* bsc#1219660 Cross-References: * CVE-2024-24577 . # Security update for git Announcement ID: SUSE-SU-2024:2592-1 Rating: important References: * bsc#1219660 Cross-References: * CVE-2024-24577 CVSS scores: * CVE-2024-24577 ( SUSE ): 8.6 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:L * CVE-2024-24577 ( NVD ): 9.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H Affected Products: * SUSE Linux Enterprise High Performance Computing 12 SP5 * SUSE Linux Enterprise Server 12 SP5 * SUSE Linux Enterprise Server for SAP Applications 12 SP5 * SUSE Linux Enterprise Software Development Kit 12 SP5 An update that solves one vulnerability can now be installed. ## Description: This update for git fixes the following issues: * CVE-2024-24577: Fixed arbitrary code execution due to heap corruption in git_index_add (bsc#1219660) ## Patch Instructions: To install this SUSE update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: * SUSE Linux Enterprise Software Development Kit 12 SP5 zypper in -t patch SUSE-SLE-SDK-12-SP5-2024-2592=1 * SUSE Linux Enterprise High Performance Computing 12 SP5 zypper in -t patch SUSE-SLE-SERVER-12-SP5-2024-2592=1 * SUSE Linux Enterprise Server 12 SP5 zypper in -t patch SUSE-SLE-SERVER-12-SP5-2024-2592=1 * SUSE Linux Enterprise Server for SAP Applications 12 SP5 zypper in -t patch SUSE-SLE-SERVER-12-SP5-2024-2592=1 ## Package List: * SUSE Linux Enterprise Software Development Kit 12 SP5 (aarch64 ppc64le s390x x86_64) * git-core-debuginfo-2.26.2-27.75.1 * git-svn-debuginfo-2.26.2-27.75.1 * git-cvs-2.26.2-27.75.1 * git-2.26.2-27.75.1 * git-arch-2.26.2-27.75.1 * git-debugsource-2.26.2-27.75.1 * git-core-2.26.2-27.75.1 * git-daemon-2.26.2-27.75.1 * git-web-2.26.2-27.75.1 * gitk-2.26.2-27.75.1 * git-gui-2.26.2-27.75.1 * git-svn-2.26.2-27.75.1 *git-daemon-debuginfo-2.26.2-27.75.1 * git-email-2.26.2-27.75.1 * SUSE Linux Enterprise Software Development Kit 12 SP5 (noarch) * git-doc-2.26.2-27.75.1 * SUSE Linux Enterprise High Performance Computing 12 SP5 (aarch64 x86_64) * git-core-debuginfo-2.26.2-27.75.1 * git-cvs-2.26.2-27.75.1 * git-2.26.2-27.75.1 * git-debugsource-2.26.2-27.75.1 * git-core-2.26.2-27.75.1 * git-daemon-2.26.2-27.75.1 * git-web-2.26.2-27.75.1 * gitk-2.26.2-27.75.1 * git-gui-2.26.2-27.75.1 * git-svn-2.26.2-27.75.1 * git-daemon-debuginfo-2.26.2-27.75.1 * git-email-2.26.2-27.75.1 * SUSE Linux Enterprise Server 12 SP5 (aarch64 ppc64le s390x x86_64) * git-core-debuginfo-2.26.2-27.75.1 * git-cvs-2.26.2-27.75.1 * git-2.26.2-27.75.1 * git-debugsource-2.26.2-27.75.1 * git-core-2.26.2-27.75.1 * git-daemon-2.26.2-27.75.1 * git-web-2.26.2-27.75.1 * gitk-2.26.2-27.75.1 * git-gui-2.26.2-27.75.1 * git-svn-2.26.2-27.75.1 * git-daemon-debuginfo-2.26.2-27.75.1 * git-email-2.26.2-27.75.1 * SUSE Linux Enterprise Server for SAP Applications 12 SP5 (ppc64le x86_64) * git-core-debuginfo-2.26.2-27.75.1 * git-cvs-2.26.2-27.75.1 * git-2.26.2-27.75.1 * git-debugsource-2.26.2-27.75.1 * git-core-2.26.2-27.75.1 * git-daemon-2.26.2-27.75.1 * git-web-2.26.2-27.75.1 * gitk-2.26.2-27.75.1 * git-gui-2.26.2-27.75.1 * git-svn-2.26.2-27.75.1 * git-daemon-debuginfo-2.26.2-27.75.1 * git-email-2.26.2-27.75.1 ## References: * https://www.suse.com/security/cve/CVE-2024-24577.html * https://bugzilla.suse.com/show_bug.cgi?id=1219660 . Critical announcement regarding git, focusing on a memory corruption vulnerability in SUSE Linux, aimed at maintaining operational integrity and safeguarding security.. Git Security Update, Heap Corruption Fix, SUSE Linux Advisory. . Severity: Important. LinuxSecurity.com Team
The container bci/golang was updated. The following patches have been included in this update:. SUSE Container Update Advisory: bci/golang ----------------------------------------------------------------- Container Advisory ID : SUSE-CU-2022:2942-1 Container Tags : bci/golang:1.17 , bci/golang:1.17-29.77 Container Release : 29.77 Severity : moderate Type : security References : 1204455 1204456 CVE-2022-39253 CVE-2022-39260 ----------------------------------------------------------------- The container bci/golang was updated. The following patches have been included in this update: ----------------------------------------------------------------- Advisory ID: SUSE-SU-2022:3931-1 Released: Thu Nov 10 11:26:01 2022 Summary: Security update for git Type: security Severity: moderate References: 1204455,1204456,CVE-2022-39253,CVE-2022-39260 This update for git fixes the following issues: - CVE-2022-39260: Fixed overflow in split_cmdline() (bsc#1204456). - CVE-2022-39253: Fixed dereference issue with symbolic links via the `--local` clone mechanism (bsc#1204455). The following package changes have been done: - git-core-2.35.3-150300.10.18.1 updated . A security enhancement for the bci/golang image is now available, addressing several moderate vulnerabilities that impact both users and developers.. SUSE Container Update, bci/golang security, Software Patches. . LinuxSecurity.com Team
Get the latest Linux and open source security news straight to your inbox.