August 2014 - openSUSE Security Announce

[security-announce] SUSE-SU-2014:1072-1: important: Security update for MySQL
by opensuse-security＠opensuse.org 28 Aug '14

28 Aug '14

SUSE Security Update: Security update for MySQL ______________________________________________________________________________ Announcement ID: SUSE-SU-2014:1072-1 Rating: important References: #887580 Cross-References: CVE-2014-2484 CVE-2014-2494 CVE-2014-4207 CVE-2014-4214 CVE-2014-4233 CVE-2014-4238 CVE-2014-4240 CVE-2014-4243 CVE-2014-4258 CVE-2014-4260 Affected Products: SUSE Linux Enterprise Software Development Kit 11 SP3 SUSE Linux Enterprise Server 11 SP3 for VMware SUSE Linux Enterprise Server 11 SP3 SUSE Linux Enterprise Desktop 11 SP3 ______________________________________________________________________________ An update that fixes 10 vulnerabilities is now available. It includes one version update. Description: This MySQL update provides the following: * upgrade to version 5.5.39, [bnc#887580] * CVE's fixed: CVE-2014-2484, CVE-2014-4258, CVE-2014-4260, CVE-2014-2494, CVE-2014-4238, CVE-2014-4207, CVE-2014-4233, CVE-2014-4240, CVE-2014-4214, CVE-2014-4243 See also: http://www.oracle.com/technetwork/topics/security/cpujul2014-1972956.html <http://www.oracle.com/technetwork/topics/security/cpujul2014-1972956.html> Security Issues: * CVE-2014-2484 <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-2484> * CVE-2014-4258 <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-4258> * CVE-2014-4260 <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-4260> * CVE-2014-2494 <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-2494> * CVE-2014-4238 <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-4238> * CVE-2014-4207 <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-4207> * CVE-2014-4233 <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-4233> * CVE-2014-4240 <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-4240> * CVE-2014-4214 <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-4214> * CVE-2014-4243 <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-4243> Patch Instructions: To install this SUSE Security Update use YaST online_update. Alternatively you can run the command listed for your product: - SUSE Linux Enterprise Software Development Kit 11 SP3: zypper in -t patch sdksp3-libmysql55client18-9624 - SUSE Linux Enterprise Server 11 SP3 for VMware: zypper in -t patch slessp3-libmysql55client18-9624 - SUSE Linux Enterprise Server 11 SP3: zypper in -t patch slessp3-libmysql55client18-9624 - SUSE Linux Enterprise Desktop 11 SP3: zypper in -t patch sledsp3-libmysql55client18-9624 To bring your system up-to-date, use "zypper patch". Package List: - SUSE Linux Enterprise Software Development Kit 11 SP3 (ppc64 s390x x86_64): libmysql55client_r18-32bit-5.5.39-0.7.1 libmysqlclient_r15-32bit-5.0.96-0.6.13 - SUSE Linux Enterprise Software Development Kit 11 SP3 (ia64): libmysql55client_r18-x86-5.5.39-0.7.1 libmysqlclient_r15-x86-5.0.96-0.6.13 - SUSE Linux Enterprise Server 11 SP3 for VMware (i586 x86_64) [New Version: 5.5.39]: libmysql55client18-5.5.39-0.7.1 libmysql55client_r18-5.5.39-0.7.1 libmysqlclient15-5.0.96-0.6.13 libmysqlclient_r15-5.0.96-0.6.13 mysql-5.5.39-0.7.1 mysql-client-5.5.39-0.7.1 mysql-tools-5.5.39-0.7.1 - SUSE Linux Enterprise Server 11 SP3 for VMware (x86_64) [New Version: 5.5.39]: libmysql55client18-32bit-5.5.39-0.7.1 libmysqlclient15-32bit-5.0.96-0.6.13 - SUSE Linux Enterprise Server 11 SP3 (i586 ia64 ppc64 s390x x86_64) [New Version: 5.5.39]: libmysql55client18-5.5.39-0.7.1 libmysql55client_r18-5.5.39-0.7.1 libmysqlclient15-5.0.96-0.6.13 libmysqlclient_r15-5.0.96-0.6.13 mysql-5.5.39-0.7.1 mysql-client-5.5.39-0.7.1 mysql-tools-5.5.39-0.7.1 - SUSE Linux Enterprise Server 11 SP3 (ppc64 s390x x86_64) [New Version: 5.5.39]: libmysql55client18-32bit-5.5.39-0.7.1 libmysqlclient15-32bit-5.0.96-0.6.13 - SUSE Linux Enterprise Server 11 SP3 (ia64) [New Version: 5.5.39]: libmysql55client18-x86-5.5.39-0.7.1 libmysqlclient15-x86-5.0.96-0.6.13 - SUSE Linux Enterprise Desktop 11 SP3 (i586 x86_64) [New Version: 5.5.39]: libmysql55client18-5.5.39-0.7.1 libmysql55client_r18-5.5.39-0.7.1 libmysqlclient15-5.0.96-0.6.13 libmysqlclient_r15-5.0.96-0.6.13 mysql-5.5.39-0.7.1 mysql-client-5.5.39-0.7.1 - SUSE Linux Enterprise Desktop 11 SP3 (x86_64) [New Version: 5.5.39]: libmysql55client18-32bit-5.5.39-0.7.1 libmysql55client_r18-32bit-5.5.39-0.7.1 libmysqlclient15-32bit-5.0.96-0.6.13 libmysqlclient_r15-32bit-5.0.96-0.6.13 References: http://support.novell.com/security/cve/CVE-2014-2484.html http://support.novell.com/security/cve/CVE-2014-2494.html http://support.novell.com/security/cve/CVE-2014-4207.html http://support.novell.com/security/cve/CVE-2014-4214.html http://support.novell.com/security/cve/CVE-2014-4233.html http://support.novell.com/security/cve/CVE-2014-4238.html http://support.novell.com/security/cve/CVE-2014-4240.html http://support.novell.com/security/cve/CVE-2014-4243.html http://support.novell.com/security/cve/CVE-2014-4258.html http://support.novell.com/security/cve/CVE-2014-4260.html https://bugzilla.novell.com/887580 http://download.suse.com/patch/finder/?keywords=8b3fd18dd93c87bd6dd0292986f… -- To unsubscribe, e-mail: opensuse-security-announce+unsubscribe(a)opensuse.org For additional commands, e-mail: opensuse-security-announce+help(a)opensuse.org

1 0

[security-announce] SUSE-SU-2014:1035-1: important: Security update for flash-player
by opensuse-security＠opensuse.org 18 Aug '14

18 Aug '14

SUSE Security Update: Security update for flash-player ______________________________________________________________________________ Announcement ID: SUSE-SU-2014:1035-1 Rating: important References: #891688 Cross-References: CVE-2014-0538 CVE-2014-0540 CVE-2014-0541 CVE-2014-0542 CVE-2014-0543 CVE-2014-0544 CVE-2014-0545 Affected Products: SUSE Linux Enterprise Desktop 11 SP3 ______________________________________________________________________________ An update that fixes 7 vulnerabilities is now available. It includes one version update. Description: This flash-player update fixes the following security issues: * These updates resolve memory leakage vulnerabilities that could have been used to bypass memory address randomization (CVE-2014-0540, CVE-2014-0542, CVE-2014-0543, CVE-2014-0544, CVE-2014-0545). * These updates resolve a security bypass vulnerability (CVE-2014-0541). * These updates resolve a use-after-free vulnerability that could have lead to code execution (CVE-2014-0538). Find more details under http://helpx.adobe.com/security/products/flash-player/apsb14-18.html <http://helpx.adobe.com/security/products/flash-player/apsb14-18.html> Security Issues: * CVE-2014-0538 <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-0538> * CVE-2014-0540 <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-0540> * CVE-2014-0541 <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-0541> * CVE-2014-0542 <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-0542> * CVE-2014-0543 <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-0543> * CVE-2014-0544 <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-0544> * CVE-2014-0545 <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-0545> Patch Instructions: To install this SUSE Security Update use YaST online_update. Alternatively you can run the command listed for your product: - SUSE Linux Enterprise Desktop 11 SP3: zypper in -t patch sledsp3-flash-player-9612 To bring your system up-to-date, use "zypper patch". Package List: - SUSE Linux Enterprise Desktop 11 SP3 (i586 x86_64) [New Version: 11.2.202.400]: flash-player-11.2.202.400-0.3.1 flash-player-gnome-11.2.202.400-0.3.1 flash-player-kde4-11.2.202.400-0.3.1 References: http://support.novell.com/security/cve/CVE-2014-0538.html http://support.novell.com/security/cve/CVE-2014-0540.html http://support.novell.com/security/cve/CVE-2014-0541.html http://support.novell.com/security/cve/CVE-2014-0542.html http://support.novell.com/security/cve/CVE-2014-0543.html http://support.novell.com/security/cve/CVE-2014-0544.html http://support.novell.com/security/cve/CVE-2014-0545.html https://bugzilla.novell.com/891688 http://download.suse.com/patch/finder/?keywords=45b3cfc443642a9e3f85e156ff8… -- To unsubscribe, e-mail: opensuse-security-announce+unsubscribe(a)opensuse.org For additional commands, e-mail: opensuse-security-announce+help(a)opensuse.org

1 0

[security-announce] openSUSE-SU-2014:1029-1: critical: update for flash-player
by opensuse-security＠opensuse.org 16 Aug '14

16 Aug '14

openSUSE Security Update: update for flash-player ______________________________________________________________________________ Announcement ID: openSUSE-SU-2014:1029-1 Rating: critical References: #891688 Cross-References: CVE-2014-0538 CVE-2014-0540 CVE-2014-0541 CVE-2014-0542 CVE-2014-0543 CVE-2014-0544 CVE-2014-0545 Affected Products: openSUSE 11.4 ______________________________________________________________________________ An update that fixes 7 vulnerabilities is now available. Description: This critical flash-player update fixes the following CVEs: - Security update to 11.2.202.400 (bnc#891688): * APSB14-18, CVE-2014-0538, CVE-2014-0540, CVE-2014-0541, CVE-2014-0542, CVE-2014-0543, CVE-2014-0544, CVE-2014-0545 Patch Instructions: To install this openSUSE Security Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE 11.4: zypper in -t patch 2014-75 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE 11.4 (i586 x86_64): flash-player-11.2.202.400-123.1 flash-player-gnome-11.2.202.400-123.1 flash-player-kde4-11.2.202.400-123.1 References: http://support.novell.com/security/cve/CVE-2014-0538.html http://support.novell.com/security/cve/CVE-2014-0540.html http://support.novell.com/security/cve/CVE-2014-0541.html http://support.novell.com/security/cve/CVE-2014-0542.html http://support.novell.com/security/cve/CVE-2014-0543.html http://support.novell.com/security/cve/CVE-2014-0544.html http://support.novell.com/security/cve/CVE-2014-0545.html https://bugzilla.novell.com/891688 -- To unsubscribe, e-mail: opensuse-security-announce+unsubscribe(a)opensuse.org For additional commands, e-mail: opensuse-security-announce+help(a)opensuse.org

1 0

[security-announce] SUSE-SU-2014:1028-1: important: Security update for krb5
by opensuse-security＠opensuse.org 15 Aug '14

15 Aug '14

SUSE Security Update: Security update for krb5 ______________________________________________________________________________ Announcement ID: SUSE-SU-2014:1028-1 Rating: important References: #891082 Cross-References: CVE-2014-4345 Affected Products: SUSE Linux Enterprise Software Development Kit 11 SP3 SUSE Linux Enterprise Server 11 SP3 for VMware SUSE Linux Enterprise Server 11 SP3 SUSE Linux Enterprise Desktop 11 SP3 ______________________________________________________________________________ An update that fixes one vulnerability is now available. Description: This MIT krb5 update fixes a buffer overrun problem in kadmind: * bnc#891082: buffer overrun in kadmind with LDAP back end (MITKRB5-SA-2014-001) (CVE-2014-4345) MIT krb5 Security Advisory 2014-001 * http://web.mit.edu/kerberos/advisories/MITKRB5-SA-2014-001.txt Security Issues: * CVE-2014-4345 <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-4345> Patch Instructions: To install this SUSE Security Update use YaST online_update. Alternatively you can run the command listed for your product: - SUSE Linux Enterprise Software Development Kit 11 SP3: zypper in -t patch sdksp3-krb5-9606 - SUSE Linux Enterprise Server 11 SP3 for VMware: zypper in -t patch slessp3-krb5-9606 - SUSE Linux Enterprise Server 11 SP3: zypper in -t patch slessp3-krb5-9606 - SUSE Linux Enterprise Desktop 11 SP3: zypper in -t patch sledsp3-krb5-9606 To bring your system up-to-date, use "zypper patch". Package List: - SUSE Linux Enterprise Software Development Kit 11 SP3 (i586 ia64 ppc64 s390x x86_64): krb5-devel-1.6.3-133.49.62.1 - SUSE Linux Enterprise Software Development Kit 11 SP3 (ppc64 s390x x86_64): krb5-devel-32bit-1.6.3-133.49.62.1 - SUSE Linux Enterprise Software Development Kit 11 SP3 (i586 x86_64): krb5-server-1.6.3-133.49.62.1 - SUSE Linux Enterprise Server 11 SP3 for VMware (i586 x86_64): krb5-1.6.3-133.49.62.1 krb5-apps-clients-1.6.3-133.49.62.1 krb5-apps-servers-1.6.3-133.49.62.1 krb5-client-1.6.3-133.49.62.1 krb5-plugin-kdb-ldap-1.6.3-133.49.62.1 krb5-plugin-preauth-pkinit-1.6.3-133.49.62.1 krb5-server-1.6.3-133.49.62.1 - SUSE Linux Enterprise Server 11 SP3 for VMware (x86_64): krb5-32bit-1.6.3-133.49.62.1 - SUSE Linux Enterprise Server 11 SP3 for VMware (noarch): krb5-doc-1.6.3-133.49.62.1 - SUSE Linux Enterprise Server 11 SP3 (i586 ia64 ppc64 s390x x86_64): krb5-1.6.3-133.49.62.1 krb5-apps-clients-1.6.3-133.49.62.1 krb5-apps-servers-1.6.3-133.49.62.1 krb5-client-1.6.3-133.49.62.1 krb5-plugin-kdb-ldap-1.6.3-133.49.62.1 krb5-plugin-preauth-pkinit-1.6.3-133.49.62.1 krb5-server-1.6.3-133.49.62.1 - SUSE Linux Enterprise Server 11 SP3 (ppc64 s390x x86_64): krb5-32bit-1.6.3-133.49.62.1 - SUSE Linux Enterprise Server 11 SP3 (noarch): krb5-doc-1.6.3-133.49.62.1 - SUSE Linux Enterprise Server 11 SP3 (ia64): krb5-x86-1.6.3-133.49.62.1 - SUSE Linux Enterprise Desktop 11 SP3 (i586 x86_64): krb5-1.6.3-133.49.62.1 krb5-client-1.6.3-133.49.62.1 - SUSE Linux Enterprise Desktop 11 SP3 (x86_64): krb5-32bit-1.6.3-133.49.62.1 References: http://support.novell.com/security/cve/CVE-2014-4345.html https://bugzilla.novell.com/891082 http://download.suse.com/patch/finder/?keywords=6d08c2f838c570a86cddae30d26… -- To unsubscribe, e-mail: opensuse-security-announce+unsubscribe(a)opensuse.org For additional commands, e-mail: opensuse-security-announce+help(a)opensuse.org

1 0

[security-announce] openSUSE-SU-2014:1020-1: critical: update for flash-player
by opensuse-security＠opensuse.org 14 Aug '14

14 Aug '14

openSUSE Security Update: update for flash-player ______________________________________________________________________________ Announcement ID: openSUSE-SU-2014:1020-1 Rating: critical References: #891688 Cross-References: CVE-2014-0538 CVE-2014-0540 CVE-2014-0541 CVE-2014-0542 CVE-2014-0543 CVE-2014-0544 CVE-2014-0545 Affected Products: openSUSE 13.1:NonFree openSUSE 12.3:NonFree ______________________________________________________________________________ An update that fixes 7 vulnerabilities is now available. Description: This critical flash-player update fixes the following CVEs: - Security update to 11.2.202.400 (bnc#891688): * APSB14-18, CVE-2014-0538, CVE-2014-0540, CVE-2014-0541, CVE-2014-0542, CVE-2014-0543, CVE-2014-0544, CVE-2014-0545 Patch Instructions: To install this openSUSE Security Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE 13.1:NonFree: zypper in -t patch openSUSE-2014-494 - openSUSE 12.3:NonFree: zypper in -t patch openSUSE-2014-494 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE 13.1:NonFree (i586 x86_64): flash-player-11.2.202.400-62.1 flash-player-gnome-11.2.202.400-62.1 flash-player-kde4-11.2.202.400-62.1 - openSUSE 12.3:NonFree (i586 x86_64): flash-player-11.2.202.400-2.88.1 flash-player-gnome-11.2.202.400-2.88.1 flash-player-kde4-11.2.202.400-2.88.1 References: http://support.novell.com/security/cve/CVE-2014-0538.html http://support.novell.com/security/cve/CVE-2014-0540.html http://support.novell.com/security/cve/CVE-2014-0541.html http://support.novell.com/security/cve/CVE-2014-0542.html http://support.novell.com/security/cve/CVE-2014-0543.html http://support.novell.com/security/cve/CVE-2014-0544.html http://support.novell.com/security/cve/CVE-2014-0545.html https://bugzilla.novell.com/891688 -- To unsubscribe, e-mail: opensuse-security-announce+unsubscribe(a)opensuse.org For additional commands, e-mail: opensuse-security-announce+help(a)opensuse.org

1 0

[security-announce] openSUSE-SU-2014:0985-1: important: kernel: security and bugfix update
by opensuse-security＠opensuse.org 11 Aug '14

11 Aug '14

openSUSE Security Update: kernel: security and bugfix update ______________________________________________________________________________ Announcement ID: openSUSE-SU-2014:0985-1 Rating: important References: #768714 #851686 #855657 #866101 #867531 #867723 #879071 #880484 #882189 #883518 #883724 #883795 #884840 #885422 #885725 #886629 Cross-References: CVE-2014-0100 CVE-2014-0131 CVE-2014-2309 CVE-2014-3917 CVE-2014-4014 CVE-2014-4171 CVE-2014-4508 CVE-2014-4652 CVE-2014-4653 CVE-2014-4654 CVE-2014-4655 CVE-2014-4656 CVE-2014-4667 CVE-2014-4699 Affected Products: openSUSE 13.1 ______________________________________________________________________________ An update that solves 14 vulnerabilities and has two fixes is now available. Description: The Linux kernel was updated to fix security issues and bugs: Security issues fixed: CVE-2014-4699: The Linux kernel on Intel processors did not properly restrict use of a non-canonical value for the saved RIP address in the case of a system call that does not use IRET, which allowed local users to leverage a race condition and gain privileges, or cause a denial of service (double fault), via a crafted application that makes ptrace and fork system calls. CVE-2014-4667: The sctp_association_free function in net/sctp/associola.c in the Linux kernel did not properly manage a certain backlog value, which allowed remote attackers to cause a denial of service (socket outage) via a crafted SCTP packet. CVE-2014-4171: mm/shmem.c in the Linux kernel did not properly implement the interaction between range notification and hole punching, which allowed local users to cause a denial of service (i_mutex hold) by using the mmap system call to access a hole, as demonstrated by interfering with intended shmem activity by blocking completion of (1) an MADV_REMOVE madvise call or (2) an FALLOC_FL_PUNCH_HOLE fallocate call. CVE-2014-4508: arch/x86/kernel/entry_32.S in the Linux kernel on 32-bit x86 platforms, when syscall auditing is enabled and the sep CPU feature flag is set, allowed local users to cause a denial of service (OOPS and system crash) via an invalid syscall number, as demonstrated by number 1000. CVE-2014-0100: Race condition in the inet_frag_intern function in net/ipv4/inet_fragment.c in the Linux kernel allowed remote attackers to cause a denial of service (use-after-free error) or possibly have unspecified other impact via a large series of fragmented ICMP Echo Request packets to a system with a heavy CPU load. CVE-2014-4656: Multiple integer overflows in sound/core/control.c in the ALSA control implementation in the Linux kernel allowed local users to cause a denial of service by leveraging /dev/snd/controlCX access, related to (1) index values in the snd_ctl_add function and (2) numid values in the snd_ctl_remove_numid_conflict function. CVE-2014-4655: The snd_ctl_elem_add function in sound/core/control.c in the ALSA control implementation in the Linux kernel did not properly maintain the user_ctl_count value, which allowed local users to cause a denial of service (integer overflow and limit bypass) by leveraging /dev/snd/controlCX access for a large number of SNDRV_CTL_IOCTL_ELEM_REPLACE ioctl calls. CVE-2014-4654: The snd_ctl_elem_add function in sound/core/control.c in the ALSA control implementation in the Linux kernel did not check authorization for SNDRV_CTL_IOCTL_ELEM_REPLACE commands, which allowed local users to remove kernel controls and cause a denial of service (use-after-free and system crash) by leveraging /dev/snd/controlCX access for an ioctl call. CVE-2014-4653: sound/core/control.c in the ALSA control implementation in the Linux kernel did not ensure possession of a read/write lock, which allowed local users to cause a denial of service (use-after-free) and obtain sensitive information from kernel memory by leveraging /dev/snd/controlCX access. CVE-2014-4652: Race condition in the tlv handler functionality in the snd_ctl_elem_user_tlv function in sound/core/control.c in the ALSA control implementation in the Linux kernel allowed local users to obtain sensitive information from kernel memory by leveraging /dev/snd/controlCX access. CVE-2014-4014: The capabilities implementation in the Linux kernel did not properly consider that namespaces are inapplicable to inodes, which allowed local users to bypass intended chmod restrictions by first creating a user namespace, as demonstrated by setting the setgid bit on a file with group ownership of root. CVE-2014-2309: The ip6_route_add function in net/ipv6/route.c in the Linux kernel did not properly count the addition of routes, which allowed remote attackers to cause a denial of service (memory consumption) via a flood of ICMPv6 Router Advertisement packets. CVE-2014-3917: kernel/auditsc.c in the Linux kernel, when CONFIG_AUDITSYSCALL is enabled with certain syscall rules, allowed local users to obtain potentially sensitive single-bit values from kernel memory or cause a denial of service (OOPS) via a large value of a syscall number. CVE-2014-0131: Use-after-free vulnerability in the skb_segment function in net/core/skbuff.c in the Linux kernel allowed attackers to obtain sensitive information from kernel memory by leveraging the absence of a certain orphaning operation. Bugs fixed: - Don't trigger congestion wait on dirty-but-not-writeout pages (bnc#879071). - via-velocity: fix netif_receive_skb use in irq disabled section (bnc#851686). - HID: logitech-dj: Fix USB 3.0 issue (bnc#886629). - tg3: Change nvram command timeout value to 50ms (bnc#768714 bnc#855657). - tg3: Override clock, link aware and link idle mode during NVRAM dump (bnc#768714 bnc#855657). - tg3: Set the MAC clock to the fastest speed during boot code load (bnc#768714 bnc#855657). - ALSA: usb-audio: Fix deadlocks at resuming (bnc#884840). - ALSA: usb-audio: Save mixer status only once at suspend (bnc#884840). - ALSA: usb-audio: Resume mixer values properly (bnc#884840). Patch Instructions: To install this openSUSE Security Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE 13.1: zypper in -t patch openSUSE-2014-493 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE 13.1 (i686 x86_64): kernel-debug-3.11.10-21.1 kernel-debug-base-3.11.10-21.1 kernel-debug-base-debuginfo-3.11.10-21.1 kernel-debug-debuginfo-3.11.10-21.1 kernel-debug-debugsource-3.11.10-21.1 kernel-debug-devel-3.11.10-21.1 kernel-debug-devel-debuginfo-3.11.10-21.1 kernel-desktop-3.11.10-21.1 kernel-desktop-base-3.11.10-21.1 kernel-desktop-base-debuginfo-3.11.10-21.1 kernel-desktop-debuginfo-3.11.10-21.1 kernel-desktop-debugsource-3.11.10-21.1 kernel-desktop-devel-3.11.10-21.1 kernel-desktop-devel-debuginfo-3.11.10-21.1 kernel-ec2-3.11.10-21.1 kernel-ec2-base-3.11.10-21.1 kernel-ec2-base-debuginfo-3.11.10-21.1 kernel-ec2-debuginfo-3.11.10-21.1 kernel-ec2-debugsource-3.11.10-21.1 kernel-ec2-devel-3.11.10-21.1 kernel-ec2-devel-debuginfo-3.11.10-21.1 kernel-trace-3.11.10-21.1 kernel-trace-base-3.11.10-21.1 kernel-trace-base-debuginfo-3.11.10-21.1 kernel-trace-debuginfo-3.11.10-21.1 kernel-trace-debugsource-3.11.10-21.1 kernel-trace-devel-3.11.10-21.1 kernel-trace-devel-debuginfo-3.11.10-21.1 kernel-vanilla-3.11.10-21.1 kernel-vanilla-debuginfo-3.11.10-21.1 kernel-vanilla-debugsource-3.11.10-21.1 kernel-vanilla-devel-3.11.10-21.1 kernel-vanilla-devel-debuginfo-3.11.10-21.1 kernel-xen-3.11.10-21.1 kernel-xen-base-3.11.10-21.1 kernel-xen-base-debuginfo-3.11.10-21.1 kernel-xen-debuginfo-3.11.10-21.1 kernel-xen-debugsource-3.11.10-21.1 kernel-xen-devel-3.11.10-21.1 kernel-xen-devel-debuginfo-3.11.10-21.1 - openSUSE 13.1 (i586 x86_64): cloop-2.639-11.13.1 cloop-debuginfo-2.639-11.13.1 cloop-debugsource-2.639-11.13.1 cloop-kmp-default-2.639_k3.11.10_21-11.13.1 cloop-kmp-default-debuginfo-2.639_k3.11.10_21-11.13.1 cloop-kmp-desktop-2.639_k3.11.10_21-11.13.1 cloop-kmp-desktop-debuginfo-2.639_k3.11.10_21-11.13.1 cloop-kmp-xen-2.639_k3.11.10_21-11.13.1 cloop-kmp-xen-debuginfo-2.639_k3.11.10_21-11.13.1 crash-7.0.2-2.13.1 crash-debuginfo-7.0.2-2.13.1 crash-debugsource-7.0.2-2.13.1 crash-devel-7.0.2-2.13.1 crash-doc-7.0.2-2.13.1 crash-eppic-7.0.2-2.13.1 crash-eppic-debuginfo-7.0.2-2.13.1 crash-gcore-7.0.2-2.13.1 crash-gcore-debuginfo-7.0.2-2.13.1 crash-kmp-default-7.0.2_k3.11.10_21-2.13.1 crash-kmp-default-debuginfo-7.0.2_k3.11.10_21-2.13.1 crash-kmp-desktop-7.0.2_k3.11.10_21-2.13.1 crash-kmp-desktop-debuginfo-7.0.2_k3.11.10_21-2.13.1 crash-kmp-xen-7.0.2_k3.11.10_21-2.13.1 crash-kmp-xen-debuginfo-7.0.2_k3.11.10_21-2.13.1 hdjmod-debugsource-1.28-16.13.1 hdjmod-kmp-default-1.28_k3.11.10_21-16.13.1 hdjmod-kmp-default-debuginfo-1.28_k3.11.10_21-16.13.1 hdjmod-kmp-desktop-1.28_k3.11.10_21-16.13.1 hdjmod-kmp-desktop-debuginfo-1.28_k3.11.10_21-16.13.1 hdjmod-kmp-xen-1.28_k3.11.10_21-16.13.1 hdjmod-kmp-xen-debuginfo-1.28_k3.11.10_21-16.13.1 ipset-6.21.1-2.17.1 ipset-debuginfo-6.21.1-2.17.1 ipset-debugsource-6.21.1-2.17.1 ipset-devel-6.21.1-2.17.1 ipset-kmp-default-6.21.1_k3.11.10_21-2.17.1 ipset-kmp-default-debuginfo-6.21.1_k3.11.10_21-2.17.1 ipset-kmp-desktop-6.21.1_k3.11.10_21-2.17.1 ipset-kmp-desktop-debuginfo-6.21.1_k3.11.10_21-2.17.1 ipset-kmp-xen-6.21.1_k3.11.10_21-2.17.1 ipset-kmp-xen-debuginfo-6.21.1_k3.11.10_21-2.17.1 iscsitarget-1.4.20.3-13.13.1 iscsitarget-debuginfo-1.4.20.3-13.13.1 iscsitarget-debugsource-1.4.20.3-13.13.1 iscsitarget-kmp-default-1.4.20.3_k3.11.10_21-13.13.1 iscsitarget-kmp-default-debuginfo-1.4.20.3_k3.11.10_21-13.13.1 iscsitarget-kmp-desktop-1.4.20.3_k3.11.10_21-13.13.1 iscsitarget-kmp-desktop-debuginfo-1.4.20.3_k3.11.10_21-13.13.1 iscsitarget-kmp-xen-1.4.20.3_k3.11.10_21-13.13.1 iscsitarget-kmp-xen-debuginfo-1.4.20.3_k3.11.10_21-13.13.1 kernel-default-3.11.10-21.1 kernel-default-base-3.11.10-21.1 kernel-default-base-debuginfo-3.11.10-21.1 kernel-default-debuginfo-3.11.10-21.1 kernel-default-debugsource-3.11.10-21.1 kernel-default-devel-3.11.10-21.1 kernel-default-devel-debuginfo-3.11.10-21.1 kernel-syms-3.11.10-21.1 libipset3-6.21.1-2.17.1 libipset3-debuginfo-6.21.1-2.17.1 ndiswrapper-1.58-13.1 ndiswrapper-debuginfo-1.58-13.1 ndiswrapper-debugsource-1.58-13.1 ndiswrapper-kmp-default-1.58_k3.11.10_21-13.1 ndiswrapper-kmp-default-debuginfo-1.58_k3.11.10_21-13.1 ndiswrapper-kmp-desktop-1.58_k3.11.10_21-13.1 ndiswrapper-kmp-desktop-debuginfo-1.58_k3.11.10_21-13.1 pcfclock-0.44-258.13.1 pcfclock-debuginfo-0.44-258.13.1 pcfclock-debugsource-0.44-258.13.1 pcfclock-kmp-default-0.44_k3.11.10_21-258.13.1 pcfclock-kmp-default-debuginfo-0.44_k3.11.10_21-258.13.1 pcfclock-kmp-desktop-0.44_k3.11.10_21-258.13.1 pcfclock-kmp-desktop-debuginfo-0.44_k3.11.10_21-258.13.1 python-virtualbox-4.2.18-2.18.1 python-virtualbox-debuginfo-4.2.18-2.18.1 vhba-kmp-debugsource-20130607-2.14.1 vhba-kmp-default-20130607_k3.11.10_21-2.14.1 vhba-kmp-default-debuginfo-20130607_k3.11.10_21-2.14.1 vhba-kmp-desktop-20130607_k3.11.10_21-2.14.1 vhba-kmp-desktop-debuginfo-20130607_k3.11.10_21-2.14.1 vhba-kmp-xen-20130607_k3.11.10_21-2.14.1 vhba-kmp-xen-debuginfo-20130607_k3.11.10_21-2.14.1 virtualbox-4.2.18-2.18.1 virtualbox-debuginfo-4.2.18-2.18.1 virtualbox-debugsource-4.2.18-2.18.1 virtualbox-devel-4.2.18-2.18.1 virtualbox-guest-kmp-default-4.2.18_k3.11.10_21-2.18.1 virtualbox-guest-kmp-default-debuginfo-4.2.18_k3.11.10_21-2.18.1 virtualbox-guest-kmp-desktop-4.2.18_k3.11.10_21-2.18.1 virtualbox-guest-kmp-desktop-debuginfo-4.2.18_k3.11.10_21-2.18.1 virtualbox-guest-tools-4.2.18-2.18.1 virtualbox-guest-tools-debuginfo-4.2.18-2.18.1 virtualbox-guest-x11-4.2.18-2.18.1 virtualbox-guest-x11-debuginfo-4.2.18-2.18.1 virtualbox-host-kmp-default-4.2.18_k3.11.10_21-2.18.1 virtualbox-host-kmp-default-debuginfo-4.2.18_k3.11.10_21-2.18.1 virtualbox-host-kmp-desktop-4.2.18_k3.11.10_21-2.18.1 virtualbox-host-kmp-desktop-debuginfo-4.2.18_k3.11.10_21-2.18.1 virtualbox-qt-4.2.18-2.18.1 virtualbox-qt-debuginfo-4.2.18-2.18.1 virtualbox-websrv-4.2.18-2.18.1 virtualbox-websrv-debuginfo-4.2.18-2.18.1 xen-debugsource-4.3.2_01-21.1 xen-devel-4.3.2_01-21.1 xen-kmp-default-4.3.2_01_k3.11.10_21-21.1 xen-kmp-default-debuginfo-4.3.2_01_k3.11.10_21-21.1 xen-kmp-desktop-4.3.2_01_k3.11.10_21-21.1 xen-kmp-desktop-debuginfo-4.3.2_01_k3.11.10_21-21.1 xen-libs-4.3.2_01-21.1 xen-libs-debuginfo-4.3.2_01-21.1 xen-tools-domU-4.3.2_01-21.1 xen-tools-domU-debuginfo-4.3.2_01-21.1 xtables-addons-2.3-2.13.1 xtables-addons-debuginfo-2.3-2.13.1 xtables-addons-debugsource-2.3-2.13.1 xtables-addons-kmp-default-2.3_k3.11.10_21-2.13.1 xtables-addons-kmp-default-debuginfo-2.3_k3.11.10_21-2.13.1 xtables-addons-kmp-desktop-2.3_k3.11.10_21-2.13.1 xtables-addons-kmp-desktop-debuginfo-2.3_k3.11.10_21-2.13.1 xtables-addons-kmp-xen-2.3_k3.11.10_21-2.13.1 xtables-addons-kmp-xen-debuginfo-2.3_k3.11.10_21-2.13.1 - openSUSE 13.1 (noarch): kernel-devel-3.11.10-21.1 kernel-docs-3.11.10-21.3 kernel-source-3.11.10-21.1 kernel-source-vanilla-3.11.10-21.1 - openSUSE 13.1 (x86_64): xen-4.3.2_01-21.1 xen-doc-html-4.3.2_01-21.1 xen-libs-32bit-4.3.2_01-21.1 xen-libs-debuginfo-32bit-4.3.2_01-21.1 xen-tools-4.3.2_01-21.1 xen-tools-debuginfo-4.3.2_01-21.1 xen-xend-tools-4.3.2_01-21.1 xen-xend-tools-debuginfo-4.3.2_01-21.1 - openSUSE 13.1 (i686): kernel-pae-3.11.10-21.1 kernel-pae-base-3.11.10-21.1 kernel-pae-base-debuginfo-3.11.10-21.1 kernel-pae-debuginfo-3.11.10-21.1 kernel-pae-debugsource-3.11.10-21.1 kernel-pae-devel-3.11.10-21.1 kernel-pae-devel-debuginfo-3.11.10-21.1 - openSUSE 13.1 (i586): cloop-kmp-pae-2.639_k3.11.10_21-11.13.1 cloop-kmp-pae-debuginfo-2.639_k3.11.10_21-11.13.1 crash-kmp-pae-7.0.2_k3.11.10_21-2.13.1 crash-kmp-pae-debuginfo-7.0.2_k3.11.10_21-2.13.1 hdjmod-kmp-pae-1.28_k3.11.10_21-16.13.1 hdjmod-kmp-pae-debuginfo-1.28_k3.11.10_21-16.13.1 ipset-kmp-pae-6.21.1_k3.11.10_21-2.17.1 ipset-kmp-pae-debuginfo-6.21.1_k3.11.10_21-2.17.1 iscsitarget-kmp-pae-1.4.20.3_k3.11.10_21-13.13.1 iscsitarget-kmp-pae-debuginfo-1.4.20.3_k3.11.10_21-13.13.1 ndiswrapper-kmp-pae-1.58_k3.11.10_21-13.1 ndiswrapper-kmp-pae-debuginfo-1.58_k3.11.10_21-13.1 pcfclock-kmp-pae-0.44_k3.11.10_21-258.13.1 pcfclock-kmp-pae-debuginfo-0.44_k3.11.10_21-258.13.1 vhba-kmp-pae-20130607_k3.11.10_21-2.14.1 vhba-kmp-pae-debuginfo-20130607_k3.11.10_21-2.14.1 virtualbox-guest-kmp-pae-4.2.18_k3.11.10_21-2.18.1 virtualbox-guest-kmp-pae-debuginfo-4.2.18_k3.11.10_21-2.18.1 virtualbox-host-kmp-pae-4.2.18_k3.11.10_21-2.18.1 virtualbox-host-kmp-pae-debuginfo-4.2.18_k3.11.10_21-2.18.1 xen-kmp-pae-4.3.2_01_k3.11.10_21-21.1 xen-kmp-pae-debuginfo-4.3.2_01_k3.11.10_21-21.1 xtables-addons-kmp-pae-2.3_k3.11.10_21-2.13.1 xtables-addons-kmp-pae-debuginfo-2.3_k3.11.10_21-2.13.1 References: http://support.novell.com/security/cve/CVE-2014-0100.html http://support.novell.com/security/cve/CVE-2014-0131.html http://support.novell.com/security/cve/CVE-2014-2309.html http://support.novell.com/security/cve/CVE-2014-3917.html http://support.novell.com/security/cve/CVE-2014-4014.html http://support.novell.com/security/cve/CVE-2014-4171.html http://support.novell.com/security/cve/CVE-2014-4508.html http://support.novell.com/security/cve/CVE-2014-4652.html http://support.novell.com/security/cve/CVE-2014-4653.html http://support.novell.com/security/cve/CVE-2014-4654.html http://support.novell.com/security/cve/CVE-2014-4655.html http://support.novell.com/security/cve/CVE-2014-4656.html http://support.novell.com/security/cve/CVE-2014-4667.html http://support.novell.com/security/cve/CVE-2014-4699.html https://bugzilla.novell.com/768714 https://bugzilla.novell.com/851686 https://bugzilla.novell.com/855657 https://bugzilla.novell.com/866101 https://bugzilla.novell.com/867531 https://bugzilla.novell.com/867723 https://bugzilla.novell.com/879071 https://bugzilla.novell.com/880484 https://bugzilla.novell.com/882189 https://bugzilla.novell.com/883518 https://bugzilla.novell.com/883724 https://bugzilla.novell.com/883795 https://bugzilla.novell.com/884840 https://bugzilla.novell.com/885422 https://bugzilla.novell.com/885725 https://bugzilla.novell.com/886629 -- To unsubscribe, e-mail: opensuse-security-announce+unsubscribe(a)opensuse.org For additional commands, e-mail: opensuse-security-announce+help(a)opensuse.org

1 0

[security-announce] openSUSE-SU-2014:0982-1: important: chromium: update to 36.0.1985.125
by opensuse-security＠opensuse.org 11 Aug '14

11 Aug '14

openSUSE Security Update: chromium: update to 36.0.1985.125 ______________________________________________________________________________ Announcement ID: openSUSE-SU-2014:0982-1 Rating: important References: #882263 #882264 #882265 #887952 #887955 Cross-References: CVE-2014-3154 CVE-2014-3155 CVE-2014-3156 CVE-2014-3157 CVE-2014-3160 CVE-2014-3162 Affected Products: openSUSE 13.1 openSUSE 12.3 ______________________________________________________________________________ An update that fixes 6 vulnerabilities is now available. Description: Chromium was updated to version 36.0.1985.125. New Functionality: * Rich Notifications Improvements * An Updated Incognito / Guest NTP design * The addition of a Browser crash recovery bubble * Chrome App Launcher for Linux * Lots of under the hood changes for stability and performance Security Fixes (bnc#887952,bnc#887955): * CVE-2014-3160: Same-Origin-Policy bypass in SVG * CVE-2014-3162: Various fixes from internal audits, fuzzing and other initiatives and 24 more fixes for which no description was given. Packaging changes: * Switch to newer method to retrieve toolchain packages. Dropping the three naclsdk_*tgz files. Everything is now included in the toolchain_linux_x86.tar.bz2 tarball * Add Courgette.tar.xz as that the build process now requires some files from Courgette in order to build succesfully. This does not mean that Courgette is build/delivered. Includes also an update to Chromium 35.0.1916.153 Security fixes (bnc#882264,bnc#882264,bnc#882265,bnc#882263): * CVE-2014-3154: Use-after-free in filesystem api * CVE-2014-3155: Out-of-bounds read in SPDY * CVE-2014-3156: Buffer overflow in clipboard * CVE-2014-3157: Heap overflow in media Patch Instructions: To install this openSUSE Security Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE 13.1: zypper in -t patch openSUSE-2014-483 - openSUSE 12.3: zypper in -t patch openSUSE-2014-483 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE 13.1 (i586 x86_64): chromedriver-36.0.1985.125-41.1 chromedriver-debuginfo-36.0.1985.125-41.1 chromium-36.0.1985.125-41.1 chromium-debuginfo-36.0.1985.125-41.1 chromium-debugsource-36.0.1985.125-41.1 chromium-desktop-gnome-36.0.1985.125-41.1 chromium-desktop-kde-36.0.1985.125-41.1 chromium-ffmpegsumo-36.0.1985.125-41.1 chromium-ffmpegsumo-debuginfo-36.0.1985.125-41.1 chromium-suid-helper-36.0.1985.125-41.1 chromium-suid-helper-debuginfo-36.0.1985.125-41.1 - openSUSE 12.3 (i586 x86_64): chromedriver-36.0.1985.125-1.50.1 chromedriver-debuginfo-36.0.1985.125-1.50.1 chromium-36.0.1985.125-1.50.1 chromium-debuginfo-36.0.1985.125-1.50.1 chromium-debugsource-36.0.1985.125-1.50.1 chromium-desktop-gnome-36.0.1985.125-1.50.1 chromium-desktop-kde-36.0.1985.125-1.50.1 chromium-ffmpegsumo-36.0.1985.125-1.50.1 chromium-ffmpegsumo-debuginfo-36.0.1985.125-1.50.1 chromium-suid-helper-36.0.1985.125-1.50.1 chromium-suid-helper-debuginfo-36.0.1985.125-1.50.1 References: http://support.novell.com/security/cve/CVE-2014-3154.html http://support.novell.com/security/cve/CVE-2014-3155.html http://support.novell.com/security/cve/CVE-2014-3156.html http://support.novell.com/security/cve/CVE-2014-3157.html http://support.novell.com/security/cve/CVE-2014-3160.html http://support.novell.com/security/cve/CVE-2014-3162.html https://bugzilla.novell.com/882263 https://bugzilla.novell.com/882264 https://bugzilla.novell.com/882265 https://bugzilla.novell.com/887952 https://bugzilla.novell.com/887955 -- To unsubscribe, e-mail: opensuse-security-announce+unsubscribe(a)opensuse.org For additional commands, e-mail: opensuse-security-announce+help(a)opensuse.org

1 0

[security-announce] openSUSE-SU-2014:0976-1: important: MozillaThunderbird: Update to 24.7.0
by opensuse-security＠opensuse.org 11 Aug '14

11 Aug '14

openSUSE Security Update: MozillaThunderbird: Update to 24.7.0 ______________________________________________________________________________ Announcement ID: openSUSE-SU-2014:0976-1 Rating: important References: #887746 Cross-References: CVE-2014-1544 CVE-2014-1547 CVE-2014-1548 CVE-2014-1555 CVE-2014-1556 CVE-2014-1557 Affected Products: openSUSE 13.1 openSUSE 12.3 ______________________________________________________________________________ An update that fixes 6 vulnerabilities is now available. Description: MozillaThunderbird was updated to Thunderbird 24.7.0 (bnc#887746) * MFSA 2014-56/CVE-2014-1547/CVE-2014-1548 Miscellaneous memory safety hazards * MFSA 2014-61/CVE-2014-1555 (bmo#1023121) Use-after-free with FireOnStateChange event * MFSA 2014-62/CVE-2014-1556 (bmo#1028891) Exploitable WebGL crash with Cesium JavaScript library * MFSA 2014-63/CVE-2014-1544 (bmo#963150) Use-after-free while when manipulating certificates in the trusted cache (solved with NSS 3.16.2 requirement) * MFSA 2014-64/CVE-2014-1557 (bmo#913805) Crash in Skia library when scaling high quality images A standalone enigmail 1.7 package that was previously built as part of MozillaThunderbird was added. Patch Instructions: To install this openSUSE Security Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE 13.1: zypper in -t patch openSUSE-2014-487 - openSUSE 12.3: zypper in -t patch openSUSE-2014-487 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE 13.1 (i586 x86_64): MozillaThunderbird-24.7.0-70.27.1 MozillaThunderbird-buildsymbols-24.7.0-70.27.1 MozillaThunderbird-debuginfo-24.7.0-70.27.1 MozillaThunderbird-debugsource-24.7.0-70.27.1 MozillaThunderbird-devel-24.7.0-70.27.1 MozillaThunderbird-translations-common-24.7.0-70.27.1 MozillaThunderbird-translations-other-24.7.0-70.27.1 enigmail-1.7-2.1 enigmail-debuginfo-1.7-2.1 enigmail-debugsource-1.7-2.1 - openSUSE 12.3 (i586 x86_64): MozillaThunderbird-24.7.0-61.55.1 MozillaThunderbird-buildsymbols-24.7.0-61.55.1 MozillaThunderbird-debuginfo-24.7.0-61.55.1 MozillaThunderbird-debugsource-24.7.0-61.55.1 MozillaThunderbird-devel-24.7.0-61.55.1 MozillaThunderbird-translations-common-24.7.0-61.55.1 MozillaThunderbird-translations-other-24.7.0-61.55.1 enigmail-1.7-2.1 enigmail-debuginfo-1.7-2.1 enigmail-debugsource-1.7-2.1 References: http://support.novell.com/security/cve/CVE-2014-1544.html http://support.novell.com/security/cve/CVE-2014-1547.html http://support.novell.com/security/cve/CVE-2014-1548.html http://support.novell.com/security/cve/CVE-2014-1555.html http://support.novell.com/security/cve/CVE-2014-1556.html http://support.novell.com/security/cve/CVE-2014-1557.html https://bugzilla.novell.com/887746 -- To unsubscribe, e-mail: opensuse-security-announce+unsubscribe(a)opensuse.org For additional commands, e-mail: opensuse-security-announce+help(a)opensuse.org

1 0

[security-announce] openSUSE-SU-2014:0969-1: important: security issues addressed, most notably the mod_security heap overflow known as CVE-2014-0226
by opensuse-security＠opensuse.org 07 Aug '14

07 Aug '14

openSUSE Security Update: security issues addressed, most notably the mod_security heap overflow known as CVE-2014-0226 ______________________________________________________________________________ Announcement ID: openSUSE-SU-2014:0969-1 Rating: important References: #859916 #869105 #869106 #871309 #887765 #887768 Cross-References: CVE-2013-5705 CVE-2013-6438 CVE-2014-0098 CVE-2014-0226 CVE-2014-0231 Affected Products: openSUSE 11.4 ______________________________________________________________________________ An update that solves 5 vulnerabilities and has one errata is now available. Description: apache2: - ECC support was added to mod_ssl - fix for a race condition in mod_status known as CVE-2014-0226 can lead to information disclosure; mod_status is not active by default, and is normally only open for connects from localhost. - fix for bug known as CVE-2014-0098 that can crash the apache process if a specially designed cookie is sent to the server (log_cookie.c) - fix for crash bug in mod_dav known as CVE-2013-6438 - fix for a problem with non-responsive CGI scripts that would otherwise cause the server to stall and deny service. CVE-2014-0231, new configuration parameter CGIDScriptTimeout defaults to 60s. apache2-mod_security2: - specially drafted chunked http requests allow an attacker to bypass filters configured in mod_security2. This vulnerability is known as CVE-2013-5705. Patch Instructions: To install this openSUSE Security Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE 11.4: zypper in -t patch 2014-72 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE 11.4 (i586 x86_64): apache2-2.2.17-80.1 apache2-debuginfo-2.2.17-80.1 apache2-debugsource-2.2.17-80.1 apache2-devel-2.2.17-80.1 apache2-event-2.2.17-80.1 apache2-event-debuginfo-2.2.17-80.1 apache2-example-certificates-2.2.17-80.1 apache2-example-pages-2.2.17-80.1 apache2-itk-2.2.17-80.1 apache2-itk-debuginfo-2.2.17-80.1 apache2-mod_security2-2.7.5-16.1 apache2-mod_security2-debuginfo-2.7.5-16.1 apache2-mod_security2-debugsource-2.7.5-16.1 apache2-prefork-2.2.17-80.1 apache2-prefork-debuginfo-2.2.17-80.1 apache2-utils-2.2.17-80.1 apache2-utils-debuginfo-2.2.17-80.1 apache2-worker-2.2.17-80.1 apache2-worker-debuginfo-2.2.17-80.1 - openSUSE 11.4 (noarch): apache2-doc-2.2.17-80.1 References: http://support.novell.com/security/cve/CVE-2013-5705.html http://support.novell.com/security/cve/CVE-2013-6438.html http://support.novell.com/security/cve/CVE-2014-0098.html http://support.novell.com/security/cve/CVE-2014-0226.html http://support.novell.com/security/cve/CVE-2014-0231.html https://bugzilla.novell.com/859916 https://bugzilla.novell.com/869105 https://bugzilla.novell.com/869106 https://bugzilla.novell.com/871309 https://bugzilla.novell.com/887765 https://bugzilla.novell.com/887768 -- To unsubscribe, e-mail: opensuse-security-announce+unsubscribe(a)opensuse.org For additional commands, e-mail: opensuse-security-announce+help(a)opensuse.org

1 0

[security-announce] SUSE-SU-2014:0967-1: important: Security update for the Apache Web Server
by opensuse-security＠opensuse.org 06 Aug '14

06 Aug '14

SUSE Security Update: Security update for the Apache Web Server ______________________________________________________________________________ Announcement ID: SUSE-SU-2014:0967-1 Rating: important References: #859916 #869105 #869106 #887765 #887768 Cross-References: CVE-2013-6438 CVE-2014-0098 CVE-2014-0226 CVE-2014-0231 Affected Products: SUSE Linux Enterprise Software Development Kit 11 SP3 SUSE Linux Enterprise Server 11 SP3 for VMware SUSE Linux Enterprise Server 11 SP3 ______________________________________________________________________________ An update that solves four vulnerabilities and has one errata is now available. Description: This update for the Apache Web Server provides the following fixes: * Fixed a heap-based buffer overflow on apache module mod_status. (bnc#887765, CVE-2014-0226) * Properly remove whitespace characters from CDATA sections to avoid remote denial of service by crashing the Apache Server process. (bnc#869105, CVE-2013-6438) * Correction to parsing of cookie content; this can lead to a crash with a specially designed cookie sent to the server. (bnc#869106, CVE-2014-0098) * ECC support should not be missing. (bnc#859916) This update also introduces a new configuration parameter CGIDScriptTimeout, which defaults to the value of parameter Timeout. CGIDScriptTimeout is set to 60s if mod_cgid is loaded/active, via /etc/apache2/conf.d/cgid-timeout.conf. The new directive and its effect prevent request workers to be eaten until starvation if cgi programs do not send output back to the server within the timeout set by CGIDScriptTimeout. (bnc#887768, CVE-2014-0231) Security Issues references: * CVE-2014-0226 <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-0226> * CVE-2013-6438 <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2013-6438> * CVE-2014-0098 <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-0098> * CVE-2014-0231 <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-0231> Patch Instructions: To install this SUSE Security Update use YaST online_update. Alternatively you can run the command listed for your product: - SUSE Linux Enterprise Software Development Kit 11 SP3: zypper in -t patch sdksp3-apache2-9542 - SUSE Linux Enterprise Server 11 SP3 for VMware: zypper in -t patch slessp3-apache2-9542 - SUSE Linux Enterprise Server 11 SP3: zypper in -t patch slessp3-apache2-9542 To bring your system up-to-date, use "zypper patch". Package List: - SUSE Linux Enterprise Software Development Kit 11 SP3 (i586 ia64 ppc64 s390x x86_64): apache2-devel-2.2.12-1.46.1 - SUSE Linux Enterprise Software Development Kit 11 SP3 (i586 x86_64): apache2-2.2.12-1.46.1 apache2-doc-2.2.12-1.46.1 apache2-example-pages-2.2.12-1.46.1 apache2-prefork-2.2.12-1.46.1 apache2-utils-2.2.12-1.46.1 apache2-worker-2.2.12-1.46.1 - SUSE Linux Enterprise Server 11 SP3 for VMware (i586 x86_64): apache2-2.2.12-1.46.1 apache2-doc-2.2.12-1.46.1 apache2-example-pages-2.2.12-1.46.1 apache2-prefork-2.2.12-1.46.1 apache2-utils-2.2.12-1.46.1 apache2-worker-2.2.12-1.46.1 - SUSE Linux Enterprise Server 11 SP3 (i586 ia64 ppc64 s390x x86_64): apache2-2.2.12-1.46.1 apache2-doc-2.2.12-1.46.1 apache2-example-pages-2.2.12-1.46.1 apache2-prefork-2.2.12-1.46.1 apache2-utils-2.2.12-1.46.1 apache2-worker-2.2.12-1.46.1 References: http://support.novell.com/security/cve/CVE-2013-6438.html http://support.novell.com/security/cve/CVE-2014-0098.html http://support.novell.com/security/cve/CVE-2014-0226.html http://support.novell.com/security/cve/CVE-2014-0231.html https://bugzilla.novell.com/859916 https://bugzilla.novell.com/869105 https://bugzilla.novell.com/869106 https://bugzilla.novell.com/887765 https://bugzilla.novell.com/887768 http://download.suse.com/patch/finder/?keywords=829ba0775cf41b675d6b37e956e… -- To unsubscribe, e-mail: opensuse-security-announce+unsubscribe(a)opensuse.org For additional commands, e-mail: opensuse-security-announce+help(a)opensuse.org

1 0