November 2012 - openSUSE Security Announce

[security-announce] SUSE-SU-2012:1503-1: important: Security update for libvirt
by opensuse-security＠opensuse.org 19 Nov '12

19 Nov '12

SUSE Security Update: Security update for libvirt ______________________________________________________________________________ Announcement ID: SUSE-SU-2012:1503-1 Rating: important References: #772586 #773621 #773626 #780432 Cross-References: CVE-2012-3497 CVE-2012-4411 CVE-2012-4535 CVE-2012-4536 CVE-2012-4537 CVE-2012-4538 CVE-2012-4539 CVE-2012-4544 Affected Products: SUSE Linux Enterprise Software Development Kit 11 SP2 SUSE Linux Enterprise Server 11 SP2 SUSE Linux Enterprise Desktop 11 SP2 ______________________________________________________________________________ An update that fixes 8 vulnerabilities is now available. Description: libvirt received security and bugfixes: * CVE-2012-4423: Fixed a libvirt remote denial of service (crash) problem. The following bugs have been fixed: * qemu: Fix probing for guest capabilities * xen-xm: Generate UUID if not specified * xenParseXM: don't dereference NULL pointer when script is empty Security Issue references: * CVE-2012-4539 <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2012-4539 > * CVE-2012-3497 <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2012-3497 > * CVE-2012-4411 <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2012-4411 > * CVE-2012-4535 <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2012-4535 > * CVE-2012-4537 <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2012-4537 > * CVE-2012-4536 <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2012-4536 > * CVE-2012-4538 <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2012-4538 > * CVE-2012-4539 <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2012-4539 > * CVE-2012-4544 <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2012-4544 > Patch Instructions: To install this SUSE Security Update use YaST online_update. Alternatively you can run the command listed for your product: - SUSE Linux Enterprise Software Development Kit 11 SP2: zypper in -t patch sdksp2-libvirt-201211-7015 - SUSE Linux Enterprise Server 11 SP2: zypper in -t patch slessp2-libvirt-201211-7015 - SUSE Linux Enterprise Desktop 11 SP2: zypper in -t patch sledsp2-libvirt-201211-7015 To bring your system up-to-date, use "zypper patch". Package List: - SUSE Linux Enterprise Software Development Kit 11 SP2 (i586 x86_64): libvirt-devel-0.9.6-0.23.1 - SUSE Linux Enterprise Software Development Kit 11 SP2 (x86_64): libvirt-devel-32bit-0.9.6-0.23.1 - SUSE Linux Enterprise Server 11 SP2 (i586 x86_64): libvirt-0.9.6-0.23.1 libvirt-client-0.9.6-0.23.1 libvirt-doc-0.9.6-0.23.1 libvirt-python-0.9.6-0.23.1 - SUSE Linux Enterprise Server 11 SP2 (x86_64): libvirt-client-32bit-0.9.6-0.23.1 - SUSE Linux Enterprise Desktop 11 SP2 (i586 x86_64): libvirt-0.9.6-0.23.1 libvirt-client-0.9.6-0.23.1 libvirt-doc-0.9.6-0.23.1 libvirt-python-0.9.6-0.23.1 - SUSE Linux Enterprise Desktop 11 SP2 (x86_64): libvirt-client-32bit-0.9.6-0.23.1 References: http://support.novell.com/security/cve/CVE-2012-3497.html http://support.novell.com/security/cve/CVE-2012-4411.html http://support.novell.com/security/cve/CVE-2012-4535.html http://support.novell.com/security/cve/CVE-2012-4536.html http://support.novell.com/security/cve/CVE-2012-4537.html http://support.novell.com/security/cve/CVE-2012-4538.html http://support.novell.com/security/cve/CVE-2012-4539.html http://support.novell.com/security/cve/CVE-2012-4544.html https://bugzilla.novell.com/772586 https://bugzilla.novell.com/773621 https://bugzilla.novell.com/773626 https://bugzilla.novell.com/780432 http://download.novell.com/patch/finder/?keywords=6c77cedf2e828c0cfa0f10bbd… -- To unsubscribe, e-mail: opensuse-security-announce+unsubscribe(a)opensuse.org For additional commands, e-mail: opensuse-security-announce+help(a)opensuse.org

1 0

[security-announce] SUSE-SU-2012:1490-1: important: Security update for IBM Java 1.4.2
by opensuse-security＠opensuse.org 16 Nov '12

16 Nov '12

SUSE Security Update: Security update for IBM Java 1.4.2 ______________________________________________________________________________ Announcement ID: SUSE-SU-2012:1490-1 Rating: important References: #758651 #788750 Affected Products: SUSE Linux Enterprise Software Development Kit 11 SP2 SUSE Linux Enterprise Server 11 SP2 for VMware SUSE Linux Enterprise Server 11 SP2 SUSE Linux Enterprise Server 10 SP4 SUSE Linux Enterprise Java 11 SP2 SUSE Linux Enterprise Java 10 SP4 ______________________________________________________________________________ An update that contains security fixes can now be installed. Description: IBM Java 1.4.2 has been updated to SR13-FP14 which fixes bugs and security issues. More information can be found on: [http://www.ibm.com/developerworks/java/jdk/alerts/)(http:// www.ibm.com/developerworks/java/jdk/alerts/) CVEs fixed: CVE-2012-3216,CVE-2012-5073,CVE-2012-5083,CVE-2012-5083,CVE- 2012-1531,CVE-2012-5081,CVE-2012-5084,CVE-2012-5079 Patch Instructions: To install this SUSE Security Update use YaST online_update. Alternatively you can run the command listed for your product: - SUSE Linux Enterprise Software Development Kit 11 SP2: zypper in -t patch sdksp2-java-1_4_2-ibm-7043 - SUSE Linux Enterprise Server 11 SP2 for VMware: zypper in -t patch slessp2-java-1_4_2-ibm-7043 - SUSE Linux Enterprise Server 11 SP2: zypper in -t patch slessp2-java-1_4_2-ibm-7043 - SUSE Linux Enterprise Java 11 SP2: zypper in -t patch slejsp2-java-1_4_2-ibm-7043 To bring your system up-to-date, use "zypper patch". Package List: - SUSE Linux Enterprise Software Development Kit 11 SP2 (i586 ia64 ppc64 s390x x86_64): java-1_4_2-ibm-devel-1.4.2_sr13.14-0.2.1 - SUSE Linux Enterprise Software Development Kit 11 SP2 (i586 x86_64): java-1_4_2-ibm-1.4.2_sr13.14-0.2.1 - SUSE Linux Enterprise Server 11 SP2 for VMware (i586 x86_64): java-1_4_2-ibm-1.4.2_sr13.14-0.2.1 - SUSE Linux Enterprise Server 11 SP2 for VMware (i586): java-1_4_2-ibm-jdbc-1.4.2_sr13.14-0.2.1 java-1_4_2-ibm-plugin-1.4.2_sr13.14-0.2.1 - SUSE Linux Enterprise Server 11 SP2 (i586 ia64 ppc64 s390x x86_64): java-1_4_2-ibm-1.4.2_sr13.14-0.2.1 - SUSE Linux Enterprise Server 11 SP2 (i586): java-1_4_2-ibm-jdbc-1.4.2_sr13.14-0.2.1 java-1_4_2-ibm-plugin-1.4.2_sr13.14-0.2.1 - SUSE Linux Enterprise Server 10 SP4 (i586 ia64 ppc s390x x86_64): java-1_4_2-ibm-1.4.2_sr13.14-0.5.1 java-1_4_2-ibm-devel-1.4.2_sr13.14-0.5.1 - SUSE Linux Enterprise Server 10 SP4 (i586 ppc): java-1_4_2-ibm-jdbc-1.4.2_sr13.14-0.5.1 - SUSE Linux Enterprise Server 10 SP4 (i586): java-1_4_2-ibm-plugin-1.4.2_sr13.14-0.5.1 - SUSE Linux Enterprise Java 11 SP2 (i586 ppc64 s390x x86_64): java-1_4_2-ibm-1.4.2_sr13.14-0.2.1 - SUSE Linux Enterprise Java 11 SP2 (i586): java-1_4_2-ibm-jdbc-1.4.2_sr13.14-0.2.1 java-1_4_2-ibm-plugin-1.4.2_sr13.14-0.2.1 - SUSE Linux Enterprise Java 10 SP4 (i586 ia64 ppc s390x x86_64): java-1_4_2-ibm-1.4.2_sr13.14-0.5.1 java-1_4_2-ibm-devel-1.4.2_sr13.14-0.5.1 - SUSE Linux Enterprise Java 10 SP4 (i586 ppc): java-1_4_2-ibm-jdbc-1.4.2_sr13.14-0.5.1 - SUSE Linux Enterprise Java 10 SP4 (i586): java-1_4_2-ibm-plugin-1.4.2_sr13.14-0.5.1 References: https://bugzilla.novell.com/758651 https://bugzilla.novell.com/788750 http://download.novell.com/patch/finder/?keywords=a01a06d8f691fbd19a4c84ccc… http://download.novell.com/patch/finder/?keywords=cc64f4b8f8231d78d335786a3… -- To unsubscribe, e-mail: opensuse-security-announce+unsubscribe(a)opensuse.org For additional commands, e-mail: opensuse-security-announce+help(a)opensuse.org

1 0

[security-announce] SUSE-SU-2012:1489-1: important: Security update for IBM Java 1.5.0
by opensuse-security＠opensuse.org 16 Nov '12

16 Nov '12

SUSE Security Update: Security update for IBM Java 1.5.0 ______________________________________________________________________________ Announcement ID: SUSE-SU-2012:1489-1 Rating: important References: #788750 Affected Products: SUSE Linux Enterprise Server 10 SP4 SUSE Linux Enterprise Java 10 SP4 SUSE Linux Enterprise Desktop 10 SP4 ______________________________________________________________________________ An update that contains security fixes can now be installed. Description: IBM Java 1.5.0 has been updated to SR15 which fixes bugs and security issues. More information can be found on: http://www.ibm.com/developerworks/java/jdk/alerts/ <http://www.ibm.com/developerworks/java/jdk/alerts/> CVE-2012-3216,CVE-2012-3143,CVE-2012-5073,CVE-2012-5075,CVE- 2012-5083,CVE-2012-5083,CVE-2012-1531,CVE-2012-5081,CVE-2012 -5069,CVE-2012-5071,CVE-2012-5084,CVE-2012-5079,CVE-2012-508 9 Package List: - SUSE Linux Enterprise Server 10 SP4 (i586 ppc s390x x86_64): java-1_5_0-ibm-1.5.0_sr15.0-0.5.1 java-1_5_0-ibm-devel-1.5.0_sr15.0-0.5.1 java-1_5_0-ibm-fonts-1.5.0_sr15.0-0.5.1 - SUSE Linux Enterprise Server 10 SP4 (s390x x86_64): java-1_5_0-ibm-32bit-1.5.0_sr15.0-0.5.1 java-1_5_0-ibm-devel-32bit-1.5.0_sr15.0-0.5.1 - SUSE Linux Enterprise Server 10 SP4 (i586 ppc): java-1_5_0-ibm-jdbc-1.5.0_sr15.0-0.5.1 java-1_5_0-ibm-plugin-1.5.0_sr15.0-0.5.1 - SUSE Linux Enterprise Server 10 SP4 (x86_64): java-1_5_0-ibm-alsa-32bit-1.5.0_sr15.0-0.5.1 - SUSE Linux Enterprise Server 10 SP4 (i586): java-1_5_0-ibm-alsa-1.5.0_sr15.0-0.5.1 - SUSE Linux Enterprise Server 10 SP4 (ppc): java-1_5_0-ibm-64bit-1.5.0_sr15.0-0.5.1 - SUSE Linux Enterprise Java 10 SP4 (i586 ppc s390x x86_64): java-1_5_0-ibm-1.5.0_sr15.0-0.5.1 java-1_5_0-ibm-devel-1.5.0_sr15.0-0.5.1 java-1_5_0-ibm-fonts-1.5.0_sr15.0-0.5.1 - SUSE Linux Enterprise Java 10 SP4 (ppc): java-1_5_0-ibm-jdbc-1.5.0_sr15.0-0.5.1 java-1_5_0-ibm-plugin-1.5.0_sr15.0-0.5.1 - SUSE Linux Enterprise Desktop 10 SP4 (i586 x86_64): java-1_5_0-ibm-1.5.0_sr15.0-0.5.1 java-1_5_0-ibm-demo-1.5.0_sr15.0-0.5.1 java-1_5_0-ibm-devel-1.5.0_sr15.0-0.5.1 java-1_5_0-ibm-fonts-1.5.0_sr15.0-0.5.1 java-1_5_0-ibm-src-1.5.0_sr15.0-0.5.1 - SUSE Linux Enterprise Desktop 10 SP4 (x86_64): java-1_5_0-ibm-32bit-1.5.0_sr15.0-0.5.1 java-1_5_0-ibm-alsa-32bit-1.5.0_sr15.0-0.5.1 java-1_5_0-ibm-devel-32bit-1.5.0_sr15.0-0.5.1 - SUSE Linux Enterprise Desktop 10 SP4 (i586): java-1_5_0-ibm-alsa-1.5.0_sr15.0-0.5.1 java-1_5_0-ibm-jdbc-1.5.0_sr15.0-0.5.1 java-1_5_0-ibm-plugin-1.5.0_sr15.0-0.5.1 References: https://bugzilla.novell.com/788750 http://download.novell.com/patch/finder/?keywords=bb56b08850390b907db4d458f… -- To unsubscribe, e-mail: opensuse-security-announce+unsubscribe(a)opensuse.org For additional commands, e-mail: opensuse-security-announce+help(a)opensuse.org

1 0

[security-announce] SUSE-SU-2012:1487-1: important: Security update for Xen
by opensuse-security＠opensuse.org 16 Nov '12

16 Nov '12

SUSE Security Update: Security update for Xen ______________________________________________________________________________ Announcement ID: SUSE-SU-2012:1487-1 Rating: important References: #651093 #713555 #784087 #786516 #786517 Cross-References: CVE-2012-3497 CVE-2012-4411 CVE-2012-4535 CVE-2012-4536 CVE-2012-4537 CVE-2012-4538 CVE-2012-4539 CVE-2012-4544 Affected Products: SUSE Linux Enterprise Server 10 SP4 SUSE Linux Enterprise Desktop 10 SP4 SLE SDK 10 SP4 ______________________________________________________________________________ An update that fixes 8 vulnerabilities is now available. Description: XEN received various security and bugfixes: * CVE-2012-4535: xen: Timer overflow DoS vulnerability (XSA-20) * CVE-2012-4537: xen: Memory mapping failure DoS vulnerability (XSA-22) The following additional bugs have beenfixed: * bnc#784087 - L3: Xen BUG at io_apic.c:129 26102-x86-IOAPIC-legacy-not-first.patch * Upstream patches from Jan 25927-x86-domctl-ioport-mapping-range.patch 25931-x86-domctl-iomem-mapping-checks.patch 26061-x86-oprof-counter-range.patch 25431-x86-EDD-MBR-sig-check.patch 25480-x86_64-sysret-canonical.patch 25481-x86_64-AMD-erratum-121.patch 25485-x86_64-canonical-checks.patch 25587-param-parse-limit.patch 25589-pygrub-size-limits.patch 25744-hypercall-return-long.patch 25765-x86_64-allow-unsafe-adjust.patch 25773-x86-honor-no-real-mode.patch 25786-x86-prefer-multiboot-meminfo-over-e801.patch 25808-domain_create-return-value.patch 25814-x86_64-set-debugreg-guest.patch 24742-gnttab-misc.patch 25098-x86-emul-lock-UD.patch 25200-x86_64-trap-bounce-flags.patch 25271-x86_64-IST-index.patch * bnc#651093 - win2k8 guests are unable to restore after saving the vms state ept-novell-x64.patch 23800-x86_64-guest-addr-range.patch 24168-x86-vioapic-clear-remote_irr.patch 24453-x86-vIRQ-IRR-TMR-race.patch 24456-x86-emul-lea.patch * bnc#713555 - Unable to install RHEL 6.1 x86 as a paravirtualized guest OS on SLES 10 SP4 x86 vm-install-0.2.19.tar.bz2 Security Issue references: * CVE-2012-4539 <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2012-4539 > * CVE-2012-3497 <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2012-3497 > * CVE-2012-4411 <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2012-4411 > * CVE-2012-4535 <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2012-4535 > * CVE-2012-4537 <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2012-4537 > * CVE-2012-4536 <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2012-4536 > * CVE-2012-4538 <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2012-4538 > * CVE-2012-4539 <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2012-4539 > * CVE-2012-4544 <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2012-4544 > Package List: - SUSE Linux Enterprise Server 10 SP4 (x86_64): xen-3.2.3_17040_42-0.7.2 xen-devel-3.2.3_17040_42-0.7.2 xen-doc-html-3.2.3_17040_42-0.7.2 xen-doc-pdf-3.2.3_17040_42-0.7.2 xen-doc-ps-3.2.3_17040_42-0.7.2 xen-kmp-debug-3.2.3_17040_42_2.6.16.60_0.99.11-0.7.2 xen-kmp-default-3.2.3_17040_42_2.6.16.60_0.99.11-0.7.2 xen-kmp-kdump-3.2.3_17040_42_2.6.16.60_0.99.11-0.7.2 xen-kmp-smp-3.2.3_17040_42_2.6.16.60_0.99.11-0.7.2 xen-libs-3.2.3_17040_42-0.7.2 xen-libs-32bit-3.2.3_17040_42-0.7.1 xen-tools-3.2.3_17040_42-0.7.2 xen-tools-domU-3.2.3_17040_42-0.7.2 xen-tools-ioemu-3.2.3_17040_42-0.7.2 - SUSE Linux Enterprise Server 10 SP4 (i586): xen-3.2.3_17040_42-0.7.1 xen-devel-3.2.3_17040_42-0.7.1 xen-doc-html-3.2.3_17040_42-0.7.1 xen-doc-pdf-3.2.3_17040_42-0.7.1 xen-doc-ps-3.2.3_17040_42-0.7.1 xen-kmp-bigsmp-3.2.3_17040_42_2.6.16.60_0.99.8-0.7.1 xen-kmp-debug-3.2.3_17040_42_2.6.16.60_0.99.8-0.7.1 xen-kmp-default-3.2.3_17040_42_2.6.16.60_0.99.8-0.7.1 xen-kmp-kdump-3.2.3_17040_42_2.6.16.60_0.99.8-0.7.1 xen-kmp-kdumppae-3.2.3_17040_42_2.6.16.60_0.99.8-0.7.1 xen-kmp-smp-3.2.3_17040_42_2.6.16.60_0.99.8-0.7.1 xen-kmp-vmi-3.2.3_17040_42_2.6.16.60_0.99.8-0.7.1 xen-kmp-vmipae-3.2.3_17040_42_2.6.16.60_0.99.8-0.7.1 xen-libs-3.2.3_17040_42-0.7.1 xen-tools-3.2.3_17040_42-0.7.1 xen-tools-domU-3.2.3_17040_42-0.7.1 xen-tools-ioemu-3.2.3_17040_42-0.7.1 - SUSE Linux Enterprise Desktop 10 SP4 (x86_64): xen-3.2.3_17040_42-0.7.2 xen-devel-3.2.3_17040_42-0.7.2 xen-doc-html-3.2.3_17040_42-0.7.2 xen-doc-pdf-3.2.3_17040_42-0.7.2 xen-doc-ps-3.2.3_17040_42-0.7.2 xen-kmp-default-3.2.3_17040_42_2.6.16.60_0.99.11-0.7.2 xen-kmp-smp-3.2.3_17040_42_2.6.16.60_0.99.11-0.7.2 xen-libs-3.2.3_17040_42-0.7.2 xen-libs-32bit-3.2.3_17040_42-0.7.1 xen-tools-3.2.3_17040_42-0.7.2 xen-tools-domU-3.2.3_17040_42-0.7.2 xen-tools-ioemu-3.2.3_17040_42-0.7.2 - SUSE Linux Enterprise Desktop 10 SP4 (i586): xen-3.2.3_17040_42-0.7.1 xen-devel-3.2.3_17040_42-0.7.1 xen-doc-html-3.2.3_17040_42-0.7.1 xen-doc-pdf-3.2.3_17040_42-0.7.1 xen-doc-ps-3.2.3_17040_42-0.7.1 xen-kmp-bigsmp-3.2.3_17040_42_2.6.16.60_0.99.8-0.7.1 xen-kmp-default-3.2.3_17040_42_2.6.16.60_0.99.8-0.7.1 xen-kmp-smp-3.2.3_17040_42_2.6.16.60_0.99.8-0.7.1 xen-libs-3.2.3_17040_42-0.7.1 xen-tools-3.2.3_17040_42-0.7.1 xen-tools-domU-3.2.3_17040_42-0.7.1 xen-tools-ioemu-3.2.3_17040_42-0.7.1 - SLE SDK 10 SP4 (x86_64): xen-3.2.3_17040_42-0.7.2 xen-devel-3.2.3_17040_42-0.7.2 xen-kmp-debug-3.2.3_17040_42_2.6.16.60_0.99.11-0.7.2 xen-kmp-kdump-3.2.3_17040_42_2.6.16.60_0.99.11-0.7.2 xen-libs-3.2.3_17040_42-0.7.2 xen-libs-32bit-3.2.3_17040_42-0.7.1 xen-tools-3.2.3_17040_42-0.7.2 xen-tools-ioemu-3.2.3_17040_42-0.7.2 - SLE SDK 10 SP4 (i586): xen-3.2.3_17040_42-0.7.1 xen-devel-3.2.3_17040_42-0.7.1 xen-kmp-debug-3.2.3_17040_42_2.6.16.60_0.99.8-0.7.1 xen-kmp-kdump-3.2.3_17040_42_2.6.16.60_0.99.8-0.7.1 xen-libs-3.2.3_17040_42-0.7.1 xen-tools-3.2.3_17040_42-0.7.1 xen-tools-ioemu-3.2.3_17040_42-0.7.1 References: http://support.novell.com/security/cve/CVE-2012-3497.html http://support.novell.com/security/cve/CVE-2012-4411.html http://support.novell.com/security/cve/CVE-2012-4535.html http://support.novell.com/security/cve/CVE-2012-4536.html http://support.novell.com/security/cve/CVE-2012-4537.html http://support.novell.com/security/cve/CVE-2012-4538.html http://support.novell.com/security/cve/CVE-2012-4539.html http://support.novell.com/security/cve/CVE-2012-4544.html https://bugzilla.novell.com/651093 https://bugzilla.novell.com/713555 https://bugzilla.novell.com/784087 https://bugzilla.novell.com/786516 https://bugzilla.novell.com/786517 http://download.novell.com/patch/finder/?keywords=1e9042debead5d88c23444a90… -- To unsubscribe, e-mail: opensuse-security-announce+unsubscribe(a)opensuse.org For additional commands, e-mail: opensuse-security-announce+help(a)opensuse.org

1 0

[security-announce] SUSE-SU-2012:1486-1: important: Security update for Xen
by opensuse-security＠opensuse.org 15 Nov '12

15 Nov '12

SUSE Security Update: Security update for Xen ______________________________________________________________________________ Announcement ID: SUSE-SU-2012:1486-1 Rating: important References: #777890 #778105 #779212 #784087 #786516 #786517 #786518 #786519 #786520 #787163 Cross-References: CVE-2012-3497 CVE-2012-4411 CVE-2012-4535 CVE-2012-4536 CVE-2012-4537 CVE-2012-4538 CVE-2012-4539 CVE-2012-4544 Affected Products: SUSE Linux Enterprise Software Development Kit 11 SP2 SUSE Linux Enterprise Server 11 SP2 for VMware SUSE Linux Enterprise Server 11 SP2 SUSE Linux Enterprise Desktop 11 SP2 ______________________________________________________________________________ An update that solves 8 vulnerabilities and has two fixes is now available. Description: XEN was updated to fix various bugs and security issues: The following security issues have been fixed: * CVE-2012-4544: xen: Domain builder Out-of-memory due to malicious kernel/ramdisk (XSA 25) * CVE-2012-4411: XEN / qemu: guest administrator can access qemu monitor console (XSA-19) * CVE-2012-4535: xen: Timer overflow DoS vulnerability (XSA 20) * CVE-2012-4536: xen: pirq range check DoS vulnerability (XSA 21) * CVE-2012-4537: xen: Memory mapping failure DoS vulnerability (XSA 22) * CVE-2012-4538: xen: Unhooking empty PAE entries DoS vulnerability (XSA 23) * CVE-2012-4539: xen: Grant table hypercall infinite loop DoS vulnerability (XSA 24) * CVE-2012-3497: xen: multiple TMEM hypercall vulnerabilities (XSA-15) Also the following bugs have been fixed and upstream patches have been applied: * bnc#784087 - L3: Xen BUG at io_apic.c:129 26102-x86-IOAPIC-legacy-not-first.patch * Upstream patches merged: 26054-x86-AMD-perf-ctr-init.patch 26055-x86-oprof-hvm-mode.patch 26056-page-alloc-flush-filter.patch 26061-x86-oprof-counter-range.patch 26062-ACPI-ERST-move-data.patch 26063-x86-HPET-affinity-lock.patch 26093-HVM-PoD-grant-mem-type.patch 25931-x86-domctl-iomem-mapping-checks.patch 25952-x86-MMIO-remap-permissions.patch 25808-domain_create-return-value.patch 25814-x86_64-set-debugreg-guest.patch 25815-x86-PoD-no-bug-in-non-translated.patch 25816-x86-hvm-map-pirq-range-check.patch 25833-32on64-bogus-pt_base-adjust.patch 25834-x86-S3-MSI-resume.patch 25835-adjust-rcu-lock-domain.patch 25836-VT-d-S3-MSI-resume.patch 25850-tmem-xsa-15-1.patch 25851-tmem-xsa-15-2.patch 25852-tmem-xsa-15-3.patch 25853-tmem-xsa-15-4.patch 25854-tmem-xsa-15-5.patch 25855-tmem-xsa-15-6.patch 25856-tmem-xsa-15-7.patch 25857-tmem-xsa-15-8.patch 25858-tmem-xsa-15-9.patch 25859-tmem-missing-break.patch 25860-tmem-cleanup.patch 25883-pt-MSI-cleanup.patch 25927-x86-domctl-ioport-mapping-range.patch 25929-tmem-restore-pool-version.patch * bnc#778105 - first XEN-PV VM fails to spawn xend: Increase wait time for disk to appear in host bootloader Modified existing xen-domUloader.diff 25752-ACPI-pm-op-valid-cpu.patch 25754-x86-PoD-early-access.patch 25755-x86-PoD-types.patch 25756-x86-MMIO-max-mapped-pfn.patch Security Issue references: * CVE-2012-4539 <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2012-4539 > * CVE-2012-3497 <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2012-3497 > * CVE-2012-4411 <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2012-4411 > * CVE-2012-4535 <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2012-4535 > * CVE-2012-4537 <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2012-4537 > * CVE-2012-4536 <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2012-4536 > * CVE-2012-4538 <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2012-4538 > * CVE-2012-4539 <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2012-4539 > * CVE-2012-4544 <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2012-4544 > Indications: Everyone using XEN should update. Special Instructions and Notes: Please reboot the system after installing this update. Patch Instructions: To install this SUSE Security Update use YaST online_update. Alternatively you can run the command listed for your product: - SUSE Linux Enterprise Software Development Kit 11 SP2: zypper in -t patch sdksp2-xen-201211-7018 - SUSE Linux Enterprise Server 11 SP2 for VMware: zypper in -t patch slessp2-xen-201211-7018 - SUSE Linux Enterprise Server 11 SP2: zypper in -t patch slessp2-xen-201211-7018 - SUSE Linux Enterprise Desktop 11 SP2: zypper in -t patch sledsp2-xen-201211-7018 To bring your system up-to-date, use "zypper patch". Package List: - SUSE Linux Enterprise Software Development Kit 11 SP2 (i586 x86_64): xen-devel-4.1.3_04-0.5.1 - SUSE Linux Enterprise Server 11 SP2 for VMware (i586 x86_64): xen-kmp-trace-4.1.3_04_3.0.42_0.7-0.5.1 - SUSE Linux Enterprise Server 11 SP2 (i586 x86_64): xen-kmp-default-4.1.3_04_3.0.42_0.7-0.5.1 xen-kmp-trace-4.1.3_04_3.0.42_0.7-0.5.1 xen-libs-4.1.3_04-0.5.1 xen-tools-domU-4.1.3_04-0.5.1 - SUSE Linux Enterprise Server 11 SP2 (x86_64): xen-4.1.3_04-0.5.1 xen-doc-html-4.1.3_04-0.5.1 xen-doc-pdf-4.1.3_04-0.5.1 xen-libs-32bit-4.1.3_04-0.5.1 xen-tools-4.1.3_04-0.5.1 - SUSE Linux Enterprise Server 11 SP2 (i586): xen-kmp-pae-4.1.3_04_3.0.42_0.7-0.5.1 - SUSE Linux Enterprise Desktop 11 SP2 (i586 x86_64): xen-kmp-default-4.1.3_04_3.0.42_0.7-0.5.1 xen-kmp-trace-4.1.3_04_3.0.42_0.7-0.5.1 xen-libs-4.1.3_04-0.5.1 xen-tools-domU-4.1.3_04-0.5.1 - SUSE Linux Enterprise Desktop 11 SP2 (x86_64): xen-4.1.3_04-0.5.1 xen-doc-html-4.1.3_04-0.5.1 xen-doc-pdf-4.1.3_04-0.5.1 xen-libs-32bit-4.1.3_04-0.5.1 xen-tools-4.1.3_04-0.5.1 - SUSE Linux Enterprise Desktop 11 SP2 (i586): xen-kmp-pae-4.1.3_04_3.0.42_0.7-0.5.1 References: http://support.novell.com/security/cve/CVE-2012-3497.html http://support.novell.com/security/cve/CVE-2012-4411.html http://support.novell.com/security/cve/CVE-2012-4535.html http://support.novell.com/security/cve/CVE-2012-4536.html http://support.novell.com/security/cve/CVE-2012-4537.html http://support.novell.com/security/cve/CVE-2012-4538.html http://support.novell.com/security/cve/CVE-2012-4539.html http://support.novell.com/security/cve/CVE-2012-4544.html https://bugzilla.novell.com/777890 https://bugzilla.novell.com/778105 https://bugzilla.novell.com/779212 https://bugzilla.novell.com/784087 https://bugzilla.novell.com/786516 https://bugzilla.novell.com/786517 https://bugzilla.novell.com/786518 https://bugzilla.novell.com/786519 https://bugzilla.novell.com/786520 https://bugzilla.novell.com/787163 http://download.novell.com/patch/finder/?keywords=8f87058beb7d6e2bf1940373a… -- To unsubscribe, e-mail: opensuse-security-announce+unsubscribe(a)opensuse.org For additional commands, e-mail: opensuse-security-announce+help(a)opensuse.org

1 0

[security-announce] SUSE-SU-2012:1485-1: important: Security update for flash-player
by opensuse-security＠opensuse.org 15 Nov '12

15 Nov '12

SUSE Security Update: Security update for flash-player ______________________________________________________________________________ Announcement ID: SUSE-SU-2012:1485-1 Rating: important References: #788450 Cross-References: CVE-2012-5274 CVE-2012-5275 CVE-2012-5276 CVE-2012-5277 CVE-2012-5278 CVE-2012-5279 CVE-2012-5280 Affected Products: SUSE Linux Enterprise Desktop 11 SP2 SUSE Linux Enterprise Desktop 10 SP4 ______________________________________________________________________________ An update that fixes 7 vulnerabilities is now available. It includes one version update. Description: This update of flash-player fixes multiple (unspecified) buffer overflows, memory corruptions and other security-related issues. Security Issue references: * CVE-2012-5274 <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2012-5274 > * CVE-2012-5275 <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2012-5275 > * CVE-2012-5276 <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2012-5276 > * CVE-2012-5277 <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2012-5277 > * CVE-2012-5278 <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2012-5278 > * CVE-2012-5279 <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2012-5279 > * CVE-2012-5280 <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2012-5280 > Patch Instructions: To install this SUSE Security Update use YaST online_update. Alternatively you can run the command listed for your product: - SUSE Linux Enterprise Desktop 11 SP2: zypper in -t patch sledsp2-flash-player-7038 To bring your system up-to-date, use "zypper patch". Package List: - SUSE Linux Enterprise Desktop 11 SP2 (i586 x86_64) [New Version: 11.2.202.251]: flash-player-11.2.202.251-0.3.1 - SUSE Linux Enterprise Desktop 10 SP4 (i586) [New Version: 11.2.202.251]: flash-player-11.2.202.251-0.5.1 References: http://support.novell.com/security/cve/CVE-2012-5274.html http://support.novell.com/security/cve/CVE-2012-5275.html http://support.novell.com/security/cve/CVE-2012-5276.html http://support.novell.com/security/cve/CVE-2012-5277.html http://support.novell.com/security/cve/CVE-2012-5278.html http://support.novell.com/security/cve/CVE-2012-5279.html http://support.novell.com/security/cve/CVE-2012-5280.html https://bugzilla.novell.com/788450 http://download.novell.com/patch/finder/?keywords=2704cd8e916c14e8d622e5409… http://download.novell.com/patch/finder/?keywords=8a2ea2251ceaffe0fb0d2fb28… -- To unsubscribe, e-mail: opensuse-security-announce+unsubscribe(a)opensuse.org For additional commands, e-mail: opensuse-security-announce+help(a)opensuse.org

1 0

[security-announce] openSUSE-SU-2012:1481-1: important: opera to 12.10
by opensuse-security＠opensuse.org 14 Nov '12

14 Nov '12

openSUSE Security Update: opera to 12.10 ______________________________________________________________________________ Announcement ID: openSUSE-SU-2012:1481-1 Rating: important References: #788321 Affected Products: openSUSE 12.2 openSUSE 12.1 ______________________________________________________________________________ An update that contains security fixes can now be installed. Description: This Opera 12.10 security update fixes following security issues: -an issue that could cause Opera not to correctly check for certificate revocation; -an issue where CORS requests could incorrectly retrieve contents of cross origin pages; -an issue where data URIs could be used to facilitate Cross-Site Scripting; -a high severity issue, as reported by Gareth Heyes; details will be disclosed at a later date -an issue where specially crafted SVG images could allow execution of arbitrary code; -a moderate severity issue, as reported by the Google Security Group; details will be disclosed at a later date Full changelog available at: http://www.opera.com/docs/changelogs/unix/1210 Patch Instructions: To install this openSUSE Security Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE 12.2: zypper in -t patch openSUSE-2012-777 - openSUSE 12.1: zypper in -t patch openSUSE-2012-777 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE 12.2 (i586 x86_64): opera-12.10-6.1 opera-gtk-12.10-6.1 opera-kde4-12.10-6.1 - openSUSE 12.1 (i586 x86_64): opera-12.10-26.1 opera-gtk-12.10-26.1 opera-kde4-12.10-26.1 References: https://bugzilla.novell.com/788321 -- To unsubscribe, e-mail: opensuse-security-announce+unsubscribe(a)opensuse.org For additional commands, e-mail: opensuse-security-announce+help(a)opensuse.org

1 0

[security-announce] openSUSE-SU-2012:1480-1: important: flash-player: Update to 11.2.202.251
by opensuse-security＠opensuse.org 14 Nov '12

14 Nov '12

openSUSE Security Update: flash-player: Update to 11.2.202.251 ______________________________________________________________________________ Announcement ID: openSUSE-SU-2012:1480-1 Rating: important References: #788450 Cross-References: CVE-2012-5274 CVE-2012-5275 CVE-2012-5276 CVE-2012-5277 CVE-2012-5278 CVE-2012-5279 CVE-2012-5280 Affected Products: openSUSE 12.1 ______________________________________________________________________________ An update that fixes 7 vulnerabilities is now available. Description: Flash Player was updated to 11.2.202.251 (bnc#788450), fixing severe security issues: * CVE-2012-5274, CVE-2012-5275, CVE-2012-5276, CVE-2012-5277, CVE-2012-5278, CVE-2012-5279, CVE-2012-5280 Patch Instructions: To install this openSUSE Security Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE 12.1: zypper in -t patch openSUSE-2012-776 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE 12.1 (i586 x86_64): flash-player-11.2.202.251-34.1 flash-player-gnome-11.2.202.251-34.1 flash-player-kde4-11.2.202.251-34.1 References: http://support.novell.com/security/cve/CVE-2012-5274.html http://support.novell.com/security/cve/CVE-2012-5275.html http://support.novell.com/security/cve/CVE-2012-5276.html http://support.novell.com/security/cve/CVE-2012-5277.html http://support.novell.com/security/cve/CVE-2012-5278.html http://support.novell.com/security/cve/CVE-2012-5279.html http://support.novell.com/security/cve/CVE-2012-5280.html https://bugzilla.novell.com/788450 -- To unsubscribe, e-mail: opensuse-security-announce+unsubscribe(a)opensuse.org For additional commands, e-mail: opensuse-security-announce+help(a)opensuse.org

1 0

[security-announce] openSUSE-SU-2012:1461-1: important: update for cgit
by opensuse-security＠opensuse.org 12 Nov '12

12 Nov '12

openSUSE Security Update: update for cgit ______________________________________________________________________________ Announcement ID: openSUSE-SU-2012:1461-1 Rating: important References: #787074 Cross-References: CVE-2012-4548 Affected Products: openSUSE 12.1 ______________________________________________________________________________ An update that fixes one vulnerability is now available. Description: Specially-crafted commits can cause code to be executed on the clients due to improperly quoted arguments. Patch Instructions: To install this openSUSE Security Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE 12.1: zypper in -t patch openSUSE-2012-765 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE 12.1 (i586 x86_64): cgit-0.9.0.2-9.4.1 cgit-debuginfo-0.9.0.2-9.4.1 cgit-debugsource-0.9.0.2-9.4.1 References: http://support.novell.com/security/cve/CVE-2012-4548.html https://bugzilla.novell.com/787074 -- To unsubscribe, e-mail: opensuse-security-announce+unsubscribe(a)opensuse.org For additional commands, e-mail: opensuse-security-announce+help(a)opensuse.org

1 0

[security-announce] openSUSE-SU-2012:1460-1: important: update for cgit
by opensuse-security＠opensuse.org 12 Nov '12

12 Nov '12

openSUSE Security Update: update for cgit ______________________________________________________________________________ Announcement ID: openSUSE-SU-2012:1460-1 Rating: important References: #787074 Cross-References: CVE-2012-4548 Affected Products: openSUSE 12.2 ______________________________________________________________________________ An update that fixes one vulnerability is now available. Description: Specially-crafted commits can cause code to be executed on the clients due to improperly quoted arguments. Patch Instructions: To install this openSUSE Security Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE 12.2: zypper in -t patch openSUSE-2012-764 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE 12.2 (i586 x86_64): cgit-0.9.0.2-14.4.1 cgit-debuginfo-0.9.0.2-14.4.1 cgit-debugsource-0.9.0.2-14.4.1 References: http://support.novell.com/security/cve/CVE-2012-4548.html https://bugzilla.novell.com/787074 -- To unsubscribe, e-mail: opensuse-security-announce+unsubscribe(a)opensuse.org For additional commands, e-mail: opensuse-security-announce+help(a)opensuse.org

1 0