June 2015 - openSUSE Security Announce

[security-announce] SUSE-SU-2015:1161-1: important: Security update for java-1_6_0-ibm
by opensuse-security＠opensuse.org 30 Jun '15

30 Jun '15

SUSE Security Update: Security update for java-1_6_0-ibm ______________________________________________________________________________ Announcement ID: SUSE-SU-2015:1161-1 Rating: important References: #912434 #912447 #930365 #931702 Cross-References: CVE-2015-0138 CVE-2015-0192 CVE-2015-0204 CVE-2015-0458 CVE-2015-0459 CVE-2015-0469 CVE-2015-0477 CVE-2015-0478 CVE-2015-0480 CVE-2015-0488 CVE-2015-0491 CVE-2015-1914 CVE-2015-2808 Affected Products: SUSE Linux Enterprise Module for Legacy Software 12 ______________________________________________________________________________ An update that fixes 13 vulnerabilities is now available. Description: IBM Java 1.6.0 was updated to SR16-FP4 fixing security issues and bugs. Tabulated information can be found on: [http://www.ibm.com/developerworks/java/jdk/alerts/#IBM_Security_Update_May _2015](http://www.ibm.com/developerworks/java/jdk/alerts/#IBM_Security_Upda te_May_2015) CVEs addressed: CVE-2015-0192 CVE-2015-2808 CVE-2015-1914 CVE-2015-0138 CVE-2015-0491 CVE-2015-0458 CVE-2015-0459 CVE-2015-0469 CVE-2015-0480 CVE-2015-0488 CVE-2015-0478 CVE-2015-0477 CVE-2015-0204 Additional bugs fixed: * Fix javaws/plugin stuff should slave plugin update-alternatives (bnc#912434) * Changed Java to use the system root CA certificates (bnc#912447) Patch Instructions: To install this SUSE Security Update use YaST online_update. Alternatively you can run the command listed for your product: - SUSE Linux Enterprise Module for Legacy Software 12: zypper in -t patch SUSE-SLE-Module-Legacy-12-2015-288=1 To bring your system up-to-date, use "zypper patch". Package List: - SUSE Linux Enterprise Module for Legacy Software 12 (s390x x86_64): java-1_6_0-ibm-1.6.0_sr16.4-15.1 java-1_6_0-ibm-fonts-1.6.0_sr16.4-15.1 java-1_6_0-ibm-jdbc-1.6.0_sr16.4-15.1 - SUSE Linux Enterprise Module for Legacy Software 12 (x86_64): java-1_6_0-ibm-plugin-1.6.0_sr16.4-15.1 References: https://www.suse.com/security/cve/CVE-2015-0138.html https://www.suse.com/security/cve/CVE-2015-0192.html https://www.suse.com/security/cve/CVE-2015-0204.html https://www.suse.com/security/cve/CVE-2015-0458.html https://www.suse.com/security/cve/CVE-2015-0459.html https://www.suse.com/security/cve/CVE-2015-0469.html https://www.suse.com/security/cve/CVE-2015-0477.html https://www.suse.com/security/cve/CVE-2015-0478.html https://www.suse.com/security/cve/CVE-2015-0480.html https://www.suse.com/security/cve/CVE-2015-0488.html https://www.suse.com/security/cve/CVE-2015-0491.html https://www.suse.com/security/cve/CVE-2015-1914.html https://www.suse.com/security/cve/CVE-2015-2808.html https://bugzilla.suse.com/912434 https://bugzilla.suse.com/912447 https://bugzilla.suse.com/930365 https://bugzilla.suse.com/931702 -- To unsubscribe, e-mail: opensuse-security-announce+unsubscribe(a)opensuse.org For additional commands, e-mail: opensuse-security-announce+help(a)opensuse.org

1 0

[security-announce] SUSE-SU-2015:1157-1: important: Security update for Xen
by opensuse-security＠opensuse.org 29 Jun '15

29 Jun '15

SUSE Security Update: Security update for Xen ______________________________________________________________________________ Announcement ID: SUSE-SU-2015:1157-1 Rating: important References: #931625 #931626 #931627 #931628 #932770 #932996 Cross-References: CVE-2015-3209 CVE-2015-4103 CVE-2015-4104 CVE-2015-4105 CVE-2015-4106 CVE-2015-4163 CVE-2015-4164 Affected Products: SUSE Linux Enterprise Server 11 SP2 LTSS ______________________________________________________________________________ An update that fixes 7 vulnerabilities is now available. Description: Xen was updated to fix six security issues: * CVE-2015-4103: Potential unintended writes to host MSI message data field via qemu. (XSA-128, bsc#931625) * CVE-2015-4104: PCI MSI mask bits inadvertently exposed to guests. (XSA-129, bsc#931626) * CVE-2015-4105: Guest triggerable qemu MSI-X pass-through error messages. (XSA-130, bsc#931627) * CVE-2015-4106: Unmediated PCI register access in qemu. (XSA-131, bsc#931628) * CVE-2015-3209: Heap overflow in qemu pcnet controller allowing guest to host escape. (XSA-135, bsc#932770) * CVE-2015-4164: DoS through iret hypercall handler. (XSA-136, bsc#932996) Security Issues: * CVE-2015-4103 <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2015-4103> * CVE-2015-4104 <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2015-4104> * CVE-2015-4105 <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2015-4105> * CVE-2015-4106 <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2015-4106> * CVE-2015-4163 <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2015-4163> * CVE-2015-4164 <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2015-4164> * CVE-2015-3209 <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2015-3209> Special Instructions and Notes: Please reboot the system after installing this update. Patch Instructions: To install this SUSE Security Update use YaST online_update. Alternatively you can run the command listed for your product: - SUSE Linux Enterprise Server 11 SP2 LTSS: zypper in -t patch slessp2-xen-201506=10729 To bring your system up-to-date, use "zypper patch". Package List: - SUSE Linux Enterprise Server 11 SP2 LTSS (i586 x86_64): xen-devel-4.1.6_08-0.13.1 xen-kmp-default-4.1.6_08_3.0.101_0.7.29-0.13.1 xen-kmp-trace-4.1.6_08_3.0.101_0.7.29-0.13.1 xen-libs-4.1.6_08-0.13.1 xen-tools-domU-4.1.6_08-0.13.1 - SUSE Linux Enterprise Server 11 SP2 LTSS (x86_64): xen-4.1.6_08-0.13.1 xen-doc-html-4.1.6_08-0.13.1 xen-doc-pdf-4.1.6_08-0.13.1 xen-libs-32bit-4.1.6_08-0.13.1 xen-tools-4.1.6_08-0.13.1 - SUSE Linux Enterprise Server 11 SP2 LTSS (i586): xen-kmp-pae-4.1.6_08_3.0.101_0.7.29-0.13.1 References: https://www.suse.com/security/cve/CVE-2015-3209.html https://www.suse.com/security/cve/CVE-2015-4103.html https://www.suse.com/security/cve/CVE-2015-4104.html https://www.suse.com/security/cve/CVE-2015-4105.html https://www.suse.com/security/cve/CVE-2015-4106.html https://www.suse.com/security/cve/CVE-2015-4163.html https://www.suse.com/security/cve/CVE-2015-4164.html https://bugzilla.suse.com/931625 https://bugzilla.suse.com/931626 https://bugzilla.suse.com/931627 https://bugzilla.suse.com/931628 https://bugzilla.suse.com/932770 https://bugzilla.suse.com/932996 https://download.suse.com/patch/finder/?keywords=664b696391d543da0f24d6d0b0… -- To unsubscribe, e-mail: opensuse-security-announce+unsubscribe(a)opensuse.org For additional commands, e-mail: opensuse-security-announce+help(a)opensuse.org

1 0

[security-announce] SUSE-SU-2015:1156-1: important: Security update for Xen
by opensuse-security＠opensuse.org 29 Jun '15

29 Jun '15

SUSE Security Update: Security update for Xen ______________________________________________________________________________ Announcement ID: SUSE-SU-2015:1156-1 Rating: important References: #931625 #931626 #931627 #931628 #932770 #932996 Cross-References: CVE-2015-3209 CVE-2015-4103 CVE-2015-4104 CVE-2015-4105 CVE-2015-4106 CVE-2015-4164 Affected Products: SUSE Linux Enterprise Server 11 SP1 LTSS ______________________________________________________________________________ An update that fixes 6 vulnerabilities is now available. Description: Xen was updated to fix six security issues: * CVE-2015-4103: Potential unintended writes to host MSI message data field via qemu. (XSA-128, bsc#931625) * CVE-2015-4104: PCI MSI mask bits inadvertently exposed to guests. (XSA-129, bsc#931626) * CVE-2015-4105: Guest triggerable qemu MSI-X pass-through error messages. (XSA-130, bsc#931627) * CVE-2015-4106: Unmediated PCI register access in qemu. (XSA-131, bsc#931628) * CVE-2015-3209: heap overflow in qemu pcnet controller allowing guest to host escape. (XSA-135, bsc#932770) * CVE-2015-4164: DoS through iret hypercall handler. (XSA-136, bsc#932996) Security Issues: * CVE-2015-4103 <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2015-4103> * CVE-2015-4104 <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2015-4104> * CVE-2015-4105 <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2015-4105> * CVE-2015-4106 <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2015-4106> * CVE-2015-4164 <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2015-4164> * CVE-2015-3209 <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2015-3209> Special Instructions and Notes: Please reboot the system after installing this update. Patch Instructions: To install this SUSE Security Update use YaST online_update. Alternatively you can run the command listed for your product: - SUSE Linux Enterprise Server 11 SP1 LTSS: zypper in -t patch slessp1-xen-201506=10726 To bring your system up-to-date, use "zypper patch". Package List: - SUSE Linux Enterprise Server 11 SP1 LTSS (i586 x86_64): xen-4.0.3_21548_18-0.25.1 xen-doc-html-4.0.3_21548_18-0.25.1 xen-doc-pdf-4.0.3_21548_18-0.25.1 xen-kmp-default-4.0.3_21548_18_2.6.32.59_0.19-0.25.1 xen-kmp-trace-4.0.3_21548_18_2.6.32.59_0.19-0.25.1 xen-libs-4.0.3_21548_18-0.25.1 xen-tools-4.0.3_21548_18-0.25.1 xen-tools-domU-4.0.3_21548_18-0.25.1 - SUSE Linux Enterprise Server 11 SP1 LTSS (i586): xen-kmp-pae-4.0.3_21548_18_2.6.32.59_0.19-0.25.1 References: https://www.suse.com/security/cve/CVE-2015-3209.html https://www.suse.com/security/cve/CVE-2015-4103.html https://www.suse.com/security/cve/CVE-2015-4104.html https://www.suse.com/security/cve/CVE-2015-4105.html https://www.suse.com/security/cve/CVE-2015-4106.html https://www.suse.com/security/cve/CVE-2015-4164.html https://bugzilla.suse.com/931625 https://bugzilla.suse.com/931626 https://bugzilla.suse.com/931627 https://bugzilla.suse.com/931628 https://bugzilla.suse.com/932770 https://bugzilla.suse.com/932996 https://download.suse.com/patch/finder/?keywords=5db78436698154117f5060fbcf… -- To unsubscribe, e-mail: opensuse-security-announce+unsubscribe(a)opensuse.org For additional commands, e-mail: opensuse-security-announce+help(a)opensuse.org

1 0

[security-announce] SUSE-SU-2015:1086-4: important: Security update for java-1_7_0-ibm
by opensuse-security＠opensuse.org 27 Jun '15

27 Jun '15

SUSE Security Update: Security update for java-1_7_0-ibm ______________________________________________________________________________ Announcement ID: SUSE-SU-2015:1086-4 Rating: important References: #912434 #912447 #930365 #931702 Cross-References: CVE-2015-0138 CVE-2015-0192 CVE-2015-0204 CVE-2015-0458 CVE-2015-0459 CVE-2015-0469 CVE-2015-0477 CVE-2015-0478 CVE-2015-0480 CVE-2015-0488 CVE-2015-0491 CVE-2015-1914 CVE-2015-2808 Affected Products: SUSE Linux Enterprise Software Development Kit 11 SP3 SUSE Linux Enterprise Server 11 SP3 for VMware SUSE Linux Enterprise Server 11 SP3 ______________________________________________________________________________ An update that fixes 13 vulnerabilities is now available. Description: IBM Java 1.7.0 was updated to SR9 fixing security issues and bugs. Tabulated information can be found on: http://www.ibm.com/developerworks/java/jdk/alerts/#IBM_Security_Update_May_ 2015 <http://www.ibm.com/developerworks/java/jdk/alerts/#IBM_Security_Update_May _2015> . Security Issues: * CVE-2015-0192 <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2015-0192> * CVE-2015-2808 <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2015-2808> * CVE-2015-1914 <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2015-1914> * CVE-2015-0138 <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2015-0138> * CVE-2015-0491 <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2015-0491> * CVE-2015-0458 <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2015-0458> * CVE-2015-0459 <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2015-0459> * CVE-2015-0469 <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2015-0469> * CVE-2015-0480 <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2015-0480> * CVE-2015-0488 <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2015-0488> * CVE-2015-0478 <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2015-0478> * CVE-2015-0477 <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2015-0477> * CVE-2015-0204 <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2015-0204> Patch Instructions: To install this SUSE Security Update use YaST online_update. Alternatively you can run the command listed for your product: - SUSE Linux Enterprise Software Development Kit 11 SP3: zypper in -t patch sdksp3-java-1_7_0-ibm=10784 - SUSE Linux Enterprise Server 11 SP3 for VMware: zypper in -t patch slessp3-java-1_7_0-ibm=10784 - SUSE Linux Enterprise Server 11 SP3: zypper in -t patch slessp3-java-1_7_0-ibm=10784 To bring your system up-to-date, use "zypper patch". Package List: - SUSE Linux Enterprise Software Development Kit 11 SP3 (i586 ppc64 s390x x86_64): java-1_7_0-ibm-devel-1.7.0_sr9.0-0.7.1 - SUSE Linux Enterprise Server 11 SP3 for VMware (i586 x86_64): java-1_7_0-ibm-1.7.0_sr9.0-0.7.1 java-1_7_0-ibm-alsa-1.7.0_sr9.0-0.7.1 java-1_7_0-ibm-jdbc-1.7.0_sr9.0-0.7.1 java-1_7_0-ibm-plugin-1.7.0_sr9.0-0.7.1 - SUSE Linux Enterprise Server 11 SP3 (i586 ppc64 s390x x86_64): java-1_7_0-ibm-1.7.0_sr9.0-0.7.1 java-1_7_0-ibm-jdbc-1.7.0_sr9.0-0.7.1 - SUSE Linux Enterprise Server 11 SP3 (i586 x86_64): java-1_7_0-ibm-alsa-1.7.0_sr9.0-0.7.1 java-1_7_0-ibm-plugin-1.7.0_sr9.0-0.7.1 References: https://www.suse.com/security/cve/CVE-2015-0138.html https://www.suse.com/security/cve/CVE-2015-0192.html https://www.suse.com/security/cve/CVE-2015-0204.html https://www.suse.com/security/cve/CVE-2015-0458.html https://www.suse.com/security/cve/CVE-2015-0459.html https://www.suse.com/security/cve/CVE-2015-0469.html https://www.suse.com/security/cve/CVE-2015-0477.html https://www.suse.com/security/cve/CVE-2015-0478.html https://www.suse.com/security/cve/CVE-2015-0480.html https://www.suse.com/security/cve/CVE-2015-0488.html https://www.suse.com/security/cve/CVE-2015-0491.html https://www.suse.com/security/cve/CVE-2015-1914.html https://www.suse.com/security/cve/CVE-2015-2808.html https://bugzilla.suse.com/912434 https://bugzilla.suse.com/912447 https://bugzilla.suse.com/930365 https://bugzilla.suse.com/931702 https://download.suse.com/patch/finder/?keywords=9679d0aa3625acf75e826a41db… -- To unsubscribe, e-mail: opensuse-security-announce+unsubscribe(a)opensuse.org For additional commands, e-mail: opensuse-security-announce+help(a)opensuse.org

1 0

[security-announce] SUSE-SU-2015:1152-1: important: Security update for KVM
by opensuse-security＠opensuse.org 26 Jun '15

26 Jun '15

SUSE Security Update: Security update for KVM ______________________________________________________________________________ Announcement ID: SUSE-SU-2015:1152-1 Rating: important References: #932267 #932770 Cross-References: CVE-2015-3209 Affected Products: SUSE Linux Enterprise Server 11 SP3 SUSE Linux Enterprise Desktop 11 SP3 ______________________________________________________________________________ An update that solves one vulnerability and has one errata is now available. It includes one version update. Description: KVM was updated to fix two security issues: * CVE-2015-3209: Heap overflow in qemu pcnet controller allowing guest to host escape. (bsc#932770) * CVE-2015-4037: Predictable directory names for smb configuration. (bsc#932267) Security Issues: * CVE-2015-3209 <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2015-3209> Patch Instructions: To install this SUSE Security Update use YaST online_update. Alternatively you can run the command listed for your product: - SUSE Linux Enterprise Server 11 SP3: zypper in -t patch slessp3-kvm=10747 - SUSE Linux Enterprise Desktop 11 SP3: zypper in -t patch sledsp3-kvm=10747 To bring your system up-to-date, use "zypper patch". Package List: - SUSE Linux Enterprise Server 11 SP3 (i586 s390x x86_64) [New Version: 1.4.2]: kvm-1.4.2-0.22.31.1 - SUSE Linux Enterprise Desktop 11 SP3 (i586 x86_64) [New Version: 1.4.2]: kvm-1.4.2-0.22.31.1 References: https://www.suse.com/security/cve/CVE-2015-3209.html https://bugzilla.suse.com/932267 https://bugzilla.suse.com/932770 https://download.suse.com/patch/finder/?keywords=22b018e7745a4c6e213ac9c057… -- To unsubscribe, e-mail: opensuse-security-announce+unsubscribe(a)opensuse.org For additional commands, e-mail: opensuse-security-announce+help(a)opensuse.org

1 0

[security-announce] SUSE-SU-2015:1150-1: important: Security update for compat-openssl098
by opensuse-security＠opensuse.org 26 Jun '15

26 Jun '15

SUSE Security Update: Security update for compat-openssl098 ______________________________________________________________________________ Announcement ID: SUSE-SU-2015:1150-1 Rating: important References: #879179 #929678 #931698 #933898 #933911 #934487 #934489 #934491 #934493 Cross-References: CVE-2015-1788 CVE-2015-1789 CVE-2015-1790 CVE-2015-1791 CVE-2015-1792 CVE-2015-3216 CVE-2015-4000 Affected Products: SUSE Linux Enterprise Module for Legacy Software 12 SUSE Linux Enterprise Desktop 12 ______________________________________________________________________________ An update that solves 7 vulnerabilities and has two fixes is now available. Description: This update fixes the following security issues: - CVE-2015-4000 (boo#931698) * The Logjam Attack / weakdh.org * reject connections with DH parameters shorter than 1024 bits * generates 2048-bit DH parameters by default - CVE-2015-1788 (boo#934487) * Malformed ECParameters causes infinite loop - CVE-2015-1789 (boo#934489) * Exploitable out-of-bounds read in X509_cmp_time - CVE-2015-1790 (boo#934491) * PKCS7 crash with missing EnvelopedContent - CVE-2015-1792 (boo#934493) * CMS verify infinite loop with unknown hash function - CVE-2015-1791 (boo#933911) * race condition in NewSessionTicket - CVE-2015-3216 (boo#933898) * Crash in ssleay_rand_bytes due to locking regression * modified openssl-1.0.1i-fipslocking.patch - fix timing side channel in RSA decryption (bnc#929678) - add ECC ciphersuites to DEFAULT (bnc#879179) - Disable EXPORT ciphers by default (bnc#931698, comment #3) Patch Instructions: To install this SUSE Security Update use YaST online_update. Alternatively you can run the command listed for your product: - SUSE Linux Enterprise Module for Legacy Software 12: zypper in -t patch SUSE-SLE-Module-Legacy-12-2015-285=1 - SUSE Linux Enterprise Desktop 12: zypper in -t patch SUSE-SLE-DESKTOP-12-2015-285=1 To bring your system up-to-date, use "zypper patch". Package List: - SUSE Linux Enterprise Module for Legacy Software 12 (s390x x86_64): compat-openssl098-debugsource-0.9.8j-78.1 libopenssl0_9_8-0.9.8j-78.1 libopenssl0_9_8-32bit-0.9.8j-78.1 libopenssl0_9_8-debuginfo-0.9.8j-78.1 libopenssl0_9_8-debuginfo-32bit-0.9.8j-78.1 - SUSE Linux Enterprise Desktop 12 (x86_64): compat-openssl098-debugsource-0.9.8j-78.1 libopenssl0_9_8-0.9.8j-78.1 libopenssl0_9_8-32bit-0.9.8j-78.1 libopenssl0_9_8-debuginfo-0.9.8j-78.1 libopenssl0_9_8-debuginfo-32bit-0.9.8j-78.1 References: https://www.suse.com/security/cve/CVE-2015-1788.html https://www.suse.com/security/cve/CVE-2015-1789.html https://www.suse.com/security/cve/CVE-2015-1790.html https://www.suse.com/security/cve/CVE-2015-1791.html https://www.suse.com/security/cve/CVE-2015-1792.html https://www.suse.com/security/cve/CVE-2015-3216.html https://www.suse.com/security/cve/CVE-2015-4000.html https://bugzilla.suse.com/879179 https://bugzilla.suse.com/929678 https://bugzilla.suse.com/931698 https://bugzilla.suse.com/933898 https://bugzilla.suse.com/933911 https://bugzilla.suse.com/934487 https://bugzilla.suse.com/934489 https://bugzilla.suse.com/934491 https://bugzilla.suse.com/934493 -- To unsubscribe, e-mail: opensuse-security-announce+unsubscribe(a)opensuse.org For additional commands, e-mail: opensuse-security-announce+help(a)opensuse.org

1 0

[security-announce] openSUSE-SU-2015:1148-1: important: Security update for Adobe Flash Player
by opensuse-security＠opensuse.org 26 Jun '15

26 Jun '15

openSUSE Security Update: Security update for Adobe Flash Player ______________________________________________________________________________ Announcement ID: openSUSE-SU-2015:1148-1 Rating: important References: #935701 Cross-References: CVE-2015-3113 Affected Products: openSUSE 13.2:NonFree openSUSE 13.1:NonFree ______________________________________________________________________________ An update that fixes one vulnerability is now available. Description: Adobe Flash Player was updated to 11.2.202.468 to fix one security issue. The following vulnerability was fixed: * CVE-2015-3113: A heap buffer overflow vulnerability could have allowed code execution (bsc#935701, APSB15-14) Patch Instructions: To install this openSUSE Security Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE 13.2:NonFree: zypper in -t patch openSUSE-2015-450=1 - openSUSE 13.1:NonFree: zypper in -t patch openSUSE-2015-450=1 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE 13.2:NonFree (i586 x86_64): flash-player-11.2.202.468-2.58.1 flash-player-gnome-11.2.202.468-2.58.1 flash-player-kde4-11.2.202.468-2.58.1 - openSUSE 13.1:NonFree (i586 x86_64): flash-player-11.2.202.468-123.1 flash-player-gnome-11.2.202.468-123.1 flash-player-kde4-11.2.202.468-123.1 References: https://www.suse.com/security/cve/CVE-2015-3113.html https://bugzilla.suse.com/935701 -- To unsubscribe, e-mail: opensuse-security-announce+unsubscribe(a)opensuse.org For additional commands, e-mail: opensuse-security-announce+help(a)opensuse.org

1 0

[security-announce] SUSE-SU-2015:1143-1: important: Security update for openssl
by opensuse-security＠opensuse.org 25 Jun '15

25 Jun '15

SUSE Security Update: Security update for openssl ______________________________________________________________________________ Announcement ID: SUSE-SU-2015:1143-1 Rating: important References: #926597 #929678 #931698 #933898 #933911 #934487 #934489 #934491 #934493 Cross-References: CVE-2015-1788 CVE-2015-1789 CVE-2015-1790 CVE-2015-1791 CVE-2015-1792 CVE-2015-3216 CVE-2015-4000 Affected Products: SUSE Linux Enterprise Software Development Kit 12 SUSE Linux Enterprise Server 12 SUSE Linux Enterprise Desktop 12 ______________________________________________________________________________ An update that solves 7 vulnerabilities and has two fixes is now available. Description: This update of openssl fixes the following security issues: - CVE-2015-4000 (bsc#931698) * The Logjam Attack / weakdh.org * reject connections with DH parameters shorter than 1024 bits * generates 2048-bit DH parameters by default - CVE-2015-1788 (bsc#934487) * Malformed ECParameters causes infinite loop - CVE-2015-1789 (bsc#934489) * Exploitable out-of-bounds read in X509_cmp_time - CVE-2015-1790 (bsc#934491) * PKCS7 crash with missing EnvelopedContent - CVE-2015-1792 (bsc#934493) * CMS verify infinite loop with unknown hash function - CVE-2015-1791 (bsc#933911) * race condition in NewSessionTicket - CVE-2015-3216 (bsc#933898) * Crash in ssleay_rand_bytes due to locking regression - fix a timing side channel in RSA decryption (bnc#929678) Patch Instructions: To install this SUSE Security Update use YaST online_update. Alternatively you can run the command listed for your product: - SUSE Linux Enterprise Software Development Kit 12: zypper in -t patch SUSE-SLE-SDK-12-2015-282=1 - SUSE Linux Enterprise Server 12: zypper in -t patch SUSE-SLE-SERVER-12-2015-282=1 - SUSE Linux Enterprise Desktop 12: zypper in -t patch SUSE-SLE-DESKTOP-12-2015-282=1 To bring your system up-to-date, use "zypper patch". Package List: - SUSE Linux Enterprise Software Development Kit 12 (ppc64le s390x x86_64): libopenssl-devel-1.0.1i-25.1 openssl-debuginfo-1.0.1i-25.1 openssl-debugsource-1.0.1i-25.1 - SUSE Linux Enterprise Server 12 (ppc64le s390x x86_64): libopenssl1_0_0-1.0.1i-25.1 libopenssl1_0_0-debuginfo-1.0.1i-25.1 libopenssl1_0_0-hmac-1.0.1i-25.1 openssl-1.0.1i-25.1 openssl-debuginfo-1.0.1i-25.1 openssl-debugsource-1.0.1i-25.1 - SUSE Linux Enterprise Server 12 (s390x x86_64): libopenssl1_0_0-32bit-1.0.1i-25.1 libopenssl1_0_0-debuginfo-32bit-1.0.1i-25.1 libopenssl1_0_0-hmac-32bit-1.0.1i-25.1 - SUSE Linux Enterprise Server 12 (noarch): openssl-doc-1.0.1i-25.1 - SUSE Linux Enterprise Desktop 12 (x86_64): libopenssl1_0_0-1.0.1i-25.1 libopenssl1_0_0-32bit-1.0.1i-25.1 libopenssl1_0_0-debuginfo-1.0.1i-25.1 libopenssl1_0_0-debuginfo-32bit-1.0.1i-25.1 openssl-1.0.1i-25.1 openssl-debuginfo-1.0.1i-25.1 openssl-debugsource-1.0.1i-25.1 References: https://www.suse.com/security/cve/CVE-2015-1788.html https://www.suse.com/security/cve/CVE-2015-1789.html https://www.suse.com/security/cve/CVE-2015-1790.html https://www.suse.com/security/cve/CVE-2015-1791.html https://www.suse.com/security/cve/CVE-2015-1792.html https://www.suse.com/security/cve/CVE-2015-3216.html https://www.suse.com/security/cve/CVE-2015-4000.html https://bugzilla.suse.com/926597 https://bugzilla.suse.com/929678 https://bugzilla.suse.com/931698 https://bugzilla.suse.com/933898 https://bugzilla.suse.com/933911 https://bugzilla.suse.com/934487 https://bugzilla.suse.com/934489 https://bugzilla.suse.com/934491 https://bugzilla.suse.com/934493 -- To unsubscribe, e-mail: opensuse-security-announce+unsubscribe(a)opensuse.org For additional commands, e-mail: opensuse-security-announce+help(a)opensuse.org

1 0

[security-announce] openSUSE-SU-2015:1139-1: important: Security update for openssl
by opensuse-security＠opensuse.org 25 Jun '15

25 Jun '15

openSUSE Security Update: Security update for openssl ______________________________________________________________________________ Announcement ID: openSUSE-SU-2015:1139-1 Rating: important References: #931698 #933898 #933911 #934487 #934489 #934491 #934493 #934494 Cross-References: CVE-2015-1788 CVE-2015-1789 CVE-2015-1790 CVE-2015-1791 CVE-2015-1792 CVE-2015-3216 CVE-2015-4000 Affected Products: openSUSE 13.2 openSUSE 13.1 ______________________________________________________________________________ An update that solves 7 vulnerabilities and has one errata is now available. Description: openssl was updated to fix six security issues. The following vulnerabilities were fixed: * CVE-2015-4000: The Logjam Attack / weakdh.org. Rject connections with DH parameters shorter than 768 bits, generates 2048-bit DH parameters by default. (boo#931698) * CVE-2015-1788: Malformed ECParameters causes infinite loop (boo#934487) * CVE-2015-1789: Exploitable out-of-bounds read in X509_cmp_time (boo#934489) * CVE-2015-1790: PKCS7 crash with missing EnvelopedContent (boo#934491) * CVE-2015-1792: CMS verify infinite loop with unknown hash function (boo#934493) * CVE-2015-1791: race condition in NewSessionTicket (boo#933911) * CVE-2015-3216: Crash in ssleay_rand_bytes due to locking regression (boo#933898) Patch Instructions: To install this openSUSE Security Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE 13.2: zypper in -t patch openSUSE-2015-447=1 - openSUSE 13.1: zypper in -t patch openSUSE-2015-447=1 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE 13.2 (i586 x86_64): libopenssl-devel-1.0.1k-2.24.1 libopenssl1_0_0-1.0.1k-2.24.1 libopenssl1_0_0-debuginfo-1.0.1k-2.24.1 libopenssl1_0_0-hmac-1.0.1k-2.24.1 openssl-1.0.1k-2.24.1 openssl-debuginfo-1.0.1k-2.24.1 openssl-debugsource-1.0.1k-2.24.1 - openSUSE 13.2 (x86_64): libopenssl-devel-32bit-1.0.1k-2.24.1 libopenssl1_0_0-32bit-1.0.1k-2.24.1 libopenssl1_0_0-debuginfo-32bit-1.0.1k-2.24.1 libopenssl1_0_0-hmac-32bit-1.0.1k-2.24.1 - openSUSE 13.2 (noarch): openssl-doc-1.0.1k-2.24.1 - openSUSE 13.1 (i586 x86_64): libopenssl-devel-1.0.1k-11.72.1 libopenssl1_0_0-1.0.1k-11.72.1 libopenssl1_0_0-debuginfo-1.0.1k-11.72.1 openssl-1.0.1k-11.72.1 openssl-debuginfo-1.0.1k-11.72.1 openssl-debugsource-1.0.1k-11.72.1 - openSUSE 13.1 (x86_64): libopenssl-devel-32bit-1.0.1k-11.72.1 libopenssl1_0_0-32bit-1.0.1k-11.72.1 libopenssl1_0_0-debuginfo-32bit-1.0.1k-11.72.1 - openSUSE 13.1 (noarch): openssl-doc-1.0.1k-11.72.1 References: https://www.suse.com/security/cve/CVE-2015-1788.html https://www.suse.com/security/cve/CVE-2015-1789.html https://www.suse.com/security/cve/CVE-2015-1790.html https://www.suse.com/security/cve/CVE-2015-1791.html https://www.suse.com/security/cve/CVE-2015-1792.html https://www.suse.com/security/cve/CVE-2015-3216.html https://www.suse.com/security/cve/CVE-2015-4000.html https://bugzilla.suse.com/931698 https://bugzilla.suse.com/933898 https://bugzilla.suse.com/933911 https://bugzilla.suse.com/934487 https://bugzilla.suse.com/934489 https://bugzilla.suse.com/934491 https://bugzilla.suse.com/934493 https://bugzilla.suse.com/934494 -- To unsubscribe, e-mail: opensuse-security-announce+unsubscribe(a)opensuse.org For additional commands, e-mail: opensuse-security-announce+help(a)opensuse.org

1 0

[security-announce] SUSE-SU-2015:1138-1: important: Security update for IBM Java
by opensuse-security＠opensuse.org 24 Jun '15

24 Jun '15

SUSE Security Update: Security update for IBM Java ______________________________________________________________________________ Announcement ID: SUSE-SU-2015:1138-1 Rating: important References: #930365 Affected Products: SUSE Linux Enterprise Server 10 SP4 LTSS ______________________________________________________________________________ An update that contains security fixes can now be installed. Description: IBM Java 1.6.0 was updated to SR16-FP4 fixing security issues and bugs. Tabulated information can be found on: http://www.ibm.com/developerworks/java/jdk/alerts/#IBM_Security_Update_May_ 2015 <http://www.ibm.com/developerworks/java/jdk/alerts/#IBM_Security_Update_May _2015> CVE-2015-0192 CVE-2015-2808 CVE-2015-1914 CVE-2015-0138 CVE-2015-0491 CVE-2015-0458 CVE-2015-0459 CVE-2015-0469 CVE-2015-0480 CVE-2015-0488 CVE-2015-0478 CVE-2015-0477 CVE-2015-0204 Package List: - SUSE Linux Enterprise Server 10 SP4 LTSS (i586 s390x x86_64): java-1_6_0-ibm-1.6.0_sr16.4-0.8.1 java-1_6_0-ibm-devel-1.6.0_sr16.4-0.8.1 java-1_6_0-ibm-fonts-1.6.0_sr16.4-0.8.1 java-1_6_0-ibm-jdbc-1.6.0_sr16.4-0.8.1 - SUSE Linux Enterprise Server 10 SP4 LTSS (s390x x86_64): java-1_6_0-ibm-32bit-1.6.0_sr16.4-0.8.1 java-1_6_0-ibm-devel-32bit-1.6.0_sr16.4-0.8.1 - SUSE Linux Enterprise Server 10 SP4 LTSS (i586 x86_64): java-1_6_0-ibm-plugin-1.6.0_sr16.4-0.8.1 - SUSE Linux Enterprise Server 10 SP4 LTSS (x86_64): java-1_6_0-ibm-alsa-32bit-1.6.0_sr16.4-0.8.1 java-1_6_0-ibm-plugin-32bit-1.6.0_sr16.4-0.8.1 - SUSE Linux Enterprise Server 10 SP4 LTSS (i586): java-1_6_0-ibm-alsa-1.6.0_sr16.4-0.8.1 References: https://bugzilla.suse.com/930365 https://download.suse.com/patch/finder/?keywords=c5428e2c57be4bc06608802e52… -- To unsubscribe, e-mail: opensuse-security-announce+unsubscribe(a)opensuse.org For additional commands, e-mail: opensuse-security-announce+help(a)opensuse.org

1 0