# Security update for squashfs

Announcement ID: SUSE-SU-2023:4591-1  
Rating: important  
References:

  * bsc#1189936
  * bsc#1190531
  * bsc#935380

  
Cross-References:

  * CVE-2015-4645
  * CVE-2015-4646
  * CVE-2021-40153
  * CVE-2021-41072

  
CVSS scores:

  * CVE-2015-4645 ( SUSE ):  5.5 CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H
  * CVE-2015-4645 ( NVD ):  5.5 CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H
  * CVE-2015-4646 ( SUSE ):  5.5 CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H
  * CVE-2021-40153 ( SUSE ):  6.6 CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:N
  * CVE-2021-40153 ( NVD ):  8.1 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:H
  * CVE-2021-41072 ( SUSE ):  6.6 CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:N
  * CVE-2021-41072 ( NVD ):  8.1 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:H

  
Affected Products:

  * Basesystem Module 15-SP4
  * Basesystem Module 15-SP5
  * openSUSE Leap 15.3
  * openSUSE Leap 15.4
  * openSUSE Leap 15.5
  * openSUSE Leap Micro 5.3
  * openSUSE Leap Micro 5.4
  * SUSE Enterprise Storage 7.1
  * SUSE Linux Enterprise Desktop 15 SP4
  * SUSE Linux Enterprise Desktop 15 SP5
  * SUSE Linux Enterprise High Performance Computing 15 SP3
  * SUSE Linux Enterprise High Performance Computing 15 SP4
  * SUSE Linux Enterprise High Performance Computing 15 SP5
  * SUSE Linux Enterprise High Performance Computing ESPOS 15 SP3
  * SUSE Linux Enterprise High Performance Computing LTSS 15 SP3
  * SUSE Linux Enterprise Micro 5.1
  * SUSE Linux Enterprise Micro 5.2
  * SUSE Linux Enterprise Micro 5.3
  * SUSE Linux Enterprise Micro 5.4
  * SUSE Linux Enterprise Micro 5.5
  * SUSE Linux Enterprise Micro for Rancher 5.2
  * SUSE Linux Enterprise Micro for Rancher 5.3
  * SUSE Linux Enterprise Micro for Rancher 5.4
  * SUSE Linux Enterprise Real Time 15 SP4
  * SUSE Linux Enterprise Real Time 15 SP5
  * SUSE Linux Enterprise Server 15 SP3
  * SUSE Linux Enterprise Server 15 SP3 LTSS 15-SP3
  * SUSE Linux Enterprise Server 15 SP4
  * SUSE Linux Enterprise Server 15 SP5
  * SUSE Linux Enterprise Server for SAP Applications 15 SP3
  * SUSE Linux Enterprise Server for SAP Applications 15 SP4
  * SUSE Linux Enterprise Server for SAP Applications 15 SP5
  * SUSE Manager Proxy 4.2
  * SUSE Manager Proxy 4.3
  * SUSE Manager Retail Branch Server 4.2
  * SUSE Manager Retail Branch Server 4.3
  * SUSE Manager Server 4.2
  * SUSE Manager Server 4.3

  
  
An update that solves four vulnerabilities can now be installed.

## Description:

This update for squashfs fixes the following issues:

  * CVE-2015-4645,CVE-2015-4646: Multiple buffer overflows fixed in squashfs-
    tools (bsc#935380)
  * CVE-2021-40153: Fixed an issue where an attacker might have been able to
    write a file outside of destination (bsc#1189936)
  * CVE-2021-41072: Fixed an issue where an attacker might have been able to
    write a file outside the destination directory via a symlink (bsc#1190531).

update to 4.6.1:

  * Race condition which can cause corruption of the "fragment table" fixed.
    This is a regression introduced in August 2022, and it has been seen when
    tailend packing is used (-tailends option).
  * Fix build failure when the tools are being built without extended attribute
    (XATTRs) support.
  * Fix XATTR error message when an unrecognised prefix is found
  * Fix incorrect free of pointer when an unrecognised XATTR prefix is found.
  * Major improvements in extended attribute handling, pseudo file handling, and
    miscellaneous new options and improvements
  * Extended attribute handling improved in Mksquashfs and Sqfstar
  * New Pseudo file xattr definition to add extended attributes to files.
  * New xattrs-add Action to add extended attributes to files
  * Extended attribute handling improved in Unsquashfs
  * Other major improvements
  * Unsquashfs can now output Pseudo files to standard out.
  * Mksquashfs can now input Pseudo files from standard in.
  * Squashfs filesystems can now be converted (different block size compression
    etc) without unpacking to an intermediate filesystem or mounting, by piping
    the output of Unsquashfs to Mksquashfs.
  * Pseudo files are now supported by Sqfstar.
  * "Non-anchored" excludes are now supported by Unsquashfs.

update to 4.5.1 (bsc#1190531, CVE-2021-41072):

  * This release adds Manpages for Mksquashfs(1), Unsquashfs(1), Sqfstar(1) and
    Sqfscat(1).
  * The -help text output from the utilities has been improved and extended as
    well (but the Manpages are now more comprehensive).
  * CVE-2021-41072 which is a writing outside of destination exploit, has been
    fixed.
  * The number of hard-links in the filesystem is now also displayed by
    Mksquashfs in the output summary.
  * The number of hard-links written by Unsquashfs is now also displayed in the
    output summary.
  * Unsquashfs will now write to a pre-existing destination directory, rather
    than aborting.
  * Unsquashfs now allows "." to used as the destination, to extract to the
    current directory.
  * The Unsquashfs progress bar now tracks empty files and hardlinks, in
    addition to data blocks.
  * -no-hardlinks option has been implemented for Sqfstar.
  * More sanity checking for "corrupted" filesystems, including checks for
    multiply linked directories and directory loops.
  * Options that may cause filesystems to be unmountable have been moved into a
    new "experts" category in the Mksquashfs help text (and Manpage).
  * Maximum cpiostyle filename limited to PATH_MAX. This prevents attempts to
    overflow the stack, or cause system calls to fail with a too long pathname.
  * Don't always use "max open file limit" when calculating length of queues, as
    a very large file limit can cause Unsquashfs to abort. Instead use the
    smaller of max open file limit and cache size.
  * Fix Mksquashfs silently ignoring Pseudo file definitions when appending.
  * Don't abort if no XATTR support has been built in, and there's XATTRs in the
    filesystem. This is a regression introduced in 2019 in Version 4.4.
  * Fix duplicate check when the last file block is sparse.

update to 4.5:

  * Mksquashfs now supports "Actions".
  * New sqfstar command which will create a Squashfs image from a tar archive.
  * Tar style handling of source pathnames in Mksquashfs.
  * Cpio style handling of source pathnames in Mksquashfs.
  * New option to throttle the amount of CPU and I/O.
  * Mksquashfs now allows no source directory to be specified.
  * New Pseudo file "R" definition which allows a Regular file o be created with
    data stored within the Pseudo file.
  * Symbolic links are now followed in extract files
  * Unsquashfs now supports "exclude" files.
  * Max depth traversal option added.
  * Unsquashfs can now output a "Pseudo file" representing the input Squashfs
    filesystem.
  * New -one-file-system option in Mksquashfs.
  * New -no-hardlinks option in Mksquashfs.
  * Exit code in Unsquashfs changed to distinguish between non-fatal errors
    (exit 2), and fatal errors (exit 1).
  * Xattr id count added in Unsquashfs "-stat" output.
  * Unsquashfs "write outside directory" exploit fixed.
  * Error handling in Unsquashfs writer thread fixed.
  * Fix failure to truncate destination if appending aborted.
  * Prevent Mksquashfs reading the destination file.

## Patch Instructions:

To install this SUSE update use the SUSE recommended installation methods like
YaST online_update or "zypper patch".  
Alternatively you can run the command listed for your product:

  * openSUSE Leap 15.4  
    zypper in -t patch openSUSE-SLE-15.4-2023-4591=1

  * openSUSE Leap 15.5  
    zypper in -t patch openSUSE-SLE-15.5-2023-4591=1

  * SUSE Linux Enterprise Micro for Rancher 5.3  
    zypper in -t patch SUSE-SLE-Micro-5.3-2023-4591=1

  * SUSE Linux Enterprise Micro 5.3  
    zypper in -t patch SUSE-SLE-Micro-5.3-2023-4591=1

  * SUSE Linux Enterprise Micro for Rancher 5.4  
    zypper in -t patch SUSE-SLE-Micro-5.4-2023-4591=1

  * SUSE Linux Enterprise Micro 5.4  
    zypper in -t patch SUSE-SLE-Micro-5.4-2023-4591=1

  * SUSE Linux Enterprise Micro 5.5  
    zypper in -t patch SUSE-SLE-Micro-5.5-2023-4591=1

  * Basesystem Module 15-SP4  
    zypper in -t patch SUSE-SLE-Module-Basesystem-15-SP4-2023-4591=1

  * Basesystem Module 15-SP5  
    zypper in -t patch SUSE-SLE-Module-Basesystem-15-SP5-2023-4591=1

  * SUSE Linux Enterprise High Performance Computing ESPOS 15 SP3  
    zypper in -t patch SUSE-SLE-Product-HPC-15-SP3-ESPOS-2023-4591=1

  * SUSE Linux Enterprise High Performance Computing LTSS 15 SP3  
    zypper in -t patch SUSE-SLE-Product-HPC-15-SP3-LTSS-2023-4591=1

  * SUSE Linux Enterprise Server 15 SP3 LTSS 15-SP3  
    zypper in -t patch SUSE-SLE-Product-SLES-15-SP3-LTSS-2023-4591=1

  * SUSE Linux Enterprise Server for SAP Applications 15 SP3  
    zypper in -t patch SUSE-SLE-Product-SLES_SAP-15-SP3-2023-4591=1

  * SUSE Manager Proxy 4.2  
    zypper in -t patch SUSE-SLE-Product-SUSE-Manager-Proxy-4.2-2023-4591=1

  * SUSE Manager Retail Branch Server 4.2  
    zypper in -t patch SUSE-SLE-Product-SUSE-Manager-Retail-Branch-
Server-4.2-2023-4591=1

  * SUSE Manager Server 4.2  
    zypper in -t patch SUSE-SLE-Product-SUSE-Manager-Server-4.2-2023-4591=1

  * SUSE Enterprise Storage 7.1  
    zypper in -t patch SUSE-Storage-7.1-2023-4591=1

  * SUSE Linux Enterprise Micro 5.1  
    zypper in -t patch SUSE-SUSE-MicroOS-5.1-2023-4591=1

  * SUSE Linux Enterprise Micro 5.2  
    zypper in -t patch SUSE-SUSE-MicroOS-5.2-2023-4591=1

  * SUSE Linux Enterprise Micro for Rancher 5.2  
    zypper in -t patch SUSE-SUSE-MicroOS-5.2-2023-4591=1

  * openSUSE Leap 15.3  
    zypper in -t patch SUSE-2023-4591=1

  * openSUSE Leap Micro 5.3  
    zypper in -t patch openSUSE-Leap-Micro-5.3-2023-4591=1

  * openSUSE Leap Micro 5.4  
    zypper in -t patch openSUSE-Leap-Micro-5.4-2023-4591=1

## Package List:

  * openSUSE Leap 15.4 (aarch64 ppc64le s390x x86_64)
    * squashfs-debuginfo-4.6.1-150300.3.3.1
    * squashfs-debugsource-4.6.1-150300.3.3.1
    * squashfs-4.6.1-150300.3.3.1
  * openSUSE Leap 15.5 (aarch64 ppc64le s390x x86_64)
    * squashfs-debuginfo-4.6.1-150300.3.3.1
    * squashfs-debugsource-4.6.1-150300.3.3.1
    * squashfs-4.6.1-150300.3.3.1
  * SUSE Linux Enterprise Micro for Rancher 5.3 (aarch64 s390x x86_64)
    * squashfs-debuginfo-4.6.1-150300.3.3.1
    * squashfs-debugsource-4.6.1-150300.3.3.1
    * squashfs-4.6.1-150300.3.3.1
  * SUSE Linux Enterprise Micro 5.3 (aarch64 s390x x86_64)
    * squashfs-debuginfo-4.6.1-150300.3.3.1
    * squashfs-debugsource-4.6.1-150300.3.3.1
    * squashfs-4.6.1-150300.3.3.1
  * SUSE Linux Enterprise Micro for Rancher 5.4 (aarch64 s390x x86_64)
    * squashfs-debuginfo-4.6.1-150300.3.3.1
    * squashfs-debugsource-4.6.1-150300.3.3.1
    * squashfs-4.6.1-150300.3.3.1
  * SUSE Linux Enterprise Micro 5.4 (aarch64 s390x x86_64)
    * squashfs-debuginfo-4.6.1-150300.3.3.1
    * squashfs-debugsource-4.6.1-150300.3.3.1
    * squashfs-4.6.1-150300.3.3.1
  * SUSE Linux Enterprise Micro 5.5 (aarch64 s390x x86_64)
    * squashfs-debuginfo-4.6.1-150300.3.3.1
    * squashfs-debugsource-4.6.1-150300.3.3.1
    * squashfs-4.6.1-150300.3.3.1
  * Basesystem Module 15-SP4 (aarch64 ppc64le s390x x86_64)
    * squashfs-debuginfo-4.6.1-150300.3.3.1
    * squashfs-debugsource-4.6.1-150300.3.3.1
    * squashfs-4.6.1-150300.3.3.1
  * Basesystem Module 15-SP5 (aarch64 ppc64le s390x x86_64)
    * squashfs-debuginfo-4.6.1-150300.3.3.1
    * squashfs-debugsource-4.6.1-150300.3.3.1
    * squashfs-4.6.1-150300.3.3.1
  * SUSE Linux Enterprise High Performance Computing ESPOS 15 SP3 (aarch64
    x86_64)
    * squashfs-debuginfo-4.6.1-150300.3.3.1
    * squashfs-debugsource-4.6.1-150300.3.3.1
    * squashfs-4.6.1-150300.3.3.1
  * SUSE Linux Enterprise High Performance Computing LTSS 15 SP3 (aarch64
    x86_64)
    * squashfs-debuginfo-4.6.1-150300.3.3.1
    * squashfs-debugsource-4.6.1-150300.3.3.1
    * squashfs-4.6.1-150300.3.3.1
  * SUSE Linux Enterprise Server 15 SP3 LTSS 15-SP3 (aarch64 ppc64le s390x
    x86_64)
    * squashfs-debuginfo-4.6.1-150300.3.3.1
    * squashfs-debugsource-4.6.1-150300.3.3.1
    * squashfs-4.6.1-150300.3.3.1
  * SUSE Linux Enterprise Server for SAP Applications 15 SP3 (ppc64le x86_64)
    * squashfs-debuginfo-4.6.1-150300.3.3.1
    * squashfs-debugsource-4.6.1-150300.3.3.1
    * squashfs-4.6.1-150300.3.3.1
  * SUSE Manager Proxy 4.2 (x86_64)
    * squashfs-debuginfo-4.6.1-150300.3.3.1
    * squashfs-debugsource-4.6.1-150300.3.3.1
    * squashfs-4.6.1-150300.3.3.1
  * SUSE Manager Retail Branch Server 4.2 (x86_64)
    * squashfs-debuginfo-4.6.1-150300.3.3.1
    * squashfs-debugsource-4.6.1-150300.3.3.1
    * squashfs-4.6.1-150300.3.3.1
  * SUSE Manager Server 4.2 (ppc64le s390x x86_64)
    * squashfs-debuginfo-4.6.1-150300.3.3.1
    * squashfs-debugsource-4.6.1-150300.3.3.1
    * squashfs-4.6.1-150300.3.3.1
  * SUSE Enterprise Storage 7.1 (aarch64 x86_64)
    * squashfs-debuginfo-4.6.1-150300.3.3.1
    * squashfs-debugsource-4.6.1-150300.3.3.1
    * squashfs-4.6.1-150300.3.3.1
  * SUSE Linux Enterprise Micro 5.1 (aarch64 s390x x86_64)
    * squashfs-debuginfo-4.6.1-150300.3.3.1
    * squashfs-debugsource-4.6.1-150300.3.3.1
    * squashfs-4.6.1-150300.3.3.1
  * SUSE Linux Enterprise Micro 5.2 (aarch64 s390x x86_64)
    * squashfs-debuginfo-4.6.1-150300.3.3.1
    * squashfs-debugsource-4.6.1-150300.3.3.1
    * squashfs-4.6.1-150300.3.3.1
  * SUSE Linux Enterprise Micro for Rancher 5.2 (aarch64 s390x x86_64)
    * squashfs-debuginfo-4.6.1-150300.3.3.1
    * squashfs-debugsource-4.6.1-150300.3.3.1
    * squashfs-4.6.1-150300.3.3.1
  * openSUSE Leap 15.3 (aarch64 ppc64le s390x x86_64 i586)
    * squashfs-debuginfo-4.6.1-150300.3.3.1
    * squashfs-debugsource-4.6.1-150300.3.3.1
    * squashfs-4.6.1-150300.3.3.1
  * openSUSE Leap Micro 5.3 (aarch64 x86_64)
    * squashfs-debuginfo-4.6.1-150300.3.3.1
    * squashfs-debugsource-4.6.1-150300.3.3.1
    * squashfs-4.6.1-150300.3.3.1
  * openSUSE Leap Micro 5.4 (aarch64 s390x x86_64)
    * squashfs-debuginfo-4.6.1-150300.3.3.1
    * squashfs-debugsource-4.6.1-150300.3.3.1
    * squashfs-4.6.1-150300.3.3.1

## References:

  * https://www.suse.com/security/cve/CVE-2015-4645.html
  * https://www.suse.com/security/cve/CVE-2015-4646.html
  * https://www.suse.com/security/cve/CVE-2021-40153.html
  * https://www.suse.com/security/cve/CVE-2021-41072.html
  * https://bugzilla.suse.com/show_bug.cgi?id=1189936
  * https://bugzilla.suse.com/show_bug.cgi?id=1190531
  * https://bugzilla.suse.com/show_bug.cgi?id=935380

SUSE: 2023:4591-1 important: squashfs

November 27, 2023
* bsc#1189936 * bsc#1190531 * bsc#935380 Cross-References:

Summary

## This update for squashfs fixes the following issues: * CVE-2015-4645,CVE-2015-4646: Multiple buffer overflows fixed in squashfs- tools (bsc#935380) * CVE-2021-40153: Fixed an issue where an attacker might have been able to write a file outside of destination (bsc#1189936) * CVE-2021-41072: Fixed an issue where an attacker might have been able to write a file outside the destination directory via a symlink (bsc#1190531). update to 4.6.1: * Race condition which can cause corruption of the "fragment table" fixed. This is a regression introduced in August 2022, and it has been seen when tailend packing is used (-tailends option). * Fix build failure when the tools are being built without extended attribute (XATTRs) support. * Fix XATTR error message when an unrecognised prefix is found * Fix incorrect free of pointer when an unrecognised XATTR prefix is found. * Major improvements in extended attribute handling, pseudo file handling, and miscellaneous new options and improvements * Extended attribute handling improved in Mksquashfs and Sqfstar * New Pseudo file xattr definition to add extended attributes to files. * New xattrs-add Action to add extended attributes to files * Extended attribute handling improved in Unsquashfs * Other major improvements * Unsquashfs can now output Pseudo files to standard out. * Mksquashfs can now input Pseudo files from standard in. * Squashfs filesystems can now be converted (different block size compression etc) without unpacking to an intermediate filesystem or mounting, by piping the output of Unsquashfs to Mksquashfs. * Pseudo files are now supported by Sqfstar. * "Non-anchored" excludes are now supported by Unsquashfs. update to 4.5.1 (bsc#1190531, CVE-2021-41072): * This release adds Manpages for Mksquashfs(1), Unsquashfs(1), Sqfstar(1) and Sqfscat(1). * The -help text output from the utilities has been improved and extended as well (but the Manpages are now more comprehensive). * CVE-2021-41072 which is a writing outside of destination exploit, has been fixed. * The number of hard-links in the filesystem is now also displayed by Mksquashfs in the output summary. * The number of hard-links written by Unsquashfs is now also displayed in the output summary. * Unsquashfs will now write to a pre-existing destination directory, rather than aborting. * Unsquashfs now allows "." to used as the destination, to extract to the current directory. * The Unsquashfs progress bar now tracks empty files and hardlinks, in addition to data blocks. * -no-hardlinks option has been implemented for Sqfstar. * More sanity checking for "corrupted" filesystems, including checks for multiply linked directories and directory loops. * Options that may cause filesystems to be unmountable have been moved into a new "experts" category in the Mksquashfs help text (and Manpage). * Maximum cpiostyle filename limited to PATH_MAX. This prevents attempts to overflow the stack, or cause system calls to fail with a too long pathname. * Don't always use "max open file limit" when calculating length of queues, as a very large file limit can cause Unsquashfs to abort. Instead use the smaller of max open file limit and cache size. * Fix Mksquashfs silently ignoring Pseudo file definitions when appending. * Don't abort if no XATTR support has been built in, and there's XATTRs in the filesystem. This is a regression introduced in 2019 in Version 4.4. * Fix duplicate check when the last file block is sparse. update to 4.5: * Mksquashfs now supports "Actions". * New sqfstar command which will create a Squashfs image from a tar archive. * Tar style handling of source pathnames in Mksquashfs. * Cpio style handling of source pathnames in Mksquashfs. * New option to throttle the amount of CPU and I/O. * Mksquashfs now allows no source directory to be specified. * New Pseudo file "R" definition which allows a Regular file o be created with data stored within the Pseudo file. * Symbolic links are now followed in extract files * Unsquashfs now supports "exclude" files. * Max depth traversal option added. * Unsquashfs can now output a "Pseudo file" representing the input Squashfs filesystem. * New -one-file-system option in Mksquashfs. * New -no-hardlinks option in Mksquashfs. * Exit code in Unsquashfs changed to distinguish between non-fatal errors (exit 2), and fatal errors (exit 1). * Xattr id count added in Unsquashfs "-stat" output. * Unsquashfs "write outside directory" exploit fixed. * Error handling in Unsquashfs writer thread fixed. * Fix failure to truncate destination if appending aborted. * Prevent Mksquashfs reading the destination file. ## Patch Instructions: To install this SUSE update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: * openSUSE Leap 15.4 zypper in -t patch openSUSE-SLE-15.4-2023-4591=1 * openSUSE Leap 15.5 zypper in -t patch openSUSE-SLE-15.5-2023-4591=1 * SUSE Linux Enterprise Micro for Rancher 5.3 zypper in -t patch SUSE-SLE-Micro-5.3-2023-4591=1 * SUSE Linux Enterprise Micro 5.3 zypper in -t patch SUSE-SLE-Micro-5.3-2023-4591=1 * SUSE Linux Enterprise Micro for Rancher 5.4 zypper in -t patch SUSE-SLE-Micro-5.4-2023-4591=1 * SUSE Linux Enterprise Micro 5.4 zypper in -t patch SUSE-SLE-Micro-5.4-2023-4591=1 * SUSE Linux Enterprise Micro 5.5 zypper in -t patch SUSE-SLE-Micro-5.5-2023-4591=1 * Basesystem Module 15-SP4 zypper in -t patch SUSE-SLE-Module-Basesystem-15-SP4-2023-4591=1 * Basesystem Module 15-SP5 zypper in -t patch SUSE-SLE-Module-Basesystem-15-SP5-2023-4591=1 * SUSE Linux Enterprise High Performance Computing ESPOS 15 SP3 zypper in -t patch SUSE-SLE-Product-HPC-15-SP3-ESPOS-2023-4591=1 * SUSE Linux Enterprise High Performance Computing LTSS 15 SP3 zypper in -t patch SUSE-SLE-Product-HPC-15-SP3-LTSS-2023-4591=1 * SUSE Linux Enterprise Server 15 SP3 LTSS 15-SP3 zypper in -t patch SUSE-SLE-Product-SLES-15-SP3-LTSS-2023-4591=1 * SUSE Linux Enterprise Server for SAP Applications 15 SP3 zypper in -t patch SUSE-SLE-Product-SLES_SAP-15-SP3-2023-4591=1 * SUSE Manager Proxy 4.2 zypper in -t patch SUSE-SLE-Product-SUSE-Manager-Proxy-4.2-2023-4591=1 * SUSE Manager Retail Branch Server 4.2 zypper in -t patch SUSE-SLE-Product-SUSE-Manager-Retail-Branch- Server-4.2-2023-4591=1 * SUSE Manager Server 4.2 zypper in -t patch SUSE-SLE-Product-SUSE-Manager-Server-4.2-2023-4591=1 * SUSE Enterprise Storage 7.1 zypper in -t patch SUSE-Storage-7.1-2023-4591=1 * SUSE Linux Enterprise Micro 5.1 zypper in -t patch SUSE-SUSE-MicroOS-5.1-2023-4591=1 * SUSE Linux Enterprise Micro 5.2 zypper in -t patch SUSE-SUSE-MicroOS-5.2-2023-4591=1 * SUSE Linux Enterprise Micro for Rancher 5.2 zypper in -t patch SUSE-SUSE-MicroOS-5.2-2023-4591=1 * openSUSE Leap 15.3 zypper in -t patch SUSE-2023-4591=1 * openSUSE Leap Micro 5.3 zypper in -t patch openSUSE-Leap-Micro-5.3-2023-4591=1 * openSUSE Leap Micro 5.4 zypper in -t patch openSUSE-Leap-Micro-5.4-2023-4591=1 ## Package List: * openSUSE Leap 15.4 (aarch64 ppc64le s390x x86_64) * squashfs-debuginfo-4.6.1-150300.3.3.1 * squashfs-debugsource-4.6.1-150300.3.3.1 * squashfs-4.6.1-150300.3.3.1 * openSUSE Leap 15.5 (aarch64 ppc64le s390x x86_64) * squashfs-debuginfo-4.6.1-150300.3.3.1 * squashfs-debugsource-4.6.1-150300.3.3.1 * squashfs-4.6.1-150300.3.3.1 * SUSE Linux Enterprise Micro for Rancher 5.3 (aarch64 s390x x86_64) * squashfs-debuginfo-4.6.1-150300.3.3.1 * squashfs-debugsource-4.6.1-150300.3.3.1 * squashfs-4.6.1-150300.3.3.1 * SUSE Linux Enterprise Micro 5.3 (aarch64 s390x x86_64) * squashfs-debuginfo-4.6.1-150300.3.3.1 * squashfs-debugsource-4.6.1-150300.3.3.1 * squashfs-4.6.1-150300.3.3.1 * SUSE Linux Enterprise Micro for Rancher 5.4 (aarch64 s390x x86_64) * squashfs-debuginfo-4.6.1-150300.3.3.1 * squashfs-debugsource-4.6.1-150300.3.3.1 * squashfs-4.6.1-150300.3.3.1 * SUSE Linux Enterprise Micro 5.4 (aarch64 s390x x86_64) * squashfs-debuginfo-4.6.1-150300.3.3.1 * squashfs-debugsource-4.6.1-150300.3.3.1 * squashfs-4.6.1-150300.3.3.1 * SUSE Linux Enterprise Micro 5.5 (aarch64 s390x x86_64) * squashfs-debuginfo-4.6.1-150300.3.3.1 * squashfs-debugsource-4.6.1-150300.3.3.1 * squashfs-4.6.1-150300.3.3.1 * Basesystem Module 15-SP4 (aarch64 ppc64le s390x x86_64) * squashfs-debuginfo-4.6.1-150300.3.3.1 * squashfs-debugsource-4.6.1-150300.3.3.1 * squashfs-4.6.1-150300.3.3.1 * Basesystem Module 15-SP5 (aarch64 ppc64le s390x x86_64) * squashfs-debuginfo-4.6.1-150300.3.3.1 * squashfs-debugsource-4.6.1-150300.3.3.1 * squashfs-4.6.1-150300.3.3.1 * SUSE Linux Enterprise High Performance Computing ESPOS 15 SP3 (aarch64 x86_64) * squashfs-debuginfo-4.6.1-150300.3.3.1 * squashfs-debugsource-4.6.1-150300.3.3.1 * squashfs-4.6.1-150300.3.3.1 * SUSE Linux Enterprise High Performance Computing LTSS 15 SP3 (aarch64 x86_64) * squashfs-debuginfo-4.6.1-150300.3.3.1 * squashfs-debugsource-4.6.1-150300.3.3.1 * squashfs-4.6.1-150300.3.3.1 * SUSE Linux Enterprise Server 15 SP3 LTSS 15-SP3 (aarch64 ppc64le s390x x86_64) * squashfs-debuginfo-4.6.1-150300.3.3.1 * squashfs-debugsource-4.6.1-150300.3.3.1 * squashfs-4.6.1-150300.3.3.1 * SUSE Linux Enterprise Server for SAP Applications 15 SP3 (ppc64le x86_64) * squashfs-debuginfo-4.6.1-150300.3.3.1 * squashfs-debugsource-4.6.1-150300.3.3.1 * squashfs-4.6.1-150300.3.3.1 * SUSE Manager Proxy 4.2 (x86_64) * squashfs-debuginfo-4.6.1-150300.3.3.1 * squashfs-debugsource-4.6.1-150300.3.3.1 * squashfs-4.6.1-150300.3.3.1 * SUSE Manager Retail Branch Server 4.2 (x86_64) * squashfs-debuginfo-4.6.1-150300.3.3.1 * squashfs-debugsource-4.6.1-150300.3.3.1 * squashfs-4.6.1-150300.3.3.1 * SUSE Manager Server 4.2 (ppc64le s390x x86_64) * squashfs-debuginfo-4.6.1-150300.3.3.1 * squashfs-debugsource-4.6.1-150300.3.3.1 * squashfs-4.6.1-150300.3.3.1 * SUSE Enterprise Storage 7.1 (aarch64 x86_64) * squashfs-debuginfo-4.6.1-150300.3.3.1 * squashfs-debugsource-4.6.1-150300.3.3.1 * squashfs-4.6.1-150300.3.3.1 * SUSE Linux Enterprise Micro 5.1 (aarch64 s390x x86_64) * squashfs-debuginfo-4.6.1-150300.3.3.1 * squashfs-debugsource-4.6.1-150300.3.3.1 * squashfs-4.6.1-150300.3.3.1 * SUSE Linux Enterprise Micro 5.2 (aarch64 s390x x86_64) * squashfs-debuginfo-4.6.1-150300.3.3.1 * squashfs-debugsource-4.6.1-150300.3.3.1 * squashfs-4.6.1-150300.3.3.1 * SUSE Linux Enterprise Micro for Rancher 5.2 (aarch64 s390x x86_64) * squashfs-debuginfo-4.6.1-150300.3.3.1 * squashfs-debugsource-4.6.1-150300.3.3.1 * squashfs-4.6.1-150300.3.3.1 * openSUSE Leap 15.3 (aarch64 ppc64le s390x x86_64 i586) * squashfs-debuginfo-4.6.1-150300.3.3.1 * squashfs-debugsource-4.6.1-150300.3.3.1 * squashfs-4.6.1-150300.3.3.1 * openSUSE Leap Micro 5.3 (aarch64 x86_64) * squashfs-debuginfo-4.6.1-150300.3.3.1 * squashfs-debugsource-4.6.1-150300.3.3.1 * squashfs-4.6.1-150300.3.3.1 * openSUSE Leap Micro 5.4 (aarch64 s390x x86_64) * squashfs-debuginfo-4.6.1-150300.3.3.1 * squashfs-debugsource-4.6.1-150300.3.3.1 * squashfs-4.6.1-150300.3.3.1

References

* bsc#1189936

* bsc#1190531

* bsc#935380

Cross-

* CVE-2015-4645

* CVE-2015-4646

* CVE-2021-40153

* CVE-2021-41072

CVSS scores:

* CVE-2015-4645 ( SUSE ): 5.5 CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H

* CVE-2015-4645 ( NVD ): 5.5 CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H

* CVE-2015-4646 ( SUSE ): 5.5 CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H

* CVE-2021-40153 ( SUSE ): 6.6 CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:N

* CVE-2021-40153 ( NVD ): 8.1 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:H

* CVE-2021-41072 ( SUSE ): 6.6 CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:N

* CVE-2021-41072 ( NVD ): 8.1 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:H

Affected Products:

* Basesystem Module 15-SP4

* Basesystem Module 15-SP5

* openSUSE Leap 15.3

* openSUSE Leap 15.4

* openSUSE Leap 15.5

* openSUSE Leap Micro 5.3

* openSUSE Leap Micro 5.4

* SUSE Enterprise Storage 7.1

* SUSE Linux Enterprise Desktop 15 SP4

* SUSE Linux Enterprise Desktop 15 SP5

* SUSE Linux Enterprise High Performance Computing 15 SP3

* SUSE Linux Enterprise High Performance Computing 15 SP4

* SUSE Linux Enterprise High Performance Computing 15 SP5

* SUSE Linux Enterprise High Performance Computing ESPOS 15 SP3

* SUSE Linux Enterprise High Performance Computing LTSS 15 SP3

* SUSE Linux Enterprise Micro 5.1

* SUSE Linux Enterprise Micro 5.2

* SUSE Linux Enterprise Micro 5.3

* SUSE Linux Enterprise Micro 5.4

* SUSE Linux Enterprise Micro 5.5

* SUSE Linux Enterprise Micro for Rancher 5.2

* SUSE Linux Enterprise Micro for Rancher 5.3

* SUSE Linux Enterprise Micro for Rancher 5.4

* SUSE Linux Enterprise Real Time 15 SP4

* SUSE Linux Enterprise Real Time 15 SP5

* SUSE Linux Enterprise Server 15 SP3

* SUSE Linux Enterprise Server 15 SP3 LTSS 15-SP3

* SUSE Linux Enterprise Server 15 SP4

* SUSE Linux Enterprise Server 15 SP5

* SUSE Linux Enterprise Server for SAP Applications 15 SP3

* SUSE Linux Enterprise Server for SAP Applications 15 SP4

* SUSE Linux Enterprise Server for SAP Applications 15 SP5

* SUSE Manager Proxy 4.2

* SUSE Manager Proxy 4.3

* SUSE Manager Retail Branch Server 4.2

* SUSE Manager Retail Branch Server 4.3

* SUSE Manager Server 4.2

* SUSE Manager Server 4.3

An update that solves four vulnerabilities can now be installed.

##

* https://www.suse.com/security/cve/CVE-2015-4645.html

* https://www.suse.com/security/cve/CVE-2015-4646.html

* https://www.suse.com/security/cve/CVE-2021-40153.html

* https://www.suse.com/security/cve/CVE-2021-41072.html

* https://bugzilla.suse.com/show_bug.cgi?id=1189936

* https://bugzilla.suse.com/show_bug.cgi?id=1190531

* https://bugzilla.suse.com/show_bug.cgi?id=935380

Severity
Announcement ID: SUSE-SU-2023:4591-1
Rating: important

Related News

News

Powered By

Footer Logo

Linux Security - Your source for Top Linux News, Advisories, HowTo's and Feature Release.

Powered By

Footer Logo