June 2014 - openSUSE Security Announce

[security-announce] SUSE-SU-2014:0768-1: critical: Security update for OpenSSL
by opensuse-security＠opensuse.org 06 Jun '14

06 Jun '14

SUSE Security Update: Security update for OpenSSL ______________________________________________________________________________ Announcement ID: SUSE-SU-2014:0768-1 Rating: critical References: #459468 #489641 #880891 Cross-References: CVE-2011-4354 CVE-2014-0224 Affected Products: SUSE CORE 9 ______________________________________________________________________________ An update that solves two vulnerabilities and has one errata is now available. Description: OpenSSL was updated to fix the following security vulnerabilities: * SSL/TLS MITM vulnerability. (CVE-2014-0224) * ECC private key can leak on 32 bit platforms. (CVE-2011-4354) Further information can be found at http://www.openssl.org/news/secadv_20140605.txt <http://www.openssl.org/news/secadv_20140605.txt> . Security Issues references: * CVE-2014-0224 <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-0224> * CVE-2011-4354 <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2011-4354> Package List: - SUSE CORE 9 (i586 s390 s390x x86_64): openssl-0.9.7d-15.50 openssl-devel-0.9.7d-15.50 openssl-doc-0.9.7d-15.50 - SUSE CORE 9 (x86_64): openssl-32bit-9-201406041231 openssl-devel-32bit-9-201406041231 - SUSE CORE 9 (s390x): openssl-32bit-9-201406060130 openssl-devel-32bit-9-201406060130 References: http://support.novell.com/security/cve/CVE-2011-4354.html http://support.novell.com/security/cve/CVE-2014-0224.html https://bugzilla.novell.com/459468 https://bugzilla.novell.com/489641 https://bugzilla.novell.com/880891 http://download.suse.com/patch/finder/?keywords=cf56900ecd68d8b418e857ef2c7… -- To unsubscribe, e-mail: opensuse-security-announce+unsubscribe(a)opensuse.org For additional commands, e-mail: opensuse-security-announce+help(a)opensuse.org

1 0

[security-announce] openSUSE-SU-2014:0767-1: important: gnutls: Fixed possible memory corruption
by opensuse-security＠opensuse.org 06 Jun '14

06 Jun '14

openSUSE Security Update: gnutls: Fixed possible memory corruption ______________________________________________________________________________ Announcement ID: openSUSE-SU-2014:0767-1 Rating: important References: #880730 Cross-References: CVE-2014-3466 Affected Products: openSUSE 11.4 ______________________________________________________________________________ An update that fixes one vulnerability is now available. Description: gnutls was patched to fix security vulnerability that could be used to disrupt service or potentially allow remote code execution. - Memory corruption during connect (CVE-2014-3466) - NULL pointer dereference in gnutls_x509_dn_oid_name (CVE-2014-3465) Patch Instructions: To install this openSUSE Security Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE 11.4: zypper in -t patch 2014-59 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE 11.4 (i586 x86_64): gnutls-2.8.6-5.29.1 gnutls-debuginfo-2.8.6-5.29.1 gnutls-debugsource-2.8.6-5.29.1 libgnutls-devel-2.8.6-5.29.1 libgnutls-extra-devel-2.8.6-5.29.1 libgnutls-extra26-2.8.6-5.29.1 libgnutls-extra26-debuginfo-2.8.6-5.29.1 libgnutls26-2.8.6-5.29.1 libgnutls26-debuginfo-2.8.6-5.29.1 - openSUSE 11.4 (x86_64): libgnutls26-32bit-2.8.6-5.29.1 libgnutls26-debuginfo-32bit-2.8.6-5.29.1 - openSUSE 11.4 (ia64): libgnutls26-debuginfo-x86-2.8.6-5.29.1 libgnutls26-x86-2.8.6-5.29.1 References: http://support.novell.com/security/cve/CVE-2014-3466.html https://bugzilla.novell.com/880730 -- To unsubscribe, e-mail: opensuse-security-announce+unsubscribe(a)opensuse.org For additional commands, e-mail: opensuse-security-announce+help(a)opensuse.org

1 0

[security-announce] openSUSE-SU-2014:0765-1: critical: update to version 1.0.0m
by opensuse-security＠opensuse.org 06 Jun '14

06 Jun '14

openSUSE Security Update: update to version 1.0.0m ______________________________________________________________________________ Announcement ID: openSUSE-SU-2014:0765-1 Rating: critical References: #880891 Cross-References: CVE-2014-0195 CVE-2014-0221 CVE-2014-0224 CVE-2014-3470 Affected Products: openSUSE 11.4 ______________________________________________________________________________ An update that fixes four vulnerabilities is now available. Description: The openssl library was updated to version 1.0.0m fixing various security issues and bugs: Security issues fixed: - CVE-2014-0224: Fix for SSL/TLS MITM flaw. An attacker using a carefully crafted handshake can force the use of weak keying material in OpenSSL SSL/TLS clients and servers. - CVE-2014-0221: Fix DTLS recursion flaw. By sending an invalid DTLS handshake to an OpenSSL DTLS client the code can be made to recurse eventually crashing in a DoS attack. - CVE-2014-0195: Fix DTLS invalid fragment vulnerability. A buffer overrun attack can be triggered by sending invalid DTLS fragments to an OpenSSL DTLS client or server. This is potentially exploitable to run arbitrary code on a vulnerable client or server. - CVE-2014-3470: Fix bug in TLS code where clients enable anonymous ECDH ciphersuites are subject to a denial of service attack. Patch Instructions: To install this openSUSE Security Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE 11.4: zypper in -t patch 2014-60 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE 11.4 (i586 x86_64): libopenssl-devel-1.0.0m-18.53.1 libopenssl1_0_0-1.0.0m-18.53.1 libopenssl1_0_0-debuginfo-1.0.0m-18.53.1 openssl-1.0.0m-18.53.1 openssl-debuginfo-1.0.0m-18.53.1 openssl-debugsource-1.0.0m-18.53.1 - openSUSE 11.4 (x86_64): libopenssl1_0_0-32bit-1.0.0m-18.53.1 libopenssl1_0_0-debuginfo-32bit-1.0.0m-18.53.1 - openSUSE 11.4 (noarch): openssl-doc-1.0.0m-18.53.1 - openSUSE 11.4 (ia64): libopenssl1_0_0-debuginfo-x86-1.0.0m-18.53.1 libopenssl1_0_0-x86-1.0.0m-18.53.1 References: http://support.novell.com/security/cve/CVE-2014-0195.html http://support.novell.com/security/cve/CVE-2014-0221.html http://support.novell.com/security/cve/CVE-2014-0224.html http://support.novell.com/security/cve/CVE-2014-3470.html https://bugzilla.novell.com/880891 -- To unsubscribe, e-mail: opensuse-security-announce+unsubscribe(a)opensuse.org For additional commands, e-mail: opensuse-security-announce+help(a)opensuse.org

1 0

[security-announce] openSUSE-SU-2014:0764-1: critical: openssl: update to version 1.0.1h
by opensuse-security＠opensuse.org 06 Jun '14

06 Jun '14

openSUSE Security Update: openssl: update to version 1.0.1h ______________________________________________________________________________ Announcement ID: openSUSE-SU-2014:0764-1 Rating: critical References: #880891 Cross-References: CVE-2014-0195 CVE-2014-0221 CVE-2014-0224 CVE-2014-3470 Affected Products: openSUSE 13.1 openSUSE 12.3 ______________________________________________________________________________ An update that fixes four vulnerabilities is now available. Description: The openssl library was updated to version 1.0.1h fixing various security issues and bugs: Security issues fixed: - CVE-2014-0224: Fix for SSL/TLS MITM flaw. An attacker using a carefully crafted handshake can force the use of weak keying material in OpenSSL SSL/TLS clients and servers. - CVE-2014-0221: Fix DTLS recursion flaw. By sending an invalid DTLS handshake to an OpenSSL DTLS client the code can be made to recurse eventually crashing in a DoS attack. - CVE-2014-0195: Fix DTLS invalid fragment vulnerability. A buffer overrun attack can be triggered by sending invalid DTLS fragments to an OpenSSL DTLS client or server. This is potentially exploitable to run arbitrary code on a vulnerable client or server. - CVE-2014-3470: Fix bug in TLS code where clients enable anonymous ECDH ciphersuites are subject to a denial of service attack. Patch Instructions: To install this openSUSE Security Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE 13.1: zypper in -t patch openSUSE-2014-410 - openSUSE 12.3: zypper in -t patch openSUSE-2014-410 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE 13.1 (i586 x86_64): libopenssl-devel-1.0.1h-11.48.1 libopenssl1_0_0-1.0.1h-11.48.1 libopenssl1_0_0-debuginfo-1.0.1h-11.48.1 openssl-1.0.1h-11.48.1 openssl-debuginfo-1.0.1h-11.48.1 openssl-debugsource-1.0.1h-11.48.1 - openSUSE 13.1 (x86_64): libopenssl-devel-32bit-1.0.1h-11.48.1 libopenssl1_0_0-32bit-1.0.1h-11.48.1 libopenssl1_0_0-debuginfo-32bit-1.0.1h-11.48.1 - openSUSE 13.1 (noarch): openssl-doc-1.0.1h-11.48.1 - openSUSE 12.3 (i586 x86_64): libopenssl-devel-1.0.1h-1.60.1 libopenssl1_0_0-1.0.1h-1.60.1 libopenssl1_0_0-debuginfo-1.0.1h-1.60.1 openssl-1.0.1h-1.60.1 openssl-debuginfo-1.0.1h-1.60.1 openssl-debugsource-1.0.1h-1.60.1 - openSUSE 12.3 (x86_64): libopenssl-devel-32bit-1.0.1h-1.60.1 libopenssl1_0_0-32bit-1.0.1h-1.60.1 libopenssl1_0_0-debuginfo-32bit-1.0.1h-1.60.1 - openSUSE 12.3 (noarch): openssl-doc-1.0.1h-1.60.1 References: http://support.novell.com/security/cve/CVE-2014-0195.html http://support.novell.com/security/cve/CVE-2014-0221.html http://support.novell.com/security/cve/CVE-2014-0224.html http://support.novell.com/security/cve/CVE-2014-3470.html https://bugzilla.novell.com/880891 -- To unsubscribe, e-mail: opensuse-security-announce+unsubscribe(a)opensuse.org For additional commands, e-mail: opensuse-security-announce+help(a)opensuse.org

1 0

[security-announce] openSUSE-SU-2014:0763-1: important: gnutls: Fixed possible memory corruption and NULL pointer dereference
by opensuse-security＠opensuse.org 06 Jun '14

06 Jun '14

openSUSE Security Update: gnutls: Fixed possible memory corruption and NULL pointer dereference ______________________________________________________________________________ Announcement ID: openSUSE-SU-2014:0763-1 Rating: important References: #880730 #880733 Cross-References: CVE-2014-3465 CVE-2014-3466 Affected Products: openSUSE 13.1 openSUSE 12.3 ______________________________________________________________________________ An update that fixes two vulnerabilities is now available. Description: gnutls was patched to fix two security vulnerabilities that could be used to disrupt service or potentially allow remote code execution. - Memory corruption during connect (CVE-2014-3466) - NULL pointer dereference in gnutls_x509_dn_oid_name (CVE-2014-3465) Patch Instructions: To install this openSUSE Security Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE 13.1: zypper in -t patch openSUSE-2014-411 - openSUSE 12.3: zypper in -t patch openSUSE-2014-411 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE 13.1 (i586 x86_64): gnutls-3.2.4-2.24.1 gnutls-debuginfo-3.2.4-2.24.1 gnutls-debugsource-3.2.4-2.24.1 libgnutls-devel-3.2.4-2.24.1 libgnutls-openssl-devel-3.2.4-2.24.1 libgnutls-openssl27-3.2.4-2.24.1 libgnutls-openssl27-debuginfo-3.2.4-2.24.1 libgnutls28-3.2.4-2.24.1 libgnutls28-debuginfo-3.2.4-2.24.1 libgnutlsxx-devel-3.2.4-2.24.1 libgnutlsxx28-3.2.4-2.24.1 libgnutlsxx28-debuginfo-3.2.4-2.24.1 - openSUSE 13.1 (x86_64): libgnutls-devel-32bit-3.2.4-2.24.1 libgnutls28-32bit-3.2.4-2.24.1 libgnutls28-debuginfo-32bit-3.2.4-2.24.1 - openSUSE 12.3 (i586 x86_64): gnutls-3.0.28-1.14.1 gnutls-debuginfo-3.0.28-1.14.1 gnutls-debugsource-3.0.28-1.14.1 libgnutls-devel-3.0.28-1.14.1 libgnutls-openssl-devel-3.0.28-1.14.1 libgnutls-openssl27-3.0.28-1.14.1 libgnutls-openssl27-debuginfo-3.0.28-1.14.1 libgnutls28-3.0.28-1.14.1 libgnutls28-debuginfo-3.0.28-1.14.1 libgnutlsxx-devel-3.0.28-1.14.1 libgnutlsxx28-3.0.28-1.14.1 libgnutlsxx28-debuginfo-3.0.28-1.14.1 - openSUSE 12.3 (x86_64): libgnutls-devel-32bit-3.0.28-1.14.1 libgnutls28-32bit-3.0.28-1.14.1 libgnutls28-debuginfo-32bit-3.0.28-1.14.1 References: http://support.novell.com/security/cve/CVE-2014-3465.html http://support.novell.com/security/cve/CVE-2014-3466.html https://bugzilla.novell.com/880730 https://bugzilla.novell.com/880733 -- To unsubscribe, e-mail: opensuse-security-announce+unsubscribe(a)opensuse.org For additional commands, e-mail: opensuse-security-announce+help(a)opensuse.org

1 0

[security-announce] SUSE-SU-2014:0762-1: critical: Security update for OpenSSL 1.0
by opensuse-security＠opensuse.org 06 Jun '14

06 Jun '14

SUSE Security Update: Security update for OpenSSL 1.0 ______________________________________________________________________________ Announcement ID: SUSE-SU-2014:0762-1 Rating: critical References: #876282 #880891 Cross-References: CVE-2014-0195 CVE-2014-0198 CVE-2014-0221 CVE-2014-0224 CVE-2014-3470 Affected Products: SUSE Linux Enterprise Security Module 11 SP3 ______________________________________________________________________________ An update that fixes 5 vulnerabilities is now available. Description: OpenSSL was updated to fix several vulnerabilities: * SSL/TLS MITM vulnerability. (CVE-2014-0224) * DTLS recursion flaw. (CVE-2014-0221) * DTLS invalid fragment vulnerability. (CVE-2014-0195) * SSL_MODE_RELEASE_BUFFERS NULL pointer dereference. (CVE-2014-0198) * Anonymous ECDH denial of service. (CVE-2014-3470) Further information can be found at http://www.openssl.org/news/secadv_20140605.txt <http://www.openssl.org/news/secadv_20140605.txt> . Security Issues references: * CVE-2014-0224 <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-0224> * CVE-2014-0221 <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-0221> * CVE-2014-0195 <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-0195> * CVE-2014-0198 <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-0198> * CVE-2014-3470 <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-3470> Patch Instructions: To install this SUSE Security Update use YaST online_update. Alternatively you can run the command listed for your product: - SUSE Linux Enterprise Security Module 11 SP3: zypper in -t patch secsp3-libopenssl1-devel-9325 To bring your system up-to-date, use "zypper patch". Package List: - SUSE Linux Enterprise Security Module 11 SP3 (i586 ia64 ppc64 s390x x86_64): libopenssl1-devel-1.0.1g-0.16.1 libopenssl1_0_0-1.0.1g-0.16.1 openssl1-1.0.1g-0.16.1 openssl1-doc-1.0.1g-0.16.1 - SUSE Linux Enterprise Security Module 11 SP3 (ppc64 s390x x86_64): libopenssl1_0_0-32bit-1.0.1g-0.16.1 - SUSE Linux Enterprise Security Module 11 SP3 (ia64): libopenssl1_0_0-x86-1.0.1g-0.16.1 References: http://support.novell.com/security/cve/CVE-2014-0195.html http://support.novell.com/security/cve/CVE-2014-0198.html http://support.novell.com/security/cve/CVE-2014-0221.html http://support.novell.com/security/cve/CVE-2014-0224.html http://support.novell.com/security/cve/CVE-2014-3470.html https://bugzilla.novell.com/876282 https://bugzilla.novell.com/880891 http://download.suse.com/patch/finder/?keywords=61cb4c46d00371ca48e4548ed26… -- To unsubscribe, e-mail: opensuse-security-announce+unsubscribe(a)opensuse.org For additional commands, e-mail: opensuse-security-announce+help(a)opensuse.org

1 0

[security-announce] SUSE-SU-2014:0761-1: critical: Security update for OpenSSL
by opensuse-security＠opensuse.org 05 Jun '14

05 Jun '14

SUSE Security Update: Security update for OpenSSL ______________________________________________________________________________ Announcement ID: SUSE-SU-2014:0761-1 Rating: critical References: #859228 #859924 #860332 #862181 #869945 #870192 #880891 Cross-References: CVE-2014-0076 CVE-2014-0221 CVE-2014-0224 CVE-2014-3470 Affected Products: SUSE Linux Enterprise Server 11 SP2 LTSS SUSE Linux Enterprise Server 11 SP1 LTSS ______________________________________________________________________________ An update that solves four vulnerabilities and has three fixes is now available. It includes one version update. Description: OpenSSL was updated to fix several vulnerabilities: * SSL/TLS MITM vulnerability. (CVE-2014-0224) * DTLS recursion flaw. (CVE-2014-0221) * Anonymous ECDH denial of service. (CVE-2014-3470) * Using the FLUSH+RELOAD Cache Side-channel Attack the nonces could have been recovered. (CVE-2014-0076) Further information can be found at http://www.openssl.org/news/secadv_20140605.txt <http://www.openssl.org/news/secadv_20140605.txt> . Additionally, the following non-security fixes and enhancements have been included in this release: * Ensure that the stack is marked non-executable on x86 32bit. On other processor platforms it was already marked as non-executable before. (bnc#870192) * IPv6 support was added to the openssl s_client and s_server command line tool. (bnc#859228) * The openssl command line tool now checks certificates by default against /etc/ssl/certs (this can be changed via the -CApath option). (bnc#860332) * The Elliptic Curve Diffie-Hellman key exchange selector was enabled and can be selected by kECDHE, kECDH, ECDH tags in the SSL cipher string. (bnc#859924) * If an optional openssl1 command line tool is installed in parallel, c_rehash uses it to generate certificate hashes in both OpenSSL 0 and OpenSSL 1 style. This allows parallel usage of OpenSSL 0.9.8j and OpenSSL 1.x client libraries with a shared certificate store. (bnc#862181) Security Issues references: * CVE-2014-0224 <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-0224> * CVE-2014-0221 <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-0221> * CVE-2014-3470 <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-3470> * CVE-2014-0076 <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-0076> Patch Instructions: To install this SUSE Security Update use YaST online_update. Alternatively you can run the command listed for your product: - SUSE Linux Enterprise Server 11 SP2 LTSS: zypper in -t patch slessp2-libopenssl-devel-9324 - SUSE Linux Enterprise Server 11 SP1 LTSS: zypper in -t patch slessp1-libopenssl-devel-9323 To bring your system up-to-date, use "zypper patch". Package List: - SUSE Linux Enterprise Server 11 SP2 LTSS (i586 s390x x86_64): libopenssl0_9_8-0.9.8j-0.58.1 libopenssl0_9_8-hmac-0.9.8j-0.58.1 openssl-0.9.8j-0.58.1 openssl-doc-0.9.8j-0.58.1 - SUSE Linux Enterprise Server 11 SP2 LTSS (s390x x86_64): libopenssl0_9_8-32bit-0.9.8j-0.58.1 libopenssl0_9_8-hmac-32bit-0.9.8j-0.58.1 - SUSE Linux Enterprise Server 11 SP1 LTSS (i586 s390x x86_64) [New Version: 0.9.8j]: libopenssl0_9_8-0.9.8j-0.58.1 libopenssl0_9_8-hmac-0.9.8j-0.58.1 openssl-0.9.8j-0.58.1 openssl-doc-0.9.8j-0.58.1 - SUSE Linux Enterprise Server 11 SP1 LTSS (s390x x86_64) [New Version: 0.9.8j]: libopenssl0_9_8-32bit-0.9.8j-0.58.1 libopenssl0_9_8-hmac-32bit-0.9.8j-0.58.1 References: http://support.novell.com/security/cve/CVE-2014-0076.html http://support.novell.com/security/cve/CVE-2014-0221.html http://support.novell.com/security/cve/CVE-2014-0224.html http://support.novell.com/security/cve/CVE-2014-3470.html https://bugzilla.novell.com/859228 https://bugzilla.novell.com/859924 https://bugzilla.novell.com/860332 https://bugzilla.novell.com/862181 https://bugzilla.novell.com/869945 https://bugzilla.novell.com/870192 https://bugzilla.novell.com/880891 http://download.suse.com/patch/finder/?keywords=6cb273ec77c3138de899b696097… http://download.suse.com/patch/finder/?keywords=b76b151f2d2ff2b6064a21d179b… -- To unsubscribe, e-mail: opensuse-security-announce+unsubscribe(a)opensuse.org For additional commands, e-mail: opensuse-security-announce+help(a)opensuse.org

1 0

[security-announce] SUSE-SU-2014:0759-1: critical: Security update for OpenSSL
by opensuse-security＠opensuse.org 05 Jun '14

05 Jun '14

SUSE Security Update: Security update for OpenSSL ______________________________________________________________________________ Announcement ID: SUSE-SU-2014:0759-1 Rating: critical References: #880891 Cross-References: CVE-2014-0221 CVE-2014-0224 CVE-2014-3470 Affected Products: SUSE Linux Enterprise Software Development Kit 11 SP3 SUSE Linux Enterprise Server 11 SP3 for VMware SUSE Linux Enterprise Server 11 SP3 SUSE Linux Enterprise Desktop 11 SP3 ______________________________________________________________________________ An update that fixes three vulnerabilities is now available. Description: OpenSSL was updated to fix several vulnerabilities: * SSL/TLS MITM vulnerability. (CVE-2014-0224) * DTLS recursion flaw. (CVE-2014-0221) * Anonymous ECDH denial of service. (CVE-2014-3470) Further information can be found at http://www.openssl.org/news/secadv_20140605.txt <http://www.openssl.org/news/secadv_20140605.txt> . Security Issues references: * CVE-2014-0224 <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-0224> * CVE-2014-0221 <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-0221> * CVE-2014-3470 <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-3470> Patch Instructions: To install this SUSE Security Update use YaST online_update. Alternatively you can run the command listed for your product: - SUSE Linux Enterprise Software Development Kit 11 SP3: zypper in -t patch sdksp3-libopenssl-devel-9326 - SUSE Linux Enterprise Server 11 SP3 for VMware: zypper in -t patch slessp3-libopenssl-devel-9326 - SUSE Linux Enterprise Server 11 SP3: zypper in -t patch slessp3-libopenssl-devel-9326 - SUSE Linux Enterprise Desktop 11 SP3: zypper in -t patch sledsp3-libopenssl-devel-9326 To bring your system up-to-date, use "zypper patch". Package List: - SUSE Linux Enterprise Software Development Kit 11 SP3 (i586 ia64 ppc64 s390x x86_64): libopenssl-devel-0.9.8j-0.58.1 - SUSE Linux Enterprise Server 11 SP3 for VMware (i586 x86_64): libopenssl0_9_8-0.9.8j-0.58.1 libopenssl0_9_8-hmac-0.9.8j-0.58.1 openssl-0.9.8j-0.58.1 openssl-doc-0.9.8j-0.58.1 - SUSE Linux Enterprise Server 11 SP3 for VMware (x86_64): libopenssl0_9_8-32bit-0.9.8j-0.58.1 libopenssl0_9_8-hmac-32bit-0.9.8j-0.58.1 - SUSE Linux Enterprise Server 11 SP3 (i586 ia64 ppc64 s390x x86_64): libopenssl0_9_8-0.9.8j-0.58.1 libopenssl0_9_8-hmac-0.9.8j-0.58.1 openssl-0.9.8j-0.58.1 openssl-doc-0.9.8j-0.58.1 - SUSE Linux Enterprise Server 11 SP3 (ppc64 s390x x86_64): libopenssl0_9_8-32bit-0.9.8j-0.58.1 libopenssl0_9_8-hmac-32bit-0.9.8j-0.58.1 - SUSE Linux Enterprise Server 11 SP3 (ia64): libopenssl0_9_8-x86-0.9.8j-0.58.1 - SUSE Linux Enterprise Desktop 11 SP3 (i586 x86_64): libopenssl0_9_8-0.9.8j-0.58.1 openssl-0.9.8j-0.58.1 - SUSE Linux Enterprise Desktop 11 SP3 (x86_64): libopenssl0_9_8-32bit-0.9.8j-0.58.1 References: http://support.novell.com/security/cve/CVE-2014-0221.html http://support.novell.com/security/cve/CVE-2014-0224.html http://support.novell.com/security/cve/CVE-2014-3470.html https://bugzilla.novell.com/880891 http://download.suse.com/patch/finder/?keywords=db2f8a5e6769133f6c66e372701… -- To unsubscribe, e-mail: opensuse-security-announce+unsubscribe(a)opensuse.org For additional commands, e-mail: opensuse-security-announce+help(a)opensuse.org

1 0

[security-announce] Announcement: openssl 1.0.1h released to fix several vulnerabilities
by Thomas Biege 05 Jun '14

05 Jun '14

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 Today the openssl project released a new version of the openssl library (openssl-1.0.1h) that fixes six/seven vulnerabilities. Details about the vulnerabilities can be found in their advisory: http://www.openssl.org/news/secadv_20140605.txt List of issues: 1. SSL/TLS MITM vulnerability (CVE-2014-0224) 2. DTLS recursion flaw (CVE-2014-0221) 3. DTLS invalid fragment vulnerability (CVE-2014-0195) 4. SSL_MODE_RELEASE_BUFFERS NULL pointer dereference (CVE-2014-0198) 5. SSL_MODE_RELEASE_BUFFERS session injection or denial of service (CVE-2010-5298) 6. Anonymous ECDH denial of service (CVE-2014-3470) 7. Recovering OpenSSL ECDSA Nonces Using the FLUSH+RELOAD (CVE-2014-0076) We ship the following openssl versions which are affected by...: - - SLES9: openssl 0.9.7d + SSL/TLS MITM vulnerability (CVE-2014-0224) - - SLE10: openssl 0.9.8a + SSL/TLS MITM vulnerability (CVE-2014-0224) + DTLS recursion flaw (CVE-2014-0221) - - SLE11: openssl 0.9.8j + SSL/TLS MITM vulnerability (CVE-2014-0224) + DTLS recursion flaw (CVE-2014-0221) + Anonymous ECDH denial of service (CVE-2014-3470) - - Security AddON for SLES11: openssl 1.0.1g + SSL/TLS MITM vulnerability (CVE-2014-0224) + DTLS recursion flaw (CVE-2014-0221) + DTLS invalid fragment vulnerability (CVE-2014-0195) + SSL_MODE_RELEASE_BUFFERS NULL pointer dereference (CVE-2014-0198) + Anonymous ECDH denial of service (CVE-2014-3470) - - opensuse: openssl 1.0.1* + SSL/TLS MITM vulnerability (CVE-2014-0224) + DTLS recursion flaw (CVE-2014-0221) + DTLS invalid fragment vulnerability (CVE-2014-0195) + SSL_MODE_RELEASE_BUFFERS NULL pointer dereference (CVE-2014-0198) + Anonymous ECDH denial of service (CVE-2014-3470) An update package for CVE-2014-0076 was released in April 2014, see http://lists.opensuse.org/opensuse-updates/2014-04/msg00007.html. DTLS invalid fragment vulnerability (CVE-2014-0195): This issue affects only versions starting from 0.9.8o, therefore 0.9.8j is not affected by this remote buffer overflow. The updates will be released as soon as possible. Best regards, Thomas - -- Thomas Biege <thomas(a)suse.de>, Team Leader MaintenanceSecurity, CSSLP SUSE LINUX Products GmbH GF: Jeff Hawn, Jennifer Guild, Felix Imendörffer HRB 21284 (AG Nürnberg) - -- Wer aufhoert besser werden zu wollen, hoert auf gut zu sein. -- Marie von Ebner-Eschenbach -----BEGIN PGP SIGNATURE----- Version: GnuPG v2.0.22 (GNU/Linux) Comment: Using GnuPG with Thunderbird - http://www.enigmail.net/ iQEVAwUBU5CEfHey5gA9JdPZAQLC0gf/Y4M29yMsWf1fBUZP6VCFbDK03UAT0HhI Srdx4FgSwr3Rda6M52UKqP8HdP2yv9/G30NGHihX7Gz6hStc8G/bvj8RyVGPlUh4 XadWUVztnSct1v68z45Z1zk53XBVsK5lIpxORX04LW0EPQytYAltD7/W4wvNtwBU Y7Ji1WDb+L6sGHyZn9Cp2Zvs30+jraf10MK/L7tYuvdNoOJTVfgrlzt+dfFKIuuW 5Az7KXb8J21CEk4DVhO5CG2ogNjsVR/K7b7vlWFxYorhfkKr1tXi5SKSXooD1WPY ovMhZFfopkKuuor898Xpyzb54Qjcc7eMDS3Pk7jDo9lBifY6loJqLw== =bSsy -----END PGP SIGNATURE----- -- To unsubscribe, e-mail: opensuse-security-announce+unsubscribe(a)opensuse.org For additional commands, e-mail: opensuse-security-announce+help(a)opensuse.org

1 0

[security-announce] SUSE-SU-2014:0758-1: important: Security update for gnutls
by opensuse-security＠opensuse.org 05 Jun '14

05 Jun '14

SUSE Security Update: Security update for gnutls ______________________________________________________________________________ Announcement ID: SUSE-SU-2014:0758-1 Rating: important References: #880730 #880910 Cross-References: CVE-2014-3466 Affected Products: SUSE Linux Enterprise Software Development Kit 11 SP3 SUSE Linux Enterprise Server 11 SP3 for VMware SUSE Linux Enterprise Server 11 SP3 SUSE Linux Enterprise High Availability Extension 11 SP3 SUSE Linux Enterprise Desktop 11 SP3 ______________________________________________________________________________ An update that solves one vulnerability and has one errata is now available. Description: GnuTLS has been patched to ensure proper parsing of session ids during the TLS/SSL handshake. Additionally, three issues inherited from libtasn1 have been fixed. Further information is available at http://www.gnutls.org/security.html#GNUTLS-SA-2014-3 <http://www.gnutls.org/security.html#GNUTLS-SA-2014-3> These security issues have been fixed: * Possible memory corruption during connect (CVE-2014-3466) * Multiple boundary check issues could allow DoS (CVE-2014-3467) * asn1_get_bit_der() can return negative bit length (CVE-2014-3468) * Possible DoS by NULL pointer dereference (CVE-2014-3469) Security Issue references: * CVE-2014-3466 <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-3466> Patch Instructions: To install this SUSE Security Update use YaST online_update. Alternatively you can run the command listed for your product: - SUSE Linux Enterprise Software Development Kit 11 SP3: zypper in -t patch sdksp3-gnutls-9320 - SUSE Linux Enterprise Server 11 SP3 for VMware: zypper in -t patch slessp3-gnutls-9320 - SUSE Linux Enterprise Server 11 SP3: zypper in -t patch slessp3-gnutls-9320 - SUSE Linux Enterprise High Availability Extension 11 SP3: zypper in -t patch slehasp3-gnutls-9320 - SUSE Linux Enterprise Desktop 11 SP3: zypper in -t patch sledsp3-gnutls-9320 To bring your system up-to-date, use "zypper patch". Package List: - SUSE Linux Enterprise Software Development Kit 11 SP3 (i586 ia64 ppc64 s390x x86_64): libgnutls-devel-2.4.1-24.39.51.1 libgnutls-extra-devel-2.4.1-24.39.51.1 libgnutls-extra26-2.4.1-24.39.51.1 - SUSE Linux Enterprise Server 11 SP3 for VMware (i586 x86_64): gnutls-2.4.1-24.39.51.1 libgnutls-extra26-2.4.1-24.39.51.1 libgnutls26-2.4.1-24.39.51.1 - SUSE Linux Enterprise Server 11 SP3 for VMware (x86_64): libgnutls26-32bit-2.4.1-24.39.51.1 - SUSE Linux Enterprise Server 11 SP3 (i586 ia64 ppc64 s390x x86_64): gnutls-2.4.1-24.39.51.1 libgnutls-extra26-2.4.1-24.39.51.1 libgnutls26-2.4.1-24.39.51.1 - SUSE Linux Enterprise Server 11 SP3 (ppc64 s390x x86_64): libgnutls26-32bit-2.4.1-24.39.51.1 - SUSE Linux Enterprise Server 11 SP3 (ia64): libgnutls26-x86-2.4.1-24.39.51.1 - SUSE Linux Enterprise High Availability Extension 11 SP3 (i586 ia64 ppc64 s390x x86_64): libgnutls-extra26-2.4.1-24.39.51.1 - SUSE Linux Enterprise Desktop 11 SP3 (i586 x86_64): gnutls-2.4.1-24.39.51.1 libgnutls26-2.4.1-24.39.51.1 - SUSE Linux Enterprise Desktop 11 SP3 (x86_64): libgnutls26-32bit-2.4.1-24.39.51.1 References: http://support.novell.com/security/cve/CVE-2014-3466.html https://bugzilla.novell.com/880730 https://bugzilla.novell.com/880910 http://download.suse.com/patch/finder/?keywords=cbb1ebdf6ecb2e49e09ac0ae8fa… -- To unsubscribe, e-mail: opensuse-security-announce+unsubscribe(a)opensuse.org For additional commands, e-mail: opensuse-security-announce+help(a)opensuse.org

1 0