=]-d=alignhot=0.
* Linker: The linker now disallows using a //go:linkname
directive to refer to internal symbols in the standard library
(including the runtime) that are not marked with //go:linkname
on their definitions. Similarly, the linker disallows
references to such symbols from assembly code. For backward
compatibility, existing usages of //go:linkname found in a
large open-source code corpus remain supported. Any new
references to standard library internal symbols will be
disallowed.
* Linker: A linker command line flag -checklinkname=0 can be used
to disable this check, for debugging and experimenting
purposes.
* Linker: When building a dynamically linked ELF binary
(including PIE binary), the new -bindnow flag enables immediate
function binding.
* Standard library changes:
* timer: 1.23 makes two significant changes to the implementation
of time.Timer and time.Ticker.
First, Timers and Tickers that are no longer referred to by the
program become eligible for garbage collection immediately,
even if their Stop methods have not been called. Earlier
versions of Go did not collect unstopped Timers until after
they had fired and never collected unstopped Tickers.
Second, the timer channel associated with a Timer or Ticker is
now unbuffered, with capacity 0. The main effect of this change
is that Go now guarantees that for any call to a Reset or Stop
method, no stale values prepared before that call will be sent
or received after the call. Earlier versions of Go used
channels with a one-element buffer, making it difficult to use
Reset and Stop correctly. A visible effect of this change is
that len and cap of timer channels now returns 0 instead of 1,
which may affect programs that poll the length to decide
whether a receive on the timer channel will succeed. Such code
should use a non-blocking receive instead.
These new behaviors are only enabled when the main Go program
is in a module with a go.mod go line using Go 1.23.0 or
later. When Go 1.23 builds older programs, the old behaviors
remain in effect. The new GODEBUG setting asynctimerchan=1 can
be used to revert back to asynchronous channel behaviors even
when a program names Go 1.23.0 or later in its go.mod file.
* unique: The new unique package provides facilities for
canonicalizing values (like 'interning' or 'hash-consing').
Any value of comparable type may be canonicalized with the new
Make[T] function, which produces a reference to a canonical
copy of the value in the form of a Handle[T]. Two Handle[T] are
equal if and only if the values used to produce the handles are
equal, allowing programs to deduplicate values and reduce their
memory footprint. Comparing two Handle[T] values is efficient,
reducing down to a simple pointer comparison.
* iter: The new iter package provides the basic definitions for
working with user-defined iterators.
* slices: The slices package adds several functions that work
with iterators:
- All returns an iterator over slice indexes and values.
- Values returns an iterator over slice elements.
- Backward returns an iterator that loops over a slice backward.
- Collect collects values from an iterator into a new slice.
- AppendSeq appends values from an iterator to an existing slice.
- Sorted collects values from an iterator into a new slice, and then sorts the slice.
- SortedFunc is like Sorted but with a comparison function.
- SortedStableFunc is like SortFunc but uses a stable sort algorithm.
- Chunk returns an iterator over consecutive sub-slices of up to n elements of a slice.
* maps: The maps package adds several functions that work with
iterators:
- All returns an iterator over key-value pairs from a map.
- Keys returns an iterator over keys in a map.
- Values returns an iterator over values in a map.
- Insert adds the key-value pairs from an iterator to an existing map.
- Collect collects key-value pairs from an iterator into a new map and returns it.
* structs: The new structs package provides types for struct
fields that modify properties of the containing struct type
such as memory layout.
In this release, the only such type is HostLayout which
indicates that a structure with a field of that type has a
layout that conforms to host platform expectations.
* Minor changes to the standard library: As always, there are
various minor changes and updates to the library, made with the
Go 1 promise of compatibility in mind.
* archive/tar: If the argument to FileInfoHeader implements the
new FileInfoNames interface, then the interface methods will be
used to set the Uname/Gname of the file header. This allows
applications to override the system-dependent Uname/Gname
lookup.
* crypto/tls: The TLS client now supports the Encrypted Client
Hello draft specification. This feature can be enabled by
setting the Config.EncryptedClientHelloConfigList field to an
encoded ECHConfigList for the host that is being connected to.
* crypto/tls: The QUICConn type used by QUIC implementations
includes new events reporting on the state of session
resumption, and provides a way for the QUIC layer to add data
to session tickets and session cache entries.
* crypto/tls: 3DES cipher suites were removed from the default
list used when Config.CipherSuites is nil. The default can be
reverted by adding tls3des=1 to the GODEBUG environment
variable.
* crypto/tls: The experimental post-quantum key exchange
mechanism X25519Kyber768Draft00 is now enabled by default when
Config.CurvePreferences is nil. The default can be reverted by
adding tlskyber=0 to the GODEBUG environment variable.
* crypto/tls: Go 1.23 changed the behavior of X509KeyPair and
LoadX509KeyPair to populate the Certificate.Leaf field of the
returned Certificate. The new x509keypairleaf GODEBUG setting
is added for this behavior.
* crypto/x509: CreateCertificateRequest now correctly supports
RSA-PSS signature algorithms.
* crypto/x509: CreateCertificateRequest and CreateRevocationList
now verify the generated signature using the signer's public
key. If the signature is invalid, an error is returned. This
has been the behavior of CreateCertificate since Go 1.16.
* crypto/x509: The x509sha1 GODEBUG setting will be removed in
the next Go major release (Go 1.24). This will mean that
crypto/x509 will no longer support verifying signatures on
certificates that use SHA-1 based signature algorithms.
* crypto/x509: The new ParseOID function parses a dot-encoded
ASN.1 Object Identifier string. The OID type now implements the
encoding.BinaryMarshaler, encoding.BinaryUnmarshaler,
encoding.TextMarshaler, encoding.TextUnmarshaler interfaces.
database/sql
* crypto/x509: Errors returned by driver.Valuer implementations
are now wrapped for improved error handling during operations
like DB.Query, DB.Exec, and DB.QueryRow.
* debug/elf: The debug/elf package now defines
PT_OPENBSD_NOBTCFI. This ProgType is used to disable Branch
Tracking Control Flow Integrity (BTCFI) enforcement on OpenBSD
binaries.
* debug/elf: Now defines the symbol type constants STT_RELC,
STT_SRELC, and STT_GNU_IFUNC.
* encoding/binary The new Encode and Decode functions are byte
slice equivalents to Read and Write. Append allows marshaling
multiple data into the same byte slice.
* go/ast: The new Preorder function returns a convenient iterator
over all the nodes of a syntax tree.
* go/types: The Func type, which represents a function or method
symbol, now has a Func.Signature method that returns the
function's type, which is always a Signature.
* go/types: The Alias type now has an Rhs method that returns the
type on the right-hand side of its declaration: given type A =
B, the Rhs of A is B. (go#66559)
* go/types: The methods Alias.Origin, Alias.SetTypeParams,
Alias.TypeParams, and Alias.TypeArgs have been added. They are
needed for generic alias types.
* go/types: By default, go/types now produces Alias type nodes
for type aliases. This behavior can be controlled by the
GODEBUG gotypesalias flag. Its default has changed from 0 in Go
1.22 to 1 in Go 1.23.
* math/rand/v2: The Uint function and Rand.Uint method have been
added. They were inadvertently left out of Go 1.22.
* math/rand/v2: The new ChaCha8.Read method implements the
io.Reader interface.
* net: The new type KeepAliveConfig permits fine-tuning the
keep-alive options for TCP connections, via a new
TCPConn.SetKeepAliveConfig method and new KeepAliveConfig
fields for Dialer and ListenConfig.
* net: The DNSError type now wraps errors caused by timeouts or
cancellation. For example, errors.Is(someDNSErr,
context.DeadlineExceedeed) will now report whether a DNS error
was caused by a timeout.
* net: The new GODEBUG setting netedns0=0 disables sending EDNS0
additional headers on DNS requests, as they reportedly break
the DNS server on some modems.
* net/http: Cookie now preserves double quotes surrounding a
cookie value. The new Cookie.Quoted field indicates whether the
Cookie.Value was originally quoted.
* net/http: The new Request.CookiesNamed method retrieves all
cookies that match the given name.
* net/http: The new Cookie.Partitioned field identifies cookies
with the Partitioned attribute.
* net/http: The patterns used by ServeMux now allow one or more
spaces or tabs after the method name. Previously, only a single
space was permitted.
* net/http: The new ParseCookie function parses a Cookie header
value and returns all the cookies which were set in it. Since
the same cookie name can appear multiple times the returned
Values can contain more than one value for a given key.
* net/http: The new ParseSetCookie function parses a Set-Cookie
header value and returns a cookie. It returns an error on
syntax error.
* net/http: ServeContent, ServeFile, and ServeFileFS now remove
the Cache-Control, Content-Encoding, Etag, and Last-Modified
headers when serving an error. These headers usually apply to
the non-error content, but not to the text of errors.
* net/http: Middleware which wraps a ResponseWriter and applies
on-the-fly encoding, such as Content-Encoding: gzip, will not
function after this change. The previous behavior of
ServeContent, ServeFile, and ServeFileFS may be restored by
setting GODEBUG=httpservecontentkeepheaders=1.
Note that middleware which changes the size of the served
content (such as by compressing it) already does not function
properly when ServeContent handles a Range request. On-the-fly
compression should use the Transfer-Encoding header instead of
Content-Encoding.
* net/http: For inbound requests, the new Request.Pattern field
contains the ServeMux pattern (if any) that matched the
request. This field is not set when GODEBUG=httpmuxgo121=1 is
set.
* net/http/httptest: The new NewRequestWithContext method creates
an incoming request with a context.Context.
* net/netip: In Go 1.22 and earlier, using reflect.DeepEqual to
compare an Addr holding an IPv4 address to one holding the
IPv4-mapped IPv6 form of that address incorrectly returned
true, even though the Addr values were different when comparing
with == or Addr.Compare. This bug is now fixed and all three
approaches now report the same result.
* os: The Stat function now sets the ModeSocket bit for files
that are Unix sockets on Windows. These files are identified by
having a reparse tag set to IO_REPARSE_TAG_AF_UNIX.
* os: On Windows, the mode bits reported by Lstat and Stat for
reparse points changed. Mount points no longer have ModeSymlink
set, and reparse points that are not symlinks, Unix sockets, or
dedup files now always have ModeIrregular set. This behavior is
controlled by the winsymlink setting. For Go 1.23, it defaults
to winsymlink=1. Previous versions default to winsymlink=0.
* os: The CopyFS function copies an io/fs.FS into the local
filesystem.
* os: On Windows, Readlink no longer tries to normalize volumes
to drive letters, which was not always even possible. This
behavior is controlled by the winreadlinkvolume setting. For Go
1.23, it defaults to winreadlinkvolume=1. Previous versions
default to winreadlinkvolume=0.
* os: On Linux with pidfd support (generally Linux v5.4+),
Process-related functions and methods use pidfd (rather than
PID) internally, eliminating potential mistargeting when a PID
is reused by the OS. Pidfd support is fully transparent to a
user, except for additional process file descriptors that a
process may have.
* path/filepath: The new Localize function safely converts a
slash-separated path into an operating system path.
* path/filepath: On Windows, EvalSymlinks no longer evaluates
mount points, which was a source of many inconsistencies and
bugs. This behavior is controlled by the winsymlink
setting. For Go 1.23, it defaults to winsymlink=1. Previous
versions default to winsymlink=0.
* path/filepath: On Windows, EvalSymlinks no longer tries to
normalize volumes to drive letters, which was not always even
possible. This behavior is controlled by the winreadlinkvolume
setting. For Go 1.23, it defaults to
winreadlinkvolume=1. Previous versions default to
winreadlinkvolume=0.
* reflect: The new methods synonymous with the methods of the
same name in Value are added to Type:
- Type.OverflowComplex
- Type.OverflowFloat
- Type.OverflowInt
- Type.OverflowUint
* reflect: The new SliceAt function is analogous to NewAt, but
for slices.
* reflect: The Value.Pointer and Value.UnsafePointer methods now
support values of kind String.
* reflect: The new methods Value.Seq and Value.Seq2 return
sequences that iterate over the value as though it were used in
a for/range loop. The new methods Type.CanSeq and Type.CanSeq2
report whether calling Value.Seq and Value.Seq2, respectively,
will succeed without panicking.
* runtime/debug: The SetCrashOutput function allows the user to
specify an alternate file to which the runtime should write its
fatal crash report. It may be used to construct an automated
reporting mechanism for all unexpected crashes, not just those
in goroutines that explicitly use recover.
* runtime/pprof: The maximum stack depth for alloc, mutex, block,
threadcreate and goroutine profiles has been raised from 32 to
128 frames.
* runtime/trace: The runtime now explicitly flushes trace data
when a program crashes due to an uncaught panic. This means
that more complete trace data will be available in a trace if
the program crashes while tracing is active.
* slices: The Repeat function returns a new slice that repeats
the provided slice the given number of times.
* sync: The Map.Clear method deletes all the entries, resulting
in an empty Map. It is analogous to clear.
* sync/atomic: The new And and Or operators apply a bitwise AND
or OR to the given input, returning the old value.
* syscall: The syscall package now defines WSAENOPROTOOPT on
Windows.
* syscall: The GetsockoptInt function is now supported on
Windows.
* testing/fstest: TestFS now returns a structured error that can
be unwrapped (via method Unwrap() []error). This allows
inspecting errors using errors.Is or errors.As.
* text/template: Templates now support the new 'else with'
action, which reduces template complexity in some use cases.
* time: Parse and ParseInLocation now return an error if the time
zone offset is out of range.
* unicode/utf16: The RuneLen function returns the number of
16-bit words in the UTF-16 encoding of the rune. It returns -1
if the rune is not a valid value to encode in UTF-16.
* Port: Darwin: As announced in the Go 1.22 release notes, Go
1.23 requires macOS 11 Big Sur or later; support for previous
versions has been discontinued.
* Port: Linux: Go 1.23 is the last release that requires Linux
kernel version 2.6.32 or later. Go 1.24 will require Linux
kernel version 3.17 or later, with an exception that systems
running 3.10 or later will continue to be supported if the
kernel has been patched to support the getrandom system call.
* Port: OpenBSD: Go 1.23 adds experimental support for OpenBSD on
64-bit RISC-V (GOOS=openbsd, GOARCH=riscv64).
* Port: ARM64: Go 1.23 introduces a new GOARM64 environment
variable, which specifies the minimum target version of the
ARM64 architecture at compile time. Allowed values are v8.{0-9}
and v9.{0-5}. This may be followed by an option specifying
extensions implemented by target hardware. Valid options are
,lse and ,crypto.
The GOARM64 environment variable defaults to v8.0.
* Port: RISC-V: Go 1.23 introduces a new GORISCV64 environment
variable, which selects the RISC-V user-mode application
profile for which to compile. Allowed values are rva20u64 and
rva22u64.
The GORISCV64 environment variable defaults to rva20u64.
* Port: Wasm: The go_wasip1_wasm_exec script in GOROOT/misc/wasm
has dropped support for versions of wasmtime < 14.0.0.
SUSE-CU-2024:3384-1
| Container Advisory ID | SUSE-CU-2024:3384-1 |
| Container Tags | bci/golang:1.22 , bci/golang:1.22-1.36.1 , bci/golang:latest , bci/golang:stable , bci/golang:stable-1.36.1 |
| Container Release | 36.1 |
The following patches have been included in this update:
| Advisory ID | SUSE-SU-2024:2635-1
|
| Released | Tue Jul 30 09:14:09 2024 |
| Summary | Security update for openssl-3 |
| Type | security |
| Severity | important |
| References | 1222899,1223336,1226463,1227138,CVE-2024-5535 |
Description:
This update for openssl-3 fixes the following issues:
Security fixes:
- CVE-2024-5535: Fixed SSL_select_next_proto buffer overread (bsc#1227138)
Other fixes:
- Build with no-afalgeng (bsc#1226463)
- Build with enabled sm2 and sm4 support (bsc#1222899)
- Fix non-reproducibility issue (bsc#1223336)
| Advisory ID | SUSE-RU-2024:2641-1
|
| Released | Tue Jul 30 09:29:36 2024 |
| Summary | Recommended update for systemd |
| Type | recommended |
| Severity | moderate |
| References | |
Description:
This update for systemd fixes the following issues:
systemd was updated from version 254.13 to version 254.15:
- Changes in version 254.15:
* boot: cover for hardware keys on phones/tablets
* Conditional PSI check to reflect changes done in 5.13
* core/dbus-manager: refuse SoftReboot() for user managers
* core/exec-invoke: reopen OpenFile= fds with O_NOCTTY
* core/exec-invoke: use sched_setattr instead of sched_setscheduler
* core/unit: follow merged units before updating SourcePath= timestamp too
* coredump: correctly take tmpfs size into account for compression
* cryptsetup: improve TPM2 blob display
* docs: Add section to HACKING.md on distribution packages
* docs: fixed dead link to GNOME documentation
* docs/CODING_STYLE: document that we nowadays prefer (const char*) for func ret type
* Fixed typo in CAP_BPF description
* LICENSES/README: expand text to summarize state for binaries and libs
* man: fully adopt ~/.local/state/
* man/systemd.exec: list inaccessible files for ProtectKernelTunables
* man/tmpfiles: remove outdated behavior regarding symlink ownership
* meson: bpf: propagate 'sysroot' for cross compilation
* meson: Define __TARGET_ARCH macros required by bpf
* mkfs-util: Set sector size for btrfs as well
* mkosi: drop CentOS 8 from CI
* mkosi: Enable hyperscale-packages-experimental for CentOS
* mountpoint-util: do not assume symlinks are not mountpoints
* os-util: avoid matching on the wrong extension-release file
* README: add missing CONFIG_MEMCG kernel config option for oomd
* README: update requirements for signed dm-verity
* resolved: allow the full TTL to be used by OPT records
* resolved: correct parsing of OPT extended RCODEs
* sysusers: handle NSS errors gracefully
* TEST-58-REPART: reverse order of diff args
* TEST-64-UDEV-STORAGE: Make nvme_subsystem expected pci symlinks more generic
* test: fixed TEST-24-CRYPTSETUP on SUSE
* test: install /etc/hosts
* Use consistent spelling of systemd.condition_first_boot argument
* util: make file_read() 64bit offset safe
* vmm: make sure we can handle smbios objects without variable part
- Changes in version 254.14:
* analyze: show pcrs also in sha384 bank
* chase: Tighten '.' and './' check
* core/service: fixed accept-socket deserialization
* efi-api: check /sys/class/tpm/tpm0/tpm_version_major, too
* executor: check for all permission related errnos when setting up IPC namespace
* install: allow removing symlinks even for units that are gone
* json: use secure un{base64,hex}mem for sensitive variants
* man,units: drop 'temporary' from description of systemd-tmpfiles
* missing_loop.h: fixed LOOP_SET_STATUS_SETTABLE_FLAGS
* repart: fixed memory leak
* repart: Use CRYPT_ACTIVATE_PRIVATE
* resolved: permit dnssec rrtype questions when we aren't validating
* rules: Limit the number of device units generated for serial ttys
* run: do not pass the pty slave fd to transient service in a machine
* sd-dhcp-server: clear buffer before receive
* strbuf: use GREEDY_REALLOC to grow the buffer
SUSE-CU-2024:3252-1
| Container Advisory ID | SUSE-CU-2024:3252-1 |
| Container Tags | bci/golang:1.22 , bci/golang:1.22-1.35.4 , bci/golang:latest , bci/golang:stable , bci/golang:stable-1.35.4 |
| Container Release | 35.4 |
The following patches have been included in this update:
| Advisory ID | SUSE-SU-2024:2579-1
|
| Released | Mon Jul 22 12:36:34 2024 |
| Summary | Security update for git |
| Type | security |
| Severity | important |
| References | 1219660,CVE-2024-24577 |
Description:
This update for git fixes the following issues:
- CVE-2024-24577: Fixed arbitrary code execution due to heap corruption in git_index_add (bsc#1219660)
SUSE-CU-2024:3126-1
| Container Advisory ID | SUSE-CU-2024:3126-1 |
| Container Tags | bci/golang:1.22 , bci/golang:1.22-1.35.3 , bci/golang:latest , bci/golang:stable , bci/golang:stable-1.35.3 |
| Container Release | 35.3 |
The following patches have been included in this update:
SUSE-CU-2024:3067-1
| Container Advisory ID | SUSE-CU-2024:3067-1 |
| Container Tags | bci/golang:1.22 , bci/golang:1.22-1.34.7 , bci/golang:latest , bci/golang:stable , bci/golang:stable-1.34.7 |
| Container Release | 34.7 |
The following patches have been included in this update:
| Advisory ID | SUSE-SU-2024:2307-1
|
| Released | Fri Jul 5 12:04:34 2024 |
| Summary | Security update for krb5 |
| Type | security |
| Severity | important |
| References | 1227186,1227187,CVE-2024-37370,CVE-2024-37371 |
Description:
This update for krb5 fixes the following issues:
- CVE-2024-37370: Fixed confidential GSS krb5 wrap tokens with invalid fields were errouneously accepted (bsc#1227186).
- CVE-2024-37371: Fixed invalid memory read when processing message tokens with invalid length fields (bsc#1227187).
| Advisory ID | SUSE-SU-2024:2309-1
|
| Released | Fri Jul 5 12:05:37 2024 |
| Summary | Security update for go1.22 |
| Type | security |
| Severity | important |
| References | 1218424,1227314,CVE-2024-24791 |
Description:
This update for go1.22 fixes the following issues:
Updated to version 1.22.5 (bsc#1218424):
- CVE-2024-24791: Fixed a potential denial of service due to
improper handling of HTTP 100-continue headers (bsc#1227314).
SUSE-CU-2024:3048-1
| Container Advisory ID | SUSE-CU-2024:3048-1 |
| Container Tags | bci/golang:1.22 , bci/golang:1.22-1.34.5 , bci/golang:latest , bci/golang:stable , bci/golang:stable-1.34.5 |
| Container Release | 34.5 |
The following patches have been included in this update:
| Advisory ID | SUSE-RU-2018:2607-1
|
| Released | Wed Nov 7 15:42:48 2018 |
| Summary | Optional update for gcc8 |
| Type | recommended |
| Severity | low |
| References | 1084812,1084842,1087550,1094222,1102564 |
Description:
The GNU Compiler GCC 8 is being added to the Development Tools Module by this
update.
The update also supplies gcc8 compatible libstdc++, libgcc_s1 and other
gcc derived libraries for the Basesystem module of SUSE Linux Enterprise 15.
Various optimizers have been improved in GCC 8, several of bugs fixed,
quite some new warnings added and the error pin-pointing and
fix-suggestions have been greatly improved.
The GNU Compiler page for GCC 8 contains a summary of all the changes that
have happened:
https://gcc.gnu.org/gcc-8/changes.html
Also changes needed or common pitfalls when porting software are described on:
https://gcc.gnu.org/gcc-8/porting_to.html
| Advisory ID | SUSE-RU-2018:2798-1
|
| Released | Wed Nov 28 07:48:35 2018 |
| Summary | Recommended update for make |
| Type | recommended |
| Severity | moderate |
| References | 1100504 |
Description:
This update for make fixes the following issues:
- Use a non-blocking read with pselect to avoid hangs (bsc#1100504)
| Advisory ID | SUSE-SU-2018:2861-1
|
| Released | Thu Dec 6 14:32:01 2018 |
| Summary | Security update for ncurses |
| Type | security |
| Severity | important |
| References | 1103320,1115929,CVE-2018-19211 |
Description:
This update for ncurses fixes the following issues:
Security issue fixed:
- CVE-2018-19211: Fixed denial of service issue that was triggered by a NULL pointer dereference at function _nc_parse_entry (bsc#1115929).
Non-security issue fixed:
- Remove scree.xterm from terminfo data base as with this screen uses fallback TERM=screen (bsc#1103320).
| Advisory ID | SUSE-RU-2019:6-1
|
| Released | Wed Jan 2 20:25:25 2019 |
| Summary | Recommended update for gcc7 |
| Type | recommended |
| Severity | moderate |
| References | 1099119,1099192 |
Description:
GCC 7 was updated to the GCC 7.4 release.
- Fix AVR configuration to not use __cxa_atexit or libstdc++ headers.
Point to /usr/avr/sys-root/include as system header include directory.
- Includes fix for build with ISL 0.20.
- Pulls fix for libcpp lexing bug on ppc64le manifesting during
build with gcc8. [bsc#1099119]
- Pulls fix for forcing compile-time tuning even when building
with -march=z13 on s390x. [bsc#1099192]
- Fixes support for 32bit ASAN with glibc 2.27+
| Advisory ID | SUSE-RU-2019:44-1
|
| Released | Tue Jan 8 13:07:32 2019 |
| Summary | Recommended update for acl |
| Type | recommended |
| Severity | low |
| References | 953659 |
Description:
This update for acl fixes the following issues:
- test: Add helper library to fake passwd/group files.
- quote: Escape literal backslashes. (bsc#953659)
| Advisory ID | SUSE-SU-2019:571-1
|
| Released | Thu Mar 7 18:13:46 2019 |
| Summary | Security update for file |
| Type | security |
| Severity | moderate |
| References | 1096974,1096984,1126117,1126118,1126119,CVE-2018-10360,CVE-2019-8905,CVE-2019-8906,CVE-2019-8907 |
Description:
This update for file fixes the following issues:
The following security vulnerabilities were addressed:
- CVE-2018-10360: Fixed an out-of-bounds read in the function do_core_note in
readelf.c, which allowed remote attackers to cause a denial of service
(application crash) via a crafted ELF file (bsc#1096974)
- CVE-2019-8905: Fixed a stack-based buffer over-read in do_core_note in readelf.c
(bsc#1126118)
- CVE-2019-8906: Fixed an out-of-bounds read in do_core_note in readelf. c
(bsc#1126119)
- CVE-2019-8907: Fixed a stack corruption in do_core_note in readelf.c
(bsc#1126117)
| Advisory ID | SUSE-RU-2019:905-1
|
| Released | Mon Apr 8 16:48:02 2019 |
| Summary | Recommended update for gcc |
| Type | recommended |
| Severity | moderate |
| References | 1096008 |
Description:
This update for gcc fixes the following issues:
- Fix gcc-PIE spec to properly honor -no-pie at link time. (bsc#1096008)
| Advisory ID | SUSE-RU-2019:1105-1
|
| Released | Tue Apr 30 12:10:58 2019 |
| Summary | Recommended update for gcc7 |
| Type | recommended |
| Severity | moderate |
| References | 1084842,1114592,1124644,1128794,1129389,1131264,SLE-6738 |
Description:
This update for gcc7 fixes the following issues:
Update to gcc-7-branch head (r270528).
- Disables switch jump-tables when retpolines are used. This restores
some lost performance for kernel builds with retpolines. (bsc#1131264,
jsc#SLE-6738)
- Fix ICE compiling tensorflow on aarch64. (bsc#1129389)
- Fix for aarch64 FMA steering pass use-after-free. (bsc#1128794)
- Fix for s390x FP load-and-test issue. (bsc#1124644)
- Improve build reproducability by disabling address-space randomization
during build.
- Adjust gnat manual entries in the info directory. (bsc#1114592)
- Includes fix to no longer try linking -lieee with -mieee-fp. (bsc#1084842)
| Advisory ID | SUSE-SU-2019:1368-1
|
| Released | Tue May 28 13:15:38 2019 |
| Summary | Recommended update for sles12sp3-docker-image, sles12sp4-image, system-user-root |
| Type | security |
| Severity | important |
| References | 1134524,CVE-2019-5021 |
Description:
This update for sles12sp3-docker-image, sles12sp4-image, system-user-root fixes the following issues:
- CVE-2019-5021: Include an invalidated root password by default, not an empty one (bsc#1134524)
| Advisory ID | SUSE-SU-2019:2702-1
|
| Released | Wed Oct 16 18:41:30 2019 |
| Summary | Security update for gcc7 |
| Type | security |
| Severity | moderate |
| References | 1071995,1141897,1142649,1148517,1149145,CVE-2019-14250,CVE-2019-15847 |
Description:
This update for gcc7 to r275405 fixes the following issues:
Security issues fixed:
- CVE-2019-14250: Fixed an integer overflow in binutils (bsc#1142649).
- CVE-2019-15847: Fixed an optimization in the POWER9 backend of gcc that could reduce the entropy of the random number generator (bsc#1149145).
Non-security issue fixed:
- Move Live Patching technology stack from kGraft to upstream klp (bsc#1071995, fate#323487).
| Advisory ID | SUSE-SU-2019:2730-1
|
| Released | Mon Oct 21 16:04:57 2019 |
| Summary | Security update for procps |
| Type | security |
| Severity | important |
| References | 1092100,1121753,CVE-2018-1122,CVE-2018-1123,CVE-2018-1124,CVE-2018-1125,CVE-2018-1126 |
Description:
This update for procps fixes the following issues:
procps was updated to 3.3.15. (bsc#1092100)
Following security issues were fixed:
- CVE-2018-1122: Prevent local privilege escalation in top. If a user ran top
with HOME unset in an attacker-controlled directory, the attacker could have
achieved privilege escalation by exploiting one of several vulnerabilities in
the config_file() function (bsc#1092100).
- CVE-2018-1123: Prevent denial of service in ps via mmap buffer overflow.
Inbuilt protection in ps maped a guard page at the end of the overflowed
buffer, ensuring that the impact of this flaw is limited to a crash (temporary
denial of service) (bsc#1092100).
- CVE-2018-1124: Prevent multiple integer overflows leading to a heap
corruption in file2strvec function. This allowed a privilege escalation for a
local attacker who can create entries in procfs by starting processes, which
could result in crashes or arbitrary code execution in proc utilities run by
other users (bsc#1092100).
- CVE-2018-1125: Prevent stack buffer overflow in pgrep. This vulnerability was
mitigated by FORTIFY limiting the impact to a crash (bsc#1092100).
- CVE-2018-1126: Ensure correct integer size in proc/alloc.* to prevent
truncation/integer overflow issues (bsc#1092100).
Also this non-security issue was fixed:
- Fix CPU summary showing old data. (bsc#1121753)
The update to 3.3.15 contains the following fixes:
- library: Increment to 8:0:1
No removals, no new functions
Changes: slab and pid structures
- library: Just check for SIGLOST and don't delete it
- library: Fix integer overflow and LPE in file2strvec CVE-2018-1124
- library: Use size_t for alloc functions CVE-2018-1126
- library: Increase comm size to 64
- pgrep: Fix stack-based buffer overflow CVE-2018-1125
- pgrep: Remove >15 warning as comm can be longer
- ps: Fix buffer overflow in output buffer, causing DOS CVE-2018-1123
- ps: Increase command name selection field to 64
- top: Don't use cwd for location of config CVE-2018-1122
- update translations
- library: build on non-glibc systems
- free: fix scaling on 32-bit systems
- Revert 'Support running with child namespaces'
- library: Increment to 7:0:1
No changes, no removals
New fuctions: numa_init, numa_max_node, numa_node_of_cpu, numa_uninit, xalloc_err_handler
- doc: Document I idle state in ps.1 and top.1
- free: fix some of the SI multiples
- kill: -l space between name parses correctly
- library: dont use vm_min_free on non Linux
- library: don't strip off wchan prefixes (ps & top)
- pgrep: warn about 15+ char name only if -f not used
- pgrep/pkill: only match in same namespace by default
- pidof: specify separator between pids
- pkill: Return 0 only if we can kill process
- pmap: fix duplicate output line under '-x' option
- ps: avoid eip/esp address truncations
- ps: recognizes SCHED_DEADLINE as valid CPU scheduler
- ps: display NUMA node under which a thread ran
- ps: Add seconds display for cputime and time
- ps: Add LUID field
- sysctl: Permit empty string for value
- sysctl: Don't segv when file not available
- sysctl: Read and write large buffers
- top: add config file support for XDG specification
- top: eliminated minor libnuma memory leak
- top: show fewer memory decimal places (configurable)
- top: provide command line switch for memory scaling
- top: provide command line switch for CPU States
- top: provides more accurate cpu usage at startup
- top: display NUMA node under which a thread ran
- top: fix argument parsing quirk resulting in SEGV
- top: delay interval accepts non-locale radix point
- top: address a wishlist man page NLS suggestion
- top: fix potential distortion in 'Mem' graph display
- top: provide proper multi-byte string handling
- top: startup defaults are fully customizable
- watch: define HOST_NAME_MAX where not defined
- vmstat: Fix alignment for disk partition format
- watch: Support ANSI 39,49 reset sequences
| Advisory ID | SUSE-SU-2019:2779-1
|
| Released | Thu Oct 24 16:57:42 2019 |
| Summary | Security update for binutils |
| Type | security |
| Severity | moderate |
| References | 1109412,1109413,1109414,1111996,1112534,1112535,1113247,1113252,1113255,1116827,1118644,1118830,1118831,1120640,1121034,1121035,1121056,1133131,1133232,1141913,1142772,1152590,1154016,1154025,CVE-2018-1000876,CVE-2018-17358,CVE-2018-17359,CVE-2018-17360,CVE-2018-17985,CVE-2018-18309,CVE-2018-18483,CVE-2018-18484,CVE-2018-18605,CVE-2018-18606,CVE-2018-18607,CVE-2018-19931,CVE-2018-19932,CVE-2018-20623,CVE-2018-20651,CVE-2018-20671,CVE-2018-6323,CVE-2018-6543,CVE-2018-6759,CVE-2018-6872,CVE-2018-7208,CVE-2018-7568,CVE-2018-7569,CVE-2018-7570,CVE-2018-7642,CVE-2018-7643,CVE-2018-8945,CVE-2019-1010180,ECO-368,SLE-6206 |
Description:
This update for binutils fixes the following issues:
binutils was updated to current 2.32 branch [jsc#ECO-368].
Includes following security fixes:
- CVE-2018-17358: Fixed invalid memory access in _bfd_stab_section_find_nearest_line in syms.c (bsc#1109412)
- CVE-2018-17359: Fixed invalid memory access exists in bfd_zalloc in opncls.c (bsc#1109413)
- CVE-2018-17360: Fixed heap-based buffer over-read in bfd_getl32 in libbfd.c (bsc#1109414)
- CVE-2018-17985: Fixed a stack consumption problem caused by the cplus_demangle_type (bsc#1116827)
- CVE-2018-18309: Fixed an invalid memory address dereference was discovered in read_reloc in reloc.c (bsc#1111996)
- CVE-2018-18483: Fixed get_count function provided by libiberty that allowed attackers to cause a denial of service or other unspecified impact (bsc#1112535)
- CVE-2018-18484: Fixed stack exhaustion in the C++ demangling functions provided by libiberty, caused by recursive stack frames (bsc#1112534)
- CVE-2018-18605: Fixed a heap-based buffer over-read issue was discovered in the function sec_merge_hash_lookup causing a denial of service (bsc#1113255)
- CVE-2018-18606: Fixed a NULL pointer dereference in _bfd_add_merge_section when attempting to merge sections with large alignments, causing denial of service (bsc#1113252)
- CVE-2018-18607: Fixed a NULL pointer dereference in elf_link_input_bfd when used for finding STT_TLS symbols without any TLS section, causing denial of service (bsc#1113247)
- CVE-2018-19931: Fixed a heap-based buffer overflow in bfd_elf32_swap_phdr_in in elfcode.h (bsc#1118831)
- CVE-2018-19932: Fixed an integer overflow and infinite loop caused by the IS_CONTAINED_BY_LMA (bsc#1118830)
- CVE-2018-20623: Fixed a use-after-free in the error function in elfcomm.c (bsc#1121035)
- CVE-2018-20651: Fixed a denial of service via a NULL pointer dereference in elf_link_add_object_symbols in elflink.c (bsc#1121034)
- CVE-2018-20671: Fixed an integer overflow that can trigger a heap-based buffer overflow in load_specific_debug_section in objdump.c (bsc#1121056)
- CVE-2018-1000876: Fixed integer overflow in bfd_get_dynamic_reloc_upper_bound,bfd_canonicalize_dynamic_reloc in objdump (bsc#1120640)
- CVE-2019-1010180: Fixed an out of bound memory access that could lead to crashes (bsc#1142772)
- enable xtensa architecture (Tensilica lc6 and related)
- Use -ffat-lto-objects in order to provide assembly for static libs
(bsc#1141913).
- Fixed some LTO build issues (bsc#1133131 bsc#1133232).
- riscv: Don't check ABI flags if no code section
- Fixed a segfault in ld when building some versions of pacemaker (bsc#1154025, bsc#1154016).
- Add avr, epiphany and rx to target_list so that the common binutils can handle all objects we can create with crosses (bsc#1152590).
Update to binutils 2.32:
- The binutils now support for the C-SKY processor series.
- The x86 assembler now supports a -mvexwig=[0|1] option to control
encoding of VEX.W-ignored (WIG) VEX instructions.
It also has a new -mx86-used-note=[yes|no] option to generate (or
not) x86 GNU property notes.
- The MIPS assembler now supports the Loongson EXTensions R2 (EXT2),
the Loongson EXTensions (EXT) instructions, the Loongson Content
Address Memory (CAM) ASE and the Loongson MultiMedia extensions
Instructions (MMI) ASE.
- The addr2line, c++filt, nm and objdump tools now have a default
limit on the maximum amount of recursion that is allowed whilst
demangling strings. This limit can be disabled if necessary.
- Objdump's --disassemble option can now take a parameter,
specifying the starting symbol for disassembly. Disassembly will
continue from this symbol up to the next symbol or the end of the
function.
- The BFD linker will now report property change in linker map file
when merging GNU properties.
- The BFD linker's -t option now doesn't report members within
archives, unless -t is given twice. This makes it more useful
when generating a list of files that should be packaged for a
linker bug report.
- The GOLD linker has improved warning messages for relocations that
refer to discarded sections.
- Improve relro support on s390 [fate#326356]
- Fix broken debug symbols (bsc#1118644)
- Handle ELF compressed header alignment correctly.
| Advisory ID | SUSE-SU-2019:2997-1
|
| Released | Mon Nov 18 15:16:38 2019 |
| Summary | Security update for ncurses |
| Type | security |
| Severity | moderate |
| References | 1103320,1154036,1154037,CVE-2019-17594,CVE-2019-17595 |
Description:
This update for ncurses fixes the following issues:
Security issues fixed:
- CVE-2019-17594: Fixed a heap-based buffer over-read in the _nc_find_entry function (bsc#1154036).
- CVE-2019-17595: Fixed a heap-based buffer over-read in the fmt_entry function (bsc#1154037).
Non-security issue fixed:
- Removed screen.xterm from terminfo database (bsc#1103320).
| Advisory ID | SUSE-SU-2019:3061-1
|
| Released | Mon Nov 25 17:34:22 2019 |
| Summary | Security update for gcc9 |
| Type | security |
| Severity | moderate |
| References | 1114592,1135254,1141897,1142649,1142654,1148517,1149145,CVE-2019-14250,CVE-2019-15847,SLE-6533,SLE-6536 |
Description:
This update includes the GNU Compiler Collection 9.
A full changelog is provided by the GCC team on:
https://www.gnu.org/software/gcc/gcc-9/changes.html
The base system compiler libraries libgcc_s1, libstdc++6 and others are
now built by the gcc 9 packages.
To use it, install 'gcc9' or 'gcc9-c++' or other compiler brands and use CC=gcc-9 /
CXX=g++-9 during configuration for using it.
Security issues fixed:
- CVE-2019-15847: Fixed a miscompilation in the POWER9 back end, that optimized multiple calls of the __builtin_darn intrinsic into a single call. (bsc#1149145)
- CVE-2019-14250: Fixed a heap overflow in the LTO linker. (bsc#1142649)
Non-security issues fixed:
- Split out libstdc++ pretty-printers into a separate package supplementing gdb and the installed runtime. (bsc#1135254)
- Fixed miscompilation for vector shift on s390. (bsc#1141897)
| Advisory ID | SUSE-SU-2019:3086-1
|
| Released | Thu Nov 28 10:02:24 2019 |
| Summary | Security update for libidn2 |
| Type | security |
| Severity | moderate |
| References | 1154884,1154887,CVE-2019-12290,CVE-2019-18224 |
Description:
This update for libidn2 to version 2.2.0 fixes the following issues:
- CVE-2019-12290: Fixed an improper round-trip check when converting A-labels to U-labels (bsc#1154884).
- CVE-2019-18224: Fixed a heap-based buffer overflow that was caused by long domain strings (bsc#1154887).
| Advisory ID | SUSE-RU-2020:10-1
|
| Released | Thu Jan 2 12:35:06 2020 |
| Summary | Recommended update for gcc7 |
| Type | recommended |
| Severity | moderate |
| References | 1146475 |
Description:
This update for gcc7 fixes the following issues:
- Fix miscompilation with thread-safe localstatic initialization (gcc#85887).
- Fix debug info created for array definitions that complete an earlier declaration (bsc#1146475).
| Advisory ID | SUSE-RU-2020:225-1
|
| Released | Fri Jan 24 06:49:07 2020 |
| Summary | Recommended update for procps |
| Type | recommended |
| Severity | moderate |
| References | 1158830 |
Description:
This update for procps fixes the following issues:
- Fix for 'ps -C' allowing to accept any arguments longer than 15 characters anymore. (bsc#1158830)
| Advisory ID | SUSE-RU-2020:395-1
|
| Released | Tue Feb 18 14:16:48 2020 |
| Summary | Recommended update for gcc7 |
| Type | recommended |
| Severity | moderate |
| References | 1160086 |
Description:
This update for gcc7 fixes the following issue:
- Fixed a miscompilation in zSeries code (bsc#1160086)
| Advisory ID | SUSE-RU-2020:453-1
|
| Released | Tue Feb 25 10:51:53 2020 |
| Summary | Recommended update for binutils |
| Type | recommended |
| Severity | moderate |
| References | 1160590 |
Description:
This update for binutils fixes the following issues:
- Recognize the official name of s390 arch13: 'z15'. (bsc#1160590, jsc#SLE-7903 aka jsc#SLE-7464)
| Advisory ID | SUSE-SU-2020:948-1
|
| Released | Wed Apr 8 07:44:21 2020 |
| Summary | Security update for gmp, gnutls, libnettle |
| Type | security |
| Severity | moderate |
| References | 1152692,1155327,1166881,1168345,CVE-2020-11501 |
Description:
This update for gmp, gnutls, libnettle fixes the following issues:
Security issue fixed:
- CVE-2020-11501: Fixed zero random value in DTLS client hello (bsc#1168345)
FIPS related bugfixes:
- FIPS: Install checksums for binary integrity verification which are
required when running in FIPS mode (bsc#1152692, jsc#SLE-9518)
- FIPS: Fixed a cfb8 decryption issue, no longer truncate output IV if
input is shorter than block size. (bsc#1166881)
- FIPS: Added Diffie Hellman public key verification test. (bsc#1155327)
| Advisory ID | SUSE-RU-2020:1226-1
|
| Released | Fri May 8 10:51:05 2020 |
| Summary | Recommended update for gcc9 |
| Type | recommended |
| Severity | moderate |
| References | 1149995,1152590,1167898 |
Description:
This update for gcc9 fixes the following issues:
This update ships the GCC 9.3 release.
- Includes a fix for Internal compiler error when building HepMC (bsc#1167898)
- Includes fix for binutils version parsing
- Add libstdc++6-pp provides and conflicts to avoid file conflicts
with same minor version of libstdc++6-pp from gcc10.
- Add gcc9 autodetect -g at lto link (bsc#1149995)
- Install go tool buildid for bootstrapping go
| Advisory ID | SUSE-SU-2020:1294-1
|
| Released | Mon May 18 07:38:36 2020 |
| Summary | Security update for file |
| Type | security |
| Severity | moderate |
| References | 1154661,1169512,CVE-2019-18218 |
Description:
This update for file fixes the following issues:
Security issues fixed:
- CVE-2019-18218: Fixed a heap-based buffer overflow in cdf_read_property_info() (bsc#1154661).
Non-security issue fixed:
- Fixed broken '--help' output (bsc#1169512).
| Advisory ID | SUSE-RU-2020:1906-1
|
| Released | Tue Jul 14 15:58:16 2020 |
| Summary | Recommended update for lifecycle-data-sle-module-development-tools |
| Type | recommended |
| Severity | moderate |
| References | 1173407 |
Description:
This update for lifecycle-data-sle-module-development-tools fixes the following issue:
- Ensure package is installed with its corresponding module when lifecycle package is installed. (bsc#1173407)
| Advisory ID | SUSE-SU-2020:2947-1
|
| Released | Fri Oct 16 15:23:07 2020 |
| Summary | Security update for gcc10, nvptx-tools |
| Type | security |
| Severity | moderate |
| References | 1172798,1172846,1173972,1174753,1174817,1175168,CVE-2020-13844 |
Description:
This update for gcc10, nvptx-tools fixes the following issues:
This update provides the GCC10 compiler suite and runtime libraries.
The base SUSE Linux Enterprise libraries libgcc_s1, libstdc++6 are replaced by
the gcc10 variants.
The new compiler variants are available with '-10' suffix, you can specify them
via:
CC=gcc-10
CXX=g++-10
or similar commands.
For a detailed changelog check out https://gcc.gnu.org/gcc-10/changes.html
Changes in nvptx-tools:
| Advisory ID | SUSE-RU-2020:2958-1
|
| Released | Tue Oct 20 12:24:55 2020 |
| Summary | Recommended update for procps |
| Type | recommended |
| Severity | moderate |
| References | 1158830 |
Description:
This update for procps fixes the following issues:
- Fixes an issue when command 'ps -C' does not allow anymore an argument longer than 15 characters. (bsc#1158830)
| Advisory ID | SUSE-RU-2020:2983-1
|
| Released | Wed Oct 21 15:03:03 2020 |
| Summary | Recommended update for file |
| Type | recommended |
| Severity | moderate |
| References | 1176123 |
Description:
This update for file fixes the following issues:
- Fixes an issue when file displays broken 'ELF' interpreter. (bsc#1176123)
| Advisory ID | SUSE-SU-2020:3060-1
|
| Released | Wed Oct 28 08:09:21 2020 |
| Summary | Security update for binutils |
| Type | security |
| Severity | moderate |
| References | 1126826,1126829,1126831,1140126,1142649,1143609,1153768,1153770,1157755,1160254,1160590,1163333,1163744,CVE-2019-12972,CVE-2019-14250,CVE-2019-14444,CVE-2019-17450,CVE-2019-17451,CVE-2019-9074,CVE-2019-9075,CVE-2019-9077 |
Description:
This update for binutils fixes the following issues:
binutils was updated to version 2.35. (jsc#ECO-2373)
Update to binutils 2.35:
- The assembler can now produce DWARF-5 format line number tables.
- Readelf now has a 'lint' mode to enable extra checks of the files it is processing.
- Readelf will now display '[...]' when it has to truncate a symbol name.
The old behaviour - of displaying as many characters as possible, up to
the 80 column limit - can be restored by the use of the --silent-truncation
option.
- The linker can now produce a dependency file listing the inputs that it
has processed, much like the -M -MP option supported by the compiler.
- fix DT_NEEDED order with -flto [bsc#1163744]
Update to binutils 2.34:
- The disassembler (objdump --disassemble) now has an option to
generate ascii art thats show the arcs between that start and end
points of control flow instructions.
- The binutils tools now have support for debuginfod. Debuginfod is a
HTTP service for distributing ELF/DWARF debugging information as
well as source code. The tools can now connect to debuginfod
servers in order to download debug information about the files that
they are processing.
- The assembler and linker now support the generation of ELF format
files for the Z80 architecture.
- Add new subpackages for libctf and libctf-nobfd.
- Disable LTO due to bsc#1163333.
- Includes fixes for these CVEs:
bsc#1153768 aka CVE-2019-17451 aka PR25070
bsc#1153770 aka CVE-2019-17450 aka PR25078
- fix various build fails on aarch64 (PR25210, bsc#1157755).
Update to binutils 2.33.1:
- Adds support for the Arm Scalable Vector Extension version 2
(SVE2) instructions, the Arm Transactional Memory Extension (TME)
instructions and the Armv8.1-M Mainline and M-profile Vector
Extension (MVE) instructions.
- Adds support for the Arm Cortex-A76AE, Cortex-A77 and Cortex-M35P
processors and the AArch64 Cortex-A34, Cortex-A65, Cortex-A65AE,
Cortex-A76AE, and Cortex-A77 processors.
- Adds a .float16 directive for both Arm and AArch64 to allow
encoding of 16-bit floating point literals.
- For MIPS, Add -m[no-]fix-loongson3-llsc option to fix (or not)
Loongson3 LLSC Errata. Add a --enable-mips-fix-loongson3-llsc=[yes|no]
configure time option to set the default behavior. Set the default
if the configure option is not used to 'no'.
- The Cortex-A53 Erratum 843419 workaround now supports a choice of
which workaround to use. The option --fix-cortex-a53-843419 now
takes an optional argument --fix-cortex-a53-843419[=full|adr|adrp]
which can be used to force a particular workaround to be used.
See --help for AArch64 for more details.
- Add support for GNU_PROPERTY_AARCH64_FEATURE_1_BTI and
GNU_PROPERTY_AARCH64_FEATURE_1_PAC in ELF GNU program properties
in the AArch64 ELF linker.
- Add -z force-bti for AArch64 to enable GNU_PROPERTY_AARCH64_FEATURE_1_BTI
on output while warning about missing GNU_PROPERTY_AARCH64_FEATURE_1_BTI
on inputs and use PLTs protected with BTI.
- Add -z pac-plt for AArch64 to pick PAC enabled PLTs.
- Add --source-comment[=] option to objdump which if present,
provides a prefix to source code lines displayed in a disassembly.
- Add --set-section-alignment =
option to objcopy to allow the changing of section alignments.
- Add --verilog-data-width option to objcopy for verilog targets to
control width of data elements in verilog hex format.
- The separate debug info file options of readelf (--debug-dump=links
and --debug-dump=follow) and objdump (--dwarf=links and
--dwarf=follow-links) will now display and/or follow multiple
links if more than one are present in a file. (This usually
happens when gcc's -gsplit-dwarf option is used).
In addition objdump's --dwarf=follow-links now also affects its
other display options, so that for example, when combined with
--syms it will cause the symbol tables in any linked debug info
files to also be displayed. In addition when combined with
--disassemble the --dwarf= follow-links option will ensure that
any symbol tables in the linked files are read and used when
disassembling code in the main file.
- Add support for dumping types encoded in the Compact Type Format
to objdump and readelf.
- Includes fixes for these CVEs:
bsc#1126826 aka CVE-2019-9077 aka PR1126826
bsc#1126829 aka CVE-2019-9075 aka PR1126829
bsc#1126831 aka CVE-2019-9074 aka PR24235
bsc#1140126 aka CVE-2019-12972 aka PR23405
bsc#1143609 aka CVE-2019-14444 aka PR24829
bsc#1142649 aka CVE-2019-14250 aka PR90924
- Add xBPF target
- Fix various problems with DWARF 5 support in gas
- fix nm -B for objects compiled with -flto and -fcommon.
| Advisory ID | SUSE-RU-2020:3603-1
|
| Released | Wed Dec 2 15:11:46 2020 |
| Summary | Recommended update for lifecycle-data-sle-module-development-tools |
| Type | recommended |
| Severity | moderate |
| References | |
Description:
This update for lifecycle-data-sle-module-development-tools fixes the following issues:
- Added expiration data for the GCC 9 yearly update for the Toolchain/Development modules.
(jsc#ECO-2373, jsc#SLE-10950, jsc#SLE-10951)
| Advisory ID | SUSE-RU-2020:3640-1
|
| Released | Mon Dec 7 13:24:41 2020 |
| Summary | Recommended update for binutils |
| Type | recommended |
| Severity | important |
| References | 1179036,1179341 |
Description:
This update for binutils fixes the following issues:
Update binutils 2.35 branch to commit 1c5243df:
- Fixes PR26520, aka [bsc#1179036], a problem in addr2line with
certain DWARF variable descriptions.
- Also fixes PR26711, PR26656, PR26655, PR26929, PR26808, PR25878,
PR26740, PR26778, PR26763, PR26685, PR26699, PR26902, PR26869,
PR26711
- The above includes fixes for dwo files produced by modern dwp,
fixing several problems in the DWARF reader.
Update binutils to 2.35.1 and rebased branch diff:
- This is a point release over the previous 2.35 version, containing bug
fixes, and as an exception to the usual rule, one new feature. The
new feature is the support for a new directive in the assembler:
'.nop'. This directive creates a single no-op instruction in whatever
encoding is correct for the target architecture. Unlike the .space or
.fill this is a real instruction, and it does affect the generation of
DWARF line number tables, should they be enabled. This fixes an
incompatibility introduced in the latest update that broke the install
scripts of the Oracle server. [bsc#1179341]
| Advisory ID | SUSE-SU-2020:3749-1
|
| Released | Thu Dec 10 14:39:28 2020 |
| Summary | Security update for gcc7 |
| Type | security |
| Severity | moderate |
| References | 1150164,1161913,1167939,1172798,1178577,1178614,1178624,1178675,CVE-2020-13844 |
Description:
This update for gcc7 fixes the following issues:
- CVE-2020-13844: Added mitigation for aarch64 Straight Line Speculation issue (bsc#1172798)
- Enable fortran for the nvptx offload compiler.
- Update README.First-for.SuSE.packagers
- avoid assembler errors with AVX512 gather and scatter instructions when using -masm=intel.
- Backport the aarch64 -moutline-atomics feature and accumulated fixes but not its
default enabling. [jsc#SLE-12209, bsc#1167939]
- Fixed 32bit libgnat.so link. [bsc#1178675]
- Fixed memcpy miscompilation on aarch64. [bsc#1178624, bsc#1178577]
- Fixed debug line info for try/catch. [bsc#1178614]
- Remove -mbranch-protection=standard (aarch64 flag) when gcc7 is used to build gcc7 (ie when ada is enabled)
- Fixed corruption of pass private ->aux via DF. [gcc#94148]
- Fixed debug information issue with inlined functions and passed by reference arguments. [gcc#93888]
- Fixed binutils release date detection issue.
- Fixed register allocation issue with exception handling code on s390x. [bsc#1161913]
- Fixed miscompilation of some atomic code on aarch64. [bsc#1150164]
| Advisory ID | SUSE-RU-2020:3942-1
|
| Released | Tue Dec 29 12:22:01 2020 |
| Summary | Recommended update for libidn2 |
| Type | recommended |
| Severity | moderate |
| References | 1180138 |
Description:
This update for libidn2 fixes the following issues:
- The library is actually dual licensed, GPL-2.0-or-later or LGPL-3.0-or-later,
adjusted the RPM license tags (bsc#1180138)
| Advisory ID | SUSE-RU-2021:79-1
|
| Released | Tue Jan 12 10:49:34 2021 |
| Summary | Recommended update for gcc7 |
| Type | recommended |
| Severity | moderate |
| References | 1167939 |
Description:
This update for gcc7 fixes the following issues:
- Amend the gcc7 aarch64 atomics for glibc namespace violation with getauxval. [bsc#1167939]
| Advisory ID | SUSE-RU-2021:220-1
|
| Released | Tue Jan 26 14:00:51 2021 |
| Summary | Recommended update for keyutils |
| Type | recommended |
| Severity | moderate |
| References | 1180603 |
Description:
This update for keyutils fixes the following issues:
- Adjust the library license to be LPGL-2.1+ only (the tools are GPL2+, the library is just LGPL-2.1+) (bsc#1180603)
| Advisory ID | SUSE-RU-2021:293-1
|
| Released | Wed Feb 3 12:52:34 2021 |
| Summary | Recommended update for gmp |
| Type | recommended |
| Severity | moderate |
| References | 1180603 |
Description:
This update for gmp fixes the following issues:
- correct license statements of packages (library itself is no GPL-3.0) (bsc#1180603)
| Advisory ID | SUSE-RU-2021:596-1
|
| Released | Thu Feb 25 10:26:30 2021 |
| Summary | Recommended update for gcc7 |
| Type | recommended |
| Severity | moderate |
| References | 1181618 |
Description:
This update for gcc7 fixes the following issues:
- Fixed webkit2gtk3 build (bsc#1181618)
- Change GCC exception licenses to SPDX format
- Remove include-fixed/pthread.h
| Advisory ID | SUSE-RU-2021:924-1
|
| Released | Tue Mar 23 10:00:49 2021 |
| Summary | Recommended update for filesystem |
| Type | recommended |
| Severity | moderate |
| References | 1078466,1146705,1175519,1178775,1180020,1180083,1180596,1181011,1181831,1183094 |
Description:
This update for filesystem the following issues:
- Remove duplicate line due to merge error
- Add fix for 'mesa' creating cache with perm 0700. (bsc#1181011)
- Fixed an issue causing failure during installation/upgrade a failure. (rh#1548403) (bsc#1146705)
- Allows to override config to add cleanup options of '/var/tmp'. (bsc#1078466)
- Create config to cleanup '/tmp' regular required with 'tmpfs'. (bsc#1175519)
This update for systemd fixes the following issues:
- Fix for a possible memory leak. (bsc#1180020)
- Fix for a case when to a bind mounted directory results inactive mount units. (#7811) (bsc#1180596)
- Fixed an issue when starting a container conflicts with another one. (bsc#1178775)
- Drop most of the tmpfiles that deal with generic paths and avoid warnings. (bsc#1078466, bsc#1181831)
- Don't use shell redirections when calling a rpm macro. (bsc#1183094)
- 'systemd' requires 'aaa_base' >= 13.2. (bsc#1180083)
| Advisory ID | SUSE-RU-2021:1169-1
|
| Released | Tue Apr 13 15:01:42 2021 |
| Summary | Recommended update for procps |
| Type | recommended |
| Severity | low |
| References | 1181976 |
Description:
This update for procps fixes the following issues:
- Corrected a statement in the man page about processor pinning via taskset (bsc#1181976)
| Advisory ID | SUSE-RU-2021:1291-1
|
| Released | Wed Apr 21 14:04:06 2021 |
| Summary | Recommended update for mpfr |
| Type | recommended |
| Severity | moderate |
| References | 1141190 |
Description:
This update for mpfr fixes the following issues:
- Fixed an issue when building for ppc64le (bsc#1141190)
Technical library fixes:
- A subtraction of two numbers of the same sign or addition of two numbers of different signs
can be rounded incorrectly (and the ternary value can be incorrect) when one of the two
inputs is reused as the output (destination) and all these MPFR numbers have exactly
GMP_NUMB_BITS bits of precision (typically, 32 bits on 32-bit machines, 64 bits on 64-bit
machines).
- The mpfr_fma and mpfr_fms functions can behave incorrectly in case of internal overflow or
underflow.
- The result of the mpfr_sqr function can be rounded incorrectly in a rare case near underflow
when the destination has exactly GMP_NUMB_BITS bits of precision (typically, 32 bits on
32-bit machines, 64 bits on 64-bit machines) and the input has at most GMP_NUMB_BITS bits
of precision.
- The behavior and documentation of the mpfr_get_str function are inconsistent concerning the
minimum precision (this is related to the change of the minimum precision from 2 to 1 in
MPFR 4.0.0). The get_str patch fixes this issue in the following way: the value 1 can now be
provided for n (4th argument of mpfr_get_str); if n = 0, then the number of significant digits
in the output string can now be 1, as already implied by the documentation (but the code was
increasing it to 2).
- The mpfr_cmp_q function can behave incorrectly when the rational (mpq_t) number has a null
denominator.
- The mpfr_inp_str and mpfr_out_str functions might behave incorrectly when the stream is a
null pointer: the stream is replaced by stdin and stdout, respectively. This behavior is
useless, not documented (thus incorrect in case a null pointer would have a special meaning),
and not consistent with other input/output functions.
| Advisory ID | SUSE-RU-2021:1549-1
|
| Released | Mon May 10 13:48:00 2021 |
| Summary | Recommended update for procps |
| Type | recommended |
| Severity | moderate |
| References | 1185417 |
Description:
This update for procps fixes the following issues:
- Support up to 2048 CPU as well. (bsc#1185417)
| Advisory ID | SUSE-RU-2021:1861-1
|
| Released | Fri Jun 4 09:59:40 2021 |
| Summary | Recommended update for gcc10 |
| Type | recommended |
| Severity | moderate |
| References | 1029961,1106014,1178577,1178624,1178675,1182016 |
Description:
This update for gcc10 fixes the following issues:
- Disable nvptx offloading for aarch64 again since it doesn't work
- Fixed a build failure issue. (bsc#1182016)
- Fix for memory miscompilation on 'aarch64'. (bsc#1178624, bsc#1178577)
- Fix 32bit 'libgnat.so' link. (bsc#1178675)
- prepare usrmerge: Install libgcc_s into %_libdir. ABI wise it stays /%lib. (bsc#1029961)
- Build complete set of multilibs for arm-none target. (bsc#1106014)
| Advisory ID | SUSE-RU-2021:1926-1
|
| Released | Thu Jun 10 08:38:14 2021 |
| Summary | Recommended update for gcc |
| Type | recommended |
| Severity | moderate |
| References | 1096677 |
Description:
This update for gcc fixes the following issues:
- Added gccgo symlink and go and gofmt as alternatives to support parallel installation
of golang (bsc#1096677)
| Advisory ID | SUSE-RU-2021:2245-1
|
| Released | Mon Jul 5 12:14:52 2021 |
| Summary | Recommended update for lifecycle-data-sle-module-development-tools |
| Type | recommended |
| Severity | moderate |
| References | |
Description:
This update for lifecycle-data-sle-module-development-tools fixes the following issues:
- mark go1.14 as 'end of life' as go1.16 was released and we only support 2 go versions parallel (jsc#ECO-1484)
| Advisory ID | SUSE-RU-2021:2993-1
|
| Released | Thu Sep 9 14:31:33 2021 |
| Summary | Recommended update for gcc |
| Type | recommended |
| Severity | moderate |
| References | 1185348 |
Description:
This update for gcc fixes the following issues:
- With gcc-PIE add -pie even when -fPIC is specified but we are
not linking a shared library. [bsc#1185348]
- Fix postun of gcc-go alternative.
| Advisory ID | SUSE-RU-2021:3182-1
|
| Released | Tue Sep 21 17:04:26 2021 |
| Summary | Recommended update for file |
| Type | recommended |
| Severity | moderate |
| References | 1189996 |
Description:
This update for file fixes the following issues:
- Fixes exception thrown by memory allocation problem (bsc#1189996)
| Advisory ID | SUSE-SU-2021:3490-1
|
| Released | Wed Oct 20 16:31:55 2021 |
| Summary | Security update for ncurses |
| Type | security |
| Severity | moderate |
| References | 1190793,CVE-2021-39537 |
Description:
This update for ncurses fixes the following issues:
- CVE-2021-39537: Fixed an heap-based buffer overflow in _nc_captoinfo. (bsc#1190793)
| Advisory ID | SUSE-SU-2021:3616-1
|
| Released | Thu Nov 4 12:29:16 2021 |
| Summary | Security update for binutils |
| Type | security |
| Severity | moderate |
| References | 1179898,1179899,1179900,1179901,1179902,1179903,1180451,1180454,1180461,1181452,1182252,1183511,1184620,1184794,CVE-2020-16590,CVE-2020-16591,CVE-2020-16592,CVE-2020-16593,CVE-2020-16598,CVE-2020-16599,CVE-2020-35448,CVE-2020-35493,CVE-2020-35496,CVE-2020-35507,CVE-2021-20197,CVE-2021-20284,CVE-2021-3487 |
Description:
This update for binutils fixes the following issues:
Update to binutils 2.37:
- The GNU Binutils sources now requires a C99 compiler and library to
build.
- Support for Realm Management Extension (RME) for AArch64 has been
added.
- A new linker option '-z report-relative-reloc' for x86 ELF targets
has been added to report dynamic relative relocations.
- A new linker option '-z start-stop-gc' has been added to disable
special treatment of __start_*/__stop_* references when
--gc-sections.
- A new linker options '-Bno-symbolic' has been added which will
cancel the '-Bsymbolic' and '-Bsymbolic-functions' options.
- The readelf tool has a new command line option which can be used to
specify how the numeric values of symbols are reported.
--sym-base=0|8|10|16 tells readelf to display the values in base 8,
base 10 or base 16. A sym base of 0 represents the default action
of displaying values under 10000 in base 10 and values above that in
base 16.
- A new format has been added to the nm program. Specifying
'--format=just-symbols' (or just using -j) will tell the program to
only display symbol names and nothing else.
- A new command line option '--keep-section-symbols' has been added to
objcopy and strip. This stops the removal of unused section symbols
when the file is copied. Removing these symbols saves space, but
sometimes they are needed by other tools.
- The '--weaken', '--weaken-symbol' and '--weaken-symbols' options
supported by objcopy now make undefined symbols weak on targets that
support weak symbols.
- Readelf and objdump can now display and use the contents of .debug_sup
sections.
- Readelf and objdump will now follow links to separate debug info
files by default. This behaviour can be stopped via the use of the
new '-wN' or '--debug-dump=no-follow-links' options for readelf and
the '-WN' or '--dwarf=no-follow-links' options for objdump. Also
the old behaviour can be restored by the use of the
'--enable-follow-debug-links=no' configure time option.
The semantics of the =follow-links option have also been slightly
changed. When enabled, the option allows for the loading of symbol
tables and string tables from the separate files which can be used
to enhance the information displayed when dumping other sections,
but it does not automatically imply that information from the
separate files should be displayed.
If other debug section display options are also enabled (eg
'--debug-dump=info') then the contents of matching sections in both
the main file and the separate debuginfo file *will* be displayed.
This is because in most cases the debug section will only be present
in one of the files.
If however non-debug section display options are enabled (eg
'--sections') then the contents of matching parts of the separate
debuginfo file will *not* be displayed. This is because in most
cases the user probably only wanted to load the symbol information
from the separate debuginfo file. In order to change this behaviour
a new command line option --process-links can be used. This will
allow di0pslay options to applied to both the main file and any
separate debuginfo files.
- Nm has a new command line option: '--quiet'. This suppresses 'no
symbols' diagnostic.
Update to binutils 2.36:
New features in the Assembler:
* When setting the link order attribute of ELF sections, it is now
possible to use a numeric section index instead of symbol name.
* Added a .nop directive to generate a single no-op instruction in
a target neutral manner. This instruction does have an effect on
DWARF line number generation, if that is active.
* Removed --reduce-memory-overheads and --hash-size as gas now
uses hash tables that can be expand and shrink automatically.
* Add support for AVX VNNI, HRESET, UINTR, TDX, AMX and Key
Locker instructions.
* Support non-absolute segment values for lcall and ljmp.
* Add {disp16} pseudo prefix to x86 assembler.
* Configure with --enable-x86-used-note by default for Linux/x86.
* Add support for Cortex-A78, Cortex-A78AE and Cortex-X1,
Cortex-R82, Neoverse V1, and Neoverse N2 cores.
* Add support for ETMv4 (Embedded Trace Macrocell), ETE (Embedded
Trace Extension), TRBE (Trace Buffer Extension), CSRE (Call
Stack Recorder Extension) and BRBE (Branch Record Buffer
Extension) system registers.
* Add support for Armv8-R and Armv8.7-A ISA extensions.
* Add support for DSB memory nXS barrier, WFET and WFIT
instruction for Armv8.7.
* Add support for +csre feature for -march. Add CSR PDEC
instruction for CSRE feature in AArch64.
* Add support for +flagm feature for -march in Armv8.4 AArch64.
* Add support for +ls64 feature for -march in Armv8.7
AArch64. Add atomic 64-byte load/store instructions for this
feature.
* Add support for +pauth (Pointer Authentication) feature for
-march in AArch64.
New features in the Linker:
* Add --error-handling-script= command line option to allow
a helper script to be invoked when an undefined symbol or a
missing library is encountered. This option can be suppressed
via the configure time switch: --enable-error-handling-script=no.
* Add -z x86-64-{baseline|v[234]} to the x86 ELF linker to mark
x86-64-{baseline|v[234]} ISA level as needed.
* Add -z unique-symbol to avoid duplicated local symbol names.
* The creation of PE format DLLs now defaults to using a more
secure set of DLL characteristics.
* The linker now deduplicates the types in .ctf sections. The new
command-line option --ctf-share-types describes how to do this:
its default value, share-unconflicted, produces the most compact
output.
* The linker now omits the 'variable section' from .ctf sections
by default, saving space. This is almost certainly what you
want unless you are working on a project that has its own
analogue of symbol tables that are not reflected in the ELF
symtabs.
New features in other binary tools:
* The ar tool's previously unused l modifier is now used for
specifying dependencies of a static library. The arguments of
this option (or --record-libdeps long form option) will be
stored verbatim in the __.LIBDEP member of the archive, which
the linker may read at link time.
* Readelf can now display the contents of LTO symbol table
sections when asked to do so via the --lto-syms command line
option.
* Readelf now accepts the -C command line option to enable the
demangling of symbol names. In addition the --demangle=