SUSE: 2023:3389-1 bci/php Security Update
Summary
Advisory ID: SUSE-SU-2023:3997-1 Released: Fri Oct 6 14:13:56 2023 Summary: Security update for nghttp2 Type: security Severity: important Advisory ID: SUSE-SU-2023:4024-1 Released: Tue Oct 10 13:24:40 2023 Summary: Security update for shadow Type: security Severity: low Advisory ID: SUSE-SU-2023:4041-1 Released: Tue Oct 10 18:28:16 2023 Summary: Security update for php-composer2 Type: security Severity: moderate Advisory ID: SUSE-SU-2023:4044-1 Released: Wed Oct 11 09:01:14 2023 Summary: Security update for curl Type: security Severity: important
References
References : 1214806 1215713 1215859 1215888 1215889 CVE-2023-35945 CVE-2023-38545
CVE-2023-38546 CVE-2023-43655 CVE-2023-4641
1215713,CVE-2023-35945
This update for nghttp2 fixes the following issues:
- CVE-2023-35945: Fixed memory leak when PUSH_PROMISE or HEADERS frame cannot be sent (bsc#1215713).
1214806,CVE-2023-4641
This update for shadow fixes the following issues:
- CVE-2023-4641: Fixed potential password leak (bsc#1214806).
1215859,CVE-2023-43655
This update for php-composer2 fixes the following issues:
- CVE-2023-43655: Fixed a remote code execution issue that could be
triggered if users published a web-accessible composer.phar file
(bsc#1215859).
1215888,1215889,CVE-2023-38545,CVE-2023-38546
This update for curl fixes the following issues:
- CVE-2023-38545: Fixed a heap buffer overflow in SOCKS5. (bsc#1215888)
- CVE-2023-38546: Fixed a cookie injection with none file. (bsc#1215889)
The following package changes have been done:
- libnghttp2-14-1.40.0-150200.9.1 updated
- login_defs-4.8.1-150400.10.12.1 updated
- libcurl4-8.0.1-150400.5.32.1 updated
- shadow-4.8.1-150400.10.12.1 updated
- php-composer2-2.2.3-150400.3.6.1 updated
- container:sles15-image-15.0.0-36.5.41 updated
![Dist Suse](/images/distros/dist-suse.gif)