SUSE-IU-2025:893-1 SUSE Image security@suse.de SUSE Security Team SUSE Image SUSE-IU-2025:893-1 Interim 1 1 2025-12-07T16:08:37Z current 2025-04-08T01:00:00Z 2025-04-08T01:00:00Z cve-database/bin/generate-cvrf-publiccloud.pl 2021-02-18T01:00:00Z Image update for SUSE-IU-2025:893-1 / google/sles-15-sp5-sap-v20250408-x86-64 This image update for google/sles-15-sp5-sap-v20250408-x86-64 contains the following changes: Package HANA-Firewall was updated: - HANA-Firewall built without PIE (bsc#1239943) Package 000release-packages:SLES_SAP-release was updated: Package apparmor was updated: - Add dovecot-unix_chkpwd.diff to allow dovecot-auth to execute unix_chkpwd, and add a profile for unix_chkpwd. This is needed for PAM with CVE-2024-10041 (bsc#1234452) Package ca-certificates-mozilla was updated: - explit remove distruted certs, as the distrust does not get exported correctly and the SSL certs are still trusted. (bsc#1240343) - Entrust.net Premium 2048 Secure Server CA - Entrust Root Certification Authority - AffirmTrust Commercial - AffirmTrust Networking - AffirmTrust Premium - AffirmTrust Premium ECC - Entrust Root Certification Authority - G2 - Entrust Root Certification Authority - EC1 - GlobalSign Root E46 - GLOBALTRUST 2020 - remove-distrusted.patch: apply to certdata.txt - Fix awk to compare (missing a =) and give the following output: [#] NSS_BUILTINS_LIBRARY_VERSION &quot;2.74&quot; - pass file argument to awk (bsc#1240009) - update to 2.74 state of Mozilla SSL root CAs: Removed: * SwissSign Silver CA - G2 Added: * D-TRUST BR Root CA 2 2023 * D-TRUST EV Root CA 2 2023 - remove extensive signature printing in comments of the cert bundle - Define two macros to break a build cycle with p11-kit. - Updated to 2.72 state of Mozilla SSL root CAs (bsc#1234798) Removed: - SecureSign RootCA11 - Security Communication RootCA3 Added: - TWCA CYBER Root CA - TWCA Global Root CA G2 - SecureSign Root CA12 - SecureSign Root CA14 - SecureSign Root CA15 Package kernel-default was updated: - mm/mempolicy: fix mpol_new leak in shared_policy_replace (CVE-2022-49080 bsc#1238033). - commit ee261e8 - KVM: VMX: Bury Intel PT virtualization (guest/host mode) behind CONFIG_BROKEN (CVE-2024-53135 bsc#1234154). - commit c33dbae - kabi: hide adding RCU head into struct netdev_name_node (bsc#1233749). - net: free altname using an RCU callback (bsc#1233749). - net: fix removing a namespace with conflicting altnames (bsc#1233749). - net: do not send a MOVE event when netdev changes netns (bsc#1233749). - net: Fix undefined behavior in netdev name allocation (bsc#1233749). - net: remove else after return in dev_prep_valid_name() (bsc#1233749). - net: remove dev_valid_name() check from __dev_alloc_name() (bsc#1233749). - net: trust the bitmap in __dev_alloc_name() (bsc#1233749). - net: reduce indentation of __dev_alloc_name() (bsc#1233749). - net: make dev_alloc_name() call dev_prep_valid_name() (bsc#1233749). - net: don't use input buffer of __dev_alloc_name() as a scratch space (bsc#1233749). - net: move altnames together with the netdevice (bsc#1233749). - net: avoid UAF on deleted altname (bsc#1233749). - net: check for altname conflicts when changing netdev's netns (bsc#1233749). - net: fix ifname in netlink ntf during netns move (bsc#1233749). - net: core: Use the bitmap API to allocate bitmaps (bsc#1233749). - net: minor __dev_alloc_name() optimization (bsc#1233749). - net: introduce a function to check if a netdev name is in use (bsc#1233749). - commit b7b1c0b - ipv4/tcp: do not use per netns ctl sockets (bsc#1237693). - commit 5e81510 - x86/xen: allow larger contiguous memory regions in PV guests (bsc#1236951). - commit ae8b3dd - xen/swiotlb: relax alignment requirements (bsc#1236951). - commit 5a1b514 - x86/xen: add FRAME_END to xen_hypercall_hvm() (git-fixes). - commit e70ee83 - x86/xen: fix xen_hypercall_hvm() to not clobber %rbx (git-fixes). - commit 2ad21f6 - idpf: call set_real_num_queues in idpf_open (bsc#1236661 bsc#1237316). - commit 97881c4 - Update References for CVE-2024-53226 and bsc#1236576 Patch: patches.suse/RDMA-hns-Fix-NULL-pointer-derefernce-in-hns_roce_map.patch - commit 990ce5d - gfs2: Truncate address space when flipping GFS2_DIF_JDATA flag (bsc#1237139 CVE-2025-21699). - commit 94ceb50 - cpufreq/amd-pstate: Only print supported EPP values for performance governor (bsc#1236777). - commit 6568154 - scsi: storvsc: Ratelimit warning logs to prevent VM denial of service (bsc#1237025 CVE-2025-21690). - commit 57c2742 - NFSD: use explicit lock/unlock for directory ops (bsc#1234650 bsc#1233701 bsc#1232472). - blacklist.conf: Remove this commit - we do need some of it. - commit dfa4cb2 - sched: sch_cake: add bounds checks to host bulk flow fairness counts (CVE-2025-21647 bsc#1236133). - commit e9841a3 - Update patches.suse/cifs-Fix-UAF-in-cifs_demultiplex_thread-.patch (bsc#1208995 CVE-2023-1192 CVE-2023-52572 bsc#1220946). Move to the sorted section. - commit bb08640 - net: sched: fix ets qdisc OOB Indexing (bsc#1237028 CVE-2025-21692). - commit 947f160 - scsi: storvsc: Set correct data length for sending SCSI command without payload (git-fixes). - commit f05636e - net: mana: Cleanup &quot;mana&quot; debugfs dir after cleanup of all children (bsc#1236760). - net: mana: Enable debugfs files for MANA device (bsc#1236758). - net: mana: Add get_link and get_link_ksettings in ethtool (bsc#1236761). - net: netvsc: Update default VMBus channels (bsc#1236757). - commit 7db536d - Update patches.suse/ALSA-6fire-Release-resources-at-card-release.patch (CVE-2024-53239 bsc#1235054 bsc#1234853). - Update patches.suse/Bluetooth-L2CAP-do-not-leave-dangling-sk-pointer-on-.patch (CVE-2024-56605 bsc#1235061 bsc#1234853). - Update patches.suse/KVM-nSVM-Ignore-nCR3-4-0-when-loading-PDPTEs-from-me.patch (CVE-2024-50115 bsc#1232919 bsc#1225742). - Update patches.suse/NFSv4.0-Fix-a-use-after-free-problem-in-the-asynchronous-open.patch (CVE-2024-53173 bsc#1234891 bsc#1234853). - Update patches.suse/hfsplus-don-t-query-the-device-logical-block-size-multiple-times.patch (bsc#1235073 CVE-2024-56548 bsc#1234853). - Update patches.suse/wifi-mwifiex-Fix-memcpy-field-spanning-write-warning-in-mwifiex_config_scan.patch (CVE-2024-56539 bsc#1234963 bsc#1234853). - commit c3c2bf8 - mac802154: check local interfaces before deleting sdata list (CVE-2024-57948 bsc#1236677). - commit 4de21f7 Package corosync was updated: - Add a patch to fix CVE-2025-30472 (bsc#1239987) * bsc-1239987-check-size-of-orf_token-msg.patch Package crmsh was updated: - Update to version 4.5.1+20250207.2c89797: * Fix: bootstrap: Local joining node should be included when merging known_hosts (bsc#1229419) * Dev: bootstrap: more robust implementation for ssh_merge (bsc#1230530) Package docker was updated: - Don't use the new container-selinux conditional requires on SLE-12, as the RPM version there doesn't support it. Arguably the change itself is a bit suspect but we can fix that later. bsc#1237367 - Add backport for golang.org/x/oauth2 CVE-2025-22868 fix. bsc#1239185 + 0006-CVE-2025-22868-vendor-jws-split-token-into-fixed-num.patch - Add backport for golang.org/x/crypto CVE-2025-22869 fix. bsc#1239322 + 0007-CVE-2025-22869-vendor-ssh-limit-the-size-of-the-inte.patch - Refresh patches: * 0001-SECRETS-daemon-allow-directory-creation-in-run-secre.patch * 0002-SECRETS-SUSE-implement-SUSE-container-secrets.patch * 0003-BUILD-SLE12-revert-graphdriver-btrfs-use-kernel-UAPI.patch * 0004-bsc1073877-apparmor-clobber-docker-default-profile-o.patch * 0005-SLE12-revert-apparmor-remove-version-conditionals-fr.patch - Make container-selinux requirement conditional on selinux-policy (bsc#1237367) - Update to Docker 27.5.1-ce. See upstream changelog online at &lt;https://docs.docker.com/engine/release-notes/27/#2741&gt; bsc#1237335 - Rebase patches: * 0001-SECRETS-daemon-allow-directory-creation-in-run-secre.patch * 0002-SECRETS-SUSE-implement-SUSE-container-secrets.patch * 0003-BUILD-SLE12-revert-graphdriver-btrfs-use-kernel-UAPI.patch * 0004-bsc1073877-apparmor-clobber-docker-default-profile-o.patch * 0005-SLE12-revert-apparmor-remove-version-conditionals-fr.patch * cli-0001-docs-include-required-tools-in-source-tree.patch - Update to docker-buildx 0.20.1. See upstream changelog online at &lt;https://github.com/docker/buildx/releases/tag/v0.20.1&gt; - Update to Docker 27.4.1-ce. See upstream changelog online at &lt;https://docs.docker.com/engine/release-notes/27/#2741&gt; - Rebase patches: * 0001-SECRETS-daemon-allow-directory-creation-in-run-secre.patch * 0002-SECRETS-SUSE-implement-SUSE-container-secrets.patch * 0003-BUILD-SLE12-revert-graphdriver-btrfs-use-kernel-UAPI.patch * 0004-bsc1073877-apparmor-clobber-docker-default-profile-o.patch * 0005-SLE12-revert-apparmor-remove-version-conditionals-fr.patch * cli-0001-docs-include-required-tools-in-source-tree.patch - Update to docker-buildx 0.19.3. See upstream changelog online at &lt;https://github.com/docker/buildx/releases/tag/v0.19.3&gt; - Update to Docker 27.4.0-ce. See upstream changelog online at &lt;https://docs.docker.com/engine/release-notes/27/#274&gt; - Rebase patches: * 0001-SECRETS-daemon-allow-directory-creation-in-run-secre.patch * 0002-SECRETS-SUSE-implement-SUSE-container-secrets.patch * 0003-BUILD-SLE12-revert-graphdriver-btrfs-use-kernel-UAPI.patch * 0004-bsc1073877-apparmor-clobber-docker-default-profile-o.patch * 0005-SLE12-revert-apparmor-remove-version-conditionals-fr.patch * cli-0001-docs-include-required-tools-in-source-tree.patch - Remove upstreamed patches: - 0006-bsc1221916-update-to-patched-buildkit-version-to-fix.patch - 0007-bsc1214855-volume-use-AtomicWriteFile-to-save-volume.patch Package gnutls was updated: - Security fix [bsc#1236974, CVE-2024-12243] * gnutls: inefficient DER Decoding in libtasn1 could lead to remote DoS * Add gnutls-CVE-2024-12243.patch Package google-cloud-sap-agent was updated: - Add patch to fix unexpected memory consumption during token parsing in golang.org/x/oauth2 (bsc#1239197, CVE-2025-22868) * CVE-2025-22868.patch Package google-guest-agent was updated: - Update to version 20250327.01 (bsc#1239763, bsc#1239866) * Remove error messages from gce_workload_cert_refresh and metadata script runner (#527) - from version 20250327.00 * Update guest-logging-go dependency (#526) * Add 'created-by' metadata, and pass it as option to logging library (#508) * Revert &quot;oslogin: Correctly handle newlines at the end of modified files (#520)&quot; (#523) * Re-enable disabled services if the core plugin was enabled (#522) * Enable guest services on package upgrade (#519) * oslogin: Correctly handle newlines at the end of modified files (#520) * Fix core plugin path (#518) * Fix package build issues (#517) * Fix dependencies ran go mod tidy -v (#515) * Fix debian build path (#514) * Bundle compat metadata script runner binary in package (#513) * Bump golang.org/x/net from 0.27.0 to 0.36.0 (#512) * Update startup/shutdown services to launch compat manager (#503) * Bundle new gce metadata script runner binary in agent package (#502) * Revert &quot;Revert bundling new binaries in the package (#509)&quot; (#511) - from version 20250326.00 * Re-enable disabled services if the core plugin was enabled (#521) - from version 20250324.00 * Enable guest services on package upgrade (#519) * oslogin: Correctly handle newlines at the end of modified files (#520) * Fix core plugin path (#518) * Fix package build issues (#517) * Fix dependencies ran go mod tidy -v (#515) * Fix debian build path (#514) * Bundle compat metadata script runner binary in package (#513) * Bump golang.org/x/net from 0.27.0 to 0.36.0 (#512) * Update startup/shutdown services to launch compat manager (#503) * Bundle new gce metadata script runner binary in agent package (#502) * Revert &quot;Revert bundling new binaries in the package (#509)&quot; (#511) * Revert bundling new binaries in the package (#509) * Fix typo in windows build script (#501) * Include core plugin binary for all packages (#500) * Update crypto library to fix CVE-2024-45337 (#499) * Start packaging compat manager (#498) * Start bundling ggactl_plugin_cleanup binary in all agent packages (#492) * scripts: introduce a wrapper to locally build deb package (#490) * Introduce compat-manager systemd unit (#497) - from version 20250317.00 * Revert &quot;Revert bundling new binaries in the package (#509)&quot; (#511) * Revert bundling new binaries in the package (#509) * Fix typo in windows build script (#501) * Include core plugin binary for all packages (#500) * Update crypto library to fix CVE-2024-45337 (#499) * Start packaging compat manager (#498) * Start bundling ggactl_plugin_cleanup binary in all agent packages (#492) * scripts: introduce a wrapper to locally build deb package (#490) * Introduce compat-manager systemd unit (#497) - from version 20250312.00 * Revert bundling new binaries in the package (#509) * Fix typo in windows build script (#501) * Include core plugin binary for all packages (#500) * Update crypto library to fix CVE-2024-45337 (#499) * Start packaging compat manager (#498) * Start bundling ggactl_plugin_cleanup binary in all agent packages (#492) * scripts: introduce a wrapper to locally build deb package (#490) * Introduce compat-manager systemd unit (#497) - from version 20250305.00 * Revert bundling new binaries in the package (#509) * Fix typo in windows build script (#501) * Include core plugin binary for all packages (#500) * Update crypto library to fix CVE-2024-45337 (#499) * Start packaging compat manager (#498) * Start bundling ggactl_plugin_cleanup binary in all agent packages (#492) * scripts: introduce a wrapper to locally build deb package (#490) * Introduce compat-manager systemd unit (#497) - from version 20250304.01 * Fix typo in windows build script (#501) - from version 20250214.01 * Include core plugin binary for all packages (#500) - from version 20250214.00 * Update crypto library to fix CVE-2024-45337 (#499) - from version 20250212.00 * Start packaging compat manager (#498) * Start bundling ggactl_plugin_cleanup binary in all agent packages (#492) - from version 20250211.00 * scripts: introduce a wrapper to locally build deb package (#490) * Introduce compat-manager systemd unit (#497) - from version 20250207.00 * vlan: toggle vlan configuration in debian packaging (#495) * vlan: move config out of unstable section (#494) * Add clarification to comments regarding invalid NICs and the `invalid` tag. (#493) * Include interfaces in lists even if it has an invalid MAC. (#489) * Fix windows package build failures (#491) * vlan: don't index based on the vlan ID (#486) * Revert PR #482 (#488) * Remove Amy and Zach from OWNERS (#487) * Skip interfaces in interfaceNames() instead of erroring if there is an (#482) * Fix Debian packaging if guest agent manager is not checked out (#485) - from version 20250204.02 * force concourse to move version forward. - from version 20250204.01 * vlan: toggle vlan configuration in debian packaging (#495) - from version 20250204.00 * vlan: move config out of unstable section (#494) * Add clarification to comments regarding invalid NICs and the `invalid` tag. (#493) - from version 20250203.01 * Include interfaces in lists even if it has an invalid MAC. (#489) - from version 20250203.00 * Fix windows package build failures (#491) * vlan: don't index based on the vlan ID (#486) * Revert PR #482 (#488) * Remove Amy and Zach from OWNERS (#487) * Skip interfaces in interfaceNames() instead of erroring if there is an (#482) * Fix Debian packaging if guest agent manager is not checked out (#485) - from version 20250122.00 * networkd(vlan): remove the interface in addition to config (#468) * Implement support for vlan dynamic removal, update dhclient to remove only if configured (#465) * Update logging library (#479) * Remove Pat from owners file. (#478) - Add patch to fix unexpected memory consumption during token parsing in golang.org/x/oauth2 (bsc#1239197, CVE-2025-22868) * CVE-2025-22868.patch - Update to version 20250116.00: (bsc#1236403) * networkd(vlan): remove the interface in addition to config (#468) * Implement support for vlan dynamic removal, update dhclient to remove only if configured (#465) * Update logging library (#479) * Remove Pat from owners file. (#478) - Update to version 20241209.01: (bsc#1235664) * readme: add notes about plugin manager (#476) * Update metadata script runner to honor cloud logging config flag (#475) * Fixing fallback from systemd-networkd to dhclient (#471) * network: fix nmcli check pattern (#472) * Update readme with guest agent manager (#469) * Add missing packaging spec (#466) * Bring back side-by-side packaging (#464) * Avoid changing permissions of directory if parent is / (#463) * network: force NetworkManager to connect to primary nic (#461) * Revert plugin manager packaging (#460) * Add GOPATH to PATH in debian build (#459) * Add plugin manager to debian build (#457) * rpm packaging: fix plugin manager assumptions (#458) * packaging: add plugin manager to rhel packaging (#454) Package google-guest-oslogin was updated: - Rework SELinux support (bsc#1232553) * Add pkgconfig(systemd) to BuildRequires for SELinux builds * Add policycoreutils to BuildRequires * Build and install SELinux module on older distributions as well to allow users to use the module with their own SELinux policies * Make checkpolicy build dependency unconditional * Move oslogin.pp SELinux module into %{selinuxtype} subdirectory * Own %{_datadir}/selinux{,/packages} on older distributions * Split SELinux support into separate -selinux package * Use SELinux RPM macros to install and uninstall SELinux module * Use RPM conditional builds to enable SELinux on newer distributions - Build and install SELinux module (bsc#1232553) Package google-osconfig-agent was updated: - Add patch to fix unexpected memory consumption during token parsing in golang.org/x/oauth2 (bsc#1239197, CVE-2025-22868) * CVE-2025-22868.patch - Add patch to fix vulnerability when creating log files * CVE-2024-45339.patch (bsc#1236560, CVE-2024-45339) Package grub2 was updated: - Fix zfs.mo not found message when booting on legacy BIOS (bsc#1237865) * 0001-autofs-Ignore-zfs-not-found.patch Package hawk2 was updated: - Update to version 2.6.6+git.1742310530.bfcd0e2c: * Dev: proof code from injections (bsc#1182162,bsc#1182164) * Fix: enable colocation linking * Dev: make sprockets-4.2 compatible * Dev: enable rails-8.0 * Test: test_check_cluster_configuration: relax required resource options * remove patch - relax-test-cluster-conf.patch Package hwinfo was updated: - merge gh#openSUSE/hwinfo#152- avoid reporting of spurious usb storage devices (bsc#1223330) - 21.87 - merge gh#openSUSE/hwinfo#151 - do not overdo usb device de-duplication (bsc#1239663) - 21.86 Package kdump was updated: Package libX11 was updated: - U_CVE-2025-26597-0001-xkb-Fix-buffer-overflow-in-XkbChangeTypesOfKey.patch * Buffer overflow in XkbChangeTypesOfKey() (CVE-2025-26597, bsc#1237431) Package libapparmor was updated: - Add dovecot-unix_chkpwd.diff to allow dovecot-auth to execute unix_chkpwd, and add a profile for unix_chkpwd. This is needed for PAM with CVE-2024-10041 (bsc#1234452) Package mozilla-nss was updated: - Updated nss-fips-approved-crypto-non-ec.patch to not pass in bad targetKeyLength parameters when checking for FIPS approval after keygen. This was causing false rejections. - Updated nss-fips-approved-crypto-non-ec.patch to approve RSA signature verification mechanisms with PKCS padding and legacy moduli (bsc#1222834). Package freetype2 was updated: - Added patch: * CVE-2025-27363.patch + fixes bsc#1239465, CVE-2025-27363: out-of-bounds write when attempting to parse font subglyph structures related to TrueType GX and variable font files Package procps was updated: - Add patch CVE-2023-4016-part2.patch * Fix the ps command segfaults when pid argument has a leading space (bsc#1236842) Package python3 was updated: - Update CVE-2024-11168-validation-IPv6-addrs.patch according to the Debian version (gh#python/cpython#103848#issuecomment-2708135083). Package ruby2.5 was updated: - remove rexml-test.patch as it is included in suse.patch now- update suse.patch to f0660edeba - fix HTTP request smuggling in WEBrick bsc#1230930 CVE-2024-47220 - update REXML to 3.3.9 to fix ReDOS vulnerability bsc#1232440 CVE-2024-49761 - [ruby/uri] Fix quadratic backtracking on invalid relative URI - [ruby/time] Make RFC2822 regexp linear - [ruby/time] Fix quadratic backtracking on invalid time - merge some parts of CGI 0.1.1 Package libxkbfile was updated: - U_CVE-2025-26595-0001-xkb-Fix-buffer-overflow-in-XkbVModMaskText.patch * Buffer overflow in XkbVModMaskText() (CVE-2025-26595, bsc#1237429) Package libxml2 was updated: - security update- added patches fix CVE-2024-56171 [bsc#1237363], use-after-free in xmlSchemaIDCFillNodeTables and xmlSchemaBubbleIDCNodeTables in xmlschemas.c + libxml2-CVE-2024-56171.patch fix CVE-2025-24928 [bsc#1237370], stack-based buffer overflow in xmlSnprintfElements in valid.c + libxml2-CVE-2025-24928.patch fix CVE-2025-27113 [bsc#1237418], NULL Pointer Dereference in libxml2 xmlPatMatch + libxml2-CVE-2025-27113.patch Package libxslt was updated: - Security fixes: * Fix use-after-free of XPath context node [bsc#1239625, CVE-2025-24855] * Fix UAF related to excluded namespaces [bsc#1239637, CVE-2024-55549] * Make generate-id() deterministic [bsc#1238591, CVE-2023-40403] Just adding the reference here as this CVE was already fixed in 0009-Make-generate-id-deterministic.patch * Rebase patches to use autosetup: - libxslt-1.1.24-no-net-autobuild.patch - libxslt-config-fixes.patch * Add patches: - libxslt-CVE-2024-55549.patch - libxslt-CVE-2025-24855.patch Package libzypp was updated: - Disable zypp.conf:download.use_deltarpm by default (fixes #620) Measurements show that you don't benefit from using deltarpms unless your network connection is very slow. That's why most distributions even stop offering deltarpms. The default remains unchanged on SUSE-15.6 and older. - Make sure repo variables are evaluated in the right context (bsc#1237044) - Introducing MediaCurl2 a alternative HTTP backend. This patch adds MediaCurl2 as a testbed for experimenting with a more simple way to download files. Set ZYPP_CURL2=1 in the environment to use it. - version 17.36.3 (35) - Filesystem usrmerge must not be done in singletrans mode (bsc#1236481, bsc#1189788) Commit will amend the backend in case the transaction would perform a filesystem usrmerge. - Workaround bsc#1216091 on Code16. - version 17.36.2 (35) - Don't issue deprecated warnings if -DNDEBUG is set (bsc#1236983) Released libyui packages compile with -Werror=deprecated-declarations so we can't add deprecated warnings without breaking them. - make gcc15 happy (fixes #613) - version 17.36.1 (35) - Drop zypp-CheckAccessDeleted in favor of 'zypper ps'. - Fix Repoverification plugin not being executed (fixes #614) - Refresh: Fetch the master index file before key and signature (bsc#1236820) - Allow libzypp to compile with C++20. - Deprecate RepoReports we do not trigger. - version 17.36.0 (35) Package lifecycle-data-sle-module-live-patching was updated: - Added data for 5_14_21-150400_24_147, 5_14_21-150400_24_150, 5_14_21-150500_55_91, 5_14_21-150500_55_94, 5_3_18-150300_59_188, 5_3_18-150300_59_191, 5_3_18-150300_59_195, 6_4_0-150600_23_33, 6_4_0-150600_23_38, 6_4_0-19, 6_4_0-20, +kernel-livepatch-5_14_21-150500_13_79-rt,*,+kernel-livepatch-6_4_0-10-rt,*,+kernel-livepatch-6_4_0-11-rt,*,+kernel-livepatch-6_4_0-150600_10_20-rt,*,+kernel-livepatch-6_4_0-150600_10_23-rt,*,+kernel-livepatch-6_4_0-150600_10_26-rt,*. (bsc#1020320) Package python-instance-billing-flavor-check was updated: - Update to version 1.0.0 (jsc#PCT-531) + API incompatibility: The check_payg_byos function no longer exits, it now returns a tuple of (flavor, exit_code). This makes the function reusable. + Update the build setup to work with the system interpreter of upcoming SLE releases. SLE 12 stays with the Python 3.4 interpreter and SLE 15 with the Python 3.6 interpreter. Package python3-M2Crypto was updated: - Change macro to %{?sle15allpythons} so we build both Python 3.6 and Python 3.11 on SLE-15. - Fix spelling of BSD-2-Clause license. - Add rpmlintrc … overflow of ignorable rpmlint warnings caused me not to see the previous problem. - Update to 0.44.0: - fix(rsa): introduce internal cache for rsa.check_key() (bsc#1236664, srht#mcepl/m2crypto#369) - fix[authcookie]: modernize the module - fix(_lib): add missing #include for windows - ci: relax fedora crypto policy to legacy. - enhance setup.py for macos compatibility - prefer packaging.version over distutils.version - fix segfault with openssl 3.4.0 - fix[ec]: raise ioerror instead when load_key_bio() cannot read the file. - doc: update installation instructions for windows. - fix setting x509.verify_* variables - fix building against openssl in non-standard location - test_x509: use only x509_version_1 (0) as version for csr. - The real license is BSD 2-Clause, not MIT. - Update to 0.43.0: - feat[m2]: add m2.time_t_bits to checking for 32bitness. - fix[tests]: Use only X509_VERSION_1 (0) as version for CSR. - fix[EC]: raise ValueError when load_key_bio() cannot read the file (bsc#1231589). - ci: use -mpip wheel instead of -mbuild - fix: use PyMem_Malloc() instead of malloc() - fix[hints]: more work on conversion of type hints to the py3k ones - fix: make the package build even on Python 3.6 - ci[local]: skip freezing local tests - fix[hints]: remove AnyStr type - test: add suggested test for RSA.{get,set}_ex_data - fix: implement interfaces for RSA_{get,set}_ex_new_{data,index} - fix: generate src/SWIG/x509_v_flag.h to overcome weaknesses of swig - fix: replace literal enumeration of all VERIFY_ constants by a cycle - test: unify various test cases in test_ssl related to ftpslib - fix: replace deprecated url keyword in setup.cfg with complete project_urls map - Update 0.42.0: - allow ASN1_{Integer,String} be initialized directly - minimal infrastructure for type hints for a C extension and some type hints for some basic modules - time_t on 32bit Linux is 32bit (integer) not 64bit (long) - EOS for CentOS 7 - correct checking for OpenSSL version number on Windows - make compatible with Python 3.13 (replace PyEval_CallObject with PyObject_CallObject) - fix typo in extern function signature (and proper type of engine_ctrl_cmd_string()) - move the package to Sorucehut - setup CI to use Sourcehut CI - setup CI on GitLab for Windows as well (remove Appveyor) - initial draft of documentation for migration to pyca/cryptography - fix Read the Docs configuration (contributed kindly by Facundo Tuesca) - Remove upstreamed 32bit_ASN1_Time.patch - Remove python-M2Crypto.keyring, because PyPI broke GPG support - Build for modern python stack on SLE/Leap Package zypp-plugin was updated: - version 0.6.5 - Build package for multiple Python flavors on the SLE15 family (fixes #4) Package rsync was updated: - Fix bsc#1237187 - broken rsyncd * Lists digests available in greeting line * Add rsync-fix-daemon-proto-32.patch Package rubygem-rack was updated: - security update- added patches fix CVE-2025-27610 [bsc#1239298], improper sanitization of user-supplied paths + rubygem-rack-CVE-2025-27610.patch - security update - added patches fix CVE-2025-25184 [bsc#1237141], Rack::CommonLogger can be exploited by crafting input + rubygem-rack-CVE-2025-25184.patch fix CVE-2025-27111 [bsc#1238607], Escape Sequence Injection vulnerability in Rack lead to Possible Log Injection + rubygem-rack-CVE-2025-27111.patch Package saptune was updated: - update package version of saptune to 3.1.5 * on Azure cloud create a saptune service drop-in file to start saptune after cloud-final.service (bsc#1235824, jsc#SAPSOL-523) * fix NVMe device detection and update man page saptune-note.5 (bsc#1233126) * fix wrong error handling, if system limits.conf file is missing and skip reading system limits.conf file on SLES 16 as it can not contain customer changes (bsc#1236232) * fix value for grub transparent_hugepage entries in Note 2684254 (bsc#1235579) Package 000release-packages:sle-ha-release was updated: Package 000release-packages:sle-module-basesystem-release was updated: Package 000release-packages:sle-module-containers-release was updated: Package 000release-packages:sle-module-desktop-applications-release was updated: Package 000release-packages:sle-module-development-tools-release was updated: Package 000release-packages:sle-module-live-patching-release was updated: Package 000release-packages:sle-module-public-cloud-release was updated: Package 000release-packages:sle-module-python3-release was updated: Package 000release-packages:sle-module-sap-applications-release was updated: Package 000release-packages:sle-module-server-applications-release was updated: Package 000release-packages:sle-module-web-scripting-release was updated: Package suse-build-key was updated: - changed keys to use SHA256 UIDs instead of SHA1. (bsc#1237294 bsc#1236779 jsc#PED-12321) - gpg-pubkey-3fa1d6ce-67c856ee.asc to gpg-pubkey-09d9ea69-67c857f3.asc - gpg-pubkey-09d9ea69-645b99ce.asc to gpg-pubkey-3fa1d6ce-63c9481c.asc - suse_ptf_key_2023.asc, suse_ptf_key.asc: adjusted Package tcsh was updated: - Do not interfere Meta with Carriage Return (boo#1170527) - Key-binding: support also other variants of terminals like xterm-256color Package timezone was updated: - Update to 2025a: * Paraguay adopts permanent -03 starting spring 2024 * Improve pre-1991 data for the Philippines * Etc/Unknown is now reserved - Update to 2024b: * Improve historical data for Mexico, Mongolia, and Portugal. * System V names are now obsolescent. * The main data form now uses %z. * The code now conforms to RFC 8536 for early timestamps. * Support POSIX.1-2024, which removes asctime_r and ctime_r. * Assume POSIX.2-1992 or later for shell scripts. * SUPPORT_C89 now defaults to 1. - Add revert-philippines-historical-data.patch, revert-systemv-deprecation.patch * Fixes testsuite failures for other packages Package vim was updated: - Introduce patch to fix bsc#1235751 (regression). * vim-9.1.1134-revert-putty-terminal-colors.patch - Update to 9.1.1176. Changes: * 9.1.1176: wrong indent when expanding multiple lines * 9.1.1175: inconsistent behaviour with exclusive selection and motion commands * 9.1.1174: tests: Test_complete_cmdline() may fail * 9.1.1173: filetype: ABNF files are not detected * 9.1.1172: [security]: overflow with 'nostartofline' and Ex command in tag file * 9.1.1171: tests: wrong arguments passed to assert_equal() * 9.1.1170: wildmenu highlighting in popup can be improved * 9.1.1169: using global variable for get_insert()/get_lambda_name() * 9.1.1168: wrong flags passed down to nextwild() * 9.1.1167: mark '] wrong after copying text object * 9.1.1166: command-line auto-completion hard with wildmenu * 9.1.1165: diff: regression with multi-file diff blocks * 9.1.1164: [security]: code execution with tar.vim and special crafted tar files * 9.1.1163: $MYVIMDIR is set too late * 9.1.1162: completion popup not cleared in cmdline * 9.1.1161: preinsert requires bot &quot;menu&quot; and &quot;menuone&quot; to be set * 9.1.1160: Ctrl-Y does not work well with &quot;preinsert&quot; when completing items * 9.1.1159: $MYVIMDIR may not always be set * 9.1.1158: :verbose set has wrong file name with :compiler! * 9.1.1157: command completion wrong for input() * 9.1.1156: tests: No test for what patch 9.1.1152 fixes * 9.1.1155: Mode message not cleared after :silent message * 9.1.1154: Vim9: not able to use autoload class accross scripts * 9.1.1153: build error on Haiku * 9.1.1152: Patch v9.1.1151 causes problems * 9.1.1151: too many strlen() calls in getchar.c * 9.1.1150: :hi completion may complete to wrong value * 9.1.1149: Unix Makefile does not support Brazilian lang for the installer * 9.1.1148: Vim9: finding imported scripts can be further improved * 9.1.1147: preview-window does not scroll correctly * 9.1.1146: Vim9: wrong context being used when evaluating class member * 9.1.1145: multi-line completion has wrong indentation for last line * 9.1.1144: no way to create raw strings from a blob * 9.1.1143: illegal memory access when putting a register * 9.1.1142: tests: test_startup fails if $HOME/$XDG_CONFIG_HOME is defined * 9.1.1141: Misplaced comment in readfile() * 9.1.1140: filetype: m17ndb files are not detected * 9.1.1139: [fifo] is not displayed when editing a fifo * 9.1.1138: cmdline completion for :hi is too simplistic * 9.1.1137: ins_str() is inefficient by calling STRLEN() * 9.1.1136: Match highlighting marks a buffer region as changed * 9.1.1135: 'suffixesadd' doesn't work with multiple items * 9.1.1134: filetype: Guile init file not recognized * 9.1.1133: filetype: xkb files not recognized everywhere * 9.1.1132: Mark positions wrong after triggering multiline completion * 9.1.1131: potential out-of-memory issue in search.c * 9.1.1130: 'listchars' &quot;precedes&quot; is not drawn on Tabs. * 9.1.1129: missing out-of-memory test in buf_write() * 9.1.1128: patch 9.1.1119 caused a regression with imports * 9.1.1127: preinsert text is not cleaned up correctly * 9.1.1126: patch 9.1.1121 used a wrong way to handle enter * 9.1.1125: cannot loop through pum menu with multiline items * 9.1.1124: No test for 'listchars' &quot;precedes&quot; with double-width char * 9.1.1123: popup hi groups not falling back to defaults * 9.1.1122: too many strlen() calls in findfile.c * 9.1.1121: Enter does not insert newline with &quot;noselect&quot; * 9.1.1120: tests: Test_registers fails * 9.1.1119: Vim9: Not able to use an autoloaded class from another autoloaded script * 9.1.1118: tests: test_termcodes fails * 9.1.1117: there are a few minor style issues * 9.1.1116: Vim9: super not supported in lambda expressions * 9.1.1115: [security]: use-after-free in str_to_reg() * 9.1.1114: enabling termguicolors automatically confuses users * 9.1.1113: tests: Test_terminal_builtin_without_gui waits 2 seconds * 9.1.1112: Inconsistencies in get_next_or_prev_match() * 9.1.1111: Vim9: variable not found in transitive import * 9.1.1110: Vim tests are slow and flaky * 9.1.1109: cmdexpand.c hard to read * 9.1.1108: 'smoothscroll' gets stuck with 'listchars' &quot;eol&quot; * 9.1.1107: cannot loop through completion menu with fuzzy * 9.1.1106: tests: Test_log_nonexistent() causes asan failure * 9.1.1105: Vim9: no support for protected new() method * 9.1.1104: CI: using Ubuntu 22.04 Github runners * 9.1.1103: if_perl: still some compile errors with Perl 5.38 * 9.1.1102: tests: Test_WinScrolled_Resized_eiw() uses wrong filename - 9.1.1101 is a fix for: bsc#1229685 (CVE-2024-43790) bsc#1229822 (CVE-2024-43802) bsc#1230078 (CVE-2024-45306) bsc#1235695 (CVE-2025-22134) bsc#1236151 (CVE-2025-24014) bsc#1237137 (CVE-2025-1215) - Remove obsoleted patch: * vim-7.3-mktemp_tutor.patch - update to 9.1.1101 * insexpand.c hard to read * tests: Test_log_nonexistent only works on Linux * Update base-syntax, improve variable matching * Vim9: import with extends may crash * leaking memory with completing multi lines * --log with non-existent path causes a crash * if_perl: Perl 5.38 adds new symbols causing link failure * tests: matchparen plugin test wrongly named * Vim9: problem finding implemented method in type hierarchy * runtime(qf): Update syntax file, match second delimiter * tests: output of test ...win32_ctrl_z depends on python version * tests: fix expected return code for python 3.13 on Windows * tests: timeout might be a bit too small * tests: test_terminwscroll_topline2 unreliable * tests: No check when tests are run under Github actions * tests: plugin tests are named inconsistently * Vim9: import with extends may crash * completion doesn't work with multi lines * filetype: cmmt files are not recognized * Unable to persistently ignore events in a window and its buffers * improve syntax highlighting * setreg() doesn't correctly handle mbyte chars in blockwise mode * unexpected DCS responses may cause out of bounds reads * has('bsd') is true for GNU/Hurd * filetype: Mill files are not recognized * GUI late startup leads to uninitialized scrollbars * Add support for lz4 to tar &amp; gzip plugin * Terminal ansi colors off by one after tgc reset * included syntax items do not understand contains=TOP * vim_strnchr() is strange and unnecessary * Vim9: len variable not used in compile_load() * runtime(vim): Update base-syntax, match :debuggreedy count prefix * Strange error when heredoc marker starts with &quot;trim&quot; * tests: test_compiler fails on Windows without Maven * 'diffopt' &quot;linematch&quot; cannot be used with {n} less than 10 * args missing after failing to redefine a function * Cannot control cursor positioning of getchar() * preinsert text completions not deleted with &lt;C-W&gt;/&lt;C-U&gt; * getchar() can't distinguish between C-I and Tab * tests: Test_termwinscroll_topline2 fails on MacOS * heap-use-after-free and stack-use-after-scope with :14verbose * no digraph for &quot;Approaches the limit&quot; * not possible to use plural forms with gettext() * too many strlen() calls in userfunc.c * terminal: E315 when dragging the terminal with the mouse * runtime(openPlugin): fix unclosed parenthesis in GetWordUnderCursor() * runtime(doc): Tweak documentation style a bit * tests: test_glvs fails when unarchiver not available * Vim always enables 'termguicolors' in a terminal * completion: input text deleted with preinsert when adding leader * translation(sr): Missing Serbian translation for the tutor * Superfluous cleanup steps in test_ins_complete.vim * runtime(netrw): correct wrong version check * Vim doesn't highlight to be inserted text when completing * runtime(netrw): upstream snapshot of v176 * runtime(dist/vim9): fix regressions in dist#vim9#Open * runtime(hyprlang): fix string recognition * make install fails because of a missing dependency * runtime(asm): add byte directives to syntax script * Vim doesn't work well with TERM=xterm-direct * runtime(filetype): commit 99181205c5f8284a3 breaks V lang detection * runtime: decouple Open and Launch commands and gx mapping from netrw * &quot;nosort&quot; enables fuzzy filtering even if &quot;fuzzy&quot; isn't in 'completeopt' * runtime(just): fix typo in syntax file * runtime(filetype): Improve Verilog detection by checking for modules definition * tests: off-by-one error in CheckCWD in test_debugger.vim * tests: no support for env variables when running Vim in terminal * too many strlen() calls in os_unix.c * insert-completed items are always sorted * crash after scrolling and pasting in silent Ex mode * Makefiles uses non-portable syntax * fuzzymatching doesn't prefer matching camelcase * filetype: N-Tripels and TriG files are not recognized * Vim9: Patch 9.1.1014 causes regressions * translation(sr): Update Serbian messages translation - updade to 9.1.1043 * [security]: segfault in win_line() * update helptags * filetype: just files are not recognized * Update base-syntax, match ternary and falsy operators * Vim9: out-of-bound access when echoing an enum * Vim9: imported type cannot be used as func return type * runtime(kconfig): updated ftplugin and syntax script * runtime(doc): rename last t_BG reference to t_RB * Vim9: comments are outdated * tests: test_channel.py fails with IPv6 * runtime(vim): Update base-syntax, fix is/isnot operator matching * Vim9: confusing error when using abstract method via super * make install fails when using shadowdir * Vim9: memory leak with blob2str() * runtime(tex): add texEmphStyle to texMatchGroup in syntax script * runtime(netrw): upstream snapshot of v175 * Vim9: compiling abstract method fails without return * runtime(c): add new constexpr keyword to syntax file (C23) * tests: shaderslang was removed from test_filetype erroneously * link error when FEAT_SPELL not defined * Coverity complains about insecure data handling * runtime(sh): update syntax script * runtime(c): Add missing syntax test files * filetype: setting bash filetype is backwards incompatible * runtime(c): Update syntax and ftplugin files * the installer can be improved * too many strlen() calls in screen.c * no sanitize check when running linematch * filetype: swc configuration files are not recognized * runtime(netrw): change netrw maintainer * wrong return type of blob2str() * blob2str/str2blob() do not support list of strings * runtime(doc): fix typo in usr_02.txt * Coverity complains about dereferencing NULL pointer * linematch option value not completed * string might be used without a trailing NUL * no way to get current selected item in a async context * filetype: fd ignore files are not recognized * v9.1.0743 causes regression with diff mode * runtime(doc): fix base64 encode/decode examples * Vim9: Patch 9.1.1013 causes a few problems * Not possible to convert string2blob and blob2string * Coverity complains about dereferencing NULL value * Vim9: variable not found in transitive import * runtime(colors): Update colorschemes, include new unokai colorscheme * Vim9: Regression caused by patch v9.1.0646 * runtime(lyrics): support milliseconds in syntax script * runtime(vim): Split Vim legacy and Vim9 script indent tests * Vim9: class interface inheritance not correctly working * popupmenu internal error with some abbr in completion item * filetype: VisualCode setting file not recognized * diff feature can be improved * tests: test for patch 9.1.1006 doesn't fail without the patch * filetype: various ignore are not recognized * tests: Load screendump files with &quot;git vimdumps&quot; * PmenuMatch completion highlight can be combined * completion text is highlighted even with no pattern found * tests: a few termdebug tests are flaky * [security]: heap-buffer-overflow with visual mode * runtime(doc): add package-&lt;name&gt; helptags for included packages * Vim9: unknown func error with interface declaring func var * runtime(filetype): don't detect string interpolation as angular * ComplMatchIns highlight hard to read on light background * runtime(vim): Update base-syntax, highlight literal string quote escape * runtime(editorconfig): set omnifunc to syntaxcomplete func * tests: ruby tests fail with Ruby 3.4 * Vim9: leaking finished exception * runtime(tiasm): use correct syntax name tiasm in syntax script * filetype: TI assembly files are not recognized * too many strlen() calls in drawscreen.c * runtime(xf86conf): add section name OutputClass to syntax script * ComplMatchIns may highlight wrong text * runtime(vim): Update base-syntax, improve ex-bang matching * runtime(doc): clarify buffer deletion on popup_close() * filetype: shaderslang files are not detected * Vim9: not able to use comment after opening curly brace - update to 9.1.0993 * 9.1.0993: New 'cmdheight' behavior may be surprising * runtime(sh): fix typo in Last Change header * 9.1.0992: Vim9: double-free after v9.1.0988 * 9.1.0991: v:stacktrace has wrong type in Vim9 script * runtime(sh): add PS0 to bashSpecialVariables in syntax script * runtime(vim): Remove trailing comma from match_words * runtime(zsh): sync syntax script with upstream repo * runtime(doc): Capitalise the mnemonic &quot;Zero&quot; for the 'z' flag of search() * 9.1.0990: Inconsistent behavior when changing cmdheight * 9.1.0989: Vim9: Whitespace after the final enum value causes a syntax error * runtime(java): Quietly opt out for unsupported markdown.vim versions * runtime(vim): fix failing vim syntax test * 9.1.0988: Vim9: no error when using uninitialized var in new() * runtime(doc): update index.txt * 9.1.0987: filetype: cake files are not recognized * 9.1.0986: filetype: 'jj' filetype is a bit imprecise * runtime(jj): Support diffs in jj syntax * runtime(vim): Update matchit pattern, no Vim9 short names * 9.1.0985: Vim9: some ex commands can be shortened * 9.1.0984: exception handling can be improved * runtime(doc): update doc for :horizontal * runtime(doc): update index.txt, windows.txt and version9.txt * runtime(doc): Tweak documentation about base64 function * runtime(chordpro): update syntax script * 9.1.0983: not able to get the displayed items in complete_info() * runtime(doc): use standard SGR format at :h xterm-true-color * 9.1.0982: TI linker files are not recognized * runtime(vim): update vim generator syntax script * 9.1.0981: tests: typo in test_filetype.vim * 9.1.0980: no support for base64 en-/decoding functions in Vim Script * syntax(sh): Improve the recognition of bracket expressions * runtime(doc): mention how NUL bytes are handled * 9.1.0979: VMS: type warning with $XDG_VIMRC_FILE * 9.1.0978: GUI tests sometimes fail when setting 'scroll' options * 9.1.0977: filetype: msbuild filetypes are not recognized * 9.1.0976: Vim9: missing return statement with throw * 9.1.0975: Vim9: interpolated string expr not working in object methods * 9.1.0974: typo in change of commit v9.1.0873 * 9.1.0973: too many strlen() calls in fileio.c * runtime(sh): set shellcheck as the compiler for supported shells * runtime(doc): Fix enum example syntax * 9.1.0972: filetype: TI linker map files are not recognized * runtime(vim): Improve syntax script generator for Vim Script * 9.1.0971: filetype: SLNX files are not recognized * 9.1.0970: VMS: build errors on VMS architecture * runtime(doc): Fix documentation typos * runtime(doc): update for new keyprotocol option value (after v9.1.0969) * 9.1.0969: ghostty not using kitty protocol by default * 9.1.0968: tests: GetFileNameChecks() isn't fully sorted by filetype name * runtime(doc): update version9.txt for bash filetype * runtime(netrw): update last change header for #16265 * runtime(doc): fix doc error in :r behaviour * 9.1.0967: SpotBugs compiler setup can be further improved * 9.1.0966: Vim9: :enum command can be shortened * runtime(compiler): include a basic bash syntax checker compiler * 9.1.0965: filetype: sh filetype set when detecting the use of bash * runtime(doc): clarify ARCH value for 32-bit in INSTALLpc.txt * 9.1.0963: fuzzy-matching does not prefer full match * 9.1.0962: filetype: bun.lock file is not recognized * runtime(vim): update indentation plugin for Vim script * runtime(doc): tweak documentation style in helphelp.txt * runtime(vim): Update base-syntax, allow parens in default arguments * runtime(doc): mention auto-format using clang-format for sound.c/sign.c * runtime(help): fix typo s/additional/arbitrary/ * runtime(help): Add better support for language annotation highlighting * 9.1.0961: filetype: TI gel files are not recognized * 9.1.0960: filetype: hy history files are not recognized * translation(fi): Fix typoes in Finish menu translation * 9.1.0959: Coverity complains about type conversion * runtime(vim): Use supported syntax in indent tests * 9.1.0958: filetype: supertux2 config files detected as lisp * 9.1.0956: completion may crash, completion highlight wrong with preview window * 9.1.0955: Vim9: vim9compile.c can be further improved * runtime(doc): move help tag E1182 * runtime(graphql): contribute vim-graphql to Vim core * 9.1.0954: popupmenu.c can be improved * 9.1.0953: filetype: APKBUILD files not correctly detected * 9.1.0952: Vim9: missing type checking for any type assignment * 9.1.0951: filetype: jshell files are not recognized * runtime(dockerfile): do not set commentstring in syntax script * 9.1.0950: filetype: fennelrc files are not recognized * runtime(netrw): do not double escape Vim special characters * git: ignore reformatting change of netrw plugin * runtime(netrw): more reformating #16248 * runtime(doc): Add a note about handling symbolic links in starting.txt * 9.1.0949: popups inconsistently shifted to the left * git: ignore reformatting change of netrw plugin * runtime(netrw): change indent size from 1 to 2 * 9.1.0948: Missing cmdline completion for :pbuffer * runtime(tutor): Reformat tutor1 * 9.1.0947: short-description * 9.1.0946: cross-compiling fails on osx-arm64 * 9.1.0945: ComplMatchIns highlight doesn't end after inserted text * translation(sv): re-include the change from #16240 * 9.1.0944: tests: test_registers fails when not run under X11 * 9.1.0943: Vim9: vim9compile.c can be further improved * runtime(doc): Update README and mention make check to verify * translation(sv): partly revert commit 98874dca6d0b60ccd6fc3a140b3ec * runtime(vim): update base-syntax after v9.1.0936 * 9.1.0942: a few typos were found * 9.1.0941: ComplMatchIns doesn't work after multibyte chars * runtime(doc): Fix style in fold.txt * translation(sv): Fix typo in Swedish translation * 9.1.0940: Wrong cursor shape with &quot;gq&quot; and 'indentexpr' executes :normal * runtime(doc): fix some small errors * 9.1.0939: make installtutor fails * 9.1.0938: exclusive selection not respected when re-selecting block mode * 9.1.0937: test_undolist() is flaky * 9.1.0936: cannot highlight completed text * 9.1.0935: SpotBugs compiler can be improved * 9.1.0934: hard to view an existing buffer in the preview window * runtime(doc): document how to minimize fold computation costs * 9.1.0933: Vim9: vim9compile.c can be further improved * 9.1.0932: new Italian tutor not installed * runtime(doc): fix a few minor errors from the last doc updates * translation(it): add Italian translation for the interactive tutor * runtime(doc): update the change.txt help file * runtime(help): Add Vim lang annotation support for codeblocks * 9.1.0931: ml_get error in terminal buffer * 9.1.0930: tests: test_terminal2 may hang in GUI mode * 9.1.0929: filetype: lalrpop files are not recognized * 9.1.0928: tests: test_popupwin fails because the filter command fails * editorconfig: set trim_trailing_whitespace = false for src/testdir/test*.vim * 9.1.0927: style issues in insexpand.c * 9.1.0926: filetype: Pixi lock files are not recognized * runtime(doc): Add a reference to |++opt| and |+cmd| at `:h :pedit` * runtime(doc): add a note about inclusive motions and exclusive selection * 9.1.0925: Vim9: expression compiled when not necessary * 9.1.0924: patch 9.1.0923 causes issues * 9.1.0923: too many strlen() calls in filepath.c * 9.1.0923: wrong MIN macro in popupmenu.c * 9.1.0921: popupmenu logic is a bit convoluted * 9.1.0920: Vim9: compile_assignment() too long * 9.1.0919: filetype: some assembler files are not recognized * runtime(netrw): do not pollute search history with symlinks * 9.1.0918: tiny Vim crashes with fuzzy buffer completion * 9.1.0917: various vartabstop and shiftround bugs when shifting lines * runtime(typst): add definition lists to formatlistpat, update maintainer * 9.1.0916: messages.c is exceeding 80 columns * runtime(proto): include filetype plugin for protobuf * 9.1.0915: GVim: default font size a bit too small * 9.1.0914: Vim9: compile_assignment() is too long * 9.1.0913: no error check for neg values for 'messagesopt' * runtime(netrw): only check first arg of netrw_browsex_viewer for being executable * 9.1.0912: xxd: integer overflow with sparse files and -autoskip * 9.1.0911: Variable name for 'messagesopt' doesn't match short name * 9.1.0910: 'messagesopt' does not check max wait time * runtime(doc): update wrong Vietnamese localization tag * 9.1.0909: Vim9: crash when calling instance method - update to 9.1.0908 * refresh vim-7.3-mktemp_tutor.patch * 9.1.0908: not possible to configure :messages * 9.1.0907: printoptions:portrait does not change postscript Orientation * runtime(doc): Add vietnamese.txt to helps main TOC * 9.1.0906: filetype: Nvidia PTX files are not recognized * runtime(doc): updated version9.txt with changes from v9.1.0905 * 9.1.0905: Missing information in CompleteDone event * 9.1.0904: Vim9: copy-paste error in class_defining_member() * 9.1.0903: potential overflow in spell_soundfold_wsal() * runtime(netrw): do not detach when launching external programs in gvim * runtime(doc): make tag alignment more consistent in filetype.txt * runtime(doc): fix wrong syntax and style of vietnamese.txt * translation(it): update Italian manpage for vimtutor * runtime(lua): add optional lua function folding * Filelist: include translations for Chapter 2 tutor * translation(vi): Update Vietnamese translation * runtime(doc): include vietnamese.txt * runtime(tutor): fix another typo in tutor2 * runtime(doc): fix typo in vimtutor manpage * translation(it): update Italian manpage for vimtutor * translation(it): include Italian version of tutor chapter 2 * runtime(tutor): regenerated some translated tutor1 files * runtime(tutor): fix typo in Chapter 2 * 9.1.0902: filetype: Conda configuration files are not recognized * runtime(doc): Tweak documentation style a bit * runtime(tutor): update the tutor files and re-number the chapters * runtime(tutor): Update the makefiles for tutor1 and tutor2 files * 9.1.0901: MS-Windows: vimtutor batch script can be improved * runtime(doc): remove buffer-local completeopt todo item * 9.1.0900: Vim9: digraph_getlist() does not accept bool arg * runtime(typst): provide a formatlistpat in ftplugin * runtime(doc): Update documentation for &quot;noselect&quot; in 'completeopt' * 9.1.0899: default for 'backspace' can be set in C code * runtime(helptoc): reload cached g:helptoc.shell_prompt when starting toc * translation(ru): Updated messages translation * 9.1.0898: runtime(compiler): pytest compiler not included * 9.1.0897: filetype: pyrex files are not detected * runtime(compiler): update eslint compiler * 9.1.0896: completion list wrong after v9.1.0891 * runtime(doc): document changed default value for 'history' * 9.1.0895: default history value is too small * 9.1.0894: No test for what the spotbug compiler parses * 9.1.0893: No test that undofile format does not regress * translation(de): update German manpages * runtime(compiler): include spotbugs Java linter * 9.1.0892: the max value of 'tabheight' is limited by other tabpages * runtime(po): remove poDiffOld/New, add po-format flags to syntax file * 9.1.0891: building the completion list array is inefficient * patch 9.1.0890: %! item not allowed for 'rulerformat' * runtime(gzip): load undofile if there exists one * 9.1.0889: Possible unnecessary redraw after adding/deleting lines * 9.1.0888: leftcol property not available in getwininfo() * 9.1.0887: Wrong expression in sign.c * 9.1.0886: filetype: debian control file not detected * runtime(c3): include c3 filetype plugin * 9.1.0885: style of sign.c can be improved * 9.1.0884: gcc warns about uninitialized variable * runtime(apache): Update syntax directives for apache server 2.4.62 * translation(ru): updated vimtutor translation, update MAINTAINERS file * 9.1.0883: message history cleanup is missing some tests * runtime(doc): Expand docs on :! vs. :term * runtime(netrw): Fixing powershell execution issues on Windows * 9.1.0882: too many strlen() calls in insexpand.c * 9.1.0881: GUI: message dialog may not get focus * runtime(netrw): update netrw's decompress logic * runtime(apache): Update syntax keyword definition * runtime(misc): add Italian LICENSE and (top-level) README file * 9.1.0880: filetype: C3 files are not recognized * runtime(doc): add helptag for :HelpToc command * 9.1.0879: source is not consistently formatted * Add clang-format config file * runtime(compiler): fix escaping of arguments passed to :CompilerSet * 9.1.0878: termdebug: cannot enable DEBUG mode * 9.1.0877: tests: missing test for termdebug + decimal signs * 9.1.0876: filetype: openCL files are not recognized * 9.1.0875: filetype: hyprlang detection can be improved * 9.1.0874: filetype: karel files are not detected * 9.1.0873: filetype: Vivado files are not recognized * 9.1.0872: No test for W23 message * 9.1.0871: getcellpixels() can be further improved * 9.1.0870: too many strlen() calls in eval.c * 9.1.0869: Problem: curswant not set on gm in folded line * 9.1.0868: the warning about missing clipboard can be improved * runtime(doc): Makefile does not clean up all temporary files * 9.1.0867: ins_compl_add() has too many args * editorconfig: don't trim trailing whitespaces in runtime/doc * translation(am): Remove duplicate keys in desktop files * runtime(doc): update helptags * runtime(filetype): remove duplicated *.org file pattern * runtime(cfg): only consider leading // as starting a comment * 9.1.0866: filetype: LLVM IR files are not recognized * 9.1.0865: filetype: org files are not recognized * 9.1.0864: message history is fixed to 200 * 9.1.0863: getcellpixels() can be further improved * runtime(sh): better function support for bash/zsh in indent script * runtime(netrw): small fixes to netrw#BrowseX * 9.1.0862: 'wildmenu' not enabled by default in nocp mode * runtime(doc): update how to report issues for mac Vim * runtime(doc): mention option-backslash at :h CompilerSet * runtime(compiler): include a Java Maven compiler plugin * runtime(racket): update Racket runtime files * runtime(doc): improve indentation in examples for netrw-handler * runtime(doc): improve examples for netrw-handler functions * runtime(idris2): include filetype,indent+syntax plugins for (L)Idris2 + ipkg * runtime(doc): clarify the use of filters and external commands * 9.1.0861: Vim9: no runtime check for object member access of any var * runtime(compiler): update pylint linter * 9.1.0860: tests: mouse_shape tests use hard code sleep value * 9.1.0859: several problems with the GLVS plugin * 9.1.0858: Coverity complains about dead code * runtime(tar): Update tar.vim to support permissions * 9.1.0857: xxd: --- is incorrectly recognized as end-of-options * 9.1.0851: too many strlen() calls in getchar.c * 9.1.0850: Vim9: cannot access nested object inside objects * runtime(tex): extra Number highlighting causes issues * runtime(vim): Fix indent after :silent! function * 9.1.0849: there are a few typos in the source * runtime(netrw): directory symlink not resolved in tree view * runtime(doc): add a table of supported Operating Systems * runtime(tex): update Last Change header in syntax script * runtime(doc): fix typo in g:termdebug_config * runtime(vim): Update base-syntax, improve :normal highlighting * runtime(tex): add Number highlighting to syntax file * runtime(doc): Tweak documentation style a bit * 9.1.0848: if_lua: v:false/v:true are not evaluated to boolean * runtime(dune): use :setl instead of :set in ftplugin * runtime(termdebug): allow to use decimal signs * translation(it): Updated Italian vimtutor * runtime(compiler): improve cppcheck * git: git-blame-ignore-revs shown as an error on Github * 9.1.0847: tests: test_popupwin fails because of updated help file * 9.1.0846: debug symbols for xxd are not cleaned in Makefile * runtime(structurizr): Update structurizr syntax * runtime(8th): updated 8th syntax * runtime(doc): Add pi_tutor.txt to help TOC * runtime(compiler): add mypy and ruff compiler; update pylint linter * runtime(netrw): fix several bugs in netrw tree listing * runtime(netrw): prevent polluting the search history * 9.1.0845: vimtutor shell script can be improved * 9.1.0844: if_python: no way to pass local vars to python * 9.1.0843: too many strlen() calls in undo.c * runtime(doc): update default value for fillchars option * runtime(compiler): fix typo in cppcheck compiler plugin * runtime(doc): simplify vimtutor manpage a bit more * runtime(matchparen): Add matchparen_disable_cursor_hl config option * 9.1.0842: not checking for the sync() systemcall * 9.1.0841: tests: still preferring python2 over python3 * 9.1.0840: filetype: idris2 files are not recognized * 9.1.0839: filetype: leo files are not recognized * runtime(cook): include cook filetype plugin * runtime(debversions): Update Debian versions * patch 9.1.0838: vimtutor is bash-specific * runtime(doc): add help specific modeline to pi_tutor.txt * Filelist: vimtutor chapter 2 is missing in Filelist * 9.1.0837: cross-compiling has some issues * runtime(vimtutor): Add a second chapter Package zypper was updated: - Annonunce --root in commands not launching a Target (bsc#1237044) - BuildRequires: libzypp-devel &gt;= 17.36.3. - version 1.14.85 - Let zypper dup fail in case of (temporarily) unaccessible repos (bsc#1228434, bsc#1236939, fixes #446) - version 1.14.84 - New system-architecture command (bsc#1236384) Prints the detected system architecture. - version 1.14.83 - requires: libzypp &gt;= 17.36.0. - Change versioncmp command to return exit code according to the comparison result (#593) - version 1.14.82 The CVRF data is provided by SUSE under the Creative Commons License 4.0 with Attribution (CC-BY-4.0). https://publiccloudimagechangeinfo.suse.com/google/sles-15-sp5-sap-v20250408-x86-64/ Public Cloud Image Info https://www.suse.com/support/security/rating/ SUSE Security Ratings Public Cloud Image google/sles-15-sp5-sap-v20250408-x86-64 HANA-Firewall-2.0.4-150000.3.12.1 apparmor-abstractions-3.0.4-150500.11.12.2 apparmor-parser-3.0.4-150500.11.12.2 ca-certificates-mozilla-2.74-150200.38.1 cluster-md-kmp-default-5.14.21-150500.55.97.1 corosync-2.4.6-150300.12.13.1 corosync-qdevice-2.4.6-150300.12.13.1 crmsh-4.5.1+20250207.2c89797-150500.3.45.2 crmsh-scripts-4.5.1+20250207.2c89797-150500.3.45.2 dlm-kmp-default-5.14.21-150500.55.97.1 docker-27.5.1_ce-150000.218.1 gfs2-kmp-default-5.14.21-150500.55.97.1 gnutls-3.7.3-150400.4.47.1 google-cloud-sap-agent-3.6-150100.3.44.1 google-guest-agent-20250327.01-150000.1.60.1 google-guest-oslogin-20240311.00-150000.1.48.1 google-osconfig-agent-20250115.01-150000.1.47.1 grub2-2.06-150500.29.46.2 grub2-i386-pc-2.06-150500.29.46.2 grub2-x86_64-efi-2.06-150500.29.46.2 hawk2-2.6.6+git.1742310530.bfcd0e2c-150000.3.59.1 hwinfo-21.87-150500.3.6.1 kdump-1.0.2+git48.g64445e1-150500.3.9.2 kernel-default-5.14.21-150500.55.97.1 libX11-6-1.6.5-150000.3.36.1 libX11-data-1.6.5-150000.3.36.1 libX11-xcb1-1.6.5-150000.3.36.1 libapparmor1-3.0.4-150500.11.12.2 libcfg6-2.4.6-150300.12.13.1 libcmap4-2.4.6-150300.12.13.1 libcorosync_common4-2.4.6-150300.12.13.1 libcpg4-2.4.6-150300.12.13.1 libfreebl3-3.101.2-150400.3.54.1 libfreetype6-2.10.4-150000.4.18.1 libgnutls30-3.7.3-150400.4.47.1 libprocps8-3.3.17-150000.7.42.1 libpython3_6m1_0-3.6.15-150300.10.84.1 libquorum5-2.4.6-150300.12.13.1 libruby2_5-2_5-2.5.9-150000.4.36.1 libsam4-2.4.6-150300.12.13.1 libsnmp40-5.9.4-150300.15.16.1 libsoftokn3-3.101.2-150400.3.54.1 libtotem_pg5-2.4.6-150300.12.13.1 libvotequorum8-2.4.6-150300.12.13.1 libxkbfile1-1.0.9-150000.3.3.1 libxml2-2-2.10.3-150500.5.23.1 libxml2-tools-2.10.3-150500.5.23.1 libxslt1-1.1.34-150400.3.6.1 libzypp-17.36.3-150500.6.42.1 lifecycle-data-sle-module-live-patching-15-150000.4.123.1 mozilla-nss-3.101.2-150400.3.54.1 mozilla-nss-certs-3.101.2-150400.3.54.1 mozilla-nss-tools-3.101.2-150400.3.54.1 net-snmp-5.9.4-150300.15.16.1 ocfs2-kmp-default-5.14.21-150500.55.97.1 perl-SNMP-5.9.4-150300.15.16.1 perl-Term-ReadKey-2.37-150000.3.2.1 procps-3.3.17-150000.7.42.1 python-instance-billing-flavor-check-1.0.0-150000.1.20.1 python3-3.6.15-150300.10.84.1 python3-M2Crypto-0.44.0-150400.13.1 python3-base-3.6.15-150300.10.84.1 python3-curses-3.6.15-150300.10.84.1 python3-zypp-plugin-0.6.5-150500.16.5.1 rsync-3.2.3-150400.3.23.3 ruby2.5-2.5.9-150000.4.36.1 ruby2.5-rubygem-rack-2.0.8-150000.3.26.1 ruby2.5-stdlib-2.5.9-150000.4.36.1 saptune-3.1.5-150400.15.19.2 snmp-mibs-5.9.4-150300.15.16.1 suse-build-key-12.0-150000.8.58.1 tcsh-6.20.00-150000.4.18.2 timezone-2025a-150000.75.31.1 vim-9.1.1176-150500.20.24.2 vim-data-common-9.1.1176-150500.20.24.2 zypper-1.14.85-150500.6.26.1 HANA-Firewall-2.0.4-150000.3.12.1 as a component of Public Cloud Image google/sles-15-sp5-sap-v20250408-x86-64 apparmor-abstractions-3.0.4-150500.11.12.2 as a component of Public Cloud Image google/sles-15-sp5-sap-v20250408-x86-64 apparmor-parser-3.0.4-150500.11.12.2 as a component of Public Cloud Image google/sles-15-sp5-sap-v20250408-x86-64 ca-certificates-mozilla-2.74-150200.38.1 as a component of Public Cloud Image google/sles-15-sp5-sap-v20250408-x86-64 cluster-md-kmp-default-5.14.21-150500.55.97.1 as a component of Public Cloud Image google/sles-15-sp5-sap-v20250408-x86-64 corosync-2.4.6-150300.12.13.1 as a component of Public Cloud Image google/sles-15-sp5-sap-v20250408-x86-64 corosync-qdevice-2.4.6-150300.12.13.1 as a component of Public Cloud Image google/sles-15-sp5-sap-v20250408-x86-64 crmsh-4.5.1+20250207.2c89797-150500.3.45.2 as a component of Public Cloud Image google/sles-15-sp5-sap-v20250408-x86-64 crmsh-scripts-4.5.1+20250207.2c89797-150500.3.45.2 as a component of Public Cloud Image google/sles-15-sp5-sap-v20250408-x86-64 dlm-kmp-default-5.14.21-150500.55.97.1 as a component of Public Cloud Image google/sles-15-sp5-sap-v20250408-x86-64 docker-27.5.1_ce-150000.218.1 as a component of Public Cloud Image google/sles-15-sp5-sap-v20250408-x86-64 gfs2-kmp-default-5.14.21-150500.55.97.1 as a component of Public Cloud Image google/sles-15-sp5-sap-v20250408-x86-64 gnutls-3.7.3-150400.4.47.1 as a component of Public Cloud Image google/sles-15-sp5-sap-v20250408-x86-64 google-cloud-sap-agent-3.6-150100.3.44.1 as a component of Public Cloud Image google/sles-15-sp5-sap-v20250408-x86-64 google-guest-agent-20250327.01-150000.1.60.1 as a component of Public Cloud Image google/sles-15-sp5-sap-v20250408-x86-64 google-guest-oslogin-20240311.00-150000.1.48.1 as a component of Public Cloud Image google/sles-15-sp5-sap-v20250408-x86-64 google-osconfig-agent-20250115.01-150000.1.47.1 as a component of Public Cloud Image google/sles-15-sp5-sap-v20250408-x86-64 grub2-2.06-150500.29.46.2 as a component of Public Cloud Image google/sles-15-sp5-sap-v20250408-x86-64 grub2-i386-pc-2.06-150500.29.46.2 as a component of Public Cloud Image google/sles-15-sp5-sap-v20250408-x86-64 grub2-x86_64-efi-2.06-150500.29.46.2 as a component of Public Cloud Image google/sles-15-sp5-sap-v20250408-x86-64 hawk2-2.6.6+git.1742310530.bfcd0e2c-150000.3.59.1 as a component of Public Cloud Image google/sles-15-sp5-sap-v20250408-x86-64 hwinfo-21.87-150500.3.6.1 as a component of Public Cloud Image google/sles-15-sp5-sap-v20250408-x86-64 kdump-1.0.2+git48.g64445e1-150500.3.9.2 as a component of Public Cloud Image google/sles-15-sp5-sap-v20250408-x86-64 kernel-default-5.14.21-150500.55.97.1 as a component of Public Cloud Image google/sles-15-sp5-sap-v20250408-x86-64 libX11-6-1.6.5-150000.3.36.1 as a component of Public Cloud Image google/sles-15-sp5-sap-v20250408-x86-64 libX11-data-1.6.5-150000.3.36.1 as a component of Public Cloud Image google/sles-15-sp5-sap-v20250408-x86-64 libX11-xcb1-1.6.5-150000.3.36.1 as a component of Public Cloud Image google/sles-15-sp5-sap-v20250408-x86-64 libapparmor1-3.0.4-150500.11.12.2 as a component of Public Cloud Image google/sles-15-sp5-sap-v20250408-x86-64 libcfg6-2.4.6-150300.12.13.1 as a component of Public Cloud Image google/sles-15-sp5-sap-v20250408-x86-64 libcmap4-2.4.6-150300.12.13.1 as a component of Public Cloud Image google/sles-15-sp5-sap-v20250408-x86-64 libcorosync_common4-2.4.6-150300.12.13.1 as a component of Public Cloud Image google/sles-15-sp5-sap-v20250408-x86-64 libcpg4-2.4.6-150300.12.13.1 as a component of Public Cloud Image google/sles-15-sp5-sap-v20250408-x86-64 libfreebl3-3.101.2-150400.3.54.1 as a component of Public Cloud Image google/sles-15-sp5-sap-v20250408-x86-64 libfreetype6-2.10.4-150000.4.18.1 as a component of Public Cloud Image google/sles-15-sp5-sap-v20250408-x86-64 libgnutls30-3.7.3-150400.4.47.1 as a component of Public Cloud Image google/sles-15-sp5-sap-v20250408-x86-64 libprocps8-3.3.17-150000.7.42.1 as a component of Public Cloud Image google/sles-15-sp5-sap-v20250408-x86-64 libpython3_6m1_0-3.6.15-150300.10.84.1 as a component of Public Cloud Image google/sles-15-sp5-sap-v20250408-x86-64 libquorum5-2.4.6-150300.12.13.1 as a component of Public Cloud Image google/sles-15-sp5-sap-v20250408-x86-64 libruby2_5-2_5-2.5.9-150000.4.36.1 as a component of Public Cloud Image google/sles-15-sp5-sap-v20250408-x86-64 libsam4-2.4.6-150300.12.13.1 as a component of Public Cloud Image google/sles-15-sp5-sap-v20250408-x86-64 libsnmp40-5.9.4-150300.15.16.1 as a component of Public Cloud Image google/sles-15-sp5-sap-v20250408-x86-64 libsoftokn3-3.101.2-150400.3.54.1 as a component of Public Cloud Image google/sles-15-sp5-sap-v20250408-x86-64 libtotem_pg5-2.4.6-150300.12.13.1 as a component of Public Cloud Image google/sles-15-sp5-sap-v20250408-x86-64 libvotequorum8-2.4.6-150300.12.13.1 as a component of Public Cloud Image google/sles-15-sp5-sap-v20250408-x86-64 libxkbfile1-1.0.9-150000.3.3.1 as a component of Public Cloud Image google/sles-15-sp5-sap-v20250408-x86-64 libxml2-2-2.10.3-150500.5.23.1 as a component of Public Cloud Image google/sles-15-sp5-sap-v20250408-x86-64 libxml2-tools-2.10.3-150500.5.23.1 as a component of Public Cloud Image google/sles-15-sp5-sap-v20250408-x86-64 libxslt1-1.1.34-150400.3.6.1 as a component of Public Cloud Image google/sles-15-sp5-sap-v20250408-x86-64 libzypp-17.36.3-150500.6.42.1 as a component of Public Cloud Image google/sles-15-sp5-sap-v20250408-x86-64 lifecycle-data-sle-module-live-patching-15-150000.4.123.1 as a component of Public Cloud Image google/sles-15-sp5-sap-v20250408-x86-64 mozilla-nss-3.101.2-150400.3.54.1 as a component of Public Cloud Image google/sles-15-sp5-sap-v20250408-x86-64 mozilla-nss-certs-3.101.2-150400.3.54.1 as a component of Public Cloud Image google/sles-15-sp5-sap-v20250408-x86-64 mozilla-nss-tools-3.101.2-150400.3.54.1 as a component of Public Cloud Image google/sles-15-sp5-sap-v20250408-x86-64 net-snmp-5.9.4-150300.15.16.1 as a component of Public Cloud Image google/sles-15-sp5-sap-v20250408-x86-64 ocfs2-kmp-default-5.14.21-150500.55.97.1 as a component of Public Cloud Image google/sles-15-sp5-sap-v20250408-x86-64 perl-SNMP-5.9.4-150300.15.16.1 as a component of Public Cloud Image google/sles-15-sp5-sap-v20250408-x86-64 perl-Term-ReadKey-2.37-150000.3.2.1 as a component of Public Cloud Image google/sles-15-sp5-sap-v20250408-x86-64 procps-3.3.17-150000.7.42.1 as a component of Public Cloud Image google/sles-15-sp5-sap-v20250408-x86-64 python-instance-billing-flavor-check-1.0.0-150000.1.20.1 as a component of Public Cloud Image google/sles-15-sp5-sap-v20250408-x86-64 python3-3.6.15-150300.10.84.1 as a component of Public Cloud Image google/sles-15-sp5-sap-v20250408-x86-64 python3-M2Crypto-0.44.0-150400.13.1 as a component of Public Cloud Image google/sles-15-sp5-sap-v20250408-x86-64 python3-base-3.6.15-150300.10.84.1 as a component of Public Cloud Image google/sles-15-sp5-sap-v20250408-x86-64 python3-curses-3.6.15-150300.10.84.1 as a component of Public Cloud Image google/sles-15-sp5-sap-v20250408-x86-64 python3-zypp-plugin-0.6.5-150500.16.5.1 as a component of Public Cloud Image google/sles-15-sp5-sap-v20250408-x86-64 rsync-3.2.3-150400.3.23.3 as a component of Public Cloud Image google/sles-15-sp5-sap-v20250408-x86-64 ruby2.5-2.5.9-150000.4.36.1 as a component of Public Cloud Image google/sles-15-sp5-sap-v20250408-x86-64 ruby2.5-rubygem-rack-2.0.8-150000.3.26.1 as a component of Public Cloud Image google/sles-15-sp5-sap-v20250408-x86-64 ruby2.5-stdlib-2.5.9-150000.4.36.1 as a component of Public Cloud Image google/sles-15-sp5-sap-v20250408-x86-64 saptune-3.1.5-150400.15.19.2 as a component of Public Cloud Image google/sles-15-sp5-sap-v20250408-x86-64 snmp-mibs-5.9.4-150300.15.16.1 as a component of Public Cloud Image google/sles-15-sp5-sap-v20250408-x86-64 suse-build-key-12.0-150000.8.58.1 as a component of Public Cloud Image google/sles-15-sp5-sap-v20250408-x86-64 tcsh-6.20.00-150000.4.18.2 as a component of Public Cloud Image google/sles-15-sp5-sap-v20250408-x86-64 timezone-2025a-150000.75.31.1 as a component of Public Cloud Image google/sles-15-sp5-sap-v20250408-x86-64 vim-9.1.1176-150500.20.24.2 as a component of Public Cloud Image google/sles-15-sp5-sap-v20250408-x86-64 vim-data-common-9.1.1176-150500.20.24.2 as a component of Public Cloud Image google/sles-15-sp5-sap-v20250408-x86-64 zypper-1.14.85-150500.6.26.1 as a component of Public Cloud Image google/sles-15-sp5-sap-v20250408-x86-64 In the Linux kernel, the following vulnerability has been resolved: mm/mempolicy: fix mpol_new leak in shared_policy_replace If mpol_new is allocated but not used in restart loop, mpol_new will be freed via mpol_put before returning to the caller. But refcnt is not initialized yet, so mpol_put could not do the right things and might leak the unused mpol_new. This would happen if mempolicy was updated on the shared shmem file while the sp->lock has been dropped during the memory allocation. This issue could be triggered easily with the below code snippet if there are many processes doing the below work at the same time: shmid = shmget((key_t)5566, 1024 * PAGE_SIZE, 0666|IPC_CREAT); shm = shmat(shmid, 0, 0); loop many times { mbind(shm, 1024 * PAGE_SIZE, MPOL_LOCAL, mask, maxnode, 0); mbind(shm + 128 * PAGE_SIZE, 128 * PAGE_SIZE, MPOL_DEFAULT, mask, maxnode, 0); } CVE-2022-49080 Public Cloud Image google/sles-15-sp5-sap-v20250408-x86-64:cluster-md-kmp-default-5.14.21-150500.55.97.1 Public Cloud Image google/sles-15-sp5-sap-v20250408-x86-64:dlm-kmp-default-5.14.21-150500.55.97.1 Public Cloud Image google/sles-15-sp5-sap-v20250408-x86-64:gfs2-kmp-default-5.14.21-150500.55.97.1 Public Cloud Image google/sles-15-sp5-sap-v20250408-x86-64:kernel-default-5.14.21-150500.55.97.1 Public Cloud Image google/sles-15-sp5-sap-v20250408-x86-64:ocfs2-kmp-default-5.14.21-150500.55.97.1 important A use-after-free flaw was found in smb2_is_status_io_timeout() in CIFS in the Linux Kernel. After CIFS transfers response data to a system call, there are still local variable points to the memory region, and if the system call frees it faster than CIFS uses it, CIFS will access a free memory region, leading to a denial of service. CVE-2023-1192 Public Cloud Image google/sles-15-sp5-sap-v20250408-x86-64:cluster-md-kmp-default-5.14.21-150500.55.97.1 Public Cloud Image google/sles-15-sp5-sap-v20250408-x86-64:dlm-kmp-default-5.14.21-150500.55.97.1 Public Cloud Image google/sles-15-sp5-sap-v20250408-x86-64:gfs2-kmp-default-5.14.21-150500.55.97.1 Public Cloud Image google/sles-15-sp5-sap-v20250408-x86-64:kernel-default-5.14.21-150500.55.97.1 Public Cloud Image google/sles-15-sp5-sap-v20250408-x86-64:ocfs2-kmp-default-5.14.21-150500.55.97.1 moderate Under some circumstances, this weakness allows a user who has access to run the "ps" utility on a machine, the ability to write almost unlimited amounts of unfiltered data into the process heap. CVE-2023-4016 Public Cloud Image google/sles-15-sp5-sap-v20250408-x86-64:libprocps8-3.3.17-150000.7.42.1 Public Cloud Image google/sles-15-sp5-sap-v20250408-x86-64:procps-3.3.17-150000.7.42.1 low The issue was addressed with improved memory handling. This issue is fixed in macOS Ventura 13.6, tvOS 17, iOS 16.7 and iPadOS 16.7, macOS Monterey 12.7, watchOS 10, iOS 17 and iPadOS 17, macOS Sonoma 14. Processing web content may disclose sensitive information. CVE-2023-40403 Public Cloud Image google/sles-15-sp5-sap-v20250408-x86-64:libxslt1-1.1.34-150400.3.6.1 moderate A vulnerability was found in PAM. The secret information is stored in memory, where the attacker can trigger the victim program to execute by sending characters to its standard input (stdin). As this occurs, the attacker can train the branch predictor to execute an ROP chain speculatively. This flaw could result in leaked passwords, such as those found in /etc/shadow while performing authentications. CVE-2024-10041 Public Cloud Image google/sles-15-sp5-sap-v20250408-x86-64:apparmor-abstractions-3.0.4-150500.11.12.2 Public Cloud Image google/sles-15-sp5-sap-v20250408-x86-64:apparmor-parser-3.0.4-150500.11.12.2 Public Cloud Image google/sles-15-sp5-sap-v20250408-x86-64:libapparmor1-3.0.4-150500.11.12.2 moderate The urllib.parse.urlsplit() and urlparse() functions improperly validated bracketed hosts (`[]`), allowing hosts that weren't IPv6 or IPvFuture. This behavior was not conformant to RFC 3986 and potentially enabled SSRF if a URL is processed by more than one URL parser. CVE-2024-11168 Public Cloud Image google/sles-15-sp5-sap-v20250408-x86-64:python3-3.6.15-150300.10.84.1 Public Cloud Image google/sles-15-sp5-sap-v20250408-x86-64:python3-curses-3.6.15-150300.10.84.1 low A flaw was found in GnuTLS, which relies on libtasn1 for ASN.1 data processing. Due to an inefficient algorithm in libtasn1, decoding certain DER-encoded certificate data can take excessive time, leading to increased resource consumption. This flaw allows a remote attacker to send a specially crafted certificate, causing GnuTLS to become unresponsive or slow, resulting in a denial-of-service condition. CVE-2024-12243 Public Cloud Image google/sles-15-sp5-sap-v20250408-x86-64:gnutls-3.7.3-150400.4.47.1 Public Cloud Image google/sles-15-sp5-sap-v20250408-x86-64:libgnutls30-3.7.3-150400.4.47.1 moderate Vim is an open source command line text editor. When performing a search and displaying the search-count message is disabled (:set shm+=S), the search pattern is displayed at the bottom of the screen in a buffer (msgbuf). When right-left mode (:set rl) is enabled, the search pattern is reversed. This happens by allocating a new buffer. If the search pattern contains some ASCII NUL characters, the buffer allocated will be smaller than the original allocated buffer (because for allocating the reversed buffer, the strlen() function is called, which only counts until it notices an ASCII NUL byte ) and thus the original length indicator is wrong. This causes an overflow when accessing characters inside the msgbuf by the previously (now wrong) length of the msgbuf. The issue has been fixed as of Vim patch v9.1.0689. CVE-2024-43790 Public Cloud Image google/sles-15-sp5-sap-v20250408-x86-64:vim-9.1.1176-150500.20.24.2 Public Cloud Image google/sles-15-sp5-sap-v20250408-x86-64:vim-data-common-9.1.1176-150500.20.24.2 moderate Vim is an improved version of the unix vi text editor. When flushing the typeahead buffer, Vim moves the current position in the typeahead buffer but does not check whether there is enough space left in the buffer to handle the next characters. So this may lead to the tb_off position within the typebuf variable to point outside of the valid buffer size, which can then later lead to a heap-buffer overflow in e.g. ins_typebuf(). Therefore, when flushing the typeahead buffer, check if there is enough space left before advancing the off position. If not, fall back to flush current typebuf contents. It's not quite clear yet, what can lead to this situation. It seems to happen when error messages occur (which will cause Vim to flush the typeahead buffer) in comnination with several long mappgins and so it may eventually move the off position out of a valid buffer size. Impact is low since it is not easily reproducible and requires to have several mappings active and run into some error condition. But when this happens, this will cause a crash. The issue has been fixed as of Vim patch v9.1.0697. Users are advised to upgrade. There are no known workarounds for this issue. CVE-2024-43802 Public Cloud Image google/sles-15-sp5-sap-v20250408-x86-64:vim-9.1.1176-150500.20.24.2 Public Cloud Image google/sles-15-sp5-sap-v20250408-x86-64:vim-data-common-9.1.1176-150500.20.24.2 moderate Vim is an open source, command line text editor. Patch v9.1.0038 optimized how the cursor position is calculated and removed a loop, that verified that the cursor position always points inside a line and does not become invalid by pointing beyond the end of a line. Back then we assumed this loop is unnecessary. However, this change made it possible that the cursor position stays invalid and points beyond the end of a line, which would eventually cause a heap-buffer-overflow when trying to access the line pointer at the specified cursor position. It's not quite clear yet, what can lead to this situation that the cursor points to an invalid position. That's why patch v9.1.0707 does not include a test case. The only observed impact has been a program crash. This issue has been addressed in with the patch v9.1.0707. All users are advised to upgrade. CVE-2024-45306 Public Cloud Image google/sles-15-sp5-sap-v20250408-x86-64:vim-9.1.1176-150500.20.24.2 Public Cloud Image google/sles-15-sp5-sap-v20250408-x86-64:vim-data-common-9.1.1176-150500.20.24.2 moderate Applications and libraries which misuse connection.serverAuthenticate (via callback field ServerConfig.PublicKeyCallback) may be susceptible to an authorization bypass. The documentation for ServerConfig.PublicKeyCallback says that "A call to this function does not guarantee that the key offered is in fact used to authenticate." Specifically, the SSH protocol allows clients to inquire about whether a public key is acceptable before proving control of the corresponding private key. PublicKeyCallback may be called with multiple keys, and the order in which the keys were provided cannot be used to infer which key the client successfully authenticated with, if any. Some applications, which store the key(s) passed to PublicKeyCallback (or derived information) and make security relevant determinations based on it once the connection is established, may make incorrect assumptions. For example, an attacker may send public keys A and B, and then authenticate with A. PublicKeyCallback would be called only twice, first with A and then with B. A vulnerable application may then make authorization decisions based on key B for which the attacker does not actually control the private key. Since this API is widely misused, as a partial mitigation golang.org/x/cry...@v0.31.0 enforces the property that, when successfully authenticating via public key, the last key passed to ServerConfig.PublicKeyCallback will be the key used to authenticate the connection. PublicKeyCallback will now be called multiple times with the same key, if necessary. Note that the client may still not control the last key passed to PublicKeyCallback if the connection is then authenticated with a different method, such as PasswordCallback, KeyboardInteractiveCallback, or NoClientAuth. Users should be using the Extensions field of the Permissions return value from the various authentication callbacks to record data associated with the authentication attempt instead of referencing external state. Once the connection is established the state corresponding to the successful authentication attempt can be retrieved via the ServerConn.Permissions field. Note that some third-party libraries misuse the Permissions type by sharing it across authentication attempts; users of third-party libraries should refer to the relevant projects for guidance. CVE-2024-45337 Public Cloud Image google/sles-15-sp5-sap-v20250408-x86-64:google-guest-agent-20250327.01-150000.1.60.1 important When logs are written to a widely-writable directory (the default), an unprivileged attacker may predict a privileged process's log file path and pre-create a symbolic link to a sensitive file in its place. When that privileged process runs, it will follow the planted symlink and overwrite that sensitive file. To fix that, glog now causes the program to exit (with status code 2) when it finds that the configured log file already exists. CVE-2024-45339 Public Cloud Image google/sles-15-sp5-sap-v20250408-x86-64:google-osconfig-agent-20250115.01-150000.1.47.1 important An issue was discovered in the WEBrick toolkit through 1.8.1 for Ruby. It allows HTTP request smuggling by providing both a Content-Length header and a Transfer-Encoding header, e.g., "GET /admin HTTP/1.1\r\n" inside of a "POST /user HTTP/1.1\r\n" request. NOTE: the supplier's position is "Webrick should not be used in production." CVE-2024-47220 Public Cloud Image google/sles-15-sp5-sap-v20250408-x86-64:libruby2_5-2_5-2.5.9-150000.4.36.1 Public Cloud Image google/sles-15-sp5-sap-v20250408-x86-64:ruby2.5-2.5.9-150000.4.36.1 Public Cloud Image google/sles-15-sp5-sap-v20250408-x86-64:ruby2.5-stdlib-2.5.9-150000.4.36.1 important REXML is an XML toolkit for Ruby. The REXML gem before 3.3.9 has a ReDoS vulnerability when it parses an XML that has many digits between &# and x...; in a hex numeric character reference (&#x...;). This does not happen with Ruby 3.2 or later. Ruby 3.1 is the only affected maintained Ruby. The REXML gem 3.3.9 or later include the patch to fix the vulnerability. CVE-2024-49761 Public Cloud Image google/sles-15-sp5-sap-v20250408-x86-64:libruby2_5-2_5-2.5.9-150000.4.36.1 Public Cloud Image google/sles-15-sp5-sap-v20250408-x86-64:ruby2.5-2.5.9-150000.4.36.1 Public Cloud Image google/sles-15-sp5-sap-v20250408-x86-64:ruby2.5-stdlib-2.5.9-150000.4.36.1 moderate In the Linux kernel, the following vulnerability has been resolved: KVM: nSVM: Ignore nCR3[4:0] when loading PDPTEs from memory Ignore nCR3[4:0] when loading PDPTEs from memory for nested SVM, as bits 4:0 of CR3 are ignored when PAE paging is used, and thus VMRUN doesn't enforce 32-byte alignment of nCR3. In the absolute worst case scenario, failure to ignore bits 4:0 can result in an out-of-bounds read, e.g. if the target page is at the end of a memslot, and the VMM isn't using guard pages. Per the APM: The CR3 register points to the base address of the page-directory-pointer table. The page-directory-pointer table is aligned on a 32-byte boundary, with the low 5 address bits 4:0 assumed to be 0. And the SDM's much more explicit: 4:0 Ignored Note, KVM gets this right when loading PDPTRs, it's only the nSVM flow that is broken. CVE-2024-50115 Public Cloud Image google/sles-15-sp5-sap-v20250408-x86-64:cluster-md-kmp-default-5.14.21-150500.55.97.1 Public Cloud Image google/sles-15-sp5-sap-v20250408-x86-64:dlm-kmp-default-5.14.21-150500.55.97.1 Public Cloud Image google/sles-15-sp5-sap-v20250408-x86-64:gfs2-kmp-default-5.14.21-150500.55.97.1 Public Cloud Image google/sles-15-sp5-sap-v20250408-x86-64:kernel-default-5.14.21-150500.55.97.1 Public Cloud Image google/sles-15-sp5-sap-v20250408-x86-64:ocfs2-kmp-default-5.14.21-150500.55.97.1 important In the Linux kernel, the following vulnerability has been resolved: KVM: VMX: Bury Intel PT virtualization (guest/host mode) behind CONFIG_BROKEN Hide KVM's pt_mode module param behind CONFIG_BROKEN, i.e. disable support for virtualizing Intel PT via guest/host mode unless BROKEN=y. There are myriad bugs in the implementation, some of which are fatal to the guest, and others which put the stability and health of the host at risk. For guest fatalities, the most glaring issue is that KVM fails to ensure tracing is disabled, and *stays* disabled prior to VM-Enter, which is necessary as hardware disallows loading (the guest's) RTIT_CTL if tracing is enabled (enforced via a VMX consistency check). Per the SDM: If the logical processor is operating with Intel PT enabled (if IA32_RTIT_CTL.TraceEn = 1) at the time of VM entry, the "load IA32_RTIT_CTL" VM-entry control must be 0. On the host side, KVM doesn't validate the guest CPUID configuration provided by userspace, and even worse, uses the guest configuration to decide what MSRs to save/load at VM-Enter and VM-Exit. E.g. configuring guest CPUID to enumerate more address ranges than are supported in hardware will result in KVM trying to passthrough, save, and load non-existent MSRs, which generates a variety of WARNs, ToPA ERRORs in the host, a potential deadlock, etc. CVE-2024-53135 Public Cloud Image google/sles-15-sp5-sap-v20250408-x86-64:cluster-md-kmp-default-5.14.21-150500.55.97.1 Public Cloud Image google/sles-15-sp5-sap-v20250408-x86-64:dlm-kmp-default-5.14.21-150500.55.97.1 Public Cloud Image google/sles-15-sp5-sap-v20250408-x86-64:gfs2-kmp-default-5.14.21-150500.55.97.1 Public Cloud Image google/sles-15-sp5-sap-v20250408-x86-64:kernel-default-5.14.21-150500.55.97.1 Public Cloud Image google/sles-15-sp5-sap-v20250408-x86-64:ocfs2-kmp-default-5.14.21-150500.55.97.1 moderate In the Linux kernel, the following vulnerability has been resolved: NFSv4.0: Fix a use-after-free problem in the asynchronous open() Yang Erkun reports that when two threads are opening files at the same time, and are forced to abort before a reply is seen, then the call to nfs_release_seqid() in nfs4_opendata_free() can result in a use-after-free of the pointer to the defunct rpc task of the other thread. The fix is to ensure that if the RPC call is aborted before the call to nfs_wait_on_sequence() is complete, then we must call nfs_release_seqid() in nfs4_open_release() before the rpc_task is freed. CVE-2024-53173 Public Cloud Image google/sles-15-sp5-sap-v20250408-x86-64:cluster-md-kmp-default-5.14.21-150500.55.97.1 Public Cloud Image google/sles-15-sp5-sap-v20250408-x86-64:dlm-kmp-default-5.14.21-150500.55.97.1 Public Cloud Image google/sles-15-sp5-sap-v20250408-x86-64:gfs2-kmp-default-5.14.21-150500.55.97.1 Public Cloud Image google/sles-15-sp5-sap-v20250408-x86-64:kernel-default-5.14.21-150500.55.97.1 Public Cloud Image google/sles-15-sp5-sap-v20250408-x86-64:ocfs2-kmp-default-5.14.21-150500.55.97.1 important In the Linux kernel, the following vulnerability has been resolved: RDMA/hns: Fix NULL pointer derefernce in hns_roce_map_mr_sg() ib_map_mr_sg() allows ULPs to specify NULL as the sg_offset argument. The driver needs to check whether it is a NULL pointer before dereferencing it. CVE-2024-53226 Public Cloud Image google/sles-15-sp5-sap-v20250408-x86-64:cluster-md-kmp-default-5.14.21-150500.55.97.1 Public Cloud Image google/sles-15-sp5-sap-v20250408-x86-64:dlm-kmp-default-5.14.21-150500.55.97.1 Public Cloud Image google/sles-15-sp5-sap-v20250408-x86-64:gfs2-kmp-default-5.14.21-150500.55.97.1 Public Cloud Image google/sles-15-sp5-sap-v20250408-x86-64:kernel-default-5.14.21-150500.55.97.1 Public Cloud Image google/sles-15-sp5-sap-v20250408-x86-64:ocfs2-kmp-default-5.14.21-150500.55.97.1 moderate In the Linux kernel, the following vulnerability has been resolved: ALSA: 6fire: Release resources at card release The current 6fire code tries to release the resources right after the call of usb6fire_chip_abort(). But at this moment, the card object might be still in use (as we're calling snd_card_free_when_closed()). For avoid potential UAFs, move the release of resources to the card's private_free instead of the manual call of usb6fire_chip_destroy() at the USB disconnect callback. CVE-2024-53239 Public Cloud Image google/sles-15-sp5-sap-v20250408-x86-64:cluster-md-kmp-default-5.14.21-150500.55.97.1 Public Cloud Image google/sles-15-sp5-sap-v20250408-x86-64:dlm-kmp-default-5.14.21-150500.55.97.1 Public Cloud Image google/sles-15-sp5-sap-v20250408-x86-64:gfs2-kmp-default-5.14.21-150500.55.97.1 Public Cloud Image google/sles-15-sp5-sap-v20250408-x86-64:kernel-default-5.14.21-150500.55.97.1 Public Cloud Image google/sles-15-sp5-sap-v20250408-x86-64:ocfs2-kmp-default-5.14.21-150500.55.97.1 important xsltGetInheritedNsList in libxslt before 1.1.43 has a use-after-free issue related to exclusion of result prefixes. CVE-2024-55549 Public Cloud Image google/sles-15-sp5-sap-v20250408-x86-64:libxslt1-1.1.34-150400.3.6.1 important libxml2 before 2.12.10 and 2.13.x before 2.13.6 has a use-after-free in xmlSchemaIDCFillNodeTables and xmlSchemaBubbleIDCNodeTables in xmlschemas.c. To exploit this, a crafted XML document must be validated against an XML schema with certain identity constraints, or a crafted XML schema must be used. CVE-2024-56171 Public Cloud Image google/sles-15-sp5-sap-v20250408-x86-64:libxml2-2-2.10.3-150500.5.23.1 Public Cloud Image google/sles-15-sp5-sap-v20250408-x86-64:libxml2-tools-2.10.3-150500.5.23.1 important In the Linux kernel, the following vulnerability has been resolved: wifi: mwifiex: Fix memcpy() field-spanning write warning in mwifiex_config_scan() Replace one-element array with a flexible-array member in `struct mwifiex_ie_types_wildcard_ssid_params` to fix the following warning on a MT8173 Chromebook (mt8173-elm-hana): [ 356.775250] ------------[ cut here ]------------ [ 356.784543] memcpy: detected field-spanning write (size 6) of single field "wildcard_ssid_tlv->ssid" at drivers/net/wireless/marvell/mwifiex/scan.c:904 (size 1) [ 356.813403] WARNING: CPU: 3 PID: 742 at drivers/net/wireless/marvell/mwifiex/scan.c:904 mwifiex_scan_networks+0x4fc/0xf28 [mwifiex] The "(size 6)" above is exactly the length of the SSID of the network this device was connected to. The source of the warning looks like: ssid_len = user_scan_in->ssid_list[i].ssid_len; [...] memcpy(wildcard_ssid_tlv->ssid, user_scan_in->ssid_list[i].ssid, ssid_len); There is a #define WILDCARD_SSID_TLV_MAX_SIZE that uses sizeof() on this struct, but it already didn't account for the size of the one-element array, so it doesn't need to be changed. CVE-2024-56539 Public Cloud Image google/sles-15-sp5-sap-v20250408-x86-64:cluster-md-kmp-default-5.14.21-150500.55.97.1 Public Cloud Image google/sles-15-sp5-sap-v20250408-x86-64:dlm-kmp-default-5.14.21-150500.55.97.1 Public Cloud Image google/sles-15-sp5-sap-v20250408-x86-64:gfs2-kmp-default-5.14.21-150500.55.97.1 Public Cloud Image google/sles-15-sp5-sap-v20250408-x86-64:kernel-default-5.14.21-150500.55.97.1 Public Cloud Image google/sles-15-sp5-sap-v20250408-x86-64:ocfs2-kmp-default-5.14.21-150500.55.97.1 important In the Linux kernel, the following vulnerability has been resolved: hfsplus: don't query the device logical block size multiple times Devices block sizes may change. One of these cases is a loop device by using ioctl LOOP_SET_BLOCK_SIZE. While this may cause other issues like IO being rejected, in the case of hfsplus, it will allocate a block by using that size and potentially write out-of-bounds when hfsplus_read_wrapper calls hfsplus_submit_bio and the latter function reads a different io_size. Using a new min_io_size initally set to sb_min_blocksize works for the purposes of the original fix, since it will be set to the max between HFSPLUS_SECTOR_SIZE and the first seen logical block size. We still use the max between HFSPLUS_SECTOR_SIZE and min_io_size in case the latter is not initialized. Tested by mounting an hfsplus filesystem with loop block sizes 512, 1024 and 4096. The produced KASAN report before the fix looks like this: [ 419.944641] ================================================================== [ 419.945655] BUG: KASAN: slab-use-after-free in hfsplus_read_wrapper+0x659/0xa0a [ 419.946703] Read of size 2 at addr ffff88800721fc00 by task repro/10678 [ 419.947612] [ 419.947846] CPU: 0 UID: 0 PID: 10678 Comm: repro Not tainted 6.12.0-rc5-00008-gdf56e0f2f3ca #84 [ 419.949007] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.15.0-1 04/01/2014 [ 419.950035] Call Trace: [ 419.950384] <TASK> [ 419.950676] dump_stack_lvl+0x57/0x78 [ 419.951212] ? hfsplus_read_wrapper+0x659/0xa0a [ 419.951830] print_report+0x14c/0x49e [ 419.952361] ? __virt_addr_valid+0x267/0x278 [ 419.952979] ? kmem_cache_debug_flags+0xc/0x1d [ 419.953561] ? hfsplus_read_wrapper+0x659/0xa0a [ 419.954231] kasan_report+0x89/0xb0 [ 419.954748] ? hfsplus_read_wrapper+0x659/0xa0a [ 419.955367] hfsplus_read_wrapper+0x659/0xa0a [ 419.955948] ? __pfx_hfsplus_read_wrapper+0x10/0x10 [ 419.956618] ? do_raw_spin_unlock+0x59/0x1a9 [ 419.957214] ? _raw_spin_unlock+0x1a/0x2e [ 419.957772] hfsplus_fill_super+0x348/0x1590 [ 419.958355] ? hlock_class+0x4c/0x109 [ 419.958867] ? __pfx_hfsplus_fill_super+0x10/0x10 [ 419.959499] ? __pfx_string+0x10/0x10 [ 419.960006] ? lock_acquire+0x3e2/0x454 [ 419.960532] ? bdev_name.constprop.0+0xce/0x243 [ 419.961129] ? __pfx_bdev_name.constprop.0+0x10/0x10 [ 419.961799] ? pointer+0x3f0/0x62f [ 419.962277] ? __pfx_pointer+0x10/0x10 [ 419.962761] ? vsnprintf+0x6c4/0xfba [ 419.963178] ? __pfx_vsnprintf+0x10/0x10 [ 419.963621] ? setup_bdev_super+0x376/0x3b3 [ 419.964029] ? snprintf+0x9d/0xd2 [ 419.964344] ? __pfx_snprintf+0x10/0x10 [ 419.964675] ? lock_acquired+0x45c/0x5e9 [ 419.965016] ? set_blocksize+0x139/0x1c1 [ 419.965381] ? sb_set_blocksize+0x6d/0xae [ 419.965742] ? __pfx_hfsplus_fill_super+0x10/0x10 [ 419.966179] mount_bdev+0x12f/0x1bf [ 419.966512] ? __pfx_mount_bdev+0x10/0x10 [ 419.966886] ? vfs_parse_fs_string+0xce/0x111 [ 419.967293] ? __pfx_vfs_parse_fs_string+0x10/0x10 [ 419.967702] ? __pfx_hfsplus_mount+0x10/0x10 [ 419.968073] legacy_get_tree+0x104/0x178 [ 419.968414] vfs_get_tree+0x86/0x296 [ 419.968751] path_mount+0xba3/0xd0b [ 419.969157] ? __pfx_path_mount+0x10/0x10 [ 419.969594] ? kmem_cache_free+0x1e2/0x260 [ 419.970311] do_mount+0x99/0xe0 [ 419.970630] ? __pfx_do_mount+0x10/0x10 [ 419.971008] __do_sys_mount+0x199/0x1c9 [ 419.971397] do_syscall_64+0xd0/0x135 [ 419.971761] entry_SYSCALL_64_after_hwframe+0x76/0x7e [ 419.972233] RIP: 0033:0x7c3cb812972e [ 419.972564] Code: 48 8b 0d f5 46 0d 00 f7 d8 64 89 01 48 83 c8 ff c3 66 2e 0f 1f 84 00 00 00 00 00 90 f3 0f 1e fa 49 89 ca b8 a5 00 00 00 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 8b 0d c2 46 0d 00 f7 d8 64 89 01 48 [ 419.974371] RSP: 002b:00007ffe30632548 EFLAGS: 00000286 ORIG_RAX: 00000000000000a5 [ 419.975048] RAX: ffffffffffffffda RBX: 00007ffe306328d8 RCX: 00007c3cb812972e [ 419.975701] RDX: 0000000020000000 RSI: 0000000020000c80 RDI: ---truncated--- CVE-2024-56548 Public Cloud Image google/sles-15-sp5-sap-v20250408-x86-64:cluster-md-kmp-default-5.14.21-150500.55.97.1 Public Cloud Image google/sles-15-sp5-sap-v20250408-x86-64:dlm-kmp-default-5.14.21-150500.55.97.1 Public Cloud Image google/sles-15-sp5-sap-v20250408-x86-64:gfs2-kmp-default-5.14.21-150500.55.97.1 Public Cloud Image google/sles-15-sp5-sap-v20250408-x86-64:kernel-default-5.14.21-150500.55.97.1 Public Cloud Image google/sles-15-sp5-sap-v20250408-x86-64:ocfs2-kmp-default-5.14.21-150500.55.97.1 important In the Linux kernel, the following vulnerability has been resolved: Bluetooth: L2CAP: do not leave dangling sk pointer on error in l2cap_sock_create() bt_sock_alloc() allocates the sk object and attaches it to the provided sock object. On error l2cap_sock_alloc() frees the sk object, but the dangling pointer is still attached to the sock object, which may create use-after-free in other code. CVE-2024-56605 Public Cloud Image google/sles-15-sp5-sap-v20250408-x86-64:cluster-md-kmp-default-5.14.21-150500.55.97.1 Public Cloud Image google/sles-15-sp5-sap-v20250408-x86-64:dlm-kmp-default-5.14.21-150500.55.97.1 Public Cloud Image google/sles-15-sp5-sap-v20250408-x86-64:gfs2-kmp-default-5.14.21-150500.55.97.1 Public Cloud Image google/sles-15-sp5-sap-v20250408-x86-64:kernel-default-5.14.21-150500.55.97.1 Public Cloud Image google/sles-15-sp5-sap-v20250408-x86-64:ocfs2-kmp-default-5.14.21-150500.55.97.1 important In the Linux kernel, the following vulnerability has been resolved: mac802154: check local interfaces before deleting sdata list syzkaller reported a corrupted list in ieee802154_if_remove. [1] Remove an IEEE 802.15.4 network interface after unregister an IEEE 802.15.4 hardware device from the system. CPU0 CPU1 ==== ==== genl_family_rcv_msg_doit ieee802154_unregister_hw ieee802154_del_iface ieee802154_remove_interfaces rdev_del_virtual_intf_deprecated list_del(&sdata->list) ieee802154_if_remove list_del_rcu The net device has been unregistered, since the rcu grace period, unregistration must be run before ieee802154_if_remove. To avoid this issue, add a check for local->interfaces before deleting sdata list. [1] kernel BUG at lib/list_debug.c:58! Oops: invalid opcode: 0000 [#1] PREEMPT SMP KASAN PTI CPU: 0 UID: 0 PID: 6277 Comm: syz-executor157 Not tainted 6.12.0-rc6-syzkaller-00005-g557329bcecc2 #0 Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 09/13/2024 RIP: 0010:__list_del_entry_valid_or_report+0xf4/0x140 lib/list_debug.c:56 Code: e8 a1 7e 00 07 90 0f 0b 48 c7 c7 e0 37 60 8c 4c 89 fe e8 8f 7e 00 07 90 0f 0b 48 c7 c7 40 38 60 8c 4c 89 fe e8 7d 7e 00 07 90 <0f> 0b 48 c7 c7 a0 38 60 8c 4c 89 fe e8 6b 7e 00 07 90 0f 0b 48 c7 RSP: 0018:ffffc9000490f3d0 EFLAGS: 00010246 RAX: 000000000000004e RBX: dead000000000122 RCX: d211eee56bb28d00 RDX: 0000000000000000 RSI: 0000000080000000 RDI: 0000000000000000 RBP: ffff88805b278dd8 R08: ffffffff8174a12c R09: 1ffffffff2852f0d R10: dffffc0000000000 R11: fffffbfff2852f0e R12: dffffc0000000000 R13: dffffc0000000000 R14: dead000000000100 R15: ffff88805b278cc0 FS: 0000555572f94380(0000) GS:ffff8880b8600000(0000) knlGS:0000000000000000 CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 CR2: 000056262e4a3000 CR3: 0000000078496000 CR4: 00000000003526f0 DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000 DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400 Call Trace: <TASK> __list_del_entry_valid include/linux/list.h:124 [inline] __list_del_entry include/linux/list.h:215 [inline] list_del_rcu include/linux/rculist.h:157 [inline] ieee802154_if_remove+0x86/0x1e0 net/mac802154/iface.c:687 rdev_del_virtual_intf_deprecated net/ieee802154/rdev-ops.h:24 [inline] ieee802154_del_iface+0x2c0/0x5c0 net/ieee802154/nl-phy.c:323 genl_family_rcv_msg_doit net/netlink/genetlink.c:1115 [inline] genl_family_rcv_msg net/netlink/genetlink.c:1195 [inline] genl_rcv_msg+0xb14/0xec0 net/netlink/genetlink.c:1210 netlink_rcv_skb+0x1e3/0x430 net/netlink/af_netlink.c:2551 genl_rcv+0x28/0x40 net/netlink/genetlink.c:1219 netlink_unicast_kernel net/netlink/af_netlink.c:1331 [inline] netlink_unicast+0x7f6/0x990 net/netlink/af_netlink.c:1357 netlink_sendmsg+0x8e4/0xcb0 net/netlink/af_netlink.c:1901 sock_sendmsg_nosec net/socket.c:729 [inline] __sock_sendmsg+0x221/0x270 net/socket.c:744 ____sys_sendmsg+0x52a/0x7e0 net/socket.c:2607 ___sys_sendmsg net/socket.c:2661 [inline] __sys_sendmsg+0x292/0x380 net/socket.c:2690 do_syscall_x64 arch/x86/entry/common.c:52 [inline] do_syscall_64+0xf3/0x230 arch/x86/entry/common.c:83 entry_SYSCALL_64_after_hwframe+0x77/0x7f CVE-2024-57948 Public Cloud Image google/sles-15-sp5-sap-v20250408-x86-64:cluster-md-kmp-default-5.14.21-150500.55.97.1 Public Cloud Image google/sles-15-sp5-sap-v20250408-x86-64:dlm-kmp-default-5.14.21-150500.55.97.1 Public Cloud Image google/sles-15-sp5-sap-v20250408-x86-64:gfs2-kmp-default-5.14.21-150500.55.97.1 Public Cloud Image google/sles-15-sp5-sap-v20250408-x86-64:kernel-default-5.14.21-150500.55.97.1 Public Cloud Image google/sles-15-sp5-sap-v20250408-x86-64:ocfs2-kmp-default-5.14.21-150500.55.97.1 moderate A vulnerability classified as problematic was found in vim up to 9.1.1096. This vulnerability affects unknown code of the file src/main.c. The manipulation of the argument --log leads to memory corruption. It is possible to launch the attack on the local host. Upgrading to version 9.1.1097 is able to address this issue. The patch is identified as c5654b84480822817bb7b69ebc97c174c91185e9. It is recommended to upgrade the affected component. CVE-2025-1215 Public Cloud Image google/sles-15-sp5-sap-v20250408-x86-64:vim-9.1.1176-150500.20.24.2 Public Cloud Image google/sles-15-sp5-sap-v20250408-x86-64:vim-data-common-9.1.1176-150500.20.24.2 low In the Linux kernel, the following vulnerability has been resolved: sched: sch_cake: add bounds checks to host bulk flow fairness counts Even though we fixed a logic error in the commit cited below, syzbot still managed to trigger an underflow of the per-host bulk flow counters, leading to an out of bounds memory access. To avoid any such logic errors causing out of bounds memory accesses, this commit factors out all accesses to the per-host bulk flow counters to a series of helpers that perform bounds-checking before any increments and decrements. This also has the benefit of improving readability by moving the conditional checks for the flow mode into these helpers, instead of having them spread out throughout the code (which was the cause of the original logic error). As part of this change, the flow quantum calculation is consolidated into a helper function, which means that the dithering applied to the ost load scaling is now applied both in the DRR rotation and when a sparse flow's quantum is first initiated. The only user-visible effect of this is that the maximum packet size that can be sent while a flow stays sparse will now vary with +/- one byte in some cases. This should not make a noticeable difference in practice, and thus it's not worth complicating the code to preserve the old behaviour. CVE-2025-21647 Public Cloud Image google/sles-15-sp5-sap-v20250408-x86-64:cluster-md-kmp-default-5.14.21-150500.55.97.1 Public Cloud Image google/sles-15-sp5-sap-v20250408-x86-64:dlm-kmp-default-5.14.21-150500.55.97.1 Public Cloud Image google/sles-15-sp5-sap-v20250408-x86-64:gfs2-kmp-default-5.14.21-150500.55.97.1 Public Cloud Image google/sles-15-sp5-sap-v20250408-x86-64:kernel-default-5.14.21-150500.55.97.1 Public Cloud Image google/sles-15-sp5-sap-v20250408-x86-64:ocfs2-kmp-default-5.14.21-150500.55.97.1 important In the Linux kernel, the following vulnerability has been resolved: scsi: storvsc: Ratelimit warning logs to prevent VM denial of service If there's a persistent error in the hypervisor, the SCSI warning for failed I/O can flood the kernel log and max out CPU utilization, preventing troubleshooting from the VM side. Ratelimit the warning so it doesn't DoS the VM. CVE-2025-21690 Public Cloud Image google/sles-15-sp5-sap-v20250408-x86-64:cluster-md-kmp-default-5.14.21-150500.55.97.1 Public Cloud Image google/sles-15-sp5-sap-v20250408-x86-64:dlm-kmp-default-5.14.21-150500.55.97.1 Public Cloud Image google/sles-15-sp5-sap-v20250408-x86-64:gfs2-kmp-default-5.14.21-150500.55.97.1 Public Cloud Image google/sles-15-sp5-sap-v20250408-x86-64:kernel-default-5.14.21-150500.55.97.1 Public Cloud Image google/sles-15-sp5-sap-v20250408-x86-64:ocfs2-kmp-default-5.14.21-150500.55.97.1 moderate In the Linux kernel, the following vulnerability has been resolved: net: sched: fix ets qdisc OOB Indexing Haowei Yan <g1042620637@gmail.com> found that ets_class_from_arg() can index an Out-Of-Bound class in ets_class_from_arg() when passed clid of 0. The overflow may cause local privilege escalation. [ 18.852298] ------------[ cut here ]------------ [ 18.853271] UBSAN: array-index-out-of-bounds in net/sched/sch_ets.c:93:20 [ 18.853743] index 18446744073709551615 is out of range for type 'ets_class [16]' [ 18.854254] CPU: 0 UID: 0 PID: 1275 Comm: poc Not tainted 6.12.6-dirty #17 [ 18.854821] Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.15.0-1 04/01/2014 [ 18.856532] Call Trace: [ 18.857441] <TASK> [ 18.858227] dump_stack_lvl+0xc2/0xf0 [ 18.859607] dump_stack+0x10/0x20 [ 18.860908] __ubsan_handle_out_of_bounds+0xa7/0xf0 [ 18.864022] ets_class_change+0x3d6/0x3f0 [ 18.864322] tc_ctl_tclass+0x251/0x910 [ 18.864587] ? lock_acquire+0x5e/0x140 [ 18.865113] ? __mutex_lock+0x9c/0xe70 [ 18.866009] ? __mutex_lock+0xa34/0xe70 [ 18.866401] rtnetlink_rcv_msg+0x170/0x6f0 [ 18.866806] ? __lock_acquire+0x578/0xc10 [ 18.867184] ? __pfx_rtnetlink_rcv_msg+0x10/0x10 [ 18.867503] netlink_rcv_skb+0x59/0x110 [ 18.867776] rtnetlink_rcv+0x15/0x30 [ 18.868159] netlink_unicast+0x1c3/0x2b0 [ 18.868440] netlink_sendmsg+0x239/0x4b0 [ 18.868721] ____sys_sendmsg+0x3e2/0x410 [ 18.869012] ___sys_sendmsg+0x88/0xe0 [ 18.869276] ? rseq_ip_fixup+0x198/0x260 [ 18.869563] ? rseq_update_cpu_node_id+0x10a/0x190 [ 18.869900] ? trace_hardirqs_off+0x5a/0xd0 [ 18.870196] ? syscall_exit_to_user_mode+0xcc/0x220 [ 18.870547] ? do_syscall_64+0x93/0x150 [ 18.870821] ? __memcg_slab_free_hook+0x69/0x290 [ 18.871157] __sys_sendmsg+0x69/0xd0 [ 18.871416] __x64_sys_sendmsg+0x1d/0x30 [ 18.871699] x64_sys_call+0x9e2/0x2670 [ 18.871979] do_syscall_64+0x87/0x150 [ 18.873280] ? do_syscall_64+0x93/0x150 [ 18.874742] ? lock_release+0x7b/0x160 [ 18.876157] ? do_user_addr_fault+0x5ce/0x8f0 [ 18.877833] ? irqentry_exit_to_user_mode+0xc2/0x210 [ 18.879608] ? irqentry_exit+0x77/0xb0 [ 18.879808] ? clear_bhb_loop+0x15/0x70 [ 18.880023] ? clear_bhb_loop+0x15/0x70 [ 18.880223] ? clear_bhb_loop+0x15/0x70 [ 18.880426] entry_SYSCALL_64_after_hwframe+0x76/0x7e [ 18.880683] RIP: 0033:0x44a957 [ 18.880851] Code: ff ff e8 fc 00 00 00 66 2e 0f 1f 84 00 00 00 00 00 66 90 f3 0f 1e fa 64 8b 04 25 18 00 00 00 85 c0 75 10 b8 2e 00 00 00 0f 05 <48> 3d 00 f0 ff ff 77 51 c3 48 83 ec 28 89 54 24 1c 48 8974 24 10 [ 18.881766] RSP: 002b:00007ffcdd00fad8 EFLAGS: 00000246 ORIG_RAX: 000000000000002e [ 18.882149] RAX: ffffffffffffffda RBX: 00007ffcdd010db8 RCX: 000000000044a957 [ 18.882507] RDX: 0000000000000000 RSI: 00007ffcdd00fb70 RDI: 0000000000000003 [ 18.885037] RBP: 00007ffcdd010bc0 R08: 000000000703c770 R09: 000000000703c7c0 [ 18.887203] R10: 0000000000000080 R11: 0000000000000246 R12: 0000000000000001 [ 18.888026] R13: 00007ffcdd010da8 R14: 00000000004ca7d0 R15: 0000000000000001 [ 18.888395] </TASK> [ 18.888610] ---[ end trace ]--- CVE-2025-21692 Public Cloud Image google/sles-15-sp5-sap-v20250408-x86-64:cluster-md-kmp-default-5.14.21-150500.55.97.1 Public Cloud Image google/sles-15-sp5-sap-v20250408-x86-64:dlm-kmp-default-5.14.21-150500.55.97.1 Public Cloud Image google/sles-15-sp5-sap-v20250408-x86-64:gfs2-kmp-default-5.14.21-150500.55.97.1 Public Cloud Image google/sles-15-sp5-sap-v20250408-x86-64:kernel-default-5.14.21-150500.55.97.1 Public Cloud Image google/sles-15-sp5-sap-v20250408-x86-64:ocfs2-kmp-default-5.14.21-150500.55.97.1 important In the Linux kernel, the following vulnerability has been resolved: gfs2: Truncate address space when flipping GFS2_DIF_JDATA flag Truncate an inode's address space when flipping the GFS2_DIF_JDATA flag: depending on that flag, the pages in the address space will either use buffer heads or iomap_folio_state structs, and we cannot mix the two. CVE-2025-21699 Public Cloud Image google/sles-15-sp5-sap-v20250408-x86-64:cluster-md-kmp-default-5.14.21-150500.55.97.1 Public Cloud Image google/sles-15-sp5-sap-v20250408-x86-64:dlm-kmp-default-5.14.21-150500.55.97.1 Public Cloud Image google/sles-15-sp5-sap-v20250408-x86-64:gfs2-kmp-default-5.14.21-150500.55.97.1 Public Cloud Image google/sles-15-sp5-sap-v20250408-x86-64:kernel-default-5.14.21-150500.55.97.1 Public Cloud Image google/sles-15-sp5-sap-v20250408-x86-64:ocfs2-kmp-default-5.14.21-150500.55.97.1 moderate When switching to other buffers using the :all command and visual mode still being active, this may cause a heap-buffer overflow, because Vim does not properly end visual mode and therefore may try to access beyond the end of a line in a buffer. In Patch 9.1.1003 Vim will correctly reset the visual mode before opening other windows and buffers and therefore fix this bug. In addition it does verify that it won't try to access a position if the position is greater than the corresponding buffer line. Impact is medium since the user must have switched on visual mode when executing the :all ex command. The Vim project would like to thank github user gandalf4a for reporting this issue. The issue has been fixed as of Vim patch v9.1.1003 CVE-2025-22134 Public Cloud Image google/sles-15-sp5-sap-v20250408-x86-64:vim-9.1.1176-150500.20.24.2 Public Cloud Image google/sles-15-sp5-sap-v20250408-x86-64:vim-data-common-9.1.1176-150500.20.24.2 moderate An attacker can pass a malicious malformed token which causes unexpected memory to be consumed during parsing. CVE-2025-22868 Public Cloud Image google/sles-15-sp5-sap-v20250408-x86-64:docker-27.5.1_ce-150000.218.1 Public Cloud Image google/sles-15-sp5-sap-v20250408-x86-64:google-cloud-sap-agent-3.6-150100.3.44.1 Public Cloud Image google/sles-15-sp5-sap-v20250408-x86-64:google-guest-agent-20250327.01-150000.1.60.1 Public Cloud Image google/sles-15-sp5-sap-v20250408-x86-64:google-osconfig-agent-20250115.01-150000.1.47.1 important SSH servers which implement file transfer protocols are vulnerable to a denial of service attack from clients which complete the key exchange slowly, or not at all, causing pending content to be read into memory, but never transmitted. CVE-2025-22869 Public Cloud Image google/sles-15-sp5-sap-v20250408-x86-64:docker-27.5.1_ce-150000.218.1 important Vim is an open source, command line text editor. A segmentation fault was found in Vim before 9.1.1043. In silent Ex mode (-s -e), Vim typically doesn't show a screen and just operates silently in batch mode. However, it is still possible to trigger the function that handles the scrolling of a gui version of Vim by feeding some binary characters to Vim. The function that handles the scrolling however may be triggering a redraw, which will access the ScreenLines pointer, even so this variable hasn't been allocated (since there is no screen). This vulnerability is fixed in 9.1.1043. CVE-2025-24014 Public Cloud Image google/sles-15-sp5-sap-v20250408-x86-64:vim-9.1.1176-150500.20.24.2 Public Cloud Image google/sles-15-sp5-sap-v20250408-x86-64:vim-data-common-9.1.1176-150500.20.24.2 moderate numbers.c in libxslt before 1.1.43 has a use-after-free because, in nested XPath evaluations, an XPath context node can be modified but never restored. This is related to xsltNumberFormatGetValue, xsltEvalXPathPredicate, xsltEvalXPathStringNs, and xsltComputeSortResultInternal. CVE-2025-24855 Public Cloud Image google/sles-15-sp5-sap-v20250408-x86-64:libxslt1-1.1.34-150400.3.6.1 important libxml2 before 2.12.10 and 2.13.x before 2.13.6 has a stack-based buffer overflow in xmlSnprintfElements in valid.c. To exploit this, DTD validation must occur for an untrusted document or untrusted DTD. NOTE: this is similar to CVE-2017-9047. CVE-2025-24928 Public Cloud Image google/sles-15-sp5-sap-v20250408-x86-64:libxml2-2-2.10.3-150500.5.23.1 Public Cloud Image google/sles-15-sp5-sap-v20250408-x86-64:libxml2-tools-2.10.3-150500.5.23.1 moderate Rack provides an interface for developing web applications in Ruby. Prior to versions 2.2.11, 3.0.12, and 3.1.10, Rack::CommonLogger can be exploited by crafting input that includes newline characters to manipulate log entries. The supplied proof-of-concept demonstrates injecting malicious content into logs. When a user provides the authorization credentials via Rack::Auth::Basic, if success, the username will be put in env['REMOTE_USER'] and later be used by Rack::CommonLogger for logging purposes. The issue occurs when a server intentionally or unintentionally allows a user creation with the username contain CRLF and white space characters, or the server just want to log every login attempts. If an attacker enters a username with CRLF character, the logger will log the malicious username with CRLF characters into the logfile. Attackers can break log formats or insert fraudulent entries, potentially obscuring real activity or injecting malicious data into log files. Versions 2.2.11, 3.0.12, and 3.1.10 contain a fix. CVE-2025-25184 Public Cloud Image google/sles-15-sp5-sap-v20250408-x86-64:ruby2.5-rubygem-rack-2.0.8-150000.3.26.1 moderate A buffer overflow flaw was found in X.Org and Xwayland. The code in XkbVModMaskText() allocates a fixed-sized buffer on the stack and copies the names of the virtual modifiers to that buffer. The code fails to check the bounds of the buffer and would copy the data regardless of the size. CVE-2025-26595 Public Cloud Image google/sles-15-sp5-sap-v20250408-x86-64:libxkbfile1-1.0.9-150000.3.3.1 moderate A buffer overflow flaw was found in X.Org and Xwayland. If XkbChangeTypesOfKey() is called with a 0 group, it will resize the key symbols table to 0 but leave the key actions unchanged. If the same function is later called with a non-zero value of groups, this will cause a buffer overflow because the key actions are of the wrong size. CVE-2025-26597 Public Cloud Image google/sles-15-sp5-sap-v20250408-x86-64:libX11-6-1.6.5-150000.3.36.1 Public Cloud Image google/sles-15-sp5-sap-v20250408-x86-64:libX11-data-1.6.5-150000.3.36.1 Public Cloud Image google/sles-15-sp5-sap-v20250408-x86-64:libX11-xcb1-1.6.5-150000.3.36.1 moderate Rack is a modular Ruby web server interface. The Rack::Sendfile middleware logs unsanitised header values from the X-Sendfile-Type header. An attacker can exploit this by injecting escape sequences (such as newline characters) into the header, resulting in log injection. This vulnerability is fixed in 2.2.12, 3.0.13, and 3.1.11. CVE-2025-27111 Public Cloud Image google/sles-15-sp5-sap-v20250408-x86-64:ruby2.5-rubygem-rack-2.0.8-150000.3.26.1 moderate libxml2 before 2.12.10 and 2.13.x before 2.13.6 has a NULL pointer dereference in xmlPatMatch in pattern.c. CVE-2025-27113 Public Cloud Image google/sles-15-sp5-sap-v20250408-x86-64:libxml2-2-2.10.3-150500.5.23.1 Public Cloud Image google/sles-15-sp5-sap-v20250408-x86-64:libxml2-tools-2.10.3-150500.5.23.1 moderate An out of bounds write exists in FreeType versions 2.13.0 and below (newer versions of FreeType are not vulnerable) when attempting to parse font subglyph structures related to TrueType GX and variable font files. The vulnerable code assigns a signed short value to an unsigned long and then adds a static value causing it to wrap around and allocate too small of a heap buffer. The code then writes up to 6 signed long integers out of bounds relative to this buffer. This may result in arbitrary code execution. This vulnerability may have been exploited in the wild. CVE-2025-27363 Public Cloud Image google/sles-15-sp5-sap-v20250408-x86-64:libfreetype6-2.10.4-150000.4.18.1 important Rack provides an interface for developing web applications in Ruby. Prior to versions 2.2.13, 3.0.14, and 3.1.12, `Rack::Static` can serve files under the specified `root:` even if `urls:` are provided, which may expose other files under the specified `root:` unexpectedly. The vulnerability occurs because `Rack::Static` does not properly sanitize user-supplied paths before serving files. Specifically, encoded path traversal sequences are not correctly validated, allowing attackers to access files outside the designated static file directory. By exploiting this vulnerability, an attacker can gain access to all files under the specified `root:` directory, provided they are able to determine then path of the file. Versions 2.2.13, 3.0.14, and 3.1.12 contain a patch for the issue. Other mitigations include removing usage of `Rack::Static`, or ensuring that `root:` points at a directory path which only contains files which should be accessed publicly. It is likely that a CDN or similar static file server would also mitigate the issue. CVE-2025-27610 Public Cloud Image google/sles-15-sp5-sap-v20250408-x86-64:ruby2.5-rubygem-rack-2.0.8-150000.3.26.1 important Corosync through 3.1.9, if encryption is disabled or the attacker knows the encryption key, has a stack-based buffer overflow in orf_token_endian_convert in exec/totemsrp.c via a large UDP packet. CVE-2025-30472 Public Cloud Image google/sles-15-sp5-sap-v20250408-x86-64:corosync-2.4.6-150300.12.13.1 Public Cloud Image google/sles-15-sp5-sap-v20250408-x86-64:corosync-qdevice-2.4.6-150300.12.13.1 Public Cloud Image google/sles-15-sp5-sap-v20250408-x86-64:libcfg6-2.4.6-150300.12.13.1 Public Cloud Image google/sles-15-sp5-sap-v20250408-x86-64:libcmap4-2.4.6-150300.12.13.1 Public Cloud Image google/sles-15-sp5-sap-v20250408-x86-64:libcorosync_common4-2.4.6-150300.12.13.1 Public Cloud Image google/sles-15-sp5-sap-v20250408-x86-64:libcpg4-2.4.6-150300.12.13.1 Public Cloud Image google/sles-15-sp5-sap-v20250408-x86-64:libquorum5-2.4.6-150300.12.13.1 Public Cloud Image google/sles-15-sp5-sap-v20250408-x86-64:libsam4-2.4.6-150300.12.13.1 Public Cloud Image google/sles-15-sp5-sap-v20250408-x86-64:libtotem_pg5-2.4.6-150300.12.13.1 Public Cloud Image google/sles-15-sp5-sap-v20250408-x86-64:libvotequorum8-2.4.6-150300.12.13.1 critical