Alerts This Week
Warning Icon 1 692
Alerts This Week
Warning Icon 1 692

SUSE: 2023:1863-1 Important Update for Shim - Buffer Overflow

suse
Calendar Grey February 27, 2024
Dist Suse Esm H88
This crucial announcement regarding shim provides various security enhancements and boosts overall system reliability for openSUSE users.
* bsc#1185232 * bsc#1185261 * bsc#1185441 * bsc#1185621 * bsc#1187071

Summary

## This update for shim fixes the following issues: * Updated shim signature after shim 15.7 be signed back: signature- sles.x86_64.asc, signature-sles.aarch64.asc (bsc#1198458) * Add POST_PROCESS_PE_FLAGS=-N to the build command in shim.spec to disable the NX compatibility flag when using post-process-pe because grub2 is not ready. (bsc#1205588) * Enable the NX compatibility flag by default. (jsc#PED-127) Update to 15.7 (bsc#1198458) (jsc#PED-127): * Make SBAT variable payload introspectable * Reference MokListRT instead of MokList * Add a link to the test plan in the readme. * [V3] Enable TDX measurement to RTMR register * Discard load-options that start with a NUL * Fixed load_cert_file bugs * Add -malign-double to IA32 compiler flags * pe: Fix image section entry-point validation

Topics%20covered

Topics Covered

security advisory buffer overflow security fix vulnerability SUSE important update shim

References

* bsc#1185232

* bsc#1185261

* bsc#1185441

* bsc#1185621

* bsc#1187071

* bsc#1187260

* bsc#1193282

* bsc#1193315

* bsc#1198458

* bsc#1201066

* bsc#1202120

* bsc#1205588

* jsc#PED-127

* jsc#PED-1273

Cross-

* CVE-2022-28737

CVSS scores:

* CVE-2022-28737 ( SUSE ): 8.4 CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

* CVE-2022-28737 ( NVD ): 6.5 CVSS:3.1/AV:L/AC:L/PR:H/UI:R/S:U/C:H/I:H/A:H

Affected Products:

* SUSE Linux Enterprise High Performance Computing 12 SP4

* SUSE Linux Enterprise High Performance Computing 12 SP5

* SUSE Linux Enterprise Server 12 SP4

* SUSE Linux Enterprise Server 12 SP4 ESPOS 12-SP4

* SUSE Linux Enterprise Server 12 SP4 LTSS 12-SP4

* SUSE Linux Enterprise Server 12 SP5

* SUSE Linux Enterprise Server for SAP Applications 12 SP4

* SUSE Linux Enterprise Server for SAP Applications 12 SP5

Severity
important
Lowest
Low
Medium
High
Critical

Announcement ID: SUSE-SU-2023:1863-1
Rating: important

Topics%20covered

Topics Covered

security advisory buffer overflow security fix vulnerability SUSE important update shim

Get the latest News and Insights

Get the latest Linux and open source security news straight to your inbox.

Related News

Your message here