<updates>
  <update from="maint-coord@suse.de" status="stable" type="feature" version="1">
    <id>openSUSE-SLE-15.4-2022-19</id>
    <title>Feature update for ghostscript and gswrap</title>
    <severity>moderate</severity>
    <release>SUSE Updates openSUSE-SLE 15.4</release>
    <issued date="1641288234"/>
    <references>
      <reference href="https://jira.suse.com/browse/SLE-21706" id="SLE-21706" title="https://jira.suse.com/browse/SLE-21706" type="jira"/>
      <reference href="https://jira.suse.com/browse/SLE-21705" id="SLE-21705" title="https://jira.suse.com/browse/SLE-21705" type="jira"/>
    </references>
    <description>This update for ghostscript, gswrap fixes the following issues:

We now ship an additional wraper for ghostscript, called gswrap, for SLE 15 SP2 and SLE15 SP3. You can install this wrapper by installing the gswrap package.

- Allow the `gswrap` package to use its wrapper script for `ghostscript` (jsc#SLE-21705 jsc#SLE-21706)
- Use `update-alternatives` to get the real `ghostscript` binary from `/usr/bin/gs` to `/usr/bin/gs.bin`
</description>
    <pkglist>
      <collection>
        <package name="ghostscript" epoch="0" version="9.52" release="158.1" arch="src" src="src/ghostscript-9.52-158.1.src.rpm">
          <filename>ghostscript-9.52-158.1.src.rpm</filename>
        </package>
        <package name="ghostscript" epoch="0" version="9.52" release="158.1" arch="x86_64" src="x86_64/ghostscript-9.52-158.1.x86_64.rpm">
          <filename>ghostscript-9.52-158.1.x86_64.rpm</filename>
        </package>
        <package name="ghostscript-devel" epoch="0" version="9.52" release="158.1" arch="x86_64" src="x86_64/ghostscript-devel-9.52-158.1.x86_64.rpm">
          <filename>ghostscript-devel-9.52-158.1.x86_64.rpm</filename>
        </package>
        <package name="ghostscript-x11" epoch="0" version="9.52" release="158.1" arch="x86_64" src="x86_64/ghostscript-x11-9.52-158.1.x86_64.rpm">
          <filename>ghostscript-x11-9.52-158.1.x86_64.rpm</filename>
        </package>
        <package name="ghostscript" epoch="0" version="9.52" release="158.1" arch="s390x" src="s390x/ghostscript-9.52-158.1.s390x.rpm">
          <filename>ghostscript-9.52-158.1.s390x.rpm</filename>
        </package>
        <package name="ghostscript-devel" epoch="0" version="9.52" release="158.1" arch="s390x" src="s390x/ghostscript-devel-9.52-158.1.s390x.rpm">
          <filename>ghostscript-devel-9.52-158.1.s390x.rpm</filename>
        </package>
        <package name="ghostscript-x11" epoch="0" version="9.52" release="158.1" arch="s390x" src="s390x/ghostscript-x11-9.52-158.1.s390x.rpm">
          <filename>ghostscript-x11-9.52-158.1.s390x.rpm</filename>
        </package>
        <package name="ghostscript" epoch="0" version="9.52" release="158.1" arch="ppc64le" src="ppc64le/ghostscript-9.52-158.1.ppc64le.rpm">
          <filename>ghostscript-9.52-158.1.ppc64le.rpm</filename>
        </package>
        <package name="ghostscript-devel" epoch="0" version="9.52" release="158.1" arch="ppc64le" src="ppc64le/ghostscript-devel-9.52-158.1.ppc64le.rpm">
          <filename>ghostscript-devel-9.52-158.1.ppc64le.rpm</filename>
        </package>
        <package name="ghostscript-x11" epoch="0" version="9.52" release="158.1" arch="ppc64le" src="ppc64le/ghostscript-x11-9.52-158.1.ppc64le.rpm">
          <filename>ghostscript-x11-9.52-158.1.ppc64le.rpm</filename>
        </package>
        <package name="ghostscript" epoch="0" version="9.52" release="158.1" arch="aarch64" src="aarch64/ghostscript-9.52-158.1.aarch64.rpm">
          <filename>ghostscript-9.52-158.1.aarch64.rpm</filename>
        </package>
        <package name="ghostscript-devel" epoch="0" version="9.52" release="158.1" arch="aarch64" src="aarch64/ghostscript-devel-9.52-158.1.aarch64.rpm">
          <filename>ghostscript-devel-9.52-158.1.aarch64.rpm</filename>
        </package>
        <package name="ghostscript-x11" epoch="0" version="9.52" release="158.1" arch="aarch64" src="aarch64/ghostscript-x11-9.52-158.1.aarch64.rpm">
          <filename>ghostscript-x11-9.52-158.1.aarch64.rpm</filename>
        </package>
      </collection>
    </pkglist>
  </update>
  <update from="maint-coord@suse.de" status="stable" type="recommended" version="1">
    <id>openSUSE-SLE-15.4-2022-143</id>
    <title>Recommended update for java-11-openjdk</title>
    <severity>moderate</severity>
    <release>SUSE Updates openSUSE-SLE 15.4</release>
    <issued date="1642685614"/>
    <references>
      <reference href="https://bugzilla.suse.com/show_bug.cgi?id=1193314" id="1193314" title="L3: Cipher suite problems with java u312 [ref:_00D1igLOd._5001inJsjH:ref]" type="bugzilla"/>
    </references>
    <description>This update for java-11-openjdk fixes the following issues:

- Java Cryptography was always operating in FIPS mode if crypto-policies was not used.
- Allow plain key import in fips mode unless &quot;com.suse.fips.plainKeySupport&quot; is set to false
</description>
    <pkglist>
      <collection>
        <package name="java-11-openjdk" epoch="0" version="11.0.13.0" release="3.68.1" arch="src" src="src/java-11-openjdk-11.0.13.0-3.68.1.src.rpm">
          <filename>java-11-openjdk-11.0.13.0-3.68.1.src.rpm</filename>
        </package>
        <package name="java-11-openjdk" epoch="0" version="11.0.13.0" release="3.68.1" arch="x86_64" src="x86_64/java-11-openjdk-11.0.13.0-3.68.1.x86_64.rpm">
          <filename>java-11-openjdk-11.0.13.0-3.68.1.x86_64.rpm</filename>
        </package>
        <package name="java-11-openjdk-accessibility" epoch="0" version="11.0.13.0" release="3.68.1" arch="x86_64" src="x86_64/java-11-openjdk-accessibility-11.0.13.0-3.68.1.x86_64.rpm">
          <filename>java-11-openjdk-accessibility-11.0.13.0-3.68.1.x86_64.rpm</filename>
        </package>
        <package name="java-11-openjdk-demo" epoch="0" version="11.0.13.0" release="3.68.1" arch="x86_64" src="x86_64/java-11-openjdk-demo-11.0.13.0-3.68.1.x86_64.rpm">
          <filename>java-11-openjdk-demo-11.0.13.0-3.68.1.x86_64.rpm</filename>
        </package>
        <package name="java-11-openjdk-devel" epoch="0" version="11.0.13.0" release="3.68.1" arch="x86_64" src="x86_64/java-11-openjdk-devel-11.0.13.0-3.68.1.x86_64.rpm">
          <filename>java-11-openjdk-devel-11.0.13.0-3.68.1.x86_64.rpm</filename>
        </package>
        <package name="java-11-openjdk-headless" epoch="0" version="11.0.13.0" release="3.68.1" arch="x86_64" src="x86_64/java-11-openjdk-headless-11.0.13.0-3.68.1.x86_64.rpm">
          <filename>java-11-openjdk-headless-11.0.13.0-3.68.1.x86_64.rpm</filename>
        </package>
        <package name="java-11-openjdk-javadoc" epoch="0" version="11.0.13.0" release="3.68.1" arch="noarch" src="noarch/java-11-openjdk-javadoc-11.0.13.0-3.68.1.noarch.rpm">
          <filename>java-11-openjdk-javadoc-11.0.13.0-3.68.1.noarch.rpm</filename>
        </package>
        <package name="java-11-openjdk-jmods" epoch="0" version="11.0.13.0" release="3.68.1" arch="x86_64" src="x86_64/java-11-openjdk-jmods-11.0.13.0-3.68.1.x86_64.rpm">
          <filename>java-11-openjdk-jmods-11.0.13.0-3.68.1.x86_64.rpm</filename>
        </package>
        <package name="java-11-openjdk-src" epoch="0" version="11.0.13.0" release="3.68.1" arch="x86_64" src="x86_64/java-11-openjdk-src-11.0.13.0-3.68.1.x86_64.rpm">
          <filename>java-11-openjdk-src-11.0.13.0-3.68.1.x86_64.rpm</filename>
        </package>
        <package name="java-11-openjdk" epoch="0" version="11.0.13.0" release="3.68.1" arch="s390x" src="s390x/java-11-openjdk-11.0.13.0-3.68.1.s390x.rpm">
          <filename>java-11-openjdk-11.0.13.0-3.68.1.s390x.rpm</filename>
        </package>
        <package name="java-11-openjdk-accessibility" epoch="0" version="11.0.13.0" release="3.68.1" arch="s390x" src="s390x/java-11-openjdk-accessibility-11.0.13.0-3.68.1.s390x.rpm">
          <filename>java-11-openjdk-accessibility-11.0.13.0-3.68.1.s390x.rpm</filename>
        </package>
        <package name="java-11-openjdk-demo" epoch="0" version="11.0.13.0" release="3.68.1" arch="s390x" src="s390x/java-11-openjdk-demo-11.0.13.0-3.68.1.s390x.rpm">
          <filename>java-11-openjdk-demo-11.0.13.0-3.68.1.s390x.rpm</filename>
        </package>
        <package name="java-11-openjdk-devel" epoch="0" version="11.0.13.0" release="3.68.1" arch="s390x" src="s390x/java-11-openjdk-devel-11.0.13.0-3.68.1.s390x.rpm">
          <filename>java-11-openjdk-devel-11.0.13.0-3.68.1.s390x.rpm</filename>
        </package>
        <package name="java-11-openjdk-headless" epoch="0" version="11.0.13.0" release="3.68.1" arch="s390x" src="s390x/java-11-openjdk-headless-11.0.13.0-3.68.1.s390x.rpm">
          <filename>java-11-openjdk-headless-11.0.13.0-3.68.1.s390x.rpm</filename>
        </package>
        <package name="java-11-openjdk-jmods" epoch="0" version="11.0.13.0" release="3.68.1" arch="s390x" src="s390x/java-11-openjdk-jmods-11.0.13.0-3.68.1.s390x.rpm">
          <filename>java-11-openjdk-jmods-11.0.13.0-3.68.1.s390x.rpm</filename>
        </package>
        <package name="java-11-openjdk-src" epoch="0" version="11.0.13.0" release="3.68.1" arch="s390x" src="s390x/java-11-openjdk-src-11.0.13.0-3.68.1.s390x.rpm">
          <filename>java-11-openjdk-src-11.0.13.0-3.68.1.s390x.rpm</filename>
        </package>
        <package name="java-11-openjdk" epoch="0" version="11.0.13.0" release="3.68.1" arch="ppc64le" src="ppc64le/java-11-openjdk-11.0.13.0-3.68.1.ppc64le.rpm">
          <filename>java-11-openjdk-11.0.13.0-3.68.1.ppc64le.rpm</filename>
        </package>
        <package name="java-11-openjdk-accessibility" epoch="0" version="11.0.13.0" release="3.68.1" arch="ppc64le" src="ppc64le/java-11-openjdk-accessibility-11.0.13.0-3.68.1.ppc64le.rpm">
          <filename>java-11-openjdk-accessibility-11.0.13.0-3.68.1.ppc64le.rpm</filename>
        </package>
        <package name="java-11-openjdk-demo" epoch="0" version="11.0.13.0" release="3.68.1" arch="ppc64le" src="ppc64le/java-11-openjdk-demo-11.0.13.0-3.68.1.ppc64le.rpm">
          <filename>java-11-openjdk-demo-11.0.13.0-3.68.1.ppc64le.rpm</filename>
        </package>
        <package name="java-11-openjdk-devel" epoch="0" version="11.0.13.0" release="3.68.1" arch="ppc64le" src="ppc64le/java-11-openjdk-devel-11.0.13.0-3.68.1.ppc64le.rpm">
          <filename>java-11-openjdk-devel-11.0.13.0-3.68.1.ppc64le.rpm</filename>
        </package>
        <package name="java-11-openjdk-headless" epoch="0" version="11.0.13.0" release="3.68.1" arch="ppc64le" src="ppc64le/java-11-openjdk-headless-11.0.13.0-3.68.1.ppc64le.rpm">
          <filename>java-11-openjdk-headless-11.0.13.0-3.68.1.ppc64le.rpm</filename>
        </package>
        <package name="java-11-openjdk-jmods" epoch="0" version="11.0.13.0" release="3.68.1" arch="ppc64le" src="ppc64le/java-11-openjdk-jmods-11.0.13.0-3.68.1.ppc64le.rpm">
          <filename>java-11-openjdk-jmods-11.0.13.0-3.68.1.ppc64le.rpm</filename>
        </package>
        <package name="java-11-openjdk-src" epoch="0" version="11.0.13.0" release="3.68.1" arch="ppc64le" src="ppc64le/java-11-openjdk-src-11.0.13.0-3.68.1.ppc64le.rpm">
          <filename>java-11-openjdk-src-11.0.13.0-3.68.1.ppc64le.rpm</filename>
        </package>
        <package name="java-11-openjdk" epoch="0" version="11.0.13.0" release="3.68.1" arch="aarch64" src="aarch64/java-11-openjdk-11.0.13.0-3.68.1.aarch64.rpm">
          <filename>java-11-openjdk-11.0.13.0-3.68.1.aarch64.rpm</filename>
        </package>
        <package name="java-11-openjdk-accessibility" epoch="0" version="11.0.13.0" release="3.68.1" arch="aarch64" src="aarch64/java-11-openjdk-accessibility-11.0.13.0-3.68.1.aarch64.rpm">
          <filename>java-11-openjdk-accessibility-11.0.13.0-3.68.1.aarch64.rpm</filename>
        </package>
        <package name="java-11-openjdk-demo" epoch="0" version="11.0.13.0" release="3.68.1" arch="aarch64" src="aarch64/java-11-openjdk-demo-11.0.13.0-3.68.1.aarch64.rpm">
          <filename>java-11-openjdk-demo-11.0.13.0-3.68.1.aarch64.rpm</filename>
        </package>
        <package name="java-11-openjdk-devel" epoch="0" version="11.0.13.0" release="3.68.1" arch="aarch64" src="aarch64/java-11-openjdk-devel-11.0.13.0-3.68.1.aarch64.rpm">
          <filename>java-11-openjdk-devel-11.0.13.0-3.68.1.aarch64.rpm</filename>
        </package>
        <package name="java-11-openjdk-headless" epoch="0" version="11.0.13.0" release="3.68.1" arch="aarch64" src="aarch64/java-11-openjdk-headless-11.0.13.0-3.68.1.aarch64.rpm">
          <filename>java-11-openjdk-headless-11.0.13.0-3.68.1.aarch64.rpm</filename>
        </package>
        <package name="java-11-openjdk-jmods" epoch="0" version="11.0.13.0" release="3.68.1" arch="aarch64" src="aarch64/java-11-openjdk-jmods-11.0.13.0-3.68.1.aarch64.rpm">
          <filename>java-11-openjdk-jmods-11.0.13.0-3.68.1.aarch64.rpm</filename>
        </package>
        <package name="java-11-openjdk-src" epoch="0" version="11.0.13.0" release="3.68.1" arch="aarch64" src="aarch64/java-11-openjdk-src-11.0.13.0-3.68.1.aarch64.rpm">
          <filename>java-11-openjdk-src-11.0.13.0-3.68.1.aarch64.rpm</filename>
        </package>
      </collection>
    </pkglist>
  </update>
  <update from="maint-coord@suse.de" status="stable" type="security" version="1">
    <id>openSUSE-SLE-15.4-2022-157</id>
    <title>Security update for zxing-cpp</title>
    <severity>important</severity>
    <release>SUSE Updates openSUSE-SLE 15.4</release>
    <issued date="1643015447"/>
    <references>
      <reference href="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-28021" id="CVE-2021-28021" title="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-28021" type="cve"/>
      <reference href="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-42715" id="CVE-2021-42715" title="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-42715" type="cve"/>
      <reference href="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-42716" id="CVE-2021-42716" title="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-42716" type="cve"/>
      <reference href="https://bugzilla.suse.com/show_bug.cgi?id=1191743" id="1191743" title="VUL-1: CVE-2021-28021: Buffer overflow vulnerability in function stbi__extend_receive in stb_image.h in stb 2.26 via a crafted JPEG file." type="bugzilla"/>
      <reference href="https://bugzilla.suse.com/show_bug.cgi?id=1191942" id="1191942" title="VUL-1: CVE-2021-42715: stb: denial of service in stb_image HDR loader when reading crafted HDR files" type="bugzilla"/>
      <reference href="https://bugzilla.suse.com/show_bug.cgi?id=1191944" id="1191944" title="VUL-1: CVE-2021-42716: stb: buffer overflow in stb_image PNM loader" type="bugzilla"/>
    </references>
    <description>This update for zxing-cpp fixes the following issues:

- CVE-2021-28021: Fixed buffer overflow vulnerability in function stbi__extend_receive in stb_image.h via a crafted JPEG file. (bsc#1191743).
- CVE-2021-42715: Fixed buffer overflow in stb_image PNM loader (bsc#1191942).
- CVE-2021-42716: Fixed denial of service in stb_image HDR loader when reading crafted HDR files (bsc#1191944).
</description>
    <pkglist>
      <collection>
        <package name="libZXing1" epoch="0" version="1.2.0" release="9.7.1" arch="x86_64" src="x86_64/libZXing1-1.2.0-9.7.1.x86_64.rpm">
          <filename>libZXing1-1.2.0-9.7.1.x86_64.rpm</filename>
        </package>
        <package name="libZXing1-32bit" epoch="0" version="1.2.0" release="9.7.1" arch="x86_64" src="x86_64/libZXing1-32bit-1.2.0-9.7.1.x86_64.rpm">
          <filename>libZXing1-32bit-1.2.0-9.7.1.x86_64.rpm</filename>
        </package>
        <package name="zxing-cpp" epoch="0" version="1.2.0" release="9.7.1" arch="src" src="src/zxing-cpp-1.2.0-9.7.1.src.rpm">
          <filename>zxing-cpp-1.2.0-9.7.1.src.rpm</filename>
        </package>
        <package name="zxing-cpp-devel" epoch="0" version="1.2.0" release="9.7.1" arch="x86_64" src="x86_64/zxing-cpp-devel-1.2.0-9.7.1.x86_64.rpm">
          <filename>zxing-cpp-devel-1.2.0-9.7.1.x86_64.rpm</filename>
        </package>
        <package name="libZXing1" epoch="0" version="1.2.0" release="9.7.1" arch="s390x" src="s390x/libZXing1-1.2.0-9.7.1.s390x.rpm">
          <filename>libZXing1-1.2.0-9.7.1.s390x.rpm</filename>
        </package>
        <package name="zxing-cpp-devel" epoch="0" version="1.2.0" release="9.7.1" arch="s390x" src="s390x/zxing-cpp-devel-1.2.0-9.7.1.s390x.rpm">
          <filename>zxing-cpp-devel-1.2.0-9.7.1.s390x.rpm</filename>
        </package>
        <package name="libZXing1" epoch="0" version="1.2.0" release="9.7.1" arch="ppc64le" src="ppc64le/libZXing1-1.2.0-9.7.1.ppc64le.rpm">
          <filename>libZXing1-1.2.0-9.7.1.ppc64le.rpm</filename>
        </package>
        <package name="zxing-cpp-devel" epoch="0" version="1.2.0" release="9.7.1" arch="ppc64le" src="ppc64le/zxing-cpp-devel-1.2.0-9.7.1.ppc64le.rpm">
          <filename>zxing-cpp-devel-1.2.0-9.7.1.ppc64le.rpm</filename>
        </package>
        <package name="libZXing1" epoch="0" version="1.2.0" release="9.7.1" arch="aarch64" src="aarch64/libZXing1-1.2.0-9.7.1.aarch64.rpm">
          <filename>libZXing1-1.2.0-9.7.1.aarch64.rpm</filename>
        </package>
        <package name="zxing-cpp-devel" epoch="0" version="1.2.0" release="9.7.1" arch="aarch64" src="aarch64/zxing-cpp-devel-1.2.0-9.7.1.aarch64.rpm">
          <filename>zxing-cpp-devel-1.2.0-9.7.1.aarch64.rpm</filename>
        </package>
      </collection>
    </pkglist>
  </update>
  <update from="maint-coord@suse.de" status="stable" type="security" version="1">
    <id>openSUSE-SLE-15.4-2022-176</id>
    <title>Security update for unbound</title>
    <severity>important</severity>
    <release>SUSE Updates openSUSE-SLE 15.4</release>
    <issued date="1643116440"/>
    <references>
      <reference href="https://bugzilla.suse.com/show_bug.cgi?id=1076963" id="1076963" title="VUL-1: CVE-2017-15105: unbound: Improper validation of wildcard synthesized NSEC records" type="bugzilla"/>
      <reference href="https://bugzilla.suse.com/show_bug.cgi?id=1112009" id="1112009" title="VUL-0: unbound: update KSK (due to DNSSEC root KSK rollover)" type="bugzilla"/>
      <reference href="https://bugzilla.suse.com/show_bug.cgi?id=1112033" id="1112033" title="VUL-0: unbound: /etc/unbound/icannbundle.pem outdated intermediate certificates" type="bugzilla"/>
      <reference href="https://bugzilla.suse.com/show_bug.cgi?id=1179191" id="1179191" title="VUL-1: CVE-2020-28935: unbound:  symbolic link traversal when writing PID file" type="bugzilla"/>
      <reference href="https://bugzilla.suse.com/show_bug.cgi?id=1185382" id="1185382" title="VUL-0: CVE-2019-25031: unbound: configuration injection in create_unbound_ad_servers.sh upon a successful man-in-the-middle attack" type="bugzilla"/>
      <reference href="https://bugzilla.suse.com/show_bug.cgi?id=1185383" id="1185383" title="VUL-0: CVE-2019-25032: unbound: integer overflow in the regional allocator via regional_alloc" type="bugzilla"/>
      <reference href="https://bugzilla.suse.com/show_bug.cgi?id=1185384" id="1185384" title="VUL-0: CVE-2019-25033: unbound: integer overflow in the regional allocator via the ALIGN_UP macro" type="bugzilla"/>
      <reference href="https://bugzilla.suse.com/show_bug.cgi?id=1185385" id="1185385" title="VUL-0: CVE-2019-25034: unbound: integer overflow in sldns_str2wire_dname_buf_origin, leading to an out-of-bounds write" type="bugzilla"/>
      <reference href="https://bugzilla.suse.com/show_bug.cgi?id=1185386" id="1185386" title="VUL-0: CVE-2019-25035: unbound: out-of-bounds write in sldns_bget_token_par" type="bugzilla"/>
      <reference href="https://bugzilla.suse.com/show_bug.cgi?id=1185387" id="1185387" title="VUL-0: CVE-2019-25036: unbound: assertion failure and denial of service in synth_cname" type="bugzilla"/>
      <reference href="https://bugzilla.suse.com/show_bug.cgi?id=1185388" id="1185388" title="VUL-0: CVE-2019-25037: unbound: assertion failure and denial of service in dname_pkt_copy via an invalid packet" type="bugzilla"/>
      <reference href="https://bugzilla.suse.com/show_bug.cgi?id=1185389" id="1185389" title="VUL-0: CVE-2019-25038: unbound: integer overflow in a size calculation in dnscrypt/dnscrypt.c" type="bugzilla"/>
      <reference href="https://bugzilla.suse.com/show_bug.cgi?id=1185390" id="1185390" title="VUL-0: CVE-2019-25039: unbound: integer overflow in a size calculation in respip/respip.c" type="bugzilla"/>
      <reference href="https://bugzilla.suse.com/show_bug.cgi?id=1185391" id="1185391" title="VUL-0: CVE-2019-25040: unbound: infinite loop via a compressed name in dname_pkt_copy" type="bugzilla"/>
      <reference href="https://bugzilla.suse.com/show_bug.cgi?id=1185392" id="1185392" title="VUL-0: CVE-2019-25041: unbound: assertion failure via a compressed name in dname_pkt_copy" type="bugzilla"/>
      <reference href="https://bugzilla.suse.com/show_bug.cgi?id=1185393" id="1185393" title="VUL-0: CVE-2019-25042: unbound: out-of-bounds write via a compressed name in rdata_copy" type="bugzilla"/>
      <reference href="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-25031" id="CVE-2019-25031" title="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-25031" type="cve"/>
      <reference href="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-25032" id="CVE-2019-25032" title="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-25032" type="cve"/>
      <reference href="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-25033" id="CVE-2019-25033" title="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-25033" type="cve"/>
      <reference href="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-25034" id="CVE-2019-25034" title="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-25034" type="cve"/>
      <reference href="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-25035" id="CVE-2019-25035" title="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-25035" type="cve"/>
      <reference href="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-25036" id="CVE-2019-25036" title="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-25036" type="cve"/>
      <reference href="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-25037" id="CVE-2019-25037" title="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-25037" type="cve"/>
      <reference href="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-25038" id="CVE-2019-25038" title="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-25038" type="cve"/>
      <reference href="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-25039" id="CVE-2019-25039" title="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-25039" type="cve"/>
      <reference href="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-25040" id="CVE-2019-25040" title="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-25040" type="cve"/>
      <reference href="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-25041" id="CVE-2019-25041" title="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-25041" type="cve"/>
      <reference href="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-25042" id="CVE-2019-25042" title="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-25042" type="cve"/>
      <reference href="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-28935" id="CVE-2020-28935" title="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-28935" type="cve"/>
    </references>
    <description>This update for unbound fixes the following issues:

- CVE-2019-25031: Fixed configuration injection in create_unbound_ad_servers.sh upon a successful man-in-the-middle attack (bsc#1185382).
- CVE-2019-25032: Fixed integer overflow in the regional allocator via regional_alloc (bsc#1185383).
- CVE-2019-25033: Fixed integer overflow in the regional allocator via the ALIGN_UP macro (bsc#1185384).
- CVE-2019-25034: Fixed integer overflow in sldns_str2wire_dname_buf_origin, leading to an out-of-bounds write (bsc#1185385).
- CVE-2019-25035: Fixed out-of-bounds write in sldns_bget_token_par (bsc#1185386).
- CVE-2019-25036: Fixed assertion failure and denial of service in synth_cname (bsc#1185387).
- CVE-2019-25037: Fixed assertion failure and denial of service in dname_pkt_copy via an invalid packet (bsc#1185388).
- CVE-2019-25038: Fixed integer overflow in a size calculation in dnscrypt/dnscrypt.c (bsc#1185389).
- CVE-2019-25039: Fixed integer overflow in a size calculation in respip/respip.c (bsc#1185390).
- CVE-2019-25040: Fixed infinite loop via a compressed name in dname_pkt_copy (bsc#1185391).
- CVE-2019-25041: Fixed assertion failure via a compressed name in dname_pkt_copy (bsc#1185392).
- CVE-2019-25042: Fixed out-of-bounds write via a compressed name in rdata_copy (bsc#1185393).
- CVE-2020-28935: Fixed symbolic link traversal when writing PID file (bsc#1179191).
</description>
    <pkglist>
      <collection>
        <package name="libunbound2" epoch="0" version="1.6.8" release="10.6.1" arch="x86_64" src="x86_64/libunbound2-1.6.8-10.6.1.x86_64.rpm">
          <filename>libunbound2-1.6.8-10.6.1.x86_64.rpm</filename>
        </package>
        <package name="unbound" epoch="0" version="1.6.8" release="10.6.1" arch="src" src="src/unbound-1.6.8-10.6.1.src.rpm">
          <filename>unbound-1.6.8-10.6.1.src.rpm</filename>
        </package>
        <package name="unbound" epoch="0" version="1.6.8" release="10.6.1" arch="x86_64" src="x86_64/unbound-1.6.8-10.6.1.x86_64.rpm">
          <filename>unbound-1.6.8-10.6.1.x86_64.rpm</filename>
        </package>
        <package name="unbound-anchor" epoch="0" version="1.6.8" release="10.6.1" arch="x86_64" src="x86_64/unbound-anchor-1.6.8-10.6.1.x86_64.rpm">
          <filename>unbound-anchor-1.6.8-10.6.1.x86_64.rpm</filename>
        </package>
        <package name="unbound-devel" epoch="0" version="1.6.8" release="10.6.1" arch="x86_64" src="x86_64/unbound-devel-1.6.8-10.6.1.x86_64.rpm">
          <filename>unbound-devel-1.6.8-10.6.1.x86_64.rpm</filename>
        </package>
        <package name="unbound-munin" epoch="0" version="1.6.8" release="10.6.1" arch="noarch" src="noarch/unbound-munin-1.6.8-10.6.1.noarch.rpm">
          <filename>unbound-munin-1.6.8-10.6.1.noarch.rpm</filename>
        </package>
        <package name="unbound-python" epoch="0" version="1.6.8" release="10.6.1" arch="x86_64" src="x86_64/unbound-python-1.6.8-10.6.1.x86_64.rpm">
          <filename>unbound-python-1.6.8-10.6.1.x86_64.rpm</filename>
        </package>
        <package name="libunbound2" epoch="0" version="1.6.8" release="10.6.1" arch="s390x" src="s390x/libunbound2-1.6.8-10.6.1.s390x.rpm">
          <filename>libunbound2-1.6.8-10.6.1.s390x.rpm</filename>
        </package>
        <package name="unbound" epoch="0" version="1.6.8" release="10.6.1" arch="s390x" src="s390x/unbound-1.6.8-10.6.1.s390x.rpm">
          <filename>unbound-1.6.8-10.6.1.s390x.rpm</filename>
        </package>
        <package name="unbound-anchor" epoch="0" version="1.6.8" release="10.6.1" arch="s390x" src="s390x/unbound-anchor-1.6.8-10.6.1.s390x.rpm">
          <filename>unbound-anchor-1.6.8-10.6.1.s390x.rpm</filename>
        </package>
        <package name="unbound-devel" epoch="0" version="1.6.8" release="10.6.1" arch="s390x" src="s390x/unbound-devel-1.6.8-10.6.1.s390x.rpm">
          <filename>unbound-devel-1.6.8-10.6.1.s390x.rpm</filename>
        </package>
        <package name="unbound-python" epoch="0" version="1.6.8" release="10.6.1" arch="s390x" src="s390x/unbound-python-1.6.8-10.6.1.s390x.rpm">
          <filename>unbound-python-1.6.8-10.6.1.s390x.rpm</filename>
        </package>
        <package name="libunbound2" epoch="0" version="1.6.8" release="10.6.1" arch="ppc64le" src="ppc64le/libunbound2-1.6.8-10.6.1.ppc64le.rpm">
          <filename>libunbound2-1.6.8-10.6.1.ppc64le.rpm</filename>
        </package>
        <package name="unbound" epoch="0" version="1.6.8" release="10.6.1" arch="ppc64le" src="ppc64le/unbound-1.6.8-10.6.1.ppc64le.rpm">
          <filename>unbound-1.6.8-10.6.1.ppc64le.rpm</filename>
        </package>
        <package name="unbound-anchor" epoch="0" version="1.6.8" release="10.6.1" arch="ppc64le" src="ppc64le/unbound-anchor-1.6.8-10.6.1.ppc64le.rpm">
          <filename>unbound-anchor-1.6.8-10.6.1.ppc64le.rpm</filename>
        </package>
        <package name="unbound-devel" epoch="0" version="1.6.8" release="10.6.1" arch="ppc64le" src="ppc64le/unbound-devel-1.6.8-10.6.1.ppc64le.rpm">
          <filename>unbound-devel-1.6.8-10.6.1.ppc64le.rpm</filename>
        </package>
        <package name="unbound-python" epoch="0" version="1.6.8" release="10.6.1" arch="ppc64le" src="ppc64le/unbound-python-1.6.8-10.6.1.ppc64le.rpm">
          <filename>unbound-python-1.6.8-10.6.1.ppc64le.rpm</filename>
        </package>
        <package name="libunbound2" epoch="0" version="1.6.8" release="10.6.1" arch="aarch64" src="aarch64/libunbound2-1.6.8-10.6.1.aarch64.rpm">
          <filename>libunbound2-1.6.8-10.6.1.aarch64.rpm</filename>
        </package>
        <package name="unbound" epoch="0" version="1.6.8" release="10.6.1" arch="aarch64" src="aarch64/unbound-1.6.8-10.6.1.aarch64.rpm">
          <filename>unbound-1.6.8-10.6.1.aarch64.rpm</filename>
        </package>
        <package name="unbound-anchor" epoch="0" version="1.6.8" release="10.6.1" arch="aarch64" src="aarch64/unbound-anchor-1.6.8-10.6.1.aarch64.rpm">
          <filename>unbound-anchor-1.6.8-10.6.1.aarch64.rpm</filename>
        </package>
        <package name="unbound-devel" epoch="0" version="1.6.8" release="10.6.1" arch="aarch64" src="aarch64/unbound-devel-1.6.8-10.6.1.aarch64.rpm">
          <filename>unbound-devel-1.6.8-10.6.1.aarch64.rpm</filename>
        </package>
        <package name="unbound-python" epoch="0" version="1.6.8" release="10.6.1" arch="aarch64" src="aarch64/unbound-python-1.6.8-10.6.1.aarch64.rpm">
          <filename>unbound-python-1.6.8-10.6.1.aarch64.rpm</filename>
        </package>
      </collection>
    </pkglist>
  </update>
  <update from="maint-coord@suse.de" status="stable" type="security" version="1">
    <id>openSUSE-SLE-15.4-2022-198</id>
    <title>Security update for the Linux Kernel</title>
    <severity>important</severity>
    <release>SUSE Updates openSUSE-SLE 15.4</release>
    <issued date="1643179408"/>
    <references>
      <reference href="https://bugzilla.suse.com/show_bug.cgi?id=1065729" id="1065729" title="[trackerbug] 4.12 powerpc base kernel fixes" type="bugzilla"/>
      <reference href="https://bugzilla.suse.com/show_bug.cgi?id=1071995" id="1071995" title="[TRACKERBUG] SLE15 livepatch backports" type="bugzilla"/>
      <reference href="https://bugzilla.suse.com/show_bug.cgi?id=1154353" id="1154353" title="Update skb/net-sched kernel API" type="bugzilla"/>
      <reference href="https://bugzilla.suse.com/show_bug.cgi?id=1154492" id="1154492" title="Update ENA driver" type="bugzilla"/>
      <reference href="https://bugzilla.suse.com/show_bug.cgi?id=1156395" id="1156395" title="[TRACKERBUG] 5.3 powerpc base kernel fixes" type="bugzilla"/>
      <reference href="https://bugzilla.suse.com/show_bug.cgi?id=1167773" id="1167773" title="[Jira ECO-1386] Add the Pensando ionic network kernel driver." type="bugzilla"/>
      <reference href="https://bugzilla.suse.com/show_bug.cgi?id=1176447" id="1176447" title="TRACKERBUG Network Infrastructure backports for 15SP3" type="bugzilla"/>
      <reference href="https://bugzilla.suse.com/show_bug.cgi?id=1176774" id="1176774" title="Mellanox mlxsw/platform driver update for SLE15-SP3" type="bugzilla"/>
      <reference href="https://bugzilla.suse.com/show_bug.cgi?id=1177437" id="1177437" title="SLES 15 SP3 - powerpc/xive: Do not expose a debugfs file when XIVE is disabled / powerpc/xive: Add a debugfs file to dump internal XIVE state" type="bugzilla"/>
      <reference href="https://bugzilla.suse.com/show_bug.cgi?id=1190256" id="1190256" title="Keyboard not working after cold-boot on ASUS Zenbook 14 UM425UA with Tumbleweed 20210904" type="bugzilla"/>
      <reference href="https://bugzilla.suse.com/show_bug.cgi?id=1191271" id="1191271" title="L3-Question: fstrim : FITRIM ioctl failed: Invalid argument ref:_00D1igLOd._5001iacv86:ref" type="bugzilla"/>
      <reference href="https://bugzilla.suse.com/show_bug.cgi?id=1191929" id="1191929" title="NVMe SSD slow since openSUSE-LEAP-15.3 (especially with cryptsetup / dm-crypt device)" type="bugzilla"/>
      <reference href="https://bugzilla.suse.com/show_bug.cgi?id=1192931" id="1192931" title="[HPE Bug] Intel idxd, intel-pmt, intel_qat and qat_4xxx drivers initializing fails" type="bugzilla"/>
      <reference href="https://bugzilla.suse.com/show_bug.cgi?id=1193255" id="1193255" title="Uninformative video device names as of Kernel 5.15.3" type="bugzilla"/>
      <reference href="https://bugzilla.suse.com/show_bug.cgi?id=1193328" id="1193328" title="hyptop and read_values does not work if LPAR is booted in secure mode." type="bugzilla"/>
      <reference href="https://bugzilla.suse.com/show_bug.cgi?id=1193660" id="1193660" title="SLES15 SP4:lpar crashed while doing kexec with VTPM2.0 enabled[P10]" type="bugzilla"/>
      <reference href="https://bugzilla.suse.com/show_bug.cgi?id=1193669" id="1193669" title="kernel-source-rt, kernel-source-azure, kernel-source: kprobes bug allows overwriting kernel memory" type="bugzilla"/>
      <reference href="https://bugzilla.suse.com/show_bug.cgi?id=1193727" id="1193727" title="VUL-0: CVE-2021-4083: kernel-source-azure, kernel-source-rt, kernel-source: kernel: fget: check that the fd still exists after getting a ref to it" type="bugzilla"/>
      <reference href="https://bugzilla.suse.com/show_bug.cgi?id=1193901" id="1193901" title="ISST-LTE:[P10]:[32TB/232c] PVM: SLES15.3:c565slestest: Incorrect CPU's listed during analysing vmcore (fadump issue)" type="bugzilla"/>
      <reference href="https://bugzilla.suse.com/show_bug.cgi?id=1193927" id="1193927" title="VUL-0: CVE-2021-4135: kernel-source-rt, kernel-source, kernel-source-azure: information leak in map_lookup_elem function through BPF_MAP_LOOKUP_ELEM ioctl" type="bugzilla"/>
      <reference href="https://bugzilla.suse.com/show_bug.cgi?id=1194001" id="1194001" title="VUL-0: CVE-2021-4149: kernel-source, kernel-source-azure, kernel-source-rt: Improper lock operation in btrfs" type="bugzilla"/>
      <reference href="https://bugzilla.suse.com/show_bug.cgi?id=1194027" id="1194027" title="L3: System hangs with 46 processes containing fsnotify in bt ref:_00D1igLOd._5001io7iym:ref" type="bugzilla"/>
      <reference href="https://bugzilla.suse.com/show_bug.cgi?id=1194087" id="1194087" title="VUL-1: CVE-2021-45486: kernel-source, kernel-source-rt, kernel-source-azure: information leak in the IPv4 implementation in the Linux kernel before 5.12.4" type="bugzilla"/>
      <reference href="https://bugzilla.suse.com/show_bug.cgi?id=1194094" id="1194094" title="VUL-1: CVE-2021-45485: kernel-source-rt, kernel-source-azure, kernel-source: information leak in the IPv6 implementation in the Linux kernel before 5.13.3" type="bugzilla"/>
      <reference href="https://bugzilla.suse.com/show_bug.cgi?id=1194266" id="1194266" title="Update Broadcom Emulex lpfc driver to 14.0.0.4" type="bugzilla"/>
      <reference href="https://bugzilla.suse.com/show_bug.cgi?id=1194302" id="1194302" title="VUL-0: CVE-2021-4197: kernel-source-azure,kernel-source,kernel-source-rt: cgroup: Use open-time creds and namespace for migration perm checks" type="bugzilla"/>
      <reference href="https://bugzilla.suse.com/show_bug.cgi?id=1194493" id="1194493" title="Auto NMI function &quot;kdump&quot; doesn't capture all register information" type="bugzilla"/>
      <reference href="https://bugzilla.suse.com/show_bug.cgi?id=1194516" id="1194516" title="VUL-0: kernel: moxart-mmc: use-after-free in moxart_remove" type="bugzilla"/>
      <reference href="https://bugzilla.suse.com/show_bug.cgi?id=1194517" id="1194517" title="VUL-0: CVE-2022-0185: kernel-source: overflow bug in legacy_parse_param" type="bugzilla"/>
      <reference href="https://bugzilla.suse.com/show_bug.cgi?id=1194518" id="1194518" title="VUL-0: CVE-2021-46283: kernel-source-rt,kernel-source,kernel-source-azure: crash in netfilter table expressions" type="bugzilla"/>
      <reference href="https://bugzilla.suse.com/show_bug.cgi?id=1194529" id="1194529" title="VUL-0: CVE-2021-4202: kernel-source-rt,kernel-source,kernel-source-azure: kernel: Race condition in nci_request() leads to use after free while the device is getting removed" type="bugzilla"/>
      <reference href="https://bugzilla.suse.com/show_bug.cgi?id=1194578" id="1194578" title="mpi3mr driver not loading during installation" type="bugzilla"/>
      <reference href="https://bugzilla.suse.com/show_bug.cgi?id=1194580" id="1194580" title="[PATCH] ext4: fix lazy initialization next schedule time computation  in more granular unit" type="bugzilla"/>
      <reference href="https://bugzilla.suse.com/show_bug.cgi?id=1194584" id="1194584" title="[PATCH] blk-cgroup: synchronize blkg creation against policy  deactivation" type="bugzilla"/>
      <reference href="https://bugzilla.suse.com/show_bug.cgi?id=1194586" id="1194586" title="[PATCH] block: fix ioprio_get(IOPRIO_WHO_PGRP) vs setuid(2)" type="bugzilla"/>
      <reference href="https://bugzilla.suse.com/show_bug.cgi?id=1194587" id="1194587" title="[PATCH] pipe: increase minimum default pipe size to 2 pages" type="bugzilla"/>
      <reference href="https://bugzilla.suse.com/show_bug.cgi?id=1194589" id="1194589" title="[PATCH] quota: check block number when reading the block in quota  file" type="bugzilla"/>
      <reference href="https://bugzilla.suse.com/show_bug.cgi?id=1194590" id="1194590" title="[PATCH] quota: correct error number in free_dqentry()" type="bugzilla"/>
      <reference href="https://bugzilla.suse.com/show_bug.cgi?id=1194591" id="1194591" title="[PATCH] isofs: Fix out of bound access for corrupted isofs image" type="bugzilla"/>
      <reference href="https://bugzilla.suse.com/show_bug.cgi?id=1194592" id="1194592" title="[PATCH] udf: Fix crash after seekdir" type="bugzilla"/>
      <reference href="https://bugzilla.suse.com/show_bug.cgi?id=1194888" id="1194888" title="Backport request for finit_module() fixes" type="bugzilla"/>
      <reference href="https://bugzilla.suse.com/show_bug.cgi?id=1194953" id="1194953" title="fuse: Pass correct lend value to filemap_write_and_wait_range()" type="bugzilla"/>
      <reference href="https://bugzilla.suse.com/show_bug.cgi?id=1194985" id="1194985" title="VUL-0: CVE-2022-0322: kernel-source: DoS in sctp_addto_chunk in net/sctp/sm_make_chunk.c" type="bugzilla"/>
      <reference href="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2022-0185" id="CVE-2022-0185" title="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2022-0185" type="cve"/>
      <reference href="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2022-0322" id="CVE-2022-0322" title="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2022-0322" type="cve"/>
      <reference href="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-4197" id="CVE-2021-4197" title="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-4197" type="cve"/>
      <reference href="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-46283" id="CVE-2021-46283" title="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-46283" type="cve"/>
      <reference href="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-4135" id="CVE-2021-4135" title="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-4135" type="cve"/>
      <reference href="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-4202" id="CVE-2021-4202" title="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-4202" type="cve"/>
      <reference href="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-4083" id="CVE-2021-4083" title="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-4083" type="cve"/>
      <reference href="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-4149" id="CVE-2021-4149" title="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-4149" type="cve"/>
      <reference href="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-45485" id="CVE-2021-45485" title="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-45485" type="cve"/>
      <reference href="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-45486" id="CVE-2021-45486" title="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-45486" type="cve"/>
    </references>
    <description>

The SUSE Linux Enterprise 15 SP3 kernel was updated to receive various security and bugfixes.

The following security bugs were fixed:

- CVE-2022-0185: Incorrect param length parsing in legacy_parse_param which could have led to a local privilege escalation (bsc#1194517).
- CVE-2022-0322: Fixed a denial of service in SCTP sctp_addto_chunk (bsc#1194985).
- CVE-2021-4197: Fixed a cgroup issue where lower privileged processes could write to fds of lower privileged ones that could lead to privilege escalation (bsc#1194302).
- CVE-2021-46283: nf_tables_newset in net/netfilter/nf_tables_api.c in the Linux kernel allowed local users to cause a denial of service (NULL pointer dereference and general protection fault) because of the missing initialization for nft_set_elem_expr_alloc. A local user can set a netfilter table expression in their own namespace (bnc#1194518).
- CVE-2021-4135: Fixed an information leak in the nsim_bpf_map_alloc function (bsc#1193927).
- CVE-2021-4202: Fixed a race condition during NFC device remove which could lead to a use-after-free memory corruption (bsc#1194529)
- CVE-2021-4083: A read-after-free memory flaw was found in the Linux kernel's garbage collection for Unix domain socket file handlers in the way users call close() and fget() simultaneously and can potentially trigger a race condition. This flaw allowed a local user to crash the system or escalate their privileges on the system. This flaw affects Linux kernel versions prior to 5.16-rc4 (bnc#1193727).
- CVE-2021-4149: Fixed a locking condition in btrfs which could lead to system deadlocks (bsc#1194001).
- CVE-2021-45485: In the IPv6 implementation in net/ipv6/output_core.c has an information leak because of certain use of a hash table which, although big, doesn't properly consider that IPv6-based attackers can typically choose among many IPv6 source addresses (bnc#1194094).
- CVE-2021-45486: In the IPv4 implementation in net/ipv4/route.c has an information leak because the hash table is very small (bnc#1194087).

The following non-security bugs were fixed:

- ACPI: APD: Check for NULL pointer after calling devm_ioremap() (git-fixes).
- ACPI: Add stubs for wakeup handler functions (git-fixes).
- ACPI: scan: Create platform device for BCM4752 and LNV4752 ACPI nodes (git-fixes).
- ALSA: PCM: Add missing rwsem around snd_ctl_remove() calls (git-fixes).
- ALSA: ctl: Fix copy of updated id with element read/write (git-fixes).
- ALSA: drivers: opl3: Fix incorrect use of vp-&gt;state (git-fixes).
- ALSA: hda/hdmi: Disable silent stream on GLK (git-fixes).
- ALSA: hda/realtek - Add headset Mic support for Lenovo ALC897 platform (git-fixes).
- ALSA: hda/realtek - Fix silent output on Gigabyte X570 Aorus Master after reboot from Windows (git-fixes).
- ALSA: hda/realtek: Add a quirk for HP OMEN 15 mute LED (git-fixes).
- ALSA: hda/realtek: Add quirk for ASRock NUC Box 1100 (git-fixes).
- ALSA: hda/realtek: Amp init fixup for HP ZBook 15 G6 (git-fixes).
- ALSA: hda/realtek: Fix quirk for Clevo NJ51CU (git-fixes).
- ALSA: hda/realtek: Fix quirk for TongFang PHxTxX1 (git-fixes).
- ALSA: hda/realtek: Fixes HP Spectre x360 15-eb1xxx speakers (git-fixes).
- ALSA: hda/realtek: Headset fixup for Clevo NH77HJQ (git-fixes).
- ALSA: hda: Add missing rwsem around snd_ctl_remove() calls (git-fixes).
- ALSA: hda: Make proper use of timecounter (git-fixes).
- ALSA: jack: Add missing rwsem around snd_ctl_remove() calls (git-fixes).
- ALSA: jack: Check the return value of kstrdup() (git-fixes).
- ALSA: oss: fix compile error when OSS_DEBUG is enabled (git-fixes).
- ALSA: pcm: oss: Fix negative period/buffer sizes (git-fixes).
- ALSA: pcm: oss: Handle missing errors in snd_pcm_oss_change_params*() (git-fixes).
- ALSA: pcm: oss: Limit the period size to 16MB (git-fixes).
- ALSA: usb-audio: Drop superfluous '0' in Presonus Studio 1810c's ID (git-fixes).
- ALSA: usb-audio: Line6 HX-Stomp XL USB_ID for 48k-fixed quirk (git-fixes).
- ASoC: codecs: wcd934x: handle channel mappping list correctly (git-fixes).
- ASoC: codecs: wcd934x: return correct value from mixer put (git-fixes).
- ASoC: codecs: wcd934x: return error code correctly from hw_params (git-fixes).
- ASoC: codecs: wsa881x: fix return values from kcontrol put (git-fixes).
- ASoC: cs42l42: Correct configuring of switch inversion from ts-inv (git-fixes).
- ASoC: cs42l42: Disable regulators if probe fails (git-fixes).
- ASoC: cs42l42: Use device_property API instead of of_property (git-fixes).
- ASoC: fsl_asrc: refine the check of available clock divider (git-fixes).
- ASoC: fsl_mqs: fix MODULE_ALIAS (git-fixes).
- ASoC: mediatek: Check for error clk pointer (git-fixes).
- ASoC: meson: aiu: Move AIU_I2S_MISC hold setting to aiu-fifo-i2s (git-fixes).
- ASoC: meson: aiu: fifo: Add missing dma_coerce_mask_and_coherent() (git-fixes).
- ASoC: qdsp6: q6routing: Fix return value from msm_routing_put_audio_mixer (git-fixes).
- ASoC: rt5663: Handle device_property_read_u32_array error codes (git-fixes).
- ASoC: samsung: idma: Check of ioremap return value (git-fixes).
- ASoC: soc-core: fix null-ptr-deref in snd_soc_del_component_unlocked() (git-fixes).
- ASoC: sunxi: fix a sound binding broken reference (git-fixes).
- ASoC: tegra: Fix kcontrol put callback in ADMAIF (git-fixes).
- ASoC: tegra: Fix kcontrol put callback in AHUB (git-fixes).
- ASoC: tegra: Fix kcontrol put callback in DMIC (git-fixes).
- ASoC: tegra: Fix kcontrol put callback in DSPK (git-fixes).
- ASoC: tegra: Fix kcontrol put callback in I2S (git-fixes).
- ASoC: tegra: Fix wrong value type in ADMAIF (git-fixes).
- ASoC: tegra: Fix wrong value type in DMIC (git-fixes).
- ASoC: tegra: Fix wrong value type in DSPK (git-fixes).
- ASoC: tegra: Fix wrong value type in I2S (git-fixes).
- ASoC: uniphier: drop selecting non-existing SND_SOC_UNIPHIER_AIO_DMA (git-fixes).
- Add cherry-picked IDs for qemu fw_cfg patches
- Bluetooth: L2CAP: Fix using wrong mode (git-fixes).
- Bluetooth: bfusb: fix division by zero in send path (git-fixes).
- Bluetooth: btmtksdio: fix resume failure (git-fixes).
- Bluetooth: btusb: fix memory leak in btusb_mtk_submit_wmt_recv_urb() (git-fixes).
- Bluetooth: cmtp: fix possible panic when cmtp_init_sockets() fails (git-fixes).
- Bluetooth: hci_bcm: Check for error irq (git-fixes).
- Bluetooth: hci_qca: Stop IBS timer during BT OFF (git-fixes).
- Bluetooth: stop proccessing malicious adv data (git-fixes).
- Documentation: ACPI: Fix data node reference documentation (git-fixes).
- Documentation: dmaengine: Correctly describe dmatest with channel unset (git-fixes).
- Documentation: refer to config RANDOMIZE_BASE for kernel address-space randomization (git-fixes).
- HID: add USB_HID dependancy to hid-chicony (git-fixes).
- HID: add USB_HID dependancy to hid-prodikeys (git-fixes).
- HID: asus: Add depends on USB_HID to HID_ASUS Kconfig option (git-fixes).
- HID: bigbenff: prevent null pointer dereference (git-fixes).
- HID: google: add eel USB id (git-fixes).
- HID: hid-uclogic-params: Invalid parameter check in uclogic_params_frame_init_v1_buttonpad (git-fixes).
- HID: hid-uclogic-params: Invalid parameter check in uclogic_params_get_str_desc (git-fixes).
- HID: hid-uclogic-params: Invalid parameter check in uclogic_params_huion_init (git-fixes).
- HID: hid-uclogic-params: Invalid parameter check in uclogic_params_init (git-fixes).
- HID: quirks: Add quirk for the Microsoft Surface 3 type-cover (git-fixes).
- Input: appletouch - initialize work before device registration (git-fixes).
- Input: atmel_mxt_ts - fix double free in mxt_read_info_block (git-fixes).
- Input: elantech - fix stack out of bound access in elantech_change_report_id() (git-fixes).
- Input: i8042 - add deferred probe support (bsc#1190256).
- Input: i8042 - enable deferred probe quirk for ASUS UM325UA (bsc#1190256).
- Input: max8925_onkey - do not mark comment as kernel-doc (git-fixes).
- Input: spaceball - fix parsing of movement data packets (git-fixes).
- Input: ti_am335x_tsc - fix STEPCONFIG setup for Z2 (git-fixes).
- Input: ti_am335x_tsc - set ADCREFM for X configuration (git-fixes).
- Move upstreamed patches into sorted section
- NFC: st21nfca: Fix memory leak in device probe and remove (git-fixes).
- NFSD: Fix zero-length NFSv3 WRITEs (git-fixes).
- NFSv42: Do not fail clone() unless the OP_CLONE operation failed (git-fixes).
- NFSv42: Fix pagecache invalidation after COPY/CLONE (git-fixes).
- PCI/ACPI: Fix acpi_pci_osc_control_set() kernel-doc comment (git-fixes).
- PCI/MSI: Clear PCI_MSIX_FLAGS_MASKALL on error (git-fixes).
- PCI/MSI: Fix pci_irq_vector()/pci_irq_get_affinity() (git-fixes).
- PCI/MSI: Mask MSI-X vectors only on success (git-fixes).
- PCI: cadence: Add cdns_plat_pcie_probe() missing return (git-fixes).
- PCI: dwc: Do not remap invalid res (git-fixes).
- PCI: mvebu: Check for errors from pci_bridge_emul_init() call (git-fixes).
- PCI: mvebu: Do not modify PCI IO type bits in conf_write (git-fixes).
- PCI: mvebu: Fix support for DEVCAP2, DEVCTL2 and LNKCTL2 registers on emulated bridge (git-fixes).
- PCI: mvebu: Fix support for PCI_EXP_DEVCTL on emulated bridge (git-fixes).
- PCI: mvebu: Fix support for PCI_EXP_RTSTA on emulated bridge (git-fixes).
- PCI: pci-bridge-emul: Properly mark reserved PCIe bits in PCI config space (git-fixes).
- PCI: pci-bridge-emul: Set PCI_STATUS_CAP_LIST for PCIe device (git-fixes).
- PCI: pciehp: Fix infinite loop in IRQ handler upon power fault (git-fixes).
- PCI: xgene: Fix IB window setup (git-fixes).
- PM: runtime: Defer suspending suppliers (git-fixes).
- PM: sleep: Do not assume that &quot;mem&quot; is always present (git-fixes).
- RDMA/hns: Replace kfree() with kvfree() (jsc#SLE-14777).
- Revert &quot;PM: sleep: Do not assume that &quot;mem&quot; is always present&quot; (git-fixes).
- Revert &quot;USB: xhci: fix U1/U2 handling for hardware with XHCI_INTEL_HOST quirk set&quot; (git-fixes).
- Revert &quot;net/mlx5: Add retry mechanism to the command entry index allocation&quot; (jsc#SLE-15172).
- USB: Fix &quot;slab-out-of-bounds Write&quot; bug in usb_hcd_poll_rh_status (git-fixes).
- USB: NO_LPM quirk Lenovo Powered USB-C Travel Hub (git-fixes).
- USB: NO_LPM quirk Lenovo USB-C to Ethernet Adapher(RTL8153-04) (git-fixes).
- USB: cdc-acm: fix break reporting (git-fixes).
- USB: cdc-acm: fix racy tty buffer accesses (git-fixes).
- USB: chipidea: fix interrupt deadlock (git-fixes).
- USB: core: Fix bug in resuming hub's handling of wakeup requests (git-fixes).
- USB: gadget: bRequestType is a bitfield, not a enum (git-fixes).
- USB: gadget: detect too-big endpoint 0 requests (git-fixes).
- USB: gadget: zero allocate endpoint 0 buffers (git-fixes).
- USB: serial: cp210x: fix CP2105 GPIO registration (git-fixes).
- USB: serial: option: add Telit FN990 compositions (git-fixes).
- Update patches.suse/tpm-fix-potential-NULL-pointer-access-in-tpm_del_cha.patch (git-fixes bsc#1193660 ltc#195634).
- Updated mpi3mr entry in supported.conf (bsc#1194578 jsc#SLE-18120) Moving this driver into the &quot;supported&quot; package.
- amd/display: downgrade validation failure log level (git-fixes).
- ata: ahci: Add Green Sardine vendor ID as board_ahci_mobile (git-fixes).
- atlantic: Fix buff_ring OOB in aq_ring_rx_clean (git-fixes).
- ax25: NPD bug when detaching AX25 device (git-fixes).
- backlight: qcom-wled: Fix off-by-one maximum with default num_strings (git-fixes).
- backlight: qcom-wled: Override default length with qcom,enabled-strings (git-fixes).
- backlight: qcom-wled: Pass number of elements to read to read_u32_array (git-fixes).
- backlight: qcom-wled: Validate enabled string indices in DT (git-fixes).
- batman-adv: mcast: do not send link-local multicast to mcast routers (git-fixes).
- blk-cgroup: synchronize blkg creation against policy deactivation (bsc#1194584).
- block/scsi-ioctl: Fix kernel-infoleak in scsi_put_cdrom_generic_arg() (git-fixes).
- block: fix ioprio_get(IOPRIO_WHO_PGRP) vs setuid(2) (bsc#1194586).
- can: gs_usb: fix use of uninitialized variable, detach device on reception of invalid USB data (git-fixes).
- can: gs_usb: gs_can_start_xmit(): zero-initialize hf-&gt;{flags,reserved} (git-fixes).
- can: kvaser_usb: get CAN clock frequency from device (git-fixes).
- can: sja1000: fix use after free in ems_pcmcia_add_card() (git-fixes).
- can: softing: softing_startstop(): fix set but not used variable warning (git-fixes).
- can: softing_cs: softingcs_probe(): fix memleak on registration failure (git-fixes).
- can: usb_8dev: remove unused member echo_skb from struct usb_8dev_priv (git-fixes).
- can: xilinx_can: xcan_probe(): check for error irq (git-fixes).
- char/mwave: Adjust io port register size (git-fixes).
- clk: Do not parent clks until the parent is fully registered (git-fixes).
- clk: Gemini: fix struct name in kernel-doc (git-fixes).
- clk: bcm-2835: Pick the closest clock rate (git-fixes).
- clk: bcm-2835: Remove rounding up the dividers (git-fixes).
- clk: imx8mn: Fix imx8mn_clko1_sels (git-fixes).
- clk: imx: pllv1: fix kernel-doc notation for struct clk_pllv1 (git-fixes).
- clk: qcom: gcc-msm8996: Drop (again) gcc_aggre1_pnoc_ahb_clk (git-fixes).
- clk: qcom: regmap-mux: fix parent clock lookup (git-fixes).
- clk: stm32: Fix ltdc's clock turn off by clk_disable_unused() after system enter shell (git-fixes).
- crypto: caam - replace this_cpu_ptr with raw_cpu_ptr (git-fixes).
- crypto: mxs-dcp - Use sg_mapping_iter to copy data (git-fixes).
- crypto: omap-sham - clear dma flags only after omap_sham_update_dma_stop() (git-fixes).
- crypto: qat - do not ignore errors from enable_vf2pf_comms() (git-fixes).
- crypto: qat - fix reuse of completion variable (git-fixes).
- crypto: qat - handle both source of interrupt in VF ISR (git-fixes).
- crypto: qce - fix uaf on qce_ahash_register_one (git-fixes).
- crypto: stm32/crc32 - Fix kernel BUG triggered in probe() (git-fixes).
- crypto: stm32/cryp - fix double pm exit (git-fixes).
- crypto: stm32/cryp - fix lrw chaining mode (git-fixes).
- crypto: stm32/cryp - fix xts and race condition in crypto_engine requests (git-fixes).
- debugfs: lockdown: Allow reading debugfs files that are not world readable (bsc#1193328 ltc#195566).
- device property: Fix documentation for FWNODE_GRAPH_DEVICE_DISABLED (git-fixes).
- dm crypt: document encrypted keyring key option (git-fixes).
- dm writecache: add &quot;cleaner&quot; and &quot;max_age&quot; to Documentation (git-fixes).
- dm writecache: advance the number of arguments when reporting max_age (git-fixes).
- dm writecache: fix performance degradation in ssd mode (git-fixes).
- dm writecache: flush origin device when writing and cache is full (git-fixes).
- dma_fence_array: Fix PENDING_ERROR leak in dma_fence_array_signaled() (git-fixes).
- dmaengine: at_xdmac: Do not start transactions at tx_submit level (git-fixes).
- dmaengine: at_xdmac: Fix at_xdmac_lld struct definition (git-fixes).
- dmaengine: at_xdmac: Fix concurrency over xfers_list (git-fixes).
- dmaengine: at_xdmac: Fix lld view setting (git-fixes).
- dmaengine: at_xdmac: Print debug message after realeasing the lock (git-fixes).
- dmaengine: bestcomm: fix system boot lockups (git-fixes).
- dmaengine: idxd: add module parameter to force disable of SVA (bsc#1192931).
- dmaengine: idxd: enable SVA feature for IOMMU (bsc#1192931).
- dmaengine: pxa/mmp: stop referencing config-&gt;slave_id (git-fixes).
- dmaengine: st_fdma: fix MODULE_ALIAS (git-fixes).
- drm/amd/amdgpu: Increase HWIP_MAX_INSTANCE to 10 (git-fixes).
- drm/amd/display: Fix for the no Audio bug with Tiled Displays (git-fixes).
- drm/amd/display: Update bounding box states (v2) (git-fixes).
- drm/amd/display: Update number of DCN3 clock states (git-fixes).
- drm/amd/display: add connector type check for CRC source set (git-fixes).
- drm/amd/display: dcn20_resource_construct reduce scope of FPU enabled (git-fixes).
- drm/amd/display: fix incorrect CM/TF programming sequence in dwb (git-fixes).
- drm/amd/display: fix missing writeback disablement if plane is removed (git-fixes).
- drm/amdgpu: Fix a NULL pointer dereference in amdgpu_connector_lcd_native_mode() (git-fixes).
- drm/amdgpu: Fix a printing message (git-fixes).
- drm/amdgpu: Fix amdgpu_ras_eeprom_init() (git-fixes).
- drm/amdgpu: correct register access for RLC_JUMP_TABLE_RESTORE (git-fixes).
- drm/amdgpu: revert &quot;Add autodump debugfs node for gpu reset v8&quot; (git-fixes).
- drm/amdkfd: Account for SH/SE count when setting up cu masks (git-fixes).
- drm/amdkfd: Check for null pointer after calling kmemdup (git-fixes).
- drm/ast: potential dereference of null pointer (git-fixes).
- drm/atomic: Check new_crtc_state-&gt;active to determine if CRTC needs disable in self refresh mode (git-fixes).
- drm/bridge: analogix_dp: Make PSR-exit block less (git-fixes).
- drm/bridge: display-connector: fix an uninitialized pointer in probe() (git-fixes).
- drm/bridge: nwl-dsi: Avoid potential multiplication overflow on 32-bit (git-fixes).
- drm/bridge: ti-sn65dsi86: Set max register for regmap (git-fixes).
- drm/display: fix possible null-pointer dereference in dcn10_set_clock() (git-fixes).
- drm/exynos: Always initialize mapping in exynos_drm_register_dma() (git-fixes).
- drm/i915/fb: Fix rounding error in subsampled plane size calculation (git-fixes).
- drm/i915: Avoid bitwise vs logical OR warning in snb_wm_latency_quirk() (git-fixes).
- drm/mediatek: Check plane visibility in atomic_update (git-fixes).
- drm/msm/dpu: fix safe status debugfs file (git-fixes).
- drm/msm/dsi: Fix DSI and DSI PHY regulator config from SDM660 (git-fixes).
- drm/msm/dsi: set default num_data_lanes (git-fixes).
- drm/msm/mdp5: fix cursor-related warnings (git-fixes).
- drm/msm: mdp4: drop vblank get/put from prepare/complete_commit (git-fixes).
- drm/msm: prevent NULL dereference in msm_gpu_crashstate_capture() (git-fixes).
- drm/panel: innolux-p079zca: Delete panel on attach() failure (git-fixes).
- drm/panel: kingdisplay-kd097d04: Delete panel on attach() failure (git-fixes).
- drm/radeon/radeon_kms: Fix a NULL pointer dereference in radeon_driver_open_kms() (git-fixes).
- drm/rockchip: dsi: Disable PLL clock on bind error (git-fixes).
- drm/rockchip: dsi: Fix unbalanced clock on probe error (git-fixes).
- drm/rockchip: dsi: Hold pm-runtime across bind/unbind (git-fixes).
- drm/rockchip: dsi: Reconfigure hardware on resume() (git-fixes).
- drm/sun4i: dw-hdmi: Fix missing put_device() call in sun8i_hdmi_phy_get (git-fixes).
- drm/sun4i: fix unmet dependency on RESET_CONTROLLER for PHY_SUN6I_MIPI_DPHY (git-fixes).
- drm/syncobj: Deal with signalled fences in drm_syncobj_find_fence (git-fixes).
- drm/tegra: vic: Fix DMA API misuse (git-fixes).
- drm/vboxvideo: fix a NULL vs IS_ERR() check (git-fixes).
- drm/vc4: hdmi: Make sure the controller is powered up during bind (git-fixes).
- drm/vc4: hdmi: Set HD_CTL_WHOLSMP and HD_CTL_CHALIGN_SET (git-fixes).
- drm/vc4: hdmi: Set a default HSM rate (git-fixes).
- drm: fix null-ptr-deref in drm_dev_init_release() (git-fixes).
- drm: xlnx: zynqmp: release reset to DP controller before accessing DP registers (git-fixes).
- drm: xlnx: zynqmp_dpsub: Call pm_runtime_get_sync before setting pixel clock (git-fixes).
- eeprom: idt_89hpesx: Put fwnode in matching case during -&gt;probe() (git-fixes).
- eeprom: idt_89hpesx: Restore printing the unsupported fwnode name (git-fixes).
- ext4: Avoid trim error on fs with small groups (bsc#1191271).
- ext4: fix lazy initialization next schedule time computation in more granular unit (bsc#1194580).
- fget: clarify and improve __fget_files() implementation (bsc#1193727).
- firmware: Update Kconfig help text for Google firmware (git-fixes).
- firmware: arm_scmi: pm: Propagate return value to caller (git-fixes).
- firmware: arm_scpi: Fix string overflow in SCPI genpd driver (git-fixes).
- firmware: qcom_scm: Fix error retval in __qcom_scm_is_call_available() (git-fixes).
- firmware: qemu_fw_cfg: fix NULL-pointer deref on duplicate entries (git-fixes).
- firmware: qemu_fw_cfg: fix kobject leak in probe error path (git-fixes).
- firmware: qemu_fw_cfg: fix sysfs information leak (git-fixes).
- firmware: raspberrypi: Fix a leak in 'rpi_firmware_get()' (git-fixes).
- firmware: smccc: Fix check for ARCH_SOC_ID not implemented (git-fixes).
- firmware: tegra: Fix error application of sizeof() to pointer (git-fixes).
- firmware: tegra: Reduce stack usage (git-fixes).
- firmware_loader: fix pre-allocated buf built-in firmware use (git-fixes).
- floppy: Fix hang in watchdog when disk is ejected (git-fixes).
- flow_offload: return EOPNOTSUPP for the unsupported mpls action type (bsc#1154353).
- fuse: Pass correct lend value to filemap_write_and_wait_range() (bsc#1194953).
- gpiolib: acpi: Make set-debounce-timeout failures non fatal (git-fixes).
- gpu: host1x: Add back arm_iommu_detach_device() (git-fixes).
- hwmon: (lm90) Add basic support for TI TMP461 (git-fixes).
- hwmon: (lm90) Add max6654 support to lm90 driver (git-fixes).
- hwmon: (lm90) Do not report 'busy' status bit as alarm (git-fixes).
- hwmon: (lm90) Drop critical attribute support for MAX6654 (git-fixes).
- hwmon: (lm90) Fix usage of CONFIG2 register in detect function (git-fixes).
- hwmon: (lm90) Introduce flag indicating extended temperature support (git-fixes).
- i2c: rk3x: Handle a spurious start completion interrupt flag (git-fixes).
- i2c: validate user data in compat ioctl (git-fixes).
- i3c: fix incorrect address slot lookup on 64-bit (git-fixes).
- i3c: master: dw: check return of dw_i3c_master_get_free_pos() (git-fixes).
- i40e: Fix NULL pointer dereference in i40e_dbg_dump_desc (git-fixes).
- i40e: Fix for displaying message regarding NVM version (git-fixes).
- i40e: Fix incorrect netdev's real number of RX/TX queues (git-fixes).
- i40e: Fix to not show opcode msg on unsuccessful VF MAC change (git-fixes).
- i40e: fix use-after-free in i40e_sync_filters_subtask() (git-fixes).
- iavf: Fix limit of total number of queues to active queues of VF (git-fixes).
- iavf: restore MSI state on reset (git-fixes).
- ieee802154: atusb: fix uninit value in atusb_set_extended_addr (git-fixes).
- ieee802154: fix error return code in ieee802154_llsec_getparams() (git-fixes).
- ieee802154: fix error return code in ieee802154_add_iface() (git-fixes).
- ieee802154: hwsim: Fix memory leak in hwsim_add_one (git-fixes).
- ieee802154: hwsim: Fix possible memory leak in hwsim_subscribe_all_others (git-fixes).
- ieee802154: hwsim: avoid possible crash in hwsim_del_edge_nl() (git-fixes).
- ieee802154: hwsim: fix GPF in hwsim_set_edge_lqi (git-fixes).
- igb: Fix removal of unicast MAC filters of VFs (git-fixes).
- igbvf: fix double free in `igbvf_probe` (git-fixes).
- igc: Fix typo in i225 LTR functions (jsc#SLE-13533).
- iio: accel: kxcjk-1013: Fix possible memory leak in probe and remove (git-fixes).
- iio: ad7768-1: Call iio_trigger_notify_done() on error (git-fixes).
- iio: adc: axp20x_adc: fix charging current reporting on AXP22x (git-fixes).
- iio: at91-sama5d2: Fix incorrect sign extension (git-fixes).
- iio: dln2-adc: Fix lockdep complaint (git-fixes).
- iio: dln2: Check return value of devm_iio_trigger_register() (git-fixes).
- iio: itg3200: Call iio_trigger_notify_done() on error (git-fixes).
- iio: kxsd9: Do not return error code in trigger handler (git-fixes).
- iio: ltr501: Do not return error code in trigger handler (git-fixes).
- iio: mma8452: Fix trigger reference couting (git-fixes).
- iio: stk3310: Do not return error code in interrupt handler (git-fixes).
- iio: trigger: Fix reference counting (git-fixes).
- iio: trigger: stm32-timer: fix MODULE_ALIAS (git-fixes).
- ionic: Initialize the 'lif-&gt;dbid_inuse' bitmap (bsc#1167773).
- isofs: Fix out of bound access for corrupted isofs image (bsc#1194591).
- iwlwifi: fw: correctly limit to monitor dump (git-fixes).
- iwlwifi: mvm: Fix scan channel flags settings (git-fixes).
- iwlwifi: mvm: Use div_s64 instead of do_div in iwl_mvm_ftm_rtt_smoothing() (git-fixes).
- iwlwifi: mvm: avoid static queue number aliasing (git-fixes).
- iwlwifi: mvm: disable RX-diversity in powersave (git-fixes).
- iwlwifi: mvm: fix 32-bit build in FTM (git-fixes).
- iwlwifi: mvm: fix access to BSS elements (git-fixes).
- iwlwifi: mvm: test roc running status bits before removing the sta (git-fixes).
- iwlwifi: pcie: free RBs during configure (git-fixes).
- ixgbe: set X550 MDIO speed before talking to PHY (git-fixes).
- kmod: make request_module() return an error when autoloading is disabled (git-fixes).
- kobject: Restore old behaviour of kobject_del(NULL) (git-fixes).
- kobject_uevent: remove warning in init_uevent_argv() (git-fixes).
- kprobes: Limit max data_size of the kretprobe instances (bsc#1193669).
- libata: add horkage for ASMedia 1092 (git-fixes).
- libata: if T_LENGTH is zero, dma direction should be DMA_NONE (git-fixes).
- livepatch: Avoid CPU hogging with cond_resched (bsc#1071995).
- lockdown: Allow unprivileged users to see lockdown status (git-fixes).
- mISDN: change function names to avoid conflicts (git-fixes).
- mac80211: Fix monitor MTU limit so that A-MSDUs get through (git-fixes).
- mac80211: agg-tx: do not schedule_and_wake_txq() under sta-&gt;lock (git-fixes).
- mac80211: do not access the IV when it was stripped (git-fixes).
- mac80211: fix lookup when adding AddBA extension element (git-fixes).
- mac80211: fix regression in SSN handling of addba tx (git-fixes).
- mac80211: initialize variable have_higher_than_11mbit (git-fixes).
- mac80211: mark TX-during-stop for TX in in_reconfig (git-fixes).
- mac80211: send ADDBA requests using the tid/queue of the aggregation session (git-fixes).
- mac80211: track only QoS data frames for admission control (git-fixes).
- mac80211: validate extended element ID is present (git-fixes).
- mailbox: hi3660: convert struct comments to kernel-doc notation (git-fixes).
- media: Revert &quot;media: uvcvideo: Set unique vdev name based in type&quot; (bsc#1193255).
- media: aspeed: Update signal status immediately to ensure sane hw state (git-fixes).
- media: aspeed: fix mode-detect always time out at 2nd run (git-fixes).
- media: cpia2: fix control-message timeouts (git-fixes).
- media: dib0700: fix undefined behavior in tuner shutdown (git-fixes).
- media: dib8000: Fix a memleak in dib8000_init() (git-fixes).
- media: dmxdev: fix UAF when dvb_register_device() fails (git-fixes).
- media: dw2102: Fix use after free (git-fixes).
- media: em28xx: fix control-message timeouts (git-fixes).
- media: em28xx: fix memory leak in em28xx_init_dev (git-fixes).
- media: flexcop-usb: fix control-message timeouts (git-fixes).
- media: hantro: Fix probe func error path (git-fixes).
- media: i2c: imx274: fix trivial typo expsoure/exposure (git-fixes).
- media: i2c: imx274: fix trivial typo obainted/obtained (git-fixes).
- media: imx-pxp: Initialize the spinlock prior to using it (git-fixes).
- media: mceusb: fix control-message timeouts (git-fixes).
- media: msi001: fix possible null-ptr-deref in msi001_probe() (git-fixes).
- media: mtk-vcodec: call v4l2_m2m_ctx_release first when file is released (git-fixes).
- media: pvrusb2: fix control-message timeouts (git-fixes).
- media: rcar-csi2: Correct the selection of hsfreqrange (git-fixes).
- media: rcar-csi2: Optimize the selection PHTW register (git-fixes).
- media: redrat3: fix control-message timeouts (git-fixes).
- media: s2255: fix control-message timeouts (git-fixes).
- media: saa7146: mxb: Fix a NULL pointer dereference in mxb_attach() (git-fixes).
- media: si2157: Fix &quot;warm&quot; tuner state detection (git-fixes).
- media: si470x-i2c: fix possible memory leak in si470x_i2c_probe() (git-fixes).
- media: stk1160: fix control-message timeouts (git-fixes).
- media: streamzap: remove unnecessary ir_raw_event_reset and handle (git-fixes).
- media: uvcvideo: fix division by zero at stream start (git-fixes).
- media: venus: core: Fix a resource leak in the error handling path of 'venus_probe()' (git-fixes).
- memblock: ensure there is no overflow in memblock_overlaps_region() (git-fixes).
- memory: emif: Remove bogus debugfs error handling (git-fixes).
- mfd: intel-lpss: Fix too early PM enablement in the ACPI -&gt;probe() (git-fixes).
- misc: fastrpc: Add missing lock before accessing find_vma() (git-fixes).
- misc: fastrpc: fix improper packet size calculation (git-fixes).
- misc: lattice-ecp3-config: Fix task hung when firmware load failed (git-fixes).
- mmc: meson-mx-sdio: add IRQ check (git-fixes).
- mmc: sdhci-esdhc-imx: clear the buffer_read_ready to reset standard tuning circuit (git-fixes).
- mmc: sdhci-esdhc-imx: disable CMDQ support (git-fixes).
- mmc: sdhci-pci: Add PCI ID for Intel ADL (git-fixes).
- mmc: sdhci-tegra: Fix switch to HS400ES mode (git-fixes).
- move to &quot;mainline soon&quot; section: - patches.suse/0001-mmc-moxart_remove-Fix-UAF.patch
- moxart: fix potential use-after-free on remove path (bsc#1194516).
- mt76: mt7915: fix NULL pointer dereference in mt7915_get_phy_mode (git-fixes).
- mt76: mt7915: fix an off-by-one bound check (git-fixes).
- mtd: rawnand: fsmc: Fix timing computation (git-fixes).
- mtd: rawnand: fsmc: Take instruction delay into account (git-fixes).
- mtd: rawnand: mpc5121: Remove unused variable in ads5121_select_chip() (git-fixes).
- mtd: spi-nor: hisi-sfc: Remove excessive clk_disable_unprepare() (git-fixes).
- mwifiex: Fix possible ABBA deadlock (git-fixes).
- mwifiex: Try waking the firmware until we get an interrupt (git-fixes).
- net/mlx5: DR, Fix NULL vs IS_ERR checking in dr_domain_init_resources (jsc#SLE-8464).
- net/mlx5: Set command entry semaphore up once got index free (jsc#SLE-15172).
- net/mlx5e: Fix wrong features assignment in case of error (git-fixes).
- net/mlx5e: Wrap the tx reporter dump callback to extract the sq (jsc#SLE-15172).
- net/sched: fq_pie: prevent dismantle issue (jsc#SLE-15172).
- net/sched: sch_ets: do not remove idle classes from the round-robin list (bsc#1176774).
- net: create netdev-&gt;dev_addr assignment helpers (git-fixes).
- net: ena: Fix error handling when calculating max IO queues number (bsc#1154492).
- net: ena: Fix undefined state when tx request id is out of bounds (bsc#1154492).
- net: ena: Fix wrong rx request id by resetting device (git-fixes).
- net: hns3: fix use-after-free bug in hclgevf_send_mbx_msg (jsc#SLE-14777).
- net: usb: lan78xx: add Allied Telesis AT29M2-AF (git-fixes).
- net: usb: pegasus: Do not drop long Ethernet frames (git-fixes).
- netfilter: nft_set_pipapo: allocate pcpu scratch maps on clone (bsc#1176447).
- nfc: fix potential NULL pointer deref in nfc_genl_dump_ses_done (git-fixes).
- nfc: fix segfault in nfc_genl_dump_devices_done (git-fixes).
- nfsd: Fix nsfd startup race (again) (git-fixes).
- nft_set_pipapo: Fix bucket load in AVX2 lookup routine for six 8-bit groups (bsc#1176447).
- nvme-tcp: block BH in sk state_change sk callback (git-fixes).
- nvme-tcp: can't set sk_user_data without write_lock (git-fixes).
- nvme-tcp: check sgl supported by target (git-fixes).
- nvme-tcp: do not update queue count when failing to set io queues (git-fixes).
- nvme-tcp: fix a NULL deref when receiving a 0-length r2t PDU (git-fixes).
- nvme-tcp: fix crash triggered with a dataless request submission (git-fixes).
- nvme-tcp: fix error codes in nvme_tcp_setup_ctrl() (git-fixes).
- nvme-tcp: fix io_work priority inversion (git-fixes).
- nvme-tcp: fix possible data corruption with bio merges (git-fixes).
- nvme-tcp: fix possible req-&gt;offset corruption (git-fixes).
- nvme-tcp: fix wrong setting of request iov_iter (git-fixes).
- nvme-tcp: get rid of unused helper function (git-fixes).
- nvme-tcp: pair send_mutex init with destroy (git-fixes).
- nvme-tcp: pass multipage bvec to request iov_iter (git-fixes).
- nvme-tcp: remove incorrect Kconfig dep in BLK_DEV_NVME (git-fixes).
- pcmcia: fix setting of kthread task states (git-fixes).
- pcmcia: rsrc_nonstatic: Fix a NULL pointer dereference in __nonstatic_find_io_region() (git-fixes).
- pcmcia: rsrc_nonstatic: Fix a NULL pointer dereference in nonstatic_find_mem_region() (git-fixes).
- pcnet32: Use pci_resource_len to validate PCI resource (git-fixes).
- pinctrl: mediatek: fix global-out-of-bounds issue (git-fixes).
- pinctrl: qcom: spmi-gpio: correct parent irqspec translation (git-fixes).
- pinctrl: stm32: consider the GPIO offset to expose all the GPIO lines (git-fixes).
- pinctrl: stm32: use valid pin identifier in stm32_pinctrl_resume() (git-fixes).
- pipe: increase minimum default pipe size to 2 pages (bsc#1194587).
- platform/x86: apple-gmux: use resource_size() with res (git-fixes).
- platform/x86: thinkpad_acpi: Fix WWAN device disabled issue after S3 deep (git-fixes).
- power: reset: ltc2952: Fix use of floating point literals (git-fixes).
- power: supply: core: Break capacity loop (git-fixes).
- power: supply: max17042_battery: Clear status bits in interrupt handler (git-fixes).
- powerpc/64s: fix program check interrupt emergency stack path (bsc#1156395).
- powerpc/fadump: Fix inaccurate CPU state info in vmcore generated with panic (bsc#1193901 ltc#194976).
- powerpc/perf: Fix PMU callbacks to clear pending PMI before resetting an overflown PMC (bsc#1156395).
- powerpc/perf: Fix data source encodings for L2.1 and L3.1 accesses (bsc#1065729).
- powerpc/prom_init: Fix improper check of prom_getprop() (bsc#1065729).
- powerpc/pseries/cpuhp: cache node corrections (bsc#1065729).
- powerpc/pseries/cpuhp: delete add/remove_by_count code (bsc#1065729).
- powerpc/pseries/mobility: ignore ibm, platform-facilities updates (bsc#1065729).
- powerpc/traps: do not enable irqs in _exception (bsc#1065729).
- powerpc/xive: Add missing null check after calling kmalloc (bsc#1177437 ltc#188522 jsc#SLE-13294 git-fixes).
- powerpc: add interrupt_cond_local_irq_enable helper (bsc#1065729).
- powerpc: handle kdump appropriately with crash_kexec_post_notifiers option (bsc#1193901 ltc#194976).
- pwm: mxs: Do not modify HW state in .probe() after the PWM chip was registered (git-fixes).
- pwm: tiecap: Drop .free() callback (git-fixes).
- qlcnic: potential dereference null pointer of rx_queue-&gt;page_ring (git-fixes).
- quota: check block number when reading the block in quota file (bsc#1194589).
- quota: correct error number in free_dqentry() (bsc#1194590).
- random: fix data race on crng init time (git-fixes).
- random: fix data race on crng_node_pool (git-fixes).
- regmap: Call regmap_debugfs_exit() prior to _init() (git-fixes).
- rndis_host: support Hytera digital radios (git-fixes).
- rpmsg: core: Clean up resources on announce_create failure (git-fixes).
- rtl8xxxu: Fix the handling of TX A-MPDU aggregation (git-fixes).
- rtlwifi: rtl8192cu: Fix WARNING when calling local_irq_restore() with interrupts enabled (git-fixes).
- rtw88: use read_poll_timeout instead of fixed sleep (git-fixes).
- rtw88: wow: build wow function only if CONFIG_PM is on (git-fixes).
- rtw88: wow: fix size access error of probe request (git-fixes).
- sata: nv: fix debug format string mismatch (git-fixes).
- scsi: lpfc: Add additional debugfs support for CMF (bsc#1194266).
- scsi: lpfc: Adjust CMF total bytes and rxmonitor (bsc#1194266).
- scsi: lpfc: Cap CMF read bytes to MBPI (bsc#1194266).
- scsi: lpfc: Change return code on I/Os received during link bounce (bsc#1194266).
- scsi: lpfc: Fix NPIV port deletion crash (bsc#1194266).
- scsi: lpfc: Fix leaked lpfc_dmabuf mbox allocations with NPIV (bsc#1194266).
- scsi: lpfc: Fix lpfc_force_rscn ndlp kref imbalance (bsc#1194266).
- scsi: lpfc: Trigger SLI4 firmware dump before doing driver cleanup (bsc#1194266).
- scsi: lpfc: Update lpfc version to 14.0.0.4 (bsc#1194266).
- scsi: qla2xxx: Fix mailbox direction flags in qla2xxx_get_adapter_id() (git-fixes).
- scsi: qla2xxx: Format log strings only if needed (git-fixes).
- scsi: qla2xxx: edif: Fix EDIF bsg (git-fixes).
- scsi: qla2xxx: edif: Fix app start delay (git-fixes).
- scsi: qla2xxx: edif: Fix app start fail (git-fixes).
- scsi: qla2xxx: edif: Fix off by one bug in qla_edif_app_getfcinfo() (git-fixes).
- scsi: qla2xxx: edif: Flush stale events and msgs on session down (git-fixes).
- scsi: qla2xxx: edif: Increase ELS payload (git-fixes).
- select: Fix indefinitely sleeping task in poll_schedule_timeout() (bsc#1194027).
- selftests: KVM: Explicitly use movq to read xmm registers (git-fixes).
- selinux: fix potential memleak in selinux_add_opt() (git-fixes).
- seq_buf: Fix overflow in seq_buf_putmem_hex() (git-fixes).
- seq_buf: Make trace_seq_putmem_hex() support data longer than 8 (git-fixes).
- serial: pl011: Add ACPI SBSA UART match id (git-fixes).
- serial: tty: uartlite: fix console setup (git-fixes).
- sfc: Check null pointer of rx_queue-&gt;page_ring (git-fixes).
- sfc: The RX page_ring is optional (git-fixes).
- sfc: falcon: Check null pointer of rx_queue-&gt;page_ring (git-fixes).
- sfc_ef100: potential dereference of null pointer (jsc#SLE-16683).
- shmem: shmem_writepage() split unlikely i915 THP (git-fixes).
- slimbus: qcom: fix potential NULL dereference in qcom_slim_prg_slew() (git-fixes).
- soc/tegra: fuse: Fix bitwise vs. logical OR warning (git-fixes).
- soc: fsl: dpaa2-console: free buffer before returning from dpaa2_console_read (git-fixes).
- soc: fsl: dpio: rename the enqueue descriptor variable (git-fixes).
- soc: fsl: dpio: replace smp_processor_id with raw_smp_processor_id (git-fixes).
- soc: fsl: dpio: use an explicit NULL instead of 0 (git-fixes).
- soc: fsl: dpio: use the combined functions to protect critical zone (git-fixes).
- spi: change clk_disable_unprepare to clk_unprepare (git-fixes).
- spi: spi-meson-spifc: Add missing pm_runtime_disable() in meson_spifc_probe (git-fixes).
- spi: spi-rspi: Drop redeclaring ret variable in qspi_transfer_in() (git-fixes).
- staging: emxx_udc: Fix passing of NULL to dma_alloc_coherent() (git-fixes).
- staging: fbtft: Do not spam logs when probe is deferred (git-fixes).
- staging: fbtft: Rectify GPIO handling (git-fixes).
- staging: fieldbus: anybuss: jump to correct label in an error path (git-fixes).
- staging: ks7010: select CRYPTO_HASH/CRYPTO_MICHAEL_MIC (git-fixes).
- staging: rtl8192e: return error code from rtllib_softmac_init() (git-fixes).
- staging: rtl8192e: rtllib_module: fix error handle case in alloc_rtllib() (git-fixes).
- staging: wlan-ng: Avoid bitwise vs logical OR warning in hfa384x_usb_throttlefn() (git-fixes).
- string.h: fix incompatibility between FORTIFY_SOURCE and KASAN (git-fixes).
- thermal/drivers/imx8mm: Enable ADC when enabling monitor (git-fixes).
- thermal/drivers/int340x: Do not set a wrong tcc offset on resume (git-fixes).
- thermal: core: Reset previous low and high trip during thermal zone init (git-fixes).
- tpm: add request_locality before write TPM_INT_ENABLE (git-fixes).
- tpm: fix potential NULL pointer access in tpm_del_char_device (git-fixes).
- tracing/kprobes: 'nmissed' not showed correctly for kretprobe (git-fixes).
- tracing/uprobes: Check the return value of kstrdup() for tu-&gt;filename (git-fixes).
- tracing: Add test for user space strings when filtering on string pointers (git-fixes).
- tracing: Fix check for trace_percpu_buffer validity in get_trace_buf() (git-fixes).
- tty: max310x: fix flexible_array.cocci warnings (git-fixes).
- tty: serial: atmel: Call dma_async_issue_pending() (git-fixes).
- tty: serial: atmel: Check return code of dmaengine_submit() (git-fixes).
- tty: serial: earlycon dependency (git-fixes).
- tty: serial: qcom_geni_serial: Drop __init from qcom_geni_console_setup (git-fixes).
- tty: serial: uartlite: allow 64 bit address (git-fixes).
- tty: synclink_gt: rename a conflicting function name (git-fixes).
- udf: Fix crash after seekdir (bsc#1194592).
- uio: uio_dmem_genirq: Catch the Exception (git-fixes).
- usb: core: config: fix validation of wMaxPacketValue entries (git-fixes).
- usb: core: config: using bit mask instead of individual bits (git-fixes).
- usb: dwc2: check return value after calling platform_get_resource() (git-fixes).
- usb: dwc3: gadget: Continue to process pending requests (git-fixes).
- usb: dwc3: gadget: Ignore EP queue requests during bus reset (git-fixes).
- usb: dwc3: gadget: Reclaim extra TRBs after request completion (git-fixes).
- usb: dwc3: pci: Enable dis_uX_susphy_quirk for Intel Merrifield (git-fixes).
- usb: dwc3: ulpi: Fix USB2.0 HS/FS/LS PHY suspend regression (git-fixes).
- usb: dwc3: ulpi: Replace CPU-based busyloop with Protocol-based one (git-fixes).
- usb: dwc3: ulpi: fix checkpatch warning (git-fixes).
- usb: ftdi-elan: fix memory leak on device disconnect (git-fixes).
- usb: gadget: composite: Allow bMaxPower=0 if self-powered (git-fixes).
- usb: gadget: f_fs: Clear ffs_eventfd in ffs_data_clear (git-fixes).
- usb: gadget: u_ether: fix race in setting MAC address in setup phase (git-fixes).
- usb: mtu3: add memory barrier before set GPD's HWO (git-fixes).
- usb: mtu3: fix interval value for intr and isoc (git-fixes).
- usb: mtu3: fix list_head check warning (git-fixes).
- usb: mtu3: set interval of FS intr and isoc endpoint (git-fixes).
- usb: typec: tcpm: handle SRC_STARTUP state if cc changes (git-fixes).
- usb: xhci: Extend support for runtime power management for AMD's Yellow carp (git-fixes).
- usermodehelper: reset umask to default before executing user process (git-fixes).
- vfs: check fd has read access in kernel_read_file_from_fd() (bsc#1194888).
- video: backlight: Drop maximum brightness override for brightness zero (git-fixes).
- watchdog: Fix OMAP watchdog early handling (git-fixes).
- watchdog: f71808e_wdt: fix inaccurate report in WDIOC_GETTIMEOUT (git-fixes).
- wcn36xx: Fix missing frame timestamp for beacon/probe-resp (git-fixes).
- wcn36xx: Indicate beacon not connection loss on MISSED_BEACON_IND (git-fixes).
- wcn36xx: Release DMA channel descriptor allocations (git-fixes).
- wcn36xx: handle connection loss indication (git-fixes).
- wireguard: allowedips: add missing __rcu annotation to satisfy sparse (git-fixes).
- wireguard: device: reset peer src endpoint when netns exits (git-fixes).
- wireguard: ratelimiter: use kvcalloc() instead of kvzalloc() (git-fixes).
- wireguard: receive: drop handshakes if queue lock is contended (git-fixes).
- wireguard: receive: use ring buffer for incoming handshakes (git-fixes).
- wireguard: selftests: actually test for routing loops (git-fixes).
- wireguard: selftests: increase default dmesg log size (git-fixes).
- wireless: iwlwifi: Fix a double free in iwl_txq_dyn_alloc_dma (git-fixes).
- x86/platform/uv: Add more to secondary CPU kdump info (bsc#1194493).
- xhci: Fresco FL1100 controller should not have BROKEN_MSI quirk set (git-fixes).
- xhci: Remove CONFIG_USB_DEFAULT_PERSIST to prevent xHCI from runtime suspending (git-fixes).
- xhci: avoid race between disable slot command and host runtime suspend (git-fixes).
- xhci: fix unsafe memory usage in xhci tracing (git-fixes).
</description>
    <pkglist>
      <collection>
        <package name="cluster-md-kmp-preempt" epoch="0" version="5.3.18" release="150300.59.43.1" arch="x86_64" src="x86_64/cluster-md-kmp-preempt-5.3.18-150300.59.43.1.x86_64.rpm">
          <filename>cluster-md-kmp-preempt-5.3.18-150300.59.43.1.x86_64.rpm</filename>
          <reboot_suggested>True</reboot_suggested>
        </package>
        <package name="dlm-kmp-preempt" epoch="0" version="5.3.18" release="150300.59.43.1" arch="x86_64" src="x86_64/dlm-kmp-preempt-5.3.18-150300.59.43.1.x86_64.rpm">
          <filename>dlm-kmp-preempt-5.3.18-150300.59.43.1.x86_64.rpm</filename>
          <reboot_suggested>True</reboot_suggested>
        </package>
        <package name="gfs2-kmp-preempt" epoch="0" version="5.3.18" release="150300.59.43.1" arch="x86_64" src="x86_64/gfs2-kmp-preempt-5.3.18-150300.59.43.1.x86_64.rpm">
          <filename>gfs2-kmp-preempt-5.3.18-150300.59.43.1.x86_64.rpm</filename>
          <reboot_suggested>True</reboot_suggested>
        </package>
        <package name="kernel-preempt" epoch="0" version="5.3.18" release="150300.59.43.1" arch="nosrc" src="nosrc/kernel-preempt-5.3.18-150300.59.43.1.nosrc.rpm">
          <filename>kernel-preempt-5.3.18-150300.59.43.1.nosrc.rpm</filename>
          <reboot_suggested>True</reboot_suggested>
        </package>
        <package name="kernel-preempt" epoch="0" version="5.3.18" release="150300.59.43.1" arch="x86_64" src="x86_64/kernel-preempt-5.3.18-150300.59.43.1.x86_64.rpm">
          <filename>kernel-preempt-5.3.18-150300.59.43.1.x86_64.rpm</filename>
          <reboot_suggested>True</reboot_suggested>
        </package>
        <package name="kernel-preempt-devel" epoch="0" version="5.3.18" release="150300.59.43.1" arch="x86_64" src="x86_64/kernel-preempt-devel-5.3.18-150300.59.43.1.x86_64.rpm">
          <filename>kernel-preempt-devel-5.3.18-150300.59.43.1.x86_64.rpm</filename>
          <reboot_suggested>True</reboot_suggested>
        </package>
        <package name="kernel-preempt-extra" epoch="0" version="5.3.18" release="150300.59.43.1" arch="x86_64" src="x86_64/kernel-preempt-extra-5.3.18-150300.59.43.1.x86_64.rpm">
          <filename>kernel-preempt-extra-5.3.18-150300.59.43.1.x86_64.rpm</filename>
          <reboot_suggested>True</reboot_suggested>
        </package>
        <package name="kernel-preempt-livepatch-devel" epoch="0" version="5.3.18" release="150300.59.43.1" arch="x86_64" src="x86_64/kernel-preempt-livepatch-devel-5.3.18-150300.59.43.1.x86_64.rpm">
          <filename>kernel-preempt-livepatch-devel-5.3.18-150300.59.43.1.x86_64.rpm</filename>
          <reboot_suggested>True</reboot_suggested>
        </package>
        <package name="kernel-preempt-optional" epoch="0" version="5.3.18" release="150300.59.43.1" arch="x86_64" src="x86_64/kernel-preempt-optional-5.3.18-150300.59.43.1.x86_64.rpm">
          <filename>kernel-preempt-optional-5.3.18-150300.59.43.1.x86_64.rpm</filename>
          <reboot_suggested>True</reboot_suggested>
        </package>
        <package name="kselftests-kmp-preempt" epoch="0" version="5.3.18" release="150300.59.43.1" arch="x86_64" src="x86_64/kselftests-kmp-preempt-5.3.18-150300.59.43.1.x86_64.rpm">
          <filename>kselftests-kmp-preempt-5.3.18-150300.59.43.1.x86_64.rpm</filename>
          <reboot_suggested>True</reboot_suggested>
        </package>
        <package name="ocfs2-kmp-preempt" epoch="0" version="5.3.18" release="150300.59.43.1" arch="x86_64" src="x86_64/ocfs2-kmp-preempt-5.3.18-150300.59.43.1.x86_64.rpm">
          <filename>ocfs2-kmp-preempt-5.3.18-150300.59.43.1.x86_64.rpm</filename>
          <reboot_suggested>True</reboot_suggested>
        </package>
        <package name="reiserfs-kmp-preempt" epoch="0" version="5.3.18" release="150300.59.43.1" arch="x86_64" src="x86_64/reiserfs-kmp-preempt-5.3.18-150300.59.43.1.x86_64.rpm">
          <filename>reiserfs-kmp-preempt-5.3.18-150300.59.43.1.x86_64.rpm</filename>
          <reboot_suggested>True</reboot_suggested>
        </package>
        <package name="dtb-aarch64" epoch="0" version="5.3.18" release="150300.59.43.1" arch="src" src="src/dtb-aarch64-5.3.18-150300.59.43.1.src.rpm">
          <filename>dtb-aarch64-5.3.18-150300.59.43.1.src.rpm</filename>
          <reboot_suggested>True</reboot_suggested>
        </package>
        <package name="dtb-al" epoch="0" version="5.3.18" release="150300.59.43.1" arch="aarch64" src="aarch64/dtb-al-5.3.18-150300.59.43.1.aarch64.rpm">
          <filename>dtb-al-5.3.18-150300.59.43.1.aarch64.rpm</filename>
          <reboot_suggested>True</reboot_suggested>
        </package>
        <package name="dtb-zte" epoch="0" version="5.3.18" release="150300.59.43.1" arch="aarch64" src="aarch64/dtb-zte-5.3.18-150300.59.43.1.aarch64.rpm">
          <filename>dtb-zte-5.3.18-150300.59.43.1.aarch64.rpm</filename>
          <reboot_suggested>True</reboot_suggested>
        </package>
      </collection>
    </pkglist>
  </update>
  <update from="maint-coord@suse.de" status="stable" type="security" version="1">
    <id>openSUSE-SLE-15.4-2022-214</id>
    <title>Security update for log4j</title>
    <severity>important</severity>
    <release>SUSE Updates openSUSE-SLE 15.4</release>
    <issued date="1643295159"/>
    <references>
      <reference href="https://bugzilla.suse.com/show_bug.cgi?id=1194843" id="1194843" title="VUL-0: CVE-2022-23305: log4j: SQL injection in Log4j 1.x when application is configured to use JDBCAppender" type="bugzilla"/>
      <reference href="https://bugzilla.suse.com/show_bug.cgi?id=1194842" id="1194842" title="VUL-0: CVE-2022-23302: log4j: Remote code execution in Log4j 1.x when application is configured to use JMSSink" type="bugzilla"/>
      <reference href="https://bugzilla.suse.com/show_bug.cgi?id=1194844" id="1194844" title="VUL-0: CVE-2022-23307: log4j: Apache Log4j 1.x:  A deserialization flaw in the Chainsaw component of Log4j 1 can lead to malicious code execution." type="bugzilla"/>
      <reference href="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2022-23302" id="CVE-2022-23302" title="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2022-23302" type="cve"/>
      <reference href="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2022-23305" id="CVE-2022-23305" title="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2022-23305" type="cve"/>
      <reference href="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2022-23307" id="CVE-2022-23307" title="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2022-23307" type="cve"/>
    </references>
    <description>This update for log4j fixes the following issues:

- CVE-2022-23307: Fixed deserialization flaw in the chainsaw component of log4j leading to malicious code execution. (bsc#1194844)
- CVE-2022-23305: Fixed SQL injection when application is configured to use JDBCAppender. (bsc#1194843)
- CVE-2022-23302: Fixed remote code execution when application is configured to use JMSSink. (bsc#1194842)
</description>
    <pkglist>
      <collection>
        <package name="log4j" epoch="0" version="1.2.17" release="5.9.1" arch="src" src="src/log4j-1.2.17-5.9.1.src.rpm">
          <filename>log4j-1.2.17-5.9.1.src.rpm</filename>
        </package>
        <package name="log4j-manual" epoch="0" version="1.2.17" release="5.9.1" arch="noarch" src="noarch/log4j-manual-1.2.17-5.9.1.noarch.rpm">
          <filename>log4j-manual-1.2.17-5.9.1.noarch.rpm</filename>
        </package>
      </collection>
    </pkglist>
  </update>
</updates>
