November 2011 - openSUSE Security Announce

[security-announce] SUSE-SU-2011:1239-1: critical: Security update for Acrobat Reader
by opensuse-security＠opensuse.org 15 Nov '11

15 Nov '11

SUSE Security Update: Security update for Acrobat Reader ______________________________________________________________________________ Announcement ID: SUSE-SU-2011:1239-1 Rating: critical References: #717724 Cross-References: CVE-2011-1353 CVE-2011-2431 CVE-2011-2432 CVE-2011-2433 CVE-2011-2434 CVE-2011-2435 CVE-2011-2436 CVE-2011-2437 CVE-2011-2438 CVE-2011-2439 CVE-2011-2440 CVE-2011-2441 CVE-2011-2442 Affected Products: SUSE Linux Enterprise Desktop 11 SP1 SUSE Linux Enterprise Desktop 10 SP4 ______________________________________________________________________________ An update that fixes 13 vulnerabilities is now available. It includes one version update. Description: Acrobat reader was updated to version 9.4.6 to fix several security issues (CVE-2011-1353, CVE-2011-2431, CVE-2011-2432, CVE-2011-2433, CVE-2011-2434, CVE-2011-2435, CVE-2011-2436, CVE-2011-2437, CVE-2011-2438, CVE-2011-2439, CVE-2011-2440, CVE-2011-2441, CVE-2011-2442) Security Issue references: * CVE-2011-1353 <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2011-1353 > * CVE-2011-2431 <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2011-2431 > * CVE-2011-2432 <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2011-2432 > * CVE-2011-2433 <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2011-2433 > * CVE-2011-2434 <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2011-2434 > * CVE-2011-2435 <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2011-2435 > * CVE-2011-2436 <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2011-2436 > * CVE-2011-2437 <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2011-2437 > * CVE-2011-2438 <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2011-2438 > * CVE-2011-2439 <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2011-2439 > * CVE-2011-2440 <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2011-2440 > * CVE-2011-2441 <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2011-2441 > * CVE-2011-2442 <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2011-2442 > Patch Instructions: To install this SUSE Security Update use YaST online_update. Alternatively you can run the command listed for your product: - SUSE Linux Enterprise Desktop 11 SP1: zypper in -t patch sledsp1-acroread-5412 To bring your system up-to-date, use "zypper patch". Package List: - SUSE Linux Enterprise Desktop 11 SP1 (noarch) [New Version: 9.4.6]: acroread-cmaps-9.4.6-0.2.1 acroread-fonts-ja-9.4.6-0.2.1 acroread-fonts-ko-9.4.6-0.2.1 acroread-fonts-zh_CN-9.4.6-0.2.1 acroread-fonts-zh_TW-9.4.6-0.2.1 - SUSE Linux Enterprise Desktop 11 SP1 (i586) [New Version: 9.4.6]: acroread-9.4.6-0.2.1 - SUSE Linux Enterprise Desktop 10 SP4 (noarch) [New Version: 9.4.6]: acroread-cmaps-9.4.6-0.5.1 acroread-fonts-ja-9.4.6-0.5.1 acroread-fonts-ko-9.4.6-0.5.1 acroread-fonts-zh_CN-9.4.6-0.5.1 acroread-fonts-zh_TW-9.4.6-0.5.1 - SUSE Linux Enterprise Desktop 10 SP4 (i586) [New Version: 9.4.6]: acroread-9.4.6-0.5.1 References: http://support.novell.com/security/cve/CVE-2011-1353.html http://support.novell.com/security/cve/CVE-2011-2431.html http://support.novell.com/security/cve/CVE-2011-2432.html http://support.novell.com/security/cve/CVE-2011-2433.html http://support.novell.com/security/cve/CVE-2011-2434.html http://support.novell.com/security/cve/CVE-2011-2435.html http://support.novell.com/security/cve/CVE-2011-2436.html http://support.novell.com/security/cve/CVE-2011-2437.html http://support.novell.com/security/cve/CVE-2011-2438.html http://support.novell.com/security/cve/CVE-2011-2439.html http://support.novell.com/security/cve/CVE-2011-2440.html http://support.novell.com/security/cve/CVE-2011-2441.html http://support.novell.com/security/cve/CVE-2011-2442.html https://bugzilla.novell.com/717724 http://download.novell.com/patch/finder/?keywords=04e3cd5de8e24c9c3136e1890… http://download.novell.com/patch/finder/?keywords=729306cbb9eef9773fe954105… -- To unsubscribe, e-mail: opensuse-security-announce+unsubscribe(a)opensuse.org For additional commands, e-mail: opensuse-security-announce+help(a)opensuse.org

1 0

[security-announce] openSUSE-SU-2011:1238-1: critical: acroread
by opensuse-security＠opensuse.org 14 Nov '11

14 Nov '11

openSUSE Security Update: acroread ______________________________________________________________________________ Announcement ID: openSUSE-SU-2011:1238-1 Rating: critical References: #717724 Cross-References: CVE-2011-1353 CVE-2011-2431 CVE-2011-2432 CVE-2011-2433 CVE-2011-2434 CVE-2011-2435 CVE-2011-2436 CVE-2011-2437 CVE-2011-2438 CVE-2011-2439 CVE-2011-2440 CVE-2011-2441 CVE-2011-2442 Affected Products: openSUSE 11.4 openSUSE 11.3 ______________________________________________________________________________ An update that fixes 13 vulnerabilities is now available. It includes one version update. Description: acrobat reader was updated to version 9.4.6 to fix several security issues (CVE-2011-1353, CVE-2011-2431, CVE-2011-2432, CVE-2011-2433, CVE-2011-2434, CVE-2011-2435, CVE-2011-2436, CVE-2011-2437, CVE-2011-2438, CVE-2011-2439, CVE-2011-2440, CVE-2011-2441, CVE-2011-2442) Patch Instructions: To install this openSUSE Security Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE 11.4: zypper in -t patch acroread-5411 - openSUSE 11.3: zypper in -t patch acroread-5411 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE 11.4 (i586) [New Version: 9.4.6]: acroread-9.4.6-0.5.1 - openSUSE 11.3 (i586) [New Version: 9.4.6]: acroread-9.4.6-0.2.1 References: http://support.novell.com/security/cve/CVE-2011-1353.html http://support.novell.com/security/cve/CVE-2011-2431.html http://support.novell.com/security/cve/CVE-2011-2432.html http://support.novell.com/security/cve/CVE-2011-2433.html http://support.novell.com/security/cve/CVE-2011-2434.html http://support.novell.com/security/cve/CVE-2011-2435.html http://support.novell.com/security/cve/CVE-2011-2436.html http://support.novell.com/security/cve/CVE-2011-2437.html http://support.novell.com/security/cve/CVE-2011-2438.html http://support.novell.com/security/cve/CVE-2011-2439.html http://support.novell.com/security/cve/CVE-2011-2440.html http://support.novell.com/security/cve/CVE-2011-2441.html http://support.novell.com/security/cve/CVE-2011-2442.html https://bugzilla.novell.com/717724 -- To unsubscribe, e-mail: opensuse-security-announce+unsubscribe(a)opensuse.org For additional commands, e-mail: opensuse-security-announce+help(a)opensuse.org

1 0

[security-announce] SUSE-SU-2011:1229-1: important: Security update for apache2
by opensuse-security＠opensuse.org 09 Nov '11

09 Nov '11

SUSE Security Update: Security update for apache2 ______________________________________________________________________________ Announcement ID: SUSE-SU-2011:1229-1 Rating: important References: #713966 #718106 #719236 #722545 Cross-References: CVE-2011-3192 Affected Products: SUSE Linux Enterprise Server 10 SP3 ______________________________________________________________________________ An update that solves one vulnerability and has three fixes is now available. Description: This update fixes several security issues in the Apache2 webserver. * The severe ByteRange remote denial of service attack (CVE-2011-3192) was fixed, configuration options used by upstream were added. Introduce new config option: Allow MaxRanges Number of ranges requested, if exceeded, the complete content is served. default: 200 0|unlimited: unlimited none: Range headers are ignored. This option is a backport from 2.2.21. * CVE-2011-0419,CVE-2011-1928: Two fnmatch denial of service attacks were fixed that could exhaust the servers memory. * CVE-2010-1623: Another memoryleak was fixed that could exhaust httpd server memory via unspecified methods. * CVE-2011-3368: This update also includes fixes a fix for a mod_proxy reverse exposure via RewriteRule or ProxyPassMatch directives. Security Issue references: * CVE-2011-3192 <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2011-3192 > Indications: Please install this update. Package List: - SUSE Linux Enterprise Server 10 SP3 (i586 s390x x86_64): apache2-2.2.3-16.32.37.1 apache2-devel-2.2.3-16.32.37.1 apache2-doc-2.2.3-16.32.37.1 apache2-example-pages-2.2.3-16.32.37.1 apache2-prefork-2.2.3-16.32.37.1 apache2-worker-2.2.3-16.32.37.1 References: http://support.novell.com/security/cve/CVE-2011-3192.html https://bugzilla.novell.com/713966 https://bugzilla.novell.com/718106 https://bugzilla.novell.com/719236 https://bugzilla.novell.com/722545 http://download.novell.com/patch/finder/?keywords=93f3f0fb2aeae6252ba07a3f1… -- To unsubscribe, e-mail: opensuse-security-announce+unsubscribe(a)opensuse.org For additional commands, e-mail: opensuse-security-announce+help(a)opensuse.org

1 0

[security-announce] SUSE-SU-2011:1218-1: important: Security update for pam
by opensuse-security＠opensuse.org 04 Nov '11

04 Nov '11

SUSE Security Update: Security update for pam ______________________________________________________________________________ Announcement ID: SUSE-SU-2011:1218-1 Rating: important References: #631802 #724480 Cross-References: CVE-2011-3148 CVE-2011-3149 Affected Products: ______________________________________________________________________________ An update that fixes two vulnerabilities is now available. Description: The pam_env module was vulnerable to a stack overflow (CVE-2011-3148) and a DoS condition (CVE-2011-3149) when parsing users .pam_environment files. Additionally a missing return value check inside pam_xauth has been fixed (CVE-2010-3316). Security Issue references: * CVE-2011-3148 <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2011-3148 > * CVE-2011-3149 <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2011-3149 > Package List: References: http://support.novell.com/security/cve/CVE-2011-3148.html http://support.novell.com/security/cve/CVE-2011-3149.html https://bugzilla.novell.com/631802 https://bugzilla.novell.com/724480 http://download.novell.com/patch/finder/?keywords=5e537729092eb30dd0de976a9… -- To unsubscribe, e-mail: opensuse-security-announce+unsubscribe(a)opensuse.org For additional commands, e-mail: opensuse-security-announce+help(a)opensuse.org

1 0

[security-announce] openSUSE-SU-2011:1217-1: important: apache2: Fixed several security issues
by opensuse-security＠opensuse.org 04 Nov '11

04 Nov '11

openSUSE Security Update: apache2: Fixed several security issues ______________________________________________________________________________ Announcement ID: openSUSE-SU-2011:1217-1 Rating: important References: #713966 #719236 #722545 Cross-References: CVE-2011-3192 Affected Products: openSUSE 11.4 openSUSE 11.3 ______________________________________________________________________________ An update that solves one vulnerability and has two fixes is now available. Description: This update fixes several security issues in the Apache webserver. The patch for the ByteRange remote denial of service attack (CVE-2011-3192) was refined and the configuration options used by upstream were added. Introduce new config option: Allow MaxRanges Number of ranges requested, if exceeded, the complete content is served. default: 200 0|unlimited: unlimited none: Range headers are ignored. This option is a backport from 2.2.21. Also fixed: CVE-2011-3348: Denial of service in proxy_ajp when using a undefined method. CVE-2011-3368: Exposure of internal servers via reverse proxy methods with mod_proxy enabled and incorrect Rewrite or Proxy Rules. Patch Instructions: To install this openSUSE Security Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE 11.4: zypper in -t patch apache2-5347 - openSUSE 11.3: zypper in -t patch apache2-5347 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE 11.4 (i586 x86_64): apache2-2.2.17-4.9.1 apache2-devel-2.2.17-4.9.1 apache2-example-certificates-2.2.17-4.9.1 apache2-example-pages-2.2.17-4.9.1 apache2-itk-2.2.17-4.9.1 apache2-prefork-2.2.17-4.9.1 apache2-utils-2.2.17-4.9.1 apache2-worker-2.2.17-4.9.1 - openSUSE 11.4 (noarch): apache2-doc-2.2.17-4.9.1 - openSUSE 11.3 (i586 x86_64): apache2-2.2.15-4.7.1 apache2-devel-2.2.15-4.7.1 apache2-example-certificates-2.2.15-4.7.1 apache2-example-pages-2.2.15-4.7.1 apache2-itk-2.2.15-4.7.1 apache2-prefork-2.2.15-4.7.1 apache2-utils-2.2.15-4.7.1 apache2-worker-2.2.15-4.7.1 - openSUSE 11.3 (noarch): apache2-doc-2.2.15-4.7.1 References: http://support.novell.com/security/cve/CVE-2011-3192.html https://bugzilla.novell.com/713966 https://bugzilla.novell.com/719236 https://bugzilla.novell.com/722545 -- To unsubscribe, e-mail: opensuse-security-announce+unsubscribe(a)opensuse.org For additional commands, e-mail: opensuse-security-announce+help(a)opensuse.org

1 0

[security-announce] SUSE-SU-2011:1216-1: important: Security update for Apache 2
by opensuse-security＠opensuse.org 04 Nov '11

04 Nov '11

SUSE Security Update: Security update for Apache 2 ______________________________________________________________________________ Announcement ID: SUSE-SU-2011:1216-1 Rating: important References: #555098 #627030 #661597 #663359 #690734 #713966 Cross-References: CVE-2011-3192 Affected Products: SUSE Linux Enterprise Server 10 SP2 ______________________________________________________________________________ An update that solves one vulnerability and has 5 fixes is now available. Description: This update fixes a remote denial of service bug (memory exhaustion) in the Apache 2 HTTP server, that could be triggered by remote attackers using multiple overlapping Request Ranges . (CVE-2011-3192) The fix introduces a new config option: Allow MaxRanges Number of ranges requested, if exceeded, the complete content is served. default: 200 0|unlimited: unlimited none: Range headers are ignored. (This option is a backport from 2.2.21.) It fixes also the minor security issue in the mod_cache modules in the Apache HTTP Server that allowed remote attackers to cause a denial of service (process crash) via a request that lacks a path. (CVE-2010-1452) It also fixes some non-security bugs: - take LimitRequestFieldsize config option into account when parsing headers from backend. Thereby avoid that the receiving buffers are too small. bnc#690734. - add / when on a directory to feed correctly linked listings. bnc#661597 - a2enmod shalt not disable a module in query mode. bnc#663359 - New option SSLRenegBufferSize fixes "413 Request Entity Too Large occur" problem. - fixes graceful restart hangs, bnc#555098. Security Issues: * CVE-2011-3192 <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2011-3192 > Indications: Please install this update. Package List: - SUSE Linux Enterprise Server 10 SP2 (i586 s390x x86_64): apache2-2.2.3-16.25.40 apache2-devel-2.2.3-16.25.40 apache2-doc-2.2.3-16.25.40 apache2-example-pages-2.2.3-16.25.40 apache2-prefork-2.2.3-16.25.40 apache2-worker-2.2.3-16.25.40 References: http://support.novell.com/security/cve/CVE-2011-3192.html https://bugzilla.novell.com/555098 https://bugzilla.novell.com/627030 https://bugzilla.novell.com/661597 https://bugzilla.novell.com/663359 https://bugzilla.novell.com/690734 https://bugzilla.novell.com/713966 http://download.novell.com/patch/finder/?keywords=5e275ea53de9c9e1156fe626e… -- To unsubscribe, e-mail: opensuse-security-announce+unsubscribe(a)opensuse.org For additional commands, e-mail: opensuse-security-announce+help(a)opensuse.org

1 0

[security-announce] SUSE-SU-2011:1215-1: important: Security update for Apache2
by opensuse-security＠opensuse.org 04 Nov '11

04 Nov '11

SUSE Security Update: Security update for Apache2 ______________________________________________________________________________ Announcement ID: SUSE-SU-2011:1215-1 Rating: important References: #688472 #693479 #713966 #719236 #722545 Cross-References: CVE-2011-3192 Affected Products: SUSE Linux Enterprise Software Development Kit 11 SP1 SUSE Linux Enterprise Server 11 SP1 for VMware SUSE Linux Enterprise Server 11 SP1 ______________________________________________________________________________ An update that solves one vulnerability and has four fixes is now available. It includes one version update. Description: This update brings Apache to version 2.2.12. The main reason is the enablement of the Server Name Indication (SNI) that allows several SSL-enabled domains on one IP address (FATE#311973). See the SSLStrictSNIVHostCheck directive as documented in /usr/share/apache2/manual/mod/mod_ssl.html.en Also the patch for the ByteRange remote denial of service attack (CVE-2011-3192) was refined and the configuration options used by upstream were added. Introduce new config option: Allow MaxRanges Number of ranges requested, if exceeded, the complete content is served. default: 200 0|unlimited: unlimited none: Range headers are ignored. This option is a backport from 2.2.21. Also fixed were * CVE-2011-3348: Denial of service in proxy_ajp when using a undefined method. * CVE-2011-3368: Exposure of internal servers via reverse proxy methods with mod_proxy enabled and incorrect Rewrite or Proxy Rules. This update also includes a newer apache2-vhost-ssl.template, which disables SSLv2, and allows SSLv3 and strong ciphers only. Please note that existing vhosts will not be converted. Security Issue references: * CVE-2011-3192 <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2011-3192 > Indications: Please install this update. Patch Instructions: To install this SUSE Security Update use YaST online_update. Alternatively you can run the command listed for your product: - SUSE Linux Enterprise Software Development Kit 11 SP1: zypper in -t patch sdksp1-apache2-5344 - SUSE Linux Enterprise Server 11 SP1 for VMware: zypper in -t patch slessp1-apache2-5344 - SUSE Linux Enterprise Server 11 SP1: zypper in -t patch slessp1-apache2-5344 To bring your system up-to-date, use "zypper patch". Package List: - SUSE Linux Enterprise Software Development Kit 11 SP1 (i586 ia64 ppc64 s390x x86_64) [New Version: 2.2.12]: apache2-devel-2.2.12-1.18.1 - SUSE Linux Enterprise Software Development Kit 11 SP1 (i586 x86_64) [New Version: 2.2.12]: apache2-2.2.12-1.18.1 apache2-doc-2.2.12-1.18.1 apache2-example-pages-2.2.12-1.18.1 apache2-prefork-2.2.12-1.18.1 apache2-utils-2.2.12-1.18.1 apache2-worker-2.2.12-1.18.1 - SUSE Linux Enterprise Server 11 SP1 for VMware (i586 x86_64) [New Version: 2.2.12]: apache2-2.2.12-1.18.1 apache2-doc-2.2.12-1.18.1 apache2-example-pages-2.2.12-1.18.1 apache2-prefork-2.2.12-1.18.1 apache2-utils-2.2.12-1.18.1 apache2-worker-2.2.12-1.18.1 - SUSE Linux Enterprise Server 11 SP1 (i586 ia64 ppc64 s390x x86_64) [New Version: 2.2.12]: apache2-2.2.12-1.18.1 apache2-doc-2.2.12-1.18.1 apache2-example-pages-2.2.12-1.18.1 apache2-prefork-2.2.12-1.18.1 apache2-utils-2.2.12-1.18.1 apache2-worker-2.2.12-1.18.1 References: http://support.novell.com/security/cve/CVE-2011-3192.html https://bugzilla.novell.com/688472 https://bugzilla.novell.com/693479 https://bugzilla.novell.com/713966 https://bugzilla.novell.com/719236 https://bugzilla.novell.com/722545 http://download.novell.com/patch/finder/?keywords=274b1ea87316767c995b46d30… -- To unsubscribe, e-mail: opensuse-security-announce+unsubscribe(a)opensuse.org For additional commands, e-mail: opensuse-security-announce+help(a)opensuse.org

1 0

[security-announce] SUSE-SU-2011:1209-1: important: Security update for pam
by opensuse-security＠opensuse.org 03 Nov '11

03 Nov '11

SUSE Security Update: Security update for pam ______________________________________________________________________________ Announcement ID: SUSE-SU-2011:1209-1 Rating: important References: #568833 #631802 #703187 #724480 Cross-References: CVE-2010-3316 CVE-2011-3148 CVE-2011-3149 Affected Products: SUSE Linux Enterprise Server 10 SP3 ______________________________________________________________________________ An update that solves three vulnerabilities and has one errata is now available. Description: The pam_env module is vulnerable to a stack overflow (CVE-2011-3148) and a DoS condition (CVE-2011-3149) when parsing users .pam_environment files. Additionally a missing return value check inside pam_xauth has been fixed (CVE-2010-3316). Security Issue references: * CVE-2011-3148 <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2011-3148 > * CVE-2011-3149 <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2011-3149 > * CVE-2010-3316 <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2010-3316 > Package List: - SUSE Linux Enterprise Server 10 SP3 (i586 ia64 ppc s390x x86_64): pam-0.99.6.3-28.20.3.4 pam-devel-0.99.6.3-28.20.3.4 - SUSE Linux Enterprise Server 10 SP3 (s390x x86_64): pam-32bit-0.99.6.3-28.20.3.4 pam-devel-32bit-0.99.6.3-28.20.3.4 - SUSE Linux Enterprise Server 10 SP3 (ia64): pam-x86-0.99.6.3-28.20.3.4 - SUSE Linux Enterprise Server 10 SP3 (ppc): pam-64bit-0.99.6.3-28.20.3.4 pam-devel-64bit-0.99.6.3-28.20.3.4 References: http://support.novell.com/security/cve/CVE-2010-3316.html http://support.novell.com/security/cve/CVE-2011-3148.html http://support.novell.com/security/cve/CVE-2011-3149.html https://bugzilla.novell.com/568833 https://bugzilla.novell.com/631802 https://bugzilla.novell.com/703187 https://bugzilla.novell.com/724480 http://download.novell.com/patch/finder/?keywords=c3b33b1f77a3515061a441ec5… -- To unsubscribe, e-mail: opensuse-security-announce+unsubscribe(a)opensuse.org For additional commands, e-mail: opensuse-security-announce+help(a)opensuse.org

1 0

[security-announce] openSUSE-SU-2011:1208-1: important: pam: fixing stack overflow (CVE-2011-3148), a local DoS (CVE-2011-3149) and CVE-2010-3316.
by opensuse-security＠opensuse.org 03 Nov '11

03 Nov '11

openSUSE Security Update: pam: fixing stack overflow (CVE-2011-3148), a local DoS (CVE-2011-3149) and CVE-2010-3316. ______________________________________________________________________________ Announcement ID: openSUSE-SU-2011:1208-1 Rating: important References: #631802 #724480 Cross-References: CVE-2010-3316 CVE-2011-3148 CVE-2011-3149 Affected Products: openSUSE 11.3 ______________________________________________________________________________ An update that fixes three vulnerabilities is now available. Description: The pam_env module is vulnerable to a stack overflow (CVE-2011-3148) and a DoS condition (CVE-2011-3149) when parsing users .pam_environment files. Additionally a missing return value check inside pam_xauth has been fixed (CVE-2010-3316). Patch Instructions: To install this openSUSE Security Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE 11.3: zypper in -t patch pam-5331 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE 11.3 (i586 x86_64): pam-1.1.1.90-2.3.1 pam-devel-1.1.1.90-2.3.1 - openSUSE 11.3 (x86_64): pam-32bit-1.1.1.90-2.3.1 pam-devel-32bit-1.1.1.90-2.3.1 - openSUSE 11.3 (noarch): pam-doc-1.1.1.90-2.3.1 References: http://support.novell.com/security/cve/CVE-2010-3316.html http://support.novell.com/security/cve/CVE-2011-3148.html http://support.novell.com/security/cve/CVE-2011-3149.html https://bugzilla.novell.com/631802 https://bugzilla.novell.com/724480 -- To unsubscribe, e-mail: opensuse-security-announce+unsubscribe(a)opensuse.org For additional commands, e-mail: opensuse-security-announce+help(a)opensuse.org

1 0

[security-announce] SUSE-SU-2011:1207-1: important: Security update for pam
by opensuse-security＠opensuse.org 03 Nov '11

03 Nov '11

SUSE Security Update: Security update for pam ______________________________________________________________________________ Announcement ID: SUSE-SU-2011:1207-1 Rating: important References: #631802 #724480 #726071 Cross-References: CVE-2010-3316 CVE-2011-3148 CVE-2011-3149 Affected Products: SUSE Linux Enterprise Software Development Kit 11 SP1 SUSE Linux Enterprise Server 11 SP1 for VMware SUSE Linux Enterprise Server 11 SP1 SUSE Linux Enterprise Desktop 11 SP1 ______________________________________________________________________________ An update that fixes three vulnerabilities is now available. Description: The pam_env module is vulnerable to a stack overflow (CVE-2011-3148) and a DoS condition (CVE-2011-3149) when parsing users .pam_environment files. Additionally a missing return value check inside pam_xauth has been fixed (CVE-2010-3316). Security Issue references: * CVE-2011-3148 <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2011-3148 > * CVE-2011-3149 <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2011-3149 > * CVE-2010-3316 <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2010-3316 > Patch Instructions: To install this SUSE Security Update use YaST online_update. Alternatively you can run the command listed for your product: - SUSE Linux Enterprise Software Development Kit 11 SP1: zypper in -t patch sdksp1-pam-5342 - SUSE Linux Enterprise Server 11 SP1 for VMware: zypper in -t patch slessp1-pam-5342 - SUSE Linux Enterprise Server 11 SP1: zypper in -t patch slessp1-pam-5342 - SUSE Linux Enterprise Desktop 11 SP1: zypper in -t patch sledsp1-pam-5342 To bring your system up-to-date, use "zypper patch". Package List: - SUSE Linux Enterprise Software Development Kit 11 SP1 (i586 ia64 ppc64 s390x x86_64): pam-devel-1.0.4-0.7.1 - SUSE Linux Enterprise Software Development Kit 11 SP1 (ppc64 s390x x86_64): pam-devel-32bit-1.0.4-0.7.1 - SUSE Linux Enterprise Server 11 SP1 for VMware (i586 x86_64): pam-1.0.4-0.7.1 pam-doc-1.0.4-0.7.1 - SUSE Linux Enterprise Server 11 SP1 for VMware (x86_64): pam-32bit-1.0.4-0.7.1 - SUSE Linux Enterprise Server 11 SP1 (i586 ia64 ppc64 s390x x86_64): pam-1.0.4-0.7.1 pam-doc-1.0.4-0.7.1 - SUSE Linux Enterprise Server 11 SP1 (ppc64 s390x x86_64): pam-32bit-1.0.4-0.7.1 - SUSE Linux Enterprise Server 11 SP1 (ia64): pam-x86-1.0.4-0.7.1 - SUSE Linux Enterprise Desktop 11 SP1 (i586 x86_64): pam-1.0.4-0.7.1 pam-doc-1.0.4-0.7.1 - SUSE Linux Enterprise Desktop 11 SP1 (x86_64): pam-32bit-1.0.4-0.7.1 References: http://support.novell.com/security/cve/CVE-2010-3316.html http://support.novell.com/security/cve/CVE-2011-3148.html http://support.novell.com/security/cve/CVE-2011-3149.html https://bugzilla.novell.com/631802 https://bugzilla.novell.com/724480 https://bugzilla.novell.com/726071 http://download.novell.com/patch/finder/?keywords=fd9b46439ba47c737129f5873… -- To unsubscribe, e-mail: opensuse-security-announce+unsubscribe(a)opensuse.org For additional commands, e-mail: opensuse-security-announce+help(a)opensuse.org

1 0