April 2013 - openSUSE Security Announce

[security-announce] SUSE-SU-2013:0701-2: important: Security update for java-1_6_0-ibm
by opensuse-security＠opensuse.org 23 Apr '13

23 Apr '13

SUSE Security Update: Security update for java-1_6_0-ibm ______________________________________________________________________________ Announcement ID: SUSE-SU-2013:0701-2 Rating: important References: #813939 Affected Products: SUSE Linux Enterprise Software Development Kit 11 SP2 SUSE Linux Enterprise Server 11 SP2 for VMware SUSE Linux Enterprise Server 11 SP2 SUSE Linux Enterprise Server 10 SP4 SUSE Linux Enterprise Java 11 SP2 SUSE Linux Enterprise Java 10 SP4 SUSE Linux Enterprise Desktop 10 SP4 ______________________________________________________________________________ An update that contains security fixes can now be installed. Description: IBM Java 6 was updated to SR13 FP1, fixing bugs and security issues. More information can be found on: http://www.ibm.com/developerworks/java/jdk/alerts/ and on: http://www.ibm.com/developerworks/java/jdk/aix/j664/Java6_64 .fixes.html#SR13FP1 Security issues: - CVE-2013-0485 <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2013-0485 > - CVE-2013-0809 <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2013-0809 > - CVE-2013-1493 <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2013-1493 > - CVE-2013-0169 <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2013-0169 > Patch Instructions: To install this SUSE Security Update use YaST online_update. Alternatively you can run the command listed for your product: - SUSE Linux Enterprise Software Development Kit 11 SP2: zypper in -t patch sdksp2-java-1_6_0-ibm-7627 - SUSE Linux Enterprise Server 11 SP2 for VMware: zypper in -t patch slessp2-java-1_6_0-ibm-7627 - SUSE Linux Enterprise Server 11 SP2: zypper in -t patch slessp2-java-1_6_0-ibm-7627 - SUSE Linux Enterprise Java 11 SP2: zypper in -t patch slejsp2-java-1_6_0-ibm-7627 To bring your system up-to-date, use "zypper patch". Package List: - SUSE Linux Enterprise Software Development Kit 11 SP2 (i586 ppc64 s390x x86_64): java-1_6_0-ibm-devel-1.6.0_sr13.1-0.9.1 - SUSE Linux Enterprise Software Development Kit 11 SP2 (i586 x86_64): java-1_6_0-ibm-1.6.0_sr13.1-0.9.1 java-1_6_0-ibm-fonts-1.6.0_sr13.1-0.9.1 - SUSE Linux Enterprise Server 11 SP2 for VMware (i586 x86_64): java-1_6_0-ibm-1.6.0_sr13.1-0.9.1 java-1_6_0-ibm-fonts-1.6.0_sr13.1-0.9.1 java-1_6_0-ibm-jdbc-1.6.0_sr13.1-0.9.1 java-1_6_0-ibm-plugin-1.6.0_sr13.1-0.9.1 - SUSE Linux Enterprise Server 11 SP2 for VMware (i586): java-1_6_0-ibm-alsa-1.6.0_sr13.1-0.9.1 - SUSE Linux Enterprise Server 11 SP2 (i586 ppc64 s390x x86_64): java-1_6_0-ibm-1.6.0_sr13.1-0.9.1 java-1_6_0-ibm-fonts-1.6.0_sr13.1-0.9.1 java-1_6_0-ibm-jdbc-1.6.0_sr13.1-0.9.1 - SUSE Linux Enterprise Server 11 SP2 (i586 x86_64): java-1_6_0-ibm-plugin-1.6.0_sr13.1-0.9.1 - SUSE Linux Enterprise Server 11 SP2 (i586): java-1_6_0-ibm-alsa-1.6.0_sr13.1-0.9.1 - SUSE Linux Enterprise Server 10 SP4 (i586 ppc s390x x86_64): java-1_5_0-ibm-1.5.0_sr16.1-0.5.1 java-1_5_0-ibm-devel-1.5.0_sr16.1-0.5.1 java-1_5_0-ibm-fonts-1.5.0_sr16.1-0.5.1 java-1_6_0-ibm-1.6.0_sr13.1-0.14.1 java-1_6_0-ibm-devel-1.6.0_sr13.1-0.14.1 java-1_6_0-ibm-fonts-1.6.0_sr13.1-0.14.1 java-1_6_0-ibm-jdbc-1.6.0_sr13.1-0.14.1 - SUSE Linux Enterprise Server 10 SP4 (i586 ppc x86_64): java-1_6_0-ibm-plugin-1.6.0_sr13.1-0.14.1 - SUSE Linux Enterprise Server 10 SP4 (s390x x86_64): java-1_5_0-ibm-32bit-1.5.0_sr16.1-0.5.1 java-1_5_0-ibm-devel-32bit-1.5.0_sr16.1-0.5.1 java-1_6_0-ibm-32bit-1.6.0_sr13.1-0.14.1 java-1_6_0-ibm-devel-32bit-1.6.0_sr13.1-0.14.1 - SUSE Linux Enterprise Server 10 SP4 (i586 ppc): java-1_5_0-ibm-jdbc-1.5.0_sr16.1-0.5.1 java-1_5_0-ibm-plugin-1.5.0_sr16.1-0.5.1 - SUSE Linux Enterprise Server 10 SP4 (x86_64): java-1_5_0-ibm-alsa-32bit-1.5.0_sr16.1-0.5.1 java-1_6_0-ibm-alsa-32bit-1.6.0_sr13.1-0.14.1 java-1_6_0-ibm-plugin-32bit-1.6.0_sr13.1-0.14.1 - SUSE Linux Enterprise Server 10 SP4 (i586): java-1_5_0-ibm-alsa-1.5.0_sr16.1-0.5.1 java-1_6_0-ibm-alsa-1.6.0_sr13.1-0.14.1 - SUSE Linux Enterprise Server 10 SP4 (ppc): java-1_5_0-ibm-64bit-1.5.0_sr16.1-0.5.1 java-1_6_0-ibm-64bit-1.6.0_sr13.1-0.14.1 - SUSE Linux Enterprise Java 11 SP2 (i586 ppc64 s390x x86_64): java-1_6_0-ibm-1.6.0_sr13.1-0.9.1 java-1_6_0-ibm-devel-1.6.0_sr13.1-0.9.1 java-1_6_0-ibm-fonts-1.6.0_sr13.1-0.9.1 java-1_6_0-ibm-jdbc-1.6.0_sr13.1-0.9.1 - SUSE Linux Enterprise Java 11 SP2 (i586 x86_64): java-1_6_0-ibm-plugin-1.6.0_sr13.1-0.9.1 - SUSE Linux Enterprise Java 11 SP2 (i586): java-1_6_0-ibm-alsa-1.6.0_sr13.1-0.9.1 - SUSE Linux Enterprise Java 10 SP4 (i586 ppc s390x x86_64): java-1_5_0-ibm-1.5.0_sr16.1-0.5.1 java-1_5_0-ibm-devel-1.5.0_sr16.1-0.5.1 java-1_5_0-ibm-fonts-1.5.0_sr16.1-0.5.1 - SUSE Linux Enterprise Java 10 SP4 (x86_64): java-1_6_0-ibm-1.6.0_sr13.1-0.14.1 java-1_6_0-ibm-devel-1.6.0_sr13.1-0.14.1 java-1_6_0-ibm-fonts-1.6.0_sr13.1-0.14.1 java-1_6_0-ibm-jdbc-1.6.0_sr13.1-0.14.1 java-1_6_0-ibm-plugin-1.6.0_sr13.1-0.14.1 - SUSE Linux Enterprise Java 10 SP4 (ppc): java-1_5_0-ibm-jdbc-1.5.0_sr16.1-0.5.1 java-1_5_0-ibm-plugin-1.5.0_sr16.1-0.5.1 - SUSE Linux Enterprise Desktop 10 SP4 (i586 x86_64): java-1_5_0-ibm-1.5.0_sr16.1-0.5.1 java-1_5_0-ibm-demo-1.5.0_sr16.1-0.5.1 java-1_5_0-ibm-devel-1.5.0_sr16.1-0.5.1 java-1_5_0-ibm-fonts-1.5.0_sr16.1-0.5.1 java-1_5_0-ibm-src-1.5.0_sr16.1-0.5.1 - SUSE Linux Enterprise Desktop 10 SP4 (x86_64): java-1_5_0-ibm-32bit-1.5.0_sr16.1-0.5.1 java-1_5_0-ibm-alsa-32bit-1.5.0_sr16.1-0.5.1 java-1_5_0-ibm-devel-32bit-1.5.0_sr16.1-0.5.1 - SUSE Linux Enterprise Desktop 10 SP4 (i586): java-1_5_0-ibm-alsa-1.5.0_sr16.1-0.5.1 java-1_5_0-ibm-jdbc-1.5.0_sr16.1-0.5.1 java-1_5_0-ibm-plugin-1.5.0_sr16.1-0.5.1 References: https://bugzilla.novell.com/813939 http://download.novell.com/patch/finder/?keywords=21fefcc00cce0e179e00b2e04… http://download.novell.com/patch/finder/?keywords=5af9a7844c94f8453bb2fcbdd… http://download.novell.com/patch/finder/?keywords=68dff9a90877961ddadf162e0… -- To unsubscribe, e-mail: opensuse-security-announce+unsubscribe(a)opensuse.org For additional commands, e-mail: opensuse-security-announce+help(a)opensuse.org

1 0

[security-announce] SUSE-SU-2013:0633-2: important: Security update for PostgreSQL
by opensuse-security＠opensuse.org 23 Apr '13

23 Apr '13

SUSE Security Update: Security update for PostgreSQL ______________________________________________________________________________ Announcement ID: SUSE-SU-2013:0633-2 Rating: important References: #812525 Cross-References: CVE-2013-1899 CVE-2013-1900 CVE-2013-1901 Affected Products: SUSE Linux Enterprise Server 11 SP1 for VMware LTSS SUSE Linux Enterprise Server 11 SP1 LTSS ______________________________________________________________________________ An update that fixes three vulnerabilities is now available. It includes one version update. Description: This update of PostgreSQL to version 9.1.9 fixes: * CVE-2013-1899: Fix insecure parsing of server command-line switches. * CVE-2013-1900: Reset OpenSSL randomness state in each postmaster child process. * CVE-2013-1901: Make REPLICATION privilege checks test current user not authenticated user. Security Issue references: * CVE-2013-1899 <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2013-1899 > * CVE-2013-1900 <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2013-1900 > * CVE-2013-1901 <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2013-1901 > Patch Instructions: To install this SUSE Security Update use YaST online_update. Alternatively you can run the command listed for your product: - SUSE Linux Enterprise Server 11 SP1 for VMware LTSS: zypper in -t patch slessp1-libecpg6-7601 - SUSE Linux Enterprise Server 11 SP1 LTSS: zypper in -t patch slessp1-libecpg6-7601 To bring your system up-to-date, use "zypper patch". Package List: - SUSE Linux Enterprise Server 11 SP1 for VMware LTSS (i586 x86_64) [New Version: 9.1.9]: libecpg6-9.1.9-0.3.1 libpq5-9.1.9-0.3.1 postgresql91-9.1.9-0.3.1 postgresql91-contrib-9.1.9-0.3.1 postgresql91-docs-9.1.9-0.3.1 postgresql91-server-9.1.9-0.3.1 - SUSE Linux Enterprise Server 11 SP1 for VMware LTSS (x86_64) [New Version: 9.1.9]: libpq5-32bit-9.1.9-0.3.1 - SUSE Linux Enterprise Server 11 SP1 LTSS (i586 s390x x86_64) [New Version: 9.1.9]: libecpg6-9.1.9-0.3.1 libpq5-9.1.9-0.3.1 postgresql91-9.1.9-0.3.1 postgresql91-contrib-9.1.9-0.3.1 postgresql91-docs-9.1.9-0.3.1 postgresql91-server-9.1.9-0.3.1 - SUSE Linux Enterprise Server 11 SP1 LTSS (s390x x86_64) [New Version: 9.1.9]: libpq5-32bit-9.1.9-0.3.1 References: http://support.novell.com/security/cve/CVE-2013-1899.html http://support.novell.com/security/cve/CVE-2013-1900.html http://support.novell.com/security/cve/CVE-2013-1901.html https://bugzilla.novell.com/812525 http://download.novell.com/patch/finder/?keywords=6a0c9dcd9511dbcaec90c28d6… -- To unsubscribe, e-mail: opensuse-security-announce+unsubscribe(a)opensuse.org For additional commands, e-mail: opensuse-security-announce+help(a)opensuse.org

1 0

[security-announce] SUSE-SU-2013:0710-1: important: Security update for IBM Java
by opensuse-security＠opensuse.org 23 Apr '13

23 Apr '13

SUSE Security Update: Security update for IBM Java ______________________________________________________________________________ Announcement ID: SUSE-SU-2013:0710-1 Rating: important References: #809321 #813939 Affected Products: SUSE Linux Enterprise Software Development Kit 11 SP2 SUSE Linux Enterprise Server 11 SP2 for VMware SUSE Linux Enterprise Server 11 SP2 SUSE Linux Enterprise Server 10 SP4 SUSE Linux Enterprise Java 11 SP2 SUSE Linux Enterprise Java 10 SP4 ______________________________________________________________________________ An update that contains security fixes can now be installed. Description: IBM Java 1.4.2 has been updated to SR13 FP16 which fixes bugs and security issues. More information can be found on: http://www.ibm.com/developerworks/java/jdk/alerts/ <http://www.ibm.com/developerworks/java/jdk/alerts/> and on: https://www.ibm.com/developerworks/java/jdk/aix/142_64/fixes .html#SR13FP16 <https://www.ibm.com/developerworks/java/jdk/aix/142_64/fixe s.html#SR13FP16> CVEs fixed: CVE-2013-0485, CVE-2013-0809, CVE-2013-1493 Patch Instructions: To install this SUSE Security Update use YaST online_update. Alternatively you can run the command listed for your product: - SUSE Linux Enterprise Software Development Kit 11 SP2: zypper in -t patch sdksp2-java-1_4_2-ibm-7618 - SUSE Linux Enterprise Server 11 SP2 for VMware: zypper in -t patch slessp2-java-1_4_2-ibm-7618 - SUSE Linux Enterprise Server 11 SP2: zypper in -t patch slessp2-java-1_4_2-ibm-7618 - SUSE Linux Enterprise Java 11 SP2: zypper in -t patch slejsp2-java-1_4_2-ibm-7618 To bring your system up-to-date, use "zypper patch". Package List: - SUSE Linux Enterprise Software Development Kit 11 SP2 (i586 ia64 ppc64 s390x x86_64): java-1_4_2-ibm-devel-1.4.2_sr13.16-0.2.1 - SUSE Linux Enterprise Software Development Kit 11 SP2 (i586 x86_64): java-1_4_2-ibm-1.4.2_sr13.16-0.2.1 - SUSE Linux Enterprise Server 11 SP2 for VMware (i586 x86_64): java-1_4_2-ibm-1.4.2_sr13.16-0.2.1 - SUSE Linux Enterprise Server 11 SP2 for VMware (i586): java-1_4_2-ibm-jdbc-1.4.2_sr13.16-0.2.1 java-1_4_2-ibm-plugin-1.4.2_sr13.16-0.2.1 - SUSE Linux Enterprise Server 11 SP2 (i586 ia64 ppc64 s390x x86_64): java-1_4_2-ibm-1.4.2_sr13.16-0.2.1 - SUSE Linux Enterprise Server 11 SP2 (i586): java-1_4_2-ibm-jdbc-1.4.2_sr13.16-0.2.1 java-1_4_2-ibm-plugin-1.4.2_sr13.16-0.2.1 - SUSE Linux Enterprise Server 10 SP4 (i586 ia64 ppc s390x x86_64): java-1_4_2-ibm-1.4.2_sr13.16-0.5.1 java-1_4_2-ibm-devel-1.4.2_sr13.16-0.5.1 - SUSE Linux Enterprise Server 10 SP4 (i586 ppc): java-1_4_2-ibm-jdbc-1.4.2_sr13.16-0.5.1 - SUSE Linux Enterprise Server 10 SP4 (i586): java-1_4_2-ibm-plugin-1.4.2_sr13.16-0.5.1 - SUSE Linux Enterprise Java 11 SP2 (i586 ppc64 s390x x86_64): java-1_4_2-ibm-1.4.2_sr13.16-0.2.1 - SUSE Linux Enterprise Java 11 SP2 (i586): java-1_4_2-ibm-jdbc-1.4.2_sr13.16-0.2.1 java-1_4_2-ibm-plugin-1.4.2_sr13.16-0.2.1 - SUSE Linux Enterprise Java 10 SP4 (i586 ia64 ppc s390x x86_64): java-1_4_2-ibm-1.4.2_sr13.16-0.5.1 java-1_4_2-ibm-devel-1.4.2_sr13.16-0.5.1 - SUSE Linux Enterprise Java 10 SP4 (i586 ppc): java-1_4_2-ibm-jdbc-1.4.2_sr13.16-0.5.1 - SUSE Linux Enterprise Java 10 SP4 (i586): java-1_4_2-ibm-plugin-1.4.2_sr13.16-0.5.1 References: https://bugzilla.novell.com/809321 https://bugzilla.novell.com/813939 http://download.novell.com/patch/finder/?keywords=2a81d052caa79801cec9cd015… http://download.novell.com/patch/finder/?keywords=7a55fbf728115132117fd64c8… -- To unsubscribe, e-mail: opensuse-security-announce+unsubscribe(a)opensuse.org For additional commands, e-mail: opensuse-security-announce+help(a)opensuse.org

1 0

[security-announce] SUSE-SU-2013:0701-1: important: Security update for java-1_7_0-ibm
by opensuse-security＠opensuse.org 18 Apr '13

18 Apr '13

SUSE Security Update: Security update for java-1_7_0-ibm ______________________________________________________________________________ Announcement ID: SUSE-SU-2013:0701-1 Rating: important References: #813939 Affected Products: SUSE Linux Enterprise Software Development Kit 11 SP2 SUSE Linux Enterprise Server 11 SP2 for VMware SUSE Linux Enterprise Server 11 SP2 SUSE Linux Enterprise Java 11 SP2 ______________________________________________________________________________ An update that contains security fixes can now be installed. Description: IBM Java 7 was updated to SR4-FP1, fixing bugs and security issues. More information can be found on: http://www.ibm.com/developerworks/java/jdk/alerts/ and on: http://www.ibm.com/developerworks/java/jdk/aix/j764/Java7_64 .fixes.html#SR4FP1 Security Issues: * CVE-2013-0485 <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2013-0485 > * CVE-2013-0809 <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2013-0809 > * CVE-2013-1493 <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2013-1493 > * CVE-2013-0169 <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2013-0169 > Patch Instructions: To install this SUSE Security Update use YaST online_update. Alternatively you can run the command listed for your product: - SUSE Linux Enterprise Software Development Kit 11 SP2: zypper in -t patch sdksp2-java-1_7_0-ibm-7623 - SUSE Linux Enterprise Server 11 SP2 for VMware: zypper in -t patch slessp2-java-1_7_0-ibm-7623 - SUSE Linux Enterprise Server 11 SP2: zypper in -t patch slessp2-java-1_7_0-ibm-7623 - SUSE Linux Enterprise Java 11 SP2: zypper in -t patch slejsp2-java-1_7_0-ibm-7623 To bring your system up-to-date, use "zypper patch". Package List: - SUSE Linux Enterprise Software Development Kit 11 SP2 (i586 ppc64 s390x x86_64): java-1_7_0-ibm-devel-1.7.0_sr4.1-0.5.1 - SUSE Linux Enterprise Server 11 SP2 for VMware (i586 x86_64): java-1_7_0-ibm-1.7.0_sr4.1-0.5.1 java-1_7_0-ibm-jdbc-1.7.0_sr4.1-0.5.1 java-1_7_0-ibm-plugin-1.7.0_sr4.1-0.5.1 - SUSE Linux Enterprise Server 11 SP2 for VMware (i586): java-1_7_0-ibm-alsa-1.7.0_sr4.1-0.5.1 - SUSE Linux Enterprise Server 11 SP2 (i586 ppc64 s390x x86_64): java-1_7_0-ibm-1.7.0_sr4.1-0.5.1 java-1_7_0-ibm-jdbc-1.7.0_sr4.1-0.5.1 - SUSE Linux Enterprise Server 11 SP2 (i586 x86_64): java-1_7_0-ibm-plugin-1.7.0_sr4.1-0.5.1 - SUSE Linux Enterprise Server 11 SP2 (i586): java-1_7_0-ibm-alsa-1.7.0_sr4.1-0.5.1 - SUSE Linux Enterprise Java 11 SP2 (i586 ppc64 s390x x86_64): java-1_7_0-ibm-1.7.0_sr4.1-0.5.1 java-1_7_0-ibm-devel-1.7.0_sr4.1-0.5.1 java-1_7_0-ibm-jdbc-1.7.0_sr4.1-0.5.1 - SUSE Linux Enterprise Java 11 SP2 (i586 x86_64): java-1_7_0-ibm-alsa-1.7.0_sr4.1-0.5.1 java-1_7_0-ibm-plugin-1.7.0_sr4.1-0.5.1 References: https://bugzilla.novell.com/813939 http://download.novell.com/patch/finder/?keywords=f7dbe2a771e408bfd6c779f9d… -- To unsubscribe, e-mail: opensuse-security-announce+unsubscribe(a)opensuse.org For additional commands, e-mail: opensuse-security-announce+help(a)opensuse.org

1 0

[security-announce] openSUSE-SU-2013:0675-1: important: flash-player update to 11.2.202.280
by opensuse-security＠opensuse.org 13 Apr '13

13 Apr '13

openSUSE Security Update: flash-player update to 11.2.202.280 ______________________________________________________________________________ Announcement ID: openSUSE-SU-2013:0675-1 Rating: important References: #814635 Cross-References: CVE-2013-1378 CVE-2013-1379 CVE-2013-1380 CVE-2013-2555 Affected Products: openSUSE 11.4 ______________________________________________________________________________ An update that fixes four vulnerabilities is now available. Description: Adobe Flash Player was updated to 11.2.202.280: http://www.adobe.com/support/security/bulletins/apsb13-11.ht ml * APSB13-11, CVE-2013-1378, CVE-2013-1379, CVE-2013-1380, CVE-2013-2555 Patch Instructions: To install this openSUSE Security Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE 11.4: zypper in -t patch 2013-68 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE 11.4 (i586 x86_64): flash-player-11.2.202.280-59.1 flash-player-gnome-11.2.202.280-59.1 flash-player-kde4-11.2.202.280-59.1 References: http://support.novell.com/security/cve/CVE-2013-1378.html http://support.novell.com/security/cve/CVE-2013-1379.html http://support.novell.com/security/cve/CVE-2013-1380.html http://support.novell.com/security/cve/CVE-2013-2555.html https://bugzilla.novell.com/814635 -- To unsubscribe, e-mail: opensuse-security-announce+unsubscribe(a)opensuse.org For additional commands, e-mail: opensuse-security-announce+help(a)opensuse.org

1 0

[security-announce] SUSE-SU-2013:0674-1: important: Security update for Linux kernel
by opensuse-security＠opensuse.org 12 Apr '13

12 Apr '13

SUSE Security Update: Security update for Linux kernel ______________________________________________________________________________ Announcement ID: SUSE-SU-2013:0674-1 Rating: important References: #742111 #765687 #769093 #770980 #776370 #781485 #785101 #786013 #787272 #789012 #790236 #792697 #795075 #795335 #797175 #799611 #800280 #801178 #802642 #804154 #809692 Cross-References: CVE-2012-4530 CVE-2013-0160 CVE-2013-0216 CVE-2013-0231 CVE-2013-0268 CVE-2013-0871 Affected Products: SUSE Linux Enterprise Server 10 SP4 SUSE Linux Enterprise Desktop 10 SP4 SLE SDK 10 SP4 ______________________________________________________________________________ An update that solves 6 vulnerabilities and has 15 fixes is now available. Description: This Linux kernel update fixes various security issues and bugs in the SUSE Linux Enterprise 10 SP4 kernel. The following security issues have been fixed: * CVE-2013-0871: A race condition in ptrace(2) could be used by local attackers to crash the kernel and/or execute code in kernel context. * CVE-2013-0160: Avoid side channel information leaks from the ptys via ptmx, which allowed local attackers to guess keypresses. * CVE-2012-4530: Avoid leaving bprm->interp on the stack which might have leaked information from the kernel to userland attackers. * CVE-2013-0268: The msr_open function in arch/x86/kernel/msr.c in the Linux kernel allowed local users to bypass intended capability restrictions by executing a crafted application as root, as demonstrated by msr32.c. * CVE-2013-0216: The Xen netback functionality in the Linux kernel allowed guest OS users to cause a denial of service (loop) by triggering ring pointer corruption. * CVE-2013-0231: The pciback_enable_msi function in the PCI backend driver (drivers/xen/pciback/conf_space_capability_msi.c) in Xen for the Linux kernel allowed guest OS users with PCI device access to cause a denial of service via a large number of kernel log messages. NOTE: some of these details are obtained from third party information. Also the following non-security bugs have been fixed: S/390: * s390x: tty struct used after free (bnc#809692, LTC#90216). * s390x/kernel: sched_clock() overflow (bnc#799611, LTC#87978). * qeth: set new mac even if old mac is gone (bnc#789012,LTC#86643). * qeth: set new mac even if old mac is gone (2) (bnc#792697,LTC#87138). * qeth: fix deadlock between recovery and bonding driver (bnc#785101,LTC#85905). * dasd: check count address during online setting (bnc#781485,LTC#85346). * hugetlbfs: add missing TLB invalidation (bnc#781485,LTC#85463). * s390/kernel: make user-access pagetable walk code huge page aware (bnc#781485,LTC#85455). XEN: * xen/netback: fix netbk_count_requests(). * xen: properly bound buffer access when parsing cpu/availability. * xen/scsiback/usbback: move cond_resched() invocations to proper place. * xen/pciback: properly clean up after calling pcistub_device_find(). * xen: add further backward-compatibility configure options. * xen/PCI: suppress bogus warning on old hypervisors. * xenbus: fix overflow check in xenbus_dev_write(). * xen/x86: do not corrupt %eip when returning from a signal handler. Other: * kernel: Restrict clearing TIF_SIGPENDING (bnc#742111). * kernel: recalc_sigpending_tsk fixes (bnc#742111). * xfs: Do not reclaim new inodes in xfs_sync_inodes() (bnc#770980). * jbd: Avoid BUG_ON when checkpoint stalls (bnc#795335). * reiserfs: Fix int overflow while calculating free space (bnc#795075). * cifs: clarify the meaning of tcpStatus == CifsGood (bnc#769093). * cifs: do not allow cifs_reconnect to exit with NULL socket pointer (bnc#769093). * cifs: switch to seq_files (bnc#776370). * scsi: fix check of PQ and PDT bits for WLUNs (bnc#765687). * hugetlb: preserve hugetlb pte dirty state (bnc#790236). * poll: enforce RLIMIT_NOFILE in poll() (bnc#787272). * proc: fix ->open less usage due to ->proc_fops flip (bnc#776370). * rpm/kernel-binary.spec.in: Ignore kabi errors if %%ignore_kabi_badness is defined. This is used in the Kernel:* projects in the OBS. Security Issue references: * CVE-2012-4530 <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2012-4530 > * CVE-2013-0160 <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2013-0160 > * CVE-2013-0216 <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2013-0216 > * CVE-2013-0231 <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2013-0231 > * CVE-2013-0268 <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2013-0268 > * CVE-2013-0871 <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2013-0871 > Indications: Everyone using the Linux Kernel on x86_64 architecture should update. Special Instructions and Notes: Please reboot the system after installing this update. Package List: - SUSE Linux Enterprise Server 10 SP4 (i586 ia64 ppc s390x x86_64): kernel-default-2.6.16.60-0.101.1 kernel-source-2.6.16.60-0.101.1 kernel-syms-2.6.16.60-0.101.1 - SUSE Linux Enterprise Server 10 SP4 (i586 ia64 x86_64): kernel-debug-2.6.16.60-0.101.1 - SUSE Linux Enterprise Server 10 SP4 (i586 ppc x86_64): kernel-kdump-2.6.16.60-0.101.1 - SUSE Linux Enterprise Server 10 SP4 (i586 x86_64): kernel-smp-2.6.16.60-0.101.1 kernel-xen-2.6.16.60-0.101.1 - SUSE Linux Enterprise Server 10 SP4 (i586): kernel-bigsmp-2.6.16.60-0.101.1 kernel-kdumppae-2.6.16.60-0.101.1 kernel-vmi-2.6.16.60-0.101.1 kernel-vmipae-2.6.16.60-0.101.1 kernel-xenpae-2.6.16.60-0.101.1 - SUSE Linux Enterprise Server 10 SP4 (ppc): kernel-iseries64-2.6.16.60-0.101.1 kernel-ppc64-2.6.16.60-0.101.1 - SUSE Linux Enterprise Desktop 10 SP4 (i586 x86_64): kernel-default-2.6.16.60-0.101.1 kernel-smp-2.6.16.60-0.101.1 kernel-source-2.6.16.60-0.101.1 kernel-syms-2.6.16.60-0.101.1 kernel-xen-2.6.16.60-0.101.1 - SUSE Linux Enterprise Desktop 10 SP4 (i586): kernel-bigsmp-2.6.16.60-0.101.1 kernel-xenpae-2.6.16.60-0.101.1 - SLE SDK 10 SP4 (i586 ia64 x86_64): kernel-debug-2.6.16.60-0.101.1 - SLE SDK 10 SP4 (i586 ppc x86_64): kernel-kdump-2.6.16.60-0.101.1 - SLE SDK 10 SP4 (i586 x86_64): kernel-xen-2.6.16.60-0.101.1 - SLE SDK 10 SP4 (i586): kernel-xenpae-2.6.16.60-0.101.1 References: http://support.novell.com/security/cve/CVE-2012-4530.html http://support.novell.com/security/cve/CVE-2013-0160.html http://support.novell.com/security/cve/CVE-2013-0216.html http://support.novell.com/security/cve/CVE-2013-0231.html http://support.novell.com/security/cve/CVE-2013-0268.html http://support.novell.com/security/cve/CVE-2013-0871.html https://bugzilla.novell.com/742111 https://bugzilla.novell.com/765687 https://bugzilla.novell.com/769093 https://bugzilla.novell.com/770980 https://bugzilla.novell.com/776370 https://bugzilla.novell.com/781485 https://bugzilla.novell.com/785101 https://bugzilla.novell.com/786013 https://bugzilla.novell.com/787272 https://bugzilla.novell.com/789012 https://bugzilla.novell.com/790236 https://bugzilla.novell.com/792697 https://bugzilla.novell.com/795075 https://bugzilla.novell.com/795335 https://bugzilla.novell.com/797175 https://bugzilla.novell.com/799611 https://bugzilla.novell.com/800280 https://bugzilla.novell.com/801178 https://bugzilla.novell.com/802642 https://bugzilla.novell.com/804154 https://bugzilla.novell.com/809692 http://download.novell.com/patch/finder/?keywords=2b51bf3e02179f8f70c7b2ada… http://download.novell.com/patch/finder/?keywords=7cf4de409b28c5f187bc1e9f7… http://download.novell.com/patch/finder/?keywords=ac5626f6e7f483c6dac1cc5fe… http://download.novell.com/patch/finder/?keywords=ba0e542087a9075aed8c17a29… http://download.novell.com/patch/finder/?keywords=dba6fc0fdae22199ec260695a… -- To unsubscribe, e-mail: opensuse-security-announce+unsubscribe(a)opensuse.org For additional commands, e-mail: opensuse-security-announce+help(a)opensuse.org

1 0

[security-announce] SUSE-SU-2013:0670-2: important: Security update for flash-player
by opensuse-security＠opensuse.org 12 Apr '13

12 Apr '13

SUSE Security Update: Security update for flash-player ______________________________________________________________________________ Announcement ID: SUSE-SU-2013:0670-2 Rating: important References: #814635 Cross-References: CVE-2013-1378 CVE-2013-1379 CVE-2013-1380 CVE-2013-2555 Affected Products: SUSE Linux Enterprise Desktop 10 SP4 ______________________________________________________________________________ An update that fixes four vulnerabilities is now available. It includes one version update. Description: Adobe Flash Player has been updated to 11.2.202.280 to fix various bugs and security issues. More information can be found on: http://www.adobe.com/support/security/bulletins/apsb13-11.ht ml <http://www.adobe.com/support/security/bulletins/apsb13-11.h tml> * APSB13-11, CVE-2013-1378, CVE-2013-1379, CVE-2013-1380, CVE-2013-2555 Security Issue references: * CVE-2013-1378 <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2013-1378 > * CVE-2013-1379 <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2013-1379 > * CVE-2013-1380 <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2013-1380 > * CVE-2013-2555 <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2013-2555 > Package List: - SUSE Linux Enterprise Desktop 10 SP4 (i586) [New Version: 11.2.202.280]: flash-player-11.2.202.280-0.5.1 References: http://support.novell.com/security/cve/CVE-2013-1378.html http://support.novell.com/security/cve/CVE-2013-1379.html http://support.novell.com/security/cve/CVE-2013-1380.html http://support.novell.com/security/cve/CVE-2013-2555.html https://bugzilla.novell.com/814635 http://download.novell.com/patch/finder/?keywords=43a0afb56e4fabafdd73f008f… -- To unsubscribe, e-mail: opensuse-security-announce+unsubscribe(a)opensuse.org For additional commands, e-mail: opensuse-security-announce+help(a)opensuse.org

1 0

[security-announce] SUSE-SU-2013:0670-1: important: Security update for flash-player
by opensuse-security＠opensuse.org 11 Apr '13

11 Apr '13

SUSE Security Update: Security update for flash-player ______________________________________________________________________________ Announcement ID: SUSE-SU-2013:0670-1 Rating: important References: #814635 Cross-References: CVE-2013-1378 CVE-2013-1379 CVE-2013-1380 CVE-2013-2555 Affected Products: SUSE Linux Enterprise Desktop 11 SP2 ______________________________________________________________________________ An update that fixes four vulnerabilities is now available. It includes one version update. Description: Adobe Flash Player has been updated to 11.2.202.280 to fix various bugs and security issues. More information can be found on: http://www.adobe.com/support/security/bulletins/apsb13-11.ht ml <http://www.adobe.com/support/security/bulletins/apsb13-11.h tml> * APSB13-11, CVE-2013-1378, CVE-2013-1379, CVE-2013-1380, CVE-2013-2555 Security Issue references: * CVE-2013-1378 <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2013-1378 > * CVE-2013-1379 <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2013-1379 > * CVE-2013-1380 <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2013-1380 > * CVE-2013-2555 <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2013-2555 > Patch Instructions: To install this SUSE Security Update use YaST online_update. Alternatively you can run the command listed for your product: - SUSE Linux Enterprise Desktop 11 SP2: zypper in -t patch sledsp2-flash-player-7613 To bring your system up-to-date, use "zypper patch". Package List: - SUSE Linux Enterprise Desktop 11 SP2 (i586 x86_64) [New Version: 11.2.202.280]: flash-player-11.2.202.280-0.3.1 flash-player-gnome-11.2.202.280-0.3.1 flash-player-kde4-11.2.202.280-0.3.1 References: http://support.novell.com/security/cve/CVE-2013-1378.html http://support.novell.com/security/cve/CVE-2013-1379.html http://support.novell.com/security/cve/CVE-2013-1380.html http://support.novell.com/security/cve/CVE-2013-2555.html https://bugzilla.novell.com/814635 http://download.novell.com/patch/finder/?keywords=e6da66ddfe80c70ce9ed319d6… -- To unsubscribe, e-mail: opensuse-security-announce+unsubscribe(a)opensuse.org For additional commands, e-mail: opensuse-security-announce+help(a)opensuse.org

1 0

[security-announce] SUSE-SU-2013:0647-1: important: Security update for Ruby 1.9
by opensuse-security＠opensuse.org 09 Apr '13

09 Apr '13

SUSE Security Update: Security update for Ruby 1.9 ______________________________________________________________________________ Announcement ID: SUSE-SU-2013:0647-1 Rating: important References: #783511 #789983 #791199 #796757 #802406 #803342 Cross-References: CVE-2013-0269 Affected Products: SUSE Studio Onsite 1.3 ______________________________________________________________________________ An update that solves one vulnerability and has 5 fixes is now available. Description: The Ruby script interpreter 1.9 has been updated to 1.9.3 p392 fixing various bugs and security issues: This release includes security fixes about bundled JSON and REXML. * Denial of Service and Unsafe Object Creation Vulnerability in JSON (CVE-2013-0269) * Entity expansion DoS vulnerability in REXML (XML bomb) * XSS exploit of RDoc documentation generated by rdoc (CVE-2013-0256) And some small bugfixes are also included see /usr/share/doc/packages/ruby19/Changelog for more details Also the following bugfix was added: * added bind_stack.patch: (bnc#796757) Fixes stack boundary issues when embedding Ruby into threaded C code (Ruby bug #229) Security Issue reference: * CVE-2013-0269 <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2013-0269 > Patch Instructions: To install this SUSE Security Update use YaST online_update. Alternatively you can run the command listed for your product: - SUSE Studio Onsite 1.3: zypper in -t patch slestso13-ruby19-7496 To bring your system up-to-date, use "zypper patch". Package List: - SUSE Studio Onsite 1.3 (x86_64): ruby19-1.9.3.p392-0.7.1 ruby19-devel-1.9.3.p392-0.7.1 ruby19-devel-extra-1.9.3.p392-0.7.1 References: http://support.novell.com/security/cve/CVE-2013-0269.html https://bugzilla.novell.com/783511 https://bugzilla.novell.com/789983 https://bugzilla.novell.com/791199 https://bugzilla.novell.com/796757 https://bugzilla.novell.com/802406 https://bugzilla.novell.com/803342 http://download.novell.com/patch/finder/?keywords=e50f6dac0ba6a3ba64aeb6f6f… -- To unsubscribe, e-mail: opensuse-security-announce+unsubscribe(a)opensuse.org For additional commands, e-mail: opensuse-security-announce+help(a)opensuse.org

1 0

[security-announce] SUSE-SU-2013:0609-2: important: Security update for rubygem-json_pure
by opensuse-security＠opensuse.org 09 Apr '13

09 Apr '13

SUSE Security Update: Security update for rubygem-json_pure ______________________________________________________________________________ Announcement ID: SUSE-SU-2013:0609-2 Rating: important References: #803342 Cross-References: CVE-2013-0269 Affected Products: WebYaST 1.3 SUSE Linux Enterprise Software Development Kit 11 SP2 SUSE Lifecycle Management Server 1.3 ______________________________________________________________________________ An update that fixes one vulnerability is now available. Description: The json_pure Ruby Gem has been updated to fix a Denial of Service and Unsafe Object Creation Vulnerability in JSON (CVE-2013-0269) * Entity expansion DoS vulnerability in REXML (XML bomb) Security Issues: * CVE-2013-0269 <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2013-0269 > Patch Instructions: To install this SUSE Security Update use YaST online_update. Alternatively you can run the command listed for your product: - WebYaST 1.3: zypper in -t patch slewyst13-rubygem-json_pure-7527 - SUSE Linux Enterprise Software Development Kit 11 SP2: zypper in -t patch sdksp2-rubygem-json_pure-7527 - SUSE Lifecycle Management Server 1.3: zypper in -t patch sleslms13-rubygem-json_pure-7527 To bring your system up-to-date, use "zypper patch". Package List: - WebYaST 1.3 (i586 ia64 ppc64 s390x x86_64): rubygem-json_pure-1.2.0-0.4.4 - SUSE Linux Enterprise Software Development Kit 11 SP2 (i586 ia64 ppc64 s390x x86_64): rubygem-json_pure-1.2.0-0.4.4 - SUSE Lifecycle Management Server 1.3 (x86_64): rubygem-json_pure-1.2.0-0.4.4 References: http://support.novell.com/security/cve/CVE-2013-0269.html https://bugzilla.novell.com/803342 http://download.novell.com/patch/finder/?keywords=59c25e19a4a6f534d0c992634… -- To unsubscribe, e-mail: opensuse-security-announce+unsubscribe(a)opensuse.org For additional commands, e-mail: opensuse-security-announce+help(a)opensuse.org

1 0