September 2011 - openSUSE Security Announce

[security-announce] openSUSE-SU-2011:1079-1: important: MozillaFirefox: Update to Firefox 3.6.23
by opensuse-security＠opensuse.org 29 Sep '11

29 Sep '11

openSUSE Security Update: MozillaFirefox: Update to Firefox 3.6.23 ______________________________________________________________________________ Announcement ID: openSUSE-SU-2011:1079-1 Rating: important References: #720264 Cross-References: CVE-2011-2372 CVE-2011-2995 CVE-2011-2996 CVE-2011-2999 CVE-2011-3000 Affected Products: openSUSE 11.3 ______________________________________________________________________________ An update that fixes 5 vulnerabilities is now available. It includes two new package versions. Description: Mozilla Firefox was updated to version 3.6.23, fixing various bugs and security issues. MFSA 2011-36: Mozilla developers identified and fixed several memory safety bugs in the browser engine used in Firefox and other Mozilla-based products. Some of these bugs showed evidence of memory corruption under certain circumstances, and we presume that with enough effort at least some of these could be exploited to run arbitrary code. In general these flaws cannot be exploited through email in the Thunderbird and SeaMonkey products because scripting is disabled,, but are potentially a risk in browser or browser-like contexts in those products. Benjamin Smedberg, Bob Clary, and Jesse Ruderman reported memory safety problems that affected Firefox 3.6 and Firefox 6. (CVE-2011-2995) Josh Aas reported a potential crash in the plugin API that affected Firefox 3.6 only. (CVE-2011-2996) MFSA 2011-37: Mark Kaplan reported a potentially exploitable crash due to integer underflow when using a large JavaScript RegExp expression. We would also like to thank Mark for contributing the fix for this problem. (no CVE yet) MFSA 2011-38: Mozilla developer Boris Zbarsky reported that a frame named "location" could shadow the window.location object unless a script in a page grabbed a reference to the true object before the frame was created. Because some plugins use the value of window.location to determine the page origin this could fool the plugin into granting the plugin content access to another site or the local file system in violation of the Same Origin Policy. This flaw allows circumvention of the fix added for MFSA 2010-10. (CVE-2011-2999) MFSA 2011-39: Ian Graham of Citrix Online reported that when multiple Location headers were present in a redirect response Mozilla behavior differed from other browsers: Mozilla would use the second Location header while Chrome and Internet Explorer would use the first. Two copies of this header with different values could be a symptom of a CRLF injection attack against a vulnerable server. Most commonly it is the Location header itself that is vulnerable to the response splitting and therefore the copy preferred by Mozilla is more likely to be the malicious one. It is possible, however, that the first copy was the injected one depending on the nature of the server vulnerability. The Mozilla browser engine has been changed to treat two copies of this header with different values as an error condition. The same has been done with the headers Content-Length and Content-Disposition. (CVE-2011-3000) MFSA 2011-40: Mariusz Mlynski reported that if you could convince a user to hold down the Enter key--as part of a game or test, perhaps--a malicious page could pop up a download dialog where the held key would then activate the default Open action. For some file types this would be merely annoying (the equivalent of a pop-up) but other file types have powerful scripting capabilities. And this would provide an avenue for an attacker to exploit a vulnerability in applications not normally exposed to potentially hostile internet content. Holding enter allows arbitrary code execution due to Download Manager (CVE-2011-2372) Patch Instructions: To install this openSUSE Security Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE 11.3: zypper in -t patch MozillaFirefox-5203 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE 11.3 (i586 x86_64) [New Version: 1.9.2.23 and 3.6.23]: MozillaFirefox-3.6.23-0.2.1 MozillaFirefox-branding-upstream-3.6.23-0.2.1 MozillaFirefox-translations-common-3.6.23-0.2.1 MozillaFirefox-translations-other-3.6.23-0.2.1 mozilla-js192-1.9.2.23-1.2.1 mozilla-xulrunner192-1.9.2.23-1.2.1 mozilla-xulrunner192-buildsymbols-1.9.2.23-1.2.1 mozilla-xulrunner192-devel-1.9.2.23-1.2.1 mozilla-xulrunner192-gnome-1.9.2.23-1.2.1 mozilla-xulrunner192-translations-common-1.9.2.23-1.2.1 mozilla-xulrunner192-translations-other-1.9.2.23-1.2.1 - openSUSE 11.3 (x86_64) [New Version: 1.9.2.23]: mozilla-js192-32bit-1.9.2.23-1.2.1 mozilla-xulrunner192-32bit-1.9.2.23-1.2.1 mozilla-xulrunner192-gnome-32bit-1.9.2.23-1.2.1 mozilla-xulrunner192-translations-common-32bit-1.9.2.23-1.2.1 mozilla-xulrunner192-translations-other-32bit-1.9.2.23-1.2.1 References: http://support.novell.com/security/cve/CVE-2011-2372.html http://support.novell.com/security/cve/CVE-2011-2995.html http://support.novell.com/security/cve/CVE-2011-2996.html http://support.novell.com/security/cve/CVE-2011-2999.html http://support.novell.com/security/cve/CVE-2011-3000.html https://bugzilla.novell.com/720264 -- To unsubscribe, e-mail: opensuse-security-announce+unsubscribe(a)opensuse.org For additional commands, e-mail: opensuse-security-announce+help(a)opensuse.org

1 0

[security-announce] openSUSE-SU-2011:1077-1: important: seamonkey: Update to Mozilla Seamonkey 2.4
by opensuse-security＠opensuse.org 29 Sep '11

29 Sep '11

openSUSE Security Update: seamonkey: Update to Mozilla Seamonkey 2.4 ______________________________________________________________________________ Announcement ID: openSUSE-SU-2011:1077-1 Rating: important References: #720264 Cross-References: CVE-2011-2372 CVE-2011-2995 CVE-2011-2997 CVE-2011-2999 CVE-2011-3000 CVE-2011-3001 CVE-2011-3002 CVE-2011-3003 CVE-2011-3004 CVE-2011-3005 CVE-2011-3232 Affected Products: openSUSE 11.4 openSUSE 11.3 ______________________________________________________________________________ An update that fixes 11 vulnerabilities is now available. It includes two new package versions. Description: Mozilla Seamonkey was updated to version 2.4, fixing various bugs and security issues. MFSA 2011-36: Mozilla developers identified and fixed several memory safety bugs in the browser engine used in Firefox and other Mozilla-based products. Some of these bugs showed evidence of memory corruption under certain circumstances, and we presume that with enough effort at least some of these could be exploited to run arbitrary code. In general these flaws cannot be exploited through email in the Thunderbird and SeaMonkey products because scripting is disabled, but are potentially a risk in browser or browser-like contexts in those products. Benjamin Smedberg, Bob Clary, and Jesse Ruderman reported memory safety problems that affected Firefox 3.6 and Firefox 6. (CVE-2011-2995) Bob Clary, Andrew McCreight, Andreas Gal, Gary Kwong, Igor Bukanov, Jason Orendorff, Jesse Ruderman, and Marcia Knous reported memory safety problems that affected Firefox 6, fixed in Firefox 7. (CVE-2011-2997) MFSA 2011-38: Mozilla developer Boris Zbarsky reported that a frame named "location" could shadow the window.location object unless a script in a page grabbed a reference to the true object before the frame was created. Because some plugins use the value of window.location to determine the page origin this could fool the plugin into granting the plugin content access to another site or the local file system in violation of the Same Origin Policy. This flaw allows circumvention of the fix added for MFSA 2010-10. (CVE-2011-2999) MFSA 2011-39: Ian Graham of Citrix Online reported that when multiple Location headers were present in a redirect response Mozilla behavior differed from other browsers: Mozilla would use the second Location header while Chrome and Internet Explorer would use the first. Two copies of this header with different values could be a symptom of a CRLF injection attack against a vulnerable server. Most commonly it is the Location header itself that is vulnerable to the response splitting and therefore the copy preferred by Mozilla is more likely to be the malicious one. It is possible, however, that the first copy was the injected one depending on the nature of the server vulnerability. The Mozilla browser engine has been changed to treat two copies of this header with different values as an error condition. The same has been done with the headers Content-Length and Content-Disposition. (CVE-2011-3000) MFSA 2011-40: Mariusz Mlynski reported that if you could convince a user to hold down the Enter key--as part of a game or test, perhaps--a malicious page could pop up a download dialog where the held key would then activate the default Open action. For some file types this would be merely annoying (the equivalent of a pop-up) but other file types have powerful scripting capabilities. And this would provide an avenue for an attacker to exploit a vulnerability in applications not normally exposed to potentially hostile internet content. Mariusz also reported a similar flaw with manual plugin installation using the PLUGINSPAGE attribute. It was possible to create an internal error that suppressed a confirmation dialog, such that holding enter would lead to the installation of an arbitrary add-on. (This variant did not affect Firefox 3.6) Holding enter allows arbitrary code execution due to Download Manager (CVE-2011-2372) Holding enter allows arbitrary extension installation (CVE-2011-3001) MFSA 2011-41: Michael Jordon of Context IS reported that in the ANGLE library used by WebGL the return value from GrowAtomTable() was not checked for errors. If an attacker could cause requests that exceeded the available memeory those would fail and potentially lead to a buffer overrun as subsequent code wrote into the non-allocated space. (CVE-2011-3002) Ben Hawkes of the Google Security Team reported a WebGL test case that demonstrated an out of bounds write after an allocation failed. (CVE-2011-3003) MFSA 2011-42: Security researcher Aki Helin reported a potentially exploitable crash in the YARR regular expression library used by JavaScript. (CVE-2011-3232) MFSA 2011-43: David Rees reported that the JSSubScriptLoader (a feature used by some add-ons) was "unwrapping" XPCNativeWrappers when they were used as the scope parameter to loadSubScript(). Without the protection of the wrappers the add-on could be vulnerable to privilege escalation attacks from malicious web content. Whether any given add-on were vulnerable would depend on how the add-on used the feature and whether it interacted directly with web content, but we did find at least one vulnerable add-on and presumer there are more. (CVE-2011-3004) The unwrapping behavior was a change introduced during Firefox 4 development. Firefox 3.6 and earlier versions are not affected. MFSA 2011-44: sczimmer reported that Firefox crashed when loading a particular .ogg file. This was due to a use-after-free condition and could potentially be exploited to install malware. (CVE-2011-3005) This vulnerability does not affect Firefox 3.6 or earlier. MFSA 2011-45: University of California, Davis researchers Liang Cai and Hao Chen presented a paper at the 2011 USENIX HotSec workshop on inferring keystrokes from device motion data on mobile devices. Web pages can now receive data similar to the apps studied in that paper and likely present a similar risk. We have decided to limit motion data events to the currently-active tab to prevent the possibility of background tabs attempting to decipher keystrokes the user is entering into the foreground tab. Patch Instructions: To install this openSUSE Security Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE 11.4: zypper in -t patch MozillaFirefox-5208 seamonkey-5210 - openSUSE 11.3: zypper in -t patch seamonkey-5210 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE 11.4 (i586 x86_64) [New Version: 2.4 and 7.0]: MozillaFirefox-7.0-1.2.1 MozillaFirefox-branding-upstream-7.0-1.2.1 MozillaFirefox-buildsymbols-7.0-1.2.1 MozillaFirefox-devel-7.0-1.2.1 MozillaFirefox-translations-common-7.0-1.2.1 MozillaFirefox-translations-other-7.0-1.2.1 seamonkey-2.4-1.2.1 seamonkey-dom-inspector-2.4-1.2.1 seamonkey-irc-2.4-1.2.1 seamonkey-translations-common-2.4-1.2.1 seamonkey-translations-other-2.4-1.2.1 seamonkey-venkman-2.4-1.2.1 - openSUSE 11.3 (i586 x86_64) [New Version: 2.4]: seamonkey-2.4-1.2.1 seamonkey-dom-inspector-2.4-1.2.1 seamonkey-irc-2.4-1.2.1 seamonkey-translations-common-2.4-1.2.1 seamonkey-translations-other-2.4-1.2.1 seamonkey-venkman-2.4-1.2.1 References: http://support.novell.com/security/cve/CVE-2011-2372.html http://support.novell.com/security/cve/CVE-2011-2995.html http://support.novell.com/security/cve/CVE-2011-2997.html http://support.novell.com/security/cve/CVE-2011-2999.html http://support.novell.com/security/cve/CVE-2011-3000.html http://support.novell.com/security/cve/CVE-2011-3001.html http://support.novell.com/security/cve/CVE-2011-3002.html http://support.novell.com/security/cve/CVE-2011-3003.html http://support.novell.com/security/cve/CVE-2011-3004.html http://support.novell.com/security/cve/CVE-2011-3005.html http://support.novell.com/security/cve/CVE-2011-3232.html https://bugzilla.novell.com/720264 -- To unsubscribe, e-mail: opensuse-security-announce+unsubscribe(a)opensuse.org For additional commands, e-mail: opensuse-security-announce+help(a)opensuse.org

1 0

[security-announce] openSUSE-SU-2011:1076-1: important: mozilla-xulrunner192: Update to Mozilla XULRunner 1.9.2.23
by opensuse-security＠opensuse.org 29 Sep '11

29 Sep '11

openSUSE Security Update: mozilla-xulrunner192: Update to Mozilla XULRunner 1.9.2.23 ______________________________________________________________________________ Announcement ID: openSUSE-SU-2011:1076-1 Rating: important References: #720264 Affected Products: openSUSE 11.4 ______________________________________________________________________________ An update that contains security fixes can now be installed. It includes one version update. Description: Mozilla XULRunner was updated to version 1.9.2.23, fixing various bugs and security issues. MFSA 2011-36: Mozilla developers identified and fixed several memory safety bugs in the browser engine used in Firefox and other Mozilla-based products. Some of these bugs showed evidence of memory corruption under certain circumstances, and we presume that with enough effort at least some of these could be exploited to run arbitrary code. In general these flaws cannot be exploited through email in the Thunderbird and SeaMonkey products because scripting is disabled,, but are potentially a risk in browser or browser-like contexts in those products. Benjamin Smedberg, Bob Clary, and Jesse Ruderman reported memory safety problems that affected Firefox 3.6 and Firefox 6. (CVE-2011-2995) Josh Aas reported a potential crash in the plugin API that affected Firefox 3.6 only. (CVE-2011-2996) MFSA 2011-37: Mark Kaplan reported a potentially exploitable crash due to integer underflow when using a large JavaScript RegExp expression. We would also like to thank Mark for contributing the fix for this problem. (no CVE yet) MFSA 2011-38: Mozilla developer Boris Zbarsky reported that a frame named "location" could shadow the window.location object unless a script in a page grabbed a reference to the true object before the frame was created. Because some plugins use the value of window.location to determine the page origin this could fool the plugin into granting the plugin content access to another site or the local file system in violation of the Same Origin Policy. This flaw allows circumvention of the fix added for MFSA 2010-10. (CVE-2011-2999) MFSA 2011-39: Ian Graham of Citrix Online reported that when multiple Location headers were present in a redirect response Mozilla behavior differed from other browsers: Mozilla would use the second Location header while Chrome and Internet Explorer would use the first. Two copies of this header with different values could be a symptom of a CRLF injection attack against a vulnerable server. Most commonly it is the Location header itself that is vulnerable to the response splitting and therefore the copy preferred by Mozilla is more likely to be the malicious one. It is possible, however, that the first copy was the injected one depending on the nature of the server vulnerability. The Mozilla browser engine has been changed to treat two copies of this header with different values as an error condition. The same has been done with the headers Content-Length and Content-Disposition. (CVE-2011-3000) MFSA 2011-40: Mariusz Mlynski reported that if you could convince a user to hold down the Enter key--as part of a game or test, perhaps--a malicious page could pop up a download dialog where the held key would then activate the default Open action. For some file types this would be merely annoying (the equivalent of a pop-up) but other file types have powerful scripting capabilities. And this would provide an avenue for an attacker to exploit a vulnerability in applications not normally exposed to potentially hostile internet content. Holding enter allows arbitrary code execution due to Download Manager (CVE-2011-2372) Patch Instructions: To install this openSUSE Security Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE 11.4: zypper in -t patch mozilla-js192-5206 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE 11.4 (i586 x86_64) [New Version: 1.9.2.23]: mozilla-js192-1.9.2.23-1.2.1 mozilla-xulrunner192-1.9.2.23-1.2.1 mozilla-xulrunner192-buildsymbols-1.9.2.23-1.2.1 mozilla-xulrunner192-devel-1.9.2.23-1.2.1 mozilla-xulrunner192-gnome-1.9.2.23-1.2.1 mozilla-xulrunner192-translations-common-1.9.2.23-1.2.1 mozilla-xulrunner192-translations-other-1.9.2.23-1.2.1 - openSUSE 11.4 (x86_64) [New Version: 1.9.2.23]: mozilla-js192-32bit-1.9.2.23-1.2.1 mozilla-xulrunner192-32bit-1.9.2.23-1.2.1 mozilla-xulrunner192-gnome-32bit-1.9.2.23-1.2.1 mozilla-xulrunner192-translations-common-32bit-1.9.2.23-1.2.1 mozilla-xulrunner192-translations-other-32bit-1.9.2.23-1.2.1 References: https://bugzilla.novell.com/720264 -- To unsubscribe, e-mail: opensuse-security-announce+unsubscribe(a)opensuse.org For additional commands, e-mail: opensuse-security-announce+help(a)opensuse.org

1 0

[security-announce] SUSE-SU-2011:1075-1: important: Security update for quagga
by opensuse-security＠opensuse.org 28 Sep '11

28 Sep '11

SUSE Security Update: Security update for quagga ______________________________________________________________________________ Announcement ID: SUSE-SU-2011:1075-1 Rating: important References: #718056 #718058 #718059 #718061 #718062 Cross-References: CVE-2011-3323 CVE-2011-3324 CVE-2011-3325 CVE-2011-3326 CVE-2011-3327 Affected Products: SUSE Linux Enterprise Software Development Kit 11 SP1 SUSE Linux Enterprise Server 11 SP1 for VMware SUSE Linux Enterprise Server 11 SP1 SUSE Linux Enterprise Server 10 SP4 SUSE Linux Enterprise Server 10 SP3 SLE SDK 10 SP4 SLE SDK 10 SP3 ______________________________________________________________________________ An update that fixes 5 vulnerabilities is now available. Description: This update fixes the following security issues: * 718056: OSPF6D buffer overflow while decoding Link State Update with Inter Area Prefix Lsa (CVE-2011-3323) * 718058: OSPF6D DoS while decoding Database Description packet (CVE-2011-3324) * 718059: OSPFD DoS while decoding Hello packet (CVE-2011-3325) * 718061: OSPFD DoS while decoding Link State Update (CVE-2011-3326) * 718062: DoS while decoding EXTENDED_COMMUNITIES in Quagga's BGP (CVE-2011-3327) Security Issue references: * CVE-2011-3324 <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2011-3324 > * CVE-2011-3327 <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2011-3327 > * CVE-2011-3325 <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2011-3325 > * CVE-2011-3326 <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2011-3326 > * CVE-2011-3323 <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2011-3323 > Contraindications: Patch Instructions: To install this SUSE Security Update use YaST online_update. Alternatively you can run the command listed for your product: - SUSE Linux Enterprise Software Development Kit 11 SP1: zypper in -t patch sdksp1-quagga-5169 - SUSE Linux Enterprise Server 11 SP1 for VMware: zypper in -t patch slessp1-quagga-5169 - SUSE Linux Enterprise Server 11 SP1: zypper in -t patch slessp1-quagga-5169 To bring your system up-to-date, use "zypper patch". Package List: - SUSE Linux Enterprise Software Development Kit 11 SP1 (i586 ia64 ppc64 s390x x86_64): quagga-devel-0.99.15-0.6.2 - SUSE Linux Enterprise Software Development Kit 11 SP1 (i586 x86_64): quagga-0.99.15-0.6.2 - SUSE Linux Enterprise Server 11 SP1 for VMware (i586 x86_64): quagga-0.99.15-0.6.2 - SUSE Linux Enterprise Server 11 SP1 (i586 ia64 ppc64 s390x x86_64): quagga-0.99.15-0.6.2 - SUSE Linux Enterprise Server 10 SP4 (i586 ia64 ppc s390x x86_64): quagga-0.99.9-14.11.9 quagga-devel-0.99.9-14.11.9 - SUSE Linux Enterprise Server 10 SP3 (i586 ia64 ppc s390x x86_64): quagga-0.99.9-14.11.9 quagga-devel-0.99.9-14.11.9 - SLE SDK 10 SP4 (i586 ia64 ppc s390x x86_64): quagga-0.99.9-14.11.9 quagga-devel-0.99.9-14.11.9 - SLE SDK 10 SP3 (i586 ia64 ppc s390x x86_64): quagga-0.99.9-14.11.9 quagga-devel-0.99.9-14.11.9 References: http://support.novell.com/security/cve/CVE-2011-3323.html http://support.novell.com/security/cve/CVE-2011-3324.html http://support.novell.com/security/cve/CVE-2011-3325.html http://support.novell.com/security/cve/CVE-2011-3326.html http://support.novell.com/security/cve/CVE-2011-3327.html https://bugzilla.novell.com/718056 https://bugzilla.novell.com/718058 https://bugzilla.novell.com/718059 https://bugzilla.novell.com/718061 https://bugzilla.novell.com/718062 http://download.novell.com/patch/finder/?keywords=8305dbd2a7b9ca1e42b8333a9… http://download.novell.com/patch/finder/?keywords=cd3c1bf2e33f25c0bb1223847… http://download.novell.com/patch/finder/?keywords=f7777ccc3793cd9932158dd23… -- To unsubscribe, e-mail: opensuse-security-announce+unsubscribe(a)opensuse.org For additional commands, e-mail: opensuse-security-announce+help(a)opensuse.org

1 0

[security-announce] SUSE-SU-2011:1042-2: important: Security update for libfreebl3
by opensuse-security＠opensuse.org 26 Sep '11

26 Sep '11

SUSE Security Update: Security update for libfreebl3 ______________________________________________________________________________ Announcement ID: SUSE-SU-2011:1042-2 Rating: important References: #714931 Affected Products: SUSE Linux Enterprise Software Development Kit 11 SP1 SUSE Linux Enterprise Server 11 SP1 for VMware SUSE Linux Enterprise Server 11 SP1 SUSE Linux Enterprise Desktop 11 SP1 ______________________________________________________________________________ An update that contains security fixes can now be installed. It includes two new package versions. Description: This update updates Mozilla NSS to 3.12.11. The update marks the compromised DigiNotar Certificate Authority as untrusted For more information read: MFSA 2011-34 <http://www.mozilla.org/security/announce/2011/mfsa2011-34.h tml> * update to 3.12.10 o root CA changes o filter certain bogus certs (bmo#642815) o fix minor memory leaks o other bugfixes * update to 3.12.9 o fix minor memory leaks (bmo#619268) o fix crash in nss_cms_decoder_work_data (bmo#607058) o fix crash in certutil (bmo#620908) o handle invalid argument in JPAKE (bmo#609068) o J-PAKE support (API requirement for Firefox >= 4.0b8) * replaced expired PayPal test certificate (fixing testsuite) * removed DigiNotar root certifiate from trusted db (bmo#682927) This update also brings the prerequired Mozilla NSPR to version 4.8.9. * update to 4.8.9 * update to 4.8.8 o support IPv6 on Android (bmo#626866) o use AI_ADDRCONFIG for loopback hostnames (bmo#614526) o support SDP sockets (bmo#518078) o support m32r architecture (bmo#635667) o use atomic functions on ARM (bmo#626309) o some other fixes not affecting the Linux platform Indications: Please install this update. Patch Instructions: To install this SUSE Security Update use YaST online_update. Alternatively you can run the command listed for your product: - SUSE Linux Enterprise Software Development Kit 11 SP1: zypper in -t patch sdksp1-nss-31211-5138 - SUSE Linux Enterprise Server 11 SP1 for VMware: zypper in -t patch slessp1-nss-31211-5138 - SUSE Linux Enterprise Server 11 SP1: zypper in -t patch slessp1-nss-31211-5138 - SUSE Linux Enterprise Desktop 11 SP1: zypper in -t patch sledsp1-nss-31211-5138 To bring your system up-to-date, use "zypper patch". Package List: - SUSE Linux Enterprise Software Development Kit 11 SP1 (i586 ia64 ppc64 s390x x86_64) [New Version: 3.12.11 and 4.8.9]: mozilla-nspr-devel-4.8.9-1.2.2.1 mozilla-nss-devel-3.12.11-3.2.2.1 - SUSE Linux Enterprise Server 11 SP1 for VMware (i586 x86_64) [New Version: 3.12.11 and 4.8.9]: libfreebl3-3.12.11-3.2.2.1 mozilla-nspr-4.8.9-1.2.2.1 mozilla-nss-3.12.11-3.2.2.1 mozilla-nss-tools-3.12.11-3.2.2.1 - SUSE Linux Enterprise Server 11 SP1 for VMware (x86_64) [New Version: 3.12.11 and 4.8.9]: libfreebl3-32bit-3.12.11-3.2.2.1 mozilla-nspr-32bit-4.8.9-1.2.2.1 mozilla-nss-32bit-3.12.11-3.2.2.1 - SUSE Linux Enterprise Server 11 SP1 (i586 ia64 ppc64 s390x x86_64) [New Version: 3.12.11 and 4.8.9]: libfreebl3-3.12.11-3.2.2.1 mozilla-nspr-4.8.9-1.2.2.1 mozilla-nss-3.12.11-3.2.2.1 mozilla-nss-tools-3.12.11-3.2.2.1 - SUSE Linux Enterprise Server 11 SP1 (ppc64 s390x x86_64) [New Version: 3.12.11 and 4.8.9]: libfreebl3-32bit-3.12.11-3.2.2.1 mozilla-nspr-32bit-4.8.9-1.2.2.1 mozilla-nss-32bit-3.12.11-3.2.2.1 - SUSE Linux Enterprise Server 11 SP1 (ia64) [New Version: 3.12.11 and 4.8.9]: libfreebl3-x86-3.12.11-3.2.2.1 mozilla-nspr-x86-4.8.9-1.2.2.1 mozilla-nss-x86-3.12.11-3.2.2.1 - SUSE Linux Enterprise Desktop 11 SP1 (i586 x86_64) [New Version: 3.12.11 and 4.8.9]: libfreebl3-3.12.11-3.2.2.1 mozilla-nspr-4.8.9-1.2.2.1 mozilla-nss-3.12.11-3.2.2.1 mozilla-nss-tools-3.12.11-3.2.2.1 - SUSE Linux Enterprise Desktop 11 SP1 (x86_64) [New Version: 3.12.11 and 4.8.9]: libfreebl3-32bit-3.12.11-3.2.2.1 mozilla-nspr-32bit-4.8.9-1.2.2.1 mozilla-nss-32bit-3.12.11-3.2.2.1 References: https://bugzilla.novell.com/714931 http://download.novell.com/patch/finder/?keywords=9258d4a7a325b9387335ff43a… -- To unsubscribe, e-mail: opensuse-security-announce+unsubscribe(a)opensuse.org For additional commands, e-mail: opensuse-security-announce+help(a)opensuse.org

1 0

[security-announce] SUSE-SU-2011:1063-1: important: Security update for flash-player
by opensuse-security＠opensuse.org 23 Sep '11

23 Sep '11

SUSE Security Update: Security update for flash-player ______________________________________________________________________________ Announcement ID: SUSE-SU-2011:1063-1 Rating: important References: #719400 Cross-References: CVE-2011-2426 CVE-2011-2427 CVE-2011-2428 CVE-2011-2429 CVE-2011-2430 CVE-2011-2444 Affected Products: SUSE Linux Enterprise Desktop 11 SP1 SUSE Linux Enterprise Desktop 10 SP4 ______________________________________________________________________________ An update that fixes 6 vulnerabilities is now available. It includes one version update. Description: This update resolves * a universal cross-site scripting issue that could be used to take actions on a user's behalf on any website or webmail provider if the user visits a malicious website (CVE-2011-2444). Note: There are reports that this issue is being exploited in the wild in active targeted attacks designed to trick the user into clicking on a malicious link delivered in an email message. * an AVM stack overflow issue that may allow for remote code execution. (CVE-2011-2426). * an AVM stack overflow issue that may lead to denial of service and code execution. (CVE-2011-2427). * a logic error issue which causes a browser crash and may lead to code execution. (CVE-2011- 2428). * a Flash Player security control bypass which could allow information disclosure. (CVE-2011-2429). * a streaming media logic error vulnerability which could lead to code execution. (CVE-2011-2430). Security Issue references: * CVE-2011-2426 <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2011-2426 > * CVE-2011-2427 <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2011-2427 > * CVE-2011-2428 <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2011-2428 > * CVE-2011-2429 <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2011-2429 > * CVE-2011-2430 <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2011-2430 > * CVE-2011-2444 <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2011-2444 > Patch Instructions: To install this SUSE Security Update use YaST online_update. Alternatively you can run the command listed for your product: - SUSE Linux Enterprise Desktop 11 SP1: zypper in -t patch sledsp1-flash-player-5184 To bring your system up-to-date, use "zypper patch". Package List: - SUSE Linux Enterprise Desktop 11 SP1 (i586) [New Version: 10.3.183.10]: flash-player-10.3.183.10-0.2.1 - SUSE Linux Enterprise Desktop 10 SP4 (i586) [New Version: 10.3.183.10]: flash-player-10.3.183.10-0.5.1 References: http://support.novell.com/security/cve/CVE-2011-2426.html http://support.novell.com/security/cve/CVE-2011-2427.html http://support.novell.com/security/cve/CVE-2011-2428.html http://support.novell.com/security/cve/CVE-2011-2429.html http://support.novell.com/security/cve/CVE-2011-2430.html http://support.novell.com/security/cve/CVE-2011-2444.html https://bugzilla.novell.com/719400 http://download.novell.com/patch/finder/?keywords=9a5ead7b67f842c5fc5607511… http://download.novell.com/patch/finder/?keywords=e356cf76b24484e7a3a2903c0… -- To unsubscribe, e-mail: opensuse-security-announce+unsubscribe(a)opensuse.org For additional commands, e-mail: opensuse-security-announce+help(a)opensuse.org

1 0

[security-announce] openSUSE-SU-2011:1062-1: important: jakarta-commons-daemon
by opensuse-security＠opensuse.org 23 Sep '11

23 Sep '11

openSUSE Security Update: jakarta-commons-daemon ______________________________________________________________________________ Announcement ID: openSUSE-SU-2011:1062-1 Rating: important References: #715656 Cross-References: CVE-2011-2729 Affected Products: openSUSE 11.4 ______________________________________________________________________________ An update that fixes one vulnerability is now available. Description: jsvc did not properly drop capabilities, therefore allowing applications to access files owned by the super user (CVE-2011-2729). Patch Instructions: To install this openSUSE Security Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE 11.4: zypper in -t patch jakarta-commons-daemon-5156 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE 11.4 (i586 x86_64): jakarta-commons-daemon-1.0.5-4.5.1 - openSUSE 11.4 (noarch): jakarta-commons-daemon-java-1.0.5-4.5.1 jakarta-commons-daemon-javadoc-1.0.5-4.5.1 References: http://support.novell.com/security/cve/CVE-2011-2729.html https://bugzilla.novell.com/715656 -- To unsubscribe, e-mail: opensuse-security-announce+unsubscribe(a)opensuse.org For additional commands, e-mail: opensuse-security-announce+help(a)opensuse.org

1 0

[security-announce] SUSE-SU-2011:1058-1: important: Security update for the Linux kernel
by opensuse-security＠opensuse.org 20 Sep '11

20 Sep '11

SUSE Security Update: Security update for the Linux kernel ______________________________________________________________________________ Announcement ID: SUSE-SU-2011:1058-1 Rating: important References: #635880 #665543 #677676 #684297 #687812 #689797 #692784 #693043 #696107 #698221 #701254 #701355 #702013 #702285 #705463 #714001 Cross-References: CVE-2011-0726 CVE-2011-1017 CVE-2011-1093 CVE-2011-1585 CVE-2011-1745 CVE-2011-1746 CVE-2011-1776 CVE-2011-2022 CVE-2011-2182 CVE-2011-2491 CVE-2011-2496 CVE-2011-3191 Affected Products: SUSE Linux Enterprise Server 10 SP3 SLE SDK 10 SP3 ______________________________________________________________________________ An update that solves 12 vulnerabilities and has four fixes is now available. Description: This kernel update for the SUSE Linux Enterprise 10 SP3 kernel fixes several security issues and bugs. The following security issues have been fixed: * CVE-2011-3191: A signedness issue in CIFS could possibly have lead to to memory corruption, if a malicious server could send crafted replies to the host. * CVE-2011-1776: Timo Warns reported an issue in the Linux implementation for GUID partitions. Users with physical access could gain access to sensitive kernel memory by adding a storage device with a specially crafted corrupted invalid partition table. * CVE-2011-1093: The dccp_rcv_state_process function in net/dccp/input.c in the Datagram Congestion Control Protocol (DCCP) implementation in the Linux kernel did not properly handle packets for a CLOSED endpoint, which allowed remote attackers to cause a denial of service (NULL pointer dereference and OOPS) by sending a DCCP-Close packet followed by a DCCP-Reset packet. * CVE-2011-1745: Integer overflow in the agp_generic_insert_memory function in drivers/char/agp/generic.c in the Linux kernel allowed local users to gain privileges or cause a denial of service (system crash) via a crafted AGPIOC_BIND agp_ioctl ioctl call. * CVE-2011-1746: Multiple integer overflows in the (1) agp_allocate_memory and (2) agp_create_user_memory functions in drivers/char/agp/generic.c in the Linux kernel allowed local users to trigger buffer overflows, and consequently cause a denial of service (system crash) or possibly have unspecified other impact, via vectors related to calls that specify a large number of memory pages. * CVE-2011-2022: The agp_generic_remove_memory function in drivers/char/agp/generic.c in the Linux kernel before 2.6.38.5 did not validate a certain start parameter, which allowed local users to gain privileges or cause a denial of service (system crash) via a crafted AGPIOC_UNBIND agp_ioctl ioctl call, a different vulnerability than CVE-2011-1745. * CVE-2011-0726: The do_task_stat function in fs/proc/array.c in the Linux kernel did not perform an expected uid check, which made it easier for local users to defeat the ASLR protection mechanism by reading the start_code and end_code fields in the /proc/#####/stat file for a process executing a PIE binary. * CVE-2011-2496: The normal mmap paths all avoid creating a mapping where the pgoff inside the mapping could wrap around due to overflow. However, an expanding mremap() can take such a non-wrapping mapping and make it bigger and cause a wrapping condition. * CVE-2011-2491: A local unprivileged user able to access a NFS filesystem could use file locking to deadlock parts of an nfs server under some circumstance. * CVE-2011-1017,CVE-2011-2182: The code for evaluating LDM partitions (in fs/partitions/ldm.c) contained bugs that could crash the kernel for certain corrupted LDM partitions. * CVE-2011-1585: When using a setuid root mount.cifs, local users could hijack password protected mounted CIFS shares of other local users. Also following non-security bugs were fixed: * patches.suse/fs-proc-vmcorec-add-hook-to-read_from_oldmem-to -check-for-non-ram-pages.patch: fs/proc/vmcore.c: add hook to read_from_oldmem() to check for non-ram pages (bnc#684297). * patches.xen/1062-xenbus-dev-leak.patch: xenbus: Fix memory leak on release. * patches.xen/1074-xenbus_conn-type.patch: xenbus: fix type inconsistency with xenbus_conn(). * patches.xen/1080-blkfront-xenbus-gather-format.patch: blkfront: fix data size for xenbus_gather in connect(). * patches.xen/1081-blkback-resize-transaction-end.patch: xenbus: fix xenbus_transaction_start() hang caused by double xenbus_transaction_end(). * patches.xen/1089-blkback-barrier-check.patch: blkback: dont fail empty barrier requests. * patches.xen/1091-xenbus-dev-no-BUG.patch: xenbus: dont BUG() on user mode induced conditions (bnc#696107). * patches.xen/1098-blkfront-cdrom-ioctl-check.patch: blkfront: avoid NULL de-reference in CDROM ioctl handling (bnc#701355). * patches.xen/1102-x86-max-contig-order.patch: x86: use dynamically adjusted upper bound for contiguous regions (bnc#635880). * patches.xen/xen3-x86-sanitize-user-specified-e820-memmap-val ues.patch: x86: sanitize user specified e820 memmap values (bnc#665543). * patches.fixes/libiscsi-dont-run-scsi-eh-if-iscsi-task-is-mak ing-progress: Fix typo, which was uncovered in debug mode. * patches.fixes/pacct-fix-sighand-siglock-usage.patch: Fix sighand->siglock usage in kernel/acct.c (bnc#705463). Security Issue references: * CVE-2011-0726 <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2011-0726 > * CVE-2011-1017 <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2011-1017 > * CVE-2011-1093 <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2011-1093 > * CVE-2011-1745 <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2011-1745 > * CVE-2011-1746 <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2011-1746 > * CVE-2011-1776 <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2011-1776 > * CVE-2011-2022 <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2011-2022 > * CVE-2011-2182 <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2011-2182 > * CVE-2011-2491 <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2011-2491 > * CVE-2011-2496 <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2011-2496 > * CVE-2011-3191 <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2011-3191 > * CVE-2011-1585 <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2011-1585 > Indications: Everyone using the Linux Kernel on x86_64 architecture should update. Special Instructions and Notes: Please reboot the system after installing this update. Package List: - SUSE Linux Enterprise Server 10 SP3 (i586 ia64 ppc s390x x86_64): kernel-default-2.6.16.60-0.83.2 kernel-source-2.6.16.60-0.83.2 kernel-syms-2.6.16.60-0.83.2 - SUSE Linux Enterprise Server 10 SP3 (i586 ia64 x86_64): kernel-debug-2.6.16.60-0.83.2 - SUSE Linux Enterprise Server 10 SP3 (i586 ppc x86_64): kernel-kdump-2.6.16.60-0.83.2 - SUSE Linux Enterprise Server 10 SP3 (i586 x86_64): kernel-smp-2.6.16.60-0.83.2 kernel-xen-2.6.16.60-0.83.2 - SUSE Linux Enterprise Server 10 SP3 (i586): kernel-bigsmp-2.6.16.60-0.83.2 kernel-kdumppae-2.6.16.60-0.83.2 kernel-vmi-2.6.16.60-0.83.2 kernel-vmipae-2.6.16.60-0.83.2 kernel-xenpae-2.6.16.60-0.83.2 - SUSE Linux Enterprise Server 10 SP3 (ppc): kernel-iseries64-2.6.16.60-0.83.2 kernel-ppc64-2.6.16.60-0.83.2 - SLE SDK 10 SP3 (i586 ia64 x86_64): kernel-debug-2.6.16.60-0.83.2 - SLE SDK 10 SP3 (i586 ppc x86_64): kernel-kdump-2.6.16.60-0.83.2 - SLE SDK 10 SP3 (i586 x86_64): kernel-xen-2.6.16.60-0.83.2 - SLE SDK 10 SP3 (i586): kernel-xenpae-2.6.16.60-0.83.2 References: http://support.novell.com/security/cve/CVE-2011-0726.html http://support.novell.com/security/cve/CVE-2011-1017.html http://support.novell.com/security/cve/CVE-2011-1093.html http://support.novell.com/security/cve/CVE-2011-1585.html http://support.novell.com/security/cve/CVE-2011-1745.html http://support.novell.com/security/cve/CVE-2011-1746.html http://support.novell.com/security/cve/CVE-2011-1776.html http://support.novell.com/security/cve/CVE-2011-2022.html http://support.novell.com/security/cve/CVE-2011-2182.html http://support.novell.com/security/cve/CVE-2011-2491.html http://support.novell.com/security/cve/CVE-2011-2496.html http://support.novell.com/security/cve/CVE-2011-3191.html https://bugzilla.novell.com/635880 https://bugzilla.novell.com/665543 https://bugzilla.novell.com/677676 https://bugzilla.novell.com/684297 https://bugzilla.novell.com/687812 https://bugzilla.novell.com/689797 https://bugzilla.novell.com/692784 https://bugzilla.novell.com/693043 https://bugzilla.novell.com/696107 https://bugzilla.novell.com/698221 https://bugzilla.novell.com/701254 https://bugzilla.novell.com/701355 https://bugzilla.novell.com/702013 https://bugzilla.novell.com/702285 https://bugzilla.novell.com/705463 https://bugzilla.novell.com/714001 http://download.novell.com/patch/finder/?keywords=14f999b2da14400252037984b… http://download.novell.com/patch/finder/?keywords=4f2403980de031813f91f813b… http://download.novell.com/patch/finder/?keywords=8c7d79d86d626d9e405009e61… http://download.novell.com/patch/finder/?keywords=a2be52185ebaeba245a1c8aff… http://download.novell.com/patch/finder/?keywords=a70d925c5736ccbb5c46bf7c0… -- To unsubscribe, e-mail: opensuse-security-announce+unsubscribe(a)opensuse.org For additional commands, e-mail: opensuse-security-announce+help(a)opensuse.org

1 0

[security-announce] SUSE-SU-2011:1057-1: important: Security update for Xen
by opensuse-security＠opensuse.org 20 Sep '11

20 Sep '11

SUSE Security Update: Security update for Xen ______________________________________________________________________________ Announcement ID: SUSE-SU-2011:1057-1 Rating: important References: #654798 #659070 #679344 #684297 #704380 #712038 Cross-References: CVE-2011-1166 CVE-2011-1936 CVE-2011-2901 Affected Products: SUSE Linux Enterprise Server 10 SP3 SLE SDK 10 SP3 ______________________________________________________________________________ An update that solves three vulnerabilities and has three fixes is now available. Description: This update fixes various bugs in XEN: The following security issues have been fixed: * A denial of service (Host Crash) in the XEN hypervisor. (CVE-2011-2901) * A bug was found in the way Xen handles CPUID instruction emulation during VM exits. An unprivileged guest user can potentially use this flaw to crash the guest. (CVE-2011-1936) * A 64-bit guest can get one of its vcpus into non-kernel mode without first providing a valid non-kernel pagetable. The observed failure mode was usually a hard lockup of the host (host denial of service). (CVE-2011-1166) It fixes also the following bugs: * bnc#654798 - SLES 10 SP3 XEN: Device /dev/xvdp is already connected error when starting multiple vm's * bnc#684297 - HVM taking too long to dump vmcore Security Issue references: * CVE-2011-2901 <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2011-2901 > * CVE-2011-1166 <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2011-1166 > * CVE-2011-1936 <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2011-1936 > Indications: Please install this update. Package List: - SUSE Linux Enterprise Server 10 SP3 (i586 x86_64): xen-3.2.3_17040_26-0.6.2.1 xen-devel-3.2.3_17040_26-0.6.2.1 xen-doc-html-3.2.3_17040_26-0.6.2.1 xen-doc-pdf-3.2.3_17040_26-0.6.2.1 xen-doc-ps-3.2.3_17040_26-0.6.2.1 xen-kmp-debug-3.2.3_17040_26_2.6.16.60_0.81.11-0.6.2.1 xen-kmp-default-3.2.3_17040_26_2.6.16.60_0.81.11-0.6.2.1 xen-kmp-kdump-3.2.3_17040_26_2.6.16.60_0.81.11-0.6.2.1 xen-kmp-smp-3.2.3_17040_26_2.6.16.60_0.81.11-0.6.2.1 xen-libs-3.2.3_17040_26-0.6.2.1 xen-tools-3.2.3_17040_26-0.6.2.1 xen-tools-domU-3.2.3_17040_26-0.6.2.1 xen-tools-ioemu-3.2.3_17040_26-0.6.2.1 - SUSE Linux Enterprise Server 10 SP3 (x86_64): xen-libs-32bit-3.2.3_17040_26-0.6.2.1 - SUSE Linux Enterprise Server 10 SP3 (i586): xen-kmp-bigsmp-3.2.3_17040_26_2.6.16.60_0.81.11-0.6.2.1 xen-kmp-kdumppae-3.2.3_17040_26_2.6.16.60_0.81.11-0.6.2.1 xen-kmp-vmi-3.2.3_17040_26_2.6.16.60_0.81.11-0.6.2.1 xen-kmp-vmipae-3.2.3_17040_26_2.6.16.60_0.81.11-0.6.2.1 - SLE SDK 10 SP3 (i586 x86_64): xen-3.2.3_17040_26-0.6.2.1 xen-devel-3.2.3_17040_26-0.6.2.1 xen-kmp-debug-3.2.3_17040_26_2.6.16.60_0.81.11-0.6.2.1 xen-kmp-kdump-3.2.3_17040_26_2.6.16.60_0.81.11-0.6.2.1 xen-libs-3.2.3_17040_26-0.6.2.1 xen-tools-3.2.3_17040_26-0.6.2.1 xen-tools-ioemu-3.2.3_17040_26-0.6.2.1 - SLE SDK 10 SP3 (x86_64): xen-libs-32bit-3.2.3_17040_26-0.6.2.1 References: http://support.novell.com/security/cve/CVE-2011-1166.html http://support.novell.com/security/cve/CVE-2011-1936.html http://support.novell.com/security/cve/CVE-2011-2901.html https://bugzilla.novell.com/654798 https://bugzilla.novell.com/659070 https://bugzilla.novell.com/679344 https://bugzilla.novell.com/684297 https://bugzilla.novell.com/704380 https://bugzilla.novell.com/712038 http://download.novell.com/patch/finder/?keywords=8cb29b577c0a831bd5c006778… -- To unsubscribe, e-mail: opensuse-security-announce+unsubscribe(a)opensuse.org For additional commands, e-mail: opensuse-security-announce+help(a)opensuse.org

1 0

[security-announce] SUSE Security Announcement: Linux kernel (SUSE-SA:2011:040)
by Marcus Meissner 20 Sep '11

20 Sep '11

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 ______________________________________________________________________________ SUSE Security Announcement Package: kernel Announcement ID: SUSE-SA:2011:040 Date: Tue, 20 Sep 2011 16:00:00 +0000 Affected Products: SLE SDK 10 SP3 SUSE Linux Enterprise Server 10 SP3 Vulnerability Type: remote denial of service CVSS v2 Base Score: 7.8 (AV:N/AC:L/Au:N/C:N/I:N/A:C) SUSE Default Package: yes Cross-References: CVE-2011-0726, CVE-2011-1017, CVE-2011-1093 CVE-2011-1585, CVE-2011-1745, CVE-2011-1746 CVE-2011-1776, CVE-2011-2022, CVE-2011-2182 CVE-2011-2491, CVE-2011-2496, CVE-2011-3191 Content of This Advisory: 1) Security Vulnerability Resolved: Linux kernel security update Problem Description 2) Solution or Work-Around 3) Special Instructions and Notes 4) Package Location and Checksums 5) Pending Vulnerabilities, Solutions, and Work-Arounds: none 6) Authenticity Verification and Additional Information ______________________________________________________________________________ 1) Problem Description and Brief Discussion This kernel update for the SUSE Linux Enterprise 10 SP3 kernel fixes several security issues and bugs. Following security issues were fixed: CVE-2011-3191: A signedness issue in CIFS could possibly have lead to to memory corruption, if a malicious server could send crafted replies to the host. CVE-2011-1776: Timo Warns reported an issue in the Linux implementation for GUID partitions. Users with physical access could gain access to sensitive kernel memory by adding a storage device with a specially crafted corrupted invalid partition table. CVE-2011-1093: The dccp_rcv_state_process function in net/dccp/input.c in the Datagram Congestion Control Protocol (DCCP) implementation in the Linux kernel did not properly handle packets for a CLOSED endpoint, which allowed remote attackers to cause a denial of service (NULL pointer dereference and OOPS) by sending a DCCP-Close packet followed by a DCCP-Reset packet. CVE-2011-1745: Integer overflow in the agp_generic_insert_memory function in drivers/char/agp/generic.c in the Linux kernel allowed local users to gain privileges or cause a denial of service (system crash) via a crafted AGPIOC_BIND agp_ioctl ioctl call. CVE-2011-1746: Multiple integer overflows in the (1) agp_allocate_memory and (2) agp_create_user_memory functions in drivers/char/agp/generic.c in the Linux kernel allowed local users to trigger buffer overflows, and consequently cause a denial of service (system crash) or possibly have unspecified other impact, via vectors related to calls that specify a large number of memory pages. CVE-2011-2022: The agp_generic_remove_memory function in drivers/char/agp/generic.c in the Linux kernel before 2.6.38.5 did not validate a certain start parameter, which allowed local users to gain privileges or cause a denial of service (system crash) via a crafted AGPIOC_UNBIND agp_ioctl ioctl call, a different vulnerability than CVE-2011-1745. CVE-2011-0726: The do_task_stat function in fs/proc/array.c in the Linux kernel did not perform an expected uid check, which made it easier for local users to defeat the ASLR protection mechanism by reading the start_code and end_code fields in the /proc/#####/stat file for a process executing a PIE binary. CVE-2011-2496: The normal mmap paths all avoid creating a mapping where the pgoff inside the mapping could wrap around due to overflow. However, an expanding mremap() can take such a non-wrapping mapping and make it bigger and cause a wrapping condition. CVE-2011-2491: A local unprivileged user able to access a NFS filesystem could use file locking to deadlock parts of an nfs server under some circumstance. CVE-2011-1017,CVE-2011-2182: The code for evaluating LDM partitions (in fs/partitions/ldm.c) contained bugs that could crash the kernel for certain corrupted LDM partitions. CVE-2011-1585: When using a setuid root mount.cifs, local users could hijack password protected mounted CIFS shares of other local users. Also following non-security bugs were fixed: - patches.suse/fs-proc-vmcorec-add-hook-to-read_from_oldmem-to-check-for-non-ram-pages.patch: fs/proc/vmcore.c: add hook to read_from_oldmem() to check for non-ram pages (bnc#684297). - patches.xen/1062-xenbus-dev-leak.patch: xenbus: Fix memory leak on release. - patches.xen/1074-xenbus_conn-type.patch: xenbus: fix type inconsistency with xenbus_conn(). - patches.xen/1080-blkfront-xenbus-gather-format.patch: blkfront: fix data size for xenbus_gather in connect(). - patches.xen/1081-blkback-resize-transaction-end.patch: xenbus: fix xenbus_transaction_start() hang caused by double xenbus_transaction_end(). - patches.xen/1089-blkback-barrier-check.patch: blkback: dont fail empty barrier requests. - patches.xen/1091-xenbus-dev-no-BUG.patch: xenbus: dont BUG() on user mode induced conditions (bnc#696107). - patches.xen/1098-blkfront-cdrom-ioctl-check.patch: blkfront: avoid NULL de-reference in CDROM ioctl handling (bnc#701355). - patches.xen/1102-x86-max-contig-order.patch: x86: use dynamically adjusted upper bound for contiguous regions (bnc#635880). - patches.xen/xen3-x86-sanitize-user-specified-e820-memmap-values.patch: x86: sanitize user specified e820 memmap values (bnc#665543). - patches.fixes/libiscsi-dont-run-scsi-eh-if-iscsi-task-is-making-progress: Fix typo, which was uncovered in debug mode. - patches.fixes/pacct-fix-sighand-siglock-usage.patch: Fix sighand->siglock usage in kernel/acct.c (bnc#705463). 2) Solution or Work-Around There is no known workaround, please install the update packages. 3) Special Instructions and Notes Please reboot the machine after installing the update. If you are using XEN, you also should install and boot the current SUSE Linux Enterprise 10 SP3 XEN update. 4) Package Location and Checksums The preferred method for installing security updates is to use the YaST "Online Update" module or the "zypper" commandline tool. The package and patch management stack will detect which updates are required and automatically perform the necessary steps to verify and install them. Alternatively, download the update packages for your distribution manually and verify their integrity by the methods listed in Section 6 of this announcement. Then install the packages using the command rpm -Fhv <file.rpm> to apply the update, replacing <file.rpm> with the filename of the downloaded RPM package. Our maintenance customers are notified individually. The packages are offered for installation from the maintenance web: SLE SDK 10 SP3 http://download.novell.com/patch/finder/?keywords=a2be52185ebaeba245a1c8aff… http://download.novell.com/patch/finder/?keywords=4f2403980de031813f91f813b… http://download.novell.com/patch/finder/?keywords=8c7d79d86d626d9e405009e61… http://download.novell.com/patch/finder/?keywords=14f999b2da14400252037984b… SUSE Linux Enterprise Server 10 SP3 http://download.novell.com/patch/finder/?keywords=a2be52185ebaeba245a1c8aff… http://download.novell.com/patch/finder/?keywords=a70d925c5736ccbb5c46bf7c0… http://download.novell.com/patch/finder/?keywords=4f2403980de031813f91f813b… http://download.novell.com/patch/finder/?keywords=8c7d79d86d626d9e405009e61… http://download.novell.com/patch/finder/?keywords=14f999b2da14400252037984b… ______________________________________________________________________________ 5) Pending Vulnerabilities, Solutions, and Work-Arounds: none ______________________________________________________________________________ 6) Authenticity Verification and Additional Information - Announcement authenticity verification: SUSE security announcements are published via mailing lists and on Web sites. The authenticity and integrity of a SUSE security announcement is guaranteed by a cryptographic signature in each announcement. All SUSE security announcements are published with a valid signature. To verify the signature of the announcement, save it as text into a file and run the command gpg --verify <file> replacing <file> with the name of the file where you saved the announcement. The output for a valid signature looks like: gpg: Signature made <DATE> using RSA key ID 3D25D3D9 gpg: Good signature from "SuSE Security Team <security(a)suse.de>" where <DATE> is replaced by the date the document was signed. If the security team's key is not contained in your key ring, you can import it from the first installation CD. To import the key, use the command gpg --import gpg-pubkey-3d25d3d9-36e12d04.asc - Package authenticity verification: SUSE update packages are available on many mirror FTP servers all over the world. While this service is considered valuable and important to the free and open source software community, the authenticity and the integrity of a package needs to be verified to ensure that it has not been tampered with. The internal rpm package signatures provide an easy way to verify the authenticity of an RPM package. Use the command rpm -v --checksig <file.rpm> to verify the signature of the package, replacing <file.rpm> with the filename of the RPM package downloaded. The package is unmodified if it contains a valid signature from build(a)suse.de with the key ID 9C800ACA. This key is automatically imported into the RPM database (on RPMv4-based distributions) and the gpg key ring of 'root' during installation. You can also find it on the first installation CD and at the end of this announcement. - SUSE runs two security mailing lists to which any interested party may subscribe: opensuse-security(a)opensuse.org - General Linux and SUSE security discussion. All SUSE security announcements are sent to this list. To subscribe, send an e-mail to <opensuse-security+subscribe(a)opensuse.org>. opensuse-security-announce(a)opensuse.org - SUSE's announce-only mailing list. Only SUSE's security announcements are sent to this list. To subscribe, send an e-mail to <opensuse-security-announce+subscribe(a)opensuse.org>. ===================================================================== SUSE's security contact is <security(a)suse.com> or <security(a)suse.de>. The <security(a)suse.de> public key is listed below. ===================================================================== ______________________________________________________________________________ The information in this advisory may be distributed or reproduced, provided that the advisory is not modified in any way. In particular, the clear text signature should show proof of the authenticity of the text. SUSE Linux Products GmbH provides no warranties of any kind whatsoever with respect to the information contained in this security advisory. Type Bits/KeyID Date User ID pub 2048R/3D25D3D9 1999-03-06 SuSE Security Team <security(a)suse.de> pub 1024D/9C800ACA 2000-10-19 SuSE Package Signing Key <build(a)suse.de> - -----BEGIN PGP PUBLIC KEY BLOCK----- Version: GnuPG v1.4.2 (GNU/Linux) mQENAzbhLQQAAAEIAKAkXHe0lWRBXLpn38hMHy03F0I4Sszmoc8aaKJrhfhyMlOA BqvklPLE2f9UrI4Xc860gH79ZREwAgPt0pi6+SleNFLNcNFAuuHMLQOOsaMFatbz JR9i4m/lf6q929YROu5zB48rBAlcfTm+IBbijaEdnqpwGib45wE/Cfy6FAttBHQh 1Kp+r/jPbf1mYAvljUfHKuvbg8t2EIQz/5yGp+n5trn9pElfQO2cRBq8LFpf1l+U P7EKjFmlOq+Gs/fF98/dP3DfniSd78LQPq5vp8RL8nr/o2i7jkAQ33m4f1wOBWd+ cZovrKXYlXiR+Bf7m2hpZo+/sAzhd7LmAD0l09kABRG0JVN1U0UgU2VjdXJpdHkg VGVhbSA8c2VjdXJpdHlAc3VzZS5kZT6JARUDBRA24S1H5Fiyh7HKPEUBAVcOB/9b yHYji1/+4Xc2GhvXK0FSJN0MGgeXgW47yxDL7gmR4mNgjlIOUHZj0PEpVjWepOJ7 tQS3L9oP6cpj1Fj/XxuLbkp5VCQ61hpt54coQAvYrnT9rtWEGN+xmwejT1WmYmDJ xG+EGBXKr+XP69oIUl1E2JO3rXeklulgjqRKos4cdXKgyjWZ7CP9V9daRXDtje63 Om8gwSdU/nCvhdRIWp/Vwbf7Ia8iZr9OJ5YuQl0DBG4qmGDDrvImgPAFkYFzwlqo choXFQ9y0YVCV41DnR+GYhwl2qBd81T8aXhihEGPIgaw3g8gd8B5o6mPVgl+nJqI BkEYGBusiag2pS6qwznZiQEVAwUQNuEtBHey5gA9JdPZAQFtOAf+KVh939b0J94u v/kpg4xs1LthlhquhbHcKNoVTNspugiC3qMPyvSX4XcBr2PC0cVkS4Z9PY9iCfT+ x9WM96g39dAF+le2CCx7XISk9XXJ4ApEy5g4AuK7NYgAJd39PPbERgWnxjxir9g0 Ix30dS30bW39D+3NPU5Ho9TD/B7UDFvYT5AWHl3MGwo3a1RhTs6sfgL7yQ3U+mvq MkTExZb5mfN1FeaYKMopoI4VpzNVeGxQWIz67VjJHVyUlF20ekOz4kWVgsxkc8G2 saqZd6yv2EwqYTi8BDAduweP33KrQc4KDDommQNDOXxaKOeCoESIdM4p7Esdjq1o L0oixF12CohGBBARAgAGBQI7HmHDAAoJEJ5A4xAACqukTlQAoI4QzP9yjPohY7OU F7J3eKBTzp25AJ42BmtSd3pvm5ldmognWF3Trhp+GYkAlQMFEDe3O8IWkDf+zvyS FQEBAfkD/3GG5UgJj18UhYmh1gfjIlDcPAeqMwSytEHDENmHC+vlZQ/p0mT9tPiW tp34io54mwr+bLPN8l6B5GJNkbGvH6M+mO7R8Lj4nHL6pyAv3PQr83WyLHcaX7It Klj371/4yzKV6qpz43SGRK4MacLo2rNZ/dNej7lwPCtzCcFYwqkiiEYEEBECAAYF AjoaQqQACgkQx1KqMrDf94ArewCfWnTUDG5gNYkmHG4bYL8fQcizyA4An2eVo/n+ 3J2KRWSOhpAMsnMxtPbBmQGiBDnu9IERBACT8Y35+2vv4MGVKiLEMOl9GdST6MCk YS3yEKeueNWc+z/0Kvff4JctBsgs47tjmiI9sl0eHjm3gTR8rItXMN6sJEUHWzDP +Y0PFPboMvKx0FXl/A0dM+HFrruCgBlWt6FA+okRySQiliuI5phwqkXefl9AhkwR 8xocQSVCFxcwvwCglVcOQliHu8jwRQHxlRE0tkwQQI0D+wfQwKdvhDplxHJ5nf7U 8c/yE/vdvpN6lF0tmFrKXBUX+K7u4ifrZlQvj/81M4INjtXreqDiJtr99Rs6xa0S cZqITuZC4CWxJa9GynBED3+D2t1V/f8l0smsuYoFOF7Ib49IkTdbtwAThlZp8bEh ELBeGaPdNCcmfZ66rKUdG5sRA/9ovnc1krSQF2+sqB9/o7w5/q2qiyzwOSTnkjtB UVKn4zLUOf6aeBAoV6NMCC3Kj9aZHfA+ND0ehPaVGJgjaVNFhPi4x0e7BULdvgOo AqajLfvkURHAeSsxXIoEmyW/xC1sBbDkDUIBSx5oej73XCZgnj/inphRqGpsb+1n KFvF+rQoU3VTRSBQYWNrYWdlIFNpZ25pbmcgS2V5IDxidWlsZEBzdXNlLmRlPohi BBMRAgAiBQJA2AY+AhsDBQkObd+9BAsHAwIDFQIDAxYCAQIeAQIXgAAKCRCoTtro nIAKypCfAJ9RuZ6ZSV7QW4pTgTIxQ+ABPp0sIwCffG9bCNnrETPlgOn+dGEkAWeg KL+IRgQQEQIABgUCOnBeUgAKCRCeQOMQAAqrpNzOAKCL512FZvv4VZx94TpbA9lx yoAejACeOO1HIbActAevk5MUBhNeLZa/qM2JARUDBRA6cGBvd7LmAD0l09kBATWn B/9An5vfiUUE1VQnt+T/EYklES3tXXaJJp9pHMa4fzFa8jPVtv5UBHGee3XoUNDV wM2OgSEISZxbzdXGnqIlcT08TzBUD9i579uifklLsnr35SJDZ6ram51/CWOnnaVh UzneOA9gTPSr+/fT3WeVnwJiQCQ30kNLWVXWATMnsnT486eAOlT6UNBPYQLpUprF 5Yryk23pQUPAgJENDEqeU6iIO9Ot1ZPtB0lniw+/xCi13D360o1tZDYOp0hHHJN3 D3EN8C1yPqZd5CvvznYvB6bWBIpWcRgdn2DUVMmpU661jwqGlRz1F84JG/xe4jGu zgpJt9IXSzyohEJB6XG5+D0BuQINBDnu9JIQCACEkdBN6Mxf5WvqDWkcMRy6wnrd 9DYJ8UUTmIT2iQf07tRUKJJ9v0JXfx2Z4d08IQSMNRaq4VgSe+PdYgIy0fbj23Vi a5/gO7fJEpD2hd2f+pMnOWvH2rOOIbeYfuhzAc6BQjAKtmgR0ERUTafTM9Wb6F13 CNZZNZfDqnFDP6L12w3z3F7FFXkz07Rs3AIto1ZfYZd4sCSpMr/0S5nLrHbIvGLp 271hhQBeRmmoGEKO2JRelGgUJ2CUzOdtwDIKT0LbCpvaP8PVnYF5IFoYJIWRHqlE t5ucTXstZy7vYjL6vTP4l5xs+LIOkNmPhqmfsgLzVo0UaLt80hOwc4NvDCOLAAMG B/9g+9V3ORzw4LvO1pwRYJqfDKUq/EJ0rNMMD4N8RLpZRhKHKJUm9nNHLbksnlZw rbSTM5LpC/U6sheLP+l0bLVoq0lmsCcUSyh+mY6PxWirLIWCn/IAZAGnXb6Zd6Tt IJlGG6pqUN8QxGJYQnonl0uTJKHJENbI9sWHQdcTtBMc34gorHFCo1Bcvpnc1LFL rWn7mfoGx6INQjf3HGQpMXAWuSBQhzkazY6vaWFpa8bBJ+gKbBuySWzNm3rFtT5H RKMWpO+M9bHp4d+puY0L1YwN1OMatcMMpcWnZpiWiR83oi32+xtWUY2U7Ae38mMa g8zFbpeqPQUsDv9V7CAJ1dbriEwEGBECAAwFAkDYBnoFCQ5t3+gACgkQqE7a6JyA CspnpgCfRbYwxT3iq+9l/PgNTUNTZOlof2oAn25y0eGi0371jap9kOV6uq71sUuO =ypVs - -----END PGP PUBLIC KEY BLOCK----- -----BEGIN PGP SIGNATURE----- Version: GnuPG v2.0.18 (GNU/Linux) iQEVAwUBTni0Jney5gA9JdPZAQJEmwf+N91eloGQihsESBAI3BhKA9Np5+e7q1SJ 9D8DDaN7kaVfPbY1lUQ/xNYoCO2OfBjWRg4Bgj4tvC2mOHgu6phfOShJHmbJ2esf QtKjqovICMhAjovnniuiiTWsObQOZnsnHcMloaGdMzSRTasmcemqunn1Xa1l0ESd qGNfnxRXGzkQhV+Wn3SuBNjFtGIWrX+V67GNLHzFW7Hm1eUK7ueyI78ohcH1TzZO j+8sziKMz9yM0iRdjHCpaJ2izNWHq3zOZWDYxr9xj8wep29PepPDL4zUN0rFsUDG agKxbl3hkj4cBTh5j5N9f25i2K2Ikmtq8+9bBCquieYEBcssPhNbbQ== =8gZk -----END PGP SIGNATURE----- -- To unsubscribe, e-mail: opensuse-security-announce+unsubscribe(a)opensuse.org For additional commands, e-mail: opensuse-security-announce+help(a)opensuse.org

1 0