October 2016 - openSUSE Updates - openSUSE Mailing Lists

openSUSE-SU-2016:2671-1: moderate: Security update for ImageMagick
by opensuse-security＠opensuse.org 28 Oct '16

28 Oct '16

openSUSE Security Update: Security update for ImageMagick ______________________________________________________________________________ Announcement ID: openSUSE-SU-2016:2671-1 Rating: moderate References: #1000394 #1000399 #1000434 #1000436 #1000686 #1000688 #1000689 #1000690 #1000691 #1000692 #1000693 #1000694 #1000695 #1000696 #1000697 #1000698 #1000699 #1000700 #1000701 #1000703 #1000704 #1000706 #1000707 #1000708 #1000709 #1000710 #1000711 #1000712 #1000713 #1000714 #1000715 #1001066 #1001221 #1002206 #1002209 #1002421 #1002422 #1003629 #1005123 #1005125 #1005127 #1005328 Cross-References: CVE-2014-9907 CVE-2015-8957 CVE-2015-8958 CVE-2015-8959 CVE-2016-6823 CVE-2016-7101 CVE-2016-7513 CVE-2016-7514 CVE-2016-7515 CVE-2016-7516 CVE-2016-7517 CVE-2016-7518 CVE-2016-7519 CVE-2016-7520 CVE-2016-7521 CVE-2016-7522 CVE-2016-7523 CVE-2016-7524 CVE-2016-7525 CVE-2016-7527 CVE-2016-7528 CVE-2016-7529 CVE-2016-7530 CVE-2016-7531 CVE-2016-7532 CVE-2016-7533 CVE-2016-7534 CVE-2016-7535 CVE-2016-7536 CVE-2016-7537 CVE-2016-7538 CVE-2016-7539 CVE-2016-7540 CVE-2016-7799 CVE-2016-7800 CVE-2016-7996 CVE-2016-7997 CVE-2016-8677 CVE-2016-8682 CVE-2016-8683 CVE-2016-8684 Affected Products: openSUSE 13.2 ______________________________________________________________________________ An update that solves 41 vulnerabilities and has one errata is now available. Description: This update for ImageMagick fixes the following issues: - CVE-2016-8684: Mismatch between real filesize and header values (bsc#1005123) - CVE-2016-8683: Check that filesize is reasonable compared to the header value (bsc#1005127) - CVE-2016-8682: Stack-buffer read overflow while reading SCT header (bsc#1005125) - CVE-2016-8677: Memory allocation failure in AcquireQuantumPixels (bsc#1005328) - CVE-2016-7996, CVE-2016-7997: WPG Reader Issues (bsc#1003629) - CVE-2016-7800: 8BIM/8BIMW unsigned underflow leads to heap overflow (bsc#1002422) - CVE-2016-7799: Mogrify global buffer overflow (bsc#1002421) - CVE-2016-7540: Writing to RGF format aborts (bsc#1000394) - CVE-2016-7539: Potential DOS by not releasing memory (bsc#1000715) - CVE-2016-7538: SIGABRT for corrupted pdb file (bsc#1000712) - CVE-2016-7537: Out of bound access for corrupted pdb file (bsc#1000711) - CVE-2016-7536: SEGV reported in corrupted profile handling (bsc#1000710) - CVE-2016-7535: Out of bound access for corrupted psd file (bsc#1000709) - CVE-2016-7534: Out of bound access in generic decoder (bsc#1000708) - CVE-2016-7533: Wpg file out of bound for corrupted file (bsc#1000707) - CVE-2016-7532: Fix handling of corrupted psd file (bsc#1000706) - CVE-2016-7531: Pbd file out of bound access (bsc#1000704) - CVE-2016-7530: Out of bound in quantum handling (bsc#1000703) - CVE-2016-7529: Out of bound in quantum handling (bsc#1000399) - CVE-2016-7528: Out of bound access in xcf file coder (bsc#1000434) - CVE-2016-7527: Out of bound access in wpg file coder: (bsc#1000436) - CVE-2016-7525: Heap buffer overflow in psd file coder (bsc#1000701) - CVE-2016-7524: AddressSanitizer:heap-buffer-overflow READ of size 1 in meta.c:465 (bsc#1000700) - CVE-2016-7523: AddressSanitizer:heap-buffer-overflow READ of size 1 meta.c:496 (bsc#1000699) - CVE-2016-7522: Out of bound access for malformed psd file (bsc#1000698) - CVE-2016-7521: Heap buffer overflow in psd file handling (bsc#1000697) - CVE-2016-7520: Heap overflow in hdr file handling (bsc#1000696) - CVE-2016-7519: Out-of-bounds read in coders/rle.c (bsc#1000695) - CVE-2016-7518: Out-of-bounds read in coders/sun.c (bsc#1000694) - CVE-2016-7517: Out-of-bounds read in coders/pict.c (bsc#1000693) - CVE-2016-7516: Out of bounds problem in rle, pict, viff and sun files (bsc#1000692) - CVE-2016-7515: Rle file handling for corrupted file (bsc#1000689) - CVE-2016-7514: Out-of-bounds read in coders/psd.c (bsc#1000688) - CVE-2016-7513: Off-by-one error leading to segfault (bsc#1000686) - CVE-2016-7101: SGI Coder Out-Of-Bounds Read Vulnerability (bsc#1001221) - CVE-2016-6823: BMP Coder Out-Of-Bounds Write Vulnerability (bsc#1001066) - CVE-2015-8959: DOS due to corrupted DDS files (bsc#1000713) - CVE-2015-8958: Potential DOS in sun file handling due to malformed files (bsc#1000691) - CVE-2015-8957: Buffer overflow in sun file handling (bsc#1000690) - CVE-2014-9907: DOS due to corrupted DDS files (bsc#1000714) - Divide by zero in WriteTIFFImage (bsc#1002206) - Buffer overflows in SIXEL, PDB, MAP, and TIFF coders (bsc#1002209) Patch Instructions: To install this openSUSE Security Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE 13.2: zypper in -t patch openSUSE-2016-1242=1 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE 13.2 (i586 x86_64): ImageMagick-6.8.9.8-34.1 ImageMagick-debuginfo-6.8.9.8-34.1 ImageMagick-debugsource-6.8.9.8-34.1 ImageMagick-devel-6.8.9.8-34.1 ImageMagick-extra-6.8.9.8-34.1 ImageMagick-extra-debuginfo-6.8.9.8-34.1 libMagick++-6_Q16-5-6.8.9.8-34.1 libMagick++-6_Q16-5-debuginfo-6.8.9.8-34.1 libMagick++-devel-6.8.9.8-34.1 libMagickCore-6_Q16-2-6.8.9.8-34.1 libMagickCore-6_Q16-2-debuginfo-6.8.9.8-34.1 libMagickWand-6_Q16-2-6.8.9.8-34.1 libMagickWand-6_Q16-2-debuginfo-6.8.9.8-34.1 perl-PerlMagick-6.8.9.8-34.1 perl-PerlMagick-debuginfo-6.8.9.8-34.1 - openSUSE 13.2 (x86_64): ImageMagick-devel-32bit-6.8.9.8-34.1 libMagick++-6_Q16-5-32bit-6.8.9.8-34.1 libMagick++-6_Q16-5-debuginfo-32bit-6.8.9.8-34.1 libMagick++-devel-32bit-6.8.9.8-34.1 libMagickCore-6_Q16-2-32bit-6.8.9.8-34.1 libMagickCore-6_Q16-2-debuginfo-32bit-6.8.9.8-34.1 libMagickWand-6_Q16-2-32bit-6.8.9.8-34.1 libMagickWand-6_Q16-2-debuginfo-32bit-6.8.9.8-34.1 - openSUSE 13.2 (noarch): ImageMagick-doc-6.8.9.8-34.1 References: https://www.suse.com/security/cve/CVE-2014-9907.html https://www.suse.com/security/cve/CVE-2015-8957.html https://www.suse.com/security/cve/CVE-2015-8958.html https://www.suse.com/security/cve/CVE-2015-8959.html https://www.suse.com/security/cve/CVE-2016-6823.html https://www.suse.com/security/cve/CVE-2016-7101.html https://www.suse.com/security/cve/CVE-2016-7513.html https://www.suse.com/security/cve/CVE-2016-7514.html https://www.suse.com/security/cve/CVE-2016-7515.html https://www.suse.com/security/cve/CVE-2016-7516.html https://www.suse.com/security/cve/CVE-2016-7517.html https://www.suse.com/security/cve/CVE-2016-7518.html https://www.suse.com/security/cve/CVE-2016-7519.html https://www.suse.com/security/cve/CVE-2016-7520.html https://www.suse.com/security/cve/CVE-2016-7521.html https://www.suse.com/security/cve/CVE-2016-7522.html https://www.suse.com/security/cve/CVE-2016-7523.html https://www.suse.com/security/cve/CVE-2016-7524.html https://www.suse.com/security/cve/CVE-2016-7525.html https://www.suse.com/security/cve/CVE-2016-7527.html https://www.suse.com/security/cve/CVE-2016-7528.html https://www.suse.com/security/cve/CVE-2016-7529.html https://www.suse.com/security/cve/CVE-2016-7530.html https://www.suse.com/security/cve/CVE-2016-7531.html https://www.suse.com/security/cve/CVE-2016-7532.html https://www.suse.com/security/cve/CVE-2016-7533.html https://www.suse.com/security/cve/CVE-2016-7534.html https://www.suse.com/security/cve/CVE-2016-7535.html https://www.suse.com/security/cve/CVE-2016-7536.html https://www.suse.com/security/cve/CVE-2016-7537.html https://www.suse.com/security/cve/CVE-2016-7538.html https://www.suse.com/security/cve/CVE-2016-7539.html https://www.suse.com/security/cve/CVE-2016-7540.html https://www.suse.com/security/cve/CVE-2016-7799.html https://www.suse.com/security/cve/CVE-2016-7800.html https://www.suse.com/security/cve/CVE-2016-7996.html https://www.suse.com/security/cve/CVE-2016-7997.html https://www.suse.com/security/cve/CVE-2016-8677.html https://www.suse.com/security/cve/CVE-2016-8682.html https://www.suse.com/security/cve/CVE-2016-8683.html https://www.suse.com/security/cve/CVE-2016-8684.html https://bugzilla.suse.com/1000394 https://bugzilla.suse.com/1000399 https://bugzilla.suse.com/1000434 https://bugzilla.suse.com/1000436 https://bugzilla.suse.com/1000686 https://bugzilla.suse.com/1000688 https://bugzilla.suse.com/1000689 https://bugzilla.suse.com/1000690 https://bugzilla.suse.com/1000691 https://bugzilla.suse.com/1000692 https://bugzilla.suse.com/1000693 https://bugzilla.suse.com/1000694 https://bugzilla.suse.com/1000695 https://bugzilla.suse.com/1000696 https://bugzilla.suse.com/1000697 https://bugzilla.suse.com/1000698 https://bugzilla.suse.com/1000699 https://bugzilla.suse.com/1000700 https://bugzilla.suse.com/1000701 https://bugzilla.suse.com/1000703 https://bugzilla.suse.com/1000704 https://bugzilla.suse.com/1000706 https://bugzilla.suse.com/1000707 https://bugzilla.suse.com/1000708 https://bugzilla.suse.com/1000709 https://bugzilla.suse.com/1000710 https://bugzilla.suse.com/1000711 https://bugzilla.suse.com/1000712 https://bugzilla.suse.com/1000713 https://bugzilla.suse.com/1000714 https://bugzilla.suse.com/1000715 https://bugzilla.suse.com/1001066 https://bugzilla.suse.com/1001221 https://bugzilla.suse.com/1002206 https://bugzilla.suse.com/1002209 https://bugzilla.suse.com/1002421 https://bugzilla.suse.com/1002422 https://bugzilla.suse.com/1003629 https://bugzilla.suse.com/1005123 https://bugzilla.suse.com/1005125 https://bugzilla.suse.com/1005127 https://bugzilla.suse.com/1005328

1 0

openSUSE-RU-2016:2666-1: important: Security update for the Linux Kernel
by maintenance＠opensuse.org 28 Oct '16

28 Oct '16

openSUSE Recommended Update: Security update for the Linux Kernel ______________________________________________________________________________ Announcement ID: openSUSE-RU-2016:2666-1 Rating: important References: #1007035 Affected Products: openSUSE 13.2 ______________________________________________________________________________ An update that has one recommended fix can now be installed. Description: The openSUSE 13.2 kernel was updated to fix a regression in the previous security update. The desktop device rights management was not working due to a bug in a code fix for POSIX ACLs. (bsc#1007035) Patch Instructions: To install this openSUSE Recommended Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE 13.2: zypper in -t patch openSUSE-2016-1241=1 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE 13.2 (i686 x86_64): kernel-debug-3.16.7-48.1 kernel-debug-base-3.16.7-48.1 kernel-debug-base-debuginfo-3.16.7-48.1 kernel-debug-debuginfo-3.16.7-48.1 kernel-debug-debugsource-3.16.7-48.1 kernel-debug-devel-3.16.7-48.1 kernel-debug-devel-debuginfo-3.16.7-48.1 kernel-desktop-3.16.7-48.1 kernel-desktop-base-3.16.7-48.1 kernel-desktop-base-debuginfo-3.16.7-48.1 kernel-desktop-debuginfo-3.16.7-48.1 kernel-desktop-debugsource-3.16.7-48.1 kernel-desktop-devel-3.16.7-48.1 kernel-ec2-base-debuginfo-3.16.7-48.1 kernel-ec2-debuginfo-3.16.7-48.1 kernel-ec2-debugsource-3.16.7-48.1 kernel-vanilla-3.16.7-48.1 kernel-vanilla-debuginfo-3.16.7-48.1 kernel-vanilla-debugsource-3.16.7-48.1 kernel-vanilla-devel-3.16.7-48.1 kernel-xen-3.16.7-48.1 kernel-xen-base-3.16.7-48.1 kernel-xen-base-debuginfo-3.16.7-48.1 kernel-xen-debuginfo-3.16.7-48.1 kernel-xen-debugsource-3.16.7-48.1 kernel-xen-devel-3.16.7-48.1 - openSUSE 13.2 (i586 x86_64): bbswitch-0.8-3.24.1 bbswitch-debugsource-0.8-3.24.1 bbswitch-kmp-default-0.8_k3.16.7_48-3.24.1 bbswitch-kmp-default-debuginfo-0.8_k3.16.7_48-3.24.1 bbswitch-kmp-desktop-0.8_k3.16.7_48-3.24.1 bbswitch-kmp-desktop-debuginfo-0.8_k3.16.7_48-3.24.1 bbswitch-kmp-xen-0.8_k3.16.7_48-3.24.1 bbswitch-kmp-xen-debuginfo-0.8_k3.16.7_48-3.24.1 cloop-2.639-14.24.1 cloop-debuginfo-2.639-14.24.1 cloop-debugsource-2.639-14.24.1 cloop-kmp-default-2.639_k3.16.7_48-14.24.1 cloop-kmp-default-debuginfo-2.639_k3.16.7_48-14.24.1 cloop-kmp-desktop-2.639_k3.16.7_48-14.24.1 cloop-kmp-desktop-debuginfo-2.639_k3.16.7_48-14.24.1 cloop-kmp-xen-2.639_k3.16.7_48-14.24.1 cloop-kmp-xen-debuginfo-2.639_k3.16.7_48-14.24.1 crash-7.0.8-24.1 crash-debuginfo-7.0.8-24.1 crash-debugsource-7.0.8-24.1 crash-devel-7.0.8-24.1 crash-doc-7.0.8-24.1 crash-eppic-7.0.8-24.1 crash-eppic-debuginfo-7.0.8-24.1 crash-gcore-7.0.8-24.1 crash-gcore-debuginfo-7.0.8-24.1 crash-kmp-default-7.0.8_k3.16.7_48-24.1 crash-kmp-default-debuginfo-7.0.8_k3.16.7_48-24.1 crash-kmp-desktop-7.0.8_k3.16.7_48-24.1 crash-kmp-desktop-debuginfo-7.0.8_k3.16.7_48-24.1 crash-kmp-xen-7.0.8_k3.16.7_48-24.1 crash-kmp-xen-debuginfo-7.0.8_k3.16.7_48-24.1 hdjmod-debugsource-1.28-18.25.1 hdjmod-kmp-default-1.28_k3.16.7_48-18.25.1 hdjmod-kmp-default-debuginfo-1.28_k3.16.7_48-18.25.1 hdjmod-kmp-desktop-1.28_k3.16.7_48-18.25.1 hdjmod-kmp-desktop-debuginfo-1.28_k3.16.7_48-18.25.1 hdjmod-kmp-xen-1.28_k3.16.7_48-18.25.1 hdjmod-kmp-xen-debuginfo-1.28_k3.16.7_48-18.25.1 ipset-6.23-24.1 ipset-debuginfo-6.23-24.1 ipset-debugsource-6.23-24.1 ipset-devel-6.23-24.1 ipset-kmp-default-6.23_k3.16.7_48-24.1 ipset-kmp-default-debuginfo-6.23_k3.16.7_48-24.1 ipset-kmp-desktop-6.23_k3.16.7_48-24.1 ipset-kmp-desktop-debuginfo-6.23_k3.16.7_48-24.1 ipset-kmp-xen-6.23_k3.16.7_48-24.1 ipset-kmp-xen-debuginfo-6.23_k3.16.7_48-24.1 kernel-default-3.16.7-48.1 kernel-default-base-3.16.7-48.1 kernel-default-base-debuginfo-3.16.7-48.1 kernel-default-debuginfo-3.16.7-48.1 kernel-default-debugsource-3.16.7-48.1 kernel-default-devel-3.16.7-48.1 kernel-ec2-3.16.7-48.1 kernel-ec2-base-3.16.7-48.1 kernel-ec2-devel-3.16.7-48.1 kernel-obs-build-3.16.7-48.3 kernel-obs-build-debugsource-3.16.7-48.3 kernel-obs-qa-3.16.7-48.1 kernel-obs-qa-xen-3.16.7-48.1 kernel-syms-3.16.7-48.1 libipset3-6.23-24.1 libipset3-debuginfo-6.23-24.1 pcfclock-0.44-260.24.1 pcfclock-debuginfo-0.44-260.24.1 pcfclock-debugsource-0.44-260.24.1 pcfclock-kmp-default-0.44_k3.16.7_48-260.24.1 pcfclock-kmp-default-debuginfo-0.44_k3.16.7_48-260.24.1 pcfclock-kmp-desktop-0.44_k3.16.7_48-260.24.1 pcfclock-kmp-desktop-debuginfo-0.44_k3.16.7_48-260.24.1 python-virtualbox-5.0.28-59.1 python-virtualbox-debuginfo-5.0.28-59.1 vhba-kmp-debugsource-20140629-2.24.1 vhba-kmp-default-20140629_k3.16.7_48-2.24.1 vhba-kmp-default-debuginfo-20140629_k3.16.7_48-2.24.1 vhba-kmp-desktop-20140629_k3.16.7_48-2.24.1 vhba-kmp-desktop-debuginfo-20140629_k3.16.7_48-2.24.1 vhba-kmp-xen-20140629_k3.16.7_48-2.24.1 vhba-kmp-xen-debuginfo-20140629_k3.16.7_48-2.24.1 virtualbox-5.0.28-59.1 virtualbox-debuginfo-5.0.28-59.1 virtualbox-debugsource-5.0.28-59.1 virtualbox-devel-5.0.28-59.1 virtualbox-guest-kmp-default-5.0.28_k3.16.7_48-59.1 virtualbox-guest-kmp-default-debuginfo-5.0.28_k3.16.7_48-59.1 virtualbox-guest-kmp-desktop-5.0.28_k3.16.7_48-59.1 virtualbox-guest-kmp-desktop-debuginfo-5.0.28_k3.16.7_48-59.1 virtualbox-guest-tools-5.0.28-59.1 virtualbox-guest-tools-debuginfo-5.0.28-59.1 virtualbox-guest-x11-5.0.28-59.1 virtualbox-guest-x11-debuginfo-5.0.28-59.1 virtualbox-host-kmp-default-5.0.28_k3.16.7_48-59.1 virtualbox-host-kmp-default-debuginfo-5.0.28_k3.16.7_48-59.1 virtualbox-host-kmp-desktop-5.0.28_k3.16.7_48-59.1 virtualbox-host-kmp-desktop-debuginfo-5.0.28_k3.16.7_48-59.1 virtualbox-qt-5.0.28-59.1 virtualbox-qt-debuginfo-5.0.28-59.1 virtualbox-websrv-5.0.28-59.1 virtualbox-websrv-debuginfo-5.0.28-59.1 xen-debugsource-4.4.4_05-53.1 xen-devel-4.4.4_05-53.1 xen-libs-4.4.4_05-53.1 xen-libs-debuginfo-4.4.4_05-53.1 xen-tools-domU-4.4.4_05-53.1 xen-tools-domU-debuginfo-4.4.4_05-53.1 xtables-addons-2.6-26.1 xtables-addons-debuginfo-2.6-26.1 xtables-addons-debugsource-2.6-26.1 xtables-addons-kmp-default-2.6_k3.16.7_48-26.1 xtables-addons-kmp-default-debuginfo-2.6_k3.16.7_48-26.1 xtables-addons-kmp-desktop-2.6_k3.16.7_48-26.1 xtables-addons-kmp-desktop-debuginfo-2.6_k3.16.7_48-26.1 xtables-addons-kmp-xen-2.6_k3.16.7_48-26.1 xtables-addons-kmp-xen-debuginfo-2.6_k3.16.7_48-26.1 - openSUSE 13.2 (x86_64): xen-4.4.4_05-53.1 xen-doc-html-4.4.4_05-53.1 xen-kmp-default-4.4.4_05_k3.16.7_48-53.1 xen-kmp-default-debuginfo-4.4.4_05_k3.16.7_48-53.1 xen-kmp-desktop-4.4.4_05_k3.16.7_48-53.1 xen-kmp-desktop-debuginfo-4.4.4_05_k3.16.7_48-53.1 xen-libs-32bit-4.4.4_05-53.1 xen-libs-debuginfo-32bit-4.4.4_05-53.1 xen-tools-4.4.4_05-53.1 xen-tools-debuginfo-4.4.4_05-53.1 - openSUSE 13.2 (noarch): kernel-devel-3.16.7-48.1 kernel-docs-3.16.7-48.2 kernel-macros-3.16.7-48.1 kernel-source-3.16.7-48.1 kernel-source-vanilla-3.16.7-48.1 virtualbox-guest-desktop-icons-5.0.28-59.1 virtualbox-host-source-5.0.28-59.1 - openSUSE 13.2 (i586): bbswitch-kmp-pae-0.8_k3.16.7_48-3.24.1 bbswitch-kmp-pae-debuginfo-0.8_k3.16.7_48-3.24.1 cloop-kmp-pae-2.639_k3.16.7_48-14.24.1 cloop-kmp-pae-debuginfo-2.639_k3.16.7_48-14.24.1 crash-kmp-pae-7.0.8_k3.16.7_48-24.1 crash-kmp-pae-debuginfo-7.0.8_k3.16.7_48-24.1 hdjmod-kmp-pae-1.28_k3.16.7_48-18.25.1 hdjmod-kmp-pae-debuginfo-1.28_k3.16.7_48-18.25.1 ipset-kmp-pae-6.23_k3.16.7_48-24.1 ipset-kmp-pae-debuginfo-6.23_k3.16.7_48-24.1 pcfclock-kmp-pae-0.44_k3.16.7_48-260.24.1 pcfclock-kmp-pae-debuginfo-0.44_k3.16.7_48-260.24.1 vhba-kmp-pae-20140629_k3.16.7_48-2.24.1 vhba-kmp-pae-debuginfo-20140629_k3.16.7_48-2.24.1 virtualbox-guest-kmp-pae-5.0.28_k3.16.7_48-59.1 virtualbox-guest-kmp-pae-debuginfo-5.0.28_k3.16.7_48-59.1 virtualbox-host-kmp-pae-5.0.28_k3.16.7_48-59.1 virtualbox-host-kmp-pae-debuginfo-5.0.28_k3.16.7_48-59.1 xtables-addons-kmp-pae-2.6_k3.16.7_48-26.1 xtables-addons-kmp-pae-debuginfo-2.6_k3.16.7_48-26.1 - openSUSE 13.2 (i686): kernel-pae-3.16.7-48.1 kernel-pae-base-3.16.7-48.1 kernel-pae-base-debuginfo-3.16.7-48.1 kernel-pae-debuginfo-3.16.7-48.1 kernel-pae-debugsource-3.16.7-48.1 kernel-pae-devel-3.16.7-48.1 References: https://bugzilla.suse.com/1007035

1 0

openSUSE-SU-2016:2665-1: important: Security update for flash-player
by opensuse-security＠opensuse.org 27 Oct '16

27 Oct '16

openSUSE Security Update: Security update for flash-player ______________________________________________________________________________ Announcement ID: openSUSE-SU-2016:2665-1 Rating: important References: #1007098 Cross-References: CVE-2016-7855 Affected Products: openSUSE 13.1 NonFree ______________________________________________________________________________ An update that fixes one vulnerability is now available. Description: This update for Adobe Flash Player to 11.2.202.643 fixes the following vulnerability: - CVE-2016-7855: use-after-free vulnerability (APSB16-36, boo#1007098) Patch Instructions: To install this openSUSE Security Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE 13.1 NonFree: zypper in -t patch 2016-1240=1 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE 13.1 NonFree (i586 x86_64): flash-player-11.2.202.643-177.1 flash-player-gnome-11.2.202.643-177.1 flash-player-kde4-11.2.202.643-177.1 References: https://www.suse.com/security/cve/CVE-2016-7855.html https://bugzilla.suse.com/1007098

1 0

openSUSE-SU-2016:2663-1: important: Security update for flash-player
by opensuse-security＠opensuse.org 27 Oct '16

27 Oct '16

openSUSE Security Update: Security update for flash-player ______________________________________________________________________________ Announcement ID: openSUSE-SU-2016:2663-1 Rating: important References: #1007098 Cross-References: CVE-2016-7855 Affected Products: openSUSE 13.2 NonFree ______________________________________________________________________________ An update that fixes one vulnerability is now available. Description: This update for Adobe Flash Player to 11.2.202.643 fixes the following vulnerability: - CVE-2016-7855: use-after-free vulnerability (APSB16-36, boo#1007098) Patch Instructions: To install this openSUSE Security Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE 13.2 NonFree: zypper in -t patch openSUSE-2016-1239=1 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE 13.2 NonFree (i586 x86_64): flash-player-11.2.202.643-2.115.1 flash-player-gnome-11.2.202.643-2.115.1 flash-player-kde4-11.2.202.643-2.115.1 References: https://www.suse.com/security/cve/CVE-2016-7855.html https://bugzilla.suse.com/1007098

1 0

openSUSE-SU-2016:2651-1: moderate: Security update for sssd
by opensuse-security＠opensuse.org 26 Oct '16

26 Oct '16

openSUSE Security Update: Security update for sssd ______________________________________________________________________________ Announcement ID: openSUSE-SU-2016:2651-1 Rating: moderate References: #1002973 #1004220 #880245 #993582 Cross-References: CVE-2014-0249 Affected Products: openSUSE Leap 42.1 ______________________________________________________________________________ An update that solves one vulnerability and has three fixes is now available. Description: This update for sssd fixes one security issue and three bugs. The following vulnerability was fixed: - CVE-2014-0249: Incorrect expansion of group membership when encountering a non-POSIX group. (bsc#880245) The following non-security fixes were also included: - Prevent crashes of statically linked binaries using getpwuid when sssd is used and nscd is turned off or has caching disabled. (bsc#993582) - Add logrotate configuration to prevent log files from growing too large when running with debug mode enabled. (bsc#1004220) - Order sudo rules by the same logic used by the native LDAP support from sudo. (bsc#1002973) This update was imported from the SUSE:SLE-12-SP1:Update update project. Patch Instructions: To install this openSUSE Security Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE Leap 42.1: zypper in -t patch openSUSE-2016-1238=1 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE Leap 42.1 (i586 x86_64): libipa_hbac-devel-1.11.5.1-16.1 libipa_hbac0-1.11.5.1-16.1 libipa_hbac0-debuginfo-1.11.5.1-16.1 libsss_idmap-devel-1.11.5.1-16.1 libsss_idmap0-1.11.5.1-16.1 libsss_idmap0-debuginfo-1.11.5.1-16.1 libsss_nss_idmap-devel-1.11.5.1-16.1 libsss_nss_idmap0-1.11.5.1-16.1 libsss_nss_idmap0-debuginfo-1.11.5.1-16.1 libsss_sudo-1.11.5.1-16.1 libsss_sudo-debuginfo-1.11.5.1-16.1 python-ipa_hbac-1.11.5.1-16.1 python-ipa_hbac-debuginfo-1.11.5.1-16.1 python-sss_nss_idmap-1.11.5.1-16.1 python-sss_nss_idmap-debuginfo-1.11.5.1-16.1 python-sssd-config-1.11.5.1-16.1 python-sssd-config-debuginfo-1.11.5.1-16.1 sssd-1.11.5.1-16.1 sssd-ad-1.11.5.1-16.1 sssd-ad-debuginfo-1.11.5.1-16.1 sssd-debuginfo-1.11.5.1-16.1 sssd-debugsource-1.11.5.1-16.1 sssd-ipa-1.11.5.1-16.1 sssd-ipa-debuginfo-1.11.5.1-16.1 sssd-krb5-1.11.5.1-16.1 sssd-krb5-common-1.11.5.1-16.1 sssd-krb5-common-debuginfo-1.11.5.1-16.1 sssd-krb5-debuginfo-1.11.5.1-16.1 sssd-ldap-1.11.5.1-16.1 sssd-ldap-debuginfo-1.11.5.1-16.1 sssd-proxy-1.11.5.1-16.1 sssd-proxy-debuginfo-1.11.5.1-16.1 sssd-tools-1.11.5.1-16.1 sssd-tools-debuginfo-1.11.5.1-16.1 - openSUSE Leap 42.1 (x86_64): sssd-32bit-1.11.5.1-16.1 sssd-debuginfo-32bit-1.11.5.1-16.1 References: https://www.suse.com/security/cve/CVE-2014-0249.html https://bugzilla.suse.com/1002973 https://bugzilla.suse.com/1004220 https://bugzilla.suse.com/880245 https://bugzilla.suse.com/993582

1 0

openSUSE-SU-2016:2649-1: important: kernel update for Evergreen 11.4
by opensuse-security＠opensuse.org 26 Oct '16

26 Oct '16

openSUSE Security Update: kernel update for Evergreen 11.4 ______________________________________________________________________________ Announcement ID: openSUSE-SU-2016:2649-1 Rating: important References: #1004418 #758540 #816446 #861093 #917648 #928130 #935757 #939826 #942367 #944296 #945825 #946117 #946309 #948562 #949744 #949936 #951440 #952384 #953527 #954404 #955354 #955654 #956708 #956709 #958463 #958886 #958951 #959190 #959399 #961500 #961509 #961512 #963765 #963767 #964201 #966437 #966460 #966662 #966693 #967972 #967973 #967974 #967975 #968010 #968011 #968012 #968013 #968670 #969356 #970504 #970892 #970909 #970911 #970948 #970956 #970958 #970970 #971124 #971125 #971126 #971360 #972510 #973570 #975945 #977847 #978822 Cross-References: CVE-2013-7446 CVE-2015-0272 CVE-2015-1339 CVE-2015-3339 CVE-2015-5307 CVE-2015-6252 CVE-2015-6937 CVE-2015-7509 CVE-2015-7515 CVE-2015-7550 CVE-2015-7566 CVE-2015-7799 CVE-2015-7872 CVE-2015-7990 CVE-2015-8104 CVE-2015-8215 CVE-2015-8539 CVE-2015-8543 CVE-2015-8569 CVE-2015-8575 CVE-2015-8767 CVE-2015-8785 CVE-2015-8812 CVE-2015-8816 CVE-2016-0723 CVE-2016-2069 CVE-2016-2143 CVE-2016-2184 CVE-2016-2185 CVE-2016-2186 CVE-2016-2188 CVE-2016-2384 CVE-2016-2543 CVE-2016-2544 CVE-2016-2545 CVE-2016-2546 CVE-2016-2547 CVE-2016-2548 CVE-2016-2549 CVE-2016-2782 CVE-2016-2847 CVE-2016-3134 CVE-2016-3137 CVE-2016-3138 CVE-2016-3139 CVE-2016-3140 CVE-2016-3156 CVE-2016-4486 CVE-2016-5195 Affected Products: openSUSE Evergreen 11.4 ______________________________________________________________________________ An update that solves 49 vulnerabilities and has 17 fixes is now available. Description: This kernel update fixes the well known "Dirty COW" issue as well as a bunch of other security and non-security related issues. Patch Instructions: To install this openSUSE Security Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE Evergreen 11.4: zypper in -t patch 2016-1236=1 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE Evergreen 11.4 (i586 x86_64): kernel-debug-3.0.101-105.1 kernel-debug-base-3.0.101-105.1 kernel-debug-base-debuginfo-3.0.101-105.1 kernel-debug-debuginfo-3.0.101-105.1 kernel-debug-debugsource-3.0.101-105.1 kernel-debug-devel-3.0.101-105.1 kernel-debug-devel-debuginfo-3.0.101-105.1 kernel-debug-hmac-3.0.101-105.1 kernel-default-3.0.101-105.1 kernel-default-base-3.0.101-105.1 kernel-default-base-debuginfo-3.0.101-105.1 kernel-default-debuginfo-3.0.101-105.1 kernel-default-debugsource-3.0.101-105.1 kernel-default-devel-3.0.101-105.1 kernel-default-devel-debuginfo-3.0.101-105.1 kernel-default-hmac-3.0.101-105.1 kernel-desktop-3.0.101-105.1 kernel-desktop-base-3.0.101-105.1 kernel-desktop-base-debuginfo-3.0.101-105.1 kernel-desktop-debuginfo-3.0.101-105.1 kernel-desktop-debugsource-3.0.101-105.1 kernel-desktop-devel-3.0.101-105.1 kernel-desktop-devel-debuginfo-3.0.101-105.1 kernel-desktop-hmac-3.0.101-105.1 kernel-ec2-3.0.101-105.1 kernel-ec2-base-3.0.101-105.1 kernel-ec2-base-debuginfo-3.0.101-105.1 kernel-ec2-debuginfo-3.0.101-105.1 kernel-ec2-debugsource-3.0.101-105.1 kernel-ec2-devel-3.0.101-105.1 kernel-ec2-devel-debuginfo-3.0.101-105.1 kernel-ec2-extra-3.0.101-105.1 kernel-ec2-extra-debuginfo-3.0.101-105.1 kernel-ec2-hmac-3.0.101-105.1 kernel-source-3.0.101-105.1 kernel-source-vanilla-3.0.101-105.1 kernel-syms-3.0.101-105.1 kernel-trace-3.0.101-105.1 kernel-trace-base-3.0.101-105.1 kernel-trace-base-debuginfo-3.0.101-105.1 kernel-trace-debuginfo-3.0.101-105.1 kernel-trace-debugsource-3.0.101-105.1 kernel-trace-devel-3.0.101-105.1 kernel-trace-devel-debuginfo-3.0.101-105.1 kernel-trace-hmac-3.0.101-105.1 kernel-vanilla-3.0.101-105.1 kernel-vanilla-base-3.0.101-105.1 kernel-vanilla-base-debuginfo-3.0.101-105.1 kernel-vanilla-debuginfo-3.0.101-105.1 kernel-vanilla-debugsource-3.0.101-105.1 kernel-vanilla-devel-3.0.101-105.1 kernel-vanilla-devel-debuginfo-3.0.101-105.1 kernel-vanilla-hmac-3.0.101-105.1 kernel-xen-3.0.101-105.1 kernel-xen-base-3.0.101-105.1 kernel-xen-base-debuginfo-3.0.101-105.1 kernel-xen-debuginfo-3.0.101-105.1 kernel-xen-debugsource-3.0.101-105.1 kernel-xen-devel-3.0.101-105.1 kernel-xen-devel-debuginfo-3.0.101-105.1 kernel-xen-hmac-3.0.101-105.1 preload-1.2-6.83.1 preload-debuginfo-1.2-6.83.1 preload-debugsource-1.2-6.83.1 preload-kmp-default-1.2_3.0.101_105-6.83.1 preload-kmp-default-debuginfo-1.2_3.0.101_105-6.83.1 preload-kmp-desktop-1.2_3.0.101_105-6.83.1 preload-kmp-desktop-debuginfo-1.2_3.0.101_105-6.83.1 - openSUSE Evergreen 11.4 (noarch): kernel-docs-3.0.101-105.2 - openSUSE Evergreen 11.4 (i586): kernel-pae-3.0.101-105.1 kernel-pae-base-3.0.101-105.1 kernel-pae-base-debuginfo-3.0.101-105.1 kernel-pae-debuginfo-3.0.101-105.1 kernel-pae-debugsource-3.0.101-105.1 kernel-pae-devel-3.0.101-105.1 kernel-pae-devel-debuginfo-3.0.101-105.1 kernel-pae-hmac-3.0.101-105.1 kernel-vmi-3.0.101-105.1 kernel-vmi-base-3.0.101-105.1 kernel-vmi-base-debuginfo-3.0.101-105.1 kernel-vmi-debuginfo-3.0.101-105.1 kernel-vmi-debugsource-3.0.101-105.1 kernel-vmi-devel-3.0.101-105.1 kernel-vmi-devel-debuginfo-3.0.101-105.1 kernel-vmi-hmac-3.0.101-105.1 References: https://www.suse.com/security/cve/CVE-2013-7446.html https://www.suse.com/security/cve/CVE-2015-0272.html https://www.suse.com/security/cve/CVE-2015-1339.html https://www.suse.com/security/cve/CVE-2015-3339.html https://www.suse.com/security/cve/CVE-2015-5307.html https://www.suse.com/security/cve/CVE-2015-6252.html https://www.suse.com/security/cve/CVE-2015-6937.html https://www.suse.com/security/cve/CVE-2015-7509.html https://www.suse.com/security/cve/CVE-2015-7515.html https://www.suse.com/security/cve/CVE-2015-7550.html https://www.suse.com/security/cve/CVE-2015-7566.html https://www.suse.com/security/cve/CVE-2015-7799.html https://www.suse.com/security/cve/CVE-2015-7872.html https://www.suse.com/security/cve/CVE-2015-7990.html https://www.suse.com/security/cve/CVE-2015-8104.html https://www.suse.com/security/cve/CVE-2015-8215.html https://www.suse.com/security/cve/CVE-2015-8539.html https://www.suse.com/security/cve/CVE-2015-8543.html https://www.suse.com/security/cve/CVE-2015-8569.html https://www.suse.com/security/cve/CVE-2015-8575.html https://www.suse.com/security/cve/CVE-2015-8767.html https://www.suse.com/security/cve/CVE-2015-8785.html https://www.suse.com/security/cve/CVE-2015-8812.html https://www.suse.com/security/cve/CVE-2015-8816.html https://www.suse.com/security/cve/CVE-2016-0723.html https://www.suse.com/security/cve/CVE-2016-2069.html https://www.suse.com/security/cve/CVE-2016-2143.html https://www.suse.com/security/cve/CVE-2016-2184.html https://www.suse.com/security/cve/CVE-2016-2185.html https://www.suse.com/security/cve/CVE-2016-2186.html https://www.suse.com/security/cve/CVE-2016-2188.html https://www.suse.com/security/cve/CVE-2016-2384.html https://www.suse.com/security/cve/CVE-2016-2543.html https://www.suse.com/security/cve/CVE-2016-2544.html https://www.suse.com/security/cve/CVE-2016-2545.html https://www.suse.com/security/cve/CVE-2016-2546.html https://www.suse.com/security/cve/CVE-2016-2547.html https://www.suse.com/security/cve/CVE-2016-2548.html https://www.suse.com/security/cve/CVE-2016-2549.html https://www.suse.com/security/cve/CVE-2016-2782.html https://www.suse.com/security/cve/CVE-2016-2847.html https://www.suse.com/security/cve/CVE-2016-3134.html https://www.suse.com/security/cve/CVE-2016-3137.html https://www.suse.com/security/cve/CVE-2016-3138.html https://www.suse.com/security/cve/CVE-2016-3139.html https://www.suse.com/security/cve/CVE-2016-3140.html https://www.suse.com/security/cve/CVE-2016-3156.html https://www.suse.com/security/cve/CVE-2016-4486.html https://www.suse.com/security/cve/CVE-2016-5195.html https://bugzilla.suse.com/1004418 https://bugzilla.suse.com/758540 https://bugzilla.suse.com/816446 https://bugzilla.suse.com/861093 https://bugzilla.suse.com/917648 https://bugzilla.suse.com/928130 https://bugzilla.suse.com/935757 https://bugzilla.suse.com/939826 https://bugzilla.suse.com/942367 https://bugzilla.suse.com/944296 https://bugzilla.suse.com/945825 https://bugzilla.suse.com/946117 https://bugzilla.suse.com/946309 https://bugzilla.suse.com/948562 https://bugzilla.suse.com/949744 https://bugzilla.suse.com/949936 https://bugzilla.suse.com/951440 https://bugzilla.suse.com/952384 https://bugzilla.suse.com/953527 https://bugzilla.suse.com/954404 https://bugzilla.suse.com/955354 https://bugzilla.suse.com/955654 https://bugzilla.suse.com/956708 https://bugzilla.suse.com/956709 https://bugzilla.suse.com/958463 https://bugzilla.suse.com/958886 https://bugzilla.suse.com/958951 https://bugzilla.suse.com/959190 https://bugzilla.suse.com/959399 https://bugzilla.suse.com/961500 https://bugzilla.suse.com/961509 https://bugzilla.suse.com/961512 https://bugzilla.suse.com/963765 https://bugzilla.suse.com/963767 https://bugzilla.suse.com/964201 https://bugzilla.suse.com/966437 https://bugzilla.suse.com/966460 https://bugzilla.suse.com/966662 https://bugzilla.suse.com/966693 https://bugzilla.suse.com/967972 https://bugzilla.suse.com/967973 https://bugzilla.suse.com/967974 https://bugzilla.suse.com/967975 https://bugzilla.suse.com/968010 https://bugzilla.suse.com/968011 https://bugzilla.suse.com/968012 https://bugzilla.suse.com/968013 https://bugzilla.suse.com/968670 https://bugzilla.suse.com/969356 https://bugzilla.suse.com/970504 https://bugzilla.suse.com/970892 https://bugzilla.suse.com/970909 https://bugzilla.suse.com/970911 https://bugzilla.suse.com/970948 https://bugzilla.suse.com/970956 https://bugzilla.suse.com/970958 https://bugzilla.suse.com/970970 https://bugzilla.suse.com/971124 https://bugzilla.suse.com/971125 https://bugzilla.suse.com/971126 https://bugzilla.suse.com/971360 https://bugzilla.suse.com/972510 https://bugzilla.suse.com/973570 https://bugzilla.suse.com/975945 https://bugzilla.suse.com/977847 https://bugzilla.suse.com/978822

1 0

openSUSE-SU-2016:2648-1: important: Security update for ghostscript
by opensuse-security＠opensuse.org 26 Oct '16

26 Oct '16

openSUSE Security Update: Security update for ghostscript ______________________________________________________________________________ Announcement ID: openSUSE-SU-2016:2648-1 Rating: important References: #1001951 #1004237 Cross-References: CVE-2013-5653 CVE-2016-7978 CVE-2016-7979 CVE-2016-8602 Affected Products: openSUSE 13.2 ______________________________________________________________________________ An update that fixes four vulnerabilities is now available. Description: This update for ghostscript fixes the following issues: - CVE-2016-8602: Fixes a NULL dereference in .sethalftone5 (boo#1004237). - CVE-2013-5653, CVE-2016-7978, CVE-2016-7979: Fix multiple -dsafer related CVE's (boo#1001951). Patch Instructions: To install this openSUSE Security Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE 13.2: zypper in -t patch openSUSE-2016-1237=1 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE 13.2 (i586 x86_64): ghostscript-9.15-6.1 ghostscript-debuginfo-9.15-6.1 ghostscript-debugsource-9.15-6.1 ghostscript-devel-9.15-6.1 ghostscript-mini-9.15-6.1 ghostscript-mini-debuginfo-9.15-6.1 ghostscript-mini-debugsource-9.15-6.1 ghostscript-mini-devel-9.15-6.1 ghostscript-x11-9.15-6.1 ghostscript-x11-debuginfo-9.15-6.1 References: https://www.suse.com/security/cve/CVE-2013-5653.html https://www.suse.com/security/cve/CVE-2016-7978.html https://www.suse.com/security/cve/CVE-2016-7979.html https://www.suse.com/security/cve/CVE-2016-8602.html https://bugzilla.suse.com/1001951 https://bugzilla.suse.com/1004237

1 0

openSUSE-SU-2016:2647-1: Security update for guile1
by opensuse-security＠opensuse.org 26 Oct '16

26 Oct '16

openSUSE Security Update: Security update for guile1 ______________________________________________________________________________ Announcement ID: openSUSE-SU-2016:2647-1 Rating: low References: #1004221 Cross-References: CVE-2016-8605 Affected Products: openSUSE Leap 42.1 ______________________________________________________________________________ An update that fixes one vulnerability is now available. Description: This update for guile1 fixes the following issue: - CVE-2016-8605: Thread-unsafe umask modification (bsc#1004221). Patch Instructions: To install this openSUSE Security Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE Leap 42.1: zypper in -t patch openSUSE-2016-1231=1 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE Leap 42.1 (i586 x86_64): guile1-1.8.8-22.1 guile1-debuginfo-1.8.8-22.1 guile1-debugsource-1.8.8-22.1 libguile-srfi-srfi-1-v-3-3-1.8.8-22.1 libguile-srfi-srfi-1-v-3-3-debuginfo-1.8.8-22.1 libguile-srfi-srfi-13-14-v-3-3-1.8.8-22.1 libguile-srfi-srfi-13-14-v-3-3-debuginfo-1.8.8-22.1 libguile-srfi-srfi-4-v-3-3-1.8.8-22.1 libguile-srfi-srfi-4-v-3-3-debuginfo-1.8.8-22.1 libguile-srfi-srfi-60-v-2-2-1.8.8-22.1 libguile-srfi-srfi-60-v-2-2-debuginfo-1.8.8-22.1 libguile1-devel-1.8.8-22.1 libguile17-1.8.8-22.1 libguile17-debuginfo-1.8.8-22.1 libguilereadline-v-17-17-1.8.8-22.1 libguilereadline-v-17-17-debuginfo-1.8.8-22.1 References: https://www.suse.com/security/cve/CVE-2016-8605.html https://bugzilla.suse.com/1004221

1 0

openSUSE-SU-2016:2646-1: important: Security update for quagga
by opensuse-security＠opensuse.org 26 Oct '16

26 Oct '16

openSUSE Security Update: Security update for quagga ______________________________________________________________________________ Announcement ID: openSUSE-SU-2016:2646-1 Rating: important References: #1005258 Cross-References: CVE-2016-1245 Affected Products: openSUSE Leap 42.1 ______________________________________________________________________________ An update that fixes one vulnerability is now available. Description: This update for quagga fixes the following issue: - CVE-2016-1245: Fix for a zebra stack overrun in IPv6 RA receive code. (bsc#1005258). Patch Instructions: To install this openSUSE Security Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE Leap 42.1: zypper in -t patch openSUSE-2016-1233=1 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE Leap 42.1 (i586 x86_64): quagga-0.99.24.1-14.1 quagga-debuginfo-0.99.24.1-14.1 quagga-debugsource-0.99.24.1-14.1 quagga-devel-0.99.24.1-14.1 References: https://www.suse.com/security/cve/CVE-2016-1245.html https://bugzilla.suse.com/1005258

1 0

openSUSE-SU-2016:2645-1: Security update for guile
by opensuse-security＠opensuse.org 26 Oct '16

26 Oct '16

openSUSE Security Update: Security update for guile ______________________________________________________________________________ Announcement ID: openSUSE-SU-2016:2645-1 Rating: low References: #1004221 #1004226 Cross-References: CVE-2016-8605 CVE-2016-8606 Affected Products: openSUSE 13.2 ______________________________________________________________________________ An update that fixes two vulnerabilities is now available. Description: This update for guile fixes the following issues: - CVE-2016-8606: REPL server vulnerable to HTTP inter-protocol attacks (bsc#1004226). - CVE-2016-8605: Thread-unsafe umask modification (bsc#1004221). Patch Instructions: To install this openSUSE Security Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE 13.2: zypper in -t patch openSUSE-2016-1235=1 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE 13.2 (i586 x86_64): guile-2.0.11-3.3.1 guile-debuginfo-2.0.11-3.3.1 guile-debugsource-2.0.11-3.3.1 guile-devel-2.0.11-3.3.1 guile-modules-2_0-2.0.11-3.3.1 libguile-2_0-22-2.0.11-3.3.1 libguile-2_0-22-debuginfo-2.0.11-3.3.1 libguilereadline-v-18-18-2.0.11-3.3.1 libguilereadline-v-18-18-debuginfo-2.0.11-3.3.1 References: https://www.suse.com/security/cve/CVE-2016-8605.html https://www.suse.com/security/cve/CVE-2016-8606.html https://bugzilla.suse.com/1004221 https://bugzilla.suse.com/1004226

1 0