Security update for libmfx SUSE Patch security@suse.de SUSE Security Team SUSE-SU-2024:3339-1 Final 1 1 2024-09-19T14:32:08Z current 2024-09-19T14:32:08Z 2024-09-19T14:32:08Z cve-database/bin/generate-cvrf.pl 2017-02-24T01:00:00Z Security update for libmfx This update for libmfx fixes the following issues: - CVE-2023-48368: Fixed an improper input validation. (bsc#1226897) - CVE-2023-45221: Fixed an improper buffer restrictions. (bsc#1226898) - CVE-2023-22656: Fixed an out-of-bounds read. (bsc#1226899) - CVE-2023-47282: Fixed an out-of-bounds write. (bsc#1226900) - CVE-2023-47169: Fixed an improper buffer restrictions. (bsc#1226901) The CVRF data is provided by SUSE under the Creative Commons License 4.0 with Attribution (CC-BY-4.0). SUSE-2024-3339,SUSE-SLE-Module-Desktop-Applications-15-SP5-2024-3339,SUSE-SLE-Module-Packagehub-Subpackages-15-SP5-2024-3339,openSUSE-SLE-15.5-2024-3339 Copyright SUSE LLC under the Creative Commons License 4.0 with Attribution (CC-BY-4.0) https://www.suse.com/support/update/announcement/2024/suse-su-20243339-1/ Link for SUSE-SU-2024:3339-1 https://lists.suse.com/pipermail/sle-updates/2024-September/036983.html E-Mail link for SUSE-SU-2024:3339-1 https://www.suse.com/support/security/rating/ SUSE Security Ratings https://bugzilla.suse.com/1219494 SUSE Bug 1219494 https://bugzilla.suse.com/1226892 SUSE Bug 1226892 https://bugzilla.suse.com/1226897 SUSE Bug 1226897 https://bugzilla.suse.com/1226898 SUSE Bug 1226898 https://bugzilla.suse.com/1226899 SUSE Bug 1226899 https://bugzilla.suse.com/1226900 SUSE Bug 1226900 https://bugzilla.suse.com/1226901 SUSE Bug 1226901 https://www.suse.com/security/cve/CVE-2023-22656/ SUSE CVE CVE-2023-22656 page https://www.suse.com/security/cve/CVE-2023-45221/ SUSE CVE CVE-2023-45221 page https://www.suse.com/security/cve/CVE-2023-47169/ SUSE CVE CVE-2023-47169 page https://www.suse.com/security/cve/CVE-2023-47282/ SUSE CVE CVE-2023-47282 page https://www.suse.com/security/cve/CVE-2023-48368/ SUSE CVE CVE-2023-48368 page SUSE Linux Enterprise Module for Desktop Applications 15 SP5 SUSE Linux Enterprise Module for Package Hub 15 SP5 openSUSE Leap 15.5 libmfx-22.6.1-150500.3.5.1 libmfx1-22.6.1-150500.3.5.1 libmfx1-22.6.1-150500.3.5.1 as a component of SUSE Linux Enterprise Module for Desktop Applications 15 SP5 libmfx1-22.6.1-150500.3.5.1 as a component of SUSE Linux Enterprise Module for Package Hub 15 SP5 libmfx-22.6.1-150500.3.5.1 as a component of openSUSE Leap 15.5 libmfx1-22.6.1-150500.3.5.1 as a component of openSUSE Leap 15.5 Out-of-bounds read in Intel(R) Media SDK and some Intel(R) oneVPL software before version 23.3.5 may allow an authenticated user to potentially enable escalation of privilege via local access. CVE-2023-22656 SUSE Linux Enterprise Module for Desktop Applications 15 SP5:libmfx1-22.6.1-150500.3.5.1 SUSE Linux Enterprise Module for Package Hub 15 SP5:libmfx1-22.6.1-150500.3.5.1 openSUSE Leap 15.5:libmfx-22.6.1-150500.3.5.1 openSUSE Leap 15.5:libmfx1-22.6.1-150500.3.5.1 low To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/support/update/announcement/2024/suse-su-20243339-1/ https://www.suse.com/security/cve/CVE-2023-22656.html CVE-2023-22656 https://bugzilla.suse.com/1226899 SUSE Bug 1226899 Improper buffer restrictions in Intel(R) Media SDK all versions may allow an authenticated user to potentially enable escalation of privilege via local access. CVE-2023-45221 SUSE Linux Enterprise Module for Desktop Applications 15 SP5:libmfx1-22.6.1-150500.3.5.1 SUSE Linux Enterprise Module for Package Hub 15 SP5:libmfx1-22.6.1-150500.3.5.1 openSUSE Leap 15.5:libmfx-22.6.1-150500.3.5.1 openSUSE Leap 15.5:libmfx1-22.6.1-150500.3.5.1 moderate To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/support/update/announcement/2024/suse-su-20243339-1/ https://www.suse.com/security/cve/CVE-2023-45221.html CVE-2023-45221 https://bugzilla.suse.com/1226898 SUSE Bug 1226898 Improper buffer restrictions in Intel(R) Media SDK software all versions may allow an authenticated user to potentially enable denial of service via local access. CVE-2023-47169 SUSE Linux Enterprise Module for Desktop Applications 15 SP5:libmfx1-22.6.1-150500.3.5.1 SUSE Linux Enterprise Module for Package Hub 15 SP5:libmfx1-22.6.1-150500.3.5.1 openSUSE Leap 15.5:libmfx-22.6.1-150500.3.5.1 openSUSE Leap 15.5:libmfx1-22.6.1-150500.3.5.1 low To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/support/update/announcement/2024/suse-su-20243339-1/ https://www.suse.com/security/cve/CVE-2023-47169.html CVE-2023-47169 https://bugzilla.suse.com/1226901 SUSE Bug 1226901 Out-of-bounds write in Intel(R) Media SDK all versions and some Intel(R) oneVPL software before version 23.3.5 may allow an authenticated user to potentially enable escalation of privilege via local access. CVE-2023-47282 SUSE Linux Enterprise Module for Desktop Applications 15 SP5:libmfx1-22.6.1-150500.3.5.1 SUSE Linux Enterprise Module for Package Hub 15 SP5:libmfx1-22.6.1-150500.3.5.1 openSUSE Leap 15.5:libmfx-22.6.1-150500.3.5.1 openSUSE Leap 15.5:libmfx1-22.6.1-150500.3.5.1 low To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/support/update/announcement/2024/suse-su-20243339-1/ https://www.suse.com/security/cve/CVE-2023-47282.html CVE-2023-47282 https://bugzilla.suse.com/1226900 SUSE Bug 1226900 Improper input validation in Intel(R) Media SDK software all versions may allow an authenticated user to potentially enable denial of service via local access. CVE-2023-48368 SUSE Linux Enterprise Module for Desktop Applications 15 SP5:libmfx1-22.6.1-150500.3.5.1 SUSE Linux Enterprise Module for Package Hub 15 SP5:libmfx1-22.6.1-150500.3.5.1 openSUSE Leap 15.5:libmfx-22.6.1-150500.3.5.1 openSUSE Leap 15.5:libmfx1-22.6.1-150500.3.5.1 moderate To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/support/update/announcement/2024/suse-su-20243339-1/ https://www.suse.com/security/cve/CVE-2023-48368.html CVE-2023-48368 https://bugzilla.suse.com/1226897 SUSE Bug 1226897