June 2014 - openSUSE Security Announce

[security-announce] SUSE-SU-2014:0848-1: important: Security update for openstack-keystone
by opensuse-security＠opensuse.org 26 Jun '14

26 Jun '14

SUSE Security Update: Security update for openstack-keystone ______________________________________________________________________________ Announcement ID: SUSE-SU-2014:0848-1 Rating: important References: #881977 Cross-References: CVE-2014-3476 Affected Products: SUSE Cloud 3 ______________________________________________________________________________ An update that fixes one vulnerability is now available. It includes one version update. Description: openstack-keystone was updated to version 2013.2.4.dev5.g9162837 to fix one security issue and one regular bug: * Privilege escalation through trust chained delegation. (CVE-2014-3476) * Fix invalid LDAP filter for user ID with commas. Security Issue reference: * CVE-2014-3476 <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-3476> Patch Instructions: To install this SUSE Security Update use YaST online_update. Alternatively you can run the command listed for your product: - SUSE Cloud 3: zypper in -t patch sleclo30sp3-openstack-keystone-9378 To bring your system up-to-date, use "zypper patch". Package List: - SUSE Cloud 3 (x86_64) [New Version: 2013.2.4.dev5.g9162837]: openstack-keystone-2013.2.4.dev5.g9162837-0.7.1 python-keystone-2013.2.4.dev5.g9162837-0.7.1 - SUSE Cloud 3 (noarch) [New Version: 2013.2.4.dev5.g9162837]: openstack-keystone-doc-2013.2.4.dev5.g9162837-0.7.1 References: http://support.novell.com/security/cve/CVE-2014-3476.html https://bugzilla.novell.com/881977 http://download.suse.com/patch/finder/?keywords=7e3827dc35a978ab61c22613447… -- To unsubscribe, e-mail: opensuse-security-announce+unsubscribe(a)opensuse.org For additional commands, e-mail: opensuse-security-announce+help(a)opensuse.org

1 0

[security-announce] SUSE-SU-2014:0847-1: important: Security update for novell-qtgui, novell-ui-base
by opensuse-security＠opensuse.org 26 Jun '14

26 Jun '14

SUSE Security Update: Security update for novell-qtgui, novell-ui-base ______________________________________________________________________________ Announcement ID: SUSE-SU-2014:0847-1 Rating: important References: #872796 Cross-References: CVE-2014-0595 Affected Products: SUSE Linux Enterprise Desktop 11 SP3 ______________________________________________________________________________ An update that fixes one vulnerability is now available. Description: Packages novell-ui-base and novell-qtgui were updated to prevent erroneous rights assignment when a user is granted 'File Scan' rights (F). In this case nwrights was assigning Supervisor (S) rights. (CVE-2014-0595) Further information is available at https://bugzilla.novell.com/show_bug.cgi?id=872796 <https://bugzilla.novell.com/show_bug.cgi?id=872796> . Security Issue reference: * CVE-2014-0595 <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-0595> Patch Instructions: To install this SUSE Security Update use YaST online_update. Alternatively you can run the command listed for your product: - SUSE Linux Enterprise Desktop 11 SP3: zypper in -t patch sledsp3-novell-ui-201405-9276 To bring your system up-to-date, use "zypper patch". Package List: - SUSE Linux Enterprise Desktop 11 SP3 (i586 x86_64): novell-qtgui-3.0.0-0.20.1 novell-qtgui-cli-3.0.0-0.20.1 novell-ui-base-3.0.0-0.10.1 References: http://support.novell.com/security/cve/CVE-2014-0595.html https://bugzilla.novell.com/872796 http://download.suse.com/patch/finder/?keywords=5bdf8cabc0ee4ea4ea2e5c84d21… -- To unsubscribe, e-mail: opensuse-security-announce+unsubscribe(a)opensuse.org For additional commands, e-mail: opensuse-security-announce+help(a)opensuse.org

1 0

[security-announce] openSUSE-SU-2014:0840-1: important: kernel: security and bugfix update
by opensuse-security＠opensuse.org 25 Jun '14

25 Jun '14

openSUSE Security Update: kernel: security and bugfix update ______________________________________________________________________________ Announcement ID: openSUSE-SU-2014:0840-1 Rating: important References: #851338 #858067 #868315 #869563 #870173 #870576 #871561 #872715 #873374 #876102 #876981 #877257 #877713 #877721 #878115 #878274 #879258 #879792 #880599 #880613 #880892 #881697 #881727 #882648 Cross-References: CVE-2013-7339 CVE-2014-0055 CVE-2014-0077 CVE-2014-2678 CVE-2014-2851 CVE-2014-3122 CVE-2014-3144 CVE-2014-3145 CVE-2014-3153 Affected Products: openSUSE 13.1 ______________________________________________________________________________ An update that solves 9 vulnerabilities and has 15 fixes is now available. Description: The Linux kernel was updated to fix security issues and bugs. Security issues fixed: CVE-2014-3153: The futex_requeue function in kernel/futex.c in the Linux kernel did not ensure that calls have two different futex addresses, which allowed local users to gain privileges via a crafted FUTEX_REQUEUE command that facilitates unsafe waiter modification. CVE-2014-3144: The (1) BPF_S_ANC_NLATTR and (2) BPF_S_ANC_NLATTR_NEST extension implementations in the sk_run_filter function in net/core/filter.c in the Linux kernel did not check whether a certain length value is sufficiently large, which allowed local users to cause a denial of service (integer underflow and system crash) via crafted BPF instructions. NOTE: the affected code was moved to the __skb_get_nlattr and __skb_get_nlattr_nest functions before the vulnerability was announced. CVE-2014-3145: The BPF_S_ANC_NLATTR_NEST extension implementation in the sk_run_filter function in net/core/filter.c in the Linux kernel used the reverse order in a certain subtraction, which allowed local users to cause a denial of service (over-read and system crash) via crafted BPF instructions. NOTE: the affected code was moved to the __skb_get_nlattr_nest function before the vulnerability was announced. CVE-2014-0077: drivers/vhost/net.c in the Linux kernel, when mergeable buffers are disabled, did not properly validate packet lengths, which allowed guest OS users to cause a denial of service (memory corruption and host OS crash) or possibly gain privileges on the host OS via crafted packets, related to the handle_rx and get_rx_bufs functions. CVE-2014-0055: The get_rx_bufs function in drivers/vhost/net.c in the vhost-net subsystem in the Linux kernel package did not properly handle vhost_get_vq_desc errors, which allowed guest OS users to cause a denial of service (host OS crash) via unspecified vectors. CVE-2014-2678: The rds_iw_laddr_check function in net/rds/iw.c in the Linux kernel allowed local users to cause a denial of service (NULL pointer dereference and system crash) or possibly have unspecified other impact via a bind system call for an RDS socket on a system that lacks RDS transports. CVE-2013-7339: The rds_ib_laddr_check function in net/rds/ib.c in the Linux kernel allowed local users to cause a denial of service (NULL pointer dereference and system crash) or possibly have unspecified other impact via a bind system call for an RDS socket on a system that lacks RDS transports. CVE-2014-2851: Integer overflow in the ping_init_sock function in net/ipv4/ping.c in the Linux kernel allowed local users to cause a denial of service (use-after-free and system crash) or possibly gain privileges via a crafted application that leverages an improperly managed reference counter. - ext4: Fix buffer double free in ext4_alloc_branch() (bnc#880599 bnc#876981). - patches.fixes/firewire-01-net-fix-use-after-free.patch, patches.fixes/firewire-02-ohci-fix-probe-failure-with-agere-lsi-controllers .patch, patches.fixes/firewire-03-dont-use-prepare_delayed_work.patch: Add missing bug reference (bnc#881697). - firewire: don't use PREPARE_DELAYED_WORK. - firewire: ohci: fix probe failure with Agere/LSI controllers. - firewire: net: fix use after free. - USB: OHCI: fix problem with global suspend on ATI controllers (bnc#868315). - mm: revert "page-writeback.c: subtract min_free_kbytes from dirtyable memory" (bnc#879792). - usb: musb: tusb6010: Use musb->tusb_revision instead of tusb_get_revision call (bnc#872715). - usb: musb: tusb6010: Add tusb_revision to struct musb to store the revision (bnc#872715). - ALSA: hda - Fix onboard audio on Intel H97/Z97 chipsets (bnc#880613). - floppy: do not corrupt bio.bi_flags when reading block 0 (bnc#879258). - reiserfs: call truncate_setsize under tailpack mutex (bnc#878115). - Update Xen config files: Set compatibility level back to 4.1 (bnc#851338). - Update config files. Guillaume GARDET reported a broken build due to CONFIG_USB_SERIAL_GENERIC being modular - memcg: deprecate memory.force_empty knob (bnc#878274). - nfsd: when reusing an existing repcache entry, unhash it first (bnc#877721). - Enable Socketcan again for i386 and x86_64 (bnc#858067) - xhci: extend quirk for Renesas cards (bnc#877713). - xhci: Fix resume issues on Renesas chips in Samsung laptops (bnc#877713). - mm: try_to_unmap_cluster() should lock_page() before mlocking (bnc#876102, CVE-2014-3122). - drm/i915, HD-audio: Don't continue probing when nomodeset is given (bnc#882648). - x86/mm/numa: Fix 32-bit kernel NUMA boot (bnc#881727). Patch Instructions: To install this openSUSE Security Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE 13.1: zypper in -t patch openSUSE-2014-441 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE 13.1 (i686 x86_64): kernel-debug-3.11.10-17.2 kernel-debug-base-3.11.10-17.2 kernel-debug-base-debuginfo-3.11.10-17.2 kernel-debug-debuginfo-3.11.10-17.2 kernel-debug-debugsource-3.11.10-17.2 kernel-debug-devel-3.11.10-17.2 kernel-debug-devel-debuginfo-3.11.10-17.2 kernel-desktop-3.11.10-17.2 kernel-desktop-base-3.11.10-17.2 kernel-desktop-base-debuginfo-3.11.10-17.2 kernel-desktop-debuginfo-3.11.10-17.2 kernel-desktop-debugsource-3.11.10-17.2 kernel-desktop-devel-3.11.10-17.2 kernel-desktop-devel-debuginfo-3.11.10-17.2 kernel-ec2-3.11.10-17.1 kernel-ec2-base-3.11.10-17.1 kernel-ec2-base-debuginfo-3.11.10-17.1 kernel-ec2-debuginfo-3.11.10-17.1 kernel-ec2-debugsource-3.11.10-17.1 kernel-ec2-devel-3.11.10-17.1 kernel-ec2-devel-debuginfo-3.11.10-17.1 kernel-trace-3.11.10-17.2 kernel-trace-base-3.11.10-17.2 kernel-trace-base-debuginfo-3.11.10-17.2 kernel-trace-debuginfo-3.11.10-17.2 kernel-trace-debugsource-3.11.10-17.2 kernel-trace-devel-3.11.10-17.2 kernel-trace-devel-debuginfo-3.11.10-17.2 kernel-vanilla-3.11.10-17.2 kernel-vanilla-debuginfo-3.11.10-17.2 kernel-vanilla-debugsource-3.11.10-17.2 kernel-vanilla-devel-3.11.10-17.2 kernel-vanilla-devel-debuginfo-3.11.10-17.2 kernel-xen-3.11.10-17.2 kernel-xen-base-3.11.10-17.2 kernel-xen-base-debuginfo-3.11.10-17.2 kernel-xen-debuginfo-3.11.10-17.2 kernel-xen-debugsource-3.11.10-17.2 kernel-xen-devel-3.11.10-17.2 kernel-xen-devel-debuginfo-3.11.10-17.2 - openSUSE 13.1 (i586 x86_64): cloop-2.639-11.10.1 cloop-debuginfo-2.639-11.10.1 cloop-debugsource-2.639-11.10.1 cloop-kmp-default-2.639_k3.11.10_17-11.10.1 cloop-kmp-default-debuginfo-2.639_k3.11.10_17-11.10.1 cloop-kmp-desktop-2.639_k3.11.10_17-11.10.1 cloop-kmp-desktop-debuginfo-2.639_k3.11.10_17-11.10.1 cloop-kmp-xen-2.639_k3.11.10_17-11.10.1 cloop-kmp-xen-debuginfo-2.639_k3.11.10_17-11.10.1 crash-7.0.2-2.10.9 crash-debuginfo-7.0.2-2.10.9 crash-debugsource-7.0.2-2.10.9 crash-devel-7.0.2-2.10.9 crash-doc-7.0.2-2.10.9 crash-eppic-7.0.2-2.10.9 crash-eppic-debuginfo-7.0.2-2.10.9 crash-gcore-7.0.2-2.10.9 crash-gcore-debuginfo-7.0.2-2.10.9 crash-kmp-default-7.0.2_k3.11.10_17-2.10.9 crash-kmp-default-debuginfo-7.0.2_k3.11.10_17-2.10.9 crash-kmp-desktop-7.0.2_k3.11.10_17-2.10.9 crash-kmp-desktop-debuginfo-7.0.2_k3.11.10_17-2.10.9 crash-kmp-xen-7.0.2_k3.11.10_17-2.10.9 crash-kmp-xen-debuginfo-7.0.2_k3.11.10_17-2.10.9 hdjmod-debugsource-1.28-16.10.1 hdjmod-kmp-default-1.28_k3.11.10_17-16.10.1 hdjmod-kmp-default-debuginfo-1.28_k3.11.10_17-16.10.1 hdjmod-kmp-desktop-1.28_k3.11.10_17-16.10.1 hdjmod-kmp-desktop-debuginfo-1.28_k3.11.10_17-16.10.1 hdjmod-kmp-xen-1.28_k3.11.10_17-16.10.1 hdjmod-kmp-xen-debuginfo-1.28_k3.11.10_17-16.10.1 ipset-6.21.1-2.14.1 ipset-debuginfo-6.21.1-2.14.1 ipset-debugsource-6.21.1-2.14.1 ipset-devel-6.21.1-2.14.1 ipset-kmp-default-6.21.1_k3.11.10_17-2.14.1 ipset-kmp-default-debuginfo-6.21.1_k3.11.10_17-2.14.1 ipset-kmp-desktop-6.21.1_k3.11.10_17-2.14.1 ipset-kmp-desktop-debuginfo-6.21.1_k3.11.10_17-2.14.1 ipset-kmp-xen-6.21.1_k3.11.10_17-2.14.1 ipset-kmp-xen-debuginfo-6.21.1_k3.11.10_17-2.14.1 iscsitarget-1.4.20.3-13.10.1 iscsitarget-debuginfo-1.4.20.3-13.10.1 iscsitarget-debugsource-1.4.20.3-13.10.1 iscsitarget-kmp-default-1.4.20.3_k3.11.10_17-13.10.1 iscsitarget-kmp-default-debuginfo-1.4.20.3_k3.11.10_17-13.10.1 iscsitarget-kmp-desktop-1.4.20.3_k3.11.10_17-13.10.1 iscsitarget-kmp-desktop-debuginfo-1.4.20.3_k3.11.10_17-13.10.1 iscsitarget-kmp-xen-1.4.20.3_k3.11.10_17-13.10.1 iscsitarget-kmp-xen-debuginfo-1.4.20.3_k3.11.10_17-13.10.1 kernel-default-3.11.10-17.2 kernel-default-base-3.11.10-17.2 kernel-default-base-debuginfo-3.11.10-17.2 kernel-default-debuginfo-3.11.10-17.2 kernel-default-debugsource-3.11.10-17.2 kernel-default-devel-3.11.10-17.2 kernel-default-devel-debuginfo-3.11.10-17.2 kernel-syms-3.11.10-17.1 libipset3-6.21.1-2.14.1 libipset3-debuginfo-6.21.1-2.14.1 ndiswrapper-1.58-10.1 ndiswrapper-debuginfo-1.58-10.1 ndiswrapper-debugsource-1.58-10.1 ndiswrapper-kmp-default-1.58_k3.11.10_17-10.1 ndiswrapper-kmp-default-debuginfo-1.58_k3.11.10_17-10.1 ndiswrapper-kmp-desktop-1.58_k3.11.10_17-10.1 ndiswrapper-kmp-desktop-debuginfo-1.58_k3.11.10_17-10.1 pcfclock-0.44-258.10.1 pcfclock-debuginfo-0.44-258.10.1 pcfclock-debugsource-0.44-258.10.1 pcfclock-kmp-default-0.44_k3.11.10_17-258.10.1 pcfclock-kmp-default-debuginfo-0.44_k3.11.10_17-258.10.1 pcfclock-kmp-desktop-0.44_k3.11.10_17-258.10.1 pcfclock-kmp-desktop-debuginfo-0.44_k3.11.10_17-258.10.1 python-virtualbox-4.2.18-2.15.2 python-virtualbox-debuginfo-4.2.18-2.15.2 vhba-kmp-debugsource-20130607-2.11.1 vhba-kmp-default-20130607_k3.11.10_17-2.11.1 vhba-kmp-default-debuginfo-20130607_k3.11.10_17-2.11.1 vhba-kmp-desktop-20130607_k3.11.10_17-2.11.1 vhba-kmp-desktop-debuginfo-20130607_k3.11.10_17-2.11.1 vhba-kmp-xen-20130607_k3.11.10_17-2.11.1 vhba-kmp-xen-debuginfo-20130607_k3.11.10_17-2.11.1 virtualbox-4.2.18-2.15.2 virtualbox-debuginfo-4.2.18-2.15.2 virtualbox-debugsource-4.2.18-2.15.2 virtualbox-devel-4.2.18-2.15.2 virtualbox-guest-kmp-default-4.2.18_k3.11.10_17-2.15.2 virtualbox-guest-kmp-default-debuginfo-4.2.18_k3.11.10_17-2.15.2 virtualbox-guest-kmp-desktop-4.2.18_k3.11.10_17-2.15.2 virtualbox-guest-kmp-desktop-debuginfo-4.2.18_k3.11.10_17-2.15.2 virtualbox-guest-tools-4.2.18-2.15.2 virtualbox-guest-tools-debuginfo-4.2.18-2.15.2 virtualbox-guest-x11-4.2.18-2.15.2 virtualbox-guest-x11-debuginfo-4.2.18-2.15.2 virtualbox-host-kmp-default-4.2.18_k3.11.10_17-2.15.2 virtualbox-host-kmp-default-debuginfo-4.2.18_k3.11.10_17-2.15.2 virtualbox-host-kmp-desktop-4.2.18_k3.11.10_17-2.15.2 virtualbox-host-kmp-desktop-debuginfo-4.2.18_k3.11.10_17-2.15.2 virtualbox-qt-4.2.18-2.15.2 virtualbox-qt-debuginfo-4.2.18-2.15.2 virtualbox-websrv-4.2.18-2.15.2 virtualbox-websrv-debuginfo-4.2.18-2.15.2 xen-debugsource-4.3.2_01-18.2 xen-devel-4.3.2_01-18.2 xen-kmp-default-4.3.2_01_k3.11.10_17-18.2 xen-kmp-default-debuginfo-4.3.2_01_k3.11.10_17-18.2 xen-kmp-desktop-4.3.2_01_k3.11.10_17-18.2 xen-kmp-desktop-debuginfo-4.3.2_01_k3.11.10_17-18.2 xen-libs-4.3.2_01-18.2 xen-libs-debuginfo-4.3.2_01-18.2 xen-tools-domU-4.3.2_01-18.2 xen-tools-domU-debuginfo-4.3.2_01-18.2 xtables-addons-2.3-2.10.1 xtables-addons-debuginfo-2.3-2.10.1 xtables-addons-debugsource-2.3-2.10.1 xtables-addons-kmp-default-2.3_k3.11.10_17-2.10.1 xtables-addons-kmp-default-debuginfo-2.3_k3.11.10_17-2.10.1 xtables-addons-kmp-desktop-2.3_k3.11.10_17-2.10.1 xtables-addons-kmp-desktop-debuginfo-2.3_k3.11.10_17-2.10.1 xtables-addons-kmp-xen-2.3_k3.11.10_17-2.10.1 xtables-addons-kmp-xen-debuginfo-2.3_k3.11.10_17-2.10.1 - openSUSE 13.1 (noarch): kernel-devel-3.11.10-17.2 kernel-docs-3.11.10-17.6 kernel-source-3.11.10-17.2 kernel-source-vanilla-3.11.10-17.2 - openSUSE 13.1 (x86_64): xen-4.3.2_01-18.2 xen-doc-html-4.3.2_01-18.2 xen-libs-32bit-4.3.2_01-18.2 xen-libs-debuginfo-32bit-4.3.2_01-18.2 xen-tools-4.3.2_01-18.2 xen-tools-debuginfo-4.3.2_01-18.2 xen-xend-tools-4.3.2_01-18.2 xen-xend-tools-debuginfo-4.3.2_01-18.2 - openSUSE 13.1 (i686): kernel-pae-3.11.10-17.2 kernel-pae-base-3.11.10-17.2 kernel-pae-base-debuginfo-3.11.10-17.2 kernel-pae-debuginfo-3.11.10-17.2 kernel-pae-debugsource-3.11.10-17.2 kernel-pae-devel-3.11.10-17.2 kernel-pae-devel-debuginfo-3.11.10-17.2 - openSUSE 13.1 (i586): cloop-kmp-pae-2.639_k3.11.10_17-11.10.1 cloop-kmp-pae-debuginfo-2.639_k3.11.10_17-11.10.1 crash-kmp-pae-7.0.2_k3.11.10_17-2.10.9 crash-kmp-pae-debuginfo-7.0.2_k3.11.10_17-2.10.9 hdjmod-kmp-pae-1.28_k3.11.10_17-16.10.1 hdjmod-kmp-pae-debuginfo-1.28_k3.11.10_17-16.10.1 ipset-kmp-pae-6.21.1_k3.11.10_17-2.14.1 ipset-kmp-pae-debuginfo-6.21.1_k3.11.10_17-2.14.1 iscsitarget-kmp-pae-1.4.20.3_k3.11.10_17-13.10.1 iscsitarget-kmp-pae-debuginfo-1.4.20.3_k3.11.10_17-13.10.1 ndiswrapper-kmp-pae-1.58_k3.11.10_17-10.1 ndiswrapper-kmp-pae-debuginfo-1.58_k3.11.10_17-10.1 pcfclock-kmp-pae-0.44_k3.11.10_17-258.10.1 pcfclock-kmp-pae-debuginfo-0.44_k3.11.10_17-258.10.1 vhba-kmp-pae-20130607_k3.11.10_17-2.11.1 vhba-kmp-pae-debuginfo-20130607_k3.11.10_17-2.11.1 virtualbox-guest-kmp-pae-4.2.18_k3.11.10_17-2.15.2 virtualbox-guest-kmp-pae-debuginfo-4.2.18_k3.11.10_17-2.15.2 virtualbox-host-kmp-pae-4.2.18_k3.11.10_17-2.15.2 virtualbox-host-kmp-pae-debuginfo-4.2.18_k3.11.10_17-2.15.2 xen-kmp-pae-4.3.2_01_k3.11.10_17-18.2 xen-kmp-pae-debuginfo-4.3.2_01_k3.11.10_17-18.2 xtables-addons-kmp-pae-2.3_k3.11.10_17-2.10.1 xtables-addons-kmp-pae-debuginfo-2.3_k3.11.10_17-2.10.1 References: http://support.novell.com/security/cve/CVE-2013-7339.html http://support.novell.com/security/cve/CVE-2014-0055.html http://support.novell.com/security/cve/CVE-2014-0077.html http://support.novell.com/security/cve/CVE-2014-2678.html http://support.novell.com/security/cve/CVE-2014-2851.html http://support.novell.com/security/cve/CVE-2014-3122.html http://support.novell.com/security/cve/CVE-2014-3144.html http://support.novell.com/security/cve/CVE-2014-3145.html http://support.novell.com/security/cve/CVE-2014-3153.html https://bugzilla.novell.com/851338 https://bugzilla.novell.com/858067 https://bugzilla.novell.com/868315 https://bugzilla.novell.com/869563 https://bugzilla.novell.com/870173 https://bugzilla.novell.com/870576 https://bugzilla.novell.com/871561 https://bugzilla.novell.com/872715 https://bugzilla.novell.com/873374 https://bugzilla.novell.com/876102 https://bugzilla.novell.com/876981 https://bugzilla.novell.com/877257 https://bugzilla.novell.com/877713 https://bugzilla.novell.com/877721 https://bugzilla.novell.com/878115 https://bugzilla.novell.com/878274 https://bugzilla.novell.com/879258 https://bugzilla.novell.com/879792 https://bugzilla.novell.com/880599 https://bugzilla.novell.com/880613 https://bugzilla.novell.com/880892 https://bugzilla.novell.com/881697 https://bugzilla.novell.com/881727 https://bugzilla.novell.com/882648 -- To unsubscribe, e-mail: opensuse-security-announce+unsubscribe(a)opensuse.org For additional commands, e-mail: opensuse-security-announce+help(a)opensuse.org

1 0

[security-announce] SUSE-SU-2014:0837-2: important: Security update for Linux Kernel
by opensuse-security＠opensuse.org 25 Jun '14

25 Jun '14

SUSE Security Update: Security update for Linux Kernel ______________________________________________________________________________ Announcement ID: SUSE-SU-2014:0837-2 Rating: important References: #880892 Cross-References: CVE-2014-3153 Affected Products: SUSE Linux Enterprise Server 11 SP2 LTSS ______________________________________________________________________________ An update that fixes one vulnerability is now available. It includes one version update. Description: The SUSE Linux Enterprise 11 Service Pack 2 LTSS kernel was updated to fix a critical security issue: * CVE-2014-3153: The futex acquisition code in kernel/futex.c can be used to gain ring0 access via the futex syscall. This could be used for privilege escalation by non-root users. (bnc#880892) Security Issue reference: * CVE-2014-3153 <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-3153> Indications: Everyone using the Linux Kernel on s390x architecture should update. Special Instructions and Notes: Please reboot the system after installing this update. Patch Instructions: To install this SUSE Security Update use YaST online_update. Alternatively you can run the command listed for your product: - SUSE Linux Enterprise Server 11 SP2 LTSS: zypper in -t patch slessp2-kernel-9394 slessp2-kernel-9396 To bring your system up-to-date, use "zypper patch". Package List: - SUSE Linux Enterprise Server 11 SP2 LTSS (i586 s390x) [New Version: 3.0.101]: kernel-default-3.0.101-0.7.21.1 kernel-default-base-3.0.101-0.7.21.1 kernel-default-devel-3.0.101-0.7.21.1 kernel-source-3.0.101-0.7.21.1 kernel-syms-3.0.101-0.7.21.1 kernel-trace-3.0.101-0.7.21.1 kernel-trace-base-3.0.101-0.7.21.1 kernel-trace-devel-3.0.101-0.7.21.1 - SUSE Linux Enterprise Server 11 SP2 LTSS (s390x) [New Version: 3.0.101]: kernel-default-man-3.0.101-0.7.21.1 - SUSE Linux Enterprise Server 11 SP2 LTSS (i586) [New Version: 3.0.101]: kernel-ec2-3.0.101-0.7.21.1 kernel-ec2-base-3.0.101-0.7.21.1 kernel-ec2-devel-3.0.101-0.7.21.1 kernel-pae-3.0.101-0.7.21.1 kernel-pae-base-3.0.101-0.7.21.1 kernel-pae-devel-3.0.101-0.7.21.1 kernel-xen-3.0.101-0.7.21.1 kernel-xen-base-3.0.101-0.7.21.1 kernel-xen-devel-3.0.101-0.7.21.1 xen-kmp-default-4.1.6_06_3.0.101_0.7.21-0.5.16 xen-kmp-pae-4.1.6_06_3.0.101_0.7.21-0.5.16 xen-kmp-trace-4.1.6_06_3.0.101_0.7.21-0.5.16 References: http://support.novell.com/security/cve/CVE-2014-3153.html https://bugzilla.novell.com/880892 http://download.suse.com/patch/finder/?keywords=ae793a34e7393acb565c7a3c4a4… http://download.suse.com/patch/finder/?keywords=b4fdb0d3ad801ad88765f88da91… -- To unsubscribe, e-mail: opensuse-security-announce+unsubscribe(a)opensuse.org For additional commands, e-mail: opensuse-security-announce+help(a)opensuse.org

1 0

[security-announce] SUSE-SU-2014:0824-3: important: Security update for MozillaFirefox
by opensuse-security＠opensuse.org 25 Jun '14

25 Jun '14

SUSE Security Update: Security update for MozillaFirefox ______________________________________________________________________________ Announcement ID: SUSE-SU-2014:0824-3 Rating: important References: #881874 Cross-References: CVE-2014-1533 CVE-2014-1534 CVE-2014-1536 CVE-2014-1537 CVE-2014-1538 CVE-2014-1541 CVE-2014-1545 Affected Products: SUSE Linux Enterprise Server 11 SP2 LTSS ______________________________________________________________________________ An update that fixes 7 vulnerabilities is now available. It includes three new package versions. Description: MozillaFirefox was updated to version 24.6.0 to fix six security issues: * Miscellaneous memory safety hazards. (CVE-2014-1533, CVE-2014-1534) * Use-after-free and out of bounds issues found using Address Sanitizer. (CVE-2014-1536, CVE-2014-1537, CVE-2014-1538) * Use-after-free with SMIL Animation Controller. (CVE-2014-1541) mozilla-nspr was updated to version 4.10.6 to fix one security issue: * Out of bounds write in NSPR. (CVE-2014-1545) Further information can be found at https://www.mozilla.org/security/announce/ <https://www.mozilla.org/security/announce/> . Security Issues references: * CVE-2014-1533 <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-1533> * CVE-2014-1534 <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-1534> * CVE-2014-1536 <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-1536> * CVE-2014-1537 <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-1537> * CVE-2014-1538 <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-1538> * CVE-2014-1541 <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-1541> * CVE-2014-1545 <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-1545> Patch Instructions: To install this SUSE Security Update use YaST online_update. Alternatively you can run the command listed for your product: - SUSE Linux Enterprise Server 11 SP2 LTSS: zypper in -t patch slessp2-Firefox-2014-06-9372 To bring your system up-to-date, use "zypper patch". Package List: - SUSE Linux Enterprise Server 11 SP2 LTSS (i586 s390x x86_64) [New Version: 24.6.0esr,3.16.1 and 4.10.6]: MozillaFirefox-24.6.0esr-0.3.1 MozillaFirefox-branding-SLED-24-0.4.10.24 MozillaFirefox-translations-24.6.0esr-0.3.1 libfreebl3-3.16.1-0.3.1 mozilla-nspr-4.10.6-0.3.1 mozilla-nspr-devel-4.10.6-0.3.1 mozilla-nss-3.16.1-0.3.1 mozilla-nss-devel-3.16.1-0.3.1 mozilla-nss-tools-3.16.1-0.3.1 - SUSE Linux Enterprise Server 11 SP2 LTSS (s390x x86_64) [New Version: 3.16.1 and 4.10.6]: libfreebl3-32bit-3.16.1-0.3.1 mozilla-nspr-32bit-4.10.6-0.3.1 mozilla-nss-32bit-3.16.1-0.3.1 References: http://support.novell.com/security/cve/CVE-2014-1533.html http://support.novell.com/security/cve/CVE-2014-1534.html http://support.novell.com/security/cve/CVE-2014-1536.html http://support.novell.com/security/cve/CVE-2014-1537.html http://support.novell.com/security/cve/CVE-2014-1538.html http://support.novell.com/security/cve/CVE-2014-1541.html http://support.novell.com/security/cve/CVE-2014-1545.html https://bugzilla.novell.com/881874 http://download.suse.com/patch/finder/?keywords=e2d7ece33b6e193c079bd4bb573… -- To unsubscribe, e-mail: opensuse-security-announce+unsubscribe(a)opensuse.org For additional commands, e-mail: opensuse-security-announce+help(a)opensuse.org

1 0

[security-announce] SUSE-SU-2014:0838-1: important: Security update for rxvt-unicode
by opensuse-security＠opensuse.org 24 Jun '14

24 Jun '14

SUSE Security Update: Security update for rxvt-unicode ______________________________________________________________________________ Announcement ID: SUSE-SU-2014:0838-1 Rating: important References: #876101 Cross-References: CVE-2014-3121 Affected Products: SUSE Linux Enterprise Software Development Kit 11 SP3 SUSE Linux Enterprise Desktop 11 SP3 ______________________________________________________________________________ An update that fixes one vulnerability is now available. Description: rxvt-unicode was updated to ensure that window property values can not be queried in secure mode. (CVE-2014-3121) Security Issue reference: * CVE-2014-3121 <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-3121> Patch Instructions: To install this SUSE Security Update use YaST online_update. Alternatively you can run the command listed for your product: - SUSE Linux Enterprise Software Development Kit 11 SP3: zypper in -t patch sdksp3-rxvt-unicode-9421 - SUSE Linux Enterprise Desktop 11 SP3: zypper in -t patch sledsp3-rxvt-unicode-9421 To bring your system up-to-date, use "zypper patch". Package List: - SUSE Linux Enterprise Software Development Kit 11 SP3 (i586 ia64 ppc64 s390x x86_64): rxvt-unicode-9.05-1.19.1 - SUSE Linux Enterprise Desktop 11 SP3 (i586 x86_64): rxvt-unicode-9.05-1.19.1 References: http://support.novell.com/security/cve/CVE-2014-3121.html https://bugzilla.novell.com/876101 http://download.suse.com/patch/finder/?keywords=6bf1964f470fdf42df9dcb851b5… -- To unsubscribe, e-mail: opensuse-security-announce+unsubscribe(a)opensuse.org For additional commands, e-mail: opensuse-security-announce+help(a)opensuse.org

1 0

[security-announce] SUSE-SU-2014:0837-1: important: Security update for Linux Kernel
by opensuse-security＠opensuse.org 24 Jun '14

24 Jun '14

SUSE Security Update: Security update for Linux Kernel ______________________________________________________________________________ Announcement ID: SUSE-SU-2014:0837-1 Rating: important References: #880892 Cross-References: CVE-2014-3153 Affected Products: SUSE Linux Enterprise Server 11 SP2 LTSS SLE 11 SERVER Unsupported Extras ______________________________________________________________________________ An update that fixes one vulnerability is now available. It includes one version update. Description: The SUSE Linux Enterprise 11 Service Pack 2 LTSS kernel was updated to fix a critical security issue: * CVE-2014-3153: The futex acquisition code in kernel/futex.c can be used to gain ring0 access via the futex syscall. This could be used for privilege escalation by non-root users. (bnc#880892) Security Issue reference: * CVE-2014-3153 <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-3153> Indications: Everyone using the Linux Kernel on x86_64 architecture should update. Special Instructions and Notes: Please reboot the system after installing this update. Patch Instructions: To install this SUSE Security Update use YaST online_update. Alternatively you can run the command listed for your product: - SUSE Linux Enterprise Server 11 SP2 LTSS: zypper in -t patch slessp2-kernel-9401 To bring your system up-to-date, use "zypper patch". Package List: - SUSE Linux Enterprise Server 11 SP2 LTSS (x86_64) [New Version: 3.0.101]: kernel-default-3.0.101-0.7.21.1 kernel-default-base-3.0.101-0.7.21.1 kernel-default-devel-3.0.101-0.7.21.1 kernel-ec2-3.0.101-0.7.21.1 kernel-ec2-base-3.0.101-0.7.21.1 kernel-ec2-devel-3.0.101-0.7.21.1 kernel-source-3.0.101-0.7.21.1 kernel-syms-3.0.101-0.7.21.1 kernel-trace-3.0.101-0.7.21.1 kernel-trace-base-3.0.101-0.7.21.1 kernel-trace-devel-3.0.101-0.7.21.1 kernel-xen-3.0.101-0.7.21.1 kernel-xen-base-3.0.101-0.7.21.1 kernel-xen-devel-3.0.101-0.7.21.1 xen-kmp-default-4.1.6_06_3.0.101_0.7.21-0.5.16 xen-kmp-trace-4.1.6_06_3.0.101_0.7.21-0.5.16 - SLE 11 SERVER Unsupported Extras (i586 s390x x86_64): ext4-writeable-kmp-default-0_3.0.101_0.7.21-0.14.103 ext4-writeable-kmp-trace-0_3.0.101_0.7.21-0.14.103 kernel-default-extra-3.0.101-0.7.21.1 - SLE 11 SERVER Unsupported Extras (i586 x86_64): ext4-writeable-kmp-xen-0_3.0.101_0.7.21-0.14.103 kernel-xen-extra-3.0.101-0.7.21.1 - SLE 11 SERVER Unsupported Extras (i586): ext4-writeable-kmp-pae-0_3.0.101_0.7.21-0.14.103 kernel-pae-extra-3.0.101-0.7.21.1 References: http://support.novell.com/security/cve/CVE-2014-3153.html https://bugzilla.novell.com/880892 http://download.suse.com/patch/finder/?keywords=57e8ca903c0e219b4a246341a1d… http://download.suse.com/patch/finder/?keywords=61e1a2a73687bac3fafca164f96… http://download.suse.com/patch/finder/?keywords=8a436d368e8568ba2e588b5dcdb… http://download.suse.com/patch/finder/?keywords=9f300f6a58020c0e115d462d377… -- To unsubscribe, e-mail: opensuse-security-announce+unsubscribe(a)opensuse.org For additional commands, e-mail: opensuse-security-announce+help(a)opensuse.org

1 0

[security-announce] SUSE-SU-2014:0824-2: important: Security update for MozillaFirefox
by opensuse-security＠opensuse.org 23 Jun '14

23 Jun '14

SUSE Security Update: Security update for MozillaFirefox ______________________________________________________________________________ Announcement ID: SUSE-SU-2014:0824-2 Rating: important References: #881874 Cross-References: CVE-2014-1533 CVE-2014-1534 CVE-2014-1536 CVE-2014-1537 CVE-2014-1538 CVE-2014-1541 CVE-2014-1545 Affected Products: SUSE Linux Enterprise Server 11 SP1 LTSS SUSE Linux Enterprise Server 10 SP4 LTSS ______________________________________________________________________________ An update that fixes 7 vulnerabilities is now available. It includes four new package versions. Description: MozillaFirefox was updated to version 24.6.0 to fix six security issues: * Miscellaneous memory safety hazards. (CVE-2014-1533, CVE-2014-1534) * Use-after-free and out of bounds issues found using Address Sanitizer. (CVE-2014-1536, CVE-2014-1537, CVE-2014-1538) * Use-after-free with SMIL Animation Controller. (CVE-2014-1541) mozilla-nspr was updated to version 4.10.6 to fix one security issue: * Out of bounds write in NSPR. (CVE-2014-1545) Further information can be found at https://www.mozilla.org/security/announce/ <https://www.mozilla.org/security/announce/> . Security Issues references: * CVE-2014-1533 <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-1533> * CVE-2014-1534 <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-1534> * CVE-2014-1536 <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-1536> * CVE-2014-1537 <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-1537> * CVE-2014-1538 <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-1538> * CVE-2014-1541 <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-1541> * CVE-2014-1545 <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-1545> Special Instructions and Notes: Please reboot the system after installing this update. Patch Instructions: To install this SUSE Security Update use YaST online_update. Alternatively you can run the command listed for your product: - SUSE Linux Enterprise Server 11 SP1 LTSS: zypper in -t patch slessp1-Firefox-2014-06-9371 To bring your system up-to-date, use "zypper patch". Package List: - SUSE Linux Enterprise Server 11 SP1 LTSS (i586 s390x x86_64) [New Version: 24,24.6.0esr,3.16.1 and 4.10.6]: MozillaFirefox-24.6.0esr-0.3.1 MozillaFirefox-branding-SLED-24-0.4.10.24 MozillaFirefox-translations-24.6.0esr-0.3.1 libfreebl3-3.16.1-0.3.1 mozilla-nspr-4.10.6-0.3.1 mozilla-nss-3.16.1-0.3.1 mozilla-nss-tools-3.16.1-0.3.1 - SUSE Linux Enterprise Server 11 SP1 LTSS (s390x x86_64) [New Version: 3.16.1 and 4.10.6]: libfreebl3-32bit-3.16.1-0.3.1 mozilla-nspr-32bit-4.10.6-0.3.1 mozilla-nss-32bit-3.16.1-0.3.1 - SUSE Linux Enterprise Server 10 SP4 LTSS (i586 s390x x86_64) [New Version: 3.16.1 and 4.10.6]: mozilla-nspr-4.10.6-0.5.1 mozilla-nspr-devel-4.10.6-0.5.1 mozilla-nss-3.16.1-0.5.1 mozilla-nss-devel-3.16.1-0.5.1 mozilla-nss-tools-3.16.1-0.5.1 - SUSE Linux Enterprise Server 10 SP4 LTSS (s390x x86_64) [New Version: 3.16.1 and 4.10.6]: mozilla-nspr-32bit-4.10.6-0.5.1 mozilla-nss-32bit-3.16.1-0.5.1 - SUSE Linux Enterprise Server 10 SP4 LTSS (i586 s390x) [New Version: 24]: MozillaFirefox-24.6.0esr-0.5.2 MozillaFirefox-branding-SLED-24-0.12.1 MozillaFirefox-translations-24.6.0esr-0.5.2 References: http://support.novell.com/security/cve/CVE-2014-1533.html http://support.novell.com/security/cve/CVE-2014-1534.html http://support.novell.com/security/cve/CVE-2014-1536.html http://support.novell.com/security/cve/CVE-2014-1537.html http://support.novell.com/security/cve/CVE-2014-1538.html http://support.novell.com/security/cve/CVE-2014-1541.html http://support.novell.com/security/cve/CVE-2014-1545.html https://bugzilla.novell.com/881874 http://download.suse.com/patch/finder/?keywords=e2a57d92d922ffebb85c807219c… http://download.suse.com/patch/finder/?keywords=f0a739569a9d79d0a6467c5ca4d… -- To unsubscribe, e-mail: opensuse-security-announce+unsubscribe(a)opensuse.org For additional commands, e-mail: opensuse-security-announce+help(a)opensuse.org

1 0

[security-announce] SUSE-SU-2014:0824-1: important: Security update for MozillaFirefox
by opensuse-security＠opensuse.org 21 Jun '14

21 Jun '14

SUSE Security Update: Security update for MozillaFirefox ______________________________________________________________________________ Announcement ID: SUSE-SU-2014:0824-1 Rating: important References: #881874 Cross-References: CVE-2014-1533 CVE-2014-1534 CVE-2014-1536 CVE-2014-1537 CVE-2014-1538 CVE-2014-1541 CVE-2014-1545 Affected Products: SUSE Linux Enterprise Software Development Kit 11 SP3 SUSE Linux Enterprise Server 11 SP3 for VMware SUSE Linux Enterprise Server 11 SP3 SUSE Linux Enterprise Server 10 SP3 LTSS SUSE Linux Enterprise Desktop 11 SP3 ______________________________________________________________________________ An update that fixes 7 vulnerabilities is now available. It includes four new package versions. Description: MozillaFirefox was updated to version 24.6.0 to fix six security issues: * Miscellaneous memory safety hazards. (CVE-2014-1533, CVE-2014-1534) * Use-after-free and out of bounds issues found using Address Sanitizer. (CVE-2014-1536, CVE-2014-1537, CVE-2014-1538) * Use-after-free with SMIL Animation Controller. (CVE-2014-1541) mozilla-nspr was updated to version 4.10.6 to fix one security issue: * Out of bounds write in NSPR. (CVE-2014-1545) Further information can be found at https://www.mozilla.org/security/announce/ <https://www.mozilla.org/security/announce/> . Security Issues references: * CVE-2014-1533 <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-1533> * CVE-2014-1534 <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-1534> * CVE-2014-1536 <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-1536> * CVE-2014-1537 <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-1537> * CVE-2014-1538 <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-1538> * CVE-2014-1541 <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-1541> * CVE-2014-1545 <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-1545> Patch Instructions: To install this SUSE Security Update use YaST online_update. Alternatively you can run the command listed for your product: - SUSE Linux Enterprise Software Development Kit 11 SP3: zypper in -t patch sdksp3-Firefox-2014-06-9370 - SUSE Linux Enterprise Server 11 SP3 for VMware: zypper in -t patch slessp3-Firefox-2014-06-9370 - SUSE Linux Enterprise Server 11 SP3: zypper in -t patch slessp3-Firefox-2014-06-9370 - SUSE Linux Enterprise Desktop 11 SP3: zypper in -t patch sledsp3-Firefox-2014-06-9370 To bring your system up-to-date, use "zypper patch". Package List: - SUSE Linux Enterprise Software Development Kit 11 SP3 (i586 ia64 ppc64 s390x x86_64) [New Version: 3.16.1 and 4.10.6]: MozillaFirefox-devel-24.6.0esr-0.8.1 mozilla-nspr-devel-4.10.6-0.3.1 mozilla-nss-devel-3.16.1-0.8.1 - SUSE Linux Enterprise Server 11 SP3 for VMware (i586 x86_64) [New Version: 24.6.0esr,3.16.1 and 4.10.6]: MozillaFirefox-24.6.0esr-0.8.1 MozillaFirefox-translations-24.6.0esr-0.8.1 libfreebl3-3.16.1-0.8.1 libsoftokn3-3.16.1-0.8.1 mozilla-nspr-4.10.6-0.3.1 mozilla-nss-3.16.1-0.8.1 mozilla-nss-tools-3.16.1-0.8.1 - SUSE Linux Enterprise Server 11 SP3 for VMware (x86_64) [New Version: 3.16.1 and 4.10.6]: libfreebl3-32bit-3.16.1-0.8.1 libsoftokn3-32bit-3.16.1-0.8.1 mozilla-nspr-32bit-4.10.6-0.3.1 mozilla-nss-32bit-3.16.1-0.8.1 - SUSE Linux Enterprise Server 11 SP3 (i586 ia64 ppc64 s390x x86_64) [New Version: 24.6.0esr,3.16.1 and 4.10.6]: MozillaFirefox-24.6.0esr-0.8.1 MozillaFirefox-branding-SLED-24-0.7.48 MozillaFirefox-translations-24.6.0esr-0.8.1 libfreebl3-3.16.1-0.8.1 libsoftokn3-3.16.1-0.8.1 mozilla-nspr-4.10.6-0.3.1 mozilla-nss-3.16.1-0.8.1 mozilla-nss-tools-3.16.1-0.8.1 - SUSE Linux Enterprise Server 11 SP3 (ppc64 s390x x86_64) [New Version: 3.16.1 and 4.10.6]: libfreebl3-32bit-3.16.1-0.8.1 libsoftokn3-32bit-3.16.1-0.8.1 mozilla-nspr-32bit-4.10.6-0.3.1 mozilla-nss-32bit-3.16.1-0.8.1 - SUSE Linux Enterprise Server 11 SP3 (ia64) [New Version: 3.16.1 and 4.10.6]: libfreebl3-x86-3.16.1-0.8.1 libsoftokn3-x86-3.16.1-0.8.1 mozilla-nspr-x86-4.10.6-0.3.1 mozilla-nss-x86-3.16.1-0.8.1 - SUSE Linux Enterprise Server 10 SP3 LTSS (i586 s390x x86_64) [New Version: 3.16.1 and 4.10.6]: mozilla-nspr-4.10.6-0.5.1 mozilla-nspr-devel-4.10.6-0.5.1 mozilla-nss-3.16.1-0.5.1 mozilla-nss-devel-3.16.1-0.5.1 mozilla-nss-tools-3.16.1-0.5.1 - SUSE Linux Enterprise Server 10 SP3 LTSS (s390x x86_64) [New Version: 3.16.1 and 4.10.6]: mozilla-nspr-32bit-4.10.6-0.5.1 mozilla-nss-32bit-3.16.1-0.5.1 - SUSE Linux Enterprise Server 10 SP3 LTSS (i586 s390x) [New Version: 24]: MozillaFirefox-24.6.0esr-0.5.2 MozillaFirefox-branding-SLED-24-0.12.1 MozillaFirefox-translations-24.6.0esr-0.5.2 - SUSE Linux Enterprise Desktop 11 SP3 (i586 x86_64) [New Version: 24.6.0esr,3.16.1 and 4.10.6]: MozillaFirefox-24.6.0esr-0.8.1 MozillaFirefox-branding-SLED-24-0.7.48 MozillaFirefox-translations-24.6.0esr-0.8.1 libfreebl3-3.16.1-0.8.1 libsoftokn3-3.16.1-0.8.1 mozilla-nspr-4.10.6-0.3.1 mozilla-nss-3.16.1-0.8.1 mozilla-nss-tools-3.16.1-0.8.1 - SUSE Linux Enterprise Desktop 11 SP3 (x86_64) [New Version: 3.16.1 and 4.10.6]: libfreebl3-32bit-3.16.1-0.8.1 libsoftokn3-32bit-3.16.1-0.8.1 mozilla-nspr-32bit-4.10.6-0.3.1 mozilla-nss-32bit-3.16.1-0.8.1 References: http://support.novell.com/security/cve/CVE-2014-1533.html http://support.novell.com/security/cve/CVE-2014-1534.html http://support.novell.com/security/cve/CVE-2014-1536.html http://support.novell.com/security/cve/CVE-2014-1537.html http://support.novell.com/security/cve/CVE-2014-1538.html http://support.novell.com/security/cve/CVE-2014-1541.html http://support.novell.com/security/cve/CVE-2014-1545.html https://bugzilla.novell.com/881874 http://download.suse.com/patch/finder/?keywords=a5b350492b0ce3fad7397a840a5… http://download.suse.com/patch/finder/?keywords=bbcc06aa0b93e2453183b7b5b8b… -- To unsubscribe, e-mail: opensuse-security-announce+unsubscribe(a)opensuse.org For additional commands, e-mail: opensuse-security-announce+help(a)opensuse.org

1 0

[security-announce] SUSE-SU-2014:0807-1: important: Security update for Linux Kernel
by opensuse-security＠opensuse.org 18 Jun '14

18 Jun '14

SUSE Security Update: Security update for Linux Kernel ______________________________________________________________________________ Announcement ID: SUSE-SU-2014:0807-1 Rating: important References: #630970 #661605 #663516 #761774 #792407 #852553 #852967 #854634 #854743 #856756 #857643 #863335 #865310 #866102 #868049 #868488 #868653 #869563 #871561 #873070 #874108 #875690 #875798 #876102 #878289 #880892 Cross-References: CVE-2012-6647 CVE-2013-6382 CVE-2013-6885 CVE-2013-7027 CVE-2013-7263 CVE-2013-7264 CVE-2013-7265 CVE-2013-7339 CVE-2014-0101 CVE-2014-0196 CVE-2014-1737 CVE-2014-1738 CVE-2014-1874 CVE-2014-2523 CVE-2014-2678 CVE-2014-3122 CVE-2014-3153 Affected Products: SUSE Linux Enterprise Server 11 SP1 LTSS SLE 11 SERVER Unsupported Extras ______________________________________________________________________________ An update that solves 17 vulnerabilities and has 9 fixes is now available. It includes one version update. Description: The SUSE Linux Enterprise Server 11 SP1 LTSS kernel received a roll-up update to fix security and non-security issues. The following security issues have been fixed: * CVE-2014-3153: The futex acquisition code in kernel/futex.c can be used to gain ring0 access via the futex syscall. This could be used for privilege escalation for non root users. (bnc#880892) * CVE-2012-6647: The futex_wait_requeue_pi function in kernel/futex.c in the Linux kernel before 3.5.1 does not ensure that calls have two different futex addresses, which allows local users to cause a denial of service (NULL pointer dereference and system crash) or possibly have unspecified other impact via a crafted FUTEX_WAIT_REQUEUE_PI command. (bnc#878289) * CVE-2013-6382: Multiple buffer underflows in the XFS implementation in the Linux kernel through 3.12.1 allow local users to cause a denial of service (memory corruption) or possibly have unspecified other impact by leveraging the CAP_SYS_ADMIN capability for a (1) XFS_IOC_ATTRLIST_BY_HANDLE or (2) XFS_IOC_ATTRLIST_BY_HANDLE_32 ioctl call with a crafted length value, related to the xfs_attrlist_by_handle function in fs/xfs/xfs_ioctl.c and the xfs_compat_attrlist_by_handle function in fs/xfs/xfs_ioctl32.c. (bnc#852553) * CVE-2013-6885: The microcode on AMD 16h 00h through 0Fh processors does not properly handle the interaction between locked instructions and write-combined memory types, which allows local users to cause a denial of service (system hang) via a crafted application, aka the errata 793 issue. (bnc#852967) * CVE-2013-7263: The Linux kernel before 3.12.4 updates certain length values before ensuring that associated data structures have been initialized, which allows local users to obtain sensitive information from kernel stack memory via a (1) recvfrom, (2) recvmmsg, or (3) recvmsg system call, related to net/ipv4/ping.c, net/ipv4/raw.c, net/ipv4/udp.c, net/ipv6/raw.c, and net/ipv6/udp.c. (bnc#857643) * CVE-2013-7264: The l2tp_ip_recvmsg function in net/l2tp/l2tp_ip.c in the Linux kernel before 3.12.4 updates a certain length value before ensuring that an associated data structure has been initialized, which allows local users to obtain sensitive information from kernel stack memory via a (1) recvfrom, (2) recvmmsg, or (3) recvmsg system call. (bnc#857643) * CVE-2013-7265: The pn_recvmsg function in net/phonet/datagram.c in the Linux kernel before 3.12.4 updates a certain length value before ensuring that an associated data structure has been initialized, which allows local users to obtain sensitive information from kernel stack memory via a (1) recvfrom, (2) recvmmsg, or (3) recvmsg system call. (bnc#857643) * CVE-2013-7339: The rds_ib_laddr_check function in net/rds/ib.c in the Linux kernel before 3.12.8 allows local users to cause a denial of service (NULL pointer dereference and system crash) or possibly have unspecified other impact via a bind system call for an RDS socket on a system that lacks RDS transports. (bnc#869563) * CVE-2014-0101: The sctp_sf_do_5_1D_ce function in net/sctp/sm_statefuns.c in the Linux kernel through 3.13.6 does not validate certain auth_enable and auth_capable fields before making an sctp_sf_authenticate call, which allows remote attackers to cause a denial of service (NULL pointer dereference and system crash) via an SCTP handshake with a modified INIT chunk and a crafted AUTH chunk before a COOKIE_ECHO chunk. (bnc#866102) * CVE-2014-0196: The n_tty_write function in drivers/tty/n_tty.c in the Linux kernel through 3.14.3 does not properly manage tty driver access in the "LECHO & !OPOST" case, which allows local users to cause a denial of service (memory corruption and system crash) or gain privileges by triggering a race condition involving read and write operations with long strings. (bnc#875690) * CVE-2014-1737: The raw_cmd_copyin function in drivers/block/floppy.c in the Linux kernel through 3.14.3 does not properly handle error conditions during processing of an FDRAWCMD ioctl call, which allows local users to trigger kfree operations and gain privileges by leveraging write access to a /dev/fd device. (bnc#875798) * CVE-2014-1738: The raw_cmd_copyout function in drivers/block/floppy.c in the Linux kernel through 3.14.3 does not properly restrict access to certain pointers during processing of an FDRAWCMD ioctl call, which allows local users to obtain sensitive information from kernel heap memory by leveraging write access to a /dev/fd device. (bnc#875798) * CVE-2014-1874: The security_context_to_sid_core function in security/selinux/ss/services.c in the Linux kernel before 3.13.4 allows local users to cause a denial of service (system crash) by leveraging the CAP_MAC_ADMIN capability to set a zero-length security context. (bnc#863335) * CVE-2014-2523: net/netfilter/nf_conntrack_proto_dccp.c in the Linux kernel through 3.13.6 uses a DCCP header pointer incorrectly, which allows remote attackers to cause a denial of service (system crash) or possibly execute arbitrary code via a DCCP packet that triggers a call to the (1) dccp_new, (2) dccp_packet, or (3) dccp_error function. (bnc#868653) * CVE-2014-2678: The rds_iw_laddr_check function in net/rds/iw.c in the Linux kernel through 3.14 allows local users to cause a denial of service (NULL pointer dereference and system crash) or possibly have unspecified other impact via a bind system call for an RDS socket on a system that lacks RDS transports. (bnc#871561) * CVE-2014-3122: The try_to_unmap_cluster function in mm/rmap.c in the Linux kernel before 3.14.3 does not properly consider which pages must be locked, which allows local users to cause a denial of service (system crash) by triggering a memory-usage pattern that requires removal of page-table mappings. (bnc#876102) * CVE-2013-7027: The ieee80211_radiotap_iterator_init function in net/wireless/radiotap.c in the Linux kernel before 3.11.7 does not check whether a frame contains any data outside of the header, which might allow attackers to cause a denial of service (buffer over-read) via a crafted header. (bnc#854634) The following non-security issues have been fixed: * sched: protect scale_rt_power() from clock aberations (bnc#630970, bnc#661605, bnc#865310). * sched: fix divide by zero at {thread_group,task}_times (bnc#761774, bnc#873070). * clocksource: avoid unnecessary overflow in cyclecounter_cyc2ns() (bnc#865310). * ia64: Change default PSR.ac from "1" to "0" (Fix erratum #237) (bnc#874108). * block: Wait for queue cleanup until the queue is empty before queue cleanup (bnc#792407). * fs: do_add_mount()/umount -l races (bnc#663516). * vfs,proc: guarantee unique inodes in /proc (bnc#868049). * nfs: Allow nfsdv4 to work when fips=1 (bnc#868488). * inet_diag: fix oops for IPv4 AF_INET6 TCP SYN-RECV state (bnc#854743). * bonding: send unsolicited NA for all addresses (bnc#856756). * bonding: send unsolicited neighbour advertisements to all-nodes (bnc#856756). Security Issues references: * CVE-2012-6647 <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2012-6647> * CVE-2013-6382 <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2013-6382> * CVE-2013-6885 <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2013-6885> * CVE-2013-7027 <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2013-7027> * CVE-2013-7263 <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2013-7263> * CVE-2013-7264 <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2013-7264> * CVE-2013-7265 <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2013-7265> * CVE-2013-7339 <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2013-7339> * CVE-2014-0101 <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-0101> * CVE-2014-0196 <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-0196> * CVE-2014-1737 <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-1737> * CVE-2014-1738 <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-1738> * CVE-2014-1874 <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-1874> * CVE-2014-2523 <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-2523> * CVE-2014-2678 <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-2678> * CVE-2014-3122 <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-3122> * CVE-2014-3153 <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-3153> Indications: Everyone using the Linux Kernel on x86_64 architecture should update. Special Instructions and Notes: Please reboot the system after installing this update. Patch Instructions: To install this SUSE Security Update use YaST online_update. Alternatively you can run the command listed for your product: - SUSE Linux Enterprise Server 11 SP1 LTSS: zypper in -t patch slessp1-kernel-9359 slessp1-kernel-9360 slessp1-kernel-9361 To bring your system up-to-date, use "zypper patch". Package List: - SUSE Linux Enterprise Server 11 SP1 LTSS (i586 s390x x86_64) [New Version: 2.6.32.59]: btrfs-kmp-default-0_2.6.32.59_0.13-0.3.163 ext4dev-kmp-default-0_2.6.32.59_0.13-7.9.130 ext4dev-kmp-trace-0_2.6.32.59_0.13-7.9.130 kernel-default-2.6.32.59-0.13.1 kernel-default-base-2.6.32.59-0.13.1 kernel-default-devel-2.6.32.59-0.13.1 kernel-source-2.6.32.59-0.13.1 kernel-syms-2.6.32.59-0.13.1 kernel-trace-2.6.32.59-0.13.1 kernel-trace-base-2.6.32.59-0.13.1 kernel-trace-devel-2.6.32.59-0.13.1 - SUSE Linux Enterprise Server 11 SP1 LTSS (i586 x86_64) [New Version: 2.6.32.59]: btrfs-kmp-xen-0_2.6.32.59_0.13-0.3.163 ext4dev-kmp-xen-0_2.6.32.59_0.13-7.9.130 hyper-v-kmp-default-0_2.6.32.59_0.13-0.18.39 hyper-v-kmp-trace-0_2.6.32.59_0.13-0.18.39 kernel-ec2-2.6.32.59-0.13.1 kernel-ec2-base-2.6.32.59-0.13.1 kernel-ec2-devel-2.6.32.59-0.13.1 kernel-xen-2.6.32.59-0.13.1 kernel-xen-base-2.6.32.59-0.13.1 kernel-xen-devel-2.6.32.59-0.13.1 - SUSE Linux Enterprise Server 11 SP1 LTSS (s390x) [New Version: 2.6.32.59]: kernel-default-man-2.6.32.59-0.13.1 - SUSE Linux Enterprise Server 11 SP1 LTSS (i586) [New Version: 2.6.32.59]: btrfs-kmp-pae-0_2.6.32.59_0.13-0.3.163 ext4dev-kmp-pae-0_2.6.32.59_0.13-7.9.130 hyper-v-kmp-pae-0_2.6.32.59_0.13-0.18.39 kernel-pae-2.6.32.59-0.13.1 kernel-pae-base-2.6.32.59-0.13.1 kernel-pae-devel-2.6.32.59-0.13.1 - SLE 11 SERVER Unsupported Extras (i586 s390x x86_64): kernel-default-extra-2.6.32.59-0.13.1 - SLE 11 SERVER Unsupported Extras (i586 x86_64): kernel-xen-extra-2.6.32.59-0.13.1 - SLE 11 SERVER Unsupported Extras (i586): kernel-pae-extra-2.6.32.59-0.13.1 References: http://support.novell.com/security/cve/CVE-2012-6647.html http://support.novell.com/security/cve/CVE-2013-6382.html http://support.novell.com/security/cve/CVE-2013-6885.html http://support.novell.com/security/cve/CVE-2013-7027.html http://support.novell.com/security/cve/CVE-2013-7263.html http://support.novell.com/security/cve/CVE-2013-7264.html http://support.novell.com/security/cve/CVE-2013-7265.html http://support.novell.com/security/cve/CVE-2013-7339.html http://support.novell.com/security/cve/CVE-2014-0101.html http://support.novell.com/security/cve/CVE-2014-0196.html http://support.novell.com/security/cve/CVE-2014-1737.html http://support.novell.com/security/cve/CVE-2014-1738.html http://support.novell.com/security/cve/CVE-2014-1874.html http://support.novell.com/security/cve/CVE-2014-2523.html http://support.novell.com/security/cve/CVE-2014-2678.html http://support.novell.com/security/cve/CVE-2014-3122.html http://support.novell.com/security/cve/CVE-2014-3153.html https://bugzilla.novell.com/630970 https://bugzilla.novell.com/661605 https://bugzilla.novell.com/663516 https://bugzilla.novell.com/761774 https://bugzilla.novell.com/792407 https://bugzilla.novell.com/852553 https://bugzilla.novell.com/852967 https://bugzilla.novell.com/854634 https://bugzilla.novell.com/854743 https://bugzilla.novell.com/856756 https://bugzilla.novell.com/857643 https://bugzilla.novell.com/863335 https://bugzilla.novell.com/865310 https://bugzilla.novell.com/866102 https://bugzilla.novell.com/868049 https://bugzilla.novell.com/868488 https://bugzilla.novell.com/868653 https://bugzilla.novell.com/869563 https://bugzilla.novell.com/871561 https://bugzilla.novell.com/873070 https://bugzilla.novell.com/874108 https://bugzilla.novell.com/875690 https://bugzilla.novell.com/875798 https://bugzilla.novell.com/876102 https://bugzilla.novell.com/878289 https://bugzilla.novell.com/880892 http://download.suse.com/patch/finder/?keywords=1f7d34dea2e5092125c31d9d0a4… http://download.suse.com/patch/finder/?keywords=518a51bcce5e0cc4e53c7e7bccd… http://download.suse.com/patch/finder/?keywords=9ef95d829298aaa37050f0a54e4… http://download.suse.com/patch/finder/?keywords=c146be129d24b739d74708b50d2… http://download.suse.com/patch/finder/?keywords=d036686eebebfe198fe470f1df9… http://download.suse.com/patch/finder/?keywords=fdf0b5f57e08d67cb242abf486c… -- To unsubscribe, e-mail: opensuse-security-announce+unsubscribe(a)opensuse.org For additional commands, e-mail: opensuse-security-announce+help(a)opensuse.org

1 0

[security-announce] SUSE-SU-2014:0806-1: important: Security update for flash-player
by opensuse-security＠opensuse.org 18 Jun '14

18 Jun '14

SUSE Security Update: Security update for flash-player ______________________________________________________________________________ Announcement ID: SUSE-SU-2014:0806-1 Rating: important References: #882187 Cross-References: CVE-2014-0531 CVE-2014-0532 CVE-2014-0533 CVE-2014-0534 CVE-2014-0535 CVE-2014-0536 Affected Products: SUSE Linux Enterprise Desktop 11 SP3 ______________________________________________________________________________ An update that fixes 6 vulnerabilities is now available. It includes one version update. Description: flash-player was updated to version 11.2.202.378 to fix the following security issues: * Cross-site-scripting vulnerabilities. (CVE-2014-0531, CVE-2014-0532, CVE-2014-0533) * Security bypass vulnerabilities. (CVE-2014-0534, CVE-2014-0535) * Memory corruption vulnerability that could result in arbitrary code execution. (CVE-2014-0536) More information can be found at http://helpx.adobe.com/security/products/flash-player/apsb14-16.html <http://helpx.adobe.com/security/products/flash-player/apsb14-16.html> . Security Issues references: * CVE-2014-0531 <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-0531> * CVE-2014-0532 <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-0532> * CVE-2014-0533 <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-0533> * CVE-2014-0534 <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-0534> * CVE-2014-0535 <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-0535> * CVE-2014-0536 <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-0536> Patch Instructions: To install this SUSE Security Update use YaST online_update. Alternatively you can run the command listed for your product: - SUSE Linux Enterprise Desktop 11 SP3: zypper in -t patch sledsp3-flash-player-9373 To bring your system up-to-date, use "zypper patch". Package List: - SUSE Linux Enterprise Desktop 11 SP3 (i586 x86_64) [New Version: 11.2.202.378]: flash-player-11.2.202.378-0.3.1 flash-player-gnome-11.2.202.378-0.3.1 flash-player-kde4-11.2.202.378-0.3.1 References: http://support.novell.com/security/cve/CVE-2014-0531.html http://support.novell.com/security/cve/CVE-2014-0532.html http://support.novell.com/security/cve/CVE-2014-0533.html http://support.novell.com/security/cve/CVE-2014-0534.html http://support.novell.com/security/cve/CVE-2014-0535.html http://support.novell.com/security/cve/CVE-2014-0536.html https://bugzilla.novell.com/882187 http://download.suse.com/patch/finder/?keywords=3f55be6c119b579f05c8516f6f0… -- To unsubscribe, e-mail: opensuse-security-announce+unsubscribe(a)opensuse.org For additional commands, e-mail: opensuse-security-announce+help(a)opensuse.org

1 0

[security-announce] SUSE-SU-2014:0800-1: important: Security update for GnuTLS
by opensuse-security＠opensuse.org 16 Jun '14

16 Jun '14

SUSE Security Update: Security update for GnuTLS ______________________________________________________________________________ Announcement ID: SUSE-SU-2014:0800-1 Rating: important References: #554084 #670152 #802651 #880730 #880910 Cross-References: CVE-2013-1619 CVE-2014-3466 CVE-2014-3467 CVE-2014-3468 CVE-2014-3469 Affected Products: SUSE CORE 9 ______________________________________________________________________________ An update that fixes 5 vulnerabilities is now available. Description: GnuTLS has been patched to ensure proper parsing of session ids during the TLS/SSL handshake. Additionally three issues inherited from libtasn1 have been fixed. Further information is available at http://www.gnutls.org/security.html#GNUTLS-SA-2014-3 <http://www.gnutls.org/security.html#GNUTLS-SA-2014-3> These security issues have been fixed: * Possible memory corruption during connect (CVE-2014-3466) * Multiple boundary check issues could allow DoS (CVE-2014-3467) * asn1_get_bit_der() can return negative bit length (CVE-2014-3468) * Possible DoS by NULL pointer dereference (CVE-2014-3469) * Possible timing side-channel attack (Lucky 13) (CVE-2013-1619) One additional bug has been fixed: * Allow unsafe renegotiation (bnc#554084) Security Issue references: * CVE-2014-3466 <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-3466> * CVE-2014-3467 <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-3467> * CVE-2014-3468 <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-3468> * CVE-2014-3469 <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-3469> * CVE-2013-1619 <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2013-1619> Package List: - SUSE CORE 9 (i586 s390 s390x x86_64): gnutls-1.0.8-26.32 gnutls-devel-1.0.8-26.32 References: http://support.novell.com/security/cve/CVE-2013-1619.html http://support.novell.com/security/cve/CVE-2014-3466.html http://support.novell.com/security/cve/CVE-2014-3467.html http://support.novell.com/security/cve/CVE-2014-3468.html http://support.novell.com/security/cve/CVE-2014-3469.html https://bugzilla.novell.com/554084 https://bugzilla.novell.com/670152 https://bugzilla.novell.com/802651 https://bugzilla.novell.com/880730 https://bugzilla.novell.com/880910 http://download.suse.com/patch/finder/?keywords=144b31fbd95bc788b66959b55ef… -- To unsubscribe, e-mail: opensuse-security-announce+unsubscribe(a)opensuse.org For additional commands, e-mail: opensuse-security-announce+help(a)opensuse.org

1 0

[security-announce] openSUSE-SU-2014:0797-1: critical: Mozilla updates 2014/06
by opensuse-security＠opensuse.org 16 Jun '14

16 Jun '14

openSUSE Security Update: Mozilla updates 2014/06 ______________________________________________________________________________ Announcement ID: openSUSE-SU-2014:0797-1 Rating: critical References: #881874 Cross-References: CVE-2014-1533 CVE-2014-1534 CVE-2014-1536 CVE-2014-1537 CVE-2014-1538 CVE-2014-1541 CVE-2014-1545 Affected Products: openSUSE 11.4 ______________________________________________________________________________ An update that fixes 7 vulnerabilities is now available. Description: These updates contain the latest security and maintenance updates for - Mozilla Firefox 24.6esr - Mozilla Thunderbird 24.6 - Mozilla NSPR is also updated to 4.10.6 to fix * MFSA 2014-48/CVE-2014-1533/CVE-2014-1534 Miscellaneous memory safety hazards * MFSA 2014-49/CVE-2014-1536/CVE-2014-1537/CVE-2014-1538 Use-after-free and out of bounds issues found using Address Sanitizer * MFSA 2014-52/CVE-2014-1541 Use-after-free with SMIL Animation Controller * MFSA 2014-55/CVE-2014-1545 Out of bounds write in NSPR Patch Instructions: To install this openSUSE Security Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE 11.4: zypper in -t patch 2014-64 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE 11.4 (i586 x86_64): MozillaFirefox-24.6.0-115.1 MozillaFirefox-branding-upstream-24.6.0-115.1 MozillaFirefox-buildsymbols-24.6.0-115.1 MozillaFirefox-debuginfo-24.6.0-115.1 MozillaFirefox-debugsource-24.6.0-115.1 MozillaFirefox-devel-24.6.0-115.1 MozillaFirefox-translations-common-24.6.0-115.1 MozillaFirefox-translations-other-24.6.0-115.1 MozillaThunderbird-24.6.0-97.1 MozillaThunderbird-buildsymbols-24.6.0-97.1 MozillaThunderbird-debuginfo-24.6.0-97.1 MozillaThunderbird-debugsource-24.6.0-97.1 MozillaThunderbird-devel-24.6.0-97.1 MozillaThunderbird-translations-common-24.6.0-97.1 MozillaThunderbird-translations-other-24.6.0-97.1 enigmail-1.6.0+24.6.0-97.1 mozilla-nspr-4.10.6-44.1 mozilla-nspr-debuginfo-4.10.6-44.1 mozilla-nspr-debugsource-4.10.6-44.1 mozilla-nspr-devel-4.10.6-44.1 - openSUSE 11.4 (x86_64): mozilla-nspr-32bit-4.10.6-44.1 mozilla-nspr-debuginfo-32bit-4.10.6-44.1 - openSUSE 11.4 (ia64): mozilla-nspr-debuginfo-x86-4.10.6-44.1 mozilla-nspr-x86-4.10.6-44.1 References: http://support.novell.com/security/cve/CVE-2014-1533.html http://support.novell.com/security/cve/CVE-2014-1534.html http://support.novell.com/security/cve/CVE-2014-1536.html http://support.novell.com/security/cve/CVE-2014-1537.html http://support.novell.com/security/cve/CVE-2014-1538.html http://support.novell.com/security/cve/CVE-2014-1541.html http://support.novell.com/security/cve/CVE-2014-1545.html https://bugzilla.novell.com/881874 -- To unsubscribe, e-mail: opensuse-security-announce+unsubscribe(a)opensuse.org For additional commands, e-mail: opensuse-security-announce+help(a)opensuse.org

1 0

[security-announce] SUSE-SU-2014:0796-1: important: Security update for Linux Kernel
by opensuse-security＠opensuse.org 14 Jun '14

14 Jun '14

SUSE Security Update: Security update for Linux Kernel ______________________________________________________________________________ Announcement ID: SUSE-SU-2014:0796-1 Rating: important References: #880892 Cross-References: CVE-2014-3153 Affected Products: SUSE Linux Enterprise Real Time Extension 11 SP3 ______________________________________________________________________________ An update that fixes one vulnerability is now available. It includes one version update. Description: The SUSE Linux Enterprise 11 Service Pack 3 RealTime Extension kernel was updated to fix a critical privilege escalation security issue: * CVE-2014-3153: The futex acquisition code in kernel/futex.c can be used to gain ring0 access via the futex syscall. This could be used for privilege escalation by non-root users. (bnc#880892) Security Issue reference: * CVE-2014-3153 <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-3153> Indications: Everyone using the Real Time Linux Kernel on x86_64 architecture should update. Special Instructions and Notes: Please reboot the system after installing this update. Patch Instructions: To install this SUSE Security Update use YaST online_update. Alternatively you can run the command listed for your product: - SUSE Linux Enterprise Real Time Extension 11 SP3: zypper in -t patch slertesp3-kernel-9337 To bring your system up-to-date, use "zypper patch". Package List: - SUSE Linux Enterprise Real Time Extension 11 SP3 (x86_64) [New Version: 3.0.101.rt130]: cluster-network-kmp-rt-1.4_3.0.101_rt130_0.18-2.27.69 cluster-network-kmp-rt_trace-1.4_3.0.101_rt130_0.18-2.27.69 drbd-kmp-rt-8.4.4_3.0.101_rt130_0.18-0.22.35 drbd-kmp-rt_trace-8.4.4_3.0.101_rt130_0.18-0.22.35 iscsitarget-kmp-rt-1.4.20_3.0.101_rt130_0.18-0.38.54 iscsitarget-kmp-rt_trace-1.4.20_3.0.101_rt130_0.18-0.38.54 kernel-rt-3.0.101.rt130-0.18.1 kernel-rt-base-3.0.101.rt130-0.18.1 kernel-rt-devel-3.0.101.rt130-0.18.1 kernel-rt_trace-3.0.101.rt130-0.18.1 kernel-rt_trace-base-3.0.101.rt130-0.18.1 kernel-rt_trace-devel-3.0.101.rt130-0.18.1 kernel-source-rt-3.0.101.rt130-0.18.1 kernel-syms-rt-3.0.101.rt130-0.18.1 lttng-modules-kmp-rt-2.1.1_3.0.101_rt130_0.18-0.11.47 lttng-modules-kmp-rt_trace-2.1.1_3.0.101_rt130_0.18-0.11.47 ocfs2-kmp-rt-1.6_3.0.101_rt130_0.18-0.20.69 ocfs2-kmp-rt_trace-1.6_3.0.101_rt130_0.18-0.20.69 ofed-kmp-rt-1.5.4.1_3.0.101_rt130_0.18-0.13.60 ofed-kmp-rt_trace-1.5.4.1_3.0.101_rt130_0.18-0.13.60 References: http://support.novell.com/security/cve/CVE-2014-3153.html https://bugzilla.novell.com/880892 http://download.suse.com/patch/finder/?keywords=b12b838c3802187f1ccd4d35cb7… -- To unsubscribe, e-mail: opensuse-security-announce+unsubscribe(a)opensuse.org For additional commands, e-mail: opensuse-security-announce+help(a)opensuse.org

1 0

[security-announce] SUSE-SU-2014:0788-2: important: Security update for GnuTLS
by opensuse-security＠opensuse.org 13 Jun '14

13 Jun '14

SUSE Security Update: Security update for GnuTLS ______________________________________________________________________________ Announcement ID: SUSE-SU-2014:0788-2 Rating: important References: #880730 #880910 Cross-References: CVE-2014-3466 CVE-2014-3467 CVE-2014-3468 CVE-2014-3469 Affected Products: SUSE Linux Enterprise Server 10 SP4 LTSS SUSE Linux Enterprise Server 10 SP3 LTSS ______________________________________________________________________________ An update that fixes four vulnerabilities is now available. Description: GnuTLS has been patched to ensure proper parsing of session ids during the TLS/SSL handshake. Additionally three issues inherited from libtasn1 have been fixed. Further information is available at http://www.gnutls.org/security.html#GNUTLS-SA-2014-3 <http://www.gnutls.org/security.html#GNUTLS-SA-2014-3> These security issues have been fixed: * Possible memory corruption during connect (CVE-2014-3466) * Multiple boundary check issues could allow DoS (CVE-2014-3467) * asn1_get_bit_der() can return negative bit length (CVE-2014-3468) * Possible DoS by NULL pointer dereference (CVE-2014-3469) Security Issue references: * CVE-2014-3466 <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-3466> Package List: - SUSE Linux Enterprise Server 10 SP4 LTSS (i586 s390x x86_64): gnutls-1.2.10-13.40.1 gnutls-devel-1.2.10-13.40.1 - SUSE Linux Enterprise Server 10 SP4 LTSS (s390x x86_64): gnutls-32bit-1.2.10-13.40.1 gnutls-devel-32bit-1.2.10-13.40.1 - SUSE Linux Enterprise Server 10 SP3 LTSS (i586 s390x x86_64): gnutls-1.2.10-13.40.1 gnutls-devel-1.2.10-13.40.1 - SUSE Linux Enterprise Server 10 SP3 LTSS (s390x x86_64): gnutls-32bit-1.2.10-13.40.1 gnutls-devel-32bit-1.2.10-13.40.1 References: http://support.novell.com/security/cve/CVE-2014-3466.html http://support.novell.com/security/cve/CVE-2014-3467.html http://support.novell.com/security/cve/CVE-2014-3468.html http://support.novell.com/security/cve/CVE-2014-3469.html https://bugzilla.novell.com/880730 https://bugzilla.novell.com/880910 http://download.suse.com/patch/finder/?keywords=3a664138948d527c37403de9fef… http://download.suse.com/patch/finder/?keywords=ce2995d7d37c598d89a8e91d407… -- To unsubscribe, e-mail: opensuse-security-announce+unsubscribe(a)opensuse.org For additional commands, e-mail: opensuse-security-announce+help(a)opensuse.org

1 0

[security-announce] SUSE-SU-2014:0758-2: important: Security update for GnuTLS
by opensuse-security＠opensuse.org 13 Jun '14

13 Jun '14

SUSE Security Update: Security update for GnuTLS ______________________________________________________________________________ Announcement ID: SUSE-SU-2014:0758-2 Rating: important References: #880730 #880910 Cross-References: CVE-2014-3466 Affected Products: SUSE Manager 1.7 for SLE 11 SP2 ______________________________________________________________________________ An update that solves one vulnerability and has one errata is now available. Description: GnuTLS has been patched to ensure proper parsing of session ids during the TLS/SSL handshake. Additionally three issues inherited from libtasn1 have been fixed. Further information is available at http://www.gnutls.org/security.html#GNUTLS-SA-2014-3 <http://www.gnutls.org/security.html#GNUTLS-SA-2014-3> These security issues have been fixed: * Possible memory corruption during connect (CVE-2014-3466) * Multiple boundary check issues could allow DoS (CVE-2014-3467) * asn1_get_bit_der() can return negative bit length (CVE-2014-3468) * Possible DoS by NULL pointer dereference (CVE-2014-3469) Security Issue references: * CVE-2014-3466 <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-3466> Patch Instructions: To install this SUSE Security Update use YaST online_update. Alternatively you can run the command listed for your product: - SUSE Manager 1.7 for SLE 11 SP2: zypper in -t patch sleman17sp2-gnutls-9319 To bring your system up-to-date, use "zypper patch". Package List: - SUSE Manager 1.7 for SLE 11 SP2 (x86_64): gnutls-2.4.1-24.39.51.1 libgnutls-extra26-2.4.1-24.39.51.1 libgnutls26-2.4.1-24.39.51.1 libgnutls26-32bit-2.4.1-24.39.51.1 References: http://support.novell.com/security/cve/CVE-2014-3466.html https://bugzilla.novell.com/880730 https://bugzilla.novell.com/880910 http://download.suse.com/patch/finder/?keywords=5dcca3466e06512dc053e91637a… -- To unsubscribe, e-mail: opensuse-security-announce+unsubscribe(a)opensuse.org For additional commands, e-mail: opensuse-security-announce+help(a)opensuse.org

1 0

[security-announce] SUSE-SU-2014:0788-1: important: Security update for GnuTLS
by opensuse-security＠opensuse.org 13 Jun '14

13 Jun '14

SUSE Security Update: Security update for GnuTLS ______________________________________________________________________________ Announcement ID: SUSE-SU-2014:0788-1 Rating: important References: #880730 #880910 Cross-References: CVE-2014-3466 CVE-2014-3467 CVE-2014-3468 CVE-2014-3469 Affected Products: SUSE Linux Enterprise Server 11 SP2 LTSS SUSE Linux Enterprise Server 11 SP1 LTSS ______________________________________________________________________________ An update that fixes four vulnerabilities is now available. Description: GnuTLS was patched to ensure proper parsing of session ids during the TLS/SSL handshake. Additionally three issues inherited from libtasn1 were fixed. * Possible memory corruption during connect. (CVE-2014-3466) * Multiple boundary check issues could allow DoS. (CVE-2014-3467) * asn1_get_bit_der() can return negative bit length. (CVE-2014-3468) * Possible DoS by NULL pointer dereference. (CVE-2014-3469) Further information is available at http://www.gnutls.org/security.html#GNUTLS-SA-2014-3 <http://www.gnutls.org/security.html#GNUTLS-SA-2014-3> . Security Issues references: * CVE-2014-3466 <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-3466> * CVE-2014-3467 <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-3467> * CVE-2014-3468 <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-3468> * CVE-2014-3469 <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-3469> Patch Instructions: To install this SUSE Security Update use YaST online_update. Alternatively you can run the command listed for your product: - SUSE Linux Enterprise Server 11 SP2 LTSS: zypper in -t patch slessp2-gnutls-9352 - SUSE Linux Enterprise Server 11 SP1 LTSS: zypper in -t patch slessp1-gnutls-9353 To bring your system up-to-date, use "zypper patch". Package List: - SUSE Linux Enterprise Server 11 SP2 LTSS (i586 s390x x86_64): gnutls-2.4.1-24.39.53.1 libgnutls-extra26-2.4.1-24.39.53.1 libgnutls26-2.4.1-24.39.53.1 - SUSE Linux Enterprise Server 11 SP2 LTSS (s390x x86_64): libgnutls26-32bit-2.4.1-24.39.53.1 - SUSE Linux Enterprise Server 11 SP1 LTSS (i586 s390x x86_64): gnutls-2.4.1-24.39.53.1 libgnutls-extra26-2.4.1-24.39.53.1 libgnutls26-2.4.1-24.39.53.1 - SUSE Linux Enterprise Server 11 SP1 LTSS (s390x x86_64): libgnutls26-32bit-2.4.1-24.39.53.1 References: http://support.novell.com/security/cve/CVE-2014-3466.html http://support.novell.com/security/cve/CVE-2014-3467.html http://support.novell.com/security/cve/CVE-2014-3468.html http://support.novell.com/security/cve/CVE-2014-3469.html https://bugzilla.novell.com/880730 https://bugzilla.novell.com/880910 http://download.suse.com/patch/finder/?keywords=04989b49e84d0e055f6a4e5b3d4… http://download.suse.com/patch/finder/?keywords=3cb2688e28e1b5b12a8cc0b5b25… -- To unsubscribe, e-mail: opensuse-security-announce+unsubscribe(a)opensuse.org For additional commands, e-mail: opensuse-security-announce+help(a)opensuse.org

1 0

[security-announce] SUSE-SU-2014:0775-1: critical: Security update for Linux Kernel
by opensuse-security＠opensuse.org 11 Jun '14

11 Jun '14

SUSE Security Update: Security update for Linux Kernel ______________________________________________________________________________ Announcement ID: SUSE-SU-2014:0775-1 Rating: critical References: #880892 Cross-References: CVE-2014-3153 Affected Products: SUSE Linux Enterprise Server 11 SP3 for VMware SUSE Linux Enterprise Server 11 SP3 SUSE Linux Enterprise High Availability Extension 11 SP3 SUSE Linux Enterprise Desktop 11 SP3 SLE 11 SERVER Unsupported Extras ______________________________________________________________________________ An update that fixes one vulnerability is now available. It includes one version update. Description: The SUSE Linux Enterprise 11 Service Pack 3 kernel was updated to fix a critical privilege escalation security issue: * CVE-2014-3153: The futex acquisition code in kernel/futex.c can be used to gain ring0 access via the futex syscall. This could be used for privilege escalation by non-root users. (bnc#880892) Security Issue reference: * CVE-2014-3153 <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-3153> Indications: Everyone using the Linux Kernel on x86_64 architecture should update. Special Instructions and Notes: Please reboot the system after installing this update. Patch Instructions: To install this SUSE Security Update use YaST online_update. Alternatively you can run the command listed for your product: - SUSE Linux Enterprise Server 11 SP3 for VMware: zypper in -t patch slessp3-kernel-9328 slessp3-kernel-9329 - SUSE Linux Enterprise Server 11 SP3: zypper in -t patch slessp3-kernel-9328 slessp3-kernel-9329 slessp3-kernel-9330 slessp3-kernel-9331 slessp3-kernel-9346 - SUSE Linux Enterprise High Availability Extension 11 SP3: zypper in -t patch slehasp3-kernel-9328 slehasp3-kernel-9329 slehasp3-kernel-9330 slehasp3-kernel-9331 slehasp3-kernel-9346 - SUSE Linux Enterprise Desktop 11 SP3: zypper in -t patch sledsp3-kernel-9328 sledsp3-kernel-9329 To bring your system up-to-date, use "zypper patch". Package List: - SUSE Linux Enterprise Server 11 SP3 for VMware (i586 x86_64) [New Version: 3.0.101]: kernel-default-3.0.101-0.31.1 kernel-default-base-3.0.101-0.31.1 kernel-default-devel-3.0.101-0.31.1 kernel-source-3.0.101-0.31.1 kernel-syms-3.0.101-0.31.1 kernel-trace-3.0.101-0.31.1 kernel-trace-base-3.0.101-0.31.1 kernel-trace-devel-3.0.101-0.31.1 kernel-xen-devel-3.0.101-0.31.1 - SUSE Linux Enterprise Server 11 SP3 for VMware (i586) [New Version: 3.0.101]: kernel-pae-3.0.101-0.31.1 kernel-pae-base-3.0.101-0.31.1 kernel-pae-devel-3.0.101-0.31.1 - SUSE Linux Enterprise Server 11 SP3 (i586 ia64 ppc64 s390x x86_64) [New Version: 3.0.101]: kernel-default-3.0.101-0.31.1 kernel-default-base-3.0.101-0.31.1 kernel-default-devel-3.0.101-0.31.1 kernel-source-3.0.101-0.31.1 kernel-syms-3.0.101-0.31.1 kernel-trace-3.0.101-0.31.1 kernel-trace-base-3.0.101-0.31.1 kernel-trace-devel-3.0.101-0.31.1 - SUSE Linux Enterprise Server 11 SP3 (i586 x86_64) [New Version: 3.0.101]: kernel-ec2-3.0.101-0.31.1 kernel-ec2-base-3.0.101-0.31.1 kernel-ec2-devel-3.0.101-0.31.1 kernel-xen-3.0.101-0.31.1 kernel-xen-base-3.0.101-0.31.1 kernel-xen-devel-3.0.101-0.31.1 xen-kmp-default-4.2.4_02_3.0.101_0.31-0.7.33 - SUSE Linux Enterprise Server 11 SP3 (s390x) [New Version: 3.0.101]: kernel-default-man-3.0.101-0.31.1 - SUSE Linux Enterprise Server 11 SP3 (ppc64) [New Version: 3.0.101]: kernel-ppc64-3.0.101-0.31.1 kernel-ppc64-base-3.0.101-0.31.1 kernel-ppc64-devel-3.0.101-0.31.1 - SUSE Linux Enterprise Server 11 SP3 (i586) [New Version: 3.0.101]: kernel-pae-3.0.101-0.31.1 kernel-pae-base-3.0.101-0.31.1 kernel-pae-devel-3.0.101-0.31.1 xen-kmp-pae-4.2.4_02_3.0.101_0.31-0.7.33 - SUSE Linux Enterprise High Availability Extension 11 SP3 (i586 ia64 ppc64 s390x x86_64): cluster-network-kmp-default-1.4_3.0.101_0.31-2.27.69 cluster-network-kmp-trace-1.4_3.0.101_0.31-2.27.69 gfs2-kmp-default-2_3.0.101_0.31-0.16.75 gfs2-kmp-trace-2_3.0.101_0.31-0.16.75 ocfs2-kmp-default-1.6_3.0.101_0.31-0.20.69 ocfs2-kmp-trace-1.6_3.0.101_0.31-0.20.69 - SUSE Linux Enterprise High Availability Extension 11 SP3 (i586 x86_64): cluster-network-kmp-xen-1.4_3.0.101_0.31-2.27.69 gfs2-kmp-xen-2_3.0.101_0.31-0.16.75 ocfs2-kmp-xen-1.6_3.0.101_0.31-0.20.69 - SUSE Linux Enterprise High Availability Extension 11 SP3 (ppc64): cluster-network-kmp-ppc64-1.4_3.0.101_0.31-2.27.69 gfs2-kmp-ppc64-2_3.0.101_0.31-0.16.75 ocfs2-kmp-ppc64-1.6_3.0.101_0.31-0.20.69 - SUSE Linux Enterprise High Availability Extension 11 SP3 (i586): cluster-network-kmp-pae-1.4_3.0.101_0.31-2.27.69 gfs2-kmp-pae-2_3.0.101_0.31-0.16.75 ocfs2-kmp-pae-1.6_3.0.101_0.31-0.20.69 - SUSE Linux Enterprise Desktop 11 SP3 (i586 x86_64) [New Version: 3.0.101]: kernel-default-3.0.101-0.31.1 kernel-default-base-3.0.101-0.31.1 kernel-default-devel-3.0.101-0.31.1 kernel-default-extra-3.0.101-0.31.1 kernel-source-3.0.101-0.31.1 kernel-syms-3.0.101-0.31.1 kernel-trace-devel-3.0.101-0.31.1 kernel-xen-3.0.101-0.31.1 kernel-xen-base-3.0.101-0.31.1 kernel-xen-devel-3.0.101-0.31.1 kernel-xen-extra-3.0.101-0.31.1 xen-kmp-default-4.2.4_02_3.0.101_0.31-0.7.33 - SUSE Linux Enterprise Desktop 11 SP3 (i586) [New Version: 3.0.101]: kernel-pae-3.0.101-0.31.1 kernel-pae-base-3.0.101-0.31.1 kernel-pae-devel-3.0.101-0.31.1 kernel-pae-extra-3.0.101-0.31.1 xen-kmp-pae-4.2.4_02_3.0.101_0.31-0.7.33 - SLE 11 SERVER Unsupported Extras (i586 ia64 ppc64 s390x x86_64): kernel-default-extra-3.0.101-0.31.1 - SLE 11 SERVER Unsupported Extras (i586 x86_64): kernel-xen-extra-3.0.101-0.31.1 - SLE 11 SERVER Unsupported Extras (ppc64): kernel-ppc64-extra-3.0.101-0.31.1 - SLE 11 SERVER Unsupported Extras (i586): kernel-pae-extra-3.0.101-0.31.1 References: http://support.novell.com/security/cve/CVE-2014-3153.html https://bugzilla.novell.com/880892 http://download.suse.com/patch/finder/?keywords=0cdcfea3b263f03fc7b11c9e27c… http://download.suse.com/patch/finder/?keywords=2394b6ce8b434732566fe3cbf2a… http://download.suse.com/patch/finder/?keywords=5d5df6a9a600dbe5fe09c19d8dc… http://download.suse.com/patch/finder/?keywords=8a869bd2122273831bd282fab23… http://download.suse.com/patch/finder/?keywords=a8f8feb5552e1da3b52f48f677f… http://download.suse.com/patch/finder/?keywords=a9d9490d68822582cd43af9c0c2… http://download.suse.com/patch/finder/?keywords=c905f5237a7e0ae4f9fdf0c325c… http://download.suse.com/patch/finder/?keywords=f6e7ea94e8ad3ddbdf3d897e2a3… http://download.suse.com/patch/finder/?keywords=fab06fd0fffc9ae59673101aeac… http://download.suse.com/patch/finder/?keywords=fd1bf222c9f9ff4cc32dae8bac4… -- To unsubscribe, e-mail: opensuse-security-announce+unsubscribe(a)opensuse.org For additional commands, e-mail: opensuse-security-announce+help(a)opensuse.org

1 0

[security-announce] SUSE-SU-2014:0759-2: critical: Security update for OpenSSL
by opensuse-security＠opensuse.org 07 Jun '14

07 Jun '14

SUSE Security Update: Security update for OpenSSL ______________________________________________________________________________ Announcement ID: SUSE-SU-2014:0759-2 Rating: critical References: #880891 Cross-References: CVE-2014-0221 CVE-2014-0224 CVE-2014-3470 Affected Products: SUSE Linux Enterprise Server 10 SP4 LTSS SUSE Linux Enterprise Server 10 SP3 LTSS ______________________________________________________________________________ An update that fixes three vulnerabilities is now available. Description: OpenSSL was updated to fix the following security vulnerabilities: * SSL/TLS MITM vulnerability. (CVE-2014-0224) * DTLS recursion flaw. (CVE-2014-0221) * Anonymous ECDH denial of service. (CVE-2014-3470) Further information can be found at http://www.openssl.org/news/secadv_20140605.txt <http://www.openssl.org/news/secadv_20140605.txt> . Security Issues references: * CVE-2014-0224 <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-0224> * CVE-2014-0221 <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-0221> * CVE-2014-3470 <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-3470> Package List: - SUSE Linux Enterprise Server 10 SP4 LTSS (i586 s390x x86_64): openssl-0.9.8a-18.82.4 openssl-devel-0.9.8a-18.82.4 openssl-doc-0.9.8a-18.82.4 - SUSE Linux Enterprise Server 10 SP4 LTSS (s390x x86_64): openssl-32bit-0.9.8a-18.82.4 openssl-devel-32bit-0.9.8a-18.82.4 - SUSE Linux Enterprise Server 10 SP3 LTSS (i586 s390x x86_64): openssl-0.9.8a-18.45.77.1 openssl-devel-0.9.8a-18.45.77.1 openssl-doc-0.9.8a-18.45.77.1 - SUSE Linux Enterprise Server 10 SP3 LTSS (s390x x86_64): openssl-32bit-0.9.8a-18.45.77.1 openssl-devel-32bit-0.9.8a-18.45.77.1 References: http://support.novell.com/security/cve/CVE-2014-0221.html http://support.novell.com/security/cve/CVE-2014-0224.html http://support.novell.com/security/cve/CVE-2014-3470.html https://bugzilla.novell.com/880891 http://download.suse.com/patch/finder/?keywords=06090ed98c412d84909da7f9884… http://download.suse.com/patch/finder/?keywords=ae77e66ba2a03bee961e56bc2d1… -- To unsubscribe, e-mail: opensuse-security-announce+unsubscribe(a)opensuse.org For additional commands, e-mail: opensuse-security-announce+help(a)opensuse.org

1 0

[security-announce] SUSE-SU-2014:0769-1: important: Security update for MySQL
by opensuse-security＠opensuse.org 07 Jun '14

07 Jun '14

SUSE Security Update: Security update for MySQL ______________________________________________________________________________ Announcement ID: SUSE-SU-2014:0769-1 Rating: important References: #858823 #861493 #873896 Cross-References: CVE-2013-4316 CVE-2013-5860 CVE-2013-5881 CVE-2013-5882 CVE-2013-5891 CVE-2013-5894 CVE-2013-5908 CVE-2014-0001 CVE-2014-0384 CVE-2014-0386 CVE-2014-0393 CVE-2014-0401 CVE-2014-0402 CVE-2014-0412 CVE-2014-0420 CVE-2014-0427 CVE-2014-0430 CVE-2014-0431 CVE-2014-0433 CVE-2014-0437 CVE-2014-2419 CVE-2014-2430 CVE-2014-2431 CVE-2014-2432 CVE-2014-2434 CVE-2014-2435 CVE-2014-2436 CVE-2014-2438 CVE-2014-2440 CVE-2014-2442 CVE-2014-2444 CVE-2014-2450 CVE-2014-2451 Affected Products: SUSE Linux Enterprise Software Development Kit 11 SP3 SUSE Linux Enterprise Server 11 SP3 for VMware SUSE Linux Enterprise Server 11 SP3 SUSE Linux Enterprise Desktop 11 SP3 ______________________________________________________________________________ An update that fixes 33 vulnerabilities is now available. It includes one version update. Description: MySQL was updated to version 5.5.37 to address various security issues. More information is available at http://www.oracle.com/technetwork/topics/security/cpujan2014-1972949.html#A ppendixMSQL <http://www.oracle.com/technetwork/topics/security/cpujan2014-1972949.html# AppendixMSQL> and http://www.oracle.com/technetwork/topics/security/cpuapr2014-1972952.html#A ppendixMSQL <http://www.oracle.com/technetwork/topics/security/cpuapr2014-1972952.html# AppendixMSQL> . Security Issues references: * CVE-2014-2444 <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-2444> * CVE-2014-2436 <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-2436> * CVE-2014-2440 <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-2440> * CVE-2014-2434 <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-2434> * CVE-2014-2435 <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-2435> * CVE-2014-2442 <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-2442> * CVE-2014-2450 <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-2450> * CVE-2014-2419 <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-2419> * CVE-2014-0384 <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-0384> * CVE-2014-2430 <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-2430> * CVE-2014-2451 <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-2451> * CVE-2014-2438 <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-2438> * CVE-2014-2432 <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-2432> * CVE-2014-2431 <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-2431> * CVE-2013-4316 <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2013-4316> * CVE-2013-5860 <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2013-5860> * CVE-2013-5882 <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2013-5882> * CVE-2014-0433 <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-0433> * CVE-2013-5894 <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2013-5894> * CVE-2013-5881 <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2013-5881> * CVE-2014-0412 <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-0412> * CVE-2014-0402 <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-0402> * CVE-2014-0386 <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-0386> * CVE-2013-5891 <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2013-5891> * CVE-2014-0401 <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-0401> * CVE-2014-0427 <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-0427> * CVE-2014-0431 <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-0431> * CVE-2014-0437 <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-0437> * CVE-2014-0393 <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-0393> * CVE-2014-0430 <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-0430> * CVE-2014-0420 <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-0420> * CVE-2013-5908 <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2013-5908> * CVE-2014-0001 <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-0001> Patch Instructions: To install this SUSE Security Update use YaST online_update. Alternatively you can run the command listed for your product: - SUSE Linux Enterprise Software Development Kit 11 SP3: zypper in -t patch sdksp3-libmysql55client18-9303 - SUSE Linux Enterprise Server 11 SP3 for VMware: zypper in -t patch slessp3-libmysql55client18-9303 - SUSE Linux Enterprise Server 11 SP3: zypper in -t patch slessp3-libmysql55client18-9303 - SUSE Linux Enterprise Desktop 11 SP3: zypper in -t patch sledsp3-libmysql55client18-9303 To bring your system up-to-date, use "zypper patch". Package List: - SUSE Linux Enterprise Software Development Kit 11 SP3 (ppc64 s390x x86_64): libmysql55client_r18-32bit-5.5.37-0.7.1 libmysqlclient_r15-32bit-5.0.96-0.6.11 - SUSE Linux Enterprise Software Development Kit 11 SP3 (ia64): libmysql55client_r18-x86-5.5.37-0.7.1 libmysqlclient_r15-x86-5.0.96-0.6.11 - SUSE Linux Enterprise Server 11 SP3 for VMware (i586 x86_64) [New Version: 5.5.37]: libmysql55client18-5.5.37-0.7.1 libmysql55client_r18-5.5.37-0.7.1 libmysqlclient15-5.0.96-0.6.11 libmysqlclient_r15-5.0.96-0.6.11 mysql-5.5.37-0.7.1 mysql-client-5.5.37-0.7.1 mysql-tools-5.5.37-0.7.1 - SUSE Linux Enterprise Server 11 SP3 for VMware (x86_64) [New Version: 5.5.37]: libmysql55client18-32bit-5.5.37-0.7.1 libmysqlclient15-32bit-5.0.96-0.6.11 - SUSE Linux Enterprise Server 11 SP3 (i586 ia64 ppc64 s390x x86_64) [New Version: 5.5.37]: libmysql55client18-5.5.37-0.7.1 libmysql55client_r18-5.5.37-0.7.1 libmysqlclient15-5.0.96-0.6.11 libmysqlclient_r15-5.0.96-0.6.11 mysql-5.5.37-0.7.1 mysql-client-5.5.37-0.7.1 mysql-tools-5.5.37-0.7.1 - SUSE Linux Enterprise Server 11 SP3 (ppc64 s390x x86_64) [New Version: 5.5.37]: libmysql55client18-32bit-5.5.37-0.7.1 libmysqlclient15-32bit-5.0.96-0.6.11 - SUSE Linux Enterprise Server 11 SP3 (ia64) [New Version: 5.5.37]: libmysql55client18-x86-5.5.37-0.7.1 libmysqlclient15-x86-5.0.96-0.6.11 - SUSE Linux Enterprise Desktop 11 SP3 (i586 x86_64) [New Version: 5.5.37]: libmysql55client18-5.5.37-0.7.1 libmysql55client_r18-5.5.37-0.7.1 libmysqlclient15-5.0.96-0.6.11 libmysqlclient_r15-5.0.96-0.6.11 mysql-5.5.37-0.7.1 mysql-client-5.5.37-0.7.1 - SUSE Linux Enterprise Desktop 11 SP3 (x86_64) [New Version: 5.5.37]: libmysql55client18-32bit-5.5.37-0.7.1 libmysql55client_r18-32bit-5.5.37-0.7.1 libmysqlclient15-32bit-5.0.96-0.6.11 libmysqlclient_r15-32bit-5.0.96-0.6.11 References: http://support.novell.com/security/cve/CVE-2013-4316.html http://support.novell.com/security/cve/CVE-2013-5860.html http://support.novell.com/security/cve/CVE-2013-5881.html http://support.novell.com/security/cve/CVE-2013-5882.html http://support.novell.com/security/cve/CVE-2013-5891.html http://support.novell.com/security/cve/CVE-2013-5894.html http://support.novell.com/security/cve/CVE-2013-5908.html http://support.novell.com/security/cve/CVE-2014-0001.html http://support.novell.com/security/cve/CVE-2014-0384.html http://support.novell.com/security/cve/CVE-2014-0386.html http://support.novell.com/security/cve/CVE-2014-0393.html http://support.novell.com/security/cve/CVE-2014-0401.html http://support.novell.com/security/cve/CVE-2014-0402.html http://support.novell.com/security/cve/CVE-2014-0412.html http://support.novell.com/security/cve/CVE-2014-0420.html http://support.novell.com/security/cve/CVE-2014-0427.html http://support.novell.com/security/cve/CVE-2014-0430.html http://support.novell.com/security/cve/CVE-2014-0431.html http://support.novell.com/security/cve/CVE-2014-0433.html http://support.novell.com/security/cve/CVE-2014-0437.html http://support.novell.com/security/cve/CVE-2014-2419.html http://support.novell.com/security/cve/CVE-2014-2430.html http://support.novell.com/security/cve/CVE-2014-2431.html http://support.novell.com/security/cve/CVE-2014-2432.html http://support.novell.com/security/cve/CVE-2014-2434.html http://support.novell.com/security/cve/CVE-2014-2435.html http://support.novell.com/security/cve/CVE-2014-2436.html http://support.novell.com/security/cve/CVE-2014-2438.html http://support.novell.com/security/cve/CVE-2014-2440.html http://support.novell.com/security/cve/CVE-2014-2442.html http://support.novell.com/security/cve/CVE-2014-2444.html http://support.novell.com/security/cve/CVE-2014-2450.html http://support.novell.com/security/cve/CVE-2014-2451.html https://bugzilla.novell.com/858823 https://bugzilla.novell.com/861493 https://bugzilla.novell.com/873896 http://download.suse.com/patch/finder/?keywords=ab4ffe747d344a455ea19aa1b92… -- To unsubscribe, e-mail: opensuse-security-announce+unsubscribe(a)opensuse.org For additional commands, e-mail: opensuse-security-announce+help(a)opensuse.org

1 0

[security-announce] SUSE-SU-2014:0768-1: critical: Security update for OpenSSL
by opensuse-security＠opensuse.org 07 Jun '14

07 Jun '14

SUSE Security Update: Security update for OpenSSL ______________________________________________________________________________ Announcement ID: SUSE-SU-2014:0768-1 Rating: critical References: #459468 #489641 #880891 Cross-References: CVE-2011-4354 CVE-2014-0224 Affected Products: SUSE CORE 9 ______________________________________________________________________________ An update that solves two vulnerabilities and has one errata is now available. Description: OpenSSL was updated to fix the following security vulnerabilities: * SSL/TLS MITM vulnerability. (CVE-2014-0224) * ECC private key can leak on 32 bit platforms. (CVE-2011-4354) Further information can be found at http://www.openssl.org/news/secadv_20140605.txt <http://www.openssl.org/news/secadv_20140605.txt> . Security Issues references: * CVE-2014-0224 <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-0224> * CVE-2011-4354 <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2011-4354> Package List: - SUSE CORE 9 (i586 s390 s390x x86_64): openssl-0.9.7d-15.50 openssl-devel-0.9.7d-15.50 openssl-doc-0.9.7d-15.50 - SUSE CORE 9 (x86_64): openssl-32bit-9-201406041231 openssl-devel-32bit-9-201406041231 - SUSE CORE 9 (s390x): openssl-32bit-9-201406060130 openssl-devel-32bit-9-201406060130 References: http://support.novell.com/security/cve/CVE-2011-4354.html http://support.novell.com/security/cve/CVE-2014-0224.html https://bugzilla.novell.com/459468 https://bugzilla.novell.com/489641 https://bugzilla.novell.com/880891 http://download.suse.com/patch/finder/?keywords=cf56900ecd68d8b418e857ef2c7… -- To unsubscribe, e-mail: opensuse-security-announce+unsubscribe(a)opensuse.org For additional commands, e-mail: opensuse-security-announce+help(a)opensuse.org

1 0

[security-announce] openSUSE-SU-2014:0767-1: important: gnutls: Fixed possible memory corruption
by opensuse-security＠opensuse.org 06 Jun '14

06 Jun '14

openSUSE Security Update: gnutls: Fixed possible memory corruption ______________________________________________________________________________ Announcement ID: openSUSE-SU-2014:0767-1 Rating: important References: #880730 Cross-References: CVE-2014-3466 Affected Products: openSUSE 11.4 ______________________________________________________________________________ An update that fixes one vulnerability is now available. Description: gnutls was patched to fix security vulnerability that could be used to disrupt service or potentially allow remote code execution. - Memory corruption during connect (CVE-2014-3466) - NULL pointer dereference in gnutls_x509_dn_oid_name (CVE-2014-3465) Patch Instructions: To install this openSUSE Security Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE 11.4: zypper in -t patch 2014-59 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE 11.4 (i586 x86_64): gnutls-2.8.6-5.29.1 gnutls-debuginfo-2.8.6-5.29.1 gnutls-debugsource-2.8.6-5.29.1 libgnutls-devel-2.8.6-5.29.1 libgnutls-extra-devel-2.8.6-5.29.1 libgnutls-extra26-2.8.6-5.29.1 libgnutls-extra26-debuginfo-2.8.6-5.29.1 libgnutls26-2.8.6-5.29.1 libgnutls26-debuginfo-2.8.6-5.29.1 - openSUSE 11.4 (x86_64): libgnutls26-32bit-2.8.6-5.29.1 libgnutls26-debuginfo-32bit-2.8.6-5.29.1 - openSUSE 11.4 (ia64): libgnutls26-debuginfo-x86-2.8.6-5.29.1 libgnutls26-x86-2.8.6-5.29.1 References: http://support.novell.com/security/cve/CVE-2014-3466.html https://bugzilla.novell.com/880730 -- To unsubscribe, e-mail: opensuse-security-announce+unsubscribe(a)opensuse.org For additional commands, e-mail: opensuse-security-announce+help(a)opensuse.org

1 0

[security-announce] openSUSE-SU-2014:0765-1: critical: update to version 1.0.0m
by opensuse-security＠opensuse.org 06 Jun '14

06 Jun '14

openSUSE Security Update: update to version 1.0.0m ______________________________________________________________________________ Announcement ID: openSUSE-SU-2014:0765-1 Rating: critical References: #880891 Cross-References: CVE-2014-0195 CVE-2014-0221 CVE-2014-0224 CVE-2014-3470 Affected Products: openSUSE 11.4 ______________________________________________________________________________ An update that fixes four vulnerabilities is now available. Description: The openssl library was updated to version 1.0.0m fixing various security issues and bugs: Security issues fixed: - CVE-2014-0224: Fix for SSL/TLS MITM flaw. An attacker using a carefully crafted handshake can force the use of weak keying material in OpenSSL SSL/TLS clients and servers. - CVE-2014-0221: Fix DTLS recursion flaw. By sending an invalid DTLS handshake to an OpenSSL DTLS client the code can be made to recurse eventually crashing in a DoS attack. - CVE-2014-0195: Fix DTLS invalid fragment vulnerability. A buffer overrun attack can be triggered by sending invalid DTLS fragments to an OpenSSL DTLS client or server. This is potentially exploitable to run arbitrary code on a vulnerable client or server. - CVE-2014-3470: Fix bug in TLS code where clients enable anonymous ECDH ciphersuites are subject to a denial of service attack. Patch Instructions: To install this openSUSE Security Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE 11.4: zypper in -t patch 2014-60 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE 11.4 (i586 x86_64): libopenssl-devel-1.0.0m-18.53.1 libopenssl1_0_0-1.0.0m-18.53.1 libopenssl1_0_0-debuginfo-1.0.0m-18.53.1 openssl-1.0.0m-18.53.1 openssl-debuginfo-1.0.0m-18.53.1 openssl-debugsource-1.0.0m-18.53.1 - openSUSE 11.4 (x86_64): libopenssl1_0_0-32bit-1.0.0m-18.53.1 libopenssl1_0_0-debuginfo-32bit-1.0.0m-18.53.1 - openSUSE 11.4 (noarch): openssl-doc-1.0.0m-18.53.1 - openSUSE 11.4 (ia64): libopenssl1_0_0-debuginfo-x86-1.0.0m-18.53.1 libopenssl1_0_0-x86-1.0.0m-18.53.1 References: http://support.novell.com/security/cve/CVE-2014-0195.html http://support.novell.com/security/cve/CVE-2014-0221.html http://support.novell.com/security/cve/CVE-2014-0224.html http://support.novell.com/security/cve/CVE-2014-3470.html https://bugzilla.novell.com/880891 -- To unsubscribe, e-mail: opensuse-security-announce+unsubscribe(a)opensuse.org For additional commands, e-mail: opensuse-security-announce+help(a)opensuse.org

1 0

[security-announce] openSUSE-SU-2014:0764-1: critical: openssl: update to version 1.0.1h
by opensuse-security＠opensuse.org 06 Jun '14

06 Jun '14

openSUSE Security Update: openssl: update to version 1.0.1h ______________________________________________________________________________ Announcement ID: openSUSE-SU-2014:0764-1 Rating: critical References: #880891 Cross-References: CVE-2014-0195 CVE-2014-0221 CVE-2014-0224 CVE-2014-3470 Affected Products: openSUSE 13.1 openSUSE 12.3 ______________________________________________________________________________ An update that fixes four vulnerabilities is now available. Description: The openssl library was updated to version 1.0.1h fixing various security issues and bugs: Security issues fixed: - CVE-2014-0224: Fix for SSL/TLS MITM flaw. An attacker using a carefully crafted handshake can force the use of weak keying material in OpenSSL SSL/TLS clients and servers. - CVE-2014-0221: Fix DTLS recursion flaw. By sending an invalid DTLS handshake to an OpenSSL DTLS client the code can be made to recurse eventually crashing in a DoS attack. - CVE-2014-0195: Fix DTLS invalid fragment vulnerability. A buffer overrun attack can be triggered by sending invalid DTLS fragments to an OpenSSL DTLS client or server. This is potentially exploitable to run arbitrary code on a vulnerable client or server. - CVE-2014-3470: Fix bug in TLS code where clients enable anonymous ECDH ciphersuites are subject to a denial of service attack. Patch Instructions: To install this openSUSE Security Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE 13.1: zypper in -t patch openSUSE-2014-410 - openSUSE 12.3: zypper in -t patch openSUSE-2014-410 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE 13.1 (i586 x86_64): libopenssl-devel-1.0.1h-11.48.1 libopenssl1_0_0-1.0.1h-11.48.1 libopenssl1_0_0-debuginfo-1.0.1h-11.48.1 openssl-1.0.1h-11.48.1 openssl-debuginfo-1.0.1h-11.48.1 openssl-debugsource-1.0.1h-11.48.1 - openSUSE 13.1 (x86_64): libopenssl-devel-32bit-1.0.1h-11.48.1 libopenssl1_0_0-32bit-1.0.1h-11.48.1 libopenssl1_0_0-debuginfo-32bit-1.0.1h-11.48.1 - openSUSE 13.1 (noarch): openssl-doc-1.0.1h-11.48.1 - openSUSE 12.3 (i586 x86_64): libopenssl-devel-1.0.1h-1.60.1 libopenssl1_0_0-1.0.1h-1.60.1 libopenssl1_0_0-debuginfo-1.0.1h-1.60.1 openssl-1.0.1h-1.60.1 openssl-debuginfo-1.0.1h-1.60.1 openssl-debugsource-1.0.1h-1.60.1 - openSUSE 12.3 (x86_64): libopenssl-devel-32bit-1.0.1h-1.60.1 libopenssl1_0_0-32bit-1.0.1h-1.60.1 libopenssl1_0_0-debuginfo-32bit-1.0.1h-1.60.1 - openSUSE 12.3 (noarch): openssl-doc-1.0.1h-1.60.1 References: http://support.novell.com/security/cve/CVE-2014-0195.html http://support.novell.com/security/cve/CVE-2014-0221.html http://support.novell.com/security/cve/CVE-2014-0224.html http://support.novell.com/security/cve/CVE-2014-3470.html https://bugzilla.novell.com/880891 -- To unsubscribe, e-mail: opensuse-security-announce+unsubscribe(a)opensuse.org For additional commands, e-mail: opensuse-security-announce+help(a)opensuse.org

1 0

[security-announce] openSUSE-SU-2014:0763-1: important: gnutls: Fixed possible memory corruption and NULL pointer dereference
by opensuse-security＠opensuse.org 06 Jun '14

06 Jun '14

openSUSE Security Update: gnutls: Fixed possible memory corruption and NULL pointer dereference ______________________________________________________________________________ Announcement ID: openSUSE-SU-2014:0763-1 Rating: important References: #880730 #880733 Cross-References: CVE-2014-3465 CVE-2014-3466 Affected Products: openSUSE 13.1 openSUSE 12.3 ______________________________________________________________________________ An update that fixes two vulnerabilities is now available. Description: gnutls was patched to fix two security vulnerabilities that could be used to disrupt service or potentially allow remote code execution. - Memory corruption during connect (CVE-2014-3466) - NULL pointer dereference in gnutls_x509_dn_oid_name (CVE-2014-3465) Patch Instructions: To install this openSUSE Security Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE 13.1: zypper in -t patch openSUSE-2014-411 - openSUSE 12.3: zypper in -t patch openSUSE-2014-411 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE 13.1 (i586 x86_64): gnutls-3.2.4-2.24.1 gnutls-debuginfo-3.2.4-2.24.1 gnutls-debugsource-3.2.4-2.24.1 libgnutls-devel-3.2.4-2.24.1 libgnutls-openssl-devel-3.2.4-2.24.1 libgnutls-openssl27-3.2.4-2.24.1 libgnutls-openssl27-debuginfo-3.2.4-2.24.1 libgnutls28-3.2.4-2.24.1 libgnutls28-debuginfo-3.2.4-2.24.1 libgnutlsxx-devel-3.2.4-2.24.1 libgnutlsxx28-3.2.4-2.24.1 libgnutlsxx28-debuginfo-3.2.4-2.24.1 - openSUSE 13.1 (x86_64): libgnutls-devel-32bit-3.2.4-2.24.1 libgnutls28-32bit-3.2.4-2.24.1 libgnutls28-debuginfo-32bit-3.2.4-2.24.1 - openSUSE 12.3 (i586 x86_64): gnutls-3.0.28-1.14.1 gnutls-debuginfo-3.0.28-1.14.1 gnutls-debugsource-3.0.28-1.14.1 libgnutls-devel-3.0.28-1.14.1 libgnutls-openssl-devel-3.0.28-1.14.1 libgnutls-openssl27-3.0.28-1.14.1 libgnutls-openssl27-debuginfo-3.0.28-1.14.1 libgnutls28-3.0.28-1.14.1 libgnutls28-debuginfo-3.0.28-1.14.1 libgnutlsxx-devel-3.0.28-1.14.1 libgnutlsxx28-3.0.28-1.14.1 libgnutlsxx28-debuginfo-3.0.28-1.14.1 - openSUSE 12.3 (x86_64): libgnutls-devel-32bit-3.0.28-1.14.1 libgnutls28-32bit-3.0.28-1.14.1 libgnutls28-debuginfo-32bit-3.0.28-1.14.1 References: http://support.novell.com/security/cve/CVE-2014-3465.html http://support.novell.com/security/cve/CVE-2014-3466.html https://bugzilla.novell.com/880730 https://bugzilla.novell.com/880733 -- To unsubscribe, e-mail: opensuse-security-announce+unsubscribe(a)opensuse.org For additional commands, e-mail: opensuse-security-announce+help(a)opensuse.org

1 0