March 2012 - openSUSE Security Announce

[security-announce] SUSE-SU-2012:0337-1: critical: Security update for Samba
by opensuse-security＠opensuse.org 08 Mar '12

08 Mar '12

SUSE Security Update: Security update for Samba ______________________________________________________________________________ Announcement ID: SUSE-SU-2012:0337-1 Rating: critical References: #633729 #703655 #747934 Cross-References: CVE-2012-0870 Affected Products: SUSE Linux Enterprise Server 10 SP4 SUSE Linux Enterprise Server 10 SP3 LTSS SUSE Linux Enterprise Desktop 10 SP4 SLE SDK 10 SP4 ______________________________________________________________________________ An update that solves one vulnerability and has two fixes is now available. Description: This update of Samba fixes a heap-based buffer overflow that could be exploited by remote, unauthenticated attackers to crash the smbd daemon or potentially execute arbitrary code via specially crafted SMB AndX request packets (CVE-2012-0870). Also fixed two non security bugs: * Fix to handle domain join using NetBIOS name; (bnc #633729). * Fixed the DFS referral response for msdfs root; (bnc#703655). Security Issue reference: * CVE-2012-0870 <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2012-0870 > Package List: - SUSE Linux Enterprise Server 10 SP4 (i586 ia64 ppc s390x x86_64): cifs-mount-3.0.36-0.13.18.1 ldapsmb-1.34b-25.13.18.1 libmsrpc-3.0.36-0.13.18.1 libmsrpc-devel-3.0.36-0.13.18.1 libsmbclient-3.0.36-0.13.18.1 libsmbclient-devel-3.0.36-0.13.18.1 samba-3.0.36-0.13.18.1 samba-client-3.0.36-0.13.18.1 samba-krb-printing-3.0.36-0.13.18.1 samba-python-3.0.36-0.13.18.1 samba-vscan-0.3.6b-43.13.18.1 samba-winbind-3.0.36-0.13.18.1 - SUSE Linux Enterprise Server 10 SP4 (s390x x86_64): libsmbclient-32bit-3.0.36-0.13.18.1 samba-32bit-3.0.36-0.13.18.1 samba-client-32bit-3.0.36-0.13.18.1 samba-winbind-32bit-3.0.36-0.13.18.1 - SUSE Linux Enterprise Server 10 SP4 (ia64): libsmbclient-x86-3.0.36-0.13.18.1 samba-client-x86-3.0.36-0.13.18.1 samba-winbind-x86-3.0.36-0.13.18.1 samba-x86-3.0.36-0.13.18.1 - SUSE Linux Enterprise Server 10 SP4 (ppc): libsmbclient-64bit-3.0.36-0.13.18.1 samba-64bit-3.0.36-0.13.18.1 samba-client-64bit-3.0.36-0.13.18.1 samba-winbind-64bit-3.0.36-0.13.18.1 - SUSE Linux Enterprise Server 10 SP3 LTSS (i586 s390x x86_64): cifs-mount-3.0.36-0.13.18.1 ldapsmb-1.34b-25.13.18.1 libmsrpc-3.0.36-0.13.18.1 libmsrpc-devel-3.0.36-0.13.18.1 libsmbclient-3.0.36-0.13.18.1 libsmbclient-devel-3.0.36-0.13.18.1 samba-3.0.36-0.13.18.1 samba-client-3.0.36-0.13.18.1 samba-krb-printing-3.0.36-0.13.18.1 samba-python-3.0.36-0.13.18.1 samba-vscan-0.3.6b-43.13.18.1 samba-winbind-3.0.36-0.13.18.1 - SUSE Linux Enterprise Server 10 SP3 LTSS (s390x x86_64): libsmbclient-32bit-3.0.36-0.13.18.1 samba-32bit-3.0.36-0.13.18.1 samba-client-32bit-3.0.36-0.13.18.1 samba-winbind-32bit-3.0.36-0.13.18.1 - SUSE Linux Enterprise Desktop 10 SP4 (i586 x86_64): cifs-mount-3.0.36-0.13.18.1 ldapsmb-1.34b-25.13.18.1 libsmbclient-3.0.36-0.13.18.1 libsmbclient-devel-3.0.36-0.13.18.1 samba-3.0.36-0.13.18.1 samba-client-3.0.36-0.13.18.1 samba-krb-printing-3.0.36-0.13.18.1 samba-vscan-0.3.6b-43.13.18.1 samba-winbind-3.0.36-0.13.18.1 - SUSE Linux Enterprise Desktop 10 SP4 (x86_64): libsmbclient-32bit-3.0.36-0.13.18.1 samba-32bit-3.0.36-0.13.18.1 samba-client-32bit-3.0.36-0.13.18.1 samba-winbind-32bit-3.0.36-0.13.18.1 - SLE SDK 10 SP4 (i586 ia64 ppc s390x x86_64): libmsrpc-3.0.36-0.13.18.1 libmsrpc-devel-3.0.36-0.13.18.1 libsmbclient-devel-3.0.36-0.13.18.1 libsmbsharemodes-3.0.36-0.13.18.1 libsmbsharemodes-devel-3.0.36-0.13.18.1 samba-python-3.0.36-0.13.18.1 References: http://support.novell.com/security/cve/CVE-2012-0870.html https://bugzilla.novell.com/633729 https://bugzilla.novell.com/703655 https://bugzilla.novell.com/747934 http://download.novell.com/patch/finder/?keywords=547e3b7057adb631e14396056… http://download.novell.com/patch/finder/?keywords=7da8ca4f10f91e5bf4d12b67b… -- To unsubscribe, e-mail: opensuse-security-announce+unsubscribe(a)opensuse.org For additional commands, e-mail: opensuse-security-announce+help(a)opensuse.org

1 0

[security-announce] SUSE-SU-2012:0332-2: important: Security update for flash-player
by opensuse-security＠opensuse.org 08 Mar '12

08 Mar '12

SUSE Security Update: Security update for flash-player ______________________________________________________________________________ Announcement ID: SUSE-SU-2012:0332-2 Rating: important References: #750614 Cross-References: CVE-2012-0768 CVE-2012-0769 Affected Products: SUSE Linux Enterprise Desktop 10 SP4 ______________________________________________________________________________ An update that fixes two vulnerabilities is now available. It includes one version update. Description: flash-player 11.1.102.63 fixes two security issues: * memory corruption vulnerability in Matrix3D could lead to code executionn (CVE-2012-0768) * integer errors that could lead to information disclosure (CVE-2012-0769) Security Issue references: * CVE-2012-0768 <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2012-0768 > * CVE-2012-0769 <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2012-0769 > Package List: - SUSE Linux Enterprise Desktop 10 SP4 (i586) [New Version: 10.3.183.16]: flash-player-10.3.183.16-0.5.1 References: http://support.novell.com/security/cve/CVE-2012-0768.html http://support.novell.com/security/cve/CVE-2012-0769.html https://bugzilla.novell.com/750614 http://download.novell.com/patch/finder/?keywords=e55fbfc41d02cf21b84c29632… -- To unsubscribe, e-mail: opensuse-security-announce+unsubscribe(a)opensuse.org For additional commands, e-mail: opensuse-security-announce+help(a)opensuse.org

1 0

[security-announce] SUSE-SU-2012:0332-1: important: Security update for flash-player
by opensuse-security＠opensuse.org 07 Mar '12

07 Mar '12

SUSE Security Update: Security update for flash-player ______________________________________________________________________________ Announcement ID: SUSE-SU-2012:0332-1 Rating: important References: #750614 Cross-References: CVE-2012-0768 CVE-2012-0769 Affected Products: SUSE Linux Enterprise Desktop 11 SP1 FOR SP2 SUSE Linux Enterprise Desktop 11 SP1 ______________________________________________________________________________ An update that fixes two vulnerabilities is now available. It includes one version update. Description: flash-player 11.1.102.63 fixes two security issues: * memory corruption vulnerability in Matrix3D could lead to code executionn (CVE-2012-0768) * integer errors that could lead to information disclosure (CVE-2012-0769) Security Issue references: * CVE-2012-0768 <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2012-0768 > * CVE-2012-0769 <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2012-0769 > Patch Instructions: To install this SUSE Security Update use YaST online_update. Alternatively you can run the command listed for your product: - SUSE Linux Enterprise Desktop 11 SP1 FOR SP2: zypper in -t patch sledsp1fsp2-flash-player-5928 - SUSE Linux Enterprise Desktop 11 SP1: zypper in -t patch sledsp1-flash-player-5928 To bring your system up-to-date, use "zypper patch". Package List: - SUSE Linux Enterprise Desktop 11 SP1 FOR SP2 (i586 x86_64) [New Version: 11.1.102.63]: flash-player-11.1.102.63-0.3.1 - SUSE Linux Enterprise Desktop 11 SP1 (i586 x86_64) [New Version: 11.1.102.63]: flash-player-11.1.102.63-0.3.1 References: http://support.novell.com/security/cve/CVE-2012-0768.html http://support.novell.com/security/cve/CVE-2012-0769.html https://bugzilla.novell.com/750614 http://download.novell.com/patch/finder/?keywords=2cd17573d24f9a05b79c0d549… -- To unsubscribe, e-mail: opensuse-security-announce+unsubscribe(a)opensuse.org For additional commands, e-mail: opensuse-security-announce+help(a)opensuse.org

1 0

[security-announce] openSUSE-SU-2012:0331-1: important: flash-player
by opensuse-security＠opensuse.org 07 Mar '12

07 Mar '12

openSUSE Security Update: flash-player ______________________________________________________________________________ Announcement ID: openSUSE-SU-2012:0331-1 Rating: important References: #750614 Cross-References: CVE-2012-0768 CVE-2012-0769 Affected Products: openSUSE 11.4 ______________________________________________________________________________ An update that fixes two vulnerabilities is now available. It includes one version update. Description: flash-player 11.1.102.63 fixes two security issues: - memory corruption vulnerability in Matrix3D could lead to code executionn (CVE-2012-0768) - integer errors that could lead to information disclosure (CVE-2012-0769) Patch Instructions: To install this openSUSE Security Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE 11.4: zypper in -t patch flash-player-5927 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE 11.4 (i586 x86_64) [New Version: 11.1.102.63]: flash-player-11.1.102.63-0.2.1 References: http://support.novell.com/security/cve/CVE-2012-0768.html http://support.novell.com/security/cve/CVE-2012-0769.html https://bugzilla.novell.com/750614 -- To unsubscribe, e-mail: opensuse-security-announce+unsubscribe(a)opensuse.org For additional commands, e-mail: opensuse-security-announce+help(a)opensuse.org

1 0

[security-announce] SUSE-SU-2012:0326-1: important: Security update for libvorbis
by opensuse-security＠opensuse.org 06 Mar '12

06 Mar '12

SUSE Security Update: Security update for libvorbis ______________________________________________________________________________ Announcement ID: SUSE-SU-2012:0326-1 Rating: important References: #747912 Cross-References: CVE-2012-0444 Affected Products: SUSE Linux Enterprise Software Development Kit 11 SP1 FOR SP2 SUSE Linux Enterprise Software Development Kit 11 SP1 SUSE Linux Enterprise Server 11 SP1 for VMware SUSE Linux Enterprise Server 11 SP1 FOR SP2 SUSE Linux Enterprise Server 11 SP1 SUSE Linux Enterprise Server 10 SP4 SUSE Linux Enterprise Desktop 11 SP1 FOR SP2 SUSE Linux Enterprise Desktop 11 SP1 SUSE Linux Enterprise Desktop 10 SP4 ______________________________________________________________________________ An update that fixes one vulnerability is now available. Description: Specially crafted Ogg files could cause a heap-based buffer overflow in the vorbis audio compression library that could potentially be exploited by attackers to cause a crash or execute arbitrary code (CVE-2012-0444). Security Issue reference: * CVE-2012-0444 <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2012-0444 > Patch Instructions: To install this SUSE Security Update use YaST online_update. Alternatively you can run the command listed for your product: - SUSE Linux Enterprise Software Development Kit 11 SP1 FOR SP2: zypper in -t patch sdksp1fsp2-libvorbis-5851 - SUSE Linux Enterprise Software Development Kit 11 SP1: zypper in -t patch sdksp1-libvorbis-5851 - SUSE Linux Enterprise Server 11 SP1 for VMware: zypper in -t patch slessp1-libvorbis-5851 - SUSE Linux Enterprise Server 11 SP1 FOR SP2: zypper in -t patch slessp1fsp2-libvorbis-5851 - SUSE Linux Enterprise Server 11 SP1: zypper in -t patch slessp1-libvorbis-5851 - SUSE Linux Enterprise Desktop 11 SP1 FOR SP2: zypper in -t patch sledsp1fsp2-libvorbis-5851 - SUSE Linux Enterprise Desktop 11 SP1: zypper in -t patch sledsp1-libvorbis-5851 To bring your system up-to-date, use "zypper patch". Package List: - SUSE Linux Enterprise Software Development Kit 11 SP1 FOR SP2 (i586 ia64 ppc64 s390x x86_64): libvorbis-devel-1.2.0-79.20.1 - SUSE Linux Enterprise Software Development Kit 11 SP1 (i586 ia64 ppc64 s390x x86_64): libvorbis-devel-1.2.0-79.20.1 - SUSE Linux Enterprise Server 11 SP1 for VMware (i586 x86_64): libvorbis-1.2.0-79.20.1 libvorbis-doc-1.2.0-79.20.1 - SUSE Linux Enterprise Server 11 SP1 for VMware (x86_64): libvorbis-32bit-1.2.0-79.20.1 - SUSE Linux Enterprise Server 11 SP1 FOR SP2 (i586 ia64 ppc64 s390x x86_64): libvorbis-1.2.0-79.20.1 libvorbis-doc-1.2.0-79.20.1 - SUSE Linux Enterprise Server 11 SP1 FOR SP2 (ppc64 s390x x86_64): libvorbis-32bit-1.2.0-79.20.1 - SUSE Linux Enterprise Server 11 SP1 FOR SP2 (ia64): libvorbis-x86-1.2.0-79.20.1 - SUSE Linux Enterprise Server 11 SP1 (i586 ia64 ppc64 s390x x86_64): libvorbis-1.2.0-79.20.1 libvorbis-doc-1.2.0-79.20.1 - SUSE Linux Enterprise Server 11 SP1 (ppc64 s390x x86_64): libvorbis-32bit-1.2.0-79.20.1 - SUSE Linux Enterprise Server 11 SP1 (ia64): libvorbis-x86-1.2.0-79.20.1 - SUSE Linux Enterprise Server 10 SP4 (i586 ia64 ppc s390x x86_64): libvorbis-1.1.2-13.19.1 libvorbis-devel-1.1.2-13.19.1 - SUSE Linux Enterprise Server 10 SP4 (s390x x86_64): libvorbis-32bit-1.1.2-13.19.1 - SUSE Linux Enterprise Server 10 SP4 (ia64): libvorbis-x86-1.1.2-13.19.1 - SUSE Linux Enterprise Server 10 SP4 (ppc): libvorbis-64bit-1.1.2-13.19.1 - SUSE Linux Enterprise Desktop 11 SP1 FOR SP2 (i586 x86_64): libvorbis-1.2.0-79.20.1 - SUSE Linux Enterprise Desktop 11 SP1 FOR SP2 (x86_64): libvorbis-32bit-1.2.0-79.20.1 - SUSE Linux Enterprise Desktop 11 SP1 (i586 x86_64): libvorbis-1.2.0-79.20.1 - SUSE Linux Enterprise Desktop 11 SP1 (x86_64): libvorbis-32bit-1.2.0-79.20.1 - SUSE Linux Enterprise Desktop 10 SP4 (i586 x86_64): libvorbis-1.1.2-13.19.1 libvorbis-devel-1.1.2-13.19.1 - SUSE Linux Enterprise Desktop 10 SP4 (x86_64): libvorbis-32bit-1.1.2-13.19.1 References: http://support.novell.com/security/cve/CVE-2012-0444.html https://bugzilla.novell.com/747912 http://download.novell.com/patch/finder/?keywords=56f02ce23b1f6abe181f7e00c… http://download.novell.com/patch/finder/?keywords=dca0a520e9ca9f5bad17b1c77… -- To unsubscribe, e-mail: opensuse-security-announce+unsubscribe(a)opensuse.org For additional commands, e-mail: opensuse-security-announce+help(a)opensuse.org

1 0

[security-announce] SUSE-SU-2012:0325-1: important: Security update for puppet
by opensuse-security＠opensuse.org 06 Mar '12

06 Mar '12

SUSE Security Update: Security update for puppet ______________________________________________________________________________ Announcement ID: SUSE-SU-2012:0325-1 Rating: important References: #747657 Cross-References: CVE-2012-1053 CVE-2012-1054 Affected Products: SUSE Linux Enterprise Server 11 SP1 for VMware SUSE Linux Enterprise Server 11 SP1 FOR SP2 SUSE Linux Enterprise Server 11 SP1 SUSE Linux Enterprise Desktop 11 SP1 FOR SP2 SUSE Linux Enterprise Desktop 11 SP1 ______________________________________________________________________________ An update that fixes two vulnerabilities is now available. It includes one version update. Description: This update of puppet fixes two vulnerabilities that could potentially be exploited by local attackers to escalate privileges due to improper privilege dropping and file handling issues (symlink flaws) in puppet (CVE-2012-1053, CVE-2012-1054). Security Issue references: * CVE-2012-1053 <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2012-1053 > * CVE-2012-1054 <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2012-1054 > Patch Instructions: To install this SUSE Security Update use YaST online_update. Alternatively you can run the command listed for your product: - SUSE Linux Enterprise Server 11 SP1 for VMware: zypper in -t patch slessp1-puppet-5876 - SUSE Linux Enterprise Server 11 SP1 FOR SP2: zypper in -t patch slessp1fsp2-puppet-5876 - SUSE Linux Enterprise Server 11 SP1: zypper in -t patch slessp1-puppet-5876 - SUSE Linux Enterprise Desktop 11 SP1 FOR SP2: zypper in -t patch sledsp1fsp2-puppet-5876 - SUSE Linux Enterprise Desktop 11 SP1: zypper in -t patch sledsp1-puppet-5876 To bring your system up-to-date, use "zypper patch". Package List: - SUSE Linux Enterprise Server 11 SP1 for VMware (i586 x86_64) [New Version: 2.6.12]: puppet-2.6.12-0.12.1 puppet-server-2.6.12-0.12.1 - SUSE Linux Enterprise Server 11 SP1 FOR SP2 (i586 ia64 ppc64 s390x x86_64) [New Version: 2.6.12]: puppet-2.6.12-0.12.1 puppet-server-2.6.12-0.12.1 - SUSE Linux Enterprise Server 11 SP1 (i586 ia64 ppc64 s390x x86_64) [New Version: 2.6.12]: puppet-2.6.12-0.12.1 puppet-server-2.6.12-0.12.1 - SUSE Linux Enterprise Desktop 11 SP1 FOR SP2 (i586 x86_64) [New Version: 2.6.12]: puppet-2.6.12-0.12.1 - SUSE Linux Enterprise Desktop 11 SP1 (i586 x86_64) [New Version: 2.6.12]: puppet-2.6.12-0.12.1 References: http://support.novell.com/security/cve/CVE-2012-1053.html http://support.novell.com/security/cve/CVE-2012-1054.html https://bugzilla.novell.com/747657 http://download.novell.com/patch/finder/?keywords=810c76edc7112af5e466c9d5b… -- To unsubscribe, e-mail: opensuse-security-announce+unsubscribe(a)opensuse.org For additional commands, e-mail: opensuse-security-announce+help(a)opensuse.org

1 0

[security-announce] SUSE-SU-2012:0323-1: important: Security update for Apache2
by opensuse-security＠opensuse.org 06 Mar '12

06 Mar '12

SUSE Security Update: Security update for Apache2 ______________________________________________________________________________ Announcement ID: SUSE-SU-2012:0323-1 Rating: important References: #736706 #738855 #741243 #743743 Cross-References: CVE-2007-6750 CVE-2012-0031 CVE-2012-0053 Affected Products: SUSE Linux Enterprise Server 10 SP4 SLE SDK 10 SP4 ______________________________________________________________________________ An update that solves three vulnerabilities and has one errata is now available. Description: This update of apache fixes regressions and several security problems: * bnc#741243, CVE-2012-0031: Fixed a scoreboard corruption (shared mem segment) by child causes crash of privileged parent (invalid free()) during shutdown. * bnc#743743,CVE-2012-0053: Fixed an issue in error responses that could expose "httpOnly" cookies when no custom ErrorDocument is specified for status code 400". * bnc#736706, the SSL configuration template suggested weak ciphers * bnc#738855,CVE-2007-6750: The "mod_reqtimeout" module was backported from Apache 2.2.21 to help mitigate the "Slowloris" Denial of Service attack. You need to enable the "mod_reqtimeout" module in your existing apache configuration to make it effective, e.g. in the APACHE_MODULES line in /etc/sysconfig/apache2. Security Issue references: * CVE-2012-0031 <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2012-0031 > * CVE-2012-0053 <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2012-0053 > * CVE-2007-6750 <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2007-6750 > Package List: - SUSE Linux Enterprise Server 10 SP4 (i586 ia64 ppc s390x x86_64): apache2-2.2.3-16.44.1 apache2-devel-2.2.3-16.44.1 apache2-doc-2.2.3-16.44.1 apache2-example-pages-2.2.3-16.44.1 apache2-prefork-2.2.3-16.44.1 apache2-worker-2.2.3-16.44.1 - SLE SDK 10 SP4 (i586 ia64 ppc s390x x86_64): apache2-2.2.3-16.44.1 apache2-devel-2.2.3-16.44.1 apache2-doc-2.2.3-16.44.1 apache2-example-pages-2.2.3-16.44.1 apache2-prefork-2.2.3-16.44.1 apache2-worker-2.2.3-16.44.1 References: http://support.novell.com/security/cve/CVE-2007-6750.html http://support.novell.com/security/cve/CVE-2012-0031.html http://support.novell.com/security/cve/CVE-2012-0053.html https://bugzilla.novell.com/736706 https://bugzilla.novell.com/738855 https://bugzilla.novell.com/741243 https://bugzilla.novell.com/743743 http://download.novell.com/patch/finder/?keywords=1e0c99b5795cd7497ef910246… -- To unsubscribe, e-mail: opensuse-security-announce+unsubscribe(a)opensuse.org For additional commands, e-mail: opensuse-security-announce+help(a)opensuse.org

1 0

[security-announce] SUSE-SU-2012:0114-2: important: Security update for IBM Java 1.6.0
by opensuse-security＠opensuse.org 06 Mar '12

06 Mar '12

SUSE Security Update: Security update for IBM Java 1.6.0 ______________________________________________________________________________ Announcement ID: SUSE-SU-2012:0114-2 Rating: important References: #739248 Cross-References: CVE-2011-3389 CVE-2011-3516 CVE-2011-3521 CVE-2011-3544 CVE-2011-3545 CVE-2011-3546 CVE-2011-3547 CVE-2011-3548 CVE-2011-3549 CVE-2011-3550 CVE-2011-3551 CVE-2011-3552 CVE-2011-3553 CVE-2011-3554 CVE-2011-3556 CVE-2011-3557 CVE-2011-3560 CVE-2011-3561 Affected Products: SUSE Linux Enterprise Software Development Kit 11 SP1 FOR SP2 SUSE Linux Enterprise Software Development Kit 11 SP1 SUSE Linux Enterprise Server 11 SP1 for VMware SUSE Linux Enterprise Server 11 SP1 FOR SP2 SUSE Linux Enterprise Server 11 SP1 SUSE Linux Enterprise Java 11 SP1 ______________________________________________________________________________ An update that fixes 18 vulnerabilities is now available. Description: IBM Java 1.6.0 SR10 has been released fixing the following CVE's/security Issues: * CVE-2011-3389 <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2011-3389 > * CVE-2011-3516 <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2011-3516 > * CVE-2011-3521 <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2011-3521 > * CVE-2011-3544 <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2011-3544 > * CVE-2011-3545 <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2011-3545 > * CVE-2011-3546 <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2011-3546 > * CVE-2011-3547 <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2011-3547 > * CVE-2011-3548 <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2011-3548 > * CVE-2011-3549 <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2011-3549 > * CVE-2011-3550 <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2011-3550 > * CVE-2011-3551 <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2011-3551 > * CVE-2011-3552 <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2011-3552 > * CVE-2011-3553 <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2011-3553 > * CVE-2011-3554 <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2011-3554 > * CVE-2011-3556 <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2011-3556 > * CVE-2011-3557 <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2011-3557 > * CVE-2011-3560 <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2011-3560 > * CVE-2011-3561 <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2011-3561 > Patch Instructions: To install this SUSE Security Update use YaST online_update. Alternatively you can run the command listed for your product: - SUSE Linux Enterprise Software Development Kit 11 SP1 FOR SP2: zypper in -t patch sdksp1fsp2-java-1_6_0-ibm-5872 - SUSE Linux Enterprise Software Development Kit 11 SP1: zypper in -t patch sdksp1-java-1_6_0-ibm-5872 - SUSE Linux Enterprise Server 11 SP1 for VMware: zypper in -t patch slessp1-java-1_6_0-ibm-5872 - SUSE Linux Enterprise Server 11 SP1 FOR SP2: zypper in -t patch slessp1fsp2-java-1_6_0-ibm-5872 - SUSE Linux Enterprise Server 11 SP1: zypper in -t patch slessp1-java-1_6_0-ibm-5872 - SUSE Linux Enterprise Java 11 SP1: zypper in -t patch slejsp1-java-1_6_0-ibm-5872 To bring your system up-to-date, use "zypper patch". Package List: - SUSE Linux Enterprise Software Development Kit 11 SP1 FOR SP2 (i586 ppc64 s390x x86_64): java-1_6_0-ibm-devel-1.6.0_sr10.0-0.3.1 - SUSE Linux Enterprise Software Development Kit 11 SP1 FOR SP2 (i586 x86_64): java-1_6_0-ibm-1.6.0_sr10.0-0.3.1 java-1_6_0-ibm-fonts-1.6.0_sr10.0-0.3.1 - SUSE Linux Enterprise Software Development Kit 11 SP1 (i586 ppc64 s390x x86_64): java-1_6_0-ibm-devel-1.6.0_sr10.0-0.3.1 - SUSE Linux Enterprise Software Development Kit 11 SP1 (i586 x86_64): java-1_6_0-ibm-1.6.0_sr10.0-0.3.1 java-1_6_0-ibm-fonts-1.6.0_sr10.0-0.3.1 - SUSE Linux Enterprise Server 11 SP1 for VMware (i586 x86_64): java-1_6_0-ibm-1.6.0_sr10.0-0.3.1 java-1_6_0-ibm-fonts-1.6.0_sr10.0-0.3.1 java-1_6_0-ibm-jdbc-1.6.0_sr10.0-0.3.1 java-1_6_0-ibm-plugin-1.6.0_sr10.0-0.3.1 - SUSE Linux Enterprise Server 11 SP1 for VMware (i586): java-1_6_0-ibm-alsa-1.6.0_sr10.0-0.3.1 - SUSE Linux Enterprise Server 11 SP1 FOR SP2 (i586 ppc64 s390x x86_64): java-1_6_0-ibm-1.6.0_sr10.0-0.3.1 java-1_6_0-ibm-fonts-1.6.0_sr10.0-0.3.1 java-1_6_0-ibm-jdbc-1.6.0_sr10.0-0.3.1 - SUSE Linux Enterprise Server 11 SP1 FOR SP2 (i586 x86_64): java-1_6_0-ibm-plugin-1.6.0_sr10.0-0.3.1 - SUSE Linux Enterprise Server 11 SP1 FOR SP2 (i586): java-1_6_0-ibm-alsa-1.6.0_sr10.0-0.3.1 - SUSE Linux Enterprise Server 11 SP1 (i586 ppc64 s390x x86_64): java-1_6_0-ibm-1.6.0_sr10.0-0.3.1 java-1_6_0-ibm-fonts-1.6.0_sr10.0-0.3.1 java-1_6_0-ibm-jdbc-1.6.0_sr10.0-0.3.1 - SUSE Linux Enterprise Server 11 SP1 (i586 x86_64): java-1_6_0-ibm-plugin-1.6.0_sr10.0-0.3.1 - SUSE Linux Enterprise Server 11 SP1 (i586): java-1_6_0-ibm-alsa-1.6.0_sr10.0-0.3.1 - SUSE Linux Enterprise Java 11 SP1 (i586 ppc64 s390x x86_64): java-1_6_0-ibm-1.6.0_sr10.0-0.3.1 java-1_6_0-ibm-devel-1.6.0_sr10.0-0.3.1 java-1_6_0-ibm-fonts-1.6.0_sr10.0-0.3.1 java-1_6_0-ibm-jdbc-1.6.0_sr10.0-0.3.1 - SUSE Linux Enterprise Java 11 SP1 (i586 x86_64): java-1_6_0-ibm-plugin-1.6.0_sr10.0-0.3.1 - SUSE Linux Enterprise Java 11 SP1 (i586): java-1_6_0-ibm-alsa-1.6.0_sr10.0-0.3.1 References: http://support.novell.com/security/cve/CVE-2011-3389.html http://support.novell.com/security/cve/CVE-2011-3516.html http://support.novell.com/security/cve/CVE-2011-3521.html http://support.novell.com/security/cve/CVE-2011-3544.html http://support.novell.com/security/cve/CVE-2011-3545.html http://support.novell.com/security/cve/CVE-2011-3546.html http://support.novell.com/security/cve/CVE-2011-3547.html http://support.novell.com/security/cve/CVE-2011-3548.html http://support.novell.com/security/cve/CVE-2011-3549.html http://support.novell.com/security/cve/CVE-2011-3550.html http://support.novell.com/security/cve/CVE-2011-3551.html http://support.novell.com/security/cve/CVE-2011-3552.html http://support.novell.com/security/cve/CVE-2011-3553.html http://support.novell.com/security/cve/CVE-2011-3554.html http://support.novell.com/security/cve/CVE-2011-3556.html http://support.novell.com/security/cve/CVE-2011-3557.html http://support.novell.com/security/cve/CVE-2011-3560.html http://support.novell.com/security/cve/CVE-2011-3561.html https://bugzilla.novell.com/739248 http://download.novell.com/patch/finder/?keywords=150456135775777ea73371c13… -- To unsubscribe, e-mail: opensuse-security-announce+unsubscribe(a)opensuse.org For additional commands, e-mail: opensuse-security-announce+help(a)opensuse.org

1 0

[security-announce] openSUSE-SU-2012:0319-1: important: libvorbis: fixed a heap based buffer overflow
by opensuse-security＠opensuse.org 01 Mar '12

01 Mar '12

openSUSE Security Update: libvorbis: fixed a heap based buffer overflow ______________________________________________________________________________ Announcement ID: openSUSE-SU-2012:0319-1 Rating: important References: #747912 Cross-References: CVE-2012-0444 Affected Products: openSUSE 11.4 ______________________________________________________________________________ An update that fixes one vulnerability is now available. Description: Specially crafted ogg files could cause a heap-based buffer overflow in the vorbis audio compression library that could potentially be exploited by attackers to cause a crash or execute arbitrary code (CVE-2012-0444). Patch Instructions: To install this openSUSE Security Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE 11.4: zypper in -t patch libvorbis-5850 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE 11.4 (i586 x86_64): libvorbis-devel-1.3.2-6.7.1 libvorbis0-1.3.2-6.7.1 libvorbisenc2-1.3.2-6.7.1 libvorbisfile3-1.3.2-6.7.1 - openSUSE 11.4 (x86_64): libvorbis0-32bit-1.3.2-6.7.1 libvorbisenc2-32bit-1.3.2-6.7.1 libvorbisfile3-32bit-1.3.2-6.7.1 - openSUSE 11.4 (noarch): libvorbis-doc-1.3.2-6.7.1 References: http://support.novell.com/security/cve/CVE-2012-0444.html https://bugzilla.novell.com/747912 -- To unsubscribe, e-mail: opensuse-security-announce+unsubscribe(a)opensuse.org For additional commands, e-mail: opensuse-security-announce+help(a)opensuse.org

1 0