November 2012 - openSUSE Security Announce

[security-announce] SUSE-SU-2012:1595-1: important: Security update for IBM Java 1.6.0
by opensuse-security＠opensuse.org 30 Nov '12

30 Nov '12

SUSE Security Update: Security update for IBM Java 1.6.0 ______________________________________________________________________________ Announcement ID: SUSE-SU-2012:1595-1 Rating: important References: #785631 #788750 Affected Products: SUSE Linux Enterprise Software Development Kit 11 SP2 SUSE Linux Enterprise Server 11 SP2 for VMware SUSE Linux Enterprise Server 11 SP2 SUSE Linux Enterprise Java 11 SP2 ______________________________________________________________________________ An update that contains security fixes can now be installed. Description: IBM Java 1.6.0 has been updated to SR12 which fixes bugs and security issues. More information can be found on: http://www.ibm.com/developerworks/java/jdk/alerts/ <http://www.ibm.com/developerworks/java/jdk/alerts/> CVEs fixed: CVE-2012-3159, CVE-2012-3216, CVE-2012-5068, CVE-2012-3143, CVE-2012-5073, CVE-2012-5075, CVE-2012-5083, CVE-2012-5083, CVE-2012-5072, CVE-2012-1531, CVE-2012-5081, CVE-2012-1532, CVE-2012-1533, CVE-2012-5069, CVE-2012-5071, CVE-2012-5084, CVE-2012-5079, CVE-2012-5089 Patch Instructions: To install this SUSE Security Update use YaST online_update. Alternatively you can run the command listed for your product: - SUSE Linux Enterprise Software Development Kit 11 SP2: zypper in -t patch sdksp2-java-1_6_0-ibm-7095 - SUSE Linux Enterprise Server 11 SP2 for VMware: zypper in -t patch slessp2-java-1_6_0-ibm-7095 - SUSE Linux Enterprise Server 11 SP2: zypper in -t patch slessp2-java-1_6_0-ibm-7095 - SUSE Linux Enterprise Java 11 SP2: zypper in -t patch slejsp2-java-1_6_0-ibm-7095 To bring your system up-to-date, use "zypper patch". Package List: - SUSE Linux Enterprise Software Development Kit 11 SP2 (i586 ppc64 s390x x86_64): java-1_6_0-ibm-devel-1.6.0_sr12.0-0.5.1 - SUSE Linux Enterprise Software Development Kit 11 SP2 (i586 x86_64): java-1_6_0-ibm-1.6.0_sr12.0-0.5.1 java-1_6_0-ibm-fonts-1.6.0_sr12.0-0.5.1 - SUSE Linux Enterprise Server 11 SP2 for VMware (i586 x86_64): java-1_6_0-ibm-1.6.0_sr12.0-0.5.1 java-1_6_0-ibm-fonts-1.6.0_sr12.0-0.5.1 java-1_6_0-ibm-jdbc-1.6.0_sr12.0-0.5.1 java-1_6_0-ibm-plugin-1.6.0_sr12.0-0.5.1 - SUSE Linux Enterprise Server 11 SP2 for VMware (i586): java-1_6_0-ibm-alsa-1.6.0_sr12.0-0.5.1 - SUSE Linux Enterprise Server 11 SP2 (i586 ppc64 s390x x86_64): java-1_6_0-ibm-1.6.0_sr12.0-0.5.1 java-1_6_0-ibm-fonts-1.6.0_sr12.0-0.5.1 java-1_6_0-ibm-jdbc-1.6.0_sr12.0-0.5.1 - SUSE Linux Enterprise Server 11 SP2 (i586 x86_64): java-1_6_0-ibm-plugin-1.6.0_sr12.0-0.5.1 - SUSE Linux Enterprise Server 11 SP2 (i586): java-1_6_0-ibm-alsa-1.6.0_sr12.0-0.5.1 - SUSE Linux Enterprise Java 11 SP2 (i586 ppc64 s390x x86_64): java-1_6_0-ibm-1.6.0_sr12.0-0.5.1 java-1_6_0-ibm-devel-1.6.0_sr12.0-0.5.1 java-1_6_0-ibm-fonts-1.6.0_sr12.0-0.5.1 java-1_6_0-ibm-jdbc-1.6.0_sr12.0-0.5.1 - SUSE Linux Enterprise Java 11 SP2 (i586 x86_64): java-1_6_0-ibm-plugin-1.6.0_sr12.0-0.5.1 - SUSE Linux Enterprise Java 11 SP2 (i586): java-1_6_0-ibm-alsa-1.6.0_sr12.0-0.5.1 References: https://bugzilla.novell.com/785631 https://bugzilla.novell.com/788750 http://download.novell.com/patch/finder/?keywords=5a12f1af483115fdac3b86d87… -- To unsubscribe, e-mail: opensuse-security-announce+unsubscribe(a)opensuse.org For additional commands, e-mail: opensuse-security-announce+help(a)opensuse.org

1 0

[security-announce] SUSE-SU-2012:1592-1: important: Security update for Mozilla Firefox
by opensuse-security＠opensuse.org 29 Nov '12

29 Nov '12

SUSE Security Update: Security update for Mozilla Firefox ______________________________________________________________________________ Announcement ID: SUSE-SU-2012:1592-1 Rating: important References: #790140 Affected Products: SUSE Linux Enterprise Software Development Kit 11 SP2 SUSE Linux Enterprise Server 11 SP2 for VMware SUSE Linux Enterprise Server 11 SP2 SUSE Linux Enterprise Server 10 SP4 SUSE Linux Enterprise Desktop 11 SP2 SUSE Linux Enterprise Desktop 10 SP4 SLE SDK 10 SP4 ______________________________________________________________________________ An update that contains security fixes can now be installed. It includes two new package versions. Description: Mozilla Firefox has been updated to the 10.0.11 ESR security release, which fixes various bugs and security issues. * MFSA 2012-106: Security researcher miaubiz used the Address Sanitizer tool to discover a series critically rated of use-after-free, buffer overflow, and memory corruption issues in shipped software. These issues are potentially exploitable, allowing for remote code execution. We would also like to thank miaubiz for reporting two additional use-after-free and memory corruption issues introduced during Firefox development that have been fixed before general release. In general these flaws cannot be exploited through email in the Thunderbird and SeaMonkey products because scripting is disabled, but are potentially a risk in browser or browser-like contexts in those products. References The following issues have been fixed in Firefox 17 and ESR 10.0.11: o use-after-free when loading html file on osx (CVE-2012-5830) o Mesa crashes on certain texImage2D calls involving level>0 (CVE-2012-5833) o integer overflow, invalid write w/webgl bufferdata (CVE-2012-5835) The following issues have been fixed in Firefox 17: o crash in copyTexImage2D with image dimensions too large for given level (CVE-2012-5838) * MFSA 2012-105: Security researcher Abhishek Arya (Inferno) of the Google Chrome Security Team discovered a series critically rated of use-after-free and buffer overflow issues using the Address Sanitizer tool in shipped software. These issues are potentially exploitable, allowing for remote code execution. We would also like to thank Abhishek for reporting five additional use-after-free, out of bounds read, and buffer overflow flaws introduced during Firefox development that have been fixed before general release. In general these flaws cannot be exploited through email in the Thunderbird and SeaMonkey products because scripting is disabled, but are potentially a risk in browser or browser-like contexts in those products. References The following issues have been fixed in Firefox 17 and ESR 10.0.11: o Heap-use-after-free in nsTextEditorState::PrepareEditor (CVE-2012-4214) o Heap-use-after-free in nsPlaintextEditor::FireClipboardEvent (CVE-2012-4215) o Heap-use-after-free in gfxFont::GetFontEntry (CVE-2012-4216) o Heap-buffer-overflow in nsWindow::OnExposeEvent (CVE-2012-5829) o heap-buffer-overflow in gfxShapedWord::CompressedGlyph::IsClusterStart o CVE-2012-5839 o Heap-use-after-free in nsTextEditorState::PrepareEditor (CVE-2012-5840) The following issues have been fixed in Firefox 17: o Heap-use-after-free in XPCWrappedNative::Mark (CVE-2012-4212) o Heap-use-after-free in nsEditor::FindNextLeafNode (CVE-2012-4213) o Heap-use-after-free in nsViewManager::ProcessPendingUpdates (CVE-2012-4217) o Heap-use-after-free BuildTextRunsScanner::BreakSink::SetBreaks (CVE-2012-4218) * MFSA 2012-104 / CVE-2012-4210: Security researcher Mariusz Mlynski reported that when a maliciously crafted stylesheet is inspected in the Style Inspector, HTML and CSS can run in a chrome privileged context without being properly sanitized first. This can lead to arbitrary code execution. * MFSA 2012-103 / CVE-2012-4209: Security researcher Mariusz Mlynski reported that the location property can be accessed by binary plugins through top.location with a frame whose name attribute's value is set to "top". This can allow for possible cross-site scripting (XSS) attacks through plugins. In general these flaws cannot be exploited through email in the Thunderbird and SeaMonkey products because scripting is disabled, but are potentially a risk in browser or browser-like contexts in those products. * MFSA 2012-102 / CVE-2012-5837: Security researcher Masato Kinugawa reported that when script is entered into the Developer Toolbar, it runs in a chrome privileged context. This allows for arbitrary code execution or cross-site scripting (XSS) if a user can be convinced to paste malicious code into the Developer Toolbar. * MFSA 2012-101 / CVE-2012-4207: Security researcher Masato Kinugawa found when HZ-GB-2312 charset encoding is used for text, the "~" character will destroy another character near the chunk delimiter. This can lead to a cross-site scripting (XSS) attack in pages encoded in HZ-GB-2312. * MFSA 2012-100 / CVE-2012-5841: Mozilla developer Bobby Holley reported that security wrappers filter at the time of property access, but once a function is returned, the caller can use this function without further security checks. This affects cross-origin wrappers, allowing for write actions on objects when only read actions should be properly allowed. This can lead to cross-site scripting (XSS) attacks. In general these flaws cannot be exploited through email in the Thunderbird and SeaMonkey products because scripting is disabled, but are potentially a risk in browser or browser-like contexts in those products. * MFSA 2012-99 / CVE-2012-4208: Mozilla developer Peter Van der Beken discovered that same-origin XrayWrappers expose chrome-only properties even when not in a chrome compartment. This can allow web content to get properties of DOM objects that are intended to be chrome-only. In general these flaws cannot be exploited through email in the Thunderbird and SeaMonkey products because scripting is disabled, but are potentially a risk in browser or browser-like contexts in those products. * MFSA 2012-98 / CVE-2012-4206: Security researcher Robert Kugler reported that when a specifically named DLL file on a Windows computer is placed in the default downloads directory with the Firefox installer, the Firefox installer will load this DLL when it is launched. In circumstances where the installer is run by an administrator privileged account, this allows for the downloaded DLL file to be run with administrator privileges. This can lead to arbitrary code execution from a privileged account. * MFSA 2012-97 / CVE-2012-4205: Mozilla developer Gabor Krizsanits discovered that XMLHttpRequest objects created within sandboxes have the system principal instead of the sandbox principal. This can lead to cross-site request forgery (CSRF) or information theft via an add-on running untrusted code in a sandbox. * MFSA 2012-96 / CVE-2012-4204: Security researcher Scott Bell of Security-Assessment.com used the Address Sanitizer tool to discover a memory corruption in str_unescape in the Javascript engine. This could potentially lead to arbitrary code execution. In general these flaws cannot be exploited through email in the Thunderbird and SeaMonkey products because scripting is disabled, but are potentially a risk in browser or browser-like contexts in those products. * MFSA 2012-95 / CVE-2012-4203: Security researcher kakzz.ng(a)gmail.com reported that if a javascript: URL is selected from the list of Firefox "new tab" page, the script will inherit the privileges of the privileged "new tab" page. This allows for the execution of locally installed programs if a user can be convinced to save a bookmark of a malicious javascript: URL. * MFSA 2012-94 / CVE-2012-5836: Security researcher Jonathan Stephens discovered that combining SVG text on a path with the setting of CSS properties could lead to a potentially exploitable crash. * MFSA 2012-93 / CVE-2012-4201: Mozilla security researcher moz_bug_r_a4 reported that if code executed by the evalInSandbox function sets location.href, it can get the wrong subject principal for the URL check, ignoring the sandbox's Javascript context and gaining the context of evalInSandbox object. This can lead to malicious web content being able to perform a cross-site scripting (XSS) attack or stealing a copy of a local file if the user has installed an add-on vulnerable to this attack. * MFSA 2012-92 / CVE-2012-4202: Security researcher Atte Kettunen from OUSPG used the Address Sanitizer tool to discover a buffer overflow while rendering GIF format images. This issue is potentially exploitable and could lead to arbitrary code execution. * MFSA 2012-91: Mozilla developers identified and fixed several memory safety bugs in the browser engine used in Firefox and other Mozilla-based products. Some of these bugs showed evidence of memory corruption under certain circumstances, and we presume that with enough effort at least some of these could be exploited to run arbitrary code. In general these flaws cannot be exploited through email in the Thunderbird and SeaMonkey products because scripting is disabled, but are potentially a risk in browser or browser-like contexts in those products. References Gary Kwong, Jesse Ruderman, Christian Holler, Bob Clary, Kyle Huey, Ed Morley, Chris Lord, Boris Zbarsky, Julian Seward, and Bill McCloskey reported memory safety problems and crashes that affect Firefox 16. (CVE-2012-5843) Jesse Ruderman, Andrew McCreight, Bob Clary, and Kyle Huey reported memory safety problems and crashes that affect Firefox ESR 10 and Firefox 16. (CVE-2012-5842) Patch Instructions: To install this SUSE Security Update use YaST online_update. Alternatively you can run the command listed for your product: - SUSE Linux Enterprise Software Development Kit 11 SP2: zypper in -t patch sdksp2-firefox-20121121-7093 - SUSE Linux Enterprise Server 11 SP2 for VMware: zypper in -t patch slessp2-firefox-20121121-7093 - SUSE Linux Enterprise Server 11 SP2: zypper in -t patch slessp2-firefox-20121121-7093 - SUSE Linux Enterprise Desktop 11 SP2: zypper in -t patch sledsp2-firefox-20121121-7093 To bring your system up-to-date, use "zypper patch". Package List: - SUSE Linux Enterprise Software Development Kit 11 SP2 (i586 ia64 ppc64 s390x x86_64) [New Version: 3.14]: mozilla-nss-devel-3.14-0.3.1 - SUSE Linux Enterprise Server 11 SP2 for VMware (i586 x86_64) [New Version: 10.0.11 and 3.14]: MozillaFirefox-10.0.11-0.3.1 MozillaFirefox-translations-10.0.11-0.3.1 libfreebl3-3.14-0.3.1 mozilla-nss-3.14-0.3.1 mozilla-nss-tools-3.14-0.3.1 - SUSE Linux Enterprise Server 11 SP2 for VMware (x86_64) [New Version: 3.14]: libfreebl3-32bit-3.14-0.3.1 mozilla-nss-32bit-3.14-0.3.1 - SUSE Linux Enterprise Server 11 SP2 (i586 ia64 ppc64 s390x x86_64) [New Version: 10.0.11 and 3.14]: MozillaFirefox-10.0.11-0.3.1 MozillaFirefox-translations-10.0.11-0.3.1 libfreebl3-3.14-0.3.1 mozilla-nss-3.14-0.3.1 mozilla-nss-tools-3.14-0.3.1 - SUSE Linux Enterprise Server 11 SP2 (ppc64 s390x x86_64) [New Version: 3.14]: libfreebl3-32bit-3.14-0.3.1 mozilla-nss-32bit-3.14-0.3.1 - SUSE Linux Enterprise Server 11 SP2 (ia64) [New Version: 3.14]: libfreebl3-x86-3.14-0.3.1 mozilla-nss-x86-3.14-0.3.1 - SUSE Linux Enterprise Server 10 SP4 (i586 ia64 ppc s390x x86_64) [New Version: 3.14]: mozilla-nss-3.14-0.6.1 mozilla-nss-devel-3.14-0.6.1 mozilla-nss-tools-3.14-0.6.1 - SUSE Linux Enterprise Server 10 SP4 (i586 ia64 ppc s390x): MozillaFirefox-10.0.11-0.5.1 MozillaFirefox-translations-10.0.11-0.5.1 - SUSE Linux Enterprise Server 10 SP4 (s390x x86_64) [New Version: 3.14]: mozilla-nss-32bit-3.14-0.6.1 - SUSE Linux Enterprise Server 10 SP4 (ia64) [New Version: 3.14]: mozilla-nss-x86-3.14-0.6.1 - SUSE Linux Enterprise Server 10 SP4 (ppc) [New Version: 3.14]: mozilla-nss-64bit-3.14-0.6.1 - SUSE Linux Enterprise Desktop 11 SP2 (i586 x86_64) [New Version: 10.0.11 and 3.14]: MozillaFirefox-10.0.11-0.3.1 MozillaFirefox-translations-10.0.11-0.3.1 libfreebl3-3.14-0.3.1 mozilla-nss-3.14-0.3.1 mozilla-nss-tools-3.14-0.3.1 - SUSE Linux Enterprise Desktop 11 SP2 (x86_64) [New Version: 3.14]: libfreebl3-32bit-3.14-0.3.1 mozilla-nss-32bit-3.14-0.3.1 - SUSE Linux Enterprise Desktop 10 SP4 (i586 x86_64) [New Version: 3.14]: mozilla-nss-3.14-0.6.1 mozilla-nss-devel-3.14-0.6.1 mozilla-nss-tools-3.14-0.6.1 - SUSE Linux Enterprise Desktop 10 SP4 (x86_64) [New Version: 3.14]: mozilla-nss-32bit-3.14-0.6.1 - SUSE Linux Enterprise Desktop 10 SP4 (i586): MozillaFirefox-10.0.11-0.5.1 MozillaFirefox-translations-10.0.11-0.5.1 - SLE SDK 10 SP4 (i586 ia64 ppc s390x x86_64) [New Version: 3.14]: mozilla-nss-tools-3.14-0.6.1 - SLE SDK 10 SP4 (i586 ia64 ppc s390x): MozillaFirefox-branding-upstream-10.0.11-0.5.1 References: https://bugzilla.novell.com/790140 http://download.novell.com/patch/finder/?keywords=8f4e08deca5960ae494ddceeb… http://download.novell.com/patch/finder/?keywords=be7a175297dfe6897d72c7cf8… -- To unsubscribe, e-mail: opensuse-security-announce+unsubscribe(a)opensuse.org For additional commands, e-mail: opensuse-security-announce+help(a)opensuse.org

1 0

[security-announce] SUSE-SU-2012:1588-1: important: Security update for IBM Java 1.6.0
by opensuse-security＠opensuse.org 28 Nov '12

28 Nov '12

SUSE Security Update: Security update for IBM Java 1.6.0 ______________________________________________________________________________ Announcement ID: SUSE-SU-2012:1588-1 Rating: important References: #780491 #785631 #788750 Affected Products: SUSE Linux Enterprise Server 10 SP4 SUSE Linux Enterprise Java 10 SP4 ______________________________________________________________________________ An update that contains security fixes can now be installed. Description: IBM Java 1.6.0 has been updated to SR12 which fixes bugs and security issues. More information can be found on: http://www.ibm.com/developerworks/java/jdk/alerts/ <http://www.ibm.com/developerworks/java/jdk/alerts/> CVEs fixed: CVE-2012-3159, CVE-2012-3216, CVE-2012-5068, CVE-2012-3143, CVE-2012-5073, CVE-2012-5075, CVE-2012-5083, CVE-2012-5083, CVE-2012-5072, CVE-2012-1531, CVE-2012-5081, CVE-2012-1532, CVE-2012-1533, CVE-2012-5069, CVE-2012-5071, CVE-2012-5084, CVE-2012-5079, CVE-2012-5089 Package List: - SUSE Linux Enterprise Server 10 SP4 (i586 ppc s390x x86_64): java-1_6_0-ibm-1.6.0_sr12.0-0.10.1 java-1_6_0-ibm-devel-1.6.0_sr12.0-0.10.1 java-1_6_0-ibm-fonts-1.6.0_sr12.0-0.10.1 java-1_6_0-ibm-jdbc-1.6.0_sr12.0-0.10.1 - SUSE Linux Enterprise Server 10 SP4 (i586 ppc x86_64): java-1_6_0-ibm-plugin-1.6.0_sr12.0-0.10.1 - SUSE Linux Enterprise Server 10 SP4 (s390x x86_64): java-1_6_0-ibm-32bit-1.6.0_sr12.0-0.10.1 java-1_6_0-ibm-devel-32bit-1.6.0_sr12.0-0.10.1 - SUSE Linux Enterprise Server 10 SP4 (x86_64): java-1_6_0-ibm-alsa-32bit-1.6.0_sr12.0-0.10.1 java-1_6_0-ibm-plugin-32bit-1.6.0_sr12.0-0.10.1 - SUSE Linux Enterprise Server 10 SP4 (i586): java-1_6_0-ibm-alsa-1.6.0_sr12.0-0.10.1 - SUSE Linux Enterprise Server 10 SP4 (ppc): java-1_6_0-ibm-64bit-1.6.0_sr12.0-0.10.1 - SUSE Linux Enterprise Java 10 SP4 (x86_64): java-1_6_0-ibm-1.6.0_sr12.0-0.10.1 java-1_6_0-ibm-devel-1.6.0_sr12.0-0.10.1 java-1_6_0-ibm-fonts-1.6.0_sr12.0-0.10.1 java-1_6_0-ibm-jdbc-1.6.0_sr12.0-0.10.1 java-1_6_0-ibm-plugin-1.6.0_sr12.0-0.10.1 References: https://bugzilla.novell.com/780491 https://bugzilla.novell.com/785631 https://bugzilla.novell.com/788750 http://download.novell.com/patch/finder/?keywords=94ebbbaeb864d11273a4fe129… -- To unsubscribe, e-mail: opensuse-security-announce+unsubscribe(a)opensuse.org For additional commands, e-mail: opensuse-security-announce+help(a)opensuse.org

1 0

[security-announce] SUSE-SU-2012:1578-1: important: Security update for libotr
by opensuse-security＠opensuse.org 27 Nov '12

27 Nov '12

SUSE Security Update: Security update for libotr ______________________________________________________________________________ Announcement ID: SUSE-SU-2012:1578-1 Rating: important References: #777468 Cross-References: CVE-2012-3461 Affected Products: SUSE Linux Enterprise Software Development Kit 11 SP2 SUSE Linux Enterprise Server 11 SP2 for VMware SUSE Linux Enterprise Server 11 SP2 SUSE Linux Enterprise Desktop 11 SP2 SUSE Linux Enterprise Desktop 10 SP4 SLE SDK 10 SP4 ______________________________________________________________________________ An update that fixes one vulnerability is now available. Description: This update fixes various heap overflows in libotr. CVE-2012-3461 has been assigned to this issue. Security Issue reference: * CVE-2012-3461 <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2012-3461 > Patch Instructions: To install this SUSE Security Update use YaST online_update. Alternatively you can run the command listed for your product: - SUSE Linux Enterprise Software Development Kit 11 SP2: zypper in -t patch sdksp2-libotr-7076 - SUSE Linux Enterprise Server 11 SP2 for VMware: zypper in -t patch slessp2-libotr-7076 - SUSE Linux Enterprise Server 11 SP2: zypper in -t patch slessp2-libotr-7076 - SUSE Linux Enterprise Desktop 11 SP2: zypper in -t patch sledsp2-libotr-7076 To bring your system up-to-date, use "zypper patch". Package List: - SUSE Linux Enterprise Software Development Kit 11 SP2 (i586 ia64 ppc64 s390x x86_64): libotr-devel-3.2.0-10.3.1 - SUSE Linux Enterprise Server 11 SP2 for VMware (i586 x86_64): libotr2-3.2.0-10.3.1 - SUSE Linux Enterprise Server 11 SP2 (i586 ia64 ppc64 s390x x86_64): libotr2-3.2.0-10.3.1 - SUSE Linux Enterprise Desktop 11 SP2 (i586 x86_64): libotr2-3.2.0-10.3.1 - SUSE Linux Enterprise Desktop 10 SP4 (i586 x86_64): libotr-3.0.0-16.9.1 - SLE SDK 10 SP4 (i586 ia64 ppc s390x x86_64): libotr-3.0.0-16.9.1 libotr-devel-3.0.0-16.9.1 References: http://support.novell.com/security/cve/CVE-2012-3461.html https://bugzilla.novell.com/777468 http://download.novell.com/patch/finder/?keywords=185be6b158bccfaa385e86829… http://download.novell.com/patch/finder/?keywords=fe4d1b88e23655d9450cf3fc8… -- To unsubscribe, e-mail: opensuse-security-announce+unsubscribe(a)opensuse.org For additional commands, e-mail: opensuse-security-announce+help(a)opensuse.org

1 0

[security-announce] openSUSE-SU-2012:1573-1: important: XEN: security and bugfix update
by opensuse-security＠opensuse.org 26 Nov '12

26 Nov '12

openSUSE Security Update: XEN: security and bugfix update ______________________________________________________________________________ Announcement ID: openSUSE-SU-2012:1573-1 Rating: important References: #764077 #771099 #776755 #777086 #777090 #777091 #777890 #778105 #779212 #784087 #786516 #786517 #786518 #786519 #786520 #787163 Cross-References: CVE-2007-0998 CVE-2012-2625 CVE-2012-2934 CVE-2012-3494 CVE-2012-3495 CVE-2012-3496 CVE-2012-3497 CVE-2012-3498 CVE-2012-3515 CVE-2012-4411 CVE-2012-4535 CVE-2012-4536 CVE-2012-4537 CVE-2012-4538 CVE-2012-4539 CVE-2012-4544 Affected Products: openSUSE 12.2 ______________________________________________________________________________ An update that fixes 16 vulnerabilities is now available. Description: This security update of XEN fixes various bugs and security issues. - Upstream patch 26088-xend-xml-filesize-check.patch - bnc#787163 - CVE-2012-4544: xen: Domain builder Out-of- memory due to malicious kernel/ramdisk (XSA 25) CVE-2012-4544-xsa25.patch - bnc#779212 - CVE-2012-4411: XEN / qemu: guest administrator can access qemu monitor console (XSA-19) CVE-2012-4411-xsa19.patch - bnc#786516 - CVE-2012-4535: xen: Timer overflow DoS vulnerability CVE-2012-4535-xsa20.patch - bnc#786518 - CVE-2012-4536: xen: pirq range check DoS vulnerability CVE-2012-4536-xsa21.patch - bnc#786517 - CVE-2012-4537: xen: Memory mapping failure DoS vulnerability CVE-2012-4537-xsa22.patch - bnc#786519 - CVE-2012-4538: xen: Unhooking empty PAE entries DoS vulnerability CVE-2012-4538-xsa23.patch - bnc#786520 - CVE-2012-4539: xen: Grant table hypercall infinite loop DoS vulnerability CVE-2012-4539-xsa24.patch - bnc#784087 - L3: Xen BUG at io_apic.c:129 26102-x86-IOAPIC-legacy-not-first.patch - Upstream patches from Jan 26054-x86-AMD-perf-ctr-init.patch 26055-x86-oprof-hvm-mode.patch 26056-page-alloc-flush-filter.patch 26061-x86-oprof-counter-range.patch 26062-ACPI-ERST-move-data.patch 26063-x86-HPET-affinity-lock.patch 26093-HVM-PoD-grant-mem-type.patch - Upstream patches from Jan 25931-x86-domctl-iomem-mapping-checks.patch 25952-x86-MMIO-remap-permissions.patch ------------------------------------------------------------ ------- Mon Sep 24 16:41:58 CEST 2012 - ohering(a)suse.de - use BuildRequires: gcc46 only in sles11sp2 or 12.1 to fix build in 11.4 ------------------------------------------------------------ ------- Thu Sep 20 10:03:40 MDT 2012 - carnold(a)novell.com - Upstream patches from Jan 25808-domain_create-return-value.patch 25814-x86_64-set-debugreg-guest.patch 25815-x86-PoD-no-bug-in-non-translated.patch 25816-x86-hvm-map-pirq-range-check.patch 25833-32on64-bogus-pt_base-adjust.patch 25834-x86-S3-MSI-resume.patch 25835-adjust-rcu-lock-domain.patch 25836-VT-d-S3-MSI-resume.patch 25850-tmem-xsa-15-1.patch 25851-tmem-xsa-15-2.patch 25852-tmem-xsa-15-3.patch 25853-tmem-xsa-15-4.patch 25854-tmem-xsa-15-5.patch 25855-tmem-xsa-15-6.patch 25856-tmem-xsa-15-7.patch 25857-tmem-xsa-15-8.patch 25858-tmem-xsa-15-9.patch 25859-tmem-missing-break.patch 25860-tmem-cleanup.patch 25883-pt-MSI-cleanup.patch 25927-x86-domctl-ioport-mapping-range.patch 25929-tmem-restore-pool-version.patch - bnc#778105 - first XEN-PV VM fails to spawn xend: Increase wait time for disk to appear in host bootloader Modified existing xen-domUloader.diff - Upstream patches from Jan 25752-ACPI-pm-op-valid-cpu.patch 25754-x86-PoD-early-access.patch 25755-x86-PoD-types.patch 25756-x86-MMIO-max-mapped-pfn.patch 25757-x86-EPT-PoD-1Gb-assert.patch 25764-x86-unknown-cpu-no-sysenter.patch 25765-x86_64-allow-unsafe-adjust.patch 25771-grant-copy-status-paged-out.patch 25773-x86-honor-no-real-mode.patch 25786-x86-prefer-multiboot-meminfo-over-e801.patch - bnc#777890 - CVE-2012-3497: xen: multiple TMEM hypercall vulnerabilities (XSA-15) CVE-2012-3497-tmem-xsa-15-1.patch CVE-2012-3497-tmem-xsa-15-2.patch CVE-2012-3497-tmem-xsa-15-3.patch CVE-2012-3497-tmem-xsa-15-4.patch CVE-2012-3497-tmem-xsa-15-5.patch CVE-2012-3497-tmem-xsa-15-6.patch CVE-2012-3497-tmem-xsa-15-7.patch CVE-2012-3497-tmem-xsa-15-8.patch CVE-2012-3497-tmem-xsa-15-9.patch tmem-missing-break.patch Patch Instructions: To install this openSUSE Security Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE 12.2: zypper in -t patch openSUSE-2012-812 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE 12.2 (i586 x86_64): xen-debugsource-4.1.3_04-5.13.1 xen-devel-4.1.3_04-5.13.1 xen-kmp-default-4.1.3_04_k3.4.11_2.16-5.13.1 xen-kmp-default-debuginfo-4.1.3_04_k3.4.11_2.16-5.13.1 xen-kmp-desktop-4.1.3_04_k3.4.11_2.16-5.13.1 xen-kmp-desktop-debuginfo-4.1.3_04_k3.4.11_2.16-5.13.1 xen-libs-4.1.3_04-5.13.1 xen-libs-debuginfo-4.1.3_04-5.13.1 xen-tools-domU-4.1.3_04-5.13.1 xen-tools-domU-debuginfo-4.1.3_04-5.13.1 - openSUSE 12.2 (x86_64): xen-4.1.3_04-5.13.1 xen-doc-html-4.1.3_04-5.13.1 xen-doc-pdf-4.1.3_04-5.13.1 xen-libs-32bit-4.1.3_04-5.13.1 xen-libs-debuginfo-32bit-4.1.3_04-5.13.1 xen-tools-4.1.3_04-5.13.1 xen-tools-debuginfo-4.1.3_04-5.13.1 - openSUSE 12.2 (i586): xen-kmp-pae-4.1.3_04_k3.4.11_2.16-5.13.1 xen-kmp-pae-debuginfo-4.1.3_04_k3.4.11_2.16-5.13.1 References: http://support.novell.com/security/cve/CVE-2007-0998.html http://support.novell.com/security/cve/CVE-2012-2625.html http://support.novell.com/security/cve/CVE-2012-2934.html http://support.novell.com/security/cve/CVE-2012-3494.html http://support.novell.com/security/cve/CVE-2012-3495.html http://support.novell.com/security/cve/CVE-2012-3496.html http://support.novell.com/security/cve/CVE-2012-3497.html http://support.novell.com/security/cve/CVE-2012-3498.html http://support.novell.com/security/cve/CVE-2012-3515.html http://support.novell.com/security/cve/CVE-2012-4411.html http://support.novell.com/security/cve/CVE-2012-4535.html http://support.novell.com/security/cve/CVE-2012-4536.html http://support.novell.com/security/cve/CVE-2012-4537.html http://support.novell.com/security/cve/CVE-2012-4538.html http://support.novell.com/security/cve/CVE-2012-4539.html http://support.novell.com/security/cve/CVE-2012-4544.html https://bugzilla.novell.com/764077 https://bugzilla.novell.com/771099 https://bugzilla.novell.com/776755 https://bugzilla.novell.com/777086 https://bugzilla.novell.com/777090 https://bugzilla.novell.com/777091 https://bugzilla.novell.com/777890 https://bugzilla.novell.com/778105 https://bugzilla.novell.com/779212 https://bugzilla.novell.com/784087 https://bugzilla.novell.com/786516 https://bugzilla.novell.com/786517 https://bugzilla.novell.com/786518 https://bugzilla.novell.com/786519 https://bugzilla.novell.com/786520 https://bugzilla.novell.com/787163 -- To unsubscribe, e-mail: opensuse-security-announce+unsubscribe(a)opensuse.org For additional commands, e-mail: opensuse-security-announce+help(a)opensuse.org

1 0

[security-announce] openSUSE-SU-2012:1572-1: important: XEN: security and bugfix update
by opensuse-security＠opensuse.org 26 Nov '12

26 Nov '12

openSUSE Security Update: XEN: security and bugfix update ______________________________________________________________________________ Announcement ID: openSUSE-SU-2012:1572-1 Rating: important References: #764077 #771099 #776755 #776995 #777086 #777090 #777091 #777890 #778105 #779212 #784087 #786516 #786517 #786518 #786519 #786520 #787163 Cross-References: CVE-2007-0998 CVE-2012-2625 CVE-2012-2934 CVE-2012-3494 CVE-2012-3495 CVE-2012-3496 CVE-2012-3497 CVE-2012-3498 CVE-2012-3515 CVE-2012-4411 CVE-2012-4535 CVE-2012-4536 CVE-2012-4537 CVE-2012-4538 CVE-2012-4539 CVE-2012-4544 Affected Products: openSUSE 12.1 ______________________________________________________________________________ An update that solves 16 vulnerabilities and has one errata is now available. Description: This security update of XEN fixes various bugs and security issues. - Upstream patch 26088-xend-xml-filesize-check.patch - bnc#787163 - CVE-2012-4544: xen: Domain builder Out-of- memory due to malicious kernel/ramdisk (XSA 25) CVE-2012-4544-xsa25.patch - bnc#779212 - CVE-2012-4411: XEN / qemu: guest administrator can access qemu monitor console (XSA-19) CVE-2012-4411-xsa19.patch - bnc#786516 - CVE-2012-4535: xen: Timer overflow DoS vulnerability CVE-2012-4535-xsa20.patch - bnc#786518 - CVE-2012-4536: xen: pirq range check DoS vulnerability CVE-2012-4536-xsa21.patch - bnc#786517 - CVE-2012-4537: xen: Memory mapping failure DoS vulnerability CVE-2012-4537-xsa22.patch - bnc#786519 - CVE-2012-4538: xen: Unhooking empty PAE entries DoS vulnerability CVE-2012-4538-xsa23.patch - bnc#786520 - CVE-2012-4539: xen: Grant table hypercall infinite loop DoS vulnerability CVE-2012-4539-xsa24.patch - bnc#784087 - L3: Xen BUG at io_apic.c:129 26102-x86-IOAPIC-legacy-not-first.patch - Upstream patches from Jan 26054-x86-AMD-perf-ctr-init.patch 26055-x86-oprof-hvm-mode.patch 26056-page-alloc-flush-filter.patch 26061-x86-oprof-counter-range.patch 26062-ACPI-ERST-move-data.patch 26063-x86-HPET-affinity-lock.patch 26093-HVM-PoD-grant-mem-type.patch - Upstream patches from Jan 25931-x86-domctl-iomem-mapping-checks.patch 25952-x86-MMIO-remap-permissions.patch - Upstream patches from Jan 25808-domain_create-return-value.patch 25814-x86_64-set-debugreg-guest.patch 25815-x86-PoD-no-bug-in-non-translated.patch 25816-x86-hvm-map-pirq-range-check.patch 25833-32on64-bogus-pt_base-adjust.patch 25834-x86-S3-MSI-resume.patch 25835-adjust-rcu-lock-domain.patch 25836-VT-d-S3-MSI-resume.patch 25850-tmem-xsa-15-1.patch 25851-tmem-xsa-15-2.patch 25852-tmem-xsa-15-3.patch 25853-tmem-xsa-15-4.patch 25854-tmem-xsa-15-5.patch 25855-tmem-xsa-15-6.patch 25856-tmem-xsa-15-7.patch 25857-tmem-xsa-15-8.patch 25858-tmem-xsa-15-9.patch 25859-tmem-missing-break.patch 25860-tmem-cleanup.patch 25883-pt-MSI-cleanup.patch 25927-x86-domctl-ioport-mapping-range.patch 25929-tmem-restore-pool-version.patch - bnc#778105 - first XEN-PV VM fails to spawn xend: Increase wait time for disk to appear in host bootloader Modified existing xen-domUloader.diff - Upstream patches from Jan 25752-ACPI-pm-op-valid-cpu.patch 25754-x86-PoD-early-access.patch 25755-x86-PoD-types.patch 25756-x86-MMIO-max-mapped-pfn.patch 25757-x86-EPT-PoD-1Gb-assert.patch 25764-x86-unknown-cpu-no-sysenter.patch 25765-x86_64-allow-unsafe-adjust.patch 25771-grant-copy-status-paged-out.patch 25773-x86-honor-no-real-mode.patch 25786-x86-prefer-multiboot-meminfo-over-e801.patch - bnc#777890 - CVE-2012-3497: xen: multiple TMEM hypercall vulnerabilities (XSA-15) CVE-2012-3497-tmem-xsa-15-1.patch CVE-2012-3497-tmem-xsa-15-2.patch CVE-2012-3497-tmem-xsa-15-3.patch CVE-2012-3497-tmem-xsa-15-4.patch CVE-2012-3497-tmem-xsa-15-5.patch CVE-2012-3497-tmem-xsa-15-6.patch CVE-2012-3497-tmem-xsa-15-7.patch CVE-2012-3497-tmem-xsa-15-8.patch CVE-2012-3497-tmem-xsa-15-9.patch tmem-missing-break.patch Patch Instructions: To install this openSUSE Security Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE 12.1: zypper in -t patch openSUSE-2012-811 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE 12.1 (i586 x86_64): xen-debugsource-4.1.3_04-1.21.1 xen-devel-4.1.3_04-1.21.1 xen-kmp-default-4.1.3_04_k3.1.10_1.16-1.21.1 xen-kmp-default-debuginfo-4.1.3_04_k3.1.10_1.16-1.21.1 xen-kmp-desktop-4.1.3_04_k3.1.10_1.16-1.21.1 xen-kmp-desktop-debuginfo-4.1.3_04_k3.1.10_1.16-1.21.1 xen-libs-4.1.3_04-1.21.1 xen-libs-debuginfo-4.1.3_04-1.21.1 xen-tools-domU-4.1.3_04-1.21.1 xen-tools-domU-debuginfo-4.1.3_04-1.21.1 - openSUSE 12.1 (x86_64): xen-4.1.3_04-1.21.1 xen-doc-html-4.1.3_04-1.21.1 xen-doc-pdf-4.1.3_04-1.21.1 xen-libs-32bit-4.1.3_04-1.21.1 xen-libs-debuginfo-32bit-4.1.3_04-1.21.1 xen-tools-4.1.3_04-1.21.1 xen-tools-debuginfo-4.1.3_04-1.21.1 - openSUSE 12.1 (ia64): xen-libs-debuginfo-x86-4.1.3_04-1.21.1 xen-libs-x86-4.1.3_04-1.21.1 - openSUSE 12.1 (i586): xen-kmp-pae-4.1.3_04_k3.1.10_1.16-1.21.1 xen-kmp-pae-debuginfo-4.1.3_04_k3.1.10_1.16-1.21.1 References: http://support.novell.com/security/cve/CVE-2007-0998.html http://support.novell.com/security/cve/CVE-2012-2625.html http://support.novell.com/security/cve/CVE-2012-2934.html http://support.novell.com/security/cve/CVE-2012-3494.html http://support.novell.com/security/cve/CVE-2012-3495.html http://support.novell.com/security/cve/CVE-2012-3496.html http://support.novell.com/security/cve/CVE-2012-3497.html http://support.novell.com/security/cve/CVE-2012-3498.html http://support.novell.com/security/cve/CVE-2012-3515.html http://support.novell.com/security/cve/CVE-2012-4411.html http://support.novell.com/security/cve/CVE-2012-4535.html http://support.novell.com/security/cve/CVE-2012-4536.html http://support.novell.com/security/cve/CVE-2012-4537.html http://support.novell.com/security/cve/CVE-2012-4538.html http://support.novell.com/security/cve/CVE-2012-4539.html http://support.novell.com/security/cve/CVE-2012-4544.html https://bugzilla.novell.com/764077 https://bugzilla.novell.com/771099 https://bugzilla.novell.com/776755 https://bugzilla.novell.com/776995 https://bugzilla.novell.com/777086 https://bugzilla.novell.com/777090 https://bugzilla.novell.com/777091 https://bugzilla.novell.com/777890 https://bugzilla.novell.com/778105 https://bugzilla.novell.com/779212 https://bugzilla.novell.com/784087 https://bugzilla.novell.com/786516 https://bugzilla.novell.com/786517 https://bugzilla.novell.com/786518 https://bugzilla.novell.com/786519 https://bugzilla.novell.com/786520 https://bugzilla.novell.com/787163 -- To unsubscribe, e-mail: opensuse-security-announce+unsubscribe(a)opensuse.org For additional commands, e-mail: opensuse-security-announce+help(a)opensuse.org

1 0

[security-announce] openSUSE-SU-2012:1525-1: important: update for libotr
by opensuse-security＠opensuse.org 22 Nov '12

22 Nov '12

openSUSE Security Update: update for libotr ______________________________________________________________________________ Announcement ID: openSUSE-SU-2012:1525-1 Rating: important References: #789190 Cross-References: CVE-2012-3461 Affected Products: openSUSE 12.2 openSUSE 12.1 ______________________________________________________________________________ An update that fixes one vulnerability is now available. Description: This update of libotr fixed multiple buffer overflows. Patch Instructions: To install this openSUSE Security Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE 12.2: zypper in -t patch openSUSE-2012-798 - openSUSE 12.1: zypper in -t patch openSUSE-2012-798 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE 12.2 (i586 x86_64): libotr-debugsource-3.2.1-15.4.1 libotr-devel-3.2.1-15.4.1 libotr-tools-3.2.1-15.4.1 libotr-tools-debuginfo-3.2.1-15.4.1 libotr2-3.2.1-15.4.1 libotr2-debuginfo-3.2.1-15.4.1 - openSUSE 12.1 (i586 x86_64): libotr-debugsource-3.2.1-11.4.1 libotr-devel-3.2.1-11.4.1 libotr-tools-3.2.1-11.4.1 libotr-tools-debuginfo-3.2.1-11.4.1 libotr2-3.2.1-11.4.1 libotr2-debuginfo-3.2.1-11.4.1 References: http://support.novell.com/security/cve/CVE-2012-3461.html https://bugzilla.novell.com/789190 -- To unsubscribe, e-mail: opensuse-security-announce+unsubscribe(a)opensuse.org For additional commands, e-mail: opensuse-security-announce+help(a)opensuse.org

1 0

[security-announce] SUSE-SU-2012:1520-1: important: Security update for libssh2
by opensuse-security＠opensuse.org 21 Nov '12

21 Nov '12

SUSE Security Update: Security update for libssh2 ______________________________________________________________________________ Announcement ID: SUSE-SU-2012:1520-1 Rating: important References: #789827 Cross-References: CVE-2012-4562 Affected Products: SUSE Linux Enterprise Software Development Kit 11 SP2 SUSE Linux Enterprise Desktop 11 SP2 ______________________________________________________________________________ An update that fixes one vulnerability is now available. Description: This update of libssh fixes multiple integer overflows. CVE-2012-4562 has been assigned to this issue. Security Issue reference: * CVE-2012-4562 <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2012-4562 > Patch Instructions: To install this SUSE Security Update use YaST online_update. Alternatively you can run the command listed for your product: - SUSE Linux Enterprise Software Development Kit 11 SP2: zypper in -t patch sdksp2-libssh2-7073 - SUSE Linux Enterprise Desktop 11 SP2: zypper in -t patch sledsp2-libssh2-7073 To bring your system up-to-date, use "zypper patch". Package List: - SUSE Linux Enterprise Software Development Kit 11 SP2 (i586 ia64 ppc64 s390x x86_64): libssh2-0.2-5.18.1 - SUSE Linux Enterprise Desktop 11 SP2 (i586 x86_64): libssh2-0.2-5.18.1 References: http://support.novell.com/security/cve/CVE-2012-4562.html https://bugzilla.novell.com/789827 http://download.novell.com/patch/finder/?keywords=2e1c319ecc84f3419428796ff… -- To unsubscribe, e-mail: opensuse-security-announce+unsubscribe(a)opensuse.org For additional commands, e-mail: opensuse-security-announce+help(a)opensuse.org

1 0

[security-announce] SUSE-SU-2012:1489-2: important: Security update for IBM Java 1.7.0
by opensuse-security＠opensuse.org 21 Nov '12

21 Nov '12

SUSE Security Update: Security update for IBM Java 1.7.0 ______________________________________________________________________________ Announcement ID: SUSE-SU-2012:1489-2 Rating: important References: #788750 Affected Products: SUSE Linux Enterprise Software Development Kit 11 SP2 SUSE Linux Enterprise Server 11 SP2 for VMware SUSE Linux Enterprise Server 11 SP2 SUSE Linux Enterprise Java 11 SP2 ______________________________________________________________________________ An update that contains security fixes can now be installed. Description: IBM Java 1.7.0 has been updated to SR3 which fixes bugs and security issues. More information can be found on: http://www.ibm.com/developerworks/java/jdk/alerts/ <http://www.ibm.com/developerworks/java/jdk/alerts/> CVEs fixed: CVE-2012-3159,CVE-2012-3216,CVE-2012-5070,CVE-2012-5067,CVE- 2012-3143,CVE-2012-5076,CVE-2012-5077,CVE-2012-5073,CVE-2012 -5074,CVE-2012-5075,CVE-2012-5083,CVE-2012-5083,CVE-2012-507 2,CVE-2012-1531,CVE-2012-5081,CVE-2012-1532,CVE-2012-1533,CV E-2012-5069,CVE-2012-5071,CVE-2012-5084,CVE-2012-5087,CVE-20 12-5086,CVE-2012-5079,CVE-2012-5088,CVE-2012-5089 Patch Instructions: To install this SUSE Security Update use YaST online_update. Alternatively you can run the command listed for your product: - SUSE Linux Enterprise Software Development Kit 11 SP2: zypper in -t patch sdksp2-java-1_7_0-ibm-7046 - SUSE Linux Enterprise Server 11 SP2 for VMware: zypper in -t patch slessp2-java-1_7_0-ibm-7046 - SUSE Linux Enterprise Server 11 SP2: zypper in -t patch slessp2-java-1_7_0-ibm-7046 - SUSE Linux Enterprise Java 11 SP2: zypper in -t patch slejsp2-java-1_7_0-ibm-7046 To bring your system up-to-date, use "zypper patch". Package List: - SUSE Linux Enterprise Software Development Kit 11 SP2 (i586 ppc64 s390x x86_64): java-1_7_0-ibm-devel-1.7.0_sr3.0-0.5.1 - SUSE Linux Enterprise Server 11 SP2 for VMware (i586 x86_64): java-1_7_0-ibm-1.7.0_sr3.0-0.5.1 java-1_7_0-ibm-jdbc-1.7.0_sr3.0-0.5.1 java-1_7_0-ibm-plugin-1.7.0_sr3.0-0.5.1 - SUSE Linux Enterprise Server 11 SP2 for VMware (i586): java-1_7_0-ibm-alsa-1.7.0_sr3.0-0.5.1 - SUSE Linux Enterprise Server 11 SP2 (i586 ppc64 s390x x86_64): java-1_7_0-ibm-1.7.0_sr3.0-0.5.1 java-1_7_0-ibm-jdbc-1.7.0_sr3.0-0.5.1 - SUSE Linux Enterprise Server 11 SP2 (i586 x86_64): java-1_7_0-ibm-plugin-1.7.0_sr3.0-0.5.1 - SUSE Linux Enterprise Server 11 SP2 (i586): java-1_7_0-ibm-alsa-1.7.0_sr3.0-0.5.1 - SUSE Linux Enterprise Java 11 SP2 (i586 ppc64 s390x x86_64): java-1_7_0-ibm-1.7.0_sr3.0-0.5.1 java-1_7_0-ibm-devel-1.7.0_sr3.0-0.5.1 java-1_7_0-ibm-jdbc-1.7.0_sr3.0-0.5.1 - SUSE Linux Enterprise Java 11 SP2 (i586 x86_64): java-1_7_0-ibm-alsa-1.7.0_sr3.0-0.5.1 java-1_7_0-ibm-plugin-1.7.0_sr3.0-0.5.1 References: https://bugzilla.novell.com/788750 http://download.novell.com/patch/finder/?keywords=6af80338101f9a022afdf21e0… -- To unsubscribe, e-mail: opensuse-security-announce+unsubscribe(a)opensuse.org For additional commands, e-mail: opensuse-security-announce+help(a)opensuse.org

1 0

[security-announce] openSUSE-SU-2012:1506-1: important: update for plib
by opensuse-security＠opensuse.org 20 Nov '12

20 Nov '12

openSUSE Security Update: update for plib ______________________________________________________________________________ Announcement ID: openSUSE-SU-2012:1506-1 Rating: important References: #738207 #787305 Cross-References: CVE-2011-4620 CVE-2012-4552 Affected Products: openSUSE 12.2 openSUSE 12.1 ______________________________________________________________________________ An update that fixes two vulnerabilities is now available. Description: This update of plib fixed two stack-based buffer overflows. Patch Instructions: To install this openSUSE Security Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE 12.2: zypper in -t patch openSUSE-2012-789 - openSUSE 12.1: zypper in -t patch openSUSE-2012-789 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE 12.2 (i586 x86_64): plib-1.8.5-76.4.1 plib-debuginfo-1.8.5-76.4.1 plib-debugsource-1.8.5-76.4.1 plib-devel-1.8.5-76.4.1 - openSUSE 12.1 (i586 x86_64): plib-1.8.5-71.4.1 plib-debuginfo-1.8.5-71.4.1 plib-debugsource-1.8.5-71.4.1 plib-devel-1.8.5-71.4.1 References: http://support.novell.com/security/cve/CVE-2011-4620.html http://support.novell.com/security/cve/CVE-2012-4552.html https://bugzilla.novell.com/738207 https://bugzilla.novell.com/787305 -- To unsubscribe, e-mail: opensuse-security-announce+unsubscribe(a)opensuse.org For additional commands, e-mail: opensuse-security-announce+help(a)opensuse.org

1 0

[security-announce] SUSE-SU-2012:1503-1: important: Security update for libvirt
by opensuse-security＠opensuse.org 19 Nov '12

19 Nov '12

SUSE Security Update: Security update for libvirt ______________________________________________________________________________ Announcement ID: SUSE-SU-2012:1503-1 Rating: important References: #772586 #773621 #773626 #780432 Cross-References: CVE-2012-3497 CVE-2012-4411 CVE-2012-4535 CVE-2012-4536 CVE-2012-4537 CVE-2012-4538 CVE-2012-4539 CVE-2012-4544 Affected Products: SUSE Linux Enterprise Software Development Kit 11 SP2 SUSE Linux Enterprise Server 11 SP2 SUSE Linux Enterprise Desktop 11 SP2 ______________________________________________________________________________ An update that fixes 8 vulnerabilities is now available. Description: libvirt received security and bugfixes: * CVE-2012-4423: Fixed a libvirt remote denial of service (crash) problem. The following bugs have been fixed: * qemu: Fix probing for guest capabilities * xen-xm: Generate UUID if not specified * xenParseXM: don't dereference NULL pointer when script is empty Security Issue references: * CVE-2012-4539 <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2012-4539 > * CVE-2012-3497 <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2012-3497 > * CVE-2012-4411 <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2012-4411 > * CVE-2012-4535 <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2012-4535 > * CVE-2012-4537 <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2012-4537 > * CVE-2012-4536 <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2012-4536 > * CVE-2012-4538 <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2012-4538 > * CVE-2012-4539 <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2012-4539 > * CVE-2012-4544 <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2012-4544 > Patch Instructions: To install this SUSE Security Update use YaST online_update. Alternatively you can run the command listed for your product: - SUSE Linux Enterprise Software Development Kit 11 SP2: zypper in -t patch sdksp2-libvirt-201211-7015 - SUSE Linux Enterprise Server 11 SP2: zypper in -t patch slessp2-libvirt-201211-7015 - SUSE Linux Enterprise Desktop 11 SP2: zypper in -t patch sledsp2-libvirt-201211-7015 To bring your system up-to-date, use "zypper patch". Package List: - SUSE Linux Enterprise Software Development Kit 11 SP2 (i586 x86_64): libvirt-devel-0.9.6-0.23.1 - SUSE Linux Enterprise Software Development Kit 11 SP2 (x86_64): libvirt-devel-32bit-0.9.6-0.23.1 - SUSE Linux Enterprise Server 11 SP2 (i586 x86_64): libvirt-0.9.6-0.23.1 libvirt-client-0.9.6-0.23.1 libvirt-doc-0.9.6-0.23.1 libvirt-python-0.9.6-0.23.1 - SUSE Linux Enterprise Server 11 SP2 (x86_64): libvirt-client-32bit-0.9.6-0.23.1 - SUSE Linux Enterprise Desktop 11 SP2 (i586 x86_64): libvirt-0.9.6-0.23.1 libvirt-client-0.9.6-0.23.1 libvirt-doc-0.9.6-0.23.1 libvirt-python-0.9.6-0.23.1 - SUSE Linux Enterprise Desktop 11 SP2 (x86_64): libvirt-client-32bit-0.9.6-0.23.1 References: http://support.novell.com/security/cve/CVE-2012-3497.html http://support.novell.com/security/cve/CVE-2012-4411.html http://support.novell.com/security/cve/CVE-2012-4535.html http://support.novell.com/security/cve/CVE-2012-4536.html http://support.novell.com/security/cve/CVE-2012-4537.html http://support.novell.com/security/cve/CVE-2012-4538.html http://support.novell.com/security/cve/CVE-2012-4539.html http://support.novell.com/security/cve/CVE-2012-4544.html https://bugzilla.novell.com/772586 https://bugzilla.novell.com/773621 https://bugzilla.novell.com/773626 https://bugzilla.novell.com/780432 http://download.novell.com/patch/finder/?keywords=6c77cedf2e828c0cfa0f10bbd… -- To unsubscribe, e-mail: opensuse-security-announce+unsubscribe(a)opensuse.org For additional commands, e-mail: opensuse-security-announce+help(a)opensuse.org

1 0

[security-announce] SUSE-SU-2012:1490-1: important: Security update for IBM Java 1.4.2
by opensuse-security＠opensuse.org 16 Nov '12

16 Nov '12

SUSE Security Update: Security update for IBM Java 1.4.2 ______________________________________________________________________________ Announcement ID: SUSE-SU-2012:1490-1 Rating: important References: #758651 #788750 Affected Products: SUSE Linux Enterprise Software Development Kit 11 SP2 SUSE Linux Enterprise Server 11 SP2 for VMware SUSE Linux Enterprise Server 11 SP2 SUSE Linux Enterprise Server 10 SP4 SUSE Linux Enterprise Java 11 SP2 SUSE Linux Enterprise Java 10 SP4 ______________________________________________________________________________ An update that contains security fixes can now be installed. Description: IBM Java 1.4.2 has been updated to SR13-FP14 which fixes bugs and security issues. More information can be found on: [http://www.ibm.com/developerworks/java/jdk/alerts/)(http:// www.ibm.com/developerworks/java/jdk/alerts/) CVEs fixed: CVE-2012-3216,CVE-2012-5073,CVE-2012-5083,CVE-2012-5083,CVE- 2012-1531,CVE-2012-5081,CVE-2012-5084,CVE-2012-5079 Patch Instructions: To install this SUSE Security Update use YaST online_update. Alternatively you can run the command listed for your product: - SUSE Linux Enterprise Software Development Kit 11 SP2: zypper in -t patch sdksp2-java-1_4_2-ibm-7043 - SUSE Linux Enterprise Server 11 SP2 for VMware: zypper in -t patch slessp2-java-1_4_2-ibm-7043 - SUSE Linux Enterprise Server 11 SP2: zypper in -t patch slessp2-java-1_4_2-ibm-7043 - SUSE Linux Enterprise Java 11 SP2: zypper in -t patch slejsp2-java-1_4_2-ibm-7043 To bring your system up-to-date, use "zypper patch". Package List: - SUSE Linux Enterprise Software Development Kit 11 SP2 (i586 ia64 ppc64 s390x x86_64): java-1_4_2-ibm-devel-1.4.2_sr13.14-0.2.1 - SUSE Linux Enterprise Software Development Kit 11 SP2 (i586 x86_64): java-1_4_2-ibm-1.4.2_sr13.14-0.2.1 - SUSE Linux Enterprise Server 11 SP2 for VMware (i586 x86_64): java-1_4_2-ibm-1.4.2_sr13.14-0.2.1 - SUSE Linux Enterprise Server 11 SP2 for VMware (i586): java-1_4_2-ibm-jdbc-1.4.2_sr13.14-0.2.1 java-1_4_2-ibm-plugin-1.4.2_sr13.14-0.2.1 - SUSE Linux Enterprise Server 11 SP2 (i586 ia64 ppc64 s390x x86_64): java-1_4_2-ibm-1.4.2_sr13.14-0.2.1 - SUSE Linux Enterprise Server 11 SP2 (i586): java-1_4_2-ibm-jdbc-1.4.2_sr13.14-0.2.1 java-1_4_2-ibm-plugin-1.4.2_sr13.14-0.2.1 - SUSE Linux Enterprise Server 10 SP4 (i586 ia64 ppc s390x x86_64): java-1_4_2-ibm-1.4.2_sr13.14-0.5.1 java-1_4_2-ibm-devel-1.4.2_sr13.14-0.5.1 - SUSE Linux Enterprise Server 10 SP4 (i586 ppc): java-1_4_2-ibm-jdbc-1.4.2_sr13.14-0.5.1 - SUSE Linux Enterprise Server 10 SP4 (i586): java-1_4_2-ibm-plugin-1.4.2_sr13.14-0.5.1 - SUSE Linux Enterprise Java 11 SP2 (i586 ppc64 s390x x86_64): java-1_4_2-ibm-1.4.2_sr13.14-0.2.1 - SUSE Linux Enterprise Java 11 SP2 (i586): java-1_4_2-ibm-jdbc-1.4.2_sr13.14-0.2.1 java-1_4_2-ibm-plugin-1.4.2_sr13.14-0.2.1 - SUSE Linux Enterprise Java 10 SP4 (i586 ia64 ppc s390x x86_64): java-1_4_2-ibm-1.4.2_sr13.14-0.5.1 java-1_4_2-ibm-devel-1.4.2_sr13.14-0.5.1 - SUSE Linux Enterprise Java 10 SP4 (i586 ppc): java-1_4_2-ibm-jdbc-1.4.2_sr13.14-0.5.1 - SUSE Linux Enterprise Java 10 SP4 (i586): java-1_4_2-ibm-plugin-1.4.2_sr13.14-0.5.1 References: https://bugzilla.novell.com/758651 https://bugzilla.novell.com/788750 http://download.novell.com/patch/finder/?keywords=a01a06d8f691fbd19a4c84ccc… http://download.novell.com/patch/finder/?keywords=cc64f4b8f8231d78d335786a3… -- To unsubscribe, e-mail: opensuse-security-announce+unsubscribe(a)opensuse.org For additional commands, e-mail: opensuse-security-announce+help(a)opensuse.org

1 0

[security-announce] SUSE-SU-2012:1489-1: important: Security update for IBM Java 1.5.0
by opensuse-security＠opensuse.org 16 Nov '12

16 Nov '12

SUSE Security Update: Security update for IBM Java 1.5.0 ______________________________________________________________________________ Announcement ID: SUSE-SU-2012:1489-1 Rating: important References: #788750 Affected Products: SUSE Linux Enterprise Server 10 SP4 SUSE Linux Enterprise Java 10 SP4 SUSE Linux Enterprise Desktop 10 SP4 ______________________________________________________________________________ An update that contains security fixes can now be installed. Description: IBM Java 1.5.0 has been updated to SR15 which fixes bugs and security issues. More information can be found on: http://www.ibm.com/developerworks/java/jdk/alerts/ <http://www.ibm.com/developerworks/java/jdk/alerts/> CVE-2012-3216,CVE-2012-3143,CVE-2012-5073,CVE-2012-5075,CVE- 2012-5083,CVE-2012-5083,CVE-2012-1531,CVE-2012-5081,CVE-2012 -5069,CVE-2012-5071,CVE-2012-5084,CVE-2012-5079,CVE-2012-508 9 Package List: - SUSE Linux Enterprise Server 10 SP4 (i586 ppc s390x x86_64): java-1_5_0-ibm-1.5.0_sr15.0-0.5.1 java-1_5_0-ibm-devel-1.5.0_sr15.0-0.5.1 java-1_5_0-ibm-fonts-1.5.0_sr15.0-0.5.1 - SUSE Linux Enterprise Server 10 SP4 (s390x x86_64): java-1_5_0-ibm-32bit-1.5.0_sr15.0-0.5.1 java-1_5_0-ibm-devel-32bit-1.5.0_sr15.0-0.5.1 - SUSE Linux Enterprise Server 10 SP4 (i586 ppc): java-1_5_0-ibm-jdbc-1.5.0_sr15.0-0.5.1 java-1_5_0-ibm-plugin-1.5.0_sr15.0-0.5.1 - SUSE Linux Enterprise Server 10 SP4 (x86_64): java-1_5_0-ibm-alsa-32bit-1.5.0_sr15.0-0.5.1 - SUSE Linux Enterprise Server 10 SP4 (i586): java-1_5_0-ibm-alsa-1.5.0_sr15.0-0.5.1 - SUSE Linux Enterprise Server 10 SP4 (ppc): java-1_5_0-ibm-64bit-1.5.0_sr15.0-0.5.1 - SUSE Linux Enterprise Java 10 SP4 (i586 ppc s390x x86_64): java-1_5_0-ibm-1.5.0_sr15.0-0.5.1 java-1_5_0-ibm-devel-1.5.0_sr15.0-0.5.1 java-1_5_0-ibm-fonts-1.5.0_sr15.0-0.5.1 - SUSE Linux Enterprise Java 10 SP4 (ppc): java-1_5_0-ibm-jdbc-1.5.0_sr15.0-0.5.1 java-1_5_0-ibm-plugin-1.5.0_sr15.0-0.5.1 - SUSE Linux Enterprise Desktop 10 SP4 (i586 x86_64): java-1_5_0-ibm-1.5.0_sr15.0-0.5.1 java-1_5_0-ibm-demo-1.5.0_sr15.0-0.5.1 java-1_5_0-ibm-devel-1.5.0_sr15.0-0.5.1 java-1_5_0-ibm-fonts-1.5.0_sr15.0-0.5.1 java-1_5_0-ibm-src-1.5.0_sr15.0-0.5.1 - SUSE Linux Enterprise Desktop 10 SP4 (x86_64): java-1_5_0-ibm-32bit-1.5.0_sr15.0-0.5.1 java-1_5_0-ibm-alsa-32bit-1.5.0_sr15.0-0.5.1 java-1_5_0-ibm-devel-32bit-1.5.0_sr15.0-0.5.1 - SUSE Linux Enterprise Desktop 10 SP4 (i586): java-1_5_0-ibm-alsa-1.5.0_sr15.0-0.5.1 java-1_5_0-ibm-jdbc-1.5.0_sr15.0-0.5.1 java-1_5_0-ibm-plugin-1.5.0_sr15.0-0.5.1 References: https://bugzilla.novell.com/788750 http://download.novell.com/patch/finder/?keywords=bb56b08850390b907db4d458f… -- To unsubscribe, e-mail: opensuse-security-announce+unsubscribe(a)opensuse.org For additional commands, e-mail: opensuse-security-announce+help(a)opensuse.org

1 0

[security-announce] SUSE-SU-2012:1487-1: important: Security update for Xen
by opensuse-security＠opensuse.org 16 Nov '12

16 Nov '12

SUSE Security Update: Security update for Xen ______________________________________________________________________________ Announcement ID: SUSE-SU-2012:1487-1 Rating: important References: #651093 #713555 #784087 #786516 #786517 Cross-References: CVE-2012-3497 CVE-2012-4411 CVE-2012-4535 CVE-2012-4536 CVE-2012-4537 CVE-2012-4538 CVE-2012-4539 CVE-2012-4544 Affected Products: SUSE Linux Enterprise Server 10 SP4 SUSE Linux Enterprise Desktop 10 SP4 SLE SDK 10 SP4 ______________________________________________________________________________ An update that fixes 8 vulnerabilities is now available. Description: XEN received various security and bugfixes: * CVE-2012-4535: xen: Timer overflow DoS vulnerability (XSA-20) * CVE-2012-4537: xen: Memory mapping failure DoS vulnerability (XSA-22) The following additional bugs have beenfixed: * bnc#784087 - L3: Xen BUG at io_apic.c:129 26102-x86-IOAPIC-legacy-not-first.patch * Upstream patches from Jan 25927-x86-domctl-ioport-mapping-range.patch 25931-x86-domctl-iomem-mapping-checks.patch 26061-x86-oprof-counter-range.patch 25431-x86-EDD-MBR-sig-check.patch 25480-x86_64-sysret-canonical.patch 25481-x86_64-AMD-erratum-121.patch 25485-x86_64-canonical-checks.patch 25587-param-parse-limit.patch 25589-pygrub-size-limits.patch 25744-hypercall-return-long.patch 25765-x86_64-allow-unsafe-adjust.patch 25773-x86-honor-no-real-mode.patch 25786-x86-prefer-multiboot-meminfo-over-e801.patch 25808-domain_create-return-value.patch 25814-x86_64-set-debugreg-guest.patch 24742-gnttab-misc.patch 25098-x86-emul-lock-UD.patch 25200-x86_64-trap-bounce-flags.patch 25271-x86_64-IST-index.patch * bnc#651093 - win2k8 guests are unable to restore after saving the vms state ept-novell-x64.patch 23800-x86_64-guest-addr-range.patch 24168-x86-vioapic-clear-remote_irr.patch 24453-x86-vIRQ-IRR-TMR-race.patch 24456-x86-emul-lea.patch * bnc#713555 - Unable to install RHEL 6.1 x86 as a paravirtualized guest OS on SLES 10 SP4 x86 vm-install-0.2.19.tar.bz2 Security Issue references: * CVE-2012-4539 <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2012-4539 > * CVE-2012-3497 <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2012-3497 > * CVE-2012-4411 <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2012-4411 > * CVE-2012-4535 <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2012-4535 > * CVE-2012-4537 <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2012-4537 > * CVE-2012-4536 <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2012-4536 > * CVE-2012-4538 <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2012-4538 > * CVE-2012-4539 <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2012-4539 > * CVE-2012-4544 <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2012-4544 > Package List: - SUSE Linux Enterprise Server 10 SP4 (x86_64): xen-3.2.3_17040_42-0.7.2 xen-devel-3.2.3_17040_42-0.7.2 xen-doc-html-3.2.3_17040_42-0.7.2 xen-doc-pdf-3.2.3_17040_42-0.7.2 xen-doc-ps-3.2.3_17040_42-0.7.2 xen-kmp-debug-3.2.3_17040_42_2.6.16.60_0.99.11-0.7.2 xen-kmp-default-3.2.3_17040_42_2.6.16.60_0.99.11-0.7.2 xen-kmp-kdump-3.2.3_17040_42_2.6.16.60_0.99.11-0.7.2 xen-kmp-smp-3.2.3_17040_42_2.6.16.60_0.99.11-0.7.2 xen-libs-3.2.3_17040_42-0.7.2 xen-libs-32bit-3.2.3_17040_42-0.7.1 xen-tools-3.2.3_17040_42-0.7.2 xen-tools-domU-3.2.3_17040_42-0.7.2 xen-tools-ioemu-3.2.3_17040_42-0.7.2 - SUSE Linux Enterprise Server 10 SP4 (i586): xen-3.2.3_17040_42-0.7.1 xen-devel-3.2.3_17040_42-0.7.1 xen-doc-html-3.2.3_17040_42-0.7.1 xen-doc-pdf-3.2.3_17040_42-0.7.1 xen-doc-ps-3.2.3_17040_42-0.7.1 xen-kmp-bigsmp-3.2.3_17040_42_2.6.16.60_0.99.8-0.7.1 xen-kmp-debug-3.2.3_17040_42_2.6.16.60_0.99.8-0.7.1 xen-kmp-default-3.2.3_17040_42_2.6.16.60_0.99.8-0.7.1 xen-kmp-kdump-3.2.3_17040_42_2.6.16.60_0.99.8-0.7.1 xen-kmp-kdumppae-3.2.3_17040_42_2.6.16.60_0.99.8-0.7.1 xen-kmp-smp-3.2.3_17040_42_2.6.16.60_0.99.8-0.7.1 xen-kmp-vmi-3.2.3_17040_42_2.6.16.60_0.99.8-0.7.1 xen-kmp-vmipae-3.2.3_17040_42_2.6.16.60_0.99.8-0.7.1 xen-libs-3.2.3_17040_42-0.7.1 xen-tools-3.2.3_17040_42-0.7.1 xen-tools-domU-3.2.3_17040_42-0.7.1 xen-tools-ioemu-3.2.3_17040_42-0.7.1 - SUSE Linux Enterprise Desktop 10 SP4 (x86_64): xen-3.2.3_17040_42-0.7.2 xen-devel-3.2.3_17040_42-0.7.2 xen-doc-html-3.2.3_17040_42-0.7.2 xen-doc-pdf-3.2.3_17040_42-0.7.2 xen-doc-ps-3.2.3_17040_42-0.7.2 xen-kmp-default-3.2.3_17040_42_2.6.16.60_0.99.11-0.7.2 xen-kmp-smp-3.2.3_17040_42_2.6.16.60_0.99.11-0.7.2 xen-libs-3.2.3_17040_42-0.7.2 xen-libs-32bit-3.2.3_17040_42-0.7.1 xen-tools-3.2.3_17040_42-0.7.2 xen-tools-domU-3.2.3_17040_42-0.7.2 xen-tools-ioemu-3.2.3_17040_42-0.7.2 - SUSE Linux Enterprise Desktop 10 SP4 (i586): xen-3.2.3_17040_42-0.7.1 xen-devel-3.2.3_17040_42-0.7.1 xen-doc-html-3.2.3_17040_42-0.7.1 xen-doc-pdf-3.2.3_17040_42-0.7.1 xen-doc-ps-3.2.3_17040_42-0.7.1 xen-kmp-bigsmp-3.2.3_17040_42_2.6.16.60_0.99.8-0.7.1 xen-kmp-default-3.2.3_17040_42_2.6.16.60_0.99.8-0.7.1 xen-kmp-smp-3.2.3_17040_42_2.6.16.60_0.99.8-0.7.1 xen-libs-3.2.3_17040_42-0.7.1 xen-tools-3.2.3_17040_42-0.7.1 xen-tools-domU-3.2.3_17040_42-0.7.1 xen-tools-ioemu-3.2.3_17040_42-0.7.1 - SLE SDK 10 SP4 (x86_64): xen-3.2.3_17040_42-0.7.2 xen-devel-3.2.3_17040_42-0.7.2 xen-kmp-debug-3.2.3_17040_42_2.6.16.60_0.99.11-0.7.2 xen-kmp-kdump-3.2.3_17040_42_2.6.16.60_0.99.11-0.7.2 xen-libs-3.2.3_17040_42-0.7.2 xen-libs-32bit-3.2.3_17040_42-0.7.1 xen-tools-3.2.3_17040_42-0.7.2 xen-tools-ioemu-3.2.3_17040_42-0.7.2 - SLE SDK 10 SP4 (i586): xen-3.2.3_17040_42-0.7.1 xen-devel-3.2.3_17040_42-0.7.1 xen-kmp-debug-3.2.3_17040_42_2.6.16.60_0.99.8-0.7.1 xen-kmp-kdump-3.2.3_17040_42_2.6.16.60_0.99.8-0.7.1 xen-libs-3.2.3_17040_42-0.7.1 xen-tools-3.2.3_17040_42-0.7.1 xen-tools-ioemu-3.2.3_17040_42-0.7.1 References: http://support.novell.com/security/cve/CVE-2012-3497.html http://support.novell.com/security/cve/CVE-2012-4411.html http://support.novell.com/security/cve/CVE-2012-4535.html http://support.novell.com/security/cve/CVE-2012-4536.html http://support.novell.com/security/cve/CVE-2012-4537.html http://support.novell.com/security/cve/CVE-2012-4538.html http://support.novell.com/security/cve/CVE-2012-4539.html http://support.novell.com/security/cve/CVE-2012-4544.html https://bugzilla.novell.com/651093 https://bugzilla.novell.com/713555 https://bugzilla.novell.com/784087 https://bugzilla.novell.com/786516 https://bugzilla.novell.com/786517 http://download.novell.com/patch/finder/?keywords=1e9042debead5d88c23444a90… -- To unsubscribe, e-mail: opensuse-security-announce+unsubscribe(a)opensuse.org For additional commands, e-mail: opensuse-security-announce+help(a)opensuse.org

1 0

[security-announce] SUSE-SU-2012:1486-1: important: Security update for Xen
by opensuse-security＠opensuse.org 15 Nov '12

15 Nov '12

SUSE Security Update: Security update for Xen ______________________________________________________________________________ Announcement ID: SUSE-SU-2012:1486-1 Rating: important References: #777890 #778105 #779212 #784087 #786516 #786517 #786518 #786519 #786520 #787163 Cross-References: CVE-2012-3497 CVE-2012-4411 CVE-2012-4535 CVE-2012-4536 CVE-2012-4537 CVE-2012-4538 CVE-2012-4539 CVE-2012-4544 Affected Products: SUSE Linux Enterprise Software Development Kit 11 SP2 SUSE Linux Enterprise Server 11 SP2 for VMware SUSE Linux Enterprise Server 11 SP2 SUSE Linux Enterprise Desktop 11 SP2 ______________________________________________________________________________ An update that solves 8 vulnerabilities and has two fixes is now available. Description: XEN was updated to fix various bugs and security issues: The following security issues have been fixed: * CVE-2012-4544: xen: Domain builder Out-of-memory due to malicious kernel/ramdisk (XSA 25) * CVE-2012-4411: XEN / qemu: guest administrator can access qemu monitor console (XSA-19) * CVE-2012-4535: xen: Timer overflow DoS vulnerability (XSA 20) * CVE-2012-4536: xen: pirq range check DoS vulnerability (XSA 21) * CVE-2012-4537: xen: Memory mapping failure DoS vulnerability (XSA 22) * CVE-2012-4538: xen: Unhooking empty PAE entries DoS vulnerability (XSA 23) * CVE-2012-4539: xen: Grant table hypercall infinite loop DoS vulnerability (XSA 24) * CVE-2012-3497: xen: multiple TMEM hypercall vulnerabilities (XSA-15) Also the following bugs have been fixed and upstream patches have been applied: * bnc#784087 - L3: Xen BUG at io_apic.c:129 26102-x86-IOAPIC-legacy-not-first.patch * Upstream patches merged: 26054-x86-AMD-perf-ctr-init.patch 26055-x86-oprof-hvm-mode.patch 26056-page-alloc-flush-filter.patch 26061-x86-oprof-counter-range.patch 26062-ACPI-ERST-move-data.patch 26063-x86-HPET-affinity-lock.patch 26093-HVM-PoD-grant-mem-type.patch 25931-x86-domctl-iomem-mapping-checks.patch 25952-x86-MMIO-remap-permissions.patch 25808-domain_create-return-value.patch 25814-x86_64-set-debugreg-guest.patch 25815-x86-PoD-no-bug-in-non-translated.patch 25816-x86-hvm-map-pirq-range-check.patch 25833-32on64-bogus-pt_base-adjust.patch 25834-x86-S3-MSI-resume.patch 25835-adjust-rcu-lock-domain.patch 25836-VT-d-S3-MSI-resume.patch 25850-tmem-xsa-15-1.patch 25851-tmem-xsa-15-2.patch 25852-tmem-xsa-15-3.patch 25853-tmem-xsa-15-4.patch 25854-tmem-xsa-15-5.patch 25855-tmem-xsa-15-6.patch 25856-tmem-xsa-15-7.patch 25857-tmem-xsa-15-8.patch 25858-tmem-xsa-15-9.patch 25859-tmem-missing-break.patch 25860-tmem-cleanup.patch 25883-pt-MSI-cleanup.patch 25927-x86-domctl-ioport-mapping-range.patch 25929-tmem-restore-pool-version.patch * bnc#778105 - first XEN-PV VM fails to spawn xend: Increase wait time for disk to appear in host bootloader Modified existing xen-domUloader.diff 25752-ACPI-pm-op-valid-cpu.patch 25754-x86-PoD-early-access.patch 25755-x86-PoD-types.patch 25756-x86-MMIO-max-mapped-pfn.patch Security Issue references: * CVE-2012-4539 <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2012-4539 > * CVE-2012-3497 <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2012-3497 > * CVE-2012-4411 <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2012-4411 > * CVE-2012-4535 <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2012-4535 > * CVE-2012-4537 <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2012-4537 > * CVE-2012-4536 <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2012-4536 > * CVE-2012-4538 <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2012-4538 > * CVE-2012-4539 <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2012-4539 > * CVE-2012-4544 <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2012-4544 > Indications: Everyone using XEN should update. Special Instructions and Notes: Please reboot the system after installing this update. Patch Instructions: To install this SUSE Security Update use YaST online_update. Alternatively you can run the command listed for your product: - SUSE Linux Enterprise Software Development Kit 11 SP2: zypper in -t patch sdksp2-xen-201211-7018 - SUSE Linux Enterprise Server 11 SP2 for VMware: zypper in -t patch slessp2-xen-201211-7018 - SUSE Linux Enterprise Server 11 SP2: zypper in -t patch slessp2-xen-201211-7018 - SUSE Linux Enterprise Desktop 11 SP2: zypper in -t patch sledsp2-xen-201211-7018 To bring your system up-to-date, use "zypper patch". Package List: - SUSE Linux Enterprise Software Development Kit 11 SP2 (i586 x86_64): xen-devel-4.1.3_04-0.5.1 - SUSE Linux Enterprise Server 11 SP2 for VMware (i586 x86_64): xen-kmp-trace-4.1.3_04_3.0.42_0.7-0.5.1 - SUSE Linux Enterprise Server 11 SP2 (i586 x86_64): xen-kmp-default-4.1.3_04_3.0.42_0.7-0.5.1 xen-kmp-trace-4.1.3_04_3.0.42_0.7-0.5.1 xen-libs-4.1.3_04-0.5.1 xen-tools-domU-4.1.3_04-0.5.1 - SUSE Linux Enterprise Server 11 SP2 (x86_64): xen-4.1.3_04-0.5.1 xen-doc-html-4.1.3_04-0.5.1 xen-doc-pdf-4.1.3_04-0.5.1 xen-libs-32bit-4.1.3_04-0.5.1 xen-tools-4.1.3_04-0.5.1 - SUSE Linux Enterprise Server 11 SP2 (i586): xen-kmp-pae-4.1.3_04_3.0.42_0.7-0.5.1 - SUSE Linux Enterprise Desktop 11 SP2 (i586 x86_64): xen-kmp-default-4.1.3_04_3.0.42_0.7-0.5.1 xen-kmp-trace-4.1.3_04_3.0.42_0.7-0.5.1 xen-libs-4.1.3_04-0.5.1 xen-tools-domU-4.1.3_04-0.5.1 - SUSE Linux Enterprise Desktop 11 SP2 (x86_64): xen-4.1.3_04-0.5.1 xen-doc-html-4.1.3_04-0.5.1 xen-doc-pdf-4.1.3_04-0.5.1 xen-libs-32bit-4.1.3_04-0.5.1 xen-tools-4.1.3_04-0.5.1 - SUSE Linux Enterprise Desktop 11 SP2 (i586): xen-kmp-pae-4.1.3_04_3.0.42_0.7-0.5.1 References: http://support.novell.com/security/cve/CVE-2012-3497.html http://support.novell.com/security/cve/CVE-2012-4411.html http://support.novell.com/security/cve/CVE-2012-4535.html http://support.novell.com/security/cve/CVE-2012-4536.html http://support.novell.com/security/cve/CVE-2012-4537.html http://support.novell.com/security/cve/CVE-2012-4538.html http://support.novell.com/security/cve/CVE-2012-4539.html http://support.novell.com/security/cve/CVE-2012-4544.html https://bugzilla.novell.com/777890 https://bugzilla.novell.com/778105 https://bugzilla.novell.com/779212 https://bugzilla.novell.com/784087 https://bugzilla.novell.com/786516 https://bugzilla.novell.com/786517 https://bugzilla.novell.com/786518 https://bugzilla.novell.com/786519 https://bugzilla.novell.com/786520 https://bugzilla.novell.com/787163 http://download.novell.com/patch/finder/?keywords=8f87058beb7d6e2bf1940373a… -- To unsubscribe, e-mail: opensuse-security-announce+unsubscribe(a)opensuse.org For additional commands, e-mail: opensuse-security-announce+help(a)opensuse.org

1 0

[security-announce] SUSE-SU-2012:1485-1: important: Security update for flash-player
by opensuse-security＠opensuse.org 15 Nov '12

15 Nov '12

SUSE Security Update: Security update for flash-player ______________________________________________________________________________ Announcement ID: SUSE-SU-2012:1485-1 Rating: important References: #788450 Cross-References: CVE-2012-5274 CVE-2012-5275 CVE-2012-5276 CVE-2012-5277 CVE-2012-5278 CVE-2012-5279 CVE-2012-5280 Affected Products: SUSE Linux Enterprise Desktop 11 SP2 SUSE Linux Enterprise Desktop 10 SP4 ______________________________________________________________________________ An update that fixes 7 vulnerabilities is now available. It includes one version update. Description: This update of flash-player fixes multiple (unspecified) buffer overflows, memory corruptions and other security-related issues. Security Issue references: * CVE-2012-5274 <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2012-5274 > * CVE-2012-5275 <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2012-5275 > * CVE-2012-5276 <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2012-5276 > * CVE-2012-5277 <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2012-5277 > * CVE-2012-5278 <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2012-5278 > * CVE-2012-5279 <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2012-5279 > * CVE-2012-5280 <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2012-5280 > Patch Instructions: To install this SUSE Security Update use YaST online_update. Alternatively you can run the command listed for your product: - SUSE Linux Enterprise Desktop 11 SP2: zypper in -t patch sledsp2-flash-player-7038 To bring your system up-to-date, use "zypper patch". Package List: - SUSE Linux Enterprise Desktop 11 SP2 (i586 x86_64) [New Version: 11.2.202.251]: flash-player-11.2.202.251-0.3.1 - SUSE Linux Enterprise Desktop 10 SP4 (i586) [New Version: 11.2.202.251]: flash-player-11.2.202.251-0.5.1 References: http://support.novell.com/security/cve/CVE-2012-5274.html http://support.novell.com/security/cve/CVE-2012-5275.html http://support.novell.com/security/cve/CVE-2012-5276.html http://support.novell.com/security/cve/CVE-2012-5277.html http://support.novell.com/security/cve/CVE-2012-5278.html http://support.novell.com/security/cve/CVE-2012-5279.html http://support.novell.com/security/cve/CVE-2012-5280.html https://bugzilla.novell.com/788450 http://download.novell.com/patch/finder/?keywords=2704cd8e916c14e8d622e5409… http://download.novell.com/patch/finder/?keywords=8a2ea2251ceaffe0fb0d2fb28… -- To unsubscribe, e-mail: opensuse-security-announce+unsubscribe(a)opensuse.org For additional commands, e-mail: opensuse-security-announce+help(a)opensuse.org

1 0

[security-announce] openSUSE-SU-2012:1481-1: important: opera to 12.10
by opensuse-security＠opensuse.org 14 Nov '12

14 Nov '12

openSUSE Security Update: opera to 12.10 ______________________________________________________________________________ Announcement ID: openSUSE-SU-2012:1481-1 Rating: important References: #788321 Affected Products: openSUSE 12.2 openSUSE 12.1 ______________________________________________________________________________ An update that contains security fixes can now be installed. Description: This Opera 12.10 security update fixes following security issues: -an issue that could cause Opera not to correctly check for certificate revocation; -an issue where CORS requests could incorrectly retrieve contents of cross origin pages; -an issue where data URIs could be used to facilitate Cross-Site Scripting; -a high severity issue, as reported by Gareth Heyes; details will be disclosed at a later date -an issue where specially crafted SVG images could allow execution of arbitrary code; -a moderate severity issue, as reported by the Google Security Group; details will be disclosed at a later date Full changelog available at: http://www.opera.com/docs/changelogs/unix/1210 Patch Instructions: To install this openSUSE Security Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE 12.2: zypper in -t patch openSUSE-2012-777 - openSUSE 12.1: zypper in -t patch openSUSE-2012-777 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE 12.2 (i586 x86_64): opera-12.10-6.1 opera-gtk-12.10-6.1 opera-kde4-12.10-6.1 - openSUSE 12.1 (i586 x86_64): opera-12.10-26.1 opera-gtk-12.10-26.1 opera-kde4-12.10-26.1 References: https://bugzilla.novell.com/788321 -- To unsubscribe, e-mail: opensuse-security-announce+unsubscribe(a)opensuse.org For additional commands, e-mail: opensuse-security-announce+help(a)opensuse.org

1 0

[security-announce] openSUSE-SU-2012:1480-1: important: flash-player: Update to 11.2.202.251
by opensuse-security＠opensuse.org 14 Nov '12

14 Nov '12

openSUSE Security Update: flash-player: Update to 11.2.202.251 ______________________________________________________________________________ Announcement ID: openSUSE-SU-2012:1480-1 Rating: important References: #788450 Cross-References: CVE-2012-5274 CVE-2012-5275 CVE-2012-5276 CVE-2012-5277 CVE-2012-5278 CVE-2012-5279 CVE-2012-5280 Affected Products: openSUSE 12.1 ______________________________________________________________________________ An update that fixes 7 vulnerabilities is now available. Description: Flash Player was updated to 11.2.202.251 (bnc#788450), fixing severe security issues: * CVE-2012-5274, CVE-2012-5275, CVE-2012-5276, CVE-2012-5277, CVE-2012-5278, CVE-2012-5279, CVE-2012-5280 Patch Instructions: To install this openSUSE Security Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE 12.1: zypper in -t patch openSUSE-2012-776 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE 12.1 (i586 x86_64): flash-player-11.2.202.251-34.1 flash-player-gnome-11.2.202.251-34.1 flash-player-kde4-11.2.202.251-34.1 References: http://support.novell.com/security/cve/CVE-2012-5274.html http://support.novell.com/security/cve/CVE-2012-5275.html http://support.novell.com/security/cve/CVE-2012-5276.html http://support.novell.com/security/cve/CVE-2012-5277.html http://support.novell.com/security/cve/CVE-2012-5278.html http://support.novell.com/security/cve/CVE-2012-5279.html http://support.novell.com/security/cve/CVE-2012-5280.html https://bugzilla.novell.com/788450 -- To unsubscribe, e-mail: opensuse-security-announce+unsubscribe(a)opensuse.org For additional commands, e-mail: opensuse-security-announce+help(a)opensuse.org

1 0

[security-announce] openSUSE-SU-2012:1461-1: important: update for cgit
by opensuse-security＠opensuse.org 12 Nov '12

12 Nov '12

openSUSE Security Update: update for cgit ______________________________________________________________________________ Announcement ID: openSUSE-SU-2012:1461-1 Rating: important References: #787074 Cross-References: CVE-2012-4548 Affected Products: openSUSE 12.1 ______________________________________________________________________________ An update that fixes one vulnerability is now available. Description: Specially-crafted commits can cause code to be executed on the clients due to improperly quoted arguments. Patch Instructions: To install this openSUSE Security Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE 12.1: zypper in -t patch openSUSE-2012-765 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE 12.1 (i586 x86_64): cgit-0.9.0.2-9.4.1 cgit-debuginfo-0.9.0.2-9.4.1 cgit-debugsource-0.9.0.2-9.4.1 References: http://support.novell.com/security/cve/CVE-2012-4548.html https://bugzilla.novell.com/787074 -- To unsubscribe, e-mail: opensuse-security-announce+unsubscribe(a)opensuse.org For additional commands, e-mail: opensuse-security-announce+help(a)opensuse.org

1 0

[security-announce] openSUSE-SU-2012:1460-1: important: update for cgit
by opensuse-security＠opensuse.org 12 Nov '12

12 Nov '12

openSUSE Security Update: update for cgit ______________________________________________________________________________ Announcement ID: openSUSE-SU-2012:1460-1 Rating: important References: #787074 Cross-References: CVE-2012-4548 Affected Products: openSUSE 12.2 ______________________________________________________________________________ An update that fixes one vulnerability is now available. Description: Specially-crafted commits can cause code to be executed on the clients due to improperly quoted arguments. Patch Instructions: To install this openSUSE Security Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE 12.2: zypper in -t patch openSUSE-2012-764 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE 12.2 (i586 x86_64): cgit-0.9.0.2-14.4.1 cgit-debuginfo-0.9.0.2-14.4.1 cgit-debugsource-0.9.0.2-14.4.1 References: http://support.novell.com/security/cve/CVE-2012-4548.html https://bugzilla.novell.com/787074 -- To unsubscribe, e-mail: opensuse-security-announce+unsubscribe(a)opensuse.org For additional commands, e-mail: opensuse-security-announce+help(a)opensuse.org

1 0

[security-announce] SUSE-SU-2012:1455-1: important: Security update for openstack-glance
by opensuse-security＠opensuse.org 08 Nov '12

08 Nov '12

SUSE Security Update: Security update for openstack-glance ______________________________________________________________________________ Announcement ID: SUSE-SU-2012:1455-1 Rating: important References: #787814 Cross-References: CVE-2012-4573 Affected Products: SUSE Cloud 1.0 ______________________________________________________________________________ An update that fixes one vulnerability is now available. Description: OpenStack glance had a bug where image deletion was allowed for all logged in users (CVE-2012-4573). This has been fixed. Security Issue reference: * CVE-2012-4573 <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2012-4573 > Patch Instructions: To install this SUSE Security Update use YaST online_update. Alternatively you can run the command listed for your product: - SUSE Cloud 1.0: zypper in -t patch sleclo10sp2-openstack-glance-7033 To bring your system up-to-date, use "zypper patch". Package List: - SUSE Cloud 1.0 (x86_64): openstack-glance-2012.1+git.1344578005.120fcf4-0.7.1 python-glance-2012.1+git.1344578005.120fcf4-0.7.1 References: http://support.novell.com/security/cve/CVE-2012-4573.html https://bugzilla.novell.com/787814 http://download.novell.com/patch/finder/?keywords=702ffac90e6c557e86e585da9… -- To unsubscribe, e-mail: opensuse-security-announce+unsubscribe(a)opensuse.org For additional commands, e-mail: opensuse-security-announce+help(a)opensuse.org

1 0

[security-announce] openSUSE 11.4 has reached end of SUSE support - 11.4 Evergreen goes on
by Marcus Meissner 06 Nov '12

06 Nov '12

Hi, With the release of ruby on Monday 5th of November the SUSE sponsored maintenance of openSUSE 11.4 has ended. openSUSE 11.4 is now officially discontinued and out of support by SUSE. openSUSE 11.4 was the first openSUSE distribution maintained using OpenBuildService methods (known as "OBS Maintenance"), allowing full community participation. We also migrated it from the old internal SUSE method to the OBS method on the fly during the lifetime without any interruption. openSUSE 11.4 will be continued to be maintained by the Evergreen community team. Their wikipage is on http://en.opensuse.org/Evergreen , please check it out for more information. Here are some statistics: openSUSE 11.4 was released on March 4th 2011, making it 20 months of security and bugfix support. (2 openSUSE releases + 2 months) Some statistics on the released patches (compared to 11.3): Total updates: 723 (+142) Security: 416 (+58) Recommended: 306 (+85) Optional: 1 (-1) Quite some increase on updates, both security and bugfix wise. Some of this is due to the 2 months increased lifetime compared to openSUSE 11.3, some of this is due to a more open community bugfix involvement. CVE Entries: 1113 (-99) Top issues (compared to 11.3 for issues down to 5) 10 seamonkey (-4) 10 MozillaFirefox (-2) 9 php5 (+4) 9 MozillaThunderbird (-2) 8 flash-player (-4) 6 wireshark (+1) 6 opera (-4) 6 java-1_6_0-openjdk (-1) 6 bind ( 0) 5 openssl (-2) 5 libpng14 (new) 5 icedtea-web (new) And top issues sorted by CVE (Common Vulnerability Enumeration) count down to 10) (comparison to 11.3 for some ... but due to the OBS maintenance migration some CVEs are not easily accounted for) 139 MozillaThunderbird (+26) 139 MozillaFirefox (+28) 135 seamonkey (-3) 67 kernel (-61) 56 java-1_6_0-openjdk 44 flash-player (+38) 41 mozilla-nspr 30 mysql-community-server 29 php5 26 mozilla-kde4-integration 21 mariadb 21 freetype2 20 java-1_6_0-sun 18 wireshark 18 mozilla-xulrunner192 17 mysql-cluster 13 rubygem-actionpack-2_3 12 xen 11 rubygem-activerecord-2_3 10 rubygem-activesupport-2_3 10 puppet 10 libpng14

1 0

[security-announce] SUSE-SU-2012:1390-3: important: Security update for bind
by opensuse-security＠opensuse.org 05 Nov '12

05 Nov '12

SUSE Security Update: Security update for bind ______________________________________________________________________________ Announcement ID: SUSE-SU-2012:1390-3 Rating: important References: #784602 Cross-References: CVE-2012-5166 Affected Products: SUSE CORE 9 ______________________________________________________________________________ An update that fixes one vulnerability is now available. Description: Specially crafted RDATA could have caused the bind nameserver to lockup (CVE-2012-5166). This was a different flaw than CVE-2012-4244. Security Issue reference: * CVE-2012-5166 <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2012-5166 > Package List: - SUSE CORE 9 (i586 s390 s390x x86_64): bind-9.3.4-4.18 bind-devel-9.3.4-4.18 bind-utils-9.3.4-4.18 - SUSE CORE 9 (x86_64): bind-utils-32bit-9-201210261342 - SUSE CORE 9 (s390x): bind-utils-32bit-9-201210261352 References: http://support.novell.com/security/cve/CVE-2012-5166.html https://bugzilla.novell.com/784602 http://download.novell.com/patch/finder/?keywords=cc769094d1b8a281e47121ac0… -- To unsubscribe, e-mail: opensuse-security-announce+unsubscribe(a)opensuse.org For additional commands, e-mail: opensuse-security-announce+help(a)opensuse.org

1 0