March 2016 - openSUSE Security Announce

[security-announce] openSUSE-SU-2016:0721-1: important: Security update for exim
by opensuse-security＠opensuse.org 11 Mar '16

11 Mar '16

openSUSE Security Update: Security update for exim ______________________________________________________________________________ Announcement ID: openSUSE-SU-2016:0721-1 Rating: important References: #968844 Cross-References: CVE-2016-1531 Affected Products: openSUSE Leap 42.1 openSUSE 13.2 ______________________________________________________________________________ An update that fixes one vulnerability is now available. Description: This update to exim 4.86.2 fixes the following issues: * CVE-2016-1531: local privilege escalation for set-uid root exim when using 'perl_startup' (boo#968844) Important: Exim now cleans the complete execution environment by default. This affects Exim and subprocesses such as transports calling other programs. The following new options are supported to adjust this behaviour: * keep_environment * add_environment A warning will be printed upon startup if none of these are configured. Also includes upstream changes, improvements and bug fixes: * Support for using the system standard CA bundle. * New expansion items $config_file, $config_dir, containing the file and directory name of the main configuration file. Also $exim_version. * New "malware=" support for Avast. * New "spam=" variant option for Rspamd. * Assorted options on malware= and spam= scanners. * A commandline option to write a comment into the logfile. * A logging option for slow DNS lookups. * New ${env {<variable>}} expansion. * A non-SMTP authenticator using information from TLS client certificates. * Main option "tls_eccurve" for selecting an Elliptic Curve for TLS. * Main option "dns_trust_aa" for trusting your local nameserver at the same level as DNSSEC. Patch Instructions: To install this openSUSE Security Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE Leap 42.1: zypper in -t patch openSUSE-2016-326=1 - openSUSE 13.2: zypper in -t patch openSUSE-2016-326=1 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE Leap 42.1 (i586 x86_64): exim-4.86.2-8.1 exim-debuginfo-4.86.2-8.1 exim-debugsource-4.86.2-8.1 eximon-4.86.2-8.1 eximon-debuginfo-4.86.2-8.1 eximstats-html-4.86.2-8.1 - openSUSE 13.2 (i586 x86_64): exim-4.86.2-3.10.1 exim-debuginfo-4.86.2-3.10.1 exim-debugsource-4.86.2-3.10.1 eximon-4.86.2-3.10.1 eximon-debuginfo-4.86.2-3.10.1 eximstats-html-4.86.2-3.10.1 References: https://www.suse.com/security/cve/CVE-2016-1531.html https://bugzilla.suse.com/968844 -- To unsubscribe, e-mail: opensuse-security-announce+unsubscribe(a)opensuse.org For additional commands, e-mail: opensuse-security-announce+help(a)opensuse.org

1 0

[security-announce] openSUSE-SU-2016:0720-1: important: Security update for openssl
by opensuse-security＠opensuse.org 11 Mar '16

11 Mar '16

openSUSE Security Update: Security update for openssl ______________________________________________________________________________ Announcement ID: openSUSE-SU-2016:0720-1 Rating: important References: #952871 #963415 #968046 #968048 #968051 #968053 #968374 Cross-References: CVE-2015-3197 CVE-2016-0702 CVE-2016-0703 CVE-2016-0704 CVE-2016-0797 CVE-2016-0799 CVE-2016-0800 Affected Products: openSUSE Leap 42.1 ______________________________________________________________________________ An update that fixes 7 vulnerabilities is now available. Description: This update for compat-openssl098 fixes various security issues and bugs: Security issues fixed: - CVE-2016-0800 aka the "DROWN" attack (bsc#968046): OpenSSL was vulnerable to a cross-protocol attack that could lead to decryption of TLS sessions by using a server supporting SSLv2 and EXPORT cipher suites as a Bleichenbacher RSA padding oracle. This update changes the openssl library to: * Disable SSLv2 protocol support by default. This can be overridden by setting the environment variable "OPENSSL_ALLOW_SSL2" or by using SSL_CTX_clear_options using the SSL_OP_NO_SSLv2 flag. Note that various services and clients had already disabled SSL protocol 2 by default previously. * Disable all weak EXPORT ciphers by default. These can be reenabled if required by old legacy software using the environment variable "OPENSSL_ALLOW_EXPORT". - CVE-2016-0797 (bnc#968048): The BN_hex2bn() and BN_dec2bn() functions had a bug that could result in an attempt to de-reference a NULL pointer leading to crashes. This could have security consequences if these functions were ever called by user applications with large untrusted hex/decimal data. Also, internal usage of these functions in OpenSSL uses data from config files or application command line arguments. If user developed applications generated config file data based on untrusted data, then this could have had security consequences as well. - CVE-2016-0799 (bnc#968374) On many 64 bit systems, the internal fmtstr() and doapr_outch() functions could miscalculate the length of a string and attempt to access out-of-bounds memory locations. These problems could have enabled attacks where large amounts of untrusted data is passed to the BIO_*printf functions. If applications use these functions in this way then they could have been vulnerable. OpenSSL itself uses these functions when printing out human-readable dumps of ASN.1 data. Therefore applications that print this data could have been vulnerable if the data is from untrusted sources. OpenSSL command line applications could also have been vulnerable when they print out ASN.1 data, or if untrusted data is passed as command line arguments. Libssl is not considered directly vulnerable. - CVE-2015-3197 (bsc#963415): The SSLv2 protocol did not block disabled ciphers. Note that the March 1st 2016 release also references following CVEs that were fixed by us with CVE-2015-0293 in 2015: - CVE-2016-0703 (bsc#968051): This issue only affected versions of OpenSSL prior to March 19th 2015 at which time the code was refactored to address vulnerability CVE-2015-0293. It would have made the above "DROWN" attack much easier. - CVE-2016-0704 (bsc#968053): "Bleichenbacher oracle in SSLv2" This issue only affected versions of OpenSSL prior to March 19th 2015 at which time the code was refactored to address vulnerability CVE-2015-0293. It would have made the above "DROWN" attack much easier. Also fixes the following bug: - Avoid running OPENSSL_config twice. This avoids breaking engine loading and also fixes a memory leak in libssl. (bsc#952871) This update was imported from the SUSE:SLE-12:Update update project. Patch Instructions: To install this openSUSE Security Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE Leap 42.1: zypper in -t patch openSUSE-2016-327=1 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE Leap 42.1 (i586 x86_64): compat-openssl098-debugsource-0.9.8j-9.1 libopenssl0_9_8-0.9.8j-9.1 libopenssl0_9_8-debuginfo-0.9.8j-9.1 - openSUSE Leap 42.1 (x86_64): libopenssl0_9_8-32bit-0.9.8j-9.1 libopenssl0_9_8-debuginfo-32bit-0.9.8j-9.1 References: https://www.suse.com/security/cve/CVE-2015-3197.html https://www.suse.com/security/cve/CVE-2016-0702.html https://www.suse.com/security/cve/CVE-2016-0703.html https://www.suse.com/security/cve/CVE-2016-0704.html https://www.suse.com/security/cve/CVE-2016-0797.html https://www.suse.com/security/cve/CVE-2016-0799.html https://www.suse.com/security/cve/CVE-2016-0800.html https://bugzilla.suse.com/952871 https://bugzilla.suse.com/963415 https://bugzilla.suse.com/968046 https://bugzilla.suse.com/968048 https://bugzilla.suse.com/968051 https://bugzilla.suse.com/968053 https://bugzilla.suse.com/968374 -- To unsubscribe, e-mail: opensuse-security-announce+unsubscribe(a)opensuse.org For additional commands, e-mail: opensuse-security-announce+help(a)opensuse.org

1 0

[security-announce] openSUSE-SU-2016:0719-1: important: Security update for Adobe Flash Player
by opensuse-security＠opensuse.org 11 Mar '16

11 Mar '16

openSUSE Security Update: Security update for Adobe Flash Player ______________________________________________________________________________ Announcement ID: openSUSE-SU-2016:0719-1 Rating: important References: #970547 Cross-References: CVE-2016-0960 CVE-2016-0961 CVE-2016-0962 CVE-2016-0963 CVE-2016-0986 CVE-2016-0987 CVE-2016-0988 CVE-2016-0989 CVE-2016-0990 CVE-2016-0991 CVE-2016-0992 CVE-2016-0993 CVE-2016-0994 CVE-2016-0995 CVE-2016-0996 CVE-2016-0997 CVE-2016-0998 CVE-2016-0999 CVE-2016-1000 CVE-2016-1001 CVE-2016-1002 CVE-2016-1005 CVE-2016-1010 Affected Products: openSUSE 13.2 NonFree ______________________________________________________________________________ An update that fixes 23 vulnerabilities is now available. Description: This update to Adobe Flash Player 11.2.202.577 fixes a number of vulnerabilities that could have allowed remote attackers to execute arbitrary code through crafted content. (boo#970547) * APSB16-08, CVE-2016-0960, CVE-2016-0961, CVE-2016-0962, CVE-2016-0963, CVE-2016-0986, CVE-2016-0987, CVE-2016-0988, CVE-2016-0989, CVE-2016-0990, CVE-2016-0991, CVE-2016-0992, CVE-2016-0993, CVE-2016-0994, CVE-2016-0995, CVE-2016-0996, CVE-2016-0997, CVE-2016-0998, CVE-2016-0999, CVE-2016-1000, CVE-2016-1001, CVE-2016-1002, CVE-2016-1005, CVE-2016-1010 Patch Instructions: To install this openSUSE Security Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE 13.2 NonFree: zypper in -t patch openSUSE-2016-325=1 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE 13.2 NonFree (i586 x86_64): flash-player-11.2.202.577-2.91.1 flash-player-gnome-11.2.202.577-2.91.1 flash-player-kde4-11.2.202.577-2.91.1 References: https://www.suse.com/security/cve/CVE-2016-0960.html https://www.suse.com/security/cve/CVE-2016-0961.html https://www.suse.com/security/cve/CVE-2016-0962.html https://www.suse.com/security/cve/CVE-2016-0963.html https://www.suse.com/security/cve/CVE-2016-0986.html https://www.suse.com/security/cve/CVE-2016-0987.html https://www.suse.com/security/cve/CVE-2016-0988.html https://www.suse.com/security/cve/CVE-2016-0989.html https://www.suse.com/security/cve/CVE-2016-0990.html https://www.suse.com/security/cve/CVE-2016-0991.html https://www.suse.com/security/cve/CVE-2016-0992.html https://www.suse.com/security/cve/CVE-2016-0993.html https://www.suse.com/security/cve/CVE-2016-0994.html https://www.suse.com/security/cve/CVE-2016-0995.html https://www.suse.com/security/cve/CVE-2016-0996.html https://www.suse.com/security/cve/CVE-2016-0997.html https://www.suse.com/security/cve/CVE-2016-0998.html https://www.suse.com/security/cve/CVE-2016-0999.html https://www.suse.com/security/cve/CVE-2016-1000.html https://www.suse.com/security/cve/CVE-2016-1001.html https://www.suse.com/security/cve/CVE-2016-1002.html https://www.suse.com/security/cve/CVE-2016-1005.html https://www.suse.com/security/cve/CVE-2016-1010.html https://bugzilla.suse.com/970547 -- To unsubscribe, e-mail: opensuse-security-announce+unsubscribe(a)opensuse.org For additional commands, e-mail: opensuse-security-announce+help(a)opensuse.org

1 0

[security-announce] SUSE-SU-2016:0716-1: important: Security update for flash-player
by opensuse-security＠opensuse.org 11 Mar '16

11 Mar '16

SUSE Security Update: Security update for flash-player ______________________________________________________________________________ Announcement ID: SUSE-SU-2016:0716-1 Rating: important References: #970547 Cross-References: CVE-2016-0960 CVE-2016-0961 CVE-2016-0962 CVE-2016-0963 CVE-2016-0986 CVE-2016-0987 CVE-2016-0988 CVE-2016-0989 CVE-2016-0990 CVE-2016-0991 CVE-2016-0992 CVE-2016-0993 CVE-2016-0994 CVE-2016-0995 CVE-2016-0996 CVE-2016-0997 CVE-2016-0998 CVE-2016-0999 CVE-2016-1000 CVE-2016-1001 CVE-2016-1002 CVE-2016-1005 CVE-2016-1010 Affected Products: SUSE Linux Enterprise Desktop 11-SP4 ______________________________________________________________________________ An update that fixes 23 vulnerabilities is now available. Description: Adobe flash-player was updated to 11.2.202.577 to fix the following list of security issues (bsc#970547): These updates resolve integer overflow vulnerabilities that could lead to code execution (CVE-2016-0963, CVE-2016-0993, CVE-2016-1010). These updates resolve use-after-free vulnerabilities that could lead to code execution (CVE-2016-0987, CVE-2016-0988, CVE-2016-0990, CVE-2016-0991, CVE-2016-0994, CVE-2016-0995, CVE-2016-0996, CVE-2016-0997, CVE-2016-0998, CVE-2016-0999, CVE-2016-1000). These updates resolve a heap overflow vulnerability that could lead to code execution (CVE-2016-1001). These updates resolve memory corruption vulnerabilities that could lead to code execution (CVE-2016-0960, CVE-2016-0961, CVE-2016-0962, CVE-2016-0986, CVE-2016-0989, CVE-2016-0992, CVE-2016-1002, CVE-2016-1005). Adobe advisory with more information: https://helpx.adobe.com/security/products/flash-player/apsb16-08.html Patch Instructions: To install this SUSE Security Update use YaST online_update. Alternatively you can run the command listed for your product: - SUSE Linux Enterprise Desktop 11-SP4: zypper in -t patch sledsp4-flash-player-12443=1 To bring your system up-to-date, use "zypper patch". Package List: - SUSE Linux Enterprise Desktop 11-SP4 (i586 x86_64): flash-player-11.2.202.577-0.38.1 flash-player-gnome-11.2.202.577-0.38.1 flash-player-kde4-11.2.202.577-0.38.1 References: https://www.suse.com/security/cve/CVE-2016-0960.html https://www.suse.com/security/cve/CVE-2016-0961.html https://www.suse.com/security/cve/CVE-2016-0962.html https://www.suse.com/security/cve/CVE-2016-0963.html https://www.suse.com/security/cve/CVE-2016-0986.html https://www.suse.com/security/cve/CVE-2016-0987.html https://www.suse.com/security/cve/CVE-2016-0988.html https://www.suse.com/security/cve/CVE-2016-0989.html https://www.suse.com/security/cve/CVE-2016-0990.html https://www.suse.com/security/cve/CVE-2016-0991.html https://www.suse.com/security/cve/CVE-2016-0992.html https://www.suse.com/security/cve/CVE-2016-0993.html https://www.suse.com/security/cve/CVE-2016-0994.html https://www.suse.com/security/cve/CVE-2016-0995.html https://www.suse.com/security/cve/CVE-2016-0996.html https://www.suse.com/security/cve/CVE-2016-0997.html https://www.suse.com/security/cve/CVE-2016-0998.html https://www.suse.com/security/cve/CVE-2016-0999.html https://www.suse.com/security/cve/CVE-2016-1000.html https://www.suse.com/security/cve/CVE-2016-1001.html https://www.suse.com/security/cve/CVE-2016-1002.html https://www.suse.com/security/cve/CVE-2016-1005.html https://www.suse.com/security/cve/CVE-2016-1010.html https://bugzilla.suse.com/970547 -- To unsubscribe, e-mail: opensuse-security-announce+unsubscribe(a)opensuse.org For additional commands, e-mail: opensuse-security-announce+help(a)opensuse.org

1 0

[security-announce] SUSE-SU-2016:0715-1: important: Security update for flash-player
by opensuse-security＠opensuse.org 11 Mar '16

11 Mar '16

SUSE Security Update: Security update for flash-player ______________________________________________________________________________ Announcement ID: SUSE-SU-2016:0715-1 Rating: important References: #970547 Cross-References: CVE-2016-0960 CVE-2016-0961 CVE-2016-0962 CVE-2016-0963 CVE-2016-0986 CVE-2016-0987 CVE-2016-0988 CVE-2016-0989 CVE-2016-0990 CVE-2016-0991 CVE-2016-0992 CVE-2016-0993 CVE-2016-0994 CVE-2016-0995 CVE-2016-0996 CVE-2016-0997 CVE-2016-0998 CVE-2016-0999 CVE-2016-1000 CVE-2016-1001 CVE-2016-1002 CVE-2016-1005 CVE-2016-1010 Affected Products: SUSE Linux Enterprise Workstation Extension 12-SP1 SUSE Linux Enterprise Workstation Extension 12 SUSE Linux Enterprise Desktop 12-SP1 SUSE Linux Enterprise Desktop 12 ______________________________________________________________________________ An update that fixes 23 vulnerabilities is now available. Description: Adobe flash-player was updated to 11.2.202.577 to fix the following list of security issues (bsc#970547): These updates resolve integer overflow vulnerabilities that could lead to code execution (CVE-2016-0963, CVE-2016-0993, CVE-2016-1010). These updates resolve use-after-free vulnerabilities that could lead to code execution (CVE-2016-0987, CVE-2016-0988, CVE-2016-0990, CVE-2016-0991, CVE-2016-0994, CVE-2016-0995, CVE-2016-0996, CVE-2016-0997, CVE-2016-0998, CVE-2016-0999, CVE-2016-1000). These updates resolve a heap overflow vulnerability that could lead to code execution (CVE-2016-1001). These updates resolve memory corruption vulnerabilities that could lead to code execution (CVE-2016-0960, CVE-2016-0961, CVE-2016-0962, CVE-2016-0986, CVE-2016-0989, CVE-2016-0992, CVE-2016-1002, CVE-2016-1005). Adobe advisory with more information: https://helpx.adobe.com/security/products/flash-player/apsb16-08.html Patch Instructions: To install this SUSE Security Update use YaST online_update. Alternatively you can run the command listed for your product: - SUSE Linux Enterprise Workstation Extension 12-SP1: zypper in -t patch SUSE-SLE-WE-12-SP1-2016-412=1 - SUSE Linux Enterprise Workstation Extension 12: zypper in -t patch SUSE-SLE-WE-12-2016-412=1 - SUSE Linux Enterprise Desktop 12-SP1: zypper in -t patch SUSE-SLE-DESKTOP-12-SP1-2016-412=1 - SUSE Linux Enterprise Desktop 12: zypper in -t patch SUSE-SLE-DESKTOP-12-2016-412=1 To bring your system up-to-date, use "zypper patch". Package List: - SUSE Linux Enterprise Workstation Extension 12-SP1 (x86_64): flash-player-11.2.202.577-123.1 flash-player-gnome-11.2.202.577-123.1 - SUSE Linux Enterprise Workstation Extension 12 (x86_64): flash-player-11.2.202.577-123.1 flash-player-gnome-11.2.202.577-123.1 - SUSE Linux Enterprise Desktop 12-SP1 (x86_64): flash-player-11.2.202.577-123.1 flash-player-gnome-11.2.202.577-123.1 - SUSE Linux Enterprise Desktop 12 (x86_64): flash-player-11.2.202.577-123.1 flash-player-gnome-11.2.202.577-123.1 References: https://www.suse.com/security/cve/CVE-2016-0960.html https://www.suse.com/security/cve/CVE-2016-0961.html https://www.suse.com/security/cve/CVE-2016-0962.html https://www.suse.com/security/cve/CVE-2016-0963.html https://www.suse.com/security/cve/CVE-2016-0986.html https://www.suse.com/security/cve/CVE-2016-0987.html https://www.suse.com/security/cve/CVE-2016-0988.html https://www.suse.com/security/cve/CVE-2016-0989.html https://www.suse.com/security/cve/CVE-2016-0990.html https://www.suse.com/security/cve/CVE-2016-0991.html https://www.suse.com/security/cve/CVE-2016-0992.html https://www.suse.com/security/cve/CVE-2016-0993.html https://www.suse.com/security/cve/CVE-2016-0994.html https://www.suse.com/security/cve/CVE-2016-0995.html https://www.suse.com/security/cve/CVE-2016-0996.html https://www.suse.com/security/cve/CVE-2016-0997.html https://www.suse.com/security/cve/CVE-2016-0998.html https://www.suse.com/security/cve/CVE-2016-0999.html https://www.suse.com/security/cve/CVE-2016-1000.html https://www.suse.com/security/cve/CVE-2016-1001.html https://www.suse.com/security/cve/CVE-2016-1002.html https://www.suse.com/security/cve/CVE-2016-1005.html https://www.suse.com/security/cve/CVE-2016-1010.html https://bugzilla.suse.com/970547 -- To unsubscribe, e-mail: opensuse-security-announce+unsubscribe(a)opensuse.org For additional commands, e-mail: opensuse-security-announce+help(a)opensuse.org

1 0

[security-announce] openSUSE-SU-2016:0708-1: important: Security update for libotr,libotr2
by opensuse-security＠opensuse.org 10 Mar '16

10 Mar '16

openSUSE Security Update: Security update for libotr,libotr2 ______________________________________________________________________________ Announcement ID: openSUSE-SU-2016:0708-1 Rating: important References: #969785 Cross-References: CVE-2016-2851 Affected Products: openSUSE Leap 42.1 openSUSE 13.2 ______________________________________________________________________________ An update that fixes one vulnerability is now available. Description: libotr and libotr2 were updated to fix one security issue: - CVE-2016-2851: Integer overflow vulnerability allowed remote attackers to execute arbitrary code on 64 bit platforms (boo#969785) Patch Instructions: To install this openSUSE Security Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE Leap 42.1: zypper in -t patch openSUSE-2016-322=1 - openSUSE 13.2: zypper in -t patch openSUSE-2016-322=1 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE Leap 42.1 (i586 x86_64): libotr-debugsource-4.1.1-4.1 libotr-devel-4.1.1-4.1 libotr-tools-4.1.1-4.1 libotr-tools-debuginfo-4.1.1-4.1 libotr2-3.2.1-13.1 libotr2-debuginfo-3.2.1-13.1 libotr2-debugsource-3.2.1-13.1 libotr2-devel-3.2.1-13.1 libotr2-tools-3.2.1-13.1 libotr2-tools-debuginfo-3.2.1-13.1 libotr5-4.1.1-4.1 libotr5-debuginfo-4.1.1-4.1 - openSUSE 13.2 (i586 x86_64): libotr-debugsource-4.0.0-8.3.1 libotr-devel-4.0.0-8.3.1 libotr-tools-4.0.0-8.3.1 libotr-tools-debuginfo-4.0.0-8.3.1 libotr2-3.2.1-7.3.1 libotr2-debuginfo-3.2.1-7.3.1 libotr2-debugsource-3.2.1-7.3.1 libotr2-devel-3.2.1-7.3.1 libotr2-tools-3.2.1-7.3.1 libotr2-tools-debuginfo-3.2.1-7.3.1 libotr5-4.0.0-8.3.1 libotr5-debuginfo-4.0.0-8.3.1 References: https://www.suse.com/security/cve/CVE-2016-2851.html https://bugzilla.suse.com/969785 -- To unsubscribe, e-mail: opensuse-security-announce+unsubscribe(a)opensuse.org For additional commands, e-mail: opensuse-security-announce+help(a)opensuse.org

1 0

[security-announce] SUSE-SU-2016:0700-1: important: Security update for bsh2
by opensuse-security＠opensuse.org 09 Mar '16

09 Mar '16

SUSE Security Update: Security update for bsh2 ______________________________________________________________________________ Announcement ID: SUSE-SU-2016:0700-1 Rating: important References: #967593 Cross-References: CVE-2016-2510 Affected Products: SUSE Linux Enterprise Software Development Kit 12-SP1 SUSE Linux Enterprise Software Development Kit 12 ______________________________________________________________________________ An update that fixes one vulnerability is now available. Description: This update for bsh2 fixes the following issues: - CVE-2016-2510: An application that includes BeanShell on the classpath may be vulnerable if another part of the application uses Java serialization or XStream to deserialize data from an untrusted source. Please see https://github.com/beanshell/beanshell/releases/tag/2.0b6 for more information. Patch Instructions: To install this SUSE Security Update use YaST online_update. Alternatively you can run the command listed for your product: - SUSE Linux Enterprise Software Development Kit 12-SP1: zypper in -t patch SUSE-SLE-SDK-12-SP1-2016-399=1 - SUSE Linux Enterprise Software Development Kit 12: zypper in -t patch SUSE-SLE-SDK-12-2016-399=1 To bring your system up-to-date, use "zypper patch". Package List: - SUSE Linux Enterprise Software Development Kit 12-SP1 (noarch): bsh2-2.0.0.b5-3.2 bsh2-classgen-2.0.0.b5-3.2 bsh2-javadoc-2.0.0.b5-3.2 - SUSE Linux Enterprise Software Development Kit 12 (noarch): bsh2-2.0.0.b5-3.2 bsh2-classgen-2.0.0.b5-3.2 bsh2-javadoc-2.0.0.b5-3.2 References: https://www.suse.com/security/cve/CVE-2016-2510.html https://bugzilla.suse.com/967593 -- To unsubscribe, e-mail: opensuse-security-announce+unsubscribe(a)opensuse.org For additional commands, e-mail: opensuse-security-announce+help(a)opensuse.org

1 0

[security-announce] SUSE-SU-2016:0699-1: important: Security update for bsh2
by opensuse-security＠opensuse.org 09 Mar '16

09 Mar '16

SUSE Security Update: Security update for bsh2 ______________________________________________________________________________ Announcement ID: SUSE-SU-2016:0699-1 Rating: important References: #967593 Cross-References: CVE-2016-2510 Affected Products: SUSE Linux Enterprise Software Development Kit 11-SP4 ______________________________________________________________________________ An update that fixes one vulnerability is now available. Description: This update for bsh2 fixes the following issue: - CVE-2016-2510: An application that includes BeanShell on the classpath may be vulnerable if another part of the application uses Java serialization or XStream to deserialize data from an untrusted source. Please see https://github.com/beanshell/beanshell/releases/tag/2.0b6 for more information. Patch Instructions: To install this SUSE Security Update use YaST online_update. Alternatively you can run the command listed for your product: - SUSE Linux Enterprise Software Development Kit 11-SP4: zypper in -t patch sdksp4-bsh2-12441=1 To bring your system up-to-date, use "zypper patch". Package List: - SUSE Linux Enterprise Software Development Kit 11-SP4 (noarch): bsh2-2.0-318.1 bsh2-classgen-2.0-318.1 bsh2-javadoc-2.0-318.1 References: https://www.suse.com/security/cve/CVE-2016-2510.html https://bugzilla.suse.com/967593 -- To unsubscribe, e-mail: opensuse-security-announce+unsubscribe(a)opensuse.org For additional commands, e-mail: opensuse-security-announce+help(a)opensuse.org

1 0

[security-announce] openSUSE-SU-2016:0684-1: important: Security update for Chromium
by opensuse-security＠opensuse.org 08 Mar '16

08 Mar '16

openSUSE Security Update: Security update for Chromium ______________________________________________________________________________ Announcement ID: openSUSE-SU-2016:0684-1 Rating: important References: #969333 Cross-References: CVE-2015-8126 CVE-2016-1630 CVE-2016-1631 CVE-2016-1632 CVE-2016-1633 CVE-2016-1634 CVE-2016-1635 CVE-2016-1636 CVE-2016-1637 CVE-2016-1638 CVE-2016-1639 CVE-2016-1640 CVE-2016-1641 CVE-2016-1642 Affected Products: openSUSE 13.1 ______________________________________________________________________________ An update that fixes 14 vulnerabilities is now available. Description: Chromium was updated to 49.0.2623.75 to fix the following security issues: (boo#969333) - CVE-2016-1630: Same-origin bypass in Blink - CVE-2016-1631: Same-origin bypass in Pepper Plugin - CVE-2016-1632: Bad cast in Extensions - CVE-2016-1633: Use-after-free in Blink - CVE-2016-1634: Use-after-free in Blink - CVE-2016-1635: Use-after-free in Blink - CVE-2016-1636: SRI Validation Bypass - CVE-2015-8126: Out-of-bounds access in libpng - CVE-2016-1637: Information Leak in Skia - CVE-2016-1638: WebAPI Bypass - CVE-2016-1639: Use-after-free in WebRTC - CVE-2016-1640: Origin confusion in Extensions UI - CVE-2016-1641: Use-after-free in Favicon - CVE-2016-1642: Various fixes from internal audits, fuzzing and other initiatives - Multiple vulnerabilities in V8 fixed at the tip of the 4.9 branch (currently 4.9.385.26) Patch Instructions: To install this openSUSE Security Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE 13.1: zypper in -t patch 2016-316=1 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE 13.1 (i586 x86_64): chromedriver-49.0.2623.75-135.1 chromedriver-debuginfo-49.0.2623.75-135.1 chromium-49.0.2623.75-135.1 chromium-debuginfo-49.0.2623.75-135.1 chromium-debugsource-49.0.2623.75-135.1 chromium-desktop-gnome-49.0.2623.75-135.1 chromium-desktop-kde-49.0.2623.75-135.1 chromium-ffmpegsumo-49.0.2623.75-135.1 chromium-ffmpegsumo-debuginfo-49.0.2623.75-135.1 References: https://www.suse.com/security/cve/CVE-2015-8126.html https://www.suse.com/security/cve/CVE-2016-1630.html https://www.suse.com/security/cve/CVE-2016-1631.html https://www.suse.com/security/cve/CVE-2016-1632.html https://www.suse.com/security/cve/CVE-2016-1633.html https://www.suse.com/security/cve/CVE-2016-1634.html https://www.suse.com/security/cve/CVE-2016-1635.html https://www.suse.com/security/cve/CVE-2016-1636.html https://www.suse.com/security/cve/CVE-2016-1637.html https://www.suse.com/security/cve/CVE-2016-1638.html https://www.suse.com/security/cve/CVE-2016-1639.html https://www.suse.com/security/cve/CVE-2016-1640.html https://www.suse.com/security/cve/CVE-2016-1641.html https://www.suse.com/security/cve/CVE-2016-1642.html https://bugzilla.suse.com/969333 -- To unsubscribe, e-mail: opensuse-security-announce+unsubscribe(a)opensuse.org For additional commands, e-mail: opensuse-security-announce+help(a)opensuse.org

1 0

[security-announce] SUSE-SU-2016:0678-1: important: Security update for OpenSSL
by opensuse-security＠opensuse.org 07 Mar '16

07 Mar '16

SUSE Security Update: Security update for OpenSSL ______________________________________________________________________________ Announcement ID: SUSE-SU-2016:0678-1 Rating: important References: #937492 #957812 #963415 #968046 #968048 #968051 #968053 #968374 Cross-References: CVE-2015-0287 CVE-2015-3195 CVE-2015-3197 CVE-2016-0703 CVE-2016-0704 CVE-2016-0797 CVE-2016-0799 CVE-2016-0800 Affected Products: SUSE Linux Enterprise Server 10 SP4 LTSS ______________________________________________________________________________ An update that fixes 8 vulnerabilities is now available. Description: OpenSSL was update to fix security issues and bugs: * CVE-2016-0800 aka the "DROWN" attack (bsc#968046): OpenSSL was vulnerable to a cross-protocol attack that could lead to decryption of TLS sessions by using a server supporting SSLv2 and EXPORT cipher suites as a Bleichenbacher RSA padding oracle. This update changes the OpenSSL library to: o Disable SSLv2 protocol support by default. This can be overridden by setting the environment variable "OPENSSL_ALLOW_SSL2" or by using SSL_CTX_clear_options using the SSL_OP_NO_SSLv2 flag. Note that various services and clients had already disabled SSL protocol 2 by default previously. o Disable all weak EXPORT ciphers by default. These can be re-enabled if required by old legacy software using the environment variable "OPENSSL_ALLOW_EXPORT". * CVE-2016-0797 (bsc#968048): The BN_hex2bn() and BN_dec2bn() functions had a bug that could result in an attempt to de-reference a NULL pointer leading to crashes. This could have security consequences if these functions were ever called by user applications with large untrusted hex/decimal data. Also, internal usage of these functions in OpenSSL uses data from config files or application command line arguments. If user developed applications generated config file data based on untrusted data, then this could have had security consequences as well. * CVE-2016-0799 (bsc#968374): On many 64 bit systems, the internal fmtstr() and doapr_outch() functions could miscalculate the length of a string and attempt to access out-of-bounds memory locations. These problems could have enabled attacks where large amounts of untrusted data is passed to the BIO_*printf functions. If applications use these functions in this way then they could have been vulnerable. OpenSSL itself uses these functions when printing out human-readable dumps of ASN.1 data. Therefore applications that print this data could have been vulnerable if the data is from untrusted sources. OpenSSL command line applications could also have been vulnerable when they print out ASN.1 data, or if untrusted data is passed as command line arguments. Libssl is not considered directly vulnerable. * CVE-2015-3197 (bsc#963415): The SSLv2 protocol did not block disabled ciphers. * CVE-2015-3195 (bsc#957812): An X509_ATTRIBUTE memory leak was fixed. * Fixed a regression caused by the openssl-CVE-2015-0287.patch (bsc#937492) Note that the March 1st 2016 release also references following CVEs that were fixed by us with CVE-2015-0293 in 2015: * CVE-2016-0703 (bsc#968051): This issue only affected versions of OpenSSL prior to March 19th 2015 at which time the code was refactored to address vulnerability CVE-2015-0293. It would have made the above "DROWN" attack much easier. * CVE-2016-0704 (bsc#968053): "Bleichenbacher oracle in SSLv2" This issue only affected versions of OpenSSL prior to March 19th 2015 at which time the code was refactored to address vulnerability CVE-2015-0293. It would have made the above "DROWN" attack much easier. Security Issues: * CVE-2015-0287 <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2015-0287> * CVE-2015-3195 <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2015-3195> * CVE-2015-3197 <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2015-3197> * CVE-2016-0703 <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2016-0703> * CVE-2016-0704 <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2016-0704> * CVE-2016-0797 <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2016-0797> * CVE-2016-0799 <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2016-0799> * CVE-2016-0800 <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2016-0800> Package List: - SUSE Linux Enterprise Server 10 SP4 LTSS (i586 s390x x86_64): openssl-0.9.8a-18.94.2 openssl-devel-0.9.8a-18.94.2 openssl-doc-0.9.8a-18.94.2 - SUSE Linux Enterprise Server 10 SP4 LTSS (s390x x86_64): openssl-32bit-0.9.8a-18.94.2 openssl-devel-32bit-0.9.8a-18.94.2 References: https://www.suse.com/security/cve/CVE-2015-0287.html https://www.suse.com/security/cve/CVE-2015-3195.html https://www.suse.com/security/cve/CVE-2015-3197.html https://www.suse.com/security/cve/CVE-2016-0703.html https://www.suse.com/security/cve/CVE-2016-0704.html https://www.suse.com/security/cve/CVE-2016-0797.html https://www.suse.com/security/cve/CVE-2016-0799.html https://www.suse.com/security/cve/CVE-2016-0800.html https://bugzilla.suse.com/937492 https://bugzilla.suse.com/957812 https://bugzilla.suse.com/963415 https://bugzilla.suse.com/968046 https://bugzilla.suse.com/968048 https://bugzilla.suse.com/968051 https://bugzilla.suse.com/968053 https://bugzilla.suse.com/968374 https://download.suse.com/patch/finder/?keywords=5965d0982b34e01de9e5c15991… -- To unsubscribe, e-mail: opensuse-security-announce+unsubscribe(a)opensuse.org For additional commands, e-mail: opensuse-security-announce+help(a)opensuse.org

1 0