- python-azure-agent
-
- Fix %suse_version conditional in spec file so package is built
using python2 in SLE 12 (bsc#1240385)
- Add a new version of paa_force_py3_sle15.patch to compensate for
missing Python RPM macros in older distros
- Update to version 2.12.04 (bsc#1235140)
+ Remove agent-no-auto-update.patch handeled by config file specialization
sub-packages
+ Remove paa_force_py3_sle15.patch handled by RPM macro
+ Remove agent-micro-is-sles.patch included upstream
+ Forward port paa_12_sp5_rdma_no_ext_driver.patch
+ Forward port remove-mock.patch
+ Add paa_direct_exec_in_service.patch
~ The waagent script is executable and we set the proper interpreter
using the macro for multibuild python. Do prefix the execution in the
service file wit the interpreter
+ Fix install_requires list syntax
+ Update spec file
~ Remove conditions for distros no longer maintained
~ Simplify build and install conditionals using macros
+ Enable GA versioning #3082 #3184 #3189
+ Cgroups api refactor for v2 #3096 #3135 #3188 #3196
+ Fix JIT for FIPS 140-3 #3190
+ reset network service unit file if python version changes #3058
+ Recognize SLE-Micro as a SLE based distribution #3048
+ Add distutils/version.py to azurelinuxagent #3063
+ Use legacycrypt instead of crypt on Python >= 3.13 #3070
+ Fix osutil/default route_add to pass string array. #3072
+ Fix argument to GoalState.init #3073
+ Add lock around access to fast_track.json #3076
+ Add DistroVersion class to compare distro versions #3078
+ LogCollector should skip and log warning for files that don't exist #3098
+ check for unexpected process in agent cgroups before cgroups enabled #3103
+ [Redo with correct source/target]: Remove check for "ibXX" interface
format and rework mac-address regex to expand support #3150
+ Fix Ubuntu version codename for 24.04 #3159
+ Update test certificate data #3166
+ move setupslice after cgroupsv2 check, remove unit file for
log collector and remove fiirewall daemon-reload #3223
+ Address pylint warning deprecated-method #3059
+ Run pylint on Python 3.11 #3067
+ Run unit tests with pytest on Python >= 3.10
+ Log logcollector cgroups if process is found in unexpected slice #3107
+ remove secret and use cert for aad app in e2e pipeline #3116
+ suppress pylint warn contextmanager-generator-missing-cleanup #3138
+ Switching to SNI based authentication for aad app #3137
+ updated PR template #3144
+ Avoiding mocked exception from being lost on test when using
python 3.12: complete mocked info #3149
+ Add more useful logging statement for agent unit properties #3154
+ Remove wireserver fallback for imds calls #3152
+ Remove unused import #3155
+ Add support for Azure Linux 3 #3183
+ Fix pytest warnings #3084
+ Allow use of node 16 #3160
+ Send controller/cgroup path telemetry #3231
From 2.13.0.2
+ #3221 Add support for nftables (+ refactoring of firewall code)
+ #3239 Create walinuxagent nftable atomically
+ Features in progress (Verify extension signature/Policy Enforcement)
+ #3200 Parse encodedSignature property from EGS
+ #3187 Add Regorus policy engine framework
+ #3222 Remove Regorus and platform check for policy enforcement
+ #3242 Telemetry (update logcollector telemetry with common properties)
+ #3208 Handle non-boolean when parsing extension manifests
+ #3211 Fix unicode type check when parsing extension manifests
+ #3133 Telemetry: high-priority events
+ #3240 Telemetry: report apparent dead code
+ #3210 Cleanup: remove AMA extension services cgroups tracking code
+ #3197 Accommodate the new behavior in OpenSSL 3.2.2 when given an
empty input
From 2.11.1.12
+ Remove multi config extension status only on extension delete #3172
From 2.111.1.4
+ General Improvements
+ Improvements in telemetry for firewall settings #3110, #3124
From 2.10.0.8
+ GA versioning #2810 #2850 #2860 #2881 #2974 #3004 #3015 #3033
+ Disabled GA versioning #2909 #2917 #3044
+ Add regular expression to match logs from very old agents #2839
+ Remove empty "distro" module #2854
+ Enable Python 2.7 for unit tests #2856
+ Add check for noexec on Permission denied errors #2859
+ Reorganize file structure of unit tests #2894
+ Report useful message when extension processing is disabled #2895
+ Add log and telemetry event for extension disabled #2897
+ Cleanup common directory #2902
+ Fix agent memory usage check #2903
+ enable rhel/centos agent-cgroups #2922
+ Add support for EC certificates #2936
+ Add Cpu Arch in local logs and telemetry events #2938
+ Clarify support status of installing from source. #2941
+ Gathering Guest ProxyAgent Log Files #2975
+ Remove debug info from waagent.status.json #2971
+ Handle errors when adding logs to the archive #2982
+ Update supported Ubuntu versions #2980
+ Fix pylint warning #2988
+ Add information about HTTP proxies #2985
+ update the proxy agenet log folder for logcollector #3028
+ Add config parameter to wait for cloud-init
(Extensions.WaitForCloudInit) #3031 [Added in 2.10.0.8]
+ Adding AutoUpdate.UpdateToLatestVersion new flag support #3020 #3027
[Added in 2.10.0.8]
+ Check certificates only if certificates are included in goal state #2803
+ Redact access tokens from extension's output #2811
+ Fix name of single IB device when provisioning RDMA #2814
+ Port NSBSD system to the latest version of waagent #2828
+ fix daemon version #2874
+ fix version checking in setup.py #2920
+ fix(ubuntu): Point to correct dhcp lease files #2979
+ Download certs on FT GS after check_certificates only when missing
from disk #2907
+ Add support for EC certificates (#2936) #2943 [Added in 2.10.0.5]
+ Fix for "local variable _COLLECT_NOEXEC_ERRORS referenced before
assignment" (#2935) #2944 [Added in 2.10.0.5]
+ Cache daemon version #2942 #2946 [Added in 2.10.0.5]
+ undo get daemon version change #2951 [Added in 2.10.0.5]
+ fix self-update frequency to spread over 24 hrs for regular type
and 4 hrs for hotfix #2948 [Added in 2.10.0.5]
+ ignore dependencies from extensions that do not have settings #2957
[Added in 2.10.0.6]
+ Do not reset the mode of a extension's log directory #3014
[Added in 2.10.0.8]
+ skip cgroup monitoring if log collector doesn't start by the agent.
[#2939] [Added in 2.10.0.8]
+ NM should not be restarted during hostname publish if NM_CONTROLLED=y
[#3008] [Added in 2.10.0.8]
+ Daemon should remove stale published_hostname file and log
useful warning #3016 [Added in 2.10.0.8]
+ Revert changes to publish_hostname in RedhatOSModernUtil #3032
[Added in 2.10.0.8]
+ Recover primary nic if down after publishing hostname in
RedhatOSUtil #3024 [Added in 2.10.0.8]
- fix a few typos in the spec file and use proper macros where
applicable
- remove python3 requires
- apparmor
-
- Addapt the allow-pam_unix-to-execute-unix_chkpwd.patch for SLE12.
(bsc#1241876)
- Remove revert-abi-change-for-unix_chkpwd.patch
- Allow pam_unix to execute unix_chkpwd with abi/3.0
- remove dovecot-unix_chkpwd.diff
- Add allow-pam_unix-to-execute-unix_chkpwd.patch
- Add revert-abi-change-for-unix_chkpwd.patch
(bsc#1234452, bsc#1232234)
- Update profile usr.lib.dovecot.auth and add dovecot-unix_chkpwd.diff
to allow dovecot-auth to execute unix_chkpwd, and add a profile for
unix_chkpwd. This is needed for PAM with CVE-2024-10041 (bsc#1234452)
- vim
-
- Introduce patch to fix bsc#1235751 (regression).
* vim-9.1.1134-revert-putty-terminal-colors.patch
- Update to 9.1.1176. Changes:
* 9.1.1176: wrong indent when expanding multiple lines
* 9.1.1175: inconsistent behaviour with exclusive selection and motion commands
* 9.1.1174: tests: Test_complete_cmdline() may fail
* 9.1.1173: filetype: ABNF files are not detected
* 9.1.1172: [security]: overflow with 'nostartofline' and Ex command in tag file
* 9.1.1171: tests: wrong arguments passed to assert_equal()
* 9.1.1170: wildmenu highlighting in popup can be improved
* 9.1.1169: using global variable for get_insert()/get_lambda_name()
* 9.1.1168: wrong flags passed down to nextwild()
* 9.1.1167: mark '] wrong after copying text object
* 9.1.1166: command-line auto-completion hard with wildmenu
* 9.1.1165: diff: regression with multi-file diff blocks
* 9.1.1164: [security]: code execution with tar.vim and special crafted tar files
* 9.1.1163: $MYVIMDIR is set too late
* 9.1.1162: completion popup not cleared in cmdline
* 9.1.1161: preinsert requires bot "menu" and "menuone" to be set
* 9.1.1160: Ctrl-Y does not work well with "preinsert" when completing items
* 9.1.1159: $MYVIMDIR may not always be set
* 9.1.1158: :verbose set has wrong file name with :compiler!
* 9.1.1157: command completion wrong for input()
* 9.1.1156: tests: No test for what patch 9.1.1152 fixes
* 9.1.1155: Mode message not cleared after :silent message
* 9.1.1154: Vim9: not able to use autoload class accross scripts
* 9.1.1153: build error on Haiku
* 9.1.1152: Patch v9.1.1151 causes problems
* 9.1.1151: too many strlen() calls in getchar.c
* 9.1.1150: :hi completion may complete to wrong value
* 9.1.1149: Unix Makefile does not support Brazilian lang for the installer
* 9.1.1148: Vim9: finding imported scripts can be further improved
* 9.1.1147: preview-window does not scroll correctly
* 9.1.1146: Vim9: wrong context being used when evaluating class member
* 9.1.1145: multi-line completion has wrong indentation for last line
* 9.1.1144: no way to create raw strings from a blob
* 9.1.1143: illegal memory access when putting a register
* 9.1.1142: tests: test_startup fails if $HOME/$XDG_CONFIG_HOME is defined
* 9.1.1141: Misplaced comment in readfile()
* 9.1.1140: filetype: m17ndb files are not detected
* 9.1.1139: [fifo] is not displayed when editing a fifo
* 9.1.1138: cmdline completion for :hi is too simplistic
* 9.1.1137: ins_str() is inefficient by calling STRLEN()
* 9.1.1136: Match highlighting marks a buffer region as changed
* 9.1.1135: 'suffixesadd' doesn't work with multiple items
* 9.1.1134: filetype: Guile init file not recognized
* 9.1.1133: filetype: xkb files not recognized everywhere
* 9.1.1132: Mark positions wrong after triggering multiline completion
* 9.1.1131: potential out-of-memory issue in search.c
* 9.1.1130: 'listchars' "precedes" is not drawn on Tabs.
* 9.1.1129: missing out-of-memory test in buf_write()
* 9.1.1128: patch 9.1.1119 caused a regression with imports
* 9.1.1127: preinsert text is not cleaned up correctly
* 9.1.1126: patch 9.1.1121 used a wrong way to handle enter
* 9.1.1125: cannot loop through pum menu with multiline items
* 9.1.1124: No test for 'listchars' "precedes" with double-width char
* 9.1.1123: popup hi groups not falling back to defaults
* 9.1.1122: too many strlen() calls in findfile.c
* 9.1.1121: Enter does not insert newline with "noselect"
* 9.1.1120: tests: Test_registers fails
* 9.1.1119: Vim9: Not able to use an autoloaded class from another autoloaded script
* 9.1.1118: tests: test_termcodes fails
* 9.1.1117: there are a few minor style issues
* 9.1.1116: Vim9: super not supported in lambda expressions
* 9.1.1115: [security]: use-after-free in str_to_reg()
* 9.1.1114: enabling termguicolors automatically confuses users
* 9.1.1113: tests: Test_terminal_builtin_without_gui waits 2 seconds
* 9.1.1112: Inconsistencies in get_next_or_prev_match()
* 9.1.1111: Vim9: variable not found in transitive import
* 9.1.1110: Vim tests are slow and flaky
* 9.1.1109: cmdexpand.c hard to read
* 9.1.1108: 'smoothscroll' gets stuck with 'listchars' "eol"
* 9.1.1107: cannot loop through completion menu with fuzzy
* 9.1.1106: tests: Test_log_nonexistent() causes asan failure
* 9.1.1105: Vim9: no support for protected new() method
* 9.1.1104: CI: using Ubuntu 22.04 Github runners
* 9.1.1103: if_perl: still some compile errors with Perl 5.38
* 9.1.1102: tests: Test_WinScrolled_Resized_eiw() uses wrong filename
- 9.1.1101 is a fix for:
bsc#1229685 (CVE-2024-43790)
bsc#1229822 (CVE-2024-43802)
bsc#1230078 (CVE-2024-45306)
bsc#1235695 (CVE-2025-22134)
bsc#1236151 (CVE-2025-24014)
bsc#1237137 (CVE-2025-1215)
- Remove obsoleted patch:
* vim-7.3-mktemp_tutor.patch
- update to 9.1.1101
* insexpand.c hard to read
* tests: Test_log_nonexistent only works on Linux
* Update base-syntax, improve variable matching
* Vim9: import with extends may crash
* leaking memory with completing multi lines
* --log with non-existent path causes a crash
* if_perl: Perl 5.38 adds new symbols causing link failure
* tests: matchparen plugin test wrongly named
* Vim9: problem finding implemented method in type hierarchy
* runtime(qf): Update syntax file, match second delimiter
* tests: output of test ...win32_ctrl_z depends on python version
* tests: fix expected return code for python 3.13 on Windows
* tests: timeout might be a bit too small
* tests: test_terminwscroll_topline2 unreliable
* tests: No check when tests are run under Github actions
* tests: plugin tests are named inconsistently
* Vim9: import with extends may crash
* completion doesn't work with multi lines
* filetype: cmmt files are not recognized
* Unable to persistently ignore events in a window and its buffers
* improve syntax highlighting
* setreg() doesn't correctly handle mbyte chars in blockwise mode
* unexpected DCS responses may cause out of bounds reads
* has('bsd') is true for GNU/Hurd
* filetype: Mill files are not recognized
* GUI late startup leads to uninitialized scrollbars
* Add support for lz4 to tar & gzip plugin
* Terminal ansi colors off by one after tgc reset
* included syntax items do not understand contains=TOP
* vim_strnchr() is strange and unnecessary
* Vim9: len variable not used in compile_load()
* runtime(vim): Update base-syntax, match :debuggreedy count prefix
* Strange error when heredoc marker starts with "trim"
* tests: test_compiler fails on Windows without Maven
* 'diffopt' "linematch" cannot be used with {n} less than 10
* args missing after failing to redefine a function
* Cannot control cursor positioning of getchar()
* preinsert text completions not deleted with <C-W>/<C-U>
* getchar() can't distinguish between C-I and Tab
* tests: Test_termwinscroll_topline2 fails on MacOS
* heap-use-after-free and stack-use-after-scope with :14verbose
* no digraph for "Approaches the limit"
* not possible to use plural forms with gettext()
* too many strlen() calls in userfunc.c
* terminal: E315 when dragging the terminal with the mouse
* runtime(openPlugin): fix unclosed parenthesis in GetWordUnderCursor()
* runtime(doc): Tweak documentation style a bit
* tests: test_glvs fails when unarchiver not available
* Vim always enables 'termguicolors' in a terminal
* completion: input text deleted with preinsert when adding leader
* translation(sr): Missing Serbian translation for the tutor
* Superfluous cleanup steps in test_ins_complete.vim
* runtime(netrw): correct wrong version check
* Vim doesn't highlight to be inserted text when completing
* runtime(netrw): upstream snapshot of v176
* runtime(dist/vim9): fix regressions in dist#vim9#Open
* runtime(hyprlang): fix string recognition
* make install fails because of a missing dependency
* runtime(asm): add byte directives to syntax script
* Vim doesn't work well with TERM=xterm-direct
* runtime(filetype): commit 99181205c5f8284a3 breaks V lang detection
* runtime: decouple Open and Launch commands and gx mapping from netrw
* "nosort" enables fuzzy filtering even if "fuzzy" isn't in 'completeopt'
* runtime(just): fix typo in syntax file
* runtime(filetype): Improve Verilog detection by checking for modules definition
* tests: off-by-one error in CheckCWD in test_debugger.vim
* tests: no support for env variables when running Vim in terminal
* too many strlen() calls in os_unix.c
* insert-completed items are always sorted
* crash after scrolling and pasting in silent Ex mode
* Makefiles uses non-portable syntax
* fuzzymatching doesn't prefer matching camelcase
* filetype: N-Tripels and TriG files are not recognized
* Vim9: Patch 9.1.1014 causes regressions
* translation(sr): Update Serbian messages translation
- updade to 9.1.1043
* [security]: segfault in win_line()
* update helptags
* filetype: just files are not recognized
* Update base-syntax, match ternary and falsy operators
* Vim9: out-of-bound access when echoing an enum
* Vim9: imported type cannot be used as func return type
* runtime(kconfig): updated ftplugin and syntax script
* runtime(doc): rename last t_BG reference to t_RB
* Vim9: comments are outdated
* tests: test_channel.py fails with IPv6
* runtime(vim): Update base-syntax, fix is/isnot operator matching
* Vim9: confusing error when using abstract method via super
* make install fails when using shadowdir
* Vim9: memory leak with blob2str()
* runtime(tex): add texEmphStyle to texMatchGroup in syntax script
* runtime(netrw): upstream snapshot of v175
* Vim9: compiling abstract method fails without return
* runtime(c): add new constexpr keyword to syntax file (C23)
* tests: shaderslang was removed from test_filetype erroneously
* link error when FEAT_SPELL not defined
* Coverity complains about insecure data handling
* runtime(sh): update syntax script
* runtime(c): Add missing syntax test files
* filetype: setting bash filetype is backwards incompatible
* runtime(c): Update syntax and ftplugin files
* the installer can be improved
* too many strlen() calls in screen.c
* no sanitize check when running linematch
* filetype: swc configuration files are not recognized
* runtime(netrw): change netrw maintainer
* wrong return type of blob2str()
* blob2str/str2blob() do not support list of strings
* runtime(doc): fix typo in usr_02.txt
* Coverity complains about dereferencing NULL pointer
* linematch option value not completed
* string might be used without a trailing NUL
* no way to get current selected item in a async context
* filetype: fd ignore files are not recognized
* v9.1.0743 causes regression with diff mode
* runtime(doc): fix base64 encode/decode examples
* Vim9: Patch 9.1.1013 causes a few problems
* Not possible to convert string2blob and blob2string
* Coverity complains about dereferencing NULL value
* Vim9: variable not found in transitive import
* runtime(colors): Update colorschemes, include new unokai colorscheme
* Vim9: Regression caused by patch v9.1.0646
* runtime(lyrics): support milliseconds in syntax script
* runtime(vim): Split Vim legacy and Vim9 script indent tests
* Vim9: class interface inheritance not correctly working
* popupmenu internal error with some abbr in completion item
* filetype: VisualCode setting file not recognized
* diff feature can be improved
* tests: test for patch 9.1.1006 doesn't fail without the patch
* filetype: various ignore are not recognized
* tests: Load screendump files with "git vimdumps"
* PmenuMatch completion highlight can be combined
* completion text is highlighted even with no pattern found
* tests: a few termdebug tests are flaky
* [security]: heap-buffer-overflow with visual mode
* runtime(doc): add package-<name> helptags for included packages
* Vim9: unknown func error with interface declaring func var
* runtime(filetype): don't detect string interpolation as angular
* ComplMatchIns highlight hard to read on light background
* runtime(vim): Update base-syntax, highlight literal string quote escape
* runtime(editorconfig): set omnifunc to syntaxcomplete func
* tests: ruby tests fail with Ruby 3.4
* Vim9: leaking finished exception
* runtime(tiasm): use correct syntax name tiasm in syntax script
* filetype: TI assembly files are not recognized
* too many strlen() calls in drawscreen.c
* runtime(xf86conf): add section name OutputClass to syntax script
* ComplMatchIns may highlight wrong text
* runtime(vim): Update base-syntax, improve ex-bang matching
* runtime(doc): clarify buffer deletion on popup_close()
* filetype: shaderslang files are not detected
* Vim9: not able to use comment after opening curly brace
- update to 9.1.0993
* 9.1.0993: New 'cmdheight' behavior may be surprising
* runtime(sh): fix typo in Last Change header
* 9.1.0992: Vim9: double-free after v9.1.0988
* 9.1.0991: v:stacktrace has wrong type in Vim9 script
* runtime(sh): add PS0 to bashSpecialVariables in syntax script
* runtime(vim): Remove trailing comma from match_words
* runtime(zsh): sync syntax script with upstream repo
* runtime(doc): Capitalise the mnemonic "Zero" for the 'z' flag of search()
* 9.1.0990: Inconsistent behavior when changing cmdheight
* 9.1.0989: Vim9: Whitespace after the final enum value causes a syntax error
* runtime(java): Quietly opt out for unsupported markdown.vim versions
* runtime(vim): fix failing vim syntax test
* 9.1.0988: Vim9: no error when using uninitialized var in new()
* runtime(doc): update index.txt
* 9.1.0987: filetype: cake files are not recognized
* 9.1.0986: filetype: 'jj' filetype is a bit imprecise
* runtime(jj): Support diffs in jj syntax
* runtime(vim): Update matchit pattern, no Vim9 short names
* 9.1.0985: Vim9: some ex commands can be shortened
* 9.1.0984: exception handling can be improved
* runtime(doc): update doc for :horizontal
* runtime(doc): update index.txt, windows.txt and version9.txt
* runtime(doc): Tweak documentation about base64 function
* runtime(chordpro): update syntax script
* 9.1.0983: not able to get the displayed items in complete_info()
* runtime(doc): use standard SGR format at :h xterm-true-color
* 9.1.0982: TI linker files are not recognized
* runtime(vim): update vim generator syntax script
* 9.1.0981: tests: typo in test_filetype.vim
* 9.1.0980: no support for base64 en-/decoding functions in Vim Script
* syntax(sh): Improve the recognition of bracket expressions
* runtime(doc): mention how NUL bytes are handled
* 9.1.0979: VMS: type warning with $XDG_VIMRC_FILE
* 9.1.0978: GUI tests sometimes fail when setting 'scroll' options
* 9.1.0977: filetype: msbuild filetypes are not recognized
* 9.1.0976: Vim9: missing return statement with throw
* 9.1.0975: Vim9: interpolated string expr not working in object methods
* 9.1.0974: typo in change of commit v9.1.0873
* 9.1.0973: too many strlen() calls in fileio.c
* runtime(sh): set shellcheck as the compiler for supported shells
* runtime(doc): Fix enum example syntax
* 9.1.0972: filetype: TI linker map files are not recognized
* runtime(vim): Improve syntax script generator for Vim Script
* 9.1.0971: filetype: SLNX files are not recognized
* 9.1.0970: VMS: build errors on VMS architecture
* runtime(doc): Fix documentation typos
* runtime(doc): update for new keyprotocol option value (after v9.1.0969)
* 9.1.0969: ghostty not using kitty protocol by default
* 9.1.0968: tests: GetFileNameChecks() isn't fully sorted by filetype name
* runtime(doc): update version9.txt for bash filetype
* runtime(netrw): update last change header for #16265
* runtime(doc): fix doc error in :r behaviour
* 9.1.0967: SpotBugs compiler setup can be further improved
* 9.1.0966: Vim9: :enum command can be shortened
* runtime(compiler): include a basic bash syntax checker compiler
* 9.1.0965: filetype: sh filetype set when detecting the use of bash
* runtime(doc): clarify ARCH value for 32-bit in INSTALLpc.txt
* 9.1.0963: fuzzy-matching does not prefer full match
* 9.1.0962: filetype: bun.lock file is not recognized
* runtime(vim): update indentation plugin for Vim script
* runtime(doc): tweak documentation style in helphelp.txt
* runtime(vim): Update base-syntax, allow parens in default arguments
* runtime(doc): mention auto-format using clang-format for sound.c/sign.c
* runtime(help): fix typo s/additional/arbitrary/
* runtime(help): Add better support for language annotation highlighting
* 9.1.0961: filetype: TI gel files are not recognized
* 9.1.0960: filetype: hy history files are not recognized
* translation(fi): Fix typoes in Finish menu translation
* 9.1.0959: Coverity complains about type conversion
* runtime(vim): Use supported syntax in indent tests
* 9.1.0958: filetype: supertux2 config files detected as lisp
* 9.1.0956: completion may crash, completion highlight wrong with preview window
* 9.1.0955: Vim9: vim9compile.c can be further improved
* runtime(doc): move help tag E1182
* runtime(graphql): contribute vim-graphql to Vim core
* 9.1.0954: popupmenu.c can be improved
* 9.1.0953: filetype: APKBUILD files not correctly detected
* 9.1.0952: Vim9: missing type checking for any type assignment
* 9.1.0951: filetype: jshell files are not recognized
* runtime(dockerfile): do not set commentstring in syntax script
* 9.1.0950: filetype: fennelrc files are not recognized
* runtime(netrw): do not double escape Vim special characters
* git: ignore reformatting change of netrw plugin
* runtime(netrw): more reformating #16248
* runtime(doc): Add a note about handling symbolic links in starting.txt
* 9.1.0949: popups inconsistently shifted to the left
* git: ignore reformatting change of netrw plugin
* runtime(netrw): change indent size from 1 to 2
* 9.1.0948: Missing cmdline completion for :pbuffer
* runtime(tutor): Reformat tutor1
* 9.1.0947: short-description
* 9.1.0946: cross-compiling fails on osx-arm64
* 9.1.0945: ComplMatchIns highlight doesn't end after inserted text
* translation(sv): re-include the change from #16240
* 9.1.0944: tests: test_registers fails when not run under X11
* 9.1.0943: Vim9: vim9compile.c can be further improved
* runtime(doc): Update README and mention make check to verify
* translation(sv): partly revert commit 98874dca6d0b60ccd6fc3a140b3ec
* runtime(vim): update base-syntax after v9.1.0936
* 9.1.0942: a few typos were found
* 9.1.0941: ComplMatchIns doesn't work after multibyte chars
* runtime(doc): Fix style in fold.txt
* translation(sv): Fix typo in Swedish translation
* 9.1.0940: Wrong cursor shape with "gq" and 'indentexpr' executes :normal
* runtime(doc): fix some small errors
* 9.1.0939: make installtutor fails
* 9.1.0938: exclusive selection not respected when re-selecting block mode
* 9.1.0937: test_undolist() is flaky
* 9.1.0936: cannot highlight completed text
* 9.1.0935: SpotBugs compiler can be improved
* 9.1.0934: hard to view an existing buffer in the preview window
* runtime(doc): document how to minimize fold computation costs
* 9.1.0933: Vim9: vim9compile.c can be further improved
* 9.1.0932: new Italian tutor not installed
* runtime(doc): fix a few minor errors from the last doc updates
* translation(it): add Italian translation for the interactive tutor
* runtime(doc): update the change.txt help file
* runtime(help): Add Vim lang annotation support for codeblocks
* 9.1.0931: ml_get error in terminal buffer
* 9.1.0930: tests: test_terminal2 may hang in GUI mode
* 9.1.0929: filetype: lalrpop files are not recognized
* 9.1.0928: tests: test_popupwin fails because the filter command fails
* editorconfig: set trim_trailing_whitespace = false for src/testdir/test*.vim
* 9.1.0927: style issues in insexpand.c
* 9.1.0926: filetype: Pixi lock files are not recognized
* runtime(doc): Add a reference to |++opt| and |+cmd| at `:h :pedit`
* runtime(doc): add a note about inclusive motions and exclusive selection
* 9.1.0925: Vim9: expression compiled when not necessary
* 9.1.0924: patch 9.1.0923 causes issues
* 9.1.0923: too many strlen() calls in filepath.c
* 9.1.0923: wrong MIN macro in popupmenu.c
* 9.1.0921: popupmenu logic is a bit convoluted
* 9.1.0920: Vim9: compile_assignment() too long
* 9.1.0919: filetype: some assembler files are not recognized
* runtime(netrw): do not pollute search history with symlinks
* 9.1.0918: tiny Vim crashes with fuzzy buffer completion
* 9.1.0917: various vartabstop and shiftround bugs when shifting lines
* runtime(typst): add definition lists to formatlistpat, update maintainer
* 9.1.0916: messages.c is exceeding 80 columns
* runtime(proto): include filetype plugin for protobuf
* 9.1.0915: GVim: default font size a bit too small
* 9.1.0914: Vim9: compile_assignment() is too long
* 9.1.0913: no error check for neg values for 'messagesopt'
* runtime(netrw): only check first arg of netrw_browsex_viewer for being executable
* 9.1.0912: xxd: integer overflow with sparse files and -autoskip
* 9.1.0911: Variable name for 'messagesopt' doesn't match short name
* 9.1.0910: 'messagesopt' does not check max wait time
* runtime(doc): update wrong Vietnamese localization tag
* 9.1.0909: Vim9: crash when calling instance method
- update to 9.1.0908
* refresh vim-7.3-mktemp_tutor.patch
* 9.1.0908: not possible to configure :messages
* 9.1.0907: printoptions:portrait does not change postscript Orientation
* runtime(doc): Add vietnamese.txt to helps main TOC
* 9.1.0906: filetype: Nvidia PTX files are not recognized
* runtime(doc): updated version9.txt with changes from v9.1.0905
* 9.1.0905: Missing information in CompleteDone event
* 9.1.0904: Vim9: copy-paste error in class_defining_member()
* 9.1.0903: potential overflow in spell_soundfold_wsal()
* runtime(netrw): do not detach when launching external programs in gvim
* runtime(doc): make tag alignment more consistent in filetype.txt
* runtime(doc): fix wrong syntax and style of vietnamese.txt
* translation(it): update Italian manpage for vimtutor
* runtime(lua): add optional lua function folding
* Filelist: include translations for Chapter 2 tutor
* translation(vi): Update Vietnamese translation
* runtime(doc): include vietnamese.txt
* runtime(tutor): fix another typo in tutor2
* runtime(doc): fix typo in vimtutor manpage
* translation(it): update Italian manpage for vimtutor
* translation(it): include Italian version of tutor chapter 2
* runtime(tutor): regenerated some translated tutor1 files
* runtime(tutor): fix typo in Chapter 2
* 9.1.0902: filetype: Conda configuration files are not recognized
* runtime(doc): Tweak documentation style a bit
* runtime(tutor): update the tutor files and re-number the chapters
* runtime(tutor): Update the makefiles for tutor1 and tutor2 files
* 9.1.0901: MS-Windows: vimtutor batch script can be improved
* runtime(doc): remove buffer-local completeopt todo item
* 9.1.0900: Vim9: digraph_getlist() does not accept bool arg
* runtime(typst): provide a formatlistpat in ftplugin
* runtime(doc): Update documentation for "noselect" in 'completeopt'
* 9.1.0899: default for 'backspace' can be set in C code
* runtime(helptoc): reload cached g:helptoc.shell_prompt when starting toc
* translation(ru): Updated messages translation
* 9.1.0898: runtime(compiler): pytest compiler not included
* 9.1.0897: filetype: pyrex files are not detected
* runtime(compiler): update eslint compiler
* 9.1.0896: completion list wrong after v9.1.0891
* runtime(doc): document changed default value for 'history'
* 9.1.0895: default history value is too small
* 9.1.0894: No test for what the spotbug compiler parses
* 9.1.0893: No test that undofile format does not regress
* translation(de): update German manpages
* runtime(compiler): include spotbugs Java linter
* 9.1.0892: the max value of 'tabheight' is limited by other tabpages
* runtime(po): remove poDiffOld/New, add po-format flags to syntax file
* 9.1.0891: building the completion list array is inefficient
* patch 9.1.0890: %! item not allowed for 'rulerformat'
* runtime(gzip): load undofile if there exists one
* 9.1.0889: Possible unnecessary redraw after adding/deleting lines
* 9.1.0888: leftcol property not available in getwininfo()
* 9.1.0887: Wrong expression in sign.c
* 9.1.0886: filetype: debian control file not detected
* runtime(c3): include c3 filetype plugin
* 9.1.0885: style of sign.c can be improved
* 9.1.0884: gcc warns about uninitialized variable
* runtime(apache): Update syntax directives for apache server 2.4.62
* translation(ru): updated vimtutor translation, update MAINTAINERS file
* 9.1.0883: message history cleanup is missing some tests
* runtime(doc): Expand docs on :! vs. :term
* runtime(netrw): Fixing powershell execution issues on Windows
* 9.1.0882: too many strlen() calls in insexpand.c
* 9.1.0881: GUI: message dialog may not get focus
* runtime(netrw): update netrw's decompress logic
* runtime(apache): Update syntax keyword definition
* runtime(misc): add Italian LICENSE and (top-level) README file
* 9.1.0880: filetype: C3 files are not recognized
* runtime(doc): add helptag for :HelpToc command
* 9.1.0879: source is not consistently formatted
* Add clang-format config file
* runtime(compiler): fix escaping of arguments passed to :CompilerSet
* 9.1.0878: termdebug: cannot enable DEBUG mode
* 9.1.0877: tests: missing test for termdebug + decimal signs
* 9.1.0876: filetype: openCL files are not recognized
* 9.1.0875: filetype: hyprlang detection can be improved
* 9.1.0874: filetype: karel files are not detected
* 9.1.0873: filetype: Vivado files are not recognized
* 9.1.0872: No test for W23 message
* 9.1.0871: getcellpixels() can be further improved
* 9.1.0870: too many strlen() calls in eval.c
* 9.1.0869: Problem: curswant not set on gm in folded line
* 9.1.0868: the warning about missing clipboard can be improved
* runtime(doc): Makefile does not clean up all temporary files
* 9.1.0867: ins_compl_add() has too many args
* editorconfig: don't trim trailing whitespaces in runtime/doc
* translation(am): Remove duplicate keys in desktop files
* runtime(doc): update helptags
* runtime(filetype): remove duplicated *.org file pattern
* runtime(cfg): only consider leading // as starting a comment
* 9.1.0866: filetype: LLVM IR files are not recognized
* 9.1.0865: filetype: org files are not recognized
* 9.1.0864: message history is fixed to 200
* 9.1.0863: getcellpixels() can be further improved
* runtime(sh): better function support for bash/zsh in indent script
* runtime(netrw): small fixes to netrw#BrowseX
* 9.1.0862: 'wildmenu' not enabled by default in nocp mode
* runtime(doc): update how to report issues for mac Vim
* runtime(doc): mention option-backslash at :h CompilerSet
* runtime(compiler): include a Java Maven compiler plugin
* runtime(racket): update Racket runtime files
* runtime(doc): improve indentation in examples for netrw-handler
* runtime(doc): improve examples for netrw-handler functions
* runtime(idris2): include filetype,indent+syntax plugins for (L)Idris2 + ipkg
* runtime(doc): clarify the use of filters and external commands
* 9.1.0861: Vim9: no runtime check for object member access of any var
* runtime(compiler): update pylint linter
* 9.1.0860: tests: mouse_shape tests use hard code sleep value
* 9.1.0859: several problems with the GLVS plugin
* 9.1.0858: Coverity complains about dead code
* runtime(tar): Update tar.vim to support permissions
* 9.1.0857: xxd: --- is incorrectly recognized as end-of-options
* 9.1.0851: too many strlen() calls in getchar.c
* 9.1.0850: Vim9: cannot access nested object inside objects
* runtime(tex): extra Number highlighting causes issues
* runtime(vim): Fix indent after :silent! function
* 9.1.0849: there are a few typos in the source
* runtime(netrw): directory symlink not resolved in tree view
* runtime(doc): add a table of supported Operating Systems
* runtime(tex): update Last Change header in syntax script
* runtime(doc): fix typo in g:termdebug_config
* runtime(vim): Update base-syntax, improve :normal highlighting
* runtime(tex): add Number highlighting to syntax file
* runtime(doc): Tweak documentation style a bit
* 9.1.0848: if_lua: v:false/v:true are not evaluated to boolean
* runtime(dune): use :setl instead of :set in ftplugin
* runtime(termdebug): allow to use decimal signs
* translation(it): Updated Italian vimtutor
* runtime(compiler): improve cppcheck
* git: git-blame-ignore-revs shown as an error on Github
* 9.1.0847: tests: test_popupwin fails because of updated help file
* 9.1.0846: debug symbols for xxd are not cleaned in Makefile
* runtime(structurizr): Update structurizr syntax
* runtime(8th): updated 8th syntax
* runtime(doc): Add pi_tutor.txt to help TOC
* runtime(compiler): add mypy and ruff compiler; update pylint linter
* runtime(netrw): fix several bugs in netrw tree listing
* runtime(netrw): prevent polluting the search history
* 9.1.0845: vimtutor shell script can be improved
* 9.1.0844: if_python: no way to pass local vars to python
* 9.1.0843: too many strlen() calls in undo.c
* runtime(doc): update default value for fillchars option
* runtime(compiler): fix typo in cppcheck compiler plugin
* runtime(doc): simplify vimtutor manpage a bit more
* runtime(matchparen): Add matchparen_disable_cursor_hl config option
* 9.1.0842: not checking for the sync() systemcall
* 9.1.0841: tests: still preferring python2 over python3
* 9.1.0840: filetype: idris2 files are not recognized
* 9.1.0839: filetype: leo files are not recognized
* runtime(cook): include cook filetype plugin
* runtime(debversions): Update Debian versions
* patch 9.1.0838: vimtutor is bash-specific
* runtime(doc): add help specific modeline to pi_tutor.txt
* Filelist: vimtutor chapter 2 is missing in Filelist
* 9.1.0837: cross-compiling has some issues
* runtime(vimtutor): Add a second chapter
- libxml2
-
- security update
- added patches
CVE-2025-32414 [bsc#1241551], out-of-bounds read when parsing text via the Python API
+ libxml2-CVE-2025-32414.patch
CVE-2025-32415 [bsc#1241453], a crafted XML document may lead to a heap-based buffer under-read
+ libxml2-CVE-2025-32415.patch
- security update
- modified patches
% fix-perl.diff (p1)
- added patches
fix CVE-2024-56171 [bsc#1237363], use-after-free in xmlSchemaIDCFillNodeTables and xmlSchemaBubbleIDCNodeTables in xmlschemas.c
+ libxml2-CVE-2024-56171.patch
fix CVE-2025-24928 [bsc#1237370], stack-based buffer overflow in xmlSnprintfElements in valid.c
+ libxml2-CVE-2025-24928.patch
fix CVE-2025-27113 [bsc#1237418], NULL Pointer Dereference in libxml2 xmlPatMatch
+ libxml2-CVE-2025-27113.patch
- security update
- added patches
fix CVE-2022-49043 [bsc#1236460], use-after-free in xmlXIncludeAddNode
+ libxml2-CVE-2022-49043.patch
- libX11
-
- U_CVE-2025-26597-0001-xkb-Fix-buffer-overflow-in-XkbChangeTypesOfKey.patch
* Buffer overflow in XkbChangeTypesOfKey()
(CVE-2025-26597, bsc#1237431)
- python3
-
- Update CVE-2024-11168-validation-IPv6-addrs.patch
according to the Debian version
(gh#python/cpython#103848#issuecomment-2708135083).
- Add CVE-2025-0938-sq-brackets-domain-names.patch which
disallows square brackets ([ and ]) in domain names for parsed
URLs (bsc#1236705, CVE-2025-0938, gh#python/cpython#105704)
- expat
-
- version update to 2.7.1 for SLE-12
- modified sources
% expatfaq.html
- deleted patches
- config-guess-sub-update.patch (upstreamed)
- expat-2.1.0-CVE-2016-9063.patch (upstreamed)
- expat-2.1.0-heap_buffer_overflow.patch (upstreamed)
- expat-2.1.0-parser_crashes_on_malformed_input.patch (upstreamed)
- expat-2.1.1-CVE-2012-6702.patch (upstreamed)
- expat-CVE-2017-9233.patch (upstreamed)
- expat-CVE-2018-20843.patch (upstreamed)
- expat-CVE-2019-15903-tests.patch (upstreamed)
- expat-CVE-2019-15903.patch (upstreamed)
- expat-CVE-2021-45960.patch (upstreamed)
- expat-CVE-2021-46143.patch (upstreamed)
- expat-CVE-2022-22822.patch (upstreamed)
- expat-CVE-2022-22823.patch (upstreamed)
- expat-CVE-2022-22824.patch (upstreamed)
- expat-CVE-2022-22825.patch (upstreamed)
- expat-CVE-2022-22826.patch (upstreamed)
- expat-CVE-2022-22827.patch (upstreamed)
- expat-CVE-2022-23852.patch (upstreamed)
- expat-CVE-2022-23990.patch (upstreamed)
- expat-CVE-2022-25235.patch (upstreamed)
- expat-CVE-2022-25236-relax-fix.patch (upstreamed)
- expat-CVE-2022-25236.patch (upstreamed)
- expat-CVE-2022-25313-fix-regression.patch (upstreamed)
- expat-CVE-2022-25313.patch (upstreamed)
- expat-CVE-2022-25314-before.patch (upstreamed)
- expat-CVE-2022-25314.patch (upstreamed)
- expat-CVE-2022-25315.patch (upstreamed)
- expat-CVE-2022-40674.patch (upstreamed)
- expat-CVE-2022-43680.patch (upstreamed)
- expat-CVE-2023-52425-1.patch (upstreamed)
- expat-CVE-2023-52425-2.patch (upstreamed)
- expat-CVE-2023-52425-backport-parser-changes.patch (upstreamed)
- expat-CVE-2023-52425-fix-tests.patch (upstreamed)
- expat-CVE-2024-45490.patch (upstreamed)
- expat-CVE-2024-45491.patch (upstreamed)
- expat-CVE-2024-45492.patch (upstreamed)
- expat-CVE-2024-50602.patch (upstreamed)
- expat-alloc-size.patch (upstreamed)
- expat-visibility.patch (upstreamed)
- version update to 2.7.1
Bug fixes:
[#980] #989 Restore event pointer behavior from Expat 2.6.4
(that the fix to CVE-2024-8176 changed in 2.7.0);
affected API functions are:
- XML_GetCurrentByteCount
- XML_GetCurrentByteIndex
- XML_GetCurrentColumnNumber
- XML_GetCurrentLineNumber
- XML_GetInputContext
Other changes:
[#976] #977 Autotools: Integrate files "fuzz/xml_lpm_fuzzer.{cpp,proto}"
with Automake that were missing from 2.7.0 release tarballs
[#983] #984 Fix printf format specifiers for 32bit Emscripten
[#992] docs: Promote OpenSSF Best Practices self-certification
[#978] tests/benchmark: Resolve mistaken double close
[#986] Address compiler warnings
[#990] #993 Version info bumped from 11:1:10 (libexpat*.so.1.10.1)
to 11:2:10 (libexpat*.so.1.10.2); see https://verbump.de/
for what these numbers do
Infrastructure:
[#982] CI: Start running Perl XML::Parser integration tests
[#987] CI: Enforce Clang Static Analyzer clean code
[#991] CI: Re-enable warning clang-analyzer-valist.Uninitialized
for clang-tidy
[#981] CI: Cover compilation with musl
[#983] #984 CI: Cover compilation with 32bit Emscripten
[#976] #977 CI: Protect against fuzzer files missing from future
release archives
- version update to 2.7.0 (CVE-2024-8176 [bsc#1239618])
* Security fixes:
[#893] #973 CVE-2024-8176 -- Fix crash from chaining a large number
of entities caused by stack overflow by resolving use of
recursion, for all three uses of entities:
- general entities in character data ("<e>&g1;</e>")
- general entities in attribute values ("<e k1='&g1;'/>")
- parameter entities ("%p1;")
Known impact is (reliable and easy) denial of service:
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:H/RL:O/RC:C
(Base Score: 7.5, Temporal Score: 7.2)
Please note that a layer of compression around XML can
significantly reduce the minimum attack payload size.
* Other changes:
[#935] #937 Autotools: Make generated CMake files look for
libexpat.@SO_MAJOR@.dylib on macOS
[#925] Autotools: Sync CMake templates with CMake 3.29
[#945] #962 #966 CMake: Drop support for CMake <3.13
[#942] CMake: Small fuzzing related improvements
[#921] docs: Add missing documentation of error code
XML_ERROR_NOT_STARTED that was introduced with 2.6.4
[#941] docs: Document need for C++11 compiler for use from C++
[#959] tests/benchmark: Fix a (harmless) TOCTTOU
[#944] Windows: Fix installer target location of file xmlwf.xml
for CMake
[#953] Windows: Address warning -Wunknown-warning-option
about -Wno-pedantic-ms-format from LLVM MinGW
[#971] Address Cppcheck warnings
[#969] #970 Mass-migrate links from http:// to https://
[#947] #958 ..
[#974] #975 Document changes since the previous release
[#974] #975 Version info bumped from 11:0:10 (libexpat*.so.1.10.0)
to 11:1:10 (libexpat*.so.1.10.1); see https://verbump.de/
for what these numbers do
- no source changes, just adding jira reference: jsc#SLE-21253
- systemd
-
- Add the following patches (bsc#1241079 bsc#1241586)
6004-core-rename-queued_message-pending_reload_message.patch
6005-core-when-we-can-t-send-the-pending-reload-message-s.patch
6006-core-make-sure-we-don-t-throttle-change-signal-gener.patch-
- Import commit 866467ea64074193d226d09a3779c1ff0bec63b0
2aee6d7daf basic/hashmap: add cleanup of memory pools (#7164)
908ac43c61 core: add valgrind helper for daemon-reexec
5357cabb02 sd-bus: fix a memory leak in message_new_reply() (#7636)
db07d03e46 sd-bus: unify three code-paths which free struct bus_container
732f02acb0 bus-message: use structured initialization to avoid use of unitialized memory
- Add 6002-sd-bus-add-APIs-to-query-the-current-read-and-write-.patch and
6003-core-don-t-process-dbus-unit-and-job-queue-when-ther.patch (bsc#1231211 bsc#1231211)
- Don't try to restart the udev socket units anymore (bsc#1228809)
There's currently no way to restart a socket activable service and its socket
units "atomically" and safely.
- sqlite3
-
- Sync version 3.49.1 from Factory (jsc#SLE-16032):
* CVE-2025-29087, bsc#1241020: Fix a bug in the concat_ws()
function, introduced in version 3.44.0, that could lead to a
memory error if the separator string is very large (hundreds
of megabytes).
* CVE-2025-29088, bsc#1241078: Enhanced the
SQLITE_DBCONFIG_LOOKASIDE interface to make it more robust
against misuse.
* Obsoletes sqlite3-rtree-i686.patch
- glibc
-
- assert-message-allocation.patch: Fix underallocation of abort_msg_s
struct (CVE-2025-0395, bsc#1236282, BZ #32582))
- s390x-wcsncmp.patch: s390x: Fix segfault in wcsncmp (bsc#1228044, BZ
[#31934])
- python
-
- Update CVE-2024-11168-validation-IPv6-addrs.patch
according modifications by the Debian
developers (Sylvain Beucler <beuc@debian.org>,
gh#python/cpython#103848#issuecomment-2708135083).
- Modify CVE-2025-0938-sq-brackets-domain-names.patch: we don't
use bracketed_host variable any more (correction of the fix for
bsc#1236705, discovered during analysis for bsc#1223694).
- Add CVE-2025-0938-sq-brackets-domain-names.patch which
disallows square brackets ([ and ]) in domain names for parsed
URLs (bsc#1236705, CVE-2025-0938, gh#python/cpython#105704)
- procps
-
- Add patch CVE-2023-4016-part2.patch
* Fix the ps command segfaults when pid argument has a leading space (bsc#1236842)
- rsync
-
- Fix bsc#1239649 - rsync bwlimit=0 option was broken by CVE-2024-12088 fix.
* Add rsync-fix-bwlimit.patch
* bwlimit=0 specifies no limit properly now.
- Fix bsc#1237187 - rsync daemon mode after protocol bump
* Add greeting line with available digests
* Add rsync-fix-daemon-proto-32.patch
- Bump protocl version to 32 - make it easier to show server is patched.
* Add rsync-protocol-version-32.patch
- Fix FLAG_GOT_DIR_FLIST collission with FLAG_HLINKED
* Added rsync-fix-FLAG_GOT_DIR_FLIST.patch
- Security update,CVE-2024-12747, bsc#1235475 race condition in handling symbolic links
* Added rsync-CVE-2024-12747.patch
- wget
-
- If wget for an http URL is redirected to a different site (hostname
parts of URLs differ), then any "Authenticate" and "Cookie" header
entries are discarded.
[bsc#1185551, wget-do-not-propagate-credentials.patch,
bsc#1230795, CVE-2021-31879]
- krb5
-
- Prevent overflow when calculating ulog block size. An authenticated
attacker can cause kadmind to write beyond the end of the mapped
region for the iprop log file, likely causing a process crash;
(CVE-2025-24528); (bsc#1236619).
- Add patch 0017-Prevent-overflow-when-calculating-ulog-block-size.patch
- grub2
-
- Fix zfs.mo not found message when booting on legacy BIOS (bsc#1237865)
* 0001-autofs-Ignore-zfs-not-found.patch
- Security fixes for 2024
* 0001-misc-Implement-grub_strlcpy.patch
- Fix CVE-2024-45781 (bsc#1233617)
* 0002-fs-ufs-Fix-a-heap-OOB-write.patch
- Fix CVE-2024-56737 (bsc#1234958)
- Fix CVE-2024-45782 (bsc#1233615)
* 0003-fs-hfs-Fix-stack-OOB-write-with-grub_strcpy.patch
- Fix CVE-2024-45780 (bsc#1233614)
* 0004-fs-tar-Integer-overflow-leads-to-heap-OOB-write.patch
- Fix CVE-2024-45783 (bsc#1233616)
* 0005-fs-hfsplus-Set-a-grub_errno-if-mount-fails.patch
* 0006-kern-file-Ensure-file-data-is-set.patch
* 0007-kern-file-Implement-filesystem-reference-counting.patch
- Fix CVE-2025-0624 (bsc#1236316)
* 0008-net-Fix-OOB-write-in-grub_net_search_config_file.patch
- Fix CVE-2024-45774 (bsc#1233609)
* 0009-video-readers-jpeg-Do-not-permit-duplicate-SOF0-mark.patch
- Fix CVE-2024-45775 (bsc#1233610)
* 0010-commands-extcmd-Missing-check-for-failed-allocation.patch
- Fix CVE-2025-0622 (bsc#1236317)
* 0011-commands-pgp-Unregister-the-check_signatures-hooks-o.patch
- Fix CVE-2025-0622 (bsc#1236317)
* 0012-normal-Remove-variables-hooks-on-module-unload.patch
- Fix CVE-2025-0622 (bsc#1236317)
* 0013-gettext-Remove-variables-hooks-on-module-unload.patch
- Fix CVE-2024-45776 (bsc#1233612)
* 0014-gettext-Integer-overflow-leads-to-heap-OOB-write-or-.patch
- Fix CVE-2024-45777 (bsc#1233613)
* 0015-gettext-Integer-overflow-leads-to-heap-OOB-write.patch
- Fix CVE-2025-0690 (bsc#1237012)
* 0016-commands-read-Fix-an-integer-overflow-when-supplying.patch
- Fix CVE-2025-1118 (bsc#1237013)
* 0017-commands-minicmd-Block-the-dump-command-in-lockdown-.patch
- Fix CVE-2024-45778 (bsc#1233606)
- Fix CVE-2024-45779 (bsc#1233608)
* 0018-fs-bfs-Disable-under-lockdown.patch
- Fix CVE-2025-0677 (bsc#1237002)
- Fix CVE-2025-0684 (bsc#1237008)
- Fix CVE-2025-0685 (bsc#1237009)
- Fix CVE-2025-0686 (bsc#1237010)
- Fix CVE-2025-0689 (bsc#1237011)
* 0019-fs-Disable-many-filesystems-under-lockdown.patch
- Fix CVE-2025-1125 (bsc#1237014)
- Fix CVE-2025-0678 (bsc#1237006)
* 0020-fs-Prevent-overflows-when-allocating-memory-for-arra.patch
- Bump upstream SBAT generation to 5
- libtasn1
-
- Security fix: [bsc#1236878, CVE-2024-12133]
* Potential DoS in handling of numerous SEQUENCE OF or SET OF elements
* Add libtasn1-CVE-2024-12133.patch
- release-notes-sles
-
- 12.5.20250211 (tracked in bsc#933411)
- Improveed wording (bsc#1233970)
- Fixed lifecycle information with proper version
- 12.5.20250129 (tracked in bsc#933411)
- Fixed lifecycle information (bsc#1236534)
- bind
-
- Limit additional section processing for large RDATA sets.
When answering queries, don’t add data to the additional
section if the answer has more than 13 names in the RDATA. This
limits the number of lookups into the database(s) during a
single client query, reducing the query-processing load.
(CVE-2024-11187)
[bsc#1236596, bind-9.11-CVE-2024-11187.patch]
- python36
-
- Update CVE-2024-11168-validation-IPv6-addrs.patch
according to the Debian version
(gh#python/cpython#103848#issuecomment-2708135083).
- Add CVE-2025-0938-sq-brackets-domain-names.patch which
disallows square brackets ([ and ]) in domain names for parsed
URLs (bsc#1236705, CVE-2025-0938, gh#python/cpython#105704)
- openssl-1_1
-
- Security fix: [bsc#1236136, CVE-2024-13176]
* timing side-channel in the ECDSA signature computation
* Add openssl-CVE-2024-13176.patch
- gnutls
-
- Security fix [bsc#1236974, CVE-2024-12243]
* gnutls: inefficient DER Decoding in libtasn1 could lead to remote DoS
* Add gnutls-x509-optimize-alt-name-access.patch
* Add gnutls-CVE-2024-12243.patch
- curl
-
- Security fix: [bsc#1236590, CVE-2025-0725]
* content_encoding: drop support for zlib before 1.2.0.4
* content_encoding: put the decomp buffers into the writer structs
* Add curl-CVE-2025-0725.patch
- Security fix: [bsc#1236588, CVE-2025-0167]
* netrc: 'default' with no credentials is not a match
* Add curl-CVE-2025-0167.patch
- openssh
-
- Backported patch to fix a MitM attack against OpenSSH's
VerifyHostKeyDNS-enabled client (bsc#1237040, CVE-2025-26465):
* fix-CVE-2025-26465.patch
- write active/enabled switch over files only if not yet present
(bsc#1220110)
- Add patch backported from upstream to add a s390 specific ioctl
for ecc hardware support (bsc#1225637):
* openssh-7.2p2-allow-s390-specific-ioctl-for-ecc-hardware-support.patch
- libxkbfile
-
- U_CVE-2025-26595-0001-xkb-Fix-buffer-overflow-in-XkbVModMaskText.patch
* Buffer overflow in XkbVModMaskText() (CVE-2025-26595, bsc#1237429)
- freetype2
-
- Added patch:
* CVE-2025-27363.patch
+ fixes bsc#1239465, CVE-2025-27363: out-of-bounds write when
attempting to parse font subglyph structures related to
TrueType GX and variable font files
- python3-base
-
- Add CVE-2025-0938-sq-brackets-domain-names.patch which
disallows square brackets ([ and ]) in domain names for parsed
URLs (bsc#1236705, CVE-2025-0938, gh#python/cpython#105704)
- pam
-
- pam_unix/passverify: (get_account_info) [!HELPER_COMPILE]: Always return
PAM_UNIX_RUN_HELPER instead of trying to obtain the shadow password file
entry.
[passverify-always-run-the-helper-to-obtain-shadow-pwd.patch, bsc#1232234,
CVE-2024-10041]
- Do not reject the user with a hash assuming it's non-empty.
[pam_unix-allow-empty-passwords-with-non-empty-hashes.patch]
- mozilla-nss
-
- Updated nss-fips-approved-crypto-non-ec.patch to not pass in
bad targetKeyLength parameters when checking for FIPS approval
after keygen. This was causing false rejections.
- Updated nss-fips-approved-crypto-non-ec.patch to approve
RSA signature verification mechanisms with PKCS padding and
legacy moduli (bsc#1222834).
- timezone
-
- Update to 2025b:
* New zone for Aysén Region in Chile (America/Coyhaique) which
moves from -04/-03 to -03
- Refresh patches
* revert-philippines-historical-data.patch
* tzdata-china.diff
- Update to 2025a:
* Paraguay adopts permanent -03 starting spring 2024
* Improve pre-1991 data for the Philippines
* Etc/Unknown is now reserved
- Update to 2024b:
* Improve historical data for Mexico, Mongolia, and Portugal.
* System V names are now obsolescent.
* The main data form now uses %z.
* The code now conforms to RFC 8536 for early timestamps.
* Support POSIX.1-2024, which removes asctime_r and ctime_r.
* Assume POSIX.2-1992 or later for shell scripts.
* SUPPORT_C89 now defaults to 1.
- Add revert-philippines-historical-data.patch, revert-systemv-deprecation.patch
* Fixes testsuite failures for other packages
- pciutils
-
- Apply "fix-lack-of-exposure-of-pci_init-for-libpci_3.2.patch" to
fix the biosdevname utility, which was broken by an update to
pcituils 3.5.x because the newer version forgot to export
pci_init() for library version LIBPCI_3.2. [bsc#1241994]
- Update to pciutils 3.5.6 from SLE-15 [jsc#PED-4587].
The following patches are obsolete in the newer version:
* add-decoding-of-vendor-specific-vpd-fields.patch
* pciutils-3.1.7-fix-memory-leak-in-get_cache_name.patch
* pciutils-3.5.1-add-support-for-32-bit-pci-domains.patch
* pciutils-lspci-Correct-Root-Capabilities-CRS-Software-Visibil.patch
* show-gen4-speed-properly.patch
- Add "pciutils-Add-PCIe-5.0-data-rate-32-GT-s-support.patch" and
"pciutils-Add-PCIe-6.0-data-rate-64-GT-s-support.patch" to fix
LnkCap speed recognition in lspci for multi PCIe ports such as
the ML110 Gen11. [bsc#1192862]
- Fix lspci outputs few of the VPD data fields are displayed as unknown (bsc#1170554, ltc#185587).
Added:
* pciutils-VPD-When-printing-item-IDs-escape-non-ASCII-characte.patch
* pciutils-VPD-Cleanup.patch
* pciutils-Add-decoding-of-vendor-specific-VPD-fields.patch
- python-instance-billing-flavor-check
-
- Update to version 1.0.0 (jsc#PCT-531)
+ API incompatibility: The check_payg_byos function no longer exits, it now
returns a tuple of (flavor, exit_code). This makes the function reusable.
+ Update the build setup to work with the system interpreter of
upcoming SLE releases. SLE 12 stays with the Python 3.4 interpreter
and SLE 15 with the Python 3.6 interpreter.
- Version 0.1.2 (bsc#1234444)
+ Improve detection of IPv4 and IPv6 network setup and use appropriate
IP version for access the update servers
+ Improve reliability of flavor detection. Try an update server multiple
times to get an answer, if we hit timeouts return the value flavor
value from a cache file.
- Version 0.1.1 (bsc#1235991, bsc#1235992)
+ Add time stamp to log
- From version 0.1.0
+ Doc improvements clarifying exit staus codes
- python-base
-
- Update CVE-2024-11168-validation-IPv6-addrs.patch
according modifications by the Debian
developers (Sylvain Beucler <beuc@debian.org>,
gh#python/cpython#103848#issuecomment-2708135083).
- Modify CVE-2025-0938-sq-brackets-domain-names.patch: we don't
use bracketed_host variable any more (correction of the fix for
bsc#1236705, discovered during analysis for bsc#1223694).
- Add CVE-2025-0938-sq-brackets-domain-names.patch which
disallows square brackets ([ and ]) in domain names for parsed
URLs (bsc#1236705, CVE-2025-0938, gh#python/cpython#105704)
- regionServiceClientConfigAzure
-
- Update to version 2.2.2
+ Replacing certificate for rgnsrv-azure-southeastasia to get rid of weird chain cert
- Update to version 2.2.1
+ New 4096 certificate for rgnsrv-azure-southeastasia
- kernel-default
-
- Bluetooth: L2CAP: Fix build errors in some archs (CVE-2025-21969
bsc#1240784).
- commit 7b7dc2b
- Bluetooth: L2CAP: fix use-after-free in l2cap_conn_del()
(CVE-2025-21969 bsc#1240784).
- Bluetooth: L2CAP: Fix l2cap_global_chan_by_psm regression
(CVE-2025-21969 bsc#1240784).
- commit 45ad638
- kABI workaround for l2cap_conn changes (CVE-2025-21969
bsc#1240784).
- commit 7316449
- Bluetooth: L2CAP: Fix corrupted list in hci_chan_del
(CVE-2025-21969 bsc#1240784).
- Bluetooth: L2CAP: Fix use-after-free caused by l2cap_chan_put
(CVE-2025-21969 bsc#1240784).
- commit afacee7
- Bluetooth: Fix error code in chan_alloc_skb_cb() (bsc#1240582
CVE-2025-22007).
- commit b580f9e
- drm/radeon: fix uninitialized size issue in radeon_vce_cs_parse() (CVE-2025-21996 bsc#1240801).
- commit 4ea5dea
- usb: atm: cxacru: fix a flaw in existing endpoint checks
(bsc#1240582 CVE-2025-21916).
- commit e17a34b
- Bluetooth: L2CAP: Fix slab-use-after-free Read in l2cap_send_cmd
(CVE-2025-21969 bsc#1240784).
- commit 900222a
- iscsi_ibft: Fix UBSAN shift-out-of-bounds warning in
ibft_attr_show_nic() (CVE-2025-21993 bsc#1240797).
- commit 1c1b4a4
- ppp: Fix KMSAN uninit-value warning with bpf (CVE-2025-21922
bsc#1240639).
- commit ca66710
- arm64: cacheinfo: Avoid out-of-bounds write to cacheinfo array (CVE-2025-21785 bsc#1238747)
- commit 24fbd3b
- rapidio: add check for rio_add_net() in rio_scan_alloc_net()
(CVE-2025-21935 bsc#1240700).
- rapidio: fix an API misues when rio_add_net() fails
(CVE-2025-21934 bsc#1240708).
- commit df62006
- dax: make sure inodes are flushed before destroy cache (CVE-2022-49220 bsc#1237936)
- commit dd8bb0a
- sysctl: Fix data races in proc_douintvec() (CVE-2022-49641 bsc#1237831)
- commit 1859db6
- gpu: host1x: Fix a memory leak in 'host1x_remove()' (CVE-2021-47648 bsc#1237725)
- commit 565f8ec
- qede: confirm skb is allocated before using (CVE-2022-49084 bsc#1237751)
- commit a2a6334
- net: fix data-races around sk->sk_forward_alloc (CVE-2024-53124
bsc#1234074).
- commit 7d9d482
- ipv4: prevent potential spectre v1 gadget in
ip_metrics_convert() (CVE-2023-52997 bsc#1240303).
- commit ed98686
- sysctl: Fix data races in proc_douintvec_minmax() (CVE-2022-49640 bsc#1237782)
- commit 0dfbf72
- kernel/sysctl.c: define minmax conv functions in terms of non-minmax versions (bsc#1237782)
- commit 1263b48
- Update references for patches.suse/kernel-sysctl.c-add-missing-range-check-in-do_proc_d.patch (bsc#1237782 bsc#1051510)
- commit 51d8dd8
- pipe: reject F_SETPIPE_SZ with size over UINT_MAX (bsc#1237782)
- commit 57c3c8a
- pipe, sysctl: remove pipe_proc_fn() (bsc#1237782)
- commit 5b47dc3
- pipe, sysctl: drop 'min' parameter from pipe-max-size converter (bsc#1237782)
- commit 559c162
- sysctl: check for UINT_MAX before unsigned int min/max (bsc#1237782)
- commit 6169ace
- pipe: add proc_dopipe_max_size() to safely assign pipe_max_size (bsc#1237782)
- commit 2f6a8d2
- Update references for patches.suse/pipe-match-pipe_max_size-data-type-with-procfs.patch (bsc#1237782 git-fixes)
- commit 4bc1ec0
- nfc: st21nfca: fix memory leaks in EVT_TRANSACTION handling (CVE-2022-49331 bsc#1237813)
- commit 8331408
- phy: qcom-qmp: fix struct clk leak on probe errors (CVE-2022-49397 bsc#1237823)
- commit 29ed697
- KVM: VMX: Prevent RSB underflow before vmenter (CVE-2022-49610
bsc#1238952).
- commit bea6096
- x86/kexec: Fix double-free of elf header buffer (git-fixes
CVE-2022-49546 bsc#1238750).
- x86/kexec: fix memory leak of elf header buffer (CVE-2022-49546
bsc#1238750).
- commit 69722e9
- Refresh patches.suse/ipv6-icmp-convert-to-dev_net_rcu.patch.
- commit 8cd0e69
- firmware: dmi-sysfs: Fix null-ptr-deref in dmi_sysfs_register_handle (bsc#1238467)
- commit 1cd86ca
- scsi: target: tcmu: Fix possible page UAF (CVE-2022-49053
bsc#1237918).
- commit beef048
- mm/khugepaged: fix ->anon_vma race (CVE-2023-52935 bsc#1240276).
- commit a534f8f
- usbnet: gl620a: fix endpoint checking in genelink_bind()
(bsc#1240172 CVE-2025-21877).
- commit 4ca0b45
- Refresh
patches.suse/ipv4-use-RCU-protection-in-ip_dst_mtu_maybe_forward.patch.
- commit 22f6eba
- netem: Update sch->q.qlen before qdisc_tree_reduce_backlog()
(git-fixes CVE-2025-21703 bsc#1237313).
- commit cbd2039
- net: sfp: fix memory leak in sfp_probe() (CVE-2022-49619 bsc#1239003)
- commit 04c9c14
- net: tipc: fix possible refcount leak in tipc_sk_create() (CVE-2022-49620 bsc#1239002)
- commit 73f1781
- team: prevent adding a device which is already a team device lower (CVE-2024-58071 bsc#1238970
- commit 850cca8
- tcp: tcp_rtx_synack() can be called from process context
(CVE-2022-49372 bsc#1238251).
- commit 2b7ccd1
- af_unix: Fix a data-race in unix_dgram_peer_wake_me()
(CVE-2022-49344 bsc#1237988).
- commit 906cfb9
- net/sched: netem: account for backlog updates from child qdisc
(CVE-2024-56770 bsc#1235637).
- net/smc: fix LGR and link use-after-free issue (CVE-2024-56640
bsc#1235436).
- netlink: terminate outstanding dump on socket close
(CVE-2024-53140 bsc#1234222).
- commit fa3efff
- net: mana: Support holes in device list reply msg (bsc#1240133).
- ipvlan: ensure network headers are in skb linear part
(CVE-2025-21891 bsc#1240186).
- bnxt: Do not read past the end of test names (CVE-2023-53010
bsc#1240290).
- net: mdio: validate parameter addr in mdiobus_get_phy()
(CVE-2023-53019 bsc#1240286).
- commit 44816a5
- wifi: brcmfmac: Check the count value of channel spec to
prevent out-of-bounds reads (CVE-2022-49740 bsc#1240233).
- commit 0c49112
- Update
patches.suse/ibmvnic-Don-t-reference-skb-after-sending-to-VIOS.patch
(CVE-2025-21858 bsc#1239468 CVE-2025-21855 bsc#1239484).
- commit f98b7e1
- Update
patches.suse/media-cx24116-prevent-overflows-on-SNR-calculus.patch
(CVE-2024-50290 bsc#1233479 bsc#1225742).
- Update
patches.suse/media-dvbdev-prevent-the-risk-of-out-of-memory-acces.patch
(CVE-2024-53063 bsc#1233557 bsc#1225742).
- commit 3bb8dac
- Update
patches.suse/HID-betop-check-shape-of-output-reports.patch
(git-fixes bsc#1207186 CVE-2023-53015 bsc#1240288).
- Update
patches.suse/Squashfs-fix-handling-and-sanity-checking-of-xattr_i.patch
(git-fixes CVE-2023-52933 bsc#1240275).
- Update
patches.suse/bpf-Fix-pointer-leak-due-to-insufficient-speculative.patch
(bsc#1231375 CVE-2023-53024 bsc#1240272).
- Update
patches.suse/cifs-Fix-oops-due-to-uncleared-server-smbd_conn-in-reconnect.patch
(bsc#1190317 CVE-2023-53006 bsc#1240208).
- Update
patches.suse/cifs-fix-potential-memory-leaks-in-session-setup.patch
(bsc#1190317 CVE-2023-53008 bsc#1240318).
- Update
patches.suse/netlink-prevent-potential-spectre-v1-gadgets.patch
(bsc#1209547 CVE-2017-5753 CVE-2023-53000 bsc#1240227).
- Update
patches.suse/powerpc-imc-pmu-Fix-use-of-mutex-in-IRQs-disabled-se.patch
(bsc#1054914 fate#322448 git-fixes CVE-2023-53031 bsc#1240285).
- Update
patches.suse/scsi-iscsi_tcp-Fix-UAF-during-login-when-accessing-the-shost-ipaddress.patch
(bsc#1210647 CVE-2023-2162 CVE-2023-52974 bsc#1240213).
- Update
patches.suse/squashfs-harden-sanity-check-in-squashfs_read_xattr_.patch
(git-fixes CVE-2023-52979 bsc#1240282).
- Update
patches.suse/tracing-Make-sure-trace_printk-can-output-as-soon-as-it-can-be-used.patch
(git-fixes CVE-2023-53007 bsc#1240229).
- Update
patches.suse/vc_screen-move-load-of-struct-vc_data-pointer-in-vcs.patch
(bsc#1213167 CVE-2023-3567 CVE-2023-52973 bsc#1240218).
- commit 5c75cc8
- Update
patches.suse/cpufreq-governor-Use-kobject-release-method-to-free-dbs_data.patch
(bsc#1237800 CVE-2022-49513).
- commit d961554
- um: Fix out-of-bounds read in LDT setup (CVE-2022-49395 bsc#1237953)
- commit 9b1534c
- firmware: dmi-sysfs: Fix memory leak in dmi_sysfs_register_handle (CVE-2022-49370 bsc#1238467)
- commit 56fb9f5
- ipw2x00: Fix potential NULL dereference in libipw_xmit() (CVE-2022-49544 bsc#1238721)
- commit b1c6aa1
- tee: optee: Fix supplicant wait loop (CVE-2025-21871
bsc#1240183).
- commit dd819c0
- team: add ethtool get_link_ksettings (bsc#1228909).
- commit 29a7164
- Refresh
patches.suse/net-remove-two-BUG-from-skb_checksum_help.patch.
- commit f154628
- cpufreq: governor: Use kobject release() method to free dbs_data
(bsc#1237800).
- dbs_data kABI workaround (bsc#1237800 CVE-2022-49513).
- commit 1891c97
- cpufreq: Move to_gov_attr_set() to cpufreq.h (bsc#1237800
CVE-2022-49513).
- commit af55b29
- net: usb: usbnet: restore usb%d name exception for local mac
addresses (bsc#1234480).
- commit c9b9e0d
- scsi: pm8001: Fix memory leak in pm8001_chip_fw_flash_update_req() (CVE-2022-49119 bsc#1237925)
- commit 3b2e4a3
- scsi: pm8001: Fix task leak in pm8001_send_abort_all() (CVE-2022-49120 bsc#1237969)
- commit 5941b1a
- RDMA/hfi1: Prevent use of lock before it is initialized (CVE-2022-49433 bsc#1238268)
- commit 6b108b0
- drm/msm/hdmi: check return value after calling
platform_get_resource_byname() (CVE-2022-49495 bsc#1237932).
- commit 250e248
- ipv6: mcast: extend RCU protection in igmp6_send()
(CVE-2025-21759 bsc#1238738).
- commit de67669
- ndisc: extend RCU protection in ndisc_send_skb() (CVE-2025-21760
bsc#1238763).
- commit bbd5bed
- vrf: use RCU protection in l3mdev_l3_out() (CVE-2025-21791
bsc#1238512).
- commit 67aac47
- arp: use RCU protection in arp_xmit() (CVE-2025-21762
bsc#1238780).
- commit 86c524f
- neighbour: use RCU protection in __neigh_notify()
(CVE-2025-21763 bsc#1237897).
- commit d195b5b
- ndisc: use RCU protection in ndisc_alloc_skb() (bsc#1239994).
- commit f3d8410
- ndisc: ndisc_send_redirect() must use dev_get_by_index_rcu()
(bsc#1239994).
- commit 794c7eb
- ipv6: Use RCU in ip6_input() (bsc#1239994).
- commit 81adbde
- ipv6: icmp: convert to dev_net_rcu() (bsc#1239994).
- commit 86dda00
- ipv6: use RCU protection in ip6_default_advmss() (CVE-2025-21765
bsc#1237906).
- commit 00b5f63
- ipv4: use RCU protection in __ip_rt_update_pmtu()
(CVE-2025-21766 bsc#1238754).
- commit ae267d9
- ipv4: use RCU protection in inet_select_addr() (bsc#1239994).
- commit 442e2c4
- ipv4: use RCU protection in rt_is_expired() (bsc#1239994).
- commit 6439cd7
- ipv4: use RCU protection in ip_dst_mtu_maybe_forward()
(bsc#1239994).
- commit 6b0f168
- ipv4: add RCU protection to ip4_dst_hoplimit() (bsc#1239994).
- commit fc7ba98
- net: add dev_net_rcu() helper (bsc#1239994).
- commit 51827b8
- net: treat possible_net_t net pointer as an RCU one and add
read_pnet_rcu() (bsc#1239994).
- commit a3369f3
- drm/amdgpu: Fix potential NULL pointer dereference in
atomctrl_get_smc_sclk_range_table (CVE-2024-58052 bsc#1238986).
- commit 9320da0
- KVM: Explicitly verify target vCPU is online in kvm_get_vcpu()
(CVE-2024-58083 bsc#1239036).
- commit 22cf047
- nfp: bpf: Add check for nfp_app_ctrl_msg_alloc() (CVE-2025-21848
bsc#1239479).
- commit 55016a1
- igc: Reinstate IGC_REMOVED logic and implement it properly
(CVE-2022-49605 bsc#1238433).
- commit 5af1e50
- net: dsa: mv88e6xxx: Fix refcount leak in
mv88e6xxx_mdios_register (CVE-2022-49367 bsc#1238447).
- commit 3ebb662
- net: tun: unlink NAPI from device on destruction (CVE-2022-49672
bsc#1238816).
- commit e432fa1
- kABI fix for tcp: properly terminate timers for kernel sockets
(CVE-2024-35910 bsc#1224489).
- commit 03a709f
- ip: Fix data-races around sysctl_ip_prot_sock. (CVE-2022-49578 bsc#1238794)
- commit 55c2c0e
- kABI fix for mptcp: add sk_stop_timer_sync helper
(CVE-2024-35910 bsc#1224489).
- commit d3152b9
- mptcp: add sk_stop_timer_sync helper (CVE-2024-35910
bsc#1224489).
- Refresh patches.suse/net-add-sock_init_data_uid.patch.
- commit b72feae
- net: remove two BUG() from skb_checksum_help() (CVE-2022-49497
bsc#1238946).
- commit 243b7fc
- net: bonding: fix use-after-free after 802.3ad slave unbind (CVE-2022-49667 bsc#1238282)
- commit bd21be6
- wifi: mac80211: fix use-after-free in chanctx code (CVE-2022-49416 bsc#1238293)
- commit 40d129d
- bus: fsl-mc-bus: fix KASAN use-after-free in fsl_mc_bus_remove() (CVE-2022-49711 bsc#1238416)
- commit 1048344
- media: pci: cx23885: Fix the error handling in cx23885_initdev() (CVE-2022-49524 bsc#1238949)
- commit 45001c2
- NFC: NULL out the dev->rfkill to prevent UAF (CVE-2022-49505 bsc#1238615)
- commit 8dd4c4d
- kABI: protect mr_ifc_count change (CVE-2022-49589 bsc#1238598).
- igmp: Fix data-races around sysctl_igmp_qrv (CVE-2022-49589
bsc#1238598).
- net: igmp: increase size of mr_ifc_count (CVE-2022-49589
bsc#1238598).
- net: igmp: fix data-race in igmp_ifc_timer_expire()
(CVE-2022-49589 bsc#1238598).
- commit 3efb324
- i2c: dev: check return value when calling dev_set_name() (CVE-2022-49046 bsc#1237842)
- commit de84566
- btrfs: fix qgroup reserve overflow the qgroup limit
(CVE-2022-49075 bsc#1237733).
- commit bf9031a
- ceph: fix inode reference leakage in ceph_get_snapdir() (CVE-2022-49109 bsc#1237836)
- commit d418afc
- ceph: fix up error handling with snapdirs (bsc#1237836)
- commit f7001b0
- ubi: ubi_create_volume: Fix use-after-free when volume creation failed (CVE-2022-49388 bsc#1237934)
- commit 0d5c203
- ceph: fix memory leak in ceph_readdir when note_last_dentry returns error (CVE-2022-49107 bsc#1237973)
- commit 40beec1
- ila: serialize calls to nf_register_net_hooks() (CVE-2024-57900
bsc#1235973).
- commit d69423e
- tcp: properly terminate timers for kernel sockets
(CVE-2024-35910 bsc#1224489).
- commit 5ce5df8
- ACPI: PAD: fix crash in exit_round_robin() (bsc#1232370
CVE-2024-49935).
- commit e03632e
- Update
patches.suse/netfilter-nf_tables-initialize-registers-in-nft_do_c.patch
(CVE-2022-1016 bsc#1197227 CVE-2022-49293 bsc#1239454).
- commit cedf6cd
- fbdev: omap: use threaded IRQ for LCD DMA (bsc#1239174 CVE-2025-21821)
- commit f159c1f
- drm/amd/pm: fix double free in si_parse_power_table() (bsc#1238944 CVE-2022-49530)
- commit dfebfa5
- net: phy: micrel: Allow probing without .driver_data
(CVE-2022-49472 bsc#1238951).
- ice: always check VF VSI pointer values (CVE-2022-49516
bsc#1238953).
- commit f9c1961
- geneve: Suppress list corruption splat in
geneve_destroy_tunnels() (CVE-2025-21858 bsc#1239468).
- gtp: Suppress list corruption splat in gtp_net_exit_batch_rtnl()
(CVE-2025-21865 bsc#1239481).
- ibmvnic: Don't reference skb after sending to VIOS
(CVE-2025-21858 bsc#1239468).
- geneve: Fix use-after-free in geneve_find_dev() (CVE-2025-21858
bsc#1239468).
- commit 7c11337
- net: fix SO_REUSEPORT return code (bsc#1239448)
- commit 3c526b1
- nfsd: clear acl_access/acl_default after releasing them
(bsc#1238716 CVE-2025-21796).
- commit d1c11c1
- acct: perform last write from workqueue (CVE-2025-21846
bsc#1239508).
- commit 5fc1617
- irqchip/gic-v3: Fix GICR_CTLR.RWP polling (git-fixes
CVE-2022-49074 bsc#1237728).
- commit 9f6dc13
- media: staging: media: zoran: calculate the right buffer number
for zoran_reap_stat_com (CVE-2021-47645 bsc#1237767).
- commit eab4973
- PCI: Avoid putting some root ports into D3 on TUXEDO Sirius Gen1
(CVE-2025-21831 bsc#1239039).
- commit 10f73c4
- net/smc: check iparea_offset and ipv6_prefixes_cnt when
receiving proposal msg (CVE-2024-49571 bsc#1235733).
- commit ef9a771
- kABI fix for l2tp: prevent possible tunnel refcount underflow
(CVE-2024-49940 bsc#1232812).
Upstream commit 24256415d186 ("l2tp: prevent possible tunnel
refcount underflow") changed the API of `l2tp_session_set_header_len()`
and this patch re-introduces the API in that version.
- commit 803eb4b
- l2tp: prevent possible tunnel refcount underflow (CVE-2024-49940
bsc#1232812).
- commit 377601f
- drm/msm/mdp5: Return error code in mdp5_mixer_release when deadlock (bsc#1238600 CVE-2022-49488)
- commit b961f00
- bpf, sockmap: Fix memleak in tcp_bpf_sendmsg while sk msg is
full (bsc#1238252 CVE-2022-49209).
- commit aeb9c23
- scripts: fix incorrect regex escape
With Tumbleweed's recent switch to Python 3.13 recently I noticed
several syntax warning related to regex
.../scripts/python/suse_git/patch.py:57: SyntaxWarning: invalid escape sequence '\*'
break_matcher = re.compile(b"(---|\*\*\*|Index:)[ \t][^ \t]|^diff -")
.../scripts/python/git_sort/git_sort.py:490: SyntaxWarning: invalid escape sequence '\.'
version_match = re.compile("refs/tags/v(2\.6\.\d+|\d\.\d+)(-rc\d+)?$")
.../scripts/python/git_sort/git_sort.py:578: SyntaxWarning: invalid escape sequence '\.'
m = re.search("v([0-9]+)\.([0-9]+)(|-rc([0-9]+))$", tags[-1])
Fix them by using raw string/byte literal instead.
Link: https://docs.python.org/3/reference/lexical_analysis.html#string-and-bytes-literals
- commit 74871be
- netpoll: Fix race condition in netpoll_owner_active
(CVE-2024-41005 bsc#1227858).
- net: make sure napi_list is safe for RCU traversal
(CVE-2024-41005 bsc#1227858).
- commit b55492f
- net: usb: aqc111: Fix out-of-bounds accesses in RX fixup
(bsc#1237903 CVE-2022-49051).
- commit eb6ef6f
- usb: musb: sunxi: Fix accessing an released usb phy (bsc#1233458
CVE-2024-50269).
- commit 14a906c
- USB: hub: Ignore non-compliant devices with too many configs
or interfaces (bsc#1238909 CVE-2025-21776).
- commit 6d1cc77
- net: usb: rtl8150: enable basic endpoint checking (bsc#1239087
CVE-2025-21708).
- commit 582b035
- Refresh
patches.suse/net-smc-fix-kernel-panic-caused-by-race-of-smc_sock.patch.
- commit 89c4c51
- ALSA: usb-audio: Cancel pending work at closing a MIDI substream
(CVE-2022-49545 bsc#1238729).
- commit c5aef00
- net_sched: sch_sfq: don't allow 1 packet limit (CVE-2024-57996
bsc#1239076).
- commit 30f09ff
- wifi: brcmfmac: fix NULL pointer dereference in
brcmf_txfinalize() (CVE-2025-21744 bsc#1238903).
- commit af88382
- Update
patches.suse/0006-dm-raid-fix-accesses-beyond-end-of-raid-member-array.patch
(git-fixes CVE-2022-49674 bsc#1239041).
- Update
patches.suse/0013-block-don-t-delete-queue-kobject-before-its-children.patch
(git-fixes CVE-2022-49259 bsc#1238413).
- Update
patches.suse/0013-dm-mirror-log-round-up-region-bitmap-size-to-BITS_PE.patch
(git-fixes CVE-2022-49710 bsc#1238417).
- Update
patches.suse/0015-bfq-Update-cgroup-information-before-merging-bio.patch
(git-fixes CVE-2022-49413 bsc#1238710).
- Update
patches.suse/0074-dm-ioctl-prevent-potential-spectre-v1-gadget.patch
(git-fixes CVE-2022-49122 bsc#1237983).
- Update
patches.suse/0077-nbd-call-genl_unregister_family-first-in-nbd_cleanup.patch
(git-fixes CVE-2022-49295 bsc#1238707).
- Update
patches.suse/0078-nbd-fix-race-between-nbd_alloc_config-and-module-removal.patch
(git-fixes CVE-2022-49300 bsc#1238183).
- Update
patches.suse/0079-nbd-fix-io-hung-while-disconnecting-device.patch
(git-fixes CVE-2022-49297 bsc#1238469).
- Update
patches.suse/ALSA-pcm-Fix-potential-AB-BA-lock-with-buffer_mutex-.patch
(CVE-2022-1048 bsc#1197331 CVE-2022-49272 bsc#1238272).
- Update
patches.suse/ALSA-pcm-Fix-races-among-concurrent-hw_params-and-hw.patch
(CVE-2022-1048 bsc#1197331 CVE-2022-49291 bsc#1238705).
- Update
patches.suse/ALSA-pcm-Fix-races-among-concurrent-prealloc-proc-wr.patch
(CVE-2022-1048 bsc#1197331 CVE-2022-49288 bsc#1238271).
- Update
patches.suse/ALSA-pcm-oss-Fix-race-at-SNDCTL_DSP_SYNC.patch
(CVE-2022-3303 bsc#1203769 CVE-2022-49733 bsc#1238454).
- Update
patches.suse/Bluetooth-hci_qca-Use-del_timer_sync-before-freeing.patch
(git-fixes CVE-2022-49555 bsc#1238231).
- Update
patches.suse/NFSD-prevent-underflow-in-nfssvc_decode_writeargs.patch
(git-fixes CVE-2022-49280 bsc#1238630).
- Update
patches.suse/PCI-Avoid-pci_dev_lock-AB-BA-deadlock-with-sriov_num.patch
(git-fixes CVE-2022-49434 bsc#1238916).
- Update
patches.suse/RDMA-hfi1-Prevent-panic-when-SDMA-is-disabled.patch
(git-fixes CVE-2022-49429 bsc#1238889).
- Update
patches.suse/SUNRPC-Fix-the-svc_deferred_event-trace-class.patch
(git-fixes CVE-2022-49065 bsc#1237739).
- Update
patches.suse/bpf-sockmap-Fix-more-uncharged-while-msg-has-more_da.patch
(bsc#1235485 CVE-2024-56633 CVE-2022-49204 bsc#1238240).
- Update
patches.suse/cgroup-Use-separate-src-dst-nodes-when-preloading-css_sets-for-migration.patch
(bsc#1201610 CVE-2022-49647 bsc#1238805).
- Update patches.suse/cifs-fix-handlecache-and-multiuser.patch
(bsc#1190317 CVE-2022-49281 bsc#1238635).
- Update
patches.suse/cifs-potential-buffer-overflow-in-handling-symlinks.patch
(bsc#1190317 CVE-2022-49058 bsc#1237814).
- Update
patches.suse/cifs-prevent-bad-output-lengths-in-smb2_ioctl_query_info-.patch
(bsc#1190317 CVE-2022-49271 bsc#1238626).
- Update patches.suse/crypto-qat-fix-memory-leak-in-RSA.patch
(git-fixes CVE-2022-49566 bsc#1238266).
- Update patches.suse/dlm-fix-plock-invalid-read.patch (git-fixes
CVE-2022-49407 bsc#1238180).
- Update
patches.suse/dm-raid-fix-KASAN-warning-in-raid5_add_disks.patch
(git-fixes CVE-2022-49673 bsc#1238933).
- Update
patches.suse/drbd-Fix-five-use-after-free-bugs-in-get_initial_state
(git-fixes CVE-2022-49085 bsc#1238036).
- Update
patches.suse/drivers-usb-host-Fix-deadlock-in-oxu_bus_suspend.patch
(git-fixes CVE-2022-49313 bsc#1238633).
- Update
patches.suse/drm-virtio-fix-NULL-pointer-dereference-in-virtio_gp.patch
(git-fixes CVE-2022-49532 bsc#1238925).
- Update
patches.suse/exec-Force-single-empty-string-when-argv-is-empty.patch
(bsc#1200571 CVE-2022-49264 bsc#1237815).
- Update patches.suse/ext4-add-reserved-GDT-blocks-check.patch
(bsc#1202712 CVE-2022-49707 bsc#1239035).
- Update patches.suse/ext4-avoid-cycles-in-directory-h-tree.patch
(bsc#1198577 CVE-2022-1184 CVE-2022-49343 bsc#1238382).
- Update patches.suse/ext4-fix-bug_on-ext4_mb_use_inode_pa.patch
(bsc#1200810 CVE-2022-49708 bsc#1238599).
- Update patches.suse/ext4-fix-bug_on-in-__es_tree_search.patch
(bsc#1200809 CVE-2022-49409 bsc#1238279).
- Update patches.suse/ext4-fix-bug_on-in-ext4_writepages.patch
(bsc#1200872 CVE-2022-49347 bsc#1238393).
- Update
patches.suse/ext4-fix-race-condition-between-ext4_write-and-ext4_.patch
(bsc#1200807 CVE-2022-49414 bsc#1238623).
- Update
patches.suse/ext4-fix-use-after-free-in-ext4_rename_dir_prepare.patch
(bsc#1200871 CVE-2022-49349 bsc#1238372).
- Update patches.suse/icmp-Fix-data-races-around-sysctl.patch
(CVE-2024-47678 bsc#1231854 git-fixes CVE-2022-49638
bsc#1238613).
- Update
patches.suse/ixgbe-Add-locking-to-prevent-panic-when-setting-srio.patch
(git-fixes CVE-2022-49584 bsc#1237933).
- Update patches.suse/list-fix-a-data-race-around-ep-rdllist.patch
(git-fixes CVE-2022-49443 bsc#1238434).
- Update
patches.suse/md-bitmap-don-t-set-sb-values-if-can-t-pass-sanity-c.patch
(bsc#1197158 CVE-2022-49526 bsc#1238030).
- Update
patches.suse/module-fix-e_shstrndx-.sh_size-0-OOB-access.patch
(git-fixes CVE-2022-49444 bsc#1238127).
- Update
patches.suse/msft-hv-2556-Drivers-hv-vmbus-Fix-potential-crash-on-module-unloa.patch
(git-fixes CVE-2022-49098 bsc#1238079).
- Update
patches.suse/mxser-fix-xmit_buf-leak-in-activate-when-LSR-0xff.patch
(git-fixes CVE-2022-49191 bsc#1238133).
- Update
patches.suse/net-asix-add-proper-error-handling-of-usb-read-error.patch
(git-fixes CVE-2022-49226 bsc#1238336).
- Update
patches.suse/nvme-pci-fix-a-NULL-pointer-dereference-in-nvme_allo.patch
(git-fixes CVE-2022-49492 bsc#1238954).
- Update
patches.suse/ocfs2-dlmfs-fix-error-handling-of-user_dlm_destroy_l.patch
(git-fixes CVE-2022-49337 bsc#1238376).
- Update
patches.suse/powerpc-pseries-Fix-use-after-free-in-remove_phb_dyn.patch
(bsc#1065729 bsc#1198660 ltc#197803 CVE-2022-49196 bsc#1238274).
- Update
patches.suse/powerpc-tm-Fix-more-userspace-r13-corruption.patch
(bsc#1065729 CVE-2022-49164 bsc#1238108).
- Update
patches.suse/powerpc-xics-fix-refcount-leak-in-icp_opal_init.patch
(bsc#1065729 CVE-2022-49432 bsc#1238950).
- Update
patches.suse/powerpc-xive-Fix-refcount-leak-in-xive_spapr_init.patch
(fate#322438 git-fixes CVE-2022-49437 bsc#1238443).
- Update
patches.suse/powerpc-xive-spapr-correct-bitmap-allocation-size.patch
(fate#322438 git-fixes CVE-2022-49623 bsc#1239040).
- Update
patches.suse/scsi-libfc-Fix-use-after-free-in-fc_exch_abts_resp.patch
(git-fixes CVE-2022-49114 bsc#1238146).
- Update
patches.suse/scsi-lpfc-Address-NULL-pointer-dereference-after-sta.patch
(git-fixes CVE-2022-49332 bsc#1238236).
- Update
patches.suse/scsi-pm8001-Fix-abort-all-task-initialization
(git-fixes CVE-2022-49217 bsc#1238313).
- Update
patches.suse/scsi-qla2xxx-Fix-crash-during-module-load-unload-tes.patch
(bsc#1197661 CVE-2022-49160 bsc#1238172).
- Update
patches.suse/scsi-qla2xxx-Fix-premature-hw-access-after-PCI-error.patch
(bsc#1195823 CVE-2022-49157 bsc#1238169).
- Update
patches.suse/scsi-qla2xxx-Fix-scheduling-while-atomic.patch
(bsc#1195823 CVE-2022-49156 bsc#1238168).
- Update
patches.suse/scsi-qla2xxx-Fix-warning-message-due-to-adisc-being-.patch
(bsc#1195823 CVE-2022-49158 bsc#1238170).
- Update
patches.suse/scsi-qla2xxx-Implement-ref-count-for-SRB.patch
(bsc#1195823 CVE-2022-49159 bsc#1238171).
- Update
patches.suse/scsi-qla2xxx-Suppress-a-kernel-complaint-in-qla_crea.patch
(bsc#1195823 CVE-2022-49155 bsc#1237941).
- Update
patches.suse/scsi-zorro7xx-Fix-a-resource-leak-in-zorro7xx_remove_one
(git-fixes CVE-2022-49095 bsc#1237752).
- Update
patches.suse/tcp-fix-tcp_mtup_probe_success-vs-wrong-snd_cwnd.patch
(bsc#1218450 CVE-2022-49330 bsc#1238378).
- Update
patches.suse/tpm-fix-reference-counting-for-struct-tpm_chip.patch
(CVE-2022-2977 bsc#1202672 CVE-2022-49287 bsc#1238276).
- Update
patches.suse/tracing-Fix-sleeping-function-called-from-invalid-context-on-RT-kernel.patch
(git-fixes CVE-2022-49322 bsc#1238396).
- Update
patches.suse/usb-dwc2-Fix-memory-leak-in-dwc2_hcd_init.patch
(git-fixes CVE-2022-49713 bsc#1238419).
- Update
patches.suse/usb-usbip-fix-a-refcount-leak-in-stub_probe.patch
(git-fixes CVE-2022-49389 bsc#1238257).
- Update patches.suse/usbnet-fix-memory-leak-in-error-case.patch
(git-fixes CVE-2022-49657 bsc#1238269).
- Update
patches.suse/veth-Ensure-eth-header-is-in-skb-s-linear-part.patch
(git-fixes CVE-2022-49066 bsc#1237722).
- Update
patches.suse/video-fbdev-clcdfb-Fix-refcount-leak-in-clcdfb_of_vr.patch
(bsc#1129770 CVE-2022-49421 bsc#1238819).
- Update
patches.suse/virtio_console-eliminate-anonymous-module_init-modul.patch
(git-fixes CVE-2022-49100 bsc#1237735).
- Update
patches.suse/virtio_net-fix-xdp_rxq_info-bug-after-suspend-resume.patch
(git-fixes CVE-2022-49687 bsc#1238181).
- Update
patches.suse/x86-speculation-fill-rsb-on-vmexit-for-ibrs.patch
(bsc#1201726 CVE-2022-26373 CVE-2022-49611 bsc#1238618).
- Update
patches.suse/xen-netback-avoid-entering-xenvif_rx_next_skb-with-a.patch
(bsc#1201381 CVE-2022-49649 bsc#1238612).
- Update
patches.suse/xprtrdma-treat-all-calls-not-a-bcall-when-bc_serv-is.patch
(git-fixes CVE-2022-49321 bsc#1238373).
- commit c156b3c
- Update
patches.suse/0008-video-fbdev-smscufx-Fix-null-ptr-deref-in-ufx_usb_pr.patch
(bsc#1129770 CVE-2021-47652 bsc#1237721).
- Update
patches.suse/ath5k-fix-OOB-in-ath5k_eeprom_read_pcal_info_5111.patch
(git-fixes CVE-2021-47633 bsc#1237768).
- commit 9ae3067
- rdma/cxgb4: Prevent potential integer overflow on 32bit (CVE-2024-57973 bsc#1238531)
- commit dbbc8b2
- RDMA/hfi1: Fix potential integer multiplication overflow errors (CVE-2022-49404 bsc#1238430)
- commit 80a20e6
- nfc: nci: add flush_workqueue to prevent uaf (CVE-2022-49059 bsc#1238007)
- commit 305c681
- ipv6: Fix signed integer overflow in l2tp_ip6_sendmsg (CVE-2022-49727 bsc#1239059)
- commit 7f3b150
- can: m_can: m_can_tx_handler(): fix use after free of skb (CVE-2022-49275 bsc#1238719)
- commit 1fdfcc6
- crypto: qat - add param check for DH (CVE-2022-49564 bsc#1238789)
- commit 7f4f28c
- crypto: qat - add param check for RSA (CVE-2022-49563 bsc#1238787)
- commit f87e665
- wifi: brcmsmac: add gain range check to wlc_phy_iqcal_gainparams_nphy() (CVE-2024-58014 bsc#1239109)
- commit fe78d7b
- orangefs: fix a oob in orangefs_debug_write (git-fixes
bsc#1239117 CVE-2025-21782).
- commit 6a7a2b9
- ALSA: jack: Fix mutex call in snd_jack_report() (CVE-2022-49538
bsc#1238843).
- commit 0a9be43
- kABI workaround for snd_jack.input_dev_lock field
(CVE-2022-49538 bsc#1238843).
- commit 0decf9d
- ALSA: jack: Access input_dev under mutex (CVE-2022-49538
bsc#1238843).
- ath10k: skip ath10k_halt during suspend for driver state
RESTARTING (CVE-2022-49519 bsc#1238943).
- commit b758634
- extcon: Modify extcon device to be created after driver data
is set (CVE-2022-49308 bsc#1238654).
- commit bb2d5d7
- ALSA: oss: Fix PCM OSS buffer allocation overflow
(CVE-2022-49292 bsc#1238625).
- commit 05f3e03
- wifi: rtlwifi: remove unused check_buddy_priv (CVE-2024-58072
bsc#1238964).
- commit ca6cdaf
- perf/core: Fix data race between perf_event_set_output()
and perf_mmap_close() (CVE-2022-49607 bsc#1238817).
- commit 7d0651a
- kABI workaround for pps changes (CVE-2024-57979 bsc#1238521).
- commit ecc73ae
- pps: Fix a use-after-free (CVE-2024-57979 bsc#1238521).
- commit 5e01f6b
- net: hns3: fix oops when unload drivers paralleling
(CVE-2025-21802 bsc#1238751).
- be2net: Fix buffer overflow in be_get_module_eeprom
(CVE-2022-49581 bsc#1238540).
- commit f8f5e83
- tpm: use try_get_ops() in tpm-space.c (CVE-2022-49286
bsc#1238647).
- commit 0f153ea
- ipvs: fix UB due to uninitialized stack access in
ip_vs_protocol_init() (CVE-2024-53680 bsc#1235715).
- commit 8dac11a
- kABI workaround for bluetooth hci_conn struct change
(CVE-2024-36968 bsc#1226130).
- commit be09290
- Bluetooth: L2CAP: Fix div-by-zero in l2cap_le_flowctl_init()
(CVE-2024-36968 bsc#1226130).
- commit 930b6c7
- scsi: qedf: Ensure the copied buf is NUL terminated
(CVE-2024-38559 bsc#1226785).
- commit 15b9d87
- mailbox: bcm2835: Fix timeout during suspend mode
(CVE-2024-49963 bsc#1232147).
- commit 75bdf4b
- x86/mce: Work around an erratum on fast string copy instructions (bsc#1238148 CVE-2022-49124).
- commit b1aab7b
- drm/msm/mdp5: Fix global state lock backoff (bsc#1238275)
- commit d68fed1
- sfc: fix use after free when disabling sriov (CVE-2022-49626
bsc#1238270).
- net: hns3: add vlan list lock to protect vlan list
(CVE-2022-49182 bsc#1238260).
- ibmvnic: fix race between xmit and reset (CVE-2022-49201
bsc#1238256).
- mlxsw: spectrum: Guard against invalid local ports
(CVE-2022-49134 bsc#1237982).
- net: hns3: remove useless mutex vport_cfg_mutex in the struct
hclge_dev (CVE-2022-49182 bsc#1238260).
- commit 41d3a51
- kABI fix for net/smc: fix kernel panic caused by race of
smc_sock (CVE-2021-46925 bsc#1220466).
Upstream commit 349d43127dac ("net/smc: fix kernel panic caused
by race of smc_sock") introduced two new variables into `struct
smc_connection`, which is not public, but still privately exposed.
Since allocation always happens via `smcd_alloc_dev()` we should be
safe to simply hide the symbols for the kABI checker.
- commit 5f5274c
- drm/msm/mdp5: Return error code in mdp5_pipe_release when deadlock is (bsc#1238275 CVE-2022-49490)
- commit af254cd
- net/smc: fix kernel panic caused by race of smc_sock
(CVE-2021-46925 bsc#1220466).
- commit a03d2f6
- drm/amd/display: Fix memory leak (bsc#1238006 CVE-2022-49135)
- commit 74a7dda
- memstick/mspro_block: fix handling of read-only devices
(CVE-2022-49178 bsc#1238107).
- commit f4ff479
- bpf, sockmap: Fix repeated calls to sock_put() when msg has
more_data (bsc#1235485 CVE-2024-56633).
- commit 8b17f20
- net/smc: Remove unused function declaration (CVE-2021-46925
bsc#1220466).
- commit c673437
- tracing: Free buffers when a used dynamic event is removed
(bsc#1232163 CVE-2022-49006).
- blacklist.conf: Remove the commit from the list.
- commit dc40c84
- tracing: Only have rmmod clear buffers that its events were
active in (bsc#1232163).
- kABI: Preserve TRACE_EVENT_FL values (bsc#1232163).
- kABI: Add clear_trace to trace_array (bsc#1232163).
- commit 314b5be
- uprobes: fix kernel info leak via "[uprobes]" vma (bsc#1232104
CVE-2024-49975).
- commit c0c10d0
- btrfs: fix use-after-free when attempting to join an aborted transaction (CVE-2025-21753 bsc#1237875)
- commit 6c90c9e
- mm/mempolicy: fix mpol_new leak in shared_policy_replace
(CVE-2022-49080 bsc#1238033).
- commit 067e764
- IB/rdmavt: add lock to call to rvt_error_qp to prevent a race condition (git-fixes CVE-2022-49089 bsc#1238041)
- commit 6e0de51
- RDMA/hfi1: Fix use-after-free bug for mm struct (git-fixes CVE-2022-49076 bsc#1237738)
- commit 6e82988
- gro_cells: Avoid packet re-ordering for cloned skbs
(bsc#1226323).
- commit 31d3c95
- nfsd: restore callback functionality for NFSv4.0 (CVE-2024-53217 bsc#1234999)
- commit 805ad92
- netfilter: nf_tables: don't skip expired elements during walk
(CVE-2023-52924 bsc#1236821).
- commit 0526ace
- can: gs_usb: gs_usb_open/close(): fix memory leak
(CVE-2022-49661 bsc#1237788).
- can: mcba_usb: properly check endpoint type (CVE-2022-49151
bsc#1237778).
- commit 9830891
- media: stk1160: If start stream fails, return buffers with
VB2_BUF_STATE_QUEUED (CVE-2022-49247 bsc#1237783).
- commit a93f4c4
- media: staging: media: zoran: move videodev alloc
(CVE-2021-47644 bsc#1237766).
- commit c96d641
- ubi: Fix race condition between ctrl_cdev_ioctl and
ubi_cdev_ioctl (CVE-2021-47634 bsc#1237758).
- commit d5a9e9b
- USB: serial: quatech2: fix null-ptr-deref in
qt2_process_read_urb() (CVE-2025-21689 bsc#1237017).
- commit 10a8b05
- hid: cp2112: Fix duplicate workqueue initialization
(CVE-2023-52853 bsc#1224988).
- commit 0767a8e
- Update References for CVE-2023-52572 and bsc#bsc#1220946
Patch:
patches.suse/cifs-Fix-UAF-in-cifs_demultiplex_thread-.patch
- commit 8c83bd1
- net: Fix icmp host relookup triggering ip_rt_bug (CVE-2024-56647
bsc#1235435).
- commit 5e3ecca
- net: sched: Disallow replacing of child qdisc from one parent
to another (CVE-2025-21700 bsc#1237159).
- commit 634dd23
- sctp: sysctl: cookie_hmac_alg: avoid using current->nsproxy (CVE-2025-21640 bsc#1236123)
- commit fcc1d3a
- sctp: sysctl: rto_min/max: avoid using current->nsproxy (CVE-2025-21639 bsc#1236122)
- commit cef2fdd
- sctp: sysctl: auth_enable: avoid using current->nsproxy (CVE-2025-21638 bsc#1236115)
- commit cb20958
- rtc: cmos: fix build on non-ACPI platforms (CVE-2022-48953
bsc#1231941).
- commit aeaadef
- scsi: storvsc: Ratelimit warning logs to prevent VM denial of
service (bsc#1237025 CVE-2025-21690).
- scsi: storvsc: Handle SRB status value 0x30 (git-fixes).
- scsi: storvsc: Fix handling of srb_status and capacity change
events (git-fixes).
- scsi: storvsc: Use scsi_cmd_to_rq() instead of scsi_cmnd.request
(git-fixes).
- scsi: storvsc: Log TEST_UNIT_READY errors as warnings
(git-fixes).
- scsi: storvsc: Correctly handle multiple flags in srb_status
(git-fixes).
- scsi: storvsc: Update error logging (git-fixes).
- scsi: storvsc: Miscellaneous code cleanups (git-fixes).
- scsi: storvsc: Return DID_ERROR for invalid commands
(git-fixes).
- scsi: storvsc: Add validation for untrusted Hyper-V values
(git-fixes).
- scsi: storvsc: Fix spelling mistake (git-fixes).
- commit 1ce0fca
- rtc: cmos: Fix wake alarm breakage (CVE-2022-48953 bsc#1231941).
- rtc: cmos: Fix event handler registration ordering issue
(CVE-2022-48953 bsc#1231941).
- commit 18a134d
- gpiolib: fix memory leak in gpiochip_setup_dev() (CVE-2022-48975
bsc#1231885).
- commit 8811266
- uprobe: avoid out-of-bounds memory access of fetching args
(git-fixes CVE-2024-50067 bsc#1232416).
- commit 113452d
- Refresh
patches.suse/cifs-Fix-UAF-in-cifs_demultiplex_thread-.patch.
- Refresh
patches.suse/netfilter-nf_conntrack_irc-Tighten-matching-on-DCC-m.patch.
- powerpc/64/kdump: Limit kdump base to 512MB (bsc#1203410
ltc#199904).
Add upstream commit ID and move to the sorted section.
- commit 8635ca2
- Delete
patches.suse/net-tipc-validate-domain-record-count-on-input.patch.
Obsoleted by upstream commit 9aa422ad326634b76309e8ff342c246800621216
which we already have.
- commit 0f3afb5
- Refresh
patches.suse/SUNRPC-auth-async-tasks-mustn-t-block-waiting-for-me.patch.
- Refresh
patches.suse/SUNRPC-improve-swap-handling-scheduling-and-PF_MEMAL.patch.
- Refresh
patches.suse/SUNRPC-xprt-async-tasks-mustn-t-block-waiting-for-me.patch.
Add upstream commit ID to 3 sunrpc patches and move them to the sorted
section.
- commit 95d9bb0
- Refresh
patches.suse/crypto_ccp-fix_resource_leaks_in_ccp_run_aes_gcm_cmd.patch.
- Refresh
patches.suse/mm-pmem-avoid-inserting-hugepage-pte-entry-with-fsdax-if-hugepage-support-is-disabled.patch.
- Refresh
patches.suse/proc-Avoid-mixing-integer-types-in-mem_rw.patch.
Move these 3 patches to the sorted section with proper upstream
references.
- commit b21e43e
- net: mana: Add get_link and get_link_ksettings in ethtool
(bsc#1236761).
- net: netvsc: Update default VMBus channels (bsc#1236757).
- commit cf42fac
- Refresh
patches.suse/eth-bnxt-always-recalculate-features-after-XDP-clear.patch.
Fix warning introduced by commit 26357a58074c ("eth: bnxt:
always recalculate features after XDP clearing, fix null-deref
(CVE-2025-21682 bsc#1236703).")
- commit cb8e39a
- Update
patches.suse/ALSA-6fire-Release-resources-at-card-release.patch
(CVE-2024-53239 bsc#1235054 bsc#1234853).
- Update
patches.suse/Bluetooth-L2CAP-Fix-uaf-in-l2cap_connect.patch
(CVE-2024-49950 bsc#1232159 bsc#1225742).
- Update
patches.suse/Bluetooth-L2CAP-do-not-leave-dangling-sk-pointer-on-.patch
(CVE-2024-56605 bsc#1235061 bsc#1234853).
- Update
patches.suse/KVM-nSVM-Ignore-nCR3-4-0-when-loading-PDPTEs-from-me.patch
(CVE-2024-50115 bsc#1232919 bsc#1225742).
- Update
patches.suse/NFSv4.0-Fix-a-use-after-free-problem-in-the-asynchronous-open.patch
(CVE-2024-53173 bsc#1234891 bsc#1234853).
- Update
patches.suse/btrfs-wait-for-fixup-workers-before-stopping-cleaner.patch
(bsc#1235965 CVE-2024-57896 CVE-2024-49867 bsc#1232262).
- Update
patches.suse/ext4-avoid-OOB-when-system.data-xattr-changes-undern.patch
(bsc#1231920 CVE-2024-47701 bsc#1225742).
- Update
patches.suse/ext4-fix-slab-use-after-free-in-ext4_split_extent_at.patch
(bsc#1232201 CVE-2024-49884 bsc#1232198 bsc#1225742).
- Update
patches.suse/hfsplus-don-t-query-the-device-logical-block-size-multiple-times.patch
(bsc#1235073 CVE-2024-56548 bsc#1234853).
- Update
patches.suse/tty-n_gsm-Fix-use-after-free-in-gsm_cleanup_mux.patch
(CVE-2024-50073 bsc#1232520 bsc#1225742).
- Update
patches.suse/vfio-pci-Lock-external-INTx-masking-ops.patch
(bsc#1222803 CVE-2024-26810).
- Update
patches.suse/wifi-mwifiex-Fix-memcpy-field-spanning-write-warning-in-mwifiex_config_scan.patch
(CVE-2024-56539 bsc#1234963 bsc#1234853).
- commit f832b51
- Update
patches.suse/btrfs-fix-hang-during-unmount-when-stopping-a-space-.patch
(bsc#1235965 CVE-2024-57896 CVE-2022-48664 bsc#1223524).
- commit 1e97612
- smb: client: fix double free of TCP_Server_Info::hostname
(CVE-2025-21673 bsc#1236689).
- commit a8e944b
- kABI fix for net: defer final 'struct net' free in netns
dismantle (CVE-2024-56658 bsc#1235441).
Upstream commit 0f6ede9fbc74 ("net: defer final 'struct
net' free in netns dismantle") introduced a new struct element
`defer_free_list` into `struct net`. In order to preserve the kABI, move
the newly added element into a hole.
```
struct netns_unix unx; /* 536 16 */
/* XXX 24 bytes hole, try to pack */
/* --- cacheline 9 boundary (576 bytes) --- */
struct netns_ipv4 ipv4 __attribute__((__aligned__(64))); /* 576 1088 */
```
- commit 3fe112a
- net: defer final 'struct net' free in netns dismantle
(CVE-2024-56658 bsc#1235441).
- commit a3ad07d
- net: bridge: fix vlan tunnel dst refcnt when egressing (CVE-2021-47222 bsc#1224857)
- commit c5ffad3
- net: bridge: fix vlan tunnel dst null pointer dereference (CVE-2021-47223 bsc#1224856)
- commit 183304e
- xfrm: validate new SA's prefixlen using SA family when sel.family is unset (CVE-2024-50142 bsc#1233028)
- commit 44b0b49
- tcp_bpf: Fix the sk_mem_uncharge logic in tcp_bpf_sendmsg
(bsc#1235485 CVE-2024-56633).
- bpf, sockmap: Fix the sk->sk_forward_alloc warning of
sk_stream_kill_queues (bsc#1235485 CVE-2024-56633).
- bpf, sockmap: Fix more uncharged while msg has more_data
(bsc#1235485 CVE-2024-56633).
- tcp_bpf: Fix one concurrency problem in the tcp_bpf_send_verdict
function (bsc#1235485 CVE-2024-56633).
- commit 312086f
- RDMA/hns: Fix cpu stuck caused by printings during reset (CVE-2024-56722 bsc#1235570)
- commit 8d94b2e
- vfio/pci: Lock external INTx masking ops (bsc#1222803).
- Refresh patches.suse/vfio-pci-Create-persistent-INTx-handler.patch.
- commit 0681ef7
- gtp: Destroy device along with udp socket's netns dismantle
(CVE-2025-21678 bsc#1236698).
- gtp: Use for_each_netdev_rcu() in gtp_genl_dump_pdp()
(CVE-2025-21678 bsc#1236698).
- eth: bnxt: always recalculate features after XDP clearing,
fix null-deref (CVE-2025-21682 bsc#1236703).
- commit e803c29
- ipv4: ip_tunnel: Fix suspicious RCU usage warning in
ip_tunnel_find() (CVE-2024-50304 bsc#1233522).
- commit 225c809
- netfilter: nft_payload: sanitize offset and length before
calling skb_checksum() (CVE-2024-50251 bsc#1233248).
- commit eece26a
- net: inet6: do not leave a dangling sk pointer in inet6_create()
(CVE-2024-56600 bsc#1235217).
- commit a01a9a3
- btrfs: don't abort filesystem when attempting to snapshot
deleted subvolume (bsc#1222072 CVE-2024-26644).
- commit 41ce9ae
- scsi: qla2xxx: Fix use after free on unload (CVE-2024-56623
bsc#1235466).
- scsi: qedi: Fix a possible memory leak in
qedi_alloc_and_init_sb() (CVE-2024-56747 bsc#1234934).
- scsi: bfa: Fix use-after-free in bfad_im_module_exit()
(CVE-2024-53227 bsc#1235011).
- commit 64d880b
- RDMA/uverbs: Prevent integer overflow issue (bsc#1235919 CVE-2024-57890)
- commit 38203c5
- overflow: Implement size_t saturating arithmetic helpers (bsc#1235919 CVE-2024-57890)
- commit 90eb057
- overflow: Add __must_check attribute to check_*() helpers (bsc#1235919 CVE-2024-57890)
Refresh patches.suse/0010-overflow-Correct-check_shl_overflow-comment.patch
- commit 5140cb6
- overflow.h: Add flex_array_size() helper (bsc#1235919 CVE-2024-57890)
- commit 22d16f6
- overflow.h: Add comment documenting __ab_c_size() (bsc#1235919 CVE-2024-57890)
- commit b5a4098
- netfilter: x_tables: fix LED ID check in led_tg_check()
(CVE-2024-56650 bsc#1235430).
- commit 8b9e311
- ALSA: usb-audio: Fix a DMA to stack memory bug (git-fixes).
- ALSA: usb-audio: Fix potential out-of-bound accesses for Extigy
and Mbox devices (git-fixes CVE-2024-53197 bsc#1235464).
- commit dc81ff3
- NFSD: Prevent NULL dereference in nfsd4_process_cb_update() (CVE-2024-53217 bsc#1234999)
- commit 8a6f9b4
- wifi: mac80211: fix mbss changed flags corruption on 32 bit systems (CVE-2024-57899 bsc#1235924)
- commit 600d381
- drm/modes: Avoid divide by zero harder in drm_mode_vrefresh() (CVE-2024-56369 bsc#1235750)
- commit b3145a1
- drm/modes: Switch to 64bit maths to avoid integer overflow (bsc#1235750)
- commit e4d2dd7
- igb: Fix potential invalid memory access in igb_init_module() (CVE-2024-52332 bsc#1235700)
- commit 23608e0
- rtc: check if __rtc_read_time was successful in rtc_timer_do_work() (CVE-2024-56739 bsc#1235611)
- commit 26c24f2
- crypto: bcm - add error check in the ahash_hmac_init function (CVE-2024-56681 bsc#1235557)
- commit f132d27
- sunrpc: clear XPRT_SOCK_UPD_TIMEOUT when reset transport (CVE-2024-56688 bsc#1235538)
- commit a4e5ee6
- acpi: nfit: vmalloc-out-of-bounds Read in acpi_nfit_ctl (CVE-2024-56662 bsc#1235533)
- commit c4dc3c5
- media: wl128x: Fix atomicity violation in fmc_send_cmd() (CVE-2024-56700 bsc#1235500)
- commit d0190f0
- drm/amdgpu: set the right AMDGPU sg segment limitation (CVE-2024-56594 bsc#1235413)
- commit b32a039
- wifi: brcmfmac: Fix oops due to NULL pointer dereference in brcmf_sdiod_sglist_rw() (CVE-2024-56593 bsc#1235252)
- commit 84dd400
- media: dvb-frontends: dib3000mb: fix uninit-value in dib3000_write_reg (CVE-2024-56769 bsc#1235155)
- commit d6854a8
- ALSA: us122l: Use snd_card_free_when_closed() at disconnection (CVE-2024-56532 bsc#1235059)
- commit c7d5d7e
- ALSA: usx2y: Use snd_card_free_when_closed() at disconnection (CVE-2024-56533 bsc#1235053)
- commit 7a2524a
- media: ts2020: fix null-ptr-deref in ts2020_probe() (CVE-2024-56574 bsc#1235040)
- commit 994f123
- Move patches.suse/floppy-reintroduce-O_NDELAY-fix.patch to the sorted
section with proper upstream references. Document the reason why the
upstream revert should not be applied to our kernel.
- commit c686e79
- dm thin: make get_first_thin use rcu-safe list first function (CVE-2025-21664 bsc#1236262)
- commit a5449a2
- selinux: ignore unknown extended permissions (CVE-2024-57931 bsc#1236192)
- commit 026448e
- net_sched: cls_flow: validate TCA_FLOW_RSHIFT attribute (CVE-2025-21653 bsc#1236161)
- commit 987a924
- net/sctp: Prevent autoclose integer overflow in sctp_association_init() (CVE-2024-57938 bsc#1236182)
- commit 3f47e6a
- mm: vmscan: account for free pages to prevent infinite Loop in throttle_direct_reclaim() (CVE-2024-57884 bsc#1235948)
- commit 7ce422e
- Drivers: hv: util: Avoid accessing a ringbuffer not initialized yet (bsc#1235747 CVE-2024-55916).
- commit bfb225e
- gve: guard XDP xmit NDO on existence of xdp queues
(CVE-2024-57932 bsc#1236190).
- commit 9d9586a
- Update patches.suse/tipc-fix-NULL-deref-in-cleanup_bearer.patch
(bsc#1235433 CVE-2024-56661 bsc#1234931).
- commit f670a26
- net: inet: do not leave a dangling sk pointer in inet_create()
(CVE-2024-56601 bsc#1235230).
- commit 2328dc9
- net: add more sanity checks to qdisc_pkt_len_init()
(CVE-2024-49948 bsc#1232161).
- commit 39d78f4
- net: restrict SO_REUSEPORT to inet sockets (bsc#1235967 CVE-2024-57903)
- commit eaf865b
- net: do not delay dst_entries_add() in dst_release()
(CVE-2024-50036 bsc#1231912).
- commit 4ae059f
- tracing: Prevent bad count for tracing_cpumask_write (CVE-2024-56763 bsc#1235638)
- commit 224036d
- dccp: Fix memory leak in dccp_feat_change_recv (CVE-2024-56643 bsc#1235132)
- commit f89cb51
- net/smc: initialize close_work early to avoid warning (CVE-2024-56641 bsc#1235526)
- commit 3572c76
- btrfs: fix use-after-free when COWing tree bock and tracing
is enabled (bsc#1235645 CVE-2024-56759).
- btrfs: flush delalloc workers queue before stopping cleaner
kthread during unmount (bsc#1235965 CVE-2024-57896).
- btrfs: wait for fixup workers before stopping cleaner kthread
during umount (bsc#1235965 CVE-2024-57896).
- btrfs: fix hang during unmount when stopping a space reclaim
worker (bsc#1235965 CVE-2024-57896).
- Btrfs: fix crash during unmount due to race with delayed inode
workers (bsc#1235965 CVE-2024-57896).
- commit 176ee37
- drm/amd/display: Add check for granularity in dml ceil/floor
helpers (CVE-2024-57922 bsc#1236080 with CVSS 5.5).
- commit 447f836
- netfilter: ipset: Hold module reference while requesting a module (CVE-2024-56637 bsc#1235523)
- commit 88e28cd
- dm array: fix releasing a faulty array block twice in
dm_array_cursor_end (bsc#1236096, CVE-2024-57929).
- commit 1959a0b
- Update
patches.suse/af_packet-avoid-erroring-out-after-sock_init_data-in.patch
(CVE-2024-56606 bsc#1235417).
Fix the bug number.
- commit f121592
- drm: adv7511: Fix use-after-free in adv7533_attach_dsi() (CVE-2024-57887 bsc#1235952).
- commit 5c4ee3f
- ocfs2: fix slab-use-after-free due to dangling pointer dqi_priv
(bsc#1235964 CVE-2024-57892).
- ocfs2: correct return value of ocfs2_local_free_info()
(bsc#1235964 CVE-2024-57892).
- commit b9a152d
- xen: Fix the issue of resource not being properly released in
xenbus_dev_probe() (CVE-2024-53198 bsc#1234923).
- commit ca6183e
- workqueue: skip lockdep wq dependency in cancel_work_sync()
(bsc#1235918).
- commit 1b19fa3
- workqueue: Do not warn when cancelling WQ_MEM_RECLAIM work from
!WQ_MEM_RECLAIM worker (bsc#1235416 bsc#1235918 CVE-2024-57888).
- commit b01b194
- ftrace: Fix regression with module command in stack_trace_filter
(CVE-2024-56569 bsc#1235031).
- commit e7b7c58
- ALSA: seq: oss: Fix races at processing SysEx messages
(CVE-2024-57893 bsc#1235920).
- commit 7be38f2
- bpf: fix OOB devmap writes when deleting elements (CVE-2024-56615 bsc#1235426)
- commit a05e14b
- cifs: fix calc signature on big endian systems (bsc#1235888,
bsc#1234921).
- commit 38ecaae
- ocfs2: fix uninitialized value in ocfs2_file_read_iter() (CVE-2024-53155 bsc#1234855)
- commit 1c5aa20
- dlm: fix possible lkb_resource null dereference (CVE-2024-47809 bsc#1235714)
- commit 96406ba
- ocfs2: free inode when ocfs2_get_init_inode() fails (CVE-2024-56630 bsc#1235479)
- commit 3c3dfcf
- bcache: revert replacing IS_ERR_OR_NULL with IS_ERR again (CVE-2024-48881 bsc#1235727)
- commit 027cde8
- netfilter: nf_tables: use timestamp to check for set element
timeout (CVE-2024-27397 bsc#1224095).
- commit f2d74b7
- net/smc: check return value of sock_recvmsg when draining clc
data (CVE-2024-57791 bsc#1235759).
- commit 7c27e5f
- scsi: qedf: Fix a possible memory leak in qedf_alloc_and_init_sb() (CVE-2024-56748 bsc#1235627)
- commit ce7ef63
- smb: client: fix parsing of SMB3.1.1 POSIX create context
(git-fixes).
- commit bc79049
- s390/cpum_sf: Handle CPU hotplug remove during sampling
(CVE-2024-57849 bsc#1235814).
- commit 0001c5b
- pinmux: Use sequential access to access desc->pinmux data
(CVE-2024-47141 bsc#1235708).
- commit 5d7a944
- mm/swapfile: skip HugeTLB pages for unuse_vma (CVE-2024-50199
bsc#1233112).
- commit 46f452a
- drm/dp_mst: Fix MST sideband message body length check (bsc#1235427 CVE-2024-56616)
- commit a9fa1ed
- bpf, sockmap: Fix race between element replace and close()
(CVE-2024-56664 bsc#1235249).
- commit 58b2a56
- tipc: fix NULL deref in cleanup_bearer() (bsc#1235433).
- commit 45bfce4
- scsi: sg: Fix slab-use-after-free read in sg_release()
(CVE-2024-56631 bsc#1235480).
- commit 7bf64a1
- Fix CVE reference for patches.suse/af_packet-avoid-erroring-out-after-sock_init_data-in.patch (CVE-2024-56606)
- commit 0d64068
- 9p/xen: fix release of IRQ (CVE-2024-56704 bsc#1235584).
- commit f5768af
- mfd: intel_soc_pmic_bxtwc: Use IRQ domain for TMU device
(CVE-2024-56724 bsc#1235577).
- commit fe1aa03
- irqchip/gic-v3-its: Prevent double free on error (bsc#1224697
CVE-2024-35847).
- commit 014f7f5
- smb: client: fix use-after-free of signing key (bsc#1234921,
CVE-2024-53179).
- commit c267f82
- af_packet: avoid erroring out after sock_init_data() in packet_create() (CVE-2024-5660 bsc#123541)
- commit 0fe28c5
- KVM: Always flush async #PF workqueue when vCPU is being
destroyed (CVE-2024-26976 bsc#1223635).
- commit 55809b2
- netfilter: nft_set_rbtree: .deactivate fails if element has
expired (CVE-2024-27397 bsc#1224095).
- netfilter: nft_set_rbtree: check for inactive element after
flag mismatch (CVE-2024-27397 bsc#1224095).
- commit 40ba8ec
- smb: client: fix NULL ptr deref in crypto_aead_setkey() (CVE-2024-53185 bsc#1234901)
- commit 5cf5c90
- ovl: Filter invalid inodes with missing lookup function
(bsc#1235035 CVE-2024-56570).
- commit 6e7923c
- net: af_can: do not leave a dangling sk pointer in can_create() (CVE-2024-56603 bsc#1235415)
- commit c85c522
- ubi: fastmap: Fix duplicate slab cache names while attaching (CVE-2024-53172 bsc#1234898)
- commit 9366af4
- NFSv4.0: Fix a use-after-free problem in the asynchronous open()
(CVE-2024-53173 bsc#1234891).
- commit a7e3c22
- tipc: Fix use-after-free of kernel socket in cleanup_bearer()
(CVE-2024-56642 bsc#1235433).
- commit 3768de6
- sctp: properly validate chunk size in sctp_sf_ootb() (CVE-2024-50299 bsc#1233488)
- commit 537e6f9
- drm/amdgpu: fix usage slab after free (CVE-2024-56551
bsc#1235075).
- commit d5ec598
- Bluetooth: L2CAP: do not leave dangling sk pointer on error
in l2cap_sock_create() (CVE-2024-56605 bsc#1235061).
- commit 6ac1393
- net/sched: stop qdisc_tree_reduce_backlog on TC_H_ROOT
(CVE-2024-53057 bsc#1233551).
- commit 707ad78
- media: s5p_cec: limit msg.len to CEC_MAX_MSG_SIZE
(CVE-2022-49035 bsc#1215304).
- commit e681ca0
- Revert "fbdev: efifb: Register sysfs groups through driver core"
This reverts commit bff30872a052aab87ee7774e2be9b01e1cc917a9.
(bsc#1232224 CVE-2024-49925)
As Michal Koutný's comment#70 in bsc#1232224, the reason is that kABI
fixup in patches.kabi/driver-core-kABI-workaround-for-dev_groups-in-device.patch
is not restoring original KABI since the (extended) struct device_driver
is embedded in other structs, like platform_driver.
And I agree with Michal's comments, CVE-2024-49925 vulnerability is not
easy to be used by attacker who does not have root permission. So let's
revert the following backported/kabi patches and set CVE-2024-49925 to
WONFIX on SLE12-SP5:
72643096ed46b327a37e55db8130cbdc5dadc513
driver core: Fix error return code in really_probe()
(bsc#1232224 CVE-2024-49925).
993ec78562135da497117ab08d14b980c9f783ac
driver core: kABI workaround for dev_groups in device_driver
(bsc#1232224 CVE-2024-49925).
d16dce7a3af05c2034c4ba6cea77c5fdc32124cd
driver core: add dev_groups to all drivers (bsc#1232224
CVE-2024-49925).
bff30872a052aab87ee7774e2be9b01e1cc917a9
fbdev: efifb: Register sysfs groups through driver core
(bsc#1232224 CVE-2024-49925).
- commit 70f2ffa
- Revert "driver core: add dev_groups to all drivers (bsc#1232224"
This reverts commit d16dce7a3af05c2034c4ba6cea77c5fdc32124cd.
(bsc#1232224 CVE-2024-49925)
As Michal Koutný's comment#70 in bsc#1232224, the reason is that kABI
fixup in patches.kabi/driver-core-kABI-workaround-for-dev_groups-in-device.patch
is not restoring original KABI since the (extended) struct device_driver
is embedded in other structs, like platform_driver.
And I agree with Michal's comments, CVE-2024-49925 vulnerability is not
easy to be used by attacker who does not have root permission. So let's
revert the following backported/kabi patches and set CVE-2024-49925 to
WONFIX on SLE12-SP5:
72643096ed46b327a37e55db8130cbdc5dadc513
driver core: Fix error return code in really_probe()
(bsc#1232224 CVE-2024-49925).
993ec78562135da497117ab08d14b980c9f783ac
driver core: kABI workaround for dev_groups in device_driver
(bsc#1232224 CVE-2024-49925).
d16dce7a3af05c2034c4ba6cea77c5fdc32124cd
driver core: add dev_groups to all drivers (bsc#1232224
CVE-2024-49925).
bff30872a052aab87ee7774e2be9b01e1cc917a9
fbdev: efifb: Register sysfs groups through driver core
(bsc#1232224 CVE-2024-49925).
- commit 4b057cb
- Revert "driver core: kABI workaround for dev_groups in device_driver"
This reverts commit 993ec78562135da497117ab08d14b980c9f783ac.
(bsc#1232224 CVE-2024-49925)
As Michal Koutný's comment#70 in bsc#1232224, the reason is that kABI
fixup in patches.kabi/driver-core-kABI-workaround-for-dev_groups-in-device.patch
is not restoring original KABI since the (extended) struct device_driver
is embedded in other structs, like platform_driver.
And I agree with Michal's comments, CVE-2024-49925 vulnerability is not
easy to be used by attacker who does not have root permission. So let's
revert the following backported/kabi patches and set CVE-2024-49925 to
WONFIX on SLE12-SP5:
72643096ed46b327a37e55db8130cbdc5dadc513
driver core: Fix error return code in really_probe()
(bsc#1232224 CVE-2024-49925).
993ec78562135da497117ab08d14b980c9f783ac
driver core: kABI workaround for dev_groups in device_driver
(bsc#1232224 CVE-2024-49925).
d16dce7a3af05c2034c4ba6cea77c5fdc32124cd
driver core: add dev_groups to all drivers (bsc#1232224
CVE-2024-49925).
bff30872a052aab87ee7774e2be9b01e1cc917a9
fbdev: efifb: Register sysfs groups through driver core
(bsc#1232224 CVE-2024-49925).
- commit eade7d6
- Revert "driver core: Fix error return code in really_probe()"
This reverts commit 72643096ed46b327a37e55db8130cbdc5dadc513.
(bsc#1232224 CVE-2024-49925)
As Michal Koutný's comment#70 in bsc#1232224, the reason is that kABI
fixup in patches.kabi/driver-core-kABI-workaround-for-dev_groups-in-device.patch
is not restoring original KABI since the (extended) struct device_driver
is embedded in other structs, like platform_driver.
And I agree with Michal's comments, CVE-2024-49925 vulnerability is not
easy to be used by attacker who does not have root permission. So let's
revert the following backported/kabi patches and set CVE-2024-49925 to
WONFIX on SLE12-SP5:
72643096ed46b327a37e55db8130cbdc5dadc513
driver core: Fix error return code in really_probe()
(bsc#1232224 CVE-2024-49925).
993ec78562135da497117ab08d14b980c9f783ac
driver core: kABI workaround for dev_groups in device_driver
(bsc#1232224 CVE-2024-49925).
d16dce7a3af05c2034c4ba6cea77c5fdc32124cd
driver core: add dev_groups to all drivers (bsc#1232224
CVE-2024-49925).
bff30872a052aab87ee7774e2be9b01e1cc917a9
fbdev: efifb: Register sysfs groups through driver core
(bsc#1232224 CVE-2024-49925).
- commit 409618d
- nvme-pci: fix freeing of the HMB descriptor table (bsc#1234921
CVE-2024-56756).
- commit a639847
- wifi: mwifiex: Fix memcpy() field-spanning write warning in
mwifiex_config_scan() (CVE-2024-56539 bsc#1234963).
- commit 07aa3cb
- vfio/pci: Properly hide first-in-list PCIe extended capability
(bsc#1235004 CVE-2024-53214).
- commit 1b7890f
- wifi: ath10k: avoid NULL pointer error during sdio remove
(CVE-2024-56599 bsc#1235138).
- commit 827f8ee
- leds: class: Protect brightness_show() with led_cdev->led_access
mutex (CVE-2024-56587 bsc#1235125).
- commit 654afb9
- net: marvell: mvpp2: phylink requires the link interrupt
(bsc#1117016).
- Delete
patches.suse/net-mvpp2-fix-condition-for-setting-up-link-interrup.patch.
Replace downsteram patch with upstream one
- commit 5355aa8
- Bluetooth: RFCOMM: avoid leaving dangling sk pointer in
rfcomm_sock_alloc() (bsc#1235056 CVE-2024-56604).
- commit 9674234
- Bluetooth: Consolidate code around sk_alloc into a helper
function (bsc#1235056 CVE-2024-56604).
Refresh
patches.suse/Bluetooth-SCO-Fix-UAF-on-sco_sock_timeout.patch.
- commit d4282e9
- Bluetooth: hci_sock: purge socket queues in the destruct()
callback (bsc#1235056 CVE-2024-56604).
- commit a8a4e81
- hfsplus: don't query the device logical block size multiple
times (bsc#1235073 CVE-2024-56548).
- commit ff0cbed
- wifi: ath9k: add range check for conn_rsp_epid in
htc_connect_service() (CVE-2024-53156 bsc#1234846).
- commit 22125f2
- ALSA: 6fire: Release resources at card release (CVE-2024-53239
bsc#1235054).
- ALSA: caiaq: Use snd_card_free_when_closed() at disconnection
(CVE-2024-56531 bsc#1235057).
- commit d3f225e
- NFSD: Prevent a potential integer overflow (CVE-2024-53146
bsc#1234853).
- commit c43d88d
- Refresh
patches.suse/char-virtio-Select-VIRTIO-from-VIRTIO_CONSOLE.patch.
- Refresh
patches.suse/net-packet-fix-overflow-in-tpacket_rcv.patch.
Add upstream references and move to sorted section.
- commit 62678cc
- SUNRPC: 'Directory with parent 'rpc_clnt' already
present!' (bsc#1168202 bsc#1188924).
- commit 511e0dd
- SUNRPC: fix use-after-free in rpc_free_client_work()
(bsc#1168202 bsc#1188924).
- Refresh
patches.suse/SUNRPC-Fix-RPC-client-cleaned-up-the-freed-pipefs-de.patch.
- Refresh
patches.suse/SUNRPC-defer-slow-parts-of-rpc_free_client-to-a-work.patch.
Add upstream reference and move to sorted section. Split a fix-up to a
separate patch so that it also gets its upstream reference. This aligns
with how things were done in other maintained kernel branches.
- commit f5a7a6e
- netfilter: ipset: add missing range check in bitmap_ip_uadt (CVE-2024-53141 bsc#1234381)
- commit 5b1c6de
- RDMA/mlx5: Cancel pkey work before destroying device resources (bsc#1235009 CVE-2024-53224)
- commit 9ac5166
- Update
patches.suse/Bluetooth-hci_event-Align-BR-EDR-JUST_WORKS-paring-w.patch
(git-fixes bsc#1230697 CVE-2024-8805 CVE-2024-53144
bsc#1234690).
- Update
patches.suse/can-bcm-Clear-bo-bcm_proc_read-after-remove_proc_ent.patch
(CVE-2024-46771 bsc#1230766 CVE-2024-47709 bsc#1232048).
- Update
patches.suse/mm-revert-mm-shmem-fix-data-race-in-shmem_getattr.patch
(CVE-2024-50228 bsc#1233204 git fixes (mm/shmem) CVE-2024-53136
bsc#1234161).
- Update
patches.suse/net-relax-socket-state-check-at-accept-time.patch
(git-fixes CVE-2024-36484 bsc#1226872).
- Update
patches.suse/ocfs2-uncache-inode-which-has-failed-entering-the-group.patch
(bsc#1234087 CVE-2024-53112).
- commit 357ae3f
- Refresh
patches.suse/Deprecate-NR_UNSTABLE_NFS-use-NR_WRITEBACK.patch.
- Refresh
patches.suse/MM-replace-PF_LESS_THROTTLE-with-PF_LOCAL_THROTTLE.patch.
- Refresh
patches.suse/mm-Avoid-overflows-in-dirty-throttling-logic.patch.
Add upstream reference to 2 patches, move them to the sorted section and
refresh another patch to solve context conflicts.
- commit 91ba058
- firmware: arm_scpi: Check the DVFS OPP count returned by the
firmware (CVE-2024-53157 bsc#1234827).
- commit 77c498b
- s390/iucv: MSG_PEEK causes memory leak in iucv_sock_destruct()
(CVE-2024-53210 bsc#1234971).
- commit e1704a7
- ALSA: usb-audio: Fix out of bounds reads when finding clock
sources (CVE-2024-53150 bsc#1234834).
- commit 809edc6
- smb: client: fix OOBs when building SMB2_IOCTL request
(CVE-2024-50151 bsc#1233055).
- commit 5303c51
- xen/netfront: fix crash when removing device (XSA-465
CVE-2024-53240 bsc#1234281).
- commit 6a0455d
- btrfs: qgroup: fix sleep from invalid context bug in
btrfs_qgroup_inherit() (CVE-2022-49033 bsc#1232045).
- commit 1c36522
- Bluetooth: hci_event: Align BR/EDR JUST_WORKS paring with LE
(git-fixes, bsc#1230697, CVE-2024-8805).
- commit af6048b
- scsi: pm80xx: Set phy->enable_completion only when we wait
for it (CVE-2024-47666 bsc#1231453).
- commit 3fe50d4
- xfs: don't walk off the end of a directory data block
(bsc#1228405 CVE-2024-41013).
- commit 7e72128
- bpf: Fix out-of-bounds write in trie_get_next_key() (CVE-2024-50262 bsc#1233239)
- commit deb09e1
- can: bcm: Fix UAF in bcm_proc_show() (CVE-2023-52922 bsc#1233977)
- commit a84b421
- media: v4l2-tpg: prevent the risk of a division by zero (CVE-2024-50287 bsc#1233476)
- commit f6101ec
- fs: Fix uninitialized value issue in from_kuid and from_kgid (CVE-2024-53101 bsc#1233769)
- commit a397183
- udf: refactor inode_bmap() to handle error (bsc#1234242
bsc#1233096 CVE-2024-50211).
- commit 20d3a39
- udf: refactor udf_next_aext() to handle error (bsc#1234241).
- commit f098aa9
- udf: refactor udf_current_aext() to handle error (bsc#1234240).
- commit b64184f
- udf: fix uninit-value use in udf_get_fileshortad (bsc#1234243
bsc#1233038 CVE-2024-50143).
- commit 67400f8
- udf: Handle error when adding extent to a file (bsc#1234437).
- commit f03c52b
- kabi/severities: ignore intermodule symbols between fsl_fman and fsl_dpaa_eth
- commit eb515fb
- fsl/fman: Fix refcount handling of fman-related devices
(CVE-2024-50166 bsc#1233050).
- fsl/fman: Save device references taken in mac_probe()
(CVE-2024-50166 bsc#1233050).
- net: fman: Unregister ethernet device on removal (CVE-2024-50166
bsc#1233050).
- commit f22236a
- rtnetlink: make sure to refresh master_dev/m_ops in
__rtnl_newlink() (CVE-2022-48742 bsc#1226694).
- commit 8931ec3
- Update References: field, and keep KABI consistency of bioset_exit(),
patches.suse/dm-cache-fix-flushing-uninitialized-delayed_work-on--1354.patch
(bsc#1233467, CVE-2024-50278, bsc#1233469, CVE-2024-50280).
- commit 4bed2c0
- netfilter: nf_reject_ipv6: fix potential crash in
nf_send_reset6() (CVE-2024-50256 bsc#1233200).
- commit c62ba75
- nfsidmap
-
- nss: use strrchr() instead of strchr() to get the last occurrence of
"@" (bsc#1236077)
- add 0003-nss-use-strrchr-instead-of-strchr-to-get-the-last-oc.patch
- libzypp
-
- Do not double encode URL strings passed on the commandline
(bsc#1237587)
URLs passed on the commandline must have their special chars
encoded already. We just want to check and encode forgotten
unsafe chars like a blank. A '%' however must not be encoded
again.
- version 16.22.16 (0)