Marcus Updateinfo to OVAL Converter 5.5 2023-09-28T05:20:12 openSUSE Leap Micro 5.2 In Python (aka CPython) up to 3.10.8, the mailcap module does not add escape characters into commands discovered in the system mailcap file. This may allow attackers to inject shell commands into applications that call mailcap.findmatch with untrusted input (if they lack validation of user-provided filenames or arguments). The fix is also back-ported to 3.7, 3.8, 3.9 Important CVE-2015-20107 SUSE bug 1198511 SUSE bug 1200507 SUSE bug 1201777 SUSE bug 1201791 SUSE bug 1205068 SUSE bug 1208337 cpe:/o:opensuse:leap-micro:5.2 openSUSE Leap Micro 5.2 The einj_error_inject function in drivers/acpi/apei/einj.c in the Linux kernel allows local users to simulate hardware errors and consequently cause a denial of service by leveraging failure to disable APEI error injection through EINJ when securelevel is set. Low CVE-2016-3695 SUSE bug 1023051 cpe:/o:opensuse:leap-micro:5.2 openSUSE Leap Micro 5.2 Possible cross-site scripting vulnerability in libxml after commit 960f0e2. Moderate CVE-2016-3709 SUSE bug 1201978 cpe:/o:opensuse:leap-micro:5.2 openSUSE Leap Micro 5.2 Systems with microprocessors utilizing speculative execution and branch prediction may allow unauthorized disclosure of information to an attacker with local user access via a side-channel analysis. Important CVE-2017-5753 SUSE bug 1068032 SUSE bug 1074562 SUSE bug 1074578 SUSE bug 1074701 SUSE bug 1075006 SUSE bug 1075419 SUSE bug 1075748 SUSE bug 1080039 SUSE bug 1087084 SUSE bug 1087939 SUSE bug 1089055 SUSE bug 1136865 SUSE bug 1178658 SUSE bug 1201877 SUSE bug 1209547 cpe:/o:opensuse:leap-micro:5.2 openSUSE Leap Micro 5.2 Race condition in the rmtree and remove_tree functions in the File-Path module before 2.13 for Perl allows attackers to set the mode on arbitrary files via vectors involving directory-permission loosening logic. Moderate CVE-2017-6512 SUSE bug 1042218 SUSE bug 1047178 cpe:/o:opensuse:leap-micro:5.2 openSUSE Leap Micro 5.2 The handle_gnu_hash function in readelf.c in elfutils 0.168 allows remote attackers to cause a denial of service (heap-based buffer over-read and application crash) via a crafted ELF file. Moderate CVE-2017-7607 SUSE bug 1033084 cpe:/o:opensuse:leap-micro:5.2 openSUSE Leap Micro 5.2 The ebl_object_note_type_name function in eblobjnotetypename.c in elfutils 0.168 allows remote attackers to cause a denial of service (heap-based buffer over-read and application crash) via a crafted ELF file. Low CVE-2017-7608 SUSE bug 1033085 cpe:/o:opensuse:leap-micro:5.2 openSUSE Leap Micro 5.2 elf_compress.c in elfutils 0.168 does not validate the zlib compression factor, which allows remote attackers to cause a denial of service (memory consumption) via a crafted ELF file. Low CVE-2017-7609 SUSE bug 1033086 cpe:/o:opensuse:leap-micro:5.2 openSUSE Leap Micro 5.2 The check_group function in elflint.c in elfutils 0.168 allows remote attackers to cause a denial of service (heap-based buffer over-read and application crash) via a crafted ELF file. Low CVE-2017-7610 SUSE bug 1033087 cpe:/o:opensuse:leap-micro:5.2 openSUSE Leap Micro 5.2 The check_symtab_shndx function in elflint.c in elfutils 0.168 allows remote attackers to cause a denial of service (heap-based buffer over-read and application crash) via a crafted ELF file. Low CVE-2017-7611 SUSE bug 1033088 cpe:/o:opensuse:leap-micro:5.2 openSUSE Leap Micro 5.2 The check_sysv_hash function in elflint.c in elfutils 0.168 allows remote attackers to cause a denial of service (heap-based buffer over-read and application crash) via a crafted ELF file. Low CVE-2017-7612 SUSE bug 1033089 cpe:/o:opensuse:leap-micro:5.2 openSUSE Leap Micro 5.2 elflint.c in elfutils 0.168 does not validate the number of sections and the number of segments, which allows remote attackers to cause a denial of service (memory consumption) via a crafted ELF file. Low CVE-2017-7613 SUSE bug 1033090 cpe:/o:opensuse:leap-micro:5.2 openSUSE Leap Micro 5.2 A flaw was found in python-cryptography versions between >=1.9.0 and <2.3. The finalize_with_tag API did not enforce a minimum tag length. If a user did not validate the input length prior to passing it to finalize_with_tag an attacker could craft an invalid payload with a shortened tag (e.g. 1 byte) such that they would have a 1 in 256 chance of passing the MAC check. GCM tag forgeries can cause key leakage. Important CVE-2018-10903 SUSE bug 1101820 cpe:/o:opensuse:leap-micro:5.2 openSUSE Leap Micro 5.2 dwarf_getaranges in dwarf_getaranges.c in libdw in elfutils before 2018-08-18 allows remote attackers to cause a denial of service (heap-based buffer over-read) via a crafted file. Moderate CVE-2018-16062 SUSE bug 1106390 cpe:/o:opensuse:leap-micro:5.2 openSUSE Leap Micro 5.2 libelf/elf_end.c in elfutils 0.173 allows remote attackers to cause a denial of service (double free and application crash) or possibly have unspecified other impact because it tries to decompress twice. Moderate CVE-2018-16402 SUSE bug 1107066 cpe:/o:opensuse:leap-micro:5.2 openSUSE Leap Micro 5.2 libdw in elfutils 0.173 checks the end of the attributes list incorrectly in dwarf_getabbrev in dwarf_getabbrev.c and dwarf_hasattr in dwarf_hasattr.c, leading to a heap-based buffer over-read and an application crash. Low CVE-2018-16403 SUSE bug 1107067 cpe:/o:opensuse:leap-micro:5.2 openSUSE Leap Micro 5.2 An invalid memory address dereference was discovered in dwfl_segment_report_module.c in libdwfl in elfutils through v0.174. The vulnerability allows attackers to cause a denial of service (application crash) with a crafted ELF file, as demonstrated by consider_notes. Low CVE-2018-18310 SUSE bug 1111973 cpe:/o:opensuse:leap-micro:5.2 openSUSE Leap Micro 5.2 An Invalid Memory Address Dereference exists in the function elf_end in libelf in elfutils through v0.174. Although eu-size is intended to support ar files inside ar files, handle_ar in size.c closes the outer ar file before handling all inner entries. The vulnerability allows attackers to cause a denial of service (application crash) with a crafted ELF file. Low CVE-2018-18520 SUSE bug 1112726 cpe:/o:opensuse:leap-micro:5.2 openSUSE Leap Micro 5.2 Divide-by-zero vulnerabilities in the function arlib_add_symbols() in arlib.c in elfutils 0.174 allow remote attackers to cause a denial of service (application crash) with a crafted ELF file, as demonstrated by eu-ranlib, because a zero sh_entsize is mishandled. Low CVE-2018-18521 SUSE bug 1112723 cpe:/o:opensuse:leap-micro:5.2 openSUSE Leap Micro 5.2 Insufficient input validation in MdeModulePkg in EDKII may allow an unauthenticated user to potentially enable escalation of privilege, denial of service and/or information disclosure via physical access. Moderate CVE-2019-11098 SUSE bug 1188371 cpe:/o:opensuse:leap-micro:5.2 openSUSE Leap Micro 5.2 A use-after-free in onig_new_deluxe() in regext.c in Oniguruma 6.9.2 allows attackers to potentially cause information disclosure, denial of service, or possibly code execution by providing a crafted regular expression. The attacker provides a pair of a regex pattern and a string, with a multi-byte encoding that gets handled by onig_new_deluxe(). Oniguruma issues often affect Ruby, as well as common optional libraries for PHP and Rust. Moderate CVE-2019-13224 SUSE bug 1142847 SUSE bug 1203568 cpe:/o:opensuse:leap-micro:5.2 openSUSE Leap Micro 5.2 ** REJECT ** DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: none. Reason: This candidate was in a CNA pool that was not assigned to any issues during 2019. Notes: none. Moderate CVE-2019-14560 SUSE bug 1174246 cpe:/o:opensuse:leap-micro:5.2 openSUSE Leap Micro 5.2 Oniguruma before 6.9.3 allows Stack Exhaustion in regcomp.c because of recursion in regparse.c. Low CVE-2019-16163 SUSE bug 1150130 SUSE bug 1203568 cpe:/o:opensuse:leap-micro:5.2 openSUSE Leap Micro 5.2 An issue was discovered in urllib2 in Python 2.x through 2.7.17 and urllib in Python 3.x through 3.8.0. CRLF injection is possible if the attacker controls a url parameter, as demonstrated by the first argument to urllib.request.urlopen with \r\n (specifically in the host component of a URL) followed by an HTTP header. This is similar to the CVE-2019-9740 query string issue and the CVE-2019-9947 path string issue. (This is not exploitable when glibc has CVE-2016-10739 fixed.). This is fixed in: v2.7.18, v2.7.18rc1; v3.5.10, v3.5.10rc1; v3.6.11, v3.6.11rc1, v3.6.12; v3.7.8, v3.7.8rc1, v3.7.9; v3.8.3, v3.8.3rc1, v3.8.4, v3.8.4rc1, v3.8.5, v3.8.6, v3.8.6rc1. Moderate CVE-2019-18348 SUSE bug 1155094 cpe:/o:opensuse:leap-micro:5.2 openSUSE Leap Micro 5.2 Memory leaks in *clock_source_create() functions under drivers/gpu/drm/amd/display/dc in the Linux kernel before 5.3.8 allow attackers to cause a denial of service (memory consumption). This affects the dce112_clock_source_create() function in drivers/gpu/drm/amd/display/dc/dce112/dce112_resource.c, the dce100_clock_source_create() function in drivers/gpu/drm/amd/display/dc/dce100/dce100_resource.c, the dcn10_clock_source_create() function in drivers/gpu/drm/amd/display/dc/dcn10/dcn10_resource.c, the dcn20_clock_source_create() function in drivers/gpu/drm/amd/display/dc/dcn20/dcn20_resource.c, the dce120_clock_source_create() function in drivers/gpu/drm/amd/display/dc/dce120/dce120_resource.c, the dce110_clock_source_create() function in drivers/gpu/drm/amd/display/dc/dce110/dce110_resource.c, and the dce80_clock_source_create() function in drivers/gpu/drm/amd/display/dc/dce80/dce80_resource.c, aka CID-055e547478a1. Moderate CVE-2019-19083 SUSE bug 1157049 cpe:/o:opensuse:leap-micro:5.2 openSUSE Leap Micro 5.2 An issue was discovered in Oniguruma 6.x before 6.9.4_rc2. In the function gb18030_mbc_enc_len in file gb18030.c, a UChar pointer is dereferenced without checking if it passed the end of the matched string. This leads to a heap-based buffer over-read. Important CVE-2019-19203 SUSE bug 1164550 SUSE bug 1203568 cpe:/o:opensuse:leap-micro:5.2 openSUSE Leap Micro 5.2 An issue was discovered in Oniguruma 6.x before 6.9.4_rc2. In the function fetch_interval_quantifier (formerly known as fetch_range_quantifier) in regparse.c, PFETCH is called without checking PEND. This leads to a heap-based buffer over-read. Important CVE-2019-19204 SUSE bug 1164569 SUSE bug 1203568 cpe:/o:opensuse:leap-micro:5.2 openSUSE Leap Micro 5.2 Oniguruma through 6.9.3, as used in PHP 7.3.x and other products, has a heap-based buffer over-read in str_lower_case_match in regexec.c. Important CVE-2019-19246 SUSE bug 1157805 SUSE bug 1203568 cpe:/o:opensuse:leap-micro:5.2 openSUSE Leap Micro 5.2 In the Linux kernel 5.0.21, mounting a crafted btrfs filesystem image, performing some operations, and unmounting can lead to a use-after-free in btrfs_queue_work in fs/btrfs/async-thread.c. Important CVE-2019-19377 SUSE bug 1158266 SUSE bug 1162338 SUSE bug 1162369 SUSE bug 1173871 SUSE bug 1211495 cpe:/o:opensuse:leap-micro:5.2 openSUSE Leap Micro 5.2 An out-of-bounds read was discovered in PCRE before 10.34 when the pattern \X is JIT compiled and used to match specially crafted subjects in non-UTF mode. Applications that use PCRE to parse untrusted input may be vulnerable to this flaw, which would allow an attacker to crash the application. The flaw occurs in do_extuni_no_utf in pcre2_jit_compile.c. Moderate CVE-2019-20454 SUSE bug 1164384 SUSE bug 1172973 cpe:/o:opensuse:leap-micro:5.2 openSUSE Leap Micro 5.2 Vulnerability in the Data Store component of Oracle Berkeley DB. Supported versions that are affected are Prior to 6.138, prior to 6.2.38 and prior to 18.1.32. Easily exploitable vulnerability allows low privileged attacker having Local Logon privilege with logon to the infrastructure where Data Store executes to compromise Data Store. Successful attacks of this vulnerability can result in unauthorized ability to cause a partial denial of service (partial DOS) of Data Store. CVSS 3.0 Base Score 3.3 (Availability impacts). CVSS Vector: (CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L). Low CVE-2019-2708 SUSE bug 1174414 cpe:/o:opensuse:leap-micro:5.2 openSUSE Leap Micro 5.2 sc_context_create in ctx.c in libopensc in OpenSC 0.19.0 has a memory leak, as demonstrated by a call from eidenv. Low CVE-2019-6502 SUSE bug 1122756 SUSE bug 1179291 cpe:/o:opensuse:leap-micro:5.2 openSUSE Leap Micro 5.2 In elfutils 0.175, there is a buffer over-read in the ebl_object_note function in eblobjnote.c in libebl. Remote attackers could leverage this vulnerability to cause a denial-of-service via a crafted elf file, as demonstrated by eu-readelf. Low CVE-2019-7146 SUSE bug 1123545 cpe:/o:opensuse:leap-micro:5.2 openSUSE Leap Micro 5.2 An attempted excessive memory allocation was discovered in the function read_long_names in elf_begin.c in libelf in elfutils 0.174. Remote attackers could leverage this vulnerability to cause a denial-of-service via crafted elf input, which leads to an out-of-memory exception. NOTE: The maintainers believe this is not a real issue, but instead a "warning caused by ASAN because the allocation is big. By setting ASAN_OPTIONS=allocator_may_return_null=1 and running the reproducer, nothing happens." Moderate CVE-2019-7148 SUSE bug 1123687 cpe:/o:opensuse:leap-micro:5.2 openSUSE Leap Micro 5.2 A heap-based buffer over-read was discovered in the function read_srclines in dwarf_getsrclines.c in libdw in elfutils 0.175. A crafted input can cause segmentation faults, leading to denial-of-service, as demonstrated by eu-nm. Moderate CVE-2019-7149 SUSE bug 1123559 cpe:/o:opensuse:leap-micro:5.2 openSUSE Leap Micro 5.2 An issue was discovered in elfutils 0.175. A segmentation fault can occur in the function elf64_xlatetom in libelf/elf32_xlatetom.c, due to dwfl_segment_report_module not checking whether the dyn data read from a core file is truncated. A crafted input can cause a program crash, leading to denial-of-service, as demonstrated by eu-stack. Low CVE-2019-7150 SUSE bug 1123685 cpe:/o:opensuse:leap-micro:5.2 openSUSE Leap Micro 5.2 In elfutils 0.175, a negative-sized memcpy is attempted in elf_cvt_note in libelf/note_xlate.h because of an incorrect overflow check. Crafted elf input causes a segmentation fault, leading to denial of service (program crash). Low CVE-2019-7664 SUSE bug 1125008 cpe:/o:opensuse:leap-micro:5.2 openSUSE Leap Micro 5.2 In elfutils 0.175, a heap-based buffer over-read was discovered in the function elf32_xlatetom in elf32_xlatetom.c in libelf. A crafted ELF input can cause a segmentation fault leading to denial of service (program crash) because ebl_core_note does not reject malformed core file notes. Low CVE-2019-7665 SUSE bug 1125007 cpe:/o:opensuse:leap-micro:5.2 openSUSE Leap Micro 5.2 An issue was discovered in International Components for Unicode (ICU) for C/C++ through 66.1. An integer overflow, leading to a heap-based buffer overflow, exists in the UnicodeString::doAppend() function in common/unistr.cpp. Important CVE-2020-10531 SUSE bug 1166844 SUSE bug 1175778 cpe:/o:opensuse:leap-micro:5.2 openSUSE Leap Micro 5.2 A path traversal flaw was found in Buildah in versions before 1.14.5. This flaw allows an attacker to trick a user into building a malicious container image hosted on an HTTP(s) server and then write files to the user's system anywhere that the user has permissions. Important CVE-2020-10696 SUSE bug 1167864 cpe:/o:opensuse:leap-micro:5.2 openSUSE Leap Micro 5.2 A flaw was found in python. In algorithms with quadratic time complexity using non-binary bases, when using int("text"), a system could take 50ms to parse an int string with 100,000 digits and 5s for 1,000,000 digits (float, decimal, int.from_bytes(), and int() for binary bases 2, 4, 8, 16, and 32 are not affected). The highest threat from this vulnerability is to system availability. Important CVE-2020-10735 SUSE bug 1203125 SUSE bug 1204077 SUSE bug 1204096 SUSE bug 1204097 SUSE bug 1205075 SUSE bug 1208131 cpe:/o:opensuse:leap-micro:5.2 openSUSE Leap Micro 5.2 An infinite loop flaw was found in the USB xHCI controller emulation of QEMU while computing the length of the Transfer Request Block (TRB) Ring. This flaw allows a privileged guest user to hang the QEMU process on the host, resulting in a denial of service. Low CVE-2020-14394 SUSE bug 1180207 cpe:/o:opensuse:leap-micro:5.2 openSUSE Leap Micro 5.2 Use-after-free vulnerability in the Linux kernel exploitable by a local attacker due to reuse of a DCCP socket with an attached dccps_hc_tx_ccid object as a listener after being released. Fixed in Ubuntu Linux kernel 5.4.0-51.56, 5.3.0-68.63, 4.15.0-121.123, 4.4.0-193.224, 3.13.0.182.191 and 3.2.0-149.196. Important CVE-2020-16119 SUSE bug 1177471 SUSE bug 1177742 cpe:/o:opensuse:leap-micro:5.2 openSUSE Leap Micro 5.2 International Components for Unicode (ICU-20850) v66.1 was discovered to contain a use after free bug in the pkg_createWithAssemblyCode function in the file tools/pkgdata/pkgdata.cpp. Moderate CVE-2020-21913 SUSE bug 1193951 cpe:/o:opensuse:leap-micro:5.2 openSUSE Leap Micro 5.2 A flaw was found in all released versions of m2crypto, where they are vulnerable to Bleichenbacher timing attacks in the RSA decryption API via the timed processing of valid PKCS#1 v1.5 Ciphertext. The highest threat from this vulnerability is to confidentiality. Important CVE-2020-25657 SUSE bug 1178829 cpe:/o:opensuse:leap-micro:5.2 openSUSE Leap Micro 5.2 It was found that python-rsa is vulnerable to Bleichenbacher timing attacks. An attacker can use this flaw via the RSA decryption API to decrypt parts of the cipher text encrypted with RSA. Moderate CVE-2020-25658 SUSE bug 1178676 cpe:/o:opensuse:leap-micro:5.2 openSUSE Leap Micro 5.2 python-cryptography 3.2 is vulnerable to Bleichenbacher timing attacks in the RSA decryption API, via timed processing of valid PKCS#1 v1.5 ciphertext. Moderate CVE-2020-25659 SUSE bug 1178168 cpe:/o:opensuse:leap-micro:5.2 openSUSE Leap Micro 5.2 ** REJECT ** DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: none. Further investigation showed that it was not a security issue. Notes: none. Moderate CVE-2020-26159 SUSE bug 1177179 SUSE bug 1203568 cpe:/o:opensuse:leap-micro:5.2 openSUSE Leap Micro 5.2 The Linux kernel through 5.8.13 does not properly enforce the Secure Boot Forbidden Signature Database (aka dbx) protection mechanism. This affects certs/blacklist.c and certs/system_keyring.c. Moderate CVE-2020-26541 SUSE bug 1177282 cpe:/o:opensuse:leap-micro:5.2 openSUSE Leap Micro 5.2 A vulnerability was found in the Linux kernel, where accessing a deallocated instance in printer_ioctl() printer_ioctl() tries to access of a printer_dev instance. However, use-after-free arises because it had been freed by gprinter_free(). Low CVE-2020-27784 SUSE bug 1202895 cpe:/o:opensuse:leap-micro:5.2 openSUSE Leap Micro 5.2 ncsi.c in libslirp through 4.3.1 has a buffer over-read because it tries to read a certain amount of header data even if that exceeds the total packet length. Low CVE-2020-29129 SUSE bug 1179466 SUSE bug 1179467 SUSE bug 1179477 SUSE bug 1179484 cpe:/o:opensuse:leap-micro:5.2 openSUSE Leap Micro 5.2 slirp.c in libslirp through 4.3.1 has a buffer over-read because it tries to read a certain amount of header data even if that exceeds the total packet length. Moderate CVE-2020-29130 SUSE bug 1178658 SUSE bug 1179467 SUSE bug 1179477 cpe:/o:opensuse:leap-micro:5.2 openSUSE Leap Micro 5.2 An issue was discovered in p11-kit 0.21.1 through 0.23.21. A heap-based buffer over-read has been discovered in the RPC protocol used by thep11-kit server/remote commands and the client library. When the remote entity supplies a byte array through a serialized PKCS#11 function call, the receiving entity may allow the reading of up to 4 bytes of memory past the heap allocation. Moderate CVE-2020-29362 SUSE bug 1180065 SUSE bug 1201534 cpe:/o:opensuse:leap-micro:5.2 openSUSE Leap Micro 5.2 A crafted input file could cause a null pointer dereference in jcopy_sample_rows() when processed by libjpeg-turbo. Moderate CVE-2020-35538 SUSE bug 1202915 cpe:/o:opensuse:leap-micro:5.2 openSUSE Leap Micro 5.2 In the cryptography package before 3.3.2 for Python, certain sequences of update calls to symmetrically encrypt multi-GB values could result in an integer overflow and buffer overflow, as demonstrated by the Fernet class. Important CVE-2020-36242 SUSE bug 1182066 cpe:/o:opensuse:leap-micro:5.2 openSUSE Leap Micro 5.2 An issue was discovered in the Linux kernel through 5.16.11. The mixed IPID assignment method with the hash-based IPID assignment policy allows an off-path attacker to inject data into a victim's TCP session or terminate that session. Important CVE-2020-36516 SUSE bug 1196616 SUSE bug 1196867 SUSE bug 1204092 SUSE bug 1204183 cpe:/o:opensuse:leap-micro:5.2 openSUSE Leap Micro 5.2 A race condition in the Linux kernel before 5.6.2 between the VT_DISALLOCATE ioctl and closing/opening of ttys could lead to a use-after-free. Important CVE-2020-36557 SUSE bug 1201429 SUSE bug 1201742 SUSE bug 1202874 SUSE bug 1205313 cpe:/o:opensuse:leap-micro:5.2 openSUSE Leap Micro 5.2 A race condition in the Linux kernel before 5.5.7 involving VT_RESIZEX could lead to a NULL pointer dereference and general protection fault. Important CVE-2020-36558 SUSE bug 1200910 SUSE bug 1201752 SUSE bug 1205313 cpe:/o:opensuse:leap-micro:5.2 openSUSE Leap Micro 5.2 Python 2.7 through 2.7.17, 3.5 through 3.5.9, 3.6 through 3.6.10, 3.7 through 3.7.6, and 3.8 through 3.8.1 allows an HTTP server to conduct Regular Expression Denial of Service (ReDoS) attacks against a client because of urllib.request.AbstractBasicAuthHandler catastrophic backtracking. Moderate CVE-2020-8492 SUSE bug 1162367 cpe:/o:opensuse:leap-micro:5.2 openSUSE Leap Micro 5.2 Rootless containers run with Podman, receive all traffic with a source IP address of 127.0.0.1 (including from remote hosts). This impacts containerized applications that trust localhost (127.0.01) connections by default and do not require authentication. This issue affects Podman 1.8.0 onwards. Low CVE-2021-20199 SUSE bug 1181640 cpe:/o:opensuse:leap-micro:5.2 openSUSE Leap Micro 5.2 A flaw was found in spice in versions before 0.14.92. A DoS tool might make it easier for remote attackers to cause a denial of service (CPU consumption) by performing many renegotiations within a single connection. Moderate CVE-2021-20201 SUSE bug 1181686 cpe:/o:opensuse:leap-micro:5.2 openSUSE Leap Micro 5.2 An improper limitation of path name flaw was found in containernetworking/cni in versions before 0.8.1. When specifying the plugin to load in the 'type' field in the network configuration, it is possible to use special elements such as "../" separators to reference binaries elsewhere on the system. This flaw allows an attacker to execute other existing binaries other than the cni plugins/types, such as 'reboot'. The highest threat from this vulnerability is to confidentiality, integrity, as well as system availability. Important CVE-2021-20206 SUSE bug 1181961 cpe:/o:opensuse:leap-micro:5.2 openSUSE Leap Micro 5.2 A flaw was found in samba. A race condition in the password lockout code may lead to the risk of brute force attacks being successful if special conditions are met. Important CVE-2021-20251 SUSE bug 1206546 SUSE bug 1208433 SUSE bug 1209325 SUSE bug 1209664 cpe:/o:opensuse:leap-micro:5.2 openSUSE Leap Micro 5.2 An issue in protobuf-java allowed the interleaving of com.google.protobuf.UnknownFieldSet fields in such a way that would be processed out of order. A small malicious payload can occupy the parser for several minutes by creating large numbers of short-lived objects that cause frequent, repeated pauses. We recommend upgrading libraries beyond the vulnerable versions. Moderate CVE-2021-22569 SUSE bug 1194530 cpe:/o:opensuse:leap-micro:5.2 openSUSE Leap Micro 5.2 Some AMD CPUs may transiently execute beyond unconditional direct branches, which may potentially result in data leakage. Moderate CVE-2021-26341 SUSE bug 1196901 SUSE bug 1201050 cpe:/o:opensuse:leap-micro:5.2 openSUSE Leap Micro 5.2 An issue was discovered in GNOME GLib before 2.66.8. When g_file_replace() is used with G_FILE_CREATE_REPLACE_DESTINATION to replace a path that is a dangling symlink, it incorrectly also creates the target of the symlink as an empty file, which could conceivably have security relevance if the symlink is attacker-controlled. (If the path is a symlink to a file that already exists, then the contents of that file correctly remain unchanged.) Low CVE-2021-28153 SUSE bug 1183533 cpe:/o:opensuse:leap-micro:5.2 openSUSE Leap Micro 5.2 x86: Speculative vulnerabilities with bare (non-shim) 32-bit PV guests 32-bit x86 PV guest kernels run in ring 1. At the time when Xen was developed, this area of the i386 architecture was rarely used, which is why Xen was able to use it to implement paravirtualisation, Xen's novel approach to virtualization. In AMD64, Xen had to use a different implementation approach, so Xen does not use ring 1 to support 64-bit guests. With the focus now being on 64-bit systems, and the availability of explicit hardware support for virtualization, fixing speculation issues in ring 1 is not a priority for processor companies. Indirect Branch Restricted Speculation (IBRS) is an architectural x86 extension put together to combat speculative execution sidechannel attacks, including Spectre v2. It was retrofitted in microcode to existing CPUs. For more details on Spectre v2, see: http://xenbits.xen.org/xsa/advisory-254.html However, IBRS does not architecturally protect ring 0 from predictions learnt in ring 1. For more details, see: https://software.intel.com/security-software-guidance/deep-dives/deep-dive-indirect-branch-restricted-speculation Similar situations may exist with other mitigations for other kinds of speculative execution attacks. The situation is quite likely to be similar for speculative execution attacks which have yet to be discovered, disclosed, or mitigated. Moderate CVE-2021-28689 SUSE bug 1185104 cpe:/o:opensuse:leap-micro:5.2 openSUSE Leap Micro 5.2 ** DISPUTED ** Python 3.x through 3.10 has an open redirection vulnerability in lib/http/server.py due to no protection against multiple (/) at the beginning of URI path which may leads to information disclosure. NOTE: this is disputed by a third party because the http.server.html documentation page states "Warning: http.server is not recommended for production. It only implements basic security checks." Important CVE-2021-28861 SUSE bug 1202624 SUSE bug 1204077 SUSE bug 1204801 SUSE bug 1204802 SUSE bug 1205068 SUSE bug 1205075 SUSE bug 1205467 cpe:/o:opensuse:leap-micro:5.2 openSUSE Leap Micro 5.2 Use after free in Blink XSLT in Google Chrome prior to 91.0.4472.164 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page. Important CVE-2021-30560 SUSE bug 1188373 SUSE bug 1208574 SUSE bug 1211500 SUSE bug 1211501 SUSE bug 1211544 cpe:/o:opensuse:leap-micro:5.2 openSUSE Leap Micro 5.2 Insufficient control flow management for the Intel(R) 82599 Ethernet Controllers and Adapters may allow an authenticated user to potentially enable denial of service via local access. Moderate CVE-2021-33061 SUSE bug 1196426 cpe:/o:opensuse:leap-micro:5.2 openSUSE Leap Micro 5.2 When sending malicous data to kernel by ioctl cmd FBIOPUT_VSCREENINFO,kernel will write memory out of bounds. Important CVE-2021-33655 SUSE bug 1201635 SUSE bug 1202087 SUSE bug 1205313 SUSE bug 1212291 cpe:/o:opensuse:leap-micro:5.2 openSUSE Leap Micro 5.2 When setting font with malicous data by ioctl cmd PIO_FONT,kernel will write memory out of bounds. Moderate CVE-2021-33656 SUSE bug 1201636 SUSE bug 1212286 cpe:/o:opensuse:leap-micro:5.2 openSUSE Leap Micro 5.2 A heap buffer overflow was found in the floppy disk emulator of QEMU up to 6.0.0 (including). It could occur in fdctrl_transfer_handler() in hw/block/fdc.c while processing DMA read data transfers from the floppy drive to the guest system. A privileged guest user could use this flaw to crash the QEMU process on the host resulting in DoS scenario, or potential information leakage from the host memory. Moderate CVE-2021-3507 SUSE bug 1185000 cpe:/o:opensuse:leap-micro:5.2 openSUSE Leap Micro 5.2 GStreamer before 1.18.4 may perform an out-of-bounds read when handling certain ID3v2 tags. Moderate CVE-2021-3522 SUSE bug 1185448 cpe:/o:opensuse:leap-micro:5.2 openSUSE Leap Micro 5.2 A flaw was found in libxml2. Exponential entity expansion attack its possible bypassing all existing protection mechanisms and leading to denial of service. Moderate CVE-2021-3541 SUSE bug 1186015 cpe:/o:opensuse:leap-micro:5.2 openSUSE Leap Micro 5.2 An invalid pointer initialization issue was found in the SLiRP networking implementation of QEMU. The flaw exists in the udp6_input() function and could occur while processing a udp packet that is smaller than the size of the 'udphdr' structure. This issue may lead to out-of-bounds read access or indirect host memory disclosure to the guest. The highest threat from this vulnerability is to data confidentiality. This flaw affects libslirp versions prior to 4.6.0. Low CVE-2021-3593 SUSE bug 1187365 cpe:/o:opensuse:leap-micro:5.2 openSUSE Leap Micro 5.2 A flaw was found in libtpms. The flaw can be triggered by specially-crafted TPM 2 command packets containing illegal values and may lead to an out-of-bounds access when the volatile state of the TPM 2 is marshalled/written or unmarshalled/read. The highest threat from this vulnerability is to system availability. Moderate CVE-2021-3623 SUSE bug 1187767 cpe:/o:opensuse:leap-micro:5.2 openSUSE Leap Micro 5.2 ** DISPUTED ** A segmentation fault can occur in the sqlite3.exe command-line component of SQLite 3.36.0 via the idxGetTableInfo function when there is a crafted SQL query. NOTE: the vendor disputes the relevance of this report because a sqlite3.exe user already has full privileges (e.g., is intentionally allowed to execute commands). This report does NOT imply any problem in the SQLite library. Moderate CVE-2021-36690 SUSE bug 1189802 SUSE bug 1211963 cpe:/o:opensuse:leap-micro:5.2 openSUSE Leap Micro 5.2 An internal reference count is held on the buffer pool, incremented every time a new buffer is created from the pool. The reference count is maintained as an int; on LP64 systems this can cause the reference count to overflow if the client creates a large number of wl_shm buffer objects, or if it can coerce the server to create a large number of external references to the buffer storage. With the reference count overflowing, a use-after-free can be constructed on the wl_shm_pool tracking structure, where values may be incremented or decremented; it may also be possible to construct a limited oracle to leak 4 bytes of server-side memory to the attacking client at a time. Moderate CVE-2021-3782 SUSE bug 1190486 cpe:/o:opensuse:leap-micro:5.2 openSUSE Leap Micro 5.2 Existing CommBuffer checks in SmmEntryPoint will not catch underflow when computing BufferSize. Important CVE-2021-38578 SUSE bug 1196741 cpe:/o:opensuse:leap-micro:5.2 openSUSE Leap Micro 5.2 A flaw was found in the Linux kernel's implementation of RDMA over infiniband. An attacker with a privileged local account can leak kernel stack information when issuing commands to the /dev/infiniband/rdma_cm device node. While this access is unlikely to leak sensitive user information, it can be further used to defeat existing kernel protection mechanisms. Low CVE-2021-3923 SUSE bug 1209778 cpe:/o:opensuse:leap-micro:5.2 openSUSE Leap Micro 5.2 vim is vulnerable to Use of Uninitialized Variable Moderate CVE-2021-3928 SUSE bug 1192478 cpe:/o:opensuse:leap-micro:5.2 openSUSE Leap Micro 5.2 A DMA reentrancy issue was found in the NVM Express Controller (NVME) emulation in QEMU. This CVE is similar to CVE-2021-3750 and, just like it, when the reentrancy write triggers the reset function nvme_ctrl_reset(), data structs will be freed leading to a use-after-free issue. A malicious guest could use this flaw to crash the QEMU process on the host, resulting in a denial of service condition or, potentially, executing arbitrary code within the context of the QEMU process on the host. Important CVE-2021-3929 SUSE bug 1193880 cpe:/o:opensuse:leap-micro:5.2 openSUSE Leap Micro 5.2 A key length flaw was found in Red Hat Ceph Storage. An attacker can exploit the fact that the key length is incorrectly passed in an encryption algorithm to create a non random key, which is weaker and can be exploited for loss of confidentiality and integrity on encrypted disks. Moderate CVE-2021-3979 SUSE bug 1194131 cpe:/o:opensuse:leap-micro:5.2 openSUSE Leap Micro 5.2 A flaw was found in podman. The `podman machine` function (used to create and manage Podman virtual machine containing a Podman process) spawns a `gvproxy` process on the host system. The `gvproxy` API is accessible on port 7777 on all IP addresses on the host. If that port is open on the host's firewall, an attacker can potentially use the `gvproxy` API to forward ports on the host to ports in the VM, making private services on the VM accessible to the network. This issue could be also used to interrupt the host's services by forwarding all ports to the VM. Moderate CVE-2021-4024 SUSE bug 1193166 cpe:/o:opensuse:leap-micro:5.2 openSUSE Leap Micro 5.2 A vulnerability was found in the fs/inode.c:inode_init_owner() function logic of the LInux kernel that allows local users to create files for the XFS file-system with an unintended group ownership and with group execution and SGID permission bits set, in a scenario where a directory is SGID and belongs to a certain group and is writable by a user who is not a member of this group. This can lead to excessive permissions granted in case when they should not. This vulnerability is similar to the previous CVE-2018-13405 and adds the missed fix for the XFS. Moderate CVE-2021-4037 SUSE bug 1198702 cpe:/o:opensuse:leap-micro:5.2 openSUSE Leap Micro 5.2 The OCI Distribution Spec project defines an API protocol to facilitate and standardize the distribution of content. In the OCI Distribution Specification version 1.0.0 and prior, the Content-Type header alone was used to determine the type of document during push and pull operations. Documents that contain both “manifests” and “layers” fields could be interpreted as either a manifest or an index in the absence of an accompanying Content-Type header. If a Content-Type header changed between two pulls of the same digest, a client may interpret the resulting content differently. The OCI Distribution Specification has been updated to require that a mediaType value present in a manifest or index match the Content-Type header used during the push and pull operations. Clients pulling from a registry may distrust the Content-Type header and reject an ambiguous document that contains both “manifests” and “layers” fields or “manifests” and “config” fields if they are unable to update to version 1.0.1 of the spec. Moderate CVE-2021-41190 SUSE bug 1193273 cpe:/o:opensuse:leap-micro:5.2 openSUSE Leap Micro 5.2 A data leak flaw was found in the way XFS_IOC_ALLOCSP IOCTL in the XFS filesystem allowed for size increase of files with unaligned size. A local attacker could use this flaw to leak data on the XFS filesystem otherwise not accessible to them. Moderate CVE-2021-4155 SUSE bug 1194272 SUSE bug 1199255 SUSE bug 1200084 cpe:/o:opensuse:leap-micro:5.2 openSUSE Leap Micro 5.2 An out of memory bounds write flaw (1 or 2 bytes of memory) in the Linux kernel NFS subsystem was found in the way users use mirroring (replication of files with NFS). A user, having access to the NFS mount, could potentially use this flaw to crash the system or escalate privileges on the system. Low CVE-2021-4157 SUSE bug 1194013 cpe:/o:opensuse:leap-micro:5.2 openSUSE Leap Micro 5.2 A use-after-free read flaw was found in sock_getsockopt() in net/core/sock.c due to SO_PEERCRED and SO_PEERGROUPS race with listen() (and connect()) in the Linux kernel. In this flaw, an attacker with a user privileges may crash the system or leak internal kernel information. Moderate CVE-2021-4203 SUSE bug 1194535 cpe:/o:opensuse:leap-micro:5.2 openSUSE Leap Micro 5.2 There are two Information Disclosure vulnerabilities in colord, and they lie in colord/src/cd-device-db.c and colord/src/cd-profile-db.c separately. They exist because the 'err_msg' of 'sqlite3_exec' is not releasing after use, while libxml2 emphasizes that the caller needs to release it. Low CVE-2021-42523 SUSE bug 1202802 cpe:/o:opensuse:leap-micro:5.2 openSUSE Leap Micro 5.2 GNOME gdk-pixbuf 2.42.6 is vulnerable to a heap-buffer overflow vulnerability when decoding the lzw compressed stream of image data in GIF files with lzw minimum code size equals to 12. Important CVE-2021-44648 SUSE bug 1194633 cpe:/o:opensuse:leap-micro:5.2 openSUSE Leap Micro 5.2 In libtirpc before 1.3.3rc1, remote attackers could exhaust the file descriptors of a process that uses libtirpc because idle TCP connections are mishandled. This can, in turn, lead to an svc_run infinite loop without accepting new connections. Important CVE-2021-46828 SUSE bug 1201680 SUSE bug 1206259 SUSE bug 1209708 cpe:/o:opensuse:leap-micro:5.2 openSUSE Leap Micro 5.2 GNOME GdkPixbuf (aka GDK-PixBuf) before 2.42.8 allows a heap-based buffer overflow when compositing or clearing frames in GIF files, as demonstrated by io-gif-animation.c composite_frame. This overflow is controllable and could be abused for code execution, especially on 32-bit systems. Moderate CVE-2021-46829 SUSE bug 1201826 cpe:/o:opensuse:leap-micro:5.2 openSUSE Leap Micro 5.2 GNU Libtasn1 before 4.19.0 has an ETYPE_OK off-by-one array size check that affects asn1_encode_simple_der. Critical CVE-2021-46848 SUSE bug 1204690 SUSE bug 1205081 SUSE bug 1205311 SUSE bug 1208025 cpe:/o:opensuse:leap-micro:5.2 openSUSE Leap Micro 5.2 A denial of service (DOS) issue was found in the Linux kernel’s smb2_ioctl_query_info function in the fs/cifs/smb2ops.c Common Internet File System (CIFS) due to an incorrect return from the memdup_user function. This flaw allows a local, privileged (CAP_SYS_ADMIN) attacker to crash the system. Moderate CVE-2022-0168 SUSE bug 1197472 cpe:/o:opensuse:leap-micro:5.2 openSUSE Leap Micro 5.2 A use-after-free vulnerability was found in the LSI53C895A SCSI Host Bus Adapter emulation of QEMU. The flaw occurs while processing repeated messages to cancel the current SCSI request via the lsi_do_msgout function. This flaw allows a malicious privileged user within the guest to crash the QEMU process on the host, resulting in a denial of service. Moderate CVE-2022-0216 SUSE bug 1198038 cpe:/o:opensuse:leap-micro:5.2 openSUSE Leap Micro 5.2 Null source pointer passed as an argument to memcpy() function within TIFFFetchStripThing() in tif_dirread.c in libtiff versions from 3.9.0 to 4.3.0 could lead to Denial of Service via crafted TIFF file. For users that compile libtiff from sources, the fix is available with commit eecb0712. Moderate CVE-2022-0561 SUSE bug 1195964 cpe:/o:opensuse:leap-micro:5.2 openSUSE Leap Micro 5.2 A flaw was found in Openstack manilla owning a Ceph File system "share", which enables the owner to read/write any manilla share or entire file system. The vulnerability is due to a bug in the "volumes" plugin in Ceph Manager. This allows an attacker to compromise Confidentiality and Integrity of a file system. Fixed in RHCS 5.2 and Ceph 17.2.2. Important CVE-2022-0670 SUSE bug 1201837 cpe:/o:opensuse:leap-micro:5.2 openSUSE Leap Micro 5.2 A memory leak problem was found in the TCP source port generation algorithm in net/ipv4/tcp.c due to the small table perturb size. This flaw may allow an attacker to information leak and may cause a denial of service problem. Moderate CVE-2022-1012 SUSE bug 1199482 SUSE bug 1199694 SUSE bug 1202335 cpe:/o:opensuse:leap-micro:5.2 openSUSE Leap Micro 5.2 A flaw was found in the QEMU implementation of VMWare's paravirtual RDMA device. This flaw allows a crafted guest driver to execute HW commands when shared buffers are not yet allocated, potentially leading to a use-after-free condition. Important CVE-2022-1050 SUSE bug 1197653 cpe:/o:opensuse:leap-micro:5.2 openSUSE Leap Micro 5.2 Integer Overflow or Wraparound vulnerability in io_uring of Linux Kernel allows local attacker to cause memory corruption and escalate privileges to root. This issue affects: Linux Kernel versions prior to 5.4.189; version 5.4.24 and later versions. Important CVE-2022-1116 SUSE bug 1199647 SUSE bug 1199648 SUSE bug 1209225 cpe:/o:opensuse:leap-micro:5.2 openSUSE Leap Micro 5.2 A use-after-free flaw was found in fs/ext4/namei.c:dx_insert_block() in the Linux kernel’s filesystem sub-component. This flaw allows a local attacker with a user privilege to cause a denial of service. Moderate CVE-2022-1184 SUSE bug 1198577 SUSE bug 1210859 cpe:/o:opensuse:leap-micro:5.2 openSUSE Leap Micro 5.2 A privilege escalation flaw was found in Podman. This flaw allows an attacker to publish a malicious image to a public registry. Once this image is downloaded by a potential victim, the vulnerability is triggered after a user runs the 'podman top' command. This action gives the attacker access to the host filesystem, leading to information disclosure or denial of service. Important CVE-2022-1227 SUSE bug 1182428 cpe:/o:opensuse:leap-micro:5.2 openSUSE Leap Micro 5.2 The c_rehash script does not properly sanitise shell metacharacters to prevent command injection. This script is distributed by some operating systems in a manner where it is automatically executed. On such operating systems, an attacker could execute arbitrary commands with the privileges of the script. Use of the c_rehash script is considered obsolete and should be replaced by the OpenSSL rehash command line tool. Fixed in OpenSSL 3.0.3 (Affected 3.0.0,3.0.1,3.0.2). Fixed in OpenSSL 1.1.1o (Affected 1.1.1-1.1.1n). Fixed in OpenSSL 1.0.2ze (Affected 1.0.2-1.0.2zd). Moderate CVE-2022-1292 SUSE bug 1199166 SUSE bug 1200550 SUSE bug 1200650 SUSE bug 1200758 SUSE bug 1202688 cpe:/o:opensuse:leap-micro:5.2 openSUSE Leap Micro 5.2 An out-of-bounds read flaw was found in the Linux kernel’s TeleTYpe subsystem. The issue occurs in how a user triggers a race condition using ioctls TIOCSPTLCK and TIOCGPTPEER and TIOCSTI and TCXONC with leakage of memory in the flush_to_ldisc function. This flaw allows a local user to crash the system or read unauthorized random data from memory. Moderate CVE-2022-1462 SUSE bug 1198829 cpe:/o:opensuse:leap-micro:5.2 openSUSE Leap Micro 5.2 An out-of-bounds read vulnerability was discovered in the PCRE2 library in the compile_xclass_matchingpath() function of the pcre2_jit_compile.c file. This involves a unicode property matching issue in JIT-compiled regular expressions. The issue occurs because the character was not fully read in case-less matching within JIT. Important CVE-2022-1586 SUSE bug 1199232 SUSE bug 1203032 cpe:/o:opensuse:leap-micro:5.2 openSUSE Leap Micro 5.2 An out-of-bounds read vulnerability was discovered in the PCRE2 library in the get_recurse_data_length() function of the pcre2_jit_compile.c file. This issue affects recursions in JIT-compiled regular expressions caused by duplicate data transfers. Important CVE-2022-1587 SUSE bug 1199235 SUSE bug 1201754 SUSE bug 1203032 cpe:/o:opensuse:leap-micro:5.2 openSUSE Leap Micro 5.2 In Samba, GnuTLS gnutls_rnd() can fail and give predictable random values. Important CVE-2022-1615 SUSE bug 1202976 cpe:/o:opensuse:leap-micro:5.2 openSUSE Leap Micro 5.2 Linux Kernel could allow a local attacker to execute arbitrary code on the system, caused by a concurrency use-after-free flaw in the bad_flp_intr function. By executing a specially-crafted program, an attacker could exploit this vulnerability to execute arbitrary code or cause a denial of service condition on the system. Moderate CVE-2022-1652 SUSE bug 1199063 SUSE bug 1200057 SUSE bug 1200751 SUSE bug 1201832 SUSE bug 1204132 SUSE bug 1212307 cpe:/o:opensuse:leap-micro:5.2 openSUSE Leap Micro 5.2 Dpkg::Source::Archive in dpkg, the Debian package management system, before version 1.21.8, 1.20.10, 1.19.8, 1.18.26 is prone to a directory traversal vulnerability. When extracting untrusted source packages in v2 and v3 source package formats that include a debian.tar, the in-place extraction can lead to directory traversal situations on specially crafted orig.tar and debian.tar tarballs. Low CVE-2022-1664 SUSE bug 1199944 cpe:/o:opensuse:leap-micro:5.2 openSUSE Leap Micro 5.2 A use-after-free flaw was found in the Linux kernel’s Atheros wireless adapter driver in the way a user forces the ath9k_htc_wait_for_target function to fail with some input messages. This flaw allows a local user to crash or potentially escalate their privileges on the system. Moderate CVE-2022-1679 SUSE bug 1199487 SUSE bug 1201080 SUSE bug 1201832 SUSE bug 1204132 SUSE bug 1212316 cpe:/o:opensuse:leap-micro:5.2 openSUSE Leap Micro 5.2 A vulnerability was found in Ignition where ignition configs are accessible from unprivileged containers in VMs running on VMware products. This issue is only relevant in user environments where the Ignition config contains secrets. The highest threat from this vulnerability is to data confidentiality. Possible workaround is to not put secrets in the Ignition config. Moderate CVE-2022-1706 SUSE bug 1199524 cpe:/o:opensuse:leap-micro:5.2 openSUSE Leap Micro 5.2 A vulnerability was found in CRI-O that causes memory or disk space exhaustion on the node for anyone with access to the Kube API. The ExecSync request runs commands in a container and logs the output of the command. This output is then read by CRI-O after command execution, and it is read in a manner where the entire file corresponding to the output of the command is read in. Thus, if the output of the command is large it is possible to exhaust the memory or the disk space of the node when CRI-O reads the output of the command. The highest threat from this vulnerability is system availability. Moderate CVE-2022-1708 SUSE bug 1200285 cpe:/o:opensuse:leap-micro:5.2 openSUSE Leap Micro 5.2 Buffer Over-read in function grab_file_name in GitHub repository vim/vim prior to 8.2.4956. This vulnerability is capable of crashing the software, memory modification, and possible remote execution. Low CVE-2022-1720 SUSE bug 1200732 cpe:/o:opensuse:leap-micro:5.2 openSUSE Leap Micro 5.2 A race condition was found the Linux kernel in perf_event_open() which can be exploited by an unprivileged user to gain root privileges. The bug allows to build several exploit primitives such as kernel address information leak, arbitrary execution, etc. Important CVE-2022-1729 SUSE bug 1199507 SUSE bug 1199697 SUSE bug 1201832 cpe:/o:opensuse:leap-micro:5.2 openSUSE Leap Micro 5.2 A parsing vulnerability for the MessageSet type in the ProtocolBuffers versions prior to and including 3.16.1, 3.17.3, 3.18.2, 3.19.4, 3.20.1 and 3.21.5 for protobuf-cpp, and versions prior to and including 3.16.1, 3.17.3, 3.18.2, 3.19.4, 3.20.1 and 4.21.5 for protobuf-python can lead to out of memory failures. A specially crafted message with multiple key-value per elements creates parsing issues, and can lead to a Denial of Service against services receiving unsanitized input. We recommend upgrading to versions 3.18.3, 3.19.5, 3.20.2, 3.21.6 for protobuf-cpp and 3.18.3, 3.19.5, 3.20.2, 4.21.6 for protobuf-python. Versions for 3.16 and 3.17 are no longer updated. Moderate CVE-2022-1941 SUSE bug 1203681 SUSE bug 1205141 cpe:/o:opensuse:leap-micro:5.2 openSUSE Leap Micro 5.2 ** REJECT ** DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: CVE-2022-32250. Reason: This candidate is a duplicate of CVE-2022-32250. Notes: All CVE users should reference CVE-2022-32250 instead of this candidate. All references and descriptions in this candidate have been removed to prevent accidental usage. Important CVE-2022-1966 SUSE bug 1200015 SUSE bug 1200268 SUSE bug 1200494 SUSE bug 1200529 cpe:/o:opensuse:leap-micro:5.2 openSUSE Leap Micro 5.2 Use After Free in GitHub repository vim/vim prior to 8.2. Moderate CVE-2022-1968 SUSE bug 1200270 cpe:/o:opensuse:leap-micro:5.2 openSUSE Leap Micro 5.2 ** REJECT ** DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: CVE-2022-2078. Reason: This candidate is a reservation duplicate of CVE-2022-2078. Notes: All CVE users should reference CVE-2022-2078 instead of this candidate. All references and descriptions in this candidate have been removed to prevent accidental usage. Moderate CVE-2022-1972 SUSE bug 1200019 SUSE bug 1200266 cpe:/o:opensuse:leap-micro:5.2 openSUSE Leap Micro 5.2 A use-after-free flaw was found in the Linux kernel's NFC core functionality due to a race condition between kobject creation and delete. This vulnerability allows a local attacker with CAP_NET_ADMIN privilege to leak kernel information. Moderate CVE-2022-1974 SUSE bug 1200144 SUSE bug 1200265 cpe:/o:opensuse:leap-micro:5.2 openSUSE Leap Micro 5.2 There is a sleep-in-atomic bug in /net/nfc/netlink.c that allows an attacker to crash the Linux kernel by simulating a nfc device from user-space. Moderate CVE-2022-1975 SUSE bug 1200143 cpe:/o:opensuse:leap-micro:5.2 openSUSE Leap Micro 5.2 In mmc_blk_read_single of block.c, there is a possible way to read kernel heap memory due to uninitialized data. This could lead to local information disclosure if reading from an SD card that triggers errors, with no additional execution privileges needed. User interaction is not needed for exploitation.Product: AndroidVersions: Android kernelAndroid ID: A-216481035References: Upstream kernel Moderate CVE-2022-20008 SUSE bug 1199564 cpe:/o:opensuse:leap-micro:5.2 openSUSE Leap Micro 5.2 In lg_probe and related functions of hid-lg.c and other USB HID files, there is a possible out of bounds read due to improper input validation. This could lead to local information disclosure if a malicious USB HID device were plugged in, with no additional execution privileges needed. User interaction is not needed for exploitation.Product: AndroidVersions: Android kernelAndroid ID: A-188677105References: Upstream kernel Moderate CVE-2022-20132 SUSE bug 1200619 SUSE bug 1212287 cpe:/o:opensuse:leap-micro:5.2 openSUSE Leap Micro 5.2 In ip_check_mc_rcu of igmp.c, there is a possible use after free due to improper locking. This could lead to local escalation of privilege when opening and closing inet sockets with no additional execution privileges needed. User interaction is not needed for exploitation.Product: AndroidVersions: Android kernelAndroid ID: A-112551163References: Upstream kernel Moderate CVE-2022-20141 SUSE bug 1200604 SUSE bug 1200605 SUSE bug 1203034 cpe:/o:opensuse:leap-micro:5.2 openSUSE Leap Micro 5.2 In lock_sock_nested of sock.c, there is a possible use after free due to a race condition. This could lead to local escalation of privilege with System execution privileges needed. User interaction is not needed for exploitation.Product: AndroidVersions: Android kernelAndroid ID: A-174846563References: Upstream kernel Moderate CVE-2022-20154 SUSE bug 1200599 SUSE bug 1200608 cpe:/o:opensuse:leap-micro:5.2 openSUSE Leap Micro 5.2 In various methods of kernel base drivers, there is a possible out of bounds write due to a heap buffer overflow. This could lead to local escalation of privilege with System execution privileges needed. User interaction is not needed for exploitation.Product: AndroidVersions: Android kernelAndroid ID: A-182388481References: Upstream kernel Moderate CVE-2022-20166 SUSE bug 1200598 SUSE bug 1212284 cpe:/o:opensuse:leap-micro:5.2 openSUSE Leap Micro 5.2 A flaw was found in Samba. The security vulnerability occurs when KDC and the kpasswd service share a single account and set of keys, allowing them to decrypt each other's tickets. A user who has been requested to change their password, can exploit this flaw to obtain and use tickets to other services. Important CVE-2022-2031 SUSE bug 1201495 SUSE bug 1202815 SUSE bug 1202999 SUSE bug 1205061 SUSE bug 1208433 SUSE bug 1209664 cpe:/o:opensuse:leap-micro:5.2 openSUSE Leap Micro 5.2 Product: AndroidVersions: Android kernelAndroid ID: A-224546354References: Upstream kernel Moderate CVE-2022-20368 SUSE bug 1202346 SUSE bug 1212311 cpe:/o:opensuse:leap-micro:5.2 openSUSE Leap Micro 5.2 In v4l2_m2m_querybuf of v4l2-mem2mem.c, there is a possible out of bounds write due to improper input validation. This could lead to local escalation of privilege with System execution privileges needed. User interaction is not needed for exploitation.Product: AndroidVersions: Android kernelAndroid ID: A-223375145References: Upstream kernel Moderate CVE-2022-20369 SUSE bug 1202347 SUSE bug 1212321 cpe:/o:opensuse:leap-micro:5.2 openSUSE Leap Micro 5.2 Divide By Zero error in tiffcrop in libtiff 4.4.0 allows attackers to cause a denial-of-service via a crafted tiff file. For users that compile libtiff from sources, the fix is available with commit f3a5e010. Low CVE-2022-2056 SUSE bug 1201176 cpe:/o:opensuse:leap-micro:5.2 openSUSE Leap Micro 5.2 Divide By Zero error in tiffcrop in libtiff 4.4.0 allows attackers to cause a denial-of-service via a crafted tiff file. For users that compile libtiff from sources, the fix is available with commit f3a5e010. Low CVE-2022-2057 SUSE bug 1201175 cpe:/o:opensuse:leap-micro:5.2 openSUSE Leap Micro 5.2 Divide By Zero error in tiffcrop in libtiff 4.4.0 allows attackers to cause a denial-of-service via a crafted tiff file. For users that compile libtiff from sources, the fix is available with commit f3a5e010. Low CVE-2022-2058 SUSE bug 1201174 SUSE bug 1201175 SUSE bug 1201176 cpe:/o:opensuse:leap-micro:5.2 openSUSE Leap Micro 5.2 In addition to the c_rehash shell command injection identified in CVE-2022-1292, further circumstances where the c_rehash script does not properly sanitise shell metacharacters to prevent command injection were found by code review. When the CVE-2022-1292 was fixed it was not discovered that there are other places in the script where the file names of certificates being hashed were possibly passed to a command executed through the shell. This script is distributed by some operating systems in a manner where it is automatically executed. On such operating systems, an attacker could execute arbitrary commands with the privileges of the script. Use of the c_rehash script is considered obsolete and should be replaced by the OpenSSL rehash command line tool. Fixed in OpenSSL 3.0.4 (Affected 3.0.0,3.0.1,3.0.2,3.0.3). Fixed in OpenSSL 1.1.1p (Affected 1.1.1-1.1.1o). Fixed in OpenSSL 1.0.2zf (Affected 1.0.2-1.0.2ze). Moderate CVE-2022-2068 SUSE bug 1200550 SUSE bug 1207568 cpe:/o:opensuse:leap-micro:5.2 openSUSE Leap Micro 5.2 AES OCB mode for 32-bit x86 platforms using the AES-NI assembly optimised implementation will not encrypt the entirety of the data under some circumstances. This could reveal sixteen bytes of data that was preexisting in the memory that wasn't written. In the special case of "in place" encryption, sixteen bytes of the plaintext would be revealed. Since OpenSSL does not support OCB based cipher suites for TLS and DTLS, they are both unaffected. Fixed in OpenSSL 3.0.5 (Affected 3.0.0-3.0.4). Fixed in OpenSSL 1.1.1q (Affected 1.1.1-1.1.1p). Important CVE-2022-2097 SUSE bug 1201099 SUSE bug 1201332 cpe:/o:opensuse:leap-micro:5.2 openSUSE Leap Micro 5.2 Incomplete cleanup of multi-core shared buffers for some Intel(R) Processors may allow an authenticated user to potentially enable information disclosure via local access. Moderate CVE-2022-21123 SUSE bug 1199650 SUSE bug 1200549 SUSE bug 1209075 cpe:/o:opensuse:leap-micro:5.2 openSUSE Leap Micro 5.2 Incomplete cleanup of microarchitectural fill buffers on some Intel(R) Processors may allow an authenticated user to potentially enable information disclosure via local access. Moderate CVE-2022-21125 SUSE bug 1199650 SUSE bug 1200549 SUSE bug 1209074 cpe:/o:opensuse:leap-micro:5.2 openSUSE Leap Micro 5.2 Incomplete cleanup in specific special register read operations for some Intel(R) Processors may allow an authenticated user to potentially enable information disclosure via local access. Moderate CVE-2022-21127 SUSE bug 1199650 SUSE bug 1200549 cpe:/o:opensuse:leap-micro:5.2 openSUSE Leap Micro 5.2 Incomplete cleanup in specific special register write operations for some Intel(R) Processors may allow an authenticated user to potentially enable information disclosure via local access. Moderate CVE-2022-21166 SUSE bug 1199650 SUSE bug 1200549 SUSE bug 1209073 cpe:/o:opensuse:leap-micro:5.2 openSUSE Leap Micro 5.2 Improper input validation for some Intel(R) Processors may allow an authenticated user to potentially cause a denial of service via local access. Moderate CVE-2022-21180 SUSE bug 1199650 SUSE bug 1200549 SUSE bug 1212313 cpe:/o:opensuse:leap-micro:5.2 openSUSE Leap Micro 5.2 Insufficient granularity of access control in out-of-band management in some Intel(R) Atom and Intel Xeon Scalable Processors may allow a privileged user to potentially enable escalation of privilege via adjacent network access. Important CVE-2022-21216 SUSE bug 1208277 SUSE bug 1209936 SUSE bug 1211490 SUSE bug 1211511 SUSE bug 1213820 cpe:/o:opensuse:leap-micro:5.2 openSUSE Leap Micro 5.2 Improper isolation of shared resources in some Intel(R) Processors may allow a privileged user to potentially enable information disclosure via local access. Moderate CVE-2022-21233 SUSE bug 1201727 cpe:/o:opensuse:leap-micro:5.2 openSUSE Leap Micro 5.2 Buffer Over-read in GitHub repository vim/vim prior to 8.2. Low CVE-2022-2124 SUSE bug 1200697 cpe:/o:opensuse:leap-micro:5.2 openSUSE Leap Micro 5.2 Heap-based Buffer Overflow in GitHub repository vim/vim prior to 8.2. Low CVE-2022-2125 SUSE bug 1200698 SUSE bug 1205395 cpe:/o:opensuse:leap-micro:5.2 openSUSE Leap Micro 5.2 Out-of-bounds Read in GitHub repository vim/vim prior to 8.2. Low CVE-2022-2126 SUSE bug 1200700 cpe:/o:opensuse:leap-micro:5.2 openSUSE Leap Micro 5.2 Out-of-bounds Write in GitHub repository vim/vim prior to 8.2. Low CVE-2022-2129 SUSE bug 1200701 cpe:/o:opensuse:leap-micro:5.2 openSUSE Leap Micro 5.2 ** RESERVED ** This candidate has been reserved by an organization or individual that will use it when announcing a new security problem. When the candidate has been publicized, the details for this candidate will be provided. Moderate CVE-2022-21505 SUSE bug 1201458 cpe:/o:opensuse:leap-micro:5.2 openSUSE Leap Micro 5.2 A flaw was found in the Linux kernel’s KVM when attempting to set a SynIC IRQ. This issue makes it possible for a misbehaving VMM to write to SYNIC/STIMER MSRs, causing a NULL pointer dereference. This flaw allows an unprivileged local attacker on the host to issue specific ioctl calls, causing a kernel oops condition that results in a denial of service. Moderate CVE-2022-2153 SUSE bug 1200788 cpe:/o:opensuse:leap-micro:5.2 openSUSE Leap Micro 5.2 client_golang is the instrumentation library for Go applications in Prometheus, and the promhttp package in client_golang provides tooling around HTTP servers and clients. In client_golang prior to version 1.11.1, HTTP server is susceptible to a Denial of Service through unbounded cardinality, and potential memory exhaustion, when handling requests with non-standard HTTP methods. In order to be affected, an instrumented software must use any of `promhttp.InstrumentHandler*` middleware except `RequestsInFlight`; not filter any specific methods (e.g GET) before middleware; pass metric with `method` label name to our middleware; and not have any firewall/LB/proxy that filters away requests with unknown `method`. client_golang version 1.11.1 contains a patch for this issue. Several workarounds are available, including removing the `method` label name from counter/gauge used in the InstrumentHandler; turning off affected promhttp handlers; adding custom middleware before promhttp handler that will sanitize the request method given by Go http.Request; and using a reverse proxy or web application firewall, configured to only allow a limited set of methods. Important CVE-2022-21698 SUSE bug 1196338 cpe:/o:opensuse:leap-micro:5.2 openSUSE Leap Micro 5.2 Buffer Over-read in GitHub repository vim/vim prior to 8.2. Moderate CVE-2022-2175 SUSE bug 1200904 cpe:/o:opensuse:leap-micro:5.2 openSUSE Leap Micro 5.2 Heap-based Buffer Overflow in GitHub repository vim/vim prior to 8.2. Moderate CVE-2022-2182 SUSE bug 1200903 cpe:/o:opensuse:leap-micro:5.2 openSUSE Leap Micro 5.2 Out-of-bounds Read in GitHub repository vim/vim prior to 8.2. Moderate CVE-2022-2183 SUSE bug 1200902 cpe:/o:opensuse:leap-micro:5.2 openSUSE Leap Micro 5.2 Out-of-bounds Read in GitHub repository vim/vim prior to 8.2. Moderate CVE-2022-2206 SUSE bug 1201155 cpe:/o:opensuse:leap-micro:5.2 openSUSE Leap Micro 5.2 Heap-based Buffer Overflow in GitHub repository vim/vim prior to 8.2. Moderate CVE-2022-2207 SUSE bug 1201153 cpe:/o:opensuse:leap-micro:5.2 openSUSE Leap Micro 5.2 NULL Pointer Dereference in GitHub repository vim/vim prior to 8.2.5163. Low CVE-2022-2208 SUSE bug 1201152 cpe:/o:opensuse:leap-micro:5.2 openSUSE Leap Micro 5.2 Out-of-bounds Write in GitHub repository vim/vim prior to 8.2. Moderate CVE-2022-2210 SUSE bug 1201151 cpe:/o:opensuse:leap-micro:5.2 openSUSE Leap Micro 5.2 NULL Pointer Dereference in GitHub repository vim/vim prior to 8.2. Low CVE-2022-2231 SUSE bug 1201150 cpe:/o:opensuse:leap-micro:5.2 openSUSE Leap Micro 5.2 Out-of-bounds Read in GitHub repository vim/vim prior to 9.0. Low CVE-2022-2257 SUSE bug 1201154 cpe:/o:opensuse:leap-micro:5.2 openSUSE Leap Micro 5.2 Heap-based Buffer Overflow in GitHub repository vim/vim prior to 9.0. Low CVE-2022-2264 SUSE bug 1201132 cpe:/o:opensuse:leap-micro:5.2 openSUSE Leap Micro 5.2 Heap-based Buffer Overflow in GitHub repository vim/vim prior to 9.0. Low CVE-2022-2284 SUSE bug 1201133 cpe:/o:opensuse:leap-micro:5.2 openSUSE Leap Micro 5.2 Integer Overflow or Wraparound in GitHub repository vim/vim prior to 9.0. Moderate CVE-2022-2285 SUSE bug 1201134 cpe:/o:opensuse:leap-micro:5.2 openSUSE Leap Micro 5.2 Out-of-bounds Read in GitHub repository vim/vim prior to 9.0. Low CVE-2022-2286 SUSE bug 1201135 cpe:/o:opensuse:leap-micro:5.2 openSUSE Leap Micro 5.2 Out-of-bounds Read in GitHub repository vim/vim prior to 9.0. Low CVE-2022-2287 SUSE bug 1201136 cpe:/o:opensuse:leap-micro:5.2 openSUSE Leap Micro 5.2 An issue was discovered in SaltStack Salt in versions before 3002.9, 3003.5, 3004.2. PAM auth fails to reject locked accounts, which allows a previously authorized user whose account is locked still run Salt commands when their account is locked. This affects both local shell accounts with an active session and salt-api users that authenticate via PAM eauth. Important CVE-2022-22967 SUSE bug 1200566 cpe:/o:opensuse:leap-micro:5.2 openSUSE Leap Micro 5.2 Stack-based Buffer Overflow in GitHub repository vim/vim prior to 9.0. Moderate CVE-2022-2304 SUSE bug 1201249 cpe:/o:opensuse:leap-micro:5.2 openSUSE Leap Micro 5.2 There are use-after-free vulnerabilities caused by timer handler in net/rose/rose_timer.c of linux that allow attackers to crash linux kernel without any privileges. Moderate CVE-2022-2318 SUSE bug 1201251 SUSE bug 1212303 cpe:/o:opensuse:leap-micro:5.2 openSUSE Leap Micro 5.2 The implementations of SAE in hostapd before 2.10 and wpa_supplicant before 2.10 are vulnerable to side channel attacks as a result of cache access patterns. NOTE: this issue exists because of an incomplete fix for CVE-2019-9494. Important CVE-2022-23303 SUSE bug 1194732 SUSE bug 1205064 cpe:/o:opensuse:leap-micro:5.2 openSUSE Leap Micro 5.2 The implementations of EAP-pwd in hostapd before 2.10 and wpa_supplicant before 2.10 are vulnerable to side-channel attacks as a result of cache access patterns. NOTE: this issue exists because of an incomplete fix for CVE-2019-9495. Important CVE-2022-23304 SUSE bug 1194733 SUSE bug 1205064 cpe:/o:opensuse:leap-micro:5.2 openSUSE Leap Micro 5.2 Heap-based Buffer Overflow in GitHub repository vim/vim prior to 9.0.0044. Moderate CVE-2022-2343 SUSE bug 1201356 cpe:/o:opensuse:leap-micro:5.2 openSUSE Leap Micro 5.2 Heap-based Buffer Overflow in GitHub repository vim/vim prior to 9.0.0045. Moderate CVE-2022-2344 SUSE bug 1201359 cpe:/o:opensuse:leap-micro:5.2 openSUSE Leap Micro 5.2 Use After Free in GitHub repository vim/vim prior to 9.0.0046. Moderate CVE-2022-2345 SUSE bug 1201363 cpe:/o:opensuse:leap-micro:5.2 openSUSE Leap Micro 5.2 containerd is an open source container runtime. A bug was found in containerd's CRI implementation where a user can exhaust memory on the host. In the CRI stream server, a goroutine is launched to handle terminal resize events if a TTY is requested. If the user's process fails to launch due to, for example, a faulty command, the goroutine will be stuck waiting to send without a receiver, resulting in a memory leak. Kubernetes and crictl can both be configured to use containerd's CRI implementation and the stream server is used for handling container IO. This bug has been fixed in containerd 1.6.12 and 1.5.16. Users should update to these versions to resolve the issue. Users unable to upgrade should ensure that only trusted images and commands are used and that only trusted users have permissions to execute commands in running containers. Moderate CVE-2022-23471 SUSE bug 1206235 cpe:/o:opensuse:leap-micro:5.2 openSUSE Leap Micro 5.2 Certifi is a curated collection of Root Certificates for validating the trustworthiness of SSL certificates while verifying the identity of TLS hosts. Certifi 2022.12.07 removes root certificates from "TrustCor" from the root store. These are in the process of being removed from Mozilla's trust store. TrustCor's root certificates are being removed pursuant to an investigation prompted by media reporting that TrustCor's ownership also operated a business that produced spyware. Conclusions of Mozilla's investigation can be found in the linked google group discussion. Moderate CVE-2022-23491 SUSE bug 1206212 SUSE bug 1207038 cpe:/o:opensuse:leap-micro:5.2 openSUSE Leap Micro 5.2 ** REJECT ** DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: none. Reason: This candidate is unused by its CNA. Notes: none. Moderate CVE-2022-23816 SUSE bug 1201456 SUSE bug 1201469 cpe:/o:opensuse:leap-micro:5.2 openSUSE Leap Micro 5.2 IBPB may not prevent return branch predictions from being specified by pre-IBPB branch targets leading to a potential information disclosure. Moderate CVE-2022-23824 SUSE bug 1205209 cpe:/o:opensuse:leap-micro:5.2 openSUSE Leap Micro 5.2 Aliases in the branch predictor may cause some AMD processors to predict the wrong branch type potentially leading to information disclosure. Moderate CVE-2022-23825 SUSE bug 1201457 SUSE bug 1201469 SUSE bug 1205209 cpe:/o:opensuse:leap-micro:5.2 openSUSE Leap Micro 5.2 yajl-ruby is a C binding to the YAJL JSON parsing and generation library. The 1.x branch and the 2.x branch of `yajl` contain an integer overflow which leads to subsequent heap memory corruption when dealing with large (~2GB) inputs. The reallocation logic at `yajl_buf.c#L64` may result in the `need` 32bit integer wrapping to 0 when `need` approaches a value of 0x80000000 (i.e. ~2GB of data), which results in a reallocation of buf->alloc into a small heap chunk. These integers are declared as `size_t` in the 2.x branch of `yajl`, which practically prevents the issue from triggering on 64bit platforms, however this does not preclude this issue triggering on 32bit builds on which `size_t` is a 32bit integer. Subsequent population of this under-allocated heap chunk is based on the original buffer size, leading to heap memory corruption. This vulnerability mostly impacts process availability. Maintainers believe exploitation for arbitrary code execution is unlikely. A patch is available and anticipated to be part of yajl-ruby version 1.4.2. As a workaround, avoid passing large inputs to YAJL. Moderate CVE-2022-24795 SUSE bug 1198405 cpe:/o:opensuse:leap-micro:5.2 openSUSE Leap Micro 5.2 Dm-verity is used for extending root-of-trust to root filesystems. LoadPin builds on this property to restrict module/firmware loads to just the trusted root filesystem. Device-mapper table reloads currently allow users with root privileges to switch out the target with an equivalent dm-linear target and bypass verification till reboot. This allows root to bypass LoadPin and can be used to load untrusted and unverified kernel modules and firmware, which implies arbitrary kernel execution and persistence for peripherals that do not verify firmware updates. We recommend upgrading past commit 4caae58406f8ceb741603eee460d79bacca9b1b5 Moderate CVE-2022-2503 SUSE bug 1202677 cpe:/o:opensuse:leap-micro:5.2 openSUSE Leap Micro 5.2 A vulnerability found in gnutls. This security flaw happens because of a double free error occurs during verification of pkcs7 signatures in gnutls_pkcs7_verify function. Important CVE-2022-2509 SUSE bug 1202020 SUSE bug 1202593 cpe:/o:opensuse:leap-micro:5.2 openSUSE Leap Micro 5.2 There is a double free or corruption in rotateImage() at tiffcrop.c:8839 found in libtiff 4.4.0rc1 Important CVE-2022-2519 SUSE bug 1202968 SUSE bug 1205505 cpe:/o:opensuse:leap-micro:5.2 openSUSE Leap Micro 5.2 A flaw was found in libtiff 4.4.0rc1. There is a sysmalloc assertion fail in rotateImage() at tiffcrop.c:8621 that can cause program crash when reading a crafted input. Moderate CVE-2022-2520 SUSE bug 1202973 cpe:/o:opensuse:leap-micro:5.2 openSUSE Leap Micro 5.2 It was found in libtiff 4.4.0rc1 that there is an invalid pointer free operation in TIFFClose() at tif_close.c:131 called by tiffcrop.c:2522 that can cause a program crash and denial of service while processing crafted input. Important CVE-2022-2521 SUSE bug 1202971 SUSE bug 1205505 cpe:/o:opensuse:leap-micro:5.2 openSUSE Leap Micro 5.2 Heap-based Buffer Overflow in GitHub repository vim/vim prior to 9.0.0061. Low CVE-2022-2522 SUSE bug 1201863 cpe:/o:opensuse:leap-micro:5.2 openSUSE Leap Micro 5.2 Heap-based Buffer Overflow in GitHub repository vim/vim prior to 9.0.0101. Moderate CVE-2022-2571 SUSE bug 1202046 cpe:/o:opensuse:leap-micro:5.2 openSUSE Leap Micro 5.2 Heap-based Buffer Overflow in GitHub repository vim/vim prior to 9.0.0102. Moderate CVE-2022-2580 SUSE bug 1202049 cpe:/o:opensuse:leap-micro:5.2 openSUSE Leap Micro 5.2 Out-of-bounds Read in GitHub repository vim/vim prior to 9.0.0104. Low CVE-2022-2581 SUSE bug 1202050 cpe:/o:opensuse:leap-micro:5.2 openSUSE Leap Micro 5.2 ** RESERVED ** This candidate has been reserved by an organization or individual that will use it when announcing a new security problem. When the candidate has been publicized, the details for this candidate will be provided. Moderate CVE-2022-2586 SUSE bug 1202095 SUSE bug 1209719 cpe:/o:opensuse:leap-micro:5.2 openSUSE Leap Micro 5.2 ** RESERVED ** This candidate has been reserved by an organization or individual that will use it when announcing a new security problem. When the candidate has been publicized, the details for this candidate will be provided. Important CVE-2022-2588 SUSE bug 1202096 SUSE bug 1203613 SUSE bug 1204183 SUSE bug 1209225 cpe:/o:opensuse:leap-micro:5.2 openSUSE Leap Micro 5.2 Out-of-bounds Write to API in GitHub repository vim/vim prior to 9.0.0100. Low CVE-2022-2598 SUSE bug 1202051 cpe:/o:opensuse:leap-micro:5.2 openSUSE Leap Micro 5.2 A buffer overflow was found in grub_font_construct_glyph(). A malicious crafted pf2 font can lead to an overflow when calculating the max_glyph_size value, allocating a smaller than needed buffer for the glyph, this further leads to a buffer overflow and a heap based out-of-bounds write. An attacker may use this vulnerability to circumvent the secure boot mechanism. Moderate CVE-2022-2601 SUSE bug 1205178 cpe:/o:opensuse:leap-micro:5.2 openSUSE Leap Micro 5.2 ** RESERVED ** This candidate has been reserved by an organization or individual that will use it when announcing a new security problem. When the candidate has been publicized, the details for this candidate will be provided. Important CVE-2022-2602 SUSE bug 1204228 SUSE bug 1205186 cpe:/o:opensuse:leap-micro:5.2 openSUSE Leap Micro 5.2 x86 pv: Race condition in typeref acquisition Xen maintains a type reference count for pages, in addition to a regular reference count. This scheme is used to maintain invariants required for Xen's safety, e.g. PV guests may not have direct writeable access to pagetables; updates need auditing by Xen. Unfortunately, the logic for acquiring a type reference has a race condition, whereby a safely TLB flush is issued too early and creates a window where the guest can re-establish the read/write mapping before writeability is prohibited. Important CVE-2022-26362 SUSE bug 1199965 cpe:/o:opensuse:leap-micro:5.2 openSUSE Leap Micro 5.2 x86 pv: Insufficient care with non-coherent mappings T[his CNA information record relates to multiple CVEs; the text explains which aspects/vulnerabilities correspond to which CVE.] Xen maintains a type reference count for pages, in addition to a regular reference count. This scheme is used to maintain invariants required for Xen's safety, e.g. PV guests may not have direct writeable access to pagetables; updates need auditing by Xen. Unfortunately, Xen's safety logic doesn't account for CPU-induced cache non-coherency; cases where the CPU can cause the content of the cache to be different to the content in main memory. In such cases, Xen's safety logic can incorrectly conclude that the contents of a page is safe. Important CVE-2022-26363 SUSE bug 1199966 cpe:/o:opensuse:leap-micro:5.2 openSUSE Leap Micro 5.2 x86 pv: Insufficient care with non-coherent mappings T[his CNA information record relates to multiple CVEs; the text explains which aspects/vulnerabilities correspond to which CVE.] Xen maintains a type reference count for pages, in addition to a regular reference count. This scheme is used to maintain invariants required for Xen's safety, e.g. PV guests may not have direct writeable access to pagetables; updates need auditing by Xen. Unfortunately, Xen's safety logic doesn't account for CPU-induced cache non-coherency; cases where the CPU can cause the content of the cache to be different to the content in main memory. In such cases, Xen's safety logic can incorrectly conclude that the contents of a page is safe. Important CVE-2022-26364 SUSE bug 1199966 cpe:/o:opensuse:leap-micro:5.2 openSUSE Leap Micro 5.2 Linux disk/nic frontends data leaks T[his CNA information record relates to multiple CVEs; the text explains which aspects/vulnerabilities correspond to which CVE.] Linux Block and Network PV device frontends don't zero memory regions before sharing them with the backend (CVE-2022-26365, CVE-2022-33740). Additionally the granularity of the grant table doesn't allow sharing less than a 4K page, leading to unrelated data residing in the same 4K page as data shared with a backend being accessible by such backend (CVE-2022-33741, CVE-2022-33742). Moderate CVE-2022-26365 SUSE bug 1200762 cpe:/o:opensuse:leap-micro:5.2 openSUSE Leap Micro 5.2 Non-transparent sharing of return predictor targets between contexts in some Intel(R) Processors may allow an authorized user to potentially enable information disclosure via local access. Moderate CVE-2022-26373 SUSE bug 1201726 SUSE bug 1209619 cpe:/o:opensuse:leap-micro:5.2 openSUSE Leap Micro 5.2 An integer coercion error was found in the openvswitch kernel module. Given a sufficiently large number of actions, while copying and reserving memory for a new action of a new flow, the reserve_sfa_size() function does not return -EMSGSIZE as expected, potentially leading to an out-of-bounds write access. This flaw allows a local user to crash or potentially escalate their privileges on the system. Moderate CVE-2022-2639 SUSE bug 1202154 cpe:/o:opensuse:leap-micro:5.2 openSUSE Leap Micro 5.2 An issue was found in the Linux kernel in nf_conntrack_irc where the message handling can be confused and incorrectly matches the message. A firewall may be able to be bypassed when users are using unencrypted IRC with nf_conntrack_irc configured. Moderate CVE-2022-2663 SUSE bug 1202097 SUSE bug 1212299 cpe:/o:opensuse:leap-micro:5.2 openSUSE Leap Micro 5.2 The golang.org/x/crypto/ssh package before 0.0.0-20220314234659-1baeb1ce4c0b for Go allows an attacker to crash a server in certain circumstances involving AddHostKey. Important CVE-2022-27191 SUSE bug 1197284 cpe:/o:opensuse:leap-micro:5.2 openSUSE Leap Micro 5.2 FreeType commit 1e2eb65048f75c64b68708efed6ce904c31f3b2f was discovered to contain a heap buffer overflow via the function sfnt_init_face. Moderate CVE-2022-27404 SUSE bug 1198830 cpe:/o:opensuse:leap-micro:5.2 openSUSE Leap Micro 5.2 FreeType commit 53dfdcd8198d2b3201a23c4bad9190519ba918db was discovered to contain a segmentation violation via the function FNT_Size_Request. Moderate CVE-2022-27405 SUSE bug 1198832 cpe:/o:opensuse:leap-micro:5.2 openSUSE Leap Micro 5.2 FreeType commit 22a0cccb4d9d002f33c1ba7a4b36812c7d4f46b5 was discovered to contain a segmentation violation via the function FT_Request_Size. Moderate CVE-2022-27406 SUSE bug 1198823 cpe:/o:opensuse:leap-micro:5.2 openSUSE Leap Micro 5.2 A flaw was found in Podman, where containers were started incorrectly with non-empty default permissions. A vulnerability was found in Moby (Docker Engine), where containers were started incorrectly with non-empty inheritable Linux process capabilities. This flaw allows an attacker with access to programs with inheritable file capabilities to elevate those capabilities to the permitted set when execve(2) runs. Moderate CVE-2022-27649 SUSE bug 1197909 cpe:/o:opensuse:leap-micro:5.2 openSUSE Leap Micro 5.2 Out-of-bounds Read in GitHub repository vim/vim prior to 9.0.0212. Low CVE-2022-2816 SUSE bug 1202421 SUSE bug 1203576 cpe:/o:opensuse:leap-micro:5.2 openSUSE Leap Micro 5.2 Use After Free in GitHub repository vim/vim prior to 9.0.0213. Moderate CVE-2022-2817 SUSE bug 1202420 cpe:/o:opensuse:leap-micro:5.2 openSUSE Leap Micro 5.2 Heap-based Buffer Overflow in GitHub repository vim/vim prior to 9.0.0211. Moderate CVE-2022-2819 SUSE bug 1202414 SUSE bug 1203576 cpe:/o:opensuse:leap-micro:5.2 openSUSE Leap Micro 5.2 Improper Validation of Specified Quantity in Input in GitHub repository vim/vim prior to 9.0.0218. Low CVE-2022-2845 SUSE bug 1202515 cpe:/o:opensuse:leap-micro:5.2 openSUSE Leap Micro 5.2 Heap-based Buffer Overflow in GitHub repository vim/vim prior to 9.0.0220. Low CVE-2022-2849 SUSE bug 1202512 cpe:/o:opensuse:leap-micro:5.2 openSUSE Leap Micro 5.2 Use After Free in GitHub repository vim/vim prior to 9.0.0221. Moderate CVE-2022-2862 SUSE bug 1202511 cpe:/o:opensuse:leap-micro:5.2 openSUSE Leap Micro 5.2 libtiff's tiffcrop utility has a uint32_t underflow that can lead to out of bounds read and write. An attacker who supplies a crafted file to tiffcrop (likely via tricking a user to run tiffcrop on it with certain parameters) could cause a crash or in some cases, further exploitation. Low CVE-2022-2867 SUSE bug 1202466 cpe:/o:opensuse:leap-micro:5.2 openSUSE Leap Micro 5.2 libtiff's tiffcrop utility has a improper input validation flaw that can lead to out of bounds read and ultimately cause a crash if an attacker is able to supply a crafted file to tiffcrop. Low CVE-2022-2868 SUSE bug 1202467 cpe:/o:opensuse:leap-micro:5.2 openSUSE Leap Micro 5.2 libtiff's tiffcrop tool has a uint32_t underflow which leads to out of bounds read and write in the extractContigSamples8bits routine. An attacker who supplies a crafted file to tiffcrop could trigger this flaw, most likely by tricking a user into opening the crafted file with tiffcrop. Triggering this flaw could cause a crash or potentially further exploitation. Low CVE-2022-2869 SUSE bug 1202468 cpe:/o:opensuse:leap-micro:5.2 openSUSE Leap Micro 5.2 ** RESERVED ** This candidate has been reserved by an organization or individual that will use it when announcing a new security problem. When the candidate has been publicized, the details for this candidate will be provided. Moderate CVE-2022-28693 SUSE bug 1201455 cpe:/o:opensuse:leap-micro:5.2 openSUSE Leap Micro 5.2 There's a possible overflow in handle_image() when shim tries to load and execute crafted EFI executables; The handle_image() function takes into account the SizeOfRawData field from each section to be loaded. An attacker can leverage this to perform out-of-bound writes into memory. Arbitrary code execution is not discarded in such scenario. Important CVE-2022-28737 SUSE bug 1198458 SUSE bug 1205065 SUSE bug 1205066 SUSE bug 1205831 cpe:/o:opensuse:leap-micro:5.2 openSUSE Leap Micro 5.2 NULL Pointer Dereference in GitHub repository vim/vim prior to 9.0.0224. Low CVE-2022-2874 SUSE bug 1202552 cpe:/o:opensuse:leap-micro:5.2 openSUSE Leap Micro 5.2 ** REJECT ** DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: CVE-2022-2964. Reason: This candidate is a reservation duplicate of CVE-2022-2964. Notes: All CVE users should reference CVE-2022-2964 instead of this candidate. All references and descriptions in this candidate have been removed to prevent accidental usage. Low CVE-2022-28748 SUSE bug 1196018 cpe:/o:opensuse:leap-micro:5.2 openSUSE Leap Micro 5.2 Use After Free in GitHub repository vim/vim prior to 9.0.0225. Moderate CVE-2022-2889 SUSE bug 1202599 cpe:/o:opensuse:leap-micro:5.2 openSUSE Leap Micro 5.2 An out-of-bounds memory read flaw was found in the Linux kernel's BPF subsystem in how a user calls the bpf_tail_call function with a key larger than the max_entries of the map. This flaw allows a local user to gain unauthorized access to data. Moderate CVE-2022-2905 SUSE bug 1202860 cpe:/o:opensuse:leap-micro:5.2 openSUSE Leap Micro 5.2 An issue was discovered in rsync before 3.2.5 that allows malicious remote servers to write arbitrary files inside the directories of connecting peers. The server chooses which files/directories are sent to the client. However, the rsync client performs insufficient validation of file names. A malicious rsync server (or Man-in-The-Middle attacker) can overwrite arbitrary files in the rsync client target directory and subdirectories (for example, overwrite the .ssh/authorized_keys file). Important CVE-2022-29154 SUSE bug 1201840 SUSE bug 1202970 SUSE bug 1202998 SUSE bug 1203401 SUSE bug 1203789 SUSE bug 1204119 SUSE bug 1205072 cpe:/o:opensuse:leap-micro:5.2 openSUSE Leap Micro 5.2 NULL Pointer Dereference in GitHub repository vim/vim prior to 9.0.0240. Low CVE-2022-2923 SUSE bug 1202687 cpe:/o:opensuse:leap-micro:5.2 openSUSE Leap Micro 5.2 ncurses 6.3 before patch 20220416 has an out-of-bounds read and segmentation violation in convert_strings in tinfo/read_entry.c in the terminfo library. Moderate CVE-2022-29458 SUSE bug 1198627 cpe:/o:opensuse:leap-micro:5.2 openSUSE Leap Micro 5.2 Use After Free in GitHub repository vim/vim prior to 9.0.0246. Moderate CVE-2022-2946 SUSE bug 1202689 cpe:/o:opensuse:leap-micro:5.2 openSUSE Leap Micro 5.2 Improper Update of Reference Count vulnerability in net/sched of Linux Kernel allows local attacker to cause privilege escalation to root. This issue affects: Linux Kernel versions prior to 5.18; version 4.14 and later versions. Important CVE-2022-29581 SUSE bug 1199665 SUSE bug 1199695 SUSE bug 1205313 cpe:/o:opensuse:leap-micro:5.2 openSUSE Leap Micro 5.2 A flaw was found in the Linux kernel’s driver for the ASIX AX88179_178A-based USB 2.0/3.0 Gigabit Ethernet Devices. The vulnerability contains multiple out-of-bounds reads and possible out-of-bounds writes. Important CVE-2022-2964 SUSE bug 1202686 SUSE bug 1203008 SUSE bug 1208044 cpe:/o:opensuse:leap-micro:5.2 openSUSE Leap Micro 5.2 A flaw was found in the Linux kernel implementation of proxied virtualized TPM devices. On a system where virtualized TPM devices are configured (this is not the default) a local attacker can create a use-after-free and create a situation where it may be possible to escalate privileges on the system. Moderate CVE-2022-2977 SUSE bug 1202672 cpe:/o:opensuse:leap-micro:5.2 openSUSE Leap Micro 5.2 A flaw use after free in the Linux kernel NILFS file system was found in the way user triggers function security_inode_alloc to fail with following call to function nilfs_mdt_destroy. A local user could use this flaw to crash the system or potentially escalate their privileges on the system. Moderate CVE-2022-2978 SUSE bug 1202700 SUSE bug 1204745 cpe:/o:opensuse:leap-micro:5.2 openSUSE Leap Micro 5.2 NULL Pointer Dereference in GitHub repository vim/vim prior to 9.0.0259. Low CVE-2022-2980 SUSE bug 1203155 cpe:/o:opensuse:leap-micro:5.2 openSUSE Leap Micro 5.2 Use After Free in GitHub repository vim/vim prior to 9.0.0260. Moderate CVE-2022-2982 SUSE bug 1203152 cpe:/o:opensuse:leap-micro:5.2 openSUSE Leap Micro 5.2 In libxml2 before 2.9.14, several buffer handling functions in buf.c (xmlBuf*) and tree.c (xmlBuffer*) don't check for integer overflows. This can result in out-of-bounds memory writes. Exploitation requires a victim to open a crafted, multi-gigabyte XML file. Other software using libxml2's buffer functions, for example libxslt through 1.1.35, is affected as well. Important CVE-2022-29824 SUSE bug 1199132 SUSE bug 1202878 SUSE bug 1204121 SUSE bug 1204131 SUSE bug 1205069 cpe:/o:opensuse:leap-micro:5.2 openSUSE Leap Micro 5.2 cifs-utils through 6.14, with verbose logging, can cause an information leak when a file contains = (equal sign) characters but is not a valid credentials file. Moderate CVE-2022-29869 SUSE bug 1198976 cpe:/o:opensuse:leap-micro:5.2 openSUSE Leap Micro 5.2 An incorrect handling of the supplementary groups in the Podman container engine might lead to the sensitive information disclosure or possible data modification if an attacker has direct access to the affected container where supplementary groups are used to set access permissions and is able to execute a binary code in that container. Moderate CVE-2022-2989 SUSE bug 1202809 cpe:/o:opensuse:leap-micro:5.2 openSUSE Leap Micro 5.2 An incorrect handling of the supplementary groups in the Buildah container engine might lead to the sensitive information disclosure or possible data modification if an attacker has direct access to the affected container where supplementary groups are used to set access permissions and is able to execute a binary code in that container. Moderate CVE-2022-2990 SUSE bug 1202812 cpe:/o:opensuse:leap-micro:5.2 openSUSE Leap Micro 5.2 Mis-trained branch predictions for return instructions may allow arbitrary speculative code execution under certain microarchitecture-dependent conditions. Moderate CVE-2022-29900 SUSE bug 1199657 SUSE bug 1201469 SUSE bug 1207894 cpe:/o:opensuse:leap-micro:5.2 openSUSE Leap Micro 5.2 Intel microprocessor generations 6 to 8 are affected by a new Spectre variant that is able to bypass their retpoline mitigation in the kernel to leak arbitrary data. An attacker with unprivileged user access can hijack return instructions to achieve arbitrary speculative code execution under certain microarchitecture-dependent conditions. Moderate CVE-2022-29901 SUSE bug 1201469 SUSE bug 1207894 cpe:/o:opensuse:leap-micro:5.2 openSUSE Leap Micro 5.2 Use After Free in GitHub repository vim/vim prior to 9.0.0286. Low CVE-2022-3016 SUSE bug 1202862 cpe:/o:opensuse:leap-micro:5.2 openSUSE Leap Micro 5.2 A race condition was found in the Linux kernel's IP framework for transforming packets (XFRM subsystem) when multiple calls to xfrm_probe_algs occurred simultaneously. This flaw could allow a local attacker to potentially trigger an out-of-bounds write or leak kernel heap memory by performing an out-of-bounds read and copying it into a socket. Moderate CVE-2022-3028 SUSE bug 1202898 SUSE bug 1212296 cpe:/o:opensuse:leap-micro:5.2 openSUSE Leap Micro 5.2 Use After Free in GitHub repository vim/vim prior to 9.0.0322. Low CVE-2022-3037 SUSE bug 1202962 cpe:/o:opensuse:leap-micro:5.2 openSUSE Leap Micro 5.2 The Linux kernel before 5.17.2 mishandles seccomp permissions. The PTRACE_SEIZE code path allows attackers to bypass intended restrictions on setting the PT_SUSPEND_SECCOMP flag. Important CVE-2022-30594 SUSE bug 1199505 SUSE bug 1199602 SUSE bug 1201549 SUSE bug 1204132 cpe:/o:opensuse:leap-micro:5.2 openSUSE Leap Micro 5.2 Use After Free in GitHub repository vim/vim prior to 9.0.0360. Moderate CVE-2022-3099 SUSE bug 1203110 cpe:/o:opensuse:leap-micro:5.2 openSUSE Leap Micro 5.2 An issue was discovered in the Linux kernel through 5.16-rc6. uapi_finalize in drivers/infiniband/core/uverbs_uapi.c lacks check of kmalloc_array(). Moderate CVE-2022-3105 SUSE bug 1206398 cpe:/o:opensuse:leap-micro:5.2 openSUSE Leap Micro 5.2 An issue was discovered in the Linux kernel through 5.16-rc6. ef100_update_stats in drivers/net/ethernet/sfc/ef100_nic.c lacks check of the return value of kmalloc(). Moderate CVE-2022-3106 SUSE bug 1206397 cpe:/o:opensuse:leap-micro:5.2 openSUSE Leap Micro 5.2 An issue was discovered in the Linux kernel through 5.16-rc6. netvsc_get_ethtool_stats in drivers/net/hyperv/netvsc_drv.c lacks check of the return value of kvmalloc_array() and will cause the null pointer dereference. Moderate CVE-2022-3107 SUSE bug 1206395 cpe:/o:opensuse:leap-micro:5.2 openSUSE Leap Micro 5.2 An issue was discovered in the Linux kernel through 5.16-rc6. kfd_parse_subtype_iolink in drivers/gpu/drm/amd/amdkfd/kfd_crat.c lacks check of the return value of kmemdup(). Moderate CVE-2022-3108 SUSE bug 1206389 cpe:/o:opensuse:leap-micro:5.2 openSUSE Leap Micro 5.2 An issue was discovered in the Linux kernel through 5.16-rc6. free_charger_irq() in drivers/power/supply/wm8350_power.c lacks free of WM8350_IRQ_CHG_FAST_RDY, which is registered in wm8350_init_charger(). Moderate CVE-2022-3111 SUSE bug 1206394 cpe:/o:opensuse:leap-micro:5.2 openSUSE Leap Micro 5.2 An issue was discovered in the Linux kernel through 5.16-rc6. amvdec_set_canvases in drivers/staging/media/meson/vdec/vdec_helpers.c lacks check of the return value of kzalloc() and will cause the null pointer dereference. Moderate CVE-2022-3112 SUSE bug 1206399 cpe:/o:opensuse:leap-micro:5.2 openSUSE Leap Micro 5.2 An issue was discovered in the Linux kernel through 5.16-rc6. malidp_crtc_reset in drivers/gpu/drm/arm/malidp_crtc.c lacks check of the return value of kzalloc() and will cause the null pointer dereference. Moderate CVE-2022-3115 SUSE bug 1206393 cpe:/o:opensuse:leap-micro:5.2 openSUSE Leap Micro 5.2 A Incorrect Authorization vulnerability in chkstat of SUSE Linux Enterprise Server 12-SP5; openSUSE Leap 15.3, openSUSE Leap 15.4, openSUSE Leap Micro 5.2 did not consider group writable path components, allowing local attackers with access to a group what can write to a location included in the path to a privileged binary to influence path resolution. This issue affects: SUSE Linux Enterprise Server 12-SP5 permissions versions prior to 20170707. openSUSE Leap 15.3 permissions versions prior to 20200127. openSUSE Leap 15.4 permissions versions prior to 20201225. openSUSE Leap Micro 5.2 permissions versions prior to 20181225. Moderate CVE-2022-31252 SUSE bug 1203018 cpe:/o:opensuse:leap-micro:5.2 openSUSE Leap Micro 5.2 Use After Free in GitHub repository vim/vim prior to 9.0.0389. Low CVE-2022-3134 SUSE bug 1203194 cpe:/o:opensuse:leap-micro:5.2 openSUSE Leap Micro 5.2 NULL Pointer Dereference in GitHub repository vim/vim prior to 9.0.0404. Moderate CVE-2022-3153 SUSE bug 1203272 cpe:/o:opensuse:leap-micro:5.2 openSUSE Leap Micro 5.2 VMware Tools (12.0.0, 11.x.y and 10.x.y) contains a local privilege escalation vulnerability. A malicious actor with local non-administrative access to the Guest OS can escalate privileges as a root user in the virtual machine. Important CVE-2022-31676 SUSE bug 1202657 SUSE bug 1202733 SUSE bug 1202834 SUSE bug 1202995 SUSE bug 1204044 SUSE bug 1205471 cpe:/o:opensuse:leap-micro:5.2 openSUSE Leap Micro 5.2 A flaw was found in the Linux kernel. A denial of service flaw may occur if there is a consecutive request of the NVME_IOCTL_RESET and the NVME_IOCTL_SUBSYS_RESET through the device file of the driver, resulting in a PCIe link disconnect. Moderate CVE-2022-3169 SUSE bug 1203290 cpe:/o:opensuse:leap-micro:5.2 openSUSE Leap Micro 5.2 A parsing issue with binary data in protobuf-java core and lite versions prior to 3.21.7, 3.20.3, 3.19.6 and 3.16.3 can lead to a denial of service attack. Inputs containing multiple instances of non-repeated embedded messages with repeated or unknown fields causes objects to be converted back-n-forth between mutable and immutable forms, resulting in potentially long garbage collection pauses. We recommend updating to the versions mentioned above. Important CVE-2022-3171 SUSE bug 1204256 SUSE bug 1206544 SUSE bug 1206545 cpe:/o:opensuse:leap-micro:5.2 openSUSE Leap Micro 5.2 A crafted CMS message could have been processed incorrectly, leading to an invalid memory read, and potentially further memory corruption. This vulnerability affects Thunderbird < 91.10, Firefox < 101, and Firefox ESR < 91.10. Important CVE-2022-31741 cpe:/o:opensuse:leap-micro:5.2 openSUSE Leap Micro 5.2 There exists a use-after-free in io_uring in the Linux kernel. Signalfd_poll() and binder_poll() use a waitqueue whose lifetime is the current task. It will send a POLLFREE notification to all waiters before the queue is freed. Unfortunately, the io_uring poll doesn't handle POLLFREE. This allows a use-after-free to occur if a signalfd or binder fd is polled with io_uring poll, and the waitqueue gets freed. We recommend upgrading past commit fc78b2fc21f10c4c9c4d5d659a685710ffa63659 Important CVE-2022-3176 SUSE bug 1203391 SUSE bug 1203511 cpe:/o:opensuse:leap-micro:5.2 openSUSE Leap Micro 5.2 curl < 7.84.0 supports "chained" HTTP compression algorithms, meaning that a serverresponse can be compressed multiple times and potentially with different algorithms. The number of acceptable "links" in this "decompression chain" was unbounded, allowing a malicious server to insert a virtually unlimited number of compression steps.The use of such a decompression chain could result in a "malloc bomb", makingcurl end up spending enormous amounts of allocated heap memory, or trying toand returning out of memory errors. Moderate CVE-2022-32206 SUSE bug 1200735 SUSE bug 1207992 cpe:/o:opensuse:leap-micro:5.2 openSUSE Leap Micro 5.2 When curl < 7.84.0 does FTP transfers secured by krb5, it handles message verification failures wrongly. This flaw makes it possible for a Man-In-The-Middle attack to go unnoticed and even allows it to inject data to the client. Moderate CVE-2022-32208 SUSE bug 1200737 cpe:/o:opensuse:leap-micro:5.2 openSUSE Leap Micro 5.2 When doing HTTP(S) transfers, libcurl might erroneously use the read callback (`CURLOPT_READFUNCTION`) to ask for data to send, even when the `CURLOPT_POSTFIELDS` option has been set, if the same handle previously was used to issue a `PUT` request which used that callback. This flaw may surprise the application and cause it to misbehave and either send off the wrong data or use memory after free or similar in the subsequent `POST` request. The problem exists in the logic for a reused handle when it is changed from a PUT to a POST. Important CVE-2022-32221 SUSE bug 1204383 SUSE bug 1205287 SUSE bug 1205834 SUSE bug 1206236 SUSE bug 1208340 SUSE bug 1211233 cpe:/o:opensuse:leap-micro:5.2 openSUSE Leap Micro 5.2 net/netfilter/nf_tables_api.c in the Linux kernel through 5.18.1 allows a local user (able to create user/net namespaces) to escalate privileges to root because an incorrect NFT_STATEFUL_EXPR check leads to a use-after-free. Important CVE-2022-32250 SUSE bug 1200015 SUSE bug 1200268 SUSE bug 1200494 SUSE bug 1202992 SUSE bug 1202993 SUSE bug 1203002 cpe:/o:opensuse:leap-micro:5.2 openSUSE Leap Micro 5.2 The Linux kernel before 5.17.9 allows TCP servers to identify clients by observing what source ports are used. This occurs because of use of Algorithm 4 ("Double-Hash Port Selection Algorithm") of RFC 6056. Moderate CVE-2022-32296 SUSE bug 1200288 cpe:/o:opensuse:leap-micro:5.2 openSUSE Leap Micro 5.2 Heap-based Buffer Overflow in GitHub repository vim/vim prior to 9.0.0483. Important CVE-2022-3234 SUSE bug 1203508 SUSE bug 1206240 SUSE bug 1208002 SUSE bug 1208308 SUSE bug 1208651 SUSE bug 1209329 cpe:/o:opensuse:leap-micro:5.2 openSUSE Leap Micro 5.2 Use After Free in GitHub repository vim/vim prior to 9.0.0490. Low CVE-2022-3235 SUSE bug 1203509 cpe:/o:opensuse:leap-micro:5.2 openSUSE Leap Micro 5.2 A flaw use after free in the Linux kernel video4linux driver was found in the way user triggers em28xx_usb_probe() for the Empia 28xx based TV cards. A local user could use this flaw to crash the system or potentially escalate their privileges on the system. Moderate CVE-2022-3239 SUSE bug 1203552 cpe:/o:opensuse:leap-micro:5.2 openSUSE Leap Micro 5.2 A flaw was found in Samba. Some SMB1 write requests were not correctly range-checked to ensure the client had sent enough data to fulfill the write, allowing server memory contents to be written into the file (or printer) instead of client-supplied data. The client cannot control the area of the server memory written to the file (or printer). Moderate CVE-2022-32742 SUSE bug 1201496 SUSE bug 1202815 cpe:/o:opensuse:leap-micro:5.2 openSUSE Leap Micro 5.2 Samba does not validate the Validated-DNS-Host-Name right for the dNSHostName attribute which could permit unprivileged users to write it. Moderate CVE-2022-32743 SUSE bug 1202803 SUSE bug 1209483 cpe:/o:opensuse:leap-micro:5.2 openSUSE Leap Micro 5.2 A flaw was found in Samba. The KDC accepts kpasswd requests encrypted with any key known to it. By encrypting forged kpasswd requests with its own key, a user can change other users' passwords, enabling full domain takeover. Important CVE-2022-32744 SUSE bug 1201493 SUSE bug 1202815 SUSE bug 1209664 cpe:/o:opensuse:leap-micro:5.2 openSUSE Leap Micro 5.2 A flaw was found in Samba. Samba AD users can cause the server to access uninitialized data with an LDAP add or modify the request, usually resulting in a segmentation fault. Moderate CVE-2022-32745 SUSE bug 1201492 cpe:/o:opensuse:leap-micro:5.2 openSUSE Leap Micro 5.2 A flaw was found in the Samba AD LDAP server. The AD DC database audit logging module can access LDAP message values freed by a preceding database module, resulting in a use-after-free issue. This issue is only possible when modifying certain privileged attributes, such as userAccountControl. Moderate CVE-2022-32746 SUSE bug 1201490 cpe:/o:opensuse:leap-micro:5.2 openSUSE Leap Micro 5.2 NULL Pointer Dereference in GitHub repository vim/vim prior to 9.0.0552. Low CVE-2022-3278 SUSE bug 1203799 cpe:/o:opensuse:leap-micro:5.2 openSUSE Leap Micro 5.2 Stack-based Buffer Overflow in GitHub repository vim/vim prior to 9.0.0577. Moderate CVE-2022-3296 SUSE bug 1203796 SUSE bug 1205395 cpe:/o:opensuse:leap-micro:5.2 openSUSE Leap Micro 5.2 Use After Free in GitHub repository vim/vim prior to 9.0.0579. Moderate CVE-2022-3297 SUSE bug 1203797 cpe:/o:opensuse:leap-micro:5.2 openSUSE Leap Micro 5.2 A race condition flaw was found in the Linux kernel sound subsystem due to improper locking. It could lead to a NULL pointer dereference while handling the SNDCTL_DSP_SYNC ioctl. A privileged local user (root or member of the audio group) could use this flaw to crash the system, resulting in a denial of service condition Moderate CVE-2022-3303 SUSE bug 1203769 SUSE bug 1212304 cpe:/o:opensuse:leap-micro:5.2 openSUSE Leap Micro 5.2 An integer overflow in the component hb-ot-shape-fallback.cc of Harfbuzz v4.3.0 allows attackers to cause a Denial of Service (DoS) via unspecified vectors. Important CVE-2022-33068 SUSE bug 1200900 cpe:/o:opensuse:leap-micro:5.2 openSUSE Leap Micro 5.2 Incorrect default permissions in some memory controller configurations for some Intel(R) Xeon(R) Processors when using Intel(R) Software Guard Extensions which may allow a privileged user to potentially enable escalation of privilege via local access. Important CVE-2022-33196 SUSE bug 1208276 SUSE bug 1209936 SUSE bug 1211490 SUSE bug 1211511 SUSE bug 1213820 cpe:/o:opensuse:leap-micro:5.2 openSUSE Leap Micro 5.2 Stack-based Buffer Overflow in GitHub repository vim/vim prior to 9.0.0598. Moderate CVE-2022-3324 SUSE bug 1203820 SUSE bug 1205395 SUSE bug 1206240 cpe:/o:opensuse:leap-micro:5.2 openSUSE Leap Micro 5.2 Use After Free in GitHub repository vim/vim prior to 9.0.0614. Moderate CVE-2022-3352 SUSE bug 1203924 cpe:/o:opensuse:leap-micro:5.2 openSUSE Leap Micro 5.2 Linux disk/nic frontends data leaks T[his CNA information record relates to multiple CVEs; the text explains which aspects/vulnerabilities correspond to which CVE.] Linux Block and Network PV device frontends don't zero memory regions before sharing them with the backend (CVE-2022-26365, CVE-2022-33740). Additionally the granularity of the grant table doesn't allow sharing less than a 4K page, leading to unrelated data residing in the same 4K page as data shared with a backend being accessible by such backend (CVE-2022-33741, CVE-2022-33742). Moderate CVE-2022-33740 SUSE bug 1200762 cpe:/o:opensuse:leap-micro:5.2 openSUSE Leap Micro 5.2 Linux disk/nic frontends data leaks T[his CNA information record relates to multiple CVEs; the text explains which aspects/vulnerabilities correspond to which CVE.] Linux Block and Network PV device frontends don't zero memory regions before sharing them with the backend (CVE-2022-26365, CVE-2022-33740). Additionally the granularity of the grant table doesn't allow sharing less than a 4K page, leading to unrelated data residing in the same 4K page as data shared with a backend being accessible by such backend (CVE-2022-33741, CVE-2022-33742). Moderate CVE-2022-33741 SUSE bug 1200762 cpe:/o:opensuse:leap-micro:5.2 openSUSE Leap Micro 5.2 Linux disk/nic frontends data leaks T[his CNA information record relates to multiple CVEs; the text explains which aspects/vulnerabilities correspond to which CVE.] Linux Block and Network PV device frontends don't zero memory regions before sharing them with the backend (CVE-2022-26365, CVE-2022-33740). Additionally the granularity of the grant table doesn't allow sharing less than a 4K page, leading to unrelated data residing in the same 4K page as data shared with a backend being accessible by such backend (CVE-2022-33741, CVE-2022-33742). Moderate CVE-2022-33742 SUSE bug 1200762 cpe:/o:opensuse:leap-micro:5.2 openSUSE Leap Micro 5.2 insufficient TLB flush for x86 PV guests in shadow mode For migration as well as to work around kernels unaware of L1TF (see XSA-273), PV guests may be run in shadow paging mode. To address XSA-401, code was moved inside a function in Xen. This code movement missed a variable changing meaning / value between old and new code positions. The now wrong use of the variable did lead to a wrong TLB flush condition, omitting flushes where such are necessary. Important CVE-2022-33745 SUSE bug 1201394 cpe:/o:opensuse:leap-micro:5.2 openSUSE Leap Micro 5.2 P2M pool freeing may take excessively long The P2M pool backing second level address translation for guests may be of significant size. Therefore its freeing may take more time than is reasonable without intermediate preemption checks. Such checking for the need to preempt was so far missing. Moderate CVE-2022-33746 SUSE bug 1203806 cpe:/o:opensuse:leap-micro:5.2 openSUSE Leap Micro 5.2 Arm: unbounded memory consumption for 2nd-level page tables Certain actions require e.g. removing pages from a guest's P2M (Physical-to-Machine) mapping. When large pages are in use to map guest pages in the 2nd-stage page tables, such a removal operation may incur a memory allocation (to replace a large mapping with individual smaller ones). These memory allocations are taken from the global memory pool. A malicious guest might be able to cause the global memory pool to be exhausted by manipulating its own P2M mappings. Low CVE-2022-33747 SUSE bug 1203804 cpe:/o:opensuse:leap-micro:5.2 openSUSE Leap Micro 5.2 lock order inversion in transitive grant copy handling As part of XSA-226 a missing cleanup call was inserted on an error handling path. While doing so, locking requirements were not paid attention to. As a result two cooperating guests granting each other transitive grants can cause locks to be acquired nested within one another, but in respectively opposite order. With suitable timing between the involved grant copy operations this may result in the locking up of a CPU. Moderate CVE-2022-33748 SUSE bug 1203807 cpe:/o:opensuse:leap-micro:5.2 openSUSE Leap Micro 5.2 drivers/block/floppy.c in the Linux kernel before 5.17.6 is vulnerable to a denial of service, because of a concurrency use-after-free flaw after deallocating raw_cmd in the raw_cmd_ioctl function. Moderate CVE-2022-33981 SUSE bug 1200692 cpe:/o:opensuse:leap-micro:5.2 openSUSE Leap Micro 5.2 A use-after-free flaw was found in the Linux kernel’s SGI GRU driver in the way the first gru_file_unlocked_ioctl function is called by the user, where a fail pass occurs in the gru_check_chiplet_assignment function. This flaw allows a local user to crash or potentially escalate their privileges on the system. Moderate CVE-2022-3424 SUSE bug 1204166 SUSE bug 1204167 SUSE bug 1208044 SUSE bug 1212309 cpe:/o:opensuse:leap-micro:5.2 openSUSE Leap Micro 5.2 The libtiff-4.0.3-35.amzn2.0.1 package for LibTIFF on Amazon Linux 2 allows attackers to cause a denial of service (application crash), a different vulnerability than CVE-2022-0562. When processing a malicious TIFF file, an invalid range may be passed as an argument to the memset() function within TIFFFetchStripThing() in tif_dirread.c. This will cause TIFFFetchStripThing() to segfault after use of an uninitialized resource. Important CVE-2022-34266 SUSE bug 1201723 SUSE bug 1208311 cpe:/o:opensuse:leap-micro:5.2 openSUSE Leap Micro 5.2 A vulnerability classified as problematic has been found in Linux Kernel. This affects the function fib_nh_match of the file net/ipv4/fib_semantics.c of the component IPv4 Handler. The manipulation leads to out-of-bounds read. It is possible to initiate the attack remotely. It is recommended to apply a patch to fix this issue. The identifier VDB-210357 was assigned to this vulnerability. Moderate CVE-2022-3435 SUSE bug 1204171 cpe:/o:opensuse:leap-micro:5.2 openSUSE Leap Micro 5.2 A heap-based buffer overflow vulnerability was found in Samba within the GSSAPI unwrap_des() and unwrap_des3() routines of Heimdal. The DES and Triple-DES decryption routines in the Heimdal GSSAPI library allow a length-limited write buffer overflow on malloc() allocated memory when presented with a maliciously small packet. This flaw allows a remote user to send specially crafted malicious data to the application, possibly resulting in a denial of service (DoS) attack. Moderate CVE-2022-3437 SUSE bug 1204254 SUSE bug 1205667 SUSE bug 1208992 cpe:/o:opensuse:leap-micro:5.2 openSUSE Leap Micro 5.2 A stack overflow was discovered in the _TIFFVGetField function of Tiffsplit v4.4.0. This vulnerability allows attackers to cause a Denial of Service (DoS) via a crafted TIFF file parsed by the "tiffsplit" or "tiffcrop" utilities. Important CVE-2022-34526 SUSE bug 1202026 SUSE bug 1205073 SUSE bug 1205505 SUSE bug 1208338 cpe:/o:opensuse:leap-micro:5.2 openSUSE Leap Micro 5.2 A vulnerability found in nss. By this security vulnerability, nss client auth crash without a user certificate in the database and this can lead us to a segmentation fault or crash. Moderate CVE-2022-3479 SUSE bug 1204272 cpe:/o:opensuse:leap-micro:5.2 openSUSE Leap Micro 5.2 GnuPG through 2.3.6, in unusual situations where an attacker possesses any secret-key information from a victim's keyring and other constraints (e.g., use of GPGME) are met, allows signature forgery via injection into the status line. Moderate CVE-2022-34903 SUSE bug 1201225 cpe:/o:opensuse:leap-micro:5.2 openSUSE Leap Micro 5.2 Heap-based Buffer Overflow in GitHub repository vim/vim prior to 9.0.0742. Low CVE-2022-3491 SUSE bug 1206028 cpe:/o:opensuse:leap-micro:5.2 openSUSE Leap Micro 5.2 An issue was discovered in the Linux kernel through 5.18.9. A type confusion bug in nft_set_elem_init (leading to a buffer overflow) could be used by a local attacker to escalate privileges, a different vulnerability than CVE-2022-32250. (The attacker can obtain root access, but must start with an unprivileged user namespace to obtain CAP_NET_ADMIN access.) This can be fixed in nft_setelem_parse_data in net/netfilter/nf_tables_api.c. Important CVE-2022-34918 SUSE bug 1201171 SUSE bug 1201177 SUSE bug 1201222 cpe:/o:opensuse:leap-micro:5.2 openSUSE Leap Micro 5.2 A vulnerability was found in the Libksba library due to an integer overflow within the CRL parser. The vulnerability can be exploited remotely for code execution on the target system by passing specially crafted data to the application, for example, a malicious S/MIME attachment. Critical CVE-2022-3515 SUSE bug 1204357 SUSE bug 1204806 SUSE bug 1205080 SUSE bug 1205592 SUSE bug 1205627 SUSE bug 1206244 cpe:/o:opensuse:leap-micro:5.2 openSUSE Leap Micro 5.2 Heap-based Buffer Overflow in GitHub repository vim/vim prior to 9.0.0765. Important CVE-2022-3520 SUSE bug 1206071 SUSE bug 1208100 SUSE bug 1208649 SUSE bug 1208651 cpe:/o:opensuse:leap-micro:5.2 openSUSE Leap Micro 5.2 A vulnerability has been found in Linux Kernel and classified as problematic. This vulnerability affects the function kcm_tx_work of the file net/kcm/kcmsock.c of the component kcm. The manipulation leads to race condition. It is recommended to apply a patch to fix this issue. VDB-211018 is the identifier assigned to this vulnerability. Moderate CVE-2022-3521 SUSE bug 1204355 cpe:/o:opensuse:leap-micro:5.2 openSUSE Leap Micro 5.2 A vulnerability was found in Linux Kernel. It has been declared as problematic. Affected by this vulnerability is the function ipv6_renew_options of the component IPv6 Handler. The manipulation leads to memory leak. The attack can be launched remotely. It is recommended to apply a patch to fix this issue. The identifier VDB-211021 was assigned to this vulnerability. Moderate CVE-2022-3524 SUSE bug 1204354 SUSE bug 1212320 cpe:/o:opensuse:leap-micro:5.2 openSUSE Leap Micro 5.2 When curl is used to retrieve and parse cookies from a HTTP(S) server, itaccepts cookies using control codes that when later are sent back to a HTTPserver might make the server return 400 responses. Effectively allowing a"sister site" to deny service to all siblings. Low CVE-2022-35252 SUSE bug 1202593 cpe:/o:opensuse:leap-micro:5.2 openSUSE Leap Micro 5.2 ** REJECT ** DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: none. Reason: This candidate was withdrawn by its CNA. Further investigation showed that it was not a security issue. Notes: none. Low CVE-2022-3535 SUSE bug 1204417 cpe:/o:opensuse:leap-micro:5.2 openSUSE Leap Micro 5.2 ** DISPUTED ** softmmu/physmem.c in QEMU through 7.0.0 can perform an uninitialized read on the translate_fail path, leading to an io_readx or io_writex crash. NOTE: a third party states that the Non-virtualization Use Case in the qemu.org reference applies here, i.e., "Bugs affecting the non-virtualization use case are not considered security bugs at this time." Moderate CVE-2022-35414 SUSE bug 1201367 cpe:/o:opensuse:leap-micro:5.2 openSUSE Leap Micro 5.2 ** REJECT ** DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: none. Reason: This candidate was withdrawn by its CNA. Further investigation showed that it was not a security issue. Notes: none. Moderate CVE-2022-3542 SUSE bug 1204402 cpe:/o:opensuse:leap-micro:5.2 openSUSE Leap Micro 5.2 A vulnerability has been found in Linux Kernel and classified as critical. Affected by this vulnerability is the function area_cache_get of the file drivers/net/ethernet/netronome/nfp/nfpcore/nfp_cppcore.c of the component IPsec. The manipulation leads to use after free. It is recommended to apply a patch to fix this issue. The identifier VDB-211045 was assigned to this vulnerability. Important CVE-2022-3545 SUSE bug 1204415 SUSE bug 1204424 SUSE bug 1209225 cpe:/o:opensuse:leap-micro:5.2 openSUSE Leap Micro 5.2 ** REJECT ** DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: none. Reason: This candidate was withdrawn by its CNA. Further investigation showed that it was not a security issue. Notes: none. Moderate CVE-2022-3554 SUSE bug 1204422 cpe:/o:opensuse:leap-micro:5.2 openSUSE Leap Micro 5.2 ** REJECT ** DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: none. Reason: This candidate was withdrawn by its CNA. Further investigation showed that it was not a security issue. Notes: none. Moderate CVE-2022-3555 SUSE bug 1204425 cpe:/o:opensuse:leap-micro:5.2 openSUSE Leap Micro 5.2 A vulnerability classified as critical was found in Linux Kernel. Affected by this vulnerability is the function l2cap_reassemble_sdu of the file net/bluetooth/l2cap_core.c of the component Bluetooth. The manipulation leads to use after free. It is recommended to apply a patch to fix this issue. The associated identifier of this vulnerability is VDB-211087. Important CVE-2022-3564 SUSE bug 1206073 SUSE bug 1206314 SUSE bug 1208030 SUSE bug 1208044 SUSE bug 1208085 cpe:/o:opensuse:leap-micro:5.2 openSUSE Leap Micro 5.2 A vulnerability, which was classified as critical, has been found in Linux Kernel. Affected by this issue is the function del_timer of the file drivers/isdn/mISDN/l1oip_core.c of the component Bluetooth. The manipulation leads to use after free. It is recommended to apply a patch to fix this issue. The identifier of this vulnerability is VDB-211088. Important CVE-2022-3565 SUSE bug 1204431 SUSE bug 1204432 SUSE bug 1208044 SUSE bug 1212323 cpe:/o:opensuse:leap-micro:5.2 openSUSE Leap Micro 5.2 A vulnerability has been found in Linux Kernel and classified as problematic. This vulnerability affects the function inet6_stream_ops/inet6_dgram_ops of the component IPv6 Handler. The manipulation leads to race condition. It is recommended to apply a patch to fix this issue. VDB-211090 is the identifier assigned to this vulnerability. Moderate CVE-2022-3567 SUSE bug 1204414 cpe:/o:opensuse:leap-micro:5.2 openSUSE Leap Micro 5.2 Multiple heap buffer overflows in tiffcrop.c utility in libtiff library Version 4.4.0 allows attacker to trigger unsafe or out of bounds memory access via crafted TIFF image file which could result into application crash, potential information disclosure or any other context-dependent impact Moderate CVE-2022-3570 SUSE bug 1205422 cpe:/o:opensuse:leap-micro:5.2 openSUSE Leap Micro 5.2 SQLite 1.0.12 through 3.39.x before 3.39.2 sometimes allows an array-bounds overflow if billions of bytes are used in a string argument to a C API. Moderate CVE-2022-35737 SUSE bug 1201783 SUSE bug 1203345 SUSE bug 1211963 cpe:/o:opensuse:leap-micro:5.2 openSUSE Leap Micro 5.2 An out-of-bounds memory write flaw was found in the Linux kernel’s Kid-friendly Wired Controller driver. This flaw allows a local user to crash or potentially escalate their privileges on the system. It is in bigben_probe of drivers/hid/hid-bigbenff.c. The reason is incorrect assumption - bigben devices all have inputs. However, malicious devices can break this assumption, leaking to out-of-bound write. Moderate CVE-2022-3577 SUSE bug 1204470 SUSE bug 1204486 cpe:/o:opensuse:leap-micro:5.2 openSUSE Leap Micro 5.2 A flaw was found in the Linux kernel’s networking code. A use-after-free was found in the way the sch_sfb enqueue function used the socket buffer (SKB) cb field after the same SKB had been enqueued (and freed) into a child qdisc. This flaw allows a local, unprivileged user to crash the system, causing a denial of service. Moderate CVE-2022-3586 SUSE bug 1204439 SUSE bug 1204576 SUSE bug 1208044 SUSE bug 1209225 SUSE bug 1212294 cpe:/o:opensuse:leap-micro:5.2 openSUSE Leap Micro 5.2 Use After Free in GitHub repository vim/vim prior to 9.0.0789. Important CVE-2022-3591 SUSE bug 1206072 SUSE bug 1208100 SUSE bug 1208649 cpe:/o:opensuse:leap-micro:5.2 openSUSE Leap Micro 5.2 A vulnerability was found in Linux Kernel. It has been declared as problematic. Affected by this vulnerability is the function intr_callback of the file drivers/net/usb/r8152.c of the component BPF. The manipulation leads to logging of excessive data. The attack can be launched remotely. It is recommended to apply a patch to fix this issue. The associated identifier of this vulnerability is VDB-211363. Moderate CVE-2022-3594 SUSE bug 1204479 cpe:/o:opensuse:leap-micro:5.2 openSUSE Leap Micro 5.2 LibTIFF 4.4.0 has an out-of-bounds write in _TIFFmemcpy in libtiff/tif_unix.c:346 when called from extractImageSection, tools/tiffcrop.c:6826, allowing attackers to cause a denial-of-service via a crafted tiff file. For users that compile libtiff from sources, the fix is available with commit 236b7191. Moderate CVE-2022-3597 SUSE bug 1204641 SUSE bug 1206220 cpe:/o:opensuse:leap-micro:5.2 openSUSE Leap Micro 5.2 LibTIFF 4.4.0 has an out-of-bounds write in extractContigSamplesShifted24bits in tools/tiffcrop.c:3604, allowing attackers to cause a denial-of-service via a crafted tiff file. For users that compile libtiff from sources, the fix is available with commit cfbb883b. Moderate CVE-2022-3598 SUSE bug 1204642 SUSE bug 1206220 cpe:/o:opensuse:leap-micro:5.2 openSUSE Leap Micro 5.2 LibTIFF 4.4.0 has an out-of-bounds read in writeSingleSection in tools/tiffcrop.c:7345, allowing attackers to cause a denial-of-service via a crafted tiff file. For users that compile libtiff from sources, the fix is available with commit e8131125. Moderate CVE-2022-3599 SUSE bug 1204643 SUSE bug 1206220 cpe:/o:opensuse:leap-micro:5.2 openSUSE Leap Micro 5.2 A vulnerability was found in Linux Kernel. It has been classified as problematic. This affects the function find_prog_by_sec_insn of the file tools/lib/bpf/libbpf.c of the component BPF. The manipulation leads to null pointer dereference. It is recommended to apply a patch to fix this issue. The identifier VDB-211749 was assigned to this vulnerability. Moderate CVE-2022-3606 SUSE bug 1204502 cpe:/o:opensuse:leap-micro:5.2 openSUSE Leap Micro 5.2 Moby is an open-source project created by Docker to enable software containerization. A bug was found in Moby (Docker Engine) where supplementary groups are not set up properly. If an attacker has direct access to a container and manipulates their supplementary group access, they may be able to use supplementary group access to bypass primary group restrictions in some cases, potentially gaining access to sensitive information or gaining the ability to execute code in that container. This bug is fixed in Moby (Docker Engine) 20.10.18. Running containers should be stopped and restarted for the permissions to be fixed. For users unable to upgrade, this problem can be worked around by not using the `"USER $USERNAME"` Dockerfile instruction. Instead by calling `ENTRYPOINT ["su", "-", "user"]` the supplementary groups will be set up properly. Moderate CVE-2022-36109 SUSE bug 1205375 cpe:/o:opensuse:leap-micro:5.2 openSUSE Leap Micro 5.2 A vulnerability was found in Linux Kernel. It has been classified as problematic. Affected is the function nilfs_bmap_lookup_at_level of the file fs/nilfs2/inode.c of the component nilfs2. The manipulation leads to null pointer dereference. It is possible to launch the attack remotely. It is recommended to apply a patch to fix this issue. The identifier of this vulnerability is VDB-211920. Moderate CVE-2022-3621 SUSE bug 1204574 SUSE bug 1212295 cpe:/o:opensuse:leap-micro:5.2 openSUSE Leap Micro 5.2 A vulnerability was found in Linux Kernel. It has been classified as critical. This affects the function devlink_param_set/devlink_param_get of the file net/core/devlink.c of the component IPsec. The manipulation leads to use after free. It is recommended to apply a patch to fix this issue. The identifier VDB-211929 was assigned to this vulnerability. Moderate CVE-2022-3625 SUSE bug 1204637 cpe:/o:opensuse:leap-micro:5.2 openSUSE Leap Micro 5.2 LibTIFF 4.4.0 has an out-of-bounds write in _TIFFmemset in libtiff/tif_unix.c:340 when called from processCropSelections, tools/tiffcrop.c:7619, allowing attackers to cause a denial-of-service via a crafted tiff file. For users that compile libtiff from sources, the fix is available with commit 236b7191. Moderate CVE-2022-3626 SUSE bug 1204644 SUSE bug 1206220 cpe:/o:opensuse:leap-micro:5.2 openSUSE Leap Micro 5.2 LibTIFF 4.4.0 has an out-of-bounds write in _TIFFmemcpy in libtiff/tif_unix.c:346 when called from extractImageSection, tools/tiffcrop.c:6860, allowing attackers to cause a denial-of-service via a crafted tiff file. For users that compile libtiff from sources, the fix is available with commit 236b7191. Moderate CVE-2022-3627 SUSE bug 1204645 SUSE bug 1206220 cpe:/o:opensuse:leap-micro:5.2 openSUSE Leap Micro 5.2 A buffer overflow flaw was found in the Linux kernel Broadcom Full MAC Wi-Fi driver. This issue occurs when a user connects to a malicious USB device. This can allow a local user to crash the system or escalate their privileges. Moderate CVE-2022-3628 SUSE bug 1204868 cpe:/o:opensuse:leap-micro:5.2 openSUSE Leap Micro 5.2 An out-of-bounds(OOB) memory access vulnerability was found in vmwgfx driver in drivers/gpu/vmxgfx/vmxgfx_kms.c in GPU component in the Linux kernel with device file '/dev/dri/renderD128 (or Dxxx)'. This flaw allows a local attacker with a user account on the system to gain privilege, causing a denial of service(DoS). Moderate CVE-2022-36280 SUSE bug 1203332 cpe:/o:opensuse:leap-micro:5.2 openSUSE Leap Micro 5.2 A vulnerability was found in Linux Kernel. It has been declared as problematic. This vulnerability affects the function vsock_connect of the file net/vmw_vsock/af_vsock.c. The manipulation leads to memory leak. It is recommended to apply a patch to fix this issue. VDB-211930 is the identifier assigned to this vulnerability. Low CVE-2022-3629 SUSE bug 1204635 cpe:/o:opensuse:leap-micro:5.2 openSUSE Leap Micro 5.2 A vulnerability, which was classified as critical, has been found in Linux Kernel. Affected by this issue is the function tst_timer of the file drivers/atm/idt77252.c of the component IPsec. The manipulation leads to use after free. It is recommended to apply a patch to fix this issue. VDB-211934 is the identifier assigned to this vulnerability. Important CVE-2022-3635 SUSE bug 1204631 SUSE bug 1204636 SUSE bug 1208044 SUSE bug 1212289 cpe:/o:opensuse:leap-micro:5.2 openSUSE Leap Micro 5.2 A vulnerability, which was classified as critical, was found in Linux Kernel. Affected is the function l2cap_conn_del of the file net/bluetooth/l2cap_core.c of the component Bluetooth. The manipulation leads to use after free. It is recommended to apply a patch to fix this issue. The identifier of this vulnerability is VDB-211944. Important CVE-2022-3640 SUSE bug 1204619 SUSE bug 1204624 SUSE bug 1209225 cpe:/o:opensuse:leap-micro:5.2 openSUSE Leap Micro 5.2 Guests can trigger NIC interface reset/abort/crash via netback It is possible for a guest to trigger a NIC interface reset/abort/crash in a Linux based network backend by sending certain kinds of packets. It appears to be an (unwritten?) assumption in the rest of the Linux network stack that packet protocol headers are all contained within the linear section of the SKB and some NICs behave badly if this is not the case. This has been reported to occur with Cisco (enic) and Broadcom NetXtrem II BCM5780 (bnx2x) though it may be an issue with other NICs/drivers as well. In case the frontend is sending requests with split headers, netback will forward those violating above mentioned assumption to the networking core, resulting in said misbehavior. Moderate CVE-2022-3643 SUSE bug 1206113 cpe:/o:opensuse:leap-micro:5.2 openSUSE Leap Micro 5.2 A vulnerability, which was classified as problematic, has been found in Linux Kernel. This issue affects the function nilfs_attach_log_writer of the file fs/nilfs2/segment.c of the component BPF. The manipulation leads to memory leak. The attack may be initiated remotely. It is recommended to apply a patch to fix this issue. The identifier VDB-211961 was assigned to this vulnerability. Low CVE-2022-3646 SUSE bug 1204646 cpe:/o:opensuse:leap-micro:5.2 openSUSE Leap Micro 5.2 A vulnerability was found in Linux Kernel. It has been classified as problematic. Affected is the function nilfs_new_inode of the file fs/nilfs2/inode.c of the component BPF. The manipulation leads to use after free. It is possible to launch the attack remotely. It is recommended to apply a patch to fix this issue. The identifier of this vulnerability is VDB-211992. Low CVE-2022-3649 SUSE bug 1204647 SUSE bug 1212318 cpe:/o:opensuse:leap-micro:5.2 openSUSE Leap Micro 5.2 A privilege escalation flaw was found in Ceph. Ceph-crash.service allows a local attacker to escalate privileges to root in the form of a crash dump, and dump privileged information. Important CVE-2022-3650 SUSE bug 1204430 cpe:/o:opensuse:leap-micro:5.2 openSUSE Leap Micro 5.2 An issue was discovered in the Linux kernel through 5.18.14. xfrm_expand_policies in net/xfrm/xfrm_policy.c can cause a refcount to be dropped twice. Moderate CVE-2022-36879 SUSE bug 1201948 SUSE bug 1212327 cpe:/o:opensuse:leap-micro:5.2 openSUSE Leap Micro 5.2 nfqnl_mangle in net/netfilter/nfnetlink_queue.c in the Linux kernel through 5.18.14 allows remote attackers to cause a denial of service (panic) because, in the case of an nf_queue verdict with a one-byte nfta_payload attribute, an skb_pull can encounter a negative skb->len. Important CVE-2022-36946 SUSE bug 1201940 SUSE bug 1201941 SUSE bug 1202312 SUSE bug 1202874 SUSE bug 1203208 SUSE bug 1204132 SUSE bug 1205313 SUSE bug 1212310 cpe:/o:opensuse:leap-micro:5.2 openSUSE Leap Micro 5.2 A vulnerability was found in vim and classified as problematic. Affected by this issue is the function qf_update_buffer of the file quickfix.c of the component autocmd Handler. The manipulation leads to use after free. The attack may be launched remotely. Upgrading to version 9.0.0805 is able to address this issue. The name of the patch is d0fab10ed2a86698937e3c3fed2f10bd9bb5e731. It is recommended to upgrade the affected component. The identifier of this vulnerability is VDB-212324. Moderate CVE-2022-3705 SUSE bug 1204779 cpe:/o:opensuse:leap-micro:5.2 openSUSE Leap Micro 5.2 A double-free memory flaw was found in the Linux kernel. The Intel GVT-g graphics driver triggers VGA card system resource overload, causing a fail in the intel_gvt_dma_map_guest_page function. This issue could allow a local user to crash the system. Moderate CVE-2022-3707 SUSE bug 1204780 cpe:/o:opensuse:leap-micro:5.2 openSUSE Leap Micro 5.2 zlib through 1.2.12 has a heap-based buffer over-read or buffer overflow in inflate in inflate.c via a large gzip header extra field. NOTE: only applications that call inflateGetHeader are affected. Some common applications bundle the affected zlib source code but may be unable to call inflateGetHeader (e.g., see the nodejs/node reference). Important CVE-2022-37434 SUSE bug 1202175 SUSE bug 1203030 SUSE bug 1205074 SUSE bug 1205289 cpe:/o:opensuse:leap-micro:5.2 openSUSE Leap Micro 5.2 The Keccak XKCP SHA-3 reference implementation before fdc6fef has an integer overflow and resultant buffer overflow that allows attackers to execute arbitrary code or eliminate expected cryptographic properties. This occurs in the sponge function interface. Important CVE-2022-37454 SUSE bug 1204577 SUSE bug 1204966 SUSE bug 1205836 cpe:/o:opensuse:leap-micro:5.2 openSUSE Leap Micro 5.2 When rendering certain unicode sequences, grub2's font code doesn't proper validate if the informed glyph's width and height is constrained within bitmap size. As consequence an attacker can craft an input which will lead to a out-of-bounds write into grub2's heap, leading to memory corruption and availability issues. Although complex, arbitrary code execution could not be discarded. Moderate CVE-2022-3775 SUSE bug 1205182 cpe:/o:opensuse:leap-micro:5.2 openSUSE Leap Micro 5.2 Windows Kerberos RC4-HMAC Elevation of Privilege Vulnerability Important CVE-2022-37966 SUSE bug 1205385 SUSE bug 1208347 SUSE bug 1208433 SUSE bug 1209664 cpe:/o:opensuse:leap-micro:5.2 openSUSE Leap Micro 5.2 Windows Kerberos Elevation of Privilege Vulnerability Important CVE-2022-37967 SUSE bug 1205386 SUSE bug 1208347 cpe:/o:opensuse:leap-micro:5.2 openSUSE Leap Micro 5.2 Netlogon RPC Elevation of Privilege Vulnerability Important CVE-2022-38023 SUSE bug 1206504 SUSE bug 1209664 SUSE bug 1213694 cpe:/o:opensuse:leap-micro:5.2 openSUSE Leap Micro 5.2 Improper isolation of shared resources in some Intel(R) Processors when using Intel(R) Software Guard Extensions may allow a privileged user to potentially enable information disclosure via local access. Moderate CVE-2022-38090 SUSE bug 1208275 cpe:/o:opensuse:leap-micro:5.2 openSUSE Leap Micro 5.2 A NULL pointer dereference vulnerability was found in vmwgfx driver in drivers/gpu/vmxgfx/vmxgfx_execbuf.c in GPU component of Linux kernel with device file '/dev/dri/renderD128 (or Dxxx)'. This flaw allows a local attacker with a user account on the system to gain privilege, causing a denial of service(DoS). Moderate CVE-2022-38096 SUSE bug 1203331 cpe:/o:opensuse:leap-micro:5.2 openSUSE Leap Micro 5.2 An off-by-one Error issue was discovered in Systemd in format_timespan() function of time-util.c. An attacker could supply specific values for time and accuracy that leads to buffer overrun in format_timespan(), leading to a Denial of Service. Moderate CVE-2022-3821 SUSE bug 1204968 cpe:/o:opensuse:leap-micro:5.2 openSUSE Leap Micro 5.2 A flaw was found in Ceph, relating to the URL processing on RGW backends. An attacker can exploit the URL processing by providing a null URL to crash the RGW, causing a denial of service. Moderate CVE-2022-3854 SUSE bug 1205025 cpe:/o:opensuse:leap-micro:5.2 openSUSE Leap Micro 5.2 An incorrect read request flaw was found in the Infrared Transceiver USB driver in the Linux kernel. This issue occurs when a user attaches a malicious USB device. A local user could use this flaw to starve the resources, causing denial of service or potentially crashing the system. Moderate CVE-2022-3903 SUSE bug 1205220 SUSE bug 1212297 cpe:/o:opensuse:leap-micro:5.2 openSUSE Leap Micro 5.2 An issue was discovered in include/asm-generic/tlb.h in the Linux kernel before 5.19. Because of a race condition (unmap_mapping_range versus munmap), a device driver can free a page while it still has stale TLB entries. This only occurs in situations with VM_PFNMAP VMAs. Moderate CVE-2022-39188 SUSE bug 1203107 SUSE bug 1203116 SUSE bug 1205313 SUSE bug 1209225 SUSE bug 1212326 cpe:/o:opensuse:leap-micro:5.2 openSUSE Leap Micro 5.2 An issue was discovered the x86 KVM subsystem in the Linux kernel before 5.18.17. Unprivileged guest users can compromise the guest kernel because TLB flush operations are mishandled in certain KVM_VCPU_PREEMPTED situations. Moderate CVE-2022-39189 SUSE bug 1203066 SUSE bug 1203067 SUSE bug 1209225 cpe:/o:opensuse:leap-micro:5.2 openSUSE Leap Micro 5.2 An issue was discovered in net/netfilter/nf_tables_api.c in the Linux kernel before 5.19.6. A denial of service can occur upon binding to an already bound chain. Moderate CVE-2022-39190 SUSE bug 1203117 cpe:/o:opensuse:leap-micro:5.2 openSUSE Leap Micro 5.2 A vulnerability was found in LibTIFF. It has been classified as critical. This affects the function TIFFReadRGBATileExt of the file libtiff/tif_getimage.c. The manipulation leads to integer overflow. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used. The name of the patch is 227500897dfb07fb7d27f7aa570050e62617e3be. It is recommended to apply a patch to fix this issue. The identifier VDB-213549 was assigned to this vulnerability. Important CVE-2022-3970 SUSE bug 1205392 SUSE bug 1208311 SUSE bug 1208312 SUSE bug 1208338 SUSE bug 1208655 SUSE bug 1209328 cpe:/o:opensuse:leap-micro:5.2 openSUSE Leap Micro 5.2 An issue was discovered in libxml2 before 2.10.3. When parsing a multi-gigabyte XML document with the XML_PARSE_HUGE parser option enabled, several integer counters can overflow. This results in an attempt to access an array at a negative 2GB offset, typically leading to a segmentation fault. Important CVE-2022-40303 SUSE bug 1204366 SUSE bug 1204807 SUSE bug 1205549 SUSE bug 1206241 SUSE bug 1206248 cpe:/o:opensuse:leap-micro:5.2 openSUSE Leap Micro 5.2 An issue was discovered in libxml2 before 2.10.3. Certain invalid XML entity definitions can corrupt a hash table key, potentially leading to subsequent logic errors. In one case, a double-free can be provoked. Important CVE-2022-40304 SUSE bug 1204367 SUSE bug 1205069 SUSE bug 1205549 SUSE bug 1206241 SUSE bug 1206248 SUSE bug 1208343 cpe:/o:opensuse:leap-micro:5.2 openSUSE Leap Micro 5.2 libexpat before 2.4.9 has a use-after-free in the doContent function in xmlparse.c. Important CVE-2022-40674 SUSE bug 1203438 SUSE bug 1204099 SUSE bug 1204177 SUSE bug 1204509 SUSE bug 1205077 SUSE bug 1205285 SUSE bug 1205527 SUSE bug 1205598 SUSE bug 1208339 SUSE bug 1208753 cpe:/o:opensuse:leap-micro:5.2 openSUSE Leap Micro 5.2 drivers/scsi/stex.c in the Linux kernel through 5.19.9 allows local users to obtain sensitive information from kernel memory because stex_queuecommand_lck lacks a memset for the PASSTHRU_CMD case. Moderate CVE-2022-40768 SUSE bug 1203514 cpe:/o:opensuse:leap-micro:5.2 openSUSE Leap Micro 5.2 Python Packaging Authority (PyPA) setuptools before 65.5.1 allows remote attackers to cause a denial of service via HTML in a crafted package or custom PackageIndex page. There is a Regular Expression Denial of Service (ReDoS) in package_index.py. Moderate CVE-2022-40897 SUSE bug 1206667 cpe:/o:opensuse:leap-micro:5.2 openSUSE Leap Micro 5.2 An issue discovered in Python Charmers Future 0.18.2 and earlier allows remote attackers to cause a denial of service via crafted Set-Cookie header from malicious web server. Moderate CVE-2022-40899 SUSE bug 1206673 cpe:/o:opensuse:leap-micro:5.2 openSUSE Leap Micro 5.2 A use-after-free flaw was found in Linux kernel before 5.19.2. This issue occurs in cmd_hdl_filter in drivers/staging/rtl8712/rtl8712_cmd.c, allowing an attacker to launch a local denial of service attack and gain escalation of privileges. Important CVE-2022-4095 SUSE bug 1205514 SUSE bug 1205594 SUSE bug 1208030 SUSE bug 1208085 SUSE bug 1212319 cpe:/o:opensuse:leap-micro:5.2 openSUSE Leap Micro 5.2 In drivers/media/dvb-core/dmxdev.c in the Linux kernel through 5.19.10, there is a use-after-free caused by refcount races, affecting dvb_demux_open and dvb_dmxdev_release. Important CVE-2022-41218 SUSE bug 1202960 SUSE bug 1203606 SUSE bug 1205313 SUSE bug 1209225 cpe:/o:opensuse:leap-micro:5.2 openSUSE Leap Micro 5.2 mm/mremap.c in the Linux kernel before 5.13.3 has a use-after-free via a stale TLB because an rmap lock is not held during a PUD move. Moderate CVE-2022-41222 SUSE bug 1203622 SUSE bug 1203624 SUSE bug 1209225 SUSE bug 1209476 cpe:/o:opensuse:leap-micro:5.2 openSUSE Leap Micro 5.2 A flaw was found in the Linux kernel's Layer 2 Tunneling Protocol (L2TP). A missing lock when clearing sk_user_data can lead to a race condition and NULL pointer dereference. A local user could use this flaw to potentially crash the system causing a denial of service. Moderate CVE-2022-4129 SUSE bug 1205711 cpe:/o:opensuse:leap-micro:5.2 openSUSE Leap Micro 5.2 An incorrect TLB flush issue was found in the Linux kernel’s GPU i915 kernel driver, potentially leading to random memory corruption or data leaks. This flaw could allow a local user to crash the system or escalate their privileges on the system. Moderate CVE-2022-4139 SUSE bug 1205700 SUSE bug 1205815 SUSE bug 1209225 cpe:/o:opensuse:leap-micro:5.2 openSUSE Leap Micro 5.2 Heap based buffer overflow in vim/vim 9.0.0946 and below by allowing an attacker to CTRL-W gf in the expression used in the RHS of the substitute command. Important CVE-2022-4141 SUSE bug 1205797 SUSE bug 1208649 SUSE bug 1208651 cpe:/o:opensuse:leap-micro:5.2 openSUSE Leap Micro 5.2 An out-of-bounds read flaw was found in the QXL display device emulation in QEMU. The qxl_phys2virt() function does not check the size of the structure pointed to by the guest physical address, potentially reading past the end of the bar space into adjacent pages. A malicious guest user could use this flaw to crash the QEMU process on the host causing a denial of service condition. Moderate CVE-2022-4144 SUSE bug 1205808 cpe:/o:opensuse:leap-micro:5.2 openSUSE Leap Micro 5.2 An issue was discovered in the Linux kernel before 5.19.16. Attackers able to inject WLAN frames could cause a buffer overflow in the ieee80211_bss_info_update function in net/mac80211/scan.c. Important CVE-2022-41674 SUSE bug 1203770 SUSE bug 1203994 SUSE bug 1209225 cpe:/o:opensuse:leap-micro:5.2 openSUSE Leap Micro 5.2 drivers/char/pcmcia/synclink_cs.c in the Linux kernel through 5.19.12 has a race condition and resultant use-after-free if a physically proximate attacker removes a PCMCIA device while calling ioctl, aka a race condition between mgslpc_ioctl and mgslpc_detach. Moderate CVE-2022-41848 SUSE bug 1203987 SUSE bug 1211484 SUSE bug 1212317 cpe:/o:opensuse:leap-micro:5.2 openSUSE Leap Micro 5.2 drivers/video/fbdev/smscufx.c in the Linux kernel through 5.19.12 has a race condition and resultant use-after-free if a physically proximate attacker removes a USB device while calling open(), aka a race condition between ufx_ops_open and ufx_usb_disconnect. Moderate CVE-2022-41849 SUSE bug 1203992 cpe:/o:opensuse:leap-micro:5.2 openSUSE Leap Micro 5.2 roccat_report_event in drivers/hid/hid-roccat.c in the Linux kernel through 5.19.12 has a race condition and resultant use-after-free in certain situations where a report is received while copying a report->value is in progress. Low CVE-2022-41850 SUSE bug 1203960 SUSE bug 1212314 cpe:/o:opensuse:leap-micro:5.2 openSUSE Leap Micro 5.2 A flaw was found in the Linux kernel. A NULL pointer dereference may occur while a slip driver is in progress to detach in sl_tx_timeout in drivers/net/slip/slip.c. This issue could allow an attacker to crash the system or leak internal kernel information. Moderate CVE-2022-41858 SUSE bug 1205671 SUSE bug 1211484 SUSE bug 1212300 cpe:/o:opensuse:leap-micro:5.2 openSUSE Leap Micro 5.2 multipath-tools 0.7.7 through 0.9.x before 0.9.2 allows local users to obtain root access, as exploited in conjunction with CVE-2022-41974. Local users able to access /dev/shm can change symlinks in multipathd due to incorrect symlink handling, which could lead to controlled file writes outside of the /dev/shm directory. This could be used indirectly for local privilege escalation to root. Important CVE-2022-41973 SUSE bug 1202739 SUSE bug 1209929 cpe:/o:opensuse:leap-micro:5.2 openSUSE Leap Micro 5.2 multipath-tools 0.7.0 through 0.9.x before 0.9.2 allows local users to obtain root access, as exploited alone or in conjunction with CVE-2022-41973. Local users able to write to UNIX domain sockets can bypass access controls and manipulate the multipath setup. This can lead to local privilege escalation to root. This occurs because an attacker can repeat a keyword, which is mishandled because arithmetic ADD is used instead of bitwise OR. Important CVE-2022-41974 SUSE bug 1205472 cpe:/o:opensuse:leap-micro:5.2 openSUSE Leap Micro 5.2 An issue was discovered in D-Bus before 1.12.24, 1.13.x and 1.14.x before 1.14.4, and 1.15.x before 1.15.2. An authenticated attacker can cause dbus-daemon and other programs that use libdbus to crash when receiving a message with certain invalid type signatures. Low CVE-2022-42010 SUSE bug 1204111 cpe:/o:opensuse:leap-micro:5.2 openSUSE Leap Micro 5.2 An issue was discovered in D-Bus before 1.12.24, 1.13.x and 1.14.x before 1.14.4, and 1.15.x before 1.15.2. An authenticated attacker can cause dbus-daemon and other programs that use libdbus to crash when receiving a message where an array length is inconsistent with the size of the element type. Moderate CVE-2022-42011 SUSE bug 1204112 cpe:/o:opensuse:leap-micro:5.2 openSUSE Leap Micro 5.2 An issue was discovered in D-Bus before 1.12.24, 1.13.x and 1.14.x before 1.14.4, and 1.15.x before 1.15.2. An authenticated attacker can cause dbus-daemon and other programs that use libdbus to crash by sending a message with attached file descriptors in an unexpected format. Moderate CVE-2022-42012 SUSE bug 1204113 cpe:/o:opensuse:leap-micro:5.2 openSUSE Leap Micro 5.2 Xenstore: Guests can crash xenstored Due to a bug in the fix of XSA-115 a malicious guest can cause xenstored to use a wrong pointer during node creation in an error path, resulting in a crash of xenstored or a memory corruption in xenstored causing further damage. Entering the error path can be controlled by the guest e.g. by exceeding the quota value of maximum nodes per domain. Important CVE-2022-42309 SUSE bug 1204485 cpe:/o:opensuse:leap-micro:5.2 openSUSE Leap Micro 5.2 Xenstore: Guests can create orphaned Xenstore nodes By creating multiple nodes inside a transaction resulting in an error, a malicious guest can create orphaned nodes in the Xenstore data base, as the cleanup after the error will not remove all nodes already created. When the transaction is committed after this situation, nodes without a valid parent can be made permanent in the data base. Moderate CVE-2022-42310 SUSE bug 1204487 cpe:/o:opensuse:leap-micro:5.2 openSUSE Leap Micro 5.2 Xenstore: guests can let run xenstored out of memory T[his CNA information record relates to multiple CVEs; the text explains which aspects/vulnerabilities correspond to which CVE.] Malicious guests can cause xenstored to allocate vast amounts of memory, eventually resulting in a Denial of Service (DoS) of xenstored. There are multiple ways how guests can cause large memory allocations in xenstored: - - by issuing new requests to xenstored without reading the responses, causing the responses to be buffered in memory - - by causing large number of watch events to be generated via setting up multiple xenstore watches and then e.g. deleting many xenstore nodes below the watched path - - by creating as many nodes as allowed with the maximum allowed size and path length in as many transactions as possible - - by accessing many nodes inside a transaction Moderate CVE-2022-42311 SUSE bug 1204482 cpe:/o:opensuse:leap-micro:5.2 openSUSE Leap Micro 5.2 Xenstore: guests can let run xenstored out of memory T[his CNA information record relates to multiple CVEs; the text explains which aspects/vulnerabilities correspond to which CVE.] Malicious guests can cause xenstored to allocate vast amounts of memory, eventually resulting in a Denial of Service (DoS) of xenstored. There are multiple ways how guests can cause large memory allocations in xenstored: - - by issuing new requests to xenstored without reading the responses, causing the responses to be buffered in memory - - by causing large number of watch events to be generated via setting up multiple xenstore watches and then e.g. deleting many xenstore nodes below the watched path - - by creating as many nodes as allowed with the maximum allowed size and path length in as many transactions as possible - - by accessing many nodes inside a transaction Moderate CVE-2022-42312 SUSE bug 1204482 cpe:/o:opensuse:leap-micro:5.2 openSUSE Leap Micro 5.2 Xenstore: guests can let run xenstored out of memory T[his CNA information record relates to multiple CVEs; the text explains which aspects/vulnerabilities correspond to which CVE.] Malicious guests can cause xenstored to allocate vast amounts of memory, eventually resulting in a Denial of Service (DoS) of xenstored. There are multiple ways how guests can cause large memory allocations in xenstored: - - by issuing new requests to xenstored without reading the responses, causing the responses to be buffered in memory - - by causing large number of watch events to be generated via setting up multiple xenstore watches and then e.g. deleting many xenstore nodes below the watched path - - by creating as many nodes as allowed with the maximum allowed size and path length in as many transactions as possible - - by accessing many nodes inside a transaction Moderate CVE-2022-42313 SUSE bug 1204482 cpe:/o:opensuse:leap-micro:5.2 openSUSE Leap Micro 5.2 Xenstore: guests can let run xenstored out of memory T[his CNA information record relates to multiple CVEs; the text explains which aspects/vulnerabilities correspond to which CVE.] Malicious guests can cause xenstored to allocate vast amounts of memory, eventually resulting in a Denial of Service (DoS) of xenstored. There are multiple ways how guests can cause large memory allocations in xenstored: - - by issuing new requests to xenstored without reading the responses, causing the responses to be buffered in memory - - by causing large number of watch events to be generated via setting up multiple xenstore watches and then e.g. deleting many xenstore nodes below the watched path - - by creating as many nodes as allowed with the maximum allowed size and path length in as many transactions as possible - - by accessing many nodes inside a transaction Moderate CVE-2022-42314 SUSE bug 1204482 cpe:/o:opensuse:leap-micro:5.2 openSUSE Leap Micro 5.2 Xenstore: guests can let run xenstored out of memory T[his CNA information record relates to multiple CVEs; the text explains which aspects/vulnerabilities correspond to which CVE.] Malicious guests can cause xenstored to allocate vast amounts of memory, eventually resulting in a Denial of Service (DoS) of xenstored. There are multiple ways how guests can cause large memory allocations in xenstored: - - by issuing new requests to xenstored without reading the responses, causing the responses to be buffered in memory - - by causing large number of watch events to be generated via setting up multiple xenstore watches and then e.g. deleting many xenstore nodes below the watched path - - by creating as many nodes as allowed with the maximum allowed size and path length in as many transactions as possible - - by accessing many nodes inside a transaction Moderate CVE-2022-42315 SUSE bug 1204482 cpe:/o:opensuse:leap-micro:5.2 openSUSE Leap Micro 5.2 Xenstore: guests can let run xenstored out of memory T[his CNA information record relates to multiple CVEs; the text explains which aspects/vulnerabilities correspond to which CVE.] Malicious guests can cause xenstored to allocate vast amounts of memory, eventually resulting in a Denial of Service (DoS) of xenstored. There are multiple ways how guests can cause large memory allocations in xenstored: - - by issuing new requests to xenstored without reading the responses, causing the responses to be buffered in memory - - by causing large number of watch events to be generated via setting up multiple xenstore watches and then e.g. deleting many xenstore nodes below the watched path - - by creating as many nodes as allowed with the maximum allowed size and path length in as many transactions as possible - - by accessing many nodes inside a transaction Moderate CVE-2022-42316 SUSE bug 1204482 cpe:/o:opensuse:leap-micro:5.2 openSUSE Leap Micro 5.2 Xenstore: guests can let run xenstored out of memory T[his CNA information record relates to multiple CVEs; the text explains which aspects/vulnerabilities correspond to which CVE.] Malicious guests can cause xenstored to allocate vast amounts of memory, eventually resulting in a Denial of Service (DoS) of xenstored. There are multiple ways how guests can cause large memory allocations in xenstored: - - by issuing new requests to xenstored without reading the responses, causing the responses to be buffered in memory - - by causing large number of watch events to be generated via setting up multiple xenstore watches and then e.g. deleting many xenstore nodes below the watched path - - by creating as many nodes as allowed with the maximum allowed size and path length in as many transactions as possible - - by accessing many nodes inside a transaction Moderate CVE-2022-42317 SUSE bug 1204482 cpe:/o:opensuse:leap-micro:5.2 openSUSE Leap Micro 5.2 Xenstore: guests can let run xenstored out of memory T[his CNA information record relates to multiple CVEs; the text explains which aspects/vulnerabilities correspond to which CVE.] Malicious guests can cause xenstored to allocate vast amounts of memory, eventually resulting in a Denial of Service (DoS) of xenstored. There are multiple ways how guests can cause large memory allocations in xenstored: - - by issuing new requests to xenstored without reading the responses, causing the responses to be buffered in memory - - by causing large number of watch events to be generated via setting up multiple xenstore watches and then e.g. deleting many xenstore nodes below the watched path - - by creating as many nodes as allowed with the maximum allowed size and path length in as many transactions as possible - - by accessing many nodes inside a transaction Moderate CVE-2022-42318 SUSE bug 1204482 cpe:/o:opensuse:leap-micro:5.2 openSUSE Leap Micro 5.2 Xenstore: Guests can cause Xenstore to not free temporary memory When working on a request of a guest, xenstored might need to allocate quite large amounts of memory temporarily. This memory is freed only after the request has been finished completely. A request is regarded to be finished only after the guest has read the response message of the request from the ring page. Thus a guest not reading the response can cause xenstored to not free the temporary memory. This can result in memory shortages causing Denial of Service (DoS) of xenstored. Moderate CVE-2022-42319 SUSE bug 1204488 cpe:/o:opensuse:leap-micro:5.2 openSUSE Leap Micro 5.2 Xenstore: Guests can get access to Xenstore nodes of deleted domains Access rights of Xenstore nodes are per domid. When a domain is gone, there might be Xenstore nodes left with access rights containing the domid of the removed domain. This is normally no problem, as those access right entries will be corrected when such a node is written later. There is a small time window when a new domain is created, where the access rights of a past domain with the same domid as the new one will be regarded to be still valid, leading to the new domain being able to get access to a node which was meant to be accessible by the removed domain. For this to happen another domain needs to write the node before the newly created domain is being introduced to Xenstore by dom0. Important CVE-2022-42320 SUSE bug 1204489 cpe:/o:opensuse:leap-micro:5.2 openSUSE Leap Micro 5.2 Xenstore: Guests can crash xenstored via exhausting the stack Xenstored is using recursion for some Xenstore operations (e.g. for deleting a sub-tree of Xenstore nodes). With sufficiently deep nesting levels this can result in stack exhaustion on xenstored, leading to a crash of xenstored. Moderate CVE-2022-42321 SUSE bug 1204490 cpe:/o:opensuse:leap-micro:5.2 openSUSE Leap Micro 5.2 Xenstore: Cooperating guests can create arbitrary numbers of nodes T[his CNA information record relates to multiple CVEs; the text explains which aspects/vulnerabilities correspond to which CVE.] Since the fix of XSA-322 any Xenstore node owned by a removed domain will be modified to be owned by Dom0. This will allow two malicious guests working together to create an arbitrary number of Xenstore nodes. This is possible by domain A letting domain B write into domain A's local Xenstore tree. Domain B can then create many nodes and reboot. The nodes created by domain B will now be owned by Dom0. By repeating this process over and over again an arbitrary number of nodes can be created, as Dom0's number of nodes isn't limited by Xenstore quota. Moderate CVE-2022-42322 SUSE bug 1204494 cpe:/o:opensuse:leap-micro:5.2 openSUSE Leap Micro 5.2 Xenstore: Cooperating guests can create arbitrary numbers of nodes T[his CNA information record relates to multiple CVEs; the text explains which aspects/vulnerabilities correspond to which CVE.] Since the fix of XSA-322 any Xenstore node owned by a removed domain will be modified to be owned by Dom0. This will allow two malicious guests working together to create an arbitrary number of Xenstore nodes. This is possible by domain A letting domain B write into domain A's local Xenstore tree. Domain B can then create many nodes and reboot. The nodes created by domain B will now be owned by Dom0. By repeating this process over and over again an arbitrary number of nodes can be created, as Dom0's number of nodes isn't limited by Xenstore quota. Moderate CVE-2022-42323 SUSE bug 1204494 cpe:/o:opensuse:leap-micro:5.2 openSUSE Leap Micro 5.2 Xenstore: Guests can create arbitrary number of nodes via transactions T[his CNA information record relates to multiple CVEs; the text explains which aspects/vulnerabilities correspond to which CVE.] In case a node has been created in a transaction and it is later deleted in the same transaction, the transaction will be terminated with an error. As this error is encountered only when handling the deleted node at transaction finalization, the transaction will have been performed partially and without updating the accounting information. This will enable a malicious guest to create arbitrary number of nodes. Moderate CVE-2022-42325 SUSE bug 1204496 cpe:/o:opensuse:leap-micro:5.2 openSUSE Leap Micro 5.2 Xenstore: Guests can create arbitrary number of nodes via transactions T[his CNA information record relates to multiple CVEs; the text explains which aspects/vulnerabilities correspond to which CVE.] In case a node has been created in a transaction and it is later deleted in the same transaction, the transaction will be terminated with an error. As this error is encountered only when handling the deleted node at transaction finalization, the transaction will have been performed partially and without updating the accounting information. This will enable a malicious guest to create arbitrary number of nodes. Moderate CVE-2022-42326 SUSE bug 1204496 cpe:/o:opensuse:leap-micro:5.2 openSUSE Leap Micro 5.2 Guests can trigger deadlock in Linux netback driver T[his CNA information record relates to multiple CVEs; the text explains which aspects/vulnerabilities correspond to which CVE.] The patch for XSA-392 introduced another issue which might result in a deadlock when trying to free the SKB of a packet dropped due to the XSA-392 handling (CVE-2022-42328). Additionally when dropping packages for other reasons the same deadlock could occur in case of netpoll being active for the interface the xen-netback driver is connected to (CVE-2022-42329). Moderate CVE-2022-42328 SUSE bug 1206114 cpe:/o:opensuse:leap-micro:5.2 openSUSE Leap Micro 5.2 Guests can trigger deadlock in Linux netback driver T[his CNA information record relates to multiple CVEs; the text explains which aspects/vulnerabilities correspond to which CVE.] The patch for XSA-392 introduced another issue which might result in a deadlock when trying to free the SKB of a packet dropped due to the XSA-392 handling (CVE-2022-42328). Additionally when dropping packages for other reasons the same deadlock could occur in case of netpoll being active for the interface the xen-netback driver is connected to (CVE-2022-42329). Moderate CVE-2022-42329 SUSE bug 1206114 cpe:/o:opensuse:leap-micro:5.2 openSUSE Leap Micro 5.2 x86: speculative vulnerability in 32bit SYSCALL path Due to an oversight in the very original Spectre/Meltdown security work (XSA-254), one entrypath performs its speculation-safety actions too late. In some configurations, there is an unprotected RET instruction which can be attacked with a variety of speculative attacks. Moderate CVE-2022-42331 SUSE bug 1209019 cpe:/o:opensuse:leap-micro:5.2 openSUSE Leap Micro 5.2 x86 shadow plus log-dirty mode use-after-free In environments where host assisted address translation is necessary but Hardware Assisted Paging (HAP) is unavailable, Xen will run guests in so called shadow mode. Shadow mode maintains a pool of memory used for both shadow page tables as well as auxiliary data structures. To migrate or snapshot guests, Xen additionally runs them in so called log-dirty mode. The data structures needed by the log-dirty tracking are part of aformentioned auxiliary data. In order to keep error handling efforts within reasonable bounds, for operations which may require memory allocations shadow mode logic ensures up front that enough memory is available for the worst case requirements. Unfortunately, while page table memory is properly accounted for on the code path requiring the potential establishing of new shadows, demands by the log-dirty infrastructure were not taken into consideration. As a result, just established shadow page tables could be freed again immediately, while other code is still accessing them on the assumption that they would remain allocated. Important CVE-2022-42332 SUSE bug 1209017 cpe:/o:opensuse:leap-micro:5.2 openSUSE Leap Micro 5.2 x86/HVM pinned cache attributes mis-handling T[his CNA information record relates to multiple CVEs; the text explains which aspects/vulnerabilities correspond to which CVE.] To allow cachability control for HVM guests with passed through devices, an interface exists to explicitly override defaults which would otherwise be put in place. While not exposed to the affected guests themselves, the interface specifically exists for domains controlling such guests. This interface may therefore be used by not fully privileged entities, e.g. qemu running deprivileged in Dom0 or qemu running in a so called stub-domain. With this exposure it is an issue that - the number of the such controlled regions was unbounded (CVE-2022-42333), - installation and removal of such regions was not properly serialized (CVE-2022-42334). Moderate CVE-2022-42333 SUSE bug 1209018 cpe:/o:opensuse:leap-micro:5.2 openSUSE Leap Micro 5.2 x86/HVM pinned cache attributes mis-handling T[his CNA information record relates to multiple CVEs; the text explains which aspects/vulnerabilities correspond to which CVE.] To allow cachability control for HVM guests with passed through devices, an interface exists to explicitly override defaults which would otherwise be put in place. While not exposed to the affected guests themselves, the interface specifically exists for domains controlling such guests. This interface may therefore be used by not fully privileged entities, e.g. qemu running deprivileged in Dom0 or qemu running in a so called stub-domain. With this exposure it is an issue that - the number of the such controlled regions was unbounded (CVE-2022-42333), - installation and removal of such regions was not properly serialized (CVE-2022-42334). Moderate CVE-2022-42334 SUSE bug 1209018 cpe:/o:opensuse:leap-micro:5.2 openSUSE Leap Micro 5.2 sssd: libsss_certmap fails to sanitise certificate data used in LDAP filters Important CVE-2022-4254 SUSE bug 1207474 cpe:/o:opensuse:leap-micro:5.2 openSUSE Leap Micro 5.2 mm/rmap.c in the Linux kernel before 5.19.7 has a use-after-free related to leaf anon_vma double reuse. Important CVE-2022-42703 SUSE bug 1204168 SUSE bug 1204170 SUSE bug 1206463 SUSE bug 1208044 SUSE bug 1209225 cpe:/o:opensuse:leap-micro:5.2 openSUSE Leap Micro 5.2 A use-after-free in the mac80211 stack when parsing a multi-BSSID element in the Linux kernel 5.2 through 5.19.x before 5.19.16 could be used by attackers (able to inject WLAN frames) to crash the kernel and potentially execute code. Important CVE-2022-42719 SUSE bug 1204051 SUSE bug 1204292 SUSE bug 1209225 cpe:/o:opensuse:leap-micro:5.2 openSUSE Leap Micro 5.2 Various refcounting bugs in the multi-BSS handling in the mac80211 stack in the Linux kernel 5.1 through 5.19.x before 5.19.16 could be used by local attackers (able to inject WLAN frames) to trigger use-after-free conditions to potentially execute code. Important CVE-2022-42720 SUSE bug 1204059 SUSE bug 1204291 SUSE bug 1209225 cpe:/o:opensuse:leap-micro:5.2 openSUSE Leap Micro 5.2 A list management bug in BSS handling in the mac80211 stack in the Linux kernel 5.1 through 5.19.x before 5.19.16 could be used by local attackers (able to inject WLAN frames) to corrupt a linked list and, in turn, potentially execute code. Important CVE-2022-42721 SUSE bug 1204060 SUSE bug 1204290 SUSE bug 1209225 cpe:/o:opensuse:leap-micro:5.2 openSUSE Leap Micro 5.2 In the Linux kernel 5.8 through 5.19.x before 5.19.16, local attackers able to inject WLAN frames into the mac80211 stack could cause a NULL pointer dereference denial-of-service attack against the beacon protection of P2P devices. Important CVE-2022-42722 SUSE bug 1204125 SUSE bug 1204289 SUSE bug 1209225 cpe:/o:opensuse:leap-micro:5.2 openSUSE Leap Micro 5.2 There is an infoleak vulnerability in the Linux kernel's net/bluetooth/l2cap_core.c's l2cap_parse_conf_req function which can be used to leak kernel pointers remotely. We recommend upgrading past commit https://github.com/torvalds/linux/commit/b1a2cd50c0357f243b7435a732b4e62ba3157a2e https://www.google.com/url Moderate CVE-2022-42895 SUSE bug 1205705 cpe:/o:opensuse:leap-micro:5.2 openSUSE Leap Micro 5.2 There are use-after-free vulnerabilities in the Linux kernel's net/bluetooth/l2cap_core.c's l2cap_connect and l2cap_le_connect_req functions which may allow code execution and leaking kernel memory (respectively) remotely via Bluetooth. A remote attacker could execute code leaking kernel memory via Bluetooth if within proximity of the victim. We recommend upgrading past commit https://www.google.com/url https://github.com/torvalds/linux/commit/711f8c3fb3db61897080468586b970c87c61d9e4 https://www.google.com/url Moderate CVE-2022-42896 SUSE bug 1205709 cpe:/o:opensuse:leap-micro:5.2 openSUSE Leap Micro 5.2 PAC parsing in MIT Kerberos 5 (aka krb5) before 1.19.4 and 1.20.x before 1.20.1 has integer overflows that may lead to remote code execution (in KDC, kadmind, or a GSS or Kerberos application server) on 32-bit platforms (which have a resultant heap-based buffer overflow), and cause a denial of service on other platforms. This occurs in krb5_pac_parse in lib/krb5/krb/pac.c. Heimdal before 7.7.1 has "a similar bug." Moderate CVE-2022-42898 SUSE bug 1205126 SUSE bug 1205667 SUSE bug 1207423 SUSE bug 1207690 SUSE bug 1211487 cpe:/o:opensuse:leap-micro:5.2 openSUSE Leap Micro 5.2 Use After Free in GitHub repository vim/vim prior to 9.0.0882. Important CVE-2022-4292 SUSE bug 1206075 SUSE bug 1208100 SUSE bug 1208649 SUSE bug 1208651 cpe:/o:opensuse:leap-micro:5.2 openSUSE Leap Micro 5.2 Floating Point Comparison with Incorrect Operator in GitHub repository vim/vim prior to 9.0.0804. Moderate CVE-2022-4293 SUSE bug 1206077 SUSE bug 1211489 cpe:/o:opensuse:leap-micro:5.2 openSUSE Leap Micro 5.2 The py library through 1.11.0 for Python allows remote attackers to conduct a ReDoS (Regular expression Denial of Service) attack via a Subversion repository with crafted info data, because the InfoSvnCommand argument is mishandled. Moderate CVE-2022-42969 SUSE bug 1204364 cpe:/o:opensuse:leap-micro:5.2 openSUSE Leap Micro 5.2 A timing based side channel exists in the OpenSSL RSA Decryption implementation which could be sufficient to recover a plaintext across a network in a Bleichenbacher style attack. To achieve a successful decryption an attacker would have to be able to send a very large number of trial messages for decryption. The vulnerability affects all RSA padding modes: PKCS#1 v1.5, RSA-OEAP and RSASVE. For example, in a TLS connection, RSA is commonly used by a client to send an encrypted pre-master secret to the server. An attacker that had observed a genuine connection between a client and a server could use this flaw to send trial messages to the server and record the time taken to process them. After a sufficiently large number of messages the attacker could recover the pre-master secret used for the original connection and thus be able to decrypt the application data sent over that connection. Moderate CVE-2022-4304 SUSE bug 1207534 SUSE bug 1210067 SUSE bug 1213146 SUSE bug 1213289 SUSE bug 1215014 cpe:/o:opensuse:leap-micro:5.2 openSUSE Leap Micro 5.2 A use after free vulnerability exists in curl <7.87.0. Curl can be asked to *tunnel* virtually all protocols it supports through an HTTP proxy. HTTP proxies can (and often do) deny such tunnel operations. When getting denied to tunnel the specific protocols SMB or TELNET, curl would use a heap-allocated struct after it had been freed, in its transfer shutdown code path. Moderate CVE-2022-43552 SUSE bug 1206309 cpe:/o:opensuse:leap-micro:5.2 openSUSE Leap Micro 5.2 In libexpat through 2.4.9, there is a use-after free caused by overeager destruction of a shared DTD in XML_ExternalEntityParserCreate in out-of-memory situations. Important CVE-2022-43680 SUSE bug 1204708 SUSE bug 1205590 SUSE bug 1205598 SUSE bug 1208339 cpe:/o:opensuse:leap-micro:5.2 openSUSE Leap Micro 5.2 drivers/usb/mon/mon_bin.c in usbmon in the Linux kernel before 5.19.15 and 6.x before 6.0.1 allows a user-space client to corrupt the monitor's internal memory. Moderate CVE-2022-43750 SUSE bug 1204653 SUSE bug 1211484 cpe:/o:opensuse:leap-micro:5.2 openSUSE Leap Micro 5.2 A stack overflow flaw was found in the Linux kernel's SYSCTL subsystem in how a user changes certain kernel parameters and variables. This flaw allows a local user to crash or potentially escalate their privileges on the system. Important CVE-2022-4378 SUSE bug 1206207 SUSE bug 1206228 SUSE bug 1208030 SUSE bug 1208085 SUSE bug 1209225 SUSE bug 1211118 SUSE bug 1214268 cpe:/o:opensuse:leap-micro:5.2 openSUSE Leap Micro 5.2 The Linux kernel NFSD implementation prior to versions 5.19.17 and 6.0.2 are vulnerable to buffer overflow. NFSD tracks the number of pages held by each NFSD thread by combining the receive and send buffers of a remote procedure call (RPC) into a single array of pages. A client can force the send buffer to shrink by sending an RPC message over TCP with garbage data added at the end of the message. The RPC message with garbage data is still correctly formed according to the specification and is passed forward to handlers. Vulnerable code in NFSD is not expecting the oversized request and writes beyond the allocated buffer space. CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H Important CVE-2022-43945 SUSE bug 1205128 SUSE bug 1205130 SUSE bug 1208030 SUSE bug 1208085 SUSE bug 1209225 SUSE bug 1210124 cpe:/o:opensuse:leap-micro:5.2 openSUSE Leap Micro 5.2 Sudo 1.8.0 through 1.9.12, with the crypt() password backend, contains a plugins/sudoers/auth/passwd.c array-out-of-bounds error that can result in a heap-based buffer over-read. This can be triggered by arbitrary local users with access to Sudo by entering a password of seven characters or fewer. The impact could vary depending on the system libraries, compiler, and processor architecture. Important CVE-2022-43995 SUSE bug 1204986 SUSE bug 1205838 SUSE bug 1205969 SUSE bug 1206905 cpe:/o:opensuse:leap-micro:5.2 openSUSE Leap Micro 5.2 A vulnerability was found in systemd. This security flaw can cause a local information leak due to systemd-coredump not respecting the fs.suid_dumpable kernel setting. Moderate CVE-2022-4415 SUSE bug 1205000 cpe:/o:opensuse:leap-micro:5.2 openSUSE Leap Micro 5.2 The function PEM_read_bio_ex() reads a PEM file from a BIO and parses and decodes the "name" (e.g. "CERTIFICATE"), any header data and the payload data. If the function succeeds then the "name_out", "header" and "data" arguments are populated with pointers to buffers containing the relevant decoded data. The caller is responsible for freeing those buffers. It is possible to construct a PEM file that results in 0 bytes of payload data. In this case PEM_read_bio_ex() will return a failure code but will populate the header argument with a pointer to a buffer that has already been freed. If the caller also frees this buffer then a double free will occur. This will most likely lead to a crash. This could be exploited by an attacker who has the ability to supply malicious PEM files for parsing to achieve a denial of service attack. The functions PEM_read_bio() and PEM_read() are simple wrappers around PEM_read_bio_ex() and therefore these functions are also directly affected. These functions are also called indirectly by a number of other OpenSSL functions including PEM_X509_INFO_read_bio_ex() and SSL_CTX_use_serverinfo_file() which are also vulnerable. Some OpenSSL internal uses of these functions are not vulnerable because the caller does not free the header argument if PEM_read_bio_ex() returns a failure code. These locations include the PEM_read_bio_TYPE() functions as well as the decoders introduced in OpenSSL 3.0. The OpenSSL asn1parse command line application is also impacted by this issue. Moderate CVE-2022-4450 SUSE bug 1207538 cpe:/o:opensuse:leap-micro:5.2 openSUSE Leap Micro 5.2 In libpixman in Pixman before 0.42.2, there is an out-of-bounds write (aka heap-based buffer overflow) in rasterize_edges_8 due to an integer overflow in pixman_sample_floor_y. Important CVE-2022-44638 SUSE bug 1205033 SUSE bug 1208313 SUSE bug 1208345 SUSE bug 1211497 cpe:/o:opensuse:leap-micro:5.2 openSUSE Leap Micro 5.2 An issue was discovered in Python before 3.11.1. An unnecessary quadratic algorithm exists in one path when processing some inputs to the IDNA (RFC 3490) decoder, such that a crafted, unreasonably long name being presented to the decoder could lead to a CPU denial of service. Hostnames are often supplied by remote servers that could be controlled by a malicious actor; in such a scenario, they could trigger excessive CPU consumption on the client attempting to make use of an attacker-supplied supposed hostname. For example, the attack payload could be placed in the Location header of an HTTP response with status code 302. A fix is planned in 3.11.1, 3.10.9, 3.9.16, 3.8.16, and 3.7.16. Moderate CVE-2022-45061 SUSE bug 1205244 SUSE bug 1211488 cpe:/o:opensuse:leap-micro:5.2 openSUSE Leap Micro 5.2 An issue was discovered in the Linux kernel through 6.0.10. l2cap_config_req in net/bluetooth/l2cap_core.c has an integer wraparound via L2CAP_CONF_REQ packets. Moderate CVE-2022-45934 SUSE bug 1205796 SUSE bug 1212292 cpe:/o:opensuse:leap-micro:5.2 openSUSE Leap Micro 5.2 A flaw incorrect access control in the Linux kernel USB core subsystem was found in the way user attaches usb device. A local user could use this flaw to crash the system. Moderate CVE-2022-4662 SUSE bug 1206664 cpe:/o:opensuse:leap-micro:5.2 openSUSE Leap Micro 5.2 SQLite through 3.40.0, when relying on --safe for execution of an untrusted CLI script, does not properly implement the azProhibitedFunctions protection mechanism, and instead allows UDF functions such as WRITEFILE. Important CVE-2022-46908 SUSE bug 1206337 cpe:/o:opensuse:leap-micro:5.2 openSUSE Leap Micro 5.2 A double-free flaw was found in the Linux kernel’s TUN/TAP device driver functionality in how a user registers the device when the register_netdevice function fails (NETDEV_REGISTER notifier). This flaw allows a local user to crash or potentially escalate their privileges on the system. Important CVE-2022-4744 SUSE bug 1209635 SUSE bug 1209672 SUSE bug 1211833 cpe:/o:opensuse:leap-micro:5.2 openSUSE Leap Micro 5.2 An issue was discovered in the Linux kernel before 6.0.11. Missing offset validation in drivers/net/wireless/microchip/wilc1000/hif.c in the WILC1000 wireless driver can trigger an out-of-bounds read when parsing a Robust Security Network (RSN) information element from a Netlink packet. Important CVE-2022-47520 SUSE bug 1206515 SUSE bug 1207823 cpe:/o:opensuse:leap-micro:5.2 openSUSE Leap Micro 5.2 Libksba before 1.6.3 is prone to an integer overflow vulnerability in the CRL signature parser. Important CVE-2022-47629 SUSE bug 1206579 cpe:/o:opensuse:leap-micro:5.2 openSUSE Leap Micro 5.2 In the Linux kernel before 6.1.6, a NULL pointer dereference bug in the traffic control subsystem allows an unprivileged user to trigger a denial of service (system crash) via a crafted traffic control configuration that is set up with "tc qdisc" and "tc class" commands. This affects qdisc_graft in net/sched/sch_api.c. Moderate CVE-2022-47929 SUSE bug 1207237 cpe:/o:opensuse:leap-micro:5.2 openSUSE Leap Micro 5.2 processCropSelections in tools/tiffcrop.c in LibTIFF through 4.5.0 has a heap-based buffer overflow (e.g., "WRITE of size 307203") via a crafted TIFF image. Important CVE-2022-48281 SUSE bug 1207413 SUSE bug 1208655 SUSE bug 1209328 SUSE bug 1209937 cpe:/o:opensuse:leap-micro:5.2 openSUSE Leap Micro 5.2 GNU Tar through 1.34 has a one-byte out-of-bounds read that results in use of uninitialized memory for a conditional jump. Exploitation to change the flow of control has not been demonstrated. The issue occurs in from_header in list.c via a V7 archive in which mtime has approximately 11 whitespace characters. Moderate CVE-2022-48303 SUSE bug 1207753 cpe:/o:opensuse:leap-micro:5.2 openSUSE Leap Micro 5.2 A vulnerability was found in zstd v1.4.10, where an attacker can supply empty string as an argument to the command line tool to cause buffer overrun. Moderate CVE-2022-4899 SUSE bug 1209533 cpe:/o:opensuse:leap-micro:5.2 openSUSE Leap Micro 5.2 A flaw was found in the c-ares package. The ares_set_sortlist is missing checks about the validity of the input string, which allows a possible arbitrary length stack overflow. This issue may cause a denial of service or a limited impact on confidentiality and integrity. Moderate CVE-2022-4904 SUSE bug 1208067 cpe:/o:opensuse:leap-micro:5.2 openSUSE Leap Micro 5.2 The current implementation of the prctl syscall does not issue an IBPB immediately during the syscall. The ib_prctl_set ?function updates the Thread Information Flags (TIFs) for the task and updates the SPEC_CTRL MSR on the function __speculation_ctrl_update, but the IBPB is only issued on the next schedule, when the TIF bits are checked. This leaves the victim vulnerable to values already injected on the BTB, prior to the prctl syscall. ?The patch that added the support for the conditional mitigation via prctl (ib_prctl_set) dates back to the kernel 4.9.176. We recommend upgrading past commit?a664ec9158eeddd75121d39c9a0758016097fa96 Moderate CVE-2023-0045 SUSE bug 1207773 cpe:/o:opensuse:leap-micro:5.2 openSUSE Leap Micro 5.2 Out-of-bounds Read in GitHub repository vim/vim prior to 9.0.1143. Moderate CVE-2023-0049 SUSE bug 1206866 cpe:/o:opensuse:leap-micro:5.2 openSUSE Leap Micro 5.2 Heap-based Buffer Overflow in GitHub repository vim/vim prior to 9.0.1144. Moderate CVE-2023-0051 SUSE bug 1206867 cpe:/o:opensuse:leap-micro:5.2 openSUSE Leap Micro 5.2 Out-of-bounds Write in GitHub repository vim/vim prior to 9.0.1145. Moderate CVE-2023-0054 SUSE bug 1206868 cpe:/o:opensuse:leap-micro:5.2 openSUSE Leap Micro 5.2 A buffer overflow vulnerability was found in the Netfilter subsystem in the Linux Kernel. This issue could allow the leakage of both stack and heap addresses, and potentially allow Local Privilege Escalation to the root user via arbitrary code execution. Important CVE-2023-0179 SUSE bug 1207034 SUSE bug 1207139 SUSE bug 1215208 cpe:/o:opensuse:leap-micro:5.2 openSUSE Leap Micro 5.2 The public API function BIO_new_NDEF is a helper function used for streaming ASN.1 data via a BIO. It is primarily used internally to OpenSSL to support the SMIME, CMS and PKCS7 streaming capabilities, but may also be called directly by end user applications. The function receives a BIO from the caller, prepends a new BIO_f_asn1 filter BIO onto the front of it to form a BIO chain, and then returns the new head of the BIO chain to the caller. Under certain conditions, for example if a CMS recipient public key is invalid, the new filter BIO is freed and the function returns a NULL result indicating a failure. However, in this case, the BIO chain is not properly cleaned up and the BIO passed by the caller still retains internal pointers to the previously freed filter BIO. If the caller then goes on to call BIO_pop() on the BIO then a use-after-free will occur. This will most likely result in a crash. This scenario occurs directly in the internal function B64_write_ASN1() which may cause BIO_new_NDEF() to be called and will subsequently call BIO_pop() on the BIO. This internal function is in turn called by the public API functions PEM_write_bio_ASN1_stream, PEM_write_bio_CMS_stream, PEM_write_bio_PKCS7_stream, SMIME_write_ASN1, SMIME_write_CMS and SMIME_write_PKCS7. Other public API functions that may be impacted by this include i2d_ASN1_bio_stream, BIO_new_CMS, BIO_new_PKCS7, i2d_CMS_bio_stream and i2d_PKCS7_bio_stream. The OpenSSL cms and smime command line applications are similarly affected. Moderate CVE-2023-0215 SUSE bug 1207536 SUSE bug 1213146 cpe:/o:opensuse:leap-micro:5.2 openSUSE Leap Micro 5.2 A flaw was found in Samba. An incomplete access check on dnsHostName allows authenticated but otherwise unprivileged users to delete this attribute from any object in the directory. Moderate CVE-2023-0225 SUSE bug 1209483 cpe:/o:opensuse:leap-micro:5.2 openSUSE Leap Micro 5.2 A use after free vulnerability exists in the ALSA PCM package in the Linux Kernel.?SNDRV_CTL_IOCTL_ELEM_{READ|WRITE}32 is missing locks that can be used in a use-after-free that can result in a priviledge escalation to gain ring0 access from the system user. We recommend upgrading past commit?56b88b50565cd8b946a2d00b0c83927b7ebb055e Important CVE-2023-0266 SUSE bug 1207134 SUSE bug 1207190 SUSE bug 1214128 cpe:/o:opensuse:leap-micro:5.2 openSUSE Leap Micro 5.2 There is a type confusion vulnerability relating to X.400 address processing inside an X.509 GeneralName. X.400 addresses were parsed as an ASN1_STRING but the public structure definition for GENERAL_NAME incorrectly specified the type of the x400Address field as ASN1_TYPE. This field is subsequently interpreted by the OpenSSL function GENERAL_NAME_cmp as an ASN1_TYPE rather than an ASN1_STRING. When CRL checking is enabled (i.e. the application sets the X509_V_FLAG_CRL_CHECK flag), this vulnerability may allow an attacker to pass arbitrary pointers to a memcmp call, enabling them to read memory contents or enact a denial of service. In most cases, the attack requires the attacker to provide both the certificate chain and CRL, neither of which need to have a valid signature. If the attacker only controls one of these inputs, the other input must already contain an X.400 address as a CRL distribution point, which is uncommon. As such, this vulnerability is most likely to only affect applications which have implemented their own functionality for retrieving CRLs over a network. Important CVE-2023-0286 SUSE bug 1207533 SUSE bug 1207569 SUSE bug 1211136 SUSE bug 1211503 SUSE bug 1213146 SUSE bug 1214269 cpe:/o:opensuse:leap-micro:5.2 openSUSE Leap Micro 5.2 Heap-based Buffer Overflow in GitHub repository vim/vim prior to 9.0.1189. Moderate CVE-2023-0288 SUSE bug 1207162 cpe:/o:opensuse:leap-micro:5.2 openSUSE Leap Micro 5.2 A timing side-channel in the handling of RSA ClientKeyExchange messages was discovered in GnuTLS. This side-channel can be sufficient to recover the key encrypted in the RSA ciphertext across a network in a Bleichenbacher style attack. To achieve a successful decryption the attacker would need to send a large amount of specially crafted messages to the vulnerable server. By recovering the secret from the ClientKeyExchange message, the attacker would be able to decrypt the application data exchanged over that connection. Moderate CVE-2023-0361 SUSE bug 1208143 cpe:/o:opensuse:leap-micro:5.2 openSUSE Leap Micro 5.2 A NULL pointer dereference flaw was found in rawv6_push_pending_frames in net/ipv6/raw.c in the network subcomponent in the Linux kernel. This flaw causes the system to crash. Moderate CVE-2023-0394 SUSE bug 1207168 cpe:/o:opensuse:leap-micro:5.2 openSUSE Leap Micro 5.2 Heap-based Buffer Overflow in GitHub repository vim/vim prior to 9.0.1225. Low CVE-2023-0433 SUSE bug 1207396 cpe:/o:opensuse:leap-micro:5.2 openSUSE Leap Micro 5.2 There is a use-after-free vulnerability in the Linux Kernel which can be exploited to achieve local privilege escalation. To reach the vulnerability kernel configuration flag CONFIG_TLS?or CONFIG_XFRM_ESPINTCP?has to be configured, but the operation does not require any privilege. There is a use-after-free bug of icsk_ulp_data?of a struct inet_connection_sock. When CONFIG_TLS?is enabled, user can install a tls context (struct tls_context) on a connected tcp socket. The context is not cleared if this socket is disconnected and reused as a listener. If a new socket is created from the listener, the context is inherited and vulnerable. The setsockopt?TCP_ULP?operation does not require any privilege. We recommend upgrading past commit?2c02d41d71f90a5168391b6a5f2954112ba2307c Important CVE-2023-0461 SUSE bug 1208787 SUSE bug 1208911 SUSE bug 1211833 cpe:/o:opensuse:leap-micro:5.2 openSUSE Leap Micro 5.2 A security vulnerability has been identified in all supported versions of OpenSSL related to the verification of X.509 certificate chains that include policy constraints. Attackers may be able to exploit this vulnerability by creating a malicious certificate chain that triggers exponential use of computational resources, leading to a denial-of-service (DoS) attack on affected systems. Policy processing is disabled by default but can be enabled by passing the `-policy' argument to the command line utilities or by calling the `X509_VERIFY_PARAM_set1_policies()' function. Moderate CVE-2023-0464 SUSE bug 1209624 cpe:/o:opensuse:leap-micro:5.2 openSUSE Leap Micro 5.2 Applications that use a non-default option when verifying certificates may be vulnerable to an attack from a malicious CA to circumvent certain checks. Invalid certificate policies in leaf certificates are silently ignored by OpenSSL and other certificate policy checks are skipped for that certificate. A malicious CA could use this to deliberately assert invalid certificate policies in order to circumvent policy checking on the certificate altogether. Policy processing is disabled by default but can be enabled by passing the `-policy' argument to the command line utilities or by calling the `X509_VERIFY_PARAM_set1_policies()' function. Moderate CVE-2023-0465 SUSE bug 1209878 SUSE bug 1212331 SUSE bug 1215014 cpe:/o:opensuse:leap-micro:5.2 openSUSE Leap Micro 5.2 The function X509_VERIFY_PARAM_add0_policy() is documented to implicitly enable the certificate policy check when doing certificate verification. However the implementation of the function does not enable the check which allows certificates with invalid or incorrect policies to pass the certificate verification. As suddenly enabling the policy check could break existing deployments it was decided to keep the existing behavior of the X509_VERIFY_PARAM_add0_policy() function. Instead the applications that require OpenSSL to perform certificate policy check need to use X509_VERIFY_PARAM_set1_policies() or explicitly enable the policy check by calling X509_VERIFY_PARAM_set_flags() with the X509_V_FLAG_POLICY_CHECK flag argument. Certificate policy checks are disabled by default in OpenSSL and are not commonly used by applications. Low CVE-2023-0466 SUSE bug 1209873 cpe:/o:opensuse:leap-micro:5.2 openSUSE Leap Micro 5.2 Divide By Zero in GitHub repository vim/vim prior to 9.0.1247. Important CVE-2023-0512 SUSE bug 1207780 SUSE bug 1210385 cpe:/o:opensuse:leap-micro:5.2 openSUSE Leap Micro 5.2 A use-after-free flaw was found in qdisc_graft in net/sched/sch_api.c in the Linux Kernel due to a race problem. This flaw leads to a denial of service issue. If patch ebda44da44f6 ("net: sched: fix race condition in qdisc_graft()") not applied yet, then kernel could be affected. Important CVE-2023-0590 SUSE bug 1207795 SUSE bug 1207822 SUSE bug 1211495 SUSE bug 1211833 cpe:/o:opensuse:leap-micro:5.2 openSUSE Leap Micro 5.2 A flaw possibility of memory leak in the Linux kernel cpu_entry_area mapping of X86 CPU data to memory was found in the way user can guess location of exception stack(s) or other important data. A local user could use this flaw to get access to some important data with expected location in memory. Moderate CVE-2023-0597 SUSE bug 1207845 SUSE bug 1212395 SUSE bug 1213271 cpe:/o:opensuse:leap-micro:5.2 openSUSE Leap Micro 5.2 The fix in 4.6.16, 4.7.9, 4.8.4 and 4.9.7 for CVE-2018-10919 Confidential attribute disclosure vi LDAP filters was insufficient and an attacker may be able to obtain confidential BitLocker recovery keys from a Samba AD DC. Moderate CVE-2023-0614 SUSE bug 1209485 cpe:/o:opensuse:leap-micro:5.2 openSUSE Leap Micro 5.2 ** DISPUTED ** A vulnerability was found in GNU C Library 2.38. It has been declared as critical. This vulnerability affects the function __monstartup of the file gmon.c of the component Call Graph Monitor. The manipulation leads to buffer overflow. It is recommended to apply a patch to fix this issue. VDB-220246 is the identifier assigned to this vulnerability. NOTE: The real existence of this vulnerability is still doubted at the moment. The inputs that induce this vulnerability are basically addresses of the running application that is built with gmon enabled. It's basically trusted input or input that needs an actual security flaw to be compromised or controlled. Low CVE-2023-0687 SUSE bug 1207975 cpe:/o:opensuse:leap-micro:5.2 openSUSE Leap Micro 5.2 An attacker could construct a PKCS 12 cert bundle in such a way that could allow for arbitrary memory writes via PKCS 12 Safe Bag attributes being mishandled. This vulnerability affects Firefox < 110, Thunderbird < 102.8, and Firefox ESR < 102.8. Important CVE-2023-0767 SUSE bug 1208138 SUSE bug 1213200 SUSE bug 1213818 SUSE bug 1214271 cpe:/o:opensuse:leap-micro:5.2 openSUSE Leap Micro 5.2 A Time-of-check Time-of-use (TOCTOU) flaw was found in podman. This issue may allow a malicious user to replace a normal file in a volume with a symlink while exporting the volume, allowing for access to arbitrary files on the host file system. Moderate CVE-2023-0778 SUSE bug 1208364 cpe:/o:opensuse:leap-micro:5.2 openSUSE Leap Micro 5.2 The Samba AD DC administration tool, when operating against a remote LDAP server, will by default send new or reset passwords over a signed-only connection. Moderate CVE-2023-0922 SUSE bug 1209481 cpe:/o:opensuse:leap-micro:5.2 openSUSE Leap Micro 5.2 An out-of-bounds write vulnerability exists in TPM2.0's Module Library allowing writing of a 2-byte data past the end of TPM2.0 command in the CryptParameterDecryption routine. An attacker who can successfully exploit this vulnerability can lead to denial of service (crashing the TPM chip/process or rendering it unusable) and/or arbitrary code execution in the TPM context. Important CVE-2023-1017 SUSE bug 1206022 cpe:/o:opensuse:leap-micro:5.2 openSUSE Leap Micro 5.2 An out-of-bounds read vulnerability exists in TPM2.0's Module Library allowing a 2-byte read past the end of a TPM2.0 command in the CryptParameterDecryption routine. An attacker who can successfully exploit this vulnerability can read or access sensitive data stored in the TPM. Low CVE-2023-1018 SUSE bug 1206023 cpe:/o:opensuse:leap-micro:5.2 openSUSE Leap Micro 5.2 A flaw was found in the Linux Kernel. The tls_is_tx_ready() incorrectly checks for list emptiness, potentially accessing a type confused entry to the list_head, leaking the last byte of the confused field that overlaps with rec->tx_ready. Low CVE-2023-1075 SUSE bug 1208598 cpe:/o:opensuse:leap-micro:5.2 openSUSE Leap Micro 5.2 A flaw was found in the Linux Kernel. The tun/tap sockets have their socket UID hardcoded to 0 due to a type confusion in their initialization function. While it will be often correct, as tuntap devices require CAP_NET_ADMIN, it may not always be the case, e.g., a non-root user only having that capability. This would make tun/tap sockets being incorrectly treated in filtering/routing decisions, possibly bypassing network filters. Moderate CVE-2023-1076 SUSE bug 1208599 SUSE bug 1214019 cpe:/o:opensuse:leap-micro:5.2 openSUSE Leap Micro 5.2 A flaw was found in the Linux Kernel in RDS (Reliable Datagram Sockets) protocol. The rds_rm_zerocopy_callback() uses list_entry() on the head of a list causing a type confusion. Local user can trigger this with rds_message_put(). Type confusion leads to `struct rds_msg_zcopy_info *info` actually points to something else that is potentially controlled by local user. It is known how to trigger this, which causes an out of bounds access, and a lock corruption. Important CVE-2023-1078 SUSE bug 1208601 SUSE bug 1208603 cpe:/o:opensuse:leap-micro:5.2 openSUSE Leap Micro 5.2 In nf_tables_updtable, if nf_tables_table_enable returns an error, nft_trans_destroy is called to free the transaction object. nft_trans_destroy() calls list_del(), but the transaction was never placed on a list -- the list head is all zeroes, this results in a NULL pointer dereference. Moderate CVE-2023-1095 SUSE bug 1208777 cpe:/o:opensuse:leap-micro:5.2 openSUSE Leap Micro 5.2 A flaw use after free in the Linux kernel integrated infrared receiver/transceiver driver was found in the way user detaching rc device. A local user could use this flaw to crash the system or potentially escalate their privileges on the system. Moderate CVE-2023-1118 SUSE bug 1208837 SUSE bug 1208910 SUSE bug 1210423 SUSE bug 1211495 SUSE bug 1213841 SUSE bug 1213842 cpe:/o:opensuse:leap-micro:5.2 openSUSE Leap Micro 5.2 Divide By Zero in GitHub repository vim/vim prior to 9.0.1367. Moderate CVE-2023-1127 SUSE bug 1208828 cpe:/o:opensuse:leap-micro:5.2 openSUSE Leap Micro 5.2 Heap-based Buffer Overflow in GitHub repository vim/vim prior to 9.0.1376. Moderate CVE-2023-1170 SUSE bug 1208959 cpe:/o:opensuse:leap-micro:5.2 openSUSE Leap Micro 5.2 Incorrect Calculation of Buffer Size in GitHub repository vim/vim prior to 9.0.1378. Moderate CVE-2023-1175 SUSE bug 1208957 cpe:/o:opensuse:leap-micro:5.2 openSUSE Leap Micro 5.2 A use-after-free flaw was found in reconn_set_ipaddr_from_hostname in fs/cifs/connect.c in the Linux kernel. The issue occurs when it forgets to set the free pointer server->hostname to NULL, leading to an invalid pointer request. Low CVE-2023-1195 SUSE bug 1208971 cpe:/o:opensuse:leap-micro:5.2 openSUSE Leap Micro 5.2 NULL Pointer Dereference in GitHub repository vim/vim prior to 9.0.1392. Moderate CVE-2023-1264 SUSE bug 1209042 cpe:/o:opensuse:leap-micro:5.2 openSUSE Leap Micro 5.2 Use After Free vulnerability in Linux kernel traffic control index filter (tcindex) allows Privilege Escalation.?The imperfect hash area can be updated while packets are traversing, which will cause a use-after-free when 'tcf_exts_exec()' is called with the destroyed tcf_ext.?A local attacker user can use this vulnerability to elevate its privileges to root. This issue affects Linux Kernel: from 4.14 before git commit ee059170b1f7e94e55fa6cadee544e176a6e59c2. Important CVE-2023-1281 SUSE bug 1209634 SUSE bug 1209683 SUSE bug 1210335 SUSE bug 1210423 SUSE bug 1211833 cpe:/o:opensuse:leap-micro:5.2 openSUSE Leap Micro 5.2 NULL Pointer Dereference in GitHub repository vim/vim prior to 9.0.1402. Moderate CVE-2023-1355 SUSE bug 1209187 cpe:/o:opensuse:leap-micro:5.2 openSUSE Leap Micro 5.2 A data race flaw was found in the Linux kernel, between where con is allocated and con->sock is set. This issue leads to a NULL pointer dereference when accessing con->sock->sk in net/tipc/topsrv.c in the tipc protocol in the Linux kernel. Moderate CVE-2023-1382 SUSE bug 1209288 cpe:/o:opensuse:leap-micro:5.2 openSUSE Leap Micro 5.2 A remote denial of service vulnerability was found in the Linux kernel’s TIPC kernel module. The while loop in tipc_link_xmit() hits an unknown state while attempting to parse SKBs, which are not in the queue. Sending two small UDP packets to a system with a UDP bearer results in the CPU utilization for the system to instantly spike to 100%, causing a denial of service condition. Important CVE-2023-1390 SUSE bug 1209289 SUSE bug 1210779 SUSE bug 1211495 cpe:/o:opensuse:leap-micro:5.2 openSUSE Leap Micro 5.2 A flaw was found in KVM. When calling the KVM_GET_DEBUGREGS ioctl, on 32-bit systems, there might be some uninitialized portions of the kvm_debugregs structure that could be copied to userspace, causing an information leak. Low CVE-2023-1513 SUSE bug 1209532 cpe:/o:opensuse:leap-micro:5.2 openSUSE Leap Micro 5.2 A race problem was found in fs/proc/task_mmu.c in the memory management sub-component in the Linux kernel. This issue may allow a local attacker with user privilege to cause a denial of service. Moderate CVE-2023-1582 SUSE bug 1209636 cpe:/o:opensuse:leap-micro:5.2 openSUSE Leap Micro 5.2 A vulnerability was found in the avahi library. This flaw allows an unprivileged user to make a dbus call, causing the avahi daemon to crash. Moderate CVE-2023-1981 SUSE bug 1210328 cpe:/o:opensuse:leap-micro:5.2 openSUSE Leap Micro 5.2 In Sudo before 1.9.12p2, the sudoedit (aka -e) feature mishandles extra arguments passed in the user-provided environment variables (SUDO_EDITOR, VISUAL, and EDITOR), allowing a local attacker to append arbitrary entries to the list of files to process. This can lead to privilege escalation. Affected versions are 1.8.0 through 1.9.12.p1. The problem exists because a user-specified editor may contain a "--" argument that defeats a protection mechanism, e.g., an EDITOR='vim -- /path/to/extra/file' value. Important CVE-2023-22809 SUSE bug 1207082 SUSE bug 1208053 SUSE bug 1209326 cpe:/o:opensuse:leap-micro:5.2 openSUSE Leap Micro 5.2 In the Linux kernel before 5.17, an error path in dwc3_qcom_acpi_register_core in drivers/usb/dwc3/dwc3-qcom.c lacks certain platform_device_put and kfree calls. Low CVE-2023-22995 SUSE bug 1208741 cpe:/o:opensuse:leap-micro:5.2 openSUSE Leap Micro 5.2 In the Linux kernel before 6.0.3, drivers/gpu/drm/virtio/virtgpu_object.c misinterprets the drm_gem_shmem_get_sg_table return value (expects it to be NULL in the error case, whereas it is actually an error pointer). Moderate CVE-2023-22998 SUSE bug 1208776 cpe:/o:opensuse:leap-micro:5.2 openSUSE Leap Micro 5.2 In the Linux kernel before 5.17, drivers/phy/tegra/xusb.c mishandles the tegra_xusb_find_port_node return value. Callers expect NULL in the error case, but an error pointer is used. Low CVE-2023-23000 SUSE bug 1208816 cpe:/o:opensuse:leap-micro:5.2 openSUSE Leap Micro 5.2 In the Linux kernel before 5.19, drivers/gpu/drm/arm/malidp_planes.c misinterprets the get_sg_table return value (expects it to be NULL in the error case, whereas it is actually an error pointer). Low CVE-2023-23004 SUSE bug 1208843 cpe:/o:opensuse:leap-micro:5.2 openSUSE Leap Micro 5.2 In the Linux kernel before 5.15.13, drivers/net/ethernet/mellanox/mlx5/core/steering/dr_domain.c misinterprets the mlx5_get_uars_page return value (expects it to be NULL in the error case, whereas it is actually an error pointer). Moderate CVE-2023-23006 SUSE bug 1208845 cpe:/o:opensuse:leap-micro:5.2 openSUSE Leap Micro 5.2 cbq_classify in net/sched/sch_cbq.c in the Linux kernel through 6.1.4 allows attackers to cause a denial of service (slab-out-of-bounds read) because of type confusion (non-negative numbers can sometimes indicate a TC_ACT_SHOT condition rather than valid classification results). Important CVE-2023-23454 SUSE bug 1207036 SUSE bug 1207188 SUSE bug 1208030 SUSE bug 1208044 SUSE bug 1208085 SUSE bug 1211833 cpe:/o:opensuse:leap-micro:5.2 openSUSE Leap Micro 5.2 atm_tc_enqueue in net/sched/sch_atm.c in the Linux kernel through 6.1.4 allows attackers to cause a denial of service because of type confusion (non-negative numbers can sometimes indicate a TC_ACT_SHOT condition rather than valid classification results). Important CVE-2023-23455 SUSE bug 1207125 SUSE bug 1207189 SUSE bug 1211833 cpe:/o:opensuse:leap-micro:5.2 openSUSE Leap Micro 5.2 In rndis_query_oid in drivers/net/wireless/rndis_wlan.c in the Linux kernel through 6.1.5, there is an integer overflow in an addition. Moderate CVE-2023-23559 SUSE bug 1207051 cpe:/o:opensuse:leap-micro:5.2 openSUSE Leap Micro 5.2 An allocation of resources without limits or throttling vulnerability exists in curl <v7.88.0 based on the "chained" HTTP compression algorithms, meaning that a server response can be compressed multiple times and potentially with differentalgorithms. The number of acceptable "links" in this "decompression chain" wascapped, but the cap was implemented on a per-header basis allowing a maliciousserver to insert a virtually unlimited number of compression steps simply byusing many headers. The use of such a decompression chain could result in a "malloc bomb", making curl end up spending enormous amounts of allocated heap memory, or trying to and returning out of memory errors. Moderate CVE-2023-23916 SUSE bug 1207992 cpe:/o:opensuse:leap-micro:5.2 openSUSE Leap Micro 5.2 cryptography is a package designed to expose cryptographic primitives and recipes to Python developers. In affected versions `Cipher.update_into` would accept Python objects which implement the buffer protocol, but provide only immutable buffers. This would allow immutable objects (such as `bytes`) to be mutated, thus violating fundamental rules of Python and resulting in corrupted output. This now correctly raises an exception. This issue has been present since `update_into` was originally introduced in cryptography 1.8. Low CVE-2023-23931 SUSE bug 1208036 cpe:/o:opensuse:leap-micro:5.2 openSUSE Leap Micro 5.2 An issue in the urllib.parse component of Python before 3.11.4 allows attackers to bypass blocklisting methods by supplying a URL that starts with blank characters. Important CVE-2023-24329 SUSE bug 1208471 SUSE bug 1213553 SUSE bug 1213554 SUSE bug 1213839 cpe:/o:opensuse:leap-micro:5.2 openSUSE Leap Micro 5.2 ** REJECT ** Rejected by upstream. Moderate CVE-2023-24593 SUSE bug 1209714 cpe:/o:opensuse:leap-micro:5.2 openSUSE Leap Micro 5.2 The Linux kernel through 6.1.9 has a Use-After-Free in bigben_remove in drivers/hid/hid-bigbenff.c via a crafted USB device because the LED controllers remain registered for too long. Moderate CVE-2023-25012 SUSE bug 1207560 SUSE bug 1207846 cpe:/o:opensuse:leap-micro:5.2 openSUSE Leap Micro 5.2 containerd is an open source container runtime. Before versions 1.6.18 and 1.5.18, when importing an OCI image, there was no limit on the number of bytes read for certain files. A maliciously crafted image with a large file where a limit was not applied could cause a denial of service. This bug has been fixed in containerd 1.6.18 and 1.5.18. Users should update to these versions to resolve the issue. As a workaround, ensure that only trusted images are used and that only trusted users have permissions to import images. Moderate CVE-2023-25153 SUSE bug 1208423 cpe:/o:opensuse:leap-micro:5.2 openSUSE Leap Micro 5.2 containerd is an open source container runtime. A bug was found in containerd prior to versions 1.6.18 and 1.5.18 where supplementary groups are not set up properly inside a container. If an attacker has direct access to a container and manipulates their supplementary group access, they may be able to use supplementary group access to bypass primary group restrictions in some cases, potentially gaining access to sensitive information or gaining the ability to execute code in that container. Downstream applications that use the containerd client library may be affected as well. This bug has been fixed in containerd v1.6.18 and v.1.5.18. Users should update to these versions and recreate containers to resolve this issue. Users who rely on a downstream application that uses containerd's client library should check that application for a separate advisory and instructions. As a workaround, ensure that the `"USER $USERNAME"` Dockerfile instruction is not used. Instead, set the container entrypoint to a value similar to `ENTRYPOINT ["su", "-", "user"]` to allow `su` to properly set up supplementary groups. Moderate CVE-2023-25173 SUSE bug 1208426 SUSE bug 1215588 cpe:/o:opensuse:leap-micro:5.2 openSUSE Leap Micro 5.2 ** REJECT ** Rejected by upstream. Moderate CVE-2023-25180 SUSE bug 1209713 cpe:/o:opensuse:leap-micro:5.2 openSUSE Leap Micro 5.2 hb-ot-layout-gsubgpos.hh in HarfBuzz through 6.0.0 allows attackers to trigger O(n^2) growth via consecutive marks during the process of looking back for base glyphs when attaching marks. Important CVE-2023-25193 SUSE bug 1207922 SUSE bug 1213939 cpe:/o:opensuse:leap-micro:5.2 openSUSE Leap Micro 5.2 runc is a CLI tool for spawning and running containers according to the OCI specification. In affected versions it was found that rootless runc makes `/sys/fs/cgroup` writable in following conditons: 1. when runc is executed inside the user namespace, and the `config.json` does not specify the cgroup namespace to be unshared (e.g.., `(docker|podman|nerdctl) run --cgroupns=host`, with Rootless Docker/Podman/nerdctl) or 2. when runc is executed outside the user namespace, and `/sys` is mounted with `rbind, ro` (e.g., `runc spec --rootless`; this condition is very rare). A container may gain the write access to user-owned cgroup hierarchy `/sys/fs/cgroup/user.slice/...` on the host . Other users's cgroup hierarchies are not affected. Users are advised to upgrade to version 1.1.5. Users unable to upgrade may unshare the cgroup namespace (`(docker|podman|nerdctl) run --cgroupns=private)`. This is the default behavior of Docker/Podman/nerdctl on cgroup v2 hosts. or add `/sys/fs/cgroup` to `maskedPaths`. Low CVE-2023-25809 SUSE bug 1209884 cpe:/o:opensuse:leap-micro:5.2 openSUSE Leap Micro 5.2 In the Linux kernel before 6.1.13, there is a double free in net/mpls/af_mpls.c upon an allocation failure (for registering the sysctl table under a new location) during the renaming of a device. Moderate CVE-2023-26545 SUSE bug 1208700 SUSE bug 1208909 SUSE bug 1210423 cpe:/o:opensuse:leap-micro:5.2 openSUSE Leap Micro 5.2 GNU libmicrohttpd before 0.9.76 allows remote DoS (Denial of Service) due to improper parsing of a multipart/form-data boundary in the postprocessor.c MHD_create_post_processor() method. This allows an attacker to remotely send a malicious HTTP POST packet that includes one or more '\0' bytes in a multipart/form-data boundary field, which - assuming a specific heap layout - will result in an out-of-bounds read and a crash in the find_boundary() function. Moderate CVE-2023-27371 SUSE bug 1208745 cpe:/o:opensuse:leap-micro:5.2 openSUSE Leap Micro 5.2 A vulnerability in input validation exists in curl <8.0 during communication using the TELNET protocol may allow an attacker to pass on maliciously crafted user name and "telnet options" during server negotiation. The lack of proper input scrubbing allows an attacker to send content or perform option negotiation without the application's intent. This vulnerability could be exploited if an application allows user input, thereby enabling attackers to execute arbitrary code on the system. Moderate CVE-2023-27533 SUSE bug 1209209 cpe:/o:opensuse:leap-micro:5.2 openSUSE Leap Micro 5.2 A path traversal vulnerability exists in curl <8.0.0 SFTP implementation causes the tilde (~) character to be wrongly replaced when used as a prefix in the first path element, in addition to its intended use as the first element to indicate a path relative to the user's home directory. Attackers can exploit this flaw to bypass filtering or execute arbitrary code by crafting a path like /~2/foo while accessing a server with a specific user. Moderate CVE-2023-27534 SUSE bug 1209210 cpe:/o:opensuse:leap-micro:5.2 openSUSE Leap Micro 5.2 An authentication bypass vulnerability exists in libcurl <8.0.0 in the FTP connection reuse feature that can result in wrong credentials being used during subsequent transfers. Previously created connections are kept in a connection pool for reuse if they match the current setup. However, certain FTP settings such as CURLOPT_FTP_ACCOUNT, CURLOPT_FTP_ALTERNATIVE_TO_USER, CURLOPT_FTP_SSL_CCC, and CURLOPT_USE_SSL were not included in the configuration match checks, causing them to match too easily. This could lead to libcurl using the wrong credentials when performing a transfer, potentially allowing unauthorized access to sensitive information. Moderate CVE-2023-27535 SUSE bug 1209211 cpe:/o:opensuse:leap-micro:5.2 openSUSE Leap Micro 5.2 An authentication bypass vulnerability exists libcurl <8.0.0 in the connection reuse feature which can reuse previously established connections with incorrect user permissions due to a failure to check for changes in the CURLOPT_GSSAPI_DELEGATION option. This vulnerability affects krb5/kerberos/negotiate/GSSAPI transfers and could potentially result in unauthorized access to sensitive information. The safest option is to not reuse connections if the CURLOPT_GSSAPI_DELEGATION option has been changed. Moderate CVE-2023-27536 SUSE bug 1209212 cpe:/o:opensuse:leap-micro:5.2 openSUSE Leap Micro 5.2 An authentication bypass vulnerability exists in libcurl prior to v8.0.0 where it reuses a previously established SSH connection despite the fact that an SSH option was modified, which should have prevented reuse. libcurl maintains a pool of previously used connections to reuse them for subsequent transfers if the configurations match. However, two SSH settings were omitted from the configuration check, allowing them to match easily, potentially leading to the reuse of an inappropriate connection. Moderate CVE-2023-27538 SUSE bug 1209214 cpe:/o:opensuse:leap-micro:5.2 openSUSE Leap Micro 5.2 runc through 1.1.4 has Incorrect Access Control leading to Escalation of Privileges, related to libcontainer/rootfs_linux.go. To exploit this, an attacker must be able to spawn two containers with custom volume-mount configurations, and be able to run custom images. NOTE: this issue exists because of a CVE-2019-19921 regression. Moderate CVE-2023-27561 SUSE bug 1208962 cpe:/o:opensuse:leap-micro:5.2 openSUSE Leap Micro 5.2 A NULL pointer dereference flaw was found in the UNIX protocol in net/unix/diag.c In unix_diag_get_exact in the Linux Kernel. The newly allocated skb does not have sk, leading to a NULL pointer. This flaw allows a local user to crash or potentially cause a denial of service. Moderate CVE-2023-28327 SUSE bug 1209290 cpe:/o:opensuse:leap-micro:5.2 openSUSE Leap Micro 5.2 A NULL pointer dereference flaw was found in the az6027 driver in drivers/media/usb/dev-usb/az6027.c in the Linux Kernel. The message from user space is not checked properly before transferring into the device. This flaw allows a local user to crash the system or potentially cause a denial of service. Moderate CVE-2023-28328 SUSE bug 1209291 cpe:/o:opensuse:leap-micro:5.2 openSUSE Leap Micro 5.2 An issue was discovered in Dnsmasq before 2.90. The default maximum EDNS.0 UDP packet size was set to 4096 but should be 1232 because of DNS Flag Day 2020. Moderate CVE-2023-28450 SUSE bug 1209358 cpe:/o:opensuse:leap-micro:5.2 openSUSE Leap Micro 5.2 hci_conn_cleanup in net/bluetooth/hci_conn.c in the Linux kernel through 6.2.9 has a use-after-free (observed in hci_conn_hash_flush) because of calls to hci_dev_put and hci_conn_put. There is a double free that may lead to privilege escalation. Important CVE-2023-28464 SUSE bug 1209052 SUSE bug 1211111 cpe:/o:opensuse:leap-micro:5.2 openSUSE Leap Micro 5.2 do_tls_getsockopt in net/tls/tls_main.c in the Linux kernel through 6.2.6 lacks a lock_sock call, leading to a race condition (with a resultant use-after-free or NULL pointer dereference). Important CVE-2023-28466 SUSE bug 1209366 SUSE bug 1210452 SUSE bug 1211833 SUSE bug 1213841 cpe:/o:opensuse:leap-micro:5.2 openSUSE Leap Micro 5.2 In libxml2 before 2.10.4, parsing of certain invalid XSD schemas can lead to a NULL pointer dereference and subsequently a segfault. This occurs in xmlSchemaFixupComplexType in xmlschemas.c. Moderate CVE-2023-28484 SUSE bug 1210411 cpe:/o:opensuse:leap-micro:5.2 openSUSE Leap Micro 5.2 Sudo before 1.9.13 does not escape control characters in log messages. Moderate CVE-2023-28486 SUSE bug 1209362 cpe:/o:opensuse:leap-micro:5.2 openSUSE Leap Micro 5.2 Sudo before 1.9.13 does not escape control characters in sudoreplay output. Moderate CVE-2023-28487 SUSE bug 1209361 cpe:/o:opensuse:leap-micro:5.2 openSUSE Leap Micro 5.2 runc is a CLI tool for spawning and running containers according to the OCI specification. It was found that AppArmor can be bypassed when `/proc` inside the container is symlinked with a specific mount configuration. This issue has been fixed in runc version 1.1.5, by prohibiting symlinked `/proc`. See PR #3785 for details. users are advised to upgrade. Users unable to upgrade should avoid using an untrusted container image. Moderate CVE-2023-28642 SUSE bug 1209888 cpe:/o:opensuse:leap-micro:5.2 openSUSE Leap Micro 5.2 An issue was discovered in the Linux kernel before 5.13.3. lib/seq_buf.c has a seq_buf_putmem_hex buffer overflow. Important CVE-2023-28772 SUSE bug 1209549 SUSE bug 1211110 SUSE bug 1214378 cpe:/o:opensuse:leap-micro:5.2 openSUSE Leap Micro 5.2 In Shadow 4.13, it is possible to inject control characters into fields provided to the SUID program chfn (change finger). Although it is not possible to exploit this directly (e.g., adding a new user fails because \n is in the block list), it is possible to misrepresent the /etc/passwd file when viewed. Use of \r manipulations and Unicode characters to work around blocking of the : character make it possible to give the impression that a new user has been added. In other words, an adversary may be able to convince a system administrator to take the system offline (an indirect, social-engineered denial of service) by demonstrating that "cat /etc/passwd" shows a rogue user account. Moderate CVE-2023-29383 SUSE bug 1210507 cpe:/o:opensuse:leap-micro:5.2 openSUSE Leap Micro 5.2 An issue was discovered in libxml2 before 2.10.4. When hashing empty dict strings in a crafted XML document, xmlDictComputeFastKey in dict.c can produce non-deterministic values, leading to various logic and memory errors, such as a double free. This behavior occurs because there is an attempt to use the first byte of an empty string, and any value is possible (not solely the '\0' value). Moderate CVE-2023-29469 SUSE bug 1210412 cpe:/o:opensuse:leap-micro:5.2 openSUSE Leap Micro 5.2 Dmidecode before 3.5 allows -dump-bin to overwrite a local file. This has security relevance because, for example, execution of Dmidecode via Sudo is plausible. Moderate CVE-2023-30630 SUSE bug 1210418 cpe:/o:opensuse:leap-micro:5.2