June 2014 - openSUSE Security Announce

[security-announce] SUSE-SU-2014:0762-1: critical: Security update for OpenSSL 1.0
by opensuse-security＠opensuse.org 06 Jun '14

06 Jun '14

SUSE Security Update: Security update for OpenSSL 1.0 ______________________________________________________________________________ Announcement ID: SUSE-SU-2014:0762-1 Rating: critical References: #876282 #880891 Cross-References: CVE-2014-0195 CVE-2014-0198 CVE-2014-0221 CVE-2014-0224 CVE-2014-3470 Affected Products: SUSE Linux Enterprise Security Module 11 SP3 ______________________________________________________________________________ An update that fixes 5 vulnerabilities is now available. Description: OpenSSL was updated to fix several vulnerabilities: * SSL/TLS MITM vulnerability. (CVE-2014-0224) * DTLS recursion flaw. (CVE-2014-0221) * DTLS invalid fragment vulnerability. (CVE-2014-0195) * SSL_MODE_RELEASE_BUFFERS NULL pointer dereference. (CVE-2014-0198) * Anonymous ECDH denial of service. (CVE-2014-3470) Further information can be found at http://www.openssl.org/news/secadv_20140605.txt <http://www.openssl.org/news/secadv_20140605.txt> . Security Issues references: * CVE-2014-0224 <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-0224> * CVE-2014-0221 <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-0221> * CVE-2014-0195 <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-0195> * CVE-2014-0198 <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-0198> * CVE-2014-3470 <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-3470> Patch Instructions: To install this SUSE Security Update use YaST online_update. Alternatively you can run the command listed for your product: - SUSE Linux Enterprise Security Module 11 SP3: zypper in -t patch secsp3-libopenssl1-devel-9325 To bring your system up-to-date, use "zypper patch". Package List: - SUSE Linux Enterprise Security Module 11 SP3 (i586 ia64 ppc64 s390x x86_64): libopenssl1-devel-1.0.1g-0.16.1 libopenssl1_0_0-1.0.1g-0.16.1 openssl1-1.0.1g-0.16.1 openssl1-doc-1.0.1g-0.16.1 - SUSE Linux Enterprise Security Module 11 SP3 (ppc64 s390x x86_64): libopenssl1_0_0-32bit-1.0.1g-0.16.1 - SUSE Linux Enterprise Security Module 11 SP3 (ia64): libopenssl1_0_0-x86-1.0.1g-0.16.1 References: http://support.novell.com/security/cve/CVE-2014-0195.html http://support.novell.com/security/cve/CVE-2014-0198.html http://support.novell.com/security/cve/CVE-2014-0221.html http://support.novell.com/security/cve/CVE-2014-0224.html http://support.novell.com/security/cve/CVE-2014-3470.html https://bugzilla.novell.com/876282 https://bugzilla.novell.com/880891 http://download.suse.com/patch/finder/?keywords=61cb4c46d00371ca48e4548ed26… -- To unsubscribe, e-mail: opensuse-security-announce+unsubscribe(a)opensuse.org For additional commands, e-mail: opensuse-security-announce+help(a)opensuse.org

1 0

[security-announce] SUSE-SU-2014:0761-1: critical: Security update for OpenSSL
by opensuse-security＠opensuse.org 05 Jun '14

05 Jun '14

SUSE Security Update: Security update for OpenSSL ______________________________________________________________________________ Announcement ID: SUSE-SU-2014:0761-1 Rating: critical References: #859228 #859924 #860332 #862181 #869945 #870192 #880891 Cross-References: CVE-2014-0076 CVE-2014-0221 CVE-2014-0224 CVE-2014-3470 Affected Products: SUSE Linux Enterprise Server 11 SP2 LTSS SUSE Linux Enterprise Server 11 SP1 LTSS ______________________________________________________________________________ An update that solves four vulnerabilities and has three fixes is now available. It includes one version update. Description: OpenSSL was updated to fix several vulnerabilities: * SSL/TLS MITM vulnerability. (CVE-2014-0224) * DTLS recursion flaw. (CVE-2014-0221) * Anonymous ECDH denial of service. (CVE-2014-3470) * Using the FLUSH+RELOAD Cache Side-channel Attack the nonces could have been recovered. (CVE-2014-0076) Further information can be found at http://www.openssl.org/news/secadv_20140605.txt <http://www.openssl.org/news/secadv_20140605.txt> . Additionally, the following non-security fixes and enhancements have been included in this release: * Ensure that the stack is marked non-executable on x86 32bit. On other processor platforms it was already marked as non-executable before. (bnc#870192) * IPv6 support was added to the openssl s_client and s_server command line tool. (bnc#859228) * The openssl command line tool now checks certificates by default against /etc/ssl/certs (this can be changed via the -CApath option). (bnc#860332) * The Elliptic Curve Diffie-Hellman key exchange selector was enabled and can be selected by kECDHE, kECDH, ECDH tags in the SSL cipher string. (bnc#859924) * If an optional openssl1 command line tool is installed in parallel, c_rehash uses it to generate certificate hashes in both OpenSSL 0 and OpenSSL 1 style. This allows parallel usage of OpenSSL 0.9.8j and OpenSSL 1.x client libraries with a shared certificate store. (bnc#862181) Security Issues references: * CVE-2014-0224 <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-0224> * CVE-2014-0221 <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-0221> * CVE-2014-3470 <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-3470> * CVE-2014-0076 <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-0076> Patch Instructions: To install this SUSE Security Update use YaST online_update. Alternatively you can run the command listed for your product: - SUSE Linux Enterprise Server 11 SP2 LTSS: zypper in -t patch slessp2-libopenssl-devel-9324 - SUSE Linux Enterprise Server 11 SP1 LTSS: zypper in -t patch slessp1-libopenssl-devel-9323 To bring your system up-to-date, use "zypper patch". Package List: - SUSE Linux Enterprise Server 11 SP2 LTSS (i586 s390x x86_64): libopenssl0_9_8-0.9.8j-0.58.1 libopenssl0_9_8-hmac-0.9.8j-0.58.1 openssl-0.9.8j-0.58.1 openssl-doc-0.9.8j-0.58.1 - SUSE Linux Enterprise Server 11 SP2 LTSS (s390x x86_64): libopenssl0_9_8-32bit-0.9.8j-0.58.1 libopenssl0_9_8-hmac-32bit-0.9.8j-0.58.1 - SUSE Linux Enterprise Server 11 SP1 LTSS (i586 s390x x86_64) [New Version: 0.9.8j]: libopenssl0_9_8-0.9.8j-0.58.1 libopenssl0_9_8-hmac-0.9.8j-0.58.1 openssl-0.9.8j-0.58.1 openssl-doc-0.9.8j-0.58.1 - SUSE Linux Enterprise Server 11 SP1 LTSS (s390x x86_64) [New Version: 0.9.8j]: libopenssl0_9_8-32bit-0.9.8j-0.58.1 libopenssl0_9_8-hmac-32bit-0.9.8j-0.58.1 References: http://support.novell.com/security/cve/CVE-2014-0076.html http://support.novell.com/security/cve/CVE-2014-0221.html http://support.novell.com/security/cve/CVE-2014-0224.html http://support.novell.com/security/cve/CVE-2014-3470.html https://bugzilla.novell.com/859228 https://bugzilla.novell.com/859924 https://bugzilla.novell.com/860332 https://bugzilla.novell.com/862181 https://bugzilla.novell.com/869945 https://bugzilla.novell.com/870192 https://bugzilla.novell.com/880891 http://download.suse.com/patch/finder/?keywords=6cb273ec77c3138de899b696097… http://download.suse.com/patch/finder/?keywords=b76b151f2d2ff2b6064a21d179b… -- To unsubscribe, e-mail: opensuse-security-announce+unsubscribe(a)opensuse.org For additional commands, e-mail: opensuse-security-announce+help(a)opensuse.org

1 0

[security-announce] SUSE-SU-2014:0759-1: critical: Security update for OpenSSL
by opensuse-security＠opensuse.org 05 Jun '14

05 Jun '14

SUSE Security Update: Security update for OpenSSL ______________________________________________________________________________ Announcement ID: SUSE-SU-2014:0759-1 Rating: critical References: #880891 Cross-References: CVE-2014-0221 CVE-2014-0224 CVE-2014-3470 Affected Products: SUSE Linux Enterprise Software Development Kit 11 SP3 SUSE Linux Enterprise Server 11 SP3 for VMware SUSE Linux Enterprise Server 11 SP3 SUSE Linux Enterprise Desktop 11 SP3 ______________________________________________________________________________ An update that fixes three vulnerabilities is now available. Description: OpenSSL was updated to fix several vulnerabilities: * SSL/TLS MITM vulnerability. (CVE-2014-0224) * DTLS recursion flaw. (CVE-2014-0221) * Anonymous ECDH denial of service. (CVE-2014-3470) Further information can be found at http://www.openssl.org/news/secadv_20140605.txt <http://www.openssl.org/news/secadv_20140605.txt> . Security Issues references: * CVE-2014-0224 <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-0224> * CVE-2014-0221 <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-0221> * CVE-2014-3470 <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-3470> Patch Instructions: To install this SUSE Security Update use YaST online_update. Alternatively you can run the command listed for your product: - SUSE Linux Enterprise Software Development Kit 11 SP3: zypper in -t patch sdksp3-libopenssl-devel-9326 - SUSE Linux Enterprise Server 11 SP3 for VMware: zypper in -t patch slessp3-libopenssl-devel-9326 - SUSE Linux Enterprise Server 11 SP3: zypper in -t patch slessp3-libopenssl-devel-9326 - SUSE Linux Enterprise Desktop 11 SP3: zypper in -t patch sledsp3-libopenssl-devel-9326 To bring your system up-to-date, use "zypper patch". Package List: - SUSE Linux Enterprise Software Development Kit 11 SP3 (i586 ia64 ppc64 s390x x86_64): libopenssl-devel-0.9.8j-0.58.1 - SUSE Linux Enterprise Server 11 SP3 for VMware (i586 x86_64): libopenssl0_9_8-0.9.8j-0.58.1 libopenssl0_9_8-hmac-0.9.8j-0.58.1 openssl-0.9.8j-0.58.1 openssl-doc-0.9.8j-0.58.1 - SUSE Linux Enterprise Server 11 SP3 for VMware (x86_64): libopenssl0_9_8-32bit-0.9.8j-0.58.1 libopenssl0_9_8-hmac-32bit-0.9.8j-0.58.1 - SUSE Linux Enterprise Server 11 SP3 (i586 ia64 ppc64 s390x x86_64): libopenssl0_9_8-0.9.8j-0.58.1 libopenssl0_9_8-hmac-0.9.8j-0.58.1 openssl-0.9.8j-0.58.1 openssl-doc-0.9.8j-0.58.1 - SUSE Linux Enterprise Server 11 SP3 (ppc64 s390x x86_64): libopenssl0_9_8-32bit-0.9.8j-0.58.1 libopenssl0_9_8-hmac-32bit-0.9.8j-0.58.1 - SUSE Linux Enterprise Server 11 SP3 (ia64): libopenssl0_9_8-x86-0.9.8j-0.58.1 - SUSE Linux Enterprise Desktop 11 SP3 (i586 x86_64): libopenssl0_9_8-0.9.8j-0.58.1 openssl-0.9.8j-0.58.1 - SUSE Linux Enterprise Desktop 11 SP3 (x86_64): libopenssl0_9_8-32bit-0.9.8j-0.58.1 References: http://support.novell.com/security/cve/CVE-2014-0221.html http://support.novell.com/security/cve/CVE-2014-0224.html http://support.novell.com/security/cve/CVE-2014-3470.html https://bugzilla.novell.com/880891 http://download.suse.com/patch/finder/?keywords=db2f8a5e6769133f6c66e372701… -- To unsubscribe, e-mail: opensuse-security-announce+unsubscribe(a)opensuse.org For additional commands, e-mail: opensuse-security-announce+help(a)opensuse.org

1 0

[security-announce] Announcement: openssl 1.0.1h released to fix several vulnerabilities
by Thomas Biege 05 Jun '14

05 Jun '14

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 Today the openssl project released a new version of the openssl library (openssl-1.0.1h) that fixes six/seven vulnerabilities. Details about the vulnerabilities can be found in their advisory: http://www.openssl.org/news/secadv_20140605.txt List of issues: 1. SSL/TLS MITM vulnerability (CVE-2014-0224) 2. DTLS recursion flaw (CVE-2014-0221) 3. DTLS invalid fragment vulnerability (CVE-2014-0195) 4. SSL_MODE_RELEASE_BUFFERS NULL pointer dereference (CVE-2014-0198) 5. SSL_MODE_RELEASE_BUFFERS session injection or denial of service (CVE-2010-5298) 6. Anonymous ECDH denial of service (CVE-2014-3470) 7. Recovering OpenSSL ECDSA Nonces Using the FLUSH+RELOAD (CVE-2014-0076) We ship the following openssl versions which are affected by...: - - SLES9: openssl 0.9.7d + SSL/TLS MITM vulnerability (CVE-2014-0224) - - SLE10: openssl 0.9.8a + SSL/TLS MITM vulnerability (CVE-2014-0224) + DTLS recursion flaw (CVE-2014-0221) - - SLE11: openssl 0.9.8j + SSL/TLS MITM vulnerability (CVE-2014-0224) + DTLS recursion flaw (CVE-2014-0221) + Anonymous ECDH denial of service (CVE-2014-3470) - - Security AddON for SLES11: openssl 1.0.1g + SSL/TLS MITM vulnerability (CVE-2014-0224) + DTLS recursion flaw (CVE-2014-0221) + DTLS invalid fragment vulnerability (CVE-2014-0195) + SSL_MODE_RELEASE_BUFFERS NULL pointer dereference (CVE-2014-0198) + Anonymous ECDH denial of service (CVE-2014-3470) - - opensuse: openssl 1.0.1* + SSL/TLS MITM vulnerability (CVE-2014-0224) + DTLS recursion flaw (CVE-2014-0221) + DTLS invalid fragment vulnerability (CVE-2014-0195) + SSL_MODE_RELEASE_BUFFERS NULL pointer dereference (CVE-2014-0198) + Anonymous ECDH denial of service (CVE-2014-3470) An update package for CVE-2014-0076 was released in April 2014, see http://lists.opensuse.org/opensuse-updates/2014-04/msg00007.html. DTLS invalid fragment vulnerability (CVE-2014-0195): This issue affects only versions starting from 0.9.8o, therefore 0.9.8j is not affected by this remote buffer overflow. The updates will be released as soon as possible. Best regards, Thomas - -- Thomas Biege <thomas(a)suse.de>, Team Leader MaintenanceSecurity, CSSLP SUSE LINUX Products GmbH GF: Jeff Hawn, Jennifer Guild, Felix Imendörffer HRB 21284 (AG Nürnberg) - -- Wer aufhoert besser werden zu wollen, hoert auf gut zu sein. -- Marie von Ebner-Eschenbach -----BEGIN PGP SIGNATURE----- Version: GnuPG v2.0.22 (GNU/Linux) Comment: Using GnuPG with Thunderbird - http://www.enigmail.net/ iQEVAwUBU5CEfHey5gA9JdPZAQLC0gf/Y4M29yMsWf1fBUZP6VCFbDK03UAT0HhI Srdx4FgSwr3Rda6M52UKqP8HdP2yv9/G30NGHihX7Gz6hStc8G/bvj8RyVGPlUh4 XadWUVztnSct1v68z45Z1zk53XBVsK5lIpxORX04LW0EPQytYAltD7/W4wvNtwBU Y7Ji1WDb+L6sGHyZn9Cp2Zvs30+jraf10MK/L7tYuvdNoOJTVfgrlzt+dfFKIuuW 5Az7KXb8J21CEk4DVhO5CG2ogNjsVR/K7b7vlWFxYorhfkKr1tXi5SKSXooD1WPY ovMhZFfopkKuuor898Xpyzb54Qjcc7eMDS3Pk7jDo9lBifY6loJqLw== =bSsy -----END PGP SIGNATURE----- -- To unsubscribe, e-mail: opensuse-security-announce+unsubscribe(a)opensuse.org For additional commands, e-mail: opensuse-security-announce+help(a)opensuse.org

1 0

[security-announce] SUSE-SU-2014:0758-1: important: Security update for gnutls
by opensuse-security＠opensuse.org 05 Jun '14

05 Jun '14

SUSE Security Update: Security update for gnutls ______________________________________________________________________________ Announcement ID: SUSE-SU-2014:0758-1 Rating: important References: #880730 #880910 Cross-References: CVE-2014-3466 Affected Products: SUSE Linux Enterprise Software Development Kit 11 SP3 SUSE Linux Enterprise Server 11 SP3 for VMware SUSE Linux Enterprise Server 11 SP3 SUSE Linux Enterprise High Availability Extension 11 SP3 SUSE Linux Enterprise Desktop 11 SP3 ______________________________________________________________________________ An update that solves one vulnerability and has one errata is now available. Description: GnuTLS has been patched to ensure proper parsing of session ids during the TLS/SSL handshake. Additionally, three issues inherited from libtasn1 have been fixed. Further information is available at http://www.gnutls.org/security.html#GNUTLS-SA-2014-3 <http://www.gnutls.org/security.html#GNUTLS-SA-2014-3> These security issues have been fixed: * Possible memory corruption during connect (CVE-2014-3466) * Multiple boundary check issues could allow DoS (CVE-2014-3467) * asn1_get_bit_der() can return negative bit length (CVE-2014-3468) * Possible DoS by NULL pointer dereference (CVE-2014-3469) Security Issue references: * CVE-2014-3466 <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-3466> Patch Instructions: To install this SUSE Security Update use YaST online_update. Alternatively you can run the command listed for your product: - SUSE Linux Enterprise Software Development Kit 11 SP3: zypper in -t patch sdksp3-gnutls-9320 - SUSE Linux Enterprise Server 11 SP3 for VMware: zypper in -t patch slessp3-gnutls-9320 - SUSE Linux Enterprise Server 11 SP3: zypper in -t patch slessp3-gnutls-9320 - SUSE Linux Enterprise High Availability Extension 11 SP3: zypper in -t patch slehasp3-gnutls-9320 - SUSE Linux Enterprise Desktop 11 SP3: zypper in -t patch sledsp3-gnutls-9320 To bring your system up-to-date, use "zypper patch". Package List: - SUSE Linux Enterprise Software Development Kit 11 SP3 (i586 ia64 ppc64 s390x x86_64): libgnutls-devel-2.4.1-24.39.51.1 libgnutls-extra-devel-2.4.1-24.39.51.1 libgnutls-extra26-2.4.1-24.39.51.1 - SUSE Linux Enterprise Server 11 SP3 for VMware (i586 x86_64): gnutls-2.4.1-24.39.51.1 libgnutls-extra26-2.4.1-24.39.51.1 libgnutls26-2.4.1-24.39.51.1 - SUSE Linux Enterprise Server 11 SP3 for VMware (x86_64): libgnutls26-32bit-2.4.1-24.39.51.1 - SUSE Linux Enterprise Server 11 SP3 (i586 ia64 ppc64 s390x x86_64): gnutls-2.4.1-24.39.51.1 libgnutls-extra26-2.4.1-24.39.51.1 libgnutls26-2.4.1-24.39.51.1 - SUSE Linux Enterprise Server 11 SP3 (ppc64 s390x x86_64): libgnutls26-32bit-2.4.1-24.39.51.1 - SUSE Linux Enterprise Server 11 SP3 (ia64): libgnutls26-x86-2.4.1-24.39.51.1 - SUSE Linux Enterprise High Availability Extension 11 SP3 (i586 ia64 ppc64 s390x x86_64): libgnutls-extra26-2.4.1-24.39.51.1 - SUSE Linux Enterprise Desktop 11 SP3 (i586 x86_64): gnutls-2.4.1-24.39.51.1 libgnutls26-2.4.1-24.39.51.1 - SUSE Linux Enterprise Desktop 11 SP3 (x86_64): libgnutls26-32bit-2.4.1-24.39.51.1 References: http://support.novell.com/security/cve/CVE-2014-3466.html https://bugzilla.novell.com/880730 https://bugzilla.novell.com/880910 http://download.suse.com/patch/finder/?keywords=cbb1ebdf6ecb2e49e09ac0ae8fa… -- To unsubscribe, e-mail: opensuse-security-announce+unsubscribe(a)opensuse.org For additional commands, e-mail: opensuse-security-announce+help(a)opensuse.org

1 0

[security-announce] SUSE-SU-2014:0728-3: important: Security update for IBM Java 6
by opensuse-security＠opensuse.org 02 Jun '14

02 Jun '14

SUSE Security Update: Security update for IBM Java 6 ______________________________________________________________________________ Announcement ID: SUSE-SU-2014:0728-3 Rating: important References: #877430 Cross-References: CVE-2013-6629 CVE-2013-6954 CVE-2014-0428 CVE-2014-0429 CVE-2014-0446 CVE-2014-0449 CVE-2014-0451 CVE-2014-0452 CVE-2014-0453 CVE-2014-0457 CVE-2014-0458 CVE-2014-0459 CVE-2014-0460 CVE-2014-0461 CVE-2014-0878 CVE-2014-1876 CVE-2014-2398 CVE-2014-2401 CVE-2014-2409 CVE-2014-2412 CVE-2014-2414 CVE-2014-2420 CVE-2014-2421 CVE-2014-2423 CVE-2014-2427 CVE-2014-2428 Affected Products: SUSE Linux Enterprise Software Development Kit 11 SP3 SUSE Linux Enterprise Server 11 SP3 for VMware SUSE Linux Enterprise Server 11 SP3 SUSE Linux Enterprise Server 11 SP1 LTSS SUSE Linux Enterprise Java 11 SP3 ______________________________________________________________________________ An update that fixes 26 vulnerabilities is now available. Description: BM Java 6 was updated to version 6 SR16 to fix several security issues and various other bugs. More information can be found at: http://www.ibm.com/developerworks/java/jdk/alerts/ <http://www.ibm.com/developerworks/java/jdk/alerts/> Security Issues references: * CVE-2013-6629 <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2013-6629> * CVE-2013-6954 <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2013-6954> * CVE-2014-0429 <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-0429> * CVE-2014-0446 <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-0446> * CVE-2014-0449 <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-0449> * CVE-2014-0451 <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-0451> * CVE-2014-0452 <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-0452> * CVE-2014-0457 <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-0457> * CVE-2014-0458 <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-0458> * CVE-2014-0459 <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-0459> * CVE-2014-0460 <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-0460> * CVE-2014-0461 <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-0461> * CVE-2014-1876 <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-1876> * CVE-2014-2398 <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-2398> * CVE-2014-2401 <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-2401> * CVE-2014-2409 <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-2409> * CVE-2014-2412 <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-2412> * CVE-2014-2414 <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-2414> * CVE-2014-2420 <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-2420> * CVE-2014-2421 <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-2421> * CVE-2014-2423 <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-2423> * CVE-2014-2427 <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-2427> * CVE-2014-2428 <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-2428> * CVE-2014-0428 <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-0428> * CVE-2014-0453 <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-0453> * CVE-2014-0878 <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-0878> Patch Instructions: To install this SUSE Security Update use YaST online_update. Alternatively you can run the command listed for your product: - SUSE Linux Enterprise Software Development Kit 11 SP3: zypper in -t patch sdksp3-java-1_6_0-ibm-9256 - SUSE Linux Enterprise Server 11 SP3 for VMware: zypper in -t patch slessp3-java-1_6_0-ibm-9256 - SUSE Linux Enterprise Server 11 SP3: zypper in -t patch slessp3-java-1_6_0-ibm-9256 - SUSE Linux Enterprise Server 11 SP1 LTSS: zypper in -t patch slessp1-java-1_6_0-ibm-9273 - SUSE Linux Enterprise Java 11 SP3: zypper in -t patch slejsp3-java-1_6_0-ibm-9256 To bring your system up-to-date, use "zypper patch". Package List: - SUSE Linux Enterprise Software Development Kit 11 SP3 (i586 ppc64 s390x x86_64): java-1_6_0-ibm-devel-1.6.0_sr16.0-0.3.1 - SUSE Linux Enterprise Software Development Kit 11 SP3 (i586 x86_64): java-1_6_0-ibm-1.6.0_sr16.0-0.3.1 java-1_6_0-ibm-fonts-1.6.0_sr16.0-0.3.1 - SUSE Linux Enterprise Server 11 SP3 for VMware (i586 x86_64): java-1_6_0-ibm-1.6.0_sr16.0-0.3.1 java-1_6_0-ibm-fonts-1.6.0_sr16.0-0.3.1 java-1_6_0-ibm-jdbc-1.6.0_sr16.0-0.3.1 java-1_6_0-ibm-plugin-1.6.0_sr16.0-0.3.1 - SUSE Linux Enterprise Server 11 SP3 for VMware (i586): java-1_6_0-ibm-alsa-1.6.0_sr16.0-0.3.1 - SUSE Linux Enterprise Server 11 SP3 (i586 ppc64 s390x x86_64): java-1_6_0-ibm-1.6.0_sr16.0-0.3.1 java-1_6_0-ibm-fonts-1.6.0_sr16.0-0.3.1 java-1_6_0-ibm-jdbc-1.6.0_sr16.0-0.3.1 - SUSE Linux Enterprise Server 11 SP3 (i586 x86_64): java-1_6_0-ibm-plugin-1.6.0_sr16.0-0.3.1 - SUSE Linux Enterprise Server 11 SP3 (i586): java-1_6_0-ibm-alsa-1.6.0_sr16.0-0.3.1 - SUSE Linux Enterprise Server 11 SP1 LTSS (i586 s390x x86_64): java-1_6_0-ibm-1.6.0_sr16.0-0.3.1 java-1_6_0-ibm-fonts-1.6.0_sr16.0-0.3.1 java-1_6_0-ibm-jdbc-1.6.0_sr16.0-0.3.1 - SUSE Linux Enterprise Server 11 SP1 LTSS (i586 x86_64): java-1_6_0-ibm-plugin-1.6.0_sr16.0-0.3.1 - SUSE Linux Enterprise Server 11 SP1 LTSS (i586): java-1_6_0-ibm-alsa-1.6.0_sr16.0-0.3.1 - SUSE Linux Enterprise Java 11 SP3 (i586 ppc64 s390x x86_64): java-1_6_0-ibm-1.6.0_sr16.0-0.3.1 java-1_6_0-ibm-devel-1.6.0_sr16.0-0.3.1 java-1_6_0-ibm-fonts-1.6.0_sr16.0-0.3.1 java-1_6_0-ibm-jdbc-1.6.0_sr16.0-0.3.1 - SUSE Linux Enterprise Java 11 SP3 (i586 x86_64): java-1_6_0-ibm-plugin-1.6.0_sr16.0-0.3.1 - SUSE Linux Enterprise Java 11 SP3 (i586): java-1_6_0-ibm-alsa-1.6.0_sr16.0-0.3.1 References: http://support.novell.com/security/cve/CVE-2013-6629.html http://support.novell.com/security/cve/CVE-2013-6954.html http://support.novell.com/security/cve/CVE-2014-0428.html http://support.novell.com/security/cve/CVE-2014-0429.html http://support.novell.com/security/cve/CVE-2014-0446.html http://support.novell.com/security/cve/CVE-2014-0449.html http://support.novell.com/security/cve/CVE-2014-0451.html http://support.novell.com/security/cve/CVE-2014-0452.html http://support.novell.com/security/cve/CVE-2014-0453.html http://support.novell.com/security/cve/CVE-2014-0457.html http://support.novell.com/security/cve/CVE-2014-0458.html http://support.novell.com/security/cve/CVE-2014-0459.html http://support.novell.com/security/cve/CVE-2014-0460.html http://support.novell.com/security/cve/CVE-2014-0461.html http://support.novell.com/security/cve/CVE-2014-0878.html http://support.novell.com/security/cve/CVE-2014-1876.html http://support.novell.com/security/cve/CVE-2014-2398.html http://support.novell.com/security/cve/CVE-2014-2401.html http://support.novell.com/security/cve/CVE-2014-2409.html http://support.novell.com/security/cve/CVE-2014-2412.html http://support.novell.com/security/cve/CVE-2014-2414.html http://support.novell.com/security/cve/CVE-2014-2420.html http://support.novell.com/security/cve/CVE-2014-2421.html http://support.novell.com/security/cve/CVE-2014-2423.html http://support.novell.com/security/cve/CVE-2014-2427.html http://support.novell.com/security/cve/CVE-2014-2428.html https://bugzilla.novell.com/877430 http://download.suse.com/patch/finder/?keywords=159cbf841fa77a526042b13b2fa… http://download.suse.com/patch/finder/?keywords=ae93268c78a2b60a14d572b620a… -- To unsubscribe, e-mail: opensuse-security-announce+unsubscribe(a)opensuse.org For additional commands, e-mail: opensuse-security-announce+help(a)opensuse.org

1 0

[security-announce] SUSE-SU-2014:0733-2: important: Security update for IBM Java 7
by opensuse-security＠opensuse.org 02 Jun '14

02 Jun '14

SUSE Security Update: Security update for IBM Java 7 ______________________________________________________________________________ Announcement ID: SUSE-SU-2014:0733-2 Rating: important References: #877429 Cross-References: CVE-2013-6629 CVE-2013-6954 CVE-2014-0428 CVE-2014-0429 CVE-2014-0446 CVE-2014-0448 CVE-2014-0449 CVE-2014-0451 CVE-2014-0452 CVE-2014-0453 CVE-2014-0454 CVE-2014-0455 CVE-2014-0457 CVE-2014-0458 CVE-2014-0459 CVE-2014-0460 CVE-2014-0461 CVE-2014-0878 CVE-2014-1876 CVE-2014-2398 CVE-2014-2401 CVE-2014-2402 CVE-2014-2409 CVE-2014-2412 CVE-2014-2414 CVE-2014-2420 CVE-2014-2421 CVE-2014-2423 CVE-2014-2427 CVE-2014-2428 Affected Products: SUSE Linux Enterprise Software Development Kit 11 SP3 SUSE Linux Enterprise Server 11 SP3 for VMware SUSE Linux Enterprise Server 11 SP3 SUSE Linux Enterprise Java 11 SP3 ______________________________________________________________________________ An update that fixes 30 vulnerabilities is now available. Description: IBM Java 7 was updated to version SR7, which received security and bug fixes. More information is available at: http://www.ibm.com/developerworks/java/jdk/aix/j764/Java7_64.fixes.html#SR7 <http://www.ibm.com/developerworks/java/jdk/aix/j764/Java7_64.fixes.html#SR 7> Security Issues references: * CVE-2013-6629 <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2013-6629> * CVE-2013-6954 <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2013-6954> * CVE-2014-0429 <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-0429> * CVE-2014-0446 <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-0446> * CVE-2014-0448 <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-0448> * CVE-2014-0449 <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-0449> * CVE-2014-0451 <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-0451> * CVE-2014-0452 <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-0452> * CVE-2014-0457 <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-0457> * CVE-2014-0458 <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-0458> * CVE-2014-0459 <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-0459> * CVE-2014-0460 <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-0460> * CVE-2014-0461 <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-0461> * CVE-2014-1876 <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-1876> * CVE-2014-2398 <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-2398> * CVE-2014-2401 <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-2401> * CVE-2014-2402 <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-2402> * CVE-2014-2409 <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-2409> * CVE-2014-2412 <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-2412> * CVE-2014-2414 <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-2414> * CVE-2014-2420 <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-2420> * CVE-2014-2421 <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-2421> * CVE-2014-2423 <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-2423> * CVE-2014-2427 <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-2427> * CVE-2014-2428 <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-2428> * CVE-2014-0455 <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-0455> * CVE-2014-0428 <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-0428> * CVE-2014-0453 <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-0453> * CVE-2014-0454 <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-0454> * CVE-2014-0878 <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-0878> Patch Instructions: To install this SUSE Security Update use YaST online_update. Alternatively you can run the command listed for your product: - SUSE Linux Enterprise Software Development Kit 11 SP3: zypper in -t patch sdksp3-java-1_7_0-ibm-9263 - SUSE Linux Enterprise Server 11 SP3 for VMware: zypper in -t patch slessp3-java-1_7_0-ibm-9263 - SUSE Linux Enterprise Server 11 SP3: zypper in -t patch slessp3-java-1_7_0-ibm-9263 - SUSE Linux Enterprise Java 11 SP3: zypper in -t patch slejsp3-java-1_7_0-ibm-9263 To bring your system up-to-date, use "zypper patch". Package List: - SUSE Linux Enterprise Software Development Kit 11 SP3 (i586 ppc64 s390x x86_64): java-1_7_0-ibm-devel-1.7.0_sr7.0-0.5.1 - SUSE Linux Enterprise Server 11 SP3 for VMware (i586 x86_64): java-1_7_0-ibm-1.7.0_sr7.0-0.5.1 java-1_7_0-ibm-alsa-1.7.0_sr7.0-0.5.1 java-1_7_0-ibm-jdbc-1.7.0_sr7.0-0.5.1 java-1_7_0-ibm-plugin-1.7.0_sr7.0-0.5.1 - SUSE Linux Enterprise Server 11 SP3 (i586 ppc64 s390x x86_64): java-1_7_0-ibm-1.7.0_sr7.0-0.5.1 java-1_7_0-ibm-jdbc-1.7.0_sr7.0-0.5.1 - SUSE Linux Enterprise Server 11 SP3 (i586 x86_64): java-1_7_0-ibm-alsa-1.7.0_sr7.0-0.5.1 java-1_7_0-ibm-plugin-1.7.0_sr7.0-0.5.1 - SUSE Linux Enterprise Java 11 SP3 (i586 ppc64 s390x x86_64): java-1_7_0-ibm-1.7.0_sr7.0-0.5.1 java-1_7_0-ibm-devel-1.7.0_sr7.0-0.5.1 java-1_7_0-ibm-jdbc-1.7.0_sr7.0-0.5.1 - SUSE Linux Enterprise Java 11 SP3 (i586 x86_64): java-1_7_0-ibm-alsa-1.7.0_sr7.0-0.5.1 java-1_7_0-ibm-plugin-1.7.0_sr7.0-0.5.1 References: http://support.novell.com/security/cve/CVE-2013-6629.html http://support.novell.com/security/cve/CVE-2013-6954.html http://support.novell.com/security/cve/CVE-2014-0428.html http://support.novell.com/security/cve/CVE-2014-0429.html http://support.novell.com/security/cve/CVE-2014-0446.html http://support.novell.com/security/cve/CVE-2014-0448.html http://support.novell.com/security/cve/CVE-2014-0449.html http://support.novell.com/security/cve/CVE-2014-0451.html http://support.novell.com/security/cve/CVE-2014-0452.html http://support.novell.com/security/cve/CVE-2014-0453.html http://support.novell.com/security/cve/CVE-2014-0454.html http://support.novell.com/security/cve/CVE-2014-0455.html http://support.novell.com/security/cve/CVE-2014-0457.html http://support.novell.com/security/cve/CVE-2014-0458.html http://support.novell.com/security/cve/CVE-2014-0459.html http://support.novell.com/security/cve/CVE-2014-0460.html http://support.novell.com/security/cve/CVE-2014-0461.html http://support.novell.com/security/cve/CVE-2014-0878.html http://support.novell.com/security/cve/CVE-2014-1876.html http://support.novell.com/security/cve/CVE-2014-2398.html http://support.novell.com/security/cve/CVE-2014-2401.html http://support.novell.com/security/cve/CVE-2014-2402.html http://support.novell.com/security/cve/CVE-2014-2409.html http://support.novell.com/security/cve/CVE-2014-2412.html http://support.novell.com/security/cve/CVE-2014-2414.html http://support.novell.com/security/cve/CVE-2014-2420.html http://support.novell.com/security/cve/CVE-2014-2421.html http://support.novell.com/security/cve/CVE-2014-2423.html http://support.novell.com/security/cve/CVE-2014-2427.html http://support.novell.com/security/cve/CVE-2014-2428.html https://bugzilla.novell.com/877429 http://download.suse.com/patch/finder/?keywords=17742af872c505eb5cddf057e92… -- To unsubscribe, e-mail: opensuse-security-announce+unsubscribe(a)opensuse.org For additional commands, e-mail: opensuse-security-announce+help(a)opensuse.org

1 0