January 2017 - openSUSE Security Announce

[security-announce] openSUSE-SU-2017:0141-1: important: Security update for gstreamer-plugins-good
by opensuse-security＠opensuse.org 16 Jan '17

16 Jan '17

openSUSE Security Update: Security update for gstreamer-plugins-good ______________________________________________________________________________ Announcement ID: openSUSE-SU-2017:0141-1 Rating: important References: #1012102 #1012103 #1012104 #1013653 #1013655 #1013663 Cross-References: CVE-2016-9634 CVE-2016-9635 CVE-2016-9636 CVE-2016-9807 CVE-2016-9808 CVE-2016-9810 Affected Products: openSUSE Leap 42.1 ______________________________________________________________________________ An update that fixes 6 vulnerabilities is now available. Description: This update for gstreamer-plugins-good fixes the following issues: - CVE-2016-9634: Invalid FLIC files could have caused and an out-of-bounds write (bsc#1012102) - CVE-2016-9635: Invalid FLIC files could have caused and an out-of-bounds write (bsc#1012103) - CVE-2016-9636: Prevent maliciously crafted flic files from causing invalid memory writes (bsc#1012104) - CVE-2016-9807: Prevent the reading of invalid memory in flx_decode_chunks, leading to DoS (bsc#1013655) - CVE-2016-9808: Prevent maliciously crafted flic files from causing invalid memory accesses (bsc#1013653) - CVE-2016-9810: Invalid files can be used to extraneous unreferences, leading to invalid memory access and DoS (bsc#1013663) Patch Instructions: To install this openSUSE Security Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE Leap 42.1: zypper in -t patch openSUSE-2017-93=1 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE Leap 42.1 (i586 x86_64): gstreamer-plugins-good-1.4.5-5.1 gstreamer-plugins-good-debuginfo-1.4.5-5.1 gstreamer-plugins-good-debugsource-1.4.5-5.1 gstreamer-plugins-good-doc-1.4.5-5.1 gstreamer-plugins-good-extra-1.4.5-5.1 gstreamer-plugins-good-extra-debuginfo-1.4.5-5.1 - openSUSE Leap 42.1 (x86_64): gstreamer-plugins-good-32bit-1.4.5-5.1 gstreamer-plugins-good-debuginfo-32bit-1.4.5-5.1 gstreamer-plugins-good-extra-32bit-1.4.5-5.1 gstreamer-plugins-good-extra-debuginfo-32bit-1.4.5-5.1 - openSUSE Leap 42.1 (noarch): gstreamer-plugins-good-lang-1.4.5-5.1 References: https://www.suse.com/security/cve/CVE-2016-9634.html https://www.suse.com/security/cve/CVE-2016-9635.html https://www.suse.com/security/cve/CVE-2016-9636.html https://www.suse.com/security/cve/CVE-2016-9807.html https://www.suse.com/security/cve/CVE-2016-9808.html https://www.suse.com/security/cve/CVE-2016-9810.html https://bugzilla.suse.com/1012102 https://bugzilla.suse.com/1012103 https://bugzilla.suse.com/1012104 https://bugzilla.suse.com/1013653 https://bugzilla.suse.com/1013655 https://bugzilla.suse.com/1013663 -- To unsubscribe, e-mail: opensuse-security-announce+unsubscribe(a)opensuse.org For additional commands, e-mail: opensuse-security-announce+help(a)opensuse.org

1 0

[security-announce] SUSE-SU-2017:0127-1: important: Security update for qemu
by opensuse-security＠opensuse.org 13 Jan '17

13 Jan '17

SUSE Security Update: Security update for qemu ______________________________________________________________________________ Announcement ID: SUSE-SU-2017:0127-1 Rating: important References: #1007454 #1008519 #1009109 #1013285 #1013341 #1013764 #1013767 #1014109 #1014110 #1014111 #1014112 #1014256 #1014514 #1016779 #937125 Cross-References: CVE-2016-9102 CVE-2016-9103 CVE-2016-9381 CVE-2016-9776 CVE-2016-9845 CVE-2016-9846 CVE-2016-9907 CVE-2016-9908 CVE-2016-9911 CVE-2016-9912 CVE-2016-9913 CVE-2016-9921 CVE-2016-9922 Affected Products: SUSE Linux Enterprise Server for Raspberry Pi 12-SP2 SUSE Linux Enterprise Server 12-SP2 SUSE Linux Enterprise Desktop 12-SP2 ______________________________________________________________________________ An update that solves 13 vulnerabilities and has two fixes is now available. Description: qemu was updated to fix several issues. These security issues were fixed: - CVE-2016-9102: Memory leak in the v9fs_xattrcreate function in hw/9pfs/9p.c in allowed local guest OS administrators to cause a denial of service (memory consumption and QEMU process crash) via a large number of Txattrcreate messages with the same fid number (bsc#1014256). - CVE-2016-9103: The v9fs_xattrcreate function in hw/9pfs/9p.c in allowed local guest OS administrators to obtain sensitive host heap memory information by reading xattribute values writing to them (bsc#1007454). - CVE-2016-9381: Improper processing of shared rings allowing guest administrators take over the qemu process, elevating their privilege to that of the qemu process (bsc#1009109) - CVE-2016-9776: The ColdFire Fast Ethernet Controller emulator support was vulnerable to an infinite loop issue while receiving packets in 'mcf_fec_receive'. A privileged user/process inside guest could have used this issue to crash the Qemu process on the host leading to DoS (bsc#1013285). - CVE-2016-9845: The Virtio GPU Device emulator support as vulnerable to an information leakage issue while processing the 'VIRTIO_GPU_CMD_GET_CAPSET_INFO' command. A guest user/process could have used this flaw to leak contents of the host memory (bsc#1013767). - CVE-2016-9846: The Virtio GPU Device emulator support was vulnerable to a memory leakage issue while updating the cursor data in update_cursor_data_virgl. A guest user/process could have used this flaw to leak host memory bytes, resulting in DoS for the host (bsc#1013764). - CVE-2016-9907: The USB redirector usb-guest support was vulnerable to a memory leakage flaw when destroying the USB redirector in 'usbredir_handle_destroy'. A guest user/process could have used this issue to leak host memory, resulting in DoS for a host (bsc#1014109). - CVE-2016-9908: The Virtio GPU Device emulator support was vulnerable to an information leakage issue while processing the 'VIRTIO_GPU_CMD_GET_CAPSET' command. A guest user/process could have used this flaw to leak contents of the host memory (bsc#1014514). - CVE-2016-9911: The USB EHCI Emulation support was vulnerable to a memory leakage issue while processing packet data in 'ehci_init_transfer'. A guest user/process could have used this issue to leak host memory, resulting in DoS for the host (bsc#1014111). - CVE-2016-9912: The Virtio GPU Device emulator support was vulnerable to a memory leakage issue while destroying gpu resource object in 'virtio_gpu_resource_destroy'. A guest user/process could have used this flaw to leak host memory bytes, resulting in DoS for the host (bsc#1014112). - CVE-2016-9913: VirtFS was vulnerable to memory leakage issue via its '9p-handle' or '9p-proxy' backend drivers. A privileged user inside guest could have used this flaw to leak host memory, thus affecting other services on the host and/or potentially crash the Qemu process on the host (bsc#1014110). These non-security issues were fixed: - Fixed uint64 property parsing and add regression tests (bsc#937125) - Added a man page for kvm_stat - Fix crash in vte (bsc#1008519) - Various upstream commits targeted towards stable releases (bsc#1013341) Patch Instructions: To install this SUSE Security Update use YaST online_update. Alternatively you can run the command listed for your product: - SUSE Linux Enterprise Server for Raspberry Pi 12-SP2: zypper in -t patch SUSE-SLE-RPI-12-SP2-2017-68=1 - SUSE Linux Enterprise Server 12-SP2: zypper in -t patch SUSE-SLE-SERVER-12-SP2-2017-68=1 - SUSE Linux Enterprise Desktop 12-SP2: zypper in -t patch SUSE-SLE-DESKTOP-12-SP2-2017-68=1 To bring your system up-to-date, use "zypper patch". Package List: - SUSE Linux Enterprise Server for Raspberry Pi 12-SP2 (aarch64): qemu-2.6.2-39.1 qemu-arm-2.6.2-39.1 qemu-arm-debuginfo-2.6.2-39.1 qemu-block-curl-2.6.2-39.1 qemu-block-curl-debuginfo-2.6.2-39.1 qemu-block-rbd-2.6.2-39.1 qemu-block-rbd-debuginfo-2.6.2-39.1 qemu-block-ssh-2.6.2-39.1 qemu-block-ssh-debuginfo-2.6.2-39.1 qemu-debugsource-2.6.2-39.1 qemu-guest-agent-2.6.2-39.1 qemu-guest-agent-debuginfo-2.6.2-39.1 qemu-lang-2.6.2-39.1 qemu-tools-2.6.2-39.1 qemu-tools-debuginfo-2.6.2-39.1 - SUSE Linux Enterprise Server for Raspberry Pi 12-SP2 (noarch): qemu-ipxe-1.0.0-39.1 - SUSE Linux Enterprise Server 12-SP2 (aarch64 ppc64le x86_64): qemu-2.6.2-39.1 qemu-block-curl-2.6.2-39.1 qemu-block-curl-debuginfo-2.6.2-39.1 qemu-block-ssh-2.6.2-39.1 qemu-block-ssh-debuginfo-2.6.2-39.1 qemu-debugsource-2.6.2-39.1 qemu-guest-agent-2.6.2-39.1 qemu-guest-agent-debuginfo-2.6.2-39.1 qemu-lang-2.6.2-39.1 qemu-tools-2.6.2-39.1 qemu-tools-debuginfo-2.6.2-39.1 - SUSE Linux Enterprise Server 12-SP2 (aarch64 x86_64): qemu-block-rbd-2.6.2-39.1 qemu-block-rbd-debuginfo-2.6.2-39.1 - SUSE Linux Enterprise Server 12-SP2 (ppc64le): qemu-ppc-2.6.2-39.1 qemu-ppc-debuginfo-2.6.2-39.1 - SUSE Linux Enterprise Server 12-SP2 (aarch64): qemu-arm-2.6.2-39.1 qemu-arm-debuginfo-2.6.2-39.1 - SUSE Linux Enterprise Server 12-SP2 (x86_64): qemu-kvm-2.6.2-39.1 qemu-x86-2.6.2-39.1 - SUSE Linux Enterprise Server 12-SP2 (noarch): qemu-ipxe-1.0.0-39.1 qemu-seabios-1.9.1-39.1 qemu-sgabios-8-39.1 qemu-vgabios-1.9.1-39.1 - SUSE Linux Enterprise Desktop 12-SP2 (noarch): qemu-ipxe-1.0.0-39.1 qemu-seabios-1.9.1-39.1 qemu-sgabios-8-39.1 qemu-vgabios-1.9.1-39.1 - SUSE Linux Enterprise Desktop 12-SP2 (x86_64): qemu-2.6.2-39.1 qemu-block-curl-2.6.2-39.1 qemu-block-curl-debuginfo-2.6.2-39.1 qemu-debugsource-2.6.2-39.1 qemu-kvm-2.6.2-39.1 qemu-tools-2.6.2-39.1 qemu-tools-debuginfo-2.6.2-39.1 qemu-x86-2.6.2-39.1 References: https://www.suse.com/security/cve/CVE-2016-9102.html https://www.suse.com/security/cve/CVE-2016-9103.html https://www.suse.com/security/cve/CVE-2016-9381.html https://www.suse.com/security/cve/CVE-2016-9776.html https://www.suse.com/security/cve/CVE-2016-9845.html https://www.suse.com/security/cve/CVE-2016-9846.html https://www.suse.com/security/cve/CVE-2016-9907.html https://www.suse.com/security/cve/CVE-2016-9908.html https://www.suse.com/security/cve/CVE-2016-9911.html https://www.suse.com/security/cve/CVE-2016-9912.html https://www.suse.com/security/cve/CVE-2016-9913.html https://www.suse.com/security/cve/CVE-2016-9921.html https://www.suse.com/security/cve/CVE-2016-9922.html https://bugzilla.suse.com/1007454 https://bugzilla.suse.com/1008519 https://bugzilla.suse.com/1009109 https://bugzilla.suse.com/1013285 https://bugzilla.suse.com/1013341 https://bugzilla.suse.com/1013764 https://bugzilla.suse.com/1013767 https://bugzilla.suse.com/1014109 https://bugzilla.suse.com/1014110 https://bugzilla.suse.com/1014111 https://bugzilla.suse.com/1014112 https://bugzilla.suse.com/1014256 https://bugzilla.suse.com/1014514 https://bugzilla.suse.com/1016779 https://bugzilla.suse.com/937125 -- To unsubscribe, e-mail: opensuse-security-announce+unsubscribe(a)opensuse.org For additional commands, e-mail: opensuse-security-announce+help(a)opensuse.org

1 0

[security-announce] SUSE-SU-2017:0113-1: important: Security update for bind
by opensuse-security＠opensuse.org 12 Jan '17

12 Jan '17

SUSE Security Update: Security update for bind ______________________________________________________________________________ Announcement ID: SUSE-SU-2017:0113-1 Rating: important References: #1018699 #1018700 #1018701 #1018702 #965748 Cross-References: CVE-2016-9131 CVE-2016-9147 CVE-2016-9444 Affected Products: SUSE Linux Enterprise Server for SAP 12 SUSE Linux Enterprise Server 12-LTSS ______________________________________________________________________________ An update that solves three vulnerabilities and has two fixes is now available. Description: This update for bind fixes the following issues: - Fix a potential assertion failure that could have been triggered by a malformed response to an ANY query, thereby facilitating a denial-of-service attack. [CVE-2016-9131, bsc#1018700, bsc#1018699] - Fix a potential assertion failure that could have been triggered by responding to a query with inconsistent DNSSEC information, thereby facilitating a denial-of-service attack. [CVE-2016-9147, bsc#1018701, bsc#1018699] - Fix potential assertion failure that could have been triggered by DNS responses that contain unusually-formed DS resource records, facilitating a denial-of-service attack. [CVE-2016-9444, bsc#1018702, bsc#1018699] - Fixed ldapdump to use a temporary pseudo nameserver that conforms to BIND's expected syntax. Prior versions would not work correctly with an LDAP backed DNS server. [bsc#965748] Patch Instructions: To install this SUSE Security Update use YaST online_update. Alternatively you can run the command listed for your product: - SUSE Linux Enterprise Server for SAP 12: zypper in -t patch SUSE-SLE-SAP-12-2017-52=1 - SUSE Linux Enterprise Server 12-LTSS: zypper in -t patch SUSE-SLE-SERVER-12-2017-52=1 To bring your system up-to-date, use "zypper patch". Package List: - SUSE Linux Enterprise Server for SAP 12 (x86_64): bind-9.9.9P1-28.26.1 bind-chrootenv-9.9.9P1-28.26.1 bind-debuginfo-9.9.9P1-28.26.1 bind-debugsource-9.9.9P1-28.26.1 bind-libs-32bit-9.9.9P1-28.26.1 bind-libs-9.9.9P1-28.26.1 bind-libs-debuginfo-32bit-9.9.9P1-28.26.1 bind-libs-debuginfo-9.9.9P1-28.26.1 bind-utils-9.9.9P1-28.26.1 bind-utils-debuginfo-9.9.9P1-28.26.1 - SUSE Linux Enterprise Server for SAP 12 (noarch): bind-doc-9.9.9P1-28.26.1 - SUSE Linux Enterprise Server 12-LTSS (ppc64le s390x x86_64): bind-9.9.9P1-28.26.1 bind-chrootenv-9.9.9P1-28.26.1 bind-debuginfo-9.9.9P1-28.26.1 bind-debugsource-9.9.9P1-28.26.1 bind-libs-9.9.9P1-28.26.1 bind-libs-debuginfo-9.9.9P1-28.26.1 bind-utils-9.9.9P1-28.26.1 bind-utils-debuginfo-9.9.9P1-28.26.1 - SUSE Linux Enterprise Server 12-LTSS (s390x x86_64): bind-libs-32bit-9.9.9P1-28.26.1 bind-libs-debuginfo-32bit-9.9.9P1-28.26.1 - SUSE Linux Enterprise Server 12-LTSS (noarch): bind-doc-9.9.9P1-28.26.1 References: https://www.suse.com/security/cve/CVE-2016-9131.html https://www.suse.com/security/cve/CVE-2016-9147.html https://www.suse.com/security/cve/CVE-2016-9444.html https://bugzilla.suse.com/1018699 https://bugzilla.suse.com/1018700 https://bugzilla.suse.com/1018701 https://bugzilla.suse.com/1018702 https://bugzilla.suse.com/965748 -- To unsubscribe, e-mail: opensuse-security-announce+unsubscribe(a)opensuse.org For additional commands, e-mail: opensuse-security-announce+help(a)opensuse.org

1 0

[security-announce] SUSE-SU-2017:0112-1: important: Security update for bind
by opensuse-security＠opensuse.org 12 Jan '17

12 Jan '17

SUSE Security Update: Security update for bind ______________________________________________________________________________ Announcement ID: SUSE-SU-2017:0112-1 Rating: important References: #1018699 #1018700 #1018701 #1018702 Cross-References: CVE-2016-9131 CVE-2016-9147 CVE-2016-9444 Affected Products: SUSE OpenStack Cloud 5 SUSE Manager Proxy 2.1 SUSE Manager 2.1 SUSE Linux Enterprise Software Development Kit 11-SP4 SUSE Linux Enterprise Server 11-SP4 SUSE Linux Enterprise Server 11-SP3-LTSS SUSE Linux Enterprise Server 11-SP2-LTSS SUSE Linux Enterprise Point of Sale 11-SP3 SUSE Linux Enterprise Debuginfo 11-SP4 ______________________________________________________________________________ An update that solves three vulnerabilities and has one errata is now available. Description: This update for bind fixes the following issues: - Fix a potential assertion failure that could have been triggered by a malformed response to an ANY query, thereby facilitating a denial-of-service attack. [CVE-2016-9131, bsc#1018700, bsc#1018699] - Fix a potential assertion failure that could have been triggered by responding to a query with inconsistent DNSSEC information, thereby facilitating a denial-of-service attack. [CVE-2016-9147, bsc#1018701, bsc#1018699] - Fix potential assertion failure that could have been triggered by DNS responses that contain unusually-formed DS resource records, facilitating a denial-of-service attack. [CVE-2016-9444, bsc#1018702, bsc#1018699] Patch Instructions: To install this SUSE Security Update use YaST online_update. Alternatively you can run the command listed for your product: - SUSE OpenStack Cloud 5: zypper in -t patch sleclo50sp3-bind-12936=1 - SUSE Manager Proxy 2.1: zypper in -t patch slemap21-bind-12936=1 - SUSE Manager 2.1: zypper in -t patch sleman21-bind-12936=1 - SUSE Linux Enterprise Software Development Kit 11-SP4: zypper in -t patch sdksp4-bind-12936=1 - SUSE Linux Enterprise Server 11-SP4: zypper in -t patch slessp4-bind-12936=1 - SUSE Linux Enterprise Server 11-SP3-LTSS: zypper in -t patch slessp3-bind-12936=1 - SUSE Linux Enterprise Server 11-SP2-LTSS: zypper in -t patch slessp2-bind-12936=1 - SUSE Linux Enterprise Point of Sale 11-SP3: zypper in -t patch sleposp3-bind-12936=1 - SUSE Linux Enterprise Debuginfo 11-SP4: zypper in -t patch dbgsp4-bind-12936=1 To bring your system up-to-date, use "zypper patch". Package List: - SUSE OpenStack Cloud 5 (x86_64): bind-9.9.6P1-0.36.1 bind-chrootenv-9.9.6P1-0.36.1 bind-doc-9.9.6P1-0.36.1 bind-libs-32bit-9.9.6P1-0.36.1 bind-libs-9.9.6P1-0.36.1 bind-utils-9.9.6P1-0.36.1 - SUSE Manager Proxy 2.1 (x86_64): bind-9.9.6P1-0.36.1 bind-chrootenv-9.9.6P1-0.36.1 bind-doc-9.9.6P1-0.36.1 bind-libs-32bit-9.9.6P1-0.36.1 bind-libs-9.9.6P1-0.36.1 bind-utils-9.9.6P1-0.36.1 - SUSE Manager 2.1 (s390x x86_64): bind-9.9.6P1-0.36.1 bind-chrootenv-9.9.6P1-0.36.1 bind-doc-9.9.6P1-0.36.1 bind-libs-32bit-9.9.6P1-0.36.1 bind-libs-9.9.6P1-0.36.1 bind-utils-9.9.6P1-0.36.1 - SUSE Linux Enterprise Software Development Kit 11-SP4 (i586 ia64 ppc64 s390x x86_64): bind-devel-9.9.6P1-0.36.1 - SUSE Linux Enterprise Software Development Kit 11-SP4 (ppc64): bind-devel-32bit-9.9.6P1-0.36.1 - SUSE Linux Enterprise Server 11-SP4 (i586 ia64 ppc64 s390x x86_64): bind-9.9.6P1-0.36.1 bind-chrootenv-9.9.6P1-0.36.1 bind-doc-9.9.6P1-0.36.1 bind-libs-9.9.6P1-0.36.1 bind-utils-9.9.6P1-0.36.1 - SUSE Linux Enterprise Server 11-SP4 (ppc64 s390x x86_64): bind-libs-32bit-9.9.6P1-0.36.1 - SUSE Linux Enterprise Server 11-SP4 (ia64): bind-libs-x86-9.9.6P1-0.36.1 - SUSE Linux Enterprise Server 11-SP3-LTSS (i586 s390x x86_64): bind-9.9.6P1-0.36.1 bind-chrootenv-9.9.6P1-0.36.1 bind-doc-9.9.6P1-0.36.1 bind-libs-9.9.6P1-0.36.1 bind-utils-9.9.6P1-0.36.1 - SUSE Linux Enterprise Server 11-SP3-LTSS (s390x x86_64): bind-libs-32bit-9.9.6P1-0.36.1 - SUSE Linux Enterprise Server 11-SP2-LTSS (i586 s390x x86_64): bind-9.9.6P1-0.36.1 bind-chrootenv-9.9.6P1-0.36.1 bind-devel-9.9.6P1-0.36.1 bind-doc-9.9.6P1-0.36.1 bind-libs-9.9.6P1-0.36.1 bind-utils-9.9.6P1-0.36.1 - SUSE Linux Enterprise Server 11-SP2-LTSS (s390x x86_64): bind-libs-32bit-9.9.6P1-0.36.1 - SUSE Linux Enterprise Point of Sale 11-SP3 (i586): bind-9.9.6P1-0.36.1 bind-chrootenv-9.9.6P1-0.36.1 bind-doc-9.9.6P1-0.36.1 bind-libs-9.9.6P1-0.36.1 bind-utils-9.9.6P1-0.36.1 - SUSE Linux Enterprise Debuginfo 11-SP4 (i586 ia64 ppc64 s390x x86_64): bind-debuginfo-9.9.6P1-0.36.1 bind-debugsource-9.9.6P1-0.36.1 References: https://www.suse.com/security/cve/CVE-2016-9131.html https://www.suse.com/security/cve/CVE-2016-9147.html https://www.suse.com/security/cve/CVE-2016-9444.html https://bugzilla.suse.com/1018699 https://bugzilla.suse.com/1018700 https://bugzilla.suse.com/1018701 https://bugzilla.suse.com/1018702 -- To unsubscribe, e-mail: opensuse-security-announce+unsubscribe(a)opensuse.org For additional commands, e-mail: opensuse-security-announce+help(a)opensuse.org

1 0

[security-announce] SUSE-SU-2017:0111-1: important: Security update for bind
by opensuse-security＠opensuse.org 12 Jan '17

12 Jan '17

SUSE Security Update: Security update for bind ______________________________________________________________________________ Announcement ID: SUSE-SU-2017:0111-1 Rating: important References: #1018699 #1018700 #1018701 #1018702 Cross-References: CVE-2016-9131 CVE-2016-9147 CVE-2016-9444 Affected Products: SUSE Linux Enterprise Software Development Kit 12-SP2 SUSE Linux Enterprise Software Development Kit 12-SP1 SUSE Linux Enterprise Server for Raspberry Pi 12-SP2 SUSE Linux Enterprise Server 12-SP2 SUSE Linux Enterprise Server 12-SP1 SUSE Linux Enterprise Desktop 12-SP2 SUSE Linux Enterprise Desktop 12-SP1 ______________________________________________________________________________ An update that solves three vulnerabilities and has one errata is now available. Description: This update for bind fixes the following issues: - Fix a potential assertion failure that could have been triggered by a malformed response to an ANY query, thereby facilitating a denial-of-service attack. [CVE-2016-9131, bsc#1018700, bsc#1018699] - Fix a potential assertion failure that could have been triggered by responding to a query with inconsistent DNSSEC information, thereby facilitating a denial-of-service attack. [CVE-2016-9147, bsc#1018701, bsc#1018699] - Fix potential assertion failure that could have been triggered by DNS responses that contain unusually-formed DS resource records, facilitating a denial-of-service attack. [CVE-2016-9444, bsc#1018702, bsc#1018699] Patch Instructions: To install this SUSE Security Update use YaST online_update. Alternatively you can run the command listed for your product: - SUSE Linux Enterprise Software Development Kit 12-SP2: zypper in -t patch SUSE-SLE-SDK-12-SP2-2017-54=1 - SUSE Linux Enterprise Software Development Kit 12-SP1: zypper in -t patch SUSE-SLE-SDK-12-SP1-2017-54=1 - SUSE Linux Enterprise Server for Raspberry Pi 12-SP2: zypper in -t patch SUSE-SLE-RPI-12-SP2-2017-54=1 - SUSE Linux Enterprise Server 12-SP2: zypper in -t patch SUSE-SLE-SERVER-12-SP2-2017-54=1 - SUSE Linux Enterprise Server 12-SP1: zypper in -t patch SUSE-SLE-SERVER-12-SP1-2017-54=1 - SUSE Linux Enterprise Desktop 12-SP2: zypper in -t patch SUSE-SLE-DESKTOP-12-SP2-2017-54=1 - SUSE Linux Enterprise Desktop 12-SP1: zypper in -t patch SUSE-SLE-DESKTOP-12-SP1-2017-54=1 To bring your system up-to-date, use "zypper patch". Package List: - SUSE Linux Enterprise Software Development Kit 12-SP2 (aarch64 ppc64le s390x x86_64): bind-debuginfo-9.9.9P1-53.1 bind-debugsource-9.9.9P1-53.1 bind-devel-9.9.9P1-53.1 - SUSE Linux Enterprise Software Development Kit 12-SP1 (ppc64le s390x x86_64): bind-debuginfo-9.9.9P1-53.1 bind-debugsource-9.9.9P1-53.1 bind-devel-9.9.9P1-53.1 - SUSE Linux Enterprise Server for Raspberry Pi 12-SP2 (aarch64): bind-9.9.9P1-53.1 bind-chrootenv-9.9.9P1-53.1 bind-debuginfo-9.9.9P1-53.1 bind-debugsource-9.9.9P1-53.1 bind-libs-9.9.9P1-53.1 bind-libs-debuginfo-9.9.9P1-53.1 bind-utils-9.9.9P1-53.1 bind-utils-debuginfo-9.9.9P1-53.1 - SUSE Linux Enterprise Server for Raspberry Pi 12-SP2 (noarch): bind-doc-9.9.9P1-53.1 - SUSE Linux Enterprise Server 12-SP2 (aarch64 ppc64le x86_64): bind-9.9.9P1-53.1 bind-chrootenv-9.9.9P1-53.1 bind-debuginfo-9.9.9P1-53.1 bind-debugsource-9.9.9P1-53.1 bind-libs-9.9.9P1-53.1 bind-libs-debuginfo-9.9.9P1-53.1 bind-utils-9.9.9P1-53.1 bind-utils-debuginfo-9.9.9P1-53.1 - SUSE Linux Enterprise Server 12-SP2 (x86_64): bind-libs-32bit-9.9.9P1-53.1 bind-libs-debuginfo-32bit-9.9.9P1-53.1 - SUSE Linux Enterprise Server 12-SP2 (noarch): bind-doc-9.9.9P1-53.1 - SUSE Linux Enterprise Server 12-SP1 (ppc64le s390x x86_64): bind-9.9.9P1-53.1 bind-chrootenv-9.9.9P1-53.1 bind-debuginfo-9.9.9P1-53.1 bind-debugsource-9.9.9P1-53.1 bind-libs-9.9.9P1-53.1 bind-libs-debuginfo-9.9.9P1-53.1 bind-utils-9.9.9P1-53.1 bind-utils-debuginfo-9.9.9P1-53.1 - SUSE Linux Enterprise Server 12-SP1 (s390x x86_64): bind-libs-32bit-9.9.9P1-53.1 bind-libs-debuginfo-32bit-9.9.9P1-53.1 - SUSE Linux Enterprise Server 12-SP1 (noarch): bind-doc-9.9.9P1-53.1 - SUSE Linux Enterprise Desktop 12-SP2 (x86_64): bind-debuginfo-9.9.9P1-53.1 bind-debugsource-9.9.9P1-53.1 bind-libs-32bit-9.9.9P1-53.1 bind-libs-9.9.9P1-53.1 bind-libs-debuginfo-32bit-9.9.9P1-53.1 bind-libs-debuginfo-9.9.9P1-53.1 bind-utils-9.9.9P1-53.1 bind-utils-debuginfo-9.9.9P1-53.1 - SUSE Linux Enterprise Desktop 12-SP1 (x86_64): bind-debuginfo-9.9.9P1-53.1 bind-debugsource-9.9.9P1-53.1 bind-libs-32bit-9.9.9P1-53.1 bind-libs-9.9.9P1-53.1 bind-libs-debuginfo-32bit-9.9.9P1-53.1 bind-libs-debuginfo-9.9.9P1-53.1 bind-utils-9.9.9P1-53.1 bind-utils-debuginfo-9.9.9P1-53.1 References: https://www.suse.com/security/cve/CVE-2016-9131.html https://www.suse.com/security/cve/CVE-2016-9147.html https://www.suse.com/security/cve/CVE-2016-9444.html https://bugzilla.suse.com/1018699 https://bugzilla.suse.com/1018700 https://bugzilla.suse.com/1018701 https://bugzilla.suse.com/1018702 -- To unsubscribe, e-mail: opensuse-security-announce+unsubscribe(a)opensuse.org For additional commands, e-mail: opensuse-security-announce+help(a)opensuse.org

1 0

[security-announce] SUSE-SU-2017:0108-1: important: Security update for flash-player
by opensuse-security＠opensuse.org 11 Jan '17

11 Jan '17

SUSE Security Update: Security update for flash-player ______________________________________________________________________________ Announcement ID: SUSE-SU-2017:0108-1 Rating: important References: #1019129 Cross-References: CVE-2017-2925 CVE-2017-2926 CVE-2017-2927 CVE-2017-2928 CVE-2017-2930 CVE-2017-2931 CVE-2017-2932 CVE-2017-2933 CVE-2017-2934 CVE-2017-2935 CVE-2017-2936 CVE-2017-2937 CVE-2017-2938 Affected Products: SUSE Linux Enterprise Workstation Extension 12-SP1 SUSE Linux Enterprise Desktop 12-SP1 ______________________________________________________________________________ An update that fixes 13 vulnerabilities is now available. Description: This update to Adobe Flash 24.0.0.194 fixes the following vulnerabilities advised under APSB17-02: - security bypass vulnerability that could lead to information disclosure (CVE-2017-2938) - use-after-free vulnerabilities that could lead to code execution (CVE-2017-2932, CVE-2017-2936, CVE-2017-2937) - heap buffer overflow vulnerabilities that could lead to code execution (CVE-2017-2927, CVE-2017-2933, CVE-2017-2934, CVE-2017-2935) - memory corruption vulnerabilities that could lead to code execution (CVE-2017-2925, CVE-2017-2926, CVE-2017-2928, CVE-2017-2930, CVE-2017-2931) Patch Instructions: To install this SUSE Security Update use YaST online_update. Alternatively you can run the command listed for your product: - SUSE Linux Enterprise Workstation Extension 12-SP1: zypper in -t patch SUSE-SLE-WE-12-SP1-2017-51=1 - SUSE Linux Enterprise Desktop 12-SP1: zypper in -t patch SUSE-SLE-DESKTOP-12-SP1-2017-51=1 To bring your system up-to-date, use "zypper patch". Package List: - SUSE Linux Enterprise Workstation Extension 12-SP1 (x86_64): flash-player-24.0.0.194-155.1 flash-player-gnome-24.0.0.194-155.1 - SUSE Linux Enterprise Desktop 12-SP1 (x86_64): flash-player-24.0.0.194-155.1 flash-player-gnome-24.0.0.194-155.1 References: https://www.suse.com/security/cve/CVE-2017-2925.html https://www.suse.com/security/cve/CVE-2017-2926.html https://www.suse.com/security/cve/CVE-2017-2927.html https://www.suse.com/security/cve/CVE-2017-2928.html https://www.suse.com/security/cve/CVE-2017-2930.html https://www.suse.com/security/cve/CVE-2017-2931.html https://www.suse.com/security/cve/CVE-2017-2932.html https://www.suse.com/security/cve/CVE-2017-2933.html https://www.suse.com/security/cve/CVE-2017-2934.html https://www.suse.com/security/cve/CVE-2017-2935.html https://www.suse.com/security/cve/CVE-2017-2936.html https://www.suse.com/security/cve/CVE-2017-2937.html https://www.suse.com/security/cve/CVE-2017-2938.html https://bugzilla.suse.com/1019129 -- To unsubscribe, e-mail: opensuse-security-announce+unsubscribe(a)opensuse.org For additional commands, e-mail: opensuse-security-announce+help(a)opensuse.org

1 0

[security-announce] openSUSE-SU-2017:0107-1: important: Security update for flash-player
by opensuse-security＠opensuse.org 11 Jan '17

11 Jan '17

openSUSE Security Update: Security update for flash-player ______________________________________________________________________________ Announcement ID: openSUSE-SU-2017:0107-1 Rating: important References: #1019129 Cross-References: CVE-2017-2925 CVE-2017-2926 CVE-2017-2927 CVE-2017-2928 CVE-2017-2930 CVE-2017-2931 CVE-2017-2932 CVE-2017-2933 CVE-2017-2934 CVE-2017-2935 CVE-2017-2936 CVE-2017-2937 CVE-2017-2938 Affected Products: openSUSE 13.2 NonFree ______________________________________________________________________________ An update that fixes 13 vulnerabilities is now available. Description: This update to Adobe Flash 24.0.0.194 fixes the following vulnerabilities advised under APSB17-02: - security bypass vulnerability that could lead to information disclosure (CVE-2017-2938) - use-after-free vulnerabilities that could lead to code execution (CVE-2017-2932, CVE-2017-2936, CVE-2017-2937) - heap buffer overflow vulnerabilities that could lead to code execution (CVE-2017-2927, CVE-2017-2933, CVE-2017-2934, CVE-2017-2935) - memory corruption vulnerabilities that could lead to code execution (CVE-2017-2925, CVE-2017-2926, CVE-2017-2928, CVE-2017-2930, CVE-2017-2931) Patch Instructions: To install this openSUSE Security Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE 13.2 NonFree: zypper in -t patch openSUSE-2017-71=1 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE 13.2 NonFree (i586 x86_64): flash-player-24.0.0.194-2.124.1 flash-player-gnome-24.0.0.194-2.124.1 flash-player-kde4-24.0.0.194-2.124.1 References: https://www.suse.com/security/cve/CVE-2017-2925.html https://www.suse.com/security/cve/CVE-2017-2926.html https://www.suse.com/security/cve/CVE-2017-2927.html https://www.suse.com/security/cve/CVE-2017-2928.html https://www.suse.com/security/cve/CVE-2017-2930.html https://www.suse.com/security/cve/CVE-2017-2931.html https://www.suse.com/security/cve/CVE-2017-2932.html https://www.suse.com/security/cve/CVE-2017-2933.html https://www.suse.com/security/cve/CVE-2017-2934.html https://www.suse.com/security/cve/CVE-2017-2935.html https://www.suse.com/security/cve/CVE-2017-2936.html https://www.suse.com/security/cve/CVE-2017-2937.html https://www.suse.com/security/cve/CVE-2017-2938.html https://bugzilla.suse.com/1019129 -- To unsubscribe, e-mail: opensuse-security-announce+unsubscribe(a)opensuse.org For additional commands, e-mail: opensuse-security-announce+help(a)opensuse.org

1 0

[security-announce] SUSE-SU-2017:0104-1: important: Security update for LibVNCServer
by opensuse-security＠opensuse.org 11 Jan '17

11 Jan '17

SUSE Security Update: Security update for LibVNCServer ______________________________________________________________________________ Announcement ID: SUSE-SU-2017:0104-1 Rating: important References: #1017711 #1017712 Cross-References: CVE-2016-9941 CVE-2016-9942 Affected Products: SUSE Linux Enterprise Software Development Kit 11-SP4 SUSE Linux Enterprise Server 11-SP4 SUSE Linux Enterprise Debuginfo 11-SP4 ______________________________________________________________________________ An update that fixes two vulnerabilities is now available. Description: LibVNCServer was updated to fix two security issues. These security issues were fixed: - CVE-2016-9941: Heap-based buffer overflow in rfbproto.c allowed remote servers to cause a denial of service (application crash) or possibly execute arbitrary code via a crafted FramebufferUpdate message containing a subrectangle outside of the client drawing area (bsc#1017711) - CVE-2016-9942: Heap-based buffer overflow in ultra.c allowed remote servers to cause a denial of service (application crash) or possibly execute arbitrary code via a crafted FramebufferUpdate message with the Ultra type tile, such that the LZO payload decompressed length exceeds what is specified by the tile dimensions (bsc#1017712) Patch Instructions: To install this SUSE Security Update use YaST online_update. Alternatively you can run the command listed for your product: - SUSE Linux Enterprise Software Development Kit 11-SP4: zypper in -t patch sdksp4-LibVNCServer-12932=1 - SUSE Linux Enterprise Server 11-SP4: zypper in -t patch slessp4-LibVNCServer-12932=1 - SUSE Linux Enterprise Debuginfo 11-SP4: zypper in -t patch dbgsp4-LibVNCServer-12932=1 To bring your system up-to-date, use "zypper patch". Package List: - SUSE Linux Enterprise Software Development Kit 11-SP4 (i586 ia64 ppc64 s390x x86_64): LibVNCServer-devel-0.9.1-159.1 - SUSE Linux Enterprise Server 11-SP4 (i586 ia64 ppc64 s390x x86_64): LibVNCServer-0.9.1-159.1 - SUSE Linux Enterprise Debuginfo 11-SP4 (i586 ia64 ppc64 s390x x86_64): LibVNCServer-debuginfo-0.9.1-159.1 LibVNCServer-debugsource-0.9.1-159.1 References: https://www.suse.com/security/cve/CVE-2016-9941.html https://www.suse.com/security/cve/CVE-2016-9942.html https://bugzilla.suse.com/1017711 https://bugzilla.suse.com/1017712 -- To unsubscribe, e-mail: opensuse-security-announce+unsubscribe(a)opensuse.org For additional commands, e-mail: opensuse-security-announce+help(a)opensuse.org

1 0

[security-announce] SUSE-SU-2017:0102-1: important: Security update for freeradius-server
by opensuse-security＠opensuse.org 10 Jan '17

10 Jan '17

SUSE Security Update: Security update for freeradius-server ______________________________________________________________________________ Announcement ID: SUSE-SU-2017:0102-1 Rating: important References: #1013311 #911886 #935573 #951404 Cross-References: CVE-2015-4680 Affected Products: SUSE Linux Enterprise Software Development Kit 12-SP2 SUSE Linux Enterprise Software Development Kit 12-SP1 SUSE Linux Enterprise Server for Raspberry Pi 12-SP2 SUSE Linux Enterprise Server 12-SP2 SUSE Linux Enterprise Server 12-SP1 ______________________________________________________________________________ An update that solves one vulnerability and has three fixes is now available. Description: This update of freeradius-server fixes several issues. Security issue fixed: - CVE-2015-4680: Fixed Insufficent CRL application for intermediate certificates (bsc#935573) Non security issues fixed: - Allows FreeRadius Server to start on SUSE Linux Enterprise Server 12 SP2 systems by relaxing a too strict openssl version check. (bsc#1013311) - Fixed radclient error free() invalid pointer (bsc#911886) - Fixed failing rebuild of freeradius-server package (bsc#951404) Patch Instructions: To install this SUSE Security Update use YaST online_update. Alternatively you can run the command listed for your product: - SUSE Linux Enterprise Software Development Kit 12-SP2: zypper in -t patch SUSE-SLE-SDK-12-SP2-2017-44=1 - SUSE Linux Enterprise Software Development Kit 12-SP1: zypper in -t patch SUSE-SLE-SDK-12-SP1-2017-44=1 - SUSE Linux Enterprise Server for Raspberry Pi 12-SP2: zypper in -t patch SUSE-SLE-RPI-12-SP2-2017-44=1 - SUSE Linux Enterprise Server 12-SP2: zypper in -t patch SUSE-SLE-SERVER-12-SP2-2017-44=1 - SUSE Linux Enterprise Server 12-SP1: zypper in -t patch SUSE-SLE-SERVER-12-SP1-2017-44=1 To bring your system up-to-date, use "zypper patch". Package List: - SUSE Linux Enterprise Software Development Kit 12-SP2 (aarch64 ppc64le s390x x86_64): freeradius-server-debuginfo-3.0.3-14.1 freeradius-server-debugsource-3.0.3-14.1 freeradius-server-devel-3.0.3-14.1 - SUSE Linux Enterprise Software Development Kit 12-SP1 (ppc64le s390x x86_64): freeradius-server-debuginfo-3.0.3-14.1 freeradius-server-debugsource-3.0.3-14.1 freeradius-server-devel-3.0.3-14.1 - SUSE Linux Enterprise Server for Raspberry Pi 12-SP2 (aarch64): freeradius-server-3.0.3-14.1 freeradius-server-debuginfo-3.0.3-14.1 freeradius-server-debugsource-3.0.3-14.1 freeradius-server-doc-3.0.3-14.1 freeradius-server-krb5-3.0.3-14.1 freeradius-server-krb5-debuginfo-3.0.3-14.1 freeradius-server-ldap-3.0.3-14.1 freeradius-server-ldap-debuginfo-3.0.3-14.1 freeradius-server-libs-3.0.3-14.1 freeradius-server-libs-debuginfo-3.0.3-14.1 freeradius-server-mysql-3.0.3-14.1 freeradius-server-mysql-debuginfo-3.0.3-14.1 freeradius-server-perl-3.0.3-14.1 freeradius-server-perl-debuginfo-3.0.3-14.1 freeradius-server-postgresql-3.0.3-14.1 freeradius-server-postgresql-debuginfo-3.0.3-14.1 freeradius-server-python-3.0.3-14.1 freeradius-server-python-debuginfo-3.0.3-14.1 freeradius-server-sqlite-3.0.3-14.1 freeradius-server-sqlite-debuginfo-3.0.3-14.1 freeradius-server-utils-3.0.3-14.1 freeradius-server-utils-debuginfo-3.0.3-14.1 - SUSE Linux Enterprise Server 12-SP2 (aarch64 ppc64le x86_64): freeradius-server-3.0.3-14.1 freeradius-server-debuginfo-3.0.3-14.1 freeradius-server-debugsource-3.0.3-14.1 freeradius-server-doc-3.0.3-14.1 freeradius-server-krb5-3.0.3-14.1 freeradius-server-krb5-debuginfo-3.0.3-14.1 freeradius-server-ldap-3.0.3-14.1 freeradius-server-ldap-debuginfo-3.0.3-14.1 freeradius-server-libs-3.0.3-14.1 freeradius-server-libs-debuginfo-3.0.3-14.1 freeradius-server-mysql-3.0.3-14.1 freeradius-server-mysql-debuginfo-3.0.3-14.1 freeradius-server-perl-3.0.3-14.1 freeradius-server-perl-debuginfo-3.0.3-14.1 freeradius-server-postgresql-3.0.3-14.1 freeradius-server-postgresql-debuginfo-3.0.3-14.1 freeradius-server-python-3.0.3-14.1 freeradius-server-python-debuginfo-3.0.3-14.1 freeradius-server-sqlite-3.0.3-14.1 freeradius-server-sqlite-debuginfo-3.0.3-14.1 freeradius-server-utils-3.0.3-14.1 freeradius-server-utils-debuginfo-3.0.3-14.1 - SUSE Linux Enterprise Server 12-SP1 (ppc64le s390x x86_64): freeradius-server-3.0.3-14.1 freeradius-server-debuginfo-3.0.3-14.1 freeradius-server-debugsource-3.0.3-14.1 freeradius-server-doc-3.0.3-14.1 freeradius-server-krb5-3.0.3-14.1 freeradius-server-krb5-debuginfo-3.0.3-14.1 freeradius-server-ldap-3.0.3-14.1 freeradius-server-ldap-debuginfo-3.0.3-14.1 freeradius-server-libs-3.0.3-14.1 freeradius-server-libs-debuginfo-3.0.3-14.1 freeradius-server-mysql-3.0.3-14.1 freeradius-server-mysql-debuginfo-3.0.3-14.1 freeradius-server-perl-3.0.3-14.1 freeradius-server-perl-debuginfo-3.0.3-14.1 freeradius-server-postgresql-3.0.3-14.1 freeradius-server-postgresql-debuginfo-3.0.3-14.1 freeradius-server-python-3.0.3-14.1 freeradius-server-python-debuginfo-3.0.3-14.1 freeradius-server-sqlite-3.0.3-14.1 freeradius-server-sqlite-debuginfo-3.0.3-14.1 freeradius-server-utils-3.0.3-14.1 freeradius-server-utils-debuginfo-3.0.3-14.1 References: https://www.suse.com/security/cve/CVE-2015-4680.html https://bugzilla.suse.com/1013311 https://bugzilla.suse.com/911886 https://bugzilla.suse.com/935573 https://bugzilla.suse.com/951404 -- To unsubscribe, e-mail: opensuse-security-announce+unsubscribe(a)opensuse.org For additional commands, e-mail: opensuse-security-announce+help(a)opensuse.org

1 0

[security-announce] openSUSE-SU-2017:0101-1: important: Security update for jasper
by opensuse-security＠opensuse.org 10 Jan '17

10 Jan '17

openSUSE Security Update: Security update for jasper ______________________________________________________________________________ Announcement ID: openSUSE-SU-2017:0101-1 Rating: important References: #1010977 #1010979 #1011830 #1012530 #1015993 Cross-References: CVE-2016-8654 CVE-2016-9395 CVE-2016-9398 CVE-2016-9560 CVE-2016-9591 Affected Products: openSUSE Leap 42.2 openSUSE Leap 42.1 ______________________________________________________________________________ An update that fixes 5 vulnerabilities is now available. Description: This update for jasper fixes the following issues: - CVE-2016-8654: Heap-based buffer overflow in QMFB code in JPC codec. (bsc#1012530) - CVE-2016-9395: Invalid jasper files could lead to abort of the library caused by attacker provided image. (bsc#1010977) - CVE-2016-9398: Invalid jasper files could lead to abort of the library caused by attacker provided image. (bsc#1010979) - CVE-2016-9560: Stack-based buffer overflow in jpc_tsfb_getbands2. (bsc#1011830) - CVE-2016-9591: Use-after-free on heap in jas_matrix_destroy. (bsc#1015993) This update was imported from the SUSE:SLE-12:Update update project. Patch Instructions: To install this openSUSE Security Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE Leap 42.2: zypper in -t patch openSUSE-2017-70=1 - openSUSE Leap 42.1: zypper in -t patch openSUSE-2017-70=1 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE Leap 42.2 (i586 x86_64): jasper-1.900.14-170.1 jasper-debuginfo-1.900.14-170.1 jasper-debugsource-1.900.14-170.1 libjasper-devel-1.900.14-170.1 libjasper1-1.900.14-170.1 libjasper1-debuginfo-1.900.14-170.1 - openSUSE Leap 42.2 (x86_64): libjasper1-32bit-1.900.14-170.1 libjasper1-debuginfo-32bit-1.900.14-170.1 - openSUSE Leap 42.1 (i586 x86_64): jasper-1.900.14-170.1 jasper-debuginfo-1.900.14-170.1 jasper-debugsource-1.900.14-170.1 libjasper-devel-1.900.14-170.1 libjasper1-1.900.14-170.1 libjasper1-debuginfo-1.900.14-170.1 - openSUSE Leap 42.1 (x86_64): libjasper1-32bit-1.900.14-170.1 libjasper1-debuginfo-32bit-1.900.14-170.1 References: https://www.suse.com/security/cve/CVE-2016-8654.html https://www.suse.com/security/cve/CVE-2016-9395.html https://www.suse.com/security/cve/CVE-2016-9398.html https://www.suse.com/security/cve/CVE-2016-9560.html https://www.suse.com/security/cve/CVE-2016-9591.html https://bugzilla.suse.com/1010977 https://bugzilla.suse.com/1010979 https://bugzilla.suse.com/1011830 https://bugzilla.suse.com/1012530 https://bugzilla.suse.com/1015993 -- To unsubscribe, e-mail: opensuse-security-announce+unsubscribe(a)opensuse.org For additional commands, e-mail: opensuse-security-announce+help(a)opensuse.org

1 0

[security-announce] SUSE-SU-2017:0084-1: important: Security update for jasper
by opensuse-security＠opensuse.org 08 Jan '17

08 Jan '17

SUSE Security Update: Security update for jasper ______________________________________________________________________________ Announcement ID: SUSE-SU-2017:0084-1 Rating: important References: #1010977 #1010979 #1011830 #1012530 #1015993 Cross-References: CVE-2016-8654 CVE-2016-9395 CVE-2016-9398 CVE-2016-9560 CVE-2016-9591 Affected Products: SUSE Linux Enterprise Software Development Kit 12-SP2 SUSE Linux Enterprise Software Development Kit 12-SP1 SUSE Linux Enterprise Server for Raspberry Pi 12-SP2 SUSE Linux Enterprise Server 12-SP2 SUSE Linux Enterprise Server 12-SP1 SUSE Linux Enterprise Desktop 12-SP2 SUSE Linux Enterprise Desktop 12-SP1 ______________________________________________________________________________ An update that fixes 5 vulnerabilities is now available. Description: This update for jasper fixes the following issues: - CVE-2016-8654: Heap-based buffer overflow in QMFB code in JPC codec. (bsc#1012530) - CVE-2016-9395: Invalid jasper files could lead to abort of the library caused by attacker provided image. (bsc#1010977) - CVE-2016-9398: Invalid jasper files could lead to abort of the library caused by attacker provided image. (bsc#1010979) - CVE-2016-9560: Stack-based buffer overflow in jpc_tsfb_getbands2. (bsc#1011830) - CVE-2016-9591: Use-after-free on heap in jas_matrix_destroy. (bsc#1015993) Patch Instructions: To install this SUSE Security Update use YaST online_update. Alternatively you can run the command listed for your product: - SUSE Linux Enterprise Software Development Kit 12-SP2: zypper in -t patch SUSE-SLE-SDK-12-SP2-2017-27=1 - SUSE Linux Enterprise Software Development Kit 12-SP1: zypper in -t patch SUSE-SLE-SDK-12-SP1-2017-27=1 - SUSE Linux Enterprise Server for Raspberry Pi 12-SP2: zypper in -t patch SUSE-SLE-RPI-12-SP2-2017-27=1 - SUSE Linux Enterprise Server 12-SP2: zypper in -t patch SUSE-SLE-SERVER-12-SP2-2017-27=1 - SUSE Linux Enterprise Server 12-SP1: zypper in -t patch SUSE-SLE-SERVER-12-SP1-2017-27=1 - SUSE Linux Enterprise Desktop 12-SP2: zypper in -t patch SUSE-SLE-DESKTOP-12-SP2-2017-27=1 - SUSE Linux Enterprise Desktop 12-SP1: zypper in -t patch SUSE-SLE-DESKTOP-12-SP1-2017-27=1 To bring your system up-to-date, use "zypper patch". Package List: - SUSE Linux Enterprise Software Development Kit 12-SP2 (aarch64 ppc64le s390x x86_64): jasper-debuginfo-1.900.14-184.1 jasper-debugsource-1.900.14-184.1 libjasper-devel-1.900.14-184.1 - SUSE Linux Enterprise Software Development Kit 12-SP1 (ppc64le s390x x86_64): jasper-debuginfo-1.900.14-184.1 jasper-debugsource-1.900.14-184.1 libjasper-devel-1.900.14-184.1 - SUSE Linux Enterprise Server for Raspberry Pi 12-SP2 (aarch64): jasper-debuginfo-1.900.14-184.1 jasper-debugsource-1.900.14-184.1 libjasper1-1.900.14-184.1 libjasper1-debuginfo-1.900.14-184.1 - SUSE Linux Enterprise Server 12-SP2 (aarch64 ppc64le x86_64): jasper-debuginfo-1.900.14-184.1 jasper-debugsource-1.900.14-184.1 libjasper1-1.900.14-184.1 libjasper1-debuginfo-1.900.14-184.1 - SUSE Linux Enterprise Server 12-SP2 (x86_64): libjasper1-32bit-1.900.14-184.1 libjasper1-debuginfo-32bit-1.900.14-184.1 - SUSE Linux Enterprise Server 12-SP1 (ppc64le s390x x86_64): jasper-debuginfo-1.900.14-184.1 jasper-debugsource-1.900.14-184.1 libjasper1-1.900.14-184.1 libjasper1-debuginfo-1.900.14-184.1 - SUSE Linux Enterprise Server 12-SP1 (s390x x86_64): libjasper1-32bit-1.900.14-184.1 libjasper1-debuginfo-32bit-1.900.14-184.1 - SUSE Linux Enterprise Desktop 12-SP2 (x86_64): jasper-debuginfo-1.900.14-184.1 jasper-debugsource-1.900.14-184.1 libjasper1-1.900.14-184.1 libjasper1-32bit-1.900.14-184.1 libjasper1-debuginfo-1.900.14-184.1 libjasper1-debuginfo-32bit-1.900.14-184.1 - SUSE Linux Enterprise Desktop 12-SP1 (x86_64): jasper-debuginfo-1.900.14-184.1 jasper-debugsource-1.900.14-184.1 libjasper1-1.900.14-184.1 libjasper1-32bit-1.900.14-184.1 libjasper1-debuginfo-1.900.14-184.1 libjasper1-debuginfo-32bit-1.900.14-184.1 References: https://www.suse.com/security/cve/CVE-2016-8654.html https://www.suse.com/security/cve/CVE-2016-9395.html https://www.suse.com/security/cve/CVE-2016-9398.html https://www.suse.com/security/cve/CVE-2016-9560.html https://www.suse.com/security/cve/CVE-2016-9591.html https://bugzilla.suse.com/1010977 https://bugzilla.suse.com/1010979 https://bugzilla.suse.com/1011830 https://bugzilla.suse.com/1012530 https://bugzilla.suse.com/1015993 -- To unsubscribe, e-mail: opensuse-security-announce+unsubscribe(a)opensuse.org For additional commands, e-mail: opensuse-security-announce+help(a)opensuse.org

1 0

[security-announce] openSUSE-SU-2017:0071-1: important: Security update for gstreamer-plugins-good
by opensuse-security＠opensuse.org 08 Jan '17

08 Jan '17

openSUSE Security Update: Security update for gstreamer-plugins-good ______________________________________________________________________________ Announcement ID: openSUSE-SU-2017:0071-1 Rating: important References: #1012102 #1012103 #1012104 #1013653 #1013655 #1013663 Cross-References: CVE-2016-9634 CVE-2016-9635 CVE-2016-9636 CVE-2016-9807 CVE-2016-9808 CVE-2016-9810 Affected Products: openSUSE Leap 42.2 ______________________________________________________________________________ An update that fixes 6 vulnerabilities is now available. Description: This update for gstreamer-plugins-good fixes the following security issues: - CVE-2016-9807: Flic decoder invalid read could lead to crash. (bsc#1013655) - CVE-2016-9634: Flic out-of-bounds write could lead to code execution. (bsc#1012102) - CVE-2016-9635: Flic out-of-bounds write could lead to code execution. (bsc#1012103) - CVE-2016-9635: Flic out-of-bounds write could lead to code execution. (bsc#1012104) - CVE-2016-9808: A maliciously crafted flic file can still cause invalid memory accesses. (bsc#1013653) - CVE-2016-9810: A maliciously crafted flic file can still cause invalid memory accesses. (bsc#1013663) This update was imported from the SUSE:SLE-12-SP2:Update update project. Patch Instructions: To install this openSUSE Security Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE Leap 42.2: zypper in -t patch openSUSE-2017-65=1 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE Leap 42.2 (i586 x86_64): gstreamer-plugins-good-1.8.3-3.1 gstreamer-plugins-good-debuginfo-1.8.3-3.1 gstreamer-plugins-good-debugsource-1.8.3-3.1 gstreamer-plugins-good-doc-1.8.3-3.1 gstreamer-plugins-good-extra-1.8.3-3.1 gstreamer-plugins-good-extra-debuginfo-1.8.3-3.1 - openSUSE Leap 42.2 (x86_64): gstreamer-plugins-good-32bit-1.8.3-3.1 gstreamer-plugins-good-debuginfo-32bit-1.8.3-3.1 gstreamer-plugins-good-extra-32bit-1.8.3-3.1 gstreamer-plugins-good-extra-debuginfo-32bit-1.8.3-3.1 - openSUSE Leap 42.2 (noarch): gstreamer-plugins-good-lang-1.8.3-3.1 References: https://www.suse.com/security/cve/CVE-2016-9634.html https://www.suse.com/security/cve/CVE-2016-9635.html https://www.suse.com/security/cve/CVE-2016-9636.html https://www.suse.com/security/cve/CVE-2016-9807.html https://www.suse.com/security/cve/CVE-2016-9808.html https://www.suse.com/security/cve/CVE-2016-9810.html https://bugzilla.suse.com/1012102 https://bugzilla.suse.com/1012103 https://bugzilla.suse.com/1012104 https://bugzilla.suse.com/1013653 https://bugzilla.suse.com/1013655 https://bugzilla.suse.com/1013663 -- To unsubscribe, e-mail: opensuse-security-announce+unsubscribe(a)opensuse.org For additional commands, e-mail: opensuse-security-announce+help(a)opensuse.org

1 0

[security-announce] openSUSE-SU-2017:0023-1: important: Security update for ImageMagick
by opensuse-security＠opensuse.org 04 Jan '17

04 Jan '17

openSUSE Security Update: Security update for ImageMagick ______________________________________________________________________________ Announcement ID: openSUSE-SU-2017:0023-1 Rating: important References: #1009318 #1011130 #1011136 #1013376 #1014159 Cross-References: CVE-2014-9848 CVE-2016-8707 CVE-2016-8866 CVE-2016-9556 CVE-2016-9559 CVE-2016-9773 Affected Products: openSUSE Leap 42.2 openSUSE Leap 42.1 ______________________________________________________________________________ An update that fixes 6 vulnerabilities is now available. Description: This update for ImageMagick fixes the following issues: * CVE-2016-9556 Possible Heap-overflow found by fuzzing [bsc#1011130] * CVE-2016-9559 Possible Null pointer access found by fuzzing [bsc#1011136] * CVE-2016-8707 Possible code execution in Tiff conver utility [bsc#1014159] * CVE-2016-8866 Memory allocation failure in AcquireMagickMemory could lead to Heap overflow [bsc#1009318] * CVE-2016-9559 Possible Null pointer access found by fuzzing [bsc#1011136] This update was imported from the SUSE:SLE-12:Update update project. Patch Instructions: To install this openSUSE Security Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE Leap 42.2: zypper in -t patch openSUSE-2017-14=1 - openSUSE Leap 42.1: zypper in -t patch openSUSE-2017-14=1 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE Leap 42.2 (i586 x86_64): ImageMagick-6.8.8.1-25.1 ImageMagick-debuginfo-6.8.8.1-25.1 ImageMagick-debugsource-6.8.8.1-25.1 ImageMagick-devel-6.8.8.1-25.1 ImageMagick-extra-6.8.8.1-25.1 ImageMagick-extra-debuginfo-6.8.8.1-25.1 libMagick++-6_Q16-3-6.8.8.1-25.1 libMagick++-6_Q16-3-debuginfo-6.8.8.1-25.1 libMagick++-devel-6.8.8.1-25.1 libMagickCore-6_Q16-1-6.8.8.1-25.1 libMagickCore-6_Q16-1-debuginfo-6.8.8.1-25.1 libMagickWand-6_Q16-1-6.8.8.1-25.1 libMagickWand-6_Q16-1-debuginfo-6.8.8.1-25.1 perl-PerlMagick-6.8.8.1-25.1 perl-PerlMagick-debuginfo-6.8.8.1-25.1 - openSUSE Leap 42.2 (x86_64): ImageMagick-devel-32bit-6.8.8.1-25.1 libMagick++-6_Q16-3-32bit-6.8.8.1-25.1 libMagick++-6_Q16-3-debuginfo-32bit-6.8.8.1-25.1 libMagick++-devel-32bit-6.8.8.1-25.1 libMagickCore-6_Q16-1-32bit-6.8.8.1-25.1 libMagickCore-6_Q16-1-debuginfo-32bit-6.8.8.1-25.1 libMagickWand-6_Q16-1-32bit-6.8.8.1-25.1 libMagickWand-6_Q16-1-debuginfo-32bit-6.8.8.1-25.1 - openSUSE Leap 42.2 (noarch): ImageMagick-doc-6.8.8.1-25.1 - openSUSE Leap 42.1 (i586 x86_64): ImageMagick-6.8.8.1-27.1 ImageMagick-debuginfo-6.8.8.1-27.1 ImageMagick-debugsource-6.8.8.1-27.1 ImageMagick-devel-6.8.8.1-27.1 ImageMagick-extra-6.8.8.1-27.1 ImageMagick-extra-debuginfo-6.8.8.1-27.1 libMagick++-6_Q16-3-6.8.8.1-27.1 libMagick++-6_Q16-3-debuginfo-6.8.8.1-27.1 libMagick++-devel-6.8.8.1-27.1 libMagickCore-6_Q16-1-6.8.8.1-27.1 libMagickCore-6_Q16-1-debuginfo-6.8.8.1-27.1 libMagickWand-6_Q16-1-6.8.8.1-27.1 libMagickWand-6_Q16-1-debuginfo-6.8.8.1-27.1 perl-PerlMagick-6.8.8.1-27.1 perl-PerlMagick-debuginfo-6.8.8.1-27.1 - openSUSE Leap 42.1 (x86_64): ImageMagick-devel-32bit-6.8.8.1-27.1 libMagick++-6_Q16-3-32bit-6.8.8.1-27.1 libMagick++-6_Q16-3-debuginfo-32bit-6.8.8.1-27.1 libMagick++-devel-32bit-6.8.8.1-27.1 libMagickCore-6_Q16-1-32bit-6.8.8.1-27.1 libMagickCore-6_Q16-1-debuginfo-32bit-6.8.8.1-27.1 libMagickWand-6_Q16-1-32bit-6.8.8.1-27.1 libMagickWand-6_Q16-1-debuginfo-32bit-6.8.8.1-27.1 - openSUSE Leap 42.1 (noarch): ImageMagick-doc-6.8.8.1-27.1 References: https://www.suse.com/security/cve/CVE-2014-9848.html https://www.suse.com/security/cve/CVE-2016-8707.html https://www.suse.com/security/cve/CVE-2016-8866.html https://www.suse.com/security/cve/CVE-2016-9556.html https://www.suse.com/security/cve/CVE-2016-9559.html https://www.suse.com/security/cve/CVE-2016-9773.html https://bugzilla.suse.com/1009318 https://bugzilla.suse.com/1011130 https://bugzilla.suse.com/1011136 https://bugzilla.suse.com/1013376 https://bugzilla.suse.com/1014159 -- To unsubscribe, e-mail: opensuse-security-announce+unsubscribe(a)opensuse.org For additional commands, e-mail: opensuse-security-announce+help(a)opensuse.org

1 0

[security-announce] openSUSE-SU-2017:0022-1: important: Security update for libgme
by opensuse-security＠opensuse.org 04 Jan '17

04 Jan '17

openSUSE Security Update: Security update for libgme ______________________________________________________________________________ Announcement ID: openSUSE-SU-2017:0022-1 Rating: important References: #1015941 Cross-References: CVE-2016-9957 CVE-2016-9958 CVE-2016-9959 CVE-2016-9960 CVE-2016-9961 Affected Products: openSUSE Leap 42.2 openSUSE Leap 42.1 ______________________________________________________________________________ An update that fixes 5 vulnerabilities is now available. Description: This update for libgme fixes the following issues: - CVE-2016-9957, CVE-2016-9958, CVE-2016-9959, CVE-2016-9960, CVE-2016-9961: Various issues were fixed in the handling of SPC music files that could have been exploited for gaining privileges of desktop users. [bsc#1015941] This update was imported from the SUSE:SLE-12:Update update project. Patch Instructions: To install this openSUSE Security Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE Leap 42.2: zypper in -t patch openSUSE-2017-13=1 - openSUSE Leap 42.1: zypper in -t patch openSUSE-2017-13=1 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE Leap 42.2 (i586 x86_64): libgme-debugsource-0.6.0-8.1 libgme-devel-0.6.0-8.1 libgme0-0.6.0-8.1 libgme0-debuginfo-0.6.0-8.1 - openSUSE Leap 42.2 (x86_64): libgme0-32bit-0.6.0-8.1 libgme0-debuginfo-32bit-0.6.0-8.1 - openSUSE Leap 42.1 (i586 x86_64): libgme-debugsource-0.6.0-7.1 libgme-devel-0.6.0-7.1 libgme0-0.6.0-7.1 libgme0-debuginfo-0.6.0-7.1 - openSUSE Leap 42.1 (x86_64): libgme0-32bit-0.6.0-7.1 libgme0-debuginfo-32bit-0.6.0-7.1 References: https://www.suse.com/security/cve/CVE-2016-9957.html https://www.suse.com/security/cve/CVE-2016-9958.html https://www.suse.com/security/cve/CVE-2016-9959.html https://www.suse.com/security/cve/CVE-2016-9960.html https://www.suse.com/security/cve/CVE-2016-9961.html https://bugzilla.suse.com/1015941 -- To unsubscribe, e-mail: opensuse-security-announce+unsubscribe(a)opensuse.org For additional commands, e-mail: opensuse-security-announce+help(a)opensuse.org

1 0

[security-announce] openSUSE-SU-2017:0016-1: important: Security update for dnsmasq
by opensuse-security＠opensuse.org 03 Jan '17

03 Jan '17

openSUSE Security Update: Security update for dnsmasq ______________________________________________________________________________ Announcement ID: openSUSE-SU-2017:0016-1 Rating: important References: #983273 Cross-References: CVE-2015-8899 Affected Products: openSUSE Leap 42.2 openSUSE Leap 42.1 ______________________________________________________________________________ An update that fixes one vulnerability is now available. Description: This update for dnsmasq fixes the following issues: - CVE-2015-8899: Denial of service between local and remote dns entries (bsc#983273) This update was imported from the SUSE:SLE-12-SP1:Update update project. Patch Instructions: To install this openSUSE Security Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE Leap 42.2: zypper in -t patch openSUSE-2017-10=1 - openSUSE Leap 42.1: zypper in -t patch openSUSE-2017-10=1 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE Leap 42.2 (i586 x86_64): dnsmasq-2.71-8.1 dnsmasq-debuginfo-2.71-8.1 dnsmasq-debugsource-2.71-8.1 dnsmasq-utils-2.71-8.1 dnsmasq-utils-debuginfo-2.71-8.1 - openSUSE Leap 42.1 (i586 x86_64): dnsmasq-2.71-9.1 dnsmasq-debuginfo-2.71-9.1 dnsmasq-debugsource-2.71-9.1 dnsmasq-utils-2.71-9.1 dnsmasq-utils-debuginfo-2.71-9.1 References: https://www.suse.com/security/cve/CVE-2015-8899.html https://bugzilla.suse.com/983273 -- To unsubscribe, e-mail: opensuse-security-announce+unsubscribe(a)opensuse.org For additional commands, e-mail: opensuse-security-announce+help(a)opensuse.org

1 0

[security-announce] openSUSE-SU-2017:0008-1: important: Security update for xen
by opensuse-security＠opensuse.org 02 Jan '17

02 Jan '17

openSUSE Security Update: Security update for xen ______________________________________________________________________________ Announcement ID: openSUSE-SU-2017:0008-1 Rating: important References: #1000106 #1000195 #1002496 #1003030 #1003032 #1004016 #1005004 #1005005 #1007157 #1007160 #1009100 #1009103 #1009104 #1009107 #1009109 #1009111 #1011652 #1012651 #1014298 #1016340 #953518 Cross-References: CVE-2016-10013 CVE-2016-10024 CVE-2016-7777 CVE-2016-7908 CVE-2016-7909 CVE-2016-8576 CVE-2016-8667 CVE-2016-8669 CVE-2016-8909 CVE-2016-8910 CVE-2016-9379 CVE-2016-9380 CVE-2016-9381 CVE-2016-9382 CVE-2016-9383 CVE-2016-9385 CVE-2016-9386 CVE-2016-9637 CVE-2016-9932 Affected Products: openSUSE 13.2 ______________________________________________________________________________ An update that solves 19 vulnerabilities and has two fixes is now available. Description: This updates xen to version 4.4.4_06 to fix the following issues: - An unprivileged user in a guest could gain guest could escalate privilege to that of the guest kernel, if it had could invoke the instruction emulator. Only 64-bit x86 HVM guest were affected. Linux guest have not been vulnerable. (boo#1016340, CVE-2016-10013) - An unprivileged user in a 64 bit x86 guest could gain information from the host, crash the host or gain privilege of the host (boo#1009107, CVE-2016-9383) - An unprivileged guest process could (unintentionally or maliciously) obtain or ocorrupt sensitive information of other programs in the same guest. Only x86 HVM guests have been affected. The attacker needs to be able to trigger the Xen instruction emulator. (boo#1000106, CVE-2016-7777) - A guest on x86 systems could read small parts of hypervisor stack data (boo#1012651, CVE-2016-9932) - A malicious guest kernel could hang or crash the host system (boo#1014298, CVE-2016-10024) - A malicious guest administrator could escalate their privilege to that of the host. Only affects x86 HVM guests using qemu older version 1.6.0 or using the qemu-xen-traditional. (boo#1011652, CVE-2016-9637) - An unprivileged guest user could escalate privilege to that of the guest administrator on x86 HVM guests, especially on Intel CPUs (boo#1009100, CVE-2016-9386) - An unprivileged guest user could escalate privilege to that of the guest administrator (on AMD CPUs) or crash the system (on Intel CPUs) on 32-bit x86 HVM guests. Only guest operating systems that allowed a new task to start in VM86 mode were affected. (boo#1009103, CVE-2016-9382) - A malicious guest administrator could crash the host on x86 PV guests only (boo#1009104, CVE-2016-9385) - A malicious guest administrator could get privilege of the host emulator process on x86 HVM guests. (boo#1009109, CVE-2016-9381) - A vulnerability in pygrub allowed a malicious guest administrator to obtain the contents of sensitive host files, or even delete those files (boo#1009111, CVE-2016-9379, CVE-2016-9380) - A privileged guest user could cause an infinite loop in the RTL8139 ethernet emulation to consume CPU cycles on the host, causing a DoS situation (boo#1007157, CVE-2016-8910) - A privileged guest user could cause an infinite loop in the intel-hda sound emulation to consume CPU cycles on the host, causing a DoS situation (boo#1007160, CVE-2016-8909) - A privileged guest user could cause a crash of the emulator process on the host by exploiting a divide by zero vulnerability of the JAZZ RC4030 chipset emulation (boo#1005004 CVE-2016-8667) - A privileged guest user could cause a crash of the emulator process on the host by exploiting a divide by zero issue of the 16550A UART emulation (boo#1005005, CVE-2016-8669) - A privileged guest user could cause an infinite loop in the USB xHCI emulation, causing a DoS situation on the host (boo#1004016, CVE-2016-8576) - A privileged guest user could cause an infinite loop in the ColdFire Fash Ethernet Controller emulation, causing a DoS situation on the host (boo#1003030, CVE-2016-7908) - A privileged guest user could cause an infinite loop in the AMD PC-Net II emulation, causing a DoS situation on the host (boo#1003032, CVE-2016-7909) - Cause a reload of clvm in the block-dmmd script to avoid a blocking lvchange call (boo#1002496) - Also unplug SCSI disks in qemu-xen-traditional for upstream unplug protocol. Before a single SCSI storage devices added to HVM guests could appear multiple times in the guest. (boo#953518) - Fix a kernel panic / black screen when trying to boot a XEN kernel on some UEFI firmwares (boo#1000195) Patch Instructions: To install this openSUSE Security Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE 13.2: zypper in -t patch openSUSE-2017-5=1 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE 13.2 (i586 x86_64): xen-debugsource-4.4.4_06-58.1 xen-devel-4.4.4_06-58.1 xen-libs-4.4.4_06-58.1 xen-libs-debuginfo-4.4.4_06-58.1 xen-tools-domU-4.4.4_06-58.1 xen-tools-domU-debuginfo-4.4.4_06-58.1 - openSUSE 13.2 (x86_64): xen-4.4.4_06-58.1 xen-doc-html-4.4.4_06-58.1 xen-kmp-default-4.4.4_06_k3.16.7_53-58.1 xen-kmp-default-debuginfo-4.4.4_06_k3.16.7_53-58.1 xen-kmp-desktop-4.4.4_06_k3.16.7_53-58.1 xen-kmp-desktop-debuginfo-4.4.4_06_k3.16.7_53-58.1 xen-libs-32bit-4.4.4_06-58.1 xen-libs-debuginfo-32bit-4.4.4_06-58.1 xen-tools-4.4.4_06-58.1 xen-tools-debuginfo-4.4.4_06-58.1 References: https://www.suse.com/security/cve/CVE-2016-10013.html https://www.suse.com/security/cve/CVE-2016-10024.html https://www.suse.com/security/cve/CVE-2016-7777.html https://www.suse.com/security/cve/CVE-2016-7908.html https://www.suse.com/security/cve/CVE-2016-7909.html https://www.suse.com/security/cve/CVE-2016-8576.html https://www.suse.com/security/cve/CVE-2016-8667.html https://www.suse.com/security/cve/CVE-2016-8669.html https://www.suse.com/security/cve/CVE-2016-8909.html https://www.suse.com/security/cve/CVE-2016-8910.html https://www.suse.com/security/cve/CVE-2016-9379.html https://www.suse.com/security/cve/CVE-2016-9380.html https://www.suse.com/security/cve/CVE-2016-9381.html https://www.suse.com/security/cve/CVE-2016-9382.html https://www.suse.com/security/cve/CVE-2016-9383.html https://www.suse.com/security/cve/CVE-2016-9385.html https://www.suse.com/security/cve/CVE-2016-9386.html https://www.suse.com/security/cve/CVE-2016-9637.html https://www.suse.com/security/cve/CVE-2016-9932.html https://bugzilla.suse.com/1000106 https://bugzilla.suse.com/1000195 https://bugzilla.suse.com/1002496 https://bugzilla.suse.com/1003030 https://bugzilla.suse.com/1003032 https://bugzilla.suse.com/1004016 https://bugzilla.suse.com/1005004 https://bugzilla.suse.com/1005005 https://bugzilla.suse.com/1007157 https://bugzilla.suse.com/1007160 https://bugzilla.suse.com/1009100 https://bugzilla.suse.com/1009103 https://bugzilla.suse.com/1009104 https://bugzilla.suse.com/1009107 https://bugzilla.suse.com/1009109 https://bugzilla.suse.com/1009111 https://bugzilla.suse.com/1011652 https://bugzilla.suse.com/1012651 https://bugzilla.suse.com/1014298 https://bugzilla.suse.com/1016340 https://bugzilla.suse.com/953518 -- To unsubscribe, e-mail: opensuse-security-announce+unsubscribe(a)opensuse.org For additional commands, e-mail: opensuse-security-announce+help(a)opensuse.org

1 0

[security-announce] openSUSE-SU-2017:0007-1: important: Security update for xen
by opensuse-security＠opensuse.org 02 Jan '17

02 Jan '17

openSUSE Security Update: Security update for xen ______________________________________________________________________________ Announcement ID: openSUSE-SU-2017:0007-1 Rating: important References: #1000106 #1002496 #1003030 #1003032 #1003870 #1004016 #1005004 #1005005 #1007157 #1007160 #1009100 #1009103 #1009104 #1009107 #1009108 #1009109 #1009111 #1011652 #1012651 #1013657 #1013668 #1014298 #1016340 Cross-References: CVE-2016-10013 CVE-2016-10024 CVE-2016-7777 CVE-2016-7908 CVE-2016-7909 CVE-2016-7995 CVE-2016-8576 CVE-2016-8667 CVE-2016-8669 CVE-2016-8909 CVE-2016-8910 CVE-2016-9101 CVE-2016-9377 CVE-2016-9378 CVE-2016-9379 CVE-2016-9380 CVE-2016-9381 CVE-2016-9382 CVE-2016-9383 CVE-2016-9385 CVE-2016-9386 CVE-2016-9637 CVE-2016-9776 CVE-2016-9932 Affected Products: openSUSE Leap 42.1 ______________________________________________________________________________ An update that fixes 24 vulnerabilities is now available. Description: This updates xen to version 4.5.5 to fix the following issues: - An unprivileged user in a guest could gain guest could escalate privilege to that of the guest kernel, if it had could invoke the instruction emulator. Only 64-bit x86 HVM guest were affected. Linux guest have not been vulnerable. (boo#1016340, CVE-2016-10013) - An unprivileged user in a 64 bit x86 guest could gain information from the host, crash the host or gain privilege of the host (boo#1009107, CVE-2016-9383) - An unprivileged guest process could (unintentionally or maliciously) obtain or ocorrupt sensitive information of other programs in the same guest. Only x86 HVM guests have been affected. The attacker needs to be able to trigger the Xen instruction emulator. (boo#1000106, CVE-2016-7777) - A guest on x86 systems could read small parts of hypervisor stack data (boo#1012651, CVE-2016-9932) - A malicious guest kernel could hang or crash the host system (boo#1014298, CVE-2016-10024) - The epro100 emulated network device caused a memory leak in the host when unplugged in the guest. A privileged user in the guest could use this to cause a DoS on the host or potentially crash the guest process on the host (boo#1013668, CVE-2016-9101) - The ColdFire Fast Ethernet Controller was vulnerable to an infinite loop that could be trigged by a privileged user in the guest, leading to DoS (boo#1013657, CVE-2016-9776) - A malicious guest administrator could escalate their privilege to that of the host. Only affects x86 HVM guests using qemu older version 1.6.0 or using the qemu-xen-traditional. (boo#1011652, CVE-2016-9637) - An unprivileged guest user could escalate privilege to that of the guest administrator on x86 HVM guests, especially on Intel CPUs (boo#1009100, CVE-2016-9386) - An unprivileged guest user could escalate privilege to that of the guest administrator (on AMD CPUs) or crash the system (on Intel CPUs) on 32-bit x86 HVM guests. Only guest operating systems that allowed a new task to start in VM86 mode were affected. (boo#1009103, CVE-2016-9382) - A malicious guest administrator could crash the host on x86 PV guests only (boo#1009104, CVE-2016-9385) - An unprivileged guest user was able to crash the guest. (boo#1009108, CVE-2016-9377, CVE-2016-9378) - A malicious guest administrator could get privilege of the host emulator process on x86 HVM guests. (boo#1009109, CVE-2016-9381) - A vulnerability in pygrub allowed a malicious guest administrator to obtain the contents of sensitive host files, or even delete those files (boo#1009111, CVE-2016-9379, CVE-2016-9380) - A privileged guest user could cause an infinite loop in the RTL8139 ethernet emulation to consume CPU cycles on the host, causing a DoS situation (boo#1007157, CVE-2016-8910) - A privileged guest user could cause an infinite loop in the intel-hda sound emulation to consume CPU cycles on the host, causing a DoS situation (boo#1007160, CVE-2016-8909) - A privileged guest user could cause a crash of the emulator process on the host by exploiting a divide by zero vulnerability of the JAZZ RC4030 chipset emulation (boo#1005004 CVE-2016-8667) - A privileged guest user could cause a crash of the emulator process on the host by exploiting a divide by zero issue of the 16550A UART emulation (boo#1005005, CVE-2016-8669) - A privileged guest user could cause a memory leak in the USB EHCI emulation, causing a DoS situation on the host (boo#1003870, CVE-2016-7995) - A privileged guest user could cause an infinite loop in the USB xHCI emulation, causing a DoS situation on the host (boo#1004016, CVE-2016-8576) - A privileged guest user could cause an infinite loop in the ColdFire Fash Ethernet Controller emulation, causing a DoS situation on the host (boo#1003030, CVE-2016-7908) - A privileged guest user could cause an infinite loop in the AMD PC-Net II emulation, causing a DoS situation on the host (boo#1003032, CVE-2016-7909) - Cause a reload of clvm in the block-dmmd script to avoid a blocking lvchange call (boo#1002496) Patch Instructions: To install this openSUSE Security Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE Leap 42.1: zypper in -t patch openSUSE-2017-4=1 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE Leap 42.1 (i586 x86_64): xen-debugsource-4.5.5_06-18.1 xen-devel-4.5.5_06-18.1 xen-libs-4.5.5_06-18.1 xen-libs-debuginfo-4.5.5_06-18.1 xen-tools-domU-4.5.5_06-18.1 xen-tools-domU-debuginfo-4.5.5_06-18.1 - openSUSE Leap 42.1 (x86_64): xen-4.5.5_06-18.1 xen-doc-html-4.5.5_06-18.1 xen-kmp-default-4.5.5_06_k4.1.36_41-18.1 xen-kmp-default-debuginfo-4.5.5_06_k4.1.36_41-18.1 xen-libs-32bit-4.5.5_06-18.1 xen-libs-debuginfo-32bit-4.5.5_06-18.1 xen-tools-4.5.5_06-18.1 xen-tools-debuginfo-4.5.5_06-18.1 References: https://www.suse.com/security/cve/CVE-2016-10013.html https://www.suse.com/security/cve/CVE-2016-10024.html https://www.suse.com/security/cve/CVE-2016-7777.html https://www.suse.com/security/cve/CVE-2016-7908.html https://www.suse.com/security/cve/CVE-2016-7909.html https://www.suse.com/security/cve/CVE-2016-7995.html https://www.suse.com/security/cve/CVE-2016-8576.html https://www.suse.com/security/cve/CVE-2016-8667.html https://www.suse.com/security/cve/CVE-2016-8669.html https://www.suse.com/security/cve/CVE-2016-8909.html https://www.suse.com/security/cve/CVE-2016-8910.html https://www.suse.com/security/cve/CVE-2016-9101.html https://www.suse.com/security/cve/CVE-2016-9377.html https://www.suse.com/security/cve/CVE-2016-9378.html https://www.suse.com/security/cve/CVE-2016-9379.html https://www.suse.com/security/cve/CVE-2016-9380.html https://www.suse.com/security/cve/CVE-2016-9381.html https://www.suse.com/security/cve/CVE-2016-9382.html https://www.suse.com/security/cve/CVE-2016-9383.html https://www.suse.com/security/cve/CVE-2016-9385.html https://www.suse.com/security/cve/CVE-2016-9386.html https://www.suse.com/security/cve/CVE-2016-9637.html https://www.suse.com/security/cve/CVE-2016-9776.html https://www.suse.com/security/cve/CVE-2016-9932.html https://bugzilla.suse.com/1000106 https://bugzilla.suse.com/1002496 https://bugzilla.suse.com/1003030 https://bugzilla.suse.com/1003032 https://bugzilla.suse.com/1003870 https://bugzilla.suse.com/1004016 https://bugzilla.suse.com/1005004 https://bugzilla.suse.com/1005005 https://bugzilla.suse.com/1007157 https://bugzilla.suse.com/1007160 https://bugzilla.suse.com/1009100 https://bugzilla.suse.com/1009103 https://bugzilla.suse.com/1009104 https://bugzilla.suse.com/1009107 https://bugzilla.suse.com/1009108 https://bugzilla.suse.com/1009109 https://bugzilla.suse.com/1009111 https://bugzilla.suse.com/1011652 https://bugzilla.suse.com/1012651 https://bugzilla.suse.com/1013657 https://bugzilla.suse.com/1013668 https://bugzilla.suse.com/1014298 https://bugzilla.suse.com/1016340 -- To unsubscribe, e-mail: opensuse-security-announce+unsubscribe(a)opensuse.org For additional commands, e-mail: opensuse-security-announce+help(a)opensuse.org

1 0

[security-announce] openSUSE-SU-2017:0005-1: important: Security update for xen
by opensuse-security＠opensuse.org 02 Jan '17

02 Jan '17

openSUSE Security Update: Security update for xen ______________________________________________________________________________ Announcement ID: openSUSE-SU-2017:0005-1 Rating: important References: #1012651 #1014298 #1014300 #1016340 Cross-References: CVE-2016-10013 CVE-2016-10024 CVE-2016-10025 CVE-2016-9932 Affected Products: openSUSE Leap 42.2 ______________________________________________________________________________ An update that fixes four vulnerabilities is now available. Description: This update for xen fixes the following issues: - A Mishandling of SYSCALL singlestep during emulation which could have lead to privilege escalation. (XSA-204, bsc#1016340, CVE-2016-10013) - CMPXCHG8B emulation failed to ignore operand size override which could have lead to information disclosure. (XSA-200, bsc#1012651, CVE-2016-9932) - PV guests may have been able to mask interrupts causing a Denial of Service. (XSA-202, bsc#1014298, CVE-2016-10024) - A missing NULL pointer check in VMFUNC emulation could lead to a hypervisor crash leading to a Denial of Servce. (XSA-203, bsc#1014300, CVE-2016-10025) This update was imported from the SUSE:SLE-12-SP2:Update update project. Patch Instructions: To install this openSUSE Security Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE Leap 42.2: zypper in -t patch openSUSE-2017-2=1 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE Leap 42.2 (i586 x86_64): xen-debugsource-4.7.1_04-6.1 xen-devel-4.7.1_04-6.1 xen-libs-4.7.1_04-6.1 xen-libs-debuginfo-4.7.1_04-6.1 xen-tools-domU-4.7.1_04-6.1 xen-tools-domU-debuginfo-4.7.1_04-6.1 - openSUSE Leap 42.2 (x86_64): xen-4.7.1_04-6.1 xen-doc-html-4.7.1_04-6.1 xen-libs-32bit-4.7.1_04-6.1 xen-libs-debuginfo-32bit-4.7.1_04-6.1 xen-tools-4.7.1_04-6.1 xen-tools-debuginfo-4.7.1_04-6.1 References: https://www.suse.com/security/cve/CVE-2016-10013.html https://www.suse.com/security/cve/CVE-2016-10024.html https://www.suse.com/security/cve/CVE-2016-10025.html https://www.suse.com/security/cve/CVE-2016-9932.html https://bugzilla.suse.com/1012651 https://bugzilla.suse.com/1014298 https://bugzilla.suse.com/1014300 https://bugzilla.suse.com/1016340 -- To unsubscribe, e-mail: opensuse-security-announce+unsubscribe(a)opensuse.org For additional commands, e-mail: opensuse-security-announce+help(a)opensuse.org

1 0

[security-announce] openSUSE-SU-2017:0002-1: important: Security update for the Linux Kernel
by opensuse-security＠opensuse.org 02 Jan '17

02 Jan '17

openSUSE Security Update: Security update for the Linux Kernel ______________________________________________________________________________ Announcement ID: openSUSE-SU-2017:0002-1 Rating: important References: #1013038 #1014943 Cross-References: CVE-2016-9756 Affected Products: openSUSE Leap 42.1 ______________________________________________________________________________ An update that solves one vulnerability and has one errata is now available. Description: The openSUSE 42.1 kernel was updated to receive various security and bugfixes. The following security bugs were fixed: - CVE-2016-9756: KVM: x86: drop error recovery in em_jmp_far and em_ret_far (bsc#1013038). The following non-security bugs were fixed: - scsi: megaraid_sas: fix macro MEGASAS_IS_LOGICAL to avoid regression (bsc#1014943). Patch Instructions: To install this openSUSE Security Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE Leap 42.1: zypper in -t patch openSUSE-2017-1=1 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE Leap 42.1 (i586 x86_64): kernel-default-4.1.36-44.1 kernel-default-base-4.1.36-44.1 kernel-default-base-debuginfo-4.1.36-44.1 kernel-default-debuginfo-4.1.36-44.1 kernel-default-debugsource-4.1.36-44.1 kernel-default-devel-4.1.36-44.1 kernel-obs-build-4.1.36-44.3 kernel-obs-build-debugsource-4.1.36-44.3 kernel-obs-qa-4.1.36-44.1 kernel-syms-4.1.36-44.1 - openSUSE Leap 42.1 (i686 x86_64): kernel-debug-4.1.36-44.1 kernel-debug-base-4.1.36-44.1 kernel-debug-base-debuginfo-4.1.36-44.1 kernel-debug-debuginfo-4.1.36-44.1 kernel-debug-debugsource-4.1.36-44.1 kernel-debug-devel-4.1.36-44.1 kernel-debug-devel-debuginfo-4.1.36-44.1 kernel-ec2-4.1.36-44.1 kernel-ec2-base-4.1.36-44.1 kernel-ec2-base-debuginfo-4.1.36-44.1 kernel-ec2-debuginfo-4.1.36-44.1 kernel-ec2-debugsource-4.1.36-44.1 kernel-ec2-devel-4.1.36-44.1 kernel-pv-4.1.36-44.1 kernel-pv-base-4.1.36-44.1 kernel-pv-base-debuginfo-4.1.36-44.1 kernel-pv-debuginfo-4.1.36-44.1 kernel-pv-debugsource-4.1.36-44.1 kernel-pv-devel-4.1.36-44.1 kernel-vanilla-4.1.36-44.1 kernel-vanilla-debuginfo-4.1.36-44.1 kernel-vanilla-debugsource-4.1.36-44.1 kernel-vanilla-devel-4.1.36-44.1 kernel-xen-4.1.36-44.1 kernel-xen-base-4.1.36-44.1 kernel-xen-base-debuginfo-4.1.36-44.1 kernel-xen-debuginfo-4.1.36-44.1 kernel-xen-debugsource-4.1.36-44.1 kernel-xen-devel-4.1.36-44.1 - openSUSE Leap 42.1 (noarch): kernel-devel-4.1.36-44.1 kernel-docs-4.1.36-44.2 kernel-docs-html-4.1.36-44.2 kernel-docs-pdf-4.1.36-44.2 kernel-macros-4.1.36-44.1 kernel-source-4.1.36-44.1 kernel-source-vanilla-4.1.36-44.1 - openSUSE Leap 42.1 (i686): kernel-pae-4.1.36-44.1 kernel-pae-base-4.1.36-44.1 kernel-pae-base-debuginfo-4.1.36-44.1 kernel-pae-debuginfo-4.1.36-44.1 kernel-pae-debugsource-4.1.36-44.1 kernel-pae-devel-4.1.36-44.1 References: https://www.suse.com/security/cve/CVE-2016-9756.html https://bugzilla.suse.com/1013038 https://bugzilla.suse.com/1014943 -- To unsubscribe, e-mail: opensuse-security-announce+unsubscribe(a)opensuse.org For additional commands, e-mail: opensuse-security-announce+help(a)opensuse.org

1 0