The container bci/rust was updated. The following patches have been included in this update:. SUSE Container Update Advisory: bci/rust ----------------------------------------------------------------- Container Advisory ID : SUSE-CU-2022:2423-1 Container Tags : bci/rust:1.62 , bci/rust:1.62-2.39 , bci/rust:latest Container Release : 2.39 Severity : moderate Type : security References : 1201942 1203431 1203433 CVE-2022-36113 CVE-2022-36114 ----------------------------------------------------------------- The container bci/rust was updated. The following patches have been included in this update: ----------------------------------------------------------------- Advisory ID: SUSE-SU-2022:3451-1 Released: Wed Sep 28 09:44:15 2022 Summary: Security update for rust1.62 Type: security Severity: moderate References: 1203431,1203433,CVE-2022-36113,CVE-2022-36114 This update for rust1.62 fixes the following issues: - CVE-2022-36113: Fixed symlink hijack vulnerability (bsc#1203433). - CVE-2022-36114: Fixed zip bomb vulnerability (bsc#1203431). ----------------------------------------------------------------- Advisory ID: SUSE-RU-2022:3452-1 Released: Wed Sep 28 12:13:43 2022 Summary: Recommended update for glibc Type: recommended Severity: moderate References: 1201942 This update for glibc fixes the following issues: - Reversing calculation of __x86_shared_non_temporal_threshold (bsc#1201942) - powerpc: Optimized memcmp for power10 (jsc#PED-987) The following package changes have been done: - glibc-2.31-150300.41.1 updated - glibc-devel-2.31-150300.41.1 updated - rust1.62-1.62.1-150300.7.7.1 updated - cargo1.62-1.62.1-150300.7.7.1 updated - container:sles15-image-15.0.0-27.11.28 updated . Recent security patches for bci/rust have been issued, focusing on mitigating symlink vulnerability risks and preventing zip bomb exploits.. bci/rust security, container updates, SUSE advisory. . LinuxSecurity.com Team
An update that fixes two vulnerabilities is now available. . SUSE Security Update: Security update for rust1.62 ______________________________________________________________________________ Announcement ID: SUSE-SU-2022:3451-1 Rating: moderate References: #1203431 #1203433 Cross-References: CVE-2022-36113 CVE-2022-36114 CVSS scores: CVE-2022-36113 (NVD) : 8.1 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:H CVE-2022-36113 (SUSE): 5.4 CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:U/C:N/I:H/A:L CVE-2022-36114 (NVD) : 6.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H CVE-2022-36114 (SUSE): 4.8 CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:U/C:N/I:N/A:H Affected Products: SUSE Linux Enterprise Desktop 15-SP3 SUSE Linux Enterprise Desktop 15-SP4 SUSE Linux Enterprise High Performance Computing 15-SP3 SUSE Linux Enterprise High Performance Computing 15-SP4 SUSE Linux Enterprise Module for Development Tools 15-SP3 SUSE Linux Enterprise Module for Development Tools 15-SP4 SUSE Linux Enterprise Server 15-SP3 SUSE Linux Enterprise Server 15-SP4 SUSE Linux Enterprise Server for SAP Applications 15-SP3 SUSE Linux Enterprise Server for SAP Applications 15-SP4 SUSE Linux Enterprise Storage 7.1 SUSE Manager Proxy 4.2 SUSE Manager Proxy 4.3 SUSE Manager Retail Branch Server 4.2 SUSE Manager Retail Branch Server 4.3 SUSE Manager Server 4.2 SUSE Manager Server 4.3 openSUSE Leap 15.3 openSUSE Leap 15.4 ______________________________________________________________________________ An update that fixes two vulnerabilities is now available. Description: This update forrust1.62 fixes the following issues: - CVE-2022-36113: Fixed symlink hijack vulnerability (bsc#1203433). - CVE-2022-36114: Fixed zip bomb vulnerability (bsc#1203431). Patch Instructions: To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 15.4: zypper in -t patch openSUSE-SLE-15.4-2022-3451=1 - openSUSE Leap 15.3: zypper in -t patch openSUSE-SLE-15.3-2022-3451=1 - SUSE Linux Enterprise Module for Development Tools 15-SP4: zypper in -t patch SUSE-SLE-Module-Development-Tools-15-SP4-2022-3451=1 - SUSE Linux Enterprise Module for Development Tools 15-SP3: zypper in -t patch SUSE-SLE-Module-Development-Tools-15-SP3-2022-3451=1 Package List: - openSUSE Leap 15.4 (aarch64 ppc64le s390x x86_64): cargo1.62-1.62.1-150300.7.7.1 cargo1.62-debuginfo-1.62.1-150300.7.7.1 rust1.62-1.62.1-150300.7.7.1 rust1.62-debuginfo-1.62.1-150300.7.7.1 - openSUSE Leap 15.3 (aarch64 ppc64le s390x x86_64): cargo1.62-1.62.1-150300.7.7.1 cargo1.62-debuginfo-1.62.1-150300.7.7.1 rust1.62-1.62.1-150300.7.7.1 rust1.62-debuginfo-1.62.1-150300.7.7.1 - SUSE Linux Enterprise Module for Development Tools 15-SP4 (aarch64 ppc64le s390x x86_64): cargo1.62-1.62.1-150300.7.7.1 cargo1.62-debuginfo-1.62.1-150300.7.7.1 rust1.62-1.62.1-150300.7.7.1 rust1.62-debuginfo-1.62.1-150300.7.7.1 - SUSE Linux Enterprise Module for Development Tools 15-SP3 (aarch64 ppc64le s390x x86_64): cargo1.62-1.62.1-150300.7.7.1 cargo1.62-debuginfo-1.62.1-150300.7.7.1 rust1.62-1.62.1-150300.7.7.1 rust1.62-debuginfo-1.62.1-150300.7.7.1 References: https://www.suse.com/security/cve/CVE-2022-36113.html https://www.suse.com/security/cve/CVE-2022-36114.html https://bugzilla.suse.com/1203431 https://bugzilla.suse.com/1203433 . SUSE SecurityUpdate for rust1.63 addresses symlink vulnerabilities and zip archive threats. Apply the recommended updates to reduce exposure.. SUSE Linux Enterprise,Rust 1.62,Security Update,Patch Management,Vulnerability Fix. . LinuxSecurity.com Team
Get the latest Linux and open source security news straight to your inbox.