July 2015 - openSUSE Security Announce

[security-announce] SUSE-SU-2015:1302-1: important: Security update for xen
by opensuse-security＠opensuse.org 28 Jul '15

28 Jul '15

SUSE Security Update: Security update for xen ______________________________________________________________________________ Announcement ID: SUSE-SU-2015:1302-1 Rating: important References: #925466 #935256 #935634 #938344 Cross-References: CVE-2015-3259 CVE-2015-5154 Affected Products: SUSE Linux Enterprise Software Development Kit 12 SUSE Linux Enterprise Server 12 SUSE Linux Enterprise Desktop 12 ______________________________________________________________________________ An update that solves two vulnerabilities and has two fixes is now available. Description: xen was updated to fix two security issues. These security issues were fixed: - CVE-2015-3259: xl command line config handling stack overflow (bsc#935634, XSA-137). - CVE-2015-5154: Host code execution via IDE subsystem CD-ROM (bsc#938344). These non-security issues were fixed: - Restart of xencommons service did lead to loss of xenstore data (bsc#935256). - Kdump did not work in a XEN environment (bsc#925466). Patch Instructions: To install this SUSE Security Update use YaST online_update. Alternatively you can run the command listed for your product: - SUSE Linux Enterprise Software Development Kit 12: zypper in -t patch SUSE-SLE-SDK-12-2015-344=1 - SUSE Linux Enterprise Server 12: zypper in -t patch SUSE-SLE-SERVER-12-2015-344=1 - SUSE Linux Enterprise Desktop 12: zypper in -t patch SUSE-SLE-DESKTOP-12-2015-344=1 To bring your system up-to-date, use "zypper patch". Package List: - SUSE Linux Enterprise Software Development Kit 12 (x86_64): xen-debugsource-4.4.2_08-22.5.1 xen-devel-4.4.2_08-22.5.1 - SUSE Linux Enterprise Server 12 (x86_64): xen-4.4.2_08-22.5.1 xen-debugsource-4.4.2_08-22.5.1 xen-doc-html-4.4.2_08-22.5.1 xen-kmp-default-4.4.2_08_k3.12.43_52.6-22.5.1 xen-kmp-default-debuginfo-4.4.2_08_k3.12.43_52.6-22.5.1 xen-libs-32bit-4.4.2_08-22.5.1 xen-libs-4.4.2_08-22.5.1 xen-libs-debuginfo-32bit-4.4.2_08-22.5.1 xen-libs-debuginfo-4.4.2_08-22.5.1 xen-tools-4.4.2_08-22.5.1 xen-tools-debuginfo-4.4.2_08-22.5.1 xen-tools-domU-4.4.2_08-22.5.1 xen-tools-domU-debuginfo-4.4.2_08-22.5.1 - SUSE Linux Enterprise Desktop 12 (x86_64): xen-4.4.2_08-22.5.1 xen-debugsource-4.4.2_08-22.5.1 xen-kmp-default-4.4.2_08_k3.12.43_52.6-22.5.1 xen-kmp-default-debuginfo-4.4.2_08_k3.12.43_52.6-22.5.1 xen-libs-32bit-4.4.2_08-22.5.1 xen-libs-4.4.2_08-22.5.1 xen-libs-debuginfo-32bit-4.4.2_08-22.5.1 xen-libs-debuginfo-4.4.2_08-22.5.1 References: https://www.suse.com/security/cve/CVE-2015-3259.html https://www.suse.com/security/cve/CVE-2015-5154.html https://bugzilla.suse.com/925466 https://bugzilla.suse.com/935256 https://bugzilla.suse.com/935634 https://bugzilla.suse.com/938344 -- To unsubscribe, e-mail: opensuse-security-announce+unsubscribe(a)opensuse.org For additional commands, e-mail: opensuse-security-announce+help(a)opensuse.org

1 0

[security-announce] SUSE-SU-2015:1299-1: important: Security update for xen
by opensuse-security＠opensuse.org 27 Jul '15

27 Jul '15

SUSE Security Update: Security update for xen ______________________________________________________________________________ Announcement ID: SUSE-SU-2015:1299-1 Rating: important References: #925466 #935634 #938344 Cross-References: CVE-2015-3259 CVE-2015-5154 Affected Products: SUSE Linux Enterprise Software Development Kit 11-SP4 SUSE Linux Enterprise Server 11-SP4 SUSE Linux Enterprise Desktop 11-SP4 SUSE Linux Enterprise Debuginfo 11-SP4 ______________________________________________________________________________ An update that solves two vulnerabilities and has one errata is now available. Description: xen was updated to fix two security issues. These security issues were fixed: - CVE-2015-3259: xl command line config handling stack overflow (bsc#935634, XSA-137). - CVE-2015-5154: Host code execution via IDE subsystem CD-ROM (bsc#938344). This non-security issue was fixed: - Kdump did not work in a XEN environment (bsc#925466). Patch Instructions: To install this SUSE Security Update use YaST online_update. Alternatively you can run the command listed for your product: - SUSE Linux Enterprise Software Development Kit 11-SP4: zypper in -t patch sdksp4-xen-12007=1 - SUSE Linux Enterprise Server 11-SP4: zypper in -t patch slessp4-xen-12007=1 - SUSE Linux Enterprise Desktop 11-SP4: zypper in -t patch sledsp4-xen-12007=1 - SUSE Linux Enterprise Debuginfo 11-SP4: zypper in -t patch dbgsp4-xen-12007=1 To bring your system up-to-date, use "zypper patch". Package List: - SUSE Linux Enterprise Software Development Kit 11-SP4 (i586 x86_64): xen-devel-4.4.2_10-5.1 - SUSE Linux Enterprise Server 11-SP4 (i586 x86_64): xen-kmp-default-4.4.2_10_3.0.101_63-5.1 xen-libs-4.4.2_10-5.1 xen-tools-domU-4.4.2_10-5.1 - SUSE Linux Enterprise Server 11-SP4 (x86_64): xen-4.4.2_10-5.1 xen-doc-html-4.4.2_10-5.1 xen-libs-32bit-4.4.2_10-5.1 xen-tools-4.4.2_10-5.1 - SUSE Linux Enterprise Server 11-SP4 (i586): xen-kmp-pae-4.4.2_10_3.0.101_63-5.1 - SUSE Linux Enterprise Desktop 11-SP4 (i586 x86_64): xen-kmp-default-4.4.2_10_3.0.101_63-5.1 xen-libs-4.4.2_10-5.1 xen-tools-domU-4.4.2_10-5.1 - SUSE Linux Enterprise Desktop 11-SP4 (x86_64): xen-4.4.2_10-5.1 xen-doc-html-4.4.2_10-5.1 xen-libs-32bit-4.4.2_10-5.1 xen-tools-4.4.2_10-5.1 - SUSE Linux Enterprise Desktop 11-SP4 (i586): xen-kmp-pae-4.4.2_10_3.0.101_63-5.1 - SUSE Linux Enterprise Debuginfo 11-SP4 (i586 x86_64): xen-debuginfo-4.4.2_10-5.1 xen-debugsource-4.4.2_10-5.1 References: https://www.suse.com/security/cve/CVE-2015-3259.html https://www.suse.com/security/cve/CVE-2015-5154.html https://bugzilla.suse.com/925466 https://bugzilla.suse.com/935634 https://bugzilla.suse.com/938344 -- To unsubscribe, e-mail: opensuse-security-announce+unsubscribe(a)opensuse.org For additional commands, e-mail: opensuse-security-announce+help(a)opensuse.org

1 0

[security-announce] openSUSE-SU-2015:1289-1: important: Security update for java-1_8_0-openjdk
by opensuse-security＠opensuse.org 26 Jul '15

26 Jul '15

openSUSE Security Update: Security update for java-1_8_0-openjdk ______________________________________________________________________________ Announcement ID: openSUSE-SU-2015:1289-1 Rating: important References: #937828 #938248 Cross-References: CVE-2015-2590 CVE-2015-2597 CVE-2015-2601 CVE-2015-2613 CVE-2015-2619 CVE-2015-2621 CVE-2015-2625 CVE-2015-2627 CVE-2015-2628 CVE-2015-2632 CVE-2015-2637 CVE-2015-2638 CVE-2015-2659 CVE-2015-2664 CVE-2015-2808 CVE-2015-4000 CVE-2015-4729 CVE-2015-4731 CVE-2015-4732 CVE-2015-4733 CVE-2015-4736 CVE-2015-4748 CVE-2015-4749 CVE-2015-4760 Affected Products: openSUSE 13.2 ______________________________________________________________________________ An update that fixes 24 vulnerabilities is now available. Description: OpenJDK was updated to 2.6.1 - OpenJDK 8u51 to fix security issues and bugs. The following vulnerabilities were fixed: * CVE-2015-2590: Easily exploitable vulnerability in the Libraries component allowed successful unauthenticated network attacks via multiple protocols. Successful attack of this vulnerability could have resulted in unauthorized Operating System takeover including arbitrary code execution. * CVE-2015-2597: Easily exploitable vulnerability in the Install component requiring logon to Operating System. Successful attack of this vulnerability could have resulted in unauthorized Operating System takeover including arbitrary code execution. * CVE-2015-2601: Easily exploitable vulnerability in the JCE component allowed successful unauthenticated network attacks via multiple protocols. Successful attack of this vulnerability could have resulted in unauthorized read access to a subset of Java accessible data. * CVE-2015-2613: Easily exploitable vulnerability in the JCE component allowed successful unauthenticated network attacks via multiple protocols. Successful attack of this vulnerability could have resulted in unauthorized read access to a subset of Java SE, Java SE Embedded accessible data. * CVE-2015-2619: Easily exploitable vulnerability in the 2D component allowed successful unauthenticated network attacks via multiple protocols. Successful attack of this vulnerability could have resulted in unauthorized read access to a subset of Java accessible data. * CVE-2015-2621: Easily exploitable vulnerability in the JMX component allowed successful unauthenticated network attacks via multiple protocols. Successful attack of this vulnerability could have resulted in unauthorized read access to a subset of Java accessible data. * CVE-2015-2625: Very difficult to exploit vulnerability in the JSSE component allowed successful unauthenticated network attacks via SSL/TLS. Successful attack of this vulnerability could have resulted in unauthorized read access to a subset of Java accessible data. * CVE-2015-2627: Very difficult to exploit vulnerability in the Install component allowed successful unauthenticated network attacks via multiple protocols. Successful attack of this vulnerability could have resulted in unauthorized read access to a subset of Java accessible data. * CVE-2015-2628: Easily exploitable vulnerability in the CORBA component allowed successful unauthenticated network attacks via multiple protocols. Successful attack of this vulnerability could have resulted in unauthorized Operating System takeover including arbitrary code execution. * CVE-2015-2632: Easily exploitable vulnerability in the 2D component allowed successful unauthenticated network attacks via multiple protocols. Successful attack of this vulnerability could have resulted in unauthorized read access to a subset of Java accessible data. * CVE-2015-2637: Easily exploitable vulnerability in the 2D component allowed successful unauthenticated network attacks via multiple protocols. Successful attack of this vulnerability could have resulted in unauthorized read access to a subset of Java accessible data. * CVE-2015-2638: Easily exploitable vulnerability in the 2D component allowed successful unauthenticated network attacks via multiple protocols. Successful attack of this vulnerability could have resulted in unauthorized Operating System takeover including arbitrary code execution. * CVE-2015-2659: Easily exploitable vulnerability in the Security component allowed successful unauthenticated network attacks via multiple protocols. Successful attack of this vulnerability could have resulted in unauthorized ability to cause a partial denial of service (partial DOS). * CVE-2015-2664: Difficult to exploit vulnerability in the Deployment component requiring logon to Operating System. Successful attack of this vulnerability could have resulted in unauthorized Operating System takeover including arbitrary code execution. * CVE-2015-2808: Very difficult to exploit vulnerability in the JSSE component allowed successful unauthenticated network attacks via SSL/TLS. Successful attack of this vulnerability could have resulted in unauthorized update, insert or delete access to some Java accessible data as well as read access to a subset of Java accessible data. * CVE-2015-4000: Very difficult to exploit vulnerability in the JSSE component allowed successful unauthenticated network attacks via SSL/TLS. Successful attack of this vulnerability could have resulted in unauthorized update, insert or delete access to some Java accessible data as well as read access to a subset of Java Embedded accessible data. * CVE-2015-4729: Very difficult to exploit vulnerability in the Deployment component allowed successful unauthenticated network attacks via multiple protocols. Successful attack of this vulnerability could have resulted in unauthorized update, insert or delete access to some Java SE accessible data as well as read access to a subset of Java SE accessible data. * CVE-2015-4731: Easily exploitable vulnerability in the JMX component allowed successful unauthenticated network attacks via multiple protocols. Successful attack of this vulnerability could have resulted in unauthorized Operating System takeover including arbitrary code execution. * CVE-2015-4732: Easily exploitable vulnerability in the Libraries component allowed successful unauthenticated network attacks via multiple protocols. Successful attack of this vulnerability could have resulted in unauthorized Operating System takeover including arbitrary code execution. * CVE-2015-4733: Easily exploitable vulnerability in the RMI component allowed successful unauthenticated network attacks via multiple protocols. Successful attack of this vulnerability could have resulted in unauthorized Operating System takeover including arbitrary code execution. * CVE-2015-4736: Difficult to exploit vulnerability in the Deployment component allowed successful unauthenticated network attacks via multiple protocols. Successful attack of this vulnerability could have resulted in unauthorized Operating System takeover including arbitrary code execution. * CVE-2015-4748: Very difficult to exploit vulnerability in the Security component allowed successful unauthenticated network attacks via OCSP. Successful attack of this vulnerability could have resulted in unauthorized Operating System takeover including arbitrary code execution. * CVE-2015-4749: Difficult to exploit vulnerability in the JNDI component allowed successful unauthenticated network attacks via multiple protocols. Successful attack of this vulnerability could have resulted in unauthorized ability to cause a partial denial of service (partial DOS). * CVE-2015-4760: Easily exploitable vulnerability in the 2D component allowed successful unauthenticated network attacks via multiple protocols. Successful attack of this vulnerability could have resulted in unauthorized Operating System takeover including arbitrary code execution. Patch Instructions: To install this openSUSE Security Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE 13.2: zypper in -t patch openSUSE-2015-512=1 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE 13.2 (i586 x86_64): java-1_8_0-openjdk-1.8.0.51-12.1 java-1_8_0-openjdk-accessibility-1.8.0.51-12.1 java-1_8_0-openjdk-debuginfo-1.8.0.51-12.1 java-1_8_0-openjdk-debugsource-1.8.0.51-12.1 java-1_8_0-openjdk-demo-1.8.0.51-12.1 java-1_8_0-openjdk-demo-debuginfo-1.8.0.51-12.1 java-1_8_0-openjdk-devel-1.8.0.51-12.1 java-1_8_0-openjdk-headless-1.8.0.51-12.1 java-1_8_0-openjdk-headless-debuginfo-1.8.0.51-12.1 java-1_8_0-openjdk-src-1.8.0.51-12.1 - openSUSE 13.2 (noarch): java-1_8_0-openjdk-javadoc-1.8.0.51-12.1 References: https://www.suse.com/security/cve/CVE-2015-2590.html https://www.suse.com/security/cve/CVE-2015-2597.html https://www.suse.com/security/cve/CVE-2015-2601.html https://www.suse.com/security/cve/CVE-2015-2613.html https://www.suse.com/security/cve/CVE-2015-2619.html https://www.suse.com/security/cve/CVE-2015-2621.html https://www.suse.com/security/cve/CVE-2015-2625.html https://www.suse.com/security/cve/CVE-2015-2627.html https://www.suse.com/security/cve/CVE-2015-2628.html https://www.suse.com/security/cve/CVE-2015-2632.html https://www.suse.com/security/cve/CVE-2015-2637.html https://www.suse.com/security/cve/CVE-2015-2638.html https://www.suse.com/security/cve/CVE-2015-2659.html https://www.suse.com/security/cve/CVE-2015-2664.html https://www.suse.com/security/cve/CVE-2015-2808.html https://www.suse.com/security/cve/CVE-2015-4000.html https://www.suse.com/security/cve/CVE-2015-4729.html https://www.suse.com/security/cve/CVE-2015-4731.html https://www.suse.com/security/cve/CVE-2015-4732.html https://www.suse.com/security/cve/CVE-2015-4733.html https://www.suse.com/security/cve/CVE-2015-4736.html https://www.suse.com/security/cve/CVE-2015-4748.html https://www.suse.com/security/cve/CVE-2015-4749.html https://www.suse.com/security/cve/CVE-2015-4760.html https://bugzilla.suse.com/937828 https://bugzilla.suse.com/938248 -- To unsubscribe, e-mail: opensuse-security-announce+unsubscribe(a)opensuse.org For additional commands, e-mail: opensuse-security-announce+help(a)opensuse.org

1 0

[security-announce] openSUSE-SU-2015:1288-1: important: Security update for java-1_7_0-openjdk
by opensuse-security＠opensuse.org 26 Jul '15

26 Jul '15

openSUSE Security Update: Security update for java-1_7_0-openjdk ______________________________________________________________________________ Announcement ID: openSUSE-SU-2015:1288-1 Rating: important References: #937828 #938248 Cross-References: CVE-2015-2590 CVE-2015-2596 CVE-2015-2597 CVE-2015-2601 CVE-2015-2613 CVE-2015-2619 CVE-2015-2621 CVE-2015-2625 CVE-2015-2627 CVE-2015-2628 CVE-2015-2632 CVE-2015-2637 CVE-2015-2638 CVE-2015-2664 CVE-2015-2808 CVE-2015-4000 CVE-2015-4729 CVE-2015-4731 CVE-2015-4732 CVE-2015-4733 CVE-2015-4736 CVE-2015-4748 CVE-2015-4749 CVE-2015-4760 Affected Products: openSUSE 13.2 openSUSE 13.1 ______________________________________________________________________________ An update that fixes 24 vulnerabilities is now available. Description: OpenJDK was updated to 2.6.1 - OpenJDK 7u85 to fix security issues and bugs. The following vulnerabilities were fixed: * CVE-2015-2590: Easily exploitable vulnerability in the Libraries component allowed successful unauthenticated network attacks via multiple protocols. Successful attack of this vulnerability could have resulted in unauthorized Operating System takeover including arbitrary code execution. * CVE-2015-2596: Difficult to exploit vulnerability in the Hotspot component allowed successful unauthenticated network attacks via multiple protocols. Successful attack of this vulnerability could have resulted in unauthorized update, insert or delete access to some Java accessible data. * CVE-2015-2597: Easily exploitable vulnerability in the Install component requiring logon to Operating System. Successful attack of this vulnerability could have resulted in unauthorized Operating System takeover including arbitrary code execution. * CVE-2015-2601: Easily exploitable vulnerability in the JCE component allowed successful unauthenticated network attacks via multiple protocols. Successful attack of this vulnerability could have resulted in unauthorized read access to a subset of Java accessible data. * CVE-2015-2613: Easily exploitable vulnerability in the JCE component allowed successful unauthenticated network attacks via multiple protocols. Successful attack of this vulnerability could have resulted in unauthorized read access to a subset of Java SE, Java SE Embedded accessible data. * CVE-2015-2619: Easily exploitable vulnerability in the 2D component allowed successful unauthenticated network attacks via multiple protocols. Successful attack of this vulnerability could have resulted in unauthorized read access to a subset of Java accessible data. * CVE-2015-2621: Easily exploitable vulnerability in the JMX component allowed successful unauthenticated network attacks via multiple protocols. Successful attack of this vulnerability could have resulted in unauthorized read access to a subset of Java accessible data. * CVE-2015-2625: Very difficult to exploit vulnerability in the JSSE component allowed successful unauthenticated network attacks via SSL/TLS. Successful attack of this vulnerability could have resulted in unauthorized read access to a subset of Java accessible data. * CVE-2015-2627: Very difficult to exploit vulnerability in the Install component allowed successful unauthenticated network attacks via multiple protocols. Successful attack of this vulnerability could have resulted in unauthorized read access to a subset of Java accessible data. * CVE-2015-2628: Easily exploitable vulnerability in the CORBA component allowed successful unauthenticated network attacks via multiple protocols. Successful attack of this vulnerability could have resulted in unauthorized Operating System takeover including arbitrary code execution. * CVE-2015-2632: Easily exploitable vulnerability in the 2D component allowed successful unauthenticated network attacks via multiple protocols. Successful attack of this vulnerability could have resulted in unauthorized read access to a subset of Java accessible data. * CVE-2015-2637: Easily exploitable vulnerability in the 2D component allowed successful unauthenticated network attacks via multiple protocols. Successful attack of this vulnerability could have resulted in unauthorized read access to a subset of Java accessible data. * CVE-2015-2638: Easily exploitable vulnerability in the 2D component allowed successful unauthenticated network attacks via multiple protocols. Successful attack of this vulnerability could have resulted in unauthorized Operating System takeover including arbitrary code execution. * CVE-2015-2664: Difficult to exploit vulnerability in the Deployment component requiring logon to Operating System. Successful attack of this vulnerability could have resulted in unauthorized Operating System takeover including arbitrary code execution. * CVE-2015-2808: Very difficult to exploit vulnerability in the JSSE component allowed successful unauthenticated network attacks via SSL/TLS. Successful attack of this vulnerability could have resulted in unauthorized update, insert or delete access to some Java accessible data as well as read access to a subset of Java accessible data. * CVE-2015-4000: Very difficult to exploit vulnerability in the JSSE component allowed successful unauthenticated network attacks via SSL/TLS. Successful attack of this vulnerability could have resulted in unauthorized update, insert or delete access to some Java accessible data as well as read access to a subset of Java Embedded accessible data. * CVE-2015-4729: Very difficult to exploit vulnerability in the Deployment component allowed successful unauthenticated network attacks via multiple protocols. Successful attack of this vulnerability could have resulted in unauthorized update, insert or delete access to some Java SE accessible data as well as read access to a subset of Java SE accessible data. * CVE-2015-4731: Easily exploitable vulnerability in the JMX component allowed successful unauthenticated network attacks via multiple protocols. Successful attack of this vulnerability could have resulted in unauthorized Operating System takeover including arbitrary code execution. * CVE-2015-4732: Easily exploitable vulnerability in the Libraries component allowed successful unauthenticated network attacks via multiple protocols. Successful attack of this vulnerability could have resulted in unauthorized Operating System takeover including arbitrary code execution. * CVE-2015-4733: Easily exploitable vulnerability in the RMI component allowed successful unauthenticated network attacks via multiple protocols. Successful attack of this vulnerability could have resulted in unauthorized Operating System takeover including arbitrary code execution. * CVE-2015-4736: Difficult to exploit vulnerability in the Deployment component allowed successful unauthenticated network attacks via multiple protocols. Successful attack of this vulnerability could have resulted in unauthorized Operating System takeover including arbitrary code execution. * CVE-2015-4748: Very difficult to exploit vulnerability in the Security component allowed successful unauthenticated network attacks via OCSP. Successful attack of this vulnerability could have resulted in unauthorized Operating System takeover including arbitrary code execution. * CVE-2015-4749: Difficult to exploit vulnerability in the JNDI component allowed successful unauthenticated network attacks via multiple protocols. Successful attack of this vulnerability could have resulted in unauthorized ability to cause a partial denial of service (partial DOS). * CVE-2015-4760: Easily exploitable vulnerability in the 2D component allowed successful unauthenticated network attacks via multiple protocols. Successful attack of this vulnerability could have resulted in unauthorized Operating System takeover including arbitrary code execution. Patch Instructions: To install this openSUSE Security Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE 13.2: zypper in -t patch openSUSE-2015-511=1 - openSUSE 13.1: zypper in -t patch openSUSE-2015-511=1 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE 13.2 (i586 x86_64): java-1_7_0-openjdk-1.7.0.85-10.2 java-1_7_0-openjdk-accessibility-1.7.0.85-10.2 java-1_7_0-openjdk-bootstrap-1.7.0.85-10.1 java-1_7_0-openjdk-bootstrap-debuginfo-1.7.0.85-10.1 java-1_7_0-openjdk-bootstrap-debugsource-1.7.0.85-10.1 java-1_7_0-openjdk-bootstrap-devel-1.7.0.85-10.1 java-1_7_0-openjdk-bootstrap-devel-debuginfo-1.7.0.85-10.1 java-1_7_0-openjdk-bootstrap-headless-1.7.0.85-10.1 java-1_7_0-openjdk-bootstrap-headless-debuginfo-1.7.0.85-10.1 java-1_7_0-openjdk-debuginfo-1.7.0.85-10.2 java-1_7_0-openjdk-debugsource-1.7.0.85-10.2 java-1_7_0-openjdk-demo-1.7.0.85-10.2 java-1_7_0-openjdk-demo-debuginfo-1.7.0.85-10.2 java-1_7_0-openjdk-devel-1.7.0.85-10.2 java-1_7_0-openjdk-devel-debuginfo-1.7.0.85-10.2 java-1_7_0-openjdk-headless-1.7.0.85-10.2 java-1_7_0-openjdk-headless-debuginfo-1.7.0.85-10.2 java-1_7_0-openjdk-src-1.7.0.85-10.2 - openSUSE 13.2 (noarch): java-1_7_0-openjdk-javadoc-1.7.0.85-10.2 - openSUSE 13.1 (i586 x86_64): java-1_7_0-openjdk-1.7.0.85-24.21.1 java-1_7_0-openjdk-accessibility-1.7.0.85-24.21.1 java-1_7_0-openjdk-debuginfo-1.7.0.85-24.21.1 java-1_7_0-openjdk-debugsource-1.7.0.85-24.21.1 java-1_7_0-openjdk-demo-1.7.0.85-24.21.1 java-1_7_0-openjdk-demo-debuginfo-1.7.0.85-24.21.1 java-1_7_0-openjdk-devel-1.7.0.85-24.21.1 java-1_7_0-openjdk-devel-debuginfo-1.7.0.85-24.21.1 java-1_7_0-openjdk-headless-1.7.0.85-24.21.1 java-1_7_0-openjdk-headless-debuginfo-1.7.0.85-24.21.1 java-1_7_0-openjdk-src-1.7.0.85-24.21.1 - openSUSE 13.1 (noarch): java-1_7_0-openjdk-javadoc-1.7.0.85-24.21.1 References: https://www.suse.com/security/cve/CVE-2015-2590.html https://www.suse.com/security/cve/CVE-2015-2596.html https://www.suse.com/security/cve/CVE-2015-2597.html https://www.suse.com/security/cve/CVE-2015-2601.html https://www.suse.com/security/cve/CVE-2015-2613.html https://www.suse.com/security/cve/CVE-2015-2619.html https://www.suse.com/security/cve/CVE-2015-2621.html https://www.suse.com/security/cve/CVE-2015-2625.html https://www.suse.com/security/cve/CVE-2015-2627.html https://www.suse.com/security/cve/CVE-2015-2628.html https://www.suse.com/security/cve/CVE-2015-2632.html https://www.suse.com/security/cve/CVE-2015-2637.html https://www.suse.com/security/cve/CVE-2015-2638.html https://www.suse.com/security/cve/CVE-2015-2664.html https://www.suse.com/security/cve/CVE-2015-2808.html https://www.suse.com/security/cve/CVE-2015-4000.html https://www.suse.com/security/cve/CVE-2015-4729.html https://www.suse.com/security/cve/CVE-2015-4731.html https://www.suse.com/security/cve/CVE-2015-4732.html https://www.suse.com/security/cve/CVE-2015-4733.html https://www.suse.com/security/cve/CVE-2015-4736.html https://www.suse.com/security/cve/CVE-2015-4748.html https://www.suse.com/security/cve/CVE-2015-4749.html https://www.suse.com/security/cve/CVE-2015-4760.html https://bugzilla.suse.com/937828 https://bugzilla.suse.com/938248 -- To unsubscribe, e-mail: opensuse-security-announce+unsubscribe(a)opensuse.org For additional commands, e-mail: opensuse-security-announce+help(a)opensuse.org

1 0

[security-announce] openSUSE-SU-2015:1287-1: important: Security update for Chromium
by opensuse-security＠opensuse.org 26 Jul '15

26 Jul '15

openSUSE Security Update: Security update for Chromium ______________________________________________________________________________ Announcement ID: openSUSE-SU-2015:1287-1 Rating: important References: #939077 Cross-References: CVE-2015-1270 CVE-2015-1271 CVE-2015-1272 CVE-2015-1273 CVE-2015-1274 CVE-2015-1275 CVE-2015-1276 CVE-2015-1277 CVE-2015-1278 CVE-2015-1279 CVE-2015-1280 CVE-2015-1281 CVE-2015-1282 CVE-2015-1283 CVE-2015-1284 CVE-2015-1285 CVE-2015-1286 CVE-2015-1287 CVE-2015-1288 CVE-2015-1289 CVE-2015-5605 Affected Products: openSUSE 13.2 openSUSE 13.1 ______________________________________________________________________________ An update that fixes 21 vulnerabilities is now available. Description: Chromium was updated to 44.0.2403.89 to fix multiple security issues. The following vulnerabilities were fixed: * CVE-2015-1271: Heap-buffer-overflow in pdfium * CVE-2015-1273: Heap-buffer-overflow in pdfium * CVE-2015-1274: Settings allowed executable files to run immediately after download * CVE-2015-1275: UXSS in Chrome for Android * CVE-2015-1276: Use-after-free in IndexedDB * CVE-2015-1279: Heap-buffer-overflow in pdfium * CVE-2015-1280: Memory corruption in skia * CVE-2015-1281: CSP bypass * CVE-2015-1282: Use-after-free in pdfium * CVE-2015-1283: Heap-buffer-overflow in expat * CVE-2015-1284: Use-after-free in blink * CVE-2015-1286: UXSS in blink * CVE-2015-1287: SOP bypass with CSS * CVE-2015-1270: Uninitialized memory read in ICU * CVE-2015-1272: Use-after-free related to unexpected GPU process termination * CVE-2015-1277: Use-after-free in accessibility * CVE-2015-1278: URL spoofing using pdf files * CVE-2015-1285: Information leak in XSS auditor * CVE-2015-1288: Spell checking dictionaries fetched over HTTP * CVE-2015-1289: Various fixes from internal audits, fuzzing and other initiatives * CVE-2015-5605: Rgular-expression implementation mishandles interrupts, DoS via JS The following non-security changes are included: * A number of new apps/extension APIs * Lots of under the hood changes for stability and performance * Pepper Flash plugin updated to 18.0.0.209 Patch Instructions: To install this openSUSE Security Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE 13.2: zypper in -t patch openSUSE-2015-513=1 - openSUSE 13.1: zypper in -t patch openSUSE-2015-513=1 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE 13.2 (i586 x86_64): chromedriver-44.0.2403.89-38.1 chromedriver-debuginfo-44.0.2403.89-38.1 chromium-44.0.2403.89-38.1 chromium-debuginfo-44.0.2403.89-38.1 chromium-debugsource-44.0.2403.89-38.1 chromium-desktop-gnome-44.0.2403.89-38.1 chromium-desktop-kde-44.0.2403.89-38.1 chromium-ffmpegsumo-44.0.2403.89-38.1 chromium-ffmpegsumo-debuginfo-44.0.2403.89-38.1 - openSUSE 13.1 (i586 x86_64): chromedriver-44.0.2403.89-93.1 chromedriver-debuginfo-44.0.2403.89-93.1 chromium-44.0.2403.89-93.1 chromium-debuginfo-44.0.2403.89-93.1 chromium-debugsource-44.0.2403.89-93.1 chromium-desktop-gnome-44.0.2403.89-93.1 chromium-desktop-kde-44.0.2403.89-93.1 chromium-ffmpegsumo-44.0.2403.89-93.1 chromium-ffmpegsumo-debuginfo-44.0.2403.89-93.1 References: https://www.suse.com/security/cve/CVE-2015-1270.html https://www.suse.com/security/cve/CVE-2015-1271.html https://www.suse.com/security/cve/CVE-2015-1272.html https://www.suse.com/security/cve/CVE-2015-1273.html https://www.suse.com/security/cve/CVE-2015-1274.html https://www.suse.com/security/cve/CVE-2015-1275.html https://www.suse.com/security/cve/CVE-2015-1276.html https://www.suse.com/security/cve/CVE-2015-1277.html https://www.suse.com/security/cve/CVE-2015-1278.html https://www.suse.com/security/cve/CVE-2015-1279.html https://www.suse.com/security/cve/CVE-2015-1280.html https://www.suse.com/security/cve/CVE-2015-1281.html https://www.suse.com/security/cve/CVE-2015-1282.html https://www.suse.com/security/cve/CVE-2015-1283.html https://www.suse.com/security/cve/CVE-2015-1284.html https://www.suse.com/security/cve/CVE-2015-1285.html https://www.suse.com/security/cve/CVE-2015-1286.html https://www.suse.com/security/cve/CVE-2015-1287.html https://www.suse.com/security/cve/CVE-2015-1288.html https://www.suse.com/security/cve/CVE-2015-1289.html https://www.suse.com/security/cve/CVE-2015-5605.html https://bugzilla.suse.com/939077 -- To unsubscribe, e-mail: opensuse-security-announce+unsubscribe(a)opensuse.org For additional commands, e-mail: opensuse-security-announce+help(a)opensuse.org

1 0

[security-announce] openSUSE-SU-2015:1277-1: important: Security update for libressl
by opensuse-security＠opensuse.org 22 Jul '15

22 Jul '15

openSUSE Security Update: Security update for libressl ______________________________________________________________________________ Announcement ID: openSUSE-SU-2015:1277-1 Rating: important References: #912015 #912018 #912292 #912293 #912296 #919648 #920236 #922496 #922499 #922500 #931600 #934487 #934489 #934491 #934493 #934494 #937891 Cross-References: CVE-2014-3570 CVE-2014-3572 CVE-2014-8176 CVE-2014-8275 CVE-2015-0205 CVE-2015-0206 CVE-2015-0209 CVE-2015-0286 CVE-2015-0287 CVE-2015-0288 CVE-2015-0289 CVE-2015-1788 CVE-2015-1789 CVE-2015-1790 CVE-2015-1792 CVE-2015-4000 Affected Products: openSUSE 13.2 ______________________________________________________________________________ An update that solves 16 vulnerabilities and has one errata is now available. Description: libressl was updated to version 2.2.1 to fix 16 security issues. LibreSSL is a fork of OpenSSL. Because of that CVEs affecting OpenSSL often also affect LibreSSL. These security issues were fixed: - CVE-2014-3570: The BN_sqr implementation in OpenSSL before 0.9.8zd, 1.0.0 before 1.0.0p, and 1.0.1 before 1.0.1k did not properly calculate the square of a BIGNUM value, which might make it easier for remote attackers to defeat cryptographic protection mechanisms via unspecified vectors, related to crypto/bn/asm/mips.pl, crypto/bn/asm/x86_64-gcc.c, and crypto/bn/bn_asm.c (bsc#912296). - CVE-2014-3572: The ssl3_get_key_exchange function in s3_clnt.c in OpenSSL before 0.9.8zd, 1.0.0 before 1.0.0p, and 1.0.1 before 1.0.1k allowed remote SSL servers to conduct ECDHE-to-ECDH downgrade attacks and trigger a loss of forward secrecy by omitting the ServerKeyExchange message (bsc#912015). - CVE-2015-1792: The do_free_upto function in crypto/cms/cms_smime.c in OpenSSL before 0.9.8zg, 1.0.0 before 1.0.0s, 1.0.1 before 1.0.1n, and 1.0.2 before 1.0.2b allowed remote attackers to cause a denial of service (infinite loop) via vectors that trigger a NULL value of a BIO data structure, as demonstrated by an unrecognized X.660 OID for a hash function (bsc#934493). - CVE-2014-8275: OpenSSL before 0.9.8zd, 1.0.0 before 1.0.0p, and 1.0.1 before 1.0.1k did not enforce certain constraints on certificate data, which allowed remote attackers to defeat a fingerprint-based certificate-blacklist protection mechanism by including crafted data within a certificate's unsigned portion, related to crypto/asn1/a_verify.c, crypto/dsa/dsa_asn1.c, crypto/ecdsa/ecs_vrf.c, and crypto/x509/x_all.c (bsc#912018). - CVE-2015-0209: Use-after-free vulnerability in the d2i_ECPrivateKey function in crypto/ec/ec_asn1.c in OpenSSL before 0.9.8zf, 1.0.0 before 1.0.0r, 1.0.1 before 1.0.1m, and 1.0.2 before 1.0.2a might allowed remote attackers to cause a denial of service (memory corruption and application crash) or possibly have unspecified other impact via a malformed Elliptic Curve (EC) private-key file that is improperly handled during import (bsc#919648). - CVE-2015-1789: The X509_cmp_time function in crypto/x509/x509_vfy.c in OpenSSL before 0.9.8zg, 1.0.0 before 1.0.0s, 1.0.1 before 1.0.1n, and 1.0.2 before 1.0.2b allowed remote attackers to cause a denial of service (out-of-bounds read and application crash) via a crafted length field in ASN1_TIME data, as demonstrated by an attack against a server that supports client authentication with a custom verification callback (bsc#934489). - CVE-2015-1788: The BN_GF2m_mod_inv function in crypto/bn/bn_gf2m.c in OpenSSL before 0.9.8s, 1.0.0 before 1.0.0e, 1.0.1 before 1.0.1n, and 1.0.2 before 1.0.2b did not properly handle ECParameters structures in which the curve is over a malformed binary polynomial field, which allowed remote attackers to cause a denial of service (infinite loop) via a session that used an Elliptic Curve algorithm, as demonstrated by an attack against a server that supports client authentication (bsc#934487). - CVE-2015-1790: The PKCS7_dataDecodefunction in crypto/pkcs7/pk7_doit.c in OpenSSL before 0.9.8zg, 1.0.0 before 1.0.0s, 1.0.1 before 1.0.1n, and 1.0.2 before 1.0.2b allowed remote attackers to cause a denial of service (NULL pointer dereference and application crash) via a PKCS#7 blob that used ASN.1 encoding and lacks inner EncryptedContent data (bsc#934491). - CVE-2015-0287: The ASN1_item_ex_d2i function in crypto/asn1/tasn_dec.c in OpenSSL before 0.9.8zf, 1.0.0 before 1.0.0r, 1.0.1 before 1.0.1m, and 1.0.2 before 1.0.2a did not reinitialize CHOICE and ADB data structures, which might allowed attackers to cause a denial of service (invalid write operation and memory corruption) by leveraging an application that relies on ASN.1 structure reuse (bsc#922499). - CVE-2015-0286: The ASN1_TYPE_cmp function in crypto/asn1/a_type.c in OpenSSL before 0.9.8zf, 1.0.0 before 1.0.0r, 1.0.1 before 1.0.1m, and 1.0.2 before 1.0.2a did not properly perform boolean-type comparisons, which allowed remote attackers to cause a denial of service (invalid read operation and application crash) via a crafted X.509 certificate to an endpoint that used the certificate-verification feature (bsc#922496). - CVE-2015-0289: The PKCS#7 implementation in OpenSSL before 0.9.8zf, 1.0.0 before 1.0.0r, 1.0.1 before 1.0.1m, and 1.0.2 before 1.0.2a did not properly handle a lack of outer ContentInfo, which allowed attackers to cause a denial of service (NULL pointer dereference and application crash) by leveraging an application that processes arbitrary PKCS#7 data and providing malformed data with ASN.1 encoding, related to crypto/pkcs7/pk7_doit.c and crypto/pkcs7/pk7_lib.c (bsc#922500). - CVE-2015-0288: The X509_to_X509_REQ function in crypto/x509/x509_req.c in OpenSSL before 0.9.8zf, 1.0.0 before 1.0.0r, 1.0.1 before 1.0.1m, and 1.0.2 before 1.0.2a might allowed attackers to cause a denial of service (NULL pointer dereference and application crash) via an invalid certificate key (bsc#920236). - CVE-2014-8176: The dtls1_clear_queues function in ssl/d1_lib.c in OpenSSL before 0.9.8za, 1.0.0 before 1.0.0m, and 1.0.1 before 1.0.1h frees data structures without considering that application data can arrive between a ChangeCipherSpec message and a Finished message, which allowed remote DTLS peers to cause a denial of service (memory corruption and application crash) or possibly have unspecified other impact via unexpected application data (bsc#934494). - CVE-2015-4000: The TLS protocol 1.2 and earlier, when a DHE_EXPORT ciphersuite is enabled on a server but not on a client, did not properly convey a DHE_EXPORT choice, which allowed man-in-the-middle attackers to conduct cipher-downgrade attacks by rewriting a ClientHello with DHE replaced by DHE_EXPORT and then rewriting a ServerHello with DHE_EXPORT replaced by DHE, aka the "Logjam" issue (bsc#931600). - CVE-2015-0205: The ssl3_get_cert_verify function in s3_srvr.c in OpenSSL 1.0.0 before 1.0.0p and 1.0.1 before 1.0.1k accepts client authentication with a Diffie-Hellman (DH) certificate without requiring a CertificateVerify message, which allowed remote attackers to obtain access without knowledge of a private key via crafted TLS Handshake Protocol traffic to a server that recognizes a Certification Authority with DH support (bsc#912293). - CVE-2015-0206: Memory leak in the dtls1_buffer_record function in d1_pkt.c in OpenSSL 1.0.0 before 1.0.0p and 1.0.1 before 1.0.1k allowed remote attackers to cause a denial of service (memory consumption) by sending many duplicate records for the next epoch, leading to failure of replay detection (bsc#912292). Patch Instructions: To install this openSUSE Security Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE 13.2: zypper in -t patch openSUSE-2015-507=1 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE 13.2 (i586 x86_64): libcrypto34-2.2.1-2.3.1 libcrypto34-debuginfo-2.2.1-2.3.1 libressl-2.2.1-2.3.1 libressl-debuginfo-2.2.1-2.3.1 libressl-debugsource-2.2.1-2.3.1 libressl-devel-2.2.1-2.3.1 libssl33-2.2.1-2.3.1 libssl33-debuginfo-2.2.1-2.3.1 libtls4-2.2.1-2.3.1 libtls4-debuginfo-2.2.1-2.3.1 - openSUSE 13.2 (x86_64): libcrypto34-32bit-2.2.1-2.3.1 libcrypto34-debuginfo-32bit-2.2.1-2.3.1 libressl-devel-32bit-2.2.1-2.3.1 libssl33-32bit-2.2.1-2.3.1 libssl33-debuginfo-32bit-2.2.1-2.3.1 libtls4-32bit-2.2.1-2.3.1 libtls4-debuginfo-32bit-2.2.1-2.3.1 - openSUSE 13.2 (noarch): libressl-devel-doc-2.2.1-2.3.1 References: https://www.suse.com/security/cve/CVE-2014-3570.html https://www.suse.com/security/cve/CVE-2014-3572.html https://www.suse.com/security/cve/CVE-2014-8176.html https://www.suse.com/security/cve/CVE-2014-8275.html https://www.suse.com/security/cve/CVE-2015-0205.html https://www.suse.com/security/cve/CVE-2015-0206.html https://www.suse.com/security/cve/CVE-2015-0209.html https://www.suse.com/security/cve/CVE-2015-0286.html https://www.suse.com/security/cve/CVE-2015-0287.html https://www.suse.com/security/cve/CVE-2015-0288.html https://www.suse.com/security/cve/CVE-2015-0289.html https://www.suse.com/security/cve/CVE-2015-1788.html https://www.suse.com/security/cve/CVE-2015-1789.html https://www.suse.com/security/cve/CVE-2015-1790.html https://www.suse.com/security/cve/CVE-2015-1792.html https://www.suse.com/security/cve/CVE-2015-4000.html https://bugzilla.suse.com/912015 https://bugzilla.suse.com/912018 https://bugzilla.suse.com/912292 https://bugzilla.suse.com/912293 https://bugzilla.suse.com/912296 https://bugzilla.suse.com/919648 https://bugzilla.suse.com/920236 https://bugzilla.suse.com/922496 https://bugzilla.suse.com/922499 https://bugzilla.suse.com/922500 https://bugzilla.suse.com/931600 https://bugzilla.suse.com/934487 https://bugzilla.suse.com/934489 https://bugzilla.suse.com/934491 https://bugzilla.suse.com/934493 https://bugzilla.suse.com/934494 https://bugzilla.suse.com/937891 -- To unsubscribe, e-mail: opensuse-security-announce+unsubscribe(a)opensuse.org For additional commands, e-mail: opensuse-security-announce+help(a)opensuse.org

1 0

[security-announce] SUSE-SU-2015:1273-1: important: Security update for mariadb
by opensuse-security＠opensuse.org 21 Jul '15

21 Jul '15

SUSE Security Update: Security update for mariadb ______________________________________________________________________________ Announcement ID: SUSE-SU-2015:1273-1 Rating: important References: #906574 #919053 #919062 #920865 #920896 #921333 #924663 #924960 #924961 #934789 #936407 #936408 #936409 Cross-References: CVE-2014-8964 CVE-2015-0433 CVE-2015-0441 CVE-2015-0499 CVE-2015-0501 CVE-2015-0505 CVE-2015-2325 CVE-2015-2326 CVE-2015-2568 CVE-2015-2571 CVE-2015-2573 CVE-2015-3152 Affected Products: SUSE Linux Enterprise Workstation Extension 12 SUSE Linux Enterprise Software Development Kit 12 SUSE Linux Enterprise Server 12 SUSE Linux Enterprise Desktop 12 ______________________________________________________________________________ An update that solves 12 vulnerabilities and has one errata is now available. Description: This update fixes the following security issues: * Logjam attack: mysql uses 512 bit dh groups in SSL [bnc#934789] * CVE-2015-3152: mysql --ssl does not enforce SSL [bnc#924663] * CVE-2014-8964: heap buffer overflow [bnc#906574] * CVE-2015-2325: heap buffer overflow in compile_branch() [bnc#924960] * CVE-2015-2326: heap buffer overflow in pcre_compile2() [bnc#924961] * CVE-2015-0501: unspecified vulnerability related to Server:Compiling (CPU April 2015) * CVE-2015-2571: unspecified vulnerability related to Server:Optimizer (CPU April 2015) * CVE-2015-0505: unspecified vulnerability related to Server:DDL (CPU April 2015) * CVE-2015-0499: unspecified vulnerability related to Server:Federated (CPU April 2015) * CVE-2015-2568: unspecified vulnerability related to Server:Security:Privileges (CPU April 2015) * CVE-2015-2573: unspecified vulnerability related to Server:DDL (CPU April 2015) * CVE-2015-0433: unspecified vulnerability related to Server:InnoDB:DML (CPU April 2015) * CVE-2015-0441: unspecified vulnerability related to Server:Security:Encryption (CPU April 2015) Patch Instructions: To install this SUSE Security Update use YaST online_update. Alternatively you can run the command listed for your product: - SUSE Linux Enterprise Workstation Extension 12: zypper in -t patch SUSE-SLE-WE-12-2015-332=1 - SUSE Linux Enterprise Software Development Kit 12: zypper in -t patch SUSE-SLE-SDK-12-2015-332=1 - SUSE Linux Enterprise Server 12: zypper in -t patch SUSE-SLE-SERVER-12-2015-332=1 - SUSE Linux Enterprise Desktop 12: zypper in -t patch SUSE-SLE-DESKTOP-12-2015-332=1 To bring your system up-to-date, use "zypper patch". Package List: - SUSE Linux Enterprise Workstation Extension 12 (x86_64): libmysqlclient_r18-10.0.20-18.1 libmysqlclient_r18-32bit-10.0.20-18.1 mariadb-debuginfo-10.0.20-18.1 mariadb-debugsource-10.0.20-18.1 - SUSE Linux Enterprise Software Development Kit 12 (ppc64le s390x x86_64): libmysqlclient-devel-10.0.20-18.1 libmysqlclient_r18-10.0.20-18.1 libmysqld-devel-10.0.20-18.1 libmysqld18-10.0.20-18.1 libmysqld18-debuginfo-10.0.20-18.1 mariadb-debuginfo-10.0.20-18.1 mariadb-debugsource-10.0.20-18.1 - SUSE Linux Enterprise Server 12 (ppc64le s390x x86_64): libmysqlclient18-10.0.20-18.1 libmysqlclient18-debuginfo-10.0.20-18.1 mariadb-10.0.20-18.1 mariadb-client-10.0.20-18.1 mariadb-client-debuginfo-10.0.20-18.1 mariadb-debuginfo-10.0.20-18.1 mariadb-debugsource-10.0.20-18.1 mariadb-errormessages-10.0.20-18.1 mariadb-tools-10.0.20-18.1 mariadb-tools-debuginfo-10.0.20-18.1 - SUSE Linux Enterprise Server 12 (s390x x86_64): libmysqlclient18-32bit-10.0.20-18.1 libmysqlclient18-debuginfo-32bit-10.0.20-18.1 - SUSE Linux Enterprise Desktop 12 (x86_64): libmysqlclient18-10.0.20-18.1 libmysqlclient18-32bit-10.0.20-18.1 libmysqlclient18-debuginfo-10.0.20-18.1 libmysqlclient18-debuginfo-32bit-10.0.20-18.1 libmysqlclient_r18-10.0.20-18.1 libmysqlclient_r18-32bit-10.0.20-18.1 mariadb-10.0.20-18.1 mariadb-client-10.0.20-18.1 mariadb-client-debuginfo-10.0.20-18.1 mariadb-debuginfo-10.0.20-18.1 mariadb-debugsource-10.0.20-18.1 mariadb-errormessages-10.0.20-18.1 References: https://www.suse.com/security/cve/CVE-2014-8964.html https://www.suse.com/security/cve/CVE-2015-0433.html https://www.suse.com/security/cve/CVE-2015-0441.html https://www.suse.com/security/cve/CVE-2015-0499.html https://www.suse.com/security/cve/CVE-2015-0501.html https://www.suse.com/security/cve/CVE-2015-0505.html https://www.suse.com/security/cve/CVE-2015-2325.html https://www.suse.com/security/cve/CVE-2015-2326.html https://www.suse.com/security/cve/CVE-2015-2568.html https://www.suse.com/security/cve/CVE-2015-2571.html https://www.suse.com/security/cve/CVE-2015-2573.html https://www.suse.com/security/cve/CVE-2015-3152.html https://bugzilla.suse.com/906574 https://bugzilla.suse.com/919053 https://bugzilla.suse.com/919062 https://bugzilla.suse.com/920865 https://bugzilla.suse.com/920896 https://bugzilla.suse.com/921333 https://bugzilla.suse.com/924663 https://bugzilla.suse.com/924960 https://bugzilla.suse.com/924961 https://bugzilla.suse.com/934789 https://bugzilla.suse.com/936407 https://bugzilla.suse.com/936408 https://bugzilla.suse.com/936409 -- To unsubscribe, e-mail: opensuse-security-announce+unsubscribe(a)opensuse.org For additional commands, e-mail: opensuse-security-announce+help(a)opensuse.org

1 0

[security-announce] SUSE-SU-2015:1268-2: important: Security update for MozillaFirefox, mozilla-nspr, mozilla-nss
by opensuse-security＠opensuse.org 20 Jul '15

20 Jul '15

SUSE Security Update: Security update for MozillaFirefox, mozilla-nspr, mozilla-nss ______________________________________________________________________________ Announcement ID: SUSE-SU-2015:1268-2 Rating: important References: #908275 #935033 #935979 Cross-References: CVE-2015-2721 CVE-2015-2722 CVE-2015-2724 CVE-2015-2725 CVE-2015-2726 CVE-2015-2728 CVE-2015-2730 CVE-2015-2733 CVE-2015-2734 CVE-2015-2735 CVE-2015-2736 CVE-2015-2737 CVE-2015-2738 CVE-2015-2739 CVE-2015-2740 CVE-2015-2743 CVE-2015-4000 Affected Products: SUSE Linux Enterprise Software Development Kit 11-SP4 SUSE Linux Enterprise Software Development Kit 11-SP3 SUSE Linux Enterprise Server for VMWare 11-SP3 SUSE Linux Enterprise Server 11-SP4 SUSE Linux Enterprise Server 11-SP3 SUSE Linux Enterprise Desktop 11-SP4 SUSE Linux Enterprise Desktop 11-SP3 SUSE Linux Enterprise Debuginfo 11-SP4 SUSE Linux Enterprise Debuginfo 11-SP3 ______________________________________________________________________________ An update that fixes 17 vulnerabilities is now available. Description: MozillaFirefox, mozilla-nspr and mozilla-nss were updated to fix 17 security issues. For more details please check the changelogs. These security issues were fixed: - CVE-2015-2724/CVE-2015-2725/CVE-2015-2726: Miscellaneous memory safety hazards (bsc#935979). - CVE-2015-2728: Type confusion in Indexed Database Manager (bsc#935979). - CVE-2015-2730: ECDSA signature validation fails to handle some signatures correctly (bsc#935979). - CVE-2015-2722/CVE-2015-2733: Use-after-free in workers while using XMLHttpRequest (bsc#935979). - CVE-2015-2734/CVE-2015-2735/CVE-2015-2736/CVE-2015-2737/CVE-2015-2738/CVE-2 015-2739/CVE-2015-2740: Vulnerabilities found through code inspection (bsc#935979). - CVE-2015-2743: Privilege escalation in PDF.js (bsc#935979). - CVE-2015-4000: NSS accepts export-length DHE keys with regular DHE cipher suites (bsc#935033). - CVE-2015-2721: NSS incorrectly permits skipping of ServerKeyExchange (bsc#935979). This non-security issue was fixed: - bsc#908275: Firefox did not print in landscape orientation. Patch Instructions: To install this SUSE Security Update use YaST online_update. Alternatively you can run the command listed for your product: - SUSE Linux Enterprise Software Development Kit 11-SP4: zypper in -t patch sdksp4-MozillaFirefox-201507-12001=1 - SUSE Linux Enterprise Software Development Kit 11-SP3: zypper in -t patch sdksp3-MozillaFirefox-201507-12001=1 - SUSE Linux Enterprise Server for VMWare 11-SP3: zypper in -t patch slessp3-MozillaFirefox-201507-12001=1 - SUSE Linux Enterprise Server 11-SP4: zypper in -t patch slessp4-MozillaFirefox-201507-12001=1 - SUSE Linux Enterprise Server 11-SP3: zypper in -t patch slessp3-MozillaFirefox-201507-12001=1 - SUSE Linux Enterprise Desktop 11-SP4: zypper in -t patch sledsp4-MozillaFirefox-201507-12001=1 - SUSE Linux Enterprise Desktop 11-SP3: zypper in -t patch sledsp3-MozillaFirefox-201507-12001=1 - SUSE Linux Enterprise Debuginfo 11-SP4: zypper in -t patch dbgsp4-MozillaFirefox-201507-12001=1 - SUSE Linux Enterprise Debuginfo 11-SP3: zypper in -t patch dbgsp3-MozillaFirefox-201507-12001=1 To bring your system up-to-date, use "zypper patch". Package List: - SUSE Linux Enterprise Software Development Kit 11-SP4 (i586 ia64 ppc64 s390x x86_64): MozillaFirefox-devel-31.8.0esr-0.10.1 mozilla-nspr-devel-4.10.8-0.5.1 mozilla-nss-devel-3.19.2_CKBI_1.98-0.10.1 - SUSE Linux Enterprise Software Development Kit 11-SP3 (i586 ia64 ppc64 s390x x86_64): MozillaFirefox-devel-31.8.0esr-0.10.1 mozilla-nspr-devel-4.10.8-0.5.1 mozilla-nss-devel-3.19.2_CKBI_1.98-0.10.1 - SUSE Linux Enterprise Server for VMWare 11-SP3 (i586 x86_64): MozillaFirefox-31.8.0esr-0.10.1 MozillaFirefox-translations-31.8.0esr-0.10.1 libfreebl3-3.19.2_CKBI_1.98-0.10.1 libsoftokn3-3.19.2_CKBI_1.98-0.10.1 mozilla-nspr-4.10.8-0.5.1 mozilla-nss-3.19.2_CKBI_1.98-0.10.1 mozilla-nss-tools-3.19.2_CKBI_1.98-0.10.1 - SUSE Linux Enterprise Server for VMWare 11-SP3 (x86_64): libfreebl3-32bit-3.19.2_CKBI_1.98-0.10.1 libsoftokn3-32bit-3.19.2_CKBI_1.98-0.10.1 mozilla-nspr-32bit-4.10.8-0.5.1 mozilla-nss-32bit-3.19.2_CKBI_1.98-0.10.1 - SUSE Linux Enterprise Server 11-SP4 (i586 s390x x86_64): MozillaFirefox-31.8.0esr-0.10.1 MozillaFirefox-translations-31.8.0esr-0.10.1 libfreebl3-3.19.2_CKBI_1.98-0.10.1 libsoftokn3-3.19.2_CKBI_1.98-0.10.1 mozilla-nspr-4.10.8-0.5.1 mozilla-nss-3.19.2_CKBI_1.98-0.10.1 mozilla-nss-tools-3.19.2_CKBI_1.98-0.10.1 - SUSE Linux Enterprise Server 11-SP4 (s390x x86_64): libfreebl3-32bit-3.19.2_CKBI_1.98-0.10.1 libsoftokn3-32bit-3.19.2_CKBI_1.98-0.10.1 mozilla-nspr-32bit-4.10.8-0.5.1 mozilla-nss-32bit-3.19.2_CKBI_1.98-0.10.1 - SUSE Linux Enterprise Server 11-SP3 (i586 ia64 ppc64 s390x x86_64): MozillaFirefox-31.8.0esr-0.10.1 MozillaFirefox-translations-31.8.0esr-0.10.1 libfreebl3-3.19.2_CKBI_1.98-0.10.1 libsoftokn3-3.19.2_CKBI_1.98-0.10.1 mozilla-nspr-4.10.8-0.5.1 mozilla-nss-3.19.2_CKBI_1.98-0.10.1 mozilla-nss-tools-3.19.2_CKBI_1.98-0.10.1 - SUSE Linux Enterprise Server 11-SP3 (ppc64 s390x x86_64): libfreebl3-32bit-3.19.2_CKBI_1.98-0.10.1 libsoftokn3-32bit-3.19.2_CKBI_1.98-0.10.1 mozilla-nspr-32bit-4.10.8-0.5.1 mozilla-nss-32bit-3.19.2_CKBI_1.98-0.10.1 - SUSE Linux Enterprise Server 11-SP3 (ia64): libfreebl3-x86-3.19.2_CKBI_1.98-0.10.1 libsoftokn3-x86-3.19.2_CKBI_1.98-0.10.1 mozilla-nspr-x86-4.10.8-0.5.1 mozilla-nss-x86-3.19.2_CKBI_1.98-0.10.1 - SUSE Linux Enterprise Desktop 11-SP4 (i586 x86_64): MozillaFirefox-31.8.0esr-0.10.1 MozillaFirefox-translations-31.8.0esr-0.10.1 libfreebl3-3.19.2_CKBI_1.98-0.10.1 libsoftokn3-3.19.2_CKBI_1.98-0.10.1 mozilla-nspr-4.10.8-0.5.1 mozilla-nss-3.19.2_CKBI_1.98-0.10.1 mozilla-nss-tools-3.19.2_CKBI_1.98-0.10.1 - SUSE Linux Enterprise Desktop 11-SP4 (x86_64): libfreebl3-32bit-3.19.2_CKBI_1.98-0.10.1 libsoftokn3-32bit-3.19.2_CKBI_1.98-0.10.1 mozilla-nspr-32bit-4.10.8-0.5.1 mozilla-nss-32bit-3.19.2_CKBI_1.98-0.10.1 - SUSE Linux Enterprise Desktop 11-SP3 (i586 x86_64): MozillaFirefox-31.8.0esr-0.10.1 MozillaFirefox-translations-31.8.0esr-0.10.1 libfreebl3-3.19.2_CKBI_1.98-0.10.1 libsoftokn3-3.19.2_CKBI_1.98-0.10.1 mozilla-nspr-4.10.8-0.5.1 mozilla-nss-3.19.2_CKBI_1.98-0.10.1 mozilla-nss-tools-3.19.2_CKBI_1.98-0.10.1 - SUSE Linux Enterprise Desktop 11-SP3 (x86_64): libfreebl3-32bit-3.19.2_CKBI_1.98-0.10.1 libsoftokn3-32bit-3.19.2_CKBI_1.98-0.10.1 mozilla-nspr-32bit-4.10.8-0.5.1 mozilla-nss-32bit-3.19.2_CKBI_1.98-0.10.1 - SUSE Linux Enterprise Debuginfo 11-SP4 (i586 ia64 ppc64 s390x x86_64): MozillaFirefox-debuginfo-31.8.0esr-0.10.1 MozillaFirefox-debugsource-31.8.0esr-0.10.1 mozilla-nspr-debuginfo-4.10.8-0.5.1 mozilla-nspr-debugsource-4.10.8-0.5.1 mozilla-nss-debuginfo-3.19.2_CKBI_1.98-0.10.1 mozilla-nss-debugsource-3.19.2_CKBI_1.98-0.10.1 - SUSE Linux Enterprise Debuginfo 11-SP4 (ppc64 s390x x86_64): mozilla-nspr-debuginfo-32bit-4.10.8-0.5.1 - SUSE Linux Enterprise Debuginfo 11-SP4 (ia64): mozilla-nspr-debuginfo-x86-4.10.8-0.5.1 - SUSE Linux Enterprise Debuginfo 11-SP3 (i586 ia64 ppc64 s390x x86_64): MozillaFirefox-debuginfo-31.8.0esr-0.10.1 MozillaFirefox-debugsource-31.8.0esr-0.10.1 mozilla-nspr-debuginfo-4.10.8-0.5.1 mozilla-nspr-debugsource-4.10.8-0.5.1 mozilla-nss-debuginfo-3.19.2_CKBI_1.98-0.10.1 mozilla-nss-debugsource-3.19.2_CKBI_1.98-0.10.1 - SUSE Linux Enterprise Debuginfo 11-SP3 (ppc64 s390x x86_64): mozilla-nspr-debuginfo-32bit-4.10.8-0.5.1 - SUSE Linux Enterprise Debuginfo 11-SP3 (ia64): mozilla-nspr-debuginfo-x86-4.10.8-0.5.1 References: https://www.suse.com/security/cve/CVE-2015-2721.html https://www.suse.com/security/cve/CVE-2015-2722.html https://www.suse.com/security/cve/CVE-2015-2724.html https://www.suse.com/security/cve/CVE-2015-2725.html https://www.suse.com/security/cve/CVE-2015-2726.html https://www.suse.com/security/cve/CVE-2015-2728.html https://www.suse.com/security/cve/CVE-2015-2730.html https://www.suse.com/security/cve/CVE-2015-2733.html https://www.suse.com/security/cve/CVE-2015-2734.html https://www.suse.com/security/cve/CVE-2015-2735.html https://www.suse.com/security/cve/CVE-2015-2736.html https://www.suse.com/security/cve/CVE-2015-2737.html https://www.suse.com/security/cve/CVE-2015-2738.html https://www.suse.com/security/cve/CVE-2015-2739.html https://www.suse.com/security/cve/CVE-2015-2740.html https://www.suse.com/security/cve/CVE-2015-2743.html https://www.suse.com/security/cve/CVE-2015-4000.html https://bugzilla.suse.com/908275 https://bugzilla.suse.com/935033 https://bugzilla.suse.com/935979 -- To unsubscribe, e-mail: opensuse-security-announce+unsubscribe(a)opensuse.org For additional commands, e-mail: opensuse-security-announce+help(a)opensuse.org

1 0

[security-announce] SUSE-SU-2015:1269-1: important: Security update for MozillaFirefox, mozilla-nspr, mozilla-nss
by opensuse-security＠opensuse.org 20 Jul '15

20 Jul '15

SUSE Security Update: Security update for MozillaFirefox, mozilla-nspr, mozilla-nss ______________________________________________________________________________ Announcement ID: SUSE-SU-2015:1269-1 Rating: important References: #856315 #935033 #935979 Cross-References: CVE-2015-2721 CVE-2015-2722 CVE-2015-2724 CVE-2015-2725 CVE-2015-2726 CVE-2015-2728 CVE-2015-2730 CVE-2015-2733 CVE-2015-2734 CVE-2015-2735 CVE-2015-2736 CVE-2015-2737 CVE-2015-2738 CVE-2015-2739 CVE-2015-2740 CVE-2015-2743 CVE-2015-4000 Affected Products: SUSE Linux Enterprise Software Development Kit 12 SUSE Linux Enterprise Server 12 SUSE Linux Enterprise Desktop 12 ______________________________________________________________________________ An update that fixes 17 vulnerabilities is now available. Description: MozillaFirefox, mozilla-nspr and mozilla-nss were updated to fix 17 security issues. For more details please check the changelogs. - CVE-2015-2724/CVE-2015-2725/CVE-2015-2726: Miscellaneous memory safety hazards (bsc#935979). - CVE-2015-2728: Type confusion in Indexed Database Manager (bsc#935979). - CVE-2015-2730: ECDSA signature validation fails to handle some signatures correctly (bsc#935979). - CVE-2015-2722/CVE-2015-2733: Use-after-free in workers while using XMLHttpRequest (bsc#935979). - CVE-2015-2734/CVE-2015-2735/CVE-2015-2736/CVE-2015-2737/CVE-2015-2738/CVE-2 015-2739/CVE-2015-2740: Vulnerabilities found through code inspection (bsc#935979). - CVE-2015-2743: Privilege escalation in PDF.js (bsc#935979). - CVE-2015-4000: NSS accepts export-length DHE keys with regular DHE cipher suites (bsc#935033). - CVE-2015-2721: NSS incorrectly permits skipping of ServerKeyExchange (bsc#935979). Patch Instructions: To install this SUSE Security Update use YaST online_update. Alternatively you can run the command listed for your product: - SUSE Linux Enterprise Software Development Kit 12: zypper in -t patch SUSE-SLE-SDK-12-2015-330=1 - SUSE Linux Enterprise Server 12: zypper in -t patch SUSE-SLE-SERVER-12-2015-330=1 - SUSE Linux Enterprise Desktop 12: zypper in -t patch SUSE-SLE-DESKTOP-12-2015-330=1 To bring your system up-to-date, use "zypper patch". Package List: - SUSE Linux Enterprise Software Development Kit 12 (ppc64le s390x x86_64): MozillaFirefox-debuginfo-31.8.0esr-37.3 MozillaFirefox-debugsource-31.8.0esr-37.3 MozillaFirefox-devel-31.8.0esr-37.3 mozilla-nspr-debuginfo-4.10.8-3.1 mozilla-nspr-debugsource-4.10.8-3.1 mozilla-nspr-devel-4.10.8-3.1 mozilla-nss-debuginfo-3.19.2_CKBI_1.98-21.1 mozilla-nss-debugsource-3.19.2_CKBI_1.98-21.1 mozilla-nss-devel-3.19.2_CKBI_1.98-21.1 - SUSE Linux Enterprise Server 12 (ppc64le s390x x86_64): MozillaFirefox-31.8.0esr-37.3 MozillaFirefox-debuginfo-31.8.0esr-37.3 MozillaFirefox-debugsource-31.8.0esr-37.3 MozillaFirefox-translations-31.8.0esr-37.3 libfreebl3-3.19.2_CKBI_1.98-21.1 libfreebl3-debuginfo-3.19.2_CKBI_1.98-21.1 libfreebl3-hmac-3.19.2_CKBI_1.98-21.1 libsoftokn3-3.19.2_CKBI_1.98-21.1 libsoftokn3-debuginfo-3.19.2_CKBI_1.98-21.1 libsoftokn3-hmac-3.19.2_CKBI_1.98-21.1 mozilla-nspr-4.10.8-3.1 mozilla-nspr-debuginfo-4.10.8-3.1 mozilla-nspr-debugsource-4.10.8-3.1 mozilla-nss-3.19.2_CKBI_1.98-21.1 mozilla-nss-certs-3.19.2_CKBI_1.98-21.1 mozilla-nss-certs-debuginfo-3.19.2_CKBI_1.98-21.1 mozilla-nss-debuginfo-3.19.2_CKBI_1.98-21.1 mozilla-nss-debugsource-3.19.2_CKBI_1.98-21.1 mozilla-nss-tools-3.19.2_CKBI_1.98-21.1 mozilla-nss-tools-debuginfo-3.19.2_CKBI_1.98-21.1 - SUSE Linux Enterprise Server 12 (s390x x86_64): libfreebl3-32bit-3.19.2_CKBI_1.98-21.1 libfreebl3-debuginfo-32bit-3.19.2_CKBI_1.98-21.1 libfreebl3-hmac-32bit-3.19.2_CKBI_1.98-21.1 libsoftokn3-32bit-3.19.2_CKBI_1.98-21.1 libsoftokn3-debuginfo-32bit-3.19.2_CKBI_1.98-21.1 libsoftokn3-hmac-32bit-3.19.2_CKBI_1.98-21.1 mozilla-nspr-32bit-4.10.8-3.1 mozilla-nspr-debuginfo-32bit-4.10.8-3.1 mozilla-nss-32bit-3.19.2_CKBI_1.98-21.1 mozilla-nss-certs-32bit-3.19.2_CKBI_1.98-21.1 mozilla-nss-certs-debuginfo-32bit-3.19.2_CKBI_1.98-21.1 mozilla-nss-debuginfo-32bit-3.19.2_CKBI_1.98-21.1 - SUSE Linux Enterprise Desktop 12 (x86_64): MozillaFirefox-31.8.0esr-37.3 MozillaFirefox-debuginfo-31.8.0esr-37.3 MozillaFirefox-debugsource-31.8.0esr-37.3 MozillaFirefox-translations-31.8.0esr-37.3 libfreebl3-3.19.2_CKBI_1.98-21.1 libfreebl3-32bit-3.19.2_CKBI_1.98-21.1 libfreebl3-debuginfo-3.19.2_CKBI_1.98-21.1 libfreebl3-debuginfo-32bit-3.19.2_CKBI_1.98-21.1 libsoftokn3-3.19.2_CKBI_1.98-21.1 libsoftokn3-32bit-3.19.2_CKBI_1.98-21.1 libsoftokn3-debuginfo-3.19.2_CKBI_1.98-21.1 libsoftokn3-debuginfo-32bit-3.19.2_CKBI_1.98-21.1 mozilla-nspr-32bit-4.10.8-3.1 mozilla-nspr-4.10.8-3.1 mozilla-nspr-debuginfo-32bit-4.10.8-3.1 mozilla-nspr-debuginfo-4.10.8-3.1 mozilla-nspr-debugsource-4.10.8-3.1 mozilla-nss-3.19.2_CKBI_1.98-21.1 mozilla-nss-32bit-3.19.2_CKBI_1.98-21.1 mozilla-nss-certs-3.19.2_CKBI_1.98-21.1 mozilla-nss-certs-32bit-3.19.2_CKBI_1.98-21.1 mozilla-nss-certs-debuginfo-3.19.2_CKBI_1.98-21.1 mozilla-nss-certs-debuginfo-32bit-3.19.2_CKBI_1.98-21.1 mozilla-nss-debuginfo-3.19.2_CKBI_1.98-21.1 mozilla-nss-debuginfo-32bit-3.19.2_CKBI_1.98-21.1 mozilla-nss-debugsource-3.19.2_CKBI_1.98-21.1 mozilla-nss-tools-3.19.2_CKBI_1.98-21.1 mozilla-nss-tools-debuginfo-3.19.2_CKBI_1.98-21.1 References: https://www.suse.com/security/cve/CVE-2015-2721.html https://www.suse.com/security/cve/CVE-2015-2722.html https://www.suse.com/security/cve/CVE-2015-2724.html https://www.suse.com/security/cve/CVE-2015-2725.html https://www.suse.com/security/cve/CVE-2015-2726.html https://www.suse.com/security/cve/CVE-2015-2728.html https://www.suse.com/security/cve/CVE-2015-2730.html https://www.suse.com/security/cve/CVE-2015-2733.html https://www.suse.com/security/cve/CVE-2015-2734.html https://www.suse.com/security/cve/CVE-2015-2735.html https://www.suse.com/security/cve/CVE-2015-2736.html https://www.suse.com/security/cve/CVE-2015-2737.html https://www.suse.com/security/cve/CVE-2015-2738.html https://www.suse.com/security/cve/CVE-2015-2739.html https://www.suse.com/security/cve/CVE-2015-2740.html https://www.suse.com/security/cve/CVE-2015-2743.html https://www.suse.com/security/cve/CVE-2015-4000.html https://bugzilla.suse.com/856315 https://bugzilla.suse.com/935033 https://bugzilla.suse.com/935979 -- To unsubscribe, e-mail: opensuse-security-announce+unsubscribe(a)opensuse.org For additional commands, e-mail: opensuse-security-announce+help(a)opensuse.org

1 0

[security-announce] SUSE-SU-2015:1268-1: important: Security update for MozillaFirefox, mozilla-nspr, mozilla-nss
by opensuse-security＠opensuse.org 20 Jul '15

20 Jul '15

SUSE Security Update: Security update for MozillaFirefox, mozilla-nspr, mozilla-nss ______________________________________________________________________________ Announcement ID: SUSE-SU-2015:1268-1 Rating: important References: #908275 #935033 #935979 Cross-References: CVE-2015-2721 CVE-2015-2722 CVE-2015-2724 CVE-2015-2725 CVE-2015-2726 CVE-2015-2728 CVE-2015-2730 CVE-2015-2733 CVE-2015-2734 CVE-2015-2735 CVE-2015-2736 CVE-2015-2737 CVE-2015-2738 CVE-2015-2739 CVE-2015-2740 CVE-2015-2743 CVE-2015-4000 Affected Products: SUSE Linux Enterprise Server 11-SP4 ______________________________________________________________________________ An update that fixes 17 vulnerabilities is now available. Description: MozillaFirefox, mozilla-nspr and mozilla-nss were updated to fix 17 security issues. For more details please check the changelogs. These security issues were fixed: - CVE-2015-2724/CVE-2015-2725/CVE-2015-2726: Miscellaneous memory safety hazards (bsc#935979). - CVE-2015-2728: Type confusion in Indexed Database Manager (bsc#935979). - CVE-2015-2730: ECDSA signature validation fails to handle some signatures correctly (bsc#935979). - CVE-2015-2722/CVE-2015-2733: Use-after-free in workers while using XMLHttpRequest (bsc#935979). - CVE-2015-2734/CVE-2015-2735/CVE-2015-2736/CVE-2015-2737/CVE-2015-2738/CVE-2 015-2739/CVE-2015-2740: Vulnerabilities found through code inspection (bsc#935979). - CVE-2015-2743: Privilege escalation in PDF.js (bsc#935979). - CVE-2015-4000: NSS accepts export-length DHE keys with regular DHE cipher suites (bsc#935033). - CVE-2015-2721: NSS incorrectly permits skipping of ServerKeyExchange (bsc#935979). This non-security issue was fixed: - bsc#908275: Firefox did not print in landscape orientation. Patch Instructions: To install this SUSE Security Update use YaST online_update. Alternatively you can run the command listed for your product: - SUSE Linux Enterprise Server 11-SP4: zypper in -t patch slessp4-MozillaFirefox-201507-12001=1 To bring your system up-to-date, use "zypper patch". Package List: - SUSE Linux Enterprise Server 11-SP4 (ia64 ppc64): MozillaFirefox-31.8.0esr-0.10.1 MozillaFirefox-translations-31.8.0esr-0.10.1 libfreebl3-3.19.2_CKBI_1.98-0.10.1 libsoftokn3-3.19.2_CKBI_1.98-0.10.1 mozilla-nspr-4.10.8-0.5.1 mozilla-nss-3.19.2_CKBI_1.98-0.10.1 mozilla-nss-tools-3.19.2_CKBI_1.98-0.10.1 - SUSE Linux Enterprise Server 11-SP4 (ppc64): libfreebl3-32bit-3.19.2_CKBI_1.98-0.10.1 libsoftokn3-32bit-3.19.2_CKBI_1.98-0.10.1 mozilla-nspr-32bit-4.10.8-0.5.1 mozilla-nss-32bit-3.19.2_CKBI_1.98-0.10.1 - SUSE Linux Enterprise Server 11-SP4 (ia64): libfreebl3-x86-3.19.2_CKBI_1.98-0.10.1 libsoftokn3-x86-3.19.2_CKBI_1.98-0.10.1 mozilla-nspr-x86-4.10.8-0.5.1 mozilla-nss-x86-3.19.2_CKBI_1.98-0.10.1 References: https://www.suse.com/security/cve/CVE-2015-2721.html https://www.suse.com/security/cve/CVE-2015-2722.html https://www.suse.com/security/cve/CVE-2015-2724.html https://www.suse.com/security/cve/CVE-2015-2725.html https://www.suse.com/security/cve/CVE-2015-2726.html https://www.suse.com/security/cve/CVE-2015-2728.html https://www.suse.com/security/cve/CVE-2015-2730.html https://www.suse.com/security/cve/CVE-2015-2733.html https://www.suse.com/security/cve/CVE-2015-2734.html https://www.suse.com/security/cve/CVE-2015-2735.html https://www.suse.com/security/cve/CVE-2015-2736.html https://www.suse.com/security/cve/CVE-2015-2737.html https://www.suse.com/security/cve/CVE-2015-2738.html https://www.suse.com/security/cve/CVE-2015-2739.html https://www.suse.com/security/cve/CVE-2015-2740.html https://www.suse.com/security/cve/CVE-2015-2743.html https://www.suse.com/security/cve/CVE-2015-4000.html https://bugzilla.suse.com/908275 https://bugzilla.suse.com/935033 https://bugzilla.suse.com/935979 -- To unsubscribe, e-mail: opensuse-security-announce+unsubscribe(a)opensuse.org For additional commands, e-mail: opensuse-security-announce+help(a)opensuse.org

1 0