- 000release-packages:SUSE-MicroOS-release
-
n/a
- aaa_base
-
- Add patch git-51-fbf7ee9dc9cd970532a54eed6472d7f3b0e7f431.patch
* If a user switches the login shell respect the already set
PATH environment (bsc#1235481)
- add patch aaa_base-rc.status.patch (bsc#1236033)
(no git, file is gone in factory/tumbleweed)
update detection for systemd in rc.status, mountpoint for
cgroup changed with cgroup2, so just check if pid 1 is systemd
- ca-certificates-mozilla
-
- revert the distrusted certs for now. originally these only
distrust "new issued" certs starting after a certain date,
while old certs should still work. (bsc#1240343)
- remove-distrusted.patch: removed
- cloud-netconfig
-
- Update to version 1.15
+ Add support for creating IPv6 default route in GCE (bsc#1240869)
+ Minor fix when looking up IPv6 default route
- containerd
-
- Update to containerd v1.7.27. Upstream release notes:
<https://github.com/containerd/containerd/releases/tag/v1.7.27>
bsc#1239749 CVE-2024-40635
- Rebase patches:
* 0001-BUILD-SLE12-revert-btrfs-depend-on-kernel-UAPI-inste.patch
- Update to containerd v1.7.26. Upstream release notes:
<https://github.com/containerd/containerd/releases/tag/v1.7.26>
- Rebase patches:
* 0001-BUILD-SLE12-revert-btrfs-depend-on-kernel-UAPI-inste.patch
- Update to containerd v1.7.25. Upstream release notes:
<https://github.com/containerd/containerd/releases/tag/v1.7.25>
<https://github.com/containerd/containerd/releases/tag/v1.7.24>
- Rebase patches:
* 0001-BUILD-SLE12-revert-btrfs-depend-on-kernel-UAPI-inste.patch
- glib2
-
- Add glib2-CVE-2025-4373.patch: carefully handle gssize parameters
(bsc#1242844 CVE-2025-4373 glgo#GNOME/glib#3677).
- Add glib2-CVE-2025-3360.patch:
Backport 8d60d7dc from upstream, Fix integer overflow when
parsing very long ISO8601 inputs. This will only happen with
invalid (or maliciously invalid) potential ISO8601 strings,
but `g_date_time_new_from_iso8601()` needs to be robust against
that.
(CVE-2025-3360, bsc#1240897)
- glibc
-
- static-setuid-ld-library-path.patch: elf: Ignore LD_LIBRARY_PATH and
debug env var for setuid for static (CVE-2025-4802, bsc#1243317)
- pthread-wakeup.patch: pthreads NPTL: lost wakeup fix 2 (bsc#1234128, BZ
[#25847])
- hwinfo
-
- merge gh#openSUSE/hwinfo#156
- fix network card detection on aarch64 (bsc#1240648)
- 21.88
- ignition
-
- Add CVE-2025-22868.patch
* Fixes [bsc#1239192]
- iputils
-
- Fix bsc#1243284 - ping on s390x prints invalid ttl
* Add iputils-invalid-ttl-s390x.patch
* Fix ipv4 ttl value when using SOCK_DGRAM on big endian systems
- Security fix [bsc#1242300, CVE-2025-47268]
* integer overflow in RTT calculation can lead to undefined behavior
* Add iputils-CVE-2025-47268.patch
- kbd
-
- Don't search for resources in the current directory. It can cause
unwanted side effects or even infinite loop (bsc#1237230,
kbd-ignore-working-directory-1.patch,
kbd-ignore-working-directory-2.patch,
kbd-ignore-working-directory-3.patch).
- kernel-default
-
- ceph: avoid putting the realm twice when decoding snaps fails (CVE-2022-49770 bsc#1242597).
- commit 8f8ad66
- Update
patches.suse/0030-dm-ioctl-fix-misbehavior-if-list_versions-races-with-module-loading.patch
(git-fixes CVE-2022-49771 bsc#1242686).
- Update
patches.suse/ALSA-hda-fix-potential-memleak-in-add_widget_node.patch
(git-fixes CVE-2022-49835 bsc#1242385).
- Update
patches.suse/ALSA-usb-audio-Drop-snd_BUG_ON-from-snd_usbmidi_outp.patch
(git-fixes CVE-2022-49772 bsc#1242147).
- Update
patches.suse/ASoC-core-Fix-use-after-free-in-snd_soc_exit.patch
(git-fixes CVE-2022-49842 bsc#1242484).
- Update
patches.suse/Input-i8042-fix-leaking-of-platform-device-on-module.patch
(git-fixes CVE-2022-49777 bsc#1242232).
- Update
patches.suse/Input-iforce-invert-valid-length-check-when-fetching.patch
(git-fixes CVE-2022-49790 bsc#1242387).
- Update
patches.suse/ata-libata-transport-fix-double-ata_host_put-in-ata_.patch
(git-fixes CVE-2022-49826 bsc#1242549).
- Update
patches.suse/ata-libata-transport-fix-error-handling-in-ata_tdev_.patch
(git-fixes CVE-2022-49823 bsc#1242545).
- Update
patches.suse/ata-libata-transport-fix-error-handling-in-ata_tlink.patch
(git-fixes CVE-2022-49824 bsc#1242547).
- Update
patches.suse/ata-libata-transport-fix-error-handling-in-ata_tport.patch
(git-fixes CVE-2022-49825 bsc#1242548).
- Update
patches.suse/capabilities-fix-undefined-behavior-in-bit-shift-for.patch
(git-fixes CVE-2022-49870 bsc#1242551).
- Update
patches.suse/ceph-avoid-putting-the-realm-twice-when-decoding-snaps-fails.patch
(bsc#1207198 CVE-2022-49770 bsc#1242597).
- Update
patches.suse/cifs-fix-use-after-free-bug-in-refresh_cache_worker-.patch
(bsc#1213476 CVE-2023-53052 bsc#1242749).
- Update
patches.suse/dmaengine-mv_xor_v2-Fix-a-resource-leak-in-mv_xor_v2.patch
(git-fixes CVE-2022-49861 bsc#1242580).
- Update
patches.suse/drm-Fix-potential-null-ptr-deref-in-drm_vblank_destr.patch
(git-fixes CVE-2022-49827 bsc#1242689).
- Update
patches.suse/drm-drv-Fix-potential-memory-leak-in-drm_dev_init.patch
(git-fixes CVE-2022-49830 bsc#1242150).
- Update
patches.suse/ext4-fix-BUG_ON-when-directory-entry-has-invalid-rec.patch
(bsc#1206886 CVE-2022-49879 bsc#1242733).
- Update
patches.suse/ext4-fix-warning-in-ext4_da_release_space.patch
(bsc#1206887 CVE-2022-49880 bsc#1242734).
- Update
patches.suse/ftrace-Fix-null-pointer-dereference-in-ftrace_add_mod.patch
(git-fixes CVE-2022-49802 bsc#1242270).
- Update
patches.suse/ftrace-Fix-use-after-free-for-dynamic-ftrace_ops.patch
(git-fixes CVE-2022-49892 bsc#1242449).
- Update patches.suse/ibmvnic-Free-rwi-on-reset-success.patch
(bsc#1184350 ltc#191533 git-fixes CVE-2022-49906 bsc#1242464).
- Update
patches.suse/iio-adc-at91_adc-fix-possible-memory-leak-in-at91_ad.patch
(git-fixes CVE-2022-49794 bsc#1242392).
- Update
patches.suse/iio-trigger-sysfs-fix-possible-memory-leak-in-iio_sy.patch
(git-fixes CVE-2022-49793 bsc#1242391).
- Update
patches.suse/mISDN-fix-misuse-of-put_device-in-mISDN_register_dev.patch
(git-fixes CVE-2022-49818 bsc#1242527).
- Update
patches.suse/mISDN-fix-possible-memory-leak-in-mISDN_dsp_element_.patch
(git-fixes CVE-2022-49821 bsc#1242542).
- Update
patches.suse/mISDN-fix-possible-memory-leak-in-mISDN_register_dev.patch
(git-fixes CVE-2022-49915 bsc#1242409).
- Update
patches.suse/media-meson-vdec-fix-possible-refcount-leak-in-vdec_.patch
(git-fixes CVE-2022-49887 bsc#1242736).
- Update
patches.suse/misc-vmw_vmci-fix-an-infoleak-in-vmci_host_do_receiv.patch
(git-fixes CVE-2022-49788 bsc#1242353).
- Update
patches.suse/mmc-sdhci-pci-Fix-possible-memory-leak-caused-by-mis.patch
(git-fixes CVE-2022-49787 bsc#1242352).
- Update
patches.suse/net-x25-Fix-skb-leak-in-x25_lapb_receive_frame.patch
(git-fixes CVE-2022-49809 bsc#1242402).
- Update
patches.suse/nfc-nfcmrvl-Fix-potential-memory-leak-in-nfcmrvl_i2c.patch
(git-fixes CVE-2022-49922 bsc#1242378).
- Update
patches.suse/nfs4-Fix-kmemleak-when-allocate-slot-failed.patch
(git-fixes CVE-2022-49927 bsc#1242416).
- Update
patches.suse/pinctrl-devicetree-fix-null-pointer-dereferencing-in.patch
(git-fixes CVE-2022-49832 bsc#1242154).
- Update
patches.suse/ring-buffer-Check-for-NULL-cpu_buffer-in-ring_buffer_wake_waiters.patch
(git-fixes CVE-2022-49889 bsc#1242455).
- Update
patches.suse/scsi-scsi_transport_sas-Fix-error-handling-in-sas_phy_add.patch
(git-fixes CVE-2022-49839 bsc#1242443).
- Update
patches.suse/serial-imx-Add-missing-.thaw_noirq-hook.patch
(git-fixes CVE-2022-49841 bsc#1242473).
- Update
patches.suse/siox-fix-possible-memory-leak-in-siox_device_add.patch
(git-fixes CVE-2022-49836 bsc#1242355).
- Update
patches.suse/tracing-Fix-wild-memory-access-in-register_synth_event.patch
(git-fixes CVE-2022-49799 bsc#1242264).
- Update
patches.suse/udf-Fix-a-slab-out-of-bounds-write-bug-in-udf_find_e.patch
(bsc#1206649 CVE-2022-49846 bsc#1242716).
- Update
patches.suse/wifi-cfg80211-fix-memory-leak-in-query_regdb_file.patch
(git-fixes CVE-2022-49881 bsc#1242481).
- commit 4772a1c
- Update
patches.suse/Bluetooth-L2CAP-Fix-use-after-free-caused-by-l2cap_r.patch
(CVE-2022-3564 bsc#1206073 CVE-2022-49910 bsc#1242452).
- Update
patches.suse/net_sched-keep-alloc_hash-updated-after-hash-allocat.patch
(bsc#1154353 CVE-2020-36791 bsc#1242835).
- Update
patches.suse/nfc-st-nci-Fix-use-after-free-bug-in-ndlc_remove-due.patch
(git-fixes bsc#1210337 CVE-2023-1990 CVE-2023-53106
bsc#1242215).
- Update patches.suse/nvmet-fix-a-memory-leak.patch (git-fixes
CVE-2020-36790 bsc#1242145).
- commit ce43427
- Remove debug flavor (bsc#1243919).
This is only released in Leap, and we don't have Leap 15.2 anymore.
- Remove debug flavor (bsc#1243919).
This is only released in Leap, and we don't have Leap 15.3 anymore.
- commit 2d47ad5
- kABI workaround struct rcu_head and ax25_ptr (CVE-2025-21812
bsc#1238471).
- commit f3498ec
- ax25: rcu protect dev->ax25_ptr (CVE-2025-21812 bsc#1238471).
- Refresh patches.kabi/net-ax25_dev-kabi-workaround.patch.
- commit 23e351d
- devm-helpers: Add resource managed version of work init (bsc#1242745)
- commit cbce7ab
- net: make sock_inuse_add() available (CVE-2024-53168
bsc#1234887).
- commit 79936a6
- sunrpc: fix one UAF issue caused by sunrpc kernel tcp socket
(CVE-2024-53168 bsc#1234887).
- commit 734596d
- HID: intel-ish-hid: ipc: Fix dev_err usage with uninitialized dev->devc (bsc#1242745)
- commit eeebab3
- HID: intel-ish-hid: ipc: Fix potential use-after-free in work function (CVE-2023-53039 bsc#1242745)
- commit f350efe
- workqueue: Add resource managed version of delayed work init (bsc#1242745)
- commit 6d329e6
- mtd: phram: Add the kernel lock down check (bsc#1232649).
- commit 76f7568
- Refresh
patches.suse/ACPI-processor-idle-return-an-error-if-both-P_LVL-2-.patch.
The patch has been merged upstream, move it to the sorted section.
- commit 19d2cfa
- nfsd: make sure exp active before svc_export_show
(CVE-2024-56558 bsc#1235100).
- commit 6a6ffed
- scripts/python/git_sort/git_sort.yaml: Add 'cxl/next'
Add 'cxl/next' tree for git sort.
- commit 623f07a
- gfs2: Check sb_bsize_shift after reading superblock (bsc#1242440
CVE-2022-49769).
- gfs2: Fix invalid block size message (bsc#1242440
CVE-2022-49769).
- gfs2: add validation checks for size of superblock (bsc#1242440
CVE-2022-49769).
- commit 3b15a7d
- tcp: cdg: allow tcp_cdg_release() to be called multiple times (CVE-2022-49775 bsc#1242245)
- commit b8f5dff
- scripts/common-functions: lower curl's connection timeout
Set it to 2 seconds. Either it can reach the server or not...
ftp.suse.com is currently unreachable and it takes minutes to have a
reply from check-kernel-fixes.
- commit 4d58d2c
- ocfs2: fix the issue with discontiguous allocation in the
global_bitmap (git-fixes).
- commit 20ed8e7
- scripts/common-functions: fix sha_to_patch_in_branch
sha_to_patch_in_branch f13abc1e8e1a3b7455511c4e122750127f6bc9b0 origin/SLE15-SP6
returns
origin/SLE15-SP6:patches.suse/watch_queue-fix-pipe-accounting-mismatch.patch
which is obviously incorrect. We need to trim the branch name before
filtering.
- commit 62da488
- scripts/check-kernel-fix: wait for git-fixes background run properly
we are printing potential follow up fixes only if there is an action
required which is an intendeded behavior. We do want to wait for the run
to finish regardless of the final outcome though as we do not want the
git-fixes to outlive the script runtime. Theoretically we could just kill
git_fixes_pid but this could get more tricky if the process terminated
and the pid got recycled.
- commit abc4fc4
- scripts/check-kernel-fix: print ACTION NEEDED at the end
ACTION NEEDED has been printed as soon as it is clear there is an action
required for a certain branch. This works well for regular run but it
generates a confusing output for verbose mode
Link: https://git.kernel.org/linus/f9a9f43a62a04ec3183fb0da9226c7706eed0115
SL-16.0: nope_commit_in_base
SLE11-SP4-LTSS: nope_unaffected
SLE12-SP3-TD: nope_unaffected
ACTION NEEDED!
SLE12-SP5: MANUAL: backport f9a9f43a62a04ec3183fb0da9226c7706eed0115 (Fixes v4.12)
fix this by printing this at the very end after all the processing is
done.
- commit f47088f
- scripts/check-kernel-fix: do a full check in verbose mode
we are skipping evaluation of ineligible (based on CVSS scoring) branches
to save runtime because a common case is a low score CVE that is not
eligible to any LTSS branches. Security team would like to know whether
as specific branch is affected even in those case so let's change the
implementation and do the full evaluation even if a branch is not
eligible based on the scoring.
With the current implementation we are getting
./scripts/check-kernel-fix -v CVE-2022-49320
Security fix for CVE-2022-49320 bsc#1238394 with CVSS 5.5
= f9a9f43a62a0 ("dmaengine: zynqmp_dma: In struct zynqmp_dma_chan fix desc_size data type") merged v5.19-rc1~100^2~37
Fixes: b0cc417c1637 ("dmaengine: Add Xilinx zynqmp dma engine driver support") merged v4.8-rc1~117^2~7^2~2
Experts candidates: tiwai@suse.com (36) subsystem/role="DRIVERS"
Link: https://git.kernel.org/linus/f9a9f43a62a04ec3183fb0da9226c7706eed0115
SL-16.0: nope_commit_in_base
SLE11-SP4-LTSS: nope_cvss
SLE12-SP3-TD: nope_unaffected
ACTION NEEDED!
SLE12-SP5: MANUAL: backport f9a9f43a62a04ec3183fb0da9226c7706eed0115 (Fixes v4.12)
SLE15-SP6: nope_commit_in_base
SLE15-SP7-GA: nope_cvss
cve/linux-5.14-LTSS: ok_reference_present
cve/linux-5.3-LTSS: nope_cvss
SUSE-2024: nope_commit_in_base
SLE15-SP6-RT: nope_commit_in_base
SLE15-SP6-COCO: nope_commit_in_base
SLE15-SP6-AZURE: nope_commit_in_base
SLE15-SP7: nope_commit_in_base
SLE15-SP2-LTSS: nope_cvss
SLE15-SP3-LTSS: ok_reference_present
SUSE-2024-RT: nope_commit_in_base
SLE15-SP7-RT: nope_commit_in_base
SLE15-SP7-COCO: nope_commit_in_base
SLE15-SP7-AZURE: nope_commit_in_base
With the updated one we are getting a more specific answer for
all branches whether they are eligible or not.
./scripts/check-kernel-fix -v CVE-2022-49320
Security fix for CVE-2022-49320 bsc#1238394 with CVSS 5.5
= f9a9f43a62a0 ("dmaengine: zynqmp_dma: In struct zynqmp_dma_chan fix desc_size data type") merged v5.19-rc1~100^2~37
Fixes: b0cc417c1637 ("dmaengine: Add Xilinx zynqmp dma engine driver support") merged v4.8-rc1~117^2~7^2~2
Experts candidates: tiwai@suse.com (36) subsystem/role="DRIVERS"
Link: https://git.kernel.org/linus/f9a9f43a62a04ec3183fb0da9226c7706eed0115
SL-16.0: nope_commit_in_base
SLE11-SP4-LTSS: nope_unaffected
SLE12-SP3-TD: nope_unaffected
ACTION NEEDED!
SLE12-SP5: MANUAL: backport f9a9f43a62a04ec3183fb0da9226c7706eed0115 (Fixes v4.12)
SLE15-SP6: nope_commit_in_base
SLE15-SP7-GA: nope_commit_in_base
cve/linux-5.14-LTSS: ok_reference_present
cve/linux-5.3-LTSS: missing_commit_nope_cvss
SLE12-SP5-RT: MANUAL: backport f9a9f43a62a04ec3183fb0da9226c7706eed0115 (Fixes v4.12)
WW CONFIG_XILINX_ZYNQMP_DMA not enabled.
SUSE-2024: nope_commit_in_base
SLE15-SP6-RT: nope_commit_in_base
SLE15-SP6-COCO: nope_commit_in_base
SLE15-SP6-AZURE: nope_commit_in_base
SLE15-SP7: nope_commit_in_base
SLE15-SP4-LTSS: ok_reference_present
SLE15-SP5-LTSS: ok_reference_present
SLE15-SP2-LTSS: missing_commit_nope_cvss
SLE15-SP3-LTSS: ok_reference_present
SUSE-2024-RT: nope_commit_in_base
SLE15-SP7-RT: nope_commit_in_base
SLE15-SP7-COCO: nope_commit_in_base
SLE15-SP7-AZURE: nope_commit_in_base
SLE15-SP4-RT-LTSS: ok_reference_present
SLE15-SP5-RT-LTSS: ok_reference_present
SLE15-SP3-RT-LTSS: ok_reference_present
- commit 61a6ac4
- proc: fix UAF in proc_get_inode() (bsc#1240802 CVE-2025-21999).
- commit 7ed5033
- net: openvswitch: fix nested key length validation in the set()
action (CVE-2025-37789 bsc#1242762).
- commit bacda5a
- scripts/check-kernel-fix: recognized reserved but not published yet CVEs
We have seen a large pile of CVEs that are not released yet.
c-k-f currently says
$ ./scripts/check-kernel-fix CVE-2025-37846
Can't find sha in upstream: CVE-2025-37846.
Let's check whether the said CVE is reserved and say so to make the fact
$ ./scripts/check-kernel-fix CVE-2025-37846
CVE-2025-37846 is reserved but not fully published
- commit 539b381
- scsi: zfcp: Fix double free of FSF request when qdio send fails
(git-fixes CVE-2022-49789 bsc#1242366).
- commit aeb3b69
- netfilter: conntrack: revisit the gc initial rescheduling bias
(CVE-2022-49110 bsc#1237981).
- commit 0adef4e
- netfilter: conntrack: fix the gc rescheduling delay
(CVE-2022-49110 bsc#1237981).
- commit 4e5bc55
- netfilter: conntrack: revisit gc autotuning (CVE-2022-49110
bsc#1237981).
- commit feb04b1
- Bluetooth: fix null ptr deref on hci_sync_conn_complete_evt
(bsc#1238032 CVE-2022-49139).
- commit 2e1b8fc
- 9p/trans_fd: always use O_NONBLOCK read/write (CVE-2022-49767 bsc#1242493).
- commit c90c5e2
- Update
patches.suse/can-dev-can_get_echo_skb-prevent-call-to-kfree_skb-i.patch
(git-fixes CVE-2020-36789 bsc#1241408).
- Update
patches.suse/can-dev-can_restart-fix-use-after-free-bug.patch
(git-fixes CVE-2021-47668 bsc#1241404).
- Update patches.suse/can-peak_usb-fix-use-after-free-bugs.patch
(git-fixes CVE-2021-47670 bsc#1241407).
- Update
patches.suse/can-vxcan-vxcan_xmit-fix-use-after-free-bug.patch
(git-fixes CVE-2021-47669 bsc#1241405).
- Update patches.suse/tipc-fix-NULL-deref-in-cleanup_bearer.patch
(CVE-2024-56642 bsc#1235433 CVE-2024-56661 bsc#1234931).
- Update
patches.suse/tipc-wait-and-exit-until-all-work-queues-are-done.patch
(CVE-2024-56642 bsc#1235433 CVE-2021-47163 bsc#1221980).
- commit 8b6970a
- Bluetooth: Fix use after free in hci_send_acl (bsc#1237984
CVE-2022-49111).
- commit 5208441
- Revert "exec: fix the racy usage of fs_struct->in_exec (CVE-2025-22029"
This reverts commit 13cb02f5b5afeaca3c7fe909ce2058871394531e.
This turned out to be not an issue. See https://bugzilla.suse.com/show_bug.cgi?id=1241378#c4
- commit 9509011
- exec: fix the racy usage of fs_struct->in_exec (CVE-2025-22029
bsc#1241378).
- commit 13cb02f
- scripts/common-functions: drop is_upstream_sha
is_upstream_sha is a misnomer because it only guarantees that the given
commit is in the referenced repository. It doesn't really check whether
it is reachable from a particular remote or branch. This is not a
problem for its only existing user because Fixes tags are referring to
upstream commits but the naming is misleading and more importantly we do
have a proper function for the purpose so use sha_in_upstream instead.
- commit 5b3489d
- memstick: rtsx_usb_ms: Fix slab-use-after-free in
rtsx_usb_ms_drv_remove (bsc#1241280 CVE-2025-22020).
- commit 0218bc3
- scripts/check-kernel-fix: warn about all invalid shas for CVE
There might be stable tree specific CVEs (e.g. CVE-2025-40364) which are
referring to non-upstream (i.e. stable tree) commits. If we encounter
such a CVE we simply bail out because we do not expect that a CVE would
be mixing stable specific and upstream commits. If we ever have a case
like that it would be good to learn about the fact and find out more
about the reasoning. Therefore turn the hard failure into a warning and
examine all commit associated with the CVE.
- commit 6fc5b03
- scripts/check-kernel-fix: make branch_file local
- scripts/common-functions: make branch_file local
it doesn't have a global scope
- commit e5e85ee
- scripts/check-kernel-fix: check for non upstream sha coming from VULN_GIT
CVE-2025-40364 is refering to a stable specific vulnerability. We
currently choke on that
$ ./scripts/check-kernel-fix CVE-2025-40364
Security fix for CVE-2025-40364 bsc#1241637 with CVSS 6.1
fatal: bad object a94592ec30ff67dc36c424327f1e0a9ceeeb9bd3
fatal: bad object a94592ec30ff67dc36c424327f1e0a9ceeeb9bd3
= fatal: bad object a94592ec30ff67dc36c424327f1e0a9ceeeb9bd3
merged Could not get object for a94592ec30ff67dc36c424327f1e0a9ceeeb9bd3. Skipping.
No Fixes tag. Requires manual review for affected branches.
Experts candidates: subsystem/role=
Link: https://git.kernel.org/linus/a94592ec30ff67dc36c424327f1e0a9ceeeb9bd3
fatal: bad object a94592ec30ff67dc36c424327f1e0a9ceeeb9bd3
Be more defensive and bail out on non upstream commits before prossing
each sha for the CVE
$ ./scripts/check-kernel-fix CVE-2025-40364
Security fix for CVE-2025-40364 bsc#1241637 with CVSS 6.1
a94592ec30ff67dc36c424327f1e0a9ceeeb9bd3 is not an upstream commit
- commit a95b378
- scripts/common-functions: sha_get_upstream_git_fixes be more careful about vulnerable files
CVE.vulnerable file is not really designed for multi sha CVEs as it is
not really easy to tell which fix they correspond to. E.g.
$ cat CVE-2024-56705.vulnerable
a49d25364dfb9f8a64037488a39ab1f56c5fa419
ad85094b293e40e7a2f831b0311a389d952ebd5e
$ cat CVE-2024-56705.sha1
ed61c59139509f76d3592683c90dc3fdc6e23cd6
51b8dc5163d2ff2bf04019f8bf7e3bd0e75bb654
Our current implementation will print
= ed61c5913950 ("media: atomisp: Add check for rgby_data memory allocation failure") merged v6.13-rc1~149^2~15
Fixes: a49d25364dfb ("staging/atomisp: Add support for the Intel IPU v2") merged v4.12-rc1~84^2~796
= 51b8dc5163d2 ("media: staging: atomisp: Remove driver") merged v4.18-rc1~107^2~112
Fixes: a49d25364dfb ("staging/atomisp: Add support for the Intel IPU v2") merged v4.12-rc1~84^2~796
Fixes: ad85094b293e ("Revert "media: staging: atomisp: Remove driver"") merged v5.8-rc1~162^2~125
The output for ed61c5913950 is correct because the patch itself has
Fixes tag. For 51b8dc5163d2 there is none so we fallback to .vulnerable
file and it is quite clear that ad85094b293e cannot be breaker as it has
been merged much later. The whole situation is quite confused and
described in https://lore.kernel.org/all/2024122837-CVE-2024-56705-049b@gregkh/T/#m85050dadf9eef7608c25fe0108bee9dde056d557
Reduce the confusion and only use .vulnerable entries which are
ancestors of the sha so they are related from the development POV.
- commit c958796
- scripts/check-kernel-fix: implement multi sha CVEs handling
CVE-2024-56705 has two upstream commits referenced in
VULNS_GIT/cve/published/2024/CVE-2024-56705.sha1
Reasons for that are arguably dubious (see
https://lore.kernel.org/all/2024122837-CVE-2024-56705-049b@gregkh/T/#m85050dadf9eef7608c25fe0108bee9dde056d557)
but we need to be able to handle CVEs associated with several upstream
commits anyway.
Preparatory patches have made this quite easy. The general logic is
that we process and report each commit on its own. The final conclusion
is printed after all of them are processed
$ ./scripts/check-kernel-fix CVE-2024-56705
Security fix for CVE-2024-56705 bsc#1235568 with CVSS 4.7
= ed61c5913950 ("media: atomisp: Add check for rgby_data memory allocation failure") merged v6.13-rc1~149^2~15
Fixes: a49d25364dfb ("staging/atomisp: Add support for the Intel IPU v2") merged v4.12-rc1~84^2~796
Experts candidates: tiwai@suse.com (33) subsystem/role="DRIVERS"
Link: https://git.kernel.org/linus/ed61c59139509f76d3592683c90dc3fdc6e23cd6
= 51b8dc5163d2 ("media: staging: atomisp: Remove driver") merged v4.18-rc1~107^2~112
Fixes: a49d25364dfb ("staging/atomisp: Add support for the Intel IPU v2") merged v4.12-rc1~84^2~796
Fixes: ad85094b293e ("Revert "media: staging: atomisp: Remove driver"") merged v5.8-rc1~162^2~125
Experts candidates: tiwai@suse.com (33) subsystem/role="DRIVERS"
Link: https://git.kernel.org/linus/51b8dc5163d2ff2bf04019f8bf7e3bd0e75bb654
ACTION NEEDED!
SLE12-SP5: MANUAL: backport 51b8dc5163d2ff2bf04019f8bf7e3bd0e75bb654 (Fixes v4.12)
WW CONFIG_INTEL_ATOMISP not enabled.
WW CONFIG_VIDEO_ATOMISP not enabled.
All eligible branches have warnings. If they are correct then there is NO ACTION NEEDED for 51b8dc5163d2ff2bf04019f8bf7e3bd0e75bb654
Potential git-fixes for ed61c59139509f76d3592683c90dc3fdc6e23cd6 51b8dc5163d2ff2bf04019f8bf7e3bd0e75bb654
ad85094b293e Revert "media: staging: atomisp: Remove driver"
- commit bc601e2
- scripts/check-kernel-fix: simplify no fixes case
If there is no fixes tag then we cannot make an authoritative call for
affected branches. We are still trying to capture situation that no
branches might be actually affected e.g. because the code is not
compiled in. E.g.
36cef585e2a3 ("media: vimc: skip .s_stream() for stopped entities") merged v6.15-rc1~174^2~26
Fixes: adc589d2a208 ("media: vimc: Add vimc-streamer for stream control") merged v5.1-rc1~88^2~133
Security fix for CVE-2025-22028 bsc#1241362 with CVSS 5.5
Experts candidates: tiwai@suse.com (33) subsystem/role="MEDIA DRIVERS"
Link: https://git.kernel.org/linus/36cef585e2a31e4ddf33a004b0584a7a572246de
ACTION NEEDED!
SLE15-SP6: MANUAL: backport 36cef585e2a31e4ddf33a004b0584a7a572246de (Fixes v6.4)
WW CONFIG_VIDEO_VIMC not enabled.
All eligible branches have warnings. If they are correct then there is NO ACTION NEEDED
Potential git-fixes for 36cef585e2a31e4ddf33a004b0584a7a572246de
Nothing found
This works properly with the current code but it makes it harder to
add a support for multi sha cves because the number of eligible branches
tracking and gets more involved if we have a mixed bag of shas with and
without known breakers.
Therefore drop the heuristic and make multi sha tracking easier. That
means to track all shas without breakers in no_fixes_shas file.
Existence of the file triggers print_no_fixes_warning. Also collect
per sha "all eligible branches have warning" hint into a global warning
file.
- commit b24eae7
- scripts/common-functions: make cve2sha multi sha aware
- scripts/cve_tools/cve2metadata.sh: support multi sha CVEs
cve2sha relied on the VULN_GIT/scripts/cve_search but that is harder to
post process for multi sha CVEs so find and read the $CVE.sha1 file
directly.
make scipts/cve2metadata multi sha CVEs aware
$ scripts/cve_tools/cve2metadata.sh CVE-2024-56705
ed61c59139509f76d3592683c90dc3fdc6e23cd6 51b8dc5163d2ff2bf04019f8bf7e3bd0e75bb654 score:4.7 CVE-2024-56705 bsc#1235568
$ scripts/cve_tools/cve2metadata.sh ed61c59139509f76d3592683c90dc3fdc6e23cd6
ed61c59139509f76d3592683c90dc3fdc6e23cd6 51b8dc5163d2ff2bf04019f8bf7e3bd0e75bb654 score:4.7 CVE-2024-56705 bsc#1235568
$ scripts/cve_tools/cve2metadata.sh 51b8dc5163d2ff2bf04019f8bf7e3bd0e75bb654
ed61c59139509f76d3592683c90dc3fdc6e23cd6 51b8dc5163d2ff2bf04019f8bf7e3bd0e75bb654 score:4.7 CVE-2024-56705 bsc#1235568
- commit 4862a14
- scripts/check-kernel-fix: make the whole state handling sha specific
rename those functions to make the review easier. No function change is
intended here.
- commit 0fe862e
- scripts/check-kernel-fix: prepare for per sha runs
isolate sha and per CVE actions. Everything sha specific should live
in handle_single_sha now.
- commit 1477e41
- net: fix geneve_opt length integer overflow (CVE-2025-22055
bsc#1241371).
- commit 0f14398
- scripts/check-kernel-fix: move all the single sha processing into handle_single_sha
No functional change intended.
- commit 77cd38b
- scripts/check-kernel-fix: prepare for multi sha CVEs
c-k-f supports reverse mapping to a CVE when given a sha
./scripts/check-kernel-fix 5701875f9609
Security fix for CVE-2025-22121 bsc#1241593 with CVSS 5.5
5701875f9609 ("ext4: fix out-of-bound read in ext4_xattr_inode_dec_ref_all()") merged v6.15-rc1~145^2~16
Fixes: e50e5129f384 ("ext4: xattr-in-inode support") merged v4.13-rc1~85^2~45
[...]
unify both CVE and sha paths to store CVE shas to cve_shas so that
we are not mixing up sha used all over the place. In the next step
we will iterate over multiple shas if they are associated with a CVE.
- commit 270978f
- scripts/check-kernel-fix: print CVE info before sha
this is a preparatory work to allow a single CVE to refer to multiple
commits.
- commit fe66107
- net: atm: fix use after free in lec_send() (CVE-2025-22004
bsc#1240835).
- commit 1353737
- Update
patches.suse/RDMA-core-Fix-ib-block-iterator-counter-overflow.patch
(bsc#1207878 CVE-2023-53026 bsc#1240308).
- Update
patches.suse/netfilter-nft_payload-incorrect-arithmetics-when-fet.patch
(CVE-2023-0179 bsc#1207034 CVE-2023-53033 bsc#1240210).
- commit 518a2a0
- arm64: cacheinfo: Avoid out-of-bounds write to cacheinfo array (CVE-2025-21785 bsc#1238747)
- commit cc6f165
- vrf: use RCU protection in l3mdev_l3_out() (CVE-2025-21791
bsc#1238512).
- commit 73bdf83
- padata: avoid UAF for reorder_work (CVE-2025-21726 bsc#1238865).
- commit 6e401d3
- blk-throttle: Set BIO_THROTTLED when bio has been throttled
(CVE-2022-49465 bsc#1238919).
- commit 68c56a5
- gfs2: Always check inode size of inline inodes (bsc#1240207
CVE-2022-49739).
- gfs2: Cosmetic gfs2_dinode_{in,out} cleanup (bsc#1240207
CVE-2022-49739).
- gfs2: Fix I_NEW check in gfs2_dinode_in (bsc#1240207
CVE-2022-49739).
- gfs2: be careful with inode refresh (bsc#1240207
CVE-2022-49739).
- gfs2: removed unnecessary semicolon (bsc#1240207
CVE-2022-49739).
- commit 1c7252b
- Refresh
patches.suse/blk-throttle-Set-BIO_THROTTLED-when-bio-has-been-throttled.patch.
The original version had a back-port mistake that caused aregression.
- commit e202981
- tipc: fix NULL deref in cleanup_bearer() (CVE-2024-56642
bsc#1235433).
- tipc: Fix use-after-free of kernel socket in cleanup_bearer()
(CVE-2024-56642 bsc#1235433).
- tipc: wait and exit until all work queues are done
(CVE-2024-56642 bsc#1235433).
- commit c9c05aa
- mm/khugepaged: fix ->anon_vma race (CVE-2023-52935 bsc#1240276).
- commit 07d84da
- btrfs: send: use btrfs_file_extent_end() in send_write_or_clone() (bsc#1239969).
- commit 2102a1e
- Update
patches.suse/media-cx24116-prevent-overflows-on-SNR-calculus.patch
(CVE-2024-50290 bsc#1233479 bsc#1225742).
- Update
patches.suse/media-dvbdev-prevent-the-risk-of-out-of-memory-acces.patch
(CVE-2024-53063 bsc#1233557 bsc#1225742).
- commit 1299ffa
- Update
patches.suse/HID-betop-check-shape-of-output-reports.patch
(git-fixes bsc#1207186 CVE-2023-53015 bsc#1240288).
- Update
patches.suse/bpf-Fix-pointer-leak-due-to-insufficient-speculative.patch
(bsc#1231375 CVE-2023-53024 bsc#1240272).
- Update
patches.suse/netlink-prevent-potential-spectre-v1-gadgets.patch
(bsc#1209547 CVE-2017-5753 CVE-2023-53000 bsc#1240227).
- Update
patches.suse/scsi-iscsi_tcp-Fix-UAF-during-login-when-accessing-the-shost-ipaddress.patch
(bsc#1210647 CVE-2023-2162 CVE-2023-52974 bsc#1240213).
- Update
patches.suse/vc_screen-move-load-of-struct-vc_data-pointer-in-vcs.patch
(bsc#1213167 CVE-2023-3567 CVE-2023-52973 bsc#1240218).
- commit a1009ea
- can: hi311x: hi3110_can_ist(): fix potential use-after-free
(CVE-2024-56651 bsc#1235528).
- commit cb06313
- partitions: mac: fix handling of bogus partition table
(CVE-2025-21772 bsc#1238911).
- blk-throttle: Set BIO_THROTTLED when bio has been throttled
(CVE-2022-49465 bsc#1238919).
- scsi: target: tcmu: Fix possible page UAF (CVE-2022-49053
bsc#1237918).
- commit 3153466
- btrfs: send: fix invalid clone operation for file that got its size decreased (bsc#1239969).
- btrfs: send: allow cloning non-aligned extent if it ends at i_size (bsc#1239969).
- commit 2f86e19
- ACPI: processor: idle: Return an error if both P_LVL{2,3}
idle states are invalid (bsc#1237530).
- commit 427f536
- udp: fix race between close() and udp_abort() (CVE-2021-47248
bsc#1224867).
- commit fbfb628
- Update
patches.suse/0004-nvdimm-Fix-firmware-activation-deadlock-scenarios.patch
(git-fixes CVE-2022-49446 bsc#1238822).
- Update
patches.suse/0008-bcache-avoid-journal-no-space-deadlock-by-reserving-.patch
(git-fixes CVE-2022-49327 bsc#1238662).
- Update
patches.suse/0010-dm-raid-fix-accesses-beyond-end-of-raid-member-array.patch
(git-fixes CVE-2022-49674 bsc#1239041).
- Update
patches.suse/0017-dm-ioctl-prevent-potential-spectre-v1-gadget.patch
(git-fixes CVE-2022-49122 bsc#1237983).
- Update
patches.suse/0020-nbd-call-genl_unregister_family-first-in-nbd_cleanup.patch
(git-fixes CVE-2022-49295 bsc#1238707).
- Update
patches.suse/0021-nbd-fix-race-between-nbd_alloc_config-and-module-removal.patch
(git-fixes CVE-2022-49300 bsc#1238183).
- Update
patches.suse/0022-nbd-fix-io-hung-while-disconnecting-device.patch
(git-fixes CVE-2022-49297 bsc#1238469).
- Update
patches.suse/0024-block-don-t-delete-queue-kobject-before-its-children.patch
(git-fixes CVE-2022-49259 bsc#1238413).
- Update
patches.suse/0027-dm-integrity-fix-memory-corruption-when-tag_size-is-.patch
(git-fixes CVE-2022-49044 bsc#1237840).
- Update
patches.suse/0034-dm-mirror-log-round-up-region-bitmap-size-to-BITS_PE.patch
(git-fixes CVE-2022-49710 bsc#1238417).
- Update
patches.suse/ACPI-CPPC-Avoid-out-of-bounds-access-when-parsing-_C.patch
(git-fixes CVE-2022-49145 bsc#1238162).
- Update
patches.suse/ALSA-firewire-lib-fix-uninitialized-flag-for-AV-C-de.patch
(git-fixes CVE-2022-49248 bsc#1238284).
- Update
patches.suse/ALSA-oss-Fix-PCM-OSS-buffer-allocation-overflow.patch
(git-fixes CVE-2022-49292 bsc#1238625).
- Update
patches.suse/ALSA-pcm-Check-for-null-pointer-of-pointer-substream.patch
(git-fixes CVE-2022-49498 bsc#1238825).
- Update
patches.suse/ARM-davinci-da850-evm-Avoid-NULL-pointer-dereference.patch
(git-fixes CVE-2021-47631 bsc#1237718).
- Update
patches.suse/ASoC-atmel-Add-missing-of_node_put-in-at91sam9g20ek_.patch
(git-fixes CVE-2022-49243 bsc#1238337).
- Update
patches.suse/ASoC-codecs-wcd934x-Add-missing-of_node_put-in-wcd93.patch
(git-fixes CVE-2022-49239 bsc#1238334).
- Update
patches.suse/ASoC-mediatek-Fix-error-handling-in-mt8173_max98090_.patch
(git-fixes CVE-2022-49514 bsc#1238429).
- Update
patches.suse/ASoC-mediatek-Fix-missing-of_node_put-in-mt2701_wm89.patch
(git-fixes CVE-2022-49517 bsc#1237996).
- Update
patches.suse/ASoC-mxs-Fix-error-handling-in-mxs_sgtl5000_probe.patch
(git-fixes CVE-2022-49242 bsc#1238126).
- Update
patches.suse/ASoC-mxs-saif-Fix-refcount-leak-in-mxs_saif_probe.patch
(git-fixes CVE-2022-49482 bsc#1238543).
- Update
patches.suse/ASoC-rt5645-Fix-errorenous-cleanup-order.patch
(git-fixes CVE-2022-49493 bsc#1238939).
- Update
patches.suse/ASoC-soc-compress-prevent-the-potentially-use-of-nul.patch
(git-fixes CVE-2021-47650 bsc#1237742).
- Update
patches.suse/ASoC-ti-j721e-evm-Fix-refcount-leak-in-j721e_soc_pro.patch
(git-fixes CVE-2022-49473 bsc#1238135).
- Update
patches.suse/Bluetooth-Fix-use-after-free-in-hci_send_acl.patch
(git-fixes CVE-2022-49111 bsc#1237984).
- Update
patches.suse/Bluetooth-btmtksdio-Fix-kernel-oops-in-btmtksdio_int.patch
(git-fixes CVE-2022-49200 bsc#1237958).
- Update
patches.suse/Bluetooth-fix-dangling-sco_conn-and-use-after-free-i.patch
(git-fixes CVE-2022-49474 bsc#1238071).
- Update
patches.suse/Bluetooth-hci_qca-Use-del_timer_sync-before-freeing.patch
(git-fixes CVE-2022-49555 bsc#1238231).
- Update
patches.suse/HID-elan-Fix-potential-double-free-in-elan_input_con.patch
(git-fixes CVE-2022-49508 bsc#1237940).
- Update
patches.suse/Input-sparcspkr-fix-refcount-leak-in-bbc_beep_probe.patch
(git-fixes CVE-2022-49438 bsc#1238242).
- Update
patches.suse/KVM-VMX-Prevent-RSB-underflow-before-vmenter.patch
(bsc#1199657 CVE-2022-29900 CVE-2022-29901 CVE-2022-49610
bsc#1238952).
- Update
patches.suse/NFC-NULL-out-the-dev-rfkill-to-prevent-UAF.patch
(git-fixes CVE-2022-49505 bsc#1238615).
- Update
patches.suse/NFSD-prevent-integer-overflow-on-32-bit-systems.patch
(git-fixes CVE-2022-49279 bsc#1238655).
- Update
patches.suse/NFSD-prevent-underflow-in-nfssvc_decode_writeargs.patch
(git-fixes CVE-2022-49280 bsc#1238630).
- Update
patches.suse/NFSv4-Don-t-hold-the-layoutget-locks-across-multiple.patch
(git-fixes CVE-2022-49316 bsc#1238386).
- Update
patches.suse/PM-core-keep-irq-flags-in-device_pm_check_callbacks.patch
(git-fixes CVE-2022-49175 bsc#1238099).
- Update
patches.suse/PM-devfreq-rk3399_dmc-Disable-edev-on-remove.patch
(git-fixes CVE-2022-49460 bsc#1238892).
- Update
patches.suse/RDMA-cm-Fix-memory-leak-in-ib_cm_insert_listen.patch
(git-fixes CVE-2022-49671 bsc#1238823).
- Update
patches.suse/RDMA-hfi1-Fix-potential-integer-multiplication-overf.patch
(git-fixes CVE-2022-49404 bsc#1238430).
- Update
patches.suse/RDMA-hfi1-Fix-use-after-free-bug-for-mm-struct.patch
(bsc#1179878 CVE-2020-27835 CVE-2022-49076 bsc#1237738).
- Update
patches.suse/RDMA-mlx5-Fix-memory-leak-in-error-flow-for-subscrib.patch
(git-fixes CVE-2022-49206 bsc#1238343).
- Update
patches.suse/SUNRPC-Fix-the-svc_deferred_event-trace-class.patch
(git-fixes CVE-2022-49065 bsc#1237739).
- Update
patches.suse/USB-host-isp116x-check-return-value-after-calling-pl.patch
(git-fixes CVE-2022-49302 bsc#1238653).
- Update
patches.suse/ata-libata-core-fix-NULL-pointer-deref-in-ata_host_a.patch
(git-fixes CVE-2022-49731 bsc#1239071).
- Update
patches.suse/ata-sata_dwc_460ex-Fix-crash-due-to-OOB-write.patch
(git-fixes CVE-2022-49073 bsc#1237746).
- Update
patches.suse/ath10k-Fix-error-handling-in-ath10k_setup_msa_resour.patch
(git-fixes CVE-2022-49213 bsc#1238327).
- Update
patches.suse/ath9k_htc-fix-potential-out-of-bounds-access-with-in.patch
(git-fixes CVE-2022-49503 bsc#1238868).
- Update patches.suse/ath9k_htc-fix-uninit-value-bugs.patch
(git-fixes CVE-2022-49235 bsc#1238333).
- Update
patches.suse/bfq-Make-sure-bfqg-for-which-we-are-queueing-request.patch
(bsc#1197926 CVE-2022-49411 bsc#1238307).
- Update
patches.suse/blk-iolatency-Fix-inflight-count-imbalances-and-IO-h.patch
(bsc#1200825 CVE-2022-49394 bsc#1238712).
- Update
patches.suse/block-Fix-handling-of-offline-queues-in-blk_mq_alloc.patch
(bsc#1185762 CVE-2022-49720 bsc#1238281).
- Update
patches.suse/brcmfmac-pcie-Release-firmwares-in-the-brcmf_pcie_se.patch
(git-fixes CVE-2022-49263 bsc#1238267).
- Update
patches.suse/bus-fsl-mc-bus-fix-KASAN-use-after-free-in-fsl_mc_bu.patch
(git-fixes CVE-2022-49711 bsc#1238416).
- Update
patches.suse/can-gs_usb-gs_usb_open-close-fix-memory-leak.patch
(git-fixes CVE-2022-49661 bsc#1237788).
- Update
patches.suse/can-mcba_usb-properly-check-endpoint-type.patch
(git-fixes CVE-2022-49151 bsc#1237778).
- Update
patches.suse/cgroup-Use-separate-src-dst-nodes-when-preloading-css_sets-for-migration.patch
(bsc#1201610 CVE-2022-49647 bsc#1238805).
- Update patches.suse/cifs-fix-handlecache-and-multiuser.patch
(bsc#1200217 CVE-2022-49281 bsc#1238635).
- Update
patches.suse/cifs-fix-potential-double-free-during-failed-mount.patch
(bsc#1200217 CVE-2022-49541 bsc#1238727).
- Update
patches.suse/cifs-potential-buffer-overflow-in-handling-symlinks.patch
(bsc#1200217 CVE-2022-49058 bsc#1237814).
- Update
patches.suse/clk-qcom-clk-rcg2-Update-logic-to-calculate-D-value-.patch
(git-fixes CVE-2022-49189 bsc#1238150).
- Update patches.suse/crypto-qat-fix-memory-leak-in-RSA.patch
(git-fixes CVE-2022-49566 bsc#1238266).
- Update
patches.suse/dm-raid-fix-KASAN-warning-in-raid5_add_disks.patch
(git-fixes CVE-2022-49673 bsc#1238933).
- Update
patches.suse/dmaengine-idxd-Fix-the-error-handling-path-in-idxd_c.patch
(git-fixes CVE-2022-49422 bsc#1237784).
- Update
patches.suse/dmaengine-ti-Fix-refcount-leak-in-ti_dra7_xbar_route.patch
(git-fixes CVE-2022-49652 bsc#1238871).
- Update
patches.suse/dmaengine-zynqmp_dma-In-struct-zynqmp_dma_chan-fix-d.patch
(git-fixes CVE-2022-49320 bsc#1238394).
- Update
patches.suse/drbd-Fix-five-use-after-free-bugs-in-get_initial_state
(git-fixes CVE-2022-49085 bsc#1238036).
- Update
patches.suse/driver-base-fix-UAF-when-driver_attach-failed.patch
(git-fixes CVE-2022-49385 bsc#1237951).
- Update
patches.suse/driver-core-fix-deadlock-in-__device_attach.patch
(git-fixes CVE-2022-49371 bsc#1238546).
- Update
patches.suse/drivers-base-node.c-fix-compaction-sysfs-file-leak.patch
(git-fixes CVE-2022-49442 bsc#1238243).
- Update
patches.suse/drivers-staging-rtl8192e-Fix-deadlock-in-rtllib_beac.patch
(git-fixes CVE-2022-49315 bsc#1238638).
- Update
patches.suse/drivers-staging-rtl8192u-Fix-deadlock-in-ieee80211_b.patch
(git-fixes CVE-2022-49305 bsc#1238645).
- Update
patches.suse/drivers-tty-serial-Fix-deadlock-in-sa1100_set_termio.patch
(git-fixes CVE-2022-49304 bsc#1238639).
- Update
patches.suse/drivers-usb-host-Fix-deadlock-in-oxu_bus_suspend.patch
(git-fixes CVE-2022-49313 bsc#1238633).
- Update
patches.suse/drm-amd-amdgpu-amdgpu_cs-fix-refcount-leak-of-a-dma_.patch
(git-fixes CVE-2022-49137 bsc#1238155).
- Update
patches.suse/drm-amd-display-Fix-a-NULL-pointer-dereference-in-am.patch
(git-fixes CVE-2022-49232 bsc#1238139).
- Update
patches.suse/drm-amdgpu-cs-make-commands-with-0-chunks-illegal-be.patch
(git-fixes CVE-2022-49335 bsc#1238377).
- Update
patches.suse/drm-amdkfd-Check-for-potential-null-return-of-kmallo.patch
(git-fixes CVE-2022-49055 bsc#1237868).
- Update
patches.suse/drm-i915-fix-a-possible-refcount-leak-in-intel_dp_ad.patch
(git-fixes CVE-2022-49644 bsc#1238235).
- Update
patches.suse/drm-i915-gem-add-missing-boundary-check-in-vm_access.patch
(git-fixes CVE-2022-49261 bsc#1238462).
- Update
patches.suse/drm-i915-reset-Fix-error_state_read-ptr-offset-use.patch
(git-fixes CVE-2022-49723 bsc#1237997).
- Update
patches.suse/drm-imx-Fix-memory-leak-in-imx_pd_connector_get_mode.patch
(git-fixes CVE-2022-49091 bsc#1237726).
- Update
patches.suse/drm-msm-a6xx-Fix-refcount-leak-in-a6xx_gpu_init.patch
(git-fixes CVE-2022-49462 bsc#1238123).
- Update
patches.suse/drm-msm-disp-dpu1-set-vbif-hw-config-to-NULL-to-avoi.patch
(git-fixes CVE-2022-49489 bsc#1238244).
- Update
patches.suse/drm-msm-fix-possible-memory-leak-in-mdp5_crtc_cursor.patch
(git-fixes CVE-2022-49467 bsc#1238815).
- Update
patches.suse/drm-msm-hdmi-check-return-value-after-calling-platfo.patch
(git-fixes CVE-2022-49495 bsc#1237932).
- Update
patches.suse/drm-msm-mdp4-Fix-refcount-leak-in-mdp4_modeset_init_.patch
(git-fixes CVE-2022-49693 bsc#1237954).
- Update
patches.suse/drm-msm-mdp5-Return-error-code-in-mdp5_mixer_release.patch
(git-fixes CVE-2022-49488 bsc#1238600).
- Update
patches.suse/drm-msm-mdp5-Return-error-code-in-mdp5_pipe_release-.patch
(git-fixes CVE-2022-49490 bsc#1238275).
- Update
patches.suse/drm-panfrost-Fix-shrinker-list-corruption-by-madvise.patch
(git-fixes CVE-2022-49645 bsc#1238435).
- Update
patches.suse/drm-plane-Move-range-check-for-format_count-earlier.patch
(git-fixes CVE-2021-47659 bsc#1237839).
- Update
patches.suse/drm-rockchip-vop-fix-possible-null-ptr-deref-in-vop_.patch
(git-fixes CVE-2022-49491 bsc#1238539).
- Update
patches.suse/drm-tegra-Fix-reference-leak-in-tegra_dsi_ganged_pro.patch
(git-fixes CVE-2022-49216 bsc#1238338).
- Update
patches.suse/drm-virtio-fix-NULL-pointer-dereference-in-virtio_gp.patch
(git-fixes CVE-2022-49532 bsc#1238925).
- Update
patches.suse/efi-Do-not-import-certificates-from-UEFI-Secure-Boot.patch
(git-fixes CVE-2022-49357 bsc#1238631).
- Update patches.suse/ext4-fix-bug_on-in-__es_tree_search.patch
(bsc#1200809 CVE-2022-49409 bsc#1238279).
- Update patches.suse/ext4-fix-bug_on-in-ext4_writepages.patch
(bsc#1200872 CVE-2022-49347 bsc#1238393).
- Update
patches.suse/ext4-fix-race-condition-between-ext4_write-and-ext4_.patch
(bsc#1200807 CVE-2022-49414 bsc#1238623).
- Update
patches.suse/ext4-fix-use-after-free-in-ext4_rename_dir_prepare.patch
(bsc#1200871 CVE-2022-49349 bsc#1238372).
- Update
patches.suse/ext4-fix-warning-in-ext4_handle_inode_extension.patch
(bsc#1202711 CVE-2022-49352 bsc#1238395).
- Update
patches.suse/firmware-arm_scmi-Fix-list-protocols-enumeration-in-.patch
(git-fixes CVE-2022-49451 bsc#1238177).
- Update
patches.suse/firmware-dmi-sysfs-Fix-memory-leak-in-dmi_sysfs_regi.patch
(git-fixes CVE-2022-49370 bsc#1238467).
- Update
patches.suse/ftrace-Clean-up-hash-direct_functions-on-register-failures.patch
(git-fixes CVE-2022-49402 bsc#1238255).
- Update
patches.suse/ibmvnic-fix-race-between-xmit-and-reset.patch
(bsc#1197302 ltc#197259 CVE-2022-49201 bsc#1238256).
- Update
patches.suse/ice-arfs-fix-use-after-free-when-freeing-rx_cpu_rmap.patch
(jsc#SLE-12878 CVE-2022-49063 bsc#1237846).
- Update
patches.suse/iio-accel-mma8452-use-the-correct-logic-to-get-mma84.patch
(git-fixes CVE-2022-49285 bsc#1238641).
- Update
patches.suse/iio-trigger-sysfs-fix-use-after-free-on-remove.patch
(git-fixes CVE-2022-49685 bsc#1237963).
- Update
patches.suse/ima-Fix-a-potential-integer-overflow-in-ima_appraise.patch
(git-fixes CVE-2022-49643 bsc#1238663).
- Update
patches.suse/ima-Fix-potential-memory-leak-in-ima_init_crypto.patch
(git-fixes CVE-2022-49627 bsc#1237798).
- Update
patches.suse/iommu-omap-Fix-regression-in-probe-for-NULL-pointer-dereference
(git-fixes CVE-2022-49083 bsc#1237723).
- Update
patches.suse/ipw2x00-Fix-potential-NULL-dereference-in-libipw_xmi.patch
(git-fixes CVE-2022-49544 bsc#1238721).
- Update patches.suse/linux-dim-Fix-divide-by-0-in-RDMA-DIM.patch
(git-fixes CVE-2022-49670 bsc#1238809).
- Update
patches.suse/lz4-fix-LZ4_decompress_safe_partial-read-out-of-boun.patch
(git-fixes CVE-2022-49078 bsc#1237736).
- Update
patches.suse/mac80211-fix-potential-double-free-on-mesh-join.patch
(git-fixes CVE-2022-49290 bsc#1238156).
- Update
patches.suse/md-bitmap-don-t-set-sb-values-if-can-t-pass-sanity-c.patch
(bsc#1197158 CVE-2022-49526 bsc#1238030).
- Update
patches.suse/media-cx25821-Fix-the-warning-when-removing-the-modu.patch
(git-fixes CVE-2022-49525 bsc#1238022).
- Update
patches.suse/media-davinci-vpif-fix-use-after-free-on-driver-unbi.patch
(git-fixes CVE-2021-47653 bsc#1237748).
- Update
patches.suse/media-pci-cx23885-Fix-the-error-handling-in-cx23885_.patch
(git-fixes CVE-2022-49524 bsc#1238949).
- Update
patches.suse/media-pvrusb2-fix-array-index-out-of-bounds-in-pvr2_.patch
(git-fixes CVE-2022-49478 bsc#1238000).
- Update
patches.suse/media-stk1160-If-start-stream-fails-return-buffers-w.patch
(git-fixes CVE-2022-49247 bsc#1237783).
- Update
patches.suse/media-usb-go7007-s2250-board-fix-leak-in-probe.patch
(git-fixes CVE-2022-49253 bsc#1238420).
- Update
patches.suse/media-venus-hfi-avoid-null-dereference-in-deinit.patch
(git-fixes CVE-2022-49527 bsc#1238013).
- Update
patches.suse/misc-ocxl-fix-possible-double-free-in-ocxl_file_regi.patch
(git-fixes CVE-2022-49455 bsc#1238229).
- Update
patches.suse/mm-slub-add-missing-TID-updates-on-slab-deactivation.patch
(git-fixes CVE-2022-49700 bsc#1238249).
- Update
patches.suse/mmc-jz4740-Apply-DMA-engine-limits-to-maximum-segmen.patch
(git-fixes CVE-2022-49522 bsc#1238948).
- Update
patches.suse/msft-hv-2556-Drivers-hv-vmbus-Fix-potential-crash-on-module-unloa.patch
(git-fixes CVE-2022-49098 bsc#1238079).
- Update
patches.suse/mtd-rawnand-atmel-fix-refcount-issue-in-atmel_nand_c.patch
(git-fixes CVE-2022-49212 bsc#1238331).
- Update
patches.suse/net-asix-add-proper-error-handling-of-usb-read-error.patch
(git-fixes CVE-2022-49226 bsc#1238336).
- Update
patches.suse/nfc-nci-add-flush_workqueue-to-prevent-uaf.patch
(git-fixes CVE-2022-49059 bsc#1238007).
- Update
patches.suse/nfc-nfcmrvl-Fix-memory-leak-in-nfcmrvl_play_deferred.patch
(git-fixes CVE-2022-49729 bsc#1239060).
- Update
patches.suse/nfc-st21nfca-fix-memory-leaks-in-EVT_TRANSACTION-han.patch
(git-fixes CVE-2022-49331 bsc#1237813).
- Update
patches.suse/phy-qcom-qmp-fix-reset-controller-leak-on-probe-erro.patch
(git-fixes CVE-2022-49396 bsc#1238289).
- Update
patches.suse/phy-qcom-qmp-fix-struct-clk-leak-on-probe-errors.patch
(git-fixes CVE-2022-49397 bsc#1237823).
- Update
patches.suse/pinctrl-nomadik-Add-missing-of_node_put-in-nmk_pinct.patch
(git-fixes CVE-2022-49185 bsc#1238111).
- Update
patches.suse/power-reset-arm-versatile-Fix-refcount-leak-in-versa.patch
(git-fixes CVE-2022-49609 bsc#1238241).
- Update
patches.suse/power-supply-ab8500-Fix-memory-leak-in-ab8500_fg_sys.patch
(git-fixes CVE-2022-49224 bsc#1237998).
- Update
patches.suse/powerpc-pseries-Fix-use-after-free-in-remove_phb_dyn.patch
(bsc#1065729 bsc#1198660 ltc#197803 CVE-2022-49196 bsc#1238274).
- Update
patches.suse/powerpc-tm-Fix-more-userspace-r13-corruption.patch
(bsc#1065729 CVE-2022-49164 bsc#1238108).
- Update
patches.suse/powerpc-xive-Fix-refcount-leak-in-xive_spapr_init.patch
(fate#322438 git-fixes CVE-2022-49437 bsc#1238443).
- Update
patches.suse/powerpc-xive-spapr-correct-bitmap-allocation-size.patch
(fate#322438 git-fixes CVE-2022-49623 bsc#1239040).
- Update
patches.suse/raw-Fix-a-data-race-around-sysctl_raw_l3mdev_accept.patch
(git-fixes CVE-2022-49631 bsc#1238814).
- Update
patches.suse/regulator-pfuze100-Fix-refcount-leak-in-pfuze_parse_.patch
(git-fixes CVE-2022-49481 bsc#1238264).
- Update
patches.suse/rtc-mt6397-check-return-value-after-calling-platform.patch
(git-fixes CVE-2022-49375 bsc#1238228).
- Update
patches.suse/rtl818x-Prevent-using-not-initialized-queues.patch
(git-fixes CVE-2022-49326 bsc#1238646).
- Update
patches.suse/scsi-ibmvfc-Allocate-free-queue-resource-only-during.patch
(jsc#SLE-15442 bsc#1180814 ltc#187461 git-fixes CVE-2022-49701
bsc#1237810).
- Update
patches.suse/scsi-ibmvfc-Store-vhost-pointer-during-subcrq-alloca.patch
(jsc#SLE-15442 bsc#1180814 ltc#187461 git-fixes CVE-2022-49703
bsc#1238131).
- Update
patches.suse/scsi-libfc-Fix-use-after-free-in-fc_exch_abts_resp.patch
(git-fixes CVE-2022-49114 bsc#1238146).
- Update
patches.suse/scsi-lpfc-Address-NULL-pointer-dereference-after-sta.patch
(bsc#1201193 CVE-2022-49332 bsc#1238236).
- Update
patches.suse/scsi-lpfc-Fix-SCSI-I-O-completion-and-abort-handler-.patch
(bsc#1200045 CVE-2022-49536 bsc#1238838).
- Update
patches.suse/scsi-lpfc-Fix-call-trace-observed-during-I-O-with-CM.patch
(bsc#1200045 CVE-2022-49537 bsc#1238930).
- Update
patches.suse/scsi-lpfc-Fix-null-pointer-dereference-after-failing.patch
(bsc#1200045 CVE-2022-49535 bsc#1238937).
- Update
patches.suse/scsi-lpfc-Fix-resource-leak-in-lpfc_sli4_send_seq_to.patch
(bsc#1200045 CVE-2022-49521 bsc#1238938).
- Update
patches.suse/scsi-lpfc-Inhibit-aborts-if-external-loopback-plug-i.patch
(bsc#1200045 CVE-2022-49504 bsc#1238835).
- Update
patches.suse/scsi-lpfc-Move-cfg_log_verbose-check-before-calling-.patch
(bsc#1200045 CVE-2022-49542 bsc#1238722).
- Update
patches.suse/scsi-lpfc-Protect-memory-leak-for-NPIV-ports-sending.patch
(bsc#1200045 CVE-2022-49534 bsc#1238893).
- Update
patches.suse/scsi-lpfc-Resolve-NULL-ptr-dereference-after-an-ELS-.patch
(bsc#1201193 CVE-2022-49730 bsc#1239070).
- Update
patches.suse/scsi-mpt3sas-Fix-use-after-free-in-_scsih_expander_node_remove
(git-fixes CVE-2022-49082 bsc#1237740).
- Update
patches.suse/scsi-pm8001-Fix-abort-all-task-initialization
(git-fixes CVE-2022-49217 bsc#1238313).
- Update
patches.suse/scsi-qla2xxx-Fix-crash-during-module-load-unload-tes.patch
(bsc#1197661 CVE-2022-49160 bsc#1238172).
- Update
patches.suse/scsi-qla2xxx-Fix-premature-hw-access-after-PCI-error.patch
(bsc#1195823 CVE-2022-49157 bsc#1238169).
- Update
patches.suse/scsi-qla2xxx-Fix-scheduling-while-atomic.patch
(bsc#1195823 CVE-2022-49156 bsc#1238168).
- Update
patches.suse/scsi-qla2xxx-Fix-warning-message-due-to-adisc-being-.patch
(bsc#1195823 CVE-2022-49158 bsc#1238170).
- Update
patches.suse/scsi-qla2xxx-Implement-ref-count-for-SRB.patch
(bsc#1195823 CVE-2022-49159 bsc#1238171).
- Update
patches.suse/scsi-qla2xxx-Suppress-a-kernel-complaint-in-qla_crea.patch
(bsc#1195823 CVE-2022-49155 bsc#1237941).
- Update
patches.suse/scsi-sd-Fix-potential-NULL-pointer-dereference.patch
(git-fixes CVE-2022-49376 bsc#1238103).
- Update
patches.suse/scsi-zorro7xx-Fix-a-resource-leak-in-zorro7xx_remove_one
(git-fixes CVE-2022-49095 bsc#1237752).
- Update
patches.suse/soc-bcm-brcmstb-pm-pm-arm-Fix-refcount-leak-in-brcms.patch
(git-fixes CVE-2022-49678 bsc#1238821).
- Update
patches.suse/soc-qcom-rpmpd-Check-for-null-return-of-devm_kcalloc.patch
(git-fixes CVE-2021-47651 bsc#1237872).
- Update
patches.suse/soc-rockchip-Fix-refcount-leak-in-rockchip_grf_init.patch
(git-fixes CVE-2022-49382 bsc#1238306).
- Update
patches.suse/spi-spi-fsl-qspi-check-return-value-after-calling-pl.patch
(git-fixes CVE-2022-49475 bsc#1238617).
- Update
patches.suse/staging-rtl8712-fix-uninit-value-in-r871xu_drv_init.patch
(git-fixes CVE-2022-49298 bsc#1238718).
- Update
patches.suse/staging-rtl8712-fix-uninit-value-in-usb_read8-and-fr.patch
(git-fixes CVE-2022-49301 bsc#1238643).
- Update
patches.suse/sysctl-Fix-data-races-in-proc_douintvec.patch
(git-fixes CVE-2022-49641 bsc#1237831).
- Update
patches.suse/sysctl-Fix-data-races-in-proc_douintvec_minmax.patch
(git-fixes CVE-2022-49640 bsc#1237782).
- Update
patches.suse/thermal-drivers-broadcom-Fix-potential-NULL-derefere.patch
(git-fixes CVE-2022-49459 bsc#1238046).
- Update
patches.suse/tracing-Fix-potential-double-free-in-create_var_ref.patch
(git-fixes CVE-2022-49410 bsc#1238441).
- Update
patches.suse/tracing-histograms-Fix-memory-leak-problem.patch
(git-fixes CVE-2022-49648 bsc#1238278).
- Update
patches.suse/tty-Fix-a-possible-resource-leak-in-icom_probe.patch
(git-fixes CVE-2022-49314 bsc#1238158).
- Update
patches.suse/tty-fix-deadlock-caused-by-calling-printk-under-tty_.patch
(git-fixes CVE-2022-49441 bsc#1238263).
- Update patches.suse/tty-goldfish-Fix-free_irq-on-remove.patch
(git-fixes CVE-2022-49724 bsc#1238869).
- Update
patches.suse/tty-goldfish-Use-tty_port_destroy-to-destroy-port.patch
(git-fixes CVE-2022-49399 bsc#1237829).
- Update
patches.suse/tty-synclink_gt-Fix-null-pointer-dereference-in-slgt.patch
(git-fixes CVE-2022-49307 bsc#1238149).
- Update
patches.suse/usb-dwc2-Fix-memory-leak-in-dwc2_hcd_init.patch
(git-fixes CVE-2022-49713 bsc#1238419).
- Update
patches.suse/usb-dwc2-gadget-don-t-reset-gadget-s-driver-bus.patch
(git-fixes CVE-2022-49299 bsc#1238184).
- Update
patches.suse/usb-dwc3-gadget-Replace-list_for_each_entry_safe-if-.patch
(git-fixes CVE-2022-49398 bsc#1238621).
- Update
patches.suse/usb-gadget-lpc32xx_udc-Fix-refcount-leak-in-lpc32xx_.patch
(git-fixes CVE-2022-49712 bsc#1238239).
- Update
patches.suse/usb-usbip-fix-a-refcount-leak-in-stub_probe.patch
(git-fixes CVE-2022-49389 bsc#1238257).
- Update patches.suse/usbnet-fix-memory-leak-in-error-case.patch
(git-fixes CVE-2022-49657 bsc#1238269).
- Update
patches.suse/video-fbdev-cirrusfb-check-pixclock-to-avoid-divide-.patch
(git-fixes CVE-2021-47641 bsc#1237734).
- Update
patches.suse/video-fbdev-clcdfb-Fix-refcount-leak-in-clcdfb_of_vr.patch
(git-fixes CVE-2022-49421 bsc#1238819).
- Update
patches.suse/video-fbdev-nvidiafb-Use-strscpy-to-prevent-buffer-o.patch
(git-fixes CVE-2021-47642 bsc#1237916).
- Update
patches.suse/video-fbdev-sm712fb-Fix-crash-in-smtcfb_write.patch
(git-fixes CVE-2022-49162 bsc#1238096).
- Update
patches.suse/video-fbdev-smscufx-Fix-null-ptr-deref-in-ufx_usb_pr.patch
(git-fixes CVE-2021-47652 bsc#1237721).
- Update
patches.suse/virtio_console-eliminate-anonymous-module_init-modul.patch
(git-fixes CVE-2022-49100 bsc#1237735).
- Update
patches.suse/virtio_net-fix-xdp_rxq_info-bug-after-suspend-resume.patch
(git-fixes CVE-2022-49687 bsc#1238181).
- Update
patches.suse/watchdog-ts4800_wdt-Fix-refcount-leak-in-ts4800_wdt_.patch
(git-fixes CVE-2022-49373 bsc#1238175).
- Update
patches.suse/wifi-mac80211-fix-queue-selection-for-mesh-OCB-inter.patch
(git-fixes CVE-2022-49646 bsc#1239001).
- Update
patches.suse/wifi-mac80211-fix-use-after-free-in-chanctx-code.patch
(git-fixes CVE-2022-49416 bsc#1238293).
- Update
patches.suse/wireguard-socket-free-skb-in-send6-when-ipv6-is-disa.patch
(git-fixes CVE-2022-49153 bsc#1238166).
- Update
patches.suse/x86-kexec-fix-memory-leak-of-elf-header-buffer.patch
(bsc#1196444 CVE-2022-49546 bsc#1238750).
- Update
patches.suse/x86-speculation-Fill-RSB-on-vmexit-for-IBRS.patch
(bsc#1199657 CVE-2022-29900 CVE-2022-29901 CVE-2022-49611
bsc#1238618).
- Update
patches.suse/xen-netback-avoid-entering-xenvif_rx_next_skb-with-a.patch
(bsc#1201381 CVE-2022-49649 bsc#1238612).
- Update
patches.suse/xprtrdma-treat-all-calls-not-a-bcall-when-bc_serv-is.patch
(git-fixes CVE-2022-49321 bsc#1238373).
- commit b2f6479
- Update
patches.suse/netfilter-nf_tables-initialize-registers-in-nft_do_c.patch
(CVE-2022-1016 bsc#1197227 CVE-2022-49293 bsc#1239454).
- commit 2c00021
- net: usb: aqc111: Fix out-of-bounds accesses in RX fixup
(bsc#1237903 CVE-2022-49051).
- commit 7163fa9
- drm/amdgpu: avoid buffer overflow attach in smu_sys_set_pp_table() (bsc#1239115 CVE-2025-21780)
- commit 0a1e9ed
- ALSA: usb-audio: Cancel pending work at closing a MIDI substream
(CVE-2022-49545 bsc#1238729).
- commit cb1f0e5
- net_sched: sch_sfq: don't allow 1 packet limit (CVE-2024-57996
bsc#1239076).
- commit bc548b8
- Update
patches.suse/ALSA-pcm-Fix-potential-AB-BA-lock-with-buffer_mutex-.patch
(CVE-2022-1048 bsc#1197331 CVE-2022-49272 bsc#1238272).
- Update
patches.suse/ALSA-pcm-Fix-races-among-concurrent-hw_params-and-hw.patch
(CVE-2022-1048 bsc#1197331 CVE-2022-49291 bsc#1238705).
- Update
patches.suse/ALSA-pcm-Fix-races-among-concurrent-prealloc-proc-wr.patch
(CVE-2022-1048 bsc#1197331 CVE-2022-49288 bsc#1238271).
- Update
patches.suse/ALSA-pcm-oss-Fix-race-at-SNDCTL_DSP_SYNC.patch
(CVE-2022-3303 bsc#1203769 CVE-2022-49733 bsc#1238454).
- Update
patches.suse/cifs-prevent-bad-output-lengths-in-smb2_ioctl_query_info-.patch
(CVE-2022-0168 bsc#1197472 CVE-2022-49271 bsc#1238626).
- Update
patches.suse/exec-Force-single-empty-string-when-argv-is-empty.patch
(bsc#1200571 CVE-2022-49264 bsc#1237815).
- Update patches.suse/ext4-add-reserved-GDT-blocks-check.patch
(bsc#1230326 CVE-2022-49707 bsc#1239035).
- Update patches.suse/ext4-avoid-cycles-in-directory-h-tree.patch
(bsc#1198577 CVE-2022-1184 CVE-2022-49343 bsc#1238382).
- Update patches.suse/ext4-fix-bug_on-ext4_mb_use_inode_pa.patch
(bsc#1230326 CVE-2022-49708 bsc#1238599).
- Update
patches.suse/tpm-fix-reference-counting-for-struct-tpm_chip.patch
(CVE-2022-2977 bsc#1202672 CVE-2022-49287 bsc#1238276).
- commit e8df2d2
- bfq: Update cgroup information before merging bio (CVE-2022-49413 bsc#1238710)
- commit c78c297
- can: m_can: m_can_tx_handler(): fix use after free of skb (CVE-2022-49275 bsc#1238719)
- commit a958ae1
- crypto: qat - add param check for DH (CVE-2022-49564 bsc#1238789)
- commit 7e2e730
- crypto: qat - add param check for RSA (CVE-2022-49563 bsc#1238787)
- commit f590e48
- wifi: brcmsmac: add gain range check to wlc_phy_iqcal_gainparams_nphy() (CVE-2024-58014 bsc#1239109)
- commit f654919
- augeas
-
- Add patch, fix for bsc#1239909 / CVE-2025-2588:
* CVE-2025-2588.patch
- expat
-
- version update to 2.7.1
Bug fixes:
[#980] #989 Restore event pointer behavior from Expat 2.6.4
(that the fix to CVE-2024-8176 changed in 2.7.0);
affected API functions are:
- XML_GetCurrentByteCount
- XML_GetCurrentByteIndex
- XML_GetCurrentColumnNumber
- XML_GetCurrentLineNumber
- XML_GetInputContext
Other changes:
[#976] #977 Autotools: Integrate files "fuzz/xml_lpm_fuzzer.{cpp,proto}"
with Automake that were missing from 2.7.0 release tarballs
[#983] #984 Fix printf format specifiers for 32bit Emscripten
[#992] docs: Promote OpenSSF Best Practices self-certification
[#978] tests/benchmark: Resolve mistaken double close
[#986] Address compiler warnings
[#990] #993 Version info bumped from 11:1:10 (libexpat*.so.1.10.1)
to 11:2:10 (libexpat*.so.1.10.2); see https://verbump.de/
for what these numbers do
Infrastructure:
[#982] CI: Start running Perl XML::Parser integration tests
[#987] CI: Enforce Clang Static Analyzer clean code
[#991] CI: Re-enable warning clang-analyzer-valist.Uninitialized
for clang-tidy
[#981] CI: Cover compilation with musl
[#983] #984 CI: Cover compilation with 32bit Emscripten
[#976] #977 CI: Protect against fuzzer files missing from future
release archives
- version update to 2.7.0 for SLE-15
- deleted patches
- expat-CVE-2018-20843.patch (upstreamed)
- expat-CVE-2019-15903-tests.patch (upstreamed)
- expat-CVE-2019-15903.patch (upstreamed)
- expat-CVE-2021-45960.patch (upstreamed)
- expat-CVE-2021-46143.patch (upstreamed)
- expat-CVE-2022-22822.patch (upstreamed)
- expat-CVE-2022-22823.patch (upstreamed)
- expat-CVE-2022-22824.patch (upstreamed)
- expat-CVE-2022-22825.patch (upstreamed)
- expat-CVE-2022-22826.patch (upstreamed)
- expat-CVE-2022-22827.patch (upstreamed)
- expat-CVE-2022-23852.patch (upstreamed)
- expat-CVE-2022-23990.patch (upstreamed)
- expat-CVE-2022-25235.patch (upstreamed)
- expat-CVE-2022-25236-relax-fix.patch (upstreamed)
- expat-CVE-2022-25236.patch (upstreamed)
- expat-CVE-2022-25313-fix-regression.patch (upstreamed)
- expat-CVE-2022-25313.patch (upstreamed)
- expat-CVE-2022-25314.patch (upstreamed)
- expat-CVE-2022-25315.patch (upstreamed)
- expat-CVE-2022-40674.patch (upstreamed)
- expat-CVE-2022-43680.patch (upstreamed)
- expat-CVE-2024-45490.patch (upstreamed)
- expat-CVE-2024-45491.patch (upstreamed)
- expat-CVE-2024-45492.patch (upstreamed)
- expat-CVE-2024-50602.patch (upstreamed)
- version update to 2.7.0 (CVE-2024-8176 [bsc#1239618])
* Security fixes:
[#893] #973 CVE-2024-8176 -- Fix crash from chaining a large number
of entities caused by stack overflow by resolving use of
recursion, for all three uses of entities:
- general entities in character data ("<e>&g1;</e>")
- general entities in attribute values ("<e k1='&g1;'/>")
- parameter entities ("%p1;")
Known impact is (reliable and easy) denial of service:
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:H/RL:O/RC:C
(Base Score: 7.5, Temporal Score: 7.2)
Please note that a layer of compression around XML can
significantly reduce the minimum attack payload size.
* Other changes:
[#935] #937 Autotools: Make generated CMake files look for
libexpat.@SO_MAJOR@.dylib on macOS
[#925] Autotools: Sync CMake templates with CMake 3.29
[#945] #962 #966 CMake: Drop support for CMake <3.13
[#942] CMake: Small fuzzing related improvements
[#921] docs: Add missing documentation of error code
XML_ERROR_NOT_STARTED that was introduced with 2.6.4
[#941] docs: Document need for C++11 compiler for use from C++
[#959] tests/benchmark: Fix a (harmless) TOCTTOU
[#944] Windows: Fix installer target location of file xmlwf.xml
for CMake
[#953] Windows: Address warning -Wunknown-warning-option
about -Wno-pedantic-ms-format from LLVM MinGW
[#971] Address Cppcheck warnings
[#969] #970 Mass-migrate links from http:// to https://
[#947] #958 ..
[#974] #975 Document changes since the previous release
[#974] #975 Version info bumped from 11:0:10 (libexpat*.so.1.10.0)
to 11:1:10 (libexpat*.so.1.10.1); see https://verbump.de/
for what these numbers do
- no source changes, just adding jira reference: jsc#SLE-21253
- freetype2
-
- enable brotli support (jsc#PED-12258)
- icu
-
- Add icu-CVE-2025-5222.patch:
Backport 2c667e3 from upstream, ICU-22973 Fix buffer overflow by
using CharString.
(CVE-2025-5222, bsc#1243721)
- mozjs60
-
- Add libtheora-avoid-negative-shift.patch: avoid negative shift in
huffdec.c (bsc#1234837 CVE-2024-56431).
- Explicitly require libicu-devel, rather than using pkgconfig, to
avoid unintentionally building against icu 73.
- ncurses
-
- Modify patch ncurses-5.9-ibm327x.dif
* Backport sclp terminfo description entry if for s390 sclp terminal lines
* Add a further sclp entry for qemu s390 based systems
* Make use of dumb
- librdkafka
-
- 0001-Fix-timespec-conversion-to-avoid-infinite-loop-2108-.patch:
avoid endless loops (bsc#1242842)
- ruby2.5
-
- update suse.patch to 736ea75f25d52fdebb88ed6583468bd7c21190f6
- fix ReDoS in CGI::Util#escapeElement
bsc#1237806 CVE-2025-27220
- fix denial of service in CGI::Cookie.parse
bsc#1237804 CVE-2025-27219
- update suse.patch to 6bf78da1fc4048a11a8612741216ebc47d9ebb41
- move the request smuggling patch to the correct place
actually fixes bsc#1230930 CVE-2024-47220 and now boo#1235773
- libsolv
-
- build both static and dynamic libraries on new suse distros
- support the apk package and repository format (both v2 and v3)
- new dataiterator_final_{repo,solvable} functions
- bump version to 0.7.32
- Provide a symbol specific for the ruby-version
so yast does not break across updates (boo#1235598)
- sqlite3
-
- Sync version 3.49.1 from Factory (jsc#SLE-16032):
* CVE-2025-29087, bsc#1241020: Fix a bug in the concat_ws()
function, introduced in version 3.44.0, that could lead to a
memory error if the separator string is very large (hundreds
of megabytes).
* CVE-2025-29088, bsc#1241078: Enhanced the
SQLITE_DBCONFIG_LOOKASIDE interface to make it more robust
against misuse.
* Obsoletes sqlite3-rtree-i686.patch
- systemd
-
- Import commit b540e1826dfa84e8351be04319500077933040f2
329b3a06b2 coredump: get rid of a bogus assertion
b167ce0eca coredump: use %d in kernel core pattern (bsc#1243935 CVE-2025-4598)
d29e207ff5 coredump: get rid of _META_MANDATORY_MAX
af79ecd784 coredump: restore compatibility with older patterns
d205cdc59f basic/macro: add macro to iterate variadic args
596c225106 bootctl: don't advertise systemd-efi-options in --help/man anymore
0834294bb4 Deprecate efivar SystemdOptions
932b48caea journal-remote: use macro wrapper instead of alloca to extend string
d76757755d journal-remote: code is of type enum MHD_RequestTerminationCode
d30c705c32 man: Document ranges for distributions config files and local config files
90e404ae52 Recommend drop-ins over modifications to the main config file
cb4107e673 man: reword the description of "main conf file"
- Start the systemd-coredump.socket unit on systemd-coredump package
installation.
- Restore the kernel default values of the coredump sysctl settings on
systemd-coredump package removal.
- Apply coredump sysctl settings on systemd-coredump updates/removals
- Import commit 0df33a97370bd8a169cb4a0f927b730cb436567c
42efa94f09 utmp-wtmp: handle EINTR gracefully when waiting to write to tty
fd441024d3 utmp-wtmp: fix error in case isatty() fails
055f63184e homed: handle EINTR gracefully when waiting for device node
2e8a9938f6 resolved: handle -EINTR returned from fd_wait_for_event() better
3ac836e058 sd-netlink: handle EINTR from poll() gracefully, as success
c582c1f3eb basic/socket-util: add hint to silence gcc's maybe-unitialized warning
76de855c9f varlink: also handle EINTR gracefully when waiting for EIO via ppoll()
cee2f24db2 shared: drop a redundant if statement
c8f1fbf11f stdio-bridge: don't be bothered with EINTR
7d874abc1c sd-bus: handle -EINTR return from bus_poll() (bsc#1215241)
164a4cae44 libsystemd: ignore both EINTR and EAGAIN
7ef9a8ce46 Change gendered terms to be gender-neutral (#21325)
3d532b1fb2 errno-util: introduce ERRNO_IS_TRANSIENT()
- Import commit 73a44a04af36a84d6ed2653f9fadbfaece374c42
21ebf8c01b man/systemd-fsck@.service: clarify passno and noauto combination in /etc/fstab (bsc#1211725)
3f58f4971c units/initrd-parse-etc.service: Conflict with emergency.target
61f67f0bd1 umount: /usr/ should never be unmounted regardless of HAVE_SPLIT_USR or not (bsc#1211576)
48cb259da1 sd-device-monitor: actually refuse to send invalid devices
e0ff41ada1 coredump: do not allow user to access coredumps with changed uid/gid/capabilities (bsc#1205000 CVE-2022-4415)
b0795286ec coredump: adjust whitespace
42380ff2e9 coredump: drop an unused variable
29276c039d coredump: Fix format string type mismatch
- Drop the following patches since they have been included in branch 'SUSE/v246'
(see above):
5000-coredump-Fix-format-string-type-mismatch.patch
5001-coredump-drop-an-unused-variable.patch
5002-coredump-adjust-whitespace.patch
5003-coredump-do-not-allow-user-to-access-coredumps-with-.patch
- libxml2
-
- security update
- added patches
CVE-2025-32414 [bsc#1241551], out-of-bounds read when parsing text via the Python API
+ libxml2-CVE-2025-32414.patch
CVE-2025-32415 [bsc#1241453], a crafted XML document may lead to a heap-based buffer under-read
+ libxml2-CVE-2025-32415.patch
- libzypp
-
- Fix credential handling in HEAD requests (bsc#1244105)
- version 17.37.5 (35)
- RepoInfo: use pathNameSetTrailingSlash (fixes #643)
- Fix wrong userdata parameter type when running zypp with debug
verbosity (bsc#1239012)
- version 17.37.4 (35)
- Do not warn about no mirrors if mirrorlist was switched on
automatically. (bsc#1243901)
- Relax permission of cached packages to 0644 & ~umask
(bsc#1243887)
- version 17.37.3 (35)
- Add a note to service maintained .repo file entries (fixes #638)
- Support using %{url} variable in a RIS service's repo section.
- version 17.37.2 (35)
- Use a cookie file to validate mirrorlist cache.
This patch extends the mirrorlist code to use a cookie file to
validate the contents of the cache against the source URL, making
sure that we do not accidentially use a old cache when the
mirrorlist url was changed. For example when migrating a system
from one release to the next where the same repo alias might just
have a different URL.
- Let Service define and update gpgkey, mirrorlist and metalink.
- Preserve a mirrorlist file in the raw cache during refresh.
- version 17.37.1 (35)
- Code16: Enable curl2 backend and parallel package download by
default. In Code15 it's optional.
Environment variables ZYPP_CURL2=<0|1> and ZYPP_PCK_PRELOAD=<0|1>
can be used to turn the features on or off.
- Make gpgKeyUrl the default source for gpg keys.
When refreshing zypp now primarily uses gpgKeyUrl information
from the repo files and only falls back to a automatically
generated key Url if a gpgKeyUrl was not specified.
- Introduce mirrors into the Media backends (bsc#1240132)
- Drop MediaMultiCurl backend.
- Throttle progress updates when preloading packages (bsc#1239543)
- Check if request is in valid state in CURL callbacks (fixes
openSUSE/zypper#605)
- spec/CMake: add conditional build
'--with[out] classic_rpmtrans_as_default'.
classic_rpmtrans is the current builtin default for SUSE,
otherwise it's single_rpmtrans.
The `enable_preview_single_rpmtrans_as_default_for_zypper` switch
was removed from the spec file. Accordingly the CMake option
ENABLE_PREVIEW_SINGLE_RPMTRANS_AS_DEFAULT_FOR_ZYPPER was removed.
- version 17.37.0 (35)
- fixed build with boost 1.88.
- XmlReader: Fix detection of bad input streams (fixes #635)
libxml2 2.14 potentially reads the complete stream, so it may
have the 'eof' bit set. Which is not 'good' but also not 'bad'.
- rpm: Fix detection of %triggerscript starts (bsc#1222044)
- RepoindexFileReader: add more <repo> related attributes a
service may set.
Add optional attributes gpgcheck, repo_gpgcheck, pkg_gpgcheck,
keeppackages, gpgkey, mirrorlist, and metalink with the same
semantic as in a .repo file.
- version 17.36.7 (35)
- Drop workaround for broken rpm-4.18 in Code16 (bsc#1237172)
- BuildRequires: %{libsolv_devel_package} >= 0.7.32.
Code16 moved static libs to libsolv-devel-static.
- Drop usage of SHA1 hash algorithm because it will become
unavailable in FIPS mode (bsc#1240529)
- Fix zypp.conf dupAllowVendorChange to reflect the correct
default (false).
The default was true in Code12 (libzypp-16.x) and changed to
false with Code15 (libzypp-17.x). Unfortunately this was done by
shipping a modified zypp.conf file rather than fixing the code.
- zypp.conf: Add `lock_timeout` ($ZYPP_LOCK_TIMEOUT) (bsc#1239809)
- version 17.36.6 (35)
- Fix computation of RepStatus if Repo URLs change.
- Fix lost double slash when appending to an absolute FTP url
(bsc#1238315)
Ftp actually differs between absolute and relative URL paths.
Absolute path names begin with a double slash encoded as '/%2F'.
This must be preserved when manipulating the path.
- version 17.36.5 (35)
- Add a transaction package preloader (fixes openSUSE/zypper#104)
This patch adds a preloader that concurrently downloads files
during a transaction commit. It's not yet enabled per default.
To enable the preview set ZYPP_CURL2=1 and ZYPP_PCK_PRELOAD=1
in the environment.
- RpmPkgSigCheck_test: Exchange the test package signingkey
(fixes #622)
- Exclude MediaCurl tests if DISABLE_MEDIABACKEND_TESTS (fixes #626)
- Strip a mediahandler tag from baseUrl querystrings.
- version 17.36.4 (35)
- openssh
-
- Added openssh-bsc1241045-kexalgo-gt-256bits.patch (bsc#1241045)
from upstream, which allows KEX hashes greater than 256 bits.
Thanks to Ali Abdallah <ali.abdallah@suse.com>.
- Added openssh-cve-2025-32728.patch (bsc#1241012, CVE-2025-32728).
This fixes an upstream logic error handling the DisableForwarding
option.
- Update openssh-7.6p1-audit_race_condition.patch (bsc#1232533),
fixing failures with very large MOTDs. Thanks to Ali Abdallah
<ali.abdallah@suse.com>.
- Updated openssh-8.1p1-audit.patch (bsc#1228634) with modification
from Jaroslav Jindrak (jjindrak@suse.com) to fix the hostname
being left out of the audit output.
- pam-config
-
- Stop adding pam_env in AUTH stack, and be sure to put this module at the
really end of the SESSION stack.
[bsc#1243226, CVE-2025-6018, remove-pam_env-from-auth-stack.patch]
- pam
-
- pam_namespace: convert functions that may operate on a user-controlled path
to operate on file descriptors instead of absolute path. And keep the
bind-mount protection from protect_mount() as a defense in depthmeasure.
[bsc#1244509
pam_inline-introduce-pam_asprintf-pam_snprintf-and-p.patch,
pam_namespace-fix-potential-privilege-escalation.patch,
pam_namespace-add-flags-to-indicate-path-safety.patch,
pam_namespace-secure_opendir-do-not-look-at-the-grou.patch]
- pam_namespace-fix-potential-privilege-escalation.patch adapted and includes
changes from upstream commits: ds6242a, bc856cd.
* pam_namespace fix logic in return value handling
* pam_namespace move functions around
- pam_env: Change the default to not read the user .pam_environment file
[bsc#1243226, CVE-2025-6018,
pam_env-change-the-default-to-not-read-the-user-env.patch]
- pam_unix/passverify: (get_account_info) [!HELPER_COMPILE]: Always return
PAM_UNIX_RUN_HELPER instead of trying to obtain the shadow password file
entry.
[passverify-always-run-the-helper-to-obtain-shadow_pwd.patch, bsc#1232234,
CVE-2024-10041]
- Do not reject the user with a hash assuming it's non-empty.
[pam_unix-allow-empty-passwords-with-non-empty-hashes.patch]
- perl
-
- do not change the current directory when cloning an open
directory handle [bnc#1244079] [CVE-2025-40909]
new patch: perl-dirdup.diff
- python-pyzmq
-
- Prevent open files leak by closing sockets on timeout (bsc#1241624)
- Added:
* close-socket-on-timeout.patch
- python-requests
-
- Add CVE-2024-47081.patch upstream patch, fixes netrc credential leak
(gh#psf/requests#6965, CVE-2024-47081, bsc#1244039)
- salt
-
- Fix aptpkg 'NoneType object has no attribute split' error
- Detect openEuler as RedHat family OS
- Ensure the correct crypt module is loaded
- Implement multiple inventory for ansible.targets
- Make x509 module compatible with M2Crypto 0.44.0
- Remove deprecated code from x509.certificate_managed test mode
- Move logrotate config to /usr/etc/logrotate.d where possible
- Add DEB822 apt repository format support
- Make Salt-SSH work with all SSH passwords (bsc#1215484)
- Fix issue of using update-alternatives with alts (#105)
- Fix virt_query outputter and add support for block devices
- Make _auth calls visible with master stats
- Repair mount.fstab_present always returning pending changes
- Set virtual grain in Podman systemd container
- Fix crash due wrong client reference on `SaltMakoTemplateLookup`
- Enhace batch async and fix some detected issues
- Enhacement of Salt packaging
* Use update-alternatives for all salt scripts
* Use flexible dependencies for the subpackages
* Make salt-minion to require flavored zypp-plugin
* Make zyppnotify to use update-alternatives
* Drop unused yumnotify plugin
* Add dependency to python3-dnf-plugins-core for RHEL based
- Fix tests failures after "repo.saltproject.io" deprecation
- Fix error to stat '/root/.gitconfig' on gitfs
(bsc#1230944) (bsc#1234881) (bsc#1220905)
- Adapt to removal of hex attribute in pygit2 v1.15.0 (bsc#1230642)
- Enhance smart JSON parsing when garbage is present (bsc#1231605)
- Fix virtual grains for VMs running on Nutanix AHV (bsc#1234022)
- Fix issues running on Python 3.12 and 3.13
- Added:
* fix-deb822-nonetype-object-has-no-attribute-split-71.patch
* detect-openeuler-as-redhat-family-os.patch
* ensure-the-correct-crypt-module-is-loaded.patch
* implement-multiple-inventory-for-ansible.targets.patch
* make-x509-module-compatible-with-m2crypto-0.44.0.patch
* remove-deprecated-code-from-x509.certificate_managed.patch
* add-deb822-apt-source-format-support-692.patch
* remove-password-from-shell-after-functional-text-mat.patch
* repair-virt_query-outputter-655.patch
* make-_auth-calls-visible-with-master-stats-696.patch
* repair-fstab_present-test-mode-702.patch
* set-virtual-grain-in-podman-systemd-container-703.patch
* fixed-file-client-private-attribute-reference-on-sal.patch
* backport-batch-async-fixes-and-improvements-701.patch
* fix-tests-failures-after-repo.saltproject.io-depreca.patch
* fix-failed-to-stat-root-.gitconfig-issue-on-gitfs-bs.patch
* update-for-deprecation-of-hex-in-pygit2-1.15.0-and-a.patch
* enhance-find_json-garbage-filtering-bsc-1231605-688.patch
* fix-virtual-grains-for-vms-running-on-nutanix-ahv-bs.patch
* fix-issues-that-break-salt-in-python-3.12-and-3.13-6.patch
- python-setuptools
-
- Add patch CVE-2025-47273.patch to fix A path traversal
vulnerability.
(bsc#1243313, CVE-2025-47273, gh#pypa/setuptools@250a6d17978f)
- runc
-
- Update to runc v1.2.6. Upstream changelog is available from
<https://github.com/opencontainers/runc/releases/tag/v1.2.6>.
- Update to runc v1.2.5. Upstream changelog is available from
<https://github.com/opencontainers/runc/releases/tag/v1.2.5>.
- Update to runc v1.2.4. Upstream changelog is available from
<https://github.com/opencontainers/runc/releases/tag/v1.2.4>.
- Update runc.keyring to match upstream.
- Update to runc v1.2.3. Upstream changelog is available from
<https://github.com/opencontainers/runc/releases/tag/v1.2.3>.
- Update to runc v1.2.2. Upstream changelog is available from
<https://github.com/opencontainers/runc/releases/tag/v1.2.2>.
- Update to runc v1.2.1. Upstream changelog is available from
<https://github.com/opencontainers/runc/releases/tag/v1.2.1>.
- Update to runc v1.2.0. Upstream changelog is available from
<https://github.com/opencontainers/runc/releases/tag/v1.2.0>.
- Remove upstreamed patches.
- 0001-bsc1221050-libct-seccomp-patchbpf-rm-duplicated-code.patch
- 0002-bsc1221050-seccomp-patchbpf-rename-nativeArch-linuxA.patch
- 0003-bsc1221050-seccomp-patchbpf-always-include-native-ar.patch
- 0004-bsc1214960-nsenter-cloned_binary-remove-bindfd-logic.patch
- Update to runc v1.2.0~rc3. Upstream changelog is available from
<https://github.com/opencontainers/runc/releases/tag/v1.2.0-rc.3>.
Includes the patch for CVE-2024-45310. bsc#1230092
- sudo
-
- Fix a possilbe local privilege escalation via the --host option
[bsc#1245274, CVE-2025-32462]
- supportutils
-
- Changes to version 3.2.10
+ network.txt collect all firewalld zones (pr#233)
+ Collects gfs2 info (PED-11853, pr#235, pr#236)
+ Ignore tasks/threads to prevent collecting duplicate fd data in open_files (bsc#1230371, pr#237)
+ Added openldap2_5 support for SLES (pr#238)
+ Collects additional hawk details (pr#239)
+ Optimized filtering D/Z processes (pr#241)
+ Collect firewalld permanent configuration (pr#243)
+ ldap_info: support for multiple DBs and sanitize olcRootPW (bsc#1231838, pr#247)
+ Added dbus_info for dbus.txt (bsc#1222650, pr#248)
- Changes to version 3.2.9
+ Map running PIDs to RPM package owner aiding BPF program detection (bsc#1222896, bsc#1213291, PED-8221)
+ Supportconfig available in current distro (PED-7131)
+ Corrected display issues (bsc#1231396)
+ NFS takes too long, showmount times out (bsc#1231423)
+ Merged sle15 and master branches (bsc#1233726, PED-11669)
- timezone
-
- Update to 2025b:
* New zone for Aysén Region in Chile (America/Coyhaique) which
moves from -04/-03 to -03
- Refresh patches
* revert-philippines-historical-data.patch
* tzdata-china.diff
- vim
-
- Fix bsc#1228776 / CVE-2024-41965.
- Fix bsc#1239602 / CVE-2025-29768.
- Refresh patch:
vim-7.3-sh_is_bash.patch
- Update to 9.1.1406:
9.1.1406: crash when importing invalid tuple
9.1.1405: tests: no test for mapping with special keys in session file
9.1.1404: wrong link to Chapter 2 in new-tutor
9.1.1403: expansion of 'tabpanelopt' value adds wrong values
9.1.1402: multi-byte mappings not properly stored in session file
9.1.1401: list not materialized in prop_list()
9.1.1400: [security]: use-after-free when evaluating tuple fails
9.1.1399: tests: test_codestyle fails for auto-generated files
9.1.1398: completion: trunc does not follow Pmenu highlighting attributes
9.1.1397: tabpanel not correctly updated on :tabonly
9.1.1396: 'errorformat' is a global option
9.1.1395: search_stat not reset when pattern differs in case
9.1.1394: tabpanel not correctly redrawn on tabonly
9.1.1393: missing test for switching buffers and reusing curbuf
9.1.1392: missing patch number
9.1.1391: Vim does not have a vertical tabpanel
9.1.1390: style: more wrong indentation
9.1.1389: completion: still some issue when 'isexpand' contains a space
9.1.1388: Scrolling one line too far with 'nosmoothscroll' page scrolling
9.1.1387: memory leak when buflist_new() fails to reuse curbuf
9.1.1386: MS-Windows: some minor problems building on AARCH64
9.1.1385: inefficient loop for 'nosmoothscroll' scrolling
9.1.1384: still some problem with the new tutors filetype plugin
9.1.1383: completion: 'isexpand' option does not handle space char correct
9.1.1382: if_ruby: unused compiler warnings from ruby internals
9.1.1381: completion: cannot return to original text
9.1.1380: 'eventignorewin' only checked for current buffer
9.1.1379: MS-Windows: error when running evim when space in path
9.1.1378: sign without text overwrites number option
9.1.1377: patch v9.1.1370 causes some GTK warning messages
9.1.1376: quickfix dummy buffer may remain as dummy buffer
9.1.1375: [security]: possible heap UAF with quickfix dummy buffer
9.1.1374: completion: 'smartcase' not respected when filtering matches
9.1.1373: 'completeopt' checking logic can be simplified
9.1.1372: style: braces issues in various files
9.1.1371: style: indentation and brace issues in insexpand.c
9.1.1370: CI Tests favor GTK2 over GTK3
9.1.1369: configure still using autoconf 2.71
9.1.1368: GTK3 and GTK4 will drop numeric cursor support.
9.1.1367: too many strlen() calls in gui.c
9.1.1366: v9.1.1364 unintentionally changed sign.c and sound.c
9.1.1365: MS-Windows: compile warnings and too many strlen() calls
9.1.1364: style: more indentation issues
9.1.1363: style: inconsistent indentation in various files
9.1.1362: Vim9: type ignored when adding tuple to instance list var
9.1.1361: [security]: possible use-after-free when closing a buffer
9.1.1360: filetype: GNU Radio companion files are not recognized
9.1.1359: filetype: GNU Radio config files are not recognized
9.1.1358: if_lua: compile warnings with gcc15
9.1.1357: Vim incorrectly escapes tags with "[" in a help buffer
9.1.1356: Vim9: crash when unletting variable
9.1.1355: The pum_redraw() function is too complex
9.1.1354: tests: Test_terminalwinscroll_topline() fails on Windows
9.1.1353: missing change from v9.1.1350
9.1.1352: style: inconsistent indent in insexpand.c
9.1.1351: Return value of getcmdline() inconsistent in CmdlineLeavePre
9.1.1350: tests: typo in Test_CmdlineLeavePre_cabbr()
9.1.1349: CmdlineLeavePre may trigger twice
9.1.1348: still E315 with the terminal feature
9.1.1347: small problems with gui_w32.c
9.1.1346: missing out-of-memory check in textformat.c
9.1.1345: tests: Test_xxd_color2() test failure dump diff is misleading
9.1.1344: double free in f_complete_match() (after v9.1.1341)
9.1.1343: filetype: IPython files are not recognized
9.1.1342: Shebang filetype detection can be improved
9.1.1341: cannot define completion triggers
9.1.1340: cannot complete :filetype arguments
9.1.1339: missing out-of-memory checks for enc_to_utf16()/utf16_to_enc()
9.1.1338: Calling expand() interferes with cmdcomplete_info()
9.1.1337: Undo corrupted with 'completeopt' "preinsert" when switching buffer
9.1.1336: comment plugin does not support case-insensitive 'commentstring'
9.1.1335: Coverity complains about Null pointer dereferences
9.1.1334: Coverity complains about unchecked return value
9.1.1333: Coverity: complains about unutilized variable
9.1.1332: Vim9: segfault when using super within a lambda
9.1.1331: Leaking memory with cmdcomplete()
9.1.1330: may receive E315 in terminal
9.1.1329: cannot get information about command line completion
9.1.1328: too many strlen() calls in indent.c
9.1.1327: filetype: nroff detection can be improved
9.1.1326: invalid cursor position after 'tagfunc'
9.1.1325: tests: not checking error numbers properly
9.1.1324: undefined behaviour if X11 connection dies
9.1.1323: b:undo_ftplugin not executed when re-using buffer
9.1.1322: small delete register cannot paste multi-line correctly
9.1.1321: filetype: MS ixx and mpp files are not recognized
9.1.1320: filetype: alsoft config files are not recognized
9.1.1319: Various typos in the code, issue with test_inst_complete.vim
9.1.1318: tests: test_format fails
9.1.1317: noisy error when restoring folds from session fails
9.1.1316: missing memory allocation failure in os_mswin.c
9.1.1315: completion: issue with fuzzy completion and 'completefuzzycollect'
9.1.1314: max allowed string width too small
9.1.1313: compile warning about uninitialized value
9.1.1312: tests: Test_backupskip() fails when HOME is defined
9.1.1311: completion: not possible to limit number of matches
9.1.1310: completion: redundant check for preinsert effect
9.1.1309: tests: no test for 'pummaxwidth' with non-truncated "kind"
9.1.1308: completion: cannot order matches by distance to cursor
9.1.1307: make syntax does not reliably detect different flavors
9.1.1306: completion menu rendering can be improved
9.1.1305: completion menu active after switching windows/tabs
9.1.1304: filetype: some man files are not recognized
9.1.1303: missing out-of-memory check in linematch.c
9.1.1302: Coverity warns about using uninitialized value
9.1.1301: completion: cannot configure completion functions with 'complete'
9.1.1300: wrong detection of -inf
9.1.1299: filetype: mbsyncrc files are not recognized
9.1.1298: define_function() is too long
9.1.1297: Ctrl-D scrolling can get stuck
9.1.1296: completion: incorrect truncation logic
9.1.1295: clientserver: does not handle :stopinsert correctly
9.1.1294: gui tabline menu does not use confirm when closing tabs
9.1.1293: comment plugin does not handle 'exclusive' selection for comment object
9.1.1292: statusline not correctly evaluated
9.1.1291: too many strlen() calls in buffer.c
9.1.1290: tests: missing cleanup in test_filetype.vim
9.1.1289: tests: no test for matchparen plugin with WinScrolled event
9.1.1288: Using wrong window in ll_resize_stack()
9.1.1287: quickfix code can be further improved
9.1.1286: filetype: help files not detected when 'iskeyword' includes ":"
9.1.1285: Vim9: no error message for missing method after "super."
9.1.1284: not possible to configure pum truncation char
9.1.1283: quickfix stack is limited to 10 items
9.1.1282: Build and test failure without job feature
9.1.1281: extra newline output when editing stdin
9.1.1280: trailing additional semicolon in get_matches_in_str()
9.1.1279: Vim9: null_object and null_class are no reserved names
9.1.1278: Vim9: too long functions in vim9type.c
9.1.1277: tests: trailing comment char in test_popupwin
9.1.1276: inline word diff treats multibyte chars as word char
9.1.1275: MS-Windows: Not possible to pass additional flags to Make_mvc
9.1.1274: Vim9: no support for object<type> as variable type
9.1.1273: Coverity warns about using uninitialized value
9.1.1272: completion: in keyword completion Ctrl_P cannot go back after Ctrl_N
9.1.1271: filetype: Power Query files are not recognized
9.1.1270: missing out-of-memory checks in buffer.c
9.1.1269: completion: compl_shown_match is updated when starting keyword completion
9.1.1268: filetype: dax files are not recognized
9.1.1267: Vim9: no support for type list/dict<object<any>>
9.1.1266: MS-Windows: type conversion warnings
9.1.1265: tests: no tests for typing normal char during completion
9.1.1264: Vim9: error when comparing objects
9.1.1263: string length wrong in get_last_inserted_save()
9.1.1262: heap-buffer-overflow with narrow 'pummaxwidth' value
9.1.1261: No test for 'pummaxwidth' non-truncated items
9.1.1260: Hang when filtering buffer with NUL bytes
9.1.1259: some issues with comment package and tailing spaces
9.1.1258: regexp: max \U and \%U value is limited by INT_MAX
9.1.1257: Mixing vim_strsize() with mb_ptr2cells() in pum_redraw()
9.1.1256: if_python: duplicate tuple data entries
9.1.1255: missing test condition for 'pummaxwidth' setting
9.1.1254: need more tests for the comment plugin
9.1.1253: abort when closing window with attached quickfix data
9.1.1252: typos in code and docs related to 'diffopt' "inline:"
9.1.1251: if_python: build error with tuples and dynamic python
9.1.1250: cannot set the maximum popup menu width
9.1.1249: tests: no test that 'listchars' "eol" doesn't affect "gM"
9.1.1248: compile error when building without FEAT_QUICKFIX
9.1.1247: fragile setup to get (preferred) keys from key_name_entry
9.1.1246: coverity complains about some changes in v9.1.1243
9.1.1245: need some more tests for curly braces evaluation
9.1.1244: part of patch v9.1.1242 was wrong
9.1.1243: diff mode is lacking for changes within lines
9.1.1242: Crash when evaluating variable name
9.1.1241: wrong preprocessort indentation in term.c
9.1.1240: Regression with ic/ac text objects and comment plugin
9.1.1239: if_python: no tuple data type support
9.1.1238: wrong cursor column with 'set splitkeep=screen'
9.1.1237: Compile error with C89 compiler in term.c
9.1.1236: tests: test_comments leaves swapfiles around
9.1.1235: cproto files are outdated
9.1.1234: Compile error when SIZE_MAX is not defined
9.1.1233: Coverity warns about NULL pointer when triggering WinResized
9.1.1232: Vim script is missing the tuple data type
9.1.1231: filetype: SPA JSON files are not recognized
9.1.1230: inconsistent CTRL-C behaviour for popup windows
9.1.1229: the comment plugin can be improved
9.1.1228: completion: current position column wrong after got a match
9.1.1227: no tests for the comment package
9.1.1226: "shellcmdline" completion doesn't work with input()
9.1.1225: extra NULL check in VIM_CLEAR()
9.1.1224: cannot :put while keeping indent
9.1.1223: wrong translation used for encoding failures
9.1.1222: using wrong length for last inserted string
9.1.1221: Wrong cursor pos when leaving Insert mode just after 'autoindent'
9.1.1220: filetype: uv.lock file not recognized
9.1.1219: Strange error with wrong type for matchfuzzy() "camelcase"
9.1.1218: missing out-of-memory check in filepath.c
9.1.1217: tests: typos in test_matchfuzzy.vim
9.1.1216: Pasting the '.' register multiple times may not work
9.1.1215: Patch 9.1.1213 has some issues
9.1.1214: matchfuzzy() can be improved for camel case matches
9.1.1213: cannot :put while keeping indent
9.1.1212: too many strlen() calls in edit.c
9.1.1212: filetype: logrotate'd pacmanlogs are not recognized
9.1.1211: TabClosedPre is triggered just before the tab is being freed
9.1.1210: translation(ru): missing Russian translation for the new tutor
9.1.1209: colorcolumn not drawn after virtual text lines
9.1.1208: MS-Windows: not correctly restoring alternate screen on Win 10
9.1.1207: MS-Windows: build warning in filepath.c
9.1.1206: tests: test_filetype fails when a file is a directory
9.1.1205: completion: preinserted text not removed when closing pum
9.1.1204: MS-Windows: crash when passing long string to expand()
9.1.1203: matchparen keeps cursor on case label in sh filetype
9.1.1202: Missing TabClosedPre autocommand
9.1.1201: 'completefuzzycollect' does not handle dictionary correctly
9.1.1200: cmdline pum not cleared for input() completion
9.1.1199: gvim uses hardcoded xpm icon file
9.1.1198: [security]: potential data loss with zip.vim
9.1.1197: process_next_cpt_value() uses wrong condition
9.1.1196: filetype: config files for container tools are not recognized
9.1.1195: inside try-block: fn body executed with default arg undefined
9.1.1194: filetype: false positive help filetype detection
9.1.1193: Unnecessary use of STRCAT() in au_event_disable()
9.1.1192: Vim crashes with term response debug logging enabled
9.1.1191: tests: test for patch 9.1.1186 doesn't fail without the patch
9.1.1190: C indentation does not detect multibyte labels
9.1.1189: if_python: build error due to incompatible pointer types
9.1.1188: runtime(tera): tera support can be improved
9.1.1187: matchparen plugin wrong highlights shell case statement
9.1.1186: filetype: help files in git repos are not detected
9.1.1185: endless loop with completefuzzycollect and no match found
9.1.1184: Unnecessary use of vim_tolower() in vim_strnicmp_asc()
9.1.1083: "above" virtual text breaks cursorlineopt=number
9.1.1182: No cmdline completion for 'completefuzzycollect'
9.1.1181: Unnecessary STRLEN() calls in insexpand.c
9.1.1180: short-description
9.1.1179: too many strlen() calls in misc2.c
9.1.1178: not possible to generate completion candidates using fuzzy matching
9.1.1177: filetype: tera files not detected
- zypper
-
- BuildRequires: libzypp-devel >= 17.37.0.
- Use libzypp improvements for preload and mirror handling.
- xmlout.rnc: Update repo-element (bsc#1241463)
Add the "metalink" attribute and reflect that the "url" elements
list may in fact be empty, if no baseurls are defined in the
.repo files.
- man: update --allow-unsigned-rpm description.
Explain how to achieve the same for packages provided by
repositories.
- version 1.14.90
- Updated translations (bsc#1230267)
- version 1.14.89
- Do not double encode URL strings passed on the commandline
(bsc#1237587)
URLs passed on the commandline must have their special chars
encoded already. We just want to check and encode forgotten
unsafe chars like a blank. A '%' however must not be encoded
again.
- version 1.14.88
- Package preloader that concurrently downloads files. It's not yet
enabled per default. To enable the preview set ZYPP_CURL2=1 and
ZYPP_PCK_PRELOAD=1 in the environment. (#104)
- BuildRequires: libzypp-devel >= 17.36.4.
- version 1.14.87
- refresh: add --include-all-archs (fixes #598)
Future multi-arch repos may allow to download only those metadata
which refer to packages actually compatible with the systems
architecture. Some tools however want zypp to provide the full
metadata of a repository without filtering incompatible
architectures.
- info,search: add option to search and list Enhances
(bsc#1237949)
- version 1.14.86