SUSE-SU-2024:3746-1

Details

Description of the patch:

This update for protobuf fixes the following issues:

CVE-2024-7254: Fixed stack overflow vulnerability in Protocol Buffer (bsc#1230778)

Affected Packages

libprotobuf-lite25_1_0

SUSE Linux Enterprise Desktop 15 SP4SUSE Linux Enterprise High Performance Computing 15 SP4SUSE Linux Enterprise High Performance Computing 15 SP4-ESPOSSUSE Linux Enterprise High Performance Computing 15 SP4-LTSSSUSE Linux Enterprise Installer Updates 15 SP4

Fixed in:

25.1-150400.9.10.1

libprotobuf25_1_0

SUSE Linux Enterprise High Performance Computing 15 SP4-ESPOSSUSE Linux Enterprise High Performance Computing 15 SP4-LTSSSUSE Linux Enterprise Server 15 SP4-LTSS

Fixed in:

25.1-150400.9.10.1

libprotoc25_1_0

SUSE Linux Enterprise High Performance Computing 15 SP4-ESPOSSUSE Linux Enterprise High Performance Computing 15 SP4-LTSSSUSE Linux Enterprise Server 15 SP4-LTSS

Fixed in:

25.1-150400.9.10.1

protobuf-devel

SUSE Linux Enterprise High Performance Computing 15 SP4-ESPOSSUSE Linux Enterprise High Performance Computing 15 SP4-LTSSSUSE Linux Enterprise Server 15 SP4-LTSS

Fixed in:

25.1-150400.9.10.1

python311-protobuf

SUSE Linux Enterprise Module for Public Cloud 15 SP4

Fixed in:

4.25.1-150400.9.10.1

References

ADVISORY

https://bugzilla.suse.com/1230778

ADVISORY

https://lists.suse.com/pipermail/sle-security-updates/2024-October/019666.html

ADVISORY

https://www.suse.com/security/cve/CVE-2024-7254/

WEB

https://www.suse.com/support/security/rating/

ADVISORY

https://www.suse.com/support/update/announcement/2024/suse-su-20243746-1/