February 2014 - openSUSE Security Announce

[security-announce] SUSE-SU-2014:0290-1: critical: Security update for flash-player
by opensuse-security＠opensuse.org 25 Feb '14

25 Feb '14

SUSE Security Update: Security update for flash-player ______________________________________________________________________________ Announcement ID: SUSE-SU-2014:0290-1 Rating: critical References: #865021 Cross-References: CVE-2014-0498 CVE-2014-0499 CVE-2014-0502 Affected Products: SUSE Linux Enterprise Desktop 11 SP3 ______________________________________________________________________________ An update that fixes three vulnerabilities is now available. It includes one version update. Description: This update of Adobe Flash Player fixes the following issues: * A stack overflow vulnerability that could have resulted in arbitrary code execution. (CVE-2014-0498) * A memory leak vulnerability that could have been used to defeat memory address layout randomization. (CVE-2014-0499) * A double free vulnerability that could have resulted in arbitrary code execution. (CVE-2014-0502) Security Issue references: * CVE-2014-0498 <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-0498 > * CVE-2014-0499 <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-0499 > * CVE-2014-0502 <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-0502 > Patch Instructions: To install this SUSE Security Update use YaST online_update. Alternatively you can run the command listed for your product: - SUSE Linux Enterprise Desktop 11 SP3: zypper in -t patch sledsp3-flash-player-8922 To bring your system up-to-date, use "zypper patch". Package List: - SUSE Linux Enterprise Desktop 11 SP3 (i586 x86_64) [New Version: 11.2.202.341]: flash-player-11.2.202.341-0.3.1 flash-player-gnome-11.2.202.341-0.3.1 flash-player-kde4-11.2.202.341-0.3.1 References: http://support.novell.com/security/cve/CVE-2014-0498.html http://support.novell.com/security/cve/CVE-2014-0499.html http://support.novell.com/security/cve/CVE-2014-0502.html https://bugzilla.novell.com/865021 http://download.novell.com/patch/finder/?keywords=6003a7ba1dd825daf2236b543… -- To unsubscribe, e-mail: opensuse-security-announce+unsubscribe(a)opensuse.org For additional commands, e-mail: opensuse-security-announce+help(a)opensuse.org

1 0

[security-announce] SUSE-SU-2014:0266-3: important: Security update for IBM Java 6
by opensuse-security＠opensuse.org 24 Feb '14

24 Feb '14

SUSE Security Update: Security update for IBM Java 6 ______________________________________________________________________________ Announcement ID: SUSE-SU-2014:0266-3 Rating: important References: #862064 Cross-References: CVE-2013-5878 CVE-2013-5884 CVE-2013-5887 CVE-2013-5888 CVE-2013-5889 CVE-2013-5896 CVE-2013-5898 CVE-2013-5899 CVE-2013-5907 CVE-2013-5910 CVE-2014-0368 CVE-2014-0373 CVE-2014-0375 CVE-2014-0376 CVE-2014-0387 CVE-2014-0403 CVE-2014-0410 CVE-2014-0411 CVE-2014-0415 CVE-2014-0416 CVE-2014-0417 CVE-2014-0422 CVE-2014-0423 CVE-2014-0424 CVE-2014-0428 Affected Products: SUSE Linux Enterprise Software Development Kit 11 SP3 SUSE Linux Enterprise Server 11 SP3 for VMware SUSE Linux Enterprise Server 11 SP3 SUSE Linux Enterprise Server 11 SP1 LTSS SUSE Linux Enterprise Server 10 SP4 LTSS SUSE Linux Enterprise Java 11 SP3 ______________________________________________________________________________ An update that fixes 25 vulnerabilities is now available. Description: IBM Java 6 was updated to version SR15-FP1 which received security and bug fixes. More information at: http://www.ibm.com/developerworks/java/jdk/alerts/#Oracle_Ja nuary_14_2014_CPU <http://www.ibm.com/developerworks/java/jdk/alerts/#Oracle_J anuary_14_2014_CPU> Security Issue references: * CVE-2014-0428 <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-0428 > * CVE-2014-0422 <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-0422 > * CVE-2013-5907 <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2013-5907 > * CVE-2014-0417 <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-0417 > * CVE-2014-0373 <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-0373 > * CVE-2014-0423 <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-0423 > * CVE-2014-0376 <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-0376 > * CVE-2014-0376 <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-0376 > * CVE-2014-0416 <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-0416 > * CVE-2014-0368 <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-0368 > * CVE-2014-0411 <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-0411 > * CVE-2014-0428 <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-0428 > * CVE-2014-0422 <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-0422 > * CVE-2013-5907 <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2013-5907 > * CVE-2014-0415 <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-0415 > * CVE-2014-0410 <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-0410 > * CVE-2013-5889 <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2013-5889 > * CVE-2014-0417 <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-0417 > * CVE-2014-0387 <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-0387 > * CVE-2014-0424 <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-0424 > * CVE-2013-5878 <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2013-5878 > * CVE-2014-0373 <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-0373 > * CVE-2014-0375 <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-0375 > * CVE-2014-0403 <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-0403 > * CVE-2014-0423 <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-0423 > * CVE-2014-0376 <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-0376 > * CVE-2013-5910 <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2013-5910 > * CVE-2013-5884 <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2013-5884 > * CVE-2013-5896 <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2013-5896 > * CVE-2014-0376 <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-0376 > * CVE-2013-5899 <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2013-5899 > * CVE-2014-0416 <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-0416 > * CVE-2013-5887 <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2013-5887 > * CVE-2014-0368 <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-0368 > * CVE-2013-5888 <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2013-5888 > * CVE-2013-5898 <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2013-5898 > * CVE-2014-0411 <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-0411 > Patch Instructions: To install this SUSE Security Update use YaST online_update. Alternatively you can run the command listed for your product: - SUSE Linux Enterprise Software Development Kit 11 SP3: zypper in -t patch sdksp3-java-1_6_0-ibm-8896 - SUSE Linux Enterprise Server 11 SP3 for VMware: zypper in -t patch slessp3-java-1_6_0-ibm-8896 - SUSE Linux Enterprise Server 11 SP3: zypper in -t patch slessp3-java-1_6_0-ibm-8896 - SUSE Linux Enterprise Server 11 SP1 LTSS: zypper in -t patch slessp1-java-1_6_0-ibm-8901 - SUSE Linux Enterprise Java 11 SP3: zypper in -t patch slejsp3-java-1_6_0-ibm-8896 To bring your system up-to-date, use "zypper patch". Package List: - SUSE Linux Enterprise Software Development Kit 11 SP3 (i586 ppc64 s390x x86_64): java-1_6_0-ibm-devel-1.6.0_sr15.1-0.6.1 - SUSE Linux Enterprise Software Development Kit 11 SP3 (i586 x86_64): java-1_6_0-ibm-1.6.0_sr15.1-0.6.1 java-1_6_0-ibm-fonts-1.6.0_sr15.1-0.6.1 - SUSE Linux Enterprise Server 11 SP3 for VMware (i586 x86_64): java-1_6_0-ibm-1.6.0_sr15.1-0.6.1 java-1_6_0-ibm-fonts-1.6.0_sr15.1-0.6.1 java-1_6_0-ibm-jdbc-1.6.0_sr15.1-0.6.1 java-1_6_0-ibm-plugin-1.6.0_sr15.1-0.6.1 - SUSE Linux Enterprise Server 11 SP3 for VMware (i586): java-1_6_0-ibm-alsa-1.6.0_sr15.1-0.6.1 - SUSE Linux Enterprise Server 11 SP3 (i586 ppc64 s390x x86_64): java-1_6_0-ibm-1.6.0_sr15.1-0.6.1 java-1_6_0-ibm-fonts-1.6.0_sr15.1-0.6.1 java-1_6_0-ibm-jdbc-1.6.0_sr15.1-0.6.1 - SUSE Linux Enterprise Server 11 SP3 (i586 x86_64): java-1_6_0-ibm-plugin-1.6.0_sr15.1-0.6.1 - SUSE Linux Enterprise Server 11 SP3 (i586): java-1_6_0-ibm-alsa-1.6.0_sr15.1-0.6.1 - SUSE Linux Enterprise Server 11 SP1 LTSS (i586 s390x x86_64): java-1_6_0-ibm-1.6.0_sr15.1-0.6.1 java-1_6_0-ibm-fonts-1.6.0_sr15.1-0.6.1 java-1_6_0-ibm-jdbc-1.6.0_sr15.1-0.6.1 - SUSE Linux Enterprise Server 11 SP1 LTSS (i586 x86_64): java-1_6_0-ibm-plugin-1.6.0_sr15.1-0.6.1 - SUSE Linux Enterprise Server 11 SP1 LTSS (i586): java-1_6_0-ibm-alsa-1.6.0_sr15.1-0.6.1 - SUSE Linux Enterprise Server 10 SP4 LTSS (i586 s390x x86_64): java-1_5_0-ibm-1.5.0_sr16.5-0.6.1 java-1_5_0-ibm-devel-1.5.0_sr16.5-0.6.1 java-1_5_0-ibm-fonts-1.5.0_sr16.5-0.6.1 java-1_6_0-ibm-1.6.0_sr15.1-0.15.1 java-1_6_0-ibm-devel-1.6.0_sr15.1-0.15.1 java-1_6_0-ibm-fonts-1.6.0_sr15.1-0.15.1 java-1_6_0-ibm-jdbc-1.6.0_sr15.1-0.15.1 - SUSE Linux Enterprise Server 10 SP4 LTSS (s390x x86_64): java-1_5_0-ibm-32bit-1.5.0_sr16.5-0.6.1 java-1_5_0-ibm-devel-32bit-1.5.0_sr16.5-0.6.1 java-1_6_0-ibm-32bit-1.6.0_sr15.1-0.15.1 java-1_6_0-ibm-devel-32bit-1.6.0_sr15.1-0.15.1 - SUSE Linux Enterprise Server 10 SP4 LTSS (i586 x86_64): java-1_6_0-ibm-plugin-1.6.0_sr15.1-0.15.1 - SUSE Linux Enterprise Server 10 SP4 LTSS (x86_64): java-1_5_0-ibm-alsa-32bit-1.5.0_sr16.5-0.6.1 java-1_6_0-ibm-alsa-32bit-1.6.0_sr15.1-0.15.1 java-1_6_0-ibm-plugin-32bit-1.6.0_sr15.1-0.15.1 - SUSE Linux Enterprise Server 10 SP4 LTSS (i586): java-1_5_0-ibm-alsa-1.5.0_sr16.5-0.6.1 java-1_5_0-ibm-jdbc-1.5.0_sr16.5-0.6.1 java-1_5_0-ibm-plugin-1.5.0_sr16.5-0.6.1 java-1_6_0-ibm-alsa-1.6.0_sr15.1-0.15.1 - SUSE Linux Enterprise Java 11 SP3 (i586 ppc64 s390x x86_64): java-1_6_0-ibm-1.6.0_sr15.1-0.6.1 java-1_6_0-ibm-devel-1.6.0_sr15.1-0.6.1 java-1_6_0-ibm-fonts-1.6.0_sr15.1-0.6.1 java-1_6_0-ibm-jdbc-1.6.0_sr15.1-0.6.1 - SUSE Linux Enterprise Java 11 SP3 (i586 x86_64): java-1_6_0-ibm-plugin-1.6.0_sr15.1-0.6.1 - SUSE Linux Enterprise Java 11 SP3 (i586): java-1_6_0-ibm-alsa-1.6.0_sr15.1-0.6.1 References: http://support.novell.com/security/cve/CVE-2013-5878.html http://support.novell.com/security/cve/CVE-2013-5884.html http://support.novell.com/security/cve/CVE-2013-5887.html http://support.novell.com/security/cve/CVE-2013-5888.html http://support.novell.com/security/cve/CVE-2013-5889.html http://support.novell.com/security/cve/CVE-2013-5896.html http://support.novell.com/security/cve/CVE-2013-5898.html http://support.novell.com/security/cve/CVE-2013-5899.html http://support.novell.com/security/cve/CVE-2013-5907.html http://support.novell.com/security/cve/CVE-2013-5910.html http://support.novell.com/security/cve/CVE-2014-0368.html http://support.novell.com/security/cve/CVE-2014-0373.html http://support.novell.com/security/cve/CVE-2014-0375.html http://support.novell.com/security/cve/CVE-2014-0376.html http://support.novell.com/security/cve/CVE-2014-0387.html http://support.novell.com/security/cve/CVE-2014-0403.html http://support.novell.com/security/cve/CVE-2014-0410.html http://support.novell.com/security/cve/CVE-2014-0411.html http://support.novell.com/security/cve/CVE-2014-0415.html http://support.novell.com/security/cve/CVE-2014-0416.html http://support.novell.com/security/cve/CVE-2014-0417.html http://support.novell.com/security/cve/CVE-2014-0422.html http://support.novell.com/security/cve/CVE-2014-0423.html http://support.novell.com/security/cve/CVE-2014-0424.html http://support.novell.com/security/cve/CVE-2014-0428.html https://bugzilla.novell.com/862064 http://download.novell.com/patch/finder/?keywords=31bff4adf7f4091ce92bf4450… http://download.novell.com/patch/finder/?keywords=49593e2ab0f92f334869c11ea… http://download.novell.com/patch/finder/?keywords=80342541418cc3f0cde43530f… http://download.novell.com/patch/finder/?keywords=bc9c0f6c8b696630ae6e85a99… -- To unsubscribe, e-mail: opensuse-security-announce+unsubscribe(a)opensuse.org For additional commands, e-mail: opensuse-security-announce+help(a)opensuse.org

1 0

[security-announce] openSUSE-SU-2014:0278-1: critical: flash-player: update to 11.2.202.341 security release
by opensuse-security＠opensuse.org 24 Feb '14

24 Feb '14

openSUSE Security Update: flash-player: update to 11.2.202.341 security release ______________________________________________________________________________ Announcement ID: openSUSE-SU-2014:0278-1 Rating: critical References: #865021 Cross-References: CVE-2014-0498 CVE-2014-0499 CVE-2014-0502 Affected Products: openSUSE 11.4 ______________________________________________________________________________ An update that fixes three vulnerabilities is now available. Description: Adobe Flash Player was updated to 11.2.202.341: (bnc#865021) * APSB14-07, CVE-2014-0498 CVE-2014-0499 CVE-2014-0502 - Contents of flashplayer_11_sa.i386.tar.gz changed back: spec file updated, supplementary script (update.sh) updated. Patch Instructions: To install this openSUSE Security Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE 11.4: zypper in -t patch 2014-22 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE 11.4 (i586 x86_64): flash-player-11.2.202.341-95.1 flash-player-gnome-11.2.202.341-95.1 flash-player-kde4-11.2.202.341-95.1 References: http://support.novell.com/security/cve/CVE-2014-0498.html http://support.novell.com/security/cve/CVE-2014-0499.html http://support.novell.com/security/cve/CVE-2014-0502.html https://bugzilla.novell.com/865021 -- To unsubscribe, e-mail: opensuse-security-announce+unsubscribe(a)opensuse.org For additional commands, e-mail: opensuse-security-announce+help(a)opensuse.org

1 0

[security-announce] openSUSE-SU-2014:0277-1: critical: flash-player: update to 11.2.202.341 security release
by opensuse-security＠opensuse.org 24 Feb '14

24 Feb '14

openSUSE Security Update: flash-player: update to 11.2.202.341 security release ______________________________________________________________________________ Announcement ID: openSUSE-SU-2014:0277-1 Rating: critical References: #865021 Cross-References: CVE-2014-0498 CVE-2014-0499 CVE-2014-0502 Affected Products: openSUSE 13.1:NonFree openSUSE 12.3:NonFree ______________________________________________________________________________ An update that fixes three vulnerabilities is now available. Description: Adobe Flash Player was updated to 11.2.202.341: (bnc#865021) * APSB14-07, CVE-2014-0498 CVE-2014-0499 CVE-2014-0502 - Contents of flashplayer_11_sa.i386.tar.gz changed back: spec file updated, supplementary script (update.sh) updated. Patch Instructions: To install this openSUSE Security Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE 13.1:NonFree: zypper in -t patch openSUSE-2014-157 - openSUSE 12.3:NonFree: zypper in -t patch openSUSE-2014-157 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE 13.1:NonFree (i586 x86_64): flash-player-11.2.202.341-34.1 flash-player-gnome-11.2.202.341-34.1 flash-player-kde4-11.2.202.341-34.1 - openSUSE 12.3:NonFree (i586 x86_64): flash-player-11.2.202.341-2.60.1 flash-player-gnome-11.2.202.341-2.60.1 flash-player-kde4-11.2.202.341-2.60.1 References: http://support.novell.com/security/cve/CVE-2014-0498.html http://support.novell.com/security/cve/CVE-2014-0499.html http://support.novell.com/security/cve/CVE-2014-0502.html https://bugzilla.novell.com/865021 -- To unsubscribe, e-mail: opensuse-security-announce+unsubscribe(a)opensuse.org For additional commands, e-mail: opensuse-security-announce+help(a)opensuse.org

1 0

[security-announce] SUSE-SU-2014:0266-2: important: Security update for IBM Java 6
by opensuse-security＠opensuse.org 21 Feb '14

21 Feb '14

SUSE Security Update: Security update for IBM Java 6 ______________________________________________________________________________ Announcement ID: SUSE-SU-2014:0266-2 Rating: important References: #862064 Cross-References: CVE-2013-5878 CVE-2013-5884 CVE-2013-5887 CVE-2013-5888 CVE-2013-5889 CVE-2013-5896 CVE-2013-5898 CVE-2013-5899 CVE-2013-5907 CVE-2013-5910 CVE-2014-0368 CVE-2014-0373 CVE-2014-0375 CVE-2014-0376 CVE-2014-0387 CVE-2014-0403 CVE-2014-0410 CVE-2014-0411 CVE-2014-0415 CVE-2014-0416 CVE-2014-0417 CVE-2014-0422 CVE-2014-0423 CVE-2014-0424 CVE-2014-0428 Affected Products: SUSE Linux Enterprise Server 11 SP2 LTSS ______________________________________________________________________________ An update that fixes 25 vulnerabilities is now available. Description: IBM Java 6 was updated to version SR15-FP1 which received security and bug fixes. More information at: http://www.ibm.com/developerworks/java/jdk/alerts/#Oracle_Ja nuary_14_2014_CPU <http://www.ibm.com/developerworks/java/jdk/alerts/#Oracle_J anuary_14_2014_CPU> Security Issue references: * CVE-2014-0428 <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-0428 > * CVE-2014-0422 <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-0422 > * CVE-2013-5907 <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2013-5907 > * CVE-2014-0417 <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-0417 > * CVE-2014-0373 <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-0373 > * CVE-2014-0423 <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-0423 > * CVE-2014-0376 <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-0376 > * CVE-2014-0376 <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-0376 > * CVE-2014-0416 <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-0416 > * CVE-2014-0368 <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-0368 > * CVE-2014-0411 <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-0411 > * CVE-2014-0428 <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-0428 > * CVE-2014-0422 <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-0422 > * CVE-2013-5907 <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2013-5907 > * CVE-2014-0415 <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-0415 > * CVE-2014-0410 <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-0410 > * CVE-2013-5889 <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2013-5889 > * CVE-2014-0417 <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-0417 > * CVE-2014-0387 <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-0387 > * CVE-2014-0424 <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-0424 > * CVE-2013-5878 <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2013-5878 > * CVE-2014-0373 <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-0373 > * CVE-2014-0375 <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-0375 > * CVE-2014-0403 <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-0403 > * CVE-2014-0423 <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-0423 > * CVE-2014-0376 <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-0376 > * CVE-2013-5910 <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2013-5910 > * CVE-2013-5884 <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2013-5884 > * CVE-2013-5896 <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2013-5896 > * CVE-2014-0376 <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-0376 > * CVE-2013-5899 <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2013-5899 > * CVE-2014-0416 <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-0416 > * CVE-2013-5887 <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2013-5887 > * CVE-2014-0368 <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-0368 > * CVE-2013-5888 <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2013-5888 > * CVE-2013-5898 <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2013-5898 > * CVE-2014-0411 <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-0411 > Patch Instructions: To install this SUSE Security Update use YaST online_update. Alternatively you can run the command listed for your product: - SUSE Linux Enterprise Server 11 SP2 LTSS: zypper in -t patch slessp2-java-1_6_0-ibm-8900 slessp2-java-1_7_0-ibm-8902 To bring your system up-to-date, use "zypper patch". Package List: - SUSE Linux Enterprise Server 11 SP2 LTSS (i586 s390x x86_64): java-1_6_0-ibm-1.6.0_sr15.1-0.6.1 java-1_6_0-ibm-fonts-1.6.0_sr15.1-0.6.1 java-1_6_0-ibm-jdbc-1.6.0_sr15.1-0.6.1 java-1_7_0-ibm-1.7.0_sr6.1-0.8.1 java-1_7_0-ibm-jdbc-1.7.0_sr6.1-0.8.1 - SUSE Linux Enterprise Server 11 SP2 LTSS (i586 x86_64): java-1_6_0-ibm-plugin-1.6.0_sr15.1-0.6.1 java-1_7_0-ibm-alsa-1.7.0_sr6.1-0.8.1 java-1_7_0-ibm-plugin-1.7.0_sr6.1-0.8.1 - SUSE Linux Enterprise Server 11 SP2 LTSS (i586): java-1_6_0-ibm-alsa-1.6.0_sr15.1-0.6.1 References: http://support.novell.com/security/cve/CVE-2013-5878.html http://support.novell.com/security/cve/CVE-2013-5884.html http://support.novell.com/security/cve/CVE-2013-5887.html http://support.novell.com/security/cve/CVE-2013-5888.html http://support.novell.com/security/cve/CVE-2013-5889.html http://support.novell.com/security/cve/CVE-2013-5896.html http://support.novell.com/security/cve/CVE-2013-5898.html http://support.novell.com/security/cve/CVE-2013-5899.html http://support.novell.com/security/cve/CVE-2013-5907.html http://support.novell.com/security/cve/CVE-2013-5910.html http://support.novell.com/security/cve/CVE-2014-0368.html http://support.novell.com/security/cve/CVE-2014-0373.html http://support.novell.com/security/cve/CVE-2014-0375.html http://support.novell.com/security/cve/CVE-2014-0376.html http://support.novell.com/security/cve/CVE-2014-0387.html http://support.novell.com/security/cve/CVE-2014-0403.html http://support.novell.com/security/cve/CVE-2014-0410.html http://support.novell.com/security/cve/CVE-2014-0411.html http://support.novell.com/security/cve/CVE-2014-0415.html http://support.novell.com/security/cve/CVE-2014-0416.html http://support.novell.com/security/cve/CVE-2014-0417.html http://support.novell.com/security/cve/CVE-2014-0422.html http://support.novell.com/security/cve/CVE-2014-0423.html http://support.novell.com/security/cve/CVE-2014-0424.html http://support.novell.com/security/cve/CVE-2014-0428.html https://bugzilla.novell.com/862064 http://download.novell.com/patch/finder/?keywords=3c6eafe266af92731f1280707… http://download.novell.com/patch/finder/?keywords=5bbeed19c42dc4630ad4ad88a… -- To unsubscribe, e-mail: opensuse-security-announce+unsubscribe(a)opensuse.org For additional commands, e-mail: opensuse-security-announce+help(a)opensuse.org

1 0

[security-announce] SUSE-SU-2014:0266-1: important: Security update for IBM Java 6
by opensuse-security＠opensuse.org 20 Feb '14

20 Feb '14

SUSE Security Update: Security update for IBM Java 6 ______________________________________________________________________________ Announcement ID: SUSE-SU-2014:0266-1 Rating: important References: #862064 Cross-References: CVE-2013-5878 CVE-2013-5884 CVE-2013-5887 CVE-2013-5888 CVE-2013-5889 CVE-2013-5896 CVE-2013-5898 CVE-2013-5899 CVE-2013-5907 CVE-2013-5910 CVE-2014-0368 CVE-2014-0373 CVE-2014-0375 CVE-2014-0376 CVE-2014-0387 CVE-2014-0403 CVE-2014-0410 CVE-2014-0411 CVE-2014-0415 CVE-2014-0416 CVE-2014-0417 CVE-2014-0422 CVE-2014-0423 CVE-2014-0424 CVE-2014-0428 Affected Products: SUSE Linux Enterprise Server 10 SP3 LTSS SUSE CORE 9 ______________________________________________________________________________ An update that fixes 25 vulnerabilities is now available. Description: IBM Java 6 was updated to version SR15-FP1 which received security and bugfixes. This release fixes the following problems: * CVE-2014-0428, CVE-2014-0422, CVE-2013-5907, CVE-2014-0415, * CVE-2014-0410, CVE-2013-5889, CVE-2014-0417, CVE-2014-0387, * CVE-2014-0424, CVE-2013-5878, CVE-2014-0373, CVE-2014-0375, * CVE-2014-0403, CVE-2014-0423, CVE-2014-0376, CVE-2013-5910, * CVE-2013-5884, CVE-2013-5896, CVE-2014-0376, CVE-2013-5899, * CVE-2014-0416, CVE-2013-5887, CVE-2014-0368, CVE-2013-5888, * CVE-2013-5898, CVE-2014-0411 More information at: http://www.ibm.com/developerworks/java/jdk/alerts/#Oracle_Ja nuary_14_2014_CPU <http://www.ibm.com/developerworks/java/jdk/alerts/#Oracle_J anuary_14_2014_CPU> Security Issue references: * CVE-2014-0428 <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-0428 > * CVE-2014-0422 <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-0422 > * CVE-2013-5907 <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2013-5907 > * CVE-2014-0417 <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-0417 > * CVE-2014-0373 <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-0373 > * CVE-2014-0423 <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-0423 > * CVE-2014-0376 <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-0376 > * CVE-2014-0376 <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-0376 > * CVE-2014-0416 <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-0416 > * CVE-2014-0368 <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-0368 > * CVE-2014-0411 <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-0411 > * CVE-2014-0428 <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-0428 > * CVE-2014-0422 <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-0422 > * CVE-2013-5907 <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2013-5907 > * CVE-2014-0415 <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-0415 > * CVE-2014-0410 <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-0410 > * CVE-2013-5889 <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2013-5889 > * CVE-2014-0417 <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-0417 > * CVE-2014-0387 <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-0387 > * CVE-2014-0424 <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-0424 > * CVE-2013-5878 <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2013-5878 > * CVE-2014-0373 <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-0373 > * CVE-2014-0375 <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-0375 > * CVE-2014-0403 <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-0403 > * CVE-2014-0423 <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-0423 > * CVE-2014-0376 <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-0376 > * CVE-2013-5910 <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2013-5910 > * CVE-2013-5884 <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2013-5884 > * CVE-2013-5896 <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2013-5896 > * CVE-2014-0376 <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-0376 > * CVE-2013-5899 <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2013-5899 > * CVE-2014-0416 <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-0416 > * CVE-2013-5887 <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2013-5887 > * CVE-2014-0368 <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-0368 > * CVE-2013-5888 <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2013-5888 > * CVE-2013-5898 <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2013-5898 > * CVE-2014-0411 <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-0411 > Package List: - SUSE Linux Enterprise Server 10 SP3 LTSS (i586 s390x x86_64): java-1_5_0-ibm-1.5.0_sr16.5-0.6.1 java-1_5_0-ibm-devel-1.5.0_sr16.5-0.6.1 java-1_5_0-ibm-fonts-1.5.0_sr16.5-0.6.1 java-1_6_0-ibm-1.6.0_sr15.1-0.5.1 java-1_6_0-ibm-devel-1.6.0_sr15.1-0.5.1 java-1_6_0-ibm-fonts-1.6.0_sr15.1-0.5.1 java-1_6_0-ibm-jdbc-1.6.0_sr15.1-0.5.1 - SUSE Linux Enterprise Server 10 SP3 LTSS (s390x x86_64): java-1_5_0-ibm-32bit-1.5.0_sr16.5-0.6.1 java-1_5_0-ibm-devel-32bit-1.5.0_sr16.5-0.6.1 java-1_6_0-ibm-32bit-1.6.0_sr15.1-0.5.1 java-1_6_0-ibm-devel-32bit-1.6.0_sr15.1-0.5.1 - SUSE Linux Enterprise Server 10 SP3 LTSS (i586 x86_64): java-1_6_0-ibm-plugin-1.6.0_sr15.1-0.5.1 - SUSE Linux Enterprise Server 10 SP3 LTSS (x86_64): java-1_5_0-ibm-alsa-32bit-1.5.0_sr16.5-0.6.1 java-1_6_0-ibm-alsa-32bit-1.6.0_sr15.1-0.5.1 java-1_6_0-ibm-plugin-32bit-1.6.0_sr15.1-0.5.1 - SUSE Linux Enterprise Server 10 SP3 LTSS (i586): java-1_5_0-ibm-alsa-1.5.0_sr16.5-0.6.1 java-1_5_0-ibm-jdbc-1.5.0_sr16.5-0.6.1 java-1_5_0-ibm-plugin-1.5.0_sr16.5-0.6.1 java-1_6_0-ibm-alsa-1.6.0_sr15.1-0.5.1 - SUSE CORE 9 (i586 s390 s390x x86_64): IBMJava5-JRE-1.5.0_sr16.5-0.4 IBMJava5-SDK-1.5.0_sr16.5-0.4 References: http://support.novell.com/security/cve/CVE-2013-5878.html http://support.novell.com/security/cve/CVE-2013-5884.html http://support.novell.com/security/cve/CVE-2013-5887.html http://support.novell.com/security/cve/CVE-2013-5888.html http://support.novell.com/security/cve/CVE-2013-5889.html http://support.novell.com/security/cve/CVE-2013-5896.html http://support.novell.com/security/cve/CVE-2013-5898.html http://support.novell.com/security/cve/CVE-2013-5899.html http://support.novell.com/security/cve/CVE-2013-5907.html http://support.novell.com/security/cve/CVE-2013-5910.html http://support.novell.com/security/cve/CVE-2014-0368.html http://support.novell.com/security/cve/CVE-2014-0373.html http://support.novell.com/security/cve/CVE-2014-0375.html http://support.novell.com/security/cve/CVE-2014-0376.html http://support.novell.com/security/cve/CVE-2014-0387.html http://support.novell.com/security/cve/CVE-2014-0403.html http://support.novell.com/security/cve/CVE-2014-0410.html http://support.novell.com/security/cve/CVE-2014-0411.html http://support.novell.com/security/cve/CVE-2014-0415.html http://support.novell.com/security/cve/CVE-2014-0416.html http://support.novell.com/security/cve/CVE-2014-0417.html http://support.novell.com/security/cve/CVE-2014-0422.html http://support.novell.com/security/cve/CVE-2014-0423.html http://support.novell.com/security/cve/CVE-2014-0424.html http://support.novell.com/security/cve/CVE-2014-0428.html https://bugzilla.novell.com/862064 http://download.novell.com/patch/finder/?keywords=5ac9507194ca11bcd295300c1… http://download.novell.com/patch/finder/?keywords=abb9b287dc1d7479726b01b15… http://download.novell.com/patch/finder/?keywords=b4764fb7eed43ec4dce07d7be… -- To unsubscribe, e-mail: opensuse-security-announce+unsubscribe(a)opensuse.org For additional commands, e-mail: opensuse-security-announce+help(a)opensuse.org

1 0

[security-announce] SUSE-SU-2014:0248-2: important: Security update for Mozilla Firefox
by opensuse-security＠opensuse.org 19 Feb '14

19 Feb '14

SUSE Security Update: Security update for Mozilla Firefox ______________________________________________________________________________ Announcement ID: SUSE-SU-2014:0248-2 Rating: important References: #859055 #861847 Cross-References: CVE-2014-1477 CVE-2014-1479 CVE-2014-1480 CVE-2014-1481 CVE-2014-1482 CVE-2014-1483 CVE-2014-1484 CVE-2014-1485 CVE-2014-1486 CVE-2014-1487 CVE-2014-1488 CVE-2014-1489 CVE-2014-1490 CVE-2014-1491 Affected Products: SUSE Linux Enterprise Server 11 SP2 LTSS SUSE Linux Enterprise Server 11 SP1 LTSS ______________________________________________________________________________ An update that fixes 14 vulnerabilities is now available. It includes four new package versions. Description: Mozilla Firefox was updated to the 24.3.0ESR security release. The following security issues have been fixed: * MFSA 2014-01: Memory safety bugs fixed in Firefox ESR 24.3 and Firefox 27.0 (CVE-2014-1477)(bnc#862345) * MFSA 2014-02: Using XBL scopes its possible to steal(clone) native anonymous content (CVE-2014-1479)(bnc#862348) * MFSA 2014-03: Download "open file" dialog delay is too quick, doesn't prevent clickjacking (CVE-2014-1480) * MFSA 2014-04: Image decoding causing FireFox to crash with Goo Create (CVE-2014-1482)(bnc#862356) * MFSA 2014-05: caretPositionFromPoint and elementFromPoint leak information about iframe contents via timing information (CVE-2014-1483)(bnc#862360) * MFSA 2014-06: Fennec leaks profile path to logcat (CVE-2014-1484) * MFSA 2014-07: CSP should block XSLT as script, not as style (CVE-2014-1485) * MFSA 2014-08: imgRequestProxy Use-After-Free Remote Code Execution Vulnerability (CVE-2014-1486) * MFSA 2014-09: Cross-origin information disclosure with error message of Web Workers (CVE-2014-1487) * MFSA 2014-10: settings & history ID bug (CVE-2014-1489) * MFSA 2014-11: Firefox reproducibly crashes when using asm.js code in workers and transferable objects (CVE-2014-1488) * MFSA 2014-12: TOCTOU, potential use-after-free in libssl's session ticket processing (CVE-2014-1490)(bnc#862300) Do not allow p-1 as a public DH value (CVE-2014-1491)(bnc#862289) * MFSA 2014-13: Inconsistent this value when invoking getters on window (CVE-2014-1481)(bnc#862309) Also Mozilla NSS was updated to 3.15.4 release. * required for Firefox 27 * regular CA root store update (1.96) * some OSCP improvments * other bugfixes Security Issue references: * CVE-2014-1477 <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-1477 > * CVE-2014-1479 <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-1479 > * CVE-2014-1480 <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-1480 > * CVE-2014-1481 <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-1481 > * CVE-2014-1482 <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-1482 > * CVE-2014-1483 <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-1483 > * CVE-2014-1484 <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-1484 > * CVE-2014-1485 <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-1485 > * CVE-2014-1486 <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-1486 > * CVE-2014-1487 <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-1487 > * CVE-2014-1488 <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-1488 > * CVE-2014-1489 <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-1489 > * CVE-2014-1490 <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-1490 > * CVE-2014-1491 <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-1491 > Patch Instructions: To install this SUSE Security Update use YaST online_update. Alternatively you can run the command listed for your product: - SUSE Linux Enterprise Server 11 SP2 LTSS: zypper in -t patch slessp2-firefox-201402-8899 - SUSE Linux Enterprise Server 11 SP1 LTSS: zypper in -t patch slessp1-firefox-201402-8898 To bring your system up-to-date, use "zypper patch". Package List: - SUSE Linux Enterprise Server 11 SP2 LTSS (i586 s390x x86_64) [New Version: 24.3.0esr,3.15.4 and 4.10.2]: MozillaFirefox-24.3.0esr-0.4.2.2 MozillaFirefox-branding-SLED-24-0.4.10.4 MozillaFirefox-translations-24.3.0esr-0.4.2.2 firefox-libgcc_s1-4.7.2_20130108-0.16.1 firefox-libstdc++6-4.7.2_20130108-0.16.1 libfreebl3-3.15.4-0.4.2.1 mozilla-nspr-4.10.2-0.3.2 mozilla-nss-3.15.4-0.4.2.1 mozilla-nss-tools-3.15.4-0.4.2.1 - SUSE Linux Enterprise Server 11 SP2 LTSS (s390x x86_64) [New Version: 3.15.4 and 4.10.2]: libfreebl3-32bit-3.15.4-0.4.2.1 mozilla-nspr-32bit-4.10.2-0.3.2 mozilla-nss-32bit-3.15.4-0.4.2.1 - SUSE Linux Enterprise Server 11 SP1 LTSS (i586 s390x x86_64) [New Version: 24,24.3.0esr,3.15.4 and 4.10.2]: MozillaFirefox-24.3.0esr-0.4.2.2 MozillaFirefox-branding-SLED-24-0.4.10.4 MozillaFirefox-translations-24.3.0esr-0.4.2.2 firefox-libgcc_s1-4.7.2_20130108-0.16.1 firefox-libstdc++6-4.7.2_20130108-0.16.1 libfreebl3-3.15.4-0.4.2.1 mozilla-nspr-4.10.2-0.3.2 mozilla-nss-3.15.4-0.4.2.1 mozilla-nss-tools-3.15.4-0.4.2.1 - SUSE Linux Enterprise Server 11 SP1 LTSS (s390x x86_64) [New Version: 3.15.4 and 4.10.2]: libfreebl3-32bit-3.15.4-0.4.2.1 mozilla-nspr-32bit-4.10.2-0.3.2 mozilla-nss-32bit-3.15.4-0.4.2.1 References: http://support.novell.com/security/cve/CVE-2014-1477.html http://support.novell.com/security/cve/CVE-2014-1479.html http://support.novell.com/security/cve/CVE-2014-1480.html http://support.novell.com/security/cve/CVE-2014-1481.html http://support.novell.com/security/cve/CVE-2014-1482.html http://support.novell.com/security/cve/CVE-2014-1483.html http://support.novell.com/security/cve/CVE-2014-1484.html http://support.novell.com/security/cve/CVE-2014-1485.html http://support.novell.com/security/cve/CVE-2014-1486.html http://support.novell.com/security/cve/CVE-2014-1487.html http://support.novell.com/security/cve/CVE-2014-1488.html http://support.novell.com/security/cve/CVE-2014-1489.html http://support.novell.com/security/cve/CVE-2014-1490.html http://support.novell.com/security/cve/CVE-2014-1491.html https://bugzilla.novell.com/859055 https://bugzilla.novell.com/861847 http://download.novell.com/patch/finder/?keywords=30bede649a43f15d0ae5fd407… http://download.novell.com/patch/finder/?keywords=aba5ed8a4574a80ca797b2dbd… -- To unsubscribe, e-mail: opensuse-security-announce+unsubscribe(a)opensuse.org For additional commands, e-mail: opensuse-security-announce+help(a)opensuse.org

1 0

[security-announce] SUSE-SU-2014:0248-1: important: Security update for MozillaFirefox
by opensuse-security＠opensuse.org 18 Feb '14

18 Feb '14

SUSE Security Update: Security update for MozillaFirefox ______________________________________________________________________________ Announcement ID: SUSE-SU-2014:0248-1 Rating: important References: #859055 #861847 Cross-References: CVE-2014-1477 CVE-2014-1479 CVE-2014-1480 CVE-2014-1481 CVE-2014-1482 CVE-2014-1483 CVE-2014-1484 CVE-2014-1485 CVE-2014-1486 CVE-2014-1487 CVE-2014-1488 CVE-2014-1489 CVE-2014-1490 CVE-2014-1491 Affected Products: SUSE Linux Enterprise Software Development Kit 11 SP3 SUSE Linux Enterprise Server 11 SP3 for VMware SUSE Linux Enterprise Server 11 SP3 SUSE Linux Enterprise Desktop 11 SP3 ______________________________________________________________________________ An update that fixes 14 vulnerabilities is now available. It includes two new package versions. Description: This updates the Mozilla Firefox browser to the 24.3.0ESR security release. The Mozilla NSS libraries are now on version 3.15.4. The following security issues have been fixed: * MFSA 2014-01: Memory safety bugs fixed in Firefox ESR 24.3 and Firefox 27.0 (CVE-2014-1477)(bnc#862345) * MFSA 2014-02: Using XBL scopes its possible to steal(clone) native anonymous content (CVE-2014-1479)(bnc#862348) * MFSA 2014-03: Download "open file" dialog delay is too quick, doesn't prevent clickjacking (CVE-2014-1480) * MFSA 2014-04: Image decoding causing FireFox to crash with Goo Create (CVE-2014-1482)(bnc#862356) * MFSA 2014-05: caretPositionFromPoint and elementFromPoint leak information about iframe contents via timing information (CVE-2014-1483)(bnc#862360) * MFSA 2014-06: Fennec leaks profile path to logcat (CVE-2014-1484) * MFSA 2014-07: CSP should block XSLT as script, not as style (CVE-2014-1485) * MFSA 2014-08: imgRequestProxy Use-After-Free Remote Code Execution Vulnerability (CVE-2014-1486) * MFSA 2014-09: Cross-origin information disclosure with error message of Web Workers (CVE-2014-1487) * MFSA 2014-10: settings & history ID bug (CVE-2014-1489) * MFSA 2014-11: Firefox reproducibly crashes when using asm.js code in workers and transferable objects (CVE-2014-1488) * MFSA 2014-12: TOCTOU, potential use-after-free in libssl's session ticket processing (CVE-2014-1490)(bnc#862300) Do not allow p-1 as a public DH value (CVE-2014-1491)(bnc#862289) * MFSA 2014-13: Inconsistent this value when invoking getters on window (CVE-2014-1481)(bnc#862309) Security Issue references: * CVE-2014-1477 <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-1477 > * CVE-2014-1479 <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-1479 > * CVE-2014-1480 <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-1480 > * CVE-2014-1481 <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-1481 > * CVE-2014-1482 <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-1482 > * CVE-2014-1483 <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-1483 > * CVE-2014-1484 <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-1484 > * CVE-2014-1485 <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-1485 > * CVE-2014-1486 <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-1486 > * CVE-2014-1487 <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-1487 > * CVE-2014-1488 <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-1488 > * CVE-2014-1489 <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-1489 > * CVE-2014-1490 <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-1490 > * CVE-2014-1491 <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-1491 > Patch Instructions: To install this SUSE Security Update use YaST online_update. Alternatively you can run the command listed for your product: - SUSE Linux Enterprise Software Development Kit 11 SP3: zypper in -t patch sdksp3-firefox-201402-8879 - SUSE Linux Enterprise Server 11 SP3 for VMware: zypper in -t patch slessp3-firefox-201402-8879 - SUSE Linux Enterprise Server 11 SP3: zypper in -t patch slessp3-firefox-201402-8879 - SUSE Linux Enterprise Desktop 11 SP3: zypper in -t patch sledsp3-firefox-201402-8879 To bring your system up-to-date, use "zypper patch". Package List: - SUSE Linux Enterprise Software Development Kit 11 SP3 (i586 ia64 ppc64 s390x x86_64) [New Version: 3.15.4]: MozillaFirefox-devel-24.3.0esr-0.8.1 mozilla-nss-devel-3.15.4-0.7.1 - SUSE Linux Enterprise Server 11 SP3 for VMware (i586 x86_64) [New Version: 24.3.0esr and 3.15.4]: MozillaFirefox-24.3.0esr-0.8.1 MozillaFirefox-translations-24.3.0esr-0.8.1 libfreebl3-3.15.4-0.7.1 libsoftokn3-3.15.4-0.7.1 mozilla-nss-3.15.4-0.7.1 mozilla-nss-tools-3.15.4-0.7.1 - SUSE Linux Enterprise Server 11 SP3 for VMware (x86_64) [New Version: 3.15.4]: libfreebl3-32bit-3.15.4-0.7.1 libsoftokn3-32bit-3.15.4-0.7.1 mozilla-nss-32bit-3.15.4-0.7.1 - SUSE Linux Enterprise Server 11 SP3 (i586 ia64 ppc64 s390x x86_64) [New Version: 24.3.0esr and 3.15.4]: MozillaFirefox-24.3.0esr-0.8.1 MozillaFirefox-branding-SLED-24-0.7.14 MozillaFirefox-translations-24.3.0esr-0.8.1 libfreebl3-3.15.4-0.7.1 libsoftokn3-3.15.4-0.7.1 mozilla-nss-3.15.4-0.7.1 mozilla-nss-tools-3.15.4-0.7.1 - SUSE Linux Enterprise Server 11 SP3 (ppc64 s390x x86_64) [New Version: 3.15.4]: libfreebl3-32bit-3.15.4-0.7.1 libsoftokn3-32bit-3.15.4-0.7.1 mozilla-nss-32bit-3.15.4-0.7.1 - SUSE Linux Enterprise Server 11 SP3 (ia64) [New Version: 3.15.4]: libfreebl3-x86-3.15.4-0.7.1 libsoftokn3-x86-3.15.4-0.7.1 mozilla-nss-x86-3.15.4-0.7.1 - SUSE Linux Enterprise Desktop 11 SP3 (i586 x86_64) [New Version: 24.3.0esr and 3.15.4]: MozillaFirefox-24.3.0esr-0.8.1 MozillaFirefox-branding-SLED-24-0.7.14 MozillaFirefox-translations-24.3.0esr-0.8.1 libfreebl3-3.15.4-0.7.1 libsoftokn3-3.15.4-0.7.1 mozilla-nss-3.15.4-0.7.1 mozilla-nss-tools-3.15.4-0.7.1 - SUSE Linux Enterprise Desktop 11 SP3 (x86_64) [New Version: 3.15.4]: libfreebl3-32bit-3.15.4-0.7.1 libsoftokn3-32bit-3.15.4-0.7.1 mozilla-nss-32bit-3.15.4-0.7.1 References: http://support.novell.com/security/cve/CVE-2014-1477.html http://support.novell.com/security/cve/CVE-2014-1479.html http://support.novell.com/security/cve/CVE-2014-1480.html http://support.novell.com/security/cve/CVE-2014-1481.html http://support.novell.com/security/cve/CVE-2014-1482.html http://support.novell.com/security/cve/CVE-2014-1483.html http://support.novell.com/security/cve/CVE-2014-1484.html http://support.novell.com/security/cve/CVE-2014-1485.html http://support.novell.com/security/cve/CVE-2014-1486.html http://support.novell.com/security/cve/CVE-2014-1487.html http://support.novell.com/security/cve/CVE-2014-1488.html http://support.novell.com/security/cve/CVE-2014-1489.html http://support.novell.com/security/cve/CVE-2014-1490.html http://support.novell.com/security/cve/CVE-2014-1491.html https://bugzilla.novell.com/859055 https://bugzilla.novell.com/861847 http://download.novell.com/patch/finder/?keywords=b12f5cfd95ec4eca119a488f5… -- To unsubscribe, e-mail: opensuse-security-announce+unsubscribe(a)opensuse.org For additional commands, e-mail: opensuse-security-announce+help(a)opensuse.org

1 0

[security-announce] SUSE-SU-2014:0246-1: important: Security update for IBM Java
by opensuse-security＠opensuse.org 18 Feb '14

18 Feb '14

SUSE Security Update: Security update for IBM Java ______________________________________________________________________________ Announcement ID: SUSE-SU-2014:0246-1 Rating: important References: #861782 #862064 Cross-References: CVE-2013-5878 CVE-2013-5884 CVE-2013-5887 CVE-2013-5888 CVE-2013-5889 CVE-2013-5896 CVE-2013-5898 CVE-2013-5899 CVE-2013-5907 CVE-2013-5910 CVE-2014-0368 CVE-2014-0373 CVE-2014-0375 CVE-2014-0376 CVE-2014-0387 CVE-2014-0403 CVE-2014-0410 CVE-2014-0411 CVE-2014-0415 CVE-2014-0416 CVE-2014-0417 CVE-2014-0422 CVE-2014-0423 CVE-2014-0424 CVE-2014-0428 Affected Products: SUSE Linux Enterprise Software Development Kit 11 SP3 SUSE Linux Enterprise Server 11 SP3 for VMware SUSE Linux Enterprise Server 11 SP3 SUSE Linux Enterprise Java 11 SP3 ______________________________________________________________________________ An update that fixes 25 vulnerabilities is now available. Description: This update contains the Oracle January 14 2014 CPU for java-1_7_0-ibm. Find more information at: http://www.ibm.com/developerworks/java/jdk/alerts/#Oracle_Ja nuary_14_2014_CPU <http://www.ibm.com/developerworks/java/jdk/alerts/#Oracle_J anuary_14_2014_CPU> Security Issue references: * CVE-2014-0428 <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-0428 > * CVE-2014-0422 <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-0422 > * CVE-2013-5907 <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2013-5907 > * CVE-2014-0415 <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-0415 > * CVE-2014-0410 <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-0410 > * CVE-2013-5889 <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2013-5889 > * CVE-2014-0417 <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-0417 > * CVE-2014-0387 <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-0387 > * CVE-2014-0424 <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-0424 > * CVE-2013-5878 <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2013-5878 > * CVE-2014-0373 <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-0373 > * CVE-2014-0375 <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-0375 > * CVE-2014-0403 <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-0403 > * CVE-2014-0423 <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-0423 > * CVE-2014-0376 <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-0376 > * CVE-2013-5910 <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2013-5910 > * CVE-2013-5884 <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2013-5884 > * CVE-2013-5896 <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2013-5896 > * CVE-2014-0376 <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-0376 > * CVE-2013-5899 <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2013-5899 > * CVE-2014-0416 <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-0416 > * CVE-2013-5887 <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2013-5887 > * CVE-2014-0368 <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-0368 > * CVE-2013-5888 <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2013-5888 > * CVE-2013-5898 <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2013-5898 > * CVE-2014-0411 <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-0411 > Patch Instructions: To install this SUSE Security Update use YaST online_update. Alternatively you can run the command listed for your product: - SUSE Linux Enterprise Software Development Kit 11 SP3: zypper in -t patch sdksp3-java-1_7_0-ibm-8878 - SUSE Linux Enterprise Server 11 SP3 for VMware: zypper in -t patch slessp3-java-1_7_0-ibm-8878 - SUSE Linux Enterprise Server 11 SP3: zypper in -t patch slessp3-java-1_7_0-ibm-8878 - SUSE Linux Enterprise Java 11 SP3: zypper in -t patch slejsp3-java-1_7_0-ibm-8878 To bring your system up-to-date, use "zypper patch". Package List: - SUSE Linux Enterprise Software Development Kit 11 SP3 (i586 ppc64 s390x x86_64): java-1_7_0-ibm-devel-1.7.0_sr6.1-0.8.1 - SUSE Linux Enterprise Server 11 SP3 for VMware (i586 x86_64): java-1_7_0-ibm-1.7.0_sr6.1-0.8.1 java-1_7_0-ibm-alsa-1.7.0_sr6.1-0.8.1 java-1_7_0-ibm-jdbc-1.7.0_sr6.1-0.8.1 java-1_7_0-ibm-plugin-1.7.0_sr6.1-0.8.1 - SUSE Linux Enterprise Server 11 SP3 (i586 ppc64 s390x x86_64): java-1_7_0-ibm-1.7.0_sr6.1-0.8.1 java-1_7_0-ibm-jdbc-1.7.0_sr6.1-0.8.1 - SUSE Linux Enterprise Server 11 SP3 (i586 x86_64): java-1_7_0-ibm-alsa-1.7.0_sr6.1-0.8.1 java-1_7_0-ibm-plugin-1.7.0_sr6.1-0.8.1 - SUSE Linux Enterprise Java 11 SP3 (i586 ppc64 s390x x86_64): java-1_7_0-ibm-1.7.0_sr6.1-0.8.1 java-1_7_0-ibm-devel-1.7.0_sr6.1-0.8.1 java-1_7_0-ibm-jdbc-1.7.0_sr6.1-0.8.1 - SUSE Linux Enterprise Java 11 SP3 (i586 x86_64): java-1_7_0-ibm-alsa-1.7.0_sr6.1-0.8.1 java-1_7_0-ibm-plugin-1.7.0_sr6.1-0.8.1 References: http://support.novell.com/security/cve/CVE-2013-5878.html http://support.novell.com/security/cve/CVE-2013-5884.html http://support.novell.com/security/cve/CVE-2013-5887.html http://support.novell.com/security/cve/CVE-2013-5888.html http://support.novell.com/security/cve/CVE-2013-5889.html http://support.novell.com/security/cve/CVE-2013-5896.html http://support.novell.com/security/cve/CVE-2013-5898.html http://support.novell.com/security/cve/CVE-2013-5899.html http://support.novell.com/security/cve/CVE-2013-5907.html http://support.novell.com/security/cve/CVE-2013-5910.html http://support.novell.com/security/cve/CVE-2014-0368.html http://support.novell.com/security/cve/CVE-2014-0373.html http://support.novell.com/security/cve/CVE-2014-0375.html http://support.novell.com/security/cve/CVE-2014-0376.html http://support.novell.com/security/cve/CVE-2014-0387.html http://support.novell.com/security/cve/CVE-2014-0403.html http://support.novell.com/security/cve/CVE-2014-0410.html http://support.novell.com/security/cve/CVE-2014-0411.html http://support.novell.com/security/cve/CVE-2014-0415.html http://support.novell.com/security/cve/CVE-2014-0416.html http://support.novell.com/security/cve/CVE-2014-0417.html http://support.novell.com/security/cve/CVE-2014-0422.html http://support.novell.com/security/cve/CVE-2014-0423.html http://support.novell.com/security/cve/CVE-2014-0424.html http://support.novell.com/security/cve/CVE-2014-0428.html https://bugzilla.novell.com/861782 https://bugzilla.novell.com/862064 http://download.novell.com/patch/finder/?keywords=4805c1478d9eeaa7d50d2c43a… -- To unsubscribe, e-mail: opensuse-security-announce+unsubscribe(a)opensuse.org For additional commands, e-mail: opensuse-security-announce+help(a)opensuse.org

1 0

[security-announce] openSUSE-SU-2014:0243-1: important: chromium to 32.0.1700.102
by opensuse-security＠opensuse.org 18 Feb '14

18 Feb '14

openSUSE Security Update: chromium to 32.0.1700.102 ______________________________________________________________________________ Announcement ID: openSUSE-SU-2014:0243-1 Rating: important References: #861013 Cross-References: CVE-2013-6641 CVE-2013-6643 CVE-2013-6644 CVE-2013-6645 CVE-2013-6646 CVE-2013-6649 CVE-2013-6650 Affected Products: openSUSE 13.1 openSUSE 12.3 ______________________________________________________________________________ An update that fixes 7 vulnerabilities is now available. Description: Chromium was updated to version 32.0.1700.102: Stable channel update: - Security Fixes: * CVE-2013-6649: Use-after-free in SVG images * CVE-2013-6650: Memory corruption in V8 * and 12 other fixes - Other: * Mouse Pointer disappears after exiting full-screen mode * Drag and drop files into Chromium may not work properly * Quicktime Plugin crashes in Chromium * Chromium becomes unresponsive * Trackpad users may not be able to scroll horizontally * Scrolling does not work in combo box * Chromium does not work with all CSS minifiers such as whitespace around a media query's `and` keyword - Update to Chromium 32.0.1700.77 Stable channel update: - Security fixes: * CVE-2013-6646: Use-after-free in web workers * CVE-2013-6641: Use-after-free related to forms * CVE-2013-6643: Unprompted sync with an attacker’s Google account * CVE-2013-6645: Use-after-free related to speech input elements * CVE-2013-6644: Various fixes from internal audits, fuzzing and other initiatives - Other: * Tab indicators for sound, webcam and casting * Automatically blocking malware files * Lots of under the hood changes for stability and performance - Remove patch chromium-fix-chromedriver-build.diff as that chromedriver is fixed upstream - Updated ExcludeArch to exclude aarch64, ppc, ppc64 and ppc64le. This is based on missing build requires (valgrind, v8, etc) Patch Instructions: To install this openSUSE Security Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE 13.1: zypper in -t patch openSUSE-2014-135 - openSUSE 12.3: zypper in -t patch openSUSE-2014-135 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE 13.1 (i586 x86_64): chromedriver-32.0.1700.102-17.2 chromedriver-debuginfo-32.0.1700.102-17.2 chromium-32.0.1700.102-17.2 chromium-debuginfo-32.0.1700.102-17.2 chromium-debugsource-32.0.1700.102-17.2 chromium-desktop-gnome-32.0.1700.102-17.2 chromium-desktop-kde-32.0.1700.102-17.2 chromium-ffmpegsumo-32.0.1700.102-17.2 chromium-ffmpegsumo-debuginfo-32.0.1700.102-17.2 chromium-suid-helper-32.0.1700.102-17.2 chromium-suid-helper-debuginfo-32.0.1700.102-17.2 - openSUSE 12.3 (i586 x86_64): chromedriver-32.0.1700.102-1.25.2 chromedriver-debuginfo-32.0.1700.102-1.25.2 chromium-32.0.1700.102-1.25.2 chromium-debuginfo-32.0.1700.102-1.25.2 chromium-debugsource-32.0.1700.102-1.25.2 chromium-desktop-gnome-32.0.1700.102-1.25.2 chromium-desktop-kde-32.0.1700.102-1.25.2 chromium-ffmpegsumo-32.0.1700.102-1.25.2 chromium-ffmpegsumo-debuginfo-32.0.1700.102-1.25.2 chromium-suid-helper-32.0.1700.102-1.25.2 chromium-suid-helper-debuginfo-32.0.1700.102-1.25.2 References: http://support.novell.com/security/cve/CVE-2013-6641.html http://support.novell.com/security/cve/CVE-2013-6643.html http://support.novell.com/security/cve/CVE-2013-6644.html http://support.novell.com/security/cve/CVE-2013-6645.html http://support.novell.com/security/cve/CVE-2013-6646.html http://support.novell.com/security/cve/CVE-2013-6649.html http://support.novell.com/security/cve/CVE-2013-6650.html https://bugzilla.novell.com/861013 -- To unsubscribe, e-mail: opensuse-security-announce+unsubscribe(a)opensuse.org For additional commands, e-mail: opensuse-security-announce+help(a)opensuse.org

1 0

[security-announce] SUSE-SU-2014:0229-1: important: kernel update for SLE11 SP2
by opensuse-security＠opensuse.org 12 Feb '14

12 Feb '14

SUSE Security Update: kernel update for SLE11 SP2 ______________________________________________________________________________ Announcement ID: SUSE-SU-2014:0229-1 Rating: important References: #858831 Affected Products: SUSE Linux Enterprise Server 11 SP2 for VMware SUSE Linux Enterprise Server 11 SP2 SUSE Linux Enterprise High Availability Extension 11 SP2 SUSE Linux Enterprise Desktop 11 SP2 SLE 11 SERVER Unsupported Extras ______________________________________________________________________________ An update that contains security fixes can now be installed. It includes one version update. Description: The SUSE Linux Enterprise 11 Service Pack 2 kernel was updated to fix a regression introduced by the last update. Regression fix: - scsi_dh_alua: Incorrect reference counting in the SCSI ALUA initialization code lead to system crashes on boot (bnc#858831). As the update introducing the regression was marked security, this is also marked security even though this bug is not security relevant. Indications: Everyone using the Linux Kernel on x86_64 architecture should update. Special Instructions and Notes: Please reboot the system after installing this update. Patch Instructions: To install this SUSE Security Update use YaST online_update. Alternatively you can run the command listed for your product: - SUSE Linux Enterprise Server 11 SP2 for VMware: zypper in -t patch slessp2-kernel-8865 slessp2-kernel-8868 - SUSE Linux Enterprise Server 11 SP2: zypper in -t patch slessp2-kernel-8865 slessp2-kernel-8866 slessp2-kernel-8867 slessp2-kernel-8868 slessp2-kernel-8875 - SUSE Linux Enterprise High Availability Extension 11 SP2: zypper in -t patch sleshasp2-kernel-8865 sleshasp2-kernel-8866 sleshasp2-kernel-8867 sleshasp2-kernel-8868 sleshasp2-kernel-8875 - SUSE Linux Enterprise Desktop 11 SP2: zypper in -t patch sledsp2-kernel-8865 sledsp2-kernel-8868 To bring your system up-to-date, use "zypper patch". Package List: - SUSE Linux Enterprise Server 11 SP2 for VMware (i586 x86_64) [New Version: 3.0.101]: kernel-default-3.0.101-0.7.17.1 kernel-default-base-3.0.101-0.7.17.1 kernel-default-devel-3.0.101-0.7.17.1 kernel-source-3.0.101-0.7.17.1 kernel-syms-3.0.101-0.7.17.1 kernel-trace-3.0.101-0.7.17.1 kernel-trace-base-3.0.101-0.7.17.1 kernel-trace-devel-3.0.101-0.7.17.1 kernel-xen-devel-3.0.101-0.7.17.1 xen-kmp-trace-4.1.6_04_3.0.101_0.7.17-0.5.16 - SUSE Linux Enterprise Server 11 SP2 for VMware (i586) [New Version: 3.0.101]: kernel-pae-3.0.101-0.7.17.1 kernel-pae-base-3.0.101-0.7.17.1 kernel-pae-devel-3.0.101-0.7.17.1 - SUSE Linux Enterprise Server 11 SP2 (i586 ia64 ppc64 s390x x86_64) [New Version: 3.0.101]: kernel-default-3.0.101-0.7.17.1 kernel-default-base-3.0.101-0.7.17.1 kernel-default-devel-3.0.101-0.7.17.1 kernel-source-3.0.101-0.7.17.1 kernel-syms-3.0.101-0.7.17.1 kernel-trace-3.0.101-0.7.17.1 kernel-trace-base-3.0.101-0.7.17.1 kernel-trace-devel-3.0.101-0.7.17.1 - SUSE Linux Enterprise Server 11 SP2 (i586 x86_64) [New Version: 3.0.101]: kernel-ec2-3.0.101-0.7.17.1 kernel-ec2-base-3.0.101-0.7.17.1 kernel-ec2-devel-3.0.101-0.7.17.1 kernel-xen-3.0.101-0.7.17.1 kernel-xen-base-3.0.101-0.7.17.1 kernel-xen-devel-3.0.101-0.7.17.1 xen-kmp-default-4.1.6_04_3.0.101_0.7.17-0.5.16 xen-kmp-trace-4.1.6_04_3.0.101_0.7.17-0.5.16 - SUSE Linux Enterprise Server 11 SP2 (s390x) [New Version: 3.0.101]: kernel-default-man-3.0.101-0.7.17.1 - SUSE Linux Enterprise Server 11 SP2 (ppc64) [New Version: 3.0.101]: kernel-ppc64-3.0.101-0.7.17.1 kernel-ppc64-base-3.0.101-0.7.17.1 kernel-ppc64-devel-3.0.101-0.7.17.1 - SUSE Linux Enterprise Server 11 SP2 (i586) [New Version: 3.0.101]: kernel-pae-3.0.101-0.7.17.1 kernel-pae-base-3.0.101-0.7.17.1 kernel-pae-devel-3.0.101-0.7.17.1 xen-kmp-pae-4.1.6_04_3.0.101_0.7.17-0.5.16 - SUSE Linux Enterprise High Availability Extension 11 SP2 (i586 ia64 ppc64 s390x x86_64): cluster-network-kmp-default-1.4_3.0.101_0.7.17-2.18.81 cluster-network-kmp-trace-1.4_3.0.101_0.7.17-2.18.81 gfs2-kmp-default-2_3.0.101_0.7.17-0.7.109 gfs2-kmp-trace-2_3.0.101_0.7.17-0.7.109 ocfs2-kmp-default-1.6_3.0.101_0.7.17-0.11.80 ocfs2-kmp-trace-1.6_3.0.101_0.7.17-0.11.80 - SUSE Linux Enterprise High Availability Extension 11 SP2 (i586 x86_64): cluster-network-kmp-xen-1.4_3.0.101_0.7.17-2.18.81 gfs2-kmp-xen-2_3.0.101_0.7.17-0.7.109 ocfs2-kmp-xen-1.6_3.0.101_0.7.17-0.11.80 - SUSE Linux Enterprise High Availability Extension 11 SP2 (ppc64): cluster-network-kmp-ppc64-1.4_3.0.101_0.7.17-2.18.81 gfs2-kmp-ppc64-2_3.0.101_0.7.17-0.7.109 ocfs2-kmp-ppc64-1.6_3.0.101_0.7.17-0.11.80 - SUSE Linux Enterprise High Availability Extension 11 SP2 (i586): cluster-network-kmp-pae-1.4_3.0.101_0.7.17-2.18.81 gfs2-kmp-pae-2_3.0.101_0.7.17-0.7.109 ocfs2-kmp-pae-1.6_3.0.101_0.7.17-0.11.80 - SUSE Linux Enterprise Desktop 11 SP2 (i586 x86_64) [New Version: 3.0.101]: kernel-default-3.0.101-0.7.17.1 kernel-default-base-3.0.101-0.7.17.1 kernel-default-devel-3.0.101-0.7.17.1 kernel-default-extra-3.0.101-0.7.17.1 kernel-source-3.0.101-0.7.17.1 kernel-syms-3.0.101-0.7.17.1 kernel-trace-3.0.101-0.7.17.1 kernel-trace-base-3.0.101-0.7.17.1 kernel-trace-devel-3.0.101-0.7.17.1 kernel-trace-extra-3.0.101-0.7.17.1 kernel-xen-3.0.101-0.7.17.1 kernel-xen-base-3.0.101-0.7.17.1 kernel-xen-devel-3.0.101-0.7.17.1 kernel-xen-extra-3.0.101-0.7.17.1 xen-kmp-default-4.1.6_04_3.0.101_0.7.17-0.5.16 xen-kmp-trace-4.1.6_04_3.0.101_0.7.17-0.5.16 - SUSE Linux Enterprise Desktop 11 SP2 (i586) [New Version: 3.0.101]: kernel-pae-3.0.101-0.7.17.1 kernel-pae-base-3.0.101-0.7.17.1 kernel-pae-devel-3.0.101-0.7.17.1 kernel-pae-extra-3.0.101-0.7.17.1 xen-kmp-pae-4.1.6_04_3.0.101_0.7.17-0.5.16 - SLE 11 SERVER Unsupported Extras (i586 ia64 ppc64 s390x x86_64): ext4-writeable-kmp-default-0_3.0.101_0.7.17-0.14.90 ext4-writeable-kmp-trace-0_3.0.101_0.7.17-0.14.90 kernel-default-extra-3.0.101-0.7.17.1 - SLE 11 SERVER Unsupported Extras (i586 x86_64): ext4-writeable-kmp-xen-0_3.0.101_0.7.17-0.14.90 kernel-xen-extra-3.0.101-0.7.17.1 - SLE 11 SERVER Unsupported Extras (ppc64): ext4-writeable-kmp-ppc64-0_3.0.101_0.7.17-0.14.90 kernel-ppc64-extra-3.0.101-0.7.17.1 - SLE 11 SERVER Unsupported Extras (i586): ext4-writeable-kmp-pae-0_3.0.101_0.7.17-0.14.90 kernel-pae-extra-3.0.101-0.7.17.1 References: https://bugzilla.novell.com/858831 http://download.novell.com/patch/finder/?keywords=08528bdc933748991934ac0a1… http://download.novell.com/patch/finder/?keywords=10ee063285998a56047341e02… http://download.novell.com/patch/finder/?keywords=12b1da540849dcd803c069712… http://download.novell.com/patch/finder/?keywords=26690338c8e252806b712abfc… http://download.novell.com/patch/finder/?keywords=32718e53d0f0b9aa299d1dbf6… http://download.novell.com/patch/finder/?keywords=61a5dc8f3780484fe953a849b… http://download.novell.com/patch/finder/?keywords=78531ae4ca3e7e521680f7a48… http://download.novell.com/patch/finder/?keywords=9915a8d37fbceb33d8aacbe08… http://download.novell.com/patch/finder/?keywords=abd5de58f981a6204e3d87198… http://download.novell.com/patch/finder/?keywords=d940c974ac1f5b9bad96fada9… -- To unsubscribe, e-mail: opensuse-security-announce+unsubscribe(a)opensuse.org For additional commands, e-mail: opensuse-security-announce+help(a)opensuse.org

1 0

[security-announce] SUSE-SU-2014:0221-1: important: Security update for flash-player
by opensuse-security＠opensuse.org 11 Feb '14

11 Feb '14

SUSE Security Update: Security update for flash-player ______________________________________________________________________________ Announcement ID: SUSE-SU-2014:0221-1 Rating: important References: #862288 Cross-References: CVE-2014-0497 Affected Products: SUSE Linux Enterprise Desktop 11 SP3 SUSE Linux Enterprise Desktop 11 SP2 ______________________________________________________________________________ An update that fixes one vulnerability is now available. It includes one version update. Description: This update resolves an integer underflow vulnerability that could have been exploited to execute arbitrary code on the affected system (CVE-2014-0497). More information: http://helpx.adobe.com/security/products/flash-player/apsb14 -04.html <http://helpx.adobe.com/security/products/flash-player/apsb1 4-04.html> Security Issue references: * CVE-2014-0497 <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-0497 > Patch Instructions: To install this SUSE Security Update use YaST online_update. Alternatively you can run the command listed for your product: - SUSE Linux Enterprise Desktop 11 SP3: zypper in -t patch sledsp3-flash-player-8880 - SUSE Linux Enterprise Desktop 11 SP2: zypper in -t patch sledsp2-flash-player-8876 To bring your system up-to-date, use "zypper patch". Package List: - SUSE Linux Enterprise Desktop 11 SP3 (i586 x86_64) [New Version: 11.2.202.336]: flash-player-11.2.202.336-0.3.1 flash-player-gnome-11.2.202.336-0.3.1 flash-player-kde4-11.2.202.336-0.3.1 - SUSE Linux Enterprise Desktop 11 SP2 (i586 x86_64) [New Version: 11.2.202.336]: flash-player-11.2.202.336-0.3.1 flash-player-gnome-11.2.202.336-0.3.1 flash-player-kde4-11.2.202.336-0.3.1 References: http://support.novell.com/security/cve/CVE-2014-0497.html https://bugzilla.novell.com/862288 http://download.novell.com/patch/finder/?keywords=357d427aea791a8cdf8679299… http://download.novell.com/patch/finder/?keywords=be33063611a1e6ddf32b7fb62… -- To unsubscribe, e-mail: opensuse-security-announce+unsubscribe(a)opensuse.org For additional commands, e-mail: opensuse-security-announce+help(a)opensuse.org

1 0

[security-announce] openSUSE-SU-2014:0213-1: important: Mozilla updates February 2014
by opensuse-security＠opensuse.org 08 Feb '14

08 Feb '14

openSUSE Security Update: Mozilla updates February 2014 ______________________________________________________________________________ Announcement ID: openSUSE-SU-2014:0213-1 Rating: important References: #861847 Cross-References: CVE-2013-1740 CVE-2014-1477 CVE-2014-1478 CVE-2014-1479 CVE-2014-1481 CVE-2014-1482 CVE-2014-1486 CVE-2014-1487 CVE-2014-1490 CVE-2014-1491 Affected Products: openSUSE 11.4 ______________________________________________________________________________ An update that fixes 10 vulnerabilities is now available. Description: Updates for mozilla-nss (3.15.4) MozillaFirefox (24.3.0esr) MozillaThunderbird (24.3.0) including fixes for the following issues: * MFSA 2014-01/CVE-2014-1477/CVE-2014-1478 Miscellaneous memory safety hazards (rv:27.0 / rv:24.3) * MFSA 2014-02/CVE-2014-1479 (bmo#911864) Clone protected content with XBL scopes * MFSA 2014-04/CVE-2014-1482 (bmo#943803) Incorrect use of discarded images by RasterImage * MFSA 2014-08/CVE-2014-1486 (bmo#942164) Use-after-free with imgRequestProxy and image proccessing * MFSA 2014-09/CVE-2014-1487 (bmo#947592) Cross-origin information leak through web workers * MFSA 2014-12/CVE-2014-1490/CVE-2014-1491 (bmo#934545, bmo#930874, bmo#930857) NSS ticket handling issues * MFSA 2014-13/CVE-2014-1481(bmo#936056) Inconsistent JavaScript handling of access to Window objects Patch Instructions: To install this openSUSE Security Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE 11.4: zypper in -t patch 2014-16 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE 11.4 (i586 x86_64): MozillaFirefox-24.3.0-99.1 MozillaFirefox-branding-upstream-24.3.0-99.1 MozillaFirefox-buildsymbols-24.3.0-99.1 MozillaFirefox-debuginfo-24.3.0-99.1 MozillaFirefox-debugsource-24.3.0-99.1 MozillaFirefox-devel-24.3.0-99.1 MozillaFirefox-translations-common-24.3.0-99.1 MozillaFirefox-translations-other-24.3.0-99.1 MozillaThunderbird-24.3.0-85.1 MozillaThunderbird-buildsymbols-24.3.0-85.1 MozillaThunderbird-debuginfo-24.3.0-85.1 MozillaThunderbird-debugsource-24.3.0-85.1 MozillaThunderbird-devel-24.3.0-85.1 MozillaThunderbird-translations-common-24.3.0-85.1 MozillaThunderbird-translations-other-24.3.0-85.1 enigmail-1.6.0+24.3.0-85.1 libfreebl3-3.15.4-78.1 libfreebl3-debuginfo-3.15.4-78.1 libsoftokn3-3.15.4-78.1 libsoftokn3-debuginfo-3.15.4-78.1 mozilla-nss-3.15.4-78.1 mozilla-nss-certs-3.15.4-78.1 mozilla-nss-certs-debuginfo-3.15.4-78.1 mozilla-nss-debuginfo-3.15.4-78.1 mozilla-nss-debugsource-3.15.4-78.1 mozilla-nss-devel-3.15.4-78.1 mozilla-nss-sysinit-3.15.4-78.1 mozilla-nss-sysinit-debuginfo-3.15.4-78.1 mozilla-nss-tools-3.15.4-78.1 mozilla-nss-tools-debuginfo-3.15.4-78.1 - openSUSE 11.4 (x86_64): libfreebl3-32bit-3.15.4-78.1 libfreebl3-debuginfo-32bit-3.15.4-78.1 libsoftokn3-32bit-3.15.4-78.1 libsoftokn3-debuginfo-32bit-3.15.4-78.1 mozilla-nss-32bit-3.15.4-78.1 mozilla-nss-certs-32bit-3.15.4-78.1 mozilla-nss-certs-debuginfo-32bit-3.15.4-78.1 mozilla-nss-debuginfo-32bit-3.15.4-78.1 mozilla-nss-sysinit-32bit-3.15.4-78.1 mozilla-nss-sysinit-debuginfo-32bit-3.15.4-78.1 - openSUSE 11.4 (ia64): libfreebl3-debuginfo-x86-3.15.4-78.1 libfreebl3-x86-3.15.4-78.1 libsoftokn3-debuginfo-x86-3.15.4-78.1 libsoftokn3-x86-3.15.4-78.1 mozilla-nss-certs-debuginfo-x86-3.15.4-78.1 mozilla-nss-certs-x86-3.15.4-78.1 mozilla-nss-debuginfo-x86-3.15.4-78.1 mozilla-nss-sysinit-debuginfo-x86-3.15.4-78.1 mozilla-nss-sysinit-x86-3.15.4-78.1 mozilla-nss-x86-3.15.4-78.1 References: http://support.novell.com/security/cve/CVE-2013-1740.html http://support.novell.com/security/cve/CVE-2014-1477.html http://support.novell.com/security/cve/CVE-2014-1478.html http://support.novell.com/security/cve/CVE-2014-1479.html http://support.novell.com/security/cve/CVE-2014-1481.html http://support.novell.com/security/cve/CVE-2014-1482.html http://support.novell.com/security/cve/CVE-2014-1486.html http://support.novell.com/security/cve/CVE-2014-1487.html http://support.novell.com/security/cve/CVE-2014-1490.html http://support.novell.com/security/cve/CVE-2014-1491.html https://bugzilla.novell.com/861847 -- To unsubscribe, e-mail: opensuse-security-announce+unsubscribe(a)opensuse.org For additional commands, e-mail: opensuse-security-announce+help(a)opensuse.org

1 0

[security-announce] openSUSE-SU-2014:0212-1: important: Mozilla Firefox 27 release
by opensuse-security＠opensuse.org 08 Feb '14

08 Feb '14

openSUSE Security Update: Mozilla Firefox 27 release ______________________________________________________________________________ Announcement ID: openSUSE-SU-2014:0212-1 Rating: important References: Affected Products: openSUSE 13.1 openSUSE 12.3 ______________________________________________________________________________ An update that contains security fixes can now be installed. Description: Mozilla Firefox was updated to version 27. Mozilla Seamonkey was updated to 2.24, fixing similar issues as Firefox 27. Mozilla Thunderbird was updated to 24.3.0, fixing similar issues as Firefox 27. The Firefox 27 release brings TLS 1.2 support as a major security feature. It also fixes following security issues: * MFSA 2014-01/CVE-2014-1477/CVE-2014-1478 Miscellaneous memory safety hazards (rv:27.0 / rv:24.3) * MFSA 2014-02/CVE-2014-1479 (bmo#911864) Clone protected content with XBL scopes * MFSA 2014-03/CVE-2014-1480 (bmo#916726) UI selection timeout missing on download prompts * MFSA 2014-04/CVE-2014-1482 (bmo#943803) Incorrect use of discarded images by RasterImage * MFSA 2014-05/CVE-2014-1483 (bmo#950427) Information disclosure with *FromPoint on iframes * MFSA 2014-06/CVE-2014-1484 (bmo#953993) Profile path leaks to Android system log * MFSA 2014-07/CVE-2014-1485 (bmo#910139) XSLT stylesheets treated as styles in Content Security Policy * MFSA 2014-08/CVE-2014-1486 (bmo#942164) Use-after-free with imgRequestProxy and image proccessing * MFSA 2014-09/CVE-2014-1487 (bmo#947592) Cross-origin information leak through web workers * MFSA 2014-10/CVE-2014-1489 (bmo#959531) Firefox default start page UI content invokable by script * MFSA 2014-11/CVE-2014-1488 (bmo#950604) Crash when using web workers with asm.js * MFSA 2014-12/CVE-2014-1490/CVE-2014-1491 (bmo#934545, bmo#930874, bmo#930857) NSS ticket handling issues * MFSA 2014-13/CVE-2014-1481(bmo#936056) Inconsistent JavaScript handling of access to Window objects Mozilla NSS was updated to 3.15.4: * required for Firefox 27 * regular CA root store update (1.96) * Reordered the cipher suites offered in SSL/TLS client hello messages to match modern best practices. * Improved SSL/TLS false start. In addition to enabling the SSL_ENABLE_FALSE_START option, an application must now register a callback using the SSL_SetCanFalseStartCallback function. * When false start is enabled, libssl will sometimes return unencrypted, unauthenticated data from PR_Recv (CVE-2013-1740, bmo#919877) * MFSA 2014-12/CVE-2014-1490/CVE-2014-1491 NSS ticket handling issues New functionality * Implemented OCSP querying using the HTTP GET method, which is the new default, and will fall back to the HTTP POST method. * Implemented OCSP server functionality for testing purposes (httpserv utility). * Support SHA-1 signatures with TLS 1.2 client authentication. * Added the --empty-password command-line option to certutil, to be used with -N: use an empty password when creating a new database. * Added the -w command-line option to pp: don't wrap long output lines. Patch Instructions: To install this openSUSE Security Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE 13.1: zypper in -t patch openSUSE-2014-119 - openSUSE 12.3: zypper in -t patch openSUSE-2014-119 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE 13.1 (i586 x86_64): MozillaFirefox-27.0-8.1 MozillaFirefox-branding-upstream-27.0-8.1 MozillaFirefox-buildsymbols-27.0-8.1 MozillaFirefox-debuginfo-27.0-8.1 MozillaFirefox-debugsource-27.0-8.1 MozillaFirefox-devel-27.0-8.1 MozillaFirefox-translations-common-27.0-8.1 MozillaFirefox-translations-other-27.0-8.1 MozillaThunderbird-24.3.0-70.11.1 MozillaThunderbird-buildsymbols-24.3.0-70.11.1 MozillaThunderbird-debuginfo-24.3.0-70.11.1 MozillaThunderbird-debugsource-24.3.0-70.11.1 MozillaThunderbird-devel-24.3.0-70.11.1 MozillaThunderbird-translations-common-24.3.0-70.11.1 MozillaThunderbird-translations-other-24.3.0-70.11.1 enigmail-1.6.0+24.3.0-70.11.1 enigmail-debuginfo-1.6.0+24.3.0-70.11.1 libfreebl3-3.15.4-12.1 libfreebl3-debuginfo-3.15.4-12.1 libsoftokn3-3.15.4-12.1 libsoftokn3-debuginfo-3.15.4-12.1 mozilla-nss-3.15.4-12.1 mozilla-nss-certs-3.15.4-12.1 mozilla-nss-certs-debuginfo-3.15.4-12.1 mozilla-nss-debuginfo-3.15.4-12.1 mozilla-nss-debugsource-3.15.4-12.1 mozilla-nss-devel-3.15.4-12.1 mozilla-nss-sysinit-3.15.4-12.1 mozilla-nss-sysinit-debuginfo-3.15.4-12.1 mozilla-nss-tools-3.15.4-12.1 mozilla-nss-tools-debuginfo-3.15.4-12.1 seamonkey-2.24-8.1 seamonkey-debuginfo-2.24-8.1 seamonkey-debugsource-2.24-8.1 seamonkey-dom-inspector-2.24-8.1 seamonkey-irc-2.24-8.1 seamonkey-translations-common-2.24-8.1 seamonkey-translations-other-2.24-8.1 seamonkey-venkman-2.24-8.1 - openSUSE 13.1 (x86_64): libfreebl3-32bit-3.15.4-12.1 libfreebl3-debuginfo-32bit-3.15.4-12.1 libsoftokn3-32bit-3.15.4-12.1 libsoftokn3-debuginfo-32bit-3.15.4-12.1 mozilla-nss-32bit-3.15.4-12.1 mozilla-nss-certs-32bit-3.15.4-12.1 mozilla-nss-certs-debuginfo-32bit-3.15.4-12.1 mozilla-nss-debuginfo-32bit-3.15.4-12.1 mozilla-nss-sysinit-32bit-3.15.4-12.1 mozilla-nss-sysinit-debuginfo-32bit-3.15.4-12.1 - openSUSE 12.3 (i586 x86_64): MozillaFirefox-27.0-1.47.2 MozillaFirefox-branding-upstream-27.0-1.47.2 MozillaFirefox-buildsymbols-27.0-1.47.2 MozillaFirefox-debuginfo-27.0-1.47.2 MozillaFirefox-debugsource-27.0-1.47.2 MozillaFirefox-devel-27.0-1.47.2 MozillaFirefox-translations-common-27.0-1.47.2 MozillaFirefox-translations-other-27.0-1.47.2 MozillaThunderbird-24.3.0-61.39.2 MozillaThunderbird-buildsymbols-24.3.0-61.39.2 MozillaThunderbird-debuginfo-24.3.0-61.39.2 MozillaThunderbird-debugsource-24.3.0-61.39.2 MozillaThunderbird-devel-24.3.0-61.39.2 MozillaThunderbird-translations-common-24.3.0-61.39.2 MozillaThunderbird-translations-other-24.3.0-61.39.2 enigmail-1.6.0+24.3.0-61.39.2 enigmail-debuginfo-1.6.0+24.3.0-61.39.2 libfreebl3-3.15.4-1.28.1 libfreebl3-debuginfo-3.15.4-1.28.1 libsoftokn3-3.15.4-1.28.1 libsoftokn3-debuginfo-3.15.4-1.28.1 mozilla-nss-3.15.4-1.28.1 mozilla-nss-certs-3.15.4-1.28.1 mozilla-nss-certs-debuginfo-3.15.4-1.28.1 mozilla-nss-debuginfo-3.15.4-1.28.1 mozilla-nss-debugsource-3.15.4-1.28.1 mozilla-nss-devel-3.15.4-1.28.1 mozilla-nss-sysinit-3.15.4-1.28.1 mozilla-nss-sysinit-debuginfo-3.15.4-1.28.1 mozilla-nss-tools-3.15.4-1.28.1 mozilla-nss-tools-debuginfo-3.15.4-1.28.1 seamonkey-2.24-1.33.2 seamonkey-debuginfo-2.24-1.33.2 seamonkey-debugsource-2.24-1.33.2 seamonkey-dom-inspector-2.24-1.33.2 seamonkey-irc-2.24-1.33.2 seamonkey-translations-common-2.24-1.33.2 seamonkey-translations-other-2.24-1.33.2 seamonkey-venkman-2.24-1.33.2 - openSUSE 12.3 (x86_64): libfreebl3-32bit-3.15.4-1.28.1 libfreebl3-debuginfo-32bit-3.15.4-1.28.1 libsoftokn3-32bit-3.15.4-1.28.1 libsoftokn3-debuginfo-32bit-3.15.4-1.28.1 mozilla-nss-32bit-3.15.4-1.28.1 mozilla-nss-certs-32bit-3.15.4-1.28.1 mozilla-nss-certs-debuginfo-32bit-3.15.4-1.28.1 mozilla-nss-debuginfo-32bit-3.15.4-1.28.1 mozilla-nss-sysinit-32bit-3.15.4-1.28.1 mozilla-nss-sysinit-debuginfo-32bit-3.15.4-1.28.1 References: -- To unsubscribe, e-mail: opensuse-security-announce+unsubscribe(a)opensuse.org For additional commands, e-mail: opensuse-security-announce+help(a)opensuse.org

1 0

[security-announce] openSUSE-SU-2014:0205-1: important: kernel to 3.11.10
by opensuse-security＠opensuse.org 06 Feb '14

06 Feb '14

openSUSE Security Update: kernel to 3.11.10 ______________________________________________________________________________ Announcement ID: openSUSE-SU-2014:0205-1 Rating: important References: #733022 #773058 #838024 #844513 #845621 #846529 #848042 #849021 #850072 #852652 #852656 #852931 #853050 #853051 #853052 #853053 #854175 #854722 #856294 #859804 #860993 Cross-References: CVE-2013-4511 CVE-2013-4563 CVE-2013-4587 CVE-2013-6367 CVE-2013-6368 CVE-2013-6376 CVE-2013-6432 CVE-2014-0038 Affected Products: openSUSE 13.1 ______________________________________________________________________________ An update that solves 8 vulnerabilities and has 13 fixes is now available. Description: The Linux Kernel was updated to version 3.11.10, fixing security issues and bugs: - floppy: bail out in open() if drive is not responding to block0 read (bnc#773058). - compat_sys_recvmmsg X32 fix (bnc#860993 CVE-2014-0038). - HID: usbhid: fix sis quirk (bnc#859804). - hwmon: (coretemp) Fix truncated name of alarm attributes - HID: usbhid: quirk for Synaptics Quad HD touchscreen (bnc#859804). - HID: usbhid: quirk for Synaptics HD touchscreen (bnc#859804). - HID: usbhid: merge the sis quirk (bnc#859804). - HID: hid-multitouch: add support for SiS panels (bnc#859804). - HID: usbhid: quirk for SiS Touchscreen (bnc#859804). - HID: usbhid: quirk for Synaptics Large Touchccreen (bnc#859804). - drivers: net: cpsw: fix dt probe for one port ethernet. - drivers: net: cpsw: fix for cpsw crash when build as modules. - dma: edma: Remove limits on number of slots. - dma: edma: Leave linked to Null slot instead of DUMMY slot. - dma: edma: Find missed events and issue them. - dma: edma: Write out and handle MAX_NR_SG at a given time. - dma: edma: Setup parameters to DMA MAX_NR_SG at a time. - ARM: edma: Add function to manually trigger an EDMA channel. - ARM: edma: Fix clearing of unused list for DT DMA resources. - ACPI: Add Toshiba NB100 to Vista _OSI blacklist. - ACPI: add missing win8 OSI comment to blacklist (bnc#856294). - ACPI: update win8 OSI blacklist. - ACPI: blacklist win8 OSI for buggy laptops. - ACPI: blacklist win8 OSI for ASUS Zenbook Prime UX31A (bnc#856294). - ACPI: Blacklist Win8 OSI for some HP laptop 2013 models (bnc#856294). - floppy: bail out in open() if drive is not responding to block0 read (bnc#773058). - ping: prevent NULL pointer dereference on write to msg_name (bnc#854175 CVE-2013-6432). - x86/dumpstack: Fix printk_address for direct addresses (bnc#845621). - Refresh patches.suse/stack-unwind. - Refresh patches.xen/xen-x86_64-dump-user-pgt. - KVM: x86: Convert vapic synchronization to _cached functions (CVE-2013-6368) (bnc#853052 CVE-2013-6368). - KVM: x86: fix guest-initiated crash with x2apic (CVE-2013-6376) (bnc#853053 CVE-2013-6376). - Build the KOTD against openSUSE:13.1:Update - xencons: generalize use of add_preferred_console() (bnc#733022, bnc#852652). - Update Xen patches to 3.11.10. - Rename patches.xen/xen-pcpu-hotplug to patches.xen/xen-pcpu. - KVM: x86: Fix potential divide by 0 in lapic (CVE-2013-6367) (bnc#853051 CVE-2013-6367). - KVM: Improve create VCPU parameter (CVE-2013-4587) (bnc#853050 CVE-2013-4587). - ipv6: fix headroom calculation in udp6_ufo_fragment (bnc#848042 CVE-2013-4563). - net: rework recvmsg handler msg_name and msg_namelen logic (bnc#854722). - patches.drivers/gpio-ucb1400-add-module_alias.patch: Update upstream reference - patches.drivers/gpio-ucb1400-can-be-built-as-a-module.patch: Update upstream reference - Delete patches.suse/ida-remove-warning-dump-stack.patch. Already included in kernel 3.11 (WARN calls dump_stack.) - xhci: Limit the spurious wakeup fix only to HP machines (bnc#852931). - iscsi_target: race condition on shutdown (bnc#850072). - Linux 3.11.10. - Refresh patches.xen/xen3-patch-2.6.29. - Delete patches.suse/btrfs-relocate-csums-properly-with-prealloc-ext ents.patch. - patches.drivers/xhci-Fix-spurious-wakeups-after-S5-on-Haswel l.patch: (bnc#852931). - Build mei and mei_me as modules (bnc#852656) - Linux 3.11.9. - Linux 3.11.8 (CVE-2013-4511 bnc#846529 bnc#849021). - Delete patches.drivers/ALSA-hda-Add-a-fixup-for-ASUS-N76VZ. - Delete patches.fixes/Fix-a-few-incorrectly-checked-io_-remap_pfn_ra nge-ca.patch. - Add USB PHY support (needed to get USB and Ethernet working on beagle and panda boards) Add CONFIG_PINCTRL_SINGLE=y to be able to use Device tree (at least for beagle and panda boards) Add ARM SoC sound support Add SPI bus support Add user-space access to I2C and SPI - patches.arch/iommu-vt-d-remove-stack-trace-from-broken-irq-r emapping-warning.patch: Fix forward porting, sorry. - iommu: Remove stack trace from broken irq remapping warning (bnc#844513). - gpio: ucb1400: Add MODULE_ALIAS. - Allow NFSv4 username mapping to work properly (bnc#838024). - nfs: check if gssd is running before attempting to use krb5i auth in SETCLIENTID call. - sunrpc: replace sunrpc_net->gssd_running flag with a more reliable check. - sunrpc: create a new dummy pipe for gssd to hold open. - Set CONFIG_GPIO_TWL4030 as built-in (instead of module) as a requirement to boot on SD card on beagleboard xM - armv6hl, armv7hl: Update config files. Set CONFIG_BATMAN_ADV_BLA=y as all other kernel configuration files have. - Update config files: * CONFIG_BATMAN_ADV_NC=y, because other BATMAN_ADV options are all enabled so why not this one. * CONFIG_GPIO_SCH=m, CONFIG_GPIO_PCH=m, because we support all other features of these pieces of hardware. * CONFIG_INTEL_POWERCLAMP=m, because this small driver might be useful in specific cases, and there's no obvious reason not to include it. - Fix a few incorrectly checked [io_]remap_pfn_range() calls (bnc#849021, CVE-2013-4511). - Linux 3.11.7. Patch Instructions: To install this openSUSE Security Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE 13.1: zypper in -t patch openSUSE-2014-114 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE 13.1 (i586 x86_64): kernel-default-3.11.10-7.1 kernel-default-base-3.11.10-7.1 kernel-default-base-debuginfo-3.11.10-7.1 kernel-default-debuginfo-3.11.10-7.1 kernel-default-debugsource-3.11.10-7.1 kernel-default-devel-3.11.10-7.1 kernel-default-devel-debuginfo-3.11.10-7.1 kernel-syms-3.11.10-7.1 - openSUSE 13.1 (i686 x86_64): kernel-debug-3.11.10-7.1 kernel-debug-base-3.11.10-7.1 kernel-debug-base-debuginfo-3.11.10-7.1 kernel-debug-debuginfo-3.11.10-7.1 kernel-debug-debugsource-3.11.10-7.1 kernel-debug-devel-3.11.10-7.1 kernel-debug-devel-debuginfo-3.11.10-7.1 kernel-desktop-3.11.10-7.1 kernel-desktop-base-3.11.10-7.1 kernel-desktop-base-debuginfo-3.11.10-7.1 kernel-desktop-debuginfo-3.11.10-7.1 kernel-desktop-debugsource-3.11.10-7.1 kernel-desktop-devel-3.11.10-7.1 kernel-desktop-devel-debuginfo-3.11.10-7.1 kernel-ec2-3.11.10-7.1 kernel-ec2-base-3.11.10-7.1 kernel-ec2-base-debuginfo-3.11.10-7.1 kernel-ec2-debuginfo-3.11.10-7.1 kernel-ec2-debugsource-3.11.10-7.1 kernel-ec2-devel-3.11.10-7.1 kernel-ec2-devel-debuginfo-3.11.10-7.1 kernel-trace-3.11.10-7.1 kernel-trace-base-3.11.10-7.1 kernel-trace-base-debuginfo-3.11.10-7.1 kernel-trace-debuginfo-3.11.10-7.1 kernel-trace-debugsource-3.11.10-7.1 kernel-trace-devel-3.11.10-7.1 kernel-trace-devel-debuginfo-3.11.10-7.1 kernel-vanilla-3.11.10-7.1 kernel-vanilla-debuginfo-3.11.10-7.1 kernel-vanilla-debugsource-3.11.10-7.1 kernel-vanilla-devel-3.11.10-7.1 kernel-vanilla-devel-debuginfo-3.11.10-7.1 kernel-xen-3.11.10-7.1 kernel-xen-base-3.11.10-7.1 kernel-xen-base-debuginfo-3.11.10-7.1 kernel-xen-debuginfo-3.11.10-7.1 kernel-xen-debugsource-3.11.10-7.1 kernel-xen-devel-3.11.10-7.1 kernel-xen-devel-debuginfo-3.11.10-7.1 - openSUSE 13.1 (noarch): kernel-devel-3.11.10-7.1 kernel-docs-3.11.10-7.3 kernel-source-3.11.10-7.1 kernel-source-vanilla-3.11.10-7.1 - openSUSE 13.1 (i686): kernel-pae-3.11.10-7.1 kernel-pae-base-3.11.10-7.1 kernel-pae-base-debuginfo-3.11.10-7.1 kernel-pae-debuginfo-3.11.10-7.1 kernel-pae-debugsource-3.11.10-7.1 kernel-pae-devel-3.11.10-7.1 kernel-pae-devel-debuginfo-3.11.10-7.1 References: http://support.novell.com/security/cve/CVE-2013-4511.html http://support.novell.com/security/cve/CVE-2013-4563.html http://support.novell.com/security/cve/CVE-2013-4587.html http://support.novell.com/security/cve/CVE-2013-6367.html http://support.novell.com/security/cve/CVE-2013-6368.html http://support.novell.com/security/cve/CVE-2013-6376.html http://support.novell.com/security/cve/CVE-2013-6432.html http://support.novell.com/security/cve/CVE-2014-0038.html https://bugzilla.novell.com/733022 https://bugzilla.novell.com/773058 https://bugzilla.novell.com/838024 https://bugzilla.novell.com/844513 https://bugzilla.novell.com/845621 https://bugzilla.novell.com/846529 https://bugzilla.novell.com/848042 https://bugzilla.novell.com/849021 https://bugzilla.novell.com/850072 https://bugzilla.novell.com/852652 https://bugzilla.novell.com/852656 https://bugzilla.novell.com/852931 https://bugzilla.novell.com/853050 https://bugzilla.novell.com/853051 https://bugzilla.novell.com/853052 https://bugzilla.novell.com/853053 https://bugzilla.novell.com/854175 https://bugzilla.novell.com/854722 https://bugzilla.novell.com/856294 https://bugzilla.novell.com/859804 https://bugzilla.novell.com/860993 -- To unsubscribe, e-mail: opensuse-security-announce+unsubscribe(a)opensuse.org For additional commands, e-mail: opensuse-security-announce+help(a)opensuse.org

1 0

[security-announce] openSUSE-SU-2014:0204-1: important: kernel: security and bugfix update
by opensuse-security＠opensuse.org 06 Feb '14

06 Feb '14

openSUSE Security Update: kernel: security and bugfix update ______________________________________________________________________________ Announcement ID: openSUSE-SU-2014:0204-1 Rating: important References: #804950 #805226 #808358 #811746 #825006 #831836 #838024 #840226 #840656 #844513 #848079 #848255 #849021 #849023 #849029 #849034 #849362 #852373 #852558 #852559 #853050 #853051 #853052 #853053 #854173 #854634 #854722 #860993 Cross-References: CVE-2013-0343 CVE-2013-1792 CVE-2013-4348 CVE-2013-4511 CVE-2013-4513 CVE-2013-4514 CVE-2013-4515 CVE-2013-4587 CVE-2013-6367 CVE-2013-6368 CVE-2013-6376 CVE-2013-6378 CVE-2013-6380 CVE-2013-6431 CVE-2013-7027 CVE-2014-0038 Affected Products: openSUSE 12.3 ______________________________________________________________________________ An update that solves 16 vulnerabilities and has 12 fixes is now available. Description: The Linux kernel was updated to fix various bugs and security issues: - mm/page-writeback.c: do not count anon pages as dirtyable memory (reclaim stalls). - mm/page-writeback.c: fix dirty_balance_reserve subtraction from dirtyable memory (reclaim stalls). - compat_sys_recvmmsg X32 fix (bnc#860993 CVE-2014-0038). - hwmon: (coretemp) Fix truncated name of alarm attributes - net: fib: fib6_add: fix potential NULL pointer dereference (bnc#854173 CVE-2013-6431). - keys: fix race with concurrent install_user_keyrings() (bnc#808358)(CVE-2013-1792). - KVM: x86: Convert vapic synchronization to _cached functions (CVE-2013-6368) (bnc#853052 CVE-2013-6368). - wireless: radiotap: fix parsing buffer overrun (bnc#854634 CVE-2013-7027). - KVM: x86: fix guest-initiated crash with x2apic (CVE-2013-6376) (bnc#853053 CVE-2013-6376). - KVM: x86: Fix potential divide by 0 in lapic (CVE-2013-6367) (bnc#853051 CVE-2013-6367). - KVM: Improve create VCPU parameter (CVE-2013-4587) (bnc#853050 CVE-2013-4587). - staging: ozwpan: prevent overflow in oz_cdev_write() (bnc#849023 CVE-2013-4513). - perf/x86: Fix offcore_rsp valid mask for SNB/IVB (bnc#825006). - perf/x86: Add Intel IvyBridge event scheduling constraints (bnc#825006). - libertas: potential oops in debugfs (bnc#852559 CVE-2013-6378). - aacraid: prevent invalid pointer dereference (bnc#852373 CVE-2013-6380). - staging: wlags49_h2: buffer overflow setting station name (bnc#849029 CVE-2013-4514). - net: flow_dissector: fail on evil iph->ihl (bnc#848079 CVE-2013-4348). - Staging: bcm: info leak in ioctl (bnc#849034 CVE-2013-4515). - Refresh patches.fixes/net-rework-recvmsg-handler-msg_name-and-msg_na melen-logic.patch. - ipv6: remove max_addresses check from ipv6_create_tempaddr (bnc#805226, CVE-2013-0343). - net: rework recvmsg handler msg_name and msg_namelen logic (bnc#854722). - crypto: ansi_cprng - Fix off by one error in non-block size request (bnc#840226). - x6: Fix reserve_initrd so that acpi_initrd_override is reached (bnc#831836). - Refresh other Xen patches. - aacraid: missing capable() check in compat ioctl (bnc#852558). - patches.fixes/gpio-ich-fix-ichx_gpio_check_available-return. patch: Update upstream reference - perf/ftrace: Fix paranoid level for enabling function tracer (bnc#849362). - xhci: fix null pointer dereference on ring_doorbell_for_active_rings (bnc#848255). - xhci: Fix oops happening after address device timeout (bnc#848255). - xhci: Ensure a command structure points to the correct trb on the command ring (bnc#848255). - patches.arch/iommu-vt-d-remove-stack-trace-from-broken-irq-r emapping-warning.patch: Update upstream reference. - Allow NFSv4 username mapping to work properly (bnc#838024). - Refresh btrfs attribute publishing patchset to match openSUSE-13.1 No user-visible changes, but uses kobj_sysfs_ops and better kobject lifetime management. - Fix a few incorrectly checked [io_]remap_pfn_range() calls (bnc#849021, CVE-2013-4511). - drm/radeon: don't set hpd, afmt interrupts when interrupts are disabled. - patches.fixes/cifs-fill-TRANS2_QUERY_FILE_INFO-ByteCount-fie lds.patch: Fix TRANS2_QUERY_FILE_INFO ByteCount fields (bnc#804950). - iommu: Remove stack trace from broken irq remapping warning (bnc#844513). - Disable patches related to bnc#840656 patches.suse/btrfs-cleanup-don-t-check-the-same-thing-twice patches.suse/btrfs-0220-fix-for-patch-cleanup-don-t-check-th e-same-thi.patch - btrfs: use feature attribute names to print better error messages. - btrfs: add ability to change features via sysfs. - btrfs: add publishing of unknown features in sysfs. - btrfs: publish per-super features to sysfs. - btrfs: add per-super attributes to sysfs. - btrfs: export supported featured to sysfs. - kobject: introduce kobj_completion. - btrfs: add ioctls to query/change feature bits online. - btrfs: use btrfs_commit_transaction when setting fslabel. - x86/iommu/vt-d: Expand interrupt remapping quirk to cover x58 chipset (bnc#844513). - NFSv4: Fix issues in nfs4_discover_server_trunking (bnc#811746). - iommu/vt-d: add quirk for broken interrupt remapping on 55XX chipsets (bnc#844513). Patch Instructions: To install this openSUSE Security Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE 12.3: zypper in -t patch openSUSE-2014-113 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE 12.3 (i586 x86_64): kernel-default-3.7.10-1.28.1 kernel-default-base-3.7.10-1.28.1 kernel-default-base-debuginfo-3.7.10-1.28.1 kernel-default-debuginfo-3.7.10-1.28.1 kernel-default-debugsource-3.7.10-1.28.1 kernel-default-devel-3.7.10-1.28.1 kernel-default-devel-debuginfo-3.7.10-1.28.1 kernel-syms-3.7.10-1.28.1 - openSUSE 12.3 (i686 x86_64): kernel-debug-3.7.10-1.28.1 kernel-debug-base-3.7.10-1.28.1 kernel-debug-base-debuginfo-3.7.10-1.28.1 kernel-debug-debuginfo-3.7.10-1.28.1 kernel-debug-debugsource-3.7.10-1.28.1 kernel-debug-devel-3.7.10-1.28.1 kernel-debug-devel-debuginfo-3.7.10-1.28.1 kernel-desktop-3.7.10-1.28.1 kernel-desktop-base-3.7.10-1.28.1 kernel-desktop-base-debuginfo-3.7.10-1.28.1 kernel-desktop-debuginfo-3.7.10-1.28.1 kernel-desktop-debugsource-3.7.10-1.28.1 kernel-desktop-devel-3.7.10-1.28.1 kernel-desktop-devel-debuginfo-3.7.10-1.28.1 kernel-ec2-3.7.10-1.28.1 kernel-ec2-base-3.7.10-1.28.1 kernel-ec2-base-debuginfo-3.7.10-1.28.1 kernel-ec2-debuginfo-3.7.10-1.28.1 kernel-ec2-debugsource-3.7.10-1.28.1 kernel-ec2-devel-3.7.10-1.28.1 kernel-ec2-devel-debuginfo-3.7.10-1.28.1 kernel-trace-3.7.10-1.28.1 kernel-trace-base-3.7.10-1.28.1 kernel-trace-base-debuginfo-3.7.10-1.28.1 kernel-trace-debuginfo-3.7.10-1.28.1 kernel-trace-debugsource-3.7.10-1.28.1 kernel-trace-devel-3.7.10-1.28.1 kernel-trace-devel-debuginfo-3.7.10-1.28.1 kernel-vanilla-3.7.10-1.28.1 kernel-vanilla-debuginfo-3.7.10-1.28.1 kernel-vanilla-debugsource-3.7.10-1.28.1 kernel-vanilla-devel-3.7.10-1.28.1 kernel-vanilla-devel-debuginfo-3.7.10-1.28.1 kernel-xen-3.7.10-1.28.1 kernel-xen-base-3.7.10-1.28.1 kernel-xen-base-debuginfo-3.7.10-1.28.1 kernel-xen-debuginfo-3.7.10-1.28.1 kernel-xen-debugsource-3.7.10-1.28.1 kernel-xen-devel-3.7.10-1.28.1 kernel-xen-devel-debuginfo-3.7.10-1.28.1 - openSUSE 12.3 (noarch): kernel-devel-3.7.10-1.28.1 kernel-docs-3.7.10-1.28.2 kernel-source-3.7.10-1.28.1 kernel-source-vanilla-3.7.10-1.28.1 - openSUSE 12.3 (i686): kernel-pae-3.7.10-1.28.1 kernel-pae-base-3.7.10-1.28.1 kernel-pae-base-debuginfo-3.7.10-1.28.1 kernel-pae-debuginfo-3.7.10-1.28.1 kernel-pae-debugsource-3.7.10-1.28.1 kernel-pae-devel-3.7.10-1.28.1 kernel-pae-devel-debuginfo-3.7.10-1.28.1 References: http://support.novell.com/security/cve/CVE-2013-0343.html http://support.novell.com/security/cve/CVE-2013-1792.html http://support.novell.com/security/cve/CVE-2013-4348.html http://support.novell.com/security/cve/CVE-2013-4511.html http://support.novell.com/security/cve/CVE-2013-4513.html http://support.novell.com/security/cve/CVE-2013-4514.html http://support.novell.com/security/cve/CVE-2013-4515.html http://support.novell.com/security/cve/CVE-2013-4587.html http://support.novell.com/security/cve/CVE-2013-6367.html http://support.novell.com/security/cve/CVE-2013-6368.html http://support.novell.com/security/cve/CVE-2013-6376.html http://support.novell.com/security/cve/CVE-2013-6378.html http://support.novell.com/security/cve/CVE-2013-6380.html http://support.novell.com/security/cve/CVE-2013-6431.html http://support.novell.com/security/cve/CVE-2013-7027.html http://support.novell.com/security/cve/CVE-2014-0038.html https://bugzilla.novell.com/804950 https://bugzilla.novell.com/805226 https://bugzilla.novell.com/808358 https://bugzilla.novell.com/811746 https://bugzilla.novell.com/825006 https://bugzilla.novell.com/831836 https://bugzilla.novell.com/838024 https://bugzilla.novell.com/840226 https://bugzilla.novell.com/840656 https://bugzilla.novell.com/844513 https://bugzilla.novell.com/848079 https://bugzilla.novell.com/848255 https://bugzilla.novell.com/849021 https://bugzilla.novell.com/849023 https://bugzilla.novell.com/849029 https://bugzilla.novell.com/849034 https://bugzilla.novell.com/849362 https://bugzilla.novell.com/852373 https://bugzilla.novell.com/852558 https://bugzilla.novell.com/852559 https://bugzilla.novell.com/853050 https://bugzilla.novell.com/853051 https://bugzilla.novell.com/853052 https://bugzilla.novell.com/853053 https://bugzilla.novell.com/854173 https://bugzilla.novell.com/854634 https://bugzilla.novell.com/854722 https://bugzilla.novell.com/860993 -- To unsubscribe, e-mail: opensuse-security-announce+unsubscribe(a)opensuse.org For additional commands, e-mail: opensuse-security-announce+help(a)opensuse.org

1 0

[security-announce] openSUSE-SU-2014:0203-1: critical: update flash-player to 11.2.202.336
by opensuse-security＠opensuse.org 06 Feb '14

06 Feb '14

openSUSE Security Update: update flash-player to 11.2.202.336 ______________________________________________________________________________ Announcement ID: openSUSE-SU-2014:0203-1 Rating: critical References: #862288 Cross-References: CVE-2014-0497 Affected Products: openSUSE 11.4 ______________________________________________________________________________ An update that fixes one vulnerability is now available. Description: Flash Player received an out of band critical security update to fix an integer underflow vulnerability that could be exploited to execute arbitrary code on the affected system (CVE-2014-0497). More information can be found on: http://helpx.adobe.com/security/products/flash-player/apsb14 -04.html Patch Instructions: To install this openSUSE Security Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE 11.4: zypper in -t patch 2014-13 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE 11.4 (i586 x86_64): flash-player-11.2.202.336-91.1 flash-player-gnome-11.2.202.336-91.1 flash-player-kde4-11.2.202.336-91.1 References: http://support.novell.com/security/cve/CVE-2014-0497.html https://bugzilla.novell.com/862288 -- To unsubscribe, e-mail: opensuse-security-announce+unsubscribe(a)opensuse.org For additional commands, e-mail: opensuse-security-announce+help(a)opensuse.org

1 0

[security-announce] openSUSE-SU-2014:0197-1: critical: flash-player to 11.2.202.336
by opensuse-security＠opensuse.org 06 Feb '14

06 Feb '14

openSUSE Security Update: flash-player to 11.2.202.336 ______________________________________________________________________________ Announcement ID: openSUSE-SU-2014:0197-1 Rating: critical References: #862288 Cross-References: CVE-2014-0497 Affected Products: openSUSE 13.1:NonFree openSUSE 12.3:NonFree ______________________________________________________________________________ An update that fixes one vulnerability is now available. Description: Flash Player received an out of band critical security update to fix an integer underflow vulnerability that could be exploited to execute arbitrary code on the affected system (CVE-2014-0497). More information can be found on: http://helpx.adobe.com/security/products/flash-player/apsb14 -04.html Patch Instructions: To install this openSUSE Security Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE 13.1:NonFree: zypper in -t patch openSUSE-2014-109 - openSUSE 12.3:NonFree: zypper in -t patch openSUSE-2014-109 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE 13.1:NonFree (i586 x86_64): flash-player-11.2.202.336-30.1 flash-player-gnome-11.2.202.336-30.1 flash-player-kde4-11.2.202.336-30.1 - openSUSE 12.3:NonFree (i586 x86_64): flash-player-11.2.202.336-2.56.1 flash-player-gnome-11.2.202.336-2.56.1 flash-player-kde4-11.2.202.336-2.56.1 References: http://support.novell.com/security/cve/CVE-2014-0497.html https://bugzilla.novell.com/862288 -- To unsubscribe, e-mail: opensuse-security-announce+unsubscribe(a)opensuse.org For additional commands, e-mail: opensuse-security-announce+help(a)opensuse.org

1 0