June 2011 - openSUSE Security Announce

[security-announce] openSUSE-SU-2011:0688-1: important: opera
by opensuse-security＠opensuse.org 24 Jun '11

24 Jun '11

openSUSE Security Update: opera ______________________________________________________________________________ Announcement ID: openSUSE-SU-2011:0688-1 Rating: important References: #694567 Affected Products: openSUSE 11.4 openSUSE 11.3 ______________________________________________________________________________ An update that contains security fixes can now be installed. It includes one version update. Description: opera 11.11 fixes a security vulnerability. Citing http://www.opera.com/support/kb/view/992/: Framesets allow web pages to hold other pages inside them. Certain frameset constructs are not handled correctly when the page is unloaded, causing a memory corruption. To inject code, additional techniques will have to be employed. Patch Instructions: To install this openSUSE Security Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE 11.4: zypper in -t patch opera-4588 - openSUSE 11.3: zypper in -t patch opera-4588 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE 11.4 (i586 x86_64) [New Version: 11.11]: opera-11.11-1.2.1 opera-gtk-11.11-1.2.1 opera-kde4-11.11-1.2.1 - openSUSE 11.3 (i586 x86_64) [New Version: 11.11]: opera-11.11-1.2.1 opera-gtk-11.11-1.2.1 opera-kde4-11.11-1.2.1 References: https://bugzilla.novell.com/694567 -- To unsubscribe, e-mail: opensuse-security-announce+unsubscribe(a)opensuse.org For additional commands, e-mail: opensuse-security-announce+help(a)opensuse.org

1 0

[security-announce] Advance discontinuation notice for SUSE Linux Enterprise Server 9 regular maintenance
by Marcus Meissner 22 Jun '11

22 Jun '11

Hi, We have published the following NPA (Novell Product Announcement): SUSE(R) Linux Enterprise 9 End of General Support on August 31, 2011 SUSE announces the end of general support for SUSE Linux Enterprise 9 on August 31, 2011. Starting September 1, 2011, regular maintenance updates and patches for SUSE Linux Enterprise 9 (including security patches) will no longer be issued to SUSE Linux Enterprise subscription holders. Customers are encouraged to update their SUSE Linux Enterprise 9 servers and desktops to SUSE Linux Enterprise 10 or 11, in order to continue to receive regular maintenance updates, patches and technical support (if customers have subscribed to standard or priority support). Self Support For customers that wish to continue using SUSE Linux Enterprise 9, web-based support resources will be available until August 2014. More information about our self-help support resources, like our knowledgebase, documentation and staffed forums, can be found at http://support.novell.com/support_options.html. Long Term Service Pack Support For customers that would like to continue using SUSE Linux Enterprise 9 and receive technical support after August 31, 2011, SUSE offers Long Term Service Pack Support options. For an additional fee, customers can continue to receive technical support for products whose general support period has ended. More information about our Long Term Service Pack support options can be found at http://www.novell.com/linux/service-pack-support.html. Please contact your local SUSE sales representative about specific options and pricing. Product Information To learn more about our currently available SUSE Linux Enterprise products and services, please visit http://www.novell.com/linux. To learn more about SUSE Linux Enterprise product life cycles, please visit http://support.novell.com/lifecycle. Copyright 2011 Novell, Inc. All rights reserved. Novell is a registered trademark of Novell, Inc. in the United States and other countries. You are currently subscribed to the Novell Product Announcement distribution list. For general questions regarding NPAs or any changes to your NPA e-mail subscription, please send a message to npa(a)novell.com. Please include the name of your company, geographic location, as well as your company's relationship to Novell (i.e. Distributor, Partner, etc).

1 0

[security-announce] SUSE-SU-2011:0653-1: important: SUSE Manager
by opensuse-security＠opensuse.org 20 Jun '11

20 Jun '11

SUSE Security Update: SUSE Manager ______________________________________________________________________________ Announcement ID: SUSE-SU-2011:0653-1 Rating: important References: #644072 #644074 #644082 #674859 #685078 #685550 #685551 #689012 #691579 #693574 #694054 #695357 #695392 #697276 Cross-References: CVE-2009-4139 CVE-2011-1594 Affected Products: SUSE Manager 1.2 for SLE 11 SP1 ______________________________________________________________________________ An update that solves two vulnerabilities and has 12 fixes is now available. Description: This security update of SUSE Manager fixes the following vulnerabilities/add the following improvements: * CVE-2009-4139: A cross-site request forgery (CSRF) attack can be used to execute web-actions within the SUSE Manager web user interface with the privileges of the attacked user. * CVE-2011-1594: Open Redirect bug at the login page (Phishing) * using secure SSL ciphersuites only * added a "password strength meter" Additionally the following non-security issues were fixed too: * iso8859-1 handling of file names contained in packages * fix encoding of summary and description of a package if it is wrong * improve error message when gpg key is wrong or missing * do not trigger a resync is file is missing, can cause endless loop * do not send tracebacks as email if reposync failed * fix errata export/import for sync * handle sync with older spacewalk server which do not support weak dependencies * remove misleading information about Changing SUSE Manager hostname * fix monitoring related path name reference * fix malformed url error from pycurl when trying to download products and subscriptions with --from-dir and other minor issues * added proxy authentication to ncc-sync * fixed a syntax error on redirects when debugging is turned on * implement disconnected population of vendor channels * use pycurl instead of urllib for remote requests * catch cannot connect to database error * fix parsing the proxy user from curlrc How to apply this update: 1. Log in as root user to the SUSE Manager server. 2. Stop the Spacewalk service: spacewalk-service stop 3. Apply the patch using either zypper patch or YaST Online Update. 4. Start the Spacewalk service: spacewalk-service start Security Issue references: * CVE-2009-4139 <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2009-4139 > * CVE-2011-1594 <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2011-1594 > Indications: Every SUSE Manager user should update. Patch Instructions: To install this SUSE Security Update use YaST online_update. Alternatively you can run the command listed for your product: - SUSE Manager 1.2 for SLE 11 SP1: zypper in -t patch sleman12sp1-suse-manager-201106-4708 To bring your system up-to-date, use "zypper patch". Package List: - SUSE Manager 1.2 for SLE 11 SP1 (x86_64): spacewalk-backend-1.2.74-0.30.3 spacewalk-backend-app-1.2.74-0.30.3 spacewalk-backend-applet-1.2.74-0.30.3 spacewalk-backend-config-files-1.2.74-0.30.3 spacewalk-backend-config-files-common-1.2.74-0.30.3 spacewalk-backend-config-files-tool-1.2.74-0.30.3 spacewalk-backend-iss-1.2.74-0.30.3 spacewalk-backend-iss-export-1.2.74-0.30.3 spacewalk-backend-libs-1.2.74-0.30.3 spacewalk-backend-package-push-server-1.2.74-0.30.3 spacewalk-backend-server-1.2.74-0.30.3 spacewalk-backend-sql-1.2.74-0.30.3 spacewalk-backend-sql-oracle-1.2.74-0.30.3 spacewalk-backend-tools-1.2.74-0.30.3 spacewalk-backend-xml-export-libs-1.2.74-0.30.3 spacewalk-backend-xmlrpc-1.2.74-0.30.3 spacewalk-backend-xp-1.2.74-0.30.3 spacewalk-branding-1.2.2-0.18.2 susemanager-1.2.0-0.38.1 susemanager-tools-1.2.0-0.38.1 - SUSE Manager 1.2 for SLE 11 SP1 (noarch): spacewalk-base-1.2.31-0.25.1 spacewalk-base-minimal-1.2.31-0.25.1 spacewalk-grail-1.2.31-0.25.1 spacewalk-html-1.2.31-0.25.1 spacewalk-java-1.2.115-0.42.1 spacewalk-java-config-1.2.115-0.42.1 spacewalk-java-lib-1.2.115-0.42.1 spacewalk-java-oracle-1.2.115-0.42.1 spacewalk-pxt-1.2.31-0.25.1 spacewalk-setup-1.2.16-0.18.1 spacewalk-sniglets-1.2.31-0.25.1 spacewalk-taskomatic-1.2.115-0.42.1 susemanager-client-config_en-pdf-1.2-0.34.1 susemanager-install_en-pdf-1.2-0.34.1 susemanager-jsp_en-1.2-0.26.3 susemanager-manuals_en-1.2-0.34.1 susemanager-proxy-quick_en-pdf-1.2-0.34.1 susemanager-quick_en-pdf-1.2-0.34.1 susemanager-reference_en-pdf-1.2-0.34.1 References: http://support.novell.com/security/cve/CVE-2009-4139.html http://support.novell.com/security/cve/CVE-2011-1594.html https://bugzilla.novell.com/644072 https://bugzilla.novell.com/644074 https://bugzilla.novell.com/644082 https://bugzilla.novell.com/674859 https://bugzilla.novell.com/685078 https://bugzilla.novell.com/685550 https://bugzilla.novell.com/685551 https://bugzilla.novell.com/689012 https://bugzilla.novell.com/691579 https://bugzilla.novell.com/693574 https://bugzilla.novell.com/694054 https://bugzilla.novell.com/695357 https://bugzilla.novell.com/695392 https://bugzilla.novell.com/697276 http://download.novell.com/patch/finder/?keywords=0730ffb1d77928bc83ed1fb60… -- To unsubscribe, e-mail: opensuse-security-announce+unsubscribe(a)opensuse.org For additional commands, e-mail: opensuse-security-announce+help(a)opensuse.org

1 0

[security-announce] SUSE-SU-2011:0648-1: important: SUSE Manager Proxy
by opensuse-security＠opensuse.org 17 Jun '11

17 Jun '11

SUSE Security Update: SUSE Manager Proxy ______________________________________________________________________________ Announcement ID: SUSE-SU-2011:0648-1 Rating: important References: #685550 #691579 #693574 #695392 Affected Products: SUSE Manager Proxy 1.2 for SLE 11 SP1 ______________________________________________________________________________ An update that contains security fixes can now be installed. Description: This security update of SUSE Manger Proxy improves the SSL cipher suite setting to only allow secure SSLCipher and SSLProtocols. In addition, the following non-security issues have been fixed: * Reposync runs in endless loop if a file was not found on the server. * Improve error message when the gpg key is wrong or missing. * Wrong GPG should be reported as normal error, not as an exception. Indications: Everyoune should install this update. Patch Instructions: To install this SUSE Security Update use YaST online_update. Alternatively you can run the command listed for your product: - SUSE Manager Proxy 1.2 for SLE 11 SP1: zypper in -t patch slemap12sp1-suse-manager-proxy-201106-4699 To bring your system up-to-date, use "zypper patch". Package List: - SUSE Manager Proxy 1.2 for SLE 11 SP1 (x86_64): spacewalk-backend-1.2.74-0.30.2 spacewalk-backend-libs-1.2.74-0.30.2 - SUSE Manager Proxy 1.2 for SLE 11 SP1 (noarch): spacewalk-proxy-installer-1.2.3-0.16.1 References: https://bugzilla.novell.com/685550 https://bugzilla.novell.com/691579 https://bugzilla.novell.com/693574 https://bugzilla.novell.com/695392 http://download.novell.com/patch/finder/?keywords=7312f55efb2633ed2547216b5… -- To unsubscribe, e-mail: opensuse-security-announce+unsubscribe(a)opensuse.org For additional commands, e-mail: opensuse-security-announce+help(a)opensuse.org

1 0

[security-announce] SUSE-SU-2011:0640-1: critical: flash-player
by opensuse-security＠opensuse.org 15 Jun '11

15 Jun '11

SUSE Security Update: flash-player ______________________________________________________________________________ Announcement ID: SUSE-SU-2011:0640-1 Rating: critical References: #699942 Cross-References: CVE-2011-2110 Affected Products: SUSE Linux Enterprise Desktop 11 SP1 SUSE Linux Enterprise Desktop 10 SP4 ______________________________________________________________________________ An update that fixes one vulnerability is now available. It includes one version update. Description: A critical vulnerability has been identified in Adobe Flash Player 10.3.181.23 and earlier versions for Windows, Macintosh, Linux and Solaris, and Adobe Flash Player 10.3.185.23 and earlier versions for Android. This memory corruption vulnerability (CVE-2011-2110) could cause a crash and potentially allow an attacker to take control of the affected system. There are reports that this vulnerability is being exploited in the wild in targeted attacks via malicious Web pages. Security Issue references: * CVE-2011-2110 <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2011-2110 > Patch Instructions: To install this SUSE Security Update use YaST online_update. Alternatively you can run the command listed for your product: - SUSE Linux Enterprise Desktop 11 SP1: zypper in -t patch sledsp1-flash-player-4715 To bring your system up-to-date, use "zypper patch". Package List: - SUSE Linux Enterprise Desktop 11 SP1 (i586) [New Version: 10.3.181.26]: flash-player-10.3.181.26-0.2.1 - SUSE Linux Enterprise Desktop 10 SP4 (i586) [New Version: 10.3.181.26]: flash-player-10.3.181.26-0.5.1 References: http://support.novell.com/security/cve/CVE-2011-2110.html https://bugzilla.novell.com/699942 http://download.novell.com/patch/finder/?keywords=3346ccf604c46cb248821ffe1… http://download.novell.com/patch/finder/?keywords=c08bf73825177b7fc078941d6… -- To unsubscribe, e-mail: opensuse-security-announce+unsubscribe(a)opensuse.org For additional commands, e-mail: opensuse-security-announce+help(a)opensuse.org

1 0

[security-announce] openSUSE-SU-2011:0637-1: critical: flash-player: Update to 10.3.181.26
by opensuse-security＠opensuse.org 15 Jun '11

15 Jun '11

openSUSE Security Update: flash-player: Update to 10.3.181.26 ______________________________________________________________________________ Announcement ID: openSUSE-SU-2011:0637-1 Rating: critical References: #699942 Cross-References: CVE-2011-2110 Affected Products: openSUSE 11.4 openSUSE 11.3 ______________________________________________________________________________ An update that fixes one vulnerability is now available. It includes one version update. Description: A critical vulnerability has been identified in Adobe Flash Player 10.3.181.23 and earlier versions for Windows, Macintosh, Linux and Solaris, and Adobe Flash Player 10.3.185.23 and earlier versions for Android. This memory corruption vulnerability (CVE-2011-2110) could cause a crash and potentially allow an attacker to take control of the affected system. There are reports that this vulnerability is being exploited in the wild in targeted attacks via malicious Web pages. Patch Instructions: To install this openSUSE Security Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE 11.4: zypper in -t patch flash-player-4716 - openSUSE 11.3: zypper in -t patch flash-player-4716 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE 11.4 (i586) [New Version: 10.3.181.26]: flash-player-10.3.181.26-0.2.1 - openSUSE 11.3 (i586) [New Version: 10.3.181.26]: flash-player-10.3.181.26-0.2.1 References: http://support.novell.com/security/cve/CVE-2011-2110.html https://bugzilla.novell.com/699942 -- To unsubscribe, e-mail: opensuse-security-announce+unsubscribe(a)opensuse.org For additional commands, e-mail: opensuse-security-announce+help(a)opensuse.org

1 0

[security-announce] openSUSE-SU-2011:0633-1: critical: Oracle Java 26
by opensuse-security＠opensuse.org 14 Jun '11

14 Jun '11

openSUSE Security Update: Oracle Java 26 ______________________________________________________________________________ Announcement ID: openSUSE-SU-2011:0633-1 Rating: critical References: #698754 Cross-References: CVE-2011-0786 CVE-2011-0788 CVE-2011-0802 CVE-2011-0814 CVE-2011-0815 CVE-2011-0817 CVE-2011-0862 CVE-2011-0863 CVE-2011-0864 CVE-2011-0865 CVE-2011-0866 CVE-2011-0867 CVE-2011-0868 CVE-2011-0869 CVE-2011-0871 CVE-2011-0872 CVE-2011-0873 Affected Products: openSUSE 11.4 openSUSE 11.3 ______________________________________________________________________________ An update that fixes 17 vulnerabilities is now available. It includes one version update. Description: Oracle Java 6 Update 26 fixes several security vulnerabilities. Please refer to Oracle's site for further information: http://www.oracle.com/technetwork/topics/security/javacpujun e2011-313339.html (CVE-2011-0862, CVE-2011-0873, CVE-2011-0815, CVE-2011-0817, CVE-2011-0863, CVE-2011-0864, CVE-2011-0802, CVE-2011-0814, CVE-2011-0871, CVE-2011-0786, CVE-2011-0788, CVE-2011-0866, CVE-2011-0868, CVE-2011-0872, CVE-2011-0867, CVE-2011-0869, CVE-2011-0865) Patch Instructions: To install this openSUSE Security Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE 11.4: zypper in -t patch java-1_6_0-sun-4694 - openSUSE 11.3: zypper in -t patch java-1_6_0-sun-4694 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE 11.4 (i586 x86_64) [New Version: 1.6.0.u26]: java-1_6_0-sun-1.6.0.u26-0.2.1 java-1_6_0-sun-alsa-1.6.0.u26-0.2.1 java-1_6_0-sun-demo-1.6.0.u26-0.2.1 java-1_6_0-sun-devel-1.6.0.u26-0.2.1 java-1_6_0-sun-jdbc-1.6.0.u26-0.2.1 java-1_6_0-sun-plugin-1.6.0.u26-0.2.1 java-1_6_0-sun-src-1.6.0.u26-0.2.1 - openSUSE 11.3 (i586 x86_64) [New Version: 1.6.0.u26]: java-1_6_0-sun-1.6.0.u26-0.2.1 java-1_6_0-sun-alsa-1.6.0.u26-0.2.1 java-1_6_0-sun-devel-1.6.0.u26-0.2.1 java-1_6_0-sun-jdbc-1.6.0.u26-0.2.1 java-1_6_0-sun-plugin-1.6.0.u26-0.2.1 java-1_6_0-sun-src-1.6.0.u26-0.2.1 References: http://support.novell.com/security/cve/CVE-2011-0786.html http://support.novell.com/security/cve/CVE-2011-0788.html http://support.novell.com/security/cve/CVE-2011-0802.html http://support.novell.com/security/cve/CVE-2011-0814.html http://support.novell.com/security/cve/CVE-2011-0815.html http://support.novell.com/security/cve/CVE-2011-0817.html http://support.novell.com/security/cve/CVE-2011-0862.html http://support.novell.com/security/cve/CVE-2011-0863.html http://support.novell.com/security/cve/CVE-2011-0864.html http://support.novell.com/security/cve/CVE-2011-0865.html http://support.novell.com/security/cve/CVE-2011-0866.html http://support.novell.com/security/cve/CVE-2011-0867.html http://support.novell.com/security/cve/CVE-2011-0868.html http://support.novell.com/security/cve/CVE-2011-0869.html http://support.novell.com/security/cve/CVE-2011-0871.html http://support.novell.com/security/cve/CVE-2011-0872.html http://support.novell.com/security/cve/CVE-2011-0873.html https://bugzilla.novell.com/698754 -- To unsubscribe, e-mail: opensuse-security-announce+unsubscribe(a)opensuse.org For additional commands, e-mail: opensuse-security-announce+help(a)opensuse.org

1 0

[security-announce] SUSE-SU-2011:0632-1: critical: Sun/Oracle Java
by opensuse-security＠opensuse.org 14 Jun '11

14 Jun '11

SUSE Security Update: Sun/Oracle Java ______________________________________________________________________________ Announcement ID: SUSE-SU-2011:0632-1 Rating: critical References: #698754 Cross-References: CVE-2011-0786 CVE-2011-0788 CVE-2011-0802 CVE-2011-0814 CVE-2011-0815 CVE-2011-0817 CVE-2011-0862 CVE-2011-0863 CVE-2011-0864 CVE-2011-0865 CVE-2011-0866 CVE-2011-0867 CVE-2011-0868 CVE-2011-0869 CVE-2011-0871 CVE-2011-0872 CVE-2011-0873 Affected Products: SUSE Linux Enterprise Desktop 11 SP1 SUSE Linux Enterprise Desktop 10 SP4 ______________________________________________________________________________ An update that fixes 17 vulnerabilities is now available. It includes one version update. Description: Oracle Java 6 Update 26 fixes several security vulnerabilities. Please refer to Oracle's site for further information: http://www.oracle.com/technetwork/topics/security/javacpujun e2011-313339.html <http://www.oracle.com/technetwork/topics/security/javacpuju ne2011-313339.html> Security Issue references: * CVE-2011-0862 <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2011-0862 > * CVE-2011-0873 <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2011-0873 > * CVE-2011-0815 <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2011-0815 > * CVE-2011-0817 <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2011-0817 > * CVE-2011-0863 <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2011-0863 > * CVE-2011-0864 <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2011-0864 > * CVE-2011-0802 <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2011-0802 > * CVE-2011-0814 <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2011-0814 > * CVE-2011-0871 <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2011-0871 > * CVE-2011-0786 <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2011-0786 > * CVE-2011-0788 <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2011-0788 > * CVE-2011-0866 <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2011-0866 > * CVE-2011-0868 <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2011-0868 > * CVE-2011-0872 <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2011-0872 > * CVE-2011-0867 <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2011-0867 > * CVE-2011-0869 <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2011-0869 > * CVE-2011-0865 <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2011-0865 > Patch Instructions: To install this SUSE Security Update use YaST online_update. Alternatively you can run the command listed for your product: - SUSE Linux Enterprise Desktop 11 SP1: zypper in -t patch sledsp1-java-1_6_0-sun-4698 To bring your system up-to-date, use "zypper patch". Package List: - SUSE Linux Enterprise Desktop 11 SP1 (i586 x86_64) [New Version: 1.6.0.u26]: java-1_6_0-sun-1.6.0.u26-0.2.1 java-1_6_0-sun-alsa-1.6.0.u26-0.2.1 java-1_6_0-sun-demo-1.6.0.u26-0.2.1 java-1_6_0-sun-jdbc-1.6.0.u26-0.2.1 java-1_6_0-sun-plugin-1.6.0.u26-0.2.1 java-1_6_0-sun-src-1.6.0.u26-0.2.1 - SUSE Linux Enterprise Desktop 10 SP4 (i586 x86_64) [New Version: 1.6.0.u26]: java-1_6_0-sun-1.6.0.u26-0.11.1 java-1_6_0-sun-alsa-1.6.0.u26-0.11.1 java-1_6_0-sun-demo-1.6.0.u26-0.11.1 java-1_6_0-sun-devel-1.6.0.u26-0.11.1 java-1_6_0-sun-jdbc-1.6.0.u26-0.11.1 java-1_6_0-sun-src-1.6.0.u26-0.11.1 - SUSE Linux Enterprise Desktop 10 SP4 (x86_64) [New Version: 1.6.0.u26]: java-1_6_0-sun-32bit-1.6.0.u26-0.11.1 java-1_6_0-sun-plugin-32bit-1.6.0.u26-0.11.1 - SUSE Linux Enterprise Desktop 10 SP4 (i586) [New Version: 1.6.0.u26]: java-1_6_0-sun-plugin-1.6.0.u26-0.11.1 References: http://support.novell.com/security/cve/CVE-2011-0786.html http://support.novell.com/security/cve/CVE-2011-0788.html http://support.novell.com/security/cve/CVE-2011-0802.html http://support.novell.com/security/cve/CVE-2011-0814.html http://support.novell.com/security/cve/CVE-2011-0815.html http://support.novell.com/security/cve/CVE-2011-0817.html http://support.novell.com/security/cve/CVE-2011-0862.html http://support.novell.com/security/cve/CVE-2011-0863.html http://support.novell.com/security/cve/CVE-2011-0864.html http://support.novell.com/security/cve/CVE-2011-0865.html http://support.novell.com/security/cve/CVE-2011-0866.html http://support.novell.com/security/cve/CVE-2011-0867.html http://support.novell.com/security/cve/CVE-2011-0868.html http://support.novell.com/security/cve/CVE-2011-0869.html http://support.novell.com/security/cve/CVE-2011-0871.html http://support.novell.com/security/cve/CVE-2011-0872.html http://support.novell.com/security/cve/CVE-2011-0873.html https://bugzilla.novell.com/698754 http://download.novell.com/patch/finder/?keywords=338a1546773a4e28c9f256c1a… http://download.novell.com/patch/finder/?keywords=6bc8d900b81c810dacee03e32… -- To unsubscribe, e-mail: opensuse-security-announce+unsubscribe(a)opensuse.org For additional commands, e-mail: opensuse-security-announce+help(a)opensuse.org

1 0

[security-announce] SUSE-SU-2011:0614-1: important: flash-player
by opensuse-security＠opensuse.org 10 Jun '11

10 Jun '11

SUSE Security Update: flash-player ______________________________________________________________________________ Announcement ID: SUSE-SU-2011:0614-1 Rating: important References: #698261 Cross-References: CVE-2011-2107 Affected Products: SUSE Linux Enterprise Desktop 11 SP1 SUSE Linux Enterprise Desktop 10 SP4 ______________________________________________________________________________ An update that fixes one vulnerability is now available. It includes one version update. Description: This update of flash player fixes a cross-site scripting vulnerability ( CVE-2011-2107 <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2011-2107 > ). For more information about this issue please refer to http://www.adobe.com/support/security/bulletins/apsb11-13.ht ml <http://www.adobe.com/support/security/bulletins/apsb11-13.h tml> . Indications: Please install this update. Patch Instructions: To install this SUSE Security Update use YaST online_update. Alternatively you can run the command listed for your product: - SUSE Linux Enterprise Desktop 11 SP1: zypper in -t patch sledsp1-flash-player-4666 To bring your system up-to-date, use "zypper patch". Package List: - SUSE Linux Enterprise Desktop 11 SP1 (i586) [New Version: 10.3.181.22]: flash-player-10.3.181.22-0.2.1 - SUSE Linux Enterprise Desktop 10 SP4 (i586) [New Version: 10.3.181.22]: flash-player-10.3.181.22-0.5.1 References: http://support.novell.com/security/cve/CVE-2011-2107.html https://bugzilla.novell.com/698261 http://download.novell.com/patch/finder/?keywords=29134c62f91fad6f61cc961b1… http://download.novell.com/patch/finder/?keywords=76e1cd706437403cd75d040d3… -- To unsubscribe, e-mail: opensuse-security-announce+unsubscribe(a)opensuse.org For additional commands, e-mail: opensuse-security-announce+help(a)opensuse.org

1 0

[security-announce] SUSE-SU-2011:0608-1: important: bind
by opensuse-security＠opensuse.org 10 Jun '11

10 Jun '11

SUSE Security Update: bind ______________________________________________________________________________ Announcement ID: SUSE-SU-2011:0608-1 Rating: important References: #696585 Affected Products: SUSE Linux Enterprise Server 10 SP4 SUSE Linux Enterprise Desktop 10 SP4 SLE SDK 10 SP4 ______________________________________________________________________________ An update that contains security fixes can now be installed. It includes one version update. Description: This update provides bind 9.6ESVR4P1 which fixes a denial of service vulnerability that can be triggered by very large RRSIG RRsets in a negative response and crash named. (CVE-2011-1910 <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2011-1910 > ) It further provides a fix for a defect which may cause queries for .com names to fail with validation errors when DNSSEC records for the .com zone are initially inserted into the root zone. Please refer to https://www.isc.org/software/bind/new-features/9.6 <https://www.isc.org/software/bind/new-features/9.6> for more information on additional improvements and bug fixes. Indications: Every user of Bind9 should update. Package List: - SUSE Linux Enterprise Server 10 SP4 (i586 ia64 ppc s390x x86_64) [New Version: 9.6ESVR4P1]: bind-9.6ESVR4P1-0.12.1 bind-chrootenv-9.6ESVR4P1-0.12.1 bind-devel-9.6ESVR4P1-0.12.1 bind-doc-9.6ESVR4P1-0.12.1 bind-libs-9.6ESVR4P1-0.12.1 bind-utils-9.6ESVR4P1-0.12.1 - SUSE Linux Enterprise Server 10 SP4 (s390x x86_64) [New Version: 9.6ESVR4P1]: bind-libs-32bit-9.6ESVR4P1-0.12.1 - SUSE Linux Enterprise Server 10 SP4 (ia64) [New Version: 9.6ESVR4P1]: bind-libs-x86-9.6ESVR4P1-0.12.1 - SUSE Linux Enterprise Server 10 SP4 (ppc) [New Version: 9.6ESVR4P1]: bind-devel-64bit-9.6ESVR4P1-0.12.1 bind-libs-64bit-9.6ESVR4P1-0.12.1 - SUSE Linux Enterprise Desktop 10 SP4 (i586 x86_64) [New Version: 9.6ESVR4P1]: bind-libs-9.6ESVR4P1-0.12.1 bind-utils-9.6ESVR4P1-0.12.1 - SUSE Linux Enterprise Desktop 10 SP4 (x86_64) [New Version: 9.6ESVR4P1]: bind-libs-32bit-9.6ESVR4P1-0.12.1 - SLE SDK 10 SP4 (i586 ia64 ppc s390x x86_64) [New Version: 9.6ESVR4P1]: bind-9.6ESVR4P1-0.12.1 bind-chrootenv-9.6ESVR4P1-0.12.1 bind-devel-9.6ESVR4P1-0.12.1 bind-doc-9.6ESVR4P1-0.12.1 - SLE SDK 10 SP4 (ppc) [New Version: 9.6ESVR4P1]: bind-devel-64bit-9.6ESVR4P1-0.12.1 References: https://bugzilla.novell.com/696585 http://download.novell.com/patch/finder/?keywords=a1d2052c172e9b480eca0dec2… -- To unsubscribe, e-mail: opensuse-security-announce+unsubscribe(a)opensuse.org For additional commands, e-mail: opensuse-security-announce+help(a)opensuse.org

1 0