-1530 SUSE bug 1209598 openSUSE Leap 15.5 NonFree Use after free in ANGLE in Google Chrome prior to 111.0.5563.110 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page. (Chromium security severity: High) Critical CVE-2023-1531 SUSE bug 1209598 openSUSE Leap 15.5 NonFree Out of bounds read in GPU Video in Google Chrome prior to 111.0.5563.110 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page. (Chromium security severity: High) Critical CVE-2023-1532 SUSE bug 1209598 openSUSE Leap 15.5 NonFree Use after free in WebProtect in Google Chrome prior to 111.0.5563.110 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page. (Chromium security severity: High) Critical CVE-2023-1533 SUSE bug 1209598 openSUSE Leap 15.5 NonFree Out of bounds read in ANGLE in Google Chrome prior to 111.0.5563.110 allowed a remote attacker who had compromised the renderer process to potentially exploit heap corruption via a crafted HTML page. (Chromium security severity: High) Critical CVE-2023-1534 SUSE bug 1209598 openSUSE Leap 15.5 Heap based buffer overflow in binutils-gdb/bfd/libbfd.c in bfd_getl64. Low CVE-2023-1579 SUSE bug 1209642 SUSE bug 1213676 cpe:/o:opensuse:leap:15.5 openSUSE Leap 15.5 A race problem was found in fs/proc/task_mmu.c in the memory management sub-component in the Linux kernel. This issue may allow a local attacker with user privilege to cause a denial of service. Moderate CVE-2023-1582 SUSE bug 1209636 cpe:/o:opensuse:leap:15.5 openSUSE Leap 15.5 A NULL pointer dereference was found in io_file_bitmap_get in io_uring/filetable.c in the io_uring sub-component in the Linux Kernel. When fixed files are unregistered, some context information (file_alloc_{start,end} and alloc_hint) is not cleared. A subsequent request that has auto index selection enabled via IORING_FILE_INDEX_ALLOC can cause a NULL pointer dereference. An unprivileged user can use the flaw to cause a system crash. Moderate CVE-2023-1583 SUSE bug 1209637 cpe:/o:opensuse:leap:15.5 openSUSE Leap 15.5 A use-after-free flaw was found in btrfs_search_slot in fs/btrfs/ctree.c in btrfs in the Linux Kernel.This flaw allows an attacker to crash the system and possibly cause a kernel information lea Moderate CVE-2023-1611 SUSE bug 1209687 cpe:/o:opensuse:leap:15.5 openSUSE Leap 15.5 A flaw that boot CPU could be vulnerable for the speculative execution behavior kind of attacks in the Linux kernel X86 CPU Power management options functionality was found in the way user resuming CPU from suspend-to-RAM. A local user could use this flaw to potentially get unauthorized access to some memory of the CPU similar to the speculative execution behavior kind of attacks. Moderate CVE-2023-1637 SUSE bug 1209779 cpe:/o:opensuse:leap:15.5 openSUSE Leap 15.5 A use-after-free flaw was found in nfsd4_ssc_setup_dul in fs/nfsd/nfs4proc.c in the NFS filesystem in the Linux Kernel. This issue could allow a local attacker to crash the system or it may lead to a kernel information leak problem. Moderate CVE-2023-1652 SUSE bug 1209788 SUSE bug 1209797 cpe:/o:opensuse:leap:15.5 openSUSE Leap 15.5 A flaw was found in openvswitch (OVS). When processing an IP packet with protocol 0, OVS will install the datapath flow without the action modifying the IP header. This issue results (for both kernel and userspace datapath) in installing a datapath flow matching all IP protocols (nw_proto is wildcarded) for this flow, but with an incorrect action, possibly causing incorrect handling of other IP packets with a != 0 IP protocol that matches this dp flow. Moderate CVE-2023-1668 SUSE bug 1210054 cpe:/o:opensuse:leap:15.5 openSUSE Leap 15.5 A flaw use after free in the Linux kernel Xircom 16-bit PCMCIA (PC-card) Ethernet driver was found.A local user could use this flaw to crash the system or potentially escalate their privileges on the system. Moderate CVE-2023-1670 SUSE bug 1209871 cpe:/o:opensuse:leap:15.5 openSUSE Leap 15.5 Sensitive data could be exposed in logs of cloud-init before version 23.1.2. An attacker could use this information to find hashed passwords and possibly escalate their privilege. Moderate CVE-2023-1786 SUSE bug 1210277 cpe:/o:opensuse:leap:15.5 openSUSE Leap 15.5 A use-after-free vulnerability in the Linux Kernel traffic control index filter (tcindex) can be exploited to achieve local privilege escalation.?The tcindex_delete function which does not properly deactivate filters in case of a perfect hashes while deleting the underlying structure which can later lead to double freeing the structure.?A local attacker user can use this vulnerability to elevate its privileges to root. We recommend upgrading past commit 8c710f75256bb3cf05ac7b1672c82b92c43f3d28. Important CVE-2023-1829 SUSE bug 1210335 SUSE bug 1210619 cpe:/o:opensuse:leap:15.5 openSUSE Leap 15.5 A use-after-free flaw was found in vhost_net_set_backend in drivers/vhost/net.c in virtio network subcomponent in the Linux kernel due to a double fget. This flaw could allow a local attacker to crash the system, and could even lead to a kernel information leak problem. Moderate CVE-2023-1838 SUSE bug 1210203 cpe:/o:opensuse:leap:15.5 openSUSE Leap 15.5 A use-after-free flaw was found in xgene_hwmon_remove in drivers/hwmon/xgene-hwmon.c in the Hardware Monitoring Linux Kernel Driver (xgene-hwmon). This flaw could allow a local attacker to crash the system due to a race problem. This vulnerability could even lead to a kernel information leak problem. Moderate CVE-2023-1855 SUSE bug 1210202 cpe:/o:opensuse:leap:15.5 openSUSE Leap 15.5 A use-after-free flaw was found in xen_9pfs_front_removet in net/9p/trans_xen.c in Xen transport for 9pfs in the Linux Kernel. This flaw could allow a local attacker to crash the system due to a race problem, possibly leading to a kernel information leak. Low CVE-2023-1859 SUSE bug 1210169 cpe:/o:opensuse:leap:15.5 openSUSE Leap 15.5 A potential heap based buffer overflow was found in _bfd_elf_slurp_version_tables() in bfd/elf.c. This may lead to loss of availability. Low CVE-2023-1972 SUSE bug 1210297 cpe:/o:opensuse:leap:15.5 openSUSE Leap 15.5 A use-after-free flaw was found in btsdio_remove in drivers\bluetooth\btsdio.c in the Linux Kernel. In this flaw, a call to btsdio_remove with an unfinished job, may cause a race problem leading to a UAF on hdev devices. Important CVE-2023-1989 SUSE bug 1210336 SUSE bug 1210500 SUSE bug 1213841 SUSE bug 1213842 SUSE bug 1214128 cpe:/o:opensuse:leap:15.5 openSUSE Leap 15.5 The Linux kernel allows userspace processes to enable mitigations by calling prctl with PR_SET_SPECULATION_CTRL which disables the speculation feature as well as by using seccomp. We had noticed that on VMs of at least one major cloud provider, the kernel still left the victim process exposed to attacks in some cases even after enabling the spectre-BTI mitigation with prctl. The same behavior can be observed on a bare-metal machine when forcing the mitigation to IBRS on boot command line. This happened because when plain IBRS was enabled (not enhanced IBRS), the kernel had some logic that determined that STIBP was not needed. The IBRS bit implicitly protects against cross-thread branch target injection. However, with legacy IBRS, the IBRS bit was cleared on returning to userspace, due to performance reasons, which disabled the implicit STIBP and left userspace threads vulnerable to cross-thread branch target injection against which STIBP protects. Moderate CVE-2023-1998 SUSE bug 1210506 cpe:/o:opensuse:leap:15.5 openSUSE Leap 15.5 There exists a use after free/double free in libwebp. An attacker can use the?ApplyFiltersAndEncode() function and loop through to free best.bw and assign best = trial pointer. The second loop will then return 0 because of an Out of memory error in VP8 encoder, the pointer is still assigned to trial and the AddressSanitizer will attempt a double free.? Important CVE-2023-1999 SUSE bug 1213054 cpe:/o:opensuse:leap:15.5 openSUSE Leap 15.5 A vulnerability was found in the HCI sockets implementation due to a missing capability check in net/bluetooth/hci_sock.c in the Linux Kernel. This flaw allows an attacker to unauthorized execution of management commands, compromising the confidentiality, integrity, and availability of Bluetooth communication. Moderate CVE-2023-2002 SUSE bug 1210533 SUSE bug 1210566 cpe:/o:opensuse:leap:15.5 openSUSE Leap 15.5 ** REJECT ** DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: none. Reason: This candidate was withdrawn by its CNA. Further investigation showed that it was not a security issue. Notes: none. Moderate CVE-2023-2004 SUSE bug 1210419 cpe:/o:opensuse:leap:15.5 openSUSE Leap 15.5 The specific flaw exists within the DPT I2O Controller driver. The issue results from the lack of proper locking when performing operations on an object. An attacker can leverage this in conjunction with other vulnerabilities to escalate privileges and execute arbitrary code in the context of the kernel. Moderate CVE-2023-2007 SUSE bug 1210448 cpe:/o:opensuse:leap:15.5 openSUSE Leap 15.5 A vulnerability in the filesystem image parser for Hierarchical File System Plus (HFS+) of ClamAV could allow an unauthenticated, remote attacker to cause a denial of service (DoS) condition on an affected device. This vulnerability is due to an incorrect check for completion when a file is decompressed, which may result in a loop condition that could cause the affected software to stop responding. An attacker could exploit this vulnerability by submitting a crafted HFS+ filesystem image to be scanned by ClamAV on an affected device. A successful exploit could allow the attacker to cause the ClamAV scanning process to stop responding, resulting in a DoS condition on the affected software and consuming available system resources. For a description of this vulnerability, see the ClamAV blog . Important CVE-2023-20197 SUSE bug 1214342 cpe:/o:opensuse:leap:15.5 openSUSE Leap 15.5 NonFree Type confusion in V8 in Google Chrome prior to 112.0.5615.121 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page. (Chromium security severity: High) Important CVE-2023-2033 SUSE bug 1210478 openSUSE Leap 15.5 A side channel vulnerability on some of the AMD CPUs may allow an attacker to influence the return address prediction. This may result in speculative execution at an attacker-controlled address, potentially leading to information disclosure. Moderate CVE-2023-20569 SUSE bug 1213287 cpe:/o:opensuse:leap:15.5 openSUSE Leap 15.5 A division-by-zero error on some AMD processors can potentially return speculative data resulting in loss of confidentiality.? Moderate CVE-2023-20588 SUSE bug 1213927 cpe:/o:opensuse:leap:15.5 openSUSE Leap 15.5 An issue in “Zen 2” CPUs, under specific microarchitectural circumstances, may allow an attacker to potentially access sensitive information. Moderate CVE-2023-20593 SUSE bug 1213286 SUSE bug 1213616 SUSE bug 1215674 cpe:/o:opensuse:leap:15.5 openSUSE Leap 15.5 A fully compromised ESXi host can force VMware Tools to fail to authenticate host-to-guest operations, impacting the confidentiality and integrity of the guest virtual machine. Low CVE-2023-20867 SUSE bug 1212143 SUSE bug 1214402 cpe:/o:opensuse:leap:15.5 openSUSE Leap 15.5 Salt masters prior to 3005.2 or 3006.2 contain a DOS in minion return. After receiving several bad packets on the request server equal to the number of worker threads, the master will become unresponsive to return requests until restarted. Moderate CVE-2023-20897 SUSE bug 1214796 cpe:/o:opensuse:leap:15.5 openSUSE Leap 15.5 Git Providers can read from the wrong environment because they get the same cache directory base name in Salt masters prior to 3005.2 or 3006.2. Anything that uses Git Providers with different environments can get garbage data or the wrong data, which can lead to wrongful data disclosure, wrongful executions, data corruption and/or crash. Moderate CVE-2023-20898 SUSE bug 1214797 cpe:/o:opensuse:leap:15.5 openSUSE Leap 15.5 A malicious actor that has been granted Guest Operation Privileges https://docs.vmware.com/en/VMware-vSphere/8.0/vsphere-security/GUID-6A952214-0E5E-4CCF-9D2A-90948FF643EC.html ?in a target virtual machine may be able to elevate their privileges if that target virtual machine has been assigned a more privileged Guest Alias https://vdc-download.vmware.com/vmwb-repository/dcr-public/d1902b0e-d479-46bf-8ac9-cee0e31e8ec0/07ce8dbd-db48-4261-9b8f-c6d3ad8ba472/vim.vm.guest.AliasManager.html . Important CVE-2023-20900 SUSE bug 1214566 cpe:/o:opensuse:leap:15.5 openSUSE Leap 15.5 In __efi_rt_asm_wrapper of efi-rt-wrapper.S, there is a possible bypass of shadow stack protection due to a logic error in the code. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.Product: AndroidVersions: Android kernelAndroid ID: A-260821414References: Upstream kernel Important CVE-2023-21102 SUSE bug 1212155 SUSE bug 1212346 cpe:/o:opensuse:leap:15.5 openSUSE Leap 15.5 In adreno_set_param of adreno_gpu.c, there is a possible memory corruption due to a double free. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.Product: AndroidVersions: Android kernelAndroid ID: A-265016072References: Upstream kernel Important CVE-2023-21106 SUSE bug 1211654 SUSE bug 1211655 cpe:/o:opensuse:leap:15.5 openSUSE Leap 15.5 An out-of-bounds memory access flaw was found in the Linux kernel’s XFS file system in how a user restores an XFS image after failure (with a dirty log journal). This flaw allows a local user to crash or potentially escalate their privileges on the system. Moderate CVE-2023-2124 SUSE bug 1210498 cpe:/o:opensuse:leap:15.5 openSUSE Leap 15.5 NonFree Out of bounds memory access in Service Worker API in Google Chrome prior to 112.0.5615.137 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page. (Chromium security severity: High) Critical CVE-2023-2133 SUSE bug 1210618 openSUSE Leap 15.5 NonFree Out of bounds memory access in Service Worker API in Google Chrome prior to 112.0.5615.137 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page. (Chromium security severity: High) Critical CVE-2023-2134 SUSE bug 1210618 openSUSE Leap 15.5 NonFree Use after free in DevTools in Google Chrome prior to 112.0.5615.137 allowed a remote attacker who convinced a user to enable specific preconditions to potentially exploit heap corruption via a crafted HTML page. (Chromium security severity: High) Critical CVE-2023-2135 SUSE bug 1210618 openSUSE Leap 15.5 NonFree Integer overflow in Skia in Google Chrome prior to 112.0.5615.137 allowed a remote attacker who had compromised the renderer process to potentially perform a sandbox escape via a crafted HTML page. (Chromium security severity: High) Critical CVE-2023-2136 SUSE bug 1210618 openSUSE Leap 15.5 NonFree Heap buffer overflow in sqlite in Google Chrome prior to 112.0.5615.137 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page. (Chromium security severity: Medium) Important CVE-2023-2137 SUSE bug 1210618 SUSE bug 1210660 openSUSE Leap 15.5 In multiple functions of io_uring.c, there is a possible kernel memory corruption due to improper locking. This could lead to local escalation of privilege in the kernel with System execution privileges needed. User interaction is not needed for exploitation. Moderate CVE-2023-21400 SUSE bug 1213272 cpe:/o:opensuse:leap:15.5 openSUSE Leap 15.5 A flaw was found in the networking subsystem of the Linux kernel within the handling of the RPL protocol. This issue results from the lack of proper handling of user-supplied data, which can lead to an assertion failure. This may allow an unauthenticated remote attacker to create a denial of service condition on the system. Important CVE-2023-2156 SUSE bug 1211131 SUSE bug 1211395 cpe:/o:opensuse:leap:15.5 openSUSE Leap 15.5 A use-after-free vulnerability was found in iscsi_sw_tcp_session_create in drivers/scsi/iscsi_tcp.c in SCSI sub-component in the Linux Kernel. In this flaw an attacker could leak kernel internal information. Moderate CVE-2023-2162 SUSE bug 1210647 SUSE bug 1210662 SUSE bug 1213841 SUSE bug 1213842 SUSE bug 1214128 cpe:/o:opensuse:leap:15.5 openSUSE Leap 15.5 A null pointer dereference issue was found in can protocol in net/can/af_can.c in the Linux before Linux. ml_priv may not be initialized in the receive path of CAN frames. A local user could use this flaw to crash the system or potentially cause a denial of service. Moderate CVE-2023-2166 SUSE bug 1210627 cpe:/o:opensuse:leap:15.5 openSUSE Leap 15.5 A vulnerability was found in compare_netdev_and_ip in drivers/infiniband/core/cma.c in RDMA in the Linux Kernel. The improper cleanup results in out-of-boundary read, where a local user can utilize this problem to crash the system or escalation of privilege. Important CVE-2023-2176 SUSE bug 1210629 SUSE bug 1210630 SUSE bug 1213842 cpe:/o:opensuse:leap:15.5 openSUSE Leap 15.5 A null pointer dereference issue was found in the sctp network protocol in net/sctp/stream_sched.c in Linux Kernel. If stream_in allocation is failed, stream_out is freed which would further be accessed. A local user could use this flaw to crash the system or potentially cause a denial of service. Moderate CVE-2023-2177 SUSE bug 1210643 cpe:/o:opensuse:leap:15.5 openSUSE Leap 15.5 Grafana is an open-source platform for monitoring and observability. The option to send a test alert is not available from the user panel UI for users having the Viewer role. It is still possible for a user with the Viewer role to send a test alert using the API as the API does not check access to this function. This might enable malicious users to abuse the functionality by sending multiple alert messages to e-mail and Slack, spamming users, prepare Phishing attack or block SMTP server. Users may upgrade to version 9.5.3, 9.4.12, 9.3.15, 9.2.19 and 8.5.26 to receive a fix. Moderate CVE-2023-2183 SUSE bug 1212100 cpe:/o:opensuse:leap:15.5 openSUSE Leap 15.5 Vulnerability in the Oracle Java SE, Oracle GraalVM Enterprise Edition product of Oracle Java SE (component: JSSE). Supported versions that are affected are Oracle Java SE: 8u361, 8u361-perf, 11.0.18, 17.0.6, 20; Oracle GraalVM Enterprise Edition: 20.3.9, 21.3.5 and 22.3.1. Difficult to exploit vulnerability allows unauthenticated attacker with network access via TLS to compromise Oracle Java SE, Oracle GraalVM Enterprise Edition. Successful attacks of this vulnerability can result in unauthorized creation, deletion or modification access to critical data or all Oracle Java SE, Oracle GraalVM Enterprise Edition accessible data as well as unauthorized access to critical data or complete access to all Oracle Java SE, Oracle GraalVM Enterprise Edition accessible data. Note: This vulnerability applies to Java deployments, typically in clients running sandboxed Java Web Start applications or sandboxed Java applets, that load and run untrusted code (e.g., code that comes from the internet) and rely on the Java sandbox for security. This vulnerability can also be exploited by using APIs in the specified Component, e.g., through a web service which supplies data to the APIs. CVSS 3.1 Base Score 7.4 (Confidentiality and Integrity impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N). Important CVE-2023-21930 SUSE bug 1210628 cpe:/o:opensuse:leap:15.5 openSUSE Leap 15.5 Vulnerability in the Oracle Java SE, Oracle GraalVM Enterprise Edition product of Oracle Java SE (component: Networking). Supported versions that are affected are Oracle Java SE: 8u361, 8u361-perf, 11.0.18, 17.0.6, 20; Oracle GraalVM Enterprise Edition: 20.3.9, 21.3.5 and 22.3.1. Difficult to exploit vulnerability allows unauthenticated attacker with network access via multiple protocols to compromise Oracle Java SE, Oracle GraalVM Enterprise Edition. Successful attacks of this vulnerability can result in unauthorized update, insert or delete access to some of Oracle Java SE, Oracle GraalVM Enterprise Edition accessible data. Note: This vulnerability applies to Java deployments, typically in clients running sandboxed Java Web Start applications or sandboxed Java applets, that load and run untrusted code (e.g., code that comes from the internet) and rely on the Java sandbox for security. This vulnerability can also be exploited by using APIs in the specified Component, e.g., through a web service which supplies data to the APIs. CVSS 3.1 Base Score 3.7 (Integrity impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:N). Low CVE-2023-21937 SUSE bug 1210631 cpe:/o:opensuse:leap:15.5 openSUSE Leap 15.5 Vulnerability in the Oracle Java SE, Oracle GraalVM Enterprise Edition product of Oracle Java SE (component: Libraries). Supported versions that are affected are Oracle Java SE: 8u361, 8u361-perf, 11.0.18, 17.0.6, 20; Oracle GraalVM Enterprise Edition: 20.3.8, 21.3.4 and 22.3.0. Difficult to exploit vulnerability allows unauthenticated attacker with network access via multiple protocols to compromise Oracle Java SE, Oracle GraalVM Enterprise Edition. Successful attacks of this vulnerability can result in unauthorized update, insert or delete access to some of Oracle Java SE, Oracle GraalVM Enterprise Edition accessible data. Note: This vulnerability applies to Java deployments, typically in clients running sandboxed Java Web Start applications or sandboxed Java applets, that load and run untrusted code (e.g., code that comes from the internet) and rely on the Java sandbox for security. This vulnerability does not apply to Java deployments, typically in servers, that load and run only trusted code (e.g., code installed by an administrator). CVSS 3.1 Base Score 3.7 (Integrity impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:N). Low CVE-2023-21938 SUSE bug 1210632 cpe:/o:opensuse:leap:15.5 openSUSE Leap 15.5 Vulnerability in the Oracle Java SE, Oracle GraalVM Enterprise Edition product of Oracle Java SE (component: Swing). Supported versions that are affected are Oracle Java SE: 8u361, 8u361-perf, 11.0.18, 17.0.6, 20; Oracle GraalVM Enterprise Edition: 20.3.9, 21.3.5 and 22.3.1. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle Java SE, Oracle GraalVM Enterprise Edition. Successful attacks of this vulnerability can result in unauthorized update, insert or delete access to some of Oracle Java SE, Oracle GraalVM Enterprise Edition accessible data. Note: This vulnerability applies to Java deployments, typically in clients running sandboxed Java Web Start applications or sandboxed Java applets, that load and run untrusted code (e.g., code that comes from the internet) and rely on the Java sandbox for security. This vulnerability can also be exploited by using APIs in the specified Component, e.g., through a web service which supplies data to the APIs. CVSS 3.1 Base Score 5.3 (Integrity impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N). Moderate CVE-2023-21939 SUSE bug 1210634 cpe:/o:opensuse:leap:15.5 openSUSE Leap 15.5 An out-of-bounds write vulnerability was found in the Linux kernel's SLIMpro I2C device driver. The userspace "data->block[0]" variable was not capped to a number between 0-255 and was used as the size of a memcpy, possibly writing beyond the end of dma_buffer. This flaw could allow a local privileged user to crash the system or potentially achieve code execution. Moderate CVE-2023-2194 SUSE bug 1210715 cpe:/o:opensuse:leap:15.5 openSUSE Leap 15.5 Vulnerability in the Oracle Java SE, Oracle GraalVM Enterprise Edition product of Oracle Java SE (component: Hotspot). Supported versions that are affected are Oracle Java SE: 8u361, 8u361-perf, 11.0.18, 17.0.6; Oracle GraalVM Enterprise Edition: 20.3.9, 21.3.5 and 22.3.1. Difficult to exploit vulnerability allows unauthenticated attacker with network access via multiple protocols to compromise Oracle Java SE, Oracle GraalVM Enterprise Edition. Successful attacks of this vulnerability can result in unauthorized access to critical data or complete access to all Oracle Java SE, Oracle GraalVM Enterprise Edition accessible data. Note: This vulnerability applies to Java deployments, typically in clients running sandboxed Java Web Start applications or sandboxed Java applets, that load and run untrusted code (e.g., code that comes from the internet) and rely on the Java sandbox for security. This vulnerability can also be exploited by using APIs in the specified Component, e.g., through a web service which supplies data to the APIs. CVSS 3.1 Base Score 5.9 (Confidentiality impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N). Moderate CVE-2023-21954 SUSE bug 1210635 cpe:/o:opensuse:leap:15.5 openSUSE Leap 15.5 Vulnerability in the Oracle Java SE, Oracle GraalVM Enterprise Edition product of Oracle Java SE (component: JSSE). Supported versions that are affected are Oracle Java SE: 8u361, 8u361-perf, 11.0.18, 17.0.6, 20; Oracle GraalVM Enterprise Edition: 20.3.9, 21.3.5 and 22.3.1. Difficult to exploit vulnerability allows unauthenticated attacker with network access via HTTPS to compromise Oracle Java SE, Oracle GraalVM Enterprise Edition. Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of Oracle Java SE, Oracle GraalVM Enterprise Edition. Note: This vulnerability applies to Java deployments, typically in clients running sandboxed Java Web Start applications or sandboxed Java applets, that load and run untrusted code (e.g., code that comes from the internet) and rely on the Java sandbox for security. This vulnerability can also be exploited by using APIs in the specified Component, e.g., through a web service which supplies data to the APIs. CVSS 3.1 Base Score 5.9 (Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H). Moderate CVE-2023-21967 SUSE bug 1210636 cpe:/o:opensuse:leap:15.5 openSUSE Leap 15.5 Vulnerability in the Oracle Java SE, Oracle GraalVM Enterprise Edition product of Oracle Java SE (component: Libraries). Supported versions that are affected are Oracle Java SE: 8u361, 8u361-perf, 11.0.18, 17.0.6, 20; Oracle GraalVM Enterprise Edition: 20.3.9, 21.3.5 and 22.3.1. Difficult to exploit vulnerability allows unauthenticated attacker with network access via multiple protocols to compromise Oracle Java SE, Oracle GraalVM Enterprise Edition. Successful attacks of this vulnerability can result in unauthorized update, insert or delete access to some of Oracle Java SE, Oracle GraalVM Enterprise Edition accessible data. Note: This vulnerability applies to Java deployments, typically in clients running sandboxed Java Web Start applications or sandboxed Java applets, that load and run untrusted code (e.g., code that comes from the internet) and rely on the Java sandbox for security. This vulnerability can also be exploited by using APIs in the specified Component, e.g., through a web service which supplies data to the APIs. CVSS 3.1 Base Score 3.7 (Integrity impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:N). Low CVE-2023-21968 SUSE bug 1210637 cpe:/o:opensuse:leap:15.5 openSUSE Leap 15.5 Vulnerability in the MySQL Connectors product of Oracle MySQL (component: Connector/J). Supported versions that are affected are 8.0.32 and prior. Difficult to exploit vulnerability allows high privileged attacker with network access via multiple protocols to compromise MySQL Connectors. Successful attacks require human interaction from a person other than the attacker. Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of MySQL Connectors as well as unauthorized update, insert or delete access to some of MySQL Connectors accessible data and unauthorized read access to a subset of MySQL Connectors accessible data. CVSS 3.1 Base Score 5.3 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:H/UI:R/S:U/C:L/I:L/A:H). Moderate CVE-2023-21971 SUSE bug 1211247 SUSE bug 1212040 cpe:/o:opensuse:leap:15.5 openSUSE Leap 15.5 Vulnerability in the Oracle Java SE, Oracle GraalVM Enterprise Edition, Oracle GraalVM for JDK product of Oracle Java SE (component: Networking). Supported versions that are affected are Oracle Java SE: 11.0.19, 17.0.7, 20.0.1; Oracle GraalVM Enterprise Edition: 20.3.10, 21.3.6, 22.3.2; Oracle GraalVM for JDK: 17.0.7 and 20.0.1. Difficult to exploit vulnerability allows unauthenticated attacker with network access via multiple protocols to compromise Oracle Java SE, Oracle GraalVM Enterprise Edition, Oracle GraalVM for JDK. Successful attacks require human interaction from a person other than the attacker. Successful attacks of this vulnerability can result in unauthorized update, insert or delete access to some of Oracle Java SE, Oracle GraalVM Enterprise Edition, Oracle GraalVM for JDK accessible data. Note: This vulnerability applies to Java deployments, typically in clients running sandboxed Java Web Start applications or sandboxed Java applets, that load and run untrusted code (e.g., code that comes from the internet) and rely on the Java sandbox for security. This vulnerability does not apply to Java deployments, typically in servers, that load and run only trusted code (e.g., code installed by an administrator). CVSS 3.1 Base Score 3.1 (Integrity impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:N/I:L/A:N). Low CVE-2023-22006 SUSE bug 1213473 cpe:/o:opensuse:leap:15.5 openSUSE Leap 15.5 Vulnerability in the Oracle Java SE, Oracle GraalVM Enterprise Edition, Oracle GraalVM for JDK product of Oracle Java SE (component: Utility). Supported versions that are affected are Oracle Java SE: 11.0.19, 17.0.7, 20.0.1; Oracle GraalVM Enterprise Edition: 20.3.10, 21.3.6, 22.3.2; Oracle GraalVM for JDK: 17.0.7 and 20.0.1. Difficult to exploit vulnerability allows unauthenticated attacker with network access via multiple protocols to compromise Oracle Java SE, Oracle GraalVM Enterprise Edition, Oracle GraalVM for JDK. Successful attacks of this vulnerability can result in unauthorized ability to cause a partial denial of service (partial DOS) of Oracle Java SE, Oracle GraalVM Enterprise Edition, Oracle GraalVM for JDK. Note: This vulnerability can be exploited by using APIs in the specified Component, e.g., through a web service which supplies data to the APIs. This vulnerability also applies to Java deployments, typically in clients running sandboxed Java Web Start applications or sandboxed Java applets, that load and run untrusted code (e.g., code that comes from the internet) and rely on the Java sandbox for security. CVSS 3.1 Base Score 3.7 (Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:L). Low CVE-2023-22036 SUSE bug 1213474 cpe:/o:opensuse:leap:15.5 openSUSE Leap 15.5 Vulnerability in the Oracle Java SE, Oracle GraalVM Enterprise Edition, Oracle GraalVM for JDK product of Oracle Java SE (component: Hotspot). Supported versions that are affected are Oracle Java SE: 8u371-perf, 11.0.19, 17.0.7, 20.0.1; Oracle GraalVM Enterprise Edition: 20.3.10, 21.3.6, 22.3.2; Oracle GraalVM for JDK: 17.0.7 and 20.0.1. Difficult to exploit vulnerability allows unauthenticated attacker with logon to the infrastructure where Oracle Java SE, Oracle GraalVM Enterprise Edition, Oracle GraalVM for JDK executes to compromise Oracle Java SE, Oracle GraalVM Enterprise Edition, Oracle GraalVM for JDK. Successful attacks of this vulnerability can result in unauthorized access to critical data or complete access to all Oracle Java SE, Oracle GraalVM Enterprise Edition, Oracle GraalVM for JDK accessible data. Note: This vulnerability applies to Java deployments, typically in clients running sandboxed Java Web Start applications or sandboxed Java applets, that load and run untrusted code (e.g., code that comes from the internet) and rely on the Java sandbox for security. This vulnerability does not apply to Java deployments, typically in servers, that load and run only trusted code (e.g., code installed by an administrator). CVSS 3.1 Base Score 5.1 (Confidentiality impacts). CVSS Vector: (CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N). Moderate CVE-2023-22041 SUSE bug 1213475 cpe:/o:opensuse:leap:15.5 openSUSE Leap 15.5 Vulnerability in the Oracle Java SE, Oracle GraalVM Enterprise Edition, Oracle GraalVM for JDK product of Oracle Java SE (component: Hotspot). Supported versions that are affected are Oracle Java SE: 8u371-perf, 17.0.7, 20.0.1; Oracle GraalVM Enterprise Edition: 21.3.6, 22.3.2; Oracle GraalVM for JDK: 17.0.7 and 20.0.1. Difficult to exploit vulnerability allows unauthenticated attacker with network access via multiple protocols to compromise Oracle Java SE, Oracle GraalVM Enterprise Edition, Oracle GraalVM for JDK. Successful attacks of this vulnerability can result in unauthorized read access to a subset of Oracle Java SE, Oracle GraalVM Enterprise Edition, Oracle GraalVM for JDK accessible data. Note: This vulnerability can be exploited by using APIs in the specified Component, e.g., through a web service which supplies data to the APIs. This vulnerability also applies to Java deployments, typically in clients running sandboxed Java Web Start applications or sandboxed Java applets, that load and run untrusted code (e.g., code that comes from the internet) and rely on the Java sandbox for security. CVSS 3.1 Base Score 3.7 (Confidentiality impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N). Low CVE-2023-22044 SUSE bug 1213479 cpe:/o:opensuse:leap:15.5 openSUSE Leap 15.5 Vulnerability in the Oracle Java SE, Oracle GraalVM Enterprise Edition, Oracle GraalVM for JDK product of Oracle Java SE (component: Hotspot). Supported versions that are affected are Oracle Java SE: 8u371, 8u371-perf, 11.0.19, 17.0.7, 20.0.1; Oracle GraalVM Enterprise Edition: 20.3.10, 21.3.6, 22.3.2; Oracle GraalVM for JDK: 17.0.7 and 20.0.1. Difficult to exploit vulnerability allows unauthenticated attacker with network access via multiple protocols to compromise Oracle Java SE, Oracle GraalVM Enterprise Edition, Oracle GraalVM for JDK. Successful attacks of this vulnerability can result in unauthorized read access to a subset of Oracle Java SE, Oracle GraalVM Enterprise Edition, Oracle GraalVM for JDK accessible data. Note: This vulnerability can be exploited by using APIs in the specified Component, e.g., through a web service which supplies data to the APIs. This vulnerability also applies to Java deployments, typically in clients running sandboxed Java Web Start applications or sandboxed Java applets, that load and run untrusted code (e.g., code that comes from the internet) and rely on the Java sandbox for security. CVSS 3.1 Base Score 3.7 (Confidentiality impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N). Low CVE-2023-22045 SUSE bug 1213481 cpe:/o:opensuse:leap:15.5 openSUSE Leap 15.5 Vulnerability in the Oracle Java SE, Oracle GraalVM Enterprise Edition, Oracle GraalVM for JDK product of Oracle Java SE (component: Libraries). Supported versions that are affected are Oracle Java SE: 8u371, 8u371-perf, 11.0.19, 17.0.7, 20.0.1; Oracle GraalVM Enterprise Edition: 20.3.10, 21.3.6, 22.3.2; Oracle GraalVM for JDK: 17.0.7 and 20.0.1. Difficult to exploit vulnerability allows unauthenticated attacker with network access via multiple protocols to compromise Oracle Java SE, Oracle GraalVM Enterprise Edition, Oracle GraalVM for JDK. Successful attacks of this vulnerability can result in unauthorized update, insert or delete access to some of Oracle Java SE, Oracle GraalVM Enterprise Edition, Oracle GraalVM for JDK accessible data. Note: This vulnerability can be exploited by using APIs in the specified Component, e.g., through a web service which supplies data to the APIs. This vulnerability also applies to Java deployments, typically in clients running sandboxed Java Web Start applications or sandboxed Java applets, that load and run untrusted code (e.g., code that comes from the internet) and rely on the Java sandbox for security. CVSS 3.1 Base Score 3.7 (Integrity impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:N). Low CVE-2023-22049 SUSE bug 1213482 cpe:/o:opensuse:leap:15.5 openSUSE Leap 15.5 ** REJECT ** This was deemed not a security vulnerability by upstream. Low CVE-2023-2222 SUSE bug 1210733 cpe:/o:opensuse:leap:15.5 openSUSE Leap 15.5 A use-after-free vulnerability in the Linux Kernel Performance Events system can be exploited to achieve local privilege escalation. The perf_group_detach function did not check the event's siblings' attach_state before calling add_event_to_groups(), but?remove_on_exec made it possible to call list_del_event() on before detaching from their group, making it possible to use a dangling pointer causing a use-after-free vulnerability. We recommend upgrading past commit fd0815f632c24878e325821943edccc7fde947a2. Important CVE-2023-2235 SUSE bug 1210986 SUSE bug 1210987 cpe:/o:opensuse:leap:15.5 openSUSE Leap 15.5 A flaw was found in the `/v2/_catalog` endpoint in distribution/distribution, which accepts a parameter to control the maximum number of records returned (query string: `n`). This vulnerability allows a malicious user to submit an unreasonably large value for `n,` causing the allocation of a massive string array, possibly causing a denial of service through excessive use of memory. Important CVE-2023-2253 SUSE bug 1207705 cpe:/o:opensuse:leap:15.5 openSUSE Leap 15.5 Improper access control in editor components of The Document Foundation LibreOffice allowed an attacker to craft a document that would cause external links to be loaded without prompt. In the affected versions of LibreOffice documents that used "floating frames" linked to external files, would load the contents of those frames without prompting the user for permission to do so. This was inconsistent with the treatment of other linked content in LibreOffice. This issue affects: The Document Foundation LibreOffice 7.4 versions prior to 7.4.7; 7.5 versions prior to 7.5.3. Important CVE-2023-2255 SUSE bug 1211746 cpe:/o:opensuse:leap:15.5 openSUSE Leap 15.5 A Buffer Copy without Checking Size of Input ('Classic Buffer Overflow') vulnerability in openSUSE libeconf leads to DoS via malformed config files. This issue affects libeconf: before 0.5.2. Important CVE-2023-22652 SUSE bug 1211078 cpe:/o:opensuse:leap:15.5 openSUSE Leap 15.5 A denial of service problem was found, due to a possible recursive locking scenario, resulting in a deadlock in table_clear in drivers/md/dm-ioctl.c in the Linux Kernel Device Mapper-Multipathing sub-component. Moderate CVE-2023-2269 SUSE bug 1210806 cpe:/o:opensuse:leap:15.5 openSUSE Leap 15.5 In the Linux kernel before 6.0.3, drivers/gpu/drm/virtio/virtgpu_object.c misinterprets the drm_gem_shmem_get_sg_table return value (expects it to be NULL in the error case, whereas it is actually an error pointer). Moderate CVE-2023-22998 SUSE bug 1208776 cpe:/o:opensuse:leap:15.5 openSUSE Leap 15.5 In the Linux kernel before 5.17, drivers/phy/tegra/xusb.c mishandles the tegra_xusb_find_port_node return value. Callers expect NULL in the error case, but an error pointer is used. Low CVE-2023-23000 SUSE bug 1208816 cpe:/o:opensuse:leap:15.5 openSUSE Leap 15.5 In the Linux kernel before 5.16.3, drivers/scsi/ufs/ufs-mediatek.c misinterprets the regulator_get return value (expects it to be NULL in the error case, whereas it is actually an error pointer). Low CVE-2023-23001 SUSE bug 1208829 cpe:/o:opensuse:leap:15.5 openSUSE Leap 15.5 In the Linux kernel before 5.19, drivers/gpu/drm/arm/malidp_planes.c misinterprets the get_sg_table return value (expects it to be NULL in the error case, whereas it is actually an error pointer). Low CVE-2023-23004 SUSE bug 1208843 cpe:/o:opensuse:leap:15.5 openSUSE Leap 15.5 In the Linux kernel before 5.15.13, drivers/net/ethernet/mellanox/mlx5/core/steering/dr_domain.c misinterprets the mlx5_get_uars_page return value (expects it to be NULL in the error case, whereas it is actually an error pointer). Moderate CVE-2023-23006 SUSE bug 1208845 cpe:/o:opensuse:leap:15.5 openSUSE Leap 15.5 openSUSE Leap 15.5 NonFree Use after free in Offline in Google Chrome on Android prior to 116.0.5845.96 allowed a remote attacker who had compromised the renderer process to potentially exploit heap corruption via a crafted HTML page. (Chromium security severity: High) Important CVE-2023-2312 SUSE bug 1214301 cpe:/o:opensuse:leap:15.5 openSUSE Leap 15.5 cbq_classify in net/sched/sch_cbq.c in the Linux kernel through 6.1.4 allows attackers to cause a denial of service (slab-out-of-bounds read) because of type confusion (non-negative numbers can sometimes indicate a TC_ACT_SHOT condition rather than valid classification results). Important CVE-2023-23454 SUSE bug 1207036 SUSE bug 1207188 SUSE bug 1208030 SUSE bug 1208044 SUSE bug 1208085 SUSE bug 1211833 cpe:/o:opensuse:leap:15.5 openSUSE Leap 15.5 atm_tc_enqueue in net/sched/sch_atm.c in the Linux kernel through 6.1.4 allows attackers to cause a denial of service because of type confusion (non-negative numbers can sometimes indicate a TC_ACT_SHOT condition rather than valid classification results). Important CVE-2023-23455 SUSE bug 1207125 SUSE bug 1207189 SUSE bug 1211833 cpe:/o:opensuse:leap:15.5 openSUSE Leap 15.5 Improper access control in some 3rd Generation Intel(R) Xeon(R) Scalable processors may allow a privileged user to potentially enable information disclosure via local access. Important CVE-2023-23908 cpe:/o:opensuse:leap:15.5 openSUSE Leap 15.5 ** RESERVED ** This candidate has been reserved by an organization or individual that will use it when announcing a new security problem. When the candidate has been publicized, the details for this candidate will be provided. Important CVE-2023-23913 SUSE bug 1209826 cpe:/o:opensuse:leap:15.5 openSUSE Leap 15.5 The Nextcloud Desktop Client is a tool to synchronize files from a Nextcloud Server with your computer. Versions prior to 3.6.3 are missing sanitisation on qml labels which are used for basic HTML elements such as `strong`, `em` and `head` lines in the UI of the desktop client. The lack of sanitisation may allow for javascript injection. It is recommended that the Nextcloud Desktop Client is upgraded to 3.6.3. There are no known workarounds for this issue. Moderate CVE-2023-23942 SUSE bug 1207976 cpe:/o:opensuse:leap:15.5 openSUSE Leap 15.5 In Django 3.2 before 3.2.17, 4.0 before 4.0.9, and 4.1 before 4.1.6, the parsed values of Accept-Language headers are cached in order to avoid repetitive parsing. This leads to a potential denial-of-service vector via excessive memory usage if the raw value of Accept-Language headers is very large. Important CVE-2023-23969 SUSE bug 1207565 cpe:/o:opensuse:leap:15.5 openSUSE Leap 15.5 Use of Out-of-range Pointer Offset in GitHub repository vim/vim prior to 9.0.1499. Moderate CVE-2023-2426 SUSE bug 1210996 cpe:/o:opensuse:leap:15.5 openSUSE Leap 15.5 A vulnerability was found due to missing lock for IOPOLL flaw in io_cqring_event_overflow() in io_uring.c in Linux Kernel. This flaw allows a local attacker with user privilege to trigger a Denial of Service threat. Moderate CVE-2023-2430 SUSE bug 1211014 cpe:/o:opensuse:leap:15.5 openSUSE Leap 15.5 A security issue was discovered in Kubelet that allows pods to bypass the seccomp profile enforcement. Pods that use localhost type for seccomp profile but specify an empty profile field, are affected by this issue. In this scenario, this vulnerability allows the pod to run in unconfined (seccomp disabled) mode. This bug affects Kubelet. Low CVE-2023-2431 SUSE bug 1212493 cpe:/o:opensuse:leap:15.5 openSUSE Leap 15.5 An issue in the urllib.parse component of Python before 3.11.4 allows attackers to bypass blocklisting methods by supplying a URL that starts with blank characters. Important CVE-2023-24329 SUSE bug 1208471 SUSE bug 1213553 SUSE bug 1213554 SUSE bug 1213839 cpe:/o:opensuse:leap:15.5 openSUSE Leap 15.5 An issue was discovered in the Multipart Request Parser in Django 3.2 before 3.2.18, 4.0 before 4.0.10, and 4.1 before 4.1.7. Passing certain inputs (e.g., an excessive number of parts) to multipart forms could result in too many open files or memory exhaustion, and provided a potential vector for a denial-of-service attack. Important CVE-2023-24580 SUSE bug 1208082 cpe:/o:opensuse:leap:15.5 openSUSE Leap 15.5 Qt before 6.4.3 allows a denial of service via a crafted string when the SQL ODBC driver plugin is used and the size of SQLTCHAR is 4. The affected versions are 5.x before 5.15.13, 6.x before 6.2.8, and 6.3.x before 6.4.3. Important CVE-2023-24607 SUSE bug 1209616 cpe:/o:opensuse:leap:15.5 openSUSE Leap 15.5 cups-filters contains backends, filters, and other software required to get the cups printing service working on operating systems other than macos. If you use the Backend Error Handler (beh) to create an accessible network printer, this security vulnerability can cause remote code execution. `beh.c` contains the line `retval = system(cmdline) >> 8;` which calls the `system` command with the operand `cmdline`. `cmdline` contains multiple user controlled, unsanitized values. As a result an attacker with network access to the hosted print server can exploit this vulnerability to inject system commands which are executed in the context of the running server. This issue has been addressed in commit `8f2740357` and is expected to be bundled in the next release. Users are advised to upgrade when possible and to restrict access to network printers in the meantime. Important CVE-2023-24805 SUSE bug 1211340 cpe:/o:opensuse:leap:15.5 openSUSE Leap 15.5 ** REJECT ** DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: CVE-2023-33203. Reason: This candidate is a reservation duplicate of CVE-2023-33203. Notes: All CVE users should reference CVE-2023-33203 instead of this candidate. All references and descriptions in this candidate have been removed to prevent accidental usage. Moderate CVE-2023-2483 SUSE bug 1211037 cpe:/o:opensuse:leap:15.5 openSUSE Leap 15.5 Apache Commons FileUpload before 1.5 does not limit the number of request parts to be processed resulting in the possibility of an attacker triggering a DoS with a malicious upload or series of uploads. Note that, like all of the file upload limits, the new configuration option (FileUploadBase#setFileCountMax) is not enabled by default and must be explicitly configured. Important CVE-2023-24998 SUSE bug 1208513 SUSE bug 1210310 SUSE bug 1211608 cpe:/o:opensuse:leap:15.5 openSUSE Leap 15.5 The Linux kernel through 6.1.9 has a Use-After-Free in bigben_remove in drivers/hid/hid-bigbenff.c via a crafted USB device because the LED controllers remain registered for too long. Moderate CVE-2023-25012 SUSE bug 1207560 SUSE bug 1207846 cpe:/o:opensuse:leap:15.5 openSUSE Leap 15.5 A use-after-free vulnerability was found in the Linux kernel's ext4 filesystem in the way it handled the extra inode size for extended attributes. This flaw could allow a privileged local user to cause a system crash or other undefined behaviors. Moderate CVE-2023-2513 SUSE bug 1211105 cpe:/o:opensuse:leap:15.5 openSUSE Leap 15.5 Redis is an in-memory database that persists on disk. Authenticated users issuing specially crafted `SRANDMEMBER`, `ZRANDMEMBER`, and `HRANDFIELD` commands can trigger an integer overflow, resulting in a runtime assertion and termination of the Redis server process. This problem affects all Redis versions. Patches were released in Redis version(s) 6.0.18, 6.2.11 and 7.0.9. Important CVE-2023-25155 SUSE bug 1208790 SUSE bug 1208793 cpe:/o:opensuse:leap:15.5 openSUSE Leap 15.5 hb-ot-layout-gsubgpos.hh in HarfBuzz through 6.0.0 allows attackers to trigger O(n^2) growth via consecutive marks during the process of looking back for base glyphs when attaching marks. Important CVE-2023-25193 SUSE bug 1207922 SUSE bug 1213939 cpe:/o:opensuse:leap:15.5 openSUSE Leap 15.5 A refcounting issue which leads to potential memory leak was discovered in scipy commit 8627df31ab in Py_FindObjects() function. Low CVE-2023-25399 SUSE bug 1213062 cpe:/o:opensuse:leap:15.5 openSUSE Leap 15.5 A flaw was found in Binutils. The use of an uninitialized field in the struct module *module may lead to application crash and local denial of service. Low CVE-2023-25585 SUSE bug 1208040 cpe:/o:opensuse:leap:15.5 openSUSE Leap 15.5 ** REJECT ** DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: none. Reason: This candidate was withdrawn by its CNA. Further investigation showed that it was not a security issue. Notes: none. Low CVE-2023-25587 SUSE bug 1208038 cpe:/o:opensuse:leap:15.5 openSUSE Leap 15.5 A flaw was found in Binutils. The field `the_bfd` of `asymbol`struct is uninitialized in the `bfd_mach_o_get_synthetic_symtab` function, which may lead to an application crash and local denial of service. Low CVE-2023-25588 SUSE bug 1208037 cpe:/o:opensuse:leap:15.5 openSUSE Leap 15.5 In Eclipse Openj9 before version 0.38.0, in the implementation of the shared cache (which is enabled by default in OpenJ9 builds) the size of a string is not properly checked against the size of the buffer. Moderate CVE-2023-2597 SUSE bug 1211615 cpe:/o:opensuse:leap:15.5 openSUSE Leap 15.5 A vulnerability was found in the pthread_create() function in libcap. This issue may allow a malicious actor to use cause __real_pthread_create() to return an error, which can exhaust the process memory. Low CVE-2023-2602 SUSE bug 1211418 cpe:/o:opensuse:leap:15.5 openSUSE Leap 15.5 A vulnerability was found in libcap. This issue occurs in the _libcap_strdup() function and can lead to an integer overflow if the input string is close to 4GiB. Moderate CVE-2023-2603 SUSE bug 1211419 cpe:/o:opensuse:leap:15.5 openSUSE Leap 15.5 Jetty is a java based web server and servlet engine. In affected versions servlets with multipart support (e.g. annotated with `@MultipartConfig`) that call `HttpServletRequest.getParameter()` or `HttpServletRequest.getParts()` may cause `OutOfMemoryError` when the client sends a multipart request with a part that has a name but no filename and very large content. This happens even with the default settings of `fileSizeThreshold=0` which should stream the whole part content to disk. An attacker client may send a large multipart request and cause the server to throw `OutOfMemoryError`. However, the server may be able to recover after the `OutOfMemoryError` and continue its service -- although it may take some time. This issue has been patched in versions 9.4.51, 10.0.14, and 11.0.14. Users are advised to upgrade. Users unable to upgrade may set the multipart parameter `maxRequestSize` which must be set to a non-negative value, so the whole multipart content is limited (although still read into memory). Moderate CVE-2023-26048 SUSE bug 1210620 cpe:/o:opensuse:leap:15.5 openSUSE Leap 15.5 Jetty is a java based web server and servlet engine. Nonstandard cookie parsing in Jetty may allow an attacker to smuggle cookies within other cookies, or otherwise perform unintended behavior by tampering with the cookie parsing mechanism. If Jetty sees a cookie VALUE that starts with `"` (double quote), it will continue to read the cookie string until it sees a closing quote -- even if a semicolon is encountered. So, a cookie header such as: `DISPLAY_LANGUAGE="b; JSESSIONID=1337; c=d"` will be parsed as one cookie, with the name DISPLAY_LANGUAGE and a value of b; JSESSIONID=1337; c=d instead of 3 separate cookies. This has security implications because if, say, JSESSIONID is an HttpOnly cookie, and the DISPLAY_LANGUAGE cookie value is rendered on the page, an attacker can smuggle the JSESSIONID cookie into the DISPLAY_LANGUAGE cookie and thereby exfiltrate it. This is significant when an intermediary is enacting some policy based on cookies, so a smuggled cookie can bypass that policy yet still be seen by the Jetty server or its logging system. This issue has been addressed in versions 9.4.51, 10.0.14, 11.0.14, and 12.0.0.beta0 and users are advised to upgrade. There are no known workarounds for this issue. Low CVE-2023-26049 SUSE bug 1210621 cpe:/o:opensuse:leap:15.5 openSUSE Leap 15.5 NULL Pointer Dereference in GitHub repository vim/vim prior to 9.0.1531. Important CVE-2023-2609 SUSE bug 1211256 cpe:/o:opensuse:leap:15.5 openSUSE Leap 15.5 Integer Overflow or Wraparound in GitHub repository vim/vim prior to 9.0.1532. Important CVE-2023-2610 SUSE bug 1211257 cpe:/o:opensuse:leap:15.5 openSUSE Leap 15.5 All versions of the package configobj are vulnerable to Regular Expression Denial of Service (ReDoS) via the validate function, using (.+?)\((.*)\). **Note:** This is only exploitable in the case of a developer, putting the offending value in a server side configuration file. Low CVE-2023-26112 SUSE bug 1210070 cpe:/o:opensuse:leap:15.5 openSUSE Leap 15.5 Issue summary: Processing some specially crafted ASN.1 object identifiers or data containing them may be very slow. Impact summary: Applications that use OBJ_obj2txt() directly, or use any of the OpenSSL subsystems OCSP, PKCS7/SMIME, CMS, CMP/CRMF or TS with no message size limit may experience notable to very long delays when processing those messages, which may lead to a Denial of Service. An OBJECT IDENTIFIER is composed of a series of numbers - sub-identifiers - most of which have no size limit. OBJ_obj2txt() may be used to translate an ASN.1 OBJECT IDENTIFIER given in DER encoding form (using the OpenSSL type ASN1_OBJECT) to its canonical numeric text form, which are the sub-identifiers of the OBJECT IDENTIFIER in decimal form, separated by periods. When one of the sub-identifiers in the OBJECT IDENTIFIER is very large (these are sizes that are seen as absurdly large, taking up tens or hundreds of KiBs), the translation to a decimal number in text may take a very long time. The time complexity is O(n^2) with 'n' being the size of the sub-identifiers in bytes (*). With OpenSSL 3.0, support to fetch cryptographic algorithms using names / identifiers in string form was introduced. This includes using OBJECT IDENTIFIERs in canonical numeric text form as identifiers for fetching algorithms. Such OBJECT IDENTIFIERs may be received through the ASN.1 structure AlgorithmIdentifier, which is commonly used in multiple protocols to specify what cryptographic algorithm should be used to sign or verify, encrypt or decrypt, or digest passed data. Applications that call OBJ_obj2txt() directly with untrusted data are affected, with any version of OpenSSL. If the use is for the mere purpose of display, the severity is considered low. In OpenSSL 3.0 and newer, this affects the subsystems OCSP, PKCS7/SMIME, CMS, CMP/CRMF or TS. It also impacts anything that processes X.509 certificates, including simple things like verifying its signature. The impact on TLS is relatively low, because all versions of OpenSSL have a 100KiB limit on the peer's certificate chain. Additionally, this only impacts clients, or servers that have explicitly enabled client authentication. In OpenSSL 1.1.1 and 1.0.2, this only affects displaying diverse objects, such as X.509 certificates. This is assumed to not happen in such a way that it would cause a Denial of Service, so these versions are considered not affected by this issue in such a way that it would be cause for concern, and the severity is therefore considered low. Moderate CVE-2023-2650 SUSE bug 1211430 cpe:/o:opensuse:leap:15.5 openSUSE Leap 15.5 In the Linux kernel before 6.1.13, there is a double free in net/mpls/af_mpls.c upon an allocation failure (for registering the sysctl table under a new location) during the renaming of a device. Moderate CVE-2023-26545 SUSE bug 1208700 SUSE bug 1208909 SUSE bug 1210423 cpe:/o:opensuse:leap:15.5 openSUSE Leap 15.5 praecis_parse in ntpd/refclock_palisade.c in NTP 4.2.8p15 has an out-of-bounds write. Any attack method would be complex, e.g., with a manipulated GPS receiver. Moderate CVE-2023-26555 SUSE bug 1210390 cpe:/o:opensuse:leap:15.5 openSUSE Leap 15.5 An issue was discovered in hyper v0.13.7. h2-0.2.4 Stream stacking occurs when the H2 component processes HTTP2 RST_STREAM frames. As a result, the memory and CPU usage are high which can lead to a Denial of Service (DoS). Moderate CVE-2023-26964 SUSE bug 1210339 cpe:/o:opensuse:leap:15.5 openSUSE Leap 15.5 A vulnerability was found in libvirt. This security flaw ouccers due to repeatedly querying an SR-IOV PCI device's capabilities that exposes a memory leak caused by a failure to free the virPCIVirtualFunction array within the parent struct's g_autoptr cleanup. Moderate CVE-2023-2700 SUSE bug 1211390 cpe:/o:opensuse:leap:15.5 openSUSE Leap 15.5 NonFree Use after free in Navigation in Google Chrome prior to 113.0.5672.126 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page. (Chromium security severity: Critical) Important CVE-2023-2721 SUSE bug 1211442 openSUSE Leap 15.5 NonFree Use after free in Autofill UI in Google Chrome on Android prior to 113.0.5672.126 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page. (Chromium security severity: High) Important CVE-2023-2722 SUSE bug 1211442 openSUSE Leap 15.5 NonFree Use after free in DevTools in Google Chrome prior to 113.0.5672.126 allowed a remote attacker who had compromised the renderer process to potentially exploit heap corruption via a crafted HTML page. (Chromium security severity: High) Important CVE-2023-2723 SUSE bug 1211442 openSUSE Leap 15.5 NonFree Type confusion in V8 in Google Chrome prior to 113.0.5672.126 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page. (Chromium security severity: High) Important CVE-2023-2724 SUSE bug 1211442 openSUSE Leap 15.5 NonFree Use after free in Guest View in Google Chrome prior to 113.0.5672.126 allowed an attacker who convinced a user to install a malicious extension to potentially exploit heap corruption via a crafted HTML page. (Chromium security severity: High) Important CVE-2023-2725 SUSE bug 1211442 openSUSE Leap 15.5 NonFree Inappropriate implementation in WebApp Installs in Google Chrome prior to 113.0.5672.126 allowed an attacker who convinced a user to install a malicious web app to bypass install dialog via a crafted HTML page. (Chromium security severity: Medium) Important CVE-2023-2726 SUSE bug 1211442 openSUSE Leap 15.5 Users may be able to launch containers using images that are restricted by ImagePolicyWebhook when using ephemeral containers. Kubernetes clusters are only affected if the ImagePolicyWebhook admission plugin is used together with ephemeral containers. Moderate CVE-2023-2727 SUSE bug 1211630 cpe:/o:opensuse:leap:15.5 openSUSE Leap 15.5 Users may be able to launch containers that bypass the mountable secrets policy enforced by the ServiceAccount admission plugin when using ephemeral containers. The policy ensures pods running with a service account may only reference secrets specified in the service account’s secrets field. Kubernetes clusters are only affected if the ServiceAccount admission plugin and the `kubernetes.io/enforce-mountable-secrets` annotation are used together with ephemeral containers. Moderate CVE-2023-2728 SUSE bug 1211631 cpe:/o:opensuse:leap:15.5 openSUSE Leap 15.5 ** RESERVED ** This candidate has been reserved by an organization or individual that will use it when announcing a new security problem. When the candidate has been publicized, the details for this candidate will be provided. Important CVE-2023-27349 SUSE bug 1210398 cpe:/o:opensuse:leap:15.5 openSUSE Leap 15.5 A DoS vulnerability exists in Rack <v3.0.4.2, <v2.2.6.3, <v2.1.4.3 and <v2.0.9.3 within in the Multipart MIME parsing code in which could allow an attacker to craft requests that can be abuse to cause multipart parsing to take longer than expected. Important CVE-2023-27530 SUSE bug 1209095 cpe:/o:opensuse:leap:15.5 openSUSE Leap 15.5 CairoSVG is an SVG converter based on Cairo, a 2D graphics library. Prior to version 2.7.0, Cairo can send requests to external hosts when processing SVG files. A malicious actor could send a specially crafted SVG file that allows them to perform a server-side request forgery or denial of service. Version 2.7.0 disables CairoSVG's ability to access other files online by default. Critical CVE-2023-27586 SUSE bug 1209538 cpe:/o:opensuse:leap:15.5 openSUSE Leap 15.5 An issue found in TCPreplay tcprewrite v.4.4.3 allows a remote attacker to cause a denial of service via the tcpedit_dlt_cleanup function at plugins/dlt_plugins.c. Important CVE-2023-27783 SUSE bug 1209413 cpe:/o:opensuse:leap:15.5 openSUSE Leap 15.5 An issue found in TCPprep v.4.4.3 allows a remote attacker to cause a denial of service via the macinstring function. Important CVE-2023-27786 SUSE bug 1209416 cpe:/o:opensuse:leap:15.5 openSUSE Leap 15.5 Grafana is an open-source platform for monitoring and observability. Using public dashboards users can query multiple distinct data sources using mixed queries. However such query has a possibility of crashing a Grafana instance. The only feature that uses mixed queries at the moment is public dashboards, but it's also possible to cause this by calling the query API directly. This might enable malicious users to crash Grafana instances through that endpoint. Users may upgrade to version 9.4.12 and 9.5.3 to receive a fix. Important CVE-2023-2801 SUSE bug 1212099 cpe:/o:opensuse:leap:15.5 openSUSE Leap 15.5 ** RESERVED ** This candidate has been reserved by an organization or individual that will use it when announcing a new security problem. When the candidate has been publicized, the details for this candidate will be provided. Moderate CVE-2023-28120 SUSE bug 1209505 cpe:/o:opensuse:leap:15.5 openSUSE Leap 15.5 A use-after-free issue was addressed with improved memory management. This issue is fixed in iOS 16.4 and iPadOS 16.4, macOS Ventura 13.3. Processing web content may lead to arbitrary code execution. Important CVE-2023-28198 SUSE bug 1215230 SUSE bug 1215457 SUSE bug 1215589 cpe:/o:opensuse:leap:15.5 openSUSE Leap 15.5 An out-of-bounds read was addressed with improved input validation. This issue is fixed in watchOS 9.5, tvOS 16.5, macOS Ventura 13.4, iOS 15.7.6 and iPadOS 15.7.6, Safari 16.5, iOS 16.5 and iPadOS 16.5. Processing web content may disclose sensitive information. Apple is aware of a report that this issue may have been actively exploited. Moderate CVE-2023-28204 SUSE bug 1211659 cpe:/o:opensuse:leap:15.5 openSUSE Leap 15.5 Every `named` instance configured to run as a recursive resolver maintains a cache database holding the responses to the queries it has recently sent to authoritative servers. The size limit for that cache database can be configured using the `max-cache-size` statement in the configuration file; it defaults to 90% of the total amount of memory available on the host. When the size of the cache reaches 7/8 of the configured limit, a cache-cleaning algorithm starts to remove expired and/or least-recently used RRsets from the cache, to keep memory use below the configured limit. It has been discovered that the effectiveness of the cache-cleaning algorithm used in `named` can be severely diminished by querying the resolver for specific RRsets in a certain order, effectively allowing the configured `max-cache-size` limit to be significantly exceeded. This issue affects BIND 9 versions 9.11.0 through 9.16.41, 9.18.0 through 9.18.15, 9.19.0 through 9.19.13, 9.11.3-S1 through 9.16.41-S1, and 9.18.11-S1 through 9.18.15-S1. Important CVE-2023-2828 SUSE bug 1212544 cpe:/o:opensuse:leap:15.5 openSUSE Leap 15.5 A use after free vulnerability exists in curl <v8.1.0 in the way libcurl offers a feature to verify an SSH server's public key using a SHA 256 hash. When this check fails, libcurl would free the memory for the fingerprint before it returns an error message containing the (now freed) hash. This flaw risks inserting sensitive heap-based data into the error message that might be shown to users or otherwise get leaked and revealed. Moderate CVE-2023-28319 SUSE bug 1211230 cpe:/o:opensuse:leap:15.5 openSUSE Leap 15.5 A denial of service vulnerability exists in curl <v8.1.0 in the way libcurl provides several different backends for resolving host names, selected at build time. If it is built to use the synchronous resolver, it allows name resolves to time-out slow operations using `alarm()` and `siglongjmp()`. When doing this, libcurl used a global buffer that was not mutex protected and a multi-threaded application might therefore crash or otherwise misbehave. Low CVE-2023-28320 SUSE bug 1211231 cpe:/o:opensuse:leap:15.5 openSUSE Leap 15.5 An improper certificate validation vulnerability exists in curl <v8.1.0 in the way it supports matching of wildcard patterns when listed as "Subject Alternative Name" in TLS server certificates. curl can be built to use its own name matching function for TLS rather than one provided by a TLS library. This private wildcard matching function would match IDN (International Domain Name) hosts incorrectly and could as a result accept patterns that otherwise should mismatch. IDN hostnames are converted to puny code before used for certificate checks. Puny coded names always start with `xn--` and should not be allowed to pattern match, but the wildcard check in curl could still check for `x*`, which would match even though the IDN name most likely contained nothing even resembling an `x`. Moderate CVE-2023-28321 SUSE bug 1211232 cpe:/o:opensuse:leap:15.5 openSUSE Leap 15.5 An information disclosure vulnerability exists in curl <v8.1.0 when doing HTTP(S) transfers, libcurl might erroneously use the read callback (`CURLOPT_READFUNCTION`) to ask for data to send, even when the `CURLOPT_POSTFIELDS` option has been set, if the same handle previously wasused to issue a `PUT` request which used that callback. This flaw may surprise the application and cause it to misbehave and either send off the wrong data or use memory after free or similar in the second transfer. The problem exists in the logic for a reused handle when it is (expected to be) changed from a PUT to a POST. Important CVE-2023-28322 SUSE bug 1211233 cpe:/o:opensuse:leap:15.5 openSUSE Leap 15.5 A NULL pointer dereference flaw was found in the UNIX protocol in net/unix/diag.c In unix_diag_get_exact in the Linux Kernel. The newly allocated skb does not have sk, leading to a NULL pointer. This flaw allows a local user to crash or potentially cause a denial of service. Moderate CVE-2023-28327 SUSE bug 1209290 cpe:/o:opensuse:leap:15.5 openSUSE Leap 15.5 ** RESERVED ** This candidate has been reserved by an organization or individual that will use it when announcing a new security problem. When the candidate has been publicized, the details for this candidate will be provided. Moderate CVE-2023-28362 SUSE bug 1213312 cpe:/o:opensuse:leap:15.5 openSUSE Leap 15.5 Open redirect vulnerability in Tornado versions 6.3.1 and earlier allows a remote unauthenticated attacker to redirect a user to an arbitrary web site and conduct a phishing attack by having user access a specially crafted URL. Low CVE-2023-28370 SUSE bug 1211741 cpe:/o:opensuse:leap:15.5 openSUSE Leap 15.5 Improper restriction of operations within the bounds of a memory buffer in some Intel(R) i915 Graphics drivers for linux before kernel version 6.2.10 may allow an authenticated user to potentially enable escalation of privilege via local access. Important CVE-2023-28410 SUSE bug 1211263 SUSE bug 1211819 cpe:/o:opensuse:leap:15.5 openSUSE Leap 15.5 Redis is an in-memory database that persists on disk. Starting in version 7.0.8 and prior to version 7.0.10, authenticated users can use the MSETNX command to trigger a runtime assertion and termination of the Redis server process. The problem is fixed in Redis version 7.0.10. Moderate CVE-2023-28425 SUSE bug 1209528 cpe:/o:opensuse:leap:15.5 openSUSE Leap 15.5 hci_conn_cleanup in net/bluetooth/hci_conn.c in the Linux kernel through 6.2.9 has a use-after-free (observed in hci_conn_hash_flush) because of calls to hci_dev_put and hci_conn_put. There is a double free that may lead to privilege escalation. Important CVE-2023-28464 SUSE bug 1209052 SUSE bug 1211111 cpe:/o:opensuse:leap:15.5 openSUSE Leap 15.5 do_tls_getsockopt in net/tls/tls_main.c in the Linux kernel through 6.2.6 lacks a lock_sock call, leading to a race condition (with a resultant use-after-free or NULL pointer dereference). Important CVE-2023-28466 SUSE bug 1209366 SUSE bug 1210452 SUSE bug 1211833 SUSE bug 1213841 cpe:/o:opensuse:leap:15.5 openSUSE Leap 15.5 Candump log parser crash in Wireshark 4.0.0 to 4.0.5 and 3.6.0 to 3.6.13 allows denial of service via crafted capture file Moderate CVE-2023-2855 SUSE bug 1211703 cpe:/o:opensuse:leap:15.5 openSUSE Leap 15.5 VMS TCPIPtrace file parser crash in Wireshark 4.0.0 to 4.0.5 and 3.6.0 to 3.6.13 allows denial of service via crafted capture file Moderate CVE-2023-2856 SUSE bug 1211707 cpe:/o:opensuse:leap:15.5 openSUSE Leap 15.5 BLF file parser crash in Wireshark 4.0.0 to 4.0.5 and 3.6.0 to 3.6.13 allows denial of service via crafted capture file Moderate CVE-2023-2857 SUSE bug 1211705 cpe:/o:opensuse:leap:15.5 openSUSE Leap 15.5 NetScaler file parser crash in Wireshark 4.0.0 to 4.0.5 and 3.6.0 to 3.6.13 allows denial of service via crafted capture file Moderate CVE-2023-2858 SUSE bug 1211706 cpe:/o:opensuse:leap:15.5 openSUSE Leap 15.5 Code Injection in GitHub repository nilsteampassnet/teampass prior to 3.0.9. Important CVE-2023-2859 cpe:/o:opensuse:leap:15.5 openSUSE Leap 15.5 ** RESERVED ** This candidate has been reserved by an organization or individual that will use it when announcing a new security problem. When the candidate has been publicized, the details for this candidate will be provided. Important CVE-2023-2861 SUSE bug 1212968 cpe:/o:opensuse:leap:15.5 openSUSE Leap 15.5 The fix for CVE-2023-24998 was incomplete for Apache Tomcat 11.0.0-M2 to 11.0.0-M4, 10.1.5 to 10.1.7, 9.0.71 to 9.0.73 and 8.5.85 to 8.5.87. If non-default HTTP connector settings were used such that the maxParameterCount?could be reached using query string parameters and a request was submitted that supplied exactly maxParameterCount parameters?in the query string, the limit for uploaded request parts could be?bypassed with the potential for a denial of service to occur. Important CVE-2023-28709 SUSE bug 1211608 cpe:/o:opensuse:leap:15.5 openSUSE Leap 15.5 GDSDB infinite loop in Wireshark 4.0.0 to 4.0.5 and 3.6.0 to 3.6.13 allows denial of service via packet injection or crafted capture file Moderate CVE-2023-2879 SUSE bug 1211793 cpe:/o:opensuse:leap:15.5 openSUSE Leap 15.5 Moby is an open source container framework developed by Docker Inc. that is distributed as Docker, Mirantis Container Runtime, and various other downstream projects/products. The Moby daemon component (`dockerd`), which is developed as moby/moby, is commonly referred to as *Docker*. Swarm Mode, which is compiled in and delivered by default in dockerd and is thus present in most major Moby downstreams, is a simple, built-in container orchestrator that is implemented through a combination of SwarmKit and supporting network code. The overlay network driver is a core feature of Swarm Mode, providing isolated virtual LANs that allow communication between containers and services across the cluster. This driver is an implementation/user of VXLAN, which encapsulates link-layer (Ethernet) frames in UDP datagrams that tag the frame with a VXLAN Network ID (VNI) that identifies the originating overlay network. In addition, the overlay network driver supports an optional, off-by-default encrypted mode, which is especially useful when VXLAN packets traverses an untrusted network between nodes. Encrypted overlay networks function by encapsulating the VXLAN datagrams through the use of the IPsec Encapsulating Security Payload protocol in Transport mode. By deploying IPSec encapsulation, encrypted overlay networks gain the additional properties of source authentication through cryptographic proof, data integrity through check-summing, and confidentiality through encryption. When setting an endpoint up on an encrypted overlay network, Moby installs three iptables (Linux kernel firewall) rules that enforce both incoming and outgoing IPSec. These rules rely on the u32 iptables extension provided by the xt_u32 kernel module to directly filter on a VXLAN packet's VNI field, so that IPSec guarantees can be enforced on encrypted overlay networks without interfering with other overlay networks or other users of VXLAN. Two iptables rules serve to filter incoming VXLAN datagrams with a VNI that corresponds to an encrypted network and discards unencrypted datagrams. The rules are appended to the end of the INPUT filter chain, following any rules that have been previously set by the system administrator. Administrator-set rules take precedence over the rules Moby sets to discard unencrypted VXLAN datagrams, which can potentially admit unencrypted datagrams that should have been discarded. The injection of arbitrary Ethernet frames can enable a Denial of Service attack. A sophisticated attacker may be able to establish a UDP or TCP connection by way of the container’s outbound gateway that would otherwise be blocked by a stateful firewall, or carry out other escalations beyond simple injection by smuggling packets into the overlay network. Patches are available in Moby releases 23.0.3 and 20.10.24. As Mirantis Container Runtime's 20.10 releases are numbered differently, users of that platform should update to 20.10.16. Some workarounds are available. Close the VXLAN port (by default, UDP port 4789) to incoming traffic at the Internet boundary to prevent all VXLAN packet injection, and/or ensure that the `xt_u32` kernel module is available on all nodes of the Swarm cluster. Important CVE-2023-28840 SUSE bug 1214107 SUSE bug 1215525 cpe:/o:opensuse:leap:15.5 openSUSE Leap 15.5 Moby is an open source container framework developed by Docker Inc. that is distributed as Docker, Mirantis Container Runtime, and various other downstream projects/products. The Moby daemon component (`dockerd`), which is developed as moby/moby is commonly referred to as *Docker*. Swarm Mode, which is compiled in and delivered by default in `dockerd` and is thus present in most major Moby downstreams, is a simple, built-in container orchestrator that is implemented through a combination of SwarmKit and supporting network code. The `overlay` network driver is a core feature of Swarm Mode, providing isolated virtual LANs that allow communication between containers and services across the cluster. This driver is an implementation/user of VXLAN, which encapsulates link-layer (Ethernet) frames in UDP datagrams that tag the frame with the VXLAN metadata, including a VXLAN Network ID (VNI) that identifies the originating overlay network. In addition, the overlay network driver supports an optional, off-by-default encrypted mode, which is especially useful when VXLAN packets traverses an untrusted network between nodes. Encrypted overlay networks function by encapsulating the VXLAN datagrams through the use of the IPsec Encapsulating Security Payload protocol in Transport mode. By deploying IPSec encapsulation, encrypted overlay networks gain the additional properties of source authentication through cryptographic proof, data integrity through check-summing, and confidentiality through encryption. When setting an endpoint up on an encrypted overlay network, Moby installs three iptables (Linux kernel firewall) rules that enforce both incoming and outgoing IPSec. These rules rely on the `u32` iptables extension provided by the `xt_u32` kernel module to directly filter on a VXLAN packet's VNI field, so that IPSec guarantees can be enforced on encrypted overlay networks without interfering with other overlay networks or other users of VXLAN. An iptables rule designates outgoing VXLAN datagrams with a VNI that corresponds to an encrypted overlay network for IPsec encapsulation. Encrypted overlay networks on affected platforms silently transmit unencrypted data. As a result, `overlay` networks may appear to be functional, passing traffic as expected, but without any of the expected confidentiality or data integrity guarantees. It is possible for an attacker sitting in a trusted position on the network to read all of the application traffic that is moving across the overlay network, resulting in unexpected secrets or user data disclosure. Thus, because many database protocols, internal APIs, etc. are not protected by a second layer of encryption, a user may use Swarm encrypted overlay networks to provide confidentiality, which due to this vulnerability this is no longer guaranteed. Patches are available in Moby releases 23.0.3, and 20.10.24. As Mirantis Container Runtime's 20.10 releases are numbered differently, users of that platform should update to 20.10.16. Some workarounds are available. Close the VXLAN port (by default, UDP port 4789) to outgoing traffic at the Internet boundary in order to prevent unintentionally leaking unencrypted traffic over the Internet, and/or ensure that the `xt_u32` kernel module is available on all nodes of the Swarm cluster. Moderate CVE-2023-28841 SUSE bug 1214108 SUSE bug 1215525 cpe:/o:opensuse:leap:15.5 openSUSE Leap 15.5 Moby) is an open source container framework developed by Docker Inc. that is distributed as Docker, Mirantis Container Runtime, and various other downstream projects/products. The Moby daemon component (`dockerd`), which is developed as moby/moby is commonly referred to as *Docker*. Swarm Mode, which is compiled in and delivered by default in `dockerd` and is thus present in most major Moby downstreams, is a simple, built-in container orchestrator that is implemented through a combination of SwarmKit and supporting network code. The `overlay` network driver is a core feature of Swarm Mode, providing isolated virtual LANs that allow communication between containers and services across the cluster. This driver is an implementation/user of VXLAN, which encapsulates link-layer (Ethernet) frames in UDP datagrams that tag the frame with the VXLAN metadata, including a VXLAN Network ID (VNI) that identifies the originating overlay network. In addition, the overlay network driver supports an optional, off-by-default encrypted mode, which is especially useful when VXLAN packets traverses an untrusted network between nodes. Encrypted overlay networks function by encapsulating the VXLAN datagrams through the use of the IPsec Encapsulating Security Payload protocol in Transport mode. By deploying IPSec encapsulation, encrypted overlay networks gain the additional properties of source authentication through cryptographic proof, data integrity through check-summing, and confidentiality through encryption. When setting an endpoint up on an encrypted overlay network, Moby installs three iptables (Linux kernel firewall) rules that enforce both incoming and outgoing IPSec. These rules rely on the `u32` iptables extension provided by the `xt_u32` kernel module to directly filter on a VXLAN packet's VNI field, so that IPSec guarantees can be enforced on encrypted overlay networks without interfering with other overlay networks or other users of VXLAN. The `overlay` driver dynamically and lazily defines the kernel configuration for the VXLAN network on each node as containers are attached and detached. Routes and encryption parameters are only defined for destination nodes that participate in the network. The iptables rules that prevent encrypted overlay networks from accepting unencrypted packets are not created until a peer is available with which to communicate. Encrypted overlay networks silently accept cleartext VXLAN datagrams that are tagged with the VNI of an encrypted overlay network. As a result, it is possible to inject arbitrary Ethernet frames into the encrypted overlay network by encapsulating them in VXLAN datagrams. The implications of this can be quite dire, and GHSA-vwm3-crmr-xfxw should be referenced for a deeper exploration. Patches are available in Moby releases 23.0.3, and 20.10.24. As Mirantis Container Runtime's 20.10 releases are numbered differently, users of that platform should update to 20.10.16. Some workarounds are available. In multi-node clusters, deploy a global ‘pause’ container for each encrypted overlay network, on every node. For a single-node cluster, do not use overlay networks of any sort. Bridge networks provide the same connectivity on a single node and have no multi-node features. The Swarm ingress feature is implemented using an overlay network, but can be disabled by publishing ports in `host` mode instead of `ingress` mode (allowing the use of an external load balancer), and removing the `ingress` network. If encrypted overlay networks are in exclusive use, block UDP port 4789 from traffic that has not been validated by IPSec. Moderate CVE-2023-28842 SUSE bug 1214109 SUSE bug 1215525 cpe:/o:opensuse:leap:15.5 openSUSE Leap 15.5 Redis is an open source, in-memory database that persists on disk. Authenticated users can use the `HINCRBYFLOAT` command to create an invalid hash field that will crash Redis on access in affected versions. This issue has been addressed in in versions 7.0.11, 6.2.12, and 6.0.19. Users are advised to upgrade. There are no known workarounds for this issue. Moderate CVE-2023-28856 SUSE bug 1210548 cpe:/o:opensuse:leap:15.5 openSUSE Leap 15.5 In the Linux kernel through 6.2.8, net/bluetooth/hci_sync.c allows out-of-bounds access because amp_init1[] and amp_init2[] are supposed to have an intentionally invalid element, but do not. Moderate CVE-2023-28866 SUSE bug 1209780 cpe:/o:opensuse:leap:15.5 openSUSE Leap 15.5 Trustwave ModSecurity 3.0.5 through 3.0.8 before 3.0.9 allows a denial of service (worker crash and unresponsiveness) because some inputs cause a segfault in the Transaction class for some configurations. Moderate CVE-2023-28882 SUSE bug 1210993 cpe:/o:opensuse:leap:15.5 openSUSE Leap 15.5 Due to a failure in validating the length provided by an attacker-crafted CP2179 packet, Wireshark versions 2.0.0 through 4.0.7 is susceptible to a divide by zero allowing for a denial of service attack. Moderate CVE-2023-2906 SUSE bug 1214652 cpe:/o:opensuse:leap:15.5 openSUSE Leap 15.5 If the `recursive-clients` quota is reached on a BIND 9 resolver configured with both `stale-answer-enable yes;` and `stale-answer-client-timeout 0;`, a sequence of serve-stale-related lookups could cause `named` to loop and terminate unexpectedly due to a stack overflow. This issue affects BIND 9 versions 9.16.33 through 9.16.41, 9.18.7 through 9.18.15, 9.16.33-S1 through 9.16.41-S1, and 9.18.11-S1 through 9.18.15-S1. Important CVE-2023-2911 SUSE bug 1212544 SUSE bug 1212567 cpe:/o:opensuse:leap:15.5 openSUSE Leap 15.5 The go command may generate unexpected code at build time when using cgo. This may result in unexpected behavior when running a go program which uses cgo. This may occur when running an untrusted module which contains directories with newline characters in their names. Modules which are retrieved using the go command, i.e. via "go get", are not affected (modules retrieved using GOPATH-mode, i.e. GO111MODULE=off, may be affected). Critical CVE-2023-29402 SUSE bug 1212073 cpe:/o:opensuse:leap:15.5 openSUSE Leap 15.5 On Unix platforms, the Go runtime does not behave differently when a binary is run with the setuid/setgid bits. This can be dangerous in certain cases, such as when dumping memory state, or assuming the status of standard i/o file descriptors. If a setuid/setgid binary is executed with standard I/O file descriptors closed, opening any files can result in unexpected content being read or written with elevated privileges. Similarly, if a setuid/setgid program is terminated, either via panic or signal, it may leak the contents of its registers. Important CVE-2023-29403 SUSE bug 1212074 cpe:/o:opensuse:leap:15.5 openSUSE Leap 15.5 The go command may execute arbitrary code at build time when using cgo. This may occur when running "go get" on a malicious module, or when running any other command which builds untrusted code. This is can by triggered by linker flags, specified via a "#cgo LDFLAGS" directive. The arguments for a number of flags which are non-optional are incorrectly considered optional, allowing disallowed flags to be smuggled through the LDFLAGS sanitization. This affects usage of both the gc and gccgo compilers. Critical CVE-2023-29404 SUSE bug 1212075 cpe:/o:opensuse:leap:15.5 openSUSE Leap 15.5 The go command may execute arbitrary code at build time when using cgo. This may occur when running "go get" on a malicious module, or when running any other command which builds untrusted code. This is can by triggered by linker flags, specified via a "#cgo LDFLAGS" directive. Flags containing embedded spaces are mishandled, allowing disallowed flags to be smuggled through the LDFLAGS sanitization by including them in the argument of another flag. This only affects usage of the gccgo compiler. Critical CVE-2023-29405 SUSE bug 1212076 cpe:/o:opensuse:leap:15.5 openSUSE Leap 15.5 The HTTP/1 client does not fully validate the contents of the Host header. A maliciously crafted Host header can inject additional headers or entire requests. With fix, the HTTP/1 client now refuses to send requests containing an invalid Request.Host or Request.URL.Host value. Moderate CVE-2023-29406 SUSE bug 1213229 cpe:/o:opensuse:leap:15.5 openSUSE Leap 15.5 Extremely large RSA keys in certificate chains can cause a client/server to expend significant CPU time verifying signatures. With fix, the size of RSA keys transmitted during handshakes is restricted to <= 8192 bits. Based on a survey of publicly trusted RSA keys, there are currently only three certificates in circulation with keys larger than this, and all three appear to be test certificates that are not actively deployed. It is possible there are larger keys in use in private PKIs, but we target the web PKI, so causing breakage here in the interests of increasing the default safety of users of crypto/tls seems reasonable. Important CVE-2023-29409 SUSE bug 1213880 cpe:/o:opensuse:leap:15.5 openSUSE Leap 15.5 Stored or persistent cross-site scripting (XSS) is a type of XSS where the attacker first sends the payload to the web application, then the application saves the payload (e.g., in a database or server-side text files), and finally, the application unintentionally executes the payload for every victim visiting its web pages. Moderate CVE-2023-29454 SUSE bug 1213338 cpe:/o:opensuse:leap:15.5 openSUSE Leap 15.5 XRA dissector infinite loop in Wireshark 4.0.0 to 4.0.5 and 3.6.0 to 3.6.13 allows denial of service via packet injection or crafted capture file Low CVE-2023-2952 SUSE bug 1211844 cpe:/o:opensuse:leap:15.5 openSUSE Leap 15.5 A vulnerability was found in openldap. This security flaw causes a null pointer dereference in ber_memalloc_x() function. Moderate CVE-2023-2953 SUSE bug 1211795 cpe:/o:opensuse:leap:15.5 openSUSE Leap 15.5 A Segmentation fault caused by a floating point exception exists in libheif 1.15.1 using crafted heif images via the heif::Fraction::round() function in box.cc, which causes a denial of service. Moderate CVE-2023-29659 SUSE bug 1211174 cpe:/o:opensuse:leap:15.5 openSUSE Leap 15.5 Issue summary: The AES-SIV cipher implementation contains a bug that causes it to ignore empty associated data entries which are unauthenticated as a consequence. Impact summary: Applications that use the AES-SIV algorithm and want to authenticate empty data entries as associated data can be mislead by removing adding or reordering such empty entries as these are ignored by the OpenSSL implementation. We are currently unaware of any such applications. The AES-SIV algorithm allows for authentication of multiple associated data entries along with the encryption. To authenticate empty data the application has to call EVP_EncryptUpdate() (or EVP_CipherUpdate()) with NULL pointer as the output buffer and 0 as the input buffer length. The AES-SIV implementation in OpenSSL just returns success for such a call instead of performing the associated data authentication operation. The empty data thus will not be authenticated. As this issue does not affect non-empty associated data authentication and we expect it to be rare for an application to use empty associated data entries this is qualified as Low severity issue. Moderate CVE-2023-2975 SUSE bug 1213383 cpe:/o:opensuse:leap:15.5 openSUSE Leap 15.5 Use of Java's default temporary directory for file creation in `FileBackedOutputStream` in Google Guava versions 1.0 to 31.1 on Unix systems and Android Ice Cream Sandwich allows other users and apps on the machine with access to the default Java temporary directory to be able to access the files created by the class. Even though the security vulnerability is fixed in version 32.0.0, we recommend using version 32.0.1 as version 32.0.0 breaks some functionality under Windows. Moderate CVE-2023-2976 SUSE bug 1212401 cpe:/o:opensuse:leap:15.5 openSUSE Leap 15.5 A vulnerbility was found in OpenSC. This security flaw cause a buffer overrun vulnerability in pkcs15 cardos_have_verifyrc_package. The attacker can supply a smart card package with malformed ASN1 context. The cardos_have_verifyrc_package function scans the ASN1 buffer for 2 tags, where remaining length is wrongly caculated due to moved starting pointer. This leads to possible heap-based buffer oob read. In cases where ASAN is enabled while compiling this causes a crash. Further info leak or more damage is possible. Moderate CVE-2023-2977 SUSE bug 1211894 cpe:/o:opensuse:leap:15.5 openSUSE Leap 15.5 ** DISPUTED ** A use-after-free issue was discovered in Py_FindObjects() function in SciPy versions prior to 1.8.0. NOTE: the vendor and discoverer indicate that this is not a security issue. Moderate CVE-2023-29824 SUSE bug 1213137 cpe:/o:opensuse:leap:15.5 openSUSE Leap 15.5 A use after free flaw was found in hfsplus_put_super in fs/hfsplus/super.c in the Linux Kernel. This flaw could allow a local user to cause a denial of service problem. Moderate CVE-2023-2985 SUSE bug 1211867 cpe:/o:opensuse:leap:15.5 openSUSE Leap 15.5 A known cache speculation vulnerability, known as Branch History Injection (BHI) or Spectre-BHB, becomes actual again for the new hw AmpereOne. Spectre-BHB is similar to Spectre v2, except that malicious code uses the shared branch history (stored in the CPU Branch History Buffer, or BHB) to influence mispredicted branches within the victim's hardware context. Once that occurs, speculation caused by the mispredicted branches can cause cache allocation. This issue leads to obtaining information that should not be accessible. Moderate CVE-2023-3006 SUSE bug 1211855 cpe:/o:opensuse:leap:15.5 openSUSE Leap 15.5 A stack overflow vulnerability exists in function econf_writeFile in file atlibeconf/lib/libeconf.c in libeconf 0.5.1 allows attackers to cause a Denial of service or execute arbitrary code. Important CVE-2023-30078 SUSE bug 1214597 cpe:/o:opensuse:leap:15.5 openSUSE Leap 15.5 A stack overflow vulnerability exists in function read_file in atlibeconf/lib/getfilecontents.c in libeconf 0.5.1 allows attackers to cause a Denial of service or execute arbitrary code. Important CVE-2023-30079 SUSE bug 1214598 cpe:/o:opensuse:leap:15.5 openSUSE Leap 15.5 IBM Runtime Environment, Java Technology Edition IBMJCEPlus and JSSE 8.0.7.0 through 8.0.7.11 components could expose sensitive information using a combination of flaws and configurations. IBM X-Force ID: 253188. Important CVE-2023-30441 SUSE bug 1210711 cpe:/o:opensuse:leap:15.5 openSUSE Leap 15.5 An issue was discovered in arch/x86/kvm/vmx/nested.c in the Linux kernel before 6.2.8. nVMX on x86_64 lacks consistency checks for CR0 and CR4. Moderate CVE-2023-30456 SUSE bug 1210294 cpe:/o:opensuse:leap:15.5 openSUSE Leap 15.5 Cacti is an open source operational monitoring and fault management framework. There are two instances of insecure deserialization in Cacti version 1.2.24. While a viable gadget chain exists in Cacti’s vendor directory (phpseclib), the necessary gadgets are not included, making them inaccessible and the insecure deserializations not exploitable. Each instance of insecure deserialization is due to using the unserialize function without sanitizing the user input. Cacti has a “safe” deserialization that attempts to sanitize the content and check for specific values before calling unserialize, but it isn’t used in these instances. The vulnerable code lies in graphs_new.php, specifically within the host_new_graphs_save function. This issue has been addressed in version 1.2.25. Users are advised to upgrade. There are no known workarounds for this vulnerability. Moderate CVE-2023-30534 cpe:/o:opensuse:leap:15.5 openSUSE Leap 15.5 AMANDA (Advanced Maryland Automatic Network Disk Archiver) before tag-community-3.5.4 mishandles argument checking for runtar.c, a different vulnerability than CVE-2022-37705. Important CVE-2023-30577 SUSE bug 1213701 cpe:/o:opensuse:leap:15.5 openSUSE Leap 15.5 ** RESERVED ** This candidate has been reserved by an organization or individual that will use it when announcing a new security problem. When the candidate has been publicized, the details for this candidate will be provided. Important CVE-2023-30581 SUSE bug 1212574 cpe:/o:opensuse:leap:15.5 openSUSE Leap 15.5 ** RESERVED ** This candidate has been reserved by an organization or individual that will use it when announcing a new security problem. When the candidate has been publicized, the details for this candidate will be provided. Moderate CVE-2023-30585 SUSE bug 1212579 cpe:/o:opensuse:leap:15.5 openSUSE Leap 15.5 ** RESERVED ** This candidate has been reserved by an organization or individual that will use it when announcing a new security problem. When the candidate has been publicized, the details for this candidate will be provided. Moderate CVE-2023-30588 SUSE bug 1212581 cpe:/o:opensuse:leap:15.5 openSUSE Leap 15.5 The llhttp parser in the http module in Node v20.2.0 does not strictly use the CRLF sequence to delimit HTTP requests. This can lead to HTTP Request Smuggling (HRS). The CR character (without LF) is sufficient to delimit HTTP header fields in the llhttp parser. According to RFC7230 section 3, only the CRLF sequence should delimit each header-field. This impacts all Node.js active versions: v16, v18, and, v20 Moderate CVE-2023-30589 SUSE bug 1212582 cpe:/o:opensuse:leap:15.5 openSUSE Leap 15.5 ** RESERVED ** This candidate has been reserved by an organization or individual that will use it when announcing a new security problem. When the candidate has been publicized, the details for this candidate will be provided. Moderate CVE-2023-30590 SUSE bug 1212583 cpe:/o:opensuse:leap:15.5 openSUSE Leap 15.5 sqlparse is a non-validating SQL parser module for Python. In affected versions the SQL parser contains a regular expression that is vulnerable to ReDoS (Regular Expression Denial of Service). This issue was introduced by commit `e75e358`. The vulnerability may lead to Denial of Service (DoS). This issues has been fixed in sqlparse 0.4.4 by commit `c457abd5f`. Users are advised to upgrade. There are no known workarounds for this issue. Moderate CVE-2023-30608 SUSE bug 1210617 cpe:/o:opensuse:leap:15.5 openSUSE Leap 15.5 The Linux kernel before 6.2.9 has a race condition and resultant use-after-free in drivers/power/supply/da9150-charger.c if a physically proximate attacker unplugs a device. Moderate CVE-2023-30772 SUSE bug 1210329 cpe:/o:opensuse:leap:15.5 openSUSE Leap 15.5 Type confusion in V8 in Google Chrome prior to 114.0.5735.110 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page. (Chromium security severity: High) Important CVE-2023-3079 SUSE bug 1212044 cpe:/o:opensuse:leap:15.5 openSUSE Leap 15.5 Flask is a lightweight WSGI web application framework. When all of the following conditions are met, a response containing data intended for one client may be cached and subsequently sent by the proxy to other clients. If the proxy also caches `Set-Cookie` headers, it may send one client's `session` cookie to other clients. The severity depends on the application's use of the session and the proxy's behavior regarding cookies. The risk depends on all these conditions being met. 1. The application must be hosted behind a caching proxy that does not strip cookies or ignore responses with cookies. 2. The application sets `session.permanent = True` 3. The application does not access or modify the session at any point during a request. 4. `SESSION_REFRESH_EACH_REQUEST` enabled (the default). 5. The application does not set a `Cache-Control` header to indicate that a page is private or should not be cached. This happens because vulnerable versions of Flask only set the `Vary: Cookie` header when the session is accessed or modified, not when it is refreshed (re-sent to update the expiration) without being accessed or modified. This issue has been fixed in versions 2.3.2 and 2.2.5. Important CVE-2023-30861 SUSE bug 1211246 cpe:/o:opensuse:leap:15.5 openSUSE Leap 15.5 A heap out-of-bounds write vulnerability in the Linux Kernel ipvlan network driver can be exploited to achieve local privilege escalation. The out-of-bounds write is caused by missing skb->cb initialization in the ipvlan network driver. The vulnerability is reachable if?CONFIG_IPVLAN is enabled. We recommend upgrading past commit 90cbed5247439a966b645b34eb0a2e037836ea8e. Important CVE-2023-3090 SUSE bug 1212842 SUSE bug 1212849 SUSE bug 1214128 cpe:/o:opensuse:leap:15.5 openSUSE Leap 15.5 In Django 3.2 before 3.2.19, 4.x before 4.1.9, and 4.2 before 4.2.1, it was possible to bypass validation when using one form field to upload multiple files. This multiple upload has never been supported by forms.FileField or forms.ImageField (only the last uploaded file was validated). However, Django's "Uploading multiple files" documentation suggested otherwise. Moderate CVE-2023-31047 SUSE bug 1210866 cpe:/o:opensuse:leap:15.5 openSUSE Leap 15.5 An issue was discovered in drivers/bluetooth/hci_ldisc.c in the Linux kernel 6.2. In hci_uart_tty_ioctl, there is a race condition between HCIUARTSETPROTO and HCIUARTGETPROTO. HCI_UART_PROTO_SET is set before hu->proto is set. A NULL pointer dereference may occur. Moderate CVE-2023-31083 SUSE bug 1210780 cpe:/o:opensuse:leap:15.5 openSUSE Leap 15.5 An issue was discovered in drivers/media/dvb-core/dvb_frontend.c in the Linux kernel 6.2. There is a blocking operation when a task is in !TASK_RUNNING. In dvb_frontend_get_event, wait_event_interruptible is called; the condition is dvb_frontend_test_event(fepriv,events). In dvb_frontend_test_event, down(&fepriv->sem) is called. However, wait_event_interruptible would put the process to sleep, and down(&fepriv->sem) may block the process. Moderate CVE-2023-31084 SUSE bug 1210783 cpe:/o:opensuse:leap:15.5 openSUSE Leap 15.5 A use after free vulnerability was found in prepare_to_relocate in fs/btrfs/relocation.c in btrfs in the Linux Kernel. This possible flaw can be triggered by calling btrfs_ioctl_balance() before calling btrfs_ioctl_defrag(). Moderate CVE-2023-3111 SUSE bug 1212051 cpe:/o:opensuse:leap:15.5 openSUSE Leap 15.5 c-ares is an asynchronous resolver library. When cross-compiling c-ares and using the autotools build system, CARES_RANDOM_FILE will not be set, as seen when cross compiling aarch64 android. This will downgrade to using rand() as a fallback which could allow an attacker to take advantage of the lack of entropy by not using a CSPRNG. This issue was patched in version 1.19.1. Low CVE-2023-31124 SUSE bug 1211607 cpe:/o:opensuse:leap:15.5 openSUSE Leap 15.5 c-ares is an asynchronous resolver library. ares_inet_net_pton() is vulnerable to a buffer underflow for certain ipv6 addresses, in particular "0::00:00:00/2" was found to cause an issue. C-ares only uses this function internally for configuration purposes which would require an administrator to configure such an address via ares_set_sortlist(). However, users may externally use ares_inet_net_pton() for other purposes and thus be vulnerable to more severe issues. This issue has been fixed in 1.19.1. Moderate CVE-2023-31130 SUSE bug 1211606 cpe:/o:opensuse:leap:15.5 openSUSE Leap 15.5 c-ares is an asynchronous resolver library. When /dev/urandom or RtlGenRandom() are unavailable, c-ares uses rand() to generate random numbers used for DNS query ids. This is not a CSPRNG, and it is also not seeded by srand() so will generate predictable output. Input from the random number generator is fed into a non-compilant RC4 implementation and may not be as strong as the original RC4 implementation. No attempt is made to look for modern OS-provided CSPRNGs like arc4random() that is widely available. This issue has been fixed in version 1.19.1. Moderate CVE-2023-31147 SUSE bug 1211605 cpe:/o:opensuse:leap:15.5 openSUSE Leap 15.5 ** REJECT ** Duplicate of CVE-2023-3390. Important CVE-2023-3117 SUSE bug 1212934 SUSE bug 1213245 cpe:/o:opensuse:leap:15.5 openSUSE Leap 15.5 Linux Kernel nftables Use-After-Free Local Privilege Escalation Vulnerability; `nft_chain_lookup_byid()` failed to check whether a chain was active and CAP_NET_ADMIN is in any user or network namespace Important CVE-2023-31248 SUSE bug 1213061 SUSE bug 1213064 cpe:/o:opensuse:leap:15.5 openSUSE Leap 15.5 Grafana is validating Azure AD accounts based on the email claim. On Azure AD, the profile email field is not unique and can be easily modified. This leads to account takeover and authentication bypass when Azure AD OAuth is configured with a multi-tenant app. Critical CVE-2023-3128 SUSE bug 1212641 cpe:/o:opensuse:leap:15.5 openSUSE Leap 15.5 A vulnerability was found in libX11. The security flaw occurs because the functions in src/InitExt.c in libX11 do not check that the values provided for the Request, Event, or Error IDs are within the bounds of the arrays that those functions write to, using those IDs as array indexes. They trust that they were called with values provided by an Xserver adhering to the bounds specified in the X11 protocol, as all X servers provided by X.Org do. As the protocol only specifies a single byte for these values, an out-of-bounds value provided by a malicious server (or a malicious proxy-in-the-middle) can only overwrite other portions of the Display structure and not write outside the bounds of the Display structure itself, possibly causing the client to crash with this memory corruption. Important CVE-2023-3138 SUSE bug 1212102 SUSE bug 1212746 SUSE bug 1213994 cpe:/o:opensuse:leap:15.5 openSUSE Leap 15.5 A use-after-free flaw was found in r592_remove in drivers/memstick/host/r592.c in media access in the Linux Kernel. This flaw allows a local attacker to crash the system at device disconnect, possibly leading to a kernel information leak. Moderate CVE-2023-3141 SUSE bug 1212129 SUSE bug 1215674 cpe:/o:opensuse:leap:15.5 openSUSE Leap 15.5 qfq_change_class in net/sched/sch_qfq.c in the Linux kernel before 6.2.13 allows an out-of-bounds write because lmax can exceed QFQ_MIN_LMAX. Moderate CVE-2023-31436 SUSE bug 1210940 SUSE bug 1211260 SUSE bug 1213841 SUSE bug 1213842 SUSE bug 1214128 cpe:/o:opensuse:leap:15.5 openSUSE Leap 15.5 CPAN.pm before 2.35 does not verify TLS certificates when downloading distributions over HTTPS. Important CVE-2023-31484 SUSE bug 1210999 cpe:/o:opensuse:leap:15.5 openSUSE Leap 15.5 HTTP::Tiny before 0.083, a Perl core module since 5.13.9 and available standalone on CPAN, has an insecure default TLS configuration where users must opt in to verify certificates. Important CVE-2023-31486 SUSE bug 1211001 cpe:/o:opensuse:leap:15.5 openSUSE Leap 15.5 An issue found in Frrouting bgpd v.8.4.2 allows a remote attacker to cause a denial of service via the bgp_capability_llgr() function. Moderate CVE-2023-31489 SUSE bug 1211248 cpe:/o:opensuse:leap:15.5 openSUSE Leap 15.5 An issue found in Frrouting bgpd v.8.4.2 allows a remote attacker to cause a denial of service via the bgp_attr_psid_sub() function. Moderate CVE-2023-31490 SUSE bug 1211249 cpe:/o:opensuse:leap:15.5 openSUSE Leap 15.5 A vulnerability classified as critical has been found in SourceCodester Online Discussion Forum Site 1.0. This affects an unknown part of the file admin\posts\view_post.php. The manipulation leads to sql injection. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used. The identifier VDB-231021 was assigned to this vulnerability. Important CVE-2023-3152 cpe:/o:opensuse:leap:15.5 openSUSE Leap 15.5 A flaw was found in Open Virtual Network where the service monitor MAC does not properly rate limit. This issue could allow an attacker to cause a denial of service, including on deployments with CoPP enabled and properly configured. Moderate CVE-2023-3153 SUSE bug 1212125 cpe:/o:opensuse:leap:15.5 openSUSE Leap 15.5 A use after free issue was discovered in driver/firewire in outbound_phy_packet_callback in the Linux Kernel. In this flaw a local attacker with special privilege may cause a use after free problem when queue_event() fails. Important CVE-2023-3159 SUSE bug 1212128 SUSE bug 1212347 SUSE bug 1213842 SUSE bug 1214128 SUSE bug 1215674 cpe:/o:opensuse:leap:15.5 openSUSE Leap 15.5 A flaw was found in the Framebuffer Console (fbcon) in the Linux Kernel. When providing font->width and font->height greater than 32 to fbcon_set_font, since there are no checks in place, a shift-out-of-bounds occurs leading to undefined behavior and possible denial of service. Moderate CVE-2023-3161 SUSE bug 1212154 SUSE bug 1215674 cpe:/o:opensuse:leap:15.5 openSUSE Leap 15.5 ** REJECT ** We issued this CVE pre-maturely, as we have subsequently realized that this issue points out a problem that there really is no safe measures around or protections for. Moderate CVE-2023-32001 SUSE bug 1213237 cpe:/o:opensuse:leap:15.5 openSUSE Leap 15.5 The use of `Module._load()` can bypass the policy mechanism and require modules outside of the policy.json definition for a given module. This vulnerability affects all users using the experimental policy mechanism in all active release lines: 16.x, 18.x and, 20.x. Please note that at the time this CVE was issued, the policy is an experimental feature of Node.js. Moderate CVE-2023-32002 SUSE bug 1214150 cpe:/o:opensuse:leap:15.5 openSUSE Leap 15.5 The use of `module.constructor.createRequire()` can bypass the policy mechanism and require modules outside of the policy.json definition for a given module. This vulnerability affects all users using the experimental policy mechanism in all active release lines: 16.x, 18.x, and, 20.x. Please note that at the time this CVE was issued, the policy is an experimental feature of Node.js. Moderate CVE-2023-32006 SUSE bug 1214156 cpe:/o:opensuse:leap:15.5 openSUSE Leap 15.5 c-ares is an asynchronous resolver library. c-ares is vulnerable to denial of service. If a target resolver sends a query, the attacker forges a malformed UDP packet with a length of 0 and returns them to the target resolver. The target resolver erroneously interprets the 0 length as a graceful shutdown of the connection. This issue has been patched in version 1.19.1. Important CVE-2023-32067 SUSE bug 1211604 cpe:/o:opensuse:leap:15.5 openSUSE Leap 15.5 A NULL pointer dereference issue was found in the gfs2 file system in the Linux kernel. It occurs on corrupt gfs2 file systems when the evict code tries to reference the journal descriptor structure after it has been freed and set to NULL. A privileged local user could use this flaw to cause a kernel panic. Moderate CVE-2023-3212 SUSE bug 1212265 cpe:/o:opensuse:leap:15.5 openSUSE Leap 15.5 Use after free in Autofill payments in Google Chrome prior to 114.0.5735.133 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page. (Chromium security severity: Critical) Important CVE-2023-3214 SUSE bug 1212302 cpe:/o:opensuse:leap:15.5 openSUSE Leap 15.5 Use after free in WebRTC in Google Chrome prior to 114.0.5735.133 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page. (Chromium security severity: High) Important CVE-2023-3215 SUSE bug 1212302 cpe:/o:opensuse:leap:15.5 openSUSE Leap 15.5 Type confusion in V8 in Google Chrome prior to 114.0.5735.133 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page. (Chromium security severity: High) Important CVE-2023-3216 SUSE bug 1212302 cpe:/o:opensuse:leap:15.5 openSUSE Leap 15.5 Use after free in WebXR in Google Chrome prior to 114.0.5735.133 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page. (Chromium security severity: High) Important CVE-2023-3217 SUSE bug 1212302 cpe:/o:opensuse:leap:15.5 openSUSE Leap 15.5 A Buffer Copy without Checking Size of Input ('Classic Buffer Overflow') vulnerability in openSUSE libeconf allows for DoS via malformed configuration files This issue affects libeconf: before 0.5.2. Important CVE-2023-32181 SUSE bug 1211078 cpe:/o:opensuse:leap:15.5 openSUSE Leap 15.5 A Improper Link Resolution Before File Access ('Link Following') vulnerability in SUSE SUSE Linux Enterprise Desktop 15 SP5 postfix, SUSE SUSE Linux Enterprise High Performance Computing 15 SP5 postfix, SUSE openSUSE Leap 15.5 postfix.This issue affects SUSE Linux Enterprise Desktop 15 SP5: before 3.7.3-150500.3.5.1; SUSE Linux Enterprise High Performance Computing 15 SP5: before 3.7.3-150500.3.5.1; openSUSE Leap 15.5 : before 3.7.3-150500.3.5.1. Moderate CVE-2023-32182 SUSE bug 1211196 cpe:/o:opensuse:leap:15.5 openSUSE Leap 15.5 A Insecure Storage of Sensitive Information vulnerability in openSUSE opensuse-welcome allows local attackers to execute code as the user that runs opensuse-welcome if a custom layout is chosen This issue affects opensuse-welcome: from 0.1 before 0.1.9+git.35.4b9444a. Important CVE-2023-32184 SUSE bug 1213708 cpe:/o:opensuse:leap:15.5 openSUSE Leap 15.5 An issue was discovered in the Linux kernel through 6.1-rc8. dpu_crtc_atomic_check in drivers/gpu/drm/msm/disp/dpu1/dpu_crtc.c lacks check of the return value of kzalloc() and will cause the NULL Pointer Dereference. Moderate CVE-2023-3220 SUSE bug 1212556 cpe:/o:opensuse:leap:15.5 openSUSE Leap 15.5 In the Linux kernel through 6.3.1, a use-after-free in Netfilter nf_tables when processing batch requests can be abused to perform arbitrary read and write operations on kernel memory. Unprivileged local users can obtain root privileges. This occurs because anonymous sets are mishandled. Important CVE-2023-32233 SUSE bug 1211043 SUSE bug 1211187 cpe:/o:opensuse:leap:15.5 openSUSE Leap 15.5 An issue was discovered in the Linux kernel before 6.1.11. In net/netrom/af_netrom.c, there is a use-after-free because accept is also allowed for a successfully connected AF_NETROM socket. However, in order for an attacker to exploit this, the system must have netrom routing configured or the attacker must have the CAP_NET_ADMIN capability. Moderate CVE-2023-32269 SUSE bug 1211186 cpe:/o:opensuse:leap:15.5 openSUSE Leap 15.5 OpenPrinting CUPS is an open source printing system. In versions 2.4.2 and prior, a heap buffer overflow vulnerability would allow a remote attacker to launch a denial of service (DoS) attack. A buffer overflow vulnerability in the function `format_log_line` could allow remote attackers to cause a DoS on the affected system. Exploitation of the vulnerability can be triggered when the configuration file `cupsd.conf` sets the value of `loglevel `to `DEBUG`. No known patches or workarounds exist at time of publication. Moderate CVE-2023-32324 SUSE bug 1211643 cpe:/o:opensuse:leap:15.5 openSUSE Leap 15.5 An authentication issue was addressed with improved state management. This issue is fixed in macOS Big Sur 11.7.7, macOS Monterey 12.6.6, macOS Ventura 13.4. An unauthenticated user may be able to access recently printed documents. Moderate CVE-2023-32360 SUSE bug 1214254 cpe:/o:opensuse:leap:15.5 openSUSE Leap 15.5 A logic issue was addressed with improved validation. This issue is fixed in macOS Ventura 13.3. Content Security Policy to block domains with wildcards may fail. Important CVE-2023-32370 SUSE bug 1215230 cpe:/o:opensuse:leap:15.5 openSUSE Leap 15.5 A use-after-free issue was addressed with improved memory management. This issue is fixed in watchOS 9.5, tvOS 16.5, macOS Ventura 13.4, iOS 15.7.6 and iPadOS 15.7.6, Safari 16.5, iOS 16.5 and iPadOS 16.5. Processing maliciously crafted web content may lead to arbitrary code execution. Apple is aware of a report that this issue may have been actively exploited. Important CVE-2023-32373 SUSE bug 1211658 cpe:/o:opensuse:leap:15.5 openSUSE Leap 15.5 The issue was addressed with improved memory handling. This issue is fixed in watchOS 9.3, tvOS 16.3, macOS Ventura 13.2, iOS 16.3 and iPadOS 16.3. Processing web content may lead to arbitrary code execution. Important CVE-2023-32393 SUSE bug 1213581 cpe:/o:opensuse:leap:15.5 openSUSE Leap 15.5 A memory corruption issue was addressed with improved state management. This issue is fixed in macOS Ventura 13.3, Safari 16.4, iOS 16.4 and iPadOS 16.4, iOS 15.7.7 and iPadOS 15.7.7. Processing web content may lead to arbitrary code execution. Apple is aware of a report that this issue may have been actively exploited against versions of iOS released before iOS 15.7. Important CVE-2023-32435 SUSE bug 1212863 cpe:/o:opensuse:leap:15.5 openSUSE Leap 15.5 A type confusion issue was addressed with improved checks. This issue is fixed in iOS 16.5.1 and iPadOS 16.5.1, iOS 15.7.7 and iPadOS 15.7.7, macOS Ventura 13.4.1, Safari 16.5.1. Processing maliciously crafted web content may lead to arbitrary code execution. Apple is aware of a report that this issue may have been actively exploited. Important CVE-2023-32439 SUSE bug 1212863 cpe:/o:opensuse:leap:15.5 openSUSE Leap 15.5 In PHP versions 8.0.* before 8.0.29, 8.1.* before 8.1.20, 8.2.* before 8.2.7 when using SOAP HTTP Digest Authentication, random value generator was not checked for failure, and was using narrower range of values than it should have. In case of random generator failure, it could lead to a disclosure of 31 bits of uninitialized memory from the client to the server, and it also made easier to a malicious server to guess the client's nonce.? Moderate CVE-2023-3247 SUSE bug 1212349 cpe:/o:opensuse:leap:15.5 openSUSE Leap 15.5 A flaw was found in the QEMU built-in VNC server while processing ClientCutText messages. A wrong exit condition may lead to an infinite loop when inflating an attacker controlled zlib buffer in the `inflate_buffer` function. This could allow a remote authenticated client who is able to send a clipboard to the VNC server to trigger a denial of service. Moderate CVE-2023-3255 SUSE bug 1213001 cpe:/o:opensuse:leap:15.5 openSUSE Leap 15.5 A privilege escalation vulnerability exists in the experimental policy mechanism in all active release lines: 16.x, 18.x and, 20.x. The use of the deprecated API `process.binding()` can bypass the policy mechanism by requiring internal modules and eventually take advantage of `process.binding('spawn_sync')` run arbitrary code, outside of the limits defined in a `policy.json` file. Please note that at the time this CVE was issued, the policy is an experimental feature of Node.js. Moderate CVE-2023-32559 SUSE bug 1214154 cpe:/o:opensuse:leap:15.5 openSUSE Leap 15.5 VideoLAN dav1d before 1.2.0 has a thread_task.c race condition that can lead to an application crash, related to dav1d_decode_frame_exit. Low CVE-2023-32570 SUSE bug 1211262 cpe:/o:opensuse:leap:15.5 openSUSE Leap 15.5 In Qt before 5.15.14, 6.0.x through 6.2.x before 6.2.9, and 6.3.x through 6.5.x before 6.5.1, QtSvg QSvgFont m_unitsPerEm initialization is mishandled. Moderate CVE-2023-32573 SUSE bug 1211298 cpe:/o:opensuse:leap:15.5 openSUSE Leap 15.5 An out of bounds (OOB) memory access flaw was found in the Linux kernel in relay_file_read_start_pos in kernel/relay.c in the relayfs. This flaw could allow a local attacker to crash the system or leak kernel internal information. Moderate CVE-2023-3268 SUSE bug 1212502 SUSE bug 1215674 cpe:/o:opensuse:leap:15.5 openSUSE Leap 15.5 Requests is a HTTP library. Since Requests 2.3.0, Requests has been leaking Proxy-Authorization headers to destination servers when redirected to an HTTPS endpoint. This is a product of how we use `rebuild_proxies` to reattach the `Proxy-Authorization` header to requests. For HTTP connections sent through the tunnel, the proxy will identify the header in the request itself and remove it prior to forwarding to the destination server. However when sent over HTTPS, the `Proxy-Authorization` header must be sent in the CONNECT request as the proxy has no visibility into the tunneled request. This results in Requests forwarding proxy credentials to the destination server unintentionally, allowing a malicious actor to potentially exfiltrate sensitive information. This issue has been patched in version 2.31.0. Moderate CVE-2023-32681 SUSE bug 1211674 cpe:/o:opensuse:leap:15.5 openSUSE Leap 15.5 LuaTeX before 1.17.0 allows execution of arbitrary shell commands when compiling a TeX file obtained from an untrusted source. This occurs because luatex-core.lua lets the original io.popen be accessed. This also affects TeX Live before 2023 r66984 and MiKTeX before 23.5. Important CVE-2023-32700 SUSE bug 1211389 cpe:/o:opensuse:leap:15.5 openSUSE Leap 15.5 An issue was discovered in Qt before 5.15.14, 6.x before 6.2.9, and 6.3.x through 6.5.x before 6.5.1. Qt Network incorrectly parses the strict-transport-security (HSTS) header, allowing unencrypted connections to be established, even when explicitly prohibited by the server. This happens if the case used for this header does not exactly match. Moderate CVE-2023-32762 SUSE bug 1211797 cpe:/o:opensuse:leap:15.5 openSUSE Leap 15.5 An issue was discovered in Qt before 5.15.15, 6.x before 6.2.9, and 6.3.x through 6.5.x before 6.5.1. When a SVG file with an image inside it is rendered, a QTextLayout buffer overflow can be triggered. Important CVE-2023-32763 SUSE bug 1211798 SUSE bug 1212745 cpe:/o:opensuse:leap:15.5 openSUSE Leap 15.5 In KeePass 2.x before 2.54, it is possible to recover the cleartext master password from a memory dump, even when a workspace is locked or no longer running. The memory dump can be a KeePass process dump, swap file (pagefile.sys), hibernation file (hiberfil.sys), or RAM dump of the entire system. The first character cannot be recovered. In 2.54, there is different API usage and/or random string insertion for mitigation. Important CVE-2023-32784 SUSE bug 1211397 cpe:/o:opensuse:leap:15.5 openSUSE Leap 15.5 A flaw was found in QEMU. The async nature of hot-unplug enables a race scenario where the net device backend is cleared before the virtio-net pci frontend has been unplugged. A malicious guest could use this time window to trigger an assertion and cause a denial of service. Moderate CVE-2023-3301 SUSE bug 1213414 cpe:/o:opensuse:leap:15.5 openSUSE Leap 15.5 Rekor's goals are to provide an immutable tamper resistant ledger of metadata generated within a software projects supply chain. A malformed proposed entry of the `intoto/v0.0.2` type can cause a panic on a thread within the Rekor process. The thread is recovered so the client receives a 500 error message and service still continues, so the availability impact of this is minimal. This has been fixed in v1.2.0 of Rekor. Users are advised to upgrade. There are no known workarounds for this vulnerability. Moderate CVE-2023-33199 SUSE bug 1211790 cpe:/o:opensuse:leap:15.5 openSUSE Leap 15.5 Bouncy Castle For Java before 1.74 is affected by an LDAP injection vulnerability. The vulnerability only affects applications that use an LDAP CertStore from Bouncy Castle to validate X.509 certificates. During the certificate validation process, Bouncy Castle inserts the certificate's Subject Name into an LDAP search filter without any escaping, which leads to an LDAP injection vulnerability. Important CVE-2023-33201 SUSE bug 1212508 cpe:/o:opensuse:leap:15.5 openSUSE Leap 15.5 An issue was discovered in Qt 5.x before 5.15.14, 6.x before 6.2.9, and 6.3.x through 6.5.x before 6.5.1. QDnsLookup has a buffer over-read via a crafted reply from a DNS server. Moderate CVE-2023-33285 SUSE bug 1211642 cpe:/o:opensuse:leap:15.5 openSUSE Leap 15.5 An issue was discovered in the Linux kernel before 6.2.9. A use-after-free was found in bq24190_remove in drivers/power/supply/bq24190_charger.c. It could allow a local attacker to crash the system due to a race condition. Moderate CVE-2023-33288 SUSE bug 1211590 cpe:/o:opensuse:leap:15.5 openSUSE Leap 15.5 The code that processes control channel messages sent to `named` calls certain functions recursively during packet parsing. Recursion depth is only limited by the maximum accepted packet size; depending on the environment, this may cause the packet-parsing code to run out of available stack memory, causing `named` to terminate unexpectedly. Since each incoming control channel message is fully parsed before its contents are authenticated, exploiting this flaw does not require the attacker to hold a valid RNDC key; only network access to the control channel's configured TCP port is necessary. This issue affects BIND 9 versions 9.2.0 through 9.16.43, 9.18.0 through 9.18.18, 9.19.0 through 9.19.16, 9.9.3-S1 through 9.16.43-S1, and 9.18.0-S1 through 9.18.18-S1. Important CVE-2023-3341 SUSE bug 1215472 cpe:/o:opensuse:leap:15.5 openSUSE Leap 15.5 There's a memory leak in yajl 2.1.0 with use of yajl_tree_parse function. which will cause out-of-memory in server and cause crash. Moderate CVE-2023-33460 SUSE bug 1212928 cpe:/o:opensuse:leap:15.5 openSUSE Leap 15.5 iniparser v4.1 is vulnerable to NULL Pointer Dereference in function iniparser_getlongint which misses check NULL for function iniparser_getstring's return. Moderate CVE-2023-33461 SUSE bug 1211889 cpe:/o:opensuse:leap:15.5 openSUSE Leap 15.5 A vulnerability was found in Samba's SMB2 packet signing mechanism. The SMB2 packet signing is not enforced if an admin configured "server signing = required" or for SMB2 connections to Domain Controllers where SMB2 packet signing is mandatory. This flaw allows an attacker to perform attacks, such as a man-in-the-middle attack, by intercepting the network traffic and modifying the SMB2 messages between client and server, affecting the integrity of the data. Moderate CVE-2023-3347 SUSE bug 1213170 cpe:/o:opensuse:leap:15.5 openSUSE Leap 15.5 ** DISPUTED ** Janino 3.1.9 and earlier are subject to denial of service (DOS) attacks when using the expression evaluator.guess parameter name method. If the parser runs on user-supplied input, an attacker could supply content that causes the parser to crash due to a stack overflow. NOTE: this is disputed by multiple parties because Janino is not intended for use with untrusted input. Low CVE-2023-33546 SUSE bug 1211923 cpe:/o:opensuse:leap:15.5 openSUSE Leap 15.5 A NULL pointer dereference flaw was found in the Linux kernel AMD Sensor Fusion Hub driver. This flaw allows a local user to crash the system. Moderate CVE-2023-3357 SUSE bug 1212605 cpe:/o:opensuse:leap:15.5 openSUSE Leap 15.5 A null pointer dereference was found in the Linux kernel's Integrated Sensor Hub (ISH) driver. This issue could allow a local user to crash the system. Moderate CVE-2023-3358 SUSE bug 1212606 cpe:/o:opensuse:leap:15.5 openSUSE Leap 15.5 Reportlab up to v3.6.12 allows attackers to execute arbitrary code via supplying a crafted PDF file. Critical CVE-2023-33733 SUSE bug 1212065 cpe:/o:opensuse:leap:15.5 openSUSE Leap 15.5 SerialiseValue in RenderDoc before 1.27 allows an Integer Overflow with a resultant Buffer Overflow. 0xffffffff is sign-extended to 0xffffffffffffffff (SIZE_MAX) and then there is an attempt to add 1. Critical CVE-2023-33863 SUSE bug 1212086 cpe:/o:opensuse:leap:15.5 openSUSE Leap 15.5 StreamReader::ReadFromExternal in RenderDoc before 1.27 allows an Integer Overflow with a resultant Buffer Overflow. It uses uint32_t(m_BufferSize-m_InputSize) even though m_InputSize can exceed m_BufferSize. Critical CVE-2023-33864 SUSE bug 1212088 cpe:/o:opensuse:leap:15.5 openSUSE Leap 15.5 RenderDoc before 1.27 allows local privilege escalation via a symlink attack. It relies on the /tmp/RenderDoc directory regardless of ownership. Important CVE-2023-33865 SUSE bug 1212089 cpe:/o:opensuse:leap:15.5 openSUSE Leap 15.5 A use-after-free vulnerability in the Linux Kernel io_uring subsystem can be exploited to achieve local privilege escalation. Racing a io_uring cancel poll request with a linked timeout can cause a UAF in a hrtimer. We recommend upgrading past commit ef7dfac51d8ed961b742218f526bd589f3900a59 (4716c73b188566865bdd79c3a6709696a224ac04 for 5.10 stable and?0e388fce7aec40992eadee654193cad345d62663 for 5.15 stable). Moderate CVE-2023-3389 SUSE bug 1212838 cpe:/o:opensuse:leap:15.5 openSUSE Leap 15.5 A use-after-free vulnerability was found in the Linux kernel's netfilter subsystem in net/netfilter/nf_tables_api.c. Mishandled error handling with NFT_MSG_NEWRULE makes it possible to use a dangling pointer in the same transaction causing a use-after-free vulnerability. This flaw allows a local attacker with user access to cause a privilege escalation issue. We recommend upgrading past commit?1240eb93f0616b21c675416516ff3d74798fdc97. Important CVE-2023-3390 SUSE bug 1212846 SUSE bug 1212934 cpe:/o:opensuse:leap:15.5 openSUSE Leap 15.5 A race condition vulnerability was found in the vmwgfx driver in the Linux kernel. The flaw exists within the handling of GEM objects. The issue results from improper locking when performing operations on an object. This flaw allows a local privileged user to disclose information in the context of the kernel. Moderate CVE-2023-33951 SUSE bug 1211593 cpe:/o:opensuse:leap:15.5 openSUSE Leap 15.5 A double-free vulnerability was found in the vmwgfx driver in the Linux kernel. The flaw exists within the handling of vmw_buffer_object objects. The issue results from the lack of validating the existence of an object prior to performing further free operations on the object. This flaw allows a local privileged user to escalate privileges and execute code in the context of the kernel. Important CVE-2023-33952 SUSE bug 1211595 SUSE bug 1212348 cpe:/o:opensuse:leap:15.5 openSUSE Leap 15.5 A vulnerability was found in ImageMagick. This security flaw ouccers as an undefined behaviors of casting double to size_t in svg, mvg and other coders (recurring bugs of CVE-2022-32546). Low CVE-2023-34151 SUSE bug 1211791 cpe:/o:opensuse:leap:15.5 openSUSE Leap 15.5 A vulnerability was found in ImageMagick. This security flaw causes a shell command injection vulnerability via video:vsync or video:pixel-format options in VIDEO encoding/decoding. Important CVE-2023-34153 SUSE bug 1211792 cpe:/o:opensuse:leap:15.5 openSUSE Leap 15.5 Thunderbird allowed the Text Direction Override Unicode Character in filenames. An email attachment could be incorrectly shown as being a document file, while in fact it was an executable file. Newer versions of Thunderbird will strip the character and show the correct file extension. This vulnerability affects Thunderbird < 115.0.1 and Thunderbird < 102.13.1. Important CVE-2023-3417 SUSE bug 1213658 cpe:/o:opensuse:leap:15.5 openSUSE Leap 15.5 openSUSE Leap 15.5 NonFree Type Confusion in V8 in Google Chrome prior to 114.0.5735.198 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page. (Chromium security severity: High) Important CVE-2023-3420 SUSE bug 1212755 cpe:/o:opensuse:leap:15.5 openSUSE Leap 15.5 openSUSE Leap 15.5 NonFree Use after free in Media in Google Chrome prior to 114.0.5735.198 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page. (Chromium security severity: High) Important CVE-2023-3421 SUSE bug 1212755 cpe:/o:opensuse:leap:15.5 openSUSE Leap 15.5 openSUSE Leap 15.5 NonFree Use after free in Guest View in Google Chrome prior to 114.0.5735.198 allowed an attacker who convinced a user to install a malicious extension to potentially exploit heap corruption via a crafted HTML page. (Chromium security severity: High) Important CVE-2023-3422 SUSE bug 1212755 cpe:/o:opensuse:leap:15.5 openSUSE Leap 15.5 OpenPrinting CUPS is a standards-based, open source printing system for Linux and other Unix-like operating systems. Starting in version 2.0.0 and prior to version 2.4.6, CUPS logs data of free memory to the logging service AFTER the connection has been closed, when it should have logged the data right before. This is a use-after-free bug that impacts the entire cupsd process. The exact cause of this issue is the function `httpClose(con->http)` being called in `scheduler/client.c`. The problem is that httpClose always, provided its argument is not null, frees the pointer at the end of the call, only for cupsdLogClient to pass the pointer to httpGetHostname. This issue happens in function `cupsdAcceptClient` if LogLevel is warn or higher and in two scenarios: there is a double-lookup for the IP Address (HostNameLookups Double is set in `cupsd.conf`) which fails to resolve, or if CUPS is compiled with TCP wrappers and the connection is refused by rules from `/etc/hosts.allow` and `/etc/hosts.deny`. Version 2.4.6 has a patch for this issue. Important CVE-2023-34241 SUSE bug 1212230 cpe:/o:opensuse:leap:15.5 openSUSE Leap 15.5 The fix for XSA-423 added logic to Linux'es netback driver to deal with a frontend splitting a packet in a way such that not all of the headers would come in one piece. Unfortunately the logic introduced there didn't account for the extreme case of the entire packet being split into as many pieces as permitted by the protocol, yet still being smaller than the area that's specially dealt with to keep all (possible) headers together. Such an unusual packet would therefore trigger a buffer overrun in the driver. Moderate CVE-2023-34319 SUSE bug 1213546 cpe:/o:opensuse:leap:15.5 openSUSE Leap 15.5 ** RESERVED ** This candidate has been reserved by an organization or individual that will use it when announcing a new security problem. When the candidate has been publicized, the details for this candidate will be provided. Important CVE-2023-34322 SUSE bug 1215145 cpe:/o:opensuse:leap:15.5 openSUSE Leap 15.5 ** RESERVED ** This candidate has been reserved by an organization or individual that will use it when announcing a new security problem. When the candidate has been publicized, the details for this candidate will be provided. Moderate CVE-2023-34323 SUSE bug 1215744 cpe:/o:opensuse:leap:15.5 openSUSE Leap 15.5 ** RESERVED ** This candidate has been reserved by an organization or individual that will use it when announcing a new security problem. When the candidate has been publicized, the details for this candidate will be provided. Moderate CVE-2023-34325 SUSE bug 1215747 cpe:/o:opensuse:leap:15.5 openSUSE Leap 15.5 ** RESERVED ** This candidate has been reserved by an organization or individual that will use it when announcing a new security problem. When the candidate has been publicized, the details for this candidate will be provided. Important CVE-2023-34326 SUSE bug 1215746 cpe:/o:opensuse:leap:15.5 openSUSE Leap 15.5 ** RESERVED ** This candidate has been reserved by an organization or individual that will use it when announcing a new security problem. When the candidate has been publicized, the details for this candidate will be provided. Moderate CVE-2023-34327 SUSE bug 1215748 cpe:/o:opensuse:leap:15.5 openSUSE Leap 15.5 ** RESERVED ** This candidate has been reserved by an organization or individual that will use it when announcing a new security problem. When the candidate has been publicized, the details for this candidate will be provided. Moderate CVE-2023-34328 SUSE bug 1215748 cpe:/o:opensuse:leap:15.5 openSUSE Leap 15.5 An issue was discovered in Qt before 5.15.15, 6.x before 6.2.9, and 6.3.x through 6.5.x before 6.5.2. Certificate validation for TLS does not always consider whether the root of a chain is a configured CA certificate. Moderate CVE-2023-34410 SUSE bug 1211994 cpe:/o:opensuse:leap:15.5 openSUSE Leap 15.5 The error page for sites with invalid TLS certificates was missing the activation-delay Firefox uses to protect prompts and permission dialogs from attacks that exploit human response time delays. If a malicious page elicited user clicks in precise locations immediately before navigating to a site with a certificate error and made the renderer extremely busy at the same time, it could create a gap between when the error page was loaded and when the display actually refreshed. With the right timing the elicited clicks could land in that gap and activate the button that overrides the certificate error for that site. This vulnerability affects Firefox ESR < 102.12, Firefox < 114, and Thunderbird < 102.12. Important CVE-2023-34414 cpe:/o:opensuse:leap:15.5 openSUSE Leap 15.5 Memory safety bugs present in Firefox 113, Firefox ESR 102.11, and Thunderbird 102.12. Some of these bugs showed evidence of memory corruption and we presume that with enough effort some of these could have been exploited to run arbitrary code. This vulnerability affects Firefox ESR < 102.12, Firefox < 114, and Thunderbird < 102.12. Important CVE-2023-34416 cpe:/o:opensuse:leap:15.5 openSUSE Leap 15.5 Issue summary: Checking excessively long DH keys or parameters may be very slow. Impact summary: Applications that use the functions DH_check(), DH_check_ex() or EVP_PKEY_param_check() to check a DH key or DH parameters may experience long delays. Where the key or parameters that are being checked have been obtained from an untrusted source this may lead to a Denial of Service. The function DH_check() performs various checks on DH parameters. One of those checks confirms that the modulus ('p' parameter) is not too large. Trying to use a very large modulus is slow and OpenSSL will not normally use a modulus which is over 10,000 bits in length. However the DH_check() function checks numerous aspects of the key or parameters that have been supplied. Some of those checks use the supplied modulus value even if it has already been found to be too large. An application that calls DH_check() and supplies a key or parameters obtained from an untrusted source could be vulernable to a Denial of Service attack. The function DH_check() is itself called by a number of other OpenSSL functions. An application calling any of those other functions may similarly be affected. The other functions affected by this are DH_check_ex() and EVP_PKEY_param_check(). Also vulnerable are the OpenSSL dhparam and pkeyparam command line applications when using the '-check' option. The OpenSSL SSL/TLS implementation is not affected by this issue. The OpenSSL 3.0 and 3.1 FIPS providers are not affected by this issue. Moderate CVE-2023-3446 SUSE bug 1213487 SUSE bug 1213853 cpe:/o:opensuse:leap:15.5 openSUSE Leap 15.5 Netty is an asynchronous event-driven network application framework for rapid development of maintainable high performance protocol servers & clients. The `SniHandler` can allocate up to 16MB of heap for each channel during the TLS handshake. When the handler or the channel does not have an idle timeout, it can be used to make a TCP server using the `SniHandler` to allocate 16MB of heap. The `SniHandler` class is a handler that waits for the TLS handshake to configure a `SslHandler` according to the indicated server name by the `ClientHello` record. For this matter it allocates a `ByteBuf` using the value defined in the `ClientHello` record. Normally the value of the packet should be smaller than the handshake packet but there are not checks done here and the way the code is written, it is possible to craft a packet that makes the `SslClientHelloHandler`. This vulnerability has been fixed in version 4.1.94.Final. Moderate CVE-2023-34462 SUSE bug 1212637 cpe:/o:opensuse:leap:15.5 openSUSE Leap 15.5 A heap-based buffer overflow issue was discovered in ImageMagick's ReadTIM2ImageData() function in coders/tim2.c. A local attacker could trick the user in opening specially crafted file, triggering an out-of-bounds read error, allowing an application to crash, resulting in a denial of service. Moderate CVE-2023-34474 SUSE bug 1212237 cpe:/o:opensuse:leap:15.5 openSUSE Leap 15.5 An issue was discovered jtidy thru r938 allows attackers to cause a denial of service or other unspecified impacts via crafted object that uses cyclic dependencies. Moderate CVE-2023-34623 SUSE bug 1212404 cpe:/o:opensuse:leap:15.5 openSUSE Leap 15.5 When Firefox is configured to block storage of all cookies, it was still possible to store data in localstorage by using an iframe with a source of 'about:blank'. This could have led to malicious websites storing tracking data without permission. This vulnerability affects Firefox < 115. Important CVE-2023-3482 cpe:/o:opensuse:leap:15.5 openSUSE Leap 15.5 An infinite loop vulnerability was found in Samba's mdssvc RPC service for Spotlight. When parsing Spotlight mdssvc RPC packets sent by the client, the core unmarshalling function sl_unpack_loop() did not validate a field in the network packet that contains the count of elements in an array-like structure. By passing 0 as the count value, the attacked function will run in an endless loop consuming 100% CPU. This flaw allows an attacker to issue a malformed RPC request, triggering an infinite loop, resulting in a denial of service condition. Important CVE-2023-34966 SUSE bug 1213173 cpe:/o:opensuse:leap:15.5 openSUSE Leap 15.5 A Type Confusion vulnerability was found in Samba's mdssvc RPC service for Spotlight. When parsing Spotlight mdssvc RPC packets, one encoded data structure is a key-value style dictionary where the keys are character strings, and the values can be any of the supported types in the mdssvc protocol. Due to a lack of type checking in callers of the dalloc_value_for_key() function, which returns the object associated with a key, a caller may trigger a crash in talloc_get_size() when talloc detects that the passed-in pointer is not a valid talloc pointer. With an RPC worker process shared among multiple client connections, a malicious client or attacker can trigger a process crash in a shared RPC mdssvc worker process, affecting all other clients this worker serves. Moderate CVE-2023-34967 SUSE bug 1213172 cpe:/o:opensuse:leap:15.5 openSUSE Leap 15.5 A path disclosure vulnerability was found in Samba. As part of the Spotlight protocol, Samba discloses the server-side absolute path of shares, files, and directories in the results for search queries. This flaw allows a malicious client or an attacker with a targeted RPC request to view the information that is part of the disclosed path. Moderate CVE-2023-34968 SUSE bug 1213171 cpe:/o:opensuse:leap:15.5 openSUSE Leap 15.5 D-Bus before 1.15.6 sometimes allows unprivileged users to crash dbus-daemon. If a privileged user with control over the dbus-daemon is using the org.freedesktop.DBus.Monitoring interface to monitor message bus traffic, then an unprivileged user with the ability to connect to the same dbus-daemon can cause a dbus-daemon crash under some circumstances via an unreplyable message. When done on the well-known system bus, this is a denial-of-service vulnerability. The fixed versions are 1.12.28, 1.14.8, and 1.15.6. Moderate CVE-2023-34969 SUSE bug 1212126 cpe:/o:opensuse:leap:15.5 openSUSE Leap 15.5 Linux Kernel nftables Out-Of-Bounds Read/Write Vulnerability; nft_byteorder poorly handled vm register contents when CAP_NET_ADMIN is in any user or network namespace Important CVE-2023-35001 SUSE bug 1213059 SUSE bug 1213063 cpe:/o:opensuse:leap:15.5 openSUSE Leap 15.5 A use-after-free flaw was found in vcs_read in drivers/tty/vt/vc_screen.c in vc_screen in the Linux Kernel. This issue may allow an attacker with local user access to cause a system crash or leak internal kernel information. Important CVE-2023-3567 SUSE bug 1213167 SUSE bug 1213244 SUSE bug 1213842 SUSE bug 1215674 cpe:/o:opensuse:leap:15.5 openSUSE Leap 15.5 An issue was discovered in fl_set_geneve_opt in net/sched/cls_flower.c in the Linux kernel before 6.3.7. It allows an out-of-bounds write in the flower classifier code via TCA_FLOWER_KEY_ENC_OPTS_GENEVE packets. This may result in denial of service or privilege escalation. Important CVE-2023-35788 SUSE bug 1212504 SUSE bug 1212509 cpe:/o:opensuse:leap:15.5 openSUSE Leap 15.5 An issue was discovered in the C AMQP client library (aka rabbitmq-c) through 0.13.0 for RabbitMQ. Credentials can only be entered on the command line (e.g., for amqp-publish or amqp-consume) and are thus visible to local attackers by listing a process and its arguments. Important CVE-2023-35789 SUSE bug 1212499 cpe:/o:opensuse:leap:15.5 openSUSE Leap 15.5 An issue was discovered in dec_patch_dictionary.cc in libjxl before 0.8.2. An integer underflow in patch decoding can lead to a denial of service, such as an infinite loop. Important CVE-2023-35790 SUSE bug 1212492 cpe:/o:opensuse:leap:15.5 openSUSE Leap 15.5 An issue was discovered in the Linux kernel before 6.3.2. A use-after-free was found in saa7134_finidev in drivers/media/pci/saa7134/saa7134-core.c. Moderate CVE-2023-35823 SUSE bug 1212494 cpe:/o:opensuse:leap:15.5 openSUSE Leap 15.5 An issue was discovered in the Linux kernel before 6.3.2. A use-after-free was found in dm1105_remove in drivers/media/pci/dm1105/dm1105.c. Moderate CVE-2023-35824 SUSE bug 1212501 SUSE bug 1215674 cpe:/o:opensuse:leap:15.5 openSUSE Leap 15.5 An issue was discovered in the Linux kernel before 6.3.2. A use-after-free was found in renesas_usb3_remove in drivers/usb/gadget/udc/renesas_usb3.c. Moderate CVE-2023-35828 SUSE bug 1212513 cpe:/o:opensuse:leap:15.5 openSUSE Leap 15.5 An issue was discovered in the Linux kernel before 6.3.2. A use-after-free was found in rkvdec_remove in drivers/staging/media/rkvdec/rkvdec.c. Moderate CVE-2023-35829 SUSE bug 1212495 cpe:/o:opensuse:leap:15.5 openSUSE Leap 15.5 Envoy is a cloud-native high-performance edge/middle/service proxy. Envoy’s HTTP/2 codec may leak a header map and bookkeeping structures upon receiving `RST_STREAM` immediately followed by the `GOAWAY` frames from an upstream server. In nghttp2, cleanup of pending requests due to receipt of the `GOAWAY` frame skips de-allocation of the bookkeeping structure and pending compressed header. The error return [code path] is taken if connection is already marked for not sending more requests due to `GOAWAY` frame. The clean-up code is right after the return statement, causing memory leak. Denial of service through memory exhaustion. This vulnerability was patched in versions(s) 1.26.3, 1.25.8, 1.24.9, 1.23.11. Important CVE-2023-35945 SUSE bug 1215713 cpe:/o:opensuse:leap:15.5 openSUSE Leap 15.5 During the worker lifecycle, a use-after-free condition could have occured, which could have led to a potentially exploitable crash. This vulnerability affects Firefox < 115.0.2, Firefox ESR < 115.0.2, and Thunderbird < 115.0.1. Important CVE-2023-3600 SUSE bug 1213230 cpe:/o:opensuse:leap:15.5 openSUSE Leap 15.5 In Django 3.2 before 3.2.20, 4 before 4.1.10, and 4.2 before 4.2.3, EmailValidator and URLValidator are subject to a potential ReDoS (regular expression denial of service) attack via a very large number of domain name labels of emails and URLs. Moderate CVE-2023-36053 SUSE bug 1212742 cpe:/o:opensuse:leap:15.5 openSUSE Leap 15.5 lib/kadm5/kadm_rpc_xdr.c in MIT Kerberos 5 (aka krb5) before 1.20.2 and 1.21.x before 1.21.1 frees an uninitialized pointer. A remote authenticated user can trigger a kadmind crash. This occurs because _xdr_kadm5_principal_ent_rec does not validate the relationship between n_key_data and the key_data array count. Important CVE-2023-36054 SUSE bug 1214054 cpe:/o:opensuse:leap:15.5 openSUSE Leap 15.5 A use-after-free vulnerability in the Linux kernel's net/sched: cls_u32 component can be exploited to achieve local privilege escalation. If tcf_change_indev() fails, u32_set_parms() will immediately return an error after incrementing or decrementing the reference counter in tcf_bind_filter(). If an attacker can control the reference counter and set it to zero, they can cause the reference to be freed, leading to a use-after-free vulnerability. We recommend upgrading past commit 04c55383fa5689357bcdd2c8036725a55ed632bc. Moderate CVE-2023-3609 SUSE bug 1213586 SUSE bug 1213587 cpe:/o:opensuse:leap:15.5 openSUSE Leap 15.5 A use-after-free vulnerability in the Linux kernel's netfilter: nf_tables component can be exploited to achieve local privilege escalation. Flaw in the error handling of bound chains causes a use-after-free in the abort path of NFT_MSG_NEWRULE. The vulnerability requires CAP_NET_ADMIN to be triggered. We recommend upgrading past commit 4bedf9eee016286c835e3d8fa981ddece5338795. Important CVE-2023-3610 SUSE bug 1213580 SUSE bug 1213584 cpe:/o:opensuse:leap:15.5 openSUSE Leap 15.5 An out-of-bounds write vulnerability in the Linux kernel's net/sched: sch_qfq component can be exploited to achieve local privilege escalation. The qfq_change_agg() function in net/sched/sch_qfq.c allows an out-of-bounds write because lmax is updated according to packet sizes without bounds checks. We recommend upgrading past commit 3e337087c3b5805fe0b8a46ba622a962880b5d64. Moderate CVE-2023-3611 SUSE bug 1213585 cpe:/o:opensuse:leap:15.5 openSUSE Leap 15.5 Gifsicle v1.9.3 was discovered to contain a heap buffer overflow via the ambiguity_error component at /src/clp.c. Important CVE-2023-36193 SUSE bug 1212645 cpe:/o:opensuse:leap:15.5 openSUSE Leap 15.5 LibreDWG v0.12.5 was discovered to contain a heap buffer overflow via the function bit_wcs2nlen at bits.c. Important CVE-2023-36271 SUSE bug 1212709 cpe:/o:opensuse:leap:15.5 openSUSE Leap 15.5 LibreDWG v0.12.5 was discovered to contain a heap buffer overflow via the function bit_utf8_to_TU at bits.c. Important CVE-2023-36272 SUSE bug 1212707 cpe:/o:opensuse:leap:15.5 openSUSE Leap 15.5 LibreDWG v0.12.5 was discovered to contain a heap buffer overflow via the function bit_calc_CRC at bits.c. Important CVE-2023-36273 SUSE bug 1212706 cpe:/o:opensuse:leap:15.5 openSUSE Leap 15.5 LibreDWG v0.12.5 was discovered to contain a heap buffer overflow via the function bit_write_TF at bits.c. Important CVE-2023-36274 SUSE bug 1212705 cpe:/o:opensuse:leap:15.5 openSUSE Leap 15.5 Kafka dissector crash in Wireshark 4.0.0 to 4.0.6 and 3.6.0 to 3.6.14 allows denial of service via packet injection or crafted capture file Low CVE-2023-3648 SUSE bug 1213319 cpe:/o:opensuse:leap:15.5 openSUSE Leap 15.5 Shibboleth XMLTooling before 3.2.4, as used in OpenSAML and Shibboleth Service Provider, allows SSRF via a crafted KeyInfo element. (This is fixed in, for example, Shibboleth Service Provider 3.4.1.3 on Windows.) Moderate CVE-2023-36661 SUSE bug 1212359 cpe:/o:opensuse:leap:15.5 openSUSE Leap 15.5 Artifex Ghostscript through 10.01.2 mishandles permission validation for pipe devices (with the %pipe% prefix or the | pipe character prefix). Important CVE-2023-36664 SUSE bug 1212711 SUSE bug 1213725 SUSE bug 1214098 cpe:/o:opensuse:leap:15.5 openSUSE Leap 15.5 Redis is an in-memory database that persists on disk. In Redit 7.0 prior to 7.0.12, extracting key names from a command and a list of arguments may, in some cases, trigger a heap overflow and result in reading random heap memory, heap corruption and potentially remote code execution. Several scenarios that may lead to authenticated users executing a specially crafted `COMMAND GETKEYS` or `COMMAND GETKEYSANDFLAGS`and authenticated users who were set with ACL rules that match key names, executing a specially crafted command that refers to a variadic list of key names. The vulnerability is patched in Redis 7.0.12. Important CVE-2023-36824 SUSE bug 1213249 cpe:/o:opensuse:leap:15.5 openSUSE Leap 15.5 An attacker could have triggered a use-after-free condition when creating a WebRTC connection over HTTPS. This vulnerability affects Firefox < 115, Firefox ESR < 102.13, and Thunderbird < 102.13. Important CVE-2023-37201 cpe:/o:opensuse:leap:15.5 openSUSE Leap 15.5 Cross-compartment wrappers wrapping a scripted proxy could have caused objects from other compartments to be stored in the main compartment resulting in a use-after-free. This vulnerability affects Firefox < 115, Firefox ESR < 102.13, and Thunderbird < 102.13. Important CVE-2023-37202 cpe:/o:opensuse:leap:15.5 openSUSE Leap 15.5 Insufficient validation in the Drag and Drop API in conjunction with social engineering, may have allowed an attacker to trick end-users into creating a shortcut to local system files. This could have been leveraged to execute arbitrary code. This vulnerability affects Firefox < 115. Important CVE-2023-37203 cpe:/o:opensuse:leap:15.5 openSUSE Leap 15.5 A website could have obscured the fullscreen notification by using an option element by introducing lag via an expensive computational function. This could have led to user confusion and possible spoofing attacks. This vulnerability affects Firefox < 115. Important CVE-2023-37204 cpe:/o:opensuse:leap:15.5 openSUSE Leap 15.5 The use of RTL Arabic characters in the address bar may have allowed for URL spoofing. This vulnerability affects Firefox < 115. Important CVE-2023-37205 cpe:/o:opensuse:leap:15.5 openSUSE Leap 15.5 Uploading files which contain symlinks may have allowed an attacker to trick a user into submitting sensitive data to a malicious website. This vulnerability affects Firefox < 115. Important CVE-2023-37206 cpe:/o:opensuse:leap:15.5 openSUSE Leap 15.5 A website could have obscured the fullscreen notification by using a URL with a scheme handled by an external program, such as a mailto URL. This could have led to user confusion and possible spoofing attacks. This vulnerability affects Firefox < 115, Firefox ESR < 102.13, and Thunderbird < 102.13. Important CVE-2023-37207 cpe:/o:opensuse:leap:15.5 openSUSE Leap 15.5 When opening Diagcab files, Firefox did not warn the user that these files may contain malicious code. This vulnerability affects Firefox < 115, Firefox ESR < 102.13, and Thunderbird < 102.13. Important CVE-2023-37208 cpe:/o:opensuse:leap:15.5 openSUSE Leap 15.5 A use-after-free condition existed in `NotifyOnHistoryReload` where a `LoadingSessionHistoryEntry` object was freed and a reference to that object remained. This resulted in a potentially exploitable condition when the reference to that object was later reused. This vulnerability affects Firefox < 115. Important CVE-2023-37209 cpe:/o:opensuse:leap:15.5 openSUSE Leap 15.5 A website could prevent a user from exiting full-screen mode via alert and prompt calls. This could lead to user confusion and possible spoofing attacks. This vulnerability affects Firefox < 115. Important CVE-2023-37210 cpe:/o:opensuse:leap:15.5 openSUSE Leap 15.5 Memory safety bugs present in Firefox 114, Firefox ESR 102.12, and Thunderbird 102.12. Some of these bugs showed evidence of memory corruption and we presume that with enough effort some of these could have been exploited to run arbitrary code. This vulnerability affects Firefox < 115, Firefox ESR < 102.13, and Thunderbird < 102.13. Important CVE-2023-37211 cpe:/o:opensuse:leap:15.5 openSUSE Leap 15.5 Memory safety bugs present in Firefox 114. Some of these bugs showed evidence of memory corruption and we presume that with enough effort some of these could have been exploited to run arbitrary code. This vulnerability affects Firefox < 115. Important CVE-2023-37212 cpe:/o:opensuse:leap:15.5 openSUSE Leap 15.5 Use after free in WebRTC in Google Chrome prior to 115.0.5790.98 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page. (Chromium security severity: High) Important CVE-2023-3727 SUSE bug 1213462 cpe:/o:opensuse:leap:15.5 openSUSE Leap 15.5 Use after free in WebRTC in Google Chrome prior to 115.0.5790.98 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page. (Chromium security severity: High) Important CVE-2023-3728 SUSE bug 1213462 cpe:/o:opensuse:leap:15.5 openSUSE Leap 15.5 Use after free in Tab Groups in Google Chrome prior to 115.0.5790.98 allowed a remote attacker who convinced a user to engage in specific UI interactions to potentially exploit heap corruption via a crafted HTML page. (Chromium security severity: High) Important CVE-2023-3730 SUSE bug 1213462 cpe:/o:opensuse:leap:15.5 openSUSE Leap 15.5 Out of bounds memory access in Mojo in Google Chrome prior to 115.0.5790.98 allowed a remote attacker who had compromised the renderer process to potentially exploit heap corruption via a crafted HTML page. (Chromium security severity: High) Important CVE-2023-3732 SUSE bug 1213462 cpe:/o:opensuse:leap:15.5 openSUSE Leap 15.5 ** RESERVED ** This candidate has been reserved by an organization or individual that will use it when announcing a new security problem. When the candidate has been publicized, the details for this candidate will be provided. Important CVE-2023-37327 SUSE bug 1213128 cpe:/o:opensuse:leap:15.5 openSUSE Leap 15.5 ** RESERVED ** This candidate has been reserved by an organization or individual that will use it when announcing a new security problem. When the candidate has been publicized, the details for this candidate will be provided. Important CVE-2023-37328 SUSE bug 1213131 cpe:/o:opensuse:leap:15.5 openSUSE Leap 15.5 Inappropriate implementation in WebApp Installs in Google Chrome prior to 115.0.5790.98 allowed a remote attacker to potentially spoof the contents of the Omnibox (URL bar) via a crafted HTML page. (Chromium security severity: Medium) Important CVE-2023-3733 SUSE bug 1213462 cpe:/o:opensuse:leap:15.5 openSUSE Leap 15.5 Inappropriate implementation in Picture In Picture in Google Chrome prior to 115.0.5790.98 allowed a remote attacker to potentially spoof the contents of the Omnibox (URL bar) via a crafted HTML page. (Chromium security severity: Medium) Important CVE-2023-3734 SUSE bug 1213462 cpe:/o:opensuse:leap:15.5 openSUSE Leap 15.5 Inappropriate implementation in Web API Permission Prompts in Google Chrome prior to 115.0.5790.98 allowed a remote attacker to obfuscate security UI via a crafted HTML page. (Chromium security severity: Medium) Important CVE-2023-3735 SUSE bug 1213462 cpe:/o:opensuse:leap:15.5 openSUSE Leap 15.5 Inappropriate implementation in Custom Tabs in Google Chrome on Android prior to 115.0.5790.98 allowed a remote attacker to leak cross-origin data via a crafted HTML page. (Chromium security severity: Medium) Important CVE-2023-3736 SUSE bug 1213462 cpe:/o:opensuse:leap:15.5 openSUSE Leap 15.5 Inappropriate implementation in Notifications in Google Chrome prior to 115.0.5790.98 allowed a remote attacker to spoof the contents of media notifications via a crafted HTML page. (Chromium security severity: Medium) Important CVE-2023-3737 SUSE bug 1213462 cpe:/o:opensuse:leap:15.5 openSUSE Leap 15.5 Inappropriate implementation in Autofill in Google Chrome prior to 115.0.5790.98 allowed a remote attacker to obfuscate security UI via a crafted HTML page. (Chromium security severity: Medium) Important CVE-2023-3738 SUSE bug 1213462 cpe:/o:opensuse:leap:15.5 openSUSE Leap 15.5 Insufficient validation of untrusted input in Themes in Google Chrome prior to 115.0.5790.98 allowed a remote attacker to potentially serve malicious content to a user via a crafted background URL. (Chromium security severity: Low) Important CVE-2023-3740 SUSE bug 1213462 cpe:/o:opensuse:leap:15.5 openSUSE Leap 15.5 The issue was addressed with improved checks. This issue is fixed in iOS 16.6 and iPadOS 16.6, Safari 16.5.2, tvOS 16.6, macOS Ventura 13.5, watchOS 9.6. Processing web content may lead to arbitrary code execution. Apple is aware of a report that this issue may have been actively exploited. Important CVE-2023-37450 SUSE bug 1213379 cpe:/o:opensuse:leap:15.5 openSUSE Leap 15.5 An issue was discovered in the USB subsystem in the Linux kernel through 6.4.2. There is an out-of-bounds and crash in read_descriptors in drivers/usb/core/sysfs.c. Moderate CVE-2023-37453 SUSE bug 1213123 cpe:/o:opensuse:leap:15.5 openSUSE Leap 15.5 OpenIDC/cjose is a C library implementing the Javascript Object Signing and Encryption (JOSE). The AES GCM decryption routine incorrectly uses the Tag length from the actual Authentication Tag provided in the JWE. The spec says that a fixed length of 16 octets must be applied. Therefore this bug allows an attacker to provide a truncated Authentication Tag and to modify the JWE accordingly. Users should upgrade to a version >= 0.6.2.2. Users unable to upgrade should avoid using AES GCM encryption and replace it with another encryption algorithm (e.g. AES CBC). Important CVE-2023-37464 SUSE bug 1213385 cpe:/o:opensuse:leap:15.5 openSUSE Leap 15.5 A flaw was found in FRRouting when parsing certain babeld unicast hello messages that are intended to be ignored. This issue may allow an attacker to send specially crafted hello messages with the unicast flag set, the interval field set to 0, or any TLV that contains a sub-TLV with the Mandatory flag set to enter an infinite loop and cause a denial of service. Moderate CVE-2023-3748 SUSE bug 1213434 cpe:/o:opensuse:leap:15.5 openSUSE Leap 15.5 A flaw was found in libvirt. The virStoragePoolObjListSearch function does not return a locked pool as expected, resulting in a race condition and denial of service when attempting to lock the same object from another thread. This issue could allow clients connecting to the read-only socket to crash the libvirt daemon. Moderate CVE-2023-3750 SUSE bug 1213447 cpe:/o:opensuse:leap:15.5 openSUSE Leap 15.5 A flaw was found in the Linux kernel’s IP framework for transforming packets (XFRM subsystem). This issue may allow a malicious user with CAP_NET_ADMIN privileges to directly dereference a NULL pointer in xfrm_update_ae_params(), leading to a possible kernel crash and denial of service. Moderate CVE-2023-3772 SUSE bug 1213666 cpe:/o:opensuse:leap:15.5 openSUSE Leap 15.5 A use-after-free vulnerability in the Linux kernel's net/sched: cls_fw component can be exploited to achieve local privilege escalation. If tcf_change_indev() fails, fw_set_parms() will immediately return an error after incrementing or decrementing the reference counter in tcf_bind_filter(). If an attacker can control the reference counter and set it to zero, they can cause the reference to be freed, leading to a use-after-free vulnerability. We recommend upgrading past commit 0323bce598eea038714f941ce2b22541c46d488f. Moderate CVE-2023-3776 SUSE bug 1213588 SUSE bug 1215119 SUSE bug 1215674 cpe:/o:opensuse:leap:15.5 openSUSE Leap 15.5 When curl retrieves an HTTP response, it stores the incoming headers so that they can be accessed later via the libcurl headers API. However, curl did not have a limit in how many or how large headers it would accept in a response, allowing a malicious server to stream an endless series of headers and eventually cause curl to run out of heap memory. Important CVE-2023-38039 SUSE bug 1215026 cpe:/o:opensuse:leap:15.5 openSUSE Leap 15.5 ** RESERVED ** This candidate has been reserved by an organization or individual that will use it when announcing a new security problem. When the candidate has been publicized, the details for this candidate will be provided. Important CVE-2023-38103 SUSE bug 1213751 cpe:/o:opensuse:leap:15.5 openSUSE Leap 15.5 ** RESERVED ** This candidate has been reserved by an organization or individual that will use it when announcing a new security problem. When the candidate has been publicized, the details for this candidate will be provided. Important CVE-2023-38104 SUSE bug 1213750 cpe:/o:opensuse:leap:15.5 openSUSE Leap 15.5 An out-of-bounds memory access flaw was found in the Linux kernel’s TUN/TAP device driver functionality in how a user generates a malicious (too big) networking packet when napi frags is enabled. This flaw allows a local user to crash or potentially escalate their privileges on the system. Important CVE-2023-3812 SUSE bug 1213543 SUSE bug 1213706 cpe:/o:opensuse:leap:15.5 openSUSE Leap 15.5 The issue was addressed with improved checks. This issue is fixed in iOS 15.7.8 and iPadOS 15.7.8, iOS 16.6 and iPadOS 16.6, tvOS 16.6, macOS Ventura 13.5, Safari 16.6, watchOS 9.6. Processing web content may disclose sensitive information. Important CVE-2023-38133 SUSE bug 1213905 SUSE bug 1214251 SUSE bug 1214253 cpe:/o:opensuse:leap:15.5 openSUSE Leap 15.5 Issue summary: Checking excessively long DH keys or parameters may be very slow. Impact summary: Applications that use the functions DH_check(), DH_check_ex() or EVP_PKEY_param_check() to check a DH key or DH parameters may experience long delays. Where the key or parameters that are being checked have been obtained from an untrusted source this may lead to a Denial of Service. The function DH_check() performs various checks on DH parameters. After fixing CVE-2023-3446 it was discovered that a large q parameter value can also trigger an overly long computation during some of these checks. A correct q value, if present, cannot be larger than the modulus p parameter, thus it is unnecessary to perform these checks if q is larger than p. An application that calls DH_check() and supplies a key or parameters obtained from an untrusted source could be vulnerable to a Denial of Service attack. The function DH_check() is itself called by a number of other OpenSSL functions. An application calling any of those other functions may similarly be affected. The other functions affected by this are DH_check_ex() and EVP_PKEY_param_check(). Also vulnerable are the OpenSSL dhparam and pkeyparam command line applications when using the "-check" option. The OpenSSL SSL/TLS implementation is not affected by this issue. The OpenSSL 3.0 and 3.1 FIPS providers are not affected by this issue. Moderate CVE-2023-3817 SUSE bug 1213853 cpe:/o:opensuse:leap:15.5 openSUSE Leap 15.5 An issue was discovered in Qt before 5.15.15, 6.x before 6.2.10, and 6.3.x through 6.5.x before 6.5.3. There are infinite loops in recursive entity expansion. Moderate CVE-2023-38197 SUSE bug 1213326 cpe:/o:opensuse:leap:15.5 openSUSE Leap 15.5 A flaw was found in Keylime. Due to their blocking nature, the Keylime registrar is subject to a remote denial of service against its SSL connections. This flaw allows an attacker to exhaust all available connections. Important CVE-2023-38200 SUSE bug 1213310 cpe:/o:opensuse:leap:15.5 openSUSE Leap 15.5 A flaw was found in the Keylime registrar that could allow a bypass of the challenge-response protocol during agent registration. This issue may allow an attacker to impersonate an agent and hide the true status of a monitored machine if the fake agent is added to the verifier list by a legitimate user, resulting in a breach of the integrity of the registrar database. Important CVE-2023-38201 SUSE bug 1213314 cpe:/o:opensuse:leap:15.5 openSUSE Leap 15.5 In PHP versions 8.0.* before 8.0.30, 8.1.* before 8.1.22, and 8.2.* before 8.2.8 various XML functions rely on libxml global state to track configuration variables, like whether external entities are loaded. This state is assumed to be unchanged unless the user explicitly changes it by calling appropriate function. However, since the state is process-global, other modules - such as?ImageMagick - may also use this library within the same process, and change that global state for their internal purposes, and leave it in a state where external entities loading is enabled. This can lead to the situation where external XML is parsed with external entities loaded, which can lead to disclosure of any local files accessible to PHP. This vulnerable state may persist in the same process across many requests, until the process is shut down.? Important CVE-2023-3823 SUSE bug 1214106 cpe:/o:opensuse:leap:15.5 openSUSE Leap 15.5 In PHP version 8.0.* before 8.0.30,? 8.1.* before 8.1.22, and 8.2.* before 8.2.8, when loading phar file, while reading PHAR directory entries, insufficient length checking may lead to a stack buffer overflow, leading potentially to memory corruption or RCE.? Important CVE-2023-3824 SUSE bug 1214103 cpe:/o:opensuse:leap:15.5 openSUSE Leap 15.5 Trustwave ModSecurity 3.x before 3.0.10 has Inefficient Algorithmic Complexity. Important CVE-2023-38285 SUSE bug 1213702 cpe:/o:opensuse:leap:15.5 openSUSE Leap 15.5 iperf3 before 3.14 allows peers to cause an integer overflow and heap corruption via a crafted length field. Important CVE-2023-38403 SUSE bug 1213430 cpe:/o:opensuse:leap:15.5 openSUSE Leap 15.5 The PKCS#11 feature in ssh-agent in OpenSSH before 9.3p2 has an insufficiently trustworthy search path, leading to remote code execution if an agent is forwarded to an attacker-controlled system. (Code in /usr/lib is not necessarily safe for loading into ssh-agent.) NOTE: this issue exists because of an incomplete fix for CVE-2016-10009. Important CVE-2023-38408 SUSE bug 1213504 cpe:/o:opensuse:leap:15.5 openSUSE Leap 15.5 An issue was discovered in set_con2fb_map in drivers/video/fbdev/core/fbcon.c in the Linux kernel before 6.2.12. Because an assignment occurs only for the first vc, the fbcon_registered_fb and fbcon_display arrays can be desynchronized in fbcon_mode_deleted (the con2fb_map points at the old fb_info). Low CVE-2023-38409 SUSE bug 1213417 cpe:/o:opensuse:leap:15.5 openSUSE Leap 15.5 Cargo downloads the Rust project’s dependencies and compiles the project. Cargo prior to version 0.72.2, bundled with Rust prior to version 1.71.1, did not respect the umask when extracting crate archives on UNIX-like systems. If the user downloaded a crate containing files writeable by any local user, another local user could exploit this to change the source code compiled and executed by the current user. To prevent existing cached extractions from being exploitable, the Cargo binary version 0.72.2 included in Rust 1.71.1 or later will purge caches generated by older Cargo versions automatically. As a workaround, configure one's system to prevent other local users from accessing the Cargo directory, usually located in `~/.cargo`. Moderate CVE-2023-38497 SUSE bug 1213817 cpe:/o:opensuse:leap:15.5 openSUSE Leap 15.5 This flaw makes curl overflow a heap based buffer in the SOCKS5 proxy handshake. When curl is asked to pass along the host name to the SOCKS5 proxy to allow that to resolve the address instead of it getting done by curl itself, the maximum length that host name can be is 255 bytes. If the host name is detected to be longer, curl switches to local name resolving and instead passes on the resolved address only. Due to this bug, the local variable that means "let the host resolve the name" could get the wrong value during a slow SOCKS5 handshake, and contrary to the intention, copy the too long host name to the target buffer instead of copying just the resolved address there. The target buffer being a heap based buffer, and the host name coming from the URL that curl has been told to operate with. Important CVE-2023-38545 SUSE bug 1215888 cpe:/o:opensuse:leap:15.5 openSUSE Leap 15.5 This flaw allows an attacker to insert cookies at will into a running program using libcurl, if the specific series of conditions are met. libcurl performs transfers. In its API, an application creates "easy handles" that are the individual handles for single transfers. libcurl provides a function call that duplicates en easy handle called [curl_easy_duphandle](https://curl.se/libcurl/c/curl_easy_duphandle.html). If a transfer has cookies enabled when the handle is duplicated, the cookie-enable state is also cloned - but without cloning the actual cookies. If the source handle did not read any cookies from a specific file on disk, the cloned version of the handle would instead store the file name as `none` (using the four ASCII letters, no quotes). Subsequent use of the cloned handle that does not explicitly set a source to load cookies from would then inadvertently load cookies from a file named `none` - if such a file exists and is readable in the current directory of the program using libcurl. And if using the correct file format of course. Moderate CVE-2023-38546 SUSE bug 1215889 cpe:/o:opensuse:leap:15.5 openSUSE Leap 15.5 A buffer overflow flaw was found in base/gdevdevn.c:1973 in devn_pcx_write_rle() in ghostscript. This issue may allow a local attacker to cause a denial of service via outputting a crafted PDF file for a DEVN device with gs. Low CVE-2023-38559 SUSE bug 1213637 cpe:/o:opensuse:leap:15.5 openSUSE Leap 15.5 The issue was addressed with improved checks. This issue is fixed in iOS 15.7.8 and iPadOS 15.7.8, iOS 16.6 and iPadOS 16.6, tvOS 16.6, macOS Ventura 13.5, Safari 16.6, watchOS 9.6. A website may be able to bypass Same Origin Policy. Important CVE-2023-38572 SUSE bug 1213905 SUSE bug 1214251 SUSE bug 1214253 cpe:/o:opensuse:leap:15.5 openSUSE Leap 15.5 A logic issue was addressed with improved restrictions. This issue is fixed in iOS 16.6 and iPadOS 16.6, watchOS 9.6, tvOS 16.6, macOS Ventura 13.5. Processing web content may lead to arbitrary code execution. Important CVE-2023-38592 SUSE bug 1213905 SUSE bug 1214251 SUSE bug 1214253 cpe:/o:opensuse:leap:15.5 openSUSE Leap 15.5 The issue was addressed with improved checks. This issue is fixed in iOS 15.7.8 and iPadOS 15.7.8, iOS 16.6 and iPadOS 16.6, tvOS 16.6, macOS Ventura 13.5, Safari 16.6, watchOS 9.6. Processing web content may lead to arbitrary code execution. Important CVE-2023-38594 SUSE bug 1213905 SUSE bug 1214251 SUSE bug 1214253 SUSE bug 1215457 SUSE bug 1215589 cpe:/o:opensuse:leap:15.5 openSUSE Leap 15.5 The issue was addressed with improved checks. This issue is fixed in iOS 16.6 and iPadOS 16.6, tvOS 16.6, macOS Ventura 13.5, Safari 16.6, watchOS 9.6. Processing web content may lead to arbitrary code execution. Important CVE-2023-38595 SUSE bug 1213905 SUSE bug 1214251 SUSE bug 1214253 cpe:/o:opensuse:leap:15.5 openSUSE Leap 15.5 The issue was addressed with improved checks. This issue is fixed in iOS 15.7.8 and iPadOS 15.7.8, iOS 16.6 and iPadOS 16.6, macOS Ventura 13.5, Safari 16.6. Processing web content may lead to arbitrary code execution. Important CVE-2023-38597 SUSE bug 1213905 SUSE bug 1214251 SUSE bug 1214253 SUSE bug 1215457 SUSE bug 1215589 cpe:/o:opensuse:leap:15.5 openSUSE Leap 15.5 A logic issue was addressed with improved state management. This issue is fixed in Safari 16.6, watchOS 9.6, iOS 15.7.8 and iPadOS 15.7.8, tvOS 16.6, iOS 16.6 and iPadOS 16.6, macOS Ventura 13.5. A website may be able to track sensitive user information. Important CVE-2023-38599 SUSE bug 1213905 SUSE bug 1214251 SUSE bug 1214253 cpe:/o:opensuse:leap:15.5 openSUSE Leap 15.5 The issue was addressed with improved checks. This issue is fixed in iOS 16.6 and iPadOS 16.6, tvOS 16.6, macOS Ventura 13.5, Safari 16.6, watchOS 9.6. Processing web content may lead to arbitrary code execution. Important CVE-2023-38600 SUSE bug 1213905 SUSE bug 1214251 SUSE bug 1214253 cpe:/o:opensuse:leap:15.5 openSUSE Leap 15.5 The issue was addressed with improved memory handling. This issue is fixed in iOS 16.6 and iPadOS 16.6, tvOS 16.6, macOS Ventura 13.5, Safari 16.6, watchOS 9.6. Processing web content may lead to arbitrary code execution. Important CVE-2023-38611 SUSE bug 1213905 SUSE bug 1214251 SUSE bug 1214253 cpe:/o:opensuse:leap:15.5 openSUSE Leap 15.5 A use-after-free flaw was found in nfc_llcp_find_local in net/nfc/llcp_core.c in NFC in the Linux kernel. This flaw allows a local user with special privileges to impact a kernel information leak issue. Important CVE-2023-3863 SUSE bug 1213601 SUSE bug 1213603 cpe:/o:opensuse:leap:15.5 openSUSE Leap 15.5 A directory traversal problem in the URL decoder of librsvg before 2.56.3 could be used by local or remote attackers to disclose files (on the local filesystem outside of the expected area), as demonstrated by href=".?../../../../../../../../../../etc/passwd" in an xi:include element. Important CVE-2023-38633 SUSE bug 1213502 cpe:/o:opensuse:leap:15.5 openSUSE Leap 15.5 FRRouting FRR 7.5.1 through 9.0 and Pica8 PICOS 4.3.3.2 allow a remote attacker to cause a denial of service via a crafted BGP update with a corrupted attribute 23 (Tunnel Encapsulation). Important CVE-2023-38802 SUSE bug 1213284 cpe:/o:opensuse:leap:15.5 openSUSE Leap 15.5 A flaw was found in the Netfilter subsystem in the Linux kernel. The xt_u32 module did not validate the fields in the xt_u32 structure. This flaw allows a local privileged attacker to trigger an out-of-bounds read by setting the size fields with a value beyond the array boundaries, leading to a crash or information disclosure. Moderate CVE-2023-39192 SUSE bug 1215858 cpe:/o:opensuse:leap:15.5 openSUSE Leap 15.5 A flaw was found in the Netfilter subsystem in the Linux kernel. The sctp_mt_check did not validate the flag_count field. This flaw allows a local privileged (CAP_NET_ADMIN) attacker to trigger an out-of-bounds read, leading to a crash or information disclosure. Moderate CVE-2023-39193 SUSE bug 1215860 cpe:/o:opensuse:leap:15.5 openSUSE Leap 15.5 A flaw was found in the XFRM subsystem in the Linux kernel. The specific flaw exists within the processing of state filters, which can result in a read past the end of an allocated buffer. This flaw allows a local privileged (CAP_NET_ADMIN) attacker to trigger an out-of-bounds read, potentially leading to an information disclosure. Low CVE-2023-39194 SUSE bug 1215861 cpe:/o:opensuse:leap:15.5 openSUSE Leap 15.5 The html/template package does not properly handle HTML-like "" comment tokens, nor hashbang "#!" comment tokens, in <script> contexts. This may cause the template parser to improperly interpret the contents of <script> contexts, causing actions to be improperly escaped. This may be leveraged to perform an XSS attack. Moderate CVE-2023-39318 SUSE bug 1215084 cpe:/o:opensuse:leap:15.5 openSUSE Leap 15.5 The html/template package does not apply the proper rules for handling occurrences of "<script", "<!--", and "</script" within JS literals in <script> contexts. This may cause the template parser to improperly consider script contexts to be terminated early, causing actions to be improperly escaped. This could be leveraged to perform an XSS attack. Moderate CVE-2023-39319 SUSE bug 1215085 cpe:/o:opensuse:leap:15.5 openSUSE Leap 15.5 The go.mod toolchain directive, introduced in Go 1.21, can be leveraged to execute scripts and binaries relative to the root of the module when the "go" command was executed within the module. This applies to modules downloaded using the "go" command from the module proxy, as well as modules downloaded directly using VCS software. Important CVE-2023-39320 SUSE bug 1215086 cpe:/o:opensuse:leap:15.5 openSUSE Leap 15.5 Processing an incomplete post-handshake message for a QUIC connection can cause a panic. Important CVE-2023-39321 SUSE bug 1215087 cpe:/o:opensuse:leap:15.5 openSUSE Leap 15.5 QUIC connections do not set an upper bound on the amount of data buffered when reading post-handshake messages, allowing a malicious QUIC connection to cause unbounded memory growth. With fix, connections now consistently reject messages larger than 65KiB in size. Important CVE-2023-39322 SUSE bug 1215087 cpe:/o:opensuse:leap:15.5 openSUSE Leap 15.5 Line directives ("//line") can be used to bypass the restrictions on "//go:cgo_" directives, allowing blocked linker and compiler flags to be passed during compilation. This can result in unexpected execution of arbitrary code when running "go build". The line directive requires the absolute path of the file in which the directive lives, which makes exploiting this issue significantly more complex. Important CVE-2023-39323 SUSE bug 1215985 cpe:/o:opensuse:leap:15.5 openSUSE Leap 15.5 A malicious HTTP/2 client which rapidly creates requests and immediately resets them can cause excessive server resource consumption. While the total number of requests is bounded by the http2.Server.MaxConcurrentStreams setting, resetting an in-progress request allows the attacker to create a new request while the existing one is still executing. With the fix applied, HTTP/2 servers now bound the number of simultaneously executing handler goroutines to the stream concurrency limit (MaxConcurrentStreams). New requests arriving when at the limit (which can only happen after the client has reset an existing, in-flight request) will be queued until a handler exits. If the request queue grows too large, the server will terminate the connection. This issue is also fixed in golang.org/x/net/http2 for users manually configuring HTTP/2. The default stream concurrency limit is 250 streams (requests) per HTTP/2 connection. This value may be adjusted using the golang.org/x/net/http2 package; see the Server.MaxConcurrentStreams setting and the ConfigureServer function. Important CVE-2023-39325 SUSE bug 1216109 cpe:/o:opensuse:leap:15.5 openSUSE Leap 15.5 Cacti is an open source operational monitoring and fault management framework. A defect in the sql_save function was discovered. When the column type is numeric, the sql_save function directly utilizes user input. Many files and functions calling the sql_save function do not perform prior validation of user input, leading to the existence of multiple SQL injection vulnerabilities in Cacti. This allows authenticated users to exploit these SQL injection vulnerabilities to perform privilege escalation and remote code execution. This issue has been addressed in version 1.2.25. Users are advised to upgrade. There are no known workarounds for this vulnerability. Important CVE-2023-39357 SUSE bug 1215040 cpe:/o:opensuse:leap:15.5 openSUSE Leap 15.5 Cacti is an open source operational monitoring and fault management framework. An authenticated SQL injection vulnerability was discovered which allows authenticated users to perform privilege escalation and remote code execution. The vulnerability resides in the `reports_user.php` file. In `ajax_get_branches`, the `tree_id` parameter is passed to the `reports_get_branch_select` function without any validation. This issue has been addressed in version 1.2.25. Users are advised to upgrade. There are no known workarounds for this vulnerability. Important CVE-2023-39358 SUSE bug 1215042 cpe:/o:opensuse:leap:15.5 openSUSE Leap 15.5 Cacti is an open source operational monitoring and fault management framework. An authenticated SQL injection vulnerability was discovered which allows authenticated users to perform privilege escalation and remote code execution. The vulnerability resides in the `graphs.php` file. When dealing with the cases of ajax_hosts and ajax_hosts_noany, if the `site_id` parameter is greater than 0, it is directly reflected in the WHERE clause of the SQL statement. This creates an SQL injection vulnerability. This issue has been addressed in version 1.2.25. Users are advised to upgrade. There are no known workarounds for this vulnerability. Important CVE-2023-39359 SUSE bug 1215043 cpe:/o:opensuse:leap:15.5 openSUSE Leap 15.5 Cacti is an open source operational monitoring and fault management framework.Affected versions are subject to a Stored Cross-Site-Scripting (XSS) Vulnerability allows an authenticated user to poison data. The vulnerability is found in `graphs_new.php`. Several validations are performed, but the `returnto` parameter is directly passed to `form_save_button`. In order to bypass this validation, returnto must contain `host.php`. This vulnerability has been addressed in version 1.2.25. Users are advised to upgrade. Users unable to update should manually filter HTML output. Moderate CVE-2023-39360 SUSE bug 1215044 cpe:/o:opensuse:leap:15.5 openSUSE Leap 15.5 Cacti is an open source operational monitoring and fault management framework. Affected versions are subject to a SQL injection discovered in graph_view.php. Since guest users can access graph_view.php without authentication by default, if guest users are being utilized in an enabled state, there could be the potential for significant damage. Attackers may exploit this vulnerability, and there may be possibilities for actions such as the usurpation of administrative privileges or remote code execution. This issue has been addressed in version 1.2.25. Users are advised to upgrade. There are no known workarounds for this vulnerability. Critical CVE-2023-39361 SUSE bug 1215045 cpe:/o:opensuse:leap:15.5 openSUSE Leap 15.5 Cacti is an open source operational monitoring and fault management framework. In Cacti 1.2.24, under certain conditions, an authenticated privileged user, can use a malicious string in the SNMP options of a Device, performing command injection and obtaining remote code execution on the underlying server. The `lib/snmp.php` file has a set of functions, with similar behavior, that accept in input some variables and place them into an `exec` call without a proper escape or validation. This issue has been addressed in version 1.2.25. Users are advised to upgrade. There are no known workarounds for this vulnerability. Important CVE-2023-39362 SUSE bug 1215047 cpe:/o:opensuse:leap:15.5 openSUSE Leap 15.5 Cacti is an open source operational monitoring and fault management framework. In Cacti 1.2.24, users with console access can be redirected to an arbitrary website after a change password performed via a specifically crafted URL. The `auth_changepassword.php` file accepts `ref` as a URL parameter and reflects it in the form used to perform the change password. It's value is used to perform a redirect via `header` PHP function. A user can be tricked in performing the change password operation, e.g., via a phishing message, and then interacting with the malicious website where the redirection has been performed, e.g., downloading malwares, providing credentials, etc. This issue has been addressed in version 1.2.25. Users are advised to upgrade. There are no known workarounds for this vulnerability. Low CVE-2023-39364 SUSE bug 1215050 cpe:/o:opensuse:leap:15.5 openSUSE Leap 15.5 Cacti is an open source operational monitoring and fault management framework. Issues with Cacti Regular Expression validation combined with the external links feature can lead to limited SQL Injections and subsequent data leakage. This issue has been addressed in version 1.2.25. Users are advised to upgrade. There are no known workarounds for this vulnerability. Moderate CVE-2023-39365 SUSE bug 1215051 cpe:/o:opensuse:leap:15.5 openSUSE Leap 15.5 Cacti is an open source operational monitoring and fault management framework. Affected versions are subject to a Stored Cross-Site-Scripting (XSS) Vulnerability allows an authenticated user to poison data stored in the _cacti_'s database. These data will be viewed by administrative _cacti_ accounts and execute JavaScript code in the victim's browser at view-time. The `data_sources.php` script displays the data source management information (e.g. data source path, polling configuration etc.) for different data visualizations of the _cacti_ app. CENSUS found that an adversary that is able to configure a malicious Device name, can deploy a stored XSS attack against any user of the same (or broader) privileges. A user that possesses the _General Administration>Sites/Devices/Data_ permissions can configure the device names in _cacti_. This configuration occurs through `http://<HOST>/cacti/host.php`, while the rendered malicious payload is exhibited at `http://<HOST>/cacti/data_sources.php`. This vulnerability has been addressed in version 1.2.25. Users are advised to upgrade. Users unable to update should manually filter HTML output. Moderate CVE-2023-39366 SUSE bug 1215052 cpe:/o:opensuse:leap:15.5 openSUSE Leap 15.5 IN THE EXTENSION SCRIPT, a SQL Injection vulnerability was found in PostgreSQL if it uses @extowner@, @extschema@, or @extschema:...@ inside a quoting construct (dollar quoting, '', or ""). If an administrator has installed files of a vulnerable, trusted, non-bundled extension, an attacker with database-level CREATE privilege can execute arbitrary code as the bootstrap superuser. Moderate CVE-2023-39417 SUSE bug 1214059 cpe:/o:opensuse:leap:15.5 openSUSE Leap 15.5 A vulnerability was found in PostgreSQL with the use of the MERGE command, which fails to test new rows against row security policies defined for UPDATE and SELECT. If UPDATE and SELECT policies forbid some rows that INSERT policies do not forbid, a user could store such rows. Moderate CVE-2023-39418 SUSE bug 1214061 cpe:/o:opensuse:leap:15.5 openSUSE Leap 15.5 Cacti is an open source operational monitoring and fault management framework. Affected versions are subject to a Stored Cross-Site-Scripting (XSS) Vulnerability allows an authenticated user to poison data stored in the _cacti_'s database. These data will be viewed by administrative _cacti_ accounts and execute JavaScript code in the victim's browser at view-time. The`reports_admin.php` script displays reporting information about graphs, devices, data sources etc. CENSUS found that an adversary that is able to configure a malicious Device name, can deploy a stored XSS attack against any user of the same (or broader) privileges. A user that possesses the _General Administration>Sites/Devices/Data_ permissions can configure the device names in _cacti_. This configuration occurs through `http://<HOST>/cacti/host.php`, while the rendered malicious payload is exhibited at `http://<HOST>/cacti/reports_admin.php` when the a graph with the maliciously altered device name is linked to the report. This vulnerability has been addressed in version 1.2.25. Users are advised to upgrade. Users unable to update should manually filter HTML output. Moderate CVE-2023-39510 SUSE bug 1215053 cpe:/o:opensuse:leap:15.5 openSUSE Leap 15.5 Cacti is an open source operational monitoring and fault management framework. Affected versions are subject to a Stored Cross-Site-Scripting (XSS) Vulnerability which allows an authenticated user to poison data stored in the _cacti_'s database. These data will be viewed by administrative _cacti_ accounts and execute JavaScript code in the victim's browser at view-time. The script under `reports_admin.php` displays reporting information about graphs, devices, data sources etc. _CENSUS_ found that an adversary that is able to configure a malicious device name, related to a graph attached to a report, can deploy a stored XSS attack against any super user who has privileges of viewing the `reports_admin.php` page, such as administrative accounts. A user that possesses the _General Administration>Sites/Devices/Data_ permissions can configure the device names in _cacti_. This configuration occurs through `http://<HOST>/cacti/host.php`, while the rendered malicious payload is exhibited at `http://<HOST>/cacti/reports_admin.php` when the a graph with the maliciously altered device name is linked to the report. This issue has been addressed in version 1.2.25. Users are advised to upgrade. Users unable to upgrade should manually filter HTML output. Moderate CVE-2023-39511 SUSE bug 1215081 cpe:/o:opensuse:leap:15.5 openSUSE Leap 15.5 Cacti is an open source operational monitoring and fault management framework. Affected versions are subject to a Stored Cross-Site-Scripting (XSS) Vulnerability which allows an authenticated user to poison data stored in the _cacti_'s database. These data will be viewed by administrative _cacti_ accounts and execute JavaScript code in the victim's browser at view-time. The script under `data_sources.php` displays the data source management information (e.g. data source path, polling configuration, device name related to the datasource etc.) for different data visualizations of the _cacti_ app. _CENSUS_ found that an adversary that is able to configure a malicious device name, can deploy a stored XSS attack against any user of the same (or broader) privileges. A user that possesses the _General Administration>Sites/Devices/Data_ permissions can configure the device names in _cacti_. This configuration occurs through `http://<HOST>/cacti/host.php`, while the rendered malicious payload is exhibited at `http://<HOST>/cacti/data_sources.php`. This vulnerability has been addressed in version 1.2.25. Users are advised to upgrade. Users unable to update should manually filter HTML output. Moderate CVE-2023-39512 SUSE bug 1215054 cpe:/o:opensuse:leap:15.5 openSUSE Leap 15.5 Cacti is an open source operational monitoring and fault management framework. Affected versions are subject to a Stored Cross-Site-Scripting (XSS) Vulnerability which allows an authenticated user to poison data stored in the _cacti_'s database. These data will be viewed by administrative _cacti_ accounts and execute JavaScript code in the victim's browser at view-time. The script under `host.php` is used to monitor and manage hosts in the _cacti_ app, hence displays useful information such as data queries and verbose logs. _CENSUS_ found that an adversary that is able to configure a data-query template with malicious code appended in the template path, in order to deploy a stored XSS attack against any user with the _General Administration>Sites/Devices/Data_ privileges. A user that possesses the _Template Editor>Data Queries_ permissions can configure the data query template path in _cacti_. Please note that such a user may be a low privileged user. This configuration occurs through `http://<HOST>/cacti/data_queries.php` by editing an existing or adding a new data query template. If a template is linked to a device then the formatted template path will be rendered in the device's management page, when a _verbose data query_ is requested. This vulnerability has been addressed in version 1.2.25. Users are advised to upgrade. Users unable to update should manually filter HTML output. Moderate CVE-2023-39513 SUSE bug 1215055 cpe:/o:opensuse:leap:15.5 openSUSE Leap 15.5 Cacti is an open source operational monitoring and fault management framework. Affected versions are subject to a Stored Cross-Site-Scripting (XSS) Vulnerability which allows an authenticated user to poison data stored in the _cacti_'s database. These data will be viewed by administrative _cacti_ accounts and execute JavaScript code in the victim's browser at view-time. The script under `graphs.php` displays graph details such as data-source paths, data template information and graph related fields. _CENSUS_ found that an adversary that is able to configure either a data-source template with malicious code appended in the data-source name or a device with a malicious payload injected in the device name, may deploy a stored XSS attack against any user with _General Administration>Graphs_ privileges. A user that possesses the _Template Editor>Data Templates_ permissions can configure the data-source name in _cacti_. Please note that this may be a _low privileged_ user. This configuration occurs through `http://<HOST>/cacti/data_templates.php` by editing an existing or adding a new data template. If a template is linked to a graph then the formatted template name will be rendered in the graph's management page. A user that possesses the _General Administration>Sites/Devices/Data_ permissions can configure the device name in _cacti_. This vulnerability has been addressed in version 1.2.25. Users are advised to upgrade. Users unable to upgrade should add manual HTML escaping. Moderate CVE-2023-39514 SUSE bug 1215056 cpe:/o:opensuse:leap:15.5 openSUSE Leap 15.5 Cacti is an open source operational monitoring and fault management framework. Affected versions are subject to a Stored Cross-Site-Scripting (XSS) Vulnerability allows an authenticated user to poison data stored in the cacti's database. These data will be viewed by administrative cacti accounts and execute JavaScript code in the victim's browser at view-time. The script under `data_debug.php` displays data source related debugging information such as _data source paths, polling settings, meta-data on the data source_. _CENSUS_ found that an adversary that is able to configure a malicious data-source path, can deploy a stored XSS attack against any user that has privileges related to viewing the `data_debug.php` information. A user that possesses the _General Administration>Sites/Devices/Data_ permissions can configure the data source path in _cacti_. This configuration occurs through `http://<HOST>/cacti/data_sources.php`. This vulnerability has been addressed in version 1.2.25. Users are advised to upgrade. Users unable to update should manually filter HTML output. Moderate CVE-2023-39515 SUSE bug 1215058 cpe:/o:opensuse:leap:15.5 openSUSE Leap 15.5 Cacti is an open source operational monitoring and fault management framework. Affected versions are subject to a Stored Cross-Site-Scripting (XSS) Vulnerability which allows an authenticated user to poison data stored in the _cacti_'s database. These data will be viewed by administrative _cacti_ accounts and execute JavaScript code in the victim's browser at view-time. The script under `data_sources.php` displays the data source management information (e.g. data source path, polling configuration etc.) for different data visualizations of the _cacti_ app. CENSUS found that an adversary that is able to configure a malicious data-source path, can deploy a stored XSS attack against any user of the same (or broader) privileges. A user that possesses the 'General Administration>Sites/Devices/Data' permissions can configure the data source path in Cacti. This configuration occurs through `http://<HOST>/cacti/data_sources.php`. The same page can be used for previewing the data source path. This issue has been addressed in version 1.2.25. Users are advised to upgrade. Users unable to upgrade should manually escape HTML output. Moderate CVE-2023-39516 SUSE bug 1215059 cpe:/o:opensuse:leap:15.5 openSUSE Leap 15.5 ** RESERVED ** This candidate has been reserved by an organization or individual that will use it when announcing a new security problem. When the candidate has been publicized, the details for this candidate will be provided. Moderate CVE-2023-3961 SUSE bug 1215907 cpe:/o:opensuse:leap:15.5 openSUSE Leap 15.5 ** DISPUTED ** Xmlsoft Libxml2 v2.11.0 was discovered to contain an out-of-bounds read via the xmlSAX2StartElement() function at /libxml2/SAX2.c. This vulnerability allows attackers to cause a Denial of Service (DoS) via supplying a crafted XML file. NOTE: the vendor's position is that the product does not support the legacy SAX1 interface with custom callbacks; there is a crash even without crafted input. Moderate CVE-2023-39615 SUSE bug 1214768 cpe:/o:opensuse:leap:15.5 openSUSE Leap 15.5 log_blackbox.c in libqb before 2.0.8 allows a buffer overflow via long log messages because the header size is not considered. Moderate CVE-2023-39976 SUSE bug 1214066 cpe:/o:opensuse:leap:15.5 openSUSE Leap 15.5 Cargo downloads a Rust project’s dependencies and compiles the project. Starting in Rust 1.60.0 and prior to 1.72, Cargo did not escape Cargo feature names when including them in the report generated by `cargo build --timings`. A malicious package included as a dependency may inject nearly arbitrary HTML here, potentially leading to cross-site scripting if the report is subsequently uploaded somewhere. The vulnerability affects users relying on dependencies from git, local paths, or alternative registries. Users who solely depend on crates.io are unaffected. Rust 1.60.0 introduced `cargo build --timings`, which produces a report of how long the different steps of the build process took. It includes lists of Cargo features for each crate. Prior to Rust 1.72, Cargo feature names were allowed to contain almost any characters (with some exceptions as used by the feature syntax), but it would produce a future incompatibility warning about them since Rust 1.49. crates.io is far more stringent about what it considers a valid feature name and has not allowed such feature names. As the feature names were included unescaped in the timings report, they could be used to inject Javascript into the page, for example with a feature name like `features = ["<img src='' onerror=alert(0)"]`. If this report were subsequently uploaded to a domain that uses credentials, the injected Javascript could access resources from the website visitor. This issue was fixed in Rust 1.72 by turning the future incompatibility warning into an error. Users should still exercise care in which package they download, by only including trusted dependencies in their projects. Please note that even with these vulnerabilities fixed, by design Cargo allows arbitrary code execution at build time thanks to build scripts and procedural macros: a malicious dependency will be able to cause damage regardless of these vulnerabilities. crates.io has server-side checks preventing this attack, and there are no packages on crates.io exploiting these vulnerabilities. crates.io users still need to excercise care in choosing their dependencies though, as remote code execution is allowed by design there as well. Moderate CVE-2023-40030 SUSE bug 1214689 cpe:/o:opensuse:leap:15.5 openSUSE Leap 15.5 A use-after-free flaw was found in the Linux kernel's netfilter in the way a user triggers the nft_pipapo_remove function with the element, without a NFT_SET_EXT_KEY_END. This issue could allow a local user to crash the system or potentially escalate their privileges on the system. Important CVE-2023-4004 SUSE bug 1213812 SUSE bug 1214812 cpe:/o:opensuse:leap:15.5 openSUSE Leap 15.5 Under some circumstances, this weakness allows a user who has access to run the “ps” utility on a machine, the ability to write almost unlimited amounts of unfiltered data into the process heap. Low CVE-2023-4016 SUSE bug 1214290 cpe:/o:opensuse:leap:15.5 openSUSE Leap 15.5 Puma is a Ruby/Rack web server built for parallelism. Prior to versions 6.3.1 and 5.6.7, puma exhibited incorrect behavior when parsing chunked transfer encoding bodies and zero-length Content-Length headers in a way that allowed HTTP request smuggling. Severity of this issue is highly dependent on the nature of the web site using puma is. This could be caused by either incorrect parsing of trailing fields in chunked transfer encoding bodies or by parsing of blank/zero-length Content-Length headers. Both issues have been addressed and this vulnerability has been fixed in versions 6.3.1 and 5.6.7. Users are advised to upgrade. There are no known workarounds for this vulnerability. Important CVE-2023-40175 SUSE bug 1214425 cpe:/o:opensuse:leap:15.5 openSUSE Leap 15.5 xrdp is an open source remote desktop protocol (RDP) server. In versions prior to 0.9.23 improper handling of session establishment errors allows bypassing OS-level session restrictions. The `auth_start_session` function can return non-zero (1) value on, e.g., PAM error which may result in in session restrictions such as max concurrent sessions per user by PAM (ex ./etc/security/limits.conf) to be bypassed. Users (administrators) don't use restrictions by PAM are not affected. This issue has been addressed in release version 0.9.23. Users are advised to upgrade. There are no known workarounds for this issue. Moderate CVE-2023-40184 SUSE bug 1214805 cpe:/o:opensuse:leap:15.5 openSUSE Leap 15.5 An issue was discovered in Python before 3.8.18, 3.9.x before 3.9.18, 3.10.x before 3.10.13, and 3.11.x before 3.11.5. It primarily affects servers (such as HTTP servers) that use TLS client authentication. If a TLS server-side socket is created, receives data into the socket buffer, and then is closed quickly, there is a brief window where the SSLSocket instance will detect the socket as "not connected" and won't initiate a handshake, but buffered data will still be readable from the socket buffer. This data will not be authenticated if the server-side TLS peer is expecting client certificate authentication, and is indistinguishable from valid TLS stream data. Data is limited in size to the amount that will fit in the buffer. (The TLS connection cannot directly be used for data exfiltration because the vulnerable code path requires that the connection be closed on initialization of the SSLSocket.) Important CVE-2023-40217 SUSE bug 1214692 cpe:/o:opensuse:leap:15.5 openSUSE Leap 15.5 HAProxy through 2.0.32, 2.1.x and 2.2.x through 2.2.30, 2.3.x and 2.4.x through 2.4.23, 2.5.x and 2.6.x before 2.6.15, 2.7.x before 2.7.10, and 2.8.x before 2.8.2 forwards empty Content-Length headers, violating RFC 9110 section 8.6. In uncommon cases, an HTTP/1 server behind HAProxy may interpret the payload as an extra request. Moderate CVE-2023-40225 SUSE bug 1214102 cpe:/o:opensuse:leap:15.5 openSUSE Leap 15.5 An issue was discovered in l2cap_sock_release in net/bluetooth/l2cap_sock.c in the Linux kernel before 6.4.10. There is a use-after-free because the children of an sk are mishandled. Moderate CVE-2023-40283 SUSE bug 1214233 cpe:/o:opensuse:leap:15.5 openSUSE Leap 15.5 GNU indent 2.2.13 has a heap-based buffer overflow in search_brace in indent.c via a crafted file. Low CVE-2023-40305 SUSE bug 1214243 cpe:/o:opensuse:leap:15.5 openSUSE Leap 15.5 A failure in the -fstack-protector feature in GCC-based toolchains that target AArch64 allows an attacker to exploit an existing buffer overflow in dynamically-sized local variables in your application without this being detected. This stack-protector failure only applies to C99-style dynamically-sized local variables or those created using alloca(). The stack-protector operates as intended for statically-sized local variables. The default behavior when the stack-protector detects an overflow is to terminate your application, resulting in controlled loss of availability. An attacker who can exploit a buffer overflow without triggering the stack-protector might be able to change program flow control to cause an uncontrolled loss of availability or to go further and affect confidentiality or integrity. Important CVE-2023-4039 SUSE bug 1214052 cpe:/o:opensuse:leap:15.5 openSUSE Leap 15.5 The issue was addressed with improved checks. This issue is fixed in macOS Ventura 13.5. A remote attacker may be able to cause arbitrary javascript code execution. Important CVE-2023-40397 SUSE bug 1215230 SUSE bug 1215457 SUSE bug 1215589 cpe:/o:opensuse:leap:15.5 openSUSE Leap 15.5 Offscreen Canvas did not properly track cross-origin tainting, which could have been used to access image data from another site in violation of same-origin policy. This vulnerability affects Firefox < 116, Firefox ESR < 102.14, and Firefox ESR < 115.1. Moderate CVE-2023-4045 cpe:/o:opensuse:leap:15.5 openSUSE Leap 15.5 In some circumstances, a stale value could have been used for a global variable in WASM JIT analysis. This resulted in incorrect compilation and a potentially exploitable crash in the content process. This vulnerability affects Firefox < 116, Firefox ESR < 102.14, and Firefox ESR < 115.1. Moderate CVE-2023-4046 cpe:/o:opensuse:leap:15.5 openSUSE Leap 15.5 A bug in popup notifications delay calculation could have made it possible for an attacker to trick a user into granting permissions. This vulnerability affects Firefox < 116, Firefox ESR < 102.14, and Firefox ESR < 115.1. Moderate CVE-2023-4047 cpe:/o:opensuse:leap:15.5 openSUSE Leap 15.5 An out-of-bounds read could have led to an exploitable crash when parsing HTML with DOMParser in low memory situations. This vulnerability affects Firefox < 116, Firefox ESR < 102.14, and Firefox ESR < 115.1. Moderate CVE-2023-4048 cpe:/o:opensuse:leap:15.5 openSUSE Leap 15.5 Race conditions in reference counting code were found through code inspection. These could have resulted in potentially exploitable use-after-free vulnerabilities. This vulnerability affects Firefox < 116, Firefox ESR < 102.14, and Firefox ESR < 115.1. Moderate CVE-2023-4049 cpe:/o:opensuse:leap:15.5 openSUSE Leap 15.5 In some cases, an untrusted input stream was copied to a stack buffer without checking its size. This resulted in a potentially exploitable crash which could have led to a sandbox escape. This vulnerability affects Firefox < 116, Firefox ESR < 102.14, and Firefox ESR < 115.1. Moderate CVE-2023-4050 cpe:/o:opensuse:leap:15.5 openSUSE Leap 15.5 A website could have obscured the full screen notification by using the file open dialog. This could have led to user confusion and possible spoofing attacks. This vulnerability affects Firefox < 116, Firefox ESR < 115.2, and Thunderbird < 115.2. Moderate CVE-2023-4051 cpe:/o:opensuse:leap:15.5 openSUSE Leap 15.5 The Firefox updater created a directory writable by non-privileged users. When uninstalling Firefox, any files in that directory would be recursively deleted with the permissions of the uninstalling user account. This could be combined with creation of a junction (a form of symbolic link) to allow arbitrary file deletion controlled by the non-privileged user. *This bug only affects Firefox on Windows. Other operating systems are unaffected.* This vulnerability affects Firefox < 116, Firefox ESR < 115.1, and Thunderbird < 115.1. Moderate CVE-2023-4052 cpe:/o:opensuse:leap:15.5 openSUSE Leap 15.5 A website could have obscured the full screen notification by using a URL with a scheme handled by an external program, such as a mailto URL. This could have led to user confusion and possible spoofing attacks. This vulnerability affects Firefox < 116, Firefox ESR < 115.2, and Thunderbird < 115.2. Moderate CVE-2023-4053 cpe:/o:opensuse:leap:15.5 openSUSE Leap 15.5 When opening appref-ms files, Firefox did not warn the user that these files may contain malicious code. *This bug only affects Firefox on Windows. Other operating systems are unaffected.* This vulnerability affects Firefox < 116, Firefox ESR < 102.14, Firefox ESR < 115.1, Thunderbird < 102.14, and Thunderbird < 115.1. Moderate CVE-2023-4054 cpe:/o:opensuse:leap:15.5 openSUSE Leap 15.5 When the number of cookies per domain was exceeded in `document.cookie`, the actual cookie jar sent to the host was no longer consistent with expected cookie jar state. This could have caused requests to be sent with some cookies missing. This vulnerability affects Firefox < 116, Firefox ESR < 102.14, and Firefox ESR < 115.1. Moderate CVE-2023-4055 cpe:/o:opensuse:leap:15.5 openSUSE Leap 15.5 Memory safety bugs present in Firefox 115, Firefox ESR 115.0, Firefox ESR 102.13, Thunderbird 115.0, and Thunderbird 102.13. Some of these bugs showed evidence of memory corruption and we presume that with enough effort some of these could have been exploited to run arbitrary code. This vulnerability affects Firefox < 116, Firefox ESR < 102.14, and Firefox ESR < 115.1. Moderate CVE-2023-4056 cpe:/o:opensuse:leap:15.5 openSUSE Leap 15.5 Memory safety bugs present in Firefox 115, Firefox ESR 115.0, and Thunderbird 115.0. Some of these bugs showed evidence of memory corruption and we presume that with enough effort some of these could have been exploited to run arbitrary code. This vulnerability affects Firefox < 116, Firefox ESR < 115.1, and Thunderbird < 115.1. Moderate CVE-2023-4057 cpe:/o:opensuse:leap:15.5 openSUSE Leap 15.5 ** RESERVED ** This candidate has been reserved by an organization or individual that will use it when announcing a new security problem. When the candidate has been publicized, the details for this candidate will be provided. Important CVE-2023-40660 SUSE bug 1215762 cpe:/o:opensuse:leap:15.5 openSUSE Leap 15.5 ** RESERVED ** This candidate has been reserved by an organization or individual that will use it when announcing a new security problem. When the candidate has been publicized, the details for this candidate will be provided. Moderate CVE-2023-40661 SUSE bug 1215761 cpe:/o:opensuse:leap:15.5 openSUSE Leap 15.5 openSUSE Leap 15.5 NonFree Type Confusion in V8 in Google Chrome prior to 115.0.5790.170 allowed a remote attacker to perform arbitrary read/write via a crafted HTML page. (Chromium security severity: High) Important CVE-2023-4068 SUSE bug 1213920 cpe:/o:opensuse:leap:15.5 openSUSE Leap 15.5 openSUSE Leap 15.5 NonFree Type Confusion in V8 in Google Chrome prior to 115.0.5790.170 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page. (Chromium security severity: High) Important CVE-2023-4069 SUSE bug 1213920 cpe:/o:opensuse:leap:15.5 openSUSE Leap 15.5 openSUSE Leap 15.5 NonFree Type Confusion in V8 in Google Chrome prior to 115.0.5790.170 allowed a remote attacker to perform arbitrary read/write via a crafted HTML page. (Chromium security severity: High) Important CVE-2023-4070 SUSE bug 1213920 cpe:/o:opensuse:leap:15.5 openSUSE Leap 15.5 openSUSE Leap 15.5 NonFree Heap buffer overflow in Visuals in Google Chrome prior to 115.0.5790.170 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page. (Chromium security severity: High) Important CVE-2023-4071 SUSE bug 1213920 cpe:/o:opensuse:leap:15.5 openSUSE Leap 15.5 openSUSE Leap 15.5 NonFree Out of bounds read and write in WebGL in Google Chrome prior to 115.0.5790.170 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page. (Chromium security severity: High) Important CVE-2023-4072 SUSE bug 1213920 cpe:/o:opensuse:leap:15.5 openSUSE Leap 15.5 openSUSE Leap 15.5 NonFree Out of bounds memory access in ANGLE in Google Chrome on Mac prior to 115.0.5790.170 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page. (Chromium security severity: High) Important CVE-2023-4073 SUSE bug 1213920 cpe:/o:opensuse:leap:15.5 openSUSE Leap 15.5 openSUSE Leap 15.5 NonFree Use after free in Blink Task Scheduling in Google Chrome prior to 115.0.5790.170 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page. (Chromium security severity: High) Important CVE-2023-4074 SUSE bug 1213920 cpe:/o:opensuse:leap:15.5 openSUSE Leap 15.5 openSUSE Leap 15.5 NonFree Use after free in Cast in Google Chrome prior to 115.0.5790.170 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page. (Chromium security severity: High) Important CVE-2023-4075 SUSE bug 1213920 cpe:/o:opensuse:leap:15.5 openSUSE Leap 15.5 openSUSE Leap 15.5 NonFree Use after free in WebRTC in Google Chrome prior to 115.0.5790.170 allowed a remote attacker to potentially exploit heap corruption via a crafted WebRTC session. (Chromium security severity: High) Important CVE-2023-4076 SUSE bug 1213920 cpe:/o:opensuse:leap:15.5 openSUSE Leap 15.5 openSUSE Leap 15.5 NonFree Insufficient data validation in Extensions in Google Chrome prior to 115.0.5790.170 allowed an attacker who convinced a user to install a malicious extension to inject scripts or HTML into a privileged page via a crafted Chrome Extension. (Chromium security severity: Medium) Important CVE-2023-4077 SUSE bug 1213920 cpe:/o:opensuse:leap:15.5 openSUSE Leap 15.5 openSUSE Leap 15.5 NonFree Inappropriate implementation in Extensions in Google Chrome prior to 115.0.5790.170 allowed an attacker who convinced a user to install a malicious extension to inject scripts or HTML into a privileged page via a crafted Chrome Extension. (Chromium security severity: Medium) Important CVE-2023-4078 SUSE bug 1213920 cpe:/o:opensuse:leap:15.5 openSUSE Leap 15.5 ** RESERVED ** This candidate has been reserved by an organization or individual that will use it when announcing a new security problem. When the candidate has been publicized, the details for this candidate will be provided. Moderate CVE-2023-4091 SUSE bug 1215904 cpe:/o:opensuse:leap:15.5 openSUSE Leap 15.5 GitPython is a python library used to interact with Git repositories. In order to resolve some git references, GitPython reads files from the `.git` directory, in some places the name of the file being read is provided by the user, GitPython doesn't check if this file is located outside the `.git` directory. This allows an attacker to make GitPython read any file from the system. This vulnerability is present in https://github.com/gitpython-developers/GitPython/blob/1c8310d7cae144f74a671cbe17e51f63a830adbf/git/refs/symbolic.py#L174-L175. That code joins the base directory with a user given string without checking if the final path is located outside the base directory. This vulnerability cannot be used to read the contents of files but could in theory be used to trigger a denial of service for the program. This issue has not yet been addressed. Low CVE-2023-41040 SUSE bug 1214810 cpe:/o:opensuse:leap:15.5 openSUSE Leap 15.5 Redis is an in-memory database that persists on disk. Redis does not correctly identify keys accessed by `SORT_RO` and as a result may grant users executing this command access to keys that are not explicitly authorized by the ACL configuration. The problem exists in Redis 7.0 or newer and has been fixed in Redis 7.0.13 and 7.2.1. Users are advised to upgrade. There are no known workarounds for this vulnerability. Low CVE-2023-41053 SUSE bug 1215094 cpe:/o:opensuse:leap:15.5 openSUSE Leap 15.5 An issue was discovered in Python 3.11 through 3.11.4. If a path containing '\0' bytes is passed to os.path.normpath(), the path will be truncated unexpectedly at the first '\0' byte. There are plausible cases in which an application would have rejected a filename for security reasons in Python 3.10.x or earlier, but that filename is no longer rejected in Python 3.11.x. Moderate CVE-2023-41105 SUSE bug 1214693 cpe:/o:opensuse:leap:15.5 openSUSE Leap 15.5 A use-after-free flaw was found in net/sched/cls_fw.c in classifiers (cls_fw, cls_u32, and cls_route) in the Linux Kernel. This flaw allows a local attacker to perform a local privilege escalation due to incorrect handling of the existing filter, leading to a kernel information leak issue. Moderate CVE-2023-4128 SUSE bug 1214149 cpe:/o:opensuse:leap:15.5 openSUSE Leap 15.5 A use-after-free vulnerability was found in the siano smsusb module in the Linux kernel. The bug occurs during device initialization when the siano device is plugged in. This flaw allows a local user to crash the system, causing a denial of service condition. Moderate CVE-2023-4132 SUSE bug 1213969 cpe:/o:opensuse:leap:15.5 openSUSE Leap 15.5 A use-after-free vulnerability was found in the cxgb4 driver in the Linux kernel. The bug occurs when the cxgb4 device is detaching due to a possible rearming of the flower_stats_timer from the work queue. This flaw allows a local user to crash the system, causing a denial of service condition. Moderate CVE-2023-4133 SUSE bug 1213970 cpe:/o:opensuse:leap:15.5 openSUSE Leap 15.5 ** RESERVED ** This candidate has been reserved by an organization or individual that will use it when announcing a new security problem. When the candidate has been publicized, the details for this candidate will be provided. Moderate CVE-2023-4134 SUSE bug 1213971 cpe:/o:opensuse:leap:15.5 openSUSE Leap 15.5 An issue was discovered in FRRouting FRR through 9.0. bgpd/bgp_packet.c processes NLRIs if the attribute length is zero. Important CVE-2023-41358 SUSE bug 1214735 cpe:/o:opensuse:leap:15.5 openSUSE Leap 15.5 An issue was discovered in FRRouting FRR through 9.0. bgpd/bgp_packet.c can read the initial byte of the ORF header in an ahead-of-stream situation. Low CVE-2023-41360 SUSE bug 1214739 cpe:/o:opensuse:leap:15.5 openSUSE Leap 15.5 An issue in Gevent before version 23.9.0 allows a remote attacker to escalate privileges via a crafted script to the WSGIServer component. Important CVE-2023-41419 SUSE bug 1215469 cpe:/o:opensuse:leap:15.5 openSUSE Leap 15.5 A use-after-free flaw was found in the Linux kernel’s Netfilter functionality when adding a rule with NFTA_RULE_CHAIN_ID. This flaw allows a local user to crash or escalate their privileges on the system. Important CVE-2023-4147 SUSE bug 1213968 SUSE bug 1215118 cpe:/o:opensuse:leap:15.5 openSUSE Leap 15.5 ** RESERVED ** This candidate has been reserved by an organization or individual that will use it when announcing a new security problem. When the candidate has been publicized, the details for this candidate will be provided. Important CVE-2023-4154 SUSE bug 1215908 cpe:/o:opensuse:leap:15.5 openSUSE Leap 15.5 A flaw was found in KVM AMD Secure Encrypted Virtualization (SEV) in the Linux kernel. A KVM guest using SEV-ES or SEV-SNP with multiple vCPUs can trigger a double fetch race condition vulnerability and invoke the `VMGEXIT` handler recursively. If an attacker manages to call the handler multiple times, they can trigger a stack overflow and cause a denial of service or potentially guest-to-host escape in kernel configurations without stack guard pages (`CONFIG_VMAP_STACK`). Moderate CVE-2023-4155 SUSE bug 1214022 cpe:/o:opensuse:leap:15.5 openSUSE Leap 15.5 A heap out-of-bounds read flaw was found in builtin.c in the gawk package. This issue may lead to a crash and could be used to read sensitive information. Low CVE-2023-4156 SUSE bug 1214025 cpe:/o:opensuse:leap:15.5 openSUSE Leap 15.5 An issue was discovered in FRRouting FRR through 9.0. bgp_nlri_parse_flowspec in bgpd/bgp_flowspec.c processes malformed requests with no attributes, leading to a NULL pointer dereference. Low CVE-2023-41909 SUSE bug 1215065 cpe:/o:opensuse:leap:15.5 openSUSE Leap 15.5 ** RESERVED ** This candidate has been reserved by an organization or individual that will use it when announcing a new security problem. When the candidate has been publicized, the details for this candidate will be provided. Important CVE-2023-41914 SUSE bug 1216207 cpe:/o:opensuse:leap:15.5 openSUSE Leap 15.5 OpenPMIx PMIx before 4.2.6 and 5.0.x before 5.0.1 allows attackers to obtain ownership of arbitrary files via a race condition during execution of library code with UID 0. Moderate CVE-2023-41915 SUSE bug 1215190 cpe:/o:opensuse:leap:15.5 openSUSE Leap 15.5 A flaw was found in the Linux kernel's TUN/TAP functionality. This issue could allow a local user to bypass network filters and gain unauthorized access to some resources. The original patches fixing CVE-2023-1076 are incorrect or incomplete. The problem is that the following upstream commits - a096ccca6e50 ("tun: tun_chr_open(): correctly initialize socket uid"), - 66b2c338adce ("tap: tap_open(): correctly initialize socket uid"), pass "inode->i_uid" to sock_init_data_uid() as the last parameter and that turns out to not be accurate. Moderate CVE-2023-4194 SUSE bug 1214019 cpe:/o:opensuse:leap:15.5 openSUSE Leap 15.5 ** RESERVED ** This candidate has been reserved by an organization or individual that will use it when announcing a new security problem. When the candidate has been publicized, the details for this candidate will be provided. Low CVE-2023-42114 SUSE bug 1215784 cpe:/o:opensuse:leap:15.5 openSUSE Leap 15.5 ** RESERVED ** This candidate has been reserved by an organization or individual that will use it when announcing a new security problem. When the candidate has been publicized, the details for this candidate will be provided. Critical CVE-2023-42115 SUSE bug 1215785 cpe:/o:opensuse:leap:15.5 openSUSE Leap 15.5 ** RESERVED ** This candidate has been reserved by an organization or individual that will use it when announcing a new security problem. When the candidate has been publicized, the details for this candidate will be provided. Important CVE-2023-42116 SUSE bug 1215786 cpe:/o:opensuse:leap:15.5 openSUSE Leap 15.5 ** RESERVED ** This candidate has been reserved by an organization or individual that will use it when announcing a new security problem. When the candidate has been publicized, the details for this candidate will be provided. Important CVE-2023-42117 SUSE bug 1215787 cpe:/o:opensuse:leap:15.5 openSUSE Leap 15.5 ** RESERVED ** This candidate has been reserved by an organization or individual that will use it when announcing a new security problem. When the candidate has been publicized, the details for this candidate will be provided. Low CVE-2023-42119 SUSE bug 1215789 cpe:/o:opensuse:leap:15.5 openSUSE Leap 15.5 ** RESERVED ** This candidate has been reserved by an organization or individual that will use it when announcing a new security problem. When the candidate has been publicized, the details for this candidate will be provided. Moderate CVE-2023-42669 SUSE bug 1215905 cpe:/o:opensuse:leap:15.5 openSUSE Leap 15.5 ** RESERVED ** This candidate has been reserved by an organization or individual that will use it when announcing a new security problem. When the candidate has been publicized, the details for this candidate will be provided. Moderate CVE-2023-42670 SUSE bug 1215906 cpe:/o:opensuse:leap:15.5 openSUSE Leap 15.5 A flaw was found in the exFAT driver of the Linux kernel. The vulnerability exists in the implementation of the file name reconstruction function, which is responsible for reading file name entries from a directory index and merging file name parts belonging to one file into a single long file name. Since the file name characters are copied into a stack variable, a local privileged attacker could use this flaw to overflow the kernel stack. Important CVE-2023-4273 SUSE bug 1214120 SUSE bug 1214123 cpe:/o:opensuse:leap:15.5 openSUSE Leap 15.5 An array indexing vulnerability was found in the netfilter subsystem of the Linux kernel. A missing macro could lead to a miscalculation of the `h->nets` array offset, providing attackers with the primitive to arbitrarily increment/decrement a memory buffer out-of-bound. This issue may allow a local user to crash the system or potentially escalate their privileges on the system. Moderate CVE-2023-42753 cpe:/o:opensuse:leap:15.5 openSUSE Leap 15.5 A NULL pointer dereference flaw was found in the Linux kernel ipv4 stack. The socket buffer (skb) was assumed to be associated with a device before calling __ip_options_compile, which is not always the case if the skb is re-routed by ipvs. This issue may allow a local user with CAP_NET_ADMIN privileges to crash the system. Moderate CVE-2023-42754 SUSE bug 1215467 cpe:/o:opensuse:leap:15.5 openSUSE Leap 15.5 aes-gcm is a pure Rust implementation of the AES-GCM. Starting in version 0.10.0 and prior to version 0.10.3, in the AES GCM implementation of decrypt_in_place_detached, the decrypted ciphertext (i.e. the correct plaintext) is exposed even if tag verification fails. If a program using the `aes-gcm` crate's `decrypt_in_place*` APIs accesses the buffer after decryption failure, it will contain a decryption of an unauthenticated input. Depending on the specific nature of the program this may enable Chosen Ciphertext Attacks (CCAs) which can cause a catastrophic breakage of the cipher including full plaintext recovery. Version 0.10.3 contains a fix for this issue. Moderate CVE-2023-42811 SUSE bug 1215654 cpe:/o:opensuse:leap:15.5 openSUSE Leap 15.5 In Artifex Ghostscript through 10.01.2, gdevijs.c in GhostPDL can lead to remote code execution via crafted PostScript documents because they can switch to the IJS device, or change the IjsServer parameter, after SAFER has been activated. NOTE: it is a documented risk that the IJS server can be specified on a gs command line (the IJS device inherently must execute a command to start the IJS server). Important CVE-2023-43115 SUSE bug 1215466 cpe:/o:opensuse:leap:15.5 openSUSE Leap 15.5 openSUSE Leap 15.5 NonFree Use after free in Device Trust Connectors in Google Chrome prior to 116.0.5845.96 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page. (Chromium security severity: High) Important CVE-2023-4349 SUSE bug 1214301 cpe:/o:opensuse:leap:15.5 openSUSE Leap 15.5 openSUSE Leap 15.5 NonFree Inappropriate implementation in Fullscreen in Google Chrome on Android prior to 116.0.5845.96 allowed a remote attacker to potentially spoof the contents of the Omnibox (URL bar) via a crafted HTML page. (Chromium security severity: High) Important CVE-2023-4350 SUSE bug 1214301 cpe:/o:opensuse:leap:15.5 openSUSE Leap 15.5 openSUSE Leap 15.5 NonFree Use after free in Network in Google Chrome prior to 116.0.5845.96 allowed a remote attacker who has elicited a browser shutdown to potentially exploit heap corruption via a crafted HTML page. (Chromium security severity: High) Important CVE-2023-4351 SUSE bug 1214301 cpe:/o:opensuse:leap:15.5 openSUSE Leap 15.5 openSUSE Leap 15.5 NonFree Type confusion in V8 in Google Chrome prior to 116.0.5845.96 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page. (Chromium security severity: High) Important CVE-2023-4352 SUSE bug 1214301 cpe:/o:opensuse:leap:15.5 openSUSE Leap 15.5 openSUSE Leap 15.5 NonFree Heap buffer overflow in ANGLE in Google Chrome prior to 116.0.5845.96 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page. (Chromium security severity: High) Important CVE-2023-4353 SUSE bug 1214301 cpe:/o:opensuse:leap:15.5 openSUSE Leap 15.5 openSUSE Leap 15.5 NonFree Heap buffer overflow in Skia in Google Chrome prior to 116.0.5845.96 allowed a remote attacker who had compromised the renderer process to potentially exploit heap corruption via a crafted HTML page. (Chromium security severity: High) Important CVE-2023-4354 SUSE bug 1214301 cpe:/o:opensuse:leap:15.5 openSUSE Leap 15.5 openSUSE Leap 15.5 NonFree Out of bounds memory access in V8 in Google Chrome prior to 116.0.5845.96 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page. (Chromium security severity: High) Important CVE-2023-4355 SUSE bug 1214301 cpe:/o:opensuse:leap:15.5 openSUSE Leap 15.5 openSUSE Leap 15.5 NonFree Use after free in Audio in Google Chrome prior to 116.0.5845.96 allowed a remote attacker who has convinced a user to engage in specific UI interaction to potentially exploit heap corruption via a crafted HTML page. (Chromium security severity: Medium) Important CVE-2023-4356 SUSE bug 1214301 cpe:/o:opensuse:leap:15.5 openSUSE Leap 15.5 openSUSE Leap 15.5 NonFree Insufficient validation of untrusted input in XML in Google Chrome prior to 116.0.5845.96 allowed a remote attacker to bypass file access restrictions via a crafted HTML page. (Chromium security severity: Medium) Important CVE-2023-4357 SUSE bug 1214301 cpe:/o:opensuse:leap:15.5 openSUSE Leap 15.5 openSUSE Leap 15.5 NonFree Use after free in DNS in Google Chrome prior to 116.0.5845.96 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page. (Chromium security severity: Medium) Important CVE-2023-4358 SUSE bug 1214301 cpe:/o:opensuse:leap:15.5 openSUSE Leap 15.5 openSUSE Leap 15.5 NonFree Inappropriate implementation in App Launcher in Google Chrome on iOS prior to 116.0.5845.96 allowed a remote attacker to potentially spoof elements of the security UI via a crafted HTML page. (Chromium security severity: Medium) Important CVE-2023-4359 SUSE bug 1214301 cpe:/o:opensuse:leap:15.5 openSUSE Leap 15.5 openSUSE Leap 15.5 NonFree Inappropriate implementation in Color in Google Chrome prior to 116.0.5845.96 allowed a remote attacker to obfuscate security UI via a crafted HTML page. (Chromium security severity: Medium) Important CVE-2023-4360 SUSE bug 1214301 cpe:/o:opensuse:leap:15.5 openSUSE Leap 15.5 openSUSE Leap 15.5 NonFree Inappropriate implementation in Autofill in Google Chrome on Android prior to 116.0.5845.96 allowed a remote attacker to bypass Autofill restrictions via a crafted HTML page. (Chromium security severity: Medium) Important CVE-2023-4361 SUSE bug 1214301 cpe:/o:opensuse:leap:15.5 openSUSE Leap 15.5 openSUSE Leap 15.5 NonFree Heap buffer overflow in Mojom IDL in Google Chrome prior to 116.0.5845.96 allowed a remote attacker who had compromised the renderer process and gained control of a WebUI process to potentially exploit heap corruption via a crafted HTML page. (Chromium security severity: Medium) Important CVE-2023-4362 SUSE bug 1214301 cpe:/o:opensuse:leap:15.5 openSUSE Leap 15.5 openSUSE Leap 15.5 NonFree Inappropriate implementation in WebShare in Google Chrome on Android prior to 116.0.5845.96 allowed a remote attacker to spoof the contents of a dialog URL via a crafted HTML page. (Chromium security severity: Medium) Important CVE-2023-4363 SUSE bug 1214301 cpe:/o:opensuse:leap:15.5 openSUSE Leap 15.5 openSUSE Leap 15.5 NonFree Inappropriate implementation in Permission Prompts in Google Chrome prior to 116.0.5845.96 allowed a remote attacker to obfuscate security UI via a crafted HTML page. (Chromium security severity: Medium) Important CVE-2023-4364 SUSE bug 1214301 cpe:/o:opensuse:leap:15.5 openSUSE Leap 15.5 libcue provides an API for parsing and extracting data from CUE sheets. Versions 2.2.1 and prior are vulnerable to out-of-bounds array access. A user of the GNOME desktop environment can be exploited by downloading a cue sheet from a malicious webpage. Because the file is saved to `~/Downloads`, it is then automatically scanned by tracker-miners. And because it has a .cue filename extension, tracker-miners use libcue to parse the file. The file exploits the vulnerability in libcue to gain code execution. This issue is patched in version 2.3.0. Important CVE-2023-43641 SUSE bug 1215728 cpe:/o:opensuse:leap:15.5 openSUSE Leap 15.5 openSUSE Leap 15.5 NonFree Inappropriate implementation in Fullscreen in Google Chrome prior to 116.0.5845.96 allowed a remote attacker to obfuscate security UI via a crafted HTML page. (Chromium security severity: Medium) Important CVE-2023-4365 SUSE bug 1214301 cpe:/o:opensuse:leap:15.5 openSUSE Leap 15.5 Composer is a dependency manager for PHP. Users publishing a composer.phar to a public web-accessible server where the composer.phar can be executed as a php file may be subject to a remote code execution vulnerability if PHP also has `register_argc_argv` enabled in php.ini. Versions 2.6.4, 2.2.22 and 1.10.27 patch this vulnerability. Users are advised to upgrade. Users unable to upgrade should make sure `register_argc_argv` is disabled in php.ini, and avoid publishing composer.phar to the web as this is not best practice. Moderate CVE-2023-43655 SUSE bug 1215859 cpe:/o:opensuse:leap:15.5 openSUSE Leap 15.5 openSUSE Leap 15.5 NonFree Use after free in Extensions in Google Chrome prior to 116.0.5845.96 allowed an attacker who convinced a user to install a malicious extension to potentially exploit heap corruption via a crafted HTML page. (Chromium security severity: Medium) Important CVE-2023-4366 SUSE bug 1214301 cpe:/o:opensuse:leap:15.5 openSUSE Leap 15.5 ** RESERVED ** This candidate has been reserved by an organization or individual that will use it when announcing a new security problem. When the candidate has been publicized, the details for this candidate will be provided. Moderate CVE-2023-43665 SUSE bug 1215978 cpe:/o:opensuse:leap:15.5 openSUSE Leap 15.5 openSUSE Leap 15.5 NonFree Insufficient policy enforcement in Extensions API in Google Chrome prior to 116.0.5845.96 allowed an attacker who convinced a user to install a malicious extension to bypass an enterprise policy via a crafted HTML page. (Chromium security severity: Medium) Important CVE-2023-4367 SUSE bug 1214301 cpe:/o:opensuse:leap:15.5 openSUSE Leap 15.5 openSUSE Leap 15.5 NonFree Insufficient policy enforcement in Extensions API in Google Chrome prior to 116.0.5845.96 allowed an attacker who convinced a user to install a malicious extension to bypass an enterprise policy via a crafted HTML page. (Chromium security severity: Medium) Important CVE-2023-4368 SUSE bug 1214301 cpe:/o:opensuse:leap:15.5 openSUSE Leap 15.5 A vulnerability was found in libX11 due to a boundary condition within the _XkbReadKeySyms() function. This flaw allows a local user to trigger an out-of-bounds read error and read the contents of memory on the system. Low CVE-2023-43785 SUSE bug 1215683 cpe:/o:opensuse:leap:15.5 openSUSE Leap 15.5 A vulnerability was found in libX11 due to an infinite loop within the PutSubImage() function. This flaw allows a local user to consume all available system resources and cause a denial of service condition. Low CVE-2023-43786 SUSE bug 1215682 SUSE bug 1215684 cpe:/o:opensuse:leap:15.5 openSUSE Leap 15.5 A vulnerability was found in libX11 due to an integer overflow within the XCreateImage() function. This flaw allows a local user to trigger an integer overflow and execute arbitrary code with elevated privileges. Low CVE-2023-43787 SUSE bug 1215682 SUSE bug 1215685 cpe:/o:opensuse:leap:15.5 openSUSE Leap 15.5 A vulnerability was found in libXpm due to a boundary condition within the XpmCreateXpmImageFromBuffer() function. This flaw allows a local to trigger an out-of-bounds read error and read the contents of memory on the system. Low CVE-2023-43788 SUSE bug 1215682 SUSE bug 1215686 cpe:/o:opensuse:leap:15.5 openSUSE Leap 15.5 A vulnerability was found in libXpm where a vulnerability exists due to a boundary condition, a local user can trigger an out-of-bounds read error and read contents of memory on the system. Low CVE-2023-43789 SUSE bug 1215682 SUSE bug 1215687 cpe:/o:opensuse:leap:15.5 openSUSE Leap 15.5 urllib3 is a user-friendly HTTP client library for Python. urllib3 doesn't treat the `Cookie` HTTP header special or provide any helpers for managing cookies over HTTP, that is the responsibility of the user. However, it is possible for a user to specify a `Cookie` header and unknowingly leak information via HTTP redirects to a different origin if that user doesn't disable redirects explicitly. This issue has been patched in urllib3 version 1.26.17 or 2.0.5. Moderate CVE-2023-43804 SUSE bug 1215968 cpe:/o:opensuse:leap:15.5 openSUSE Leap 15.5 A NULL pointer dereference flaw was found in dbFree in fs/jfs/jfs_dmap.c in the journaling file system (JFS) in the Linux Kernel. This issue may allow a local attacker to crash the system due to a missing sanity check. Moderate CVE-2023-4385 SUSE bug 1214348 cpe:/o:opensuse:leap:15.5 openSUSE Leap 15.5 A use-after-free flaw was found in vmxnet3_rq_alloc_rx_buf in drivers/net/vmxnet3/vmxnet3_drv.c in VMware's vmxnet3 ethernet NIC driver in the Linux Kernel. This issue could allow a local attacker to crash the system due to a double-free while cleaning up vmxnet3_rq_cleanup_all, which could also lead to a kernel information leak problem. Moderate CVE-2023-4387 SUSE bug 1214350 cpe:/o:opensuse:leap:15.5 openSUSE Leap 15.5 A flaw was found in btrfs_get_root_ref in fs/btrfs/disk-io.c in the btrfs filesystem in the Linux Kernel due to a double decrement of the reference count. This issue may allow a local attacker with user privilege to crash the system or may lead to leaked internal kernel information. Moderate CVE-2023-4389 SUSE bug 1214351 cpe:/o:opensuse:leap:15.5 openSUSE Leap 15.5 Out of bounds memory access in V8 in Google Chrome prior to 116.0.5845.110 allowed a remote attacker to perform an out of bounds memory read via a crafted HTML page. (Chromium security severity: High) Important CVE-2023-4427 SUSE bug 1214487 cpe:/o:opensuse:leap:15.5 openSUSE Leap 15.5 Out of bounds memory access in CSS in Google Chrome prior to 116.0.5845.110 allowed a remote attacker to perform an out of bounds memory read via a crafted HTML page. (Chromium security severity: High) Important CVE-2023-4428 SUSE bug 1214487 cpe:/o:opensuse:leap:15.5 openSUSE Leap 15.5 Use after free in Loader in Google Chrome prior to 116.0.5845.110 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page. (Chromium security severity: High) Important CVE-2023-4429 SUSE bug 1214487 cpe:/o:opensuse:leap:15.5 openSUSE Leap 15.5 Use after free in Vulkan in Google Chrome prior to 116.0.5845.110 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page. (Chromium security severity: High) Important CVE-2023-4430 SUSE bug 1214487 cpe:/o:opensuse:leap:15.5 openSUSE Leap 15.5 Out of bounds memory access in Fonts in Google Chrome prior to 116.0.5845.110 allowed a remote attacker to perform an out of bounds memory read via a crafted HTML page. (Chromium security severity: Medium) Important CVE-2023-4431 SUSE bug 1214487 cpe:/o:opensuse:leap:15.5 openSUSE Leap 15.5 The HTTP/2 protocol allows a denial of service (server resource consumption) because request cancellation can reset many streams quickly, as exploited in the wild in August through October 2023. Important CVE-2023-44487 SUSE bug 1216109 SUSE bug 1216123 SUSE bug 1216169 SUSE bug 1216171 SUSE bug 1216174 SUSE bug 1216176 SUSE bug 1216181 SUSE bug 1216182 SUSE bug 1216190 cpe:/o:opensuse:leap:15.5 openSUSE Leap 15.5 A NULL pointer dereference flaw was found in vmxnet3_rq_cleanup in drivers/net/vmxnet3/vmxnet3_drv.c in the networking sub-component in vmxnet3 in the Linux Kernel. This issue may allow a local attacker with normal user privilege to cause a denial of service due to a missing sanity check during cleanup. Moderate CVE-2023-4459 SUSE bug 1214451 cpe:/o:opensuse:leap:15.5 openSUSE Leap 15.5 Due to failure in validating the length provided by an attacker-crafted PPD PostScript document, CUPS and libppd are susceptible to a heap-based buffer overflow and possibly code execution. This issue has been fixed in CUPS version 2.4.7, released in September of 2023. Important CVE-2023-4504 SUSE bug 1215204 cpe:/o:opensuse:leap:15.5 openSUSE Leap 15.5 BT SDP dissector infinite loop in Wireshark 4.0.0 to 4.0.7 and 3.6.0 to 3.6.15 allows denial of service via packet injection or crafted capture file Moderate CVE-2023-4511 SUSE bug 1214560 cpe:/o:opensuse:leap:15.5 openSUSE Leap 15.5 CBOR dissector crash in Wireshark 4.0.0 to 4.0.6 allows denial of service via packet injection or crafted capture file Moderate CVE-2023-4512 SUSE bug 1214561 cpe:/o:opensuse:leap:15.5 openSUSE Leap 15.5 BT SDP dissector memory leak in Wireshark 4.0.0 to 4.0.7 and 3.6.0 to 3.6.15 allows denial of service via packet injection or crafted capture file Moderate CVE-2023-4513 SUSE bug 1214562 cpe:/o:opensuse:leap:15.5 openSUSE Leap 15.5 ** REJECT ** This was assigned as a duplicate of CVE-2023-4244. Low CVE-2023-4563 SUSE bug 1214727 cpe:/o:opensuse:leap:15.5 openSUSE Leap 15.5 A memory leak flaw was found in nft_set_catchall_flush in net/netfilter/nf_tables_api.c in the Linux Kernel. This issue may allow a local attacker to cause a double-deactivations of catchall elements, which results in a memory leak. Low CVE-2023-4569 SUSE bug 1214729 cpe:/o:opensuse:leap:15.5 openSUSE Leap 15.5 openSUSE Leap 15.5 NonFree Use after free in MediaStream in Google Chrome prior to 116.0.5845.140 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page. (Chromium security severity: High) Important CVE-2023-4572 SUSE bug 1214758 cpe:/o:opensuse:leap:15.5 openSUSE Leap 15.5 When receiving rendering data over IPC `mStream` could have been destroyed when initialized, which could have led to a use-after-free causing a potentially exploitable crash. This vulnerability affects Firefox < 117, Firefox ESR < 102.15, Firefox ESR < 115.2, Thunderbird < 102.15, and Thunderbird < 115.2. Important CVE-2023-4573 cpe:/o:opensuse:leap:15.5 openSUSE Leap 15.5 When creating a callback over IPC for showing the Color Picker window, multiple of the same callbacks could have been created at a time and eventually all simultaneously destroyed as soon as one of the callbacks finished. This could have led to a use-after-free causing a potentially exploitable crash. This vulnerability affects Firefox < 117, Firefox ESR < 102.15, Firefox ESR < 115.2, Thunderbird < 102.15, and Thunderbird < 115.2. Important CVE-2023-4574 cpe:/o:opensuse:leap:15.5 openSUSE Leap 15.5 When creating a callback over IPC for showing the File Picker window, multiple of the same callbacks could have been created at a time and eventually all simultaneously destroyed as soon as one of the callbacks finished. This could have led to a use-after-free causing a potentially exploitable crash. This vulnerability affects Firefox < 117, Firefox ESR < 102.15, Firefox ESR < 115.2, Thunderbird < 102.15, and Thunderbird < 115.2. Important CVE-2023-4575 cpe:/o:opensuse:leap:15.5 openSUSE Leap 15.5 On Windows, an integer overflow could occur in `RecordedSourceSurfaceCreation` which resulted in a heap buffer overflow potentially leaking sensitive data that could have led to a sandbox escape. *This bug only affects Firefox on Windows. Other operating systems are unaffected.* This vulnerability affects Firefox < 117, Firefox ESR < 102.15, Firefox ESR < 115.2, Thunderbird < 102.15, and Thunderbird < 115.2. Important CVE-2023-4576 cpe:/o:opensuse:leap:15.5 openSUSE Leap 15.5 When `UpdateRegExpStatics` attempted to access `initialStringHeap` it could already have been garbage collected prior to entering the function, which could potentially have led to an exploitable crash. This vulnerability affects Firefox < 117, Firefox ESR < 115.2, and Thunderbird < 115.2. Important CVE-2023-4577 cpe:/o:opensuse:leap:15.5 openSUSE Leap 15.5 When calling `JS::CheckRegExpSyntax` a Syntax Error could have been set which would end in calling `convertToRuntimeErrorAndClear`. A path in the function could attempt to allocate memory when none is available which would have caused a newly created Out of Memory exception to be mishandled as a Syntax Error. This vulnerability affects Firefox < 117, Firefox ESR < 115.2, and Thunderbird < 115.2. Important CVE-2023-4578 cpe:/o:opensuse:leap:15.5 openSUSE Leap 15.5 Push notifications stored on disk in private browsing mode were not being encrypted potentially allowing the leak of sensitive information. This vulnerability affects Firefox < 117, Firefox ESR < 115.2, and Thunderbird < 115.2. Important CVE-2023-4580 cpe:/o:opensuse:leap:15.5 openSUSE Leap 15.5 Excel `.xll` add-in files did not have a blocklist entry in Firefox's executable blocklist which allowed them to be downloaded without any warning of their potential harm. This vulnerability affects Firefox < 117, Firefox ESR < 102.15, Firefox ESR < 115.2, Thunderbird < 102.15, and Thunderbird < 115.2. Important CVE-2023-4581 cpe:/o:opensuse:leap:15.5 openSUSE Leap 15.5 Due to large allocation checks in Angle for glsl shaders being too lenient a buffer overflow could have occured when allocating too much private shader memory on mac OS. *This bug only affects Firefox on macOS. Other operating systems are unaffected.* This vulnerability affects Firefox < 117, Firefox ESR < 115.2, and Thunderbird < 115.2. Important CVE-2023-4582 cpe:/o:opensuse:leap:15.5 openSUSE Leap 15.5 When checking if the Browsing Context had been discarded in `HttpBaseChannel`, if the load group was not available then it was assumed to have already been discarded which was not always the case for private channels after the private session had ended. This vulnerability affects Firefox < 117, Firefox ESR < 115.2, and Thunderbird < 115.2. Important CVE-2023-4583 cpe:/o:opensuse:leap:15.5 openSUSE Leap 15.5 Memory safety bugs present in Firefox 116, Firefox ESR 102.14, Firefox ESR 115.1, Thunderbird 102.14, and Thunderbird 115.1. Some of these bugs showed evidence of memory corruption and we presume that with enough effort some of these could have been exploited to run arbitrary code. This vulnerability affects Firefox < 117, Firefox ESR < 102.15, Firefox ESR < 115.2, Thunderbird < 102.15, and Thunderbird < 115.2. Important CVE-2023-4584 cpe:/o:opensuse:leap:15.5 openSUSE Leap 15.5 Memory safety bugs present in Firefox 116, Firefox ESR 115.1, and Thunderbird 115.1. Some of these bugs showed evidence of memory corruption and we presume that with enough effort some of these could have been exploited to run arbitrary code. This vulnerability affects Firefox < 117, Firefox ESR < 115.2, and Thunderbird < 115.2. Important CVE-2023-4585 cpe:/o:opensuse:leap:15.5 openSUSE Leap 15.5 A use-after-free vulnerability in the Linux kernel's af_unix component can be exploited to achieve local privilege escalation. The unix_stream_sendpage() function tries to add data to the last skb in the peer's recv queue without locking the queue. Thus there is a race where unix_stream_sendpage() could access an skb locklessly that is being released by garbage collection, resulting in use-after-free. We recommend upgrading past commit 790c2f9d15b594350ae9bca7b236f2b1859de02c. Important CVE-2023-4622 SUSE bug 1215117 SUSE bug 1215442 cpe:/o:opensuse:leap:15.5 openSUSE Leap 15.5 A use-after-free vulnerability in the Linux kernel's net/sched: sch_hfsc (HFSC qdisc traffic control) component can be exploited to achieve local privilege escalation. If a class with a link-sharing curve (i.e. with the HFSC_FSC flag set) has a parent without a link-sharing curve, then init_vf() will call vttree_insert() on the parent, but vttree_remove() will be skipped in update_vf(). This leaves a dangling pointer that can cause a use-after-free. We recommend upgrading past commit b3d26c5702c7d6c45456326e56d2ccf3f103e60f. Important CVE-2023-4623 SUSE bug 1215115 SUSE bug 1215440 cpe:/o:opensuse:leap:15.5 openSUSE Leap 15.5 ** RESERVED ** This candidate has been reserved by an organization or individual that will use it when announcing a new security problem. When the candidate has been publicized, the details for this candidate will be provided. Low CVE-2023-4641 SUSE bug 1214806 cpe:/o:opensuse:leap:15.5 openSUSE Leap 15.5 Out of bounds memory access in FedCM in Google Chrome prior to 116.0.5845.179 allowed a remote attacker who had compromised the renderer process to perform an out of bounds memory read via a crafted HTML page. (Chromium security severity: High) Important CVE-2023-4761 SUSE bug 1215023 cpe:/o:opensuse:leap:15.5 openSUSE Leap 15.5 Type Confusion in V8 in Google Chrome prior to 116.0.5845.179 allowed a remote attacker to execute arbitrary code via a crafted HTML page. (Chromium security severity: High) Important CVE-2023-4762 SUSE bug 1215023 cpe:/o:opensuse:leap:15.5 openSUSE Leap 15.5 Use after free in Networks in Google Chrome prior to 116.0.5845.179 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page. (Chromium security severity: High) Important CVE-2023-4763 SUSE bug 1215023 cpe:/o:opensuse:leap:15.5 openSUSE Leap 15.5 Incorrect security UI in BFCache in Google Chrome prior to 116.0.5845.179 allowed a remote attacker to spoof the contents of the Omnibox (URL bar) via a crafted HTML page. (Chromium security severity: High) Important CVE-2023-4764 SUSE bug 1215023 cpe:/o:opensuse:leap:15.5 openSUSE Leap 15.5 A flaw was found in glibc. In an uncommon situation, the gaih_inet function may use memory that has been freed, resulting in an application crash. This issue is only exploitable when the getaddrinfo function is called and the hosts database in /etc/nsswitch.conf is configured with SUCCESS=continue or SUCCESS=merge. Moderate CVE-2023-4813 SUSE bug 1215286 cpe:/o:opensuse:leap:15.5 openSUSE Leap 15.5 Heap buffer overflow in libwebp in Google Chrome prior to 116.0.5845.187 and libwebp 1.3.2 allowed a remote attacker to perform an out of bounds memory write via a crafted HTML page. (Chromium security severity: Critical) Important CVE-2023-4863 SUSE bug 1215231 cpe:/o:opensuse:leap:15.5 openSUSE Leap 15.5 Null pointer dereference when viewing a specially crafted email in Mutt >1.5.2 <2.2.12 Low CVE-2023-4874 SUSE bug 1215189 cpe:/o:opensuse:leap:15.5 openSUSE Leap 15.5 Null pointer dereference when composing from a specially crafted draft message in Mutt >1.5.2 <2.2.12 Moderate CVE-2023-4875 SUSE bug 1215191 cpe:/o:opensuse:leap:15.5 openSUSE Leap 15.5 ** REJECT ** CVE-2023-4881 was wrongly assigned to a bug that was deemed to be a non-security issue by the Linux kernel security team. Moderate CVE-2023-4881 SUSE bug 1215221 cpe:/o:opensuse:leap:15.5 openSUSE Leap 15.5 Inappropriate implementation in Custom Tabs in Google Chrome on Android prior to 117.0.5938.62 allowed a remote attacker to obfuscate a permission prompt via a crafted HTML page. (Chromium security severity: Medium) Important CVE-2023-4900 cpe:/o:opensuse:leap:15.5 openSUSE Leap 15.5 Inappropriate implementation in Prompts in Google Chrome prior to 117.0.5938.62 allowed a remote attacker to potentially spoof security UI via a crafted HTML page. (Chromium security severity: Medium) Important CVE-2023-4901 cpe:/o:opensuse:leap:15.5 openSUSE Leap 15.5 Inappropriate implementation in Input in Google Chrome prior to 117.0.5938.62 allowed a remote attacker to spoof security UI via a crafted HTML page. (Chromium security severity: Medium) Important CVE-2023-4902 cpe:/o:opensuse:leap:15.5 openSUSE Leap 15.5 Inappropriate implementation in Custom Mobile Tabs in Google Chrome on Android prior to 117.0.5938.62 allowed a remote attacker to spoof security UI via a crafted HTML page. (Chromium security severity: Medium) Important CVE-2023-4903 cpe:/o:opensuse:leap:15.5 openSUSE Leap 15.5 Insufficient policy enforcement in Downloads in Google Chrome prior to 117.0.5938.62 allowed a remote attacker to bypass Enterprise policy restrictions via a crafted download. (Chromium security severity: Medium) Important CVE-2023-4904 cpe:/o:opensuse:leap:15.5 openSUSE Leap 15.5 Inappropriate implementation in Prompts in Google Chrome prior to 117.0.5938.62 allowed a remote attacker to spoof security UI via a crafted HTML page. (Chromium security severity: Medium) Important CVE-2023-4905 cpe:/o:opensuse:leap:15.5 openSUSE Leap 15.5 Insufficient policy enforcement in Autofill in Google Chrome prior to 117.0.5938.62 allowed a remote attacker to bypass Autofill restrictions via a crafted HTML page. (Chromium security severity: Low) Important CVE-2023-4906 cpe:/o:opensuse:leap:15.5 openSUSE Leap 15.5 Inappropriate implementation in Intents in Google Chrome on Android prior to 117.0.5938.62 allowed a remote attacker to obfuscate security UI via a crafted HTML page. (Chromium security severity: Low) Important CVE-2023-4907 cpe:/o:opensuse:leap:15.5 openSUSE Leap 15.5 Inappropriate implementation in Picture in Picture in Google Chrome prior to 117.0.5938.62 allowed a remote attacker to spoof security UI via a crafted HTML page. (Chromium security severity: Low) Important CVE-2023-4908 cpe:/o:opensuse:leap:15.5 openSUSE Leap 15.5 Inappropriate implementation in Interstitials in Google Chrome prior to 117.0.5938.62 allowed a remote attacker to obfuscate security UI via a crafted HTML page. (Chromium security severity: Low) Important CVE-2023-4909 cpe:/o:opensuse:leap:15.5 openSUSE Leap 15.5 A use-after-free vulnerability in the Linux kernel's net/sched: sch_qfq component can be exploited to achieve local privilege escalation. When the plug qdisc is used as a class of the qfq qdisc, sending network packets triggers use-after-free in qfq_dequeue() due to the incorrect .peek handler of sch_plug and lack of error checking in agg_dequeue(). We recommend upgrading past commit 8fc134fee27f2263988ae38920bc03da416b03d8. Important CVE-2023-4921 SUSE bug 1215275 SUSE bug 1215300 cpe:/o:opensuse:leap:15.5 openSUSE Leap 15.5 A compromised content process could have provided malicious data to `FilterNodeD2D1` resulting in an out-of-bounds write, leading to a potentially exploitable crash in a privileged process. *This bug only affects Firefox on Windows. Other operating systems are unaffected.* This vulnerability affects Firefox < 118, Firefox ESR < 115.3, and Thunderbird < 115.3. Critical CVE-2023-5168 cpe:/o:opensuse:leap:15.5 openSUSE Leap 15.5 A compromised content process could have provided malicious data in a `PathRecording` resulting in an out-of-bounds write, leading to a potentially exploitable crash in a privileged process. This vulnerability affects Firefox < 118, Firefox ESR < 115.3, and Thunderbird < 115.3. Critical CVE-2023-5169 cpe:/o:opensuse:leap:15.5 openSUSE Leap 15.5 During Ion compilation, a Garbage Collection could have resulted in a use-after-free condition, allowing an attacker to write two NUL bytes, and cause a potentially exploitable crash. This vulnerability affects Firefox < 118, Firefox ESR < 115.3, and Thunderbird < 115.3. Critical CVE-2023-5171 cpe:/o:opensuse:leap:15.5 openSUSE Leap 15.5 If Windows failed to duplicate a handle during process creation, the sandbox code may have inadvertently freed a pointer twice, resulting in a use-after-free and a potentially exploitable crash. *This bug only affects Firefox on Windows when run in non-standard configurations (such as using `runas`). Other operating systems are unaffected.* This vulnerability affects Firefox < 118, Firefox ESR < 115.3, and Thunderbird < 115.3. Critical CVE-2023-5174 cpe:/o:opensuse:leap:15.5 openSUSE Leap 15.5 Memory safety bugs present in Firefox 117, Firefox ESR 115.2, and Thunderbird 115.2. Some of these bugs showed evidence of memory corruption and we presume that with enough effort some of these could have been exploited to run arbitrary code. This vulnerability affects Firefox < 118, Firefox ESR < 115.3, and Thunderbird < 115.3. Critical CVE-2023-5176 cpe:/o:opensuse:leap:15.5 openSUSE Leap 15.5 openSUSE Leap 15.5 NonFree Use after free in Passwords in Google Chrome prior to 117.0.5938.132 allowed a remote attacker who convinced a user to engage in specific UI interaction to potentially exploit heap corruption via crafted UI interaction. (Chromium security severity: High) Important CVE-2023-5186 SUSE bug 1215776 cpe:/o:opensuse:leap:15.5 openSUSE Leap 15.5 openSUSE Leap 15.5 NonFree Use after free in Extensions in Google Chrome prior to 117.0.5938.132 allowed an attacker who convinced a user to install a malicious extension to potentially exploit heap corruption via a crafted HTML page. (Chromium security severity: High) Important CVE-2023-5187 SUSE bug 1215776 cpe:/o:opensuse:leap:15.5 openSUSE Leap 15.5 openSUSE Leap 15.5 NonFree Heap buffer overflow in vp8 encoding in libvpx in Google Chrome prior to 117.0.5938.132 and libvpx 1.13.1 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page. (Chromium security severity: High) Important CVE-2023-5217 SUSE bug 1215776 SUSE bug 1215778 SUSE bug 1215814 cpe:/o:opensuse:leap:15.5 openSUSE Leap 15.5 Use after free in Site Isolation in Google Chrome prior to 118.0.5993.70 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page. (Chromium security severity: Critical) Important CVE-2023-5218 SUSE bug 1216111 cpe:/o:opensuse:leap:15.5 openSUSE Leap 15.5 ** RESERVED ** This candidate has been reserved by an organization or individual that will use it when announcing a new security problem. When the candidate has been publicized, the details for this candidate will be provided. Moderate CVE-2023-5341 SUSE bug 1215939 cpe:/o:opensuse:leap:15.5 openSUSE Leap 15.5 A use-after-free vulnerability in the Linux kernel's fs/smb/client component can be exploited to achieve local privilege escalation. In case of an error in smb3_fs_context_parse_param, ctx->password was freed but the field was not set to NULL which could lead to double free. We recommend upgrading past commit e6e43b8aa7cd3c3af686caf0c2e11819a886d705. Moderate CVE-2023-5345 SUSE bug 1215899 SUSE bug 1215971 cpe:/o:opensuse:leap:15.5 openSUSE Leap 15.5 Type confusion in V8 in Google Chrome prior to 117.0.5938.149 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page. (Chromium security severity: High) Important CVE-2023-5346 SUSE bug 1215924 cpe:/o:opensuse:leap:15.5 openSUSE Leap 15.5 RTPS dissector memory leak in Wireshark 4.0.0 to 4.0.8 and 3.6.0 to 3.6.16 allows denial of service via packet injection or crafted capture file Low CVE-2023-5371 SUSE bug 1215959 cpe:/o:opensuse:leap:15.5 openSUSE Leap 15.5 Use after free in Cast in Google Chrome prior to 118.0.5993.70 allowed a remote attacker who had compromised the renderer process to potentially exploit heap corruption via a crafted HTML page. (Chromium security severity: Low) Important CVE-2023-5473 SUSE bug 1216111 cpe:/o:opensuse:leap:15.5 openSUSE Leap 15.5 Heap buffer overflow in PDF in Google Chrome prior to 118.0.5993.70 allowed a remote attacker who convinced a user to engage in specific user interactions to potentially exploit heap corruption via a crafted PDF file. (Chromium security severity: Medium) Important CVE-2023-5474 SUSE bug 1216111 cpe:/o:opensuse:leap:15.5 openSUSE Leap 15.5 Inappropriate implementation in DevTools in Google Chrome prior to 118.0.5993.70 allowed an attacker who convinced a user to install a malicious extension to bypass discretionary access control via a crafted Chrome Extension. (Chromium security severity: Medium) Important CVE-2023-5475 SUSE bug 1216111 cpe:/o:opensuse:leap:15.5 openSUSE Leap 15.5 Use after free in Blink History in Google Chrome prior to 118.0.5993.70 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page. (Chromium security severity: Medium) Important CVE-2023-5476 SUSE bug 1216111 cpe:/o:opensuse:leap:15.5 openSUSE Leap 15.5 Inappropriate implementation in Installer in Google Chrome prior to 118.0.5993.70 allowed a local attacker to bypass discretionary access control via a crafted command. (Chromium security severity: Low) Important CVE-2023-5477 SUSE bug 1216111 cpe:/o:opensuse:leap:15.5 openSUSE Leap 15.5 Inappropriate implementation in Autofill in Google Chrome prior to 118.0.5993.70 allowed a remote attacker to leak cross-origin data via a crafted HTML page. (Chromium security severity: Low) Important CVE-2023-5478 SUSE bug 1216111 cpe:/o:opensuse:leap:15.5 openSUSE Leap 15.5 Inappropriate implementation in Extensions API in Google Chrome prior to 118.0.5993.70 allowed an attacker who convinced a user to install a malicious extension to bypass an enterprise policy via a crafted HTML page. (Chromium security severity: Medium) Important CVE-2023-5479 SUSE bug 1216111 cpe:/o:opensuse:leap:15.5 openSUSE Leap 15.5 Inappropriate implementation in Downloads in Google Chrome prior to 118.0.5993.70 allowed a remote attacker to spoof security UI via a crafted HTML page. (Chromium security severity: Medium) Important CVE-2023-5481 SUSE bug 1216111 cpe:/o:opensuse:leap:15.5 openSUSE Leap 15.5 Inappropriate implementation in Intents in Google Chrome prior to 118.0.5993.70 allowed a remote attacker to bypass content security policy via a crafted HTML page. (Chromium security severity: Medium) Important CVE-2023-5483 SUSE bug 1216111 cpe:/o:opensuse:leap:15.5 openSUSE Leap 15.5 Inappropriate implementation in Navigation in Google Chrome prior to 118.0.5993.70 allowed a remote attacker to spoof security UI via a crafted HTML page. (Chromium security severity: Medium) Important CVE-2023-5484 SUSE bug 1216111 cpe:/o:opensuse:leap:15.5 openSUSE Leap 15.5 Inappropriate implementation in Autofill in Google Chrome prior to 118.0.5993.70 allowed a remote attacker to bypass autofill restrictions via a crafted HTML page. (Chromium security severity: Low) Important CVE-2023-5485 SUSE bug 1216111 cpe:/o:opensuse:leap:15.5 openSUSE Leap 15.5 Inappropriate implementation in Input in Google Chrome prior to 118.0.5993.70 allowed a remote attacker to spoof security UI via a crafted HTML page. (Chromium security severity: Low) Important CVE-2023-5486 SUSE bug 1216111 cpe:/o:opensuse:leap:15.5 openSUSE Leap 15.5 Inappropriate implementation in Fullscreen in Google Chrome prior to 118.0.5993.70 allowed an attacker who convinced a user to install a malicious extension to bypass navigation restrictions via a crafted Chrome Extension. (Chromium security severity: Medium) Important CVE-2023-5487 SUSE bug 1216111 cpe:/o:opensuse:leap:15.5