August 2016 - openSUSE Updates - openSUSE Mailing Lists

openSUSE-SU-2016:2169-1: moderate: Security update for typo3-cms-4_5
by opensuse-security＠opensuse.org 29 Aug '16

29 Aug '16

openSUSE Security Update: Security update for typo3-cms-4_5 ______________________________________________________________________________ Announcement ID: openSUSE-SU-2016:2169-1 Rating: moderate References: Cross-References: CVE-2013-7073 CVE-2014-9508 CVE-2015-2047 Affected Products: openSUSE Leap 42.1 openSUSE 13.2 ______________________________________________________________________________ An update that fixes three vulnerabilities is now available. Description: This update for typo3-cms-4_5 fixes the following issues: - CVE-2015-2047: Authentication Bypass (TYPO3-CORE-SA-2015-001) - CVE-2014-9508: Link spoofing and cache poisoning (TYPO3-CORE-SA-2014-003) - TYPO3-CORE-SA-2014-002: Multiple Vulnerabilities - CVE-2013-7073: Multiple vulnerabilities (TYPO3-CORE-SA-2013-004) This update contains the last upstream release 4.5.40, LTS discontinued since 04.2015. Patch Instructions: To install this openSUSE Security Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE Leap 42.1: zypper in -t patch openSUSE-2016-1022=1 - openSUSE 13.2: zypper in -t patch openSUSE-2016-1022=1 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE Leap 42.1 (noarch): typo3-cms-4_5-4.5.40-7.1 - openSUSE 13.2 (noarch): typo3-cms-4_5-4.5.40-2.3.1 References: https://www.suse.com/security/cve/CVE-2013-7073.html https://www.suse.com/security/cve/CVE-2014-9508.html https://www.suse.com/security/cve/CVE-2015-2047.html

1 0

openSUSE-SU-2016:2168-1: important: Security update for phpMyAdmin
by opensuse-security＠opensuse.org 29 Aug '16

29 Aug '16

openSUSE Security Update: Security update for phpMyAdmin ______________________________________________________________________________ Announcement ID: openSUSE-SU-2016:2168-1 Rating: important References: #994313 Cross-References: CVE-2016-6606 CVE-2016-6607 CVE-2016-6608 CVE-2016-6609 CVE-2016-6610 CVE-2016-6611 CVE-2016-6612 CVE-2016-6613 CVE-2016-6614 CVE-2016-6615 CVE-2016-6616 CVE-2016-6617 CVE-2016-6618 CVE-2016-6619 CVE-2016-6620 CVE-2016-6621 CVE-2016-6622 CVE-2016-6623 CVE-2016-6624 CVE-2016-6625 CVE-2016-6626 CVE-2016-6627 CVE-2016-6628 CVE-2016-6629 CVE-2016-6630 CVE-2016-6631 CVE-2016-6632 CVE-2016-6633 Affected Products: openSUSE Leap 42.1 openSUSE 13.2 ______________________________________________________________________________ An update that fixes 28 vulnerabilities is now available. Description: phpMyAdmin was updated to version 4.4.15.8 (2016-08-16) to fix the following issues: - Upstream changelog for 4.4.15.8: * Improve session cookie code for openid.php and signon.php example files * Full path disclosure in openid.php and signon.php example files * Unsafe generation of BlowfishSecret (when not supplied by the user) * Referrer leak when phpinfo is enabled * Use HTTPS for wiki links * Improve SSL certificate handling * Fix full path disclosure in debugging code * Administrators could trigger SQL injection attack against users - other fixes * Remove Swekey support - Security fixes: https://www.phpmyadmin.net/security/ * Weaknesses with cookie encryption see PMASA-2016-29 (CVE-2016-6606, CWE-661) * Multiple XSS vulnerabilities see PMASA-2016-30 (CVE-2016-6607, CWE-661) * Multiple XSS vulnerabilities see PMASA-2016-31 (CVE-2016-6608, CWE-661) * PHP code injection see PMASA-2016-32 (CVE-2016-6609, CWE-661) * Full path disclosure see PMASA-2016-33 (CVE-2016-6610, CWE-661) * SQL injection attack see PMASA-2016-34 (CVE-2016-6611, CWE-661) * Local file exposure through LOAD DATA LOCAL INFILE see PMASA-2016-35 (CVE-2016-6612, CWE-661) * Local file exposure through symlinks with UploadDir see PMASA-2016-36 (CVE-2016-6613, CWE-661) * Path traversal with SaveDir and UploadDir see PMASA-2016-37 (CVE-2016-6614, CWE-661) * Multiple XSS vulnerabilities see PMASA-2016-38 (CVE-2016-6615, CWE-661) * SQL injection vulnerability as control user see PMASA-2016-39 (CVE-2016-6616, CWE-661) * SQL injection vulnerability see PMASA-2016-40 (CVE-2016-6617, CWE-661) * Denial-of-service attack through transformation feature see PMASA-2016-41 (CVE-2016-6618, CWE-661) * SQL injection vulnerability as control user see PMASA-2016-42 (CVE-2016-6619, CWE-661) * Verify data before unserializing see PMASA-2016-43 (CVE-2016-6620, CWE-661) * SSRF in setup script see PMASA-2016-44 (CVE-2016-6621, CWE-661) * Denial-of-service attack with $cfg['AllowArbitraryServer'] = true and persistent connections see PMASA-2016-45 (CVE-2016-6622, CWE-661) * Denial-of-service attack by using for loops see PMASA-2016-46 (CVE-2016-6623, CWE-661) * Possible circumvention of IP-based allow/deny rules with IPv6 and proxy server see PMASA-2016-47 (CVE-2016-6624, CWE-661) * Detect if user is logged in see PMASA-2016-48 (CVE-2016-6625, CWE-661) * Bypass URL redirection protection see PMASA-2016-49 (CVE-2016-6626, CWE-661) * Referrer leak see PMASA-2016-50 (CVE-2016-6627, CWE-661) * Reflected File Download see PMASA-2016-51 (CVE-2016-6628, CWE-661) * ArbitraryServerRegexp bypass see PMASA-2016-52 (CVE-2016-6629, CWE-661) * Denial-of-service attack by entering long password see PMASA-2016-53 (CVE-2016-6630, CWE-661) * Remote code execution vulnerability when running as CGI see PMASA-2016-54 (CVE-2016-6631, CWE-661) * Denial-of-service attack when PHP uses dbase extension see PMASA-2016-55 (CVE-2016-6632, CWE-661) * Remove tode execution vulnerability when PHP uses dbase extension see PMASA-2016-56 (CVE-2016-6633, CWE-661) Patch Instructions: To install this openSUSE Security Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE Leap 42.1: zypper in -t patch openSUSE-2016-1021=1 - openSUSE 13.2: zypper in -t patch openSUSE-2016-1021=1 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE Leap 42.1 (noarch): phpMyAdmin-4.4.15.8-25.1 - openSUSE 13.2 (noarch): phpMyAdmin-4.4.15.8-39.1 References: https://www.suse.com/security/cve/CVE-2016-6606.html https://www.suse.com/security/cve/CVE-2016-6607.html https://www.suse.com/security/cve/CVE-2016-6608.html https://www.suse.com/security/cve/CVE-2016-6609.html https://www.suse.com/security/cve/CVE-2016-6610.html https://www.suse.com/security/cve/CVE-2016-6611.html https://www.suse.com/security/cve/CVE-2016-6612.html https://www.suse.com/security/cve/CVE-2016-6613.html https://www.suse.com/security/cve/CVE-2016-6614.html https://www.suse.com/security/cve/CVE-2016-6615.html https://www.suse.com/security/cve/CVE-2016-6616.html https://www.suse.com/security/cve/CVE-2016-6617.html https://www.suse.com/security/cve/CVE-2016-6618.html https://www.suse.com/security/cve/CVE-2016-6619.html https://www.suse.com/security/cve/CVE-2016-6620.html https://www.suse.com/security/cve/CVE-2016-6621.html https://www.suse.com/security/cve/CVE-2016-6622.html https://www.suse.com/security/cve/CVE-2016-6623.html https://www.suse.com/security/cve/CVE-2016-6624.html https://www.suse.com/security/cve/CVE-2016-6625.html https://www.suse.com/security/cve/CVE-2016-6626.html https://www.suse.com/security/cve/CVE-2016-6627.html https://www.suse.com/security/cve/CVE-2016-6628.html https://www.suse.com/security/cve/CVE-2016-6629.html https://www.suse.com/security/cve/CVE-2016-6630.html https://www.suse.com/security/cve/CVE-2016-6631.html https://www.suse.com/security/cve/CVE-2016-6632.html https://www.suse.com/security/cve/CVE-2016-6633.html https://bugzilla.suse.com/994313

1 0

openSUSE-SU-2016:2167-1: moderate: Security update for Firefox
by opensuse-security＠opensuse.org 27 Aug '16

27 Aug '16

openSUSE Security Update: Security update for Firefox ______________________________________________________________________________ Announcement ID: openSUSE-SU-2016:2167-1 Rating: moderate References: #990856 #992236 Cross-References: CVE-2016-6354 Affected Products: openSUSE 13.1 ______________________________________________________________________________ An update that solves one vulnerability and has one errata is now available. Description: This update includes Firefox 48.0.1 to fix a few regressions and a security issue: * Fix an audio regression impacting some major websites * Fix a top crash in the JavaScript engine * Fix a startup crash issue caused by Websense * Fix a different behavior with e10s / non-e10s on select and mouse events * Fix a top crash caused by plugin issues * Fix a shutdown issue * Fix a crash in WebRTC - added upstream patch so system plugins/extensions are correctly loaded again on x86-64 - Fix for possible buffer overrun Patch Instructions: To install this openSUSE Security Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE 13.1: zypper in -t patch 2016-1019=1 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE 13.1 (i586 x86_64): MozillaFirefox-48.0.1-122.3 MozillaFirefox-branding-upstream-48.0.1-122.3 MozillaFirefox-buildsymbols-48.0.1-122.3 MozillaFirefox-debuginfo-48.0.1-122.3 MozillaFirefox-debugsource-48.0.1-122.3 MozillaFirefox-devel-48.0.1-122.3 MozillaFirefox-translations-common-48.0.1-122.3 MozillaFirefox-translations-other-48.0.1-122.3 libfreebl3-3.24-88.1 libfreebl3-debuginfo-3.24-88.1 libsoftokn3-3.24-88.1 libsoftokn3-debuginfo-3.24-88.1 mozilla-nss-3.24-88.1 mozilla-nss-certs-3.24-88.1 mozilla-nss-certs-debuginfo-3.24-88.1 mozilla-nss-debuginfo-3.24-88.1 mozilla-nss-debugsource-3.24-88.1 mozilla-nss-devel-3.24-88.1 mozilla-nss-sysinit-3.24-88.1 mozilla-nss-sysinit-debuginfo-3.24-88.1 mozilla-nss-tools-3.24-88.1 mozilla-nss-tools-debuginfo-3.24-88.1 - openSUSE 13.1 (x86_64): libfreebl3-32bit-3.24-88.1 libfreebl3-debuginfo-32bit-3.24-88.1 libsoftokn3-32bit-3.24-88.1 libsoftokn3-debuginfo-32bit-3.24-88.1 mozilla-nss-32bit-3.24-88.1 mozilla-nss-certs-32bit-3.24-88.1 mozilla-nss-certs-debuginfo-32bit-3.24-88.1 mozilla-nss-debuginfo-32bit-3.24-88.1 mozilla-nss-sysinit-32bit-3.24-88.1 mozilla-nss-sysinit-debuginfo-32bit-3.24-88.1 References: https://www.suse.com/security/cve/CVE-2016-6354.html https://bugzilla.suse.com/990856 https://bugzilla.suse.com/992236

1 0

openSUSE-RU-2016:2166-1: update for libqt5-qttools
by maintenance＠opensuse.org 27 Aug '16

27 Aug '16

openSUSE Recommended Update: update for libqt5-qttools ______________________________________________________________________________ Announcement ID: openSUSE-RU-2016:2166-1 Rating: low References: Affected Products: openSUSE 13.1 ______________________________________________________________________________ An update that has 0 recommended fixes can now be installed. Description: Update to fix the following issue: - lupdate-qt5/lrelease-qt5 can't find qmake configuration file "default". Patch Instructions: To install this openSUSE Recommended Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE 13.1: zypper in -t patch 2016-1020=1 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE 13.1 (i586 x86_64): libqt5-qttools-5.1.1-3.3 libqt5-qttools-debuginfo-5.1.1-3.3 libqt5-qttools-debugsource-5.1.1-3.3 libqt5-qttools-devel-5.1.1-3.3 libqt5-qttools-private-headers-devel-5.1.1-3.3 References:

1 0

openSUSE-RU-2016:2165-1: moderate: bugfix for rpm package
by maintenance＠opensuse.org 27 Aug '16

27 Aug '16

openSUSE Recommended Update: bugfix for rpm package ______________________________________________________________________________ Announcement ID: openSUSE-RU-2016:2165-1 Rating: moderate References: #894107 Affected Products: openSUSE 13.1 ______________________________________________________________________________ An update that has one recommended fix can now be installed. Description: This rpm update fixes an issue related to the suse_macro "%restart_on_update". issue fixed: update of phpMyAdmin tries to execute deprecated /etc/init.d/apache2 Patch Instructions: To install this openSUSE Recommended Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE 13.1: zypper in -t patch 2016-1018=1 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE 13.1 (i586 x86_64): python3-rpm-4.11.1-6.20.1 python3-rpm-debuginfo-4.11.1-6.20.1 python3-rpm-debugsource-4.11.1-6.20.1 rpm-4.11.1-6.20.1 rpm-build-4.11.1-6.20.1 rpm-build-debuginfo-4.11.1-6.20.1 rpm-debuginfo-4.11.1-6.20.1 rpm-debugsource-4.11.1-6.20.1 rpm-devel-4.11.1-6.20.1 rpm-python-4.11.1-6.20.1 rpm-python-debuginfo-4.11.1-6.20.1 rpm-python-debugsource-4.11.1-6.20.1 - openSUSE 13.1 (x86_64): rpm-32bit-4.11.1-6.20.1 rpm-debuginfo-32bit-4.11.1-6.20.1 References: https://bugzilla.suse.com/894107

1 0

openSUSE-RU-2016:2153-1: moderate: Recommended update for findutils
by maintenance＠opensuse.org 25 Aug '16

25 Aug '16

openSUSE Recommended Update: Recommended update for findutils ______________________________________________________________________________ Announcement ID: openSUSE-RU-2016:2153-1 Rating: moderate References: #986935 Affected Products: openSUSE Leap 42.1 ______________________________________________________________________________ An update that has one recommended fix can now be installed. Description: This update for findutils fixes the following issues: - find -exec + would not pass all arguments for certain specific filename lengths (bsc#986935) This update was imported from the SUSE:SLE-12:Update update project. Patch Instructions: To install this openSUSE Recommended Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE Leap 42.1: zypper in -t patch openSUSE-2016-1017=1 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE Leap 42.1 (i586 x86_64): findutils-4.5.12-10.1 findutils-debuginfo-4.5.12-10.1 findutils-debugsource-4.5.12-10.1 - openSUSE Leap 42.1 (noarch): findutils-lang-4.5.12-10.1 References: https://bugzilla.suse.com/986935

1 0

openSUSE-SU-2016:2148-1: moderate: Security update for ImageMagick
by opensuse-security＠opensuse.org 24 Aug '16

24 Aug '16

openSUSE Security Update: Security update for ImageMagick ______________________________________________________________________________ Announcement ID: openSUSE-SU-2016:2148-1 Rating: moderate References: #991444 #991445 #991872 Cross-References: CVE-2016-5010 CVE-2016-6491 CVE-2016-6520 Affected Products: openSUSE Leap 42.1 ______________________________________________________________________________ An update that fixes three vulnerabilities is now available. Description: This update for ImageMagick fixes the following issues: - security update: * CVE-2016-6520: buffer overflow [bsc#991872] * CVE-2016-5010: Out-of-bounds read in CopyMagickMemory [bsc#991444] * CVE-2016-6491: Out-of-bounds read when processing crafted tiff files [bsc#991445] This update was imported from the SUSE:SLE-12:Update update project. Patch Instructions: To install this openSUSE Security Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE Leap 42.1: zypper in -t patch openSUSE-2016-1016=1 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE Leap 42.1 (i586 x86_64): ImageMagick-6.8.8.1-18.2 ImageMagick-debuginfo-6.8.8.1-18.2 ImageMagick-debugsource-6.8.8.1-18.2 ImageMagick-devel-6.8.8.1-18.2 ImageMagick-extra-6.8.8.1-18.2 ImageMagick-extra-debuginfo-6.8.8.1-18.2 libMagick++-6_Q16-3-6.8.8.1-18.2 libMagick++-6_Q16-3-debuginfo-6.8.8.1-18.2 libMagick++-devel-6.8.8.1-18.2 libMagickCore-6_Q16-1-6.8.8.1-18.2 libMagickCore-6_Q16-1-debuginfo-6.8.8.1-18.2 libMagickWand-6_Q16-1-6.8.8.1-18.2 libMagickWand-6_Q16-1-debuginfo-6.8.8.1-18.2 perl-PerlMagick-6.8.8.1-18.2 perl-PerlMagick-debuginfo-6.8.8.1-18.2 - openSUSE Leap 42.1 (x86_64): ImageMagick-devel-32bit-6.8.8.1-18.2 libMagick++-6_Q16-3-32bit-6.8.8.1-18.2 libMagick++-6_Q16-3-debuginfo-32bit-6.8.8.1-18.2 libMagick++-devel-32bit-6.8.8.1-18.2 libMagickCore-6_Q16-1-32bit-6.8.8.1-18.2 libMagickCore-6_Q16-1-debuginfo-32bit-6.8.8.1-18.2 libMagickWand-6_Q16-1-32bit-6.8.8.1-18.2 libMagickWand-6_Q16-1-debuginfo-32bit-6.8.8.1-18.2 - openSUSE Leap 42.1 (noarch): ImageMagick-doc-6.8.8.1-18.2 References: https://www.suse.com/security/cve/CVE-2016-5010.html https://www.suse.com/security/cve/CVE-2016-6491.html https://www.suse.com/security/cve/CVE-2016-6520.html https://bugzilla.suse.com/991444 https://bugzilla.suse.com/991445 https://bugzilla.suse.com/991872

1 0

openSUSE-SU-2016:2144-1: important: Security update for the Linux Kernel
by opensuse-security＠opensuse.org 24 Aug '16

24 Aug '16

openSUSE Security Update: Security update for the Linux Kernel ______________________________________________________________________________ Announcement ID: openSUSE-SU-2016:2144-1 Rating: important References: #901754 #941113 #942702 #945219 #955654 #957052 #957988 #959709 #960561 #961512 #963762 #963765 #966245 #966437 #966693 #966849 #967972 #967973 #967974 #967975 #968010 #968011 #968012 #968013 #968018 #968670 #969354 #969355 #970114 #970275 #970892 #970909 #970911 #970948 #970955 #970956 #970958 #970970 #971124 #971125 #971126 #971360 #971628 #971799 #971919 #971944 #972174 #973378 #973570 #974308 #974418 #974646 #975945 #978401 #978445 #978469 #978821 #978822 #979021 #979213 #979548 #979867 #979879 #979913 #980348 #980363 #980371 #980725 #981267 #982706 #983143 #983213 #984464 #984755 #984764 #986362 #986365 #986377 #986572 #986573 #986811 Cross-References: CVE-2012-6701 CVE-2013-7446 CVE-2014-9904 CVE-2015-3288 CVE-2015-6526 CVE-2015-7566 CVE-2015-8709 CVE-2015-8785 CVE-2015-8812 CVE-2015-8816 CVE-2015-8830 CVE-2016-0758 CVE-2016-1583 CVE-2016-2053 CVE-2016-2184 CVE-2016-2185 CVE-2016-2186 CVE-2016-2187 CVE-2016-2188 CVE-2016-2384 CVE-2016-2543 CVE-2016-2544 CVE-2016-2545 CVE-2016-2546 CVE-2016-2547 CVE-2016-2548 CVE-2016-2549 CVE-2016-2782 CVE-2016-2847 CVE-2016-3134 CVE-2016-3136 CVE-2016-3137 CVE-2016-3138 CVE-2016-3139 CVE-2016-3140 CVE-2016-3156 CVE-2016-3672 CVE-2016-3689 CVE-2016-3951 CVE-2016-4470 CVE-2016-4482 CVE-2016-4485 CVE-2016-4486 CVE-2016-4565 CVE-2016-4569 CVE-2016-4578 CVE-2016-4580 CVE-2016-4581 CVE-2016-4805 CVE-2016-4913 CVE-2016-4997 CVE-2016-5244 CVE-2016-5829 Affected Products: openSUSE 13.2 ______________________________________________________________________________ An update that solves 53 vulnerabilities and has 28 fixes is now available. Description: The openSUSE 13.2 kernel was updated to fix various bugs and security issues. The following security bugs were fixed: - CVE-2016-1583: Prevent the usage of mmap when the lower file system does not allow it. This could have lead to local privilege escalation when ecryptfs-utils was installed and /sbin/mount.ecryptfs_private was setuid (bsc#983143). - CVE-2016-4913: The get_rock_ridge_filename function in fs/isofs/rock.c in the Linux kernel mishandles NM (aka alternate name) entries containing \0 characters, which allowed local users to obtain sensitive information from kernel memory or possibly have unspecified other impact via a crafted isofs filesystem (bnc#980725). - CVE-2016-4580: The x25_negotiate_facilities function in net/x25/x25_facilities.c in the Linux kernel did not properly initialize a certain data structure, which allowed attackers to obtain sensitive information from kernel stack memory via an X.25 Call Request (bnc#981267). - CVE-2016-0758: Tags with indefinite length could have corrupted pointers in asn1_find_indefinite_length (bsc#979867). - CVE-2016-2053: The asn1_ber_decoder function in lib/asn1_decoder.c in the Linux kernel allowed attackers to cause a denial of service (panic) via an ASN.1 BER file that lacks a public key, leading to mishandling by the public_key_verify_signature function in crypto/asymmetric_keys/public_key.c (bnc#963762). - CVE-2016-2187: The gtco_probe function in drivers/input/tablet/gtco.c in the Linux kernel allowed physically proximate attackers to cause a denial of service (NULL pointer dereference and system crash) via a crafted endpoints value in a USB device descriptor (bnc#971919 971944). - CVE-2016-4482: The proc_connectinfo function in drivers/usb/core/devio.c in the Linux kernel did not initialize a certain data structure, which allowed local users to obtain sensitive information from kernel stack memory via a crafted USBDEVFS_CONNECTINFO ioctl call (bnc#978401 bsc#978445). - CVE-2016-4565: The InfiniBand (aka IB) stack in the Linux kernel incorrectly relies on the write system call, which allowed local users to cause a denial of service (kernel memory write operation) or possibly have unspecified other impact via a uAPI interface (bnc#979548 bsc#980363). - CVE-2016-3672: The arch_pick_mmap_layout function in arch/x86/mm/mmap.c in the Linux kernel did not properly randomize the legacy base address, which made it easier for local users to defeat the intended restrictions on the ADDR_NO_RANDOMIZE flag, and bypass the ASLR protection mechanism for a setuid or setgid program, by disabling stack-consumption resource limits (bnc#974308). - CVE-2016-4581: fs/pnode.c in the Linux kernel did not properly traverse a mount propagation tree in a certain case involving a slave mount, which allowed local users to cause a denial of service (NULL pointer dereference and OOPS) via a crafted series of mount system calls (bnc#979913). - CVE-2016-4485: The llc_cmsg_rcv function in net/llc/af_llc.c in the Linux kernel did not initialize a certain data structure, which allowed attackers to obtain sensitive information from kernel stack memory by reading a message (bnc#978821). - CVE-2015-3288: A security flaw was found in the Linux kernel that there was a way to arbitrary change zero page memory. (bnc#979021). - CVE-2016-4578: sound/core/timer.c in the Linux kernel did not initialize certain r1 data structures, which allowed local users to obtain sensitive information from kernel stack memory via crafted use of the ALSA timer interface, related to the (1) snd_timer_user_ccallback and (2) snd_timer_user_tinterrupt functions (bnc#979879). - CVE-2016-3134: The netfilter subsystem in the Linux kernel did not validate certain offset fields, which allowed local users to gain privileges or cause a denial of service (heap memory corruption) via an IPT_SO_SET_REPLACE setsockopt call (bnc#971126). - CVE-2016-4486: The rtnl_fill_link_ifmap function in net/core/rtnetlink.c in the Linux kernel did not initialize a certain data structure, which allowed local users to obtain sensitive information from kernel stack memory by reading a Netlink message (bnc#978822). - CVE-2013-7446: Use-after-free vulnerability in net/unix/af_unix.c in the Linux kernel allowed local users to bypass intended AF_UNIX socket permissions or cause a denial of service (panic) via crafted epoll_ctl calls (bnc#955654). - CVE-2016-4569: The snd_timer_user_params function in sound/core/timer.c in the Linux kernel did not initialize a certain data structure, which allowed local users to obtain sensitive information from kernel stack memory via crafted use of the ALSA timer interface (bnc#979213). - CVE-2016-2847: fs/pipe.c in the Linux kernel did not limit the amount of unread data in pipes, which allowed local users to cause a denial of service (memory consumption) by creating many pipes with non-default sizes (bnc#970948 974646). - CVE-2016-3136: The mct_u232_msr_to_state function in drivers/usb/serial/mct_u232.c in the Linux kernel allowed physically proximate attackers to cause a denial of service (NULL pointer dereference and system crash) via a crafted USB device without two interrupt-in endpoint descriptors (bnc#970955). - CVE-2016-2188: The iowarrior_probe function in drivers/usb/misc/iowarrior.c in the Linux kernel allowed physically proximate attackers to cause a denial of service (NULL pointer dereference and system crash) via a crafted endpoints value in a USB device descriptor (bnc#970956). - CVE-2016-3138: The acm_probe function in drivers/usb/class/cdc-acm.c in the Linux kernel allowed physically proximate attackers to cause a denial of service (NULL pointer dereference and system crash) via a USB device without both a control and a data endpoint descriptor (bnc#970911). - CVE-2016-3137: drivers/usb/serial/cypress_m8.c in the Linux kernel allowed physically proximate attackers to cause a denial of service (NULL pointer dereference and system crash) via a USB device without both an interrupt-in and an interrupt-out endpoint descriptor, related to the cypress_generic_port_probe and cypress_open functions (bnc#970970). - CVE-2016-3951: Double free vulnerability in drivers/net/usb/cdc_ncm.c in the Linux kernel allowed physically proximate attackers to cause a denial of service (system crash) or possibly have unspecified other impact by inserting a USB device with an invalid USB descriptor (bnc#974418). - CVE-2016-3140: The digi_port_init function in drivers/usb/serial/digi_acceleport.c in the Linux kernel allowed physically proximate attackers to cause a denial of service (NULL pointer dereference and system crash) via a crafted endpoints value in a USB device descriptor (bnc#970892). - CVE-2016-2186: The powermate_probe function in drivers/input/misc/powermate.c in the Linux kernel allowed physically proximate attackers to cause a denial of service (NULL pointer dereference and system crash) via a crafted endpoints value in a USB device descriptor (bnc#970958). - CVE-2016-2185: The ati_remote2_probe function in drivers/input/misc/ati_remote2.c in the Linux kernel allowed physically proximate attackers to cause a denial of service (NULL pointer dereference and system crash) via a crafted endpoints value in a USB device descriptor (bnc#971124). - CVE-2016-3689: The ims_pcu_parse_cdc_data function in drivers/input/misc/ims-pcu.c in the Linux kernel allowed physically proximate attackers to cause a denial of service (system crash) via a USB device without both a master and a slave interface (bnc#971628). - CVE-2016-3156: The IPv4 implementation in the Linux kernel mishandles destruction of device objects, which allowed guest OS users to cause a denial of service (host OS networking outage) by arranging for a large number of IP addresses (bnc#971360). - CVE-2016-2184: The create_fixed_stream_quirk function in sound/usb/quirks.c in the snd-usb-audio driver in the Linux kernel allowed physically proximate attackers to cause a denial of service (NULL pointer dereference or double free, and system crash) via a crafted endpoints value in a USB device descriptor (bnc#971125). - CVE-2016-3139: The wacom_probe function in drivers/input/tablet/wacom_sys.c in the Linux kernel allowed physically proximate attackers to cause a denial of service (NULL pointer dereference and system crash) via a crafted endpoints value in a USB device descriptor (bnc#970909). - CVE-2015-8830: Integer overflow in the aio_setup_single_vector function in fs/aio.c in the Linux kernel 4.0 allowed local users to cause a denial of service or possibly have unspecified other impact via a large AIO iovec. NOTE: this vulnerability exists because of a CVE-2012-6701 regression (bnc#969354 bsc#969355). - CVE-2016-2782: The treo_attach function in drivers/usb/serial/visor.c in the Linux kernel allowed physically proximate attackers to cause a denial of service (NULL pointer dereference and system crash) or possibly have unspecified other impact by inserting a USB device that lacks a (1) bulk-in or (2) interrupt-in endpoint (bnc#968670). - CVE-2015-8816: The hub_activate function in drivers/usb/core/hub.c in the Linux kernel did not properly maintain a hub-interface data structure, which allowed physically proximate attackers to cause a denial of service (invalid memory access and system crash) or possibly have unspecified other impact by unplugging a USB hub device (bnc#968010). - CVE-2015-7566: The clie_5_attach function in drivers/usb/serial/visor.c in the Linux kernel allowed physically proximate attackers to cause a denial of service (NULL pointer dereference and system crash) or possibly have unspecified other impact by inserting a USB device that lacks a bulk-out endpoint (bnc#961512). - CVE-2016-2549: sound/core/hrtimer.c in the Linux kernel did not prevent recursive callback access, which allowed local users to cause a denial of service (deadlock) via a crafted ioctl call (bnc#968013). - CVE-2016-2547: sound/core/timer.c in the Linux kernel employs a locking approach that did not consider slave timer instances, which allowed local users to cause a denial of service (race condition, use-after-free, and system crash) via a crafted ioctl call (bnc#968011). - CVE-2016-2548: sound/core/timer.c in the Linux kernel retains certain linked lists after a close or stop action, which allowed local users to cause a denial of service (system crash) via a crafted ioctl call, related to the (1) snd_timer_close and (2) _snd_timer_stop functions (bnc#968012). - CVE-2016-2546: sound/core/timer.c in the Linux kernel uses an incorrect type of mutex, which allowed local users to cause a denial of service (race condition, use-after-free, and system crash) via a crafted ioctl call (bnc#967975). - CVE-2016-2545: The snd_timer_interrupt function in sound/core/timer.c in the Linux kernel did not properly maintain a certain linked list, which allowed local users to cause a denial of service (race condition and system crash) via a crafted ioctl call (bnc#967974). - CVE-2016-2544: Race condition in the queue_delete function in sound/core/seq/seq_queue.c in the Linux kernel allowed local users to cause a denial of service (use-after-free and system crash) by making an ioctl call at a certain time (bnc#967973). - CVE-2016-2543: The snd_seq_ioctl_remove_events function in sound/core/seq/seq_clientmgr.c in the Linux kernel did not verify FIFO assignment before proceeding with FIFO clearing, which allowed local users to cause a denial of service (NULL pointer dereference and OOPS) via a crafted ioctl call (bnc#967972). - CVE-2015-8709: ** DISPUTED ** kernel/ptrace.c in the Linux kernel mishandles uid and gid mappings, which allowed local users to gain privileges by establishing a user namespace, waiting for a root process to enter that namespace with an unsafe uid or gid, and then using the ptrace system call. NOTE: the vendor states "there is no kernel bug here (bnc#959709 960561 ). - CVE-2015-8812: drivers/infiniband/hw/cxgb3/iwch_cm.c in the Linux kernel did not properly identify error conditions, which allowed remote attackers to execute arbitrary code or cause a denial of service (use-after-free) via crafted packets (bnc#966437). - CVE-2016-2384: Double free vulnerability in the snd_usbmidi_create function in sound/usb/midi.c in the Linux kernel allowed physically proximate attackers to cause a denial of service (panic) or possibly have unspecified other impact via vectors involving an invalid USB descriptor (bnc#966693). - CVE-2015-8785: The fuse_fill_write_pages function in fs/fuse/file.c in the Linux kernel allowed local users to cause a denial of service (infinite loop) via a writev system call that triggers a zero length for the first segment of an iov (bnc#963765). - CVE-2014-9904: The snd_compress_check_input function in sound/core/compress_offload.c in the ALSA subsystem in the Linux kernel did not properly check for an integer overflow, which allowed local users to cause a denial of service (insufficient memory allocation) or possibly have unspecified other impact via a crafted SNDRV_COMPRESS_SET_PARAMS ioctl call (bnc#986811). - CVE-2016-5829: Multiple heap-based buffer overflows in the hiddev_ioctl_usage function in drivers/hid/usbhid/hiddev.c in the Linux kernel allow local users to cause a denial of service or possibly have unspecified other impact via a crafted (1) HIDIOCGUSAGES or (2) HIDIOCSUSAGES ioctl call (bnc#986572 986573). - CVE-2016-4997: The compat IPT_SO_SET_REPLACE setsockopt implementation in the netfilter subsystem in the Linux kernel allowed local users to gain privileges or cause a denial of service (memory corruption) by leveraging in-container root access to provide a crafted offset value that triggers an unintended decrement (bnc#986362 986365 986377). - CVE-2016-4805: Use-after-free vulnerability in drivers/net/ppp/ppp_generic.c in the Linux kernel allowed local users to cause a denial of service (memory corruption and system crash, or spinlock) or possibly have unspecified other impact by removing a network namespace, related to the ppp_register_net_channel and ppp_unregister_channel functions (bnc#980371). - CVE-2016-4470: The key_reject_and_link function in security/keys/key.c in the Linux kernel did not ensure that a certain data structure is initialized, which allowed local users to cause a denial of service (system crash) via vectors involving a crafted keyctl request2 command (bnc#984755 984764). - CVE-2015-6526: The perf_callchain_user_64 function in arch/powerpc/perf/callchain.c in the Linux kernel on ppc64 platforms allowed local users to cause a denial of service (infinite loop) via a deep 64-bit userspace backtrace (bnc#942702). - CVE-2016-5244: The rds_inc_info_copy function in net/rds/recv.c in the Linux kernel did not initialize a certain structure member, which allowed remote attackers to obtain sensitive information from kernel stack memory by reading an RDS message (bnc#983213). The following non-security bugs were fixed: - ALSA: hrtimer: Handle start/stop more properly (bsc#973378). - ALSA: pcm: Fix potential deadlock in OSS emulation (bsc#968018). - ALSA: rawmidi: Fix race at copying & updating the position (bsc#968018). - ALSA: rawmidi: Make snd_rawmidi_transmit() race-free (bsc#968018). - ALSA: seq: Fix double port list deletion (bsc#968018). - ALSA: seq: Fix incorrect sanity check at snd_seq_oss_synth_cleanup() (bsc#968018). - ALSA: seq: Fix leak of pool buffer at concurrent writes (bsc#968018). - ALSA: seq: Fix lockdep warnings due to double mutex locks (bsc#968018). - ALSA: seq: Fix race at closing in virmidi driver (bsc#968018). - ALSA: seq: Fix yet another races among ALSA timer accesses (bsc#968018). - ALSA: timer: Call notifier in the same spinlock (bsc#973378). - ALSA: timer: Code cleanup (bsc#968018). - ALSA: timer: Fix leftover link at closing (bsc#968018). - ALSA: timer: Fix link corruption due to double start or stop (bsc#968018). - ALSA: timer: Fix race between stop and interrupt (bsc#968018). - ALSA: timer: Fix wrong instance passed to slave callbacks (bsc#968018). - ALSA: timer: Protect the whole snd_timer_close() with open race (bsc#973378). - ALSA: timer: Sync timer deletion at closing the system timer (bsc#973378). - ALSA: timer: Use mod_timer() for rearming the system timer (bsc#973378). - Bluetooth: vhci: Fix race at creating hci device (bsc#971799,bsc#966849). - Bluetooth: vhci: fix open_timeout vs. hdev race (bsc#971799,bsc#966849). - Bluetooth: vhci: purge unhandled skbs (bsc#971799,bsc#966849). - Btrfs: do not use src fd for printk (bsc#980348). - Refresh patches.drivers/ALSA-hrtimer-Handle-start-stop-more-properly. Fix the build error on 32bit architectures. - Refresh patches.xen/xen-netback-coalesce: Restore copying of SKBs with head exceeding page size (bsc#978469). - Refresh patches.xen/xen3-patch-3.14: Suppress atomic file position updates on /proc/xen/xenbus (bsc#970275). - Subject: [PATCH] USB: xhci: Add broken streams quirk for Frescologic device id 1009 (bnc#982706). - USB: usbip: fix potential out-of-bounds write (bnc#975945). - af_unix: Guard against other == sk in unix_dgram_sendmsg (bsc#973570). - backends: guarantee one time reads of shared ring contents (bsc#957988). - btrfs: do not go readonly on existing qgroup items (bsc#957052). - btrfs: remove error message from search ioctl for nonexistent tree. - drm/i915: Fix missing backlight update during panel disablement (bsc#941113 boo#901754). - enic: set netdev->vlan_features (bsc#966245). - ext4: fix races between buffered IO and collapse / insert range (bsc#972174). - ext4: fix races between page faults and hole punching (bsc#972174). - ext4: fix races of writeback with punch hole and zero range (bsc#972174). - ext4: move unlocked dio protection from ext4_alloc_file_blocks() (bsc#972174). - ipv4/fib: do not warn when primary address is missing if in_dev is dead (bsc#971360). - ipvs: count pre-established TCP states as active (bsc#970114). - net: core: Correct an over-stringent device loop detection (bsc#945219). - netback: do not use last request to determine minimum Tx credit (bsc#957988). - pciback: Check PF instead of VF for PCI_COMMAND_MEMORY. - pciback: Save the number of MSI-X entries to be copied later. - pciback: guarantee one time reads of shared ring contents (bsc#957988). - series.conf: move cxgb3 patch to network drivers section - usb: quirk to stop runtime PM for Intel 7260 (bnc#984464). - x86: standardize mmap_rnd() usage (bnc#974308). Patch Instructions: To install this openSUSE Security Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE 13.2: zypper in -t patch openSUSE-2016-1015=1 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE 13.2 (i586 x86_64): bbswitch-0.8-3.20.3 bbswitch-debugsource-0.8-3.20.3 bbswitch-kmp-default-0.8_k3.16.7_42-3.20.3 bbswitch-kmp-default-debuginfo-0.8_k3.16.7_42-3.20.3 bbswitch-kmp-desktop-0.8_k3.16.7_42-3.20.3 bbswitch-kmp-desktop-debuginfo-0.8_k3.16.7_42-3.20.3 bbswitch-kmp-xen-0.8_k3.16.7_42-3.20.3 bbswitch-kmp-xen-debuginfo-0.8_k3.16.7_42-3.20.3 cloop-2.639-14.20.3 cloop-debuginfo-2.639-14.20.3 cloop-debugsource-2.639-14.20.3 cloop-kmp-default-2.639_k3.16.7_42-14.20.3 cloop-kmp-default-debuginfo-2.639_k3.16.7_42-14.20.3 cloop-kmp-desktop-2.639_k3.16.7_42-14.20.3 cloop-kmp-desktop-debuginfo-2.639_k3.16.7_42-14.20.3 cloop-kmp-xen-2.639_k3.16.7_42-14.20.3 cloop-kmp-xen-debuginfo-2.639_k3.16.7_42-14.20.3 crash-7.0.8-20.3 crash-debuginfo-7.0.8-20.3 crash-debugsource-7.0.8-20.3 crash-devel-7.0.8-20.3 crash-doc-7.0.8-20.3 crash-eppic-7.0.8-20.3 crash-eppic-debuginfo-7.0.8-20.3 crash-gcore-7.0.8-20.3 crash-gcore-debuginfo-7.0.8-20.3 crash-kmp-default-7.0.8_k3.16.7_42-20.3 crash-kmp-default-debuginfo-7.0.8_k3.16.7_42-20.3 crash-kmp-desktop-7.0.8_k3.16.7_42-20.3 crash-kmp-desktop-debuginfo-7.0.8_k3.16.7_42-20.3 crash-kmp-xen-7.0.8_k3.16.7_42-20.3 crash-kmp-xen-debuginfo-7.0.8_k3.16.7_42-20.3 hdjmod-debugsource-1.28-18.21.3 hdjmod-kmp-default-1.28_k3.16.7_42-18.21.3 hdjmod-kmp-default-debuginfo-1.28_k3.16.7_42-18.21.3 hdjmod-kmp-desktop-1.28_k3.16.7_42-18.21.3 hdjmod-kmp-desktop-debuginfo-1.28_k3.16.7_42-18.21.3 hdjmod-kmp-xen-1.28_k3.16.7_42-18.21.3 hdjmod-kmp-xen-debuginfo-1.28_k3.16.7_42-18.21.3 ipset-6.23-20.3 ipset-debuginfo-6.23-20.3 ipset-debugsource-6.23-20.3 ipset-devel-6.23-20.3 ipset-kmp-default-6.23_k3.16.7_42-20.3 ipset-kmp-default-debuginfo-6.23_k3.16.7_42-20.3 ipset-kmp-desktop-6.23_k3.16.7_42-20.3 ipset-kmp-desktop-debuginfo-6.23_k3.16.7_42-20.3 ipset-kmp-xen-6.23_k3.16.7_42-20.3 ipset-kmp-xen-debuginfo-6.23_k3.16.7_42-20.3 kernel-default-3.16.7-42.1 kernel-default-base-3.16.7-42.1 kernel-default-base-debuginfo-3.16.7-42.1 kernel-default-debuginfo-3.16.7-42.1 kernel-default-debugsource-3.16.7-42.1 kernel-default-devel-3.16.7-42.1 kernel-ec2-3.16.7-42.1 kernel-ec2-base-3.16.7-42.1 kernel-ec2-devel-3.16.7-42.1 kernel-obs-build-3.16.7-42.2 kernel-obs-build-debugsource-3.16.7-42.2 kernel-obs-qa-3.16.7-42.1 kernel-obs-qa-xen-3.16.7-42.1 kernel-syms-3.16.7-42.1 libipset3-6.23-20.3 libipset3-debuginfo-6.23-20.3 pcfclock-0.44-260.20.2 pcfclock-debuginfo-0.44-260.20.2 pcfclock-debugsource-0.44-260.20.2 pcfclock-kmp-default-0.44_k3.16.7_42-260.20.2 pcfclock-kmp-default-debuginfo-0.44_k3.16.7_42-260.20.2 pcfclock-kmp-desktop-0.44_k3.16.7_42-260.20.2 pcfclock-kmp-desktop-debuginfo-0.44_k3.16.7_42-260.20.2 python-virtualbox-5.0.20-48.5 python-virtualbox-debuginfo-5.0.20-48.5 vhba-kmp-debugsource-20140629-2.20.2 vhba-kmp-default-20140629_k3.16.7_42-2.20.2 vhba-kmp-default-debuginfo-20140629_k3.16.7_42-2.20.2 vhba-kmp-desktop-20140629_k3.16.7_42-2.20.2 vhba-kmp-desktop-debuginfo-20140629_k3.16.7_42-2.20.2 vhba-kmp-xen-20140629_k3.16.7_42-2.20.2 vhba-kmp-xen-debuginfo-20140629_k3.16.7_42-2.20.2 virtualbox-5.0.20-48.5 virtualbox-debuginfo-5.0.20-48.5 virtualbox-debugsource-5.0.20-48.5 virtualbox-devel-5.0.20-48.5 virtualbox-guest-kmp-default-5.0.20_k3.16.7_42-48.5 virtualbox-guest-kmp-default-debuginfo-5.0.20_k3.16.7_42-48.5 virtualbox-guest-kmp-desktop-5.0.20_k3.16.7_42-48.5 virtualbox-guest-kmp-desktop-debuginfo-5.0.20_k3.16.7_42-48.5 virtualbox-guest-tools-5.0.20-48.5 virtualbox-guest-tools-debuginfo-5.0.20-48.5 virtualbox-guest-x11-5.0.20-48.5 virtualbox-guest-x11-debuginfo-5.0.20-48.5 virtualbox-host-kmp-default-5.0.20_k3.16.7_42-48.5 virtualbox-host-kmp-default-debuginfo-5.0.20_k3.16.7_42-48.5 virtualbox-host-kmp-desktop-5.0.20_k3.16.7_42-48.5 virtualbox-host-kmp-desktop-debuginfo-5.0.20_k3.16.7_42-48.5 virtualbox-qt-5.0.20-48.5 virtualbox-qt-debuginfo-5.0.20-48.5 virtualbox-websrv-5.0.20-48.5 virtualbox-websrv-debuginfo-5.0.20-48.5 xen-debugsource-4.4.4_02-46.2 xen-devel-4.4.4_02-46.2 xen-libs-4.4.4_02-46.2 xen-libs-debuginfo-4.4.4_02-46.2 xen-tools-domU-4.4.4_02-46.2 xen-tools-domU-debuginfo-4.4.4_02-46.2 xtables-addons-2.6-22.3 xtables-addons-debuginfo-2.6-22.3 xtables-addons-debugsource-2.6-22.3 xtables-addons-kmp-default-2.6_k3.16.7_42-22.3 xtables-addons-kmp-default-debuginfo-2.6_k3.16.7_42-22.3 xtables-addons-kmp-desktop-2.6_k3.16.7_42-22.3 xtables-addons-kmp-desktop-debuginfo-2.6_k3.16.7_42-22.3 xtables-addons-kmp-xen-2.6_k3.16.7_42-22.3 xtables-addons-kmp-xen-debuginfo-2.6_k3.16.7_42-22.3 - openSUSE 13.2 (i686 x86_64): kernel-debug-3.16.7-42.1 kernel-debug-base-3.16.7-42.1 kernel-debug-base-debuginfo-3.16.7-42.1 kernel-debug-debuginfo-3.16.7-42.1 kernel-debug-debugsource-3.16.7-42.1 kernel-debug-devel-3.16.7-42.1 kernel-debug-devel-debuginfo-3.16.7-42.1 kernel-desktop-3.16.7-42.1 kernel-desktop-base-3.16.7-42.1 kernel-desktop-base-debuginfo-3.16.7-42.1 kernel-desktop-debuginfo-3.16.7-42.1 kernel-desktop-debugsource-3.16.7-42.1 kernel-desktop-devel-3.16.7-42.1 kernel-ec2-base-debuginfo-3.16.7-42.1 kernel-ec2-debuginfo-3.16.7-42.1 kernel-ec2-debugsource-3.16.7-42.1 kernel-vanilla-3.16.7-42.1 kernel-vanilla-debuginfo-3.16.7-42.1 kernel-vanilla-debugsource-3.16.7-42.1 kernel-vanilla-devel-3.16.7-42.1 kernel-xen-3.16.7-42.1 kernel-xen-base-3.16.7-42.1 kernel-xen-base-debuginfo-3.16.7-42.1 kernel-xen-debuginfo-3.16.7-42.1 kernel-xen-debugsource-3.16.7-42.1 kernel-xen-devel-3.16.7-42.1 - openSUSE 13.2 (x86_64): xen-4.4.4_02-46.2 xen-doc-html-4.4.4_02-46.2 xen-kmp-default-4.4.4_02_k3.16.7_42-46.2 xen-kmp-default-debuginfo-4.4.4_02_k3.16.7_42-46.2 xen-kmp-desktop-4.4.4_02_k3.16.7_42-46.2 xen-kmp-desktop-debuginfo-4.4.4_02_k3.16.7_42-46.2 xen-libs-32bit-4.4.4_02-46.2 xen-libs-debuginfo-32bit-4.4.4_02-46.2 xen-tools-4.4.4_02-46.2 xen-tools-debuginfo-4.4.4_02-46.2 - openSUSE 13.2 (noarch): kernel-devel-3.16.7-42.1 kernel-docs-3.16.7-42.2 kernel-macros-3.16.7-42.1 kernel-source-3.16.7-42.1 kernel-source-vanilla-3.16.7-42.1 virtualbox-guest-desktop-icons-5.0.20-48.5 virtualbox-host-source-5.0.20-48.5 - openSUSE 13.2 (i586): bbswitch-kmp-pae-0.8_k3.16.7_42-3.20.3 bbswitch-kmp-pae-debuginfo-0.8_k3.16.7_42-3.20.3 cloop-kmp-pae-2.639_k3.16.7_42-14.20.3 cloop-kmp-pae-debuginfo-2.639_k3.16.7_42-14.20.3 crash-kmp-pae-7.0.8_k3.16.7_42-20.3 crash-kmp-pae-debuginfo-7.0.8_k3.16.7_42-20.3 hdjmod-kmp-pae-1.28_k3.16.7_42-18.21.3 hdjmod-kmp-pae-debuginfo-1.28_k3.16.7_42-18.21.3 ipset-kmp-pae-6.23_k3.16.7_42-20.3 ipset-kmp-pae-debuginfo-6.23_k3.16.7_42-20.3 pcfclock-kmp-pae-0.44_k3.16.7_42-260.20.2 pcfclock-kmp-pae-debuginfo-0.44_k3.16.7_42-260.20.2 vhba-kmp-pae-20140629_k3.16.7_42-2.20.2 vhba-kmp-pae-debuginfo-20140629_k3.16.7_42-2.20.2 virtualbox-guest-kmp-pae-5.0.20_k3.16.7_42-48.5 virtualbox-guest-kmp-pae-debuginfo-5.0.20_k3.16.7_42-48.5 virtualbox-host-kmp-pae-5.0.20_k3.16.7_42-48.5 virtualbox-host-kmp-pae-debuginfo-5.0.20_k3.16.7_42-48.5 xtables-addons-kmp-pae-2.6_k3.16.7_42-22.3 xtables-addons-kmp-pae-debuginfo-2.6_k3.16.7_42-22.3 - openSUSE 13.2 (i686): kernel-pae-3.16.7-42.1 kernel-pae-base-3.16.7-42.1 kernel-pae-base-debuginfo-3.16.7-42.1 kernel-pae-debuginfo-3.16.7-42.1 kernel-pae-debugsource-3.16.7-42.1 kernel-pae-devel-3.16.7-42.1 References: https://www.suse.com/security/cve/CVE-2012-6701.html https://www.suse.com/security/cve/CVE-2013-7446.html https://www.suse.com/security/cve/CVE-2014-9904.html https://www.suse.com/security/cve/CVE-2015-3288.html https://www.suse.com/security/cve/CVE-2015-6526.html https://www.suse.com/security/cve/CVE-2015-7566.html https://www.suse.com/security/cve/CVE-2015-8709.html https://www.suse.com/security/cve/CVE-2015-8785.html https://www.suse.com/security/cve/CVE-2015-8812.html https://www.suse.com/security/cve/CVE-2015-8816.html https://www.suse.com/security/cve/CVE-2015-8830.html https://www.suse.com/security/cve/CVE-2016-0758.html https://www.suse.com/security/cve/CVE-2016-1583.html https://www.suse.com/security/cve/CVE-2016-2053.html https://www.suse.com/security/cve/CVE-2016-2184.html https://www.suse.com/security/cve/CVE-2016-2185.html https://www.suse.com/security/cve/CVE-2016-2186.html https://www.suse.com/security/cve/CVE-2016-2187.html https://www.suse.com/security/cve/CVE-2016-2188.html https://www.suse.com/security/cve/CVE-2016-2384.html https://www.suse.com/security/cve/CVE-2016-2543.html https://www.suse.com/security/cve/CVE-2016-2544.html https://www.suse.com/security/cve/CVE-2016-2545.html https://www.suse.com/security/cve/CVE-2016-2546.html https://www.suse.com/security/cve/CVE-2016-2547.html https://www.suse.com/security/cve/CVE-2016-2548.html https://www.suse.com/security/cve/CVE-2016-2549.html https://www.suse.com/security/cve/CVE-2016-2782.html https://www.suse.com/security/cve/CVE-2016-2847.html https://www.suse.com/security/cve/CVE-2016-3134.html https://www.suse.com/security/cve/CVE-2016-3136.html https://www.suse.com/security/cve/CVE-2016-3137.html https://www.suse.com/security/cve/CVE-2016-3138.html https://www.suse.com/security/cve/CVE-2016-3139.html https://www.suse.com/security/cve/CVE-2016-3140.html https://www.suse.com/security/cve/CVE-2016-3156.html https://www.suse.com/security/cve/CVE-2016-3672.html https://www.suse.com/security/cve/CVE-2016-3689.html https://www.suse.com/security/cve/CVE-2016-3951.html https://www.suse.com/security/cve/CVE-2016-4470.html https://www.suse.com/security/cve/CVE-2016-4482.html https://www.suse.com/security/cve/CVE-2016-4485.html https://www.suse.com/security/cve/CVE-2016-4486.html https://www.suse.com/security/cve/CVE-2016-4565.html https://www.suse.com/security/cve/CVE-2016-4569.html https://www.suse.com/security/cve/CVE-2016-4578.html https://www.suse.com/security/cve/CVE-2016-4580.html https://www.suse.com/security/cve/CVE-2016-4581.html https://www.suse.com/security/cve/CVE-2016-4805.html https://www.suse.com/security/cve/CVE-2016-4913.html https://www.suse.com/security/cve/CVE-2016-4997.html https://www.suse.com/security/cve/CVE-2016-5244.html https://www.suse.com/security/cve/CVE-2016-5829.html https://bugzilla.suse.com/901754 https://bugzilla.suse.com/941113 https://bugzilla.suse.com/942702 https://bugzilla.suse.com/945219 https://bugzilla.suse.com/955654 https://bugzilla.suse.com/957052 https://bugzilla.suse.com/957988 https://bugzilla.suse.com/959709 https://bugzilla.suse.com/960561 https://bugzilla.suse.com/961512 https://bugzilla.suse.com/963762 https://bugzilla.suse.com/963765 https://bugzilla.suse.com/966245 https://bugzilla.suse.com/966437 https://bugzilla.suse.com/966693 https://bugzilla.suse.com/966849 https://bugzilla.suse.com/967972 https://bugzilla.suse.com/967973 https://bugzilla.suse.com/967974 https://bugzilla.suse.com/967975 https://bugzilla.suse.com/968010 https://bugzilla.suse.com/968011 https://bugzilla.suse.com/968012 https://bugzilla.suse.com/968013 https://bugzilla.suse.com/968018 https://bugzilla.suse.com/968670 https://bugzilla.suse.com/969354 https://bugzilla.suse.com/969355 https://bugzilla.suse.com/970114 https://bugzilla.suse.com/970275 https://bugzilla.suse.com/970892 https://bugzilla.suse.com/970909 https://bugzilla.suse.com/970911 https://bugzilla.suse.com/970948 https://bugzilla.suse.com/970955 https://bugzilla.suse.com/970956 https://bugzilla.suse.com/970958 https://bugzilla.suse.com/970970 https://bugzilla.suse.com/971124 https://bugzilla.suse.com/971125 https://bugzilla.suse.com/971126 https://bugzilla.suse.com/971360 https://bugzilla.suse.com/971628 https://bugzilla.suse.com/971799 https://bugzilla.suse.com/971919 https://bugzilla.suse.com/971944 https://bugzilla.suse.com/972174 https://bugzilla.suse.com/973378 https://bugzilla.suse.com/973570 https://bugzilla.suse.com/974308 https://bugzilla.suse.com/974418 https://bugzilla.suse.com/974646 https://bugzilla.suse.com/975945 https://bugzilla.suse.com/978401 https://bugzilla.suse.com/978445 https://bugzilla.suse.com/978469 https://bugzilla.suse.com/978821 https://bugzilla.suse.com/978822 https://bugzilla.suse.com/979021 https://bugzilla.suse.com/979213 https://bugzilla.suse.com/979548 https://bugzilla.suse.com/979867 https://bugzilla.suse.com/979879 https://bugzilla.suse.com/979913 https://bugzilla.suse.com/980348 https://bugzilla.suse.com/980363 https://bugzilla.suse.com/980371 https://bugzilla.suse.com/980725 https://bugzilla.suse.com/981267 https://bugzilla.suse.com/982706 https://bugzilla.suse.com/983143 https://bugzilla.suse.com/983213 https://bugzilla.suse.com/984464 https://bugzilla.suse.com/984755 https://bugzilla.suse.com/984764 https://bugzilla.suse.com/986362 https://bugzilla.suse.com/986365 https://bugzilla.suse.com/986377 https://bugzilla.suse.com/986572 https://bugzilla.suse.com/986573 https://bugzilla.suse.com/986811

1 0

openSUSE-SU-2016:2135-1: moderate: Security update for libidn
by opensuse-security＠opensuse.org 23 Aug '16

23 Aug '16

openSUSE Security Update: Security update for libidn ______________________________________________________________________________ Announcement ID: openSUSE-SU-2016:2135-1 Rating: moderate References: #923241 #990189 #990190 #990191 Cross-References: CVE-2015-2059 CVE-2015-8948 CVE-2016-6261 CVE-2016-6262 CVE-2016-6263 Affected Products: openSUSE Leap 42.1 ______________________________________________________________________________ An update that fixes 5 vulnerabilities is now available. Description: This update for libidn fixes the following issues: - CVE-2016-6262 and CVE-2015-8948: Out-of-bounds-read when reading one zero byte as input (bsc#990189) - CVE-2016-6261: Out-of-bounds stack read in idna_to_ascii_4i (bsc#990190) - CVE-2016-6263: stringprep_utf8_nfkc_normalize reject invalid UTF-8 (bsc#990191) - CVE-2015-2059: out-of-bounds read with stringprep on invalid UTF-8 (bsc#923241) This update was imported from the SUSE:SLE-12:Update update project. Patch Instructions: To install this openSUSE Security Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE Leap 42.1: zypper in -t patch openSUSE-2016-1014=1 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE Leap 42.1 (i586 x86_64): libidn-debugsource-1.28-6.1 libidn-devel-1.28-6.1 libidn-tools-1.28-6.1 libidn-tools-debuginfo-1.28-6.1 libidn11-1.28-6.1 libidn11-debuginfo-1.28-6.1 - openSUSE Leap 42.1 (x86_64): libidn11-32bit-1.28-6.1 libidn11-debuginfo-32bit-1.28-6.1 References: https://www.suse.com/security/cve/CVE-2015-2059.html https://www.suse.com/security/cve/CVE-2015-8948.html https://www.suse.com/security/cve/CVE-2016-6261.html https://www.suse.com/security/cve/CVE-2016-6262.html https://www.suse.com/security/cve/CVE-2016-6263.html https://bugzilla.suse.com/923241 https://bugzilla.suse.com/990189 https://bugzilla.suse.com/990190 https://bugzilla.suse.com/990191

1 0

openSUSE-RU-2016:2134-1: Recommended update for kcoreaddons
by maintenance＠opensuse.org 23 Aug '16

23 Aug '16

openSUSE Recommended Update: Recommended update for kcoreaddons ______________________________________________________________________________ Announcement ID: openSUSE-RU-2016:2134-1 Rating: low References: #993804 Affected Products: openSUSE Leap 42.1 ______________________________________________________________________________ An update that has one recommended fix can now be installed. Description: This recommended update for kcoreaddons fixes the following issues: - Generated game boards in KDE games such as Shisen were not random (boo#993804, kde#362161) Patch Instructions: To install this openSUSE Recommended Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE Leap 42.1: zypper in -t patch openSUSE-2016-1013=1 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE Leap 42.1 (i586 x86_64): kcoreaddons-5.21.0-15.1 kcoreaddons-debugsource-5.21.0-15.1 kcoreaddons-devel-5.21.0-15.1 kcoreaddons-devel-debuginfo-5.21.0-15.1 libKF5CoreAddons5-5.21.0-15.1 libKF5CoreAddons5-debuginfo-5.21.0-15.1 - openSUSE Leap 42.1 (x86_64): kcoreaddons-devel-32bit-5.21.0-15.1 kcoreaddons-devel-debuginfo-32bit-5.21.0-15.1 libKF5CoreAddons5-32bit-5.21.0-15.1 libKF5CoreAddons5-debuginfo-32bit-5.21.0-15.1 - openSUSE Leap 42.1 (noarch): kcoreaddons-lang-5.21.0-15.1 References: https://bugzilla.suse.com/993804

1 0