June 2014 - openSUSE Security Announce

[security-announce] SUSE-SU-2014:0806-1: important: Security update for flash-player
by opensuse-security＠opensuse.org 17 Jun '14

17 Jun '14

SUSE Security Update: Security update for flash-player ______________________________________________________________________________ Announcement ID: SUSE-SU-2014:0806-1 Rating: important References: #882187 Cross-References: CVE-2014-0531 CVE-2014-0532 CVE-2014-0533 CVE-2014-0534 CVE-2014-0535 CVE-2014-0536 Affected Products: SUSE Linux Enterprise Desktop 11 SP3 ______________________________________________________________________________ An update that fixes 6 vulnerabilities is now available. It includes one version update. Description: flash-player was updated to version 11.2.202.378 to fix the following security issues: * Cross-site-scripting vulnerabilities. (CVE-2014-0531, CVE-2014-0532, CVE-2014-0533) * Security bypass vulnerabilities. (CVE-2014-0534, CVE-2014-0535) * Memory corruption vulnerability that could result in arbitrary code execution. (CVE-2014-0536) More information can be found at http://helpx.adobe.com/security/products/flash-player/apsb14-16.html <http://helpx.adobe.com/security/products/flash-player/apsb14-16.html> . Security Issues references: * CVE-2014-0531 <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-0531> * CVE-2014-0532 <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-0532> * CVE-2014-0533 <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-0533> * CVE-2014-0534 <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-0534> * CVE-2014-0535 <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-0535> * CVE-2014-0536 <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-0536> Patch Instructions: To install this SUSE Security Update use YaST online_update. Alternatively you can run the command listed for your product: - SUSE Linux Enterprise Desktop 11 SP3: zypper in -t patch sledsp3-flash-player-9373 To bring your system up-to-date, use "zypper patch". Package List: - SUSE Linux Enterprise Desktop 11 SP3 (i586 x86_64) [New Version: 11.2.202.378]: flash-player-11.2.202.378-0.3.1 flash-player-gnome-11.2.202.378-0.3.1 flash-player-kde4-11.2.202.378-0.3.1 References: http://support.novell.com/security/cve/CVE-2014-0531.html http://support.novell.com/security/cve/CVE-2014-0532.html http://support.novell.com/security/cve/CVE-2014-0533.html http://support.novell.com/security/cve/CVE-2014-0534.html http://support.novell.com/security/cve/CVE-2014-0535.html http://support.novell.com/security/cve/CVE-2014-0536.html https://bugzilla.novell.com/882187 http://download.suse.com/patch/finder/?keywords=3f55be6c119b579f05c8516f6f0… -- To unsubscribe, e-mail: opensuse-security-announce+unsubscribe(a)opensuse.org For additional commands, e-mail: opensuse-security-announce+help(a)opensuse.org

1 0

[security-announce] SUSE-SU-2014:0800-1: important: Security update for GnuTLS
by opensuse-security＠opensuse.org 16 Jun '14

16 Jun '14

SUSE Security Update: Security update for GnuTLS ______________________________________________________________________________ Announcement ID: SUSE-SU-2014:0800-1 Rating: important References: #554084 #670152 #802651 #880730 #880910 Cross-References: CVE-2013-1619 CVE-2014-3466 CVE-2014-3467 CVE-2014-3468 CVE-2014-3469 Affected Products: SUSE CORE 9 ______________________________________________________________________________ An update that fixes 5 vulnerabilities is now available. Description: GnuTLS has been patched to ensure proper parsing of session ids during the TLS/SSL handshake. Additionally three issues inherited from libtasn1 have been fixed. Further information is available at http://www.gnutls.org/security.html#GNUTLS-SA-2014-3 <http://www.gnutls.org/security.html#GNUTLS-SA-2014-3> These security issues have been fixed: * Possible memory corruption during connect (CVE-2014-3466) * Multiple boundary check issues could allow DoS (CVE-2014-3467) * asn1_get_bit_der() can return negative bit length (CVE-2014-3468) * Possible DoS by NULL pointer dereference (CVE-2014-3469) * Possible timing side-channel attack (Lucky 13) (CVE-2013-1619) One additional bug has been fixed: * Allow unsafe renegotiation (bnc#554084) Security Issue references: * CVE-2014-3466 <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-3466> * CVE-2014-3467 <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-3467> * CVE-2014-3468 <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-3468> * CVE-2014-3469 <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-3469> * CVE-2013-1619 <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2013-1619> Package List: - SUSE CORE 9 (i586 s390 s390x x86_64): gnutls-1.0.8-26.32 gnutls-devel-1.0.8-26.32 References: http://support.novell.com/security/cve/CVE-2013-1619.html http://support.novell.com/security/cve/CVE-2014-3466.html http://support.novell.com/security/cve/CVE-2014-3467.html http://support.novell.com/security/cve/CVE-2014-3468.html http://support.novell.com/security/cve/CVE-2014-3469.html https://bugzilla.novell.com/554084 https://bugzilla.novell.com/670152 https://bugzilla.novell.com/802651 https://bugzilla.novell.com/880730 https://bugzilla.novell.com/880910 http://download.suse.com/patch/finder/?keywords=144b31fbd95bc788b66959b55ef… -- To unsubscribe, e-mail: opensuse-security-announce+unsubscribe(a)opensuse.org For additional commands, e-mail: opensuse-security-announce+help(a)opensuse.org

1 0

[security-announce] openSUSE-SU-2014:0797-1: critical: Mozilla updates 2014/06
by opensuse-security＠opensuse.org 16 Jun '14

16 Jun '14

openSUSE Security Update: Mozilla updates 2014/06 ______________________________________________________________________________ Announcement ID: openSUSE-SU-2014:0797-1 Rating: critical References: #881874 Cross-References: CVE-2014-1533 CVE-2014-1534 CVE-2014-1536 CVE-2014-1537 CVE-2014-1538 CVE-2014-1541 CVE-2014-1545 Affected Products: openSUSE 11.4 ______________________________________________________________________________ An update that fixes 7 vulnerabilities is now available. Description: These updates contain the latest security and maintenance updates for - Mozilla Firefox 24.6esr - Mozilla Thunderbird 24.6 - Mozilla NSPR is also updated to 4.10.6 to fix * MFSA 2014-48/CVE-2014-1533/CVE-2014-1534 Miscellaneous memory safety hazards * MFSA 2014-49/CVE-2014-1536/CVE-2014-1537/CVE-2014-1538 Use-after-free and out of bounds issues found using Address Sanitizer * MFSA 2014-52/CVE-2014-1541 Use-after-free with SMIL Animation Controller * MFSA 2014-55/CVE-2014-1545 Out of bounds write in NSPR Patch Instructions: To install this openSUSE Security Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE 11.4: zypper in -t patch 2014-64 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE 11.4 (i586 x86_64): MozillaFirefox-24.6.0-115.1 MozillaFirefox-branding-upstream-24.6.0-115.1 MozillaFirefox-buildsymbols-24.6.0-115.1 MozillaFirefox-debuginfo-24.6.0-115.1 MozillaFirefox-debugsource-24.6.0-115.1 MozillaFirefox-devel-24.6.0-115.1 MozillaFirefox-translations-common-24.6.0-115.1 MozillaFirefox-translations-other-24.6.0-115.1 MozillaThunderbird-24.6.0-97.1 MozillaThunderbird-buildsymbols-24.6.0-97.1 MozillaThunderbird-debuginfo-24.6.0-97.1 MozillaThunderbird-debugsource-24.6.0-97.1 MozillaThunderbird-devel-24.6.0-97.1 MozillaThunderbird-translations-common-24.6.0-97.1 MozillaThunderbird-translations-other-24.6.0-97.1 enigmail-1.6.0+24.6.0-97.1 mozilla-nspr-4.10.6-44.1 mozilla-nspr-debuginfo-4.10.6-44.1 mozilla-nspr-debugsource-4.10.6-44.1 mozilla-nspr-devel-4.10.6-44.1 - openSUSE 11.4 (x86_64): mozilla-nspr-32bit-4.10.6-44.1 mozilla-nspr-debuginfo-32bit-4.10.6-44.1 - openSUSE 11.4 (ia64): mozilla-nspr-debuginfo-x86-4.10.6-44.1 mozilla-nspr-x86-4.10.6-44.1 References: http://support.novell.com/security/cve/CVE-2014-1533.html http://support.novell.com/security/cve/CVE-2014-1534.html http://support.novell.com/security/cve/CVE-2014-1536.html http://support.novell.com/security/cve/CVE-2014-1537.html http://support.novell.com/security/cve/CVE-2014-1538.html http://support.novell.com/security/cve/CVE-2014-1541.html http://support.novell.com/security/cve/CVE-2014-1545.html https://bugzilla.novell.com/881874 -- To unsubscribe, e-mail: opensuse-security-announce+unsubscribe(a)opensuse.org For additional commands, e-mail: opensuse-security-announce+help(a)opensuse.org

1 0

[security-announce] SUSE-SU-2014:0796-1: important: Security update for Linux Kernel
by opensuse-security＠opensuse.org 14 Jun '14

14 Jun '14

SUSE Security Update: Security update for Linux Kernel ______________________________________________________________________________ Announcement ID: SUSE-SU-2014:0796-1 Rating: important References: #880892 Cross-References: CVE-2014-3153 Affected Products: SUSE Linux Enterprise Real Time Extension 11 SP3 ______________________________________________________________________________ An update that fixes one vulnerability is now available. It includes one version update. Description: The SUSE Linux Enterprise 11 Service Pack 3 RealTime Extension kernel was updated to fix a critical privilege escalation security issue: * CVE-2014-3153: The futex acquisition code in kernel/futex.c can be used to gain ring0 access via the futex syscall. This could be used for privilege escalation by non-root users. (bnc#880892) Security Issue reference: * CVE-2014-3153 <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-3153> Indications: Everyone using the Real Time Linux Kernel on x86_64 architecture should update. Special Instructions and Notes: Please reboot the system after installing this update. Patch Instructions: To install this SUSE Security Update use YaST online_update. Alternatively you can run the command listed for your product: - SUSE Linux Enterprise Real Time Extension 11 SP3: zypper in -t patch slertesp3-kernel-9337 To bring your system up-to-date, use "zypper patch". Package List: - SUSE Linux Enterprise Real Time Extension 11 SP3 (x86_64) [New Version: 3.0.101.rt130]: cluster-network-kmp-rt-1.4_3.0.101_rt130_0.18-2.27.69 cluster-network-kmp-rt_trace-1.4_3.0.101_rt130_0.18-2.27.69 drbd-kmp-rt-8.4.4_3.0.101_rt130_0.18-0.22.35 drbd-kmp-rt_trace-8.4.4_3.0.101_rt130_0.18-0.22.35 iscsitarget-kmp-rt-1.4.20_3.0.101_rt130_0.18-0.38.54 iscsitarget-kmp-rt_trace-1.4.20_3.0.101_rt130_0.18-0.38.54 kernel-rt-3.0.101.rt130-0.18.1 kernel-rt-base-3.0.101.rt130-0.18.1 kernel-rt-devel-3.0.101.rt130-0.18.1 kernel-rt_trace-3.0.101.rt130-0.18.1 kernel-rt_trace-base-3.0.101.rt130-0.18.1 kernel-rt_trace-devel-3.0.101.rt130-0.18.1 kernel-source-rt-3.0.101.rt130-0.18.1 kernel-syms-rt-3.0.101.rt130-0.18.1 lttng-modules-kmp-rt-2.1.1_3.0.101_rt130_0.18-0.11.47 lttng-modules-kmp-rt_trace-2.1.1_3.0.101_rt130_0.18-0.11.47 ocfs2-kmp-rt-1.6_3.0.101_rt130_0.18-0.20.69 ocfs2-kmp-rt_trace-1.6_3.0.101_rt130_0.18-0.20.69 ofed-kmp-rt-1.5.4.1_3.0.101_rt130_0.18-0.13.60 ofed-kmp-rt_trace-1.5.4.1_3.0.101_rt130_0.18-0.13.60 References: http://support.novell.com/security/cve/CVE-2014-3153.html https://bugzilla.novell.com/880892 http://download.suse.com/patch/finder/?keywords=b12b838c3802187f1ccd4d35cb7… -- To unsubscribe, e-mail: opensuse-security-announce+unsubscribe(a)opensuse.org For additional commands, e-mail: opensuse-security-announce+help(a)opensuse.org

1 0

[security-announce] SUSE-SU-2014:0788-2: important: Security update for GnuTLS
by opensuse-security＠opensuse.org 13 Jun '14

13 Jun '14

SUSE Security Update: Security update for GnuTLS ______________________________________________________________________________ Announcement ID: SUSE-SU-2014:0788-2 Rating: important References: #880730 #880910 Cross-References: CVE-2014-3466 CVE-2014-3467 CVE-2014-3468 CVE-2014-3469 Affected Products: SUSE Linux Enterprise Server 10 SP4 LTSS SUSE Linux Enterprise Server 10 SP3 LTSS ______________________________________________________________________________ An update that fixes four vulnerabilities is now available. Description: GnuTLS has been patched to ensure proper parsing of session ids during the TLS/SSL handshake. Additionally three issues inherited from libtasn1 have been fixed. Further information is available at http://www.gnutls.org/security.html#GNUTLS-SA-2014-3 <http://www.gnutls.org/security.html#GNUTLS-SA-2014-3> These security issues have been fixed: * Possible memory corruption during connect (CVE-2014-3466) * Multiple boundary check issues could allow DoS (CVE-2014-3467) * asn1_get_bit_der() can return negative bit length (CVE-2014-3468) * Possible DoS by NULL pointer dereference (CVE-2014-3469) Security Issue references: * CVE-2014-3466 <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-3466> Package List: - SUSE Linux Enterprise Server 10 SP4 LTSS (i586 s390x x86_64): gnutls-1.2.10-13.40.1 gnutls-devel-1.2.10-13.40.1 - SUSE Linux Enterprise Server 10 SP4 LTSS (s390x x86_64): gnutls-32bit-1.2.10-13.40.1 gnutls-devel-32bit-1.2.10-13.40.1 - SUSE Linux Enterprise Server 10 SP3 LTSS (i586 s390x x86_64): gnutls-1.2.10-13.40.1 gnutls-devel-1.2.10-13.40.1 - SUSE Linux Enterprise Server 10 SP3 LTSS (s390x x86_64): gnutls-32bit-1.2.10-13.40.1 gnutls-devel-32bit-1.2.10-13.40.1 References: http://support.novell.com/security/cve/CVE-2014-3466.html http://support.novell.com/security/cve/CVE-2014-3467.html http://support.novell.com/security/cve/CVE-2014-3468.html http://support.novell.com/security/cve/CVE-2014-3469.html https://bugzilla.novell.com/880730 https://bugzilla.novell.com/880910 http://download.suse.com/patch/finder/?keywords=3a664138948d527c37403de9fef… http://download.suse.com/patch/finder/?keywords=ce2995d7d37c598d89a8e91d407… -- To unsubscribe, e-mail: opensuse-security-announce+unsubscribe(a)opensuse.org For additional commands, e-mail: opensuse-security-announce+help(a)opensuse.org

1 0

[security-announce] SUSE-SU-2014:0758-2: important: Security update for GnuTLS
by opensuse-security＠opensuse.org 13 Jun '14

13 Jun '14

SUSE Security Update: Security update for GnuTLS ______________________________________________________________________________ Announcement ID: SUSE-SU-2014:0758-2 Rating: important References: #880730 #880910 Cross-References: CVE-2014-3466 Affected Products: SUSE Manager 1.7 for SLE 11 SP2 ______________________________________________________________________________ An update that solves one vulnerability and has one errata is now available. Description: GnuTLS has been patched to ensure proper parsing of session ids during the TLS/SSL handshake. Additionally three issues inherited from libtasn1 have been fixed. Further information is available at http://www.gnutls.org/security.html#GNUTLS-SA-2014-3 <http://www.gnutls.org/security.html#GNUTLS-SA-2014-3> These security issues have been fixed: * Possible memory corruption during connect (CVE-2014-3466) * Multiple boundary check issues could allow DoS (CVE-2014-3467) * asn1_get_bit_der() can return negative bit length (CVE-2014-3468) * Possible DoS by NULL pointer dereference (CVE-2014-3469) Security Issue references: * CVE-2014-3466 <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-3466> Patch Instructions: To install this SUSE Security Update use YaST online_update. Alternatively you can run the command listed for your product: - SUSE Manager 1.7 for SLE 11 SP2: zypper in -t patch sleman17sp2-gnutls-9319 To bring your system up-to-date, use "zypper patch". Package List: - SUSE Manager 1.7 for SLE 11 SP2 (x86_64): gnutls-2.4.1-24.39.51.1 libgnutls-extra26-2.4.1-24.39.51.1 libgnutls26-2.4.1-24.39.51.1 libgnutls26-32bit-2.4.1-24.39.51.1 References: http://support.novell.com/security/cve/CVE-2014-3466.html https://bugzilla.novell.com/880730 https://bugzilla.novell.com/880910 http://download.suse.com/patch/finder/?keywords=5dcca3466e06512dc053e91637a… -- To unsubscribe, e-mail: opensuse-security-announce+unsubscribe(a)opensuse.org For additional commands, e-mail: opensuse-security-announce+help(a)opensuse.org

1 0

[security-announce] SUSE-SU-2014:0788-1: important: Security update for GnuTLS
by opensuse-security＠opensuse.org 12 Jun '14

12 Jun '14

SUSE Security Update: Security update for GnuTLS ______________________________________________________________________________ Announcement ID: SUSE-SU-2014:0788-1 Rating: important References: #880730 #880910 Cross-References: CVE-2014-3466 CVE-2014-3467 CVE-2014-3468 CVE-2014-3469 Affected Products: SUSE Linux Enterprise Server 11 SP2 LTSS SUSE Linux Enterprise Server 11 SP1 LTSS ______________________________________________________________________________ An update that fixes four vulnerabilities is now available. Description: GnuTLS was patched to ensure proper parsing of session ids during the TLS/SSL handshake. Additionally three issues inherited from libtasn1 were fixed. * Possible memory corruption during connect. (CVE-2014-3466) * Multiple boundary check issues could allow DoS. (CVE-2014-3467) * asn1_get_bit_der() can return negative bit length. (CVE-2014-3468) * Possible DoS by NULL pointer dereference. (CVE-2014-3469) Further information is available at http://www.gnutls.org/security.html#GNUTLS-SA-2014-3 <http://www.gnutls.org/security.html#GNUTLS-SA-2014-3> . Security Issues references: * CVE-2014-3466 <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-3466> * CVE-2014-3467 <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-3467> * CVE-2014-3468 <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-3468> * CVE-2014-3469 <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-3469> Patch Instructions: To install this SUSE Security Update use YaST online_update. Alternatively you can run the command listed for your product: - SUSE Linux Enterprise Server 11 SP2 LTSS: zypper in -t patch slessp2-gnutls-9352 - SUSE Linux Enterprise Server 11 SP1 LTSS: zypper in -t patch slessp1-gnutls-9353 To bring your system up-to-date, use "zypper patch". Package List: - SUSE Linux Enterprise Server 11 SP2 LTSS (i586 s390x x86_64): gnutls-2.4.1-24.39.53.1 libgnutls-extra26-2.4.1-24.39.53.1 libgnutls26-2.4.1-24.39.53.1 - SUSE Linux Enterprise Server 11 SP2 LTSS (s390x x86_64): libgnutls26-32bit-2.4.1-24.39.53.1 - SUSE Linux Enterprise Server 11 SP1 LTSS (i586 s390x x86_64): gnutls-2.4.1-24.39.53.1 libgnutls-extra26-2.4.1-24.39.53.1 libgnutls26-2.4.1-24.39.53.1 - SUSE Linux Enterprise Server 11 SP1 LTSS (s390x x86_64): libgnutls26-32bit-2.4.1-24.39.53.1 References: http://support.novell.com/security/cve/CVE-2014-3466.html http://support.novell.com/security/cve/CVE-2014-3467.html http://support.novell.com/security/cve/CVE-2014-3468.html http://support.novell.com/security/cve/CVE-2014-3469.html https://bugzilla.novell.com/880730 https://bugzilla.novell.com/880910 http://download.suse.com/patch/finder/?keywords=04989b49e84d0e055f6a4e5b3d4… http://download.suse.com/patch/finder/?keywords=3cb2688e28e1b5b12a8cc0b5b25… -- To unsubscribe, e-mail: opensuse-security-announce+unsubscribe(a)opensuse.org For additional commands, e-mail: opensuse-security-announce+help(a)opensuse.org

1 0

[security-announce] SUSE-SU-2014:0775-1: critical: Security update for Linux Kernel
by opensuse-security＠opensuse.org 11 Jun '14

11 Jun '14

SUSE Security Update: Security update for Linux Kernel ______________________________________________________________________________ Announcement ID: SUSE-SU-2014:0775-1 Rating: critical References: #880892 Cross-References: CVE-2014-3153 Affected Products: SUSE Linux Enterprise Server 11 SP3 for VMware SUSE Linux Enterprise Server 11 SP3 SUSE Linux Enterprise High Availability Extension 11 SP3 SUSE Linux Enterprise Desktop 11 SP3 SLE 11 SERVER Unsupported Extras ______________________________________________________________________________ An update that fixes one vulnerability is now available. It includes one version update. Description: The SUSE Linux Enterprise 11 Service Pack 3 kernel was updated to fix a critical privilege escalation security issue: * CVE-2014-3153: The futex acquisition code in kernel/futex.c can be used to gain ring0 access via the futex syscall. This could be used for privilege escalation by non-root users. (bnc#880892) Security Issue reference: * CVE-2014-3153 <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-3153> Indications: Everyone using the Linux Kernel on x86_64 architecture should update. Special Instructions and Notes: Please reboot the system after installing this update. Patch Instructions: To install this SUSE Security Update use YaST online_update. Alternatively you can run the command listed for your product: - SUSE Linux Enterprise Server 11 SP3 for VMware: zypper in -t patch slessp3-kernel-9328 slessp3-kernel-9329 - SUSE Linux Enterprise Server 11 SP3: zypper in -t patch slessp3-kernel-9328 slessp3-kernel-9329 slessp3-kernel-9330 slessp3-kernel-9331 slessp3-kernel-9346 - SUSE Linux Enterprise High Availability Extension 11 SP3: zypper in -t patch slehasp3-kernel-9328 slehasp3-kernel-9329 slehasp3-kernel-9330 slehasp3-kernel-9331 slehasp3-kernel-9346 - SUSE Linux Enterprise Desktop 11 SP3: zypper in -t patch sledsp3-kernel-9328 sledsp3-kernel-9329 To bring your system up-to-date, use "zypper patch". Package List: - SUSE Linux Enterprise Server 11 SP3 for VMware (i586 x86_64) [New Version: 3.0.101]: kernel-default-3.0.101-0.31.1 kernel-default-base-3.0.101-0.31.1 kernel-default-devel-3.0.101-0.31.1 kernel-source-3.0.101-0.31.1 kernel-syms-3.0.101-0.31.1 kernel-trace-3.0.101-0.31.1 kernel-trace-base-3.0.101-0.31.1 kernel-trace-devel-3.0.101-0.31.1 kernel-xen-devel-3.0.101-0.31.1 - SUSE Linux Enterprise Server 11 SP3 for VMware (i586) [New Version: 3.0.101]: kernel-pae-3.0.101-0.31.1 kernel-pae-base-3.0.101-0.31.1 kernel-pae-devel-3.0.101-0.31.1 - SUSE Linux Enterprise Server 11 SP3 (i586 ia64 ppc64 s390x x86_64) [New Version: 3.0.101]: kernel-default-3.0.101-0.31.1 kernel-default-base-3.0.101-0.31.1 kernel-default-devel-3.0.101-0.31.1 kernel-source-3.0.101-0.31.1 kernel-syms-3.0.101-0.31.1 kernel-trace-3.0.101-0.31.1 kernel-trace-base-3.0.101-0.31.1 kernel-trace-devel-3.0.101-0.31.1 - SUSE Linux Enterprise Server 11 SP3 (i586 x86_64) [New Version: 3.0.101]: kernel-ec2-3.0.101-0.31.1 kernel-ec2-base-3.0.101-0.31.1 kernel-ec2-devel-3.0.101-0.31.1 kernel-xen-3.0.101-0.31.1 kernel-xen-base-3.0.101-0.31.1 kernel-xen-devel-3.0.101-0.31.1 xen-kmp-default-4.2.4_02_3.0.101_0.31-0.7.33 - SUSE Linux Enterprise Server 11 SP3 (s390x) [New Version: 3.0.101]: kernel-default-man-3.0.101-0.31.1 - SUSE Linux Enterprise Server 11 SP3 (ppc64) [New Version: 3.0.101]: kernel-ppc64-3.0.101-0.31.1 kernel-ppc64-base-3.0.101-0.31.1 kernel-ppc64-devel-3.0.101-0.31.1 - SUSE Linux Enterprise Server 11 SP3 (i586) [New Version: 3.0.101]: kernel-pae-3.0.101-0.31.1 kernel-pae-base-3.0.101-0.31.1 kernel-pae-devel-3.0.101-0.31.1 xen-kmp-pae-4.2.4_02_3.0.101_0.31-0.7.33 - SUSE Linux Enterprise High Availability Extension 11 SP3 (i586 ia64 ppc64 s390x x86_64): cluster-network-kmp-default-1.4_3.0.101_0.31-2.27.69 cluster-network-kmp-trace-1.4_3.0.101_0.31-2.27.69 gfs2-kmp-default-2_3.0.101_0.31-0.16.75 gfs2-kmp-trace-2_3.0.101_0.31-0.16.75 ocfs2-kmp-default-1.6_3.0.101_0.31-0.20.69 ocfs2-kmp-trace-1.6_3.0.101_0.31-0.20.69 - SUSE Linux Enterprise High Availability Extension 11 SP3 (i586 x86_64): cluster-network-kmp-xen-1.4_3.0.101_0.31-2.27.69 gfs2-kmp-xen-2_3.0.101_0.31-0.16.75 ocfs2-kmp-xen-1.6_3.0.101_0.31-0.20.69 - SUSE Linux Enterprise High Availability Extension 11 SP3 (ppc64): cluster-network-kmp-ppc64-1.4_3.0.101_0.31-2.27.69 gfs2-kmp-ppc64-2_3.0.101_0.31-0.16.75 ocfs2-kmp-ppc64-1.6_3.0.101_0.31-0.20.69 - SUSE Linux Enterprise High Availability Extension 11 SP3 (i586): cluster-network-kmp-pae-1.4_3.0.101_0.31-2.27.69 gfs2-kmp-pae-2_3.0.101_0.31-0.16.75 ocfs2-kmp-pae-1.6_3.0.101_0.31-0.20.69 - SUSE Linux Enterprise Desktop 11 SP3 (i586 x86_64) [New Version: 3.0.101]: kernel-default-3.0.101-0.31.1 kernel-default-base-3.0.101-0.31.1 kernel-default-devel-3.0.101-0.31.1 kernel-default-extra-3.0.101-0.31.1 kernel-source-3.0.101-0.31.1 kernel-syms-3.0.101-0.31.1 kernel-trace-devel-3.0.101-0.31.1 kernel-xen-3.0.101-0.31.1 kernel-xen-base-3.0.101-0.31.1 kernel-xen-devel-3.0.101-0.31.1 kernel-xen-extra-3.0.101-0.31.1 xen-kmp-default-4.2.4_02_3.0.101_0.31-0.7.33 - SUSE Linux Enterprise Desktop 11 SP3 (i586) [New Version: 3.0.101]: kernel-pae-3.0.101-0.31.1 kernel-pae-base-3.0.101-0.31.1 kernel-pae-devel-3.0.101-0.31.1 kernel-pae-extra-3.0.101-0.31.1 xen-kmp-pae-4.2.4_02_3.0.101_0.31-0.7.33 - SLE 11 SERVER Unsupported Extras (i586 ia64 ppc64 s390x x86_64): kernel-default-extra-3.0.101-0.31.1 - SLE 11 SERVER Unsupported Extras (i586 x86_64): kernel-xen-extra-3.0.101-0.31.1 - SLE 11 SERVER Unsupported Extras (ppc64): kernel-ppc64-extra-3.0.101-0.31.1 - SLE 11 SERVER Unsupported Extras (i586): kernel-pae-extra-3.0.101-0.31.1 References: http://support.novell.com/security/cve/CVE-2014-3153.html https://bugzilla.novell.com/880892 http://download.suse.com/patch/finder/?keywords=0cdcfea3b263f03fc7b11c9e27c… http://download.suse.com/patch/finder/?keywords=2394b6ce8b434732566fe3cbf2a… http://download.suse.com/patch/finder/?keywords=5d5df6a9a600dbe5fe09c19d8dc… http://download.suse.com/patch/finder/?keywords=8a869bd2122273831bd282fab23… http://download.suse.com/patch/finder/?keywords=a8f8feb5552e1da3b52f48f677f… http://download.suse.com/patch/finder/?keywords=a9d9490d68822582cd43af9c0c2… http://download.suse.com/patch/finder/?keywords=c905f5237a7e0ae4f9fdf0c325c… http://download.suse.com/patch/finder/?keywords=f6e7ea94e8ad3ddbdf3d897e2a3… http://download.suse.com/patch/finder/?keywords=fab06fd0fffc9ae59673101aeac… http://download.suse.com/patch/finder/?keywords=fd1bf222c9f9ff4cc32dae8bac4… -- To unsubscribe, e-mail: opensuse-security-announce+unsubscribe(a)opensuse.org For additional commands, e-mail: opensuse-security-announce+help(a)opensuse.org

1 0

[security-announce] SUSE-SU-2014:0759-2: critical: Security update for OpenSSL
by opensuse-security＠opensuse.org 06 Jun '14

06 Jun '14

SUSE Security Update: Security update for OpenSSL ______________________________________________________________________________ Announcement ID: SUSE-SU-2014:0759-2 Rating: critical References: #880891 Cross-References: CVE-2014-0221 CVE-2014-0224 CVE-2014-3470 Affected Products: SUSE Linux Enterprise Server 10 SP4 LTSS SUSE Linux Enterprise Server 10 SP3 LTSS ______________________________________________________________________________ An update that fixes three vulnerabilities is now available. Description: OpenSSL was updated to fix the following security vulnerabilities: * SSL/TLS MITM vulnerability. (CVE-2014-0224) * DTLS recursion flaw. (CVE-2014-0221) * Anonymous ECDH denial of service. (CVE-2014-3470) Further information can be found at http://www.openssl.org/news/secadv_20140605.txt <http://www.openssl.org/news/secadv_20140605.txt> . Security Issues references: * CVE-2014-0224 <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-0224> * CVE-2014-0221 <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-0221> * CVE-2014-3470 <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-3470> Package List: - SUSE Linux Enterprise Server 10 SP4 LTSS (i586 s390x x86_64): openssl-0.9.8a-18.82.4 openssl-devel-0.9.8a-18.82.4 openssl-doc-0.9.8a-18.82.4 - SUSE Linux Enterprise Server 10 SP4 LTSS (s390x x86_64): openssl-32bit-0.9.8a-18.82.4 openssl-devel-32bit-0.9.8a-18.82.4 - SUSE Linux Enterprise Server 10 SP3 LTSS (i586 s390x x86_64): openssl-0.9.8a-18.45.77.1 openssl-devel-0.9.8a-18.45.77.1 openssl-doc-0.9.8a-18.45.77.1 - SUSE Linux Enterprise Server 10 SP3 LTSS (s390x x86_64): openssl-32bit-0.9.8a-18.45.77.1 openssl-devel-32bit-0.9.8a-18.45.77.1 References: http://support.novell.com/security/cve/CVE-2014-0221.html http://support.novell.com/security/cve/CVE-2014-0224.html http://support.novell.com/security/cve/CVE-2014-3470.html https://bugzilla.novell.com/880891 http://download.suse.com/patch/finder/?keywords=06090ed98c412d84909da7f9884… http://download.suse.com/patch/finder/?keywords=ae77e66ba2a03bee961e56bc2d1… -- To unsubscribe, e-mail: opensuse-security-announce+unsubscribe(a)opensuse.org For additional commands, e-mail: opensuse-security-announce+help(a)opensuse.org

1 0

[security-announce] SUSE-SU-2014:0769-1: important: Security update for MySQL
by opensuse-security＠opensuse.org 06 Jun '14

06 Jun '14

SUSE Security Update: Security update for MySQL ______________________________________________________________________________ Announcement ID: SUSE-SU-2014:0769-1 Rating: important References: #858823 #861493 #873896 Cross-References: CVE-2013-4316 CVE-2013-5860 CVE-2013-5881 CVE-2013-5882 CVE-2013-5891 CVE-2013-5894 CVE-2013-5908 CVE-2014-0001 CVE-2014-0384 CVE-2014-0386 CVE-2014-0393 CVE-2014-0401 CVE-2014-0402 CVE-2014-0412 CVE-2014-0420 CVE-2014-0427 CVE-2014-0430 CVE-2014-0431 CVE-2014-0433 CVE-2014-0437 CVE-2014-2419 CVE-2014-2430 CVE-2014-2431 CVE-2014-2432 CVE-2014-2434 CVE-2014-2435 CVE-2014-2436 CVE-2014-2438 CVE-2014-2440 CVE-2014-2442 CVE-2014-2444 CVE-2014-2450 CVE-2014-2451 Affected Products: SUSE Linux Enterprise Software Development Kit 11 SP3 SUSE Linux Enterprise Server 11 SP3 for VMware SUSE Linux Enterprise Server 11 SP3 SUSE Linux Enterprise Desktop 11 SP3 ______________________________________________________________________________ An update that fixes 33 vulnerabilities is now available. It includes one version update. Description: MySQL was updated to version 5.5.37 to address various security issues. More information is available at http://www.oracle.com/technetwork/topics/security/cpujan2014-1972949.html#A ppendixMSQL <http://www.oracle.com/technetwork/topics/security/cpujan2014-1972949.html# AppendixMSQL> and http://www.oracle.com/technetwork/topics/security/cpuapr2014-1972952.html#A ppendixMSQL <http://www.oracle.com/technetwork/topics/security/cpuapr2014-1972952.html# AppendixMSQL> . Security Issues references: * CVE-2014-2444 <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-2444> * CVE-2014-2436 <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-2436> * CVE-2014-2440 <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-2440> * CVE-2014-2434 <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-2434> * CVE-2014-2435 <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-2435> * CVE-2014-2442 <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-2442> * CVE-2014-2450 <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-2450> * CVE-2014-2419 <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-2419> * CVE-2014-0384 <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-0384> * CVE-2014-2430 <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-2430> * CVE-2014-2451 <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-2451> * CVE-2014-2438 <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-2438> * CVE-2014-2432 <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-2432> * CVE-2014-2431 <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-2431> * CVE-2013-4316 <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2013-4316> * CVE-2013-5860 <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2013-5860> * CVE-2013-5882 <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2013-5882> * CVE-2014-0433 <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-0433> * CVE-2013-5894 <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2013-5894> * CVE-2013-5881 <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2013-5881> * CVE-2014-0412 <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-0412> * CVE-2014-0402 <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-0402> * CVE-2014-0386 <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-0386> * CVE-2013-5891 <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2013-5891> * CVE-2014-0401 <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-0401> * CVE-2014-0427 <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-0427> * CVE-2014-0431 <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-0431> * CVE-2014-0437 <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-0437> * CVE-2014-0393 <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-0393> * CVE-2014-0430 <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-0430> * CVE-2014-0420 <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-0420> * CVE-2013-5908 <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2013-5908> * CVE-2014-0001 <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-0001> Patch Instructions: To install this SUSE Security Update use YaST online_update. Alternatively you can run the command listed for your product: - SUSE Linux Enterprise Software Development Kit 11 SP3: zypper in -t patch sdksp3-libmysql55client18-9303 - SUSE Linux Enterprise Server 11 SP3 for VMware: zypper in -t patch slessp3-libmysql55client18-9303 - SUSE Linux Enterprise Server 11 SP3: zypper in -t patch slessp3-libmysql55client18-9303 - SUSE Linux Enterprise Desktop 11 SP3: zypper in -t patch sledsp3-libmysql55client18-9303 To bring your system up-to-date, use "zypper patch". Package List: - SUSE Linux Enterprise Software Development Kit 11 SP3 (ppc64 s390x x86_64): libmysql55client_r18-32bit-5.5.37-0.7.1 libmysqlclient_r15-32bit-5.0.96-0.6.11 - SUSE Linux Enterprise Software Development Kit 11 SP3 (ia64): libmysql55client_r18-x86-5.5.37-0.7.1 libmysqlclient_r15-x86-5.0.96-0.6.11 - SUSE Linux Enterprise Server 11 SP3 for VMware (i586 x86_64) [New Version: 5.5.37]: libmysql55client18-5.5.37-0.7.1 libmysql55client_r18-5.5.37-0.7.1 libmysqlclient15-5.0.96-0.6.11 libmysqlclient_r15-5.0.96-0.6.11 mysql-5.5.37-0.7.1 mysql-client-5.5.37-0.7.1 mysql-tools-5.5.37-0.7.1 - SUSE Linux Enterprise Server 11 SP3 for VMware (x86_64) [New Version: 5.5.37]: libmysql55client18-32bit-5.5.37-0.7.1 libmysqlclient15-32bit-5.0.96-0.6.11 - SUSE Linux Enterprise Server 11 SP3 (i586 ia64 ppc64 s390x x86_64) [New Version: 5.5.37]: libmysql55client18-5.5.37-0.7.1 libmysql55client_r18-5.5.37-0.7.1 libmysqlclient15-5.0.96-0.6.11 libmysqlclient_r15-5.0.96-0.6.11 mysql-5.5.37-0.7.1 mysql-client-5.5.37-0.7.1 mysql-tools-5.5.37-0.7.1 - SUSE Linux Enterprise Server 11 SP3 (ppc64 s390x x86_64) [New Version: 5.5.37]: libmysql55client18-32bit-5.5.37-0.7.1 libmysqlclient15-32bit-5.0.96-0.6.11 - SUSE Linux Enterprise Server 11 SP3 (ia64) [New Version: 5.5.37]: libmysql55client18-x86-5.5.37-0.7.1 libmysqlclient15-x86-5.0.96-0.6.11 - SUSE Linux Enterprise Desktop 11 SP3 (i586 x86_64) [New Version: 5.5.37]: libmysql55client18-5.5.37-0.7.1 libmysql55client_r18-5.5.37-0.7.1 libmysqlclient15-5.0.96-0.6.11 libmysqlclient_r15-5.0.96-0.6.11 mysql-5.5.37-0.7.1 mysql-client-5.5.37-0.7.1 - SUSE Linux Enterprise Desktop 11 SP3 (x86_64) [New Version: 5.5.37]: libmysql55client18-32bit-5.5.37-0.7.1 libmysql55client_r18-32bit-5.5.37-0.7.1 libmysqlclient15-32bit-5.0.96-0.6.11 libmysqlclient_r15-32bit-5.0.96-0.6.11 References: http://support.novell.com/security/cve/CVE-2013-4316.html http://support.novell.com/security/cve/CVE-2013-5860.html http://support.novell.com/security/cve/CVE-2013-5881.html http://support.novell.com/security/cve/CVE-2013-5882.html http://support.novell.com/security/cve/CVE-2013-5891.html http://support.novell.com/security/cve/CVE-2013-5894.html http://support.novell.com/security/cve/CVE-2013-5908.html http://support.novell.com/security/cve/CVE-2014-0001.html http://support.novell.com/security/cve/CVE-2014-0384.html http://support.novell.com/security/cve/CVE-2014-0386.html http://support.novell.com/security/cve/CVE-2014-0393.html http://support.novell.com/security/cve/CVE-2014-0401.html http://support.novell.com/security/cve/CVE-2014-0402.html http://support.novell.com/security/cve/CVE-2014-0412.html http://support.novell.com/security/cve/CVE-2014-0420.html http://support.novell.com/security/cve/CVE-2014-0427.html http://support.novell.com/security/cve/CVE-2014-0430.html http://support.novell.com/security/cve/CVE-2014-0431.html http://support.novell.com/security/cve/CVE-2014-0433.html http://support.novell.com/security/cve/CVE-2014-0437.html http://support.novell.com/security/cve/CVE-2014-2419.html http://support.novell.com/security/cve/CVE-2014-2430.html http://support.novell.com/security/cve/CVE-2014-2431.html http://support.novell.com/security/cve/CVE-2014-2432.html http://support.novell.com/security/cve/CVE-2014-2434.html http://support.novell.com/security/cve/CVE-2014-2435.html http://support.novell.com/security/cve/CVE-2014-2436.html http://support.novell.com/security/cve/CVE-2014-2438.html http://support.novell.com/security/cve/CVE-2014-2440.html http://support.novell.com/security/cve/CVE-2014-2442.html http://support.novell.com/security/cve/CVE-2014-2444.html http://support.novell.com/security/cve/CVE-2014-2450.html http://support.novell.com/security/cve/CVE-2014-2451.html https://bugzilla.novell.com/858823 https://bugzilla.novell.com/861493 https://bugzilla.novell.com/873896 http://download.suse.com/patch/finder/?keywords=ab4ffe747d344a455ea19aa1b92… -- To unsubscribe, e-mail: opensuse-security-announce+unsubscribe(a)opensuse.org For additional commands, e-mail: opensuse-security-announce+help(a)opensuse.org

1 0