suse-sles-12-sp5-byos-v20240612-hvm-ssd-x86

bind

- Security Fixes:
  * Validating DNS messages containing a lot of DNSSEC signatures
    could cause excessive CPU load, leading to a denial-of-service
    condition. This has been fixed. (CVE-2023-50387)
    [bsc#1219823, bind-CVE-2023-50387-CVE-2023-50868.patch]
  * Preparing an NSEC3 closest encloser proof could cause excessiv
    CPU load, leading to a denial-of-service condition. This has
    been fixed. (CVE-2023-50868)
    [bsc#1219826, bind-CVE-2023-50387-CVE-2023-50868.patch]
  * Parsing DNS messages with many different names could cause
    excessive CPU load. This has been fixed. (CVE-2023-4408)
    [bsc#1219851, bind-CVE-2023-4408.patch]

libfastjson

- fix CVE-2020-12762 integer overflow and out-of-bounds write via a
  large JSON file (bsc#1171479)
  add 0001-Fix-CVE-2020-12762.patch

nfs-utils

- Add 0208-mountd-add-support-for-case-insensitive-file-names.patch
  Fix for bsc#1221774 - support case-insensivtive file names

fdupes

- Apply "toctou-race-allows-arbitrary-file-deletion.patch" to fix a
  race condition that could be exploited to delete arbitrary files.
  This patch is a back-ported and simplified version of the commit
  https://github.com/adrianlopezroche/fdupes/commit/85680897148f1ac33b55418e00334116e419717f
  introduced upstream in release 2.2.0. [bsc#1200381]

kernel-default

- blacklist.conf: update blacklist
- commit 7f77e9d

- Fix backport of :  NFS: Fix error handling for O_DIRECT write
  scheduling (bsc#1224785).
- commit e968faa

- ALSA: usb-audio: Fix an out-of-bounds bug in
  __snd_usb_parse_audio_interface() (CVE-2022-48701 bsc#1223921).
- commit 6f798e9

- Update
  patches.suse/SUNRPC-fix-some-memleaks-in-gssx_dec_option_array.patch
  (git-fixes CVE-2024-27388 bsc#1223744).
- Update
  patches.suse/s390-Once-the-discipline-is-associated-with-the-device-de.patch
  (bsc#1141539 git-fixes CVE-2024-27054 bsc#1223819).
- Update
  patches.suse/scsi-qla2xxx-Fix-command-flush-on-cable-pull.patch
  (bsc1221816 CVE-2024-26931 bsc#1223627).
- Update patches.suse/scsi-qla2xxx-Fix-double-free-of-fcport.patch
  (bsc1221816 CVE-2024-26929 bsc#1223715).
- Update
  patches.suse/scsi-qla2xxx-Fix-double-free-of-the-ha-vp_map-pointe.patch
  (bsc1221816 CVE-2024-26930 bsc#1223626).
- commit daf9a87

- Update
  patches.suse/SUNRPC-fix-a-memleak-in-gss_import_v2_context.patch
  (git-fixes CVE-2023-52653 bsc#1223712).
- Update patches.suse/aio-fix-mremap-after-fork-null-deref.patch
  (git-fixes CVE-2023-52646 bsc#1223432).
- commit 793a07e

- Update
  patches.suse/i40e-Fix-kernel-crash-during-module-removal.patch
  (git-fixes CVE-2022-48688 bsc#1223953).
- Update
  patches.suse/ipv6-sr-fix-out-of-bounds-read-when-setting-HMAC-dat.patch
  (bsc#1211592 CVE-2023-2860 CVE-2022-48687 bsc#1223952).
- Update
  patches.suse/s390-dasd-fix-Oops-in-dasd_alias_get_start_dev-due-to-missing-pavgroup
  (git-fixes CVE-2022-48636 bsc#1223512).
- Update
  patches.suse/scsi-mpt3sas-Fix-use-after-free-warning.patch
  (git-fixes CVE-2022-48695 bsc#1223941).
- Update
  patches.suse/scsi-qla2xxx-Fix-memory-leak-in-__qlt_24xx_handle_ab.patch
  (bsc#1203935 CVE-2022-48650 bsc#1223509).
- commit cc68904

- Update
  patches.suse/net-dsa-fix-a-crash-if-get_sset_count-fails.patch
  (CVE-2021-47146 bsc#1221979 CVE-2021-47159 bsc#1221967).
- Update
  patches.suse/scsi-ufs-core-Improve-SCSI-abort-handling.patch
  (bsc#11222671 CVE-2021-47188 bsc#1222671).
- commit 5a613f4

- Fix references of
  patches.suse/net-dsa-fix-a-crash-if-get_sset_count-fails.patch
  This fix actually refers to different CVE and bug report. Fix the error.
- commit b797fc2

- drm/tegra: dsi: Add missing check for of_find_device_by_node (CVE-2023-52650 bsc#1223770)
- commit 52453b3

- fs: sysfs: Fix reference leak in sysfs_break_active_protection() (CVE-2024-26993 bsc#1223693)
- commit d5b445d

- usb: dwc2: Fix memory leak in dwc2_hcd_init.
- commit b68c644

- Input: ipaq-micro-keys - add error handling for devm_kmemdup.
- commit 8755dbb

- Input: xpad - add PXN V900 support.
- commit fbd5f3f

- Input: adxl34x - do not hardcode interrupt trigger type
  (git-fixes).
- commit 926a03d

- blacklist.conf: cleanup surpressing a warning
- commit 922f659

- Input: drv260x - sleep between polling GO bit (git-fixes).
- commit e9e8d04

- blacklist.conf: cleanup, not a fix, no code change
- commit 9cb5758

- blacklist.conf: driver not compiled
- commit a3fa3df

- blacklist.conf: driver not compiled
- commit 9dfacec

- blacklist.conf: driver not compiled
- commit 1aef6fe

- drm/amd/display: Add a dc_state NULL check in dc_state_release (CVE-2024-26948 bsc#1223664)
- commit 04ae1fa

- blacklist.conf: this patch enables features only
- commit b3e7c52

- blacklist.conf: false positive
- commit 88b62ef

- USB: core: Fix deadlock in usb_deauthorize_interface().
- commit ab56ab9

- USB: usb-storage: Prevent divide-by-0 error in
  isd200_ata_command (git-fixes).
- commit f114b54

- usb: roles: don't get/set_role() when usb_role_switch is
  unregistered.
- commit d121124

- usb: mon: Fix atomicity violation in mon_bin_vma_fault
  (git-fixes).
- commit 0605a2c

- blacklist.conf: not enabled
- commit 7aaa582

- blacklist.conf: kABI
- commit d241153

- drivers: usb: host: Fix deadlock in oxu_bus_suspend()
  (git-fixes).
- commit 4bfa035

- blacklist.conf: add two fuse commits from git-fixes
- commit 57c7ed8

- fuse: don't unhash root (bsc#1223954).
- commit 4838661

- tun: limit printing rate when illegal packet received by tun
  dev (bsc#1223745 CVE-2024-27013).
- net/mlx5e: Prevent deadlock while disabling aRFS (bsc#1223735
  CVE-2024-27014).
- nfp: flower: handle acti_netdevs allocation failure (bsc#1223827
  CVE-2024-27046).
- commit bb18705

- tipc: fix a possible memleak in tipc_buf_append (bsc#1221977
  CVE-2021-47162).
- commit 503e448

- media: usbtv: Remove useless locks in usbtv_video_free()
  (CVE-2024-27072 bsc#1223837).
- commit 784e536

- media: dvb-frontends: avoid stack overflow warnings with clang
  (CVE-2024-27075 bsc#1223842).
- commit 134dc5e

- media: ttpci: fix two memleaks in budget_av_attach
  (CVE-2024-27073 bsc#1223843).
- commit 13b28d2

- media: go7007: fix a memleak in go7007_load_encoder
  (CVE-2024-27074 bsc#1223844).
- commit 54185dc

- media: edia: dvbdev: fix a use-after-free (CVE-2024-27043
  bsc#1223824).
- commit 2732be2

- s390/mm: Fix storage key clearing for guest huge pages
  (git-fixes bsc#1223885).
- commit cd536ee

- s390/mm: Fix clearing storage keys for huge pages (git-fixes
  bsc#1223883).
- commit a8f7fd9

- media: v4l2-tpg: fix some memleaks in tpg_alloc (CVE-2024-27078
  bsc#1223781).
- commit 9ec09ea

- NTB: fix possible name leak in ntb_register_device()
  (CVE-2023-52652 bsc#1223686).
- commit ca5484d

- scsi: ufs: core: Improve SCSI abort handling (bsc#11222671,
  CVE-2021-47188).
- blacklist.conf: remove 3ff1f6b
- commit 9ba0cd1

- kABI workaround for cec_adapter (CVE-2024-23848 bsc#1219104).
- media: cec: core: avoid recursive cec_claim_log_addrs
  (CVE-2024-23848 bsc#1219104).
- media: cec: core: avoid confusing "transmit timed out" message
  (CVE-2024-23848 bsc#1219104).
- media: cec: cec-api: add locking in cec_release()
  (CVE-2024-23848 bsc#1219104).
- media: cec: cec-adap: always cancel work in cec_transmit_msg_fh
  (CVE-2024-23848 bsc#1219104).
- commit 6debb18

- media: cec: abort if the current transmit was canceled
  (CVE-2024-23848 bsc#1219104).
- commit 331f0d4

- cachefiles: fix memory leak in cachefiles_add_cache()
  (bsc#1222976 CVE-2024-26840).
- commit 7ab2bde

- net/bnx2x: Prevent access to a freed page in page_pool
  (bsc#1223049 CVE-2024-26859).
- commit d2c8d25

- spi: spi-fsl-dspi: Fix a resource leak in an error handling path
  (CVE-2021-47161 bsc#1221966).
- commit 86c2723

- amdkfd: use calloc instead of kzalloc to avoid integer overflow (CVE-2024-26817 bsc#1222812)
- commit e67f0f8

- blacklist.conf: Append 'drm/amdgpu: fix use-after-free bug'
- commit f438d4d

- Update
  patches.suse/smb3-fix-temporary-data-corruption-in-insert-range.patch
  (bsc#1190317 CVE-2022-48667 bsc#1223518).
- commit 91d9162

- Update
  patches.suse/smb3-fix-temporary-data-corruption-in-collapse-range.patch
  (bsc#1190317 CVE-2022-48668 bsc#1223516).
- commit 10d5c12

- net: fujitsu: fix potential null-ptr-deref (bsc#1221972
  CVE-2021-47149).
- commit 9abeb19

- tipc: skb_linearize the head skb when reassembling msgs
  (bsc#1221977 CVE-2021-47162).
- commit ba440f6

- net: dsa: fix a crash if ->get_sset_count() fails
  (CVE-2021-47146 bsc#1221979).
- commit 599796c

- mld: fix panic in mld_newpack() (CVE-2021-47146 bsc#1221979).
- commit e3d5602

- netfilter: nf_tables: disallow timeout for anonymous sets
  (CVE-2023-52620 bsc#1221825).
- commit f690b72

- net/ipv6: avoid possible UAF in ip6_route_mpath_notify()
  (CVE-2024-26852 bsc#1223057)
- commit 598df4c

- Update
  patches.suse/s390-Once-the-discipline-is-associated-with-the-device-de.patch
  (bsc#1141539 git-fixes).
- commit b8b94c0

- quota: Fix potential NULL pointer dereference (bsc#1223060
  CVE-2024-26878).
- commit 983d363

- do_sys_name_to_handle(): use kzalloc() to fix kernel-infoleak
  (bsc#1223198 CVE-2024-26901).
- commit 2f53016

- blk-mq: fix IO hang from sbitmap wakeup race (bsc#1222357
  CVE-2024-26671).
- commit ecdc50b

- ext4: avoid allocating blocks from corrupted group in
  ext4_mb_find_by_goal() (bsc#1222613 CVE-2024-26772).
- commit 3d3003a

- PM / devfreq: Fix buffer overflow in trans_stat_show
  (CVE-2023-52614 bsc#1221617).
- commit ad2729f

- net: ice: Fix potential NULL pointer dereference in
  ice_bridge_setlink() (bsc#1223051 CVE-2024-26855).
- geneve: make sure to pull inner header in geneve_rx()
  (bsc#1223058 CVE-2024-26857).
- ppp_async: limit MRU to 64K (bsc#1222379 CVE-2024-26675).
- ipvlan: Fix out-of-bound bugs caused by unset skb->mac_header
  (bsc#1223513 CVE-2022-48651).
- commit bc8fe89

- RDMA/mlx5: Fix fortify source warning while accessing Eth segment (bsc#1223203 CVE-2024-26907)
- commit 1c532b6

- regmap: prevent noinc writes from clobbering cache (bsc#1221162
  CVE-2023-52488).
- regmap: fix page selection for noinc writes (bsc#1221162
  CVE-2023-52488).
- regmap: fix page selection for noinc reads (bsc#1221162
  CVE-2023-52488).
- commit dc5bde0

- scripts/common-functions: cve2cvss fix CVE matching
  CVE-2023-4244:
  cvss:
  - version: 3.1
    score: 7
    vector: CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H
  CVE-2023-42445:
  cvss:
  - version: 3.1
    score: 6.8
    vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:N/A:H
  CVE-2023-4244 will mismatch. Thanks to Marcus for spotting!
- commit 1e0c847

- blacklist.conf: false positive
- commit 17b05a2

- usb: dwc2: check return value after calling
  platform_get_resource() (git-fixes).
- commit 831627d

- usb: dwc3: gadget: Ignore EP queue requests during bus reset
  (git-fixes).
- commit 270950d

- drm/amdgpu: validate the parameters of bo mapping operations more (CVE-2024-26922 bsc#1223315)
- commit 1a7d0fd

- i40e: Fix NULL ptr dereference on VSI filter sync (bsc#1222666
  CVE-2021-47184).
- commit 1ad3e1d

- usb: gadget: Fix issue with config_ep_by_speed function
  (git-fixes).
- commit e3f4200

- x86/boot: Ignore relocations in .notes sections in walk_relocs() too (bsc#1222624 CVE-2024-26816).
- commit b878a00

- x86, relocs: Ignore relocations in .notes section (bsc#1222624 CVE-2024-26816).
- commit d091560

- blacklist.conf: Add 246f80a0b17f8 ("sh: push-switch: Reorder cleanup operations to avoid use-after-free bug")
- commit 8e38656

- PM / devfreq: Synchronize devfreq_monitor_[start/stop]
  (CVE-2023-52635 bsc#1222294).
- commit faf3604

- Update
  patches.suse/Bluetooth-rfcomm-Fix-null-ptr-deref-in-rfcomm_check_-2535b848.patch
  (bsc#1219170 CVE-2024-22099 CVE-2024-26903 bsc#1223187).
- Update
  patches.suse/aoe-fix-the-potential-use-after-free-problem-in-aoec.patch
  (bsc#1218562 CVE-2023-6270 CVE-2024-26898 bsc#1223016).
- Update
  patches.suse/net-sched-act_mirred-don-t-override-retval-if-we-alr.patch
  (CVE-2024-26733 bsc#1222585 CVE-2024-26739 bsc#1222559).
- Update
  patches.suse/sr9800-Add-check-for-usbnet_get_endpoints.patch
  (git-fixes CVE-2024-26651 bsc#1221337).
- commit f0c3935

- Update
  patches.suse/msft-hv-2480-x86-hyperv-Fix-NULL-deref-in-set_hv_tscchange_cb-if-.patch
  (git-fixes CVE-2021-47217 bsc#1222836).
- Update
  patches.suse/net-dpaa2-eth-fix-use-after-free-in-dpaa2_eth_remove.patch
  (git-fixes CVE-2021-47204 bsc#1222787).
- Update patches.suse/scsi-advansys-Fix-kernel-pointer-leak.patch
  (git-fixes CVE-2021-47216 bsc#1222876).
- Update
  patches.suse/scsi-lpfc-Fix-use-after-free-in-lpfc_unreg_rpi-routi.patch
  (bsc#1192145 CVE-2021-47198 bsc#1222883).
- commit 1aa3f8e

- scripts/check-kernel-fix: hide add references hint
  We would like to handle reference updates in batches by mass-cve tooling
  so prevent potential races when people add references manually. Still
  show this in the verbose mode though.
- commit 44b9e4b

- scripts/install-git-hooks: Use --git-common-dir for $GIT_DIR
  This option works better for the repo via git-worktree
- commit 5ef3652

- bpf: Fix stackmap overflow check on 32-bit arches (bsc#1223035
  CVE-2024-26883).
- bpf: Fix hashtab overflow check on 32-bit arches (bsc#1223189
  CVE-2024-26884).
- bpf: Check for integer overflow when using roundup_pow_of_two()
  (bsc#1223035 CVE-2024-26883).
- commit 4249641

- scripts/check-kernel-fix: add -c CVE-XXXX-YYY support
  Older CVEs are not tracked by VULNS_GIT so give those a chance to use
  the same workflow by just giving the CVE number.
- commit eac99ec

- scripts/check-kernel-fix: integrate suse-get-maintainers
- commit fd66b07

- IB/hfi1: Fix a memleak in init_credit_return (CVE-2024-26839 bsc#1222975)
- commit 1b9aeec

- Refresh
  patches.suse/NFS-add-atomic_open-for-NFSv3-to-handle-O_TRUNC-corr.patch.
  Handle too-long file names.
- commit d3b61d6

- scripts/check-kernel-fix: improve branch output elimination
  If the merge origin branch is only missing references then it doesn't
  make sense to report missing patch or references in the target branch
  as it will get all from the merge origin.
- commit 5728eb5

- scripts/check-kernel-fix: improve branch output elimination
  ./scripts/check-kernel-fix CVE-2024-26805
  661779e1fcaf ("netlink: Fix kernel-infoleak-after-free in __skb_datagram_iter") merged v6.8-rc7~26^2~35
  Fixes: 1853c9496460 ("netlink, mmap: transform mmap skb into full skb on taps") merged v4.3-rc3~13^2~83
  Security fix for CVE-2024-26805 bsc#1222630 with CVSS 5.5
  ..............................
  ACTION NEEDED!
  SLE15-SP6-RT: MANUAL: backport 661779e1fcafe1b74b3f3fe8e980c1e207fea1fd (Fixes 1853c9496460)
  ALP-current-RT: MANUAL: backport 661779e1fcafe1b74b3f3fe8e980c1e207fea1fd (Fixes 1853c9496460)
  SLE15-SP5-RT: MANUAL: backport 661779e1fcafe1b74b3f3fe8e980c1e207fea1fd (Fixes 1853c9496460)
  SLE12-SP3-TD: MANUAL: backport 661779e1fcafe1b74b3f3fe8e980c1e207fea1fd (Fixes 1853c9496460)
  Note how *RT branches are printed even though SLE15-SP6 resp SLE15-SP5
  already have the fix. The current elimination logic only drops branches
  which are in the same state as their merge origin.
  mb_line processing is incorrect when that state differs. Fix that by
  looking up the state rather than play with sed and grep for identical
  output.
  With this patch applied
  [...]
  ACTION NEEDED!
  SLE12-SP3-TD: MANUAL: backport 661779e1fcafe1b74b3f3fe8e980c1e207fea1fd (Fixes 1853c9496460)
- commit 2e74804

- wifi: b43: Stop/wake correct queue in DMA Tx path when QoS is
  disabled (CVE-2023-52644 bsc#1222961).
- commit 411fc96

- clk: sunxi-ng: Unregister clocks/resets when unbinding
  (CVE-2021-47205 bsc#1222888).
- commit 67523b6

- ALSA: usb-audio: fix null pointer dereference on pointer cs_desc
  (CVE-2021-47211 bsc#1222869).
- commit a86f817

- Update
  patches.suse/scsi-lpfc-Fix-list_add-corruption-in-lpfc_drain_txq.patch
  (bsc#1190576 CVE-2021-47203 bsc#1222881).
- commit 2cb2a3c

- ALSA: gus: fix null pointer dereference on pointer block
  (CVE-2021-47207 bsc#1222790).
- commit 2c3256c

- wifi: mac80211: fix race condition on enabling fast-xmit
  (CVE-2024-26779 bsc#1222772).
- commit 5e02fca

- wifi: rt2x00: restart beacon queue when hardware reset
  (CVE-2023-52595 bsc#1221046).
- commit 671852b

- ceph: prevent use-after-free in encode_cap_msg() (bsc#1222503
  CVE-2024-26689).
- commit 09813ff

- blacklist.conf: Append 'drm/amdgpu: Fix variable 'mca_funcs' dereferenced before NULL check in 'amdgpu_mca_smu_get_mca_entry()''
- commit cde121c

- Update patches.suse/arp-Prevent-overflow-in-arp_req_get.patch
- fix build warning
- commit f10c34a

- kABI: regmap: Add regmap_noinc_read/write API (bsc#1221162
  CVE-2023-52488).
- commit fb0c9d2

- regmap: Add regmap_noinc_write API (bsc#1221162 CVE-2023-52488).
- regmap: Add regmap_noinc_read API (bsc#1221162 CVE-2023-52488).
- commit 60efad2

- usb: roles: fix NULL pointer issue when put module's reference
  (bsc#1222609 CVE-2024-26747).
- commit 73af327

- serial: sc16is7xx: convert from _raw_ to _noinc_ regmap
  functions for FIFO (bsc#1221162 CVE-2023-52488).
- commit a689f3e

- Refresh patches.kabi/cpufeatures-kabi-fix.patch (bsc#1222952)
  Don't call set_cpu_caps when calling set_cpu_bug, this causes problems
  with overlapping feature/bug ints. Directly call set_bit witht he
  correct parameters.
- commit 16e52e8

- scripts/check-kernel-fix: allow explicit git fixes
- scripts/common-functions:
  change -f from flat mode to -f fixes and use -t for the flat mode.
  It seems that the security team is not using the flat mode anyway so we
  might drop it eventually. Let's keep it to play around, it is a trivial
  code anyway.
  - f "sha"  now allows to specify explicit Fixes commit shas which would
  extend existing ones.
- commit 468ac9c

- md/raid5: fix atomicity violation in raid5_cache_count (bsc#1219169, CVE-2024-23307).
- commit c0dbc35

- ext4: avoid allocating blocks from corrupted group in
  ext4_mb_try_best_found() (bsc#1222618 CVE-2024-26773).
- commit 4110538

- thermal: Fix NULL pointer dereferences in of_thermal_ functions (CVE-2021-47202 bsc#1222878)
- commit 08cf92c

- md/raid5: fix atomicity violation in raid5_cache_count
  (bsc#1219169, CVE-2024-23307).
- commit 391774d

- fbdev: sis: Error out if pixclock equals zero (bsc#1222765 CVE-2024-26777)
- commit 283e632

- fbdev: savage: Error out if pixclock equals zero (bsc#1222770 CVE-2024-26778)
- commit c2c54cf

- drm: Don't unref the same fb many times by mistake due to deadlock handling (CVE-2023-52486 bsc#1221277).
- commit 5843530

- blacklist.conf: add one more PCI git-fixes
- commit 7baca5d

- IB/ipoib: Fix mcast list locking (CVE-2023-52587 bsc#1221082)
- commit 94cde16

- RDMA/IPoIB: Fix error code return in ipoib_mcast_join (bsc#1221082)
- commit 348c98c

- RDMA/srp: Do not call scsi_done() from srp_abort() (CVE-2023-52515 bsc#1221048)
- commit d5d3a97

- RDMA/qedr: Fix qedr_create_user_qp error flow (bsc#1222677 CVE-2024-26743)
- commit c49697b

- RDMA/srpt: Support specifying the srpt_service_guid parameter (bsc#1222449 CVE-2024-26744)
- commit 00d0add

- NFS: avoid spurious warning of lost lock that is being unlocked
  (bsc#1221791).
- commit 63a2e3f

- Update
  patches.suse/NFS-add-atomic_open-for-NFSv3-to-handle-O_TRUNC-corr.patch
  (bsc#1219847 bsc#1221862).
  Fix a NULL-pointer-deref bug.  Make the patch closer to the patch I sent
  upstream.
- commit 5f62723

- dm-crypt: don't modify the data when using authenticated
  encryption (bsc#1222720, CVE-2024-26763).
- commit 3e74213

- scsi: core: Fix scsi_mode_sense() buffer length handling
  (bsc#1222662 CVE-2021-47182).
- commit 09c6ab5

- scripts/check-kernel-fix: Do not report missing references for EB branches
  After discussion with Christian Hueller (EB branches maintainer) we have
  concluded that updating references to CVE fixes which are already in EB
  branches is not really adding any value so let's just not report them
- commit 0fddb67

- scripts/check-kernel-fix: require both bsc and cvss for security fixes
  cve2bsc DB might be out of sync. This could be annoying when dealing
  with freshly coming CVE bugs where the bsc# is known and proposed
  references addition miss the bug number.
  Enforce both bsc and CVSS data for security bugs and allow to
  provide/override the bug number by -b bsc#NUMBER parameter.
- commit cc2be7b

- dmaengine: ti: edma: Add some null pointer checks to the edma_probe (CVE-2024-26771 bsc#1222610)
- commit 01a7e9c

- netlink: Fix kernel-infoleak-after-free in __skb_datagram_iter
  (bsc#1222630 CVE-2024-26805).
- commit ad84c88

- Update
  patches.suse/gtp-fix-use-after-free-and-null-ptr-deref-in-gtp_gen.patch
  (bsc#1222428 CVE-2024-26793 CVE-2024-26754 bsc#1222632).
- commit b4d8fa6

- Update
  patches.suse/btrfs-fix-memory-ordering-between-normal-and-ordered-work-functions.patch
  (git-fixes CVE-2021-47189 bsc#1222706).
- commit d1ad6f0

- tty: tty_buffer: Fix the softlockup issue in flush_to_ldisc
  (bsc#1222669 CVE-2021-47185).
- commit 24cc88e

- PCI: pciehp: Add pciehp_set_indicators() to set both indicators
  (git-fixes).
- commit deaddb6

- PCI/ASPM: Reduce severity of common clock config message
  (git-fixes).
- commit 00c0986

- PCI/ASPM: Don't warn if already in common clock mode
  (git-fixes).
- commit 231253b

- PCI/ASPM: Factor out pcie_wait_for_retrain() (git-fixes).
- PCI/ASPM: Return 0 or -ETIMEDOUT from  pcie_retrain_link()
  (git-fixes).
- PCI: Rework pcie_retrain_link() wait loop (git-fixes).
- commit 4a0cd5a

- scripts/check-kernel-fix: bail out without CVSS score
  cve2cvss DB takes quite some time to sync and it is less confusing to
  enfore cache refresh or provide manual scoring (via -s) as that tends to
  be available in bugzilla most of the time.
- commit bdee7f8

- Refresh patches.kabi/cpufeatures-kabi-fix.patch.
- commit 70aa480

- Refresh patches.suse/x86-bhi-Add-BHI-mitigation-knob.patch.
  Check for bug presence with cpu_has_bug rather than cpu_has so that
  overlapping bug/feature bits are handled correctly
- commit ec98c66

- Update
  patches.suse/scsi-lpfc-Fix-link-down-processing-to-address-NULL-p.patch
  (bsc#1192145 CVE-2021-47183 bsc#1222664).
- commit b599f2b

- Update
  patches.suse/usb-musb-tusb6010-check-return-value-after-calling-p.patch
  (git-fixes CVE-2021-47181 bsc#1222660).
- commit a0f1eaa

- scripts/common-functions: cve2sha: fix multiline output from vulns DB
  $ ./scripts/check-kernel-fix -s 5.5 CVE-2021-47181
  failes with uknown sha for the given CVE because vulns.git cve_search
  returns unexpected multi-line output
  $ scripts/cve_search CVE-2021-47181
  CVE-2021-47181 is assigned to git id 14651496a3de6807a17c310f63c894ea0c5d858e
  f08adf5add9a071160c68bb2a61d697f39ab0758
  Filter out the first line only to handle that
- commit 970f746

- tty: n_gsm: require CAP_NET_ADMIN to attach N_GSM0710 ldisc
  (bsc#1222619).
- commit 94fc6e9

- PCI: Mark 3ware-9650SE Root Port Extended Tags as broken
  (git-fixes).
- PCI/DPC: Print all TLP Prefixes, not just the first (git-fixes).
- PCI/MSI: Prevent MSI hardware interrupt number truncation
  (git-fixes).
- PCI/sysfs: Protect driver's D3cold preference from user space
  (git-fixes).
- PCI/ASPM: Use RMW accessors for changing LNKCTL (git-fixes).
- PCI: pciehp: Use RMW accessors for changing LNKCTL (git-fixes).
- PCI: Make link retraining use RMW accessors for changing LNKCTL
  (git-fixes).
- PCI: Add locking to RMW PCI Express Capability Register
  accessors (git-fixes).
- kABI: PCI: Add locking to RMW PCI Express Capability Register
  accessors (kabi).
- PCI: qcom: Use DWC helpers for modifying the read-only DBI
  registers (git-fixes).
- PCI: qcom: Disable write access to read only registers for IP
  v2.3.3 (git-fixes).
- PCI: Add function 1 DMA alias quirk for Marvell 88SE9235
  (git-fixes).
- PCI: pciehp: Cancel bringup sequence if card is not present
  (git-fixes).
- PCI/ASPM: Avoid link retraining race (git-fixes).
- commit 5d813c6

- arp: Prevent overflow in arp_req_get() (CVE-2024-26733
  bsc#1222585).
- commit 64afd8b

- net/sched: act_mirred: don't override retval if we already
  lost the skb (CVE-2024-26733 bsc#1222585).
- commit ec837ad

- blacklist.conf: update blacklist
- commit f1ca6cb

- PCI/ASPM: Disable ASPM on MFD function removal to avoid
  use-after-free (git-fixes).
- PCI: pciehp: Fix AB-BA deadlock between reset_lock and
  device_lock (git-fixes).
- PCI: switchtec: Return -EFAULT for copy_to_user() errors
  (git-fixes).
- PCI: Avoid FLR for AMD FCH AHCI adapters (git-fixes).
- PCI/IOV: Enlarge virtfn sysfs name buffer (git-fixes).
- PCI: hotplug: Allow marking devices as disconnected during
  bind/unbind (git-fixes).
- PCI: dwc: Add unroll iATU space support to dw_pcie_disable_atu()
  (git-fixes).
- PCI: Add ACS quirk for Broadcom BCM5750x NICs (git-fixes).
- commit 60d94f2

- PCI: endpoint: Don't stop controller when unbinding endpoint
  function (git-fixes).
- PCI: qcom: Fix unbalanced PHY init on probe errors (git-fixes).
- PCI: Avoid pci_dev_lock() AB/BA deadlock with
  sriov_numvfs_store() (git-fixes).
- PCI/PM: Power up all devices during runtime resume (git-fixes).
- PCI/AER: Clear MULTI_ERR_COR/UNCOR_RCV bits (git-fixes).
- PCI: aardvark: Fix setting MSI address (git-fixes).
- PCI: aardvark: Fix support for MSI interrupts (git-fixes).
- commit fd2813d

- Refresh
  patches.suse/Bluetooth-btsdio-fix-use-after-free-bug-in-btsdio_re.patch.
  Add alternate ID for stable
- commit 38c4e25

- Bluetooth: btqcomsmd: Fix command timeout after setting BD
  address (git-fixes).
- commit de57587

- Bluetooth: hci_intel: Add check for platform_driver_register
  (git-fixes).
- commit 0e58b3a

- Bluetooth: btqca: Introduce HCI_EV_VENDOR and use it
  (git-fixes).
- commit 7e74176

- Bluetooth: btqca: Fixed a coding style error (git-fixes).
- commit 0f83a52

- blacklist.conf: false positive (introduced v5.14, not backported)
- commit e867532

- ext4: fix double-free of blocks due to wrong extents moved_len
  (bsc#1222422 CVE-2024-26704).
- commit da029ac

- Refresh
  patches.suse/bpf-sockmap-Prevent-lock-inversion-deadlock-in-map-d.patch.
- commit 6490813

- gtp: fix use-after-free and null-ptr-deref in gtp_newlink()
  (bsc#1222428 CVE-2024-26793).
- gtp: fix use-after-free and null-ptr-deref in
  gtp_genl_dump_pdp() (bsc#1222428 CVE-2024-26793).
- commit 9c6b7d6

- scripts/git_sort/git_sort.py:
  Add Len Brown's kernel subtree
- commit 3e92416

- nfsd: Fix error cleanup path in nfsd_rename() (bsc#1221044
  CVE-2023-52591).
- commit b8b869c

- usb: musb: Modify the "HWVers" register address (git-fixes).
- commit d99cd58

- blacklist.conf: This is a feature, not a fix
- commit f6334d7

- sr9800: Add check for usbnet_get_endpoints (git-fixes).
- commit 24ceaa4

- blacklist.conf: add unneeded PCI git-fixes
- commit beed85d

- Refresh patches.kabi/cpufeatures-kabi-fix.patch.
  Fix aliasing problems if we have an extended capability which aliases a
  non-extended bug bit. The fix is to always ensure that bug bits related
  functionality doesn't use the "generic" cap functionality.
- commit c674af2

- Update
  patches.suse/KVM-s390-vsie-fix-race-during-shadow-creation.patch
  (git-fixes bsc#1220613 CVE-2023-52639 bsc#1222300).
- Update
  patches.suse/netfilter-nftables-exthdr-fix-4-byte-stack-OOB-write.patch
  (CVE-2023-4881 bsc#1215221 CVE-2023-52628 bsc#1222117).
- commit 5564fa1

- mass-cve: Case insensitive references detection
  Only add reference when it is new (regardless of case).
- commit 9944f70

- scripts/check-kernel-fix: implement -s CVSS option
- commit b759632

- scripts/check-kernel-fix: clarify no CVSS assignment
- commit 3d658ea

- mass-cve: Fix path to git repos
  Specifying only --git-dir ends up with checking out files to CWD and to
  under $VULNS_GIT. `git -C` should fix all various setups (worktrees or
  not).
- commit ad32354

- nfsd: Fix error cleanup path in nfsd_rename() (git-fixes).
- commit c8d258d

- scripts/check-kernel-fix: Handled unknown branches more gracefully
- scripts/common-functions:
  This doesn't happen often. Usually when branches.conf doesn't match the
  kernel-source.git tree because of renaming. git fetch should fix those
  so be more helpuful to poor users.
- commit 7d296f5

- scripts/common-functions: silenc errors when forcibly removing cache files
- commit f76f1c4

- x86/bhi: Mitigate KVM by default (bsc#1217339 CVE-2024-2201).
- commit 7079142

- scripts/common-functions: call out upstream patches with no Fixes tag
- commit 4d33f71

- x86/bhi: Add BHI mitigation knob (bsc#1217339 CVE-2024-2201).
- Update config files.
- commit 41d6371

- x86/bhi: Enumerate Branch History Injection (BHI) bug (bsc#1217339 CVE-2024-2201).
- commit 2432a6f

- x86/bhi: Define SPEC_CTRL_BHI_DIS_S (bsc#1217339 CVE-2024-2201).
- commit fe53768

- x86/bhi: Add support for clearing branch history at syscall entry (bsc#1217339 CVE-2024-2201).
- Refresh patches.kabi/cpufeatures-kabi-fix.patch.
- commit 955ab56

- Fixup NULL ptr dereference due to mistake in backporting in
  patches.suse/ext2-Avoid-reading-renamed-directory-if-parent-does-.patch.
- commit 55001e0

- Delete
  patches.suse/x86-bugs-Fix-the-SRSO-mitigation-on-Zen3-4.patch.
  the kernel fails to boot on x86:
  [    0.048461] MDS: Vulnerable: Clear CPU buffers attempted, no microcode
  [    0.048698] MMIO Stale Data: Unknown: No mitigations
  qemu-system-x86_64: terminating on signal 15 from pid 42034 (timeout)
- commit 035c88f

- x86/cpufeature: Add missing leaf enumeration (bsc#1217339 CVE-2024-2201).
- commit 248bb60

- Update references
- commit 1bab65d

- scsi: lpfc: Fix a possible data race in
  lpfc_unregister_fcf_rescan() (bsc#1219618 CVE-2024-24855).
- commit 6004b44

- scripts/check-kernel-fix: document LINUX_GIT requirement
- scripts/common-functions:
- commit 4f88751

- media: xc4000: Fix atomicity violation in xc4000_get_frequency
  (git-fixes bsc#1219623 CVE-2024-24861).
- commit ad0b314

- scripts/check-kernel-fix: add flat mode
  Talked to Robert Frohl from the security team and he exaplained that
  they would appreciate a mode which doesn't do any filtering because
  the team has to track even those products which are not required to
  publish fixes. -f should achieve that
- commit dfb0710

- x86/bugs: Fix the SRSO mitigation on Zen3/4 (git-fixes).
- commit 8032e89

- mass-cve: Hide unimportant make messages
  Hide data preprocessing messages, preserve messages that relate to git
  operations.
- commit d5ea4b9

- bpf, sockmap: Prevent lock inversion deadlock in map delete elem
  (bsc#1209657 CVE-2023-0160).
- commit 40497a8

- bpf, sockmap: Fix preempt_rt splat when using raw_spin_lock_t
  (git-fixes).
- commit 3c6384f

- bnx2x: Fix enabling network interfaces without VFs (git-fixes).
- commit b60bea3

- ethernet: myri10ge: Fix missing error code in myri10ge_probe()
  (git-fixes).
- commit 71a7d56

- bnx2x: Fix missing error code in bnx2x_iov_init_one()
  (git-fixes).
- commit 813cb9c

- net: macb: ensure the device is available before accessing
  GEMGXL control registers (git-fixes).
- commit 1742349

- net/qla3xxx: fix schedule while atomic in ql_sem_spinlock
  (git-fixes).
- commit 8e475cb

- blacklist.conf: update blacklist
- commit a7a5329

- netfilter: nf_tables: disallow anonymous set with timeout flag
  (CVE-2024-26642 bsc#1221830).
- commit b3d18fd

- netfilter: ctnetlink: fix possible refcount leak in
  ctnetlink_create_conntrack() (CVE-2023-7192 bsc#1218479).
- commit 0774a95

- net: allwinner: Fix some resources leak in the error handling path of the probe and in the remove function (git-fixes).
- commit d464181

- ethernet: ucc_geth: fix definition and size of ucc_geth_tx_global_pram (git-fixes).
- commit 6895e10

- net/mlx5: Properly convey driver version to firmware (git-fixes).
- commit 09bc4c8

- net: stmmac: free tx skb buffer in stmmac_resume() (git-fixes).
- commit 7769206

- tun: honor IOCB_NOWAIT flag (git-fixes).
- commit 1f0149b

- atl1e: fix error return code in atl1e_probe() (git-fixes).
- commit da6dd80

- atl1c: fix error return code in atl1c_probe() (git-fixes).
- commit 56e0459

- net: atheros: switch from 'pci_' to 'dma_' API (git-fixes).
- commit 47ce14b

- blacklist.conf: update blacklist
- commit dc2abcd

- mass-cve: Fail nicely if env is not set
- commit 7d0c68a

- mass-cve: Invalidate cache when scanned branch is updated
- commit cf71c00

- README.BRANCH: Remove copy of branch name
- commit 26f4895

- usb: dwc3: core: Do not perform GCTL_CORE_SOFTRESET during
  bootup (bsc#1220628 CVE-2021-46941).
- commit ebce255

- usb: dwc3: core: balance phy init and exit (bsc#1220628
  CVE-2021-46941).
- commit 8f693d2

- USB: usbfs: Don't WARN about excessively large memory
  allocations.
- commit 8172f18

- ipv6: init the accept_queue's spinlocks in inet6_create
  (bsc#1221293 CVE-2024-26614).
- commit 6bea6a5

- tcp: make sure init the accept_queue's spinlocks once
  (bsc#1221293 CVE-2024-26614).
- commit 800aa0a

- userfaultfd: release page in error path to avoid BUG_ON
  (CVE-2021-46988 bsc#1220706).
- commit bcafeec

- powerpc/mm: Fix null-pointer dereference in pgtable_cache_add
  (CVE-2023-52607 bsc#1221061).
- commit af6f33a

- mass-cve: Lazily pull from vulns DB git
- commit cf62cc6

- mass-cve: Allow calling make -f Makefile from anywhere
- commit 96ccd46

- mass-cve: Add README
- commit d223050

- Update
  patches.suse/net-nfc-llcp-Add-lock-when-modifying-device-list.patch
  (git-fixes CVE-2023-52524 bsc#1220927).
- Update
  patches.suse/net-usb-smsc75xx-Fix-uninit-value-access-in-__smsc75.patch
  (git-fixes CVE-2023-52528 bsc#1220843).
- Update
  patches.suse/nvmet-tcp-Fix-a-kernel-panic-when-host-sends-an-inva.patch
  (bsc#1217987 bsc#1217988 bsc#1217989 CVE-2023-6535 CVE-2023-6536
  CVE-2023-6356 CVE-2023-52454 bsc#1220320).
- Update
  patches.suse/ocfs2-Avoid-touching-renamed-directory-if-parent-doe.patch
  (bsc#1221044 CVE-2023-52591 CVE-2023-52590 bsc#1221088).
- Update
  patches.suse/ravb-Fix-use-after-free-issue-in-ravb_tx_timeout_wor.patch
  (bsc#1212514 CVE-2023-35827 CVE-2023-52509 bsc#1220836).
- Update
  patches.suse/x86-srso-fix-sbpb-enablement-for-spec_rstack_overflow-off.patch
  (git-fixes CVE-2023-52575 bsc#1220871).
- commit 2258ead

- Update patches.suse/mmc-moxart_remove-Fix-UAF.patch (bsc#1194516
  CVE-2022-0487 CVE-2022-48626 bsc#1220366).
- commit 10fc152

- Update
  patches.suse/0019-dm-rq-fix-double-free-of-blk_mq_tag_set-in-dev-remov.patch
  (git fixes CVE-2021-46938 bsc#1220554).
- Update
  patches.suse/ACPI-custom_method-fix-potential-use-after-free-issu.patch
  (git-fixes CVE-2021-46966 bsc#1220572).
- Update
  patches.suse/ARM-footbridge-fix-PCI-interrupt-mapping.patch
  (git-fixes CVE-2021-46909 bsc#1220442).
- Update
  patches.suse/IB-qib-Fix-memory-leak-in-qib_user_sdma_queue_pkts.patch
  (git-fixes CVE-2021-47104 bsc#1220960).
- Update
  patches.suse/NFC-nci-fix-memory-leak-in-nci_allocate_device.patch
  (git-fixes CVE-2021-47180 bsc#1221999).
- Update
  patches.suse/NFS-Don-t-corrupt-the-value-of-pg_bytes_written-in-n.patch
  (git-fixes CVE-2021-47166 bsc#1221998).
- Update
  patches.suse/NFS-Fix-an-Oopsable-condition-in-__nfs_pageio_add_re.patch
  (git-fixes CVE-2021-47167 bsc#1221991).
- Update
  patches.suse/NFS-fix-an-incorrect-limit-in-filelayout_decode_layo.patch
  (git-fixes CVE-2021-47168 bsc#1222002).
- Update
  patches.suse/NFSv4-Fix-a-NULL-pointer-dereference-in-pnfs_mark_ma.patch
  (git-fixes CVE-2021-47179 bsc#1222001).
- Update
  patches.suse/asix-fix-uninit-value-in-asix_mdio_read.patch
  (git-fixes CVE-2021-47101 bsc#1220987).
- Update
  patches.suse/bnxt_en-Fix-RX-consumer-index-logic-in-the-error-pat.patch
  (git-fixes CVE-2021-47015 bsc#1220794).
- Update
  patches.suse/btrfs-fix-race-between-transaction-aborts-and-fsyncs.patch
  (bsc#1186441 CVE-2021-46958 bsc#1220521).
- Update
  patches.suse/cifs-Return-correct-error-code-from-smb2_get_enc_key.patch
  (git-fixes CVE-2021-46960 bsc#1220528).
- Update
  patches.suse/crypto-qat-ADF_STATUS_PF_RUNNING-should-be-set-after.patch
  (git-fixes CVE-2021-47056 bsc#1220769).
- Update
  patches.suse/cxgb4-avoid-accessing-registers-when-clearing-filter.patch
  (bsc#1136345 jsc#SLE-4681 CVE-2021-47138 bsc#1221934).
- Update patches.suse/drm-amdgpu-Fix-a-use-after-free.patch
  (git-fixes CVE-2021-47142 bsc#1221952).
- Update
  patches.suse/drm-meson-fix-shutdown-crash-when-component-not-prob.patch
  (git-fixes CVE-2021-47165 bsc#1221965).
- Update
  patches.suse/ethernet-enic-Fix-a-use-after-free-bug-in-enic_hard_.patch
  (bsc#1113431 CVE-2021-46998 bsc#1220625).
- Update
  patches.suse/ext4-fix-bug-on-in-ext4_es_cache_extent-as-ext4_spli.patch
  (bsc#1187408 CVE-2021-47117 bsc#1221575).
- Update
  patches.suse/ext4-fix-memory-leak-in-ext4_fill_super.patch
  (bsc#1187409 CVE-2021-47119 bsc#1221608).
- Update
  patches.suse/gve-Add-NULL-pointer-checks-when-freeing-irqs.patch
  (bsc#1176940 CVE-2021-47141 bsc#1221949).
- Update
  patches.suse/i2c-i801-Don-t-generate-an-interrupt-on-bus-reset.patch
  (git-fixes CVE-2021-47153 bsc#1221969).
- Update patches.suse/iommu-vt-d-fix-sysfs-leak-in-alloc_iommu
  (bsc#1189272 CVE-2021-47177 bsc#1221997).
- Update
  patches.suse/ipmi-Fix-UAF-when-uninstall-ipmi_si-and-ipmi_msghand.patch
  (git-fixes CVE-2021-47100 bsc#1220985).
- Update
  patches.suse/kvm-destroy-i-o-bus-devices-on-unregister-failure-after_-sync-ing-srcu
  (CVE-2020-36312 bsc#1184509 CVE-2021-47061 bsc#1220745).
- Update
  patches.suse/kvm-stop-looking-for-coalesced-mmio-zones-if-the-bus-is-destroyed
  (CVE-2020-36312 bsc#1184509 CVE-2021-47060 bsc#1220742).
- Update
  patches.suse/md-raid1-properly-indicate-failure-when-ending-a-fai.patch
  (bsc#1185680 CVE-2021-46950 bsc#1220662).
- Update
  patches.suse/misc-uss720-fix-memory-leak-in-uss720_probe.patch
  (git-fixes CVE-2021-47173 bsc#1221993).
- Update
  patches.suse/msft-hv-2305-Drivers-hv-vmbus-Use-after-free-in-__vmbus_open.patch
  (git-fixes CVE-2021-47049 bsc#1220692).
- Update
  patches.suse/msft-hv-2316-uio_hv_generic-Fix-a-memory-leak-in-error-handling-p.patch
  (git-fixes CVE-2021-47071 bsc#1220846).
- Update
  patches.suse/msft-hv-2317-uio_hv_generic-Fix-another-memory-leak-in-error-hand.patch
  (git-fixes CVE-2021-47070 bsc#1220829).
- Update
  patches.suse/mtd-require-write-permissions-for-locking-and-badblo.patch
  (git-fixes CVE-2021-47055 bsc#1220768).
- Update
  patches.suse/nbd-Fix-NULL-pointer-in-flush_workqueue-79eb.patch
  (git-fixes CVE-2021-46981 bsc#1220611).
- Update
  patches.suse/net-fec-fix-the-potential-memory-leak-in-fec_enet_in.patch
  (git-fixes CVE-2021-47150 bsc#1221973).
- Update
  patches.suse/net-nfc-fix-use-after-free-llcp_sock_bind-connect.patch
  (CVE-2021-23134 bsc#1186060 CVE-2021-47068 bsc#1220739).
- Update
  patches.suse/net-smc-remove-device-from-smcd_dev_list-after-failed-device_add
  (git-fixes CVE-2021-47143 bsc#1221988).
- Update
  patches.suse/net-usb-fix-memory-leak-in-smsc75xx_bind.patch
  (git-fixes CVE-2021-47171 bsc#1221994).
- Update patches.suse/ocfs2-fix-data-corruption-by-fallocate.patch
  (bsc#1187412 CVE-2021-47114 bsc#1221548).
- Update
  patches.suse/pid-take-a-reference-when-initializing-cad_pid.patch
  (bsc#1114648 CVE-2021-47118 bsc#1221605).
- Update
  patches.suse/platform-x86-dell-smbios-wmi-Fix-oops-on-rmmod-dell_.patch
  (git-fixes CVE-2021-47073 bsc#1220850).
- Update
  patches.suse/powerpc-64s-Fix-crashes-when-toggling-entry-flush-ba.patch
  (bsc#1177666 git-fixes bsc#1186460 ltc#192531 CVE-2021-46990
  bsc#1220743).
- Update
  patches.suse/powerpc-64s-Fix-pte-update-for-kernel-memory-on-radi.patch
  (bsc#1055117 git-fixes CVE-2021-47034 bsc#1220687).
- Update
  patches.suse/scsi-lpfc-Fix-null-pointer-dereference-in-lpfc_prep_.patch
  (bsc#1182574 CVE-2021-47045 bsc#1220640).
- Update
  patches.suse/scsi-qla2xxx-Fix-crash-in-qla2xxx_mqueuecommand.patch
  (bsc#1185491 CVE-2021-46963 bsc#1220536).
- Update patches.suse/scsi-qla2xxx-Reserve-extra-IRQ-vectors.patch
  (bsc#1185491 CVE-2021-46964 bsc#1220538).
- Update
  patches.suse/serial-rp2-use-request_firmware-instead-of-request_f.patch
  (git-fixes CVE-2021-47169 bsc#1222000).
- Update
  patches.suse/tracing-Restructure-trace_clock_global-to-never-block.patch
  (git-fixes CVE-2021-46939 bsc#1220580).
- Update
  patches.suse/vsock-virtio-free-queued-packets-when-closing-socket.patch
  (git-fixes CVE-2021-47024 bsc#1220637).
- Update
  patches.suse/x86-kvm-Disable-kvmclock-on-all-CPUs-on-shutdown.patch
  (bsc#1185308 CVE-2021-47110 bsc#1221532).
- Update
  patches.suse/x86-kvm-Teardown-PV-features-on-boot-CPU-as-well.patch
  (bsc#1185308 CVE-2021-47112 bsc#1221541).
- commit fa763cd

- Update
  patches.suse/netlabel-fix-out-of-bounds-memory-accesses.patch
  (networking-stable-19_03_07 CVE-2019-25160 bsc#1220394).
- commit cfd1daa

- scripts/check-kernel-fix: print summary of the commit to check
- commit b73a330

- scripts/check-kernel-fix: be more conservative when proposing branches to backport to non CVE patches
  If a kernel fix doesn't have any CVE assigned (e.g. a regular git-fixes
  candidate) then do not propose branches that have higher bar to accept
  changes (e.g. LTSS branches)
- commit 5988064

- scripts/common-functions: sha_in_upstream: do not assume origin/HEAD points to origin/master
- commit ac1161f

- scripts/cve_tools/cve2metadata.sh: clarify the error message
- commit b222dc5

- scripts/common-functions: sha_in_upstream refinements.
- commit ef93b37

- IB/hfi1: Fix bugs with non-PAGE_SIZE-end multi-iovec user SDMA requests (bsc#1220445 CVE-2023-52474)
- commit 71ecb14

- scripts/common-functions: for_each_build_branch: do not consider stable and slowroll branches
- commit da10c28

- scripts/check-kernel-fix: Print RUN command with current references helper
- commit 72f7f72

- s390/vtime: fix average steal time calculation (git-fixes
  bsc#1221953).
- commit ccf7a1f

- s390/ptrace: handle setting of fpc register correctly
  (CVE-2023-52598 bsc#1221060 git-fixes).
- commit 0d179a3

- scripts/check-kernel-fix: refine the help message
- commit 339f56a

- scripts/check-kernel-fix: unify VULNS_GIT variable
- scripts/common-functions:
- commit 2d74673

- mass-cve: Exclude partial commits
  Commit references with various decorations like '(partial)' are treated
  conservatively, i.e. do not assume we have a functional patch.
- commit 0391bef

- scripts/check-kernel-fix: add support for -r (metadata refresh)
- scripts/common-functions:
- commit c47714a

- scripts/check-kernel-fix: drop -s mode (not really useful)
- commit 837a2ae

- scripts/check-kernel-fix: drop -c parameter and search cve branches by default
- scripts/common-functions:
- commit 5031df0

- scripts/check-kernel-fix: improve help message
- commit 426748a

- scripts/check-kernel-fix: Make the check of CVSS affected branches more reliable
  Make the check of branches ignoring lower CVSS score more reliable
  by the checking matching also the dash.
  Also rename the function to make more clear what success means.
- commit 9a730a8

- scripts/check-kernel-fix: Remove unused check_branch_references function
  It did not provide any helpful information
- commit 9be7356

- wifi: ath10k: fix NULL pointer dereference in
  ath10k_wmi_tlv_op_pull_mgmt_tx_compl_ev() (bsc#1218336
  CVE-2023-7042).
- commit 1463c4a

- scripts/cve_tools/cve2metadata.sh: s@VULNS_GIT_PATH@VULNS_GIT@
  to be more in line with git tree env vars
- commit e3ddb5d

- scripts/check-kernel-fix: add cvss based filtering
  TODO GA kernels are not settled yet
- commit 5ea28e0

- scripts/common-functions: cope with redirects in fetch_cache
- commit 0b72687

- scripts/sequence-patch.sh: add missing template to find -exec
  Recent fix for space handling lacks the '{}' template in find -exec command
  so that this command fails and no chmod is executed.
  Fixes: 622d2088f344 ("scripts/sequence-patch.sh: handle spaces in file names")
- commit 26808f8

- x86/CPU/AMD: Update the Zenbleed microcode revisions (git-fixes).
- commit 11a703b

- kabi fix for pNFS: Fix the pnfs block driver's calculation of
  layoutget size (git-fixes).
- commit 188e451

- pNFS: Fix the pnfs block driver's calculation of layoutget size
  (git-fixes).
- NFS: Fix O_DIRECT locking issues (git-fixes).
- NFS: Fix direct WRITE throughput regression (git-fixes).
- commit 53dafcd

- NFS: Fix an off by one in root_nfs_cat() (git-fixes).
- net: sunrpc: Fix an off by one in rpc_sockaddr2uaddr()
  (git-fixes).
- SUNRPC: fix a memleak in gss_import_v2_context (git-fixes).
- NFS: More O_DIRECT accounting fixes for error paths (git-fixes).
- NFS: Fix error handling for O_DIRECT write scheduling
  (git-fixes).
- nfs: only issue commit in DIO codepath if we have uncommitted
  data (git-fixes).
- NFS: Fix a request reference leak in
  nfs_direct_write_clear_reqs() (git-fixes).
- NFS: Fix O_DIRECT commit verifier handling (git-fixes).
- NFS: commit errors should be fatal (git-fixes).
- commit c3fe0ca

- scripts/sequence-patch.sh: handle spaces in file names
  The "find | xargs" pattern without -print0 and -0 does not handle file
  names with spaces correctly. As there is no actual need for xargs, rewrite
  the line to uses "find -exec" instead.
- commit 622d208

- scripts/check-kernel-fix: allow CVE argument
- commit 9f07d91

- scripts/check-kernel-fix: simplify to only get sha argument and resolve references automagically
- commit c317a1e

- scripts/common-functions: implement cve2sha and sha2cve
- commit d016ea0

- scripts/check-kernel-fix: Enhancements and cleanups
  Allow to check which branches have a given reference without
  passing a particular sha. Actions are not printed in this case.
  Show actions when "sha" is passed by default.
  Add [-q] option to do not show progress when checking
  state of each branch.
  Do not show action for a branch when the merge branch
  already has the patch with all references.
  Check each branch only once for the given sha and all references.
  It allowed to reduce git grep calls. Also it removed the need
  to merge branch states. It improved speed and simplified
  the logic.
- commit 0278113

- Bluetooth: rfcomm: Fix null-ptr-deref in rfcomm_check_security
  (bsc#1219170 CVE-2024-22099).
- commit f6c10f5

- scripts/patch-tag: remove bitkeeper format handling
  Drop code that deals with bk-style comments and tags. The last branch to
  include any patch exported from bk was SLE10-SP4, and it is not likely
  that we will need to handle bk again in the future.
- commit 1c94ff0

- scsi: qla2xxx: Update version to 10.02.09.200-k (bsc1221816).
- scsi: qla2xxx: Delay I/O Abort on PCI error (bsc1221816).
- scsi: qla2xxx: Change debug message during driver unload
  (bsc1221816).
- scsi: qla2xxx: Fix double free of fcport (bsc1221816).
- scsi: qla2xxx: Fix double free of the ha->vp_map pointer
  (bsc1221816).
- scsi: qla2xxx: Fix command flush on cable pull (bsc1221816).
- scsi: qla2xxx: NVME|FCP prefer flag not being honored
  (bsc1221816).
- scsi: qla2xxx: Update manufacturer detail (bsc1221816).
- scsi: qla2xxx: Split FCE|EFT trace control (bsc1221816).
- scsi: qla2xxx: Fix N2N stuck connection (bsc1221816).
- scsi: qla2xxx: Prevent command send on chip reset (bsc1221816).
- commit 61951e8

- drm: bridge/panel: Cleanup connector on bridge detach (bsc#1220777, CVE-2021-47063)
  Backporting changes:
- add patch at the top of panel_bridge_detach()
- commit 760a99d

- aoe: fix the potential use-after-free problem in aoecmd_cfg_pkts
  (bsc#1218562 CVE-2023-6270).
- commit 4e659c8

- scripts/common-functions:
- scripts/cve_tools/cve2metadata.sh:
  cve2cvss do not assume consumer and do not preformat the output
- commit 8a1b4cc

- scripts/cve_tools/cve2metadata.sh: resolve CVE or sha into metadata
  Examples
  $ ./scripts/cve_tools/cve2metadata.sh CVE-2021-46975
  2671fa4dc0109d3fb581bc3078fdf17b5d9080f6 score: 3.2 CVE-2021-46975 bsc#1220505
  ./scripts/cve_tools/cve2metadata.sh CVE-2021-46907
  04c4f2ee3f68c9a4bf1653d15f1a9a435ae33f7a score: unknown CVE-2021-46907 bsc#1220422
- commit 5e5b19b

- scripts/common-functions: silence fetch_cache
- commit dfd8093

- scripts/common-functions: implement cve->cvss
- commit 4d69061

- scripts/common-functions: implement cve -> bsc mapping
- commit 2b5ac8e

- scripts/common-functions: abstract CACHED_BRANCHES downloading
  we will have more cached files to use
- commit 3194c25

- net: Fix features skip in for_each_netdev_feature() (git-fixes).
- commit b1996ba

- rename(): avoid a deadlock in the case of parents having no
  common ancestor (bsc#1221044 CVE-2023-52591).
- commit 16f9b33

- kill lock_two_inodes() (bsc#1221044 CVE-2023-52591).
- commit c8410b2

- rename(): fix the locking of subdirectories (bsc#1221044
  CVE-2023-52591).
- commit b34d065

- f2fs: Avoid reading renamed directory if parent does not change
  (bsc#1221044 CVE-2023-52591).
- commit 95ecb76

- ext4: don't access the source subdirectory content on
  same-directory rename (bsc#1221044 CVE-2023-52591).
- commit e81c5d2

- ext2: Avoid reading renamed directory if parent does not change
  (bsc#1221044 CVE-2023-52591).
- commit 47af51c

- udf_rename(): only access the child content on cross-directory
  rename (bsc#1221044 CVE-2023-52591).
- commit 3e77e59

- ocfs2: Avoid touching renamed directory if parent does not
  change (bsc#1221044 CVE-2023-52591).
- commit ef44829

- reiserfs: Avoid touching renamed directory if parent does not
  change (git-fixes bsc#1221044 CVE-2023-52591).
  Refresh patches.suse/reiserfs-add-check-to-detect-corrupted-directory-entry.patch
  Refresh patches.suse/reiserfs-don-t-panic-on-bad-directory-entries.patch
- commit 304c6b9

- fs: don't assume arguments are non-NULL (bsc#1221044
  CVE-2023-52591).
- commit 74a158f

- fs: Restrict lock_two_nondirectories() to non-directory inodes
  (bsc#1221044 CVE-2023-52591).
- commit 2042147

- fs: ocfs2: check status values (bsc#1221044 CVE-2023-52591).
- commit 24568a1

- fs: no need to check source (bsc#1221044 CVE-2023-52591).
- commit 95711fd

- fs: Lock moved directories (bsc#1221044 CVE-2023-52591).
- commit 2b2136e

- fs: Establish locking order for unrelated directories
  (bsc#1221044 CVE-2023-52591).
- commit c49cfde

- fs: introduce lock_rename_child() helper (bsc#1221044
  CVE-2023-52591).
- commit 84b4b7d

- dwc3: switch to a global mutex (bsc#1220628 CVE-2021-46941).
- commit d93342d

- usb: dwc3: core: Do core softreset when switch mode (bsc#1220628
  CVE-2021-46941).
- blacklist.conf: needed after all for a CVE
- Refresh
  patches.suse/USB-dwc3-fix-runtime-pm-imbalance-on-probe-errors.patch.
- Refresh
  patches.suse/usb-dwc3-Fix-race-between-dwc3_set_mode-and-__dwc3_s.patch.
- commit 7ca4d31

- Input: add bounds checking to input_set_capability()
  (bsc#1218220 CVE-2022-48619).
- commit f42351b

- NFSD: Retransmit callbacks after client reconnects (git-fixes).
- NFSD: Reset cb_seq_status after NFS4ERR_DELAY (git-fixes).
- SUNRPC: fix some memleaks in gssx_dec_option_array (git-fixes).
- NFSv4.1/pnfs: Ensure we handle the error NFS4ERR_RETURNCONFLICT
  (git-fixes).
- SUNRPC: Fix RPC client cleaned up the freed pipefs dentries
  (git-fixes).
- nfsd: lock_rename() needs both directories to live on the same
  fs (git-fixes).
- pNFS/flexfiles: Check the layout validity in
  ff_layout_mirror_prepare_stats (git-fixes).
- commit 311216b

- mass-cve: Switch to cve2bugzilla database
  The map cve2bugzilla is not unique, add only first bug to references
- commit 8b6d26b

- perf/x86/lbr: Filter vsyscall addresses (bsc#1220703,
  CVE-2023-52476).
- commit ff86f16

- mass-cve: Add processing of all known history
- commit 1e9ec1d

- x86/mmio: Disable KVM mitigation when X86_FEATURE_CLEAR_CPU_BUF is set (bsc#1213456 CVE-2023-28746).
- commit c5b2dec

- Sort patches that are already upstream
- Refresh
  patches.suse/Documentation-hw-vuln-Add-documentation-for-RFDS.patch.
- Refresh
  patches.suse/KVM-x86-Export-RFDS_NO-and-RFDS_CLEAR-to-guests.patch.
- Refresh
  patches.suse/x86-rfds-Mitigate-Register-File-Data-Sampling-RFDS.patch.
- commit 031146a

- mass-cve: Parametrize with branch and do commit
- mass-cve: Add add-missing-reference helper
- commit aba83bd

- mass-cve: Add bsc# resolution
- commit 3cd075a

- iommu/amd: Set DTE[IntTabLen] to represent 512 IRTEs
  (git-fixes).
- commit ea9ae09

- iommu: Check if group is NULL before remove device (git-fixes).
- commit a7b6fa2

- iommu/amd: Silence warnings under memory pressure (git-fixes).
- commit cdec216

- iommu/amd: Increase interrupt remapping table limit to 512
  entries (git-fixes).
- commit c290a72

- iommu/amd: Mark interrupt as managed (git-fixes).
- commit 34b8fef

- ARM: 9064/1: hw_breakpoint: Do not directly check the event's
  overflow_handler hook (bsc#1220751 CVE-2021-47006).
- commit 605e3a7

- Refresh patches.kabi/team-Hide-new-member-header-ops.patch.
  Fix for kABI workaround.
- commit f1bcdf5

- mass-cve: Add Makefile to process vulns.git database
- commit 5a5d01b

- scripts: Remove unused script gen-aseries
- commit 03b8697

- scripts: Remove unused patch-report
- commit fa154b6

- usb: typec: class: fix typec_altmode_put_partner to put plugs
  (git-fixes).
- commit 4350c0c

- ceph: fix deadlock or deadcode of misusing dget() (bsc#1221058
  CVE-2023-52583).
- commit a413cb6

- usb: hub: Guard against accesses to uninitialized BOS
  descriptors (bsc#1220790 CVE-2023-52477).
- commit bf5af19

glib2

- Add patches to fix CVE-2024-34397 (boo#1224044):
  glib2-CVE-2024-34397-add-ref-count-types.patch
  glib2-allocate-SignalSubscriber-structs-individually.patch
  glib2-CVE-2024-34397.patch (glgo#GNOME/glib#3268).
  glib2-fix-ibus-regression.patch (glgo#GNOME/glib#3353)

_product:SLES-release

n/a

python3-base

- bsc#1221854 (CVE-2024-0450) Add
  CVE-2024-0450-zipfile-avoid-quoted-overlap-zipbomb.patch
  detecting the vulnerability of the "quoted-overlap" zipbomb
  (from gh#python/cpython!110016).

- Add CVE-2023-52425-libexpat-2.6.0-backport.patch fixing etree
  XMLPullParser tests for Expat >=2.6.0 with reparse deferral
  (fixing CVE-2023-52425 or bsc#1219559).

python-base

- bsc#1221854 (CVE-2024-0450) Add
  CVE-2024-0450-zipfile-avoid-quoted-overlap-zipbomb.patch
  detecting the vulnerability of the "quoted-overlap" zipbomb
  (from gh#python/cpython!110016).

- Switch to using the system libexpat (bsc#1219559,
  CVE-2023-52425)
- Make sure to remove all embedded versions of other packages
  (including expat).
- Add CVE-2023-52425-libexpat-2.6.0-remove-failing-tests.patch
  removing failing test fixing bpo#3151, which we just not
  support.
- Remove patches over those embedded packages (cffi):
  - python-2.7-libffi-aarch64.patch
  - sparc_longdouble.patch

- Modify CVE-2023-27043-email-parsing-errors.patch to fix the
  unicode string handling in email.utils.parseaddr()
  (bsc#1222537).
- Revert CVE-2022-48560-after-free-heappushpop.patch, the fix was
  unneeded.

- Switch off tests. ONLY FOR FACTORY!!! (bsc#1219306)

- Build with -std=gnu89 to build correctly with gcc14, bsc#1220970

python-typing

- Update to 3.10.0.0
  * Implement TypeGuard (PEP 649)
  * backport ParamSpecArgs/Kwargs
  * Fixed required/optional keys with old-style TypedDict
  * Bring in protocol’s __init__ behaviour same like in python > 3.8
  * Support PEP 612 in typing_extensions (Python 3)
  * Also run python 3.9 in CI
  * Add OrderedDict to typing_extensions
  * Only allow installing this package for Python 2.7 and 3.4
  * Document availability of Annotated
  * Update test_typing_extensions.py
  * Apply get_args fix from bpo-40398 to typing_extensions
  * Fix tests failing with 3.10.0a2+
  * Fix stray close paren
  * Update README
  * Disable 3.5.1 build -- can't install psutils needed by pytest-xdist
  * Bump typing_extensions version to 3.7.4.3
  * Remove extra 'use' in readme
- from version 3.7.4.3
  * Revert last two changes; bump version to 3.7.4.3
- from version 3.7.4.2
  * Disallow installation on 3.5+
  * Add tox.ini for typing_extensions
  * Add PEP 613 TypeAlias to typing_extensions
  * Make tests for Annotated work with Python 3.9
  * Remove Python 3.3 from tox.ini
  * Fix flake8 failure by using Python 3.8
  * Add SupportsIndex, added in Python 3.8
  * Update package metadata
  * Bump typing_extensions version to 3.7.4.2
  * Fix ForwardRef hash and equality checks
  * Fix required and optional keys inheritance for TypedDict
  * Replace asyncio.coroutine with async-await
  * Reuse stdlib PEP 593 implementation in typing_extensions if present
  * Add .vscode and .egg-info to gitignore
  * Backport get_origin() and get_args()
  * Add clarification to package description
  * Track optional TypdeDict keys
  * Accept arbitrary keyword names in NamedTuple() and TypedDict()
  * Bump typing_extensions version
  * Add missing objects in typing_extensions/README.rst
- from version 3.7.4.1
  * Fix isinstance() with generic protocol subclasses after subscripting
  * Try fixing Travis build
    + fix tests for non-default interpreters
  * Use environment marker to specify typing dependency
  * Fix unions of protocols on Python 2
  * Bump typing_extensions version and typing dependency version
- from version 3.7.4
  * Fix subclassing builtin protocols on older Python versions
  * Move Protocol, runtime_checkable, Final, final, Literal, and TypedDict to typing
  * Add support for Python 3.8 in typing_extensions
  * Unify the implementation of annotated in src_py2 and src_py3
  * Add Annotated in python2
  * Pep 593 py3
  * Drop support of Python 3.3
  * [typing-extensions] Simple implementation for IntVar
  * Add a python 3.7+ version of Annotated to typing_extensions
  * Add SupportsIndex
  * Add TypedDict to typing_extensions
  * .travis.yml: The 'sudo' tag is now deprecated in Travis CI
  * Add Final to the README
  * Run the tests using the current Python executable
  * Fix GeneralMeta.__instancecheck__() for old style classes
  * Bump typing_extensions version
  * Add Literal[...] types to typing_extensions
  * Fix instance/subclass checks of functions against runtime protocols
  * Bump typing_extension version
  * Improve PyPI entry for typing_extensions
  * Add Final to typing_extensions
- from version 3.6.6
  * Include license file for typing-extensions and in wheels
  * Fix IO.closed to be property
  * Backport Generic.__new__ fix
  * Bump typing_extensions version before release
  * Add missing 'NoReturn' to __all__ in typing.py
  * Add annotations to NamedTuple children __new__ constructors
  * Fix typing_extensions to support PEP 560
  * Fix for issue #524
  * Pass *args and **kwargs to superclass in Generic.__new__
- Rename README.rst to README.md in %doc section

regionServiceClientConfigEC2

- Version 4.2.0
  Replace certs (length 4096):
  rgnsrv-gce-asia-northeast1 -> 162.222.182.90 expires in 9 years
  rgnsrv-gce-us-central1     -> 35.187.193.56 expires in 10 years

python

- bsc#1221854 (CVE-2024-0450) Add
  CVE-2024-0450-zipfile-avoid-quoted-overlap-zipbomb.patch
  detecting the vulnerability of the "quoted-overlap" zipbomb
  (from gh#python/cpython!110016).

- Switch to using the system libexpat (bsc#1219559,
  CVE-2023-52425)
- Make sure to remove all embedded versions of other packages
  (including expat).
- Add CVE-2023-52425-libexpat-2.6.0-remove-failing-tests.patch
  removing failing test fixing bpo#3151, which we just not
  support.
- Remove patches over those embedded packages (cffi):
  - python-2.7-libffi-aarch64.patch
  - sparc_longdouble.patch

- Modify CVE-2023-27043-email-parsing-errors.patch to fix the
  unicode string handling in email.utils.parseaddr()
  (bsc#1222537).
- Revert CVE-2022-48560-after-free-heappushpop.patch, the fix was
  unneeded.

- Switch off tests. ONLY FOR FACTORY!!! (bsc#1219306)

- Build with -std=gnu89 to build correctly with gcc14, bsc#1220970

openldap2

- bsc#1217985 - Null pointer deref in referrals as part of
  ldap_chain_response()
  * 0229-ITS-9262-check-referral.patch

- bsc#1220787 - increase DH param minimums to 2048 bits
  * 0228-bsc-1220787-increase-dh-param-minimums.patch

wicked

- client: fix ifreload to pull UP ports/links again when the config
  of their master/lower changed (bsc#1224100,gh#openSUSE/wicked#1014).
  [+ 0001-ifreload-pull-UP-again-on-master-lower-changes-bsc1224100.patch]

- Update to version 0.6.75:
  - cleanup: fix ni_fsm_state_t enum-int-mismatch warnings
  - cleanup: fix overflow warnings in a socket testcase on i586
  - ifcheck: report new and deleted configs as changed (bsc#1218926)
  - man: improve ARP configuration options in the wicked-config.5
  - bond: add ports when master is UP to avoid port MTU revert (bsc#1219108)
  - cleanup: fix interface dependencies and shutdown order (bsc#1205604)
  - Remove port arrays from bond,team,bridge,ovs-bridge (redundant)
    and consistently use config and state info attached to the port
    interface as in rtnetlink(7).
  - Cleanup ifcfg parsing, schema configuration and service properties
  - Migrate ports in xml config and policies already applied in nanny
  - Remove "missed config" generation from finite state machine, which
    is completed while parsing the config or while xml config migration.
  - Issue a warning when "lower" interface (e.g. eth0) config is missed
    while parsing config depending on it (e.g. eth0.42 vlan).
  - Resolve ovs master to the effective bridge in config and wickedd
  - Implement netif-check-state require checks using system relations
    from wickedd/kernel instead of config relations for ifdown and add
    linkDown and deleteDevice checks to all master and lower references.
  - Add a `wicked <ifup|ifdown|ifreload> --dry-run …` option to show the
    system/config interface hierarchies as notice with +/- marked
    interfaces to setup and/or shutdown.
- Removed patches included in the source archive:
  [- 0001-addrconf-fix-fallback-lease-drop-bsc-1220996.patch]
  [- 0002-extensions-nbft-replace-nvme-show-nbft-with-nvme-nbf.patch]
  [- 0003-move-all-attribute-definitions-to-compiler-h.patch]
  [- 0004-hide-secrets-in-debug-log-bsc-1221194.patch]
  [- 0005-client-do-to-not-convert-sec-to-msec-twice-bsc-1222105.patch]

python3

- bsc#1221854 (CVE-2024-0450) Add
  CVE-2024-0450-zipfile-avoid-quoted-overlap-zipbomb.patch
  detecting the vulnerability of the "quoted-overlap" zipbomb
  (from gh#python/cpython!110016).

- Add CVE-2023-52425-libexpat-2.6.0-backport.patch fixing etree
  XMLPullParser tests for Expat >=2.6.0 with reparse deferral
  (fixing CVE-2023-52425 or bsc#1219559).

glibc

- nscd-Fix-use-after-free-in-addgetnetgrentX.patch: nscd: Fix
  use-after-free in addgetnetgrentX (BZ #23520)
- glibc-CVE-2024-33599-nscd-Stack-based-buffer-overflow-in-n.patch:
  nscd: Stack-based buffer overflow in netgroup cache
  (CVE-2024-33599, bsc#1223423, BZ #31677)
- glibc-CVE-2024-33600-nscd-Avoid-null-pointer-crashes-after.patch:
  nscd: Avoid null pointer crashes after notfound response
  (CVE-2024-33600, bsc#1223424, BZ #31678)
- glibc-CVE-2024-33600-nscd-Do-not-send-missing-not-found-re.patch:
  nscd: Do not send missing not-found response in addgetnetgrentX
  (CVE-2024-33600, bsc#1223424, BZ #31678)
- glibc-CVE-2024-33601-CVE-2024-33602-nscd-netgroup-Use-two.patch:
  netgroup: Use two buffers in addgetnetgrentX (CVE-2024-33601,
  CVE-2024-33602, bsc#1223425, BZ #31680)
- nscd-netgroup-cache-timeout.patch: Use time_t for return type of
  addgetnetgrentX (CVE-2024-33602, bsc#1223425)

- elf-ifunc-subtests-nonpie.patch: elf: Disable some subtests of
  ifuncmain1, ifuncmain5 for !PIE
- iconv-iso-2022-cn-ext.patch: iconv: ISO-2022-CN-EXT: fix out-of-bound
  writes when writing escape sequence (CVE-2024-2961, bsc#1222992)

python36

- Add bpo38361-syslog-no-slash-ident.patch (bsc#1222109,
  gh#python/cpython!16557) fixes syslog making default "ident"
  from sys.argv[0].
- Update CVE-2023-52425-libexpat-2.6.0-backport.patch so that
  it uses features sniffing, not just comparing version number
  (bsc#1220664, bsc#1219559, bsc#1221563, bsc#1222075).
- Remove support-expat-CVE-2022-25236-patched.patch, which was
  the previous name of this patch.
- Add CVE-2023-52425-remove-reparse_deferral-tests.patch skipping
  failing tests.
- Refresh patches:
  - CVE-2023-27043-email-parsing-errors.patch
  - fix_configure_rst.patch
  - skip_if_buildbot-extend.patch

- bsc#1221854 (CVE-2024-0450) Add
  CVE-2024-0450-zipfile-avoid-quoted-overlap-zipbomb.patch
  detecting the vulnerability of the "quoted-overlap" zipbomb
  (from gh#python/cpython!110016).
- Add bh42369-thread-safety-zipfile-SharedFile.patch (from
  gh#python/cpython!26974) required by the previous patch.
- Add expat-260-test_xml_etree-reparse-deferral.patch to make the
  interpreter work with patched libexpat in our distros.
- Move all patches from locally sourced to the branch
  opensuse-3.6 branch at GitHub repo, and move all metadata to
  commits themselves (readable in the headers of each patch).
- Add bpo-41675-modernize-siginterrupt.patch to make Python build
  cleanly even on more recent SPs of SLE-15
  (gh#python/cpython#85841).
- Remove patches:
  - bpo36263-Fix_hashlib_scrypt.patch - fix against bug in
    OpenSSL fixed in 1.1.1c (gh#openssl/openssl!8483), so this
    patch is redundant on all SUSE-supported distros
  - python-3.3.0b1-test-posix_fadvise.patch - protection
    against the kernel issues which has been fixed in
    gh#torvalds/linux@3d3727cdb07f, which has been included in
    all our kernels more recent than SLE-11.
  - python-3.3.3-skip-distutils-test_sysconfig_module.patch -
    skips a test, which should be relevant only for testing on
    Mac OS X systems with universal builds. I have no valid
    record, that this test would be ever problematic on Linux.
  - bpo-36576-skip_tests_for_OpenSSL-111.patch, which was
    included already in Python 3.5.

- (bsc#1219666, CVE-2023-6597) Add
  CVE-2023-6597-TempDir-cleaning-symlink.patch (patch from
  gh#python/cpython!99930) fixing symlink bug in cleanup of
  tempfile.TemporaryDirectory.
- Merge together bpo-36576-skip_tests_for_OpenSSL-111.patch into
  skip_SSL_tests.patch, and make them include all conditionals.

suseconnect-ng

- Update to version 1.9.0
  * Fix certificate import for Yast when using a registration proxy with
    self-signed SSL certificate (bsc#1223107)

python-pyOpenSSL

- Add CVE-2018-1000807-8_use_after_free_X509.patch to fix
  CVE-2018-1000807 (bsc#1111635) and CVE-2018-1000808 (bsc#1111634)
    fix a memory leak and a potential UAF and also #722 (#723)
    sanity check
    bump cryptography minimum version, add changelog
- Add skip_user_after_free_tests.patch to pass the test suite.
- bsc#1021578 add move_cryptography_backend_import.patch to avoid bad
  interaction with python-cryptography package.