Security update for patch SUSE Patch security@suse.de SUSE Security Team SUSE-SU-2024:2780-1 Final 1 1 2024-08-06T12:36:07Z current 2024-08-06T12:36:07Z 2024-08-06T12:36:07Z cve-database/bin/generate-cvrf.pl 2017-02-24T01:00:00Z Security update for patch This update for patch fixes the following issues: - CVE-2019-20633: Fixed double-free/OOB read in pch.c (bsc#1167721) The CVRF data is provided by SUSE under the Creative Commons License 4.0 with Attribution (CC-BY-4.0). Container bci/bci-sle15-kernel-module-devel:15.5-2024-2780,Container bci/bci-sle15-kernel-module-devel:15.7-2024-2780,Container bci/bci-sle15-kernel-module-devel:latest-2024-2780,Container bci/spack:0.23-2024-2780,Container bci/spack:latest-2024-2780,Container suse/manager/5.0/x86_64/server:latest-2024-2780,Image SLES15-SP3-SAPCAL-Azure-2024-2780,Image SLES15-SP3-SAPCAL-EC2-HVM-2024-2780,Image SLES15-SP3-SAPCAL-GCE-2024-2780,Image SLES15-SP4-Manager-Proxy-4-3-BYOS-2024-2780,Image SLES15-SP4-Manager-Proxy-4-3-BYOS-Azure-2024-2780,Image SLES15-SP4-Manager-Proxy-4-3-BYOS-EC2-2024-2780,Image SLES15-SP4-Manager-Proxy-4-3-BYOS-GCE-2024-2780,Image SLES15-SP4-Manager-Server-4-3-2024-2780,Image SLES15-SP4-Manager-Server-4-3-Azure-llc-2024-2780,Image SLES15-SP4-Manager-Server-4-3-Azure-ltd-2024-2780,Image SLES15-SP4-Manager-Server-4-3-BYOS-2024-2780,Image SLES15-SP4-Manager-Server-4-3-BYOS-Azure-2024-2780,Image SLES15-SP4-Manager-Server-4-3-BYOS-EC2-2024-2780,Image SLES15-SP4-Manager-Server-4-3-BYOS-GCE-2024-2780,Image SLES15-SP4-Manager-Server-4-3-EC2-llc-2024-2780,Image SLES15-SP4-Manager-Server-4-3-EC2-ltd-2024-2780,Image SLES15-SP4-SAP-2024-2780,Image SLES15-SP4-SAP-Azure-2024-2780,Image SLES15-SP4-SAP-EC2-2024-2780,Image SLES15-SP4-SAP-GCE-2024-2780,Image SLES15-SP4-SAPCAL-2024-2780,Image SLES15-SP4-SAPCAL-Azure-2024-2780,Image SLES15-SP4-SAPCAL-EC2-2024-2780,Image SLES15-SP4-SAPCAL-GCE-2024-2780,Image SLES15-SP5-SAPCAL-Azure-2024-2780,Image SLES15-SP5-SAPCAL-EC2-2024-2780,Image SLES15-SP5-SAPCAL-GCE-2024-2780,Image SLES15-SP6-SAP-2024-2780,Image SLES15-SP6-SAP-Azure-2024-2780,Image SLES15-SP6-SAP-EC2-2024-2780,Image SLES15-SP6-SAP-GCE-2024-2780,Image SLES15-SP6-SAPCAL-2024-2780,Image SLES15-SP6-SAPCAL-Azure-2024-2780,Image SLES15-SP6-SAPCAL-EC2-2024-2780,Image SLES15-SP6-SAPCAL-GCE-2024-2780,Image server-image-2024-2780,SUSE-2024-2780,SUSE-SLE-Module-Basesystem-15-SP5-2024-2780,SUSE-SLE-Module-Basesystem-15-SP6-2024-2780,openSUSE-SLE-15.5-2024-2780,openSUSE-SLE-15.6-2024-2780 Copyright SUSE LLC under the Creative Commons License 4.0 with Attribution (CC-BY-4.0) https://www.suse.com/support/update/announcement/2024/suse-su-20242780-1/ Link for SUSE-SU-2024:2780-1 https://lists.suse.com/pipermail/sle-updates/2024-August/036341.html E-Mail link for SUSE-SU-2024:2780-1 https://www.suse.com/support/security/rating/ SUSE Security Ratings https://bugzilla.suse.com/1167721 SUSE Bug 1167721 https://www.suse.com/security/cve/CVE-2019-20633/ SUSE CVE CVE-2019-20633 page Container bci/bci-sle15-kernel-module-devel:15.5 Container bci/bci-sle15-kernel-module-devel:15.7 Container bci/bci-sle15-kernel-module-devel:latest Container bci/spack:0.23 Container bci/spack:latest Container suse/manager/5.0/x86_64/server:latest Image SLES15-SP3-SAPCAL-Azure Image SLES15-SP3-SAPCAL-EC2-HVM Image SLES15-SP3-SAPCAL-GCE Image SLES15-SP4-Manager-Proxy-4-3-BYOS Image SLES15-SP4-Manager-Proxy-4-3-BYOS-Azure Image SLES15-SP4-Manager-Proxy-4-3-BYOS-EC2 Image SLES15-SP4-Manager-Proxy-4-3-BYOS-GCE Image SLES15-SP4-Manager-Server-4-3 Image SLES15-SP4-Manager-Server-4-3-Azure-llc Image SLES15-SP4-Manager-Server-4-3-Azure-ltd Image SLES15-SP4-Manager-Server-4-3-BYOS Image SLES15-SP4-Manager-Server-4-3-BYOS-Azure Image SLES15-SP4-Manager-Server-4-3-BYOS-EC2 Image SLES15-SP4-Manager-Server-4-3-BYOS-GCE Image SLES15-SP4-Manager-Server-4-3-EC2-llc Image SLES15-SP4-Manager-Server-4-3-EC2-ltd Image SLES15-SP4-SAP Image SLES15-SP4-SAP-Azure Image SLES15-SP4-SAP-EC2 Image SLES15-SP4-SAP-GCE Image SLES15-SP4-SAPCAL Image SLES15-SP4-SAPCAL-Azure Image SLES15-SP4-SAPCAL-EC2 Image SLES15-SP4-SAPCAL-GCE Image SLES15-SP5-SAPCAL-Azure Image SLES15-SP5-SAPCAL-EC2 Image SLES15-SP5-SAPCAL-GCE Image SLES15-SP6-SAP Image SLES15-SP6-SAP-Azure Image SLES15-SP6-SAP-EC2 Image SLES15-SP6-SAP-GCE Image SLES15-SP6-SAPCAL Image SLES15-SP6-SAPCAL-Azure Image SLES15-SP6-SAPCAL-EC2 Image SLES15-SP6-SAPCAL-GCE Image server-image SUSE Linux Enterprise Module for Basesystem 15 SP5 SUSE Linux Enterprise Module for Basesystem 15 SP6 openSUSE Leap 15.5 openSUSE Leap 15.6 patch-2.7.6-150000.5.6.1 patch-2.7.6-150000.5.6.1 as a component of Container bci/bci-sle15-kernel-module-devel:15.5 patch-2.7.6-150000.5.6.1 as a component of Container bci/bci-sle15-kernel-module-devel:15.7 patch-2.7.6-150000.5.6.1 as a component of Container bci/bci-sle15-kernel-module-devel:latest patch-2.7.6-150000.5.6.1 as a component of Container bci/spack:0.23 patch-2.7.6-150000.5.6.1 as a component of Container bci/spack:latest patch-2.7.6-150000.5.6.1 as a component of Container suse/manager/5.0/x86_64/server:latest patch-2.7.6-150000.5.6.1 as a component of Image SLES15-SP3-SAPCAL-Azure patch-2.7.6-150000.5.6.1 as a component of Image SLES15-SP3-SAPCAL-EC2-HVM patch-2.7.6-150000.5.6.1 as a component of Image SLES15-SP3-SAPCAL-GCE patch-2.7.6-150000.5.6.1 as a component of Image SLES15-SP4-Manager-Proxy-4-3-BYOS patch-2.7.6-150000.5.6.1 as a component of Image SLES15-SP4-Manager-Proxy-4-3-BYOS-Azure patch-2.7.6-150000.5.6.1 as a component of Image SLES15-SP4-Manager-Proxy-4-3-BYOS-EC2 patch-2.7.6-150000.5.6.1 as a component of Image SLES15-SP4-Manager-Proxy-4-3-BYOS-GCE patch-2.7.6-150000.5.6.1 as a component of Image SLES15-SP4-Manager-Server-4-3 patch-2.7.6-150000.5.6.1 as a component of Image SLES15-SP4-Manager-Server-4-3-Azure-llc patch-2.7.6-150000.5.6.1 as a component of Image SLES15-SP4-Manager-Server-4-3-Azure-ltd patch-2.7.6-150000.5.6.1 as a component of Image SLES15-SP4-Manager-Server-4-3-BYOS patch-2.7.6-150000.5.6.1 as a component of Image SLES15-SP4-Manager-Server-4-3-BYOS-Azure patch-2.7.6-150000.5.6.1 as a component of Image SLES15-SP4-Manager-Server-4-3-BYOS-EC2 patch-2.7.6-150000.5.6.1 as a component of Image SLES15-SP4-Manager-Server-4-3-BYOS-GCE patch-2.7.6-150000.5.6.1 as a component of Image SLES15-SP4-Manager-Server-4-3-EC2-llc patch-2.7.6-150000.5.6.1 as a component of Image SLES15-SP4-Manager-Server-4-3-EC2-ltd patch-2.7.6-150000.5.6.1 as a component of Image SLES15-SP4-SAP patch-2.7.6-150000.5.6.1 as a component of Image SLES15-SP4-SAP-Azure patch-2.7.6-150000.5.6.1 as a component of Image SLES15-SP4-SAP-EC2 patch-2.7.6-150000.5.6.1 as a component of Image SLES15-SP4-SAP-GCE patch-2.7.6-150000.5.6.1 as a component of Image SLES15-SP4-SAPCAL patch-2.7.6-150000.5.6.1 as a component of Image SLES15-SP4-SAPCAL-Azure patch-2.7.6-150000.5.6.1 as a component of Image SLES15-SP4-SAPCAL-EC2 patch-2.7.6-150000.5.6.1 as a component of Image SLES15-SP4-SAPCAL-GCE patch-2.7.6-150000.5.6.1 as a component of Image SLES15-SP5-SAPCAL-Azure patch-2.7.6-150000.5.6.1 as a component of Image SLES15-SP5-SAPCAL-EC2 patch-2.7.6-150000.5.6.1 as a component of Image SLES15-SP5-SAPCAL-GCE patch-2.7.6-150000.5.6.1 as a component of Image SLES15-SP6-SAP patch-2.7.6-150000.5.6.1 as a component of Image SLES15-SP6-SAP-Azure patch-2.7.6-150000.5.6.1 as a component of Image SLES15-SP6-SAP-EC2 patch-2.7.6-150000.5.6.1 as a component of Image SLES15-SP6-SAP-GCE patch-2.7.6-150000.5.6.1 as a component of Image SLES15-SP6-SAPCAL patch-2.7.6-150000.5.6.1 as a component of Image SLES15-SP6-SAPCAL-Azure patch-2.7.6-150000.5.6.1 as a component of Image SLES15-SP6-SAPCAL-EC2 patch-2.7.6-150000.5.6.1 as a component of Image SLES15-SP6-SAPCAL-GCE patch-2.7.6-150000.5.6.1 as a component of Image server-image patch-2.7.6-150000.5.6.1 as a component of SUSE Linux Enterprise Module for Basesystem 15 SP5 patch-2.7.6-150000.5.6.1 as a component of SUSE Linux Enterprise Module for Basesystem 15 SP6 patch-2.7.6-150000.5.6.1 as a component of openSUSE Leap 15.5 patch-2.7.6-150000.5.6.1 as a component of openSUSE Leap 15.6 GNU patch through 2.7.6 contains a free(p_line[p_end]) Double Free vulnerability in the function another_hunk in pch.c that can cause a denial of service via a crafted patch file. NOTE: this issue exists because of an incomplete fix for CVE-2018-6952. CVE-2019-20633 Container bci/bci-sle15-kernel-module-devel:15.5:patch-2.7.6-150000.5.6.1 Container bci/bci-sle15-kernel-module-devel:15.7:patch-2.7.6-150000.5.6.1 Container bci/bci-sle15-kernel-module-devel:latest:patch-2.7.6-150000.5.6.1 Container bci/spack:0.23:patch-2.7.6-150000.5.6.1 Container bci/spack:latest:patch-2.7.6-150000.5.6.1 Container suse/manager/5.0/x86_64/server:latest:patch-2.7.6-150000.5.6.1 Image SLES15-SP3-SAPCAL-Azure:patch-2.7.6-150000.5.6.1 Image SLES15-SP3-SAPCAL-EC2-HVM:patch-2.7.6-150000.5.6.1 Image SLES15-SP3-SAPCAL-GCE:patch-2.7.6-150000.5.6.1 Image SLES15-SP4-Manager-Proxy-4-3-BYOS-Azure:patch-2.7.6-150000.5.6.1 Image SLES15-SP4-Manager-Proxy-4-3-BYOS-EC2:patch-2.7.6-150000.5.6.1 Image SLES15-SP4-Manager-Proxy-4-3-BYOS-GCE:patch-2.7.6-150000.5.6.1 Image SLES15-SP4-Manager-Proxy-4-3-BYOS:patch-2.7.6-150000.5.6.1 Image SLES15-SP4-Manager-Server-4-3-Azure-llc:patch-2.7.6-150000.5.6.1 Image SLES15-SP4-Manager-Server-4-3-Azure-ltd:patch-2.7.6-150000.5.6.1 Image SLES15-SP4-Manager-Server-4-3-BYOS-Azure:patch-2.7.6-150000.5.6.1 Image SLES15-SP4-Manager-Server-4-3-BYOS-EC2:patch-2.7.6-150000.5.6.1 Image SLES15-SP4-Manager-Server-4-3-BYOS-GCE:patch-2.7.6-150000.5.6.1 Image SLES15-SP4-Manager-Server-4-3-BYOS:patch-2.7.6-150000.5.6.1 Image SLES15-SP4-Manager-Server-4-3-EC2-llc:patch-2.7.6-150000.5.6.1 Image SLES15-SP4-Manager-Server-4-3-EC2-ltd:patch-2.7.6-150000.5.6.1 Image SLES15-SP4-Manager-Server-4-3:patch-2.7.6-150000.5.6.1 Image SLES15-SP4-SAP-Azure:patch-2.7.6-150000.5.6.1 Image SLES15-SP4-SAP-EC2:patch-2.7.6-150000.5.6.1 Image SLES15-SP4-SAP-GCE:patch-2.7.6-150000.5.6.1 Image SLES15-SP4-SAP:patch-2.7.6-150000.5.6.1 Image SLES15-SP4-SAPCAL-Azure:patch-2.7.6-150000.5.6.1 Image SLES15-SP4-SAPCAL-EC2:patch-2.7.6-150000.5.6.1 Image SLES15-SP4-SAPCAL-GCE:patch-2.7.6-150000.5.6.1 Image SLES15-SP4-SAPCAL:patch-2.7.6-150000.5.6.1 Image SLES15-SP5-SAPCAL-Azure:patch-2.7.6-150000.5.6.1 Image SLES15-SP5-SAPCAL-EC2:patch-2.7.6-150000.5.6.1 Image SLES15-SP5-SAPCAL-GCE:patch-2.7.6-150000.5.6.1 Image SLES15-SP6-SAP-Azure:patch-2.7.6-150000.5.6.1 Image SLES15-SP6-SAP-EC2:patch-2.7.6-150000.5.6.1 Image SLES15-SP6-SAP-GCE:patch-2.7.6-150000.5.6.1 Image SLES15-SP6-SAP:patch-2.7.6-150000.5.6.1 Image SLES15-SP6-SAPCAL-Azure:patch-2.7.6-150000.5.6.1 Image SLES15-SP6-SAPCAL-EC2:patch-2.7.6-150000.5.6.1 Image SLES15-SP6-SAPCAL-GCE:patch-2.7.6-150000.5.6.1 Image SLES15-SP6-SAPCAL:patch-2.7.6-150000.5.6.1 Image server-image:patch-2.7.6-150000.5.6.1 SUSE Linux Enterprise Module for Basesystem 15 SP5:patch-2.7.6-150000.5.6.1 SUSE Linux Enterprise Module for Basesystem 15 SP6:patch-2.7.6-150000.5.6.1 openSUSE Leap 15.5:patch-2.7.6-150000.5.6.1 openSUSE Leap 15.6:patch-2.7.6-150000.5.6.1 low 4.3 AV:N/AC:M/Au:N/C:N/I:N/A:P To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/support/update/announcement/2024/suse-su-20242780-1/ https://www.suse.com/security/cve/CVE-2019-20633.html CVE-2019-20633 https://bugzilla.suse.com/1080985 SUSE Bug 1080985 https://bugzilla.suse.com/1167721 SUSE Bug 1167721