December 2012 - openSUSE Security Announce

[security-announce] openSUSE-SU-2012:1687-1: important: xen to fix various denial of service issues
by opensuse-security＠opensuse.org 23 Dec '12

23 Dec '12

openSUSE Security Update: xen to fix various denial of service issues ______________________________________________________________________________ Announcement ID: openSUSE-SU-2012:1687-1 Rating: important References: #777628 #789940 #789944 #789945 #789948 #789950 #789951 #789988 #792476 Cross-References: CVE-2012-5510 CVE-2012-5511 CVE-2012-5512 CVE-2012-5513 CVE-2012-5514 CVE-2012-5515 Affected Products: openSUSE 12.1 ______________________________________________________________________________ An update that solves 6 vulnerabilities and has three fixes is now available. Description: XEN was updated to fix various denial of service issues. - bnc#789945 - CVE-2012-5510: xen: Grant table version switch list corruption vulnerability (XSA-26) - bnc#789944 - CVE-2012-5511: xen: Several HVM operations do not validate the range of their inputs (XSA-27) - bnc#789940 - CVE-2012-5512: xen: HVMOP_get_mem_access crash / HVMOP_set_mem_access information leak (XSA-28) - bnc#789951 - CVE-2012-5513: xen: XENMEM_exchange may overwrite hypervisor memory (XSA-29) - bnc#789948 - CVE-2012-5514: xen: Missing unlock in guest_physmap_mark_populate_on_demand() (XSA-30) - bnc#789950 - CVE-2012-5515: xen: Several memory hypercall operations allow invalid extent order values (XSA-31) - bnc#789988 - FATAL PAGE FAULT in hypervisor (arch_do_domctl) - Upstream patches from Jan 26132-tmem-save-NULL-check.patch 26134-x86-shadow-invlpg-check.patch 26148-vcpu-timer-overflow.patch (Replaces CVE-2012-4535-xsa20.patch) 26149-x86-p2m-physmap-error-path.patch (Replaces CVE-2012-4537-xsa22.patch) 26150-x86-shadow-unhook-toplevel-check.patch (Replaces CVE-2012-4538-xsa23.patch) - bnc#777628 - guest "disappears" after live migration Updated block-dmmd script - Fix exception in balloon.py and osdep.py xen-max-free-mem.diff - bnc#792476 - efi files missing in latest XEN update Revert c/s 25751 EFI Makefile changes in 23614-x86_64-EFI-boot.patch Patch Instructions: To install this openSUSE Security Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE 12.1: zypper in -t patch openSUSE-2012-869 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE 12.1 (i586 x86_64): xen-debugsource-4.1.3_06-1.25.1 xen-devel-4.1.3_06-1.25.1 xen-kmp-default-4.1.3_06_k3.1.10_1.16-1.25.1 xen-kmp-default-debuginfo-4.1.3_06_k3.1.10_1.16-1.25.1 xen-kmp-desktop-4.1.3_06_k3.1.10_1.16-1.25.1 xen-kmp-desktop-debuginfo-4.1.3_06_k3.1.10_1.16-1.25.1 xen-libs-4.1.3_06-1.25.1 xen-libs-debuginfo-4.1.3_06-1.25.1 xen-tools-domU-4.1.3_06-1.25.1 xen-tools-domU-debuginfo-4.1.3_06-1.25.1 - openSUSE 12.1 (x86_64): xen-4.1.3_06-1.25.1 xen-doc-html-4.1.3_06-1.25.1 xen-doc-pdf-4.1.3_06-1.25.1 xen-libs-32bit-4.1.3_06-1.25.1 xen-libs-debuginfo-32bit-4.1.3_06-1.25.1 xen-tools-4.1.3_06-1.25.1 xen-tools-debuginfo-4.1.3_06-1.25.1 - openSUSE 12.1 (ia64): xen-libs-debuginfo-x86-4.1.3_06-1.25.1 xen-libs-x86-4.1.3_06-1.25.1 - openSUSE 12.1 (i586): xen-kmp-pae-4.1.3_06_k3.1.10_1.16-1.25.1 xen-kmp-pae-debuginfo-4.1.3_06_k3.1.10_1.16-1.25.1 References: http://support.novell.com/security/cve/CVE-2012-5510.html http://support.novell.com/security/cve/CVE-2012-5511.html http://support.novell.com/security/cve/CVE-2012-5512.html http://support.novell.com/security/cve/CVE-2012-5513.html http://support.novell.com/security/cve/CVE-2012-5514.html http://support.novell.com/security/cve/CVE-2012-5515.html https://bugzilla.novell.com/777628 https://bugzilla.novell.com/789940 https://bugzilla.novell.com/789944 https://bugzilla.novell.com/789945 https://bugzilla.novell.com/789948 https://bugzilla.novell.com/789950 https://bugzilla.novell.com/789951 https://bugzilla.novell.com/789988 https://bugzilla.novell.com/792476 -- To unsubscribe, e-mail: opensuse-security-announce+unsubscribe(a)opensuse.org For additional commands, e-mail: opensuse-security-announce+help(a)opensuse.org

1 0

[security-announce] openSUSE-SU-2012:1685-1: important: xen to fix various denial of service issues
by opensuse-security＠opensuse.org 23 Dec '12

23 Dec '12

openSUSE Security Update: xen to fix various denial of service issues ______________________________________________________________________________ Announcement ID: openSUSE-SU-2012:1685-1 Rating: important References: #777628 #789940 #789944 #789945 #789948 #789950 #789951 #789988 #792476 Cross-References: CVE-2012-5510 CVE-2012-5511 CVE-2012-5512 CVE-2012-5513 CVE-2012-5514 CVE-2012-5515 Affected Products: openSUSE 12.2 ______________________________________________________________________________ An update that solves 6 vulnerabilities and has three fixes is now available. Description: This update of XEN fixes various denial of service bugs. - bnc#789945 - CVE-2012-5510: xen: Grant table version switch list corruption vulnerability (XSA-26) - bnc#789944 - CVE-2012-5511: xen: Several HVM operations do not validate the range of their inputs (XSA-27) - bnc#789940 - CVE-2012-5512: xen: HVMOP_get_mem_access crash / HVMOP_set_mem_access information leak (XSA-28) - bnc#789951 - CVE-2012-5513: xen: XENMEM_exchange may overwrite hypervisor memory (XSA-29) - bnc#789948 - CVE-2012-5514: xen: Missing unlock in guest_physmap_mark_populate_on_demand() (XSA-30) - bnc#789950 - CVE-2012-5515: xen: Several memory hypercall operations allow invalid extent order values (XSA-31) - bnc#789988 - FATAL PAGE FAULT in hypervisor (arch_do_domctl) 25931-x86-domctl-iomem-mapping-checks.patch - Upstream patches from Jan 26132-tmem-save-NULL-check.patch 26134-x86-shadow-invlpg-check.patch 26148-vcpu-timer-overflow.patch (Replaces CVE-2012-4535-xsa20.patch) 26149-x86-p2m-physmap-error-path.patch (Replaces CVE-2012-4537-xsa22.patch) 26150-x86-shadow-unhook-toplevel-check.patch (Replaces CVE-2012-4538-xsa23.patch) 26151-gnttab-compat-get-status-frames.patch (Replaces CVE-2012-4539-xsa24.patch) - bnc#777628 - guest "disappears" after live migration Updated block-dmmd script - Fix exception in balloon.py and osdep.py xen-max-free-mem.diff - bnc#792476 - efi files missing in latest XEN update Revert c/s 25751 EFI Makefile changes in 23614-x86_64-EFI-boot.patch Patch Instructions: To install this openSUSE Security Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE 12.2: zypper in -t patch openSUSE-2012-870 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE 12.2 (i586 x86_64): xen-debugsource-4.1.3_06-5.17.1 xen-devel-4.1.3_06-5.17.1 xen-kmp-default-4.1.3_06_k3.4.11_2.16-5.17.1 xen-kmp-default-debuginfo-4.1.3_06_k3.4.11_2.16-5.17.1 xen-kmp-desktop-4.1.3_06_k3.4.11_2.16-5.17.1 xen-kmp-desktop-debuginfo-4.1.3_06_k3.4.11_2.16-5.17.1 xen-libs-4.1.3_06-5.17.1 xen-libs-debuginfo-4.1.3_06-5.17.1 xen-tools-domU-4.1.3_06-5.17.1 xen-tools-domU-debuginfo-4.1.3_06-5.17.1 - openSUSE 12.2 (x86_64): xen-4.1.3_06-5.17.1 xen-doc-html-4.1.3_06-5.17.1 xen-doc-pdf-4.1.3_06-5.17.1 xen-libs-32bit-4.1.3_06-5.17.1 xen-libs-debuginfo-32bit-4.1.3_06-5.17.1 xen-tools-4.1.3_06-5.17.1 xen-tools-debuginfo-4.1.3_06-5.17.1 - openSUSE 12.2 (i586): xen-kmp-pae-4.1.3_06_k3.4.11_2.16-5.17.1 xen-kmp-pae-debuginfo-4.1.3_06_k3.4.11_2.16-5.17.1 References: http://support.novell.com/security/cve/CVE-2012-5510.html http://support.novell.com/security/cve/CVE-2012-5511.html http://support.novell.com/security/cve/CVE-2012-5512.html http://support.novell.com/security/cve/CVE-2012-5513.html http://support.novell.com/security/cve/CVE-2012-5514.html http://support.novell.com/security/cve/CVE-2012-5515.html https://bugzilla.novell.com/777628 https://bugzilla.novell.com/789940 https://bugzilla.novell.com/789944 https://bugzilla.novell.com/789945 https://bugzilla.novell.com/789948 https://bugzilla.novell.com/789950 https://bugzilla.novell.com/789951 https://bugzilla.novell.com/789988 https://bugzilla.novell.com/792476 -- To unsubscribe, e-mail: opensuse-security-announce+unsubscribe(a)opensuse.org For additional commands, e-mail: opensuse-security-announce+help(a)opensuse.org

1 0

[security-announce] SUSE-SU-2012:1652-1: important: Security update for bogofilter
by opensuse-security＠opensuse.org 17 Dec '12

17 Dec '12

SUSE Security Update: Security update for bogofilter ______________________________________________________________________________ Announcement ID: SUSE-SU-2012:1652-1 Rating: important References: #792939 Cross-References: CVE-2012-5468 Affected Products: SUSE Linux Enterprise Desktop 11 SP2 ______________________________________________________________________________ An update that fixes one vulnerability is now available. Description: A heap corruption in bogofilter's base64 decoding function, caused by incomplete multibyte characters, could have resulted in a Denial of Service (App. crash) or potentially allowed the execution of arbitrary code. This has been fixed. Security Issue reference: * CVE-2012-5468 <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2012-5468 > Patch Instructions: To install this SUSE Security Update use YaST online_update. Alternatively you can run the command listed for your product: - SUSE Linux Enterprise Desktop 11 SP2: zypper in -t patch sledsp2-bogofilter-7135 To bring your system up-to-date, use "zypper patch". Package List: - SUSE Linux Enterprise Desktop 11 SP2 (i586 x86_64): bogofilter-1.1.1-174.27.1 References: http://support.novell.com/security/cve/CVE-2012-5468.html https://bugzilla.novell.com/792939 http://download.novell.com/patch/finder/?keywords=68d7ea43f53e4df074e77ba0e… -- To unsubscribe, e-mail: opensuse-security-announce+unsubscribe(a)opensuse.org For additional commands, e-mail: opensuse-security-announce+help(a)opensuse.org

1 0

[security-announce] openSUSE-SU-2012:1650-1: important: update for bogofilter
by opensuse-security＠opensuse.org 17 Dec '12

17 Dec '12

openSUSE Security Update: update for bogofilter ______________________________________________________________________________ Announcement ID: openSUSE-SU-2012:1650-1 Rating: important References: #792939 Cross-References: CVE-2010-2494 Affected Products: openSUSE 12.2 ______________________________________________________________________________ An update that fixes one vulnerability is now available. Description: This version upgrade of bogofilter fixed a heap corruption in the base 64 decoding routine as well as several other non-security issues. Patch Instructions: To install this openSUSE Security Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE 12.2: zypper in -t patch openSUSE-2012-852 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE 12.2 (i586 x86_64): bogofilter-1.2.3-17.4.1 bogofilter-debuginfo-1.2.3-17.4.1 bogofilter-debugsource-1.2.3-17.4.1 References: http://support.novell.com/security/cve/CVE-2010-2494.html https://bugzilla.novell.com/792939 -- To unsubscribe, e-mail: opensuse-security-announce+unsubscribe(a)opensuse.org For additional commands, e-mail: opensuse-security-announce+help(a)opensuse.org

1 0

[security-announce] openSUSE-SU-2012:1648-1: important: update for bogofilter
by opensuse-security＠opensuse.org 17 Dec '12

17 Dec '12

openSUSE Security Update: update for bogofilter ______________________________________________________________________________ Announcement ID: openSUSE-SU-2012:1648-1 Rating: important References: #792939 Cross-References: CVE-2010-2494 Affected Products: openSUSE 12.1 ______________________________________________________________________________ An update that fixes one vulnerability is now available. Description: This version upgrade of bogofilter fixed a heap corruption in the base 64 decoding routine as well as several other non-security issues. Patch Instructions: To install this openSUSE Security Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE 12.1: zypper in -t patch openSUSE-2012-851 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE 12.1 (i586 x86_64): bogofilter-1.2.3-13.4.1 bogofilter-debuginfo-1.2.3-13.4.1 bogofilter-debugsource-1.2.3-13.4.1 References: http://support.novell.com/security/cve/CVE-2010-2494.html https://bugzilla.novell.com/792939 -- To unsubscribe, e-mail: opensuse-security-announce+unsubscribe(a)opensuse.org For additional commands, e-mail: opensuse-security-announce+help(a)opensuse.org

1 0

[security-announce] openSUSE-SU-2012:1647-1: important: libxml2: fixed buffer overflow during decoding entities
by opensuse-security＠opensuse.org 17 Dec '12

17 Dec '12

openSUSE Security Update: libxml2: fixed buffer overflow during decoding entities ______________________________________________________________________________ Announcement ID: openSUSE-SU-2012:1647-1 Rating: important References: #793334 Cross-References: CVE-2012-5134 Affected Products: openSUSE 12.2 openSUSE 12.1 ______________________________________________________________________________ An update that fixes one vulnerability is now available. Description: A Heap-based buffer underflow in the xmlParseAttValueComplex function in parser.c in libxml2 allowed remote attackers to cause a denial of service or possibly execute arbitrary code via crafted entities in an XML document. Patch Instructions: To install this openSUSE Security Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE 12.2: zypper in -t patch openSUSE-2012-854 - openSUSE 12.1: zypper in -t patch openSUSE-2012-854 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE 12.2 (i586 x86_64): libxml2-2-2.7.8+git20120223-8.9.1 libxml2-2-debuginfo-2.7.8+git20120223-8.9.1 libxml2-debugsource-2.7.8+git20120223-8.9.1 libxml2-devel-2.7.8+git20120223-8.9.1 libxml2-tools-2.7.8+git20120223-8.9.1 libxml2-tools-debuginfo-2.7.8+git20120223-8.9.1 python-libxml2-2.7.8+git20120223-8.9.1 python-libxml2-debuginfo-2.7.8+git20120223-8.9.1 python-libxml2-debugsource-2.7.8+git20120223-8.9.1 - openSUSE 12.2 (x86_64): libxml2-2-32bit-2.7.8+git20120223-8.9.1 libxml2-2-debuginfo-32bit-2.7.8+git20120223-8.9.1 libxml2-devel-32bit-2.7.8+git20120223-8.9.1 - openSUSE 12.2 (noarch): libxml2-doc-2.7.8+git20120223-8.9.1 - openSUSE 12.1 (i586 x86_64): libxml2-2.7.8+git20110708-3.15.1 libxml2-debuginfo-2.7.8+git20110708-3.15.1 libxml2-debugsource-2.7.8+git20110708-3.15.1 libxml2-devel-2.7.8+git20110708-3.15.1 - openSUSE 12.1 (x86_64): libxml2-32bit-2.7.8+git20110708-3.15.1 libxml2-debuginfo-32bit-2.7.8+git20110708-3.15.1 libxml2-devel-32bit-2.7.8+git20110708-3.15.1 - openSUSE 12.1 (noarch): libxml2-doc-2.7.8+git20110708-3.15.1 - openSUSE 12.1 (ia64): libxml2-debuginfo-x86-2.7.8+git20110708-3.15.1 libxml2-x86-2.7.8+git20110708-3.15.1 References: http://support.novell.com/security/cve/CVE-2012-5134.html https://bugzilla.novell.com/793334 -- To unsubscribe, e-mail: opensuse-security-announce+unsubscribe(a)opensuse.org For additional commands, e-mail: opensuse-security-announce+help(a)opensuse.org

1 0

[security-announce] SUSE-SU-2012:1645-1: critical: Security update for flash-player
by opensuse-security＠opensuse.org 14 Dec '12

14 Dec '12

SUSE Security Update: Security update for flash-player ______________________________________________________________________________ Announcement ID: SUSE-SU-2012:1645-1 Rating: critical References: #794062 Cross-References: CVE-2012-5676 CVE-2012-5677 CVE-2012-5678 Affected Products: SUSE Linux Enterprise Desktop 11 SP2 SUSE Linux Enterprise Desktop 10 SP4 ______________________________________________________________________________ An update that fixes three vulnerabilities is now available. It includes one version update. Description: This version upgrade of flash-player fixes multiple unspecified code execution vulnerabilities. Security Issue references: * CVE-2012-5676 <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2012-5676 > * CVE-2012-5677 <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2012-5677 > * CVE-2012-5678 <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2012-5678 > Patch Instructions: To install this SUSE Security Update use YaST online_update. Alternatively you can run the command listed for your product: - SUSE Linux Enterprise Desktop 11 SP2: zypper in -t patch sledsp2-flash-player-7150 To bring your system up-to-date, use "zypper patch". Package List: - SUSE Linux Enterprise Desktop 11 SP2 (i586 x86_64) [New Version: 11.2.202.258]: flash-player-11.2.202.258-0.3.1 - SUSE Linux Enterprise Desktop 10 SP4 (i586) [New Version: 11.2.202.258]: flash-player-11.2.202.258-0.5.1 References: http://support.novell.com/security/cve/CVE-2012-5676.html http://support.novell.com/security/cve/CVE-2012-5677.html http://support.novell.com/security/cve/CVE-2012-5678.html https://bugzilla.novell.com/794062 http://download.novell.com/patch/finder/?keywords=0900ec4427a20de14e991485c… http://download.novell.com/patch/finder/?keywords=b7ac6ecdf7451e0c0240a0c45… -- To unsubscribe, e-mail: opensuse-security-announce+unsubscribe(a)opensuse.org For additional commands, e-mail: opensuse-security-announce+help(a)opensuse.org

1 0

[security-announce] openSUSE-SU-2012:1643-1: critical: update for flash-player
by opensuse-security＠opensuse.org 14 Dec '12

14 Dec '12

openSUSE Security Update: update for flash-player ______________________________________________________________________________ Announcement ID: openSUSE-SU-2012:1643-1 Rating: critical References: #794062 Cross-References: CVE-2012-5676 CVE-2012-5677 CVE-2012-5678 Affected Products: openSUSE 12.1 ______________________________________________________________________________ An update that fixes three vulnerabilities is now available. Description: This version upgrade of flash-player fixed multiple unspecified code execution vulnerabiliies. Patch Instructions: To install this openSUSE Security Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE 12.1: zypper in -t patch openSUSE-2012-850 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE 12.1 (i586 x86_64): flash-player-11.2.202.258-38.1 flash-player-gnome-11.2.202.258-38.1 flash-player-kde4-11.2.202.258-38.1 References: http://support.novell.com/security/cve/CVE-2012-5676.html http://support.novell.com/security/cve/CVE-2012-5677.html http://support.novell.com/security/cve/CVE-2012-5678.html https://bugzilla.novell.com/794062 -- To unsubscribe, e-mail: opensuse-security-announce+unsubscribe(a)opensuse.org For additional commands, e-mail: opensuse-security-announce+help(a)opensuse.org

1 0

[security-announce] openSUSE-SU-2012:1637-1: important: Chromium to 25.0.1343
by opensuse-security＠opensuse.org 12 Dec '12

12 Dec '12

openSUSE Security Update: Chromium to 25.0.1343 ______________________________________________________________________________ Announcement ID: openSUSE-SU-2012:1637-1 Rating: important References: #791234 #792154 Cross-References: CVE-2012-5130 CVE-2012-5131 CVE-2012-5132 CVE-2012-5133 CVE-2012-5134 CVE-2012-5135 CVE-2012-5136 CVE-2012-5137 CVE-2012-5138 Affected Products: openSUSE 12.2 openSUSE 12.1 ______________________________________________________________________________ An update that fixes 9 vulnerabilities is now available. Description: Chromium was updated to 25.0.1343 * Security Fixes (bnc#791234 and bnc#792154): - CVE-2012-5131: Corrupt rendering in the Apple OSX driver for Intel GPUs - CVE-2012-5133: Use-after-free in SVG filters. - CVE-2012-5130: Out-of-bounds read in Skia - CVE-2012-5132: Browser crash with chunked encoding - CVE-2012-5134: Buffer underflow in libxml. - CVE-2012-5135: Use-after-free with printing. - CVE-2012-5136: Bad cast in input element handling. - CVE-2012-5138: Incorrect file path handling - CVE-2012-5137: Use-after-free in media source handling - Correct build so that proprietary codecs can be used when the chromium-ffmpeg package is installed - Update to 25.0.1335 * {gtk} Fixed <input> selection renders white text on white background in apps. (Issue: 158422) * Fixed translate infobar button to show selected language. (Issue: 155350) * Fixed broken Arabic language. (Issue: 158978) * Fixed pre-rendering if the preference is disabled at start up. (Issue: 159393) * Fixed JavaScript rendering issue. (Issue: 159655) * No further indications in the ChangeLog * Updated V8 - 3.14.5.0 * Bookmarks are now searched by their title while typing into the omnibox with matching bookmarks being shown in the autocomplete suggestions pop-down list. Matching is done by prefix. * Fixed chromium issues 155871, 154173, 155133. - Removed patch chomium-ffmpeg-no-pkgconfig.patch - Building now internal libffmpegsumo.so based on the standard chromium ffmpeg codecs - Add a configuration file (/etc/default/chromium) where we can indicate flags for the chromium-browser. - add explicit buildrequire on libbz2-devel Patch Instructions: To install this openSUSE Security Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE 12.2: zypper in -t patch openSUSE-2012-845 - openSUSE 12.1: zypper in -t patch openSUSE-2012-845 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE 12.2 (i586 x86_64): chromedriver-25.0.1343.0-1.23.1 chromedriver-debuginfo-25.0.1343.0-1.23.1 chromium-25.0.1343.0-1.23.1 chromium-debuginfo-25.0.1343.0-1.23.1 chromium-debugsource-25.0.1343.0-1.23.1 chromium-desktop-gnome-25.0.1343.0-1.23.1 chromium-desktop-kde-25.0.1343.0-1.23.1 chromium-ffmpegsumo-25.0.1343.0-1.23.1 chromium-ffmpegsumo-debuginfo-25.0.1343.0-1.23.1 chromium-suid-helper-25.0.1343.0-1.23.1 chromium-suid-helper-debuginfo-25.0.1343.0-1.23.1 - openSUSE 12.1 (i586 x86_64): chromedriver-25.0.1343.0-1.43.1 chromedriver-debuginfo-25.0.1343.0-1.43.1 chromium-25.0.1343.0-1.43.1 chromium-debuginfo-25.0.1343.0-1.43.1 chromium-debugsource-25.0.1343.0-1.43.1 chromium-desktop-gnome-25.0.1343.0-1.43.1 chromium-desktop-kde-25.0.1343.0-1.43.1 chromium-ffmpegsumo-25.0.1343.0-1.43.1 chromium-ffmpegsumo-debuginfo-25.0.1343.0-1.43.1 chromium-suid-helper-25.0.1343.0-1.43.1 chromium-suid-helper-debuginfo-25.0.1343.0-1.43.1 References: http://support.novell.com/security/cve/CVE-2012-5130.html http://support.novell.com/security/cve/CVE-2012-5131.html http://support.novell.com/security/cve/CVE-2012-5132.html http://support.novell.com/security/cve/CVE-2012-5133.html http://support.novell.com/security/cve/CVE-2012-5134.html http://support.novell.com/security/cve/CVE-2012-5135.html http://support.novell.com/security/cve/CVE-2012-5136.html http://support.novell.com/security/cve/CVE-2012-5137.html http://support.novell.com/security/cve/CVE-2012-5138.html https://bugzilla.novell.com/791234 https://bugzilla.novell.com/792154 -- To unsubscribe, e-mail: opensuse-security-announce+unsubscribe(a)opensuse.org For additional commands, e-mail: opensuse-security-announce+help(a)opensuse.org

1 0

[security-announce] SUSE-SU-2012:1636-1: important: Security update for libxml2
by opensuse-security＠opensuse.org 12 Dec '12

12 Dec '12

SUSE Security Update: Security update for libxml2 ______________________________________________________________________________ Announcement ID: SUSE-SU-2012:1636-1 Rating: important References: #793334 Cross-References: CVE-2012-5134 Affected Products: SUSE Linux Enterprise Software Development Kit 11 SP2 SUSE Linux Enterprise Server 11 SP2 for VMware SUSE Linux Enterprise Server 11 SP2 SUSE Linux Enterprise Server 10 SP4 SUSE Linux Enterprise Desktop 11 SP2 SUSE Linux Enterprise Desktop 10 SP4 SLE SDK 10 SP4 ______________________________________________________________________________ An update that fixes one vulnerability is now available. Description: A heap-based buffer underflow in the entity decoding of libxml2 could have caused a Denial of Service or potentially allowed the execution of arbitrary code. This has been fixed. Security Issue reference: * CVE-2012-5134 <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2012-5134 > Patch Instructions: To install this SUSE Security Update use YaST online_update. Alternatively you can run the command listed for your product: - SUSE Linux Enterprise Software Development Kit 11 SP2: zypper in -t patch sdksp2-libxml2-7140 - SUSE Linux Enterprise Server 11 SP2 for VMware: zypper in -t patch slessp2-libxml2-7140 - SUSE Linux Enterprise Server 11 SP2: zypper in -t patch slessp2-libxml2-7140 - SUSE Linux Enterprise Desktop 11 SP2: zypper in -t patch sledsp2-libxml2-7140 To bring your system up-to-date, use "zypper patch". Package List: - SUSE Linux Enterprise Software Development Kit 11 SP2 (i586 ia64 ppc64 s390x x86_64): libxml2-devel-2.7.6-0.21.1 - SUSE Linux Enterprise Software Development Kit 11 SP2 (ppc64 s390x x86_64): libxml2-devel-32bit-2.7.6-0.21.1 - SUSE Linux Enterprise Server 11 SP2 for VMware (i586 x86_64): libxml2-2.7.6-0.21.1 libxml2-doc-2.7.6-0.21.1 libxml2-python-2.7.6-0.21.1 - SUSE Linux Enterprise Server 11 SP2 for VMware (x86_64): libxml2-32bit-2.7.6-0.21.1 - SUSE Linux Enterprise Server 11 SP2 (i586 ia64 ppc64 s390x x86_64): libxml2-2.7.6-0.21.1 libxml2-doc-2.7.6-0.21.1 libxml2-python-2.7.6-0.21.1 - SUSE Linux Enterprise Server 11 SP2 (ppc64 s390x x86_64): libxml2-32bit-2.7.6-0.21.1 - SUSE Linux Enterprise Server 11 SP2 (ia64): libxml2-x86-2.7.6-0.21.1 - SUSE Linux Enterprise Server 10 SP4 (i586 ia64 ppc s390x x86_64): libxml2-2.6.23-15.35.1 libxml2-devel-2.6.23-15.35.1 libxml2-python-2.6.23-15.35.1 - SUSE Linux Enterprise Server 10 SP4 (s390x x86_64): libxml2-32bit-2.6.23-15.35.1 libxml2-devel-32bit-2.6.23-15.35.1 - SUSE Linux Enterprise Server 10 SP4 (ia64): libxml2-x86-2.6.23-15.35.1 - SUSE Linux Enterprise Server 10 SP4 (ppc): libxml2-64bit-2.6.23-15.35.1 libxml2-devel-64bit-2.6.23-15.35.1 - SUSE Linux Enterprise Desktop 11 SP2 (i586 x86_64): libxml2-2.7.6-0.21.1 libxml2-python-2.7.6-0.21.1 - SUSE Linux Enterprise Desktop 11 SP2 (x86_64): libxml2-32bit-2.7.6-0.21.1 - SUSE Linux Enterprise Desktop 10 SP4 (i586 x86_64): libxml2-2.6.23-15.35.1 libxml2-devel-2.6.23-15.35.1 libxml2-python-2.6.23-15.35.1 - SUSE Linux Enterprise Desktop 10 SP4 (x86_64): libxml2-32bit-2.6.23-15.35.1 libxml2-devel-32bit-2.6.23-15.35.1 - SLE SDK 10 SP4 (i586 ia64 ppc s390x x86_64): libxml2-test-2.6.23-15.35.1 References: http://support.novell.com/security/cve/CVE-2012-5134.html https://bugzilla.novell.com/793334 http://download.novell.com/patch/finder/?keywords=109525a062f4923fd62bd1c1a… http://download.novell.com/patch/finder/?keywords=b31152ce7358e67eddba6c88c… -- To unsubscribe, e-mail: opensuse-security-announce+unsubscribe(a)opensuse.org For additional commands, e-mail: opensuse-security-announce+help(a)opensuse.org

1 0

[security-announce] openSUSE-SU-2012:1620-1: important: update for libssh
by opensuse-security＠opensuse.org 07 Dec '12

07 Dec '12

openSUSE Security Update: update for libssh ______________________________________________________________________________ Announcement ID: openSUSE-SU-2012:1620-1 Rating: important References: #789827 Cross-References: CVE-2012-4559 CVE-2012-4560 CVE-2012-4561 CVE-2012-4562 Affected Products: openSUSE 12.2 ______________________________________________________________________________ An update that fixes four vulnerabilities is now available. Description: This update of libssh fixed various memory management issues that could have security implications (Code execution, Denial of Service). Patch Instructions: To install this openSUSE Security Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE 12.2: zypper in -t patch openSUSE-2012-840 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE 12.2 (i586 x86_64): libssh-debugsource-0.5.2-2.4.1 libssh-devel-0.5.2-2.4.1 libssh-devel-doc-0.5.2-2.4.1 libssh4-0.5.2-2.4.1 libssh4-debuginfo-0.5.2-2.4.1 References: http://support.novell.com/security/cve/CVE-2012-4559.html http://support.novell.com/security/cve/CVE-2012-4560.html http://support.novell.com/security/cve/CVE-2012-4561.html http://support.novell.com/security/cve/CVE-2012-4562.html https://bugzilla.novell.com/789827 -- To unsubscribe, e-mail: opensuse-security-announce+unsubscribe(a)opensuse.org For additional commands, e-mail: opensuse-security-announce+help(a)opensuse.org

1 0

[security-announce] SUSE-SU-2012:1615-1: important: Security update for Xen
by opensuse-security＠opensuse.org 06 Dec '12

06 Dec '12

SUSE Security Update: Security update for Xen ______________________________________________________________________________ Announcement ID: SUSE-SU-2012:1615-1 Rating: important References: #777628 #789940 #789944 #789945 #789948 #789950 #789951 #789988 #792476 Cross-References: CVE-2012-5510 CVE-2012-5511 CVE-2012-5512 CVE-2012-5513 CVE-2012-5514 CVE-2012-5515 Affected Products: SUSE Linux Enterprise Software Development Kit 11 SP2 SUSE Linux Enterprise Server 11 SP2 for VMware SUSE Linux Enterprise Server 11 SP2 SUSE Linux Enterprise Desktop 11 SP2 ______________________________________________________________________________ An update that solves 6 vulnerabilities and has three fixes is now available. Description: This update fixes the following security issues in xen: * CVE-2012-5510: Grant table version switch list corruption vulnerability (XSA-26) * CVE-2012-5511: Several HVM operations do not validate the range of their inputs (XSA-27) * CVE-2012-5512: HVMOP_get_mem_access crash / HVMOP_set_mem_access information leak (XSA-28) * CVE-2012-5513: XENMEM_exchange may overwrite hypervisor memory (XSA-29) * CVE-2012-5514: Missing unlock in guest_physmap_mark_populate_on_demand() (XSA-30) * CVE-2012-5515: Several memory hypercall operations allow invalid extent order values (XSA-31) Also the following bugs have been fixed and upstream patches have been applied: * FATAL PAGE FAULT in hypervisor (arch_do_domctl) * 25931-x86-domctl-iomem-mapping-checks.patch * 26132-tmem-save-NULL-check.patch * 26134-x86-shadow-invlpg-check.patch * 26148-vcpu-timer-overflow.patch (Replaces CVE-2012-4535-xsa20.patch) * 26149-x86-p2m-physmap-error-path.patch (Replaces CVE-2012-4537-xsa22.patch) * 26150-x86-shadow-unhook-toplevel-check.patch (Replaces CVE-2012-4538-xsa23.patch) * 26151-gnttab-compat-get-status-frames.patch (Replaces CVE-2012-4539-xsa24.patch) * bnc#792476 - efi files missing in latest XEN update Security Issue references: * CVE-2012-5512 <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2012-5512 > * CVE-2012-5513 <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2012-5513 > * CVE-2012-5514 <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2012-5514 > * CVE-2012-5511 <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2012-5511 > * CVE-2012-5510 <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2012-5510 > * CVE-2012-5515 <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2012-5515 > Patch Instructions: To install this SUSE Security Update use YaST online_update. Alternatively you can run the command listed for your product: - SUSE Linux Enterprise Software Development Kit 11 SP2: zypper in -t patch sdksp2-xen-7133 - SUSE Linux Enterprise Server 11 SP2 for VMware: zypper in -t patch slessp2-xen-7133 - SUSE Linux Enterprise Server 11 SP2: zypper in -t patch slessp2-xen-7133 - SUSE Linux Enterprise Desktop 11 SP2: zypper in -t patch sledsp2-xen-7133 To bring your system up-to-date, use "zypper patch". Package List: - SUSE Linux Enterprise Software Development Kit 11 SP2 (x86_64): xen-devel-4.1.3_06-0.7.1 - SUSE Linux Enterprise Server 11 SP2 for VMware (x86_64): xen-kmp-trace-4.1.3_06_3.0.51_0.7.9-0.7.1 - SUSE Linux Enterprise Server 11 SP2 (x86_64): xen-4.1.3_06-0.7.1 xen-doc-html-4.1.3_06-0.7.1 xen-doc-pdf-4.1.3_06-0.7.1 xen-kmp-default-4.1.3_06_3.0.51_0.7.9-0.7.1 xen-kmp-trace-4.1.3_06_3.0.51_0.7.9-0.7.1 xen-libs-32bit-4.1.3_06-0.7.1 xen-libs-4.1.3_06-0.7.1 xen-tools-4.1.3_06-0.7.1 xen-tools-domU-4.1.3_06-0.7.1 - SUSE Linux Enterprise Desktop 11 SP2 (x86_64): xen-4.1.3_06-0.7.1 xen-doc-html-4.1.3_06-0.7.1 xen-doc-pdf-4.1.3_06-0.7.1 xen-kmp-default-4.1.3_06_3.0.51_0.7.9-0.7.1 xen-kmp-trace-4.1.3_06_3.0.51_0.7.9-0.7.1 xen-libs-32bit-4.1.3_06-0.7.1 xen-libs-4.1.3_06-0.7.1 xen-tools-4.1.3_06-0.7.1 xen-tools-domU-4.1.3_06-0.7.1 References: http://support.novell.com/security/cve/CVE-2012-5510.html http://support.novell.com/security/cve/CVE-2012-5511.html http://support.novell.com/security/cve/CVE-2012-5512.html http://support.novell.com/security/cve/CVE-2012-5513.html http://support.novell.com/security/cve/CVE-2012-5514.html http://support.novell.com/security/cve/CVE-2012-5515.html https://bugzilla.novell.com/777628 https://bugzilla.novell.com/789940 https://bugzilla.novell.com/789944 https://bugzilla.novell.com/789945 https://bugzilla.novell.com/789948 https://bugzilla.novell.com/789950 https://bugzilla.novell.com/789951 https://bugzilla.novell.com/789988 https://bugzilla.novell.com/792476 http://download.novell.com/patch/finder/?keywords=d862e18d5680d7561000adc9e… -- To unsubscribe, e-mail: opensuse-security-announce+unsubscribe(a)opensuse.org For additional commands, e-mail: opensuse-security-announce+help(a)opensuse.org

1 0

[security-announce] SUSE-SU-2012:1606-1: important: Security update for Xen
by opensuse-security＠opensuse.org 04 Dec '12

04 Dec '12

SUSE Security Update: Security update for Xen ______________________________________________________________________________ Announcement ID: SUSE-SU-2012:1606-1 Rating: important References: #789950 #789951 Cross-References: CVE-2012-5513 CVE-2012-5515 Affected Products: SUSE Linux Enterprise Server 10 SP4 SUSE Linux Enterprise Desktop 10 SP4 SLE SDK 10 SP4 ______________________________________________________________________________ An update that fixes two vulnerabilities is now available. Description: This update fixes the following security issues in xen: * CVE-2012-5513: XENMEM_exchange may overwrite hypervisor memory (XSA-29) * CVE-2012-5515: Several memory hypercall operations allow invalid extent order values (XSA-31) Also the following bugs have been fixed and upstream patches have been applied: 26134-x86-shadow-invlpg-check.patch Security Issue references: * CVE-2012-5513 <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2012-5513 > * CVE-2012-5515 <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2012-5515 > Special Instructions and Notes: Please reboot the system after installing this update. Package List: - SUSE Linux Enterprise Server 10 SP4 (i586 x86_64): xen-3.2.3_17040_44-0.7.1 xen-devel-3.2.3_17040_44-0.7.1 xen-doc-html-3.2.3_17040_44-0.7.1 xen-doc-pdf-3.2.3_17040_44-0.7.1 xen-doc-ps-3.2.3_17040_44-0.7.1 xen-kmp-debug-3.2.3_17040_44_2.6.16.60_0.99.13-0.7.1 xen-kmp-default-3.2.3_17040_44_2.6.16.60_0.99.13-0.7.1 xen-kmp-kdump-3.2.3_17040_44_2.6.16.60_0.99.13-0.7.1 xen-kmp-smp-3.2.3_17040_44_2.6.16.60_0.99.13-0.7.1 xen-libs-3.2.3_17040_44-0.7.1 xen-tools-3.2.3_17040_44-0.7.1 xen-tools-domU-3.2.3_17040_44-0.7.1 xen-tools-ioemu-3.2.3_17040_44-0.7.1 - SUSE Linux Enterprise Server 10 SP4 (x86_64): xen-libs-32bit-3.2.3_17040_44-0.7.1 - SUSE Linux Enterprise Server 10 SP4 (i586): xen-kmp-bigsmp-3.2.3_17040_44_2.6.16.60_0.99.13-0.7.1 xen-kmp-kdumppae-3.2.3_17040_44_2.6.16.60_0.99.13-0.7.1 xen-kmp-vmi-3.2.3_17040_44_2.6.16.60_0.99.13-0.7.1 xen-kmp-vmipae-3.2.3_17040_44_2.6.16.60_0.99.13-0.7.1 - SUSE Linux Enterprise Desktop 10 SP4 (i586 x86_64): xen-3.2.3_17040_44-0.7.1 xen-devel-3.2.3_17040_44-0.7.1 xen-doc-html-3.2.3_17040_44-0.7.1 xen-doc-pdf-3.2.3_17040_44-0.7.1 xen-doc-ps-3.2.3_17040_44-0.7.1 xen-kmp-default-3.2.3_17040_44_2.6.16.60_0.99.13-0.7.1 xen-kmp-smp-3.2.3_17040_44_2.6.16.60_0.99.13-0.7.1 xen-libs-3.2.3_17040_44-0.7.1 xen-tools-3.2.3_17040_44-0.7.1 xen-tools-domU-3.2.3_17040_44-0.7.1 xen-tools-ioemu-3.2.3_17040_44-0.7.1 - SUSE Linux Enterprise Desktop 10 SP4 (x86_64): xen-libs-32bit-3.2.3_17040_44-0.7.1 - SUSE Linux Enterprise Desktop 10 SP4 (i586): xen-kmp-bigsmp-3.2.3_17040_44_2.6.16.60_0.99.13-0.7.1 - SLE SDK 10 SP4 (i586 x86_64): xen-3.2.3_17040_44-0.7.1 xen-devel-3.2.3_17040_44-0.7.1 xen-kmp-debug-3.2.3_17040_44_2.6.16.60_0.99.13-0.7.1 xen-kmp-kdump-3.2.3_17040_44_2.6.16.60_0.99.13-0.7.1 xen-libs-3.2.3_17040_44-0.7.1 xen-tools-3.2.3_17040_44-0.7.1 xen-tools-ioemu-3.2.3_17040_44-0.7.1 - SLE SDK 10 SP4 (x86_64): xen-libs-32bit-3.2.3_17040_44-0.7.1 References: http://support.novell.com/security/cve/CVE-2012-5513.html http://support.novell.com/security/cve/CVE-2012-5515.html https://bugzilla.novell.com/789950 https://bugzilla.novell.com/789951 http://download.novell.com/patch/finder/?keywords=193b206adfdaf6da1ce1c5ced… -- To unsubscribe, e-mail: opensuse-security-announce+unsubscribe(a)opensuse.org For additional commands, e-mail: opensuse-security-announce+help(a)opensuse.org

1 0