December 2016 - openSUSE Security Announce

[security-announce] SUSE-SU-2016:3221-1: important: Security update for xen
by opensuse-security＠opensuse.org 22 Dec '16

22 Dec '16

SUSE Security Update: Security update for xen ______________________________________________________________________________ Announcement ID: SUSE-SU-2016:3221-1 Rating: important References: #1012651 #1014298 #1016340 Cross-References: CVE-2016-10013 CVE-2016-10024 CVE-2016-9932 Affected Products: SUSE Linux Enterprise Software Development Kit 11-SP4 SUSE Linux Enterprise Server 11-SP4 SUSE Linux Enterprise Debuginfo 11-SP4 ______________________________________________________________________________ An update that fixes three vulnerabilities is now available. Description: This update for xen fixes the following issues: - A Mishandling of SYSCALL singlestep during emulation which could have lead to privilege escalation. (XSA-204, bsc#1016340, CVE-2016-10013) - CMPXCHG8B emulation failed to ignore operand size override which could have lead to information disclosure. (XSA-200, bsc#1012651, CVE-2016-9932) - PV guests may have been able to mask interrupts causing a Denial of Service. (XSA-202, bsc#1014298, CVE-2016-10024) Patch Instructions: To install this SUSE Security Update use YaST online_update. Alternatively you can run the command listed for your product: - SUSE Linux Enterprise Software Development Kit 11-SP4: zypper in -t patch sdksp4-xen-12905=1 - SUSE Linux Enterprise Server 11-SP4: zypper in -t patch slessp4-xen-12905=1 - SUSE Linux Enterprise Debuginfo 11-SP4: zypper in -t patch dbgsp4-xen-12905=1 To bring your system up-to-date, use "zypper patch". Package List: - SUSE Linux Enterprise Software Development Kit 11-SP4 (i586 x86_64): xen-devel-4.4.4_12-46.1 - SUSE Linux Enterprise Server 11-SP4 (i586 x86_64): xen-kmp-default-4.4.4_12_3.0.101_91-46.1 xen-libs-4.4.4_12-46.1 xen-tools-domU-4.4.4_12-46.1 - SUSE Linux Enterprise Server 11-SP4 (x86_64): xen-4.4.4_12-46.1 xen-doc-html-4.4.4_12-46.1 xen-libs-32bit-4.4.4_12-46.1 xen-tools-4.4.4_12-46.1 - SUSE Linux Enterprise Server 11-SP4 (i586): xen-kmp-pae-4.4.4_12_3.0.101_91-46.1 - SUSE Linux Enterprise Debuginfo 11-SP4 (i586 x86_64): xen-debuginfo-4.4.4_12-46.1 xen-debugsource-4.4.4_12-46.1 References: https://www.suse.com/security/cve/CVE-2016-10013.html https://www.suse.com/security/cve/CVE-2016-10024.html https://www.suse.com/security/cve/CVE-2016-9932.html https://bugzilla.suse.com/1012651 https://bugzilla.suse.com/1014298 https://bugzilla.suse.com/1016340 -- To unsubscribe, e-mail: opensuse-security-announce+unsubscribe(a)opensuse.org For additional commands, e-mail: opensuse-security-announce+help(a)opensuse.org

1 0

[security-announce] SUSE-SU-2016:3217-1: important: Security update for the Linux Kernel
by opensuse-security＠opensuse.org 21 Dec '16

21 Dec '16

SUSE Security Update: Security update for the Linux Kernel ______________________________________________________________________________ Announcement ID: SUSE-SU-2016:3217-1 Rating: important References: #1013533 #1013604 Cross-References: CVE-2016-9576 CVE-2016-9794 Affected Products: SUSE Linux Enterprise Server for SAP 12 SUSE Linux Enterprise Server 12-LTSS SUSE Linux Enterprise Module for Public Cloud 12 ______________________________________________________________________________ An update that fixes two vulnerabilities is now available. Description: The SUSE Linux Enterprise 12 kernel was updated to receive two security fixes. The following security bugs were fixed: - CVE-2016-9576: A use-after-free vulnerability in the SCSI generic driver allows users with write access to /dev/sg* or /dev/bsg* to elevate their privileges (bsc#1013604). - CVE-2016-9794: A use-after-free vulnerability in the ALSA pcm layer allowed local users to cause a denial of service, memory corruption or possibly even to elevate their privileges (bsc#1013533). Patch Instructions: To install this SUSE Security Update use YaST online_update. Alternatively you can run the command listed for your product: - SUSE Linux Enterprise Server for SAP 12: zypper in -t patch SUSE-SLE-SAP-12-2016-1876=1 - SUSE Linux Enterprise Server 12-LTSS: zypper in -t patch SUSE-SLE-SERVER-12-2016-1876=1 - SUSE Linux Enterprise Module for Public Cloud 12: zypper in -t patch SUSE-SLE-Module-Public-Cloud-12-2016-1876=1 To bring your system up-to-date, use "zypper patch". Package List: - SUSE Linux Enterprise Server for SAP 12 (x86_64): kernel-default-3.12.60-52.63.1 kernel-default-base-3.12.60-52.63.1 kernel-default-base-debuginfo-3.12.60-52.63.1 kernel-default-debuginfo-3.12.60-52.63.1 kernel-default-debugsource-3.12.60-52.63.1 kernel-default-devel-3.12.60-52.63.1 kernel-syms-3.12.60-52.63.1 kernel-xen-3.12.60-52.63.1 kernel-xen-base-3.12.60-52.63.1 kernel-xen-base-debuginfo-3.12.60-52.63.1 kernel-xen-debuginfo-3.12.60-52.63.1 kernel-xen-debugsource-3.12.60-52.63.1 kernel-xen-devel-3.12.60-52.63.1 kgraft-patch-3_12_60-52_63-default-1-2.1 kgraft-patch-3_12_60-52_63-xen-1-2.1 - SUSE Linux Enterprise Server for SAP 12 (noarch): kernel-devel-3.12.60-52.63.1 kernel-macros-3.12.60-52.63.1 kernel-source-3.12.60-52.63.1 - SUSE Linux Enterprise Server 12-LTSS (ppc64le s390x x86_64): kernel-default-3.12.60-52.63.1 kernel-default-base-3.12.60-52.63.1 kernel-default-base-debuginfo-3.12.60-52.63.1 kernel-default-debuginfo-3.12.60-52.63.1 kernel-default-debugsource-3.12.60-52.63.1 kernel-default-devel-3.12.60-52.63.1 kernel-syms-3.12.60-52.63.1 - SUSE Linux Enterprise Server 12-LTSS (noarch): kernel-devel-3.12.60-52.63.1 kernel-macros-3.12.60-52.63.1 kernel-source-3.12.60-52.63.1 - SUSE Linux Enterprise Server 12-LTSS (x86_64): kernel-xen-3.12.60-52.63.1 kernel-xen-base-3.12.60-52.63.1 kernel-xen-base-debuginfo-3.12.60-52.63.1 kernel-xen-debuginfo-3.12.60-52.63.1 kernel-xen-debugsource-3.12.60-52.63.1 kernel-xen-devel-3.12.60-52.63.1 kgraft-patch-3_12_60-52_63-default-1-2.1 kgraft-patch-3_12_60-52_63-xen-1-2.1 - SUSE Linux Enterprise Server 12-LTSS (s390x): kernel-default-man-3.12.60-52.63.1 - SUSE Linux Enterprise Module for Public Cloud 12 (x86_64): kernel-ec2-3.12.60-52.63.1 kernel-ec2-debuginfo-3.12.60-52.63.1 kernel-ec2-debugsource-3.12.60-52.63.1 kernel-ec2-devel-3.12.60-52.63.1 kernel-ec2-extra-3.12.60-52.63.1 kernel-ec2-extra-debuginfo-3.12.60-52.63.1 References: https://www.suse.com/security/cve/CVE-2016-9576.html https://www.suse.com/security/cve/CVE-2016-9794.html https://bugzilla.suse.com/1013533 https://bugzilla.suse.com/1013604 -- To unsubscribe, e-mail: opensuse-security-announce+unsubscribe(a)opensuse.org For additional commands, e-mail: opensuse-security-announce+help(a)opensuse.org

1 0

[security-announce] SUSE-SU-2016:3210-1: important: Security update for MozillaFirefox
by opensuse-security＠opensuse.org 21 Dec '16

21 Dec '16

SUSE Security Update: Security update for MozillaFirefox ______________________________________________________________________________ Announcement ID: SUSE-SU-2016:3210-1 Rating: important References: #1000751 #1015422 Cross-References: CVE-2016-9893 CVE-2016-9895 CVE-2016-9897 CVE-2016-9898 CVE-2016-9899 CVE-2016-9900 CVE-2016-9901 CVE-2016-9902 CVE-2016-9904 CVE-2016-9905 Affected Products: SUSE OpenStack Cloud 5 SUSE Manager Proxy 2.1 SUSE Manager 2.1 SUSE Linux Enterprise Software Development Kit 11-SP4 SUSE Linux Enterprise Server 11-SP4 SUSE Linux Enterprise Server 11-SP3-LTSS SUSE Linux Enterprise Point of Sale 11-SP3 SUSE Linux Enterprise Debuginfo 11-SP4 SUSE Linux Enterprise Debuginfo 11-SP3 ______________________________________________________________________________ An update that fixes 10 vulnerabilities is now available. Description: MozillaFirefox 45 ESR was updated to 45.6 to fix the following issues: * MFSA 2016-95/CVE-2016-9897: Memory corruption in libGLES * MFSA 2016-95/CVE-2016-9901: Data from Pocket server improperly sanitized before execution * MFSA 2016-95/CVE-2016-9898: Use-after-free in Editor while manipulating DOM subtrees * MFSA 2016-95/CVE-2016-9899: Use-after-free while manipulating DOM events and audio elements * MFSA 2016-95/CVE-2016-9904: Cross-origin information leak in shared atoms * MFSA 2016-95/CVE-2016-9905: Crash in EnumerateSubDocuments * MFSA 2016-95/CVE-2016-9895: CSP bypass using marquee tag * MFSA 2016-95/CVE-2016-9900: Restricted external resources can be loaded by SVG images through data URLs * MFSA 2016-95/CVE-2016-9893: Memory safety bugs fixed in Firefox 50.1 and Firefox ESR 45.6 * MFSA 2016-95/CVE-2016-9902: Pocket extension does not validate the origin of events Please see https://www.mozilla.org/en-US/security/advisories/mfsa2016-95/ for more information. Also the following bug was fixed: - Fix fontconfig issue (bsc#1000751) on 32bit systems as well. Patch Instructions: To install this SUSE Security Update use YaST online_update. Alternatively you can run the command listed for your product: - SUSE OpenStack Cloud 5: zypper in -t patch sleclo50sp3-MozillaFirefox-12903=1 - SUSE Manager Proxy 2.1: zypper in -t patch slemap21-MozillaFirefox-12903=1 - SUSE Manager 2.1: zypper in -t patch sleman21-MozillaFirefox-12903=1 - SUSE Linux Enterprise Software Development Kit 11-SP4: zypper in -t patch sdksp4-MozillaFirefox-12903=1 - SUSE Linux Enterprise Server 11-SP4: zypper in -t patch slessp4-MozillaFirefox-12903=1 - SUSE Linux Enterprise Server 11-SP3-LTSS: zypper in -t patch slessp3-MozillaFirefox-12903=1 - SUSE Linux Enterprise Point of Sale 11-SP3: zypper in -t patch sleposp3-MozillaFirefox-12903=1 - SUSE Linux Enterprise Debuginfo 11-SP4: zypper in -t patch dbgsp4-MozillaFirefox-12903=1 - SUSE Linux Enterprise Debuginfo 11-SP3: zypper in -t patch dbgsp3-MozillaFirefox-12903=1 To bring your system up-to-date, use "zypper patch". Package List: - SUSE OpenStack Cloud 5 (x86_64): MozillaFirefox-45.6.0esr-62.1 MozillaFirefox-translations-45.6.0esr-62.1 - SUSE Manager Proxy 2.1 (x86_64): MozillaFirefox-45.6.0esr-62.1 MozillaFirefox-translations-45.6.0esr-62.1 - SUSE Manager 2.1 (s390x x86_64): MozillaFirefox-45.6.0esr-62.1 MozillaFirefox-translations-45.6.0esr-62.1 - SUSE Linux Enterprise Software Development Kit 11-SP4 (i586 ia64 ppc64 s390x x86_64): MozillaFirefox-devel-45.6.0esr-62.1 - SUSE Linux Enterprise Server 11-SP4 (i586 ia64 ppc64 s390x x86_64): MozillaFirefox-45.6.0esr-62.1 MozillaFirefox-translations-45.6.0esr-62.1 - SUSE Linux Enterprise Server 11-SP3-LTSS (i586 s390x x86_64): MozillaFirefox-45.6.0esr-62.1 MozillaFirefox-translations-45.6.0esr-62.1 - SUSE Linux Enterprise Point of Sale 11-SP3 (i586): MozillaFirefox-45.6.0esr-62.1 MozillaFirefox-translations-45.6.0esr-62.1 - SUSE Linux Enterprise Debuginfo 11-SP4 (i586 ia64 ppc64 s390x x86_64): MozillaFirefox-debuginfo-45.6.0esr-62.1 MozillaFirefox-debugsource-45.6.0esr-62.1 - SUSE Linux Enterprise Debuginfo 11-SP3 (i586 s390x x86_64): MozillaFirefox-debuginfo-45.6.0esr-62.1 MozillaFirefox-debugsource-45.6.0esr-62.1 References: https://www.suse.com/security/cve/CVE-2016-9893.html https://www.suse.com/security/cve/CVE-2016-9895.html https://www.suse.com/security/cve/CVE-2016-9897.html https://www.suse.com/security/cve/CVE-2016-9898.html https://www.suse.com/security/cve/CVE-2016-9899.html https://www.suse.com/security/cve/CVE-2016-9900.html https://www.suse.com/security/cve/CVE-2016-9901.html https://www.suse.com/security/cve/CVE-2016-9902.html https://www.suse.com/security/cve/CVE-2016-9904.html https://www.suse.com/security/cve/CVE-2016-9905.html https://bugzilla.suse.com/1000751 https://bugzilla.suse.com/1015422 -- To unsubscribe, e-mail: opensuse-security-announce+unsubscribe(a)opensuse.org For additional commands, e-mail: opensuse-security-announce+help(a)opensuse.org

1 0

[security-announce] SUSE-SU-2016:3208-1: important: Security update for xen
by opensuse-security＠opensuse.org 21 Dec '16

21 Dec '16

SUSE Security Update: Security update for xen ______________________________________________________________________________ Announcement ID: SUSE-SU-2016:3208-1 Rating: important References: #1012651 #1014298 #1014300 #1016340 Cross-References: CVE-2016-10013 CVE-2016-10024 CVE-2016-10025 CVE-2016-9932 Affected Products: SUSE Linux Enterprise Software Development Kit 12-SP2 SUSE Linux Enterprise Server 12-SP2 SUSE Linux Enterprise Desktop 12-SP2 ______________________________________________________________________________ An update that fixes four vulnerabilities is now available. Description: This update for xen fixes the following issues: - A Mishandling of SYSCALL singlestep during emulation which could have lead to privilege escalation. (XSA-204, bsc#1016340, CVE-2016-10013) - CMPXCHG8B emulation failed to ignore operand size override which could have lead to information disclosure. (XSA-200, bsc#1012651, CVE-2016-9932) - PV guests may have been able to mask interrupts causing a Denial of Service. (XSA-202, bsc#1014298, CVE-2016-10024) - A missing NULL pointer check in VMFUNC emulation could lead to a hypervisor crash leading to a Denial of Servce. (XSA-203, bsc#1014300, CVE-2016-10025) Patch Instructions: To install this SUSE Security Update use YaST online_update. Alternatively you can run the command listed for your product: - SUSE Linux Enterprise Software Development Kit 12-SP2: zypper in -t patch SUSE-SLE-SDK-12-SP2-2016-1866=1 - SUSE Linux Enterprise Server 12-SP2: zypper in -t patch SUSE-SLE-SERVER-12-SP2-2016-1866=1 - SUSE Linux Enterprise Desktop 12-SP2: zypper in -t patch SUSE-SLE-DESKTOP-12-SP2-2016-1866=1 To bring your system up-to-date, use "zypper patch". Package List: - SUSE Linux Enterprise Software Development Kit 12-SP2 (aarch64 x86_64): xen-debugsource-4.7.1_04-28.1 xen-devel-4.7.1_04-28.1 - SUSE Linux Enterprise Server 12-SP2 (x86_64): xen-4.7.1_04-28.1 xen-debugsource-4.7.1_04-28.1 xen-doc-html-4.7.1_04-28.1 xen-libs-32bit-4.7.1_04-28.1 xen-libs-4.7.1_04-28.1 xen-libs-debuginfo-32bit-4.7.1_04-28.1 xen-libs-debuginfo-4.7.1_04-28.1 xen-tools-4.7.1_04-28.1 xen-tools-debuginfo-4.7.1_04-28.1 xen-tools-domU-4.7.1_04-28.1 xen-tools-domU-debuginfo-4.7.1_04-28.1 - SUSE Linux Enterprise Desktop 12-SP2 (x86_64): xen-4.7.1_04-28.1 xen-debugsource-4.7.1_04-28.1 xen-libs-32bit-4.7.1_04-28.1 xen-libs-4.7.1_04-28.1 xen-libs-debuginfo-32bit-4.7.1_04-28.1 xen-libs-debuginfo-4.7.1_04-28.1 References: https://www.suse.com/security/cve/CVE-2016-10013.html https://www.suse.com/security/cve/CVE-2016-10024.html https://www.suse.com/security/cve/CVE-2016-10025.html https://www.suse.com/security/cve/CVE-2016-9932.html https://bugzilla.suse.com/1012651 https://bugzilla.suse.com/1014298 https://bugzilla.suse.com/1014300 https://bugzilla.suse.com/1016340 -- To unsubscribe, e-mail: opensuse-security-announce+unsubscribe(a)opensuse.org For additional commands, e-mail: opensuse-security-announce+help(a)opensuse.org

1 0

[security-announce] SUSE-SU-2016:3207-1: important: Security update for xen
by opensuse-security＠opensuse.org 21 Dec '16

21 Dec '16

SUSE Security Update: Security update for xen ______________________________________________________________________________ Announcement ID: SUSE-SU-2016:3207-1 Rating: important References: #1012651 #1014298 #1016340 Cross-References: CVE-2016-10013 CVE-2016-10024 CVE-2016-9932 Affected Products: SUSE Linux Enterprise Software Development Kit 12-SP1 SUSE Linux Enterprise Server 12-SP1 SUSE Linux Enterprise Desktop 12-SP1 ______________________________________________________________________________ An update that fixes three vulnerabilities is now available. Description: This update for xen fixes the following issues: - A Mishandling of SYSCALL singlestep during emulation which could have lead to privilege escalation. (XSA-204, bsc#1016340, CVE-2016-10013) - CMPXCHG8B emulation failed to ignore operand size override which could have lead to information disclosure. (XSA-200, bsc#1012651, CVE-2016-9932) - PV guests may have been able to mask interrupts causing a Denial of Service. (XSA-202, bsc#1014298, CVE-2016-10024) Patch Instructions: To install this SUSE Security Update use YaST online_update. Alternatively you can run the command listed for your product: - SUSE Linux Enterprise Software Development Kit 12-SP1: zypper in -t patch SUSE-SLE-SDK-12-SP1-2016-1867=1 - SUSE Linux Enterprise Server 12-SP1: zypper in -t patch SUSE-SLE-SERVER-12-SP1-2016-1867=1 - SUSE Linux Enterprise Desktop 12-SP1: zypper in -t patch SUSE-SLE-DESKTOP-12-SP1-2016-1867=1 To bring your system up-to-date, use "zypper patch". Package List: - SUSE Linux Enterprise Software Development Kit 12-SP1 (x86_64): xen-debugsource-4.5.5_04-22.6.1 xen-devel-4.5.5_04-22.6.1 - SUSE Linux Enterprise Server 12-SP1 (x86_64): xen-4.5.5_04-22.6.1 xen-debugsource-4.5.5_04-22.6.1 xen-doc-html-4.5.5_04-22.6.1 xen-kmp-default-4.5.5_04_k3.12.67_60.64.24-22.6.1 xen-kmp-default-debuginfo-4.5.5_04_k3.12.67_60.64.24-22.6.1 xen-libs-32bit-4.5.5_04-22.6.1 xen-libs-4.5.5_04-22.6.1 xen-libs-debuginfo-32bit-4.5.5_04-22.6.1 xen-libs-debuginfo-4.5.5_04-22.6.1 xen-tools-4.5.5_04-22.6.1 xen-tools-debuginfo-4.5.5_04-22.6.1 xen-tools-domU-4.5.5_04-22.6.1 xen-tools-domU-debuginfo-4.5.5_04-22.6.1 - SUSE Linux Enterprise Desktop 12-SP1 (x86_64): xen-4.5.5_04-22.6.1 xen-debugsource-4.5.5_04-22.6.1 xen-kmp-default-4.5.5_04_k3.12.67_60.64.24-22.6.1 xen-kmp-default-debuginfo-4.5.5_04_k3.12.67_60.64.24-22.6.1 xen-libs-32bit-4.5.5_04-22.6.1 xen-libs-4.5.5_04-22.6.1 xen-libs-debuginfo-32bit-4.5.5_04-22.6.1 xen-libs-debuginfo-4.5.5_04-22.6.1 References: https://www.suse.com/security/cve/CVE-2016-10013.html https://www.suse.com/security/cve/CVE-2016-10024.html https://www.suse.com/security/cve/CVE-2016-9932.html https://bugzilla.suse.com/1012651 https://bugzilla.suse.com/1014298 https://bugzilla.suse.com/1016340 -- To unsubscribe, e-mail: opensuse-security-announce+unsubscribe(a)opensuse.org For additional commands, e-mail: opensuse-security-announce+help(a)opensuse.org

1 0

[security-announce] SUSE-SU-2016:3206-1: important: Security update for Linux Kernel Live Patch 1 for SLE 12 SP2
by opensuse-security＠opensuse.org 21 Dec '16

21 Dec '16

SUSE Security Update: Security update for Linux Kernel Live Patch 1 for SLE 12 SP2 ______________________________________________________________________________ Announcement ID: SUSE-SU-2016:3206-1 Rating: important References: #1012183 #1012759 Cross-References: CVE-2016-8655 CVE-2016-9555 Affected Products: SUSE Linux Enterprise Live Patching 12 ______________________________________________________________________________ An update that fixes two vulnerabilities is now available. Description: This update for the Linux Kernel 4.4.21-81 fixes several issues. The following security bugs were fixed: - CVE-2016-8655: A race condition in the af_packet packet_set_ring function could be used by local attackers to crash the kernel or gain privileges (bsc#1012759). - CVE-2016-9555: The sctp_sf_ootb function in net/sctp/sm_statefuns.c in the Linux kernel lacks chunk-length checking for the first chunk, which allowed remote attackers to cause a denial of service (out-of-bounds slab access) or possibly have unspecified other impact via crafted SCTP data (bsc#1012183). Patch Instructions: To install this SUSE Security Update use YaST online_update. Alternatively you can run the command listed for your product: - SUSE Linux Enterprise Live Patching 12: zypper in -t patch SUSE-SLE-Live-Patching-12-2016-1864=1 To bring your system up-to-date, use "zypper patch". Package List: - SUSE Linux Enterprise Live Patching 12 (x86_64): kgraft-patch-4_4_21-81-default-2-2.1 References: https://www.suse.com/security/cve/CVE-2016-8655.html https://www.suse.com/security/cve/CVE-2016-9555.html https://bugzilla.suse.com/1012183 https://bugzilla.suse.com/1012759 -- To unsubscribe, e-mail: opensuse-security-announce+unsubscribe(a)opensuse.org For additional commands, e-mail: opensuse-security-announce+help(a)opensuse.org

1 0

[security-announce] SUSE-SU-2016:3205-1: important: Security update for Linux Kernel Live Patch 9 for SLE 12 SP1
by opensuse-security＠opensuse.org 21 Dec '16

21 Dec '16

SUSE Security Update: Security update for Linux Kernel Live Patch 9 for SLE 12 SP1 ______________________________________________________________________________ Announcement ID: SUSE-SU-2016:3205-1 Rating: important References: #1012183 #1012759 Cross-References: CVE-2016-8655 CVE-2016-9555 Affected Products: SUSE Linux Enterprise Live Patching 12 ______________________________________________________________________________ An update that fixes two vulnerabilities is now available. Description: This update for the Linux Kernel 3.12.67-60_64_18 fixes several issues. The following security bugs were fixed: - CVE-2016-8655: A race condition in the af_packet packet_set_ring function could be used by local attackers to crash the kernel or gain privileges (bsc#1012759). - CVE-2016-9555: The sctp_sf_ootb function in net/sctp/sm_statefuns.c in the Linux kernel lacks chunk-length checking for the first chunk, which allowed remote attackers to cause a denial of service (out-of-bounds slab access) or possibly have unspecified other impact via crafted SCTP data (bsc#1012183). Patch Instructions: To install this SUSE Security Update use YaST online_update. Alternatively you can run the command listed for your product: - SUSE Linux Enterprise Live Patching 12: zypper in -t patch SUSE-SLE-Live-Patching-12-2016-1865=1 To bring your system up-to-date, use "zypper patch". Package List: - SUSE Linux Enterprise Live Patching 12 (x86_64): kgraft-patch-3_12_67-60_64_18-default-2-2.1 kgraft-patch-3_12_67-60_64_18-xen-2-2.1 References: https://www.suse.com/security/cve/CVE-2016-8655.html https://www.suse.com/security/cve/CVE-2016-9555.html https://bugzilla.suse.com/1012183 https://bugzilla.suse.com/1012759 -- To unsubscribe, e-mail: opensuse-security-announce+unsubscribe(a)opensuse.org For additional commands, e-mail: opensuse-security-announce+help(a)opensuse.org

1 0

[security-announce] SUSE-SU-2016:3203-1: important: Security update for the Linux Kernel
by opensuse-security＠opensuse.org 20 Dec '16

20 Dec '16

SUSE Security Update: Security update for the Linux Kernel ______________________________________________________________________________ Announcement ID: SUSE-SU-2016:3203-1 Rating: important References: #1013533 #1013604 Cross-References: CVE-2016-9576 CVE-2016-9794 Affected Products: SUSE Linux Enterprise Software Development Kit 11-SP4 SUSE Linux Enterprise Server 11-SP4 SUSE Linux Enterprise Server 11-EXTRA SUSE Linux Enterprise Debuginfo 11-SP4 ______________________________________________________________________________ An update that fixes two vulnerabilities is now available. Description: The SUSE Linux Enterprise 11 SP4 kernel was updated to fix two security issues. The following security bugs were fixed: - CVE-2016-9576: A use-after-free vulnerability in the SCSI generic driver allows users with write access to /dev/sg* or /dev/bsg* to elevate their privileges (bsc#1013604). - CVE-2016-9794: A use-after-free vulnerability in the ALSA pcm layer allowed local users to cause a denial of service, memory corruption or possibly even to elevate their privileges (bsc#1013533). Patch Instructions: To install this SUSE Security Update use YaST online_update. Alternatively you can run the command listed for your product: - SUSE Linux Enterprise Software Development Kit 11-SP4: zypper in -t patch sdksp4-linux-kernel-12901=1 - SUSE Linux Enterprise Server 11-SP4: zypper in -t patch slessp4-linux-kernel-12901=1 - SUSE Linux Enterprise Server 11-EXTRA: zypper in -t patch slexsp3-linux-kernel-12901=1 - SUSE Linux Enterprise Debuginfo 11-SP4: zypper in -t patch dbgsp4-linux-kernel-12901=1 To bring your system up-to-date, use "zypper patch". Package List: - SUSE Linux Enterprise Software Development Kit 11-SP4 (noarch): kernel-docs-3.0.101-91.2 - SUSE Linux Enterprise Server 11-SP4 (i586 ia64 ppc64 s390x x86_64): kernel-default-3.0.101-91.1 kernel-default-base-3.0.101-91.1 kernel-default-devel-3.0.101-91.1 kernel-source-3.0.101-91.1 kernel-syms-3.0.101-91.1 kernel-trace-3.0.101-91.1 kernel-trace-base-3.0.101-91.1 kernel-trace-devel-3.0.101-91.1 - SUSE Linux Enterprise Server 11-SP4 (i586 x86_64): kernel-ec2-3.0.101-91.1 kernel-ec2-base-3.0.101-91.1 kernel-ec2-devel-3.0.101-91.1 kernel-xen-3.0.101-91.1 kernel-xen-base-3.0.101-91.1 kernel-xen-devel-3.0.101-91.1 - SUSE Linux Enterprise Server 11-SP4 (s390x): kernel-default-man-3.0.101-91.1 - SUSE Linux Enterprise Server 11-SP4 (ppc64): kernel-bigmem-3.0.101-91.1 kernel-bigmem-base-3.0.101-91.1 kernel-bigmem-devel-3.0.101-91.1 kernel-ppc64-3.0.101-91.1 kernel-ppc64-base-3.0.101-91.1 kernel-ppc64-devel-3.0.101-91.1 - SUSE Linux Enterprise Server 11-SP4 (i586): kernel-pae-3.0.101-91.1 kernel-pae-base-3.0.101-91.1 kernel-pae-devel-3.0.101-91.1 - SUSE Linux Enterprise Server 11-EXTRA (i586 ia64 ppc64 s390x x86_64): kernel-default-extra-3.0.101-91.1 - SUSE Linux Enterprise Server 11-EXTRA (i586 x86_64): kernel-xen-extra-3.0.101-91.1 - SUSE Linux Enterprise Server 11-EXTRA (x86_64): kernel-trace-extra-3.0.101-91.1 - SUSE Linux Enterprise Server 11-EXTRA (ppc64): kernel-ppc64-extra-3.0.101-91.1 - SUSE Linux Enterprise Server 11-EXTRA (i586): kernel-pae-extra-3.0.101-91.1 - SUSE Linux Enterprise Debuginfo 11-SP4 (i586 ia64 ppc64 s390x x86_64): kernel-default-debuginfo-3.0.101-91.1 kernel-default-debugsource-3.0.101-91.1 kernel-trace-debuginfo-3.0.101-91.1 kernel-trace-debugsource-3.0.101-91.1 - SUSE Linux Enterprise Debuginfo 11-SP4 (i586 ia64 s390x x86_64): kernel-default-devel-debuginfo-3.0.101-91.1 kernel-trace-devel-debuginfo-3.0.101-91.1 - SUSE Linux Enterprise Debuginfo 11-SP4 (i586 x86_64): kernel-ec2-debuginfo-3.0.101-91.1 kernel-ec2-debugsource-3.0.101-91.1 kernel-xen-debuginfo-3.0.101-91.1 kernel-xen-debugsource-3.0.101-91.1 kernel-xen-devel-debuginfo-3.0.101-91.1 - SUSE Linux Enterprise Debuginfo 11-SP4 (ppc64): kernel-bigmem-debuginfo-3.0.101-91.1 kernel-bigmem-debugsource-3.0.101-91.1 kernel-ppc64-debuginfo-3.0.101-91.1 kernel-ppc64-debugsource-3.0.101-91.1 - SUSE Linux Enterprise Debuginfo 11-SP4 (i586): kernel-pae-debuginfo-3.0.101-91.1 kernel-pae-debugsource-3.0.101-91.1 kernel-pae-devel-debuginfo-3.0.101-91.1 References: https://www.suse.com/security/cve/CVE-2016-9576.html https://www.suse.com/security/cve/CVE-2016-9794.html https://bugzilla.suse.com/1013533 https://bugzilla.suse.com/1013604 -- To unsubscribe, e-mail: opensuse-security-announce+unsubscribe(a)opensuse.org For additional commands, e-mail: opensuse-security-announce+help(a)opensuse.org

1 0

[security-announce] SUSE-SU-2016:3199-1: important: Security update for dnsmasq
by opensuse-security＠opensuse.org 20 Dec '16

20 Dec '16

SUSE Security Update: Security update for dnsmasq ______________________________________________________________________________ Announcement ID: SUSE-SU-2016:3199-1 Rating: important References: #983273 Cross-References: CVE-2015-8899 Affected Products: SUSE Linux Enterprise Server 11-SP4 SUSE Linux Enterprise Debuginfo 11-SP4 ______________________________________________________________________________ An update that fixes one vulnerability is now available. Description: This update for dnsmasq fixes the following issues: - CVE-2015-8899: Denial of service between local and remote dns entries (bsc#983273) Patch Instructions: To install this SUSE Security Update use YaST online_update. Alternatively you can run the command listed for your product: - SUSE Linux Enterprise Server 11-SP4: zypper in -t patch slessp4-dnsmasq-12899=1 - SUSE Linux Enterprise Debuginfo 11-SP4: zypper in -t patch dbgsp4-dnsmasq-12899=1 To bring your system up-to-date, use "zypper patch". Package List: - SUSE Linux Enterprise Server 11-SP4 (i586 ia64 ppc64 s390x x86_64): dnsmasq-2.71-0.16.3 - SUSE Linux Enterprise Debuginfo 11-SP4 (i586 ia64 ppc64 s390x x86_64): dnsmasq-debuginfo-2.71-0.16.3 dnsmasq-debugsource-2.71-0.16.3 References: https://www.suse.com/security/cve/CVE-2015-8899.html https://bugzilla.suse.com/983273 -- To unsubscribe, e-mail: opensuse-security-announce+unsubscribe(a)opensuse.org For additional commands, e-mail: opensuse-security-announce+help(a)opensuse.org

1 0

[security-announce] SUSE-SU-2016:3197-1: important: Security update for Linux Kernel Live Patch 15 for SLE 12
by opensuse-security＠opensuse.org 20 Dec '16

20 Dec '16

SUSE Security Update: Security update for Linux Kernel Live Patch 15 for SLE 12 ______________________________________________________________________________ Announcement ID: SUSE-SU-2016:3197-1 Rating: important References: #1012183 #1012759 Cross-References: CVE-2016-8655 CVE-2016-9555 Affected Products: SUSE Linux Enterprise Server for SAP 12 SUSE Linux Enterprise Server 12-LTSS ______________________________________________________________________________ An update that fixes two vulnerabilities is now available. Description: This update for the Linux Kernel 3.12.60-52_54 fixes several issues. The following security bugs were fixed: - CVE-2016-8655: A race condition in the af_packet packet_set_ring function could be used by local attackers to crash the kernel or gain privileges (bsc#1012759). - CVE-2016-9555: The sctp_sf_ootb function in net/sctp/sm_statefuns.c in the Linux kernel lacks chunk-length checking for the first chunk, which allowed remote attackers to cause a denial of service (out-of-bounds slab access) or possibly have unspecified other impact via crafted SCTP data (bsc#1012183). Patch Instructions: To install this SUSE Security Update use YaST online_update. Alternatively you can run the command listed for your product: - SUSE Linux Enterprise Server for SAP 12: zypper in -t patch SUSE-SLE-SAP-12-2016-1855=1 - SUSE Linux Enterprise Server 12-LTSS: zypper in -t patch SUSE-SLE-SERVER-12-2016-1855=1 To bring your system up-to-date, use "zypper patch". Package List: - SUSE Linux Enterprise Server for SAP 12 (x86_64): kgraft-patch-3_12_60-52_54-default-4-2.1 kgraft-patch-3_12_60-52_54-xen-4-2.1 - SUSE Linux Enterprise Server 12-LTSS (x86_64): kgraft-patch-3_12_60-52_54-default-4-2.1 kgraft-patch-3_12_60-52_54-xen-4-2.1 References: https://www.suse.com/security/cve/CVE-2016-8655.html https://www.suse.com/security/cve/CVE-2016-9555.html https://bugzilla.suse.com/1012183 https://bugzilla.suse.com/1012759 -- To unsubscribe, e-mail: opensuse-security-announce+unsubscribe(a)opensuse.org For additional commands, e-mail: opensuse-security-announce+help(a)opensuse.org

1 0