September 2012 - openSUSE Security Announce

[security-announce] openSUSE-SU-2012:1170-1: important: qemu: Fix buffer overflow in console VT100 emulation
by opensuse-security＠opensuse.org 14 Sep '12

14 Sep '12

openSUSE Security Update: qemu: Fix buffer overflow in console VT100 emulation ______________________________________________________________________________ Announcement ID: openSUSE-SU-2012:1170-1 Rating: important References: #777084 Cross-References: CVE-2012-3515 Affected Products: openSUSE 12.2 openSUSE 12.1 openSUSE 11.4 ______________________________________________________________________________ An update that fixes one vulnerability is now available. Description: qemu was fixed to add bounds checking for VT100 escape code parsing and cursor placement. Also qemu was updated on 12.2 and 11.4 to the latest stable release (v1.1.1 and v0.14.1 respectively). Patch Instructions: To install this openSUSE Security Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE 12.2: zypper in -t patch openSUSE-2012-599 - openSUSE 12.1: zypper in -t patch openSUSE-2012-599 - openSUSE 11.4: zypper in -t patch openSUSE-2012-599 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE 12.2 (i586 x86_64): qemu-1.1.1-3.9.1 qemu-debuginfo-1.1.1-3.9.1 qemu-debugsource-1.1.1-3.9.1 qemu-guest-agent-1.1.1-3.9.1 qemu-guest-agent-debuginfo-1.1.1-3.9.1 qemu-linux-user-1.1.1-3.9.1 qemu-tools-1.1.1-3.9.1 qemu-tools-debuginfo-1.1.1-3.9.1 - openSUSE 12.1 (i586 x86_64): qemu-0.14.1-7.6.1 qemu-debuginfo-0.14.1-7.6.1 qemu-debugsource-0.14.1-7.6.1 - openSUSE 11.4 (i586 x86_64): qemu-0.14.1-1.10.1 qemu-debuginfo-0.14.1-1.10.1 qemu-debugsource-0.14.1-1.10.1 References: http://support.novell.com/security/cve/CVE-2012-3515.html https://bugzilla.novell.com/777084 -- To unsubscribe, e-mail: opensuse-security-announce+unsubscribe(a)opensuse.org For additional commands, e-mail: opensuse-security-announce+help(a)opensuse.org

1 0

[security-announce] SUSE-SU-2012:1155-2: important: Security update for dbus-1
by opensuse-security＠opensuse.org 14 Sep '12

14 Sep '12

SUSE Security Update: Security update for dbus-1 ______________________________________________________________________________ Announcement ID: SUSE-SU-2012:1155-2 Rating: important References: #697105 #764047 Affected Products: SUSE Linux Enterprise Server 11 SP1 LTSS ______________________________________________________________________________ An update that contains security fixes can now be installed. Description: This update fixes a vulnerability in the DBUS auto-launching feature that allowed local users to execute arbitrary programs as root. CVE-2012-3524 has been assigned to this issue. Patch Instructions: To install this SUSE Security Update use YaST online_update. Alternatively you can run the command listed for your product: - SUSE Linux Enterprise Server 11 SP1 LTSS: zypper in -t patch slessp1-dbus-1-6750 To bring your system up-to-date, use "zypper patch". Package List: - SUSE Linux Enterprise Server 11 SP1 LTSS (i586 s390x x86_64): dbus-1-1.2.10-3.25.2 dbus-1-x11-1.2.10-3.25.2 - SUSE Linux Enterprise Server 11 SP1 LTSS (s390x x86_64): dbus-1-32bit-1.2.10-3.25.2 References: https://bugzilla.novell.com/697105 https://bugzilla.novell.com/764047 http://download.novell.com/patch/finder/?keywords=31465364238b4fa9b84b97edb… -- To unsubscribe, e-mail: opensuse-security-announce+unsubscribe(a)opensuse.org For additional commands, e-mail: opensuse-security-announce+help(a)opensuse.org

1 0

[security-announce] SUSE-SU-2012:1167-1: important: Security update for Mozilla Firefox
by opensuse-security＠opensuse.org 14 Sep '12

14 Sep '12

SUSE Security Update: Security update for Mozilla Firefox ______________________________________________________________________________ Announcement ID: SUSE-SU-2012:1167-1 Rating: important References: #684069 #769762 #777588 Cross-References: CVE-2012-1956 CVE-2012-1970 CVE-2012-1971 CVE-2012-1972 CVE-2012-1973 CVE-2012-1974 CVE-2012-1975 CVE-2012-1976 CVE-2012-3956 CVE-2012-3957 CVE-2012-3958 CVE-2012-3959 CVE-2012-3960 CVE-2012-3961 CVE-2012-3962 CVE-2012-3963 CVE-2012-3964 CVE-2012-3965 CVE-2012-3966 CVE-2012-3967 CVE-2012-3968 CVE-2012-3969 CVE-2012-3970 CVE-2012-3971 CVE-2012-3972 CVE-2012-3973 CVE-2012-3974 CVE-2012-3975 CVE-2012-3976 CVE-2012-3978 CVE-2012-3979 CVE-2012-3980 Affected Products: SUSE Linux Enterprise Server 10 SP4 SUSE Linux Enterprise Desktop 10 SP4 SLE SDK 10 SP4 ______________________________________________________________________________ An update that fixes 32 vulnerabilities is now available. It includes three new package versions. Description: MozillaFirefox was updated to 10.0.7ESR release, fixing a lot of bugs and security problems. The following security issues have been addressed: * MFSA 2012-57: Mozilla developers identified and fixed several memory safety bugs in the browser engine used in Firefox and other Mozilla-based products. Some of these bugs showed evidence of memory corruption under certain circumstances, and we presume that with enough effort at least some of these could be exploited to run arbitrary code. In general these flaws cannot be exploited through email in the Thunderbird and SeaMonkey products because scripting is disabled, but are potentially a risk in browser or browser-like contexts in those products. * CVE-2012-1971: Gary Kwong, Christian Holler, Jesse Ruderman, Steve Fink, Bob Clary, Andrew Sutherland, and Jason Smith reported memory safety problems and crashes that affect Firefox 14. * CVE-2012-1970: Gary Kwong, Christian Holler, Jesse Ruderman, John Schoenick, Vladimir Vukicevic and Daniel Holbert reported memory safety problems and crashes that affect Firefox ESR 10 and Firefox 14. * MFSA 2012-58: Security researcher Abhishek Arya (Inferno) of Google Chrome Security Team discovered a series of use-after-free issues using the Address Sanitizer tool. Many of these issues are potentially exploitable, allowing for remote code execution. o Heap-use-after-free in nsHTMLEditor::CollapseAdjacentTextNodes CVE-2012-1972 o Heap-use-after-free in nsObjectLoadingContent::LoadObject CVE-2012-1973 o Heap-use-after-free in gfxTextRun::CanBreakLineBefore CVE-2012-1974 o Heap-use-after-free in PresShell::CompleteMove CVE-2012-1975 o Heap-use-after-free in nsHTMLSelectElement::SubmitNamesValues CVE-2012-1976 o Heap-use-after-free in MediaStreamGraphThreadRunnable::Run() CVE-2012-3956 o Heap-buffer-overflow in nsBlockFrame::MarkLineDirty CVE-2012-3957 o Heap-use-after-free in nsHTMLEditRules::DeleteNonTableElements CVE-2012-3958 o Heap-use-after-free in nsRangeUpdater::SelAdjDeleteNode CVE-2012-3959 o Heap-use-after-free in mozSpellChecker::SetCurrentDictionary CVE-2012-3960 o Heap-use-after-free in RangeData::~RangeData CVE-2012-3961 o Bad iterator in text runs CVE-2012-3962 o use after free in js::gc::MapAllocToTraceKind CVE-2012-3963 o Heap-use-after-free READ 8 in gfxTextRun::GetUserData CVE-2012-3964 * MFSA 2012-59 / CVE-2012-1956: Security researcher Mariusz Mlynski reported that it is possible to shadow the location object using Object.defineProperty. This could be used to confuse the current location to plugins, allowing for possible cross-site scripting (XSS) attacks. * MFSA 2012-60 / CVE-2012-3965: Security researcher Mariusz Mlynski reported that when a page opens a new tab, a subsequent window can then be opened that can be navigated to about:newtab, a chrome privileged page. Once about:newtab is loaded, the special context can potentially be used to escalate privilege, allowing for arbitrary code execution on the local system in a maliciously crafted attack. * MFSA 2012-61 / CVE-2012-3966: Security researcher Frederic Hoguin reported two related issues with the decoding of bitmap (.BMP) format images embedded in icon (.ICO) format files. When processing a negative "height" header value for the bitmap image, a memory corruption can be induced, allowing an attacker to write random memory and cause a crash. This crash may be potentially exploitable. * MFSA 2012-62: Security researcher miaubiz used the Address Sanitizer tool to discover two WebGL issues. The first issue is a use-after-free when WebGL shaders are called after being destroyed. The second issue exposes a problem with Mesa drivers on Linux, leading to a potentially exploitable crash. o use after free, webgl fragment shader deleted by accessor CVE-2012-3968 o stack scribbling with 4-byte values choosable among a few values, when using more than 16 sampler uniforms, on Mesa, with all drivers CVE-2012-3967 * MFSA 2012-63: Security researcher Arthur Gerkis used the Address Sanitizer tool to find two issues involving Scalable Vector Graphics (SVG) files. The first issue is a buffer overflow in Gecko's SVG filter code when the sum of two values is too large to be stored as a signed 32-bit integer, causing the function to write past the end of an array. The second issue is a use-after-free when an element with a "requiredFeatures" attribute is moved between documents. In that situation, the internal representation of the "requiredFeatures" value could be freed prematurely. Both issues are potentially exploitable. o Heap-buffer-overflow in nsSVGFEMorphologyElement::Filter CVE-2012-3969 o Heap-use-after-free in nsTArray_base::Length() CVE-2012-3970 * MFSA 2012-64 / CVE-2012-3971: Using the Address Sanitizer tool, Mozilla security researcher Christoph Diehl discovered two memory corruption issues involving the Graphite 2 library used in Mozilla products. Both of these issues can cause a potentially exploitable crash. These problems were fixed in the Graphite 2 library, which has been updated for Mozilla products. * MFSA 2012-65 / CVE-2012-3972: Security research Nicolas Gregoire used the Address Sanitizer tool to discover an out-of-bounds read in the format-number feature of XSLT, which can cause inaccurate formatting of numbers and information leakage. This is not directly exploitable. * MFSA 2012-66 / CVE-2012-3973: Mozilla security researcher Mark Goodwin discovered an issue with the Firefox developer tools' debugger. If remote debugging is disabled, but the experimental HTTPMonitor extension has been installed and enabled, a remote user can connect to and use the remote debugging service through the port used by HTTPMonitor. A remote-enabled flag has been added to resolve this problem and close the port unless debugging is explicitly enabled. * MFSA 2012-67 / CVE-2012-3974: Security researcher Masato Kinugawa reported that if a crafted executable is placed in the root partition on a Windows file system, the Firefox and Thunderbird installer will launch this program after a standard installation instead of Firefox or Thunderbird, running this program with the user's privileges. * MFSA 2012-68 / CVE-2012-3975: Security researcher vsemozhetbyt reported that when the DOMParser is used to parse text/html data in a Firefox extension, linked resources within this HTML data will be loaded. If the data being parsed in the extension is untrusted, it could lead to information leakage and can potentially be combined with other attacks to become exploitable. * MFSA 2012-69 / CVE-2012-3976: Security researcher Mark Poticha reported an issue where incorrect SSL certificate information can be displayed on the addressbar, showing the SSL data for a previous site while another has been loaded. This is caused by two onLocationChange events being fired out of the expected order, leading to the displayed certificate data to not be updated. This can be used for phishing attacks by allowing the user to input form or other data on a newer, attacking, site while the credentials of an older site appear on the addressbar. * MFSA 2012-70 / CVE-2012-3978: Mozilla security researcher moz_bug_r_a4 reported that certain security checks in the location object can be bypassed if chrome code is called content in a specific manner. This allowed for the loading of restricted content. This can be combined with other issues to become potentially exploitable. * MFSA 2012-71 / CVE-2012-3979: Mozilla developer Blake Kaplan reported that __android_log_print is called insecurely in places. If a malicious web page used a dump() statement with a specially crafted string, it can trigger a potentially exploitable crash. This vulnerability only affects Firefox for Android. * MFSA 2012-72 / CVE-2012-3980: Security researcher Colby Russell discovered that eval in the web console can execute injected code with chrome privileges, leading to the running of malicious code in a privileged context. This allows for arbitrary code execution through a malicious web page if the web console is invoked by the user. Security Issue references: * CVE-2012-1971 <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2012-1971 > * CVE-2012-1970 <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2012-1970 > * CVE-2012-1972 <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2012-1972 > * CVE-2012-1973 <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2012-1973 > * CVE-2012-1974 <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2012-1974 > * CVE-2012-1975 <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2012-1975 > * CVE-2012-1976 <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2012-1976 > * CVE-2012-3956 <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2012-3956 > * CVE-2012-3957 <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2012-3957 > * CVE-2012-3958 <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2012-3958 > * CVE-2012-3959 <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2012-3959 > * CVE-2012-3960 <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2012-3960 > * CVE-2012-3961 <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2012-3961 > * CVE-2012-3962 <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2012-3962 > * CVE-2012-3963 <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2012-3963 > * CVE-2012-3964 <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2012-3964 > * CVE-2012-1956 <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2012-1956 > * CVE-2012-3965 <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2012-3965 > * CVE-2012-3966 <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2012-3966 > * CVE-2012-3968 <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2012-3968 > * CVE-2012-3967 <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2012-3967 > * CVE-2012-3969 <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2012-3969 > * CVE-2012-3970 <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2012-3970 > * CVE-2012-3971 <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2012-3971 > * CVE-2012-3972 <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2012-3972 > * CVE-2012-3973 <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2012-3973 > * CVE-2012-3974 <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2012-3974 > * CVE-2012-3975 <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2012-3975 > * CVE-2012-3976 <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2012-3976 > * CVE-2012-3978 <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2012-3978 > * CVE-2012-3979 <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2012-3979 > * CVE-2012-3980 <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2012-3980 > Indications: Please install this update. Package List: - SUSE Linux Enterprise Server 10 SP4 (i586 ia64 ppc s390x x86_64) [New Version: 3.13.6 and 4.9.2]: firefox3-cairo-1.2.4-0.8.1 mozilla-nspr-4.9.2-0.9.1 mozilla-nspr-devel-4.9.2-0.9.1 mozilla-nss-3.13.6-0.8.1 mozilla-nss-devel-3.13.6-0.8.1 mozilla-nss-tools-3.13.6-0.8.1 - SUSE Linux Enterprise Server 10 SP4 (i586 ia64 ppc s390x) [New Version: 7]: MozillaFirefox-10.0.7-0.5.1 MozillaFirefox-branding-SLED-7-0.8.31 MozillaFirefox-translations-10.0.7-0.5.1 - SUSE Linux Enterprise Server 10 SP4 (s390x x86_64) [New Version: 3.13.6 and 4.9.2]: firefox3-cairo-32bit-1.2.4-0.8.1 mozilla-nspr-32bit-4.9.2-0.9.1 mozilla-nss-32bit-3.13.6-0.8.1 - SUSE Linux Enterprise Server 10 SP4 (ia64) [New Version: 3.13.6 and 4.9.2]: mozilla-nspr-x86-4.9.2-0.9.1 mozilla-nss-x86-3.13.6-0.8.1 - SUSE Linux Enterprise Server 10 SP4 (ppc) [New Version: 3.13.6 and 4.9.2]: mozilla-nspr-64bit-4.9.2-0.9.1 mozilla-nss-64bit-3.13.6-0.8.1 - SUSE Linux Enterprise Desktop 10 SP4 (i586 x86_64) [New Version: 3.13.6 and 4.9.2]: firefox3-cairo-1.2.4-0.8.1 mozilla-nspr-4.9.2-0.9.1 mozilla-nspr-devel-4.9.2-0.9.1 mozilla-nss-3.13.6-0.8.1 mozilla-nss-devel-3.13.6-0.8.1 mozilla-nss-tools-3.13.6-0.8.1 - SUSE Linux Enterprise Desktop 10 SP4 (x86_64) [New Version: 3.13.6 and 4.9.2]: firefox3-cairo-32bit-1.2.4-0.8.1 mozilla-nspr-32bit-4.9.2-0.9.1 mozilla-nss-32bit-3.13.6-0.8.1 - SUSE Linux Enterprise Desktop 10 SP4 (i586) [New Version: 7]: MozillaFirefox-10.0.7-0.5.1 MozillaFirefox-branding-SLED-7-0.8.31 MozillaFirefox-translations-10.0.7-0.5.1 - SLE SDK 10 SP4 (i586 ia64 ppc s390x x86_64) [New Version: 3.13.6]: firefox3-cairo-devel-1.2.4-0.8.1 firefox3-cairo-doc-1.2.4-0.8.1 mozilla-nss-tools-3.13.6-0.8.1 - SLE SDK 10 SP4 (i586 ia64 ppc s390x): MozillaFirefox-branding-upstream-10.0.7-0.5.1 References: http://support.novell.com/security/cve/CVE-2012-1956.html http://support.novell.com/security/cve/CVE-2012-1970.html http://support.novell.com/security/cve/CVE-2012-1971.html http://support.novell.com/security/cve/CVE-2012-1972.html http://support.novell.com/security/cve/CVE-2012-1973.html http://support.novell.com/security/cve/CVE-2012-1974.html http://support.novell.com/security/cve/CVE-2012-1975.html http://support.novell.com/security/cve/CVE-2012-1976.html http://support.novell.com/security/cve/CVE-2012-3956.html http://support.novell.com/security/cve/CVE-2012-3957.html http://support.novell.com/security/cve/CVE-2012-3958.html http://support.novell.com/security/cve/CVE-2012-3959.html http://support.novell.com/security/cve/CVE-2012-3960.html http://support.novell.com/security/cve/CVE-2012-3961.html http://support.novell.com/security/cve/CVE-2012-3962.html http://support.novell.com/security/cve/CVE-2012-3963.html http://support.novell.com/security/cve/CVE-2012-3964.html http://support.novell.com/security/cve/CVE-2012-3965.html http://support.novell.com/security/cve/CVE-2012-3966.html http://support.novell.com/security/cve/CVE-2012-3967.html http://support.novell.com/security/cve/CVE-2012-3968.html http://support.novell.com/security/cve/CVE-2012-3969.html http://support.novell.com/security/cve/CVE-2012-3970.html http://support.novell.com/security/cve/CVE-2012-3971.html http://support.novell.com/security/cve/CVE-2012-3972.html http://support.novell.com/security/cve/CVE-2012-3973.html http://support.novell.com/security/cve/CVE-2012-3974.html http://support.novell.com/security/cve/CVE-2012-3975.html http://support.novell.com/security/cve/CVE-2012-3976.html http://support.novell.com/security/cve/CVE-2012-3978.html http://support.novell.com/security/cve/CVE-2012-3979.html http://support.novell.com/security/cve/CVE-2012-3980.html https://bugzilla.novell.com/684069 https://bugzilla.novell.com/769762 https://bugzilla.novell.com/777588 http://download.novell.com/patch/finder/?keywords=3d961c9ba7250844680b24832… -- To unsubscribe, e-mail: opensuse-security-announce+unsubscribe(a)opensuse.org For additional commands, e-mail: opensuse-security-announce+help(a)opensuse.org

1 0

[security-announce] SUSE-SU-2012:1156-2: important: Security update for PHP5
by opensuse-security＠opensuse.org 14 Sep '12

14 Sep '12

SUSE Security Update: Security update for PHP5 ______________________________________________________________________________ Announcement ID: SUSE-SU-2012:1156-2 Rating: important References: #775852 #778003 Cross-References: CVE-2011-1398 CVE-2011-4388 Affected Products: SUSE Linux Enterprise Software Development Kit 11 SP2 SUSE Linux Enterprise Server 11 SP2 for VMware SUSE Linux Enterprise Server 11 SP2 ______________________________________________________________________________ An update that fixes two vulnerabilities is now available. Description: This update fixes CVE-2011-1398 and CVE-2011-4388 (header injection via CR). This update also changes the default configuration to use FilesMatch with 'SetHandler' rather than 'AddHandler' to protect weakly written web applications from content confusion. Since this is a hardening measure, no CVE was assigned. Security Issue references: * CVE-2011-1398 <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2011-1398 > * CVE-2011-4388 <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2011-4388 > Patch Instructions: To install this SUSE Security Update use YaST online_update. Alternatively you can run the command listed for your product: - SUSE Linux Enterprise Software Development Kit 11 SP2: zypper in -t patch sdksp2-apache2-mod_php5-6777 - SUSE Linux Enterprise Server 11 SP2 for VMware: zypper in -t patch slessp2-apache2-mod_php5-6777 - SUSE Linux Enterprise Server 11 SP2: zypper in -t patch slessp2-apache2-mod_php5-6777 To bring your system up-to-date, use "zypper patch". Package List: - SUSE Linux Enterprise Software Development Kit 11 SP2 (i586 ia64 ppc64 s390x x86_64): php5-devel-5.2.14-0.7.30.46.1 php5-imap-5.2.14-0.7.30.46.1 php5-ncurses-5.2.14-0.7.30.46.1 php5-posix-5.2.14-0.7.30.46.1 php5-readline-5.2.14-0.7.30.46.1 php5-sockets-5.2.14-0.7.30.46.1 php5-sqlite-5.2.14-0.7.30.46.1 php5-tidy-5.2.14-0.7.30.46.1 - SUSE Linux Enterprise Software Development Kit 11 SP2 (i586 x86_64): apache2-mod_php5-5.2.14-0.7.30.46.1 php5-5.2.14-0.7.30.46.1 php5-bcmath-5.2.14-0.7.30.46.1 php5-bz2-5.2.14-0.7.30.46.1 php5-calendar-5.2.14-0.7.30.46.1 php5-ctype-5.2.14-0.7.30.46.1 php5-curl-5.2.14-0.7.30.46.1 php5-dba-5.2.14-0.7.30.46.1 php5-dbase-5.2.14-0.7.30.46.1 php5-dom-5.2.14-0.7.30.46.1 php5-exif-5.2.14-0.7.30.46.1 php5-fastcgi-5.2.14-0.7.30.46.1 php5-ftp-5.2.14-0.7.30.46.1 php5-gd-5.2.14-0.7.30.46.1 php5-gettext-5.2.14-0.7.30.46.1 php5-gmp-5.2.14-0.7.30.46.1 php5-hash-5.2.14-0.7.30.46.1 php5-iconv-5.2.14-0.7.30.46.1 php5-json-5.2.14-0.7.30.46.1 php5-ldap-5.2.14-0.7.30.46.1 php5-mbstring-5.2.14-0.7.30.46.1 php5-mcrypt-5.2.14-0.7.30.46.1 php5-mysql-5.2.14-0.7.30.46.1 php5-odbc-5.2.14-0.7.30.46.1 php5-openssl-5.2.14-0.7.30.46.1 php5-pcntl-5.2.14-0.7.30.46.1 php5-pdo-5.2.14-0.7.30.46.1 php5-pear-5.2.14-0.7.30.46.1 php5-pgsql-5.2.14-0.7.30.46.1 php5-pspell-5.2.14-0.7.30.46.1 php5-shmop-5.2.14-0.7.30.46.1 php5-snmp-5.2.14-0.7.30.46.1 php5-soap-5.2.14-0.7.30.46.1 php5-suhosin-5.2.14-0.7.30.46.1 php5-sysvmsg-5.2.14-0.7.30.46.1 php5-sysvsem-5.2.14-0.7.30.46.1 php5-sysvshm-5.2.14-0.7.30.46.1 php5-tokenizer-5.2.14-0.7.30.46.1 php5-wddx-5.2.14-0.7.30.46.1 php5-xmlreader-5.2.14-0.7.30.46.1 php5-xmlrpc-5.2.14-0.7.30.46.1 php5-xmlwriter-5.2.14-0.7.30.46.1 php5-xsl-5.2.14-0.7.30.46.1 php5-zip-5.2.14-0.7.30.46.1 php5-zlib-5.2.14-0.7.30.46.1 - SUSE Linux Enterprise Server 11 SP2 for VMware (i586 x86_64): apache2-mod_php5-5.2.14-0.7.30.46.1 php5-5.2.14-0.7.30.46.1 php5-bcmath-5.2.14-0.7.30.46.1 php5-bz2-5.2.14-0.7.30.46.1 php5-calendar-5.2.14-0.7.30.46.1 php5-ctype-5.2.14-0.7.30.46.1 php5-curl-5.2.14-0.7.30.46.1 php5-dba-5.2.14-0.7.30.46.1 php5-dbase-5.2.14-0.7.30.46.1 php5-dom-5.2.14-0.7.30.46.1 php5-exif-5.2.14-0.7.30.46.1 php5-fastcgi-5.2.14-0.7.30.46.1 php5-ftp-5.2.14-0.7.30.46.1 php5-gd-5.2.14-0.7.30.46.1 php5-gettext-5.2.14-0.7.30.46.1 php5-gmp-5.2.14-0.7.30.46.1 php5-hash-5.2.14-0.7.30.46.1 php5-iconv-5.2.14-0.7.30.46.1 php5-json-5.2.14-0.7.30.46.1 php5-ldap-5.2.14-0.7.30.46.1 php5-mbstring-5.2.14-0.7.30.46.1 php5-mcrypt-5.2.14-0.7.30.46.1 php5-mysql-5.2.14-0.7.30.46.1 php5-odbc-5.2.14-0.7.30.46.1 php5-openssl-5.2.14-0.7.30.46.1 php5-pcntl-5.2.14-0.7.30.46.1 php5-pdo-5.2.14-0.7.30.46.1 php5-pear-5.2.14-0.7.30.46.1 php5-pgsql-5.2.14-0.7.30.46.1 php5-pspell-5.2.14-0.7.30.46.1 php5-shmop-5.2.14-0.7.30.46.1 php5-snmp-5.2.14-0.7.30.46.1 php5-soap-5.2.14-0.7.30.46.1 php5-suhosin-5.2.14-0.7.30.46.1 php5-sysvmsg-5.2.14-0.7.30.46.1 php5-sysvsem-5.2.14-0.7.30.46.1 php5-sysvshm-5.2.14-0.7.30.46.1 php5-tokenizer-5.2.14-0.7.30.46.1 php5-wddx-5.2.14-0.7.30.46.1 php5-xmlreader-5.2.14-0.7.30.46.1 php5-xmlrpc-5.2.14-0.7.30.46.1 php5-xmlwriter-5.2.14-0.7.30.46.1 php5-xsl-5.2.14-0.7.30.46.1 php5-zip-5.2.14-0.7.30.46.1 php5-zlib-5.2.14-0.7.30.46.1 - SUSE Linux Enterprise Server 11 SP2 (i586 ia64 ppc64 s390x x86_64): apache2-mod_php5-5.2.14-0.7.30.46.1 php5-5.2.14-0.7.30.46.1 php5-bcmath-5.2.14-0.7.30.46.1 php5-bz2-5.2.14-0.7.30.46.1 php5-calendar-5.2.14-0.7.30.46.1 php5-ctype-5.2.14-0.7.30.46.1 php5-curl-5.2.14-0.7.30.46.1 php5-dba-5.2.14-0.7.30.46.1 php5-dbase-5.2.14-0.7.30.46.1 php5-dom-5.2.14-0.7.30.46.1 php5-exif-5.2.14-0.7.30.46.1 php5-fastcgi-5.2.14-0.7.30.46.1 php5-ftp-5.2.14-0.7.30.46.1 php5-gd-5.2.14-0.7.30.46.1 php5-gettext-5.2.14-0.7.30.46.1 php5-gmp-5.2.14-0.7.30.46.1 php5-hash-5.2.14-0.7.30.46.1 php5-iconv-5.2.14-0.7.30.46.1 php5-json-5.2.14-0.7.30.46.1 php5-ldap-5.2.14-0.7.30.46.1 php5-mbstring-5.2.14-0.7.30.46.1 php5-mcrypt-5.2.14-0.7.30.46.1 php5-mysql-5.2.14-0.7.30.46.1 php5-odbc-5.2.14-0.7.30.46.1 php5-openssl-5.2.14-0.7.30.46.1 php5-pcntl-5.2.14-0.7.30.46.1 php5-pdo-5.2.14-0.7.30.46.1 php5-pear-5.2.14-0.7.30.46.1 php5-pgsql-5.2.14-0.7.30.46.1 php5-pspell-5.2.14-0.7.30.46.1 php5-shmop-5.2.14-0.7.30.46.1 php5-snmp-5.2.14-0.7.30.46.1 php5-soap-5.2.14-0.7.30.46.1 php5-suhosin-5.2.14-0.7.30.46.1 php5-sysvmsg-5.2.14-0.7.30.46.1 php5-sysvsem-5.2.14-0.7.30.46.1 php5-sysvshm-5.2.14-0.7.30.46.1 php5-tokenizer-5.2.14-0.7.30.46.1 php5-wddx-5.2.14-0.7.30.46.1 php5-xmlreader-5.2.14-0.7.30.46.1 php5-xmlrpc-5.2.14-0.7.30.46.1 php5-xmlwriter-5.2.14-0.7.30.46.1 php5-xsl-5.2.14-0.7.30.46.1 php5-zip-5.2.14-0.7.30.46.1 php5-zlib-5.2.14-0.7.30.46.1 References: http://support.novell.com/security/cve/CVE-2011-1398.html http://support.novell.com/security/cve/CVE-2011-4388.html https://bugzilla.novell.com/775852 https://bugzilla.novell.com/778003 http://download.novell.com/patch/finder/?keywords=0759510e67ebbcbf558fe4298… -- To unsubscribe, e-mail: opensuse-security-announce+unsubscribe(a)opensuse.org For additional commands, e-mail: opensuse-security-announce+help(a)opensuse.org

1 0

[security-announce] SUSE-SU-2012:1162-1: important: Security update for Xen
by opensuse-security＠opensuse.org 13 Sep '12

13 Sep '12

SUSE Security Update: Security update for Xen ______________________________________________________________________________ Announcement ID: SUSE-SU-2012:1162-1 Rating: important References: #776995 #777084 #777090 #777091 Cross-References: CVE-2012-3494 CVE-2012-3496 CVE-2012-3515 Affected Products: SUSE Linux Enterprise Server 11 SP1 LTSS ______________________________________________________________________________ An update that solves three vulnerabilities and has one errata is now available. Description: XEN was updated to fix multiple bugs and security issues. The following security issues have been fixed: * CVE-2012-3494: xen: hypercall set_debugreg vulnerability (XSA-12) * CVE-2012-3496: xen: XENMEM_populate_physmap DoS vulnerability (XSA-14) * CVE-2012-3515: xen: Qemu VT100 emulation vulnerability (XSA-17) Also the following bugs have been fixed: * pvscsi support of attaching Luns - bnc#776995 Security Issue references: * CVE-2012-3496 <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2012-3496 > * CVE-2012-3494 <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2012-3494 > * CVE-2012-3515 <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2012-3515 > Indications: Everyone using XEN should update. Patch Instructions: To install this SUSE Security Update use YaST online_update. Alternatively you can run the command listed for your product: - SUSE Linux Enterprise Server 11 SP1 LTSS: zypper in -t patch slessp1-xen-201209-6746 To bring your system up-to-date, use "zypper patch". Package List: - SUSE Linux Enterprise Server 11 SP1 LTSS (i586 x86_64): xen-4.0.3_21548_10-0.5.1 xen-doc-html-4.0.3_21548_10-0.5.1 xen-doc-pdf-4.0.3_21548_10-0.5.1 xen-kmp-default-4.0.3_21548_10_2.6.32.59_0.7-0.5.1 xen-kmp-trace-4.0.3_21548_10_2.6.32.59_0.7-0.5.1 xen-libs-4.0.3_21548_10-0.5.1 xen-tools-4.0.3_21548_10-0.5.1 xen-tools-domU-4.0.3_21548_10-0.5.1 - SUSE Linux Enterprise Server 11 SP1 LTSS (i586): xen-kmp-pae-4.0.3_21548_10_2.6.32.59_0.7-0.5.1 References: http://support.novell.com/security/cve/CVE-2012-3494.html http://support.novell.com/security/cve/CVE-2012-3496.html http://support.novell.com/security/cve/CVE-2012-3515.html https://bugzilla.novell.com/776995 https://bugzilla.novell.com/777084 https://bugzilla.novell.com/777090 https://bugzilla.novell.com/777091 http://download.novell.com/patch/finder/?keywords=60ffb0200ab44cd2c5b21cf2c… -- To unsubscribe, e-mail: opensuse-security-announce+unsubscribe(a)opensuse.org For additional commands, e-mail: opensuse-security-announce+help(a)opensuse.org

1 0

[security-announce] SUSE-SU-2012:1157-1: important: Security update for Mozilla Firefox
by opensuse-security＠opensuse.org 12 Sep '12

12 Sep '12

SUSE Security Update: Security update for Mozilla Firefox ______________________________________________________________________________ Announcement ID: SUSE-SU-2012:1157-1 Rating: important References: #777588 Affected Products: SUSE Linux Enterprise Software Development Kit 11 SP2 SUSE Linux Enterprise Server 11 SP2 for VMware SUSE Linux Enterprise Server 11 SP2 SUSE Linux Enterprise Desktop 11 SP2 ______________________________________________________________________________ An update that contains security fixes can now be installed. It includes three new package versions. Description: MozillaFirefox was updated to 10.0.7ESR release, fixing a lot of bugs and security problems. The following security issues have been addressed: * MFSA 2012-57: Mozilla developers identified and fixed several memory safety bugs in the browser engine used in Firefox and other Mozilla-based products. Some of these bugs showed evidence of memory corruption under certain circumstances, and we presume that with enough effort at least some of these could be exploited to run arbitrary code. In general these flaws cannot be exploited through email in the Thunderbird and SeaMonkey products because scripting is disabled, but are potentially a risk in browser or browser-like contexts in those products. * CVE-2012-1971: Gary Kwong, Christian Holler, Jesse Ruderman, Steve Fink, Bob Clary, Andrew Sutherland, and Jason Smith reported memory safety problems and crashes that affect Firefox 14. * CVE-2012-1970: Gary Kwong, Christian Holler, Jesse Ruderman, John Schoenick, Vladimir Vukicevic and Daniel Holbert reported memory safety problems and crashes that affect Firefox ESR 10 and Firefox 14. * MFSA 2012-58: Security researcher Abhishek Arya (Inferno) of Google Chrome Security Team discovered a series of use-after-free issues using the Address Sanitizer tool. Many of these issues are potentially exploitable, allowing for remote code execution. o Heap-use-after-free in nsHTMLEditor::CollapseAdjacentTextNodes CVE-2012-1972 o Heap-use-after-free in nsObjectLoadingContent::LoadObject CVE-2012-1973 o Heap-use-after-free in gfxTextRun::CanBreakLineBefore CVE-2012-1974 o Heap-use-after-free in PresShell::CompleteMove CVE-2012-1975 o Heap-use-after-free in nsHTMLSelectElement::SubmitNamesValues CVE-2012-1976 o Heap-use-after-free in MediaStreamGraphThreadRunnable::Run() CVE-2012-3956 o Heap-buffer-overflow in nsBlockFrame::MarkLineDirty CVE-2012-3957 o Heap-use-after-free in nsHTMLEditRules::DeleteNonTableElements CVE-2012-3958 o Heap-use-after-free in nsRangeUpdater::SelAdjDeleteNode CVE-2012-3959 o Heap-use-after-free in mozSpellChecker::SetCurrentDictionary CVE-2012-3960 o Heap-use-after-free in RangeData::~RangeData CVE-2012-3961 o Bad iterator in text runs CVE-2012-3962 o use after free in js::gc::MapAllocToTraceKind CVE-2012-3963 o Heap-use-after-free READ 8 in gfxTextRun::GetUserData CVE-2012-3964 * MFSA 2012-59 / CVE-2012-1956: Security researcher Mariusz Mlynski reported that it is possible to shadow the location object using Object.defineProperty. This could be used to confuse the current location to plugins, allowing for possible cross-site scripting (XSS) attacks. * MFSA 2012-60 / CVE-2012-3965: Security researcher Mariusz Mlynski reported that when a page opens a new tab, a subsequent window can then be opened that can be navigated to about:newtab, a chrome privileged page. Once about:newtab is loaded, the special context can potentially be used to escalate privilege, allowing for arbitrary code execution on the local system in a maliciously crafted attack. * MFSA 2012-61 / CVE-2012-3966: Security researcher Frederic Hoguin reported two related issues with the decoding of bitmap (.BMP) format images embedded in icon (.ICO) format files. When processing a negative "height" header value for the bitmap image, a memory corruption can be induced, allowing an attacker to write random memory and cause a crash. This crash may be potentially exploitable. * MFSA 2012-62: Security researcher miaubiz used the Address Sanitizer tool to discover two WebGL issues. The first issue is a use-after-free when WebGL shaders are called after being destroyed. The second issue exposes a problem with Mesa drivers on Linux, leading to a potentially exploitable crash. o use after free, webgl fragment shader deleted by accessor CVE-2012-3968 o stack scribbling with 4-byte values choosable among a few values, when using more than 16 sampler uniforms, on Mesa, with all drivers CVE-2012-3967 * MFSA 2012-63: Security researcher Arthur Gerkis used the Address Sanitizer tool to find two issues involving Scalable Vector Graphics (SVG) files. The first issue is a buffer overflow in Gecko's SVG filter code when the sum of two values is too large to be stored as a signed 32-bit integer, causing the function to write past the end of an array. The second issue is a use-after-free when an element with a "requiredFeatures" attribute is moved between documents. In that situation, the internal representation of the "requiredFeatures" value could be freed prematurely. Both issues are potentially exploitable. o Heap-buffer-overflow in nsSVGFEMorphologyElement::Filter CVE-2012-3969 o Heap-use-after-free in nsTArray_base::Length() CVE-2012-3970 * MFSA 2012-64 / CVE-2012-3971: Using the Address Sanitizer tool, Mozilla security researcher Christoph Diehl discovered two memory corruption issues involving the Graphite 2 library used in Mozilla products. Both of these issues can cause a potentially exploitable crash. These problems were fixed in the Graphite 2 library, which has been updated for Mozilla products. * MFSA 2012-65 / CVE-2012-3972: Security research Nicolas Gregoire used the Address Sanitizer tool to discover an out-of-bounds read in the format-number feature of XSLT, which can cause inaccurate formatting of numbers and information leakage. This is not directly exploitable. * MFSA 2012-66 / CVE-2012-3973: Mozilla security researcher Mark Goodwin discovered an issue with the Firefox developer tools' debugger. If remote debugging is disabled, but the experimental HTTPMonitor extension has been installed and enabled, a remote user can connect to and use the remote debugging service through the port used by HTTPMonitor. A remote-enabled flag has been added to resolve this problem and close the port unless debugging is explicitly enabled. * MFSA 2012-67 / CVE-2012-3974: Security researcher Masato Kinugawa reported that if a crafted executable is placed in the root partition on a Windows file system, the Firefox and Thunderbird installer will launch this program after a standard installation instead of Firefox or Thunderbird, running this program with the user's privileges. * MFSA 2012-68 / CVE-2012-3975: Security researcher vsemozhetbyt reported that when the DOMParser is used to parse text/html data in a Firefox extension, linked resources within this HTML data will be loaded. If the data being parsed in the extension is untrusted, it could lead to information leakage and can potentially be combined with other attacks to become exploitable. * MFSA 2012-69 / CVE-2012-3976: Security researcher Mark Poticha reported an issue where incorrect SSL certificate information can be displayed on the addressbar, showing the SSL data for a previous site while another has been loaded. This is caused by two onLocationChange events being fired out of the expected order, leading to the displayed certificate data to not be updated. This can be used for phishing attacks by allowing the user to input form or other data on a newer, attacking, site while the credentials of an older site appear on the addressbar. * MFSA 2012-70 / CVE-2012-3978: Mozilla security researcher moz_bug_r_a4 reported that certain security checks in the location object can be bypassed if chrome code is called content in a specific manner. This allowed for the loading of restricted content. This can be combined with other issues to become potentially exploitable. * MFSA 2012-71 / CVE-2012-3979: Mozilla developer Blake Kaplan reported that __android_log_print is called insecurely in places. If a malicious web page used a dump() statement with a specially crafted string, it can trigger a potentially exploitable crash. This vulnerability only affects Firefox for Android. * MFSA 2012-72 / CVE-2012-3980: Security researcher Colby Russell discovered that eval in the web console can execute injected code with chrome privileges, leading to the running of malicious code in a privileged context. This allows for arbitrary code execution through a malicious web page if the web console is invoked by the user. Indications: Please install this update. Patch Instructions: To install this SUSE Security Update use YaST online_update. Alternatively you can run the command listed for your product: - SUSE Linux Enterprise Software Development Kit 11 SP2: zypper in -t patch sdksp2-firefox-201208-6763 - SUSE Linux Enterprise Server 11 SP2 for VMware: zypper in -t patch slessp2-firefox-201208-6763 - SUSE Linux Enterprise Server 11 SP2: zypper in -t patch slessp2-firefox-201208-6763 - SUSE Linux Enterprise Desktop 11 SP2: zypper in -t patch sledsp2-firefox-201208-6763 To bring your system up-to-date, use "zypper patch". Package List: - SUSE Linux Enterprise Software Development Kit 11 SP2 (i586 ia64 ppc64 s390x x86_64) [New Version: 3.13.6 and 4.9.2]: mozilla-nspr-devel-4.9.2-0.6.1 mozilla-nss-devel-3.13.6-0.5.1 - SUSE Linux Enterprise Server 11 SP2 for VMware (i586 x86_64) [New Version: 10.0.7,3.13.6 and 4.9.2]: MozillaFirefox-10.0.7-0.3.1 MozillaFirefox-translations-10.0.7-0.3.1 libfreebl3-3.13.6-0.5.1 mozilla-nspr-4.9.2-0.6.1 mozilla-nss-3.13.6-0.5.1 mozilla-nss-tools-3.13.6-0.5.1 - SUSE Linux Enterprise Server 11 SP2 for VMware (x86_64) [New Version: 3.13.6 and 4.9.2]: libfreebl3-32bit-3.13.6-0.5.1 mozilla-nspr-32bit-4.9.2-0.6.1 mozilla-nss-32bit-3.13.6-0.5.1 - SUSE Linux Enterprise Server 11 SP2 (i586 ia64 ppc64 s390x x86_64) [New Version: 10.0.7,3.13.6 and 4.9.2]: MozillaFirefox-10.0.7-0.3.1 MozillaFirefox-branding-SLED-7-0.6.7.80 MozillaFirefox-translations-10.0.7-0.3.1 libfreebl3-3.13.6-0.5.1 mozilla-nspr-4.9.2-0.6.1 mozilla-nss-3.13.6-0.5.1 mozilla-nss-tools-3.13.6-0.5.1 - SUSE Linux Enterprise Server 11 SP2 (ppc64 s390x x86_64) [New Version: 3.13.6 and 4.9.2]: libfreebl3-32bit-3.13.6-0.5.1 mozilla-nspr-32bit-4.9.2-0.6.1 mozilla-nss-32bit-3.13.6-0.5.1 - SUSE Linux Enterprise Server 11 SP2 (ia64) [New Version: 3.13.6 and 4.9.2]: libfreebl3-x86-3.13.6-0.5.1 mozilla-nspr-x86-4.9.2-0.6.1 mozilla-nss-x86-3.13.6-0.5.1 - SUSE Linux Enterprise Desktop 11 SP2 (i586 x86_64) [New Version: 10.0.7,3.13.6 and 4.9.2]: MozillaFirefox-10.0.7-0.3.1 MozillaFirefox-branding-SLED-7-0.6.7.80 MozillaFirefox-translations-10.0.7-0.3.1 libfreebl3-3.13.6-0.5.1 mozilla-nspr-4.9.2-0.6.1 mozilla-nss-3.13.6-0.5.1 mozilla-nss-tools-3.13.6-0.5.1 - SUSE Linux Enterprise Desktop 11 SP2 (x86_64) [New Version: 3.13.6 and 4.9.2]: libfreebl3-32bit-3.13.6-0.5.1 mozilla-nspr-32bit-4.9.2-0.6.1 mozilla-nss-32bit-3.13.6-0.5.1 References: https://bugzilla.novell.com/777588 http://download.novell.com/patch/finder/?keywords=eb74965ce2354d47597681ee9… -- To unsubscribe, e-mail: opensuse-security-announce+unsubscribe(a)opensuse.org For additional commands, e-mail: opensuse-security-announce+help(a)opensuse.org

1 0

[security-announce] SUSE-SU-2012:1156-1: important: Security update for PHP5
by opensuse-security＠opensuse.org 12 Sep '12

12 Sep '12

SUSE Security Update: Security update for PHP5 ______________________________________________________________________________ Announcement ID: SUSE-SU-2012:1156-1 Rating: important References: #775852 #778003 Cross-References: CVE-2011-1398 CVE-2011-4388 Affected Products: SUSE Linux Enterprise Software Development Kit 11 SP2 SUSE Linux Enterprise Server 11 SP2 for VMware SUSE Linux Enterprise Server 11 SP2 ______________________________________________________________________________ An update that fixes two vulnerabilities is now available. Description: This update fixes CVE-2011-1398 and CVE-2011-4388 (header injection via CR). This update also changes the default configuration to use FilesMatch with 'SetHandler' rather than 'AddHandler' to protect weakly written web applications from content confusion. Since this is a hardening measure, no CVE was assigned. Security Issue references: * CVE-2011-1398 <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2011-1398 > * CVE-2011-4388 <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2011-4388 > Patch Instructions: To install this SUSE Security Update use YaST online_update. Alternatively you can run the command listed for your product: - SUSE Linux Enterprise Software Development Kit 11 SP2: zypper in -t patch sdksp2-apache2-mod_php53-6778 - SUSE Linux Enterprise Server 11 SP2 for VMware: zypper in -t patch slessp2-apache2-mod_php53-6778 - SUSE Linux Enterprise Server 11 SP2: zypper in -t patch slessp2-apache2-mod_php53-6778 To bring your system up-to-date, use "zypper patch". Package List: - SUSE Linux Enterprise Software Development Kit 11 SP2 (i586 ia64 ppc64 s390x x86_64): php53-devel-5.3.8-0.39.1 php53-imap-5.3.8-0.39.1 php53-posix-5.3.8-0.39.1 php53-readline-5.3.8-0.39.1 php53-sockets-5.3.8-0.39.1 php53-sqlite-5.3.8-0.39.1 php53-tidy-5.3.8-0.39.1 - SUSE Linux Enterprise Server 11 SP2 for VMware (i586 x86_64): apache2-mod_php53-5.3.8-0.39.1 php53-5.3.8-0.39.1 php53-bcmath-5.3.8-0.39.1 php53-bz2-5.3.8-0.39.1 php53-calendar-5.3.8-0.39.1 php53-ctype-5.3.8-0.39.1 php53-curl-5.3.8-0.39.1 php53-dba-5.3.8-0.39.1 php53-dom-5.3.8-0.39.1 php53-exif-5.3.8-0.39.1 php53-fastcgi-5.3.8-0.39.1 php53-fileinfo-5.3.8-0.39.1 php53-ftp-5.3.8-0.39.1 php53-gd-5.3.8-0.39.1 php53-gettext-5.3.8-0.39.1 php53-gmp-5.3.8-0.39.1 php53-iconv-5.3.8-0.39.1 php53-intl-5.3.8-0.39.1 php53-json-5.3.8-0.39.1 php53-ldap-5.3.8-0.39.1 php53-mbstring-5.3.8-0.39.1 php53-mcrypt-5.3.8-0.39.1 php53-mysql-5.3.8-0.39.1 php53-odbc-5.3.8-0.39.1 php53-openssl-5.3.8-0.39.1 php53-pcntl-5.3.8-0.39.1 php53-pdo-5.3.8-0.39.1 php53-pear-5.3.8-0.39.1 php53-pgsql-5.3.8-0.39.1 php53-pspell-5.3.8-0.39.1 php53-shmop-5.3.8-0.39.1 php53-snmp-5.3.8-0.39.1 php53-soap-5.3.8-0.39.1 php53-suhosin-5.3.8-0.39.1 php53-sysvmsg-5.3.8-0.39.1 php53-sysvsem-5.3.8-0.39.1 php53-sysvshm-5.3.8-0.39.1 php53-tokenizer-5.3.8-0.39.1 php53-wddx-5.3.8-0.39.1 php53-xmlreader-5.3.8-0.39.1 php53-xmlrpc-5.3.8-0.39.1 php53-xmlwriter-5.3.8-0.39.1 php53-xsl-5.3.8-0.39.1 php53-zip-5.3.8-0.39.1 php53-zlib-5.3.8-0.39.1 - SUSE Linux Enterprise Server 11 SP2 (i586 ia64 ppc64 s390x x86_64): apache2-mod_php53-5.3.8-0.39.1 php53-5.3.8-0.39.1 php53-bcmath-5.3.8-0.39.1 php53-bz2-5.3.8-0.39.1 php53-calendar-5.3.8-0.39.1 php53-ctype-5.3.8-0.39.1 php53-curl-5.3.8-0.39.1 php53-dba-5.3.8-0.39.1 php53-dom-5.3.8-0.39.1 php53-exif-5.3.8-0.39.1 php53-fastcgi-5.3.8-0.39.1 php53-fileinfo-5.3.8-0.39.1 php53-ftp-5.3.8-0.39.1 php53-gd-5.3.8-0.39.1 php53-gettext-5.3.8-0.39.1 php53-gmp-5.3.8-0.39.1 php53-iconv-5.3.8-0.39.1 php53-intl-5.3.8-0.39.1 php53-json-5.3.8-0.39.1 php53-ldap-5.3.8-0.39.1 php53-mbstring-5.3.8-0.39.1 php53-mcrypt-5.3.8-0.39.1 php53-mysql-5.3.8-0.39.1 php53-odbc-5.3.8-0.39.1 php53-openssl-5.3.8-0.39.1 php53-pcntl-5.3.8-0.39.1 php53-pdo-5.3.8-0.39.1 php53-pear-5.3.8-0.39.1 php53-pgsql-5.3.8-0.39.1 php53-pspell-5.3.8-0.39.1 php53-shmop-5.3.8-0.39.1 php53-snmp-5.3.8-0.39.1 php53-soap-5.3.8-0.39.1 php53-suhosin-5.3.8-0.39.1 php53-sysvmsg-5.3.8-0.39.1 php53-sysvsem-5.3.8-0.39.1 php53-sysvshm-5.3.8-0.39.1 php53-tokenizer-5.3.8-0.39.1 php53-wddx-5.3.8-0.39.1 php53-xmlreader-5.3.8-0.39.1 php53-xmlrpc-5.3.8-0.39.1 php53-xmlwriter-5.3.8-0.39.1 php53-xsl-5.3.8-0.39.1 php53-zip-5.3.8-0.39.1 php53-zlib-5.3.8-0.39.1 References: http://support.novell.com/security/cve/CVE-2011-1398.html http://support.novell.com/security/cve/CVE-2011-4388.html https://bugzilla.novell.com/775852 https://bugzilla.novell.com/778003 http://download.novell.com/patch/finder/?keywords=196b574ae446447dd55893656… -- To unsubscribe, e-mail: opensuse-security-announce+unsubscribe(a)opensuse.org For additional commands, e-mail: opensuse-security-announce+help(a)opensuse.org

1 0

[security-announce] SUSE-SU-2012:1155-1: important: Security update for dbus-1
by opensuse-security＠opensuse.org 12 Sep '12

12 Sep '12

SUSE Security Update: Security update for dbus-1 ______________________________________________________________________________ Announcement ID: SUSE-SU-2012:1155-1 Rating: important References: #697105 #764047 Affected Products: SUSE Linux Enterprise Software Development Kit 11 SP2 SUSE Linux Enterprise Server 11 SP2 for VMware SUSE Linux Enterprise Server 11 SP2 SUSE Linux Enterprise Desktop 11 SP2 ______________________________________________________________________________ An update that contains security fixes can now be installed. Description: This update fixes a vulnerability in the DBUS auto-launching feature that allowed local users to execute arbitrary programs as root. CVE-2012-3524 has been assigned to this issue. Patch Instructions: To install this SUSE Security Update use YaST online_update. Alternatively you can run the command listed for your product: - SUSE Linux Enterprise Software Development Kit 11 SP2: zypper in -t patch sdksp2-dbus-1-6733 - SUSE Linux Enterprise Server 11 SP2 for VMware: zypper in -t patch slessp2-dbus-1-6733 - SUSE Linux Enterprise Server 11 SP2: zypper in -t patch slessp2-dbus-1-6733 - SUSE Linux Enterprise Desktop 11 SP2: zypper in -t patch sledsp2-dbus-1-6733 To bring your system up-to-date, use "zypper patch". Package List: - SUSE Linux Enterprise Software Development Kit 11 SP2 (i586 ia64 ppc64 s390x x86_64): dbus-1-devel-1.2.10-3.25.1 dbus-1-devel-doc-1.2.10-3.25.1 - SUSE Linux Enterprise Server 11 SP2 for VMware (i586 x86_64): dbus-1-1.2.10-3.25.1 dbus-1-x11-1.2.10-3.25.1 - SUSE Linux Enterprise Server 11 SP2 for VMware (x86_64): dbus-1-32bit-1.2.10-3.25.1 - SUSE Linux Enterprise Server 11 SP2 (i586 ia64 ppc64 s390x x86_64): dbus-1-1.2.10-3.25.1 dbus-1-x11-1.2.10-3.25.1 - SUSE Linux Enterprise Server 11 SP2 (ppc64 s390x x86_64): dbus-1-32bit-1.2.10-3.25.1 - SUSE Linux Enterprise Server 11 SP2 (ia64): dbus-1-x86-1.2.10-3.25.1 - SUSE Linux Enterprise Desktop 11 SP2 (i586 x86_64): dbus-1-1.2.10-3.25.1 dbus-1-x11-1.2.10-3.25.1 - SUSE Linux Enterprise Desktop 11 SP2 (x86_64): dbus-1-32bit-1.2.10-3.25.1 References: https://bugzilla.novell.com/697105 https://bugzilla.novell.com/764047 http://download.novell.com/patch/finder/?keywords=67554744e53055e253dbe3ef2… -- To unsubscribe, e-mail: opensuse-security-announce+unsubscribe(a)opensuse.org For additional commands, e-mail: opensuse-security-announce+help(a)opensuse.org

1 0

[security-announce] openSUSE-SU-2012:1154-1: critical: java-1_7_0-openjdk: security fix for remote exploit
by opensuse-security＠opensuse.org 12 Sep '12

12 Sep '12

openSUSE Security Update: java-1_7_0-openjdk: security fix for remote exploit ______________________________________________________________________________ Announcement ID: openSUSE-SU-2012:1154-1 Rating: critical References: #770040 #777499 Cross-References: CVE-2012-0547 CVE-2012-1682 CVE-2012-3136 CVE-2012-4681 Affected Products: openSUSE 12.2 ______________________________________________________________________________ An update that fixes four vulnerabilities is now available. Description: Java-1_7_0-openjdk was updated to fix a remote exploit (CVE-2012-4681). Also bugfixes were done: - fix build on ARM and i586 - remove files that are no longer used - zero build can be enabled using rpmbuild (osc build) --with zero - add hotspot 2.1 needed for zero - fix filelist on %{ix86} * Security fixes - S7162476, CVE-2012-1682: XMLDecoder security issue via ClassFinder - S7194567, CVE-2012-3136: Improve long term persistence of java.beans objects - S7163201, CVE-2012-0547: Simplify toolkit internals references - RH852051, CVE-2012-4681, S7162473: Reintroduce PackageAccessible checks removed in 6788531. * OpenJDK - Fix Zero FTBFS issues with 2.3 - S7180036: Build failure in Mac platform caused by fix # 7163201 - S7182135: Impossible to use some editors directly - S7183701: [TEST] closed/java/beans/security/TestClassFinder.java – compilation failed - S7185678: java/awt/Menu/NullMenuLabelTest/NullMenuLabelTest.java failed with NPE * Bug fixes - PR1149: Zero-specific patch files not being packaged - use icedtea tarball for build again, this led into following dropped files because the are already in the tarball and simplified %prep and %build - drop class-rewriter.tar.gz - drop systemtap-tapset.tar.gz - drop desktop-files.tar.gz - drop nss.cfg - drop pulseaudio.tar.gz - drop remove-intree-libraries.sh - add archives from icedtea7-forest-2.3 for openjdk, corba, jaxp, jaxws, jdk, langtools and hotspot - drop rhino.patch, pulse-soundproperties and systemtap patch - move gnome bridge patches before make as it's irritating to have the patch fail after openjdk is built - use explicit file attributes in %files sections to prevent the file permissions problems in a future (like bnc#770040) - changed version scheme, so it now matches Oracle Java 1.7.0.6 == Java7 u 6 - update to icedtea-2.3.1 / OpenJDK7 u6 (bnc#777499) * Security fixes - RH852051, CVE-2012-4681: Reintroduce PackageAccessible checks removed in 6788531. * Bug fixes - PR902: PulseAudioClip getMicrosecondsLength() returns length in milliseconds, not microseconds - PR986: IcedTea7 fails to build with IcedTea6 CACAO due to low max heapsize - PR1050: Stream objects not garbage collected - PR1119: Only add classes to rt-source-files.txt if the class (or one or more of its methods/fields) are actually missing from the boot JDK - PR1137: Allow JARs to be optionally compressed by setting COMPRESS_JARS * OpenJDK - Make dynamic support for GConf work again. - PR1095: Add configure option for -Werror - PR1101: Undefined symbols on GNU/Linux SPARC - PR1140: Unnecessary diz files should not be installed - S7192804, PR1138: Build should not install jvisualvm man page for OpenJDK * JamVM - ARMv6 armhf: Changes for Raspbian (Raspberry Pi) - PPC: Don't use lwsync if it isn't supported - X86: Generate machine-dependent stubs for i386 - When suspending, ignore detached threads that have died, this prevents a user caused deadlock when an external thread has been attached to the VM via JNI and it has exited without detaching - Add missing REF_TO_OBJs for references passed from JNI, this enable JamVM to run Qt-Jambi - there are number of fixes in 2.3, see NEWS Patch Instructions: To install this openSUSE Security Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE 12.2: zypper in -t patch openSUSE-2012-592 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE 12.2 (i586 x86_64): java-1_7_0-openjdk-1.7.0.6-3.12.1 java-1_7_0-openjdk-debuginfo-1.7.0.6-3.12.1 java-1_7_0-openjdk-debugsource-1.7.0.6-3.12.1 java-1_7_0-openjdk-demo-1.7.0.6-3.12.1 java-1_7_0-openjdk-demo-debuginfo-1.7.0.6-3.12.1 java-1_7_0-openjdk-devel-1.7.0.6-3.12.1 java-1_7_0-openjdk-devel-debuginfo-1.7.0.6-3.12.1 java-1_7_0-openjdk-javadoc-1.7.0.6-3.12.1 java-1_7_0-openjdk-src-1.7.0.6-3.12.1 References: http://support.novell.com/security/cve/CVE-2012-0547.html http://support.novell.com/security/cve/CVE-2012-1682.html http://support.novell.com/security/cve/CVE-2012-3136.html http://support.novell.com/security/cve/CVE-2012-4681.html https://bugzilla.novell.com/770040 https://bugzilla.novell.com/777499 -- To unsubscribe, e-mail: opensuse-security-announce+unsubscribe(a)opensuse.org For additional commands, e-mail: opensuse-security-announce+help(a)opensuse.org

1 0

[security-announce] SUSE-SU-2012:1149-1: important: Security update for compat-openssl097g
by opensuse-security＠opensuse.org 12 Sep '12

12 Sep '12

SUSE Security Update: Security update for compat-openssl097g ______________________________________________________________________________ Announcement ID: SUSE-SU-2012:1149-1 Rating: important References: #758060 Cross-References: CVE-2012-2110 Affected Products: SUSE Linux Enterprise for SAP Applications 11 SP2 SUSE Linux Enterprise Server 10 SP4 SUSE Linux Enterprise Desktop 11 SP2 SUSE Linux Enterprise Desktop 10 SP4 ______________________________________________________________________________ An update that fixes one vulnerability is now available. Description: This compat-openssl097g rollup update contains various security fixes: * CVE-2012-2131,CVE-2012-2110: incorrect integer conversions in OpenSSL could have resulted in memory corruption during buffer management operations. Security Issue reference: * CVE-2012-2110 <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2012-2110 > Patch Instructions: To install this SUSE Security Update use YaST online_update. Alternatively you can run the command listed for your product: - SUSE Linux Enterprise for SAP Applications 11 SP2: zypper in -t patch slesapp2-compat-openssl097g-6749 - SUSE Linux Enterprise Desktop 11 SP2: zypper in -t patch sledsp2-compat-openssl097g-6749 To bring your system up-to-date, use "zypper patch". Package List: - SUSE Linux Enterprise for SAP Applications 11 SP2 (x86_64): compat-openssl097g-0.9.7g-146.22.1 compat-openssl097g-32bit-0.9.7g-146.22.1 - SUSE Linux Enterprise Server 10 SP4 (i586 ia64 ppc s390x x86_64): compat-openssl097g-0.9.7g-13.23.1 - SUSE Linux Enterprise Server 10 SP4 (s390x x86_64): compat-openssl097g-32bit-0.9.7g-13.23.1 - SUSE Linux Enterprise Server 10 SP4 (ia64): compat-openssl097g-x86-0.9.7g-13.23.1 - SUSE Linux Enterprise Server 10 SP4 (ppc): compat-openssl097g-64bit-0.9.7g-13.23.1 - SUSE Linux Enterprise Desktop 11 SP2 (x86_64): compat-openssl097g-0.9.7g-146.22.1 compat-openssl097g-32bit-0.9.7g-146.22.1 - SUSE Linux Enterprise Desktop 10 SP4 (i586 x86_64): compat-openssl097g-0.9.7g-13.23.1 - SUSE Linux Enterprise Desktop 10 SP4 (x86_64): compat-openssl097g-32bit-0.9.7g-13.23.1 References: http://support.novell.com/security/cve/CVE-2012-2110.html https://bugzilla.novell.com/758060 http://download.novell.com/patch/finder/?keywords=6f04264f0709c1dee29924566… http://download.novell.com/patch/finder/?keywords=acfbe9a056a9163e512e97140… -- To unsubscribe, e-mail: opensuse-security-announce+unsubscribe(a)opensuse.org For additional commands, e-mail: opensuse-security-announce+help(a)opensuse.org

1 0