SUSE Container Update Advisory: 
-----------------------------------------------------------------
Container Advisory ID : SUSE-CU-2024:296-1
Container Tags        : suse/sle-micro-rancher/5.2:latest
Container Release     : 7.5.270
Severity              : important
Type                  : security
References            : 1179610 1215237 1215375 1217000 1217250 1217709 1217946 1217947
                        1218105 1218253 1218258 1218475 1218559 CVE-2020-26555 CVE-2023-51779
                        CVE-2023-6121 CVE-2023-6606 CVE-2023-6610 CVE-2023-6931 CVE-2023-6932
                        CVE-2024-22365 
-----------------------------------------------------------------

The container  was updated. The following patches have been included in this update:

-----------------------------------------------------------------
Advisory ID: SUSE-SU-2024:136-1
Released:    Thu Jan 18 09:53:47 2024
Summary:     Security update for pam
Type:        security
Severity:    moderate
References:  1217000,1218475,CVE-2024-22365
This update for pam fixes the following issues:

- CVE-2024-22365: Fixed a local denial of service during PAM login
  due to a missing check during path manipulation (bsc#1218475).
- Check localtime_r() return value to fix crashing (bsc#1217000) 

-----------------------------------------------------------------
Advisory ID: SUSE-SU-2024:153-1
Released:    Thu Jan 18 15:04:35 2024
Summary:     Security update for the Linux Kernel
Type:        security
Severity:    important
References:  1179610,1215237,1215375,1217250,1217709,1217946,1217947,1218105,1218253,1218258,1218559,CVE-2020-26555,CVE-2023-51779,CVE-2023-6121,CVE-2023-6606,CVE-2023-6610,CVE-2023-6931,CVE-2023-6932

The SUSE Linux Enterprise 15 SP3 kernel was updated to receive various security and bugfixes.


The following security bugs were fixed:

- CVE-2020-26555: Fixed Bluetooth legacy BR/EDR PIN code pairing in Bluetooth Core Specification 1.0B that may permit an unauthenticated nearby device to spoof the BD_ADDR of the peer device to complete pairing without knowledge of the PIN (bsc#1179610 bsc#1215237).
- CVE-2023-51779: Fixed a use-after-free because of a bt_sock_ioctl race condition in bt_sock_recvmsg (bsc#1218559).
- CVE-2023-6121: Fixed an out-of-bounds read vulnerability in the NVMe-oF/TCP subsystem that could lead to information leak (bsc#1217250).
- CVE-2023-6606: Fixed an out of bounds read in the SMB client when receiving a malformed length from a server (bsc#1217947).
- CVE-2023-6610: Fixed an out of bounds read in the SMB client when printing debug information (bsc#1217946).
- CVE-2023-6931: Fixed a heap out-of-bounds write vulnerability in the Linux kernel's Performance Events system component that could lead to local privilege escalation. (bsc#1218258).
- CVE-2023-6932: Fixed a use-after-free vulnerability in the Linux kernel's ipv4: igmp component that could lead to local privilege escalation (bsc#1218253).

The following non-security bugs were fixed:

- clocksource: Avoid accidental unstable marking of clocksources (bsc#1218105).
- clocksource: Suspend the watchdog temporarily when high read latency detected (bsc#1218105).
- doc/README.SUSE: Add how to update the config for module signing (jsc#PED-5021)
- doc/README.SUSE: Remove how to build modules using kernel-source (jsc#PED-5021)
- doc/README.SUSE: Simplify the list of references (jsc#PED-5021).
- efi/mokvar: Reserve the table only if it is in boot services data (bsc#1215375).
- io_uring: fix 32-bit compatability with sendmsg/recvmsg (bsc#1217709).


The following package changes have been done:

- kernel-default-5.3.18-150300.59.147.2 updated
- pam-1.3.0-150000.6.66.1 updated