May 2014 - openSUSE Security Announce - openSUSE Mailing Lists

[security-announce] SUSE-SU-2014:0671-1: important: Security update for flash-player
by opensuse-security＠opensuse.org 17 May '14

17 May '14

SUSE Security Update: Security update for flash-player ______________________________________________________________________________ Announcement ID: SUSE-SU-2014:0671-1 Rating: important References: #877649 Cross-References: CVE-2014-0510 CVE-2014-0516 CVE-2014-0517 CVE-2014-0518 CVE-2014-0519 CVE-2014-0520 Affected Products: SUSE Linux Enterprise Desktop 11 SP3 ______________________________________________________________________________ An update that fixes 6 vulnerabilities is now available. It includes one version update. Description: Adobe flash-player was updated to version 11.2.202.359 to resolve several security issues: * Remote attackers could execute arbitrary code and bypass a sandbox protection mechanism via unspecified vectors. (CVE-2014-0510) * Remote attackers could bypass the Same Origin Policy via unspecified vectors. (CVE-2014-0516) * Bypass intended access restrictions via unspecified vectors. (CVE-2014-0517, CVE-2014-0518, CVE-2014-0519, CVE-2014-0520) More information can be found at http://helpx.adobe.com/security/products/flash-player/apsb14-14.html <http://helpx.adobe.com/security/products/flash-player/apsb14-14.html> . Security Issues references: * CVE-2014-0510 <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-0510> * CVE-2014-0516 <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-0516> * CVE-2014-0517 <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-0517> * CVE-2014-0518 <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-0518> * CVE-2014-0519 <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-0519> * CVE-2014-0520 <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-0520> Patch Instructions: To install this SUSE Security Update use YaST online_update. Alternatively you can run the command listed for your product: - SUSE Linux Enterprise Desktop 11 SP3: zypper in -t patch sledsp3-flash-player-9259 To bring your system up-to-date, use "zypper patch". Package List: - SUSE Linux Enterprise Desktop 11 SP3 (i586 x86_64) [New Version: 11.2.202.359]: flash-player-11.2.202.359-0.3.1 flash-player-gnome-11.2.202.359-0.3.1 flash-player-kde4-11.2.202.359-0.3.1 References: http://support.novell.com/security/cve/CVE-2014-0510.html http://support.novell.com/security/cve/CVE-2014-0516.html http://support.novell.com/security/cve/CVE-2014-0517.html http://support.novell.com/security/cve/CVE-2014-0518.html http://support.novell.com/security/cve/CVE-2014-0519.html http://support.novell.com/security/cve/CVE-2014-0520.html https://bugzilla.novell.com/877649 http://download.suse.com/patch/finder/?keywords=e6f931e48dbfb5069e57b62247a… -- To unsubscribe, e-mail: opensuse-security-announce+unsubscribe(a)opensuse.org For additional commands, e-mail: opensuse-security-announce+help(a)opensuse.org

1 0

[security-announce] SUSE-SU-2014:0667-1: important: Security update for Linux Kernel
by opensuse-security＠opensuse.org 16 May '14

16 May '14

SUSE Security Update: Security update for Linux Kernel ______________________________________________________________________________ Announcement ID: SUSE-SU-2014:0667-1 Rating: important References: #875690 #875798 Cross-References: CVE-2014-0196 CVE-2014-1737 CVE-2014-1738 Affected Products: SUSE Linux Enterprise Server 11 SP3 for VMware SUSE Linux Enterprise Server 11 SP3 SUSE Linux Enterprise High Availability Extension 11 SP3 SUSE Linux Enterprise Desktop 11 SP3 SLE 11 SERVER Unsupported Extras ______________________________________________________________________________ An update that fixes three vulnerabilities is now available. It includes one version update. Description: The SUSE Linux Enterprise 11 Service Pack 3 kernel was updated to fix the following severe security issues: * CVE-2014-1737: The raw_cmd_copyin function in drivers/block/floppy.c in the Linux kernel through 3.14.3 does not properly handle error conditions during processing of an FDRAWCMD ioctl call, which allows local users to trigger kfree operations and gain privileges by leveraging write access to a /dev/fd device. (bnc#875798) * CVE-2014-1738: The raw_cmd_copyout function in drivers/block/floppy.c in the Linux kernel through 3.14.3 does not properly restrict access to certain pointers during processing of an FDRAWCMD ioctl call, which allows local users to obtain sensitive information from kernel heap memory by leveraging write access to a /dev/fd device. (bnc#875798) * CVE-2014-0196: The n_tty_write function in drivers/tty/n_tty.c in the Linux kernel through 3.14.3 does not properly manage tty driver access in the "LECHO & !OPOST" case, which allows local users to cause a denial of service (memory corruption and system crash) or gain privileges by triggering a race condition involving read and write operations with long strings. (bnc#875690) Security Issues references: * CVE-2014-0196 <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-0196> * CVE-2014-1737 <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-1737> * CVE-2014-1738 <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-1738> Indications: Everyone using the Linux Kernel on x86_64 architecture should update. Special Instructions and Notes: Please reboot the system after installing this update. Patch Instructions: To install this SUSE Security Update use YaST online_update. Alternatively you can run the command listed for your product: - SUSE Linux Enterprise Server 11 SP3 for VMware: zypper in -t patch slessp3-kernel-9233 slessp3-kernel-9237 - SUSE Linux Enterprise Server 11 SP3: zypper in -t patch slessp3-kernel-9233 slessp3-kernel-9234 slessp3-kernel-9235 slessp3-kernel-9236 slessp3-kernel-9237 - SUSE Linux Enterprise High Availability Extension 11 SP3: zypper in -t patch slehasp3-kernel-9233 slehasp3-kernel-9234 slehasp3-kernel-9235 slehasp3-kernel-9236 slehasp3-kernel-9237 - SUSE Linux Enterprise Desktop 11 SP3: zypper in -t patch sledsp3-kernel-9233 sledsp3-kernel-9237 To bring your system up-to-date, use "zypper patch". Package List: - SUSE Linux Enterprise Server 11 SP3 for VMware (i586 x86_64) [New Version: 3.0.101]: kernel-default-3.0.101-0.29.1 kernel-default-base-3.0.101-0.29.1 kernel-default-devel-3.0.101-0.29.1 kernel-source-3.0.101-0.29.1 kernel-syms-3.0.101-0.29.1 kernel-trace-3.0.101-0.29.1 kernel-trace-base-3.0.101-0.29.1 kernel-trace-devel-3.0.101-0.29.1 kernel-xen-devel-3.0.101-0.29.1 - SUSE Linux Enterprise Server 11 SP3 for VMware (i586) [New Version: 3.0.101]: kernel-pae-3.0.101-0.29.1 kernel-pae-base-3.0.101-0.29.1 kernel-pae-devel-3.0.101-0.29.1 - SUSE Linux Enterprise Server 11 SP3 (i586 ia64 ppc64 s390x x86_64) [New Version: 3.0.101]: kernel-default-3.0.101-0.29.1 kernel-default-base-3.0.101-0.29.1 kernel-default-devel-3.0.101-0.29.1 kernel-source-3.0.101-0.29.1 kernel-syms-3.0.101-0.29.1 kernel-trace-3.0.101-0.29.1 kernel-trace-base-3.0.101-0.29.1 kernel-trace-devel-3.0.101-0.29.1 - SUSE Linux Enterprise Server 11 SP3 (i586 x86_64) [New Version: 3.0.101]: kernel-ec2-3.0.101-0.29.1 kernel-ec2-base-3.0.101-0.29.1 kernel-ec2-devel-3.0.101-0.29.1 kernel-xen-3.0.101-0.29.1 kernel-xen-base-3.0.101-0.29.1 kernel-xen-devel-3.0.101-0.29.1 xen-kmp-default-4.2.4_02_3.0.101_0.29-0.7.24 - SUSE Linux Enterprise Server 11 SP3 (s390x) [New Version: 3.0.101]: kernel-default-man-3.0.101-0.29.1 - SUSE Linux Enterprise Server 11 SP3 (ppc64) [New Version: 3.0.101]: kernel-ppc64-3.0.101-0.29.1 kernel-ppc64-base-3.0.101-0.29.1 kernel-ppc64-devel-3.0.101-0.29.1 - SUSE Linux Enterprise Server 11 SP3 (i586) [New Version: 3.0.101]: kernel-pae-3.0.101-0.29.1 kernel-pae-base-3.0.101-0.29.1 kernel-pae-devel-3.0.101-0.29.1 xen-kmp-pae-4.2.4_02_3.0.101_0.29-0.7.24 - SUSE Linux Enterprise High Availability Extension 11 SP3 (i586 ia64 ppc64 s390x x86_64): cluster-network-kmp-default-1.4_3.0.101_0.29-2.27.63 cluster-network-kmp-trace-1.4_3.0.101_0.29-2.27.63 gfs2-kmp-default-2_3.0.101_0.29-0.16.69 gfs2-kmp-trace-2_3.0.101_0.29-0.16.69 ocfs2-kmp-default-1.6_3.0.101_0.29-0.20.63 ocfs2-kmp-trace-1.6_3.0.101_0.29-0.20.63 - SUSE Linux Enterprise High Availability Extension 11 SP3 (i586 x86_64): cluster-network-kmp-xen-1.4_3.0.101_0.29-2.27.63 gfs2-kmp-xen-2_3.0.101_0.29-0.16.69 ocfs2-kmp-xen-1.6_3.0.101_0.29-0.20.63 - SUSE Linux Enterprise High Availability Extension 11 SP3 (ppc64): cluster-network-kmp-ppc64-1.4_3.0.101_0.29-2.27.63 gfs2-kmp-ppc64-2_3.0.101_0.29-0.16.69 ocfs2-kmp-ppc64-1.6_3.0.101_0.29-0.20.63 - SUSE Linux Enterprise High Availability Extension 11 SP3 (i586): cluster-network-kmp-pae-1.4_3.0.101_0.29-2.27.63 gfs2-kmp-pae-2_3.0.101_0.29-0.16.69 ocfs2-kmp-pae-1.6_3.0.101_0.29-0.20.63 - SUSE Linux Enterprise Desktop 11 SP3 (i586 x86_64) [New Version: 3.0.101]: kernel-default-3.0.101-0.29.1 kernel-default-base-3.0.101-0.29.1 kernel-default-devel-3.0.101-0.29.1 kernel-default-extra-3.0.101-0.29.1 kernel-source-3.0.101-0.29.1 kernel-syms-3.0.101-0.29.1 kernel-trace-devel-3.0.101-0.29.1 kernel-xen-3.0.101-0.29.1 kernel-xen-base-3.0.101-0.29.1 kernel-xen-devel-3.0.101-0.29.1 kernel-xen-extra-3.0.101-0.29.1 xen-kmp-default-4.2.4_02_3.0.101_0.29-0.7.24 - SUSE Linux Enterprise Desktop 11 SP3 (i586) [New Version: 3.0.101]: kernel-pae-3.0.101-0.29.1 kernel-pae-base-3.0.101-0.29.1 kernel-pae-devel-3.0.101-0.29.1 kernel-pae-extra-3.0.101-0.29.1 xen-kmp-pae-4.2.4_02_3.0.101_0.29-0.7.24 - SLE 11 SERVER Unsupported Extras (i586 ia64 ppc64 s390x x86_64): kernel-default-extra-3.0.101-0.29.1 - SLE 11 SERVER Unsupported Extras (i586 x86_64): kernel-xen-extra-3.0.101-0.29.1 - SLE 11 SERVER Unsupported Extras (ppc64): kernel-ppc64-extra-3.0.101-0.29.1 - SLE 11 SERVER Unsupported Extras (i586): kernel-pae-extra-3.0.101-0.29.1 References: http://support.novell.com/security/cve/CVE-2014-0196.html http://support.novell.com/security/cve/CVE-2014-1737.html http://support.novell.com/security/cve/CVE-2014-1738.html https://bugzilla.novell.com/875690 https://bugzilla.novell.com/875798 http://download.suse.com/patch/finder/?keywords=0a2dcb948e608bd430761950986… http://download.suse.com/patch/finder/?keywords=274275aae87b7f5717f22fbbcef… http://download.suse.com/patch/finder/?keywords=74a759a760793246603bb46c1f2… http://download.suse.com/patch/finder/?keywords=843a01b2e875a9432b273760df4… http://download.suse.com/patch/finder/?keywords=92be4af46975d1cbad507b6d3ff… http://download.suse.com/patch/finder/?keywords=9a4b69a3f37b4e6644233447359… http://download.suse.com/patch/finder/?keywords=e8725e10de339002adb8d4cccd0… http://download.suse.com/patch/finder/?keywords=f07cfd49365f51f26faddaf62d0… http://download.suse.com/patch/finder/?keywords=f83b1e3a46f672548bf90e07d1b… http://download.suse.com/patch/finder/?keywords=fbbbacd1258eed8745c184e7d6e… -- To unsubscribe, e-mail: opensuse-security-announce+unsubscribe(a)opensuse.org For additional commands, e-mail: opensuse-security-announce+help(a)opensuse.org

1 0

[security-announce] SUSE-SU-2014:0665-1: important: Security update for Mozilla Firefox
by opensuse-security＠opensuse.org 16 May '14

16 May '14

SUSE Security Update: Security update for Mozilla Firefox ______________________________________________________________________________ Announcement ID: SUSE-SU-2014:0665-1 Rating: important References: #865539 #869827 #875378 Cross-References: CVE-2014-1492 CVE-2014-1518 CVE-2014-1523 CVE-2014-1524 CVE-2014-1529 CVE-2014-1530 CVE-2014-1531 CVE-2014-1532 Affected Products: SUSE Linux Enterprise Server 11 SP1 LTSS ______________________________________________________________________________ An update that fixes 8 vulnerabilities is now available. It includes four new package versions. Description: This Mozilla Firefox and Mozilla NSS update fixes several security and non-security issues. Mozilla Firefox has been updated to 24.5.0esr which fixes the following issues: * MFSA 2014-34/CVE-2014-1518 Miscellaneous memory safety hazards * MFSA 2014-37/CVE-2014-1523 Out of bounds read while decoding JPG images * MFSA 2014-38/CVE-2014-1524 Buffer overflow when using non-XBL object as XBL * MFSA 2014-42/CVE-2014-1529 Privilege escalation through Web Notification API * MFSA 2014-43/CVE-2014-1530 Cross-site scripting (XSS) using history navigations * MFSA 2014-44/CVE-2014-1531 Use-after-free in imgLoader while resizing images * MFSA 2014-46/CVE-2014-1532 Use-after-free in nsHostResolver Mozilla NSS has been updated to 3.16 * required for Firefox 29 * CVE-2014-1492_ In a wildcard certificate, the wildcard character should not be embedded within the U-label of an internationalized domain name. See the last bullet point in RFC 6125, Section 7.2. * Update of root certificates. Security Issue references: * CVE-2014-1532 <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-1532> * CVE-2014-1531 <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-1531> * CVE-2014-1530 <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-1530> * CVE-2014-1529 <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-1529> * CVE-2014-1524 <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-1524> * CVE-2014-1523 <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-1523> * CVE-2014-1518 <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-1518> * CVE-2014-1492 <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-1492> Patch Instructions: To install this SUSE Security Update use YaST online_update. Alternatively you can run the command listed for your product: - SUSE Linux Enterprise Server 11 SP1 LTSS: zypper in -t patch slessp1-MozillaFirefox-201404-9187 To bring your system up-to-date, use "zypper patch". Package List: - SUSE Linux Enterprise Server 11 SP1 LTSS (i586 s390x x86_64) [New Version: 24,24.5.0esr,3.16 and 4.10.4]: MozillaFirefox-24.5.0esr-0.3.1 MozillaFirefox-branding-SLED-24-0.4.10.14 MozillaFirefox-translations-24.5.0esr-0.3.1 libfreebl3-3.16-0.3.1 mozilla-nspr-4.10.4-0.3.1 mozilla-nss-3.16-0.3.1 mozilla-nss-tools-3.16-0.3.1 - SUSE Linux Enterprise Server 11 SP1 LTSS (s390x x86_64) [New Version: 3.16 and 4.10.4]: libfreebl3-32bit-3.16-0.3.1 mozilla-nspr-32bit-4.10.4-0.3.1 mozilla-nss-32bit-3.16-0.3.1 References: http://support.novell.com/security/cve/CVE-2014-1492.html http://support.novell.com/security/cve/CVE-2014-1518.html http://support.novell.com/security/cve/CVE-2014-1523.html http://support.novell.com/security/cve/CVE-2014-1524.html http://support.novell.com/security/cve/CVE-2014-1529.html http://support.novell.com/security/cve/CVE-2014-1530.html http://support.novell.com/security/cve/CVE-2014-1531.html http://support.novell.com/security/cve/CVE-2014-1532.html https://bugzilla.novell.com/865539 https://bugzilla.novell.com/869827 https://bugzilla.novell.com/875378 http://download.suse.com/patch/finder/?keywords=02d70d3c9e25d9db60e36b3f80b… -- To unsubscribe, e-mail: opensuse-security-announce+unsubscribe(a)opensuse.org For additional commands, e-mail: opensuse-security-announce+help(a)opensuse.org

1 0

[security-announce] SUSE-SU-2014:0638-2: important: Security update for Mozilla Firefox
by opensuse-security＠opensuse.org 16 May '14

16 May '14

SUSE Security Update: Security update for Mozilla Firefox ______________________________________________________________________________ Announcement ID: SUSE-SU-2014:0638-2 Rating: important References: #865539 #869827 #875378 #875803 Cross-References: CVE-2014-1518 CVE-2014-1520 CVE-2014-1523 CVE-2014-1524 CVE-2014-1529 CVE-2014-1530 CVE-2014-1531 CVE-2014-1532 Affected Products: SUSE Linux Enterprise Server 11 SP2 LTSS ______________________________________________________________________________ An update that fixes 8 vulnerabilities is now available. It includes three new package versions. Description: This MozillaFirefox and mozilla-nss update fixes several security and non-security issues. MozillaFirefox has been updated to version 24.5.0esr which fixes the following issues: * MFSA 2014-34/CVE-2014-1518 Miscellaneous memory safety hazards * MFSA 2014-37/CVE-2014-1523 Out of bounds read while decoding JPG images * MFSA 2014-38/CVE-2014-1524 Buffer overflow when using non-XBL object as XBL * MFSA 2014-42/CVE-2014-1529 Privilege escalation through Web Notification API * MFSA 2014-43/CVE-2014-1530 Cross-site scripting (XSS) using history navigations * MFSA 2014-44/CVE-2014-1531 Use-after-free in imgLoader while resizing images * MFSA 2014-46/CVE-2014-1532 Use-after-free in nsHostResolver Mozilla NSS has been updated to version 3.16 * required for Firefox 29 * CVE-2014-1492_ In a wildcard certificate, the wildcard character should not be embedded within the U-label of an internationalized domain name. See the last bullet point in RFC 6125, Section 7.2. * Update of root certificates. Security Issue references: * CVE-2014-1532 <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-1532> * CVE-2014-1531 <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-1531> * CVE-2014-1530 <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-1530> * CVE-2014-1529 <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-1529> * CVE-2014-1524 <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-1524> * CVE-2014-1523 <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-1523> * CVE-2014-1520 <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-1520> * CVE-2014-1518 <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-1518> Patch Instructions: To install this SUSE Security Update use YaST online_update. Alternatively you can run the command listed for your product: - SUSE Linux Enterprise Server 11 SP2 LTSS: zypper in -t patch slessp2-MozillaFirefox-201404-9186 To bring your system up-to-date, use "zypper patch". Package List: - SUSE Linux Enterprise Server 11 SP2 LTSS (i586 s390x x86_64) [New Version: 24.5.0esr,3.16 and 4.10.4]: MozillaFirefox-24.5.0esr-0.3.1 MozillaFirefox-branding-SLED-24-0.4.10.14 MozillaFirefox-translations-24.5.0esr-0.3.1 libfreebl3-3.16-0.3.1 mozilla-nspr-4.10.4-0.3.1 mozilla-nspr-devel-4.10.4-0.3.1 mozilla-nss-3.16-0.3.1 mozilla-nss-devel-3.16-0.3.1 mozilla-nss-tools-3.16-0.3.1 - SUSE Linux Enterprise Server 11 SP2 LTSS (s390x x86_64) [New Version: 3.16 and 4.10.4]: libfreebl3-32bit-3.16-0.3.1 mozilla-nspr-32bit-4.10.4-0.3.1 mozilla-nss-32bit-3.16-0.3.1 References: http://support.novell.com/security/cve/CVE-2014-1518.html http://support.novell.com/security/cve/CVE-2014-1520.html http://support.novell.com/security/cve/CVE-2014-1523.html http://support.novell.com/security/cve/CVE-2014-1524.html http://support.novell.com/security/cve/CVE-2014-1529.html http://support.novell.com/security/cve/CVE-2014-1530.html http://support.novell.com/security/cve/CVE-2014-1531.html http://support.novell.com/security/cve/CVE-2014-1532.html https://bugzilla.novell.com/865539 https://bugzilla.novell.com/869827 https://bugzilla.novell.com/875378 https://bugzilla.novell.com/875803 http://download.suse.com/patch/finder/?keywords=147e419c487f42538a6cd744c37… -- To unsubscribe, e-mail: opensuse-security-announce+unsubscribe(a)opensuse.org For additional commands, e-mail: opensuse-security-announce+help(a)opensuse.org

1 0

[security-announce] SUSE-SU-2014:0639-1: important: Security update for OpenJDK
by opensuse-security＠opensuse.org 13 May '14

13 May '14

SUSE Security Update: Security update for OpenJDK ______________________________________________________________________________ Announcement ID: SUSE-SU-2014:0639-1 Rating: important References: #873873 Cross-References: CVE-2013-6629 CVE-2013-6954 CVE-2014-0429 CVE-2014-0446 CVE-2014-0451 CVE-2014-0452 CVE-2014-0453 CVE-2014-0454 CVE-2014-0455 CVE-2014-0456 CVE-2014-0457 CVE-2014-0458 CVE-2014-0459 CVE-2014-0460 CVE-2014-0461 CVE-2014-1876 CVE-2014-2397 CVE-2014-2398 CVE-2014-2402 CVE-2014-2403 CVE-2014-2412 CVE-2014-2413 CVE-2014-2414 CVE-2014-2421 CVE-2014-2423 CVE-2014-2427 Affected Products: SUSE Linux Enterprise Desktop 11 SP3 ______________________________________________________________________________ An update that fixes 26 vulnerabilities is now available. Description: This java-1_7_0-openjdk update to version 2.4.7 fixes the following security and non-security issues: * Security fixes o S8023046: Enhance splashscreen support o S8025005: Enhance CORBA initializations o S8025010, CVE-2014-2412: Enhance AWT contexts o S8025030, CVE-2014-2414: Enhance stream handling o S8025152, CVE-2014-0458: Enhance activation set up o S8026067: Enhance signed jar verification o S8026163, CVE-2014-2427: Enhance media provisioning o S8026188, CVE-2014-2423: Enhance envelope factory o S8026200: Enhance RowSet Factory o S8026716, CVE-2014-2402: (aio) Enhance asynchronous channel handling o S8026736, CVE-2014-2398: Enhance Javadoc pages o S8026797, CVE-2014-0451: Enhance data transfers o S8026801, CVE-2014-0452: Enhance endpoint addressing o S8027766, CVE-2014-0453: Enhance RSA processing o S8027775: Enhance ICU code. o S8027841, CVE-2014-0429: Enhance pixel manipulations o S8028385: Enhance RowSet Factory o S8029282, CVE-2014-2403: Enhance CharInfo set up o S8029286: Enhance subject delegation o S8029699: Update Poller demo o S8029730: Improve audio device additions o S8029735: Enhance service mgmt natives o S8029740, CVE-2014-0446: Enhance handling of loggers o S8029745, CVE-2014-0454: Enhance algorithm checking o S8029750: Enhance LCMS color processing (in-tree LCMS) o S8029760, CVE-2013-6629: Enhance AWT image libraries (in-tree libjpeg) o S8029844, CVE-2014-0455: Enhance argument validation o S8029854, CVE-2014-2421: Enhance JPEG decodings o S8029858, CVE-2014-0456: Enhance array copies o S8030731, CVE-2014-0460: Improve name service robustness o S8031330: Refactor ObjectFactory o S8031335, CVE-2014-0459: Better color profiling (in-tree LCMS) o S8031352, CVE-2013-6954: Enhance PNG handling (in-tree libpng) o S8031394, CVE-2014-0457: (sl) Fix exception handling in ServiceLoader o S8031395: Enhance LDAP processing o S8032686, CVE-2014-2413: Issues with method invoke o S8033618, CVE-2014-1876: Correct logging output o S8034926, CVE-2014-2397: Attribute classes properly o S8036794, CVE-2014-0461: Manage JavaScript instances * Backports o S8004145: New improved hgforest.sh, ctrl-c now properly terminates mercurial processes. o S8007625: race with nested repos in /common/bin/hgforest.sh o S8011178: improve common/bin/hgforest.sh python detection (MacOS) o S8011342: hgforest.sh : 'python --version' not supported on older python o S8011350: hgforest.sh uses non-POSIX sh features that may fail with some shells o S8024200: handle hg wrapper with space after #! o S8025796: hgforest.sh could trigger unbuffered output from hg without complicated machinations o S8028388: 9 jaxws tests failed in nightly build with java.lang.ClassCastException o S8031477: [macosx] Loading AWT native library fails o S8032370: No "Truncated file" warning from IIOReadWarningListener on JPEGImageReader o S8035834: InetAddress.getLocalHost() can hang after JDK-8030731 was fixed * Bug fixes o PR1393: JPEG support in build is broken on non-system-libjpeg builds o PR1726: configure fails looking for ecj.jar before even trying to find javac o Red Hat local: Fix for repo with path statting with / . o Remove unused hgforest script Security Issue references: * CVE-2014-2412 <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-2412> * CVE-2014-2414 <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-2414> * CVE-2014-0458 <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-0458> * CVE-2014-2427 <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-2427> * CVE-2014-2423 <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-2423> * CVE-2014-2402 <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-2402> * CVE-2014-2398 <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-2398> * CVE-2014-0451 <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-0451> * CVE-2014-0452 <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-0452> * CVE-2014-0453 <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-0453> * CVE-2014-0429 <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-0429> * CVE-2014-2403 <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-2403> * CVE-2014-0446 <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-0446> * CVE-2014-0454 <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-0454> * CVE-2013-6629 <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2013-6629> * CVE-2014-0455 <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-0455> * CVE-2014-2421 <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-2421> * CVE-2014-0456 <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-0456> * CVE-2014-0460 <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-0460> * CVE-2014-0459 <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-0459> * CVE-2013-6954 <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2013-6954> * CVE-2014-0457 <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-0457> * CVE-2014-2413 <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-2413> * CVE-2014-1876 <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-1876> * CVE-2014-2397 <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-2397> * CVE-2014-0461 <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-0461> Patch Instructions: To install this SUSE Security Update use YaST online_update. Alternatively you can run the command listed for your product: - SUSE Linux Enterprise Desktop 11 SP3: zypper in -t patch sledsp3-java-1_7_0-openjdk-9209 To bring your system up-to-date, use "zypper patch". Package List: - SUSE Linux Enterprise Desktop 11 SP3 (i586 x86_64): java-1_7_0-openjdk-1.7.0.6-0.27.1 java-1_7_0-openjdk-demo-1.7.0.6-0.27.1 java-1_7_0-openjdk-devel-1.7.0.6-0.27.1 References: http://support.novell.com/security/cve/CVE-2013-6629.html http://support.novell.com/security/cve/CVE-2013-6954.html http://support.novell.com/security/cve/CVE-2014-0429.html http://support.novell.com/security/cve/CVE-2014-0446.html http://support.novell.com/security/cve/CVE-2014-0451.html http://support.novell.com/security/cve/CVE-2014-0452.html http://support.novell.com/security/cve/CVE-2014-0453.html http://support.novell.com/security/cve/CVE-2014-0454.html http://support.novell.com/security/cve/CVE-2014-0455.html http://support.novell.com/security/cve/CVE-2014-0456.html http://support.novell.com/security/cve/CVE-2014-0457.html http://support.novell.com/security/cve/CVE-2014-0458.html http://support.novell.com/security/cve/CVE-2014-0459.html http://support.novell.com/security/cve/CVE-2014-0460.html http://support.novell.com/security/cve/CVE-2014-0461.html http://support.novell.com/security/cve/CVE-2014-1876.html http://support.novell.com/security/cve/CVE-2014-2397.html http://support.novell.com/security/cve/CVE-2014-2398.html http://support.novell.com/security/cve/CVE-2014-2402.html http://support.novell.com/security/cve/CVE-2014-2403.html http://support.novell.com/security/cve/CVE-2014-2412.html http://support.novell.com/security/cve/CVE-2014-2413.html http://support.novell.com/security/cve/CVE-2014-2414.html http://support.novell.com/security/cve/CVE-2014-2421.html http://support.novell.com/security/cve/CVE-2014-2423.html http://support.novell.com/security/cve/CVE-2014-2427.html https://bugzilla.novell.com/873873 http://download.suse.com/patch/finder/?keywords=9e107d0028325fe6789728abca9… -- To unsubscribe, e-mail: opensuse-security-announce+unsubscribe(a)opensuse.org For additional commands, e-mail: opensuse-security-announce+help(a)opensuse.org

1 0

[security-announce] SUSE-SU-2014:0638-1: important: Security update for Mozilla Firefox
by opensuse-security＠opensuse.org 13 May '14

13 May '14

SUSE Security Update: Security update for Mozilla Firefox ______________________________________________________________________________ Announcement ID: SUSE-SU-2014:0638-1 Rating: important References: #865539 #869827 #875378 #875803 Cross-References: CVE-2014-1518 CVE-2014-1520 CVE-2014-1523 CVE-2014-1524 CVE-2014-1529 CVE-2014-1530 CVE-2014-1531 CVE-2014-1532 Affected Products: SUSE Linux Enterprise Software Development Kit 11 SP3 SUSE Linux Enterprise Server 11 SP3 for VMware SUSE Linux Enterprise Server 11 SP3 SUSE Linux Enterprise Desktop 11 SP3 ______________________________________________________________________________ An update that fixes 8 vulnerabilities is now available. It includes three new package versions. Description: This Mozilla Firefox and Mozilla NSS update to 24.5.0esr fixes the following several security and non-security issues: * MFSA 2014-34/CVE-2014-1518 Miscellaneous memory safety hazards * MFSA 2014-37/CVE-2014-1523 Out of bounds read while decoding JPG images * MFSA 2014-38/CVE-2014-1524 Buffer overflow when using non-XBL object as XBL * MFSA 2014-42/CVE-2014-1529 Privilege escalation through Web Notification API * MFSA 2014-43/CVE-2014-1530 Cross-site scripting (XSS) using history navigations * MFSA 2014-44/CVE-2014-1531 Use-after-free in imgLoader while resizing images * MFSA 2014-46/CVE-2014-1532 Use-after-free in nsHostResolver Mozilla NSS has been updated to 3.16: * required for Firefox 29 * CVE-2014-1492: In a wildcard certificate, the wildcard character should not be embedded within the U-label of an internationalized domain name. See the last bullet point in RFC 6125, Section 7.2. * Update of root certificates. Security Issue references: * CVE-2014-1532 <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-1532> * CVE-2014-1531 <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-1531> * CVE-2014-1530 <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-1530> * CVE-2014-1529 <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-1529> * CVE-2014-1524 <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-1524> * CVE-2014-1523 <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-1523> * CVE-2014-1520 <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-1520> * CVE-2014-1518 <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-1518> Patch Instructions: To install this SUSE Security Update use YaST online_update. Alternatively you can run the command listed for your product: - SUSE Linux Enterprise Software Development Kit 11 SP3: zypper in -t patch sdksp3-MozillaFirefox-201404-9185 - SUSE Linux Enterprise Server 11 SP3 for VMware: zypper in -t patch slessp3-MozillaFirefox-201404-9185 - SUSE Linux Enterprise Server 11 SP3: zypper in -t patch slessp3-MozillaFirefox-201404-9185 - SUSE Linux Enterprise Desktop 11 SP3: zypper in -t patch sledsp3-MozillaFirefox-201404-9185 To bring your system up-to-date, use "zypper patch". Package List: - SUSE Linux Enterprise Software Development Kit 11 SP3 (i586 ia64 ppc64 s390x x86_64) [New Version: 3.16 and 4.10.4]: MozillaFirefox-devel-24.5.0esr-0.8.1 mozilla-nspr-devel-4.10.4-0.3.1 mozilla-nss-devel-3.16-0.8.1 - SUSE Linux Enterprise Server 11 SP3 for VMware (i586 x86_64) [New Version: 24.5.0esr,3.16 and 4.10.4]: MozillaFirefox-24.5.0esr-0.8.1 MozillaFirefox-translations-24.5.0esr-0.8.1 libfreebl3-3.16-0.8.1 libsoftokn3-3.16-0.8.1 mozilla-nspr-4.10.4-0.3.1 mozilla-nss-3.16-0.8.1 mozilla-nss-tools-3.16-0.8.1 - SUSE Linux Enterprise Server 11 SP3 for VMware (x86_64) [New Version: 3.16 and 4.10.4]: libfreebl3-32bit-3.16-0.8.1 libsoftokn3-32bit-3.16-0.8.1 mozilla-nspr-32bit-4.10.4-0.3.1 mozilla-nss-32bit-3.16-0.8.1 - SUSE Linux Enterprise Server 11 SP3 (i586 ia64 ppc64 s390x x86_64) [New Version: 24.5.0esr,3.16 and 4.10.4]: MozillaFirefox-24.5.0esr-0.8.1 MozillaFirefox-branding-SLED-24-0.7.36 MozillaFirefox-translations-24.5.0esr-0.8.1 libfreebl3-3.16-0.8.1 libsoftokn3-3.16-0.8.1 mozilla-nspr-4.10.4-0.3.1 mozilla-nss-3.16-0.8.1 mozilla-nss-tools-3.16-0.8.1 - SUSE Linux Enterprise Server 11 SP3 (ppc64 s390x x86_64) [New Version: 3.16 and 4.10.4]: libfreebl3-32bit-3.16-0.8.1 libsoftokn3-32bit-3.16-0.8.1 mozilla-nspr-32bit-4.10.4-0.3.1 mozilla-nss-32bit-3.16-0.8.1 - SUSE Linux Enterprise Server 11 SP3 (ia64) [New Version: 3.16 and 4.10.4]: libfreebl3-x86-3.16-0.8.1 libsoftokn3-x86-3.16-0.8.1 mozilla-nspr-x86-4.10.4-0.3.1 mozilla-nss-x86-3.16-0.8.1 - SUSE Linux Enterprise Desktop 11 SP3 (i586 x86_64) [New Version: 24.5.0esr,3.16 and 4.10.4]: MozillaFirefox-24.5.0esr-0.8.1 MozillaFirefox-branding-SLED-24-0.7.36 MozillaFirefox-translations-24.5.0esr-0.8.1 libfreebl3-3.16-0.8.1 libsoftokn3-3.16-0.8.1 mozilla-nspr-4.10.4-0.3.1 mozilla-nss-3.16-0.8.1 mozilla-nss-tools-3.16-0.8.1 - SUSE Linux Enterprise Desktop 11 SP3 (x86_64) [New Version: 3.16 and 4.10.4]: libfreebl3-32bit-3.16-0.8.1 libsoftokn3-32bit-3.16-0.8.1 mozilla-nspr-32bit-4.10.4-0.3.1 mozilla-nss-32bit-3.16-0.8.1 References: http://support.novell.com/security/cve/CVE-2014-1518.html http://support.novell.com/security/cve/CVE-2014-1520.html http://support.novell.com/security/cve/CVE-2014-1523.html http://support.novell.com/security/cve/CVE-2014-1524.html http://support.novell.com/security/cve/CVE-2014-1529.html http://support.novell.com/security/cve/CVE-2014-1530.html http://support.novell.com/security/cve/CVE-2014-1531.html http://support.novell.com/security/cve/CVE-2014-1532.html https://bugzilla.novell.com/865539 https://bugzilla.novell.com/869827 https://bugzilla.novell.com/875378 https://bugzilla.novell.com/875803 http://download.suse.com/patch/finder/?keywords=10e2fe4f221c02f421ee93cc336… -- To unsubscribe, e-mail: opensuse-security-announce+unsubscribe(a)opensuse.org For additional commands, e-mail: opensuse-security-announce+help(a)opensuse.org

1 0

[security-announce] SUSE-SU-2014:0623-1: important: Security update for kvm
by opensuse-security＠opensuse.org 08 May '14

08 May '14

SUSE Security Update: Security update for kvm ______________________________________________________________________________ Announcement ID: SUSE-SU-2014:0623-1 Rating: important References: #812983 #817593 #842006 #864802 #870439 Cross-References: CVE-2013-2016 CVE-2013-4344 CVE-2013-4541 CVE-2014-0142 CVE-2014-0143 CVE-2014-0144 CVE-2014-0145 CVE-2014-0146 CVE-2014-0147 Affected Products: SUSE Linux Enterprise Server 11 SP3 SUSE Linux Enterprise Desktop 11 SP3 ______________________________________________________________________________ An update that fixes 9 vulnerabilities is now available. It includes one version update. Description: The QEMU embedded within KVM received various security fixes. Various issues in the block layer have been fixed: * A virtio security issue in config io space handling (CVE-2013-2016). * A SCSI report LUNs buffer overflow (CVE-2013-4344). * A buffer overflow in the QEMU USB stack (CVE-2013-4541). Security Issue references: * CVE-2013-2016 <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2013-2016 > * CVE-2013-4344 <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2013-4344 > * CVE-2013-4541 <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2013-4541 > * CVE-2014-0142 <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-0142 > * CVE-2014-0143 <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-0143 > * CVE-2014-0144 <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-0144 > * CVE-2014-0145 <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-0145 > * CVE-2014-0146 <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-0146 > * CVE-2014-0147 <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-0147 > Patch Instructions: To install this SUSE Security Update use YaST online_update. Alternatively you can run the command listed for your product: - SUSE Linux Enterprise Server 11 SP3: zypper in -t patch slessp3-kvm-9142 - SUSE Linux Enterprise Desktop 11 SP3: zypper in -t patch sledsp3-kvm-9142 To bring your system up-to-date, use "zypper patch". Package List: - SUSE Linux Enterprise Server 11 SP3 (i586 s390x x86_64) [New Version: 1.4.2]: kvm-1.4.2-0.11.1 - SUSE Linux Enterprise Desktop 11 SP3 (i586 x86_64) [New Version: 1.4.2]: kvm-1.4.2-0.11.1 References: http://support.novell.com/security/cve/CVE-2013-2016.html http://support.novell.com/security/cve/CVE-2013-4344.html http://support.novell.com/security/cve/CVE-2013-4541.html http://support.novell.com/security/cve/CVE-2014-0142.html http://support.novell.com/security/cve/CVE-2014-0143.html http://support.novell.com/security/cve/CVE-2014-0144.html http://support.novell.com/security/cve/CVE-2014-0145.html http://support.novell.com/security/cve/CVE-2014-0146.html http://support.novell.com/security/cve/CVE-2014-0147.html https://bugzilla.novell.com/812983 https://bugzilla.novell.com/817593 https://bugzilla.novell.com/842006 https://bugzilla.novell.com/864802 https://bugzilla.novell.com/870439 http://download.suse.com/patch/finder/?keywords=7b040d1de764d7e94156d09f838… -- To unsubscribe, e-mail: opensuse-security-announce+unsubscribe(a)opensuse.org For additional commands, e-mail: opensuse-security-announce+help(a)opensuse.org

1 0

[security-announce] SUSE-SU-2014:0605-1: important: Security update for flash-player
by opensuse-security＠opensuse.org 02 May '14

02 May '14

SUSE Security Update: Security update for flash-player ______________________________________________________________________________ Announcement ID: SUSE-SU-2014:0605-1 Rating: important References: #875577 Cross-References: CVE-2014-0515 Affected Products: SUSE Linux Enterprise Desktop 11 SP3 ______________________________________________________________________________ An update that fixes one vulnerability is now available. It includes one version update. Description: This flash-player update to version 11.2.202.356 fixes the following critical security issue: * bnc#875577: buffer overflow vulnerability that leads to arbitrary code execution (CVE-2014-0515) Adobe Security Bulletin (APSB14-13) http://helpx.adobe.com/security/products/flash-player/apsb14 -13.html <http://helpx.adobe.com/security/products/flash-player/apsb1 4-13.html> Security Issue reference: * CVE-2014-0515 <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-0515 > Patch Instructions: To install this SUSE Security Update use YaST online_update. Alternatively you can run the command listed for your product: - SUSE Linux Enterprise Desktop 11 SP3: zypper in -t patch sledsp3-flash-player-9180 To bring your system up-to-date, use "zypper patch". Package List: - SUSE Linux Enterprise Desktop 11 SP3 (i586 x86_64) [New Version: 11.2.202.356]: flash-player-11.2.202.356-0.3.1 flash-player-gnome-11.2.202.356-0.3.1 flash-player-kde4-11.2.202.356-0.3.1 References: http://support.novell.com/security/cve/CVE-2014-0515.html https://bugzilla.novell.com/875577 http://download.suse.com/patch/finder/?keywords=13b3990a87aeceff827af4e5eea… -- To unsubscribe, e-mail: opensuse-security-announce+unsubscribe(a)opensuse.org For additional commands, e-mail: opensuse-security-announce+help(a)opensuse.org

1 0

[security-announce] openSUSE-SU-2014:0589-1: critical: update for flash-player
by opensuse-security＠opensuse.org 01 May '14

01 May '14

openSUSE Security Update: update for flash-player ______________________________________________________________________________ Announcement ID: openSUSE-SU-2014:0589-1 Rating: critical References: #875577 Cross-References: CVE-2014-0515 Affected Products: openSUSE 11.4 ______________________________________________________________________________ An update that fixes one vulnerability is now available. Description: This flash-player update fixes a critical buffer overflow vulnerability that leads to arbitrary code execution. The flash-player package was updated to version 11.2.202.356. * bnc#875577, APSB14-13, CVE-2014-0515 Patch Instructions: To install this openSUSE Security Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE 11.4: zypper in -t patch 2014-48 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE 11.4 (i586 x86_64): flash-player-11.2.202.356-107.1 flash-player-gnome-11.2.202.356-107.1 flash-player-kde4-11.2.202.356-107.1 References: http://support.novell.com/security/cve/CVE-2014-0515.html https://bugzilla.novell.com/875577 -- To unsubscribe, e-mail: opensuse-security-announce+unsubscribe(a)opensuse.org For additional commands, e-mail: opensuse-security-announce+help(a)opensuse.org

1 0