December 2014 - openSUSE Security Announce

[security-announce] openSUSE-SU-2014:1626-1: important: Security update for chromium
by opensuse-security＠opensuse.org 12 Dec '14

12 Dec '14

openSUSE Security Update: Security update for chromium ______________________________________________________________________________ Announcement ID: openSUSE-SU-2014:1626-1 Rating: important References: #906317 #906318 #906319 #906320 #906321 #906322 #906323 #906324 #906326 #906327 #906328 #906330 Cross-References: CVE-2014-0574 CVE-2014-7899 CVE-2014-7900 CVE-2014-7901 CVE-2014-7902 CVE-2014-7903 CVE-2014-7904 CVE-2014-7905 CVE-2014-7906 CVE-2014-7907 CVE-2014-7908 CVE-2014-7909 CVE-2014-7910 Affected Products: openSUSE 13.2 openSUSE 13.1 ______________________________________________________________________________ An update that fixes 13 vulnerabilities is now available. Description: chromium was updated to version 39.0.2171.65 to fix 13 security issues. These security issues were fixed: - Use-after-free in pepper plugins (CVE-2014-7906). - Buffer overflow in OpenJPEG before r2911 in PDFium, as used in Google Chromebefore 39.0.2171.65, al... (CVE-2014-7903). - Uninitialized memory read in Skia (CVE-2014-7909). - Unspecified security issues (CVE-2014-7910). - Integer overflow in media (CVE-2014-7908). - Integer overflow in the opj_t2_read_packet_data function infxcodec/fx_libopenjpeg/libopenjpeg20/t2.... (CVE-2014-7901). - Use-after-free in blink (CVE-2014-7907). - Address bar spoofing (CVE-2014-7899). - Buffer overflow in Skia (CVE-2014-7904). - Use-after-free vulnerability in the CPDF_Parser (CVE-2014-7900). - Use-after-free vulnerability in PDFium allows DoS (CVE-2014-7902). - Flaw allowing navigation to intents that do not have the BROWSABLE category (CVE-2014-7905). - Double-free in Flash (CVE-2014-0574). Patch Instructions: To install this openSUSE Security Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE 13.2: zypper in -t patch openSUSE-2014-764 - openSUSE 13.1: zypper in -t patch openSUSE-2014-764 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE 13.2 (i586 x86_64): chromedriver-39.0.2171.65-4.4 chromedriver-debuginfo-39.0.2171.65-4.4 chromium-39.0.2171.65-4.4 chromium-debuginfo-39.0.2171.65-4.4 chromium-debugsource-39.0.2171.65-4.4 chromium-desktop-gnome-39.0.2171.65-4.4 chromium-desktop-kde-39.0.2171.65-4.4 chromium-ffmpegsumo-39.0.2171.65-4.4 chromium-ffmpegsumo-debuginfo-39.0.2171.65-4.4 - openSUSE 13.1 (i586 x86_64): chromedriver-39.0.2171.65-58.4 chromedriver-debuginfo-39.0.2171.65-58.4 chromium-39.0.2171.65-58.4 chromium-debuginfo-39.0.2171.65-58.4 chromium-debugsource-39.0.2171.65-58.4 chromium-desktop-gnome-39.0.2171.65-58.4 chromium-desktop-kde-39.0.2171.65-58.4 chromium-ffmpegsumo-39.0.2171.65-58.4 chromium-ffmpegsumo-debuginfo-39.0.2171.65-58.4 References: http://support.novell.com/security/cve/CVE-2014-0574.html http://support.novell.com/security/cve/CVE-2014-7899.html http://support.novell.com/security/cve/CVE-2014-7900.html http://support.novell.com/security/cve/CVE-2014-7901.html http://support.novell.com/security/cve/CVE-2014-7902.html http://support.novell.com/security/cve/CVE-2014-7903.html http://support.novell.com/security/cve/CVE-2014-7904.html http://support.novell.com/security/cve/CVE-2014-7905.html http://support.novell.com/security/cve/CVE-2014-7906.html http://support.novell.com/security/cve/CVE-2014-7907.html http://support.novell.com/security/cve/CVE-2014-7908.html http://support.novell.com/security/cve/CVE-2014-7909.html http://support.novell.com/security/cve/CVE-2014-7910.html https://bugzilla.suse.com/show_bug.cgi?id=906317 https://bugzilla.suse.com/show_bug.cgi?id=906318 https://bugzilla.suse.com/show_bug.cgi?id=906319 https://bugzilla.suse.com/show_bug.cgi?id=906320 https://bugzilla.suse.com/show_bug.cgi?id=906321 https://bugzilla.suse.com/show_bug.cgi?id=906322 https://bugzilla.suse.com/show_bug.cgi?id=906323 https://bugzilla.suse.com/show_bug.cgi?id=906324 https://bugzilla.suse.com/show_bug.cgi?id=906326 https://bugzilla.suse.com/show_bug.cgi?id=906327 https://bugzilla.suse.com/show_bug.cgi?id=906328 https://bugzilla.suse.com/show_bug.cgi?id=906330 -- To unsubscribe, e-mail: opensuse-security-announce+unsubscribe(a)opensuse.org For additional commands, e-mail: opensuse-security-announce+help(a)opensuse.org

1 0

[security-announce] SUSE-SU-2014:1624-1: important: Security update for Mozilla Firefox
by opensuse-security＠opensuse.org 12 Dec '14

12 Dec '14

SUSE Security Update: Security update for Mozilla Firefox ______________________________________________________________________________ Announcement ID: SUSE-SU-2014:1624-1 Rating: important References: #908009 Cross-References: CVE-2014-1587 CVE-2014-1588 CVE-2014-1589 CVE-2014-1590 CVE-2014-1591 CVE-2014-1592 CVE-2014-1593 CVE-2014-1594 CVE-2014-1595 Affected Products: SUSE Linux Enterprise Software Development Kit 11 SP3 SUSE Linux Enterprise Server 11 SP3 for VMware SUSE Linux Enterprise Server 11 SP3 SUSE Linux Enterprise Server 11 SP2 LTSS SUSE Linux Enterprise Server 11 SP1 LTSS SUSE Linux Enterprise Server 10 SP4 LTSS SUSE Linux Enterprise Desktop 11 SP3 ______________________________________________________________________________ An update that fixes 9 vulnerabilities is now available. It includes one version update. Description: Mozilla Firefox has been updated to the 31.3ESR release fixing bugs and security issues. * MFSA 2014-83 / CVE-2014-1588 / CVE-2014-1587: Mozilla developers and community identified and fixed several memory safety bugs in the browser engine used in Firefox and other Mozilla-based products. Some of these bugs showed evidence of memory corruption under certain circumstances, and we presume that with enough effort at least some of these could be exploited to run arbitrary code. * MFSA 2014-85 / CVE-2014-1590: Security researcher Joe Vennix from Rapid7 reported that passing a JavaScript object to XMLHttpRequest that mimics an input stream will a crash. This crash is not exploitable and can only be used for denial of service attacks. * MFSA 2014-87 / CVE-2014-1592: Security researcher Berend-Jan Wever reported a use-after-free created by triggering the creation of a second root element while parsing HTML written to a document created with document.open(). This leads to a potentially exploitable crash. * MFSA 2014-88 / CVE-2014-1593: Security researcher Abhishek Arya (Inferno) of the Google Chrome Security Team used the Address Sanitizer tool to discover a buffer overflow during the parsing of media content. This leads to a potentially exploitable crash. * MFSA 2014-89 / CVE-2014-1594: Security researchers Byoungyoung Lee, Chengyu Song, and Taesoo Kim at the Georgia Tech Information Security Center (GTISC) reported a bad casting from the BasicThebesLayer to BasicContainerLayer, resulting in undefined behavior. This behavior is potentially exploitable with some compilers but no clear mechanism to trigger it through web content was identified. * MFSA 2014-90 / CVE-2014-1595: Security researcher Kent Howard reported an Apple issue present in OS X 10.10 (Yosemite) where log files are created by the CoreGraphics framework of OS X in the /tmp local directory. These log files contain a record of all inputs into Mozilla programs during their operation. In versions of OS X from versions 10.6 through 10.9, the CoreGraphics had this logging ability but it was turned off by default. In OS X 10.10, this logging was turned on by default for some applications that use a custom memory allocator, such as jemalloc, because of an initialization bug in the framework. This issue has been addressed in Mozilla products by explicitly turning off the framework's logging of input events. On vulnerable systems, this issue can result in private data such as usernames, passwords, and other inputed data being saved to a log file on the local system. Security Issues: * CVE-2014-1587 <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-1587> * CVE-2014-1588 <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-1588> * CVE-2014-1589 <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-1589> * CVE-2014-1590 <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-1590> * CVE-2014-1591 <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-1591> * CVE-2014-1592 <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-1592> * CVE-2014-1593 <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-1593> * CVE-2014-1594 <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-1594> * CVE-2014-1595 <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-1595> Patch Instructions: To install this SUSE Security Update use YaST online_update. Alternatively you can run the command listed for your product: - SUSE Linux Enterprise Software Development Kit 11 SP3: zypper in -t patch sdksp3-firefox-201412-10064 - SUSE Linux Enterprise Server 11 SP3 for VMware: zypper in -t patch slessp3-firefox-201412-10064 - SUSE Linux Enterprise Server 11 SP3: zypper in -t patch slessp3-firefox-201412-10064 - SUSE Linux Enterprise Server 11 SP2 LTSS: zypper in -t patch slessp2-firefox-201412-10065 - SUSE Linux Enterprise Server 11 SP1 LTSS: zypper in -t patch slessp1-firefox-201412-10066 - SUSE Linux Enterprise Desktop 11 SP3: zypper in -t patch sledsp3-firefox-201412-10064 To bring your system up-to-date, use "zypper patch". Package List: - SUSE Linux Enterprise Software Development Kit 11 SP3 (i586 ia64 ppc64 s390x x86_64): MozillaFirefox-devel-31.3.0esr-0.8.1 - SUSE Linux Enterprise Server 11 SP3 for VMware (i586 x86_64) [New Version: 31.3.0esr]: MozillaFirefox-31.3.0esr-0.8.1 MozillaFirefox-translations-31.3.0esr-0.8.1 - SUSE Linux Enterprise Server 11 SP3 (i586 ia64 ppc64 s390x x86_64) [New Version: 31.3.0esr]: MozillaFirefox-31.3.0esr-0.8.1 MozillaFirefox-translations-31.3.0esr-0.8.1 - SUSE Linux Enterprise Server 11 SP2 LTSS (i586 s390x x86_64) [New Version: 31.3.0esr]: MozillaFirefox-31.3.0esr-0.3.1 MozillaFirefox-translations-31.3.0esr-0.3.1 - SUSE Linux Enterprise Server 11 SP1 LTSS (i586 s390x x86_64) [New Version: 31.3.0esr]: MozillaFirefox-31.3.0esr-0.3.1 MozillaFirefox-translations-31.3.0esr-0.3.1 - SUSE Linux Enterprise Server 10 SP4 LTSS (i586 s390x): MozillaFirefox-31.3.0esr-0.5.1 MozillaFirefox-translations-31.3.0esr-0.5.1 - SUSE Linux Enterprise Desktop 11 SP3 (i586 x86_64) [New Version: 31.3.0esr]: MozillaFirefox-31.3.0esr-0.8.1 MozillaFirefox-translations-31.3.0esr-0.8.1 References: http://support.novell.com/security/cve/CVE-2014-1587.html http://support.novell.com/security/cve/CVE-2014-1588.html http://support.novell.com/security/cve/CVE-2014-1589.html http://support.novell.com/security/cve/CVE-2014-1590.html http://support.novell.com/security/cve/CVE-2014-1591.html http://support.novell.com/security/cve/CVE-2014-1592.html http://support.novell.com/security/cve/CVE-2014-1593.html http://support.novell.com/security/cve/CVE-2014-1594.html http://support.novell.com/security/cve/CVE-2014-1595.html https://bugzilla.suse.com/show_bug.cgi?id=908009 http://download.suse.com/patch/finder/?keywords=0615641fb2f45aa54681190d0d6… http://download.suse.com/patch/finder/?keywords=4ffa3a796b6b4288bb70c145016… http://download.suse.com/patch/finder/?keywords=a163293f68a3f574c56b72fa5f1… http://download.suse.com/patch/finder/?keywords=d622a076d6545627a78da4f5c5e… -- To unsubscribe, e-mail: opensuse-security-announce+unsubscribe(a)opensuse.org For additional commands, e-mail: opensuse-security-announce+help(a)opensuse.org

1 0

[security-announce] openSUSE-SU-2014:1622-1: critical: Security update for flash-player
by opensuse-security＠opensuse.org 11 Dec '14

11 Dec '14

openSUSE Security Update: Security update for flash-player ______________________________________________________________________________ Announcement ID: openSUSE-SU-2014:1622-1 Rating: critical References: Cross-References: CVE-2014-0580 CVE-2014-0587 CVE-2014-8443 CVE-2014-9162 CVE-2014-9163 CVE-2014-9164 Affected Products: openSUSE Evergreen 11.4 ______________________________________________________________________________ An update that fixes 6 vulnerabilities is now available. Description: Flash-player was updated to version 11.2.202.245 fixing numerous vulnerabilities: *memory corruption vulnerabilities that could lead to code execution (CVE-2014-0587, CVE-2014-9164). *use-after-free vulnerability that could lead to code execution (CVE-2014-8443). *stack-based buffer overflow vulnerability that could lead to code execution (CVE-2014-9163). *information disclosure vulnerability (CVE-2014-9162). *vulnerability that could be exploited to circumvent the same-origin policy (CVE-2014-0580). Patch Instructions: To install this openSUSE Security Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE Evergreen 11.4: zypper in -t patch 2014-92 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE Evergreen 11.4 (i586 x86_64): flash-player-11.2.202.425-135.1 flash-player-gnome-11.2.202.425-135.1 flash-player-kde4-11.2.202.425-135.1 References: http://support.novell.com/security/cve/CVE-2014-0580.html http://support.novell.com/security/cve/CVE-2014-0587.html http://support.novell.com/security/cve/CVE-2014-8443.html http://support.novell.com/security/cve/CVE-2014-9162.html http://support.novell.com/security/cve/CVE-2014-9163.html http://support.novell.com/security/cve/CVE-2014-9164.html -- To unsubscribe, e-mail: opensuse-security-announce+unsubscribe(a)opensuse.org For additional commands, e-mail: opensuse-security-announce+help(a)opensuse.org

1 0

[security-announce] openSUSE-SU-2014:1621-1: important: fix server crash caused by malformed network packet.
by opensuse-security＠opensuse.org 11 Dec '14

11 Dec '14

openSUSE Security Update: fix server crash caused by malformed network packet. ______________________________________________________________________________ Announcement ID: openSUSE-SU-2014:1621-1 Rating: important References: #908127 Affected Products: openSUSE Evergreen 11.4 ______________________________________________________________________________ An update that contains security fixes can now be installed. Description: This patch contains a fix for Firebird server crashes when handling a malformed network packet. Patch Instructions: To install this openSUSE Security Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE Evergreen 11.4: zypper in -t patch 2014-93 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE Evergreen 11.4 (i586 x86_64): firebird-2.1.3.18185.0-20.1 firebird-classic-2.1.3.18185.0-20.1 firebird-classic-debuginfo-2.1.3.18185.0-20.1 firebird-debuginfo-2.1.3.18185.0-20.1 firebird-debugsource-2.1.3.18185.0-20.1 firebird-devel-2.1.3.18185.0-20.1 firebird-devel-debuginfo-2.1.3.18185.0-20.1 firebird-doc-2.1.3.18185.0-20.1 firebird-filesystem-2.1.3.18185.0-20.1 firebird-superserver-2.1.3.18185.0-20.1 firebird-superserver-debuginfo-2.1.3.18185.0-20.1 libfbclient2-2.1.3.18185.0-20.1 libfbclient2-debuginfo-2.1.3.18185.0-20.1 libfbembed2-2.1.3.18185.0-20.1 libfbembed2-debuginfo-2.1.3.18185.0-20.1 References: https://bugzilla.suse.com/show_bug.cgi?id=908127 -- To unsubscribe, e-mail: opensuse-security-announce+unsubscribe(a)opensuse.org For additional commands, e-mail: opensuse-security-announce+help(a)opensuse.org

1 0

[security-announce] SUSE-SU-2014:1619-1: important: Security update for shim
by opensuse-security＠opensuse.org 11 Dec '14

11 Dec '14

SUSE Security Update: Security update for shim ______________________________________________________________________________ Announcement ID: SUSE-SU-2014:1619-1 Rating: important References: #813448 #863205 #866690 #875385 #889332 #889765 Cross-References: CVE-2014-3675 CVE-2014-3676 CVE-2014-3677 Affected Products: SUSE Linux Enterprise Software Development Kit 11 SP3 SUSE Linux Enterprise Server 11 SP3 for VMware SUSE Linux Enterprise Server 11 SP3 SUSE Linux Enterprise Desktop 11 SP3 ______________________________________________________________________________ An update that solves three vulnerabilities and has three fixes is now available. It includes two new package versions. Description: shim has been updated to fix three security issues: * OOB read access when parsing DHCPv6 packets (remote DoS) (CVE-2014-3675). * Heap overflow when parsing IPv6 addresses provided by tftp:// DHCPv6 boot option (RCE) (CVE-2014-3676). * Memory corruption when processing user provided MOK lists (CVE-2014-3677). Security Issues: * CVE-2014-3675 <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-3675> * CVE-2014-3676 <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-3676> * CVE-2014-3677 <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-3677> Patch Instructions: To install this SUSE Security Update use YaST online_update. Alternatively you can run the command listed for your product: - SUSE Linux Enterprise Software Development Kit 11 SP3: zypper in -t patch sdksp3-shim-2014-11-20-9997 - SUSE Linux Enterprise Server 11 SP3 for VMware: zypper in -t patch slessp3-shim-2014-11-20-9997 - SUSE Linux Enterprise Server 11 SP3: zypper in -t patch slessp3-shim-2014-11-20-9997 - SUSE Linux Enterprise Desktop 11 SP3: zypper in -t patch sledsp3-shim-2014-11-20-9997 To bring your system up-to-date, use "zypper patch". Package List: - SUSE Linux Enterprise Software Development Kit 11 SP3 (x86_64) [New Version: 3.0u]: gnu-efi-3.0u-0.7.2 - SUSE Linux Enterprise Server 11 SP3 for VMware (x86_64) [New Version: 0.7.318.81ee561d and 3.0u]: gnu-efi-3.0u-0.7.2 shim-0.7.318.81ee561d-0.9.2 - SUSE Linux Enterprise Server 11 SP3 (x86_64) [New Version: 0.7.318.81ee561d and 3.0u]: gnu-efi-3.0u-0.7.2 shim-0.7.318.81ee561d-0.9.2 - SUSE Linux Enterprise Desktop 11 SP3 (x86_64) [New Version: 0.7.318.81ee561d]: shim-0.7.318.81ee561d-0.9.2 References: http://support.novell.com/security/cve/CVE-2014-3675.html http://support.novell.com/security/cve/CVE-2014-3676.html http://support.novell.com/security/cve/CVE-2014-3677.html https://bugzilla.suse.com/show_bug.cgi?id=813448 https://bugzilla.suse.com/show_bug.cgi?id=863205 https://bugzilla.suse.com/show_bug.cgi?id=866690 https://bugzilla.suse.com/show_bug.cgi?id=875385 https://bugzilla.suse.com/show_bug.cgi?id=889332 https://bugzilla.suse.com/show_bug.cgi?id=889765 http://download.suse.com/patch/finder/?keywords=9aaff893726e6b56bde50850c31… -- To unsubscribe, e-mail: opensuse-security-announce+unsubscribe(a)opensuse.org For additional commands, e-mail: opensuse-security-announce+help(a)opensuse.org

1 0

[security-announce] SUSE-SU-2014:1605-1: important: Security update for OpenVPN
by opensuse-security＠opensuse.org 09 Dec '14

09 Dec '14

SUSE Security Update: Security update for OpenVPN ______________________________________________________________________________ Announcement ID: SUSE-SU-2014:1605-1 Rating: important References: #895882 #907764 Cross-References: CVE-2014-8104 Affected Products: SUSE Linux Enterprise Server 11 SP3 for VMware SUSE Linux Enterprise Server 11 SP3 SUSE Linux Enterprise Desktop 11 SP3 ______________________________________________________________________________ An update that solves one vulnerability and has one errata is now available. Description: This update fixes a critical denial of service vulnerability in OpenVPN: * CVE-2014-8104: Critical denial of service vulnerability in OpenVPN servers that can be triggered by authenticated attackers. Also an incompatibility with OpenVPN and OpenSSL in FIPS mode has been fixed. (bnc#895882) Security Issues: * CVE-2014-8104 <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-8104> Patch Instructions: To install this SUSE Security Update use YaST online_update. Alternatively you can run the command listed for your product: - SUSE Linux Enterprise Server 11 SP3 for VMware: zypper in -t patch slessp3-openvpn-10061 - SUSE Linux Enterprise Server 11 SP3: zypper in -t patch slessp3-openvpn-10061 - SUSE Linux Enterprise Desktop 11 SP3: zypper in -t patch sledsp3-openvpn-10061 To bring your system up-to-date, use "zypper patch". Package List: - SUSE Linux Enterprise Server 11 SP3 for VMware (i586 x86_64): openvpn-2.0.9-143.44.1 openvpn-auth-pam-plugin-2.0.9-143.44.1 - SUSE Linux Enterprise Server 11 SP3 (i586 ia64 ppc64 s390x x86_64): openvpn-2.0.9-143.44.1 openvpn-auth-pam-plugin-2.0.9-143.44.1 - SUSE Linux Enterprise Desktop 11 SP3 (i586 x86_64): openvpn-2.0.9-143.44.1 References: http://support.novell.com/security/cve/CVE-2014-8104.html https://bugzilla.suse.com/show_bug.cgi?id=895882 https://bugzilla.suse.com/show_bug.cgi?id=907764 http://download.suse.com/patch/finder/?keywords=5352ff2473420ef0f67960593d5… -- To unsubscribe, e-mail: opensuse-security-announce+unsubscribe(a)opensuse.org For additional commands, e-mail: opensuse-security-announce+help(a)opensuse.org

1 0

[security-announce] openSUSE-SU-2014:1596-1: important: Security update for docker
by opensuse-security＠opensuse.org 08 Dec '14

08 Dec '14

openSUSE Security Update: Security update for docker ______________________________________________________________________________ Announcement ID: openSUSE-SU-2014:1596-1 Rating: important References: #907012 #907014 Cross-References: CVE-2014-6407 CVE-2014-6408 Affected Products: openSUSE 13.2 ______________________________________________________________________________ An update that fixes two vulnerabilities is now available. Description: docker was updated to version 1.3.2 to fix two security issues. These security issues were fixed: - Symbolic and hardlink issues leading to privilege escalation (CVE-2014-6407). - Potential container escalation (CVE-2014-6408). There non-security issues were fixed: - Fix deadlock in docker ps -f exited=1 - Fix a bug when --volumes-from references a container that failed to start - --insecure-registry now accepts CIDR notation such as 10.1.0.0/16 - Private registries whose IPs fall in the 127.0.0.0/8 range do no need the --insecure-registry flag - Skip the experimental registry v2 API when mirroring is enabled - Fixed minor packaging issues. Patch Instructions: To install this openSUSE Security Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE 13.2: zypper in -t patch openSUSE-2014-757 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE 13.2 (x86_64): docker-1.3.2-9.1 docker-debuginfo-1.3.2-9.1 docker-debugsource-1.3.2-9.1 - openSUSE 13.2 (noarch): docker-bash-completion-1.3.2-9.1 docker-zsh-completion-1.3.2-9.1 References: http://support.novell.com/security/cve/CVE-2014-6407.html http://support.novell.com/security/cve/CVE-2014-6408.html https://bugzilla.suse.com/show_bug.cgi?id=907012 https://bugzilla.suse.com/show_bug.cgi?id=907014 -- To unsubscribe, e-mail: opensuse-security-announce+unsubscribe(a)opensuse.org For additional commands, e-mail: opensuse-security-announce+help(a)opensuse.org

1 0

[security-announce] openSUSE-SU-2014:1594-1: important: Security update for openvpn
by opensuse-security＠opensuse.org 08 Dec '14

08 Dec '14

openSUSE Security Update: Security update for openvpn ______________________________________________________________________________ Announcement ID: openSUSE-SU-2014:1594-1 Rating: important References: #907764 Cross-References: CVE-2014-8104 Affected Products: openSUSE 13.2 openSUSE 13.1 openSUSE 12.3 ______________________________________________________________________________ An update that fixes one vulnerability is now available. Description: openvpn was updated to fix a denial-of-service vulnerability where an authenticated client could stop the server by triggering a server-side ASSERT (bnc#907764,CVE-2014-8104), Patch Instructions: To install this openSUSE Security Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE 13.2: zypper in -t patch openSUSE-2014-759 - openSUSE 13.1: zypper in -t patch openSUSE-2014-759 - openSUSE 12.3: zypper in -t patch openSUSE-2014-759 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE 13.2 (i586 x86_64): openvpn-2.3.4-2.4.1 openvpn-auth-pam-plugin-2.3.4-2.4.1 openvpn-auth-pam-plugin-debuginfo-2.3.4-2.4.1 openvpn-debuginfo-2.3.4-2.4.1 openvpn-debugsource-2.3.4-2.4.1 openvpn-down-root-plugin-2.3.4-2.4.1 openvpn-down-root-plugin-debuginfo-2.3.4-2.4.1 - openSUSE 13.1 (i586 x86_64): openvpn-2.3.2-3.4.1 openvpn-auth-pam-plugin-2.3.2-3.4.1 openvpn-auth-pam-plugin-debuginfo-2.3.2-3.4.1 openvpn-debuginfo-2.3.2-3.4.1 openvpn-debugsource-2.3.2-3.4.1 openvpn-down-root-plugin-2.3.2-3.4.1 openvpn-down-root-plugin-debuginfo-2.3.2-3.4.1 - openSUSE 12.3 (i586 x86_64): openvpn-2.2.2-9.9.1 openvpn-auth-pam-plugin-2.2.2-9.9.1 openvpn-auth-pam-plugin-debuginfo-2.2.2-9.9.1 openvpn-debuginfo-2.2.2-9.9.1 openvpn-debugsource-2.2.2-9.9.1 openvpn-down-root-plugin-2.2.2-9.9.1 openvpn-down-root-plugin-debuginfo-2.2.2-9.9.1 References: http://support.novell.com/security/cve/CVE-2014-8104.html https://bugzilla.suse.com/show_bug.cgi?id=907764 -- To unsubscribe, e-mail: opensuse-security-announce+unsubscribe(a)opensuse.org For additional commands, e-mail: opensuse-security-announce+help(a)opensuse.org

1 0

[security-announce] SUSE-SU-2014:1574-1: important: Security update for clamav
by opensuse-security＠opensuse.org 05 Dec '14

05 Dec '14

SUSE Security Update: Security update for clamav ______________________________________________________________________________ Announcement ID: SUSE-SU-2014:1574-1 Rating: important References: #903489 #903719 #904207 #906077 #906770 Cross-References: CVE-2013-6497 CVE-2014-9050 Affected Products: SUSE Linux Enterprise Server 11 SP3 for VMware SUSE Linux Enterprise Server 11 SP3 SUSE Linux Enterprise Server 10 SP4 LTSS SUSE Linux Enterprise Desktop 11 SP3 ______________________________________________________________________________ An update that solves two vulnerabilities and has three fixes is now available. It includes one version update. Description: clamav was updated to version 0.98.5 to fix three security issues and several non-security issues. These security issues have been fixed: * Crash when scanning maliciously crafted yoda's crypter files (CVE-2013-6497). * Heap-based buffer overflow when scanning crypted PE files (CVE-2014-9050). * Crash when using 'clamscan -a'. These non-security issues have been fixed: * Support for the XDP file format and extracting, decoding, and scanning PDF files within XDP files. * Addition of shared library support for LLVM versions 3.1 - 3.5 for the purpose of just-in-time(JIT) compilation of ClamAV bytecode signatures. * Enhancements to the clambc command line utility to assist ClamAV bytecode signature authors by providing introspection into compiled bytecode programs. * Resolution of many of the warning messages from ClamAV compilation. * Improved detection of malicious PE files. * ClamAV 0.98.5 now works with OpenSSL in FIPS compliant mode (bnc#904207). * Fix server socket setup code in clamd (bnc#903489). * Change updateclamconf to prefer the state of the old config file even for commented-out options (bnc#903719). * Fix infinite loop in clamdscan when clamd is not running. * Fix buffer underruns when handling multi-part MIME email attachments. * Fix configuration of OpenSSL on various platforms. * Fix linking issues with libclamunrar. Security Issues: * CVE-2013-6497 <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2013-6497> * CVE-2014-9050 <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-9050> Patch Instructions: To install this SUSE Security Update use YaST online_update. Alternatively you can run the command listed for your product: - SUSE Linux Enterprise Server 11 SP3 for VMware: zypper in -t patch slessp3-clamav-10016 - SUSE Linux Enterprise Server 11 SP3: zypper in -t patch slessp3-clamav-10016 - SUSE Linux Enterprise Desktop 11 SP3: zypper in -t patch sledsp3-clamav-10016 To bring your system up-to-date, use "zypper patch". Package List: - SUSE Linux Enterprise Server 11 SP3 for VMware (i586 x86_64) [New Version: 0.98.5]: clamav-0.98.5-0.5.1 - SUSE Linux Enterprise Server 11 SP3 (i586 ia64 ppc64 s390x x86_64) [New Version: 0.98.5]: clamav-0.98.5-0.5.1 - SUSE Linux Enterprise Server 10 SP4 LTSS (i586 s390x x86_64) [New Version: 0.98.5]: clamav-0.98.5-0.7.1 - SUSE Linux Enterprise Desktop 11 SP3 (i586 x86_64) [New Version: 0.98.5]: clamav-0.98.5-0.5.1 References: http://support.novell.com/security/cve/CVE-2013-6497.html http://support.novell.com/security/cve/CVE-2014-9050.html https://bugzilla.suse.com/show_bug.cgi?id=903489 https://bugzilla.suse.com/show_bug.cgi?id=903719 https://bugzilla.suse.com/show_bug.cgi?id=904207 https://bugzilla.suse.com/show_bug.cgi?id=906077 https://bugzilla.suse.com/show_bug.cgi?id=906770 http://download.suse.com/patch/finder/?keywords=6c42e45ae40ed1ee02b8a321b52… http://download.suse.com/patch/finder/?keywords=b71adb6b19097f47d8e0eb43a5e… -- To unsubscribe, e-mail: opensuse-security-announce+unsubscribe(a)opensuse.org For additional commands, e-mail: opensuse-security-announce+help(a)opensuse.org

1 0

[security-announce] SUSE-SU-2014:1571-1: important: Security update for clamav
by opensuse-security＠opensuse.org 05 Dec '14

05 Dec '14

SUSE Security Update: Security update for clamav ______________________________________________________________________________ Announcement ID: SUSE-SU-2014:1571-1 Rating: important References: #899395 #903489 #903719 #904207 #906077 #906770 Cross-References: CVE-2013-6497 CVE-2014-9050 Affected Products: SUSE Linux Enterprise Server 11 SP2 LTSS SUSE Linux Enterprise Server 11 SP1 LTSS ______________________________________________________________________________ An update that solves two vulnerabilities and has four fixes is now available. It includes one version update. Description: clamav was updated to version 0.98.5 to fix five security issues: * Crash when scanning maliciously crafted yoda's crypter files (CVE-2013-6497). * Heap-based buffer overflow when scanning crypted PE files (CVE-2014-9050). * Fix heap corruption (CVE-2013-2020). * Fix overflow due to PDF key length computation (CVE-2013-2021). * Crash when using 'clamscan -a'. Several non-security issues have also been fixed, please refer to the package's change log for details. Security Issues: * CVE-2013-6497 <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2013-6497> * CVE-2014-9050 <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-9050> * CVE-2013-2021 <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2013-2021> * CVE-2013-2020 <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2013-2020> Patch Instructions: To install this SUSE Security Update use YaST online_update. Alternatively you can run the command listed for your product: - SUSE Linux Enterprise Server 11 SP2 LTSS: zypper in -t patch slessp2-clamav-10015 - SUSE Linux Enterprise Server 11 SP1 LTSS: zypper in -t patch slessp1-clamav-10014 To bring your system up-to-date, use "zypper patch". Package List: - SUSE Linux Enterprise Server 11 SP2 LTSS (i586 s390x x86_64) [New Version: 0.98.5]: clamav-0.98.5-0.5.1 - SUSE Linux Enterprise Server 11 SP1 LTSS (i586 s390x x86_64) [New Version: 0.98.5]: clamav-0.98.5-0.5.1 References: http://support.novell.com/security/cve/CVE-2013-6497.html http://support.novell.com/security/cve/CVE-2014-9050.html https://bugzilla.suse.com/show_bug.cgi?id=899395 https://bugzilla.suse.com/show_bug.cgi?id=903489 https://bugzilla.suse.com/show_bug.cgi?id=903719 https://bugzilla.suse.com/show_bug.cgi?id=904207 https://bugzilla.suse.com/show_bug.cgi?id=906077 https://bugzilla.suse.com/show_bug.cgi?id=906770 http://download.suse.com/patch/finder/?keywords=21beeab39cfa85199510367c32c… http://download.suse.com/patch/finder/?keywords=da1389754016c53659409dd9ebb… -- To unsubscribe, e-mail: opensuse-security-announce+unsubscribe(a)opensuse.org For additional commands, e-mail: opensuse-security-announce+help(a)opensuse.org

1 0