July 2015 - openSUSE Security Announce

[security-announce] openSUSE-SU-2015:1207-1: critical: Security update for flash-player
by opensuse-security＠opensuse.org 10 Jul '15

10 Jul '15

openSUSE Security Update: Security update for flash-player ______________________________________________________________________________ Announcement ID: openSUSE-SU-2015:1207-1 Rating: critical References: #937339 Cross-References: CVE-2015-5119 Affected Products: openSUSE 13.2:NonFree openSUSE 13.1:NonFree ______________________________________________________________________________ An update that fixes one vulnerability is now available. Description: flash-player was updated to fix one security issue. This security issue was fixed: - CVE-2015-5119: Unspecified vulnerability allowing remote attackers to take over the system (bsc#937339). Special Instructions and Notes: Please reboot the system after installing this update. Patch Instructions: To install this openSUSE Security Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE 13.2:NonFree: zypper in -t patch openSUSE-2015-473=1 - openSUSE 13.1:NonFree: zypper in -t patch openSUSE-2015-473=1 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE 13.2:NonFree (i586 x86_64): flash-player-11.2.202.481-2.61.1 flash-player-gnome-11.2.202.481-2.61.1 flash-player-kde4-11.2.202.481-2.61.1 - openSUSE 13.1:NonFree (i586 x86_64): flash-player-11.2.202.481-126.1 flash-player-gnome-11.2.202.481-126.1 flash-player-kde4-11.2.202.481-126.1 References: https://www.suse.com/security/cve/CVE-2015-5119.html https://bugzilla.suse.com/937339 -- To unsubscribe, e-mail: opensuse-security-announce+unsubscribe(a)opensuse.org For additional commands, e-mail: opensuse-security-announce+help(a)opensuse.org

2 1

[security-announce] openSUSE not affected by OpenSSL CVE-2015-1793
by Andreas Stieger 09 Jul '15

09 Jul '15

Dear openSUSE users, The OpenSSL Project recently pre-announced [1], and how has released [2] an advisory for a security issue with a severity rated "high". This was picked up in various news articles [3] [4]. A detail which was not known to the general public at the time when these were written was that the issue affects 1.0.2c, 1.0.2b, 1.0.1n and 1.0.1o specifically. The fixed releases are 1.0.1p and 1.0.2d, and CVE-2015-1793 was assigned to the issue. The OpenSSL versions shipped in openSUSE 13.1 and 13.2 are not affected. The openSUSE Tumbleweed distribution never received a vulnerable version and was never affected. The next submission into Factory will skip any vulnerable versions. We have updated the Bugzilla entry [5] and CVE page [6] to that effect. [1] https://mta.openssl.org/pipermail/openssl-announce/2015-July/000037.html [2] https://www.openssl.org/news/secadv_20150709.txt [3] http://www.heise.de/security/meldung/Kritischer-OpenSSL-Patch-voraus-273980… [4] http://www.securityweek.com/openssl-preparing-updates-patch-high-severity-v… [5] https://bugzilla.opensuse.org/show_bug.cgi?id=CVE-2015-1793 [6] https://www.suse.com/security/cve/CVE-2015-1793.html On behalf of the SUSE Security team, Andreas Stieger -- Andreas Stieger <astieger(a)suse.com> Project Manager Security SUSE Linux GmbH, GF: Felix Imendörffer, Jane Smithard, Dilip Upmanyu, Graham Norton, HRB 21284 (AG Nürnberg)

2 1

[security-announce] openSUSE-SU-2015:1216-1: important: Security update for MariaDB
by opensuse-security＠opensuse.org 09 Jul '15

09 Jul '15

openSUSE Security Update: Security update for MariaDB ______________________________________________________________________________ Announcement ID: openSUSE-SU-2015:1216-1 Rating: important References: #859345 #914370 #924663 #934789 #936407 #936408 #936409 Cross-References: CVE-2014-6464 CVE-2014-6469 CVE-2014-6491 CVE-2014-6494 CVE-2014-6496 CVE-2014-6500 CVE-2014-6507 CVE-2014-6555 CVE-2014-6559 CVE-2014-6568 CVE-2014-8964 CVE-2015-0374 CVE-2015-0381 CVE-2015-0382 CVE-2015-0411 CVE-2015-0432 CVE-2015-0433 CVE-2015-0441 CVE-2015-0499 CVE-2015-0501 CVE-2015-0505 CVE-2015-2325 CVE-2015-2326 CVE-2015-2568 CVE-2015-2571 CVE-2015-2573 CVE-2015-3152 CVE-2015-4000 Affected Products: openSUSE 13.2 openSUSE 13.1 ______________________________________________________________________________ An update that fixes 28 vulnerabilities is now available. Description: MariaDB was updated to its current minor version, fixing bugs and security issues. These updates include a fix for Logjam (CVE-2015-4000), making MariaDB work with client software that no longer allows short DH groups over SSL, as e.g. our current openssl packages. On openSUSE 13.1, MariaDB was updated to 5.5.44. On openSUSE 13.2, MariaDB was updated from 10.0.13 to 10.0.20. Please read the release notes of MariaDB https://mariadb.com/kb/en/mariadb/mariadb-10020-release-notes/ https://mariadb.com/kb/en/mariadb/mariadb-10019-release-notes/ https://mariadb.com/kb/en/mariadb/mariadb-10018-release-notes/ https://mariadb.com/kb/en/mariadb/mariadb-10017-release-notes/ https://mariadb.com/kb/en/mariadb/mariadb-10016-release-notes/ https://mariadb.com/kb/en/mariadb/mariadb-10015-release-notes/ https://mariadb.com/kb/en/mariadb/mariadb-10014-release-notes/ for more information. Patch Instructions: To install this openSUSE Security Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE 13.2: zypper in -t patch openSUSE-2015-479=1 - openSUSE 13.1: zypper in -t patch openSUSE-2015-479=1 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE 13.2 (i586 x86_64): libmysqlclient-devel-10.0.20-2.9.1 libmysqlclient18-10.0.20-2.9.1 libmysqlclient18-debuginfo-10.0.20-2.9.1 libmysqlclient_r18-10.0.20-2.9.1 libmysqld-devel-10.0.20-2.9.1 libmysqld18-10.0.20-2.9.1 libmysqld18-debuginfo-10.0.20-2.9.1 mariadb-10.0.20-2.9.1 mariadb-bench-10.0.20-2.9.1 mariadb-bench-debuginfo-10.0.20-2.9.1 mariadb-client-10.0.20-2.9.1 mariadb-client-debuginfo-10.0.20-2.9.1 mariadb-debuginfo-10.0.20-2.9.1 mariadb-debugsource-10.0.20-2.9.1 mariadb-errormessages-10.0.20-2.9.1 mariadb-test-10.0.20-2.9.1 mariadb-test-debuginfo-10.0.20-2.9.1 mariadb-tools-10.0.20-2.9.1 mariadb-tools-debuginfo-10.0.20-2.9.1 - openSUSE 13.2 (x86_64): libmysqlclient18-32bit-10.0.20-2.9.1 libmysqlclient18-debuginfo-32bit-10.0.20-2.9.1 libmysqlclient_r18-32bit-10.0.20-2.9.1 - openSUSE 13.1 (i586 x86_64): libmysqlclient-devel-5.5.44-4.1 libmysqlclient18-5.5.44-4.1 libmysqlclient18-debuginfo-5.5.44-4.1 libmysqlclient_r18-5.5.44-4.1 libmysqld-devel-5.5.44-4.1 libmysqld18-5.5.44-4.1 libmysqld18-debuginfo-5.5.44-4.1 mariadb-5.5.44-4.1 mariadb-bench-5.5.44-4.1 mariadb-bench-debuginfo-5.5.44-4.1 mariadb-client-5.5.44-4.1 mariadb-client-debuginfo-5.5.44-4.1 mariadb-debuginfo-5.5.44-4.1 mariadb-debugsource-5.5.44-4.1 mariadb-errormessages-5.5.44-4.1 mariadb-test-5.5.44-4.1 mariadb-test-debuginfo-5.5.44-4.1 mariadb-tools-5.5.44-4.1 mariadb-tools-debuginfo-5.5.44-4.1 - openSUSE 13.1 (x86_64): libmysqlclient18-32bit-5.5.44-4.1 libmysqlclient18-debuginfo-32bit-5.5.44-4.1 libmysqlclient_r18-32bit-5.5.44-4.1 References: https://www.suse.com/security/cve/CVE-2014-6464.html https://www.suse.com/security/cve/CVE-2014-6469.html https://www.suse.com/security/cve/CVE-2014-6491.html https://www.suse.com/security/cve/CVE-2014-6494.html https://www.suse.com/security/cve/CVE-2014-6496.html https://www.suse.com/security/cve/CVE-2014-6500.html https://www.suse.com/security/cve/CVE-2014-6507.html https://www.suse.com/security/cve/CVE-2014-6555.html https://www.suse.com/security/cve/CVE-2014-6559.html https://www.suse.com/security/cve/CVE-2014-6568.html https://www.suse.com/security/cve/CVE-2014-8964.html https://www.suse.com/security/cve/CVE-2015-0374.html https://www.suse.com/security/cve/CVE-2015-0381.html https://www.suse.com/security/cve/CVE-2015-0382.html https://www.suse.com/security/cve/CVE-2015-0411.html https://www.suse.com/security/cve/CVE-2015-0432.html https://www.suse.com/security/cve/CVE-2015-0433.html https://www.suse.com/security/cve/CVE-2015-0441.html https://www.suse.com/security/cve/CVE-2015-0499.html https://www.suse.com/security/cve/CVE-2015-0501.html https://www.suse.com/security/cve/CVE-2015-0505.html https://www.suse.com/security/cve/CVE-2015-2325.html https://www.suse.com/security/cve/CVE-2015-2326.html https://www.suse.com/security/cve/CVE-2015-2568.html https://www.suse.com/security/cve/CVE-2015-2571.html https://www.suse.com/security/cve/CVE-2015-2573.html https://www.suse.com/security/cve/CVE-2015-3152.html https://www.suse.com/security/cve/CVE-2015-4000.html https://bugzilla.suse.com/859345 https://bugzilla.suse.com/914370 https://bugzilla.suse.com/924663 https://bugzilla.suse.com/934789 https://bugzilla.suse.com/936407 https://bugzilla.suse.com/936408 https://bugzilla.suse.com/936409 -- To unsubscribe, e-mail: opensuse-security-announce+unsubscribe(a)opensuse.org For additional commands, e-mail: opensuse-security-announce+help(a)opensuse.org

1 0

[security-announce] SUSE-SU-2015:1214-1: critical: Security update for flash-player
by opensuse-security＠opensuse.org 09 Jul '15

09 Jul '15

SUSE Security Update: Security update for flash-player ______________________________________________________________________________ Announcement ID: SUSE-SU-2015:1214-1 Rating: critical References: #937339 Cross-References: CVE-2014-0578 CVE-2015-3114 CVE-2015-3115 CVE-2015-3116 CVE-2015-3117 CVE-2015-3118 CVE-2015-3119 CVE-2015-3120 CVE-2015-3121 CVE-2015-3122 CVE-2015-3123 CVE-2015-3124 CVE-2015-3125 CVE-2015-3126 CVE-2015-3127 CVE-2015-3128 CVE-2015-3129 CVE-2015-3130 CVE-2015-3131 CVE-2015-3132 CVE-2015-3133 CVE-2015-3134 CVE-2015-3135 CVE-2015-3136 CVE-2015-3137 CVE-2015-4428 CVE-2015-4429 CVE-2015-4430 CVE-2015-4431 CVE-2015-4432 CVE-2015-4433 CVE-2015-5116 CVE-2015-5117 CVE-2015-5118 CVE-2015-5119 Affected Products: SUSE Linux Enterprise Desktop 11-SP4 SUSE Linux Enterprise Desktop 11-SP3 ______________________________________________________________________________ An update that fixes 35 vulnerabilities is now available. Description: flash-player was updated to fix 35 security issues. These security issues were fixed: - CVE-2015-3135, CVE-2015-4432, CVE-2015-5118: Heap buffer overflow vulnerabilities that could lead to code execution (bsc#937339). - CVE-2015-3117, CVE-2015-3123, CVE-2015-3130, CVE-2015-3133, CVE-2015-3134, CVE-2015-4431: Memory corruption vulnerabilities that could lead to code execution (bsc#937339). - CVE-2015-3126, CVE-2015-4429: Null pointer dereference issues (bsc#937339). - CVE-2015-3114: A security bypass vulnerability that could lead to information disclosure (bsc#937339). - CVE-2015-3119, CVE-2015-3120, CVE-2015-3121, CVE-2015-3122, CVE-2015-4433: Type confusion vulnerabilities that could lead to code execution (bsc#937339). - CVE-2015-3118, CVE-2015-3124, CVE-2015-5117, CVE-2015-3127, CVE-2015-3128, CVE-2015-3129, CVE-2015-3131, CVE-2015-3132, CVE-2015-3136, CVE-2015-3137, CVE-2015-4428, CVE-2015-4430, CVE-2015-5119: Use-after-free vulnerabilities that could lead to code execution (bsc#937339). - CVE-2014-0578, CVE-2015-3115, CVE-2015-3116, CVE-2015-3125, CVE-2015-5116: Vulnerabilities that could be exploited to bypass the same-origin-policy and lead to information disclosure (bsc#937339). Patch Instructions: To install this SUSE Security Update use YaST online_update. Alternatively you can run the command listed for your product: - SUSE Linux Enterprise Desktop 11-SP4: zypper in -t patch sledsp4-flash-player-20150708-1=1 - SUSE Linux Enterprise Desktop 11-SP3: zypper in -t patch sledsp3-flash-player-20150708-1=1 To bring your system up-to-date, use "zypper patch". Package List: - SUSE Linux Enterprise Desktop 11-SP4 (i586 x86_64): flash-player-11.2.202.481-0.5.1 flash-player-gnome-11.2.202.481-0.5.1 flash-player-kde4-11.2.202.481-0.5.1 - SUSE Linux Enterprise Desktop 11-SP3 (i586 x86_64): flash-player-11.2.202.481-0.5.1 flash-player-gnome-11.2.202.481-0.5.1 flash-player-kde4-11.2.202.481-0.5.1 References: https://www.suse.com/security/cve/CVE-2014-0578.html https://www.suse.com/security/cve/CVE-2015-3114.html https://www.suse.com/security/cve/CVE-2015-3115.html https://www.suse.com/security/cve/CVE-2015-3116.html https://www.suse.com/security/cve/CVE-2015-3117.html https://www.suse.com/security/cve/CVE-2015-3118.html https://www.suse.com/security/cve/CVE-2015-3119.html https://www.suse.com/security/cve/CVE-2015-3120.html https://www.suse.com/security/cve/CVE-2015-3121.html https://www.suse.com/security/cve/CVE-2015-3122.html https://www.suse.com/security/cve/CVE-2015-3123.html https://www.suse.com/security/cve/CVE-2015-3124.html https://www.suse.com/security/cve/CVE-2015-3125.html https://www.suse.com/security/cve/CVE-2015-3126.html https://www.suse.com/security/cve/CVE-2015-3127.html https://www.suse.com/security/cve/CVE-2015-3128.html https://www.suse.com/security/cve/CVE-2015-3129.html https://www.suse.com/security/cve/CVE-2015-3130.html https://www.suse.com/security/cve/CVE-2015-3131.html https://www.suse.com/security/cve/CVE-2015-3132.html https://www.suse.com/security/cve/CVE-2015-3133.html https://www.suse.com/security/cve/CVE-2015-3134.html https://www.suse.com/security/cve/CVE-2015-3135.html https://www.suse.com/security/cve/CVE-2015-3136.html https://www.suse.com/security/cve/CVE-2015-3137.html https://www.suse.com/security/cve/CVE-2015-4428.html https://www.suse.com/security/cve/CVE-2015-4429.html https://www.suse.com/security/cve/CVE-2015-4430.html https://www.suse.com/security/cve/CVE-2015-4431.html https://www.suse.com/security/cve/CVE-2015-4432.html https://www.suse.com/security/cve/CVE-2015-4433.html https://www.suse.com/security/cve/CVE-2015-5116.html https://www.suse.com/security/cve/CVE-2015-5117.html https://www.suse.com/security/cve/CVE-2015-5118.html https://www.suse.com/security/cve/CVE-2015-5119.html https://bugzilla.suse.com/937339 -- To unsubscribe, e-mail: opensuse-security-announce+unsubscribe(a)opensuse.org For additional commands, e-mail: opensuse-security-announce+help(a)opensuse.org

1 0

[security-announce] SUSE-SU-2015:1211-1: critical: Security update for flash-player
by opensuse-security＠opensuse.org 09 Jul '15

09 Jul '15

SUSE Security Update: Security update for flash-player ______________________________________________________________________________ Announcement ID: SUSE-SU-2015:1211-1 Rating: critical References: #937339 Cross-References: CVE-2014-0578 CVE-2015-3114 CVE-2015-3115 CVE-2015-3116 CVE-2015-3117 CVE-2015-3118 CVE-2015-3119 CVE-2015-3120 CVE-2015-3121 CVE-2015-3122 CVE-2015-3123 CVE-2015-3124 CVE-2015-3125 CVE-2015-3126 CVE-2015-3127 CVE-2015-3128 CVE-2015-3129 CVE-2015-3130 CVE-2015-3131 CVE-2015-3132 CVE-2015-3133 CVE-2015-3134 CVE-2015-3135 CVE-2015-3136 CVE-2015-3137 CVE-2015-4428 CVE-2015-4429 CVE-2015-4430 CVE-2015-4431 CVE-2015-4432 CVE-2015-4433 CVE-2015-5116 CVE-2015-5117 CVE-2015-5118 CVE-2015-5119 Affected Products: SUSE Linux Enterprise Workstation Extension 12 SUSE Linux Enterprise Desktop 12 ______________________________________________________________________________ An update that fixes 35 vulnerabilities is now available. Description: flash-player was updated to fix 35 security issues. These security issues were fixed: - CVE-2015-3135, CVE-2015-4432, CVE-2015-5118: Heap buffer overflow vulnerabilities that could lead to code execution (bsc#937339). - CVE-2015-3117, CVE-2015-3123, CVE-2015-3130, CVE-2015-3133, CVE-2015-3134, CVE-2015-4431: Memory corruption vulnerabilities that could lead to code execution (bsc#937339). - CVE-2015-3126, CVE-2015-4429: Null pointer dereference issues (bsc#937339). - CVE-2015-3114: A security bypass vulnerability that could lead to information disclosure (bsc#937339). - CVE-2015-3119, CVE-2015-3120, CVE-2015-3121, CVE-2015-3122, CVE-2015-4433: Type confusion vulnerabilities that could lead to code execution (bsc#937339). - CVE-2015-3118, CVE-2015-3124, CVE-2015-5117, CVE-2015-3127, CVE-2015-3128, CVE-2015-3129, CVE-2015-3131, CVE-2015-3132, CVE-2015-3136, CVE-2015-3137, CVE-2015-4428, CVE-2015-4430, CVE-2015-5119: Use-after-free vulnerabilities that could lead to code execution (bsc#937339). - CVE-2014-0578, CVE-2015-3115, CVE-2015-3116, CVE-2015-3125, CVE-2015-5116: Vulnerabilities that could be exploited to bypass the same-origin-policy and lead to information disclosure (bsc#937339). Patch Instructions: To install this SUSE Security Update use YaST online_update. Alternatively you can run the command listed for your product: - SUSE Linux Enterprise Workstation Extension 12: zypper in -t patch SUSE-SLE-WE-12-2015-306=1 - SUSE Linux Enterprise Desktop 12: zypper in -t patch SUSE-SLE-DESKTOP-12-2015-306=1 To bring your system up-to-date, use "zypper patch". Package List: - SUSE Linux Enterprise Workstation Extension 12 (i586 x86_64): flash-player-11.2.202.481-93.1 flash-player-gnome-11.2.202.481-93.1 - SUSE Linux Enterprise Desktop 12 (i586 x86_64): flash-player-11.2.202.481-93.1 flash-player-gnome-11.2.202.481-93.1 References: https://www.suse.com/security/cve/CVE-2014-0578.html https://www.suse.com/security/cve/CVE-2015-3114.html https://www.suse.com/security/cve/CVE-2015-3115.html https://www.suse.com/security/cve/CVE-2015-3116.html https://www.suse.com/security/cve/CVE-2015-3117.html https://www.suse.com/security/cve/CVE-2015-3118.html https://www.suse.com/security/cve/CVE-2015-3119.html https://www.suse.com/security/cve/CVE-2015-3120.html https://www.suse.com/security/cve/CVE-2015-3121.html https://www.suse.com/security/cve/CVE-2015-3122.html https://www.suse.com/security/cve/CVE-2015-3123.html https://www.suse.com/security/cve/CVE-2015-3124.html https://www.suse.com/security/cve/CVE-2015-3125.html https://www.suse.com/security/cve/CVE-2015-3126.html https://www.suse.com/security/cve/CVE-2015-3127.html https://www.suse.com/security/cve/CVE-2015-3128.html https://www.suse.com/security/cve/CVE-2015-3129.html https://www.suse.com/security/cve/CVE-2015-3130.html https://www.suse.com/security/cve/CVE-2015-3131.html https://www.suse.com/security/cve/CVE-2015-3132.html https://www.suse.com/security/cve/CVE-2015-3133.html https://www.suse.com/security/cve/CVE-2015-3134.html https://www.suse.com/security/cve/CVE-2015-3135.html https://www.suse.com/security/cve/CVE-2015-3136.html https://www.suse.com/security/cve/CVE-2015-3137.html https://www.suse.com/security/cve/CVE-2015-4428.html https://www.suse.com/security/cve/CVE-2015-4429.html https://www.suse.com/security/cve/CVE-2015-4430.html https://www.suse.com/security/cve/CVE-2015-4431.html https://www.suse.com/security/cve/CVE-2015-4432.html https://www.suse.com/security/cve/CVE-2015-4433.html https://www.suse.com/security/cve/CVE-2015-5116.html https://www.suse.com/security/cve/CVE-2015-5117.html https://www.suse.com/security/cve/CVE-2015-5118.html https://www.suse.com/security/cve/CVE-2015-5119.html https://bugzilla.suse.com/937339 -- To unsubscribe, e-mail: opensuse-security-announce+unsubscribe(a)opensuse.org For additional commands, e-mail: opensuse-security-announce+help(a)opensuse.org

1 0

[security-announce] openSUSE-SU-2015:1210-1: critical: Security update for flash-player
by opensuse-security＠opensuse.org 08 Jul '15

08 Jul '15

openSUSE Security Update: Security update for flash-player ______________________________________________________________________________ Announcement ID: openSUSE-SU-2015:1210-1 Rating: critical References: #937339 Cross-References: CVE-2015-5119 Affected Products: openSUSE Evergreen 11.4 ______________________________________________________________________________ An update that fixes one vulnerability is now available. Description: flash-player was updated to fix one security issue. This security issue was fixed: - CVE-2015-5119: Unspecified vulnerability allowing remote attackers to take over the system (bsc#937339). Patch Instructions: To install this openSUSE Security Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE Evergreen 11.4: zypper in -t patch 2015-475=1 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE Evergreen 11.4 (i586 x86_64): flash-player-11.2.202.481-170.1 flash-player-gnome-11.2.202.481-170.1 flash-player-kde4-11.2.202.481-170.1 References: https://www.suse.com/security/cve/CVE-2015-5119.html https://bugzilla.suse.com/937339 -- To unsubscribe, e-mail: opensuse-security-announce+unsubscribe(a)opensuse.org For additional commands, e-mail: opensuse-security-announce+help(a)opensuse.org

1 0

[security-announce] SUSE-SU-2015:1206-1: important: Security update for Xen
by opensuse-security＠opensuse.org 08 Jul '15

08 Jul '15

SUSE Security Update: Security update for Xen ______________________________________________________________________________ Announcement ID: SUSE-SU-2015:1206-1 Rating: important References: #932770 #932996 Cross-References: CVE-2015-3209 CVE-2015-4164 Affected Products: SUSE Linux Enterprise Server 10 SP4 LTSS ______________________________________________________________________________ An update that fixes two vulnerabilities is now available. Description: Xen was updated to fix two security issues: * CVE-2015-3209: Heap overflow in qemu pcnet controller allowing guest to host escape. (XSA-135, bsc#932770) * CVE-2015-4164: DoS through iret hypercall handler. (XSA-136, bsc#932996) Security Issues: * CVE-2015-4164 <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2015-4164> * CVE-2015-3209 <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2015-3209> Special Instructions and Notes: Please reboot the system after installing this update. Package List: - SUSE Linux Enterprise Server 10 SP4 LTSS (i586 x86_64): xen-3.2.3_17040_46-0.17.1 xen-devel-3.2.3_17040_46-0.17.1 xen-doc-html-3.2.3_17040_46-0.17.1 xen-doc-pdf-3.2.3_17040_46-0.17.1 xen-doc-ps-3.2.3_17040_46-0.17.1 xen-kmp-debug-3.2.3_17040_46_2.6.16.60_0.132.3-0.17.1 xen-kmp-default-3.2.3_17040_46_2.6.16.60_0.132.3-0.17.1 xen-kmp-kdump-3.2.3_17040_46_2.6.16.60_0.132.3-0.17.1 xen-kmp-smp-3.2.3_17040_46_2.6.16.60_0.132.3-0.17.1 xen-libs-3.2.3_17040_46-0.17.1 xen-tools-3.2.3_17040_46-0.17.1 xen-tools-domU-3.2.3_17040_46-0.17.1 xen-tools-ioemu-3.2.3_17040_46-0.17.1 - SUSE Linux Enterprise Server 10 SP4 LTSS (x86_64): xen-libs-32bit-3.2.3_17040_46-0.17.1 - SUSE Linux Enterprise Server 10 SP4 LTSS (i586): xen-kmp-bigsmp-3.2.3_17040_46_2.6.16.60_0.132.3-0.17.1 xen-kmp-kdumppae-3.2.3_17040_46_2.6.16.60_0.132.3-0.17.1 xen-kmp-vmi-3.2.3_17040_46_2.6.16.60_0.132.3-0.17.1 xen-kmp-vmipae-3.2.3_17040_46_2.6.16.60_0.132.3-0.17.1 References: https://www.suse.com/security/cve/CVE-2015-3209.html https://www.suse.com/security/cve/CVE-2015-4164.html https://bugzilla.suse.com/932770 https://bugzilla.suse.com/932996 https://download.suse.com/patch/finder/?keywords=f26fb5291b18bbfa26447df16a… -- To unsubscribe, e-mail: opensuse-security-announce+unsubscribe(a)opensuse.org For additional commands, e-mail: opensuse-security-announce+help(a)opensuse.org

1 0

[security-announce] SUSE-SU-2015:1205-1: important: Security update for bind
by opensuse-security＠opensuse.org 08 Jul '15

08 Jul '15

SUSE Security Update: Security update for bind ______________________________________________________________________________ Announcement ID: SUSE-SU-2015:1205-1 Rating: important References: #918330 #936476 Cross-References: CVE-2015-1349 CVE-2015-4620 Affected Products: SUSE Linux Enterprise Software Development Kit 11 SP3 SUSE Linux Enterprise Server 11 SP3 for VMware SUSE Linux Enterprise Server 11 SP3 SUSE Linux Enterprise Desktop 11 SP3 ______________________________________________________________________________ An update that fixes two vulnerabilities is now available. It includes one version update. Description: bind was updated to fix two security issues: * CVE-2015-1349: A problem with trust anchor management could have caused named to crash (bsc#918330). * CVE-2015-4620: Fix resolver crash when validating (bsc#936476). Security Issues: * CVE-2015-1349 <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2015-1349> * CVE-2015-4620 <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2015-4620> Patch Instructions: To install this SUSE Security Update use YaST online_update. Alternatively you can run the command listed for your product: - SUSE Linux Enterprise Software Development Kit 11 SP3: zypper in -t patch sdksp3-bind=10833 - SUSE Linux Enterprise Server 11 SP3 for VMware: zypper in -t patch slessp3-bind=10833 - SUSE Linux Enterprise Server 11 SP3: zypper in -t patch slessp3-bind=10833 - SUSE Linux Enterprise Desktop 11 SP3: zypper in -t patch sledsp3-bind=10833 To bring your system up-to-date, use "zypper patch". Package List: - SUSE Linux Enterprise Software Development Kit 11 SP3 (i586 ia64 ppc64 s390x x86_64) [New Version: 9.9.6P1]: bind-devel-9.9.6P1-0.7.1 - SUSE Linux Enterprise Software Development Kit 11 SP3 (ppc64) [New Version: 9.9.6P1]: bind-devel-32bit-9.9.6P1-0.7.1 - SUSE Linux Enterprise Server 11 SP3 for VMware (i586 x86_64) [New Version: 9.9.6P1]: bind-9.9.6P1-0.7.1 bind-chrootenv-9.9.6P1-0.7.1 bind-doc-9.9.6P1-0.7.1 bind-libs-9.9.6P1-0.7.1 bind-utils-9.9.6P1-0.7.1 - SUSE Linux Enterprise Server 11 SP3 for VMware (x86_64) [New Version: 9.9.6P1]: bind-libs-32bit-9.9.6P1-0.7.1 - SUSE Linux Enterprise Server 11 SP3 (i586 ia64 ppc64 s390x x86_64) [New Version: 9.9.6P1]: bind-9.9.6P1-0.7.1 bind-chrootenv-9.9.6P1-0.7.1 bind-doc-9.9.6P1-0.7.1 bind-libs-9.9.6P1-0.7.1 bind-utils-9.9.6P1-0.7.1 - SUSE Linux Enterprise Server 11 SP3 (ppc64 s390x x86_64) [New Version: 9.9.6P1]: bind-libs-32bit-9.9.6P1-0.7.1 - SUSE Linux Enterprise Server 11 SP3 (ia64) [New Version: 9.9.6P1]: bind-libs-x86-9.9.6P1-0.7.1 - SUSE Linux Enterprise Desktop 11 SP3 (i586 x86_64) [New Version: 9.9.6P1]: bind-libs-9.9.6P1-0.7.1 bind-utils-9.9.6P1-0.7.1 - SUSE Linux Enterprise Desktop 11 SP3 (x86_64) [New Version: 9.9.6P1]: bind-libs-32bit-9.9.6P1-0.7.1 References: https://www.suse.com/security/cve/CVE-2015-1349.html https://www.suse.com/security/cve/CVE-2015-4620.html https://bugzilla.suse.com/918330 https://bugzilla.suse.com/936476 https://download.suse.com/patch/finder/?keywords=62fe9017ea5999fde9990f72b7… -- To unsubscribe, e-mail: opensuse-security-announce+unsubscribe(a)opensuse.org For additional commands, e-mail: opensuse-security-announce+help(a)opensuse.org

1 0

[security-announce] openSUSE-SU-2015:1197-1: important: Security update for php5
by opensuse-security＠opensuse.org 06 Jul '15

06 Jul '15

openSUSE Security Update: Security update for php5 ______________________________________________________________________________ Announcement ID: openSUSE-SU-2015:1197-1 Rating: important References: #935224 #935225 #935226 #935227 #935232 #935234 #935274 #935275 Cross-References: CVE-2015-3411 CVE-2015-3412 CVE-2015-4598 CVE-2015-4599 CVE-2015-4600 CVE-2015-4601 CVE-2015-4602 CVE-2015-4603 CVE-2015-4604 CVE-2015-4605 CVE-2015-4643 CVE-2015-4644 Affected Products: openSUSE 13.2 openSUSE 13.1 ______________________________________________________________________________ An update that fixes 12 vulnerabilities is now available. Description: The PHP script interpreter was updated to receive various security fixes: * CVE-2015-4602 [bnc#935224]: Fixed an incomplete Class unserialization type confusion. * CVE-2015-4599, CVE-2015-4600, CVE-2015-4601 [bnc#935226]: Fixed type confusion issues in unserialize() with various SOAP methods. * CVE-2015-4603 [bnc#935234]: Fixed exception::getTraceAsString type confusion issue after unserialize. * CVE-2015-4644 [bnc#935274]: Fixed a crash in php_pgsql_meta_data. * CVE-2015-4643 [bnc#935275]: Fixed an integer overflow in ftp_genlist() that could result in a heap overflow. * CVE-2015-3411, CVE-2015-3412, CVE-2015-4598 [bnc#935227], [bnc#935232]: Added missing null byte checks for paths in various PHP extensions. Patch Instructions: To install this openSUSE Security Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE 13.2: zypper in -t patch openSUSE-2015-471=1 - openSUSE 13.1: zypper in -t patch openSUSE-2015-471=1 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE 13.2 (i586 x86_64): apache2-mod_php5-5.6.1-30.6 apache2-mod_php5-debuginfo-5.6.1-30.6 php5-5.6.1-30.6 php5-bcmath-5.6.1-30.6 php5-bcmath-debuginfo-5.6.1-30.6 php5-bz2-5.6.1-30.6 php5-bz2-debuginfo-5.6.1-30.6 php5-calendar-5.6.1-30.6 php5-calendar-debuginfo-5.6.1-30.6 php5-ctype-5.6.1-30.6 php5-ctype-debuginfo-5.6.1-30.6 php5-curl-5.6.1-30.6 php5-curl-debuginfo-5.6.1-30.6 php5-dba-5.6.1-30.6 php5-dba-debuginfo-5.6.1-30.6 php5-debuginfo-5.6.1-30.6 php5-debugsource-5.6.1-30.6 php5-devel-5.6.1-30.6 php5-dom-5.6.1-30.6 php5-dom-debuginfo-5.6.1-30.6 php5-enchant-5.6.1-30.6 php5-enchant-debuginfo-5.6.1-30.6 php5-exif-5.6.1-30.6 php5-exif-debuginfo-5.6.1-30.6 php5-fastcgi-5.6.1-30.6 php5-fastcgi-debuginfo-5.6.1-30.6 php5-fileinfo-5.6.1-30.6 php5-fileinfo-debuginfo-5.6.1-30.6 php5-firebird-5.6.1-30.6 php5-firebird-debuginfo-5.6.1-30.6 php5-fpm-5.6.1-30.6 php5-fpm-debuginfo-5.6.1-30.6 php5-ftp-5.6.1-30.6 php5-ftp-debuginfo-5.6.1-30.6 php5-gd-5.6.1-30.6 php5-gd-debuginfo-5.6.1-30.6 php5-gettext-5.6.1-30.6 php5-gettext-debuginfo-5.6.1-30.6 php5-gmp-5.6.1-30.6 php5-gmp-debuginfo-5.6.1-30.6 php5-iconv-5.6.1-30.6 php5-iconv-debuginfo-5.6.1-30.6 php5-imap-5.6.1-30.6 php5-imap-debuginfo-5.6.1-30.6 php5-intl-5.6.1-30.6 php5-intl-debuginfo-5.6.1-30.6 php5-json-5.6.1-30.6 php5-json-debuginfo-5.6.1-30.6 php5-ldap-5.6.1-30.6 php5-ldap-debuginfo-5.6.1-30.6 php5-mbstring-5.6.1-30.6 php5-mbstring-debuginfo-5.6.1-30.6 php5-mcrypt-5.6.1-30.6 php5-mcrypt-debuginfo-5.6.1-30.6 php5-mssql-5.6.1-30.6 php5-mssql-debuginfo-5.6.1-30.6 php5-mysql-5.6.1-30.6 php5-mysql-debuginfo-5.6.1-30.6 php5-odbc-5.6.1-30.6 php5-odbc-debuginfo-5.6.1-30.6 php5-opcache-5.6.1-30.6 php5-opcache-debuginfo-5.6.1-30.6 php5-openssl-5.6.1-30.6 php5-openssl-debuginfo-5.6.1-30.6 php5-pcntl-5.6.1-30.6 php5-pcntl-debuginfo-5.6.1-30.6 php5-pdo-5.6.1-30.6 php5-pdo-debuginfo-5.6.1-30.6 php5-pgsql-5.6.1-30.6 php5-pgsql-debuginfo-5.6.1-30.6 php5-phar-5.6.1-30.6 php5-phar-debuginfo-5.6.1-30.6 php5-posix-5.6.1-30.6 php5-posix-debuginfo-5.6.1-30.6 php5-pspell-5.6.1-30.6 php5-pspell-debuginfo-5.6.1-30.6 php5-readline-5.6.1-30.6 php5-readline-debuginfo-5.6.1-30.6 php5-shmop-5.6.1-30.6 php5-shmop-debuginfo-5.6.1-30.6 php5-snmp-5.6.1-30.6 php5-snmp-debuginfo-5.6.1-30.6 php5-soap-5.6.1-30.6 php5-soap-debuginfo-5.6.1-30.6 php5-sockets-5.6.1-30.6 php5-sockets-debuginfo-5.6.1-30.6 php5-sqlite-5.6.1-30.6 php5-sqlite-debuginfo-5.6.1-30.6 php5-suhosin-5.6.1-30.6 php5-suhosin-debuginfo-5.6.1-30.6 php5-sysvmsg-5.6.1-30.6 php5-sysvmsg-debuginfo-5.6.1-30.6 php5-sysvsem-5.6.1-30.6 php5-sysvsem-debuginfo-5.6.1-30.6 php5-sysvshm-5.6.1-30.6 php5-sysvshm-debuginfo-5.6.1-30.6 php5-tidy-5.6.1-30.6 php5-tidy-debuginfo-5.6.1-30.6 php5-tokenizer-5.6.1-30.6 php5-tokenizer-debuginfo-5.6.1-30.6 php5-wddx-5.6.1-30.6 php5-wddx-debuginfo-5.6.1-30.6 php5-xmlreader-5.6.1-30.6 php5-xmlreader-debuginfo-5.6.1-30.6 php5-xmlrpc-5.6.1-30.6 php5-xmlrpc-debuginfo-5.6.1-30.6 php5-xmlwriter-5.6.1-30.6 php5-xmlwriter-debuginfo-5.6.1-30.6 php5-xsl-5.6.1-30.6 php5-xsl-debuginfo-5.6.1-30.6 php5-zip-5.6.1-30.6 php5-zip-debuginfo-5.6.1-30.6 php5-zlib-5.6.1-30.6 php5-zlib-debuginfo-5.6.1-30.6 - openSUSE 13.2 (noarch): php5-pear-5.6.1-30.6 - openSUSE 13.1 (i586 x86_64): apache2-mod_php5-5.4.20-61.5 apache2-mod_php5-debuginfo-5.4.20-61.5 php5-5.4.20-61.5 php5-bcmath-5.4.20-61.5 php5-bcmath-debuginfo-5.4.20-61.5 php5-bz2-5.4.20-61.5 php5-bz2-debuginfo-5.4.20-61.5 php5-calendar-5.4.20-61.5 php5-calendar-debuginfo-5.4.20-61.5 php5-ctype-5.4.20-61.5 php5-ctype-debuginfo-5.4.20-61.5 php5-curl-5.4.20-61.5 php5-curl-debuginfo-5.4.20-61.5 php5-dba-5.4.20-61.5 php5-dba-debuginfo-5.4.20-61.5 php5-debuginfo-5.4.20-61.5 php5-debugsource-5.4.20-61.5 php5-devel-5.4.20-61.5 php5-dom-5.4.20-61.5 php5-dom-debuginfo-5.4.20-61.5 php5-enchant-5.4.20-61.5 php5-enchant-debuginfo-5.4.20-61.5 php5-exif-5.4.20-61.5 php5-exif-debuginfo-5.4.20-61.5 php5-fastcgi-5.4.20-61.5 php5-fastcgi-debuginfo-5.4.20-61.5 php5-fileinfo-5.4.20-61.5 php5-fileinfo-debuginfo-5.4.20-61.5 php5-firebird-5.4.20-61.5 php5-firebird-debuginfo-5.4.20-61.5 php5-fpm-5.4.20-61.5 php5-fpm-debuginfo-5.4.20-61.5 php5-ftp-5.4.20-61.5 php5-ftp-debuginfo-5.4.20-61.5 php5-gd-5.4.20-61.5 php5-gd-debuginfo-5.4.20-61.5 php5-gettext-5.4.20-61.5 php5-gettext-debuginfo-5.4.20-61.5 php5-gmp-5.4.20-61.5 php5-gmp-debuginfo-5.4.20-61.5 php5-iconv-5.4.20-61.5 php5-iconv-debuginfo-5.4.20-61.5 php5-imap-5.4.20-61.5 php5-imap-debuginfo-5.4.20-61.5 php5-intl-5.4.20-61.5 php5-intl-debuginfo-5.4.20-61.5 php5-json-5.4.20-61.5 php5-json-debuginfo-5.4.20-61.5 php5-ldap-5.4.20-61.5 php5-ldap-debuginfo-5.4.20-61.5 php5-mbstring-5.4.20-61.5 php5-mbstring-debuginfo-5.4.20-61.5 php5-mcrypt-5.4.20-61.5 php5-mcrypt-debuginfo-5.4.20-61.5 php5-mssql-5.4.20-61.5 php5-mssql-debuginfo-5.4.20-61.5 php5-mysql-5.4.20-61.5 php5-mysql-debuginfo-5.4.20-61.5 php5-odbc-5.4.20-61.5 php5-odbc-debuginfo-5.4.20-61.5 php5-openssl-5.4.20-61.5 php5-openssl-debuginfo-5.4.20-61.5 php5-pcntl-5.4.20-61.5 php5-pcntl-debuginfo-5.4.20-61.5 php5-pdo-5.4.20-61.5 php5-pdo-debuginfo-5.4.20-61.5 php5-pgsql-5.4.20-61.5 php5-pgsql-debuginfo-5.4.20-61.5 php5-phar-5.4.20-61.5 php5-phar-debuginfo-5.4.20-61.5 php5-posix-5.4.20-61.5 php5-posix-debuginfo-5.4.20-61.5 php5-pspell-5.4.20-61.5 php5-pspell-debuginfo-5.4.20-61.5 php5-readline-5.4.20-61.5 php5-readline-debuginfo-5.4.20-61.5 php5-shmop-5.4.20-61.5 php5-shmop-debuginfo-5.4.20-61.5 php5-snmp-5.4.20-61.5 php5-snmp-debuginfo-5.4.20-61.5 php5-soap-5.4.20-61.5 php5-soap-debuginfo-5.4.20-61.5 php5-sockets-5.4.20-61.5 php5-sockets-debuginfo-5.4.20-61.5 php5-sqlite-5.4.20-61.5 php5-sqlite-debuginfo-5.4.20-61.5 php5-suhosin-5.4.20-61.5 php5-suhosin-debuginfo-5.4.20-61.5 php5-sysvmsg-5.4.20-61.5 php5-sysvmsg-debuginfo-5.4.20-61.5 php5-sysvsem-5.4.20-61.5 php5-sysvsem-debuginfo-5.4.20-61.5 php5-sysvshm-5.4.20-61.5 php5-sysvshm-debuginfo-5.4.20-61.5 php5-tidy-5.4.20-61.5 php5-tidy-debuginfo-5.4.20-61.5 php5-tokenizer-5.4.20-61.5 php5-tokenizer-debuginfo-5.4.20-61.5 php5-wddx-5.4.20-61.5 php5-wddx-debuginfo-5.4.20-61.5 php5-xmlreader-5.4.20-61.5 php5-xmlreader-debuginfo-5.4.20-61.5 php5-xmlrpc-5.4.20-61.5 php5-xmlrpc-debuginfo-5.4.20-61.5 php5-xmlwriter-5.4.20-61.5 php5-xmlwriter-debuginfo-5.4.20-61.5 php5-xsl-5.4.20-61.5 php5-xsl-debuginfo-5.4.20-61.5 php5-zip-5.4.20-61.5 php5-zip-debuginfo-5.4.20-61.5 php5-zlib-5.4.20-61.5 php5-zlib-debuginfo-5.4.20-61.5 - openSUSE 13.1 (noarch): php5-pear-5.4.20-61.5 References: https://www.suse.com/security/cve/CVE-2015-3411.html https://www.suse.com/security/cve/CVE-2015-3412.html https://www.suse.com/security/cve/CVE-2015-4598.html https://www.suse.com/security/cve/CVE-2015-4599.html https://www.suse.com/security/cve/CVE-2015-4600.html https://www.suse.com/security/cve/CVE-2015-4601.html https://www.suse.com/security/cve/CVE-2015-4602.html https://www.suse.com/security/cve/CVE-2015-4603.html https://www.suse.com/security/cve/CVE-2015-4604.html https://www.suse.com/security/cve/CVE-2015-4605.html https://www.suse.com/security/cve/CVE-2015-4643.html https://www.suse.com/security/cve/CVE-2015-4644.html https://bugzilla.suse.com/935224 https://bugzilla.suse.com/935225 https://bugzilla.suse.com/935226 https://bugzilla.suse.com/935227 https://bugzilla.suse.com/935232 https://bugzilla.suse.com/935234 https://bugzilla.suse.com/935274 https://bugzilla.suse.com/935275 -- To unsubscribe, e-mail: opensuse-security-announce+unsubscribe(a)opensuse.org For additional commands, e-mail: opensuse-security-announce+help(a)opensuse.org

1 0

[security-announce] SUSE-SU-2015:1183-2: important: Security update for OpenSSL
by opensuse-security＠opensuse.org 03 Jul '15

03 Jul '15

SUSE Security Update: Security update for OpenSSL ______________________________________________________________________________ Announcement ID: SUSE-SU-2015:1183-2 Rating: important References: #929678 #931698 #934489 #934491 Cross-References: CVE-2015-1789 CVE-2015-1790 CVE-2015-4000 Affected Products: SUSE Linux Enterprise Server 10 SP4 LTSS SUSE Linux Enterprise Desktop 11 SP3 SLES for SAP Applications ______________________________________________________________________________ An update that solves three vulnerabilities and has one errata is now available. Description: OpenSSL was updated to fix several security issues. * CVE-2015-4000: The Logjam Attack ( weakdh.org ) has been addressed by rejecting connections with DH parameters shorter than 1024 bits. We now also generate 2048-bit DH parameters by default. * CVE-2015-1789: An out-of-bounds read in X509_cmp_time was fixed. * CVE-2015-1790: A PKCS7 decoder crash with missing EnvelopedContent was fixed. * fixed a timing side channel in RSA decryption (bnc#929678) Additional changes: * In the default SSL cipher string EXPORT ciphers are now disabled. This will only get active if applications get rebuilt and actually use this string. (bnc#931698) Security Issues: * CVE-2015-1789 <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2015-1789> * CVE-2015-1790 <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2015-1790> * CVE-2015-4000 <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2015-4000> Patch Instructions: To install this SUSE Security Update use YaST online_update. Alternatively you can run the command listed for your product: - SUSE Linux Enterprise Desktop 11 SP3: zypper in -t patch sledsp3-compat-openssl097g=10790 - SLES for SAP Applications: zypper in -t patch slesappsp3-compat-openssl097g=10790 To bring your system up-to-date, use "zypper patch". Package List: - SUSE Linux Enterprise Server 10 SP4 LTSS (i586 s390x x86_64): compat-openssl097g-0.9.7g-13.31.1 - SUSE Linux Enterprise Server 10 SP4 LTSS (s390x x86_64): compat-openssl097g-32bit-0.9.7g-13.31.1 - SUSE Linux Enterprise Desktop 11 SP3 (i586 x86_64): compat-openssl097g-0.9.7g-146.22.31.1 - SUSE Linux Enterprise Desktop 11 SP3 (x86_64): compat-openssl097g-32bit-0.9.7g-146.22.31.1 - SLES for SAP Applications (x86_64): compat-openssl097g-0.9.7g-146.22.31.1 compat-openssl097g-32bit-0.9.7g-146.22.31.1 References: https://www.suse.com/security/cve/CVE-2015-1789.html https://www.suse.com/security/cve/CVE-2015-1790.html https://www.suse.com/security/cve/CVE-2015-4000.html https://bugzilla.suse.com/929678 https://bugzilla.suse.com/931698 https://bugzilla.suse.com/934489 https://bugzilla.suse.com/934491 https://download.suse.com/patch/finder/?keywords=31613a0a584dc47c4e6779e1a0… https://download.suse.com/patch/finder/?keywords=9cebc5e391114f90b2cb9133b6… -- To unsubscribe, e-mail: opensuse-security-announce+unsubscribe(a)opensuse.org For additional commands, e-mail: opensuse-security-announce+help(a)opensuse.org

1 0