September 2014 - openSUSE Security Announce

[security-announce] SUSE-SU-2014:1260-1: critical: bash
by opensuse-security＠opensuse.org 30 Sep '14

30 Sep '14

SUSE Security Update: bash ______________________________________________________________________________ Announcement ID: SUSE-SU-2014:1260-1 Rating: critical References: #896776 Cross-References: CVE-2014-6271 Affected Products: SUSE Linux Enterprise Software Development Kit 12 SUSE Linux Enterprise Server 12 SUSE Linux Enterprise Desktop 12 12 ______________________________________________________________________________ An update that fixes one vulnerability is now available. Description: bash was updated to fix unexpected code execution with environment variables (CVE-2014-6271). Patch Instructions: To install this SUSE Security Update use YaST online_update. Alternatively you can run the command listed for your product: - SUSE Linux Enterprise Software Development Kit 12: zypper in -t patch SUSE-SLE-SDK-12-2014-59 - SUSE Linux Enterprise Server 12: zypper in -t patch SUSE-SLE-SERVER-12-2014-59 - SUSE Linux Enterprise Desktop 12: zypper in -t patch SUSE-SLE-DESKTOP-12-2014-59 - 12: zypper in -t patch SUSE-SLE-WE-12-2014-59 To bring your system up-to-date, use "zypper patch". Package List: - SUSE Linux Enterprise Software Development Kit 12 (ppc64le s390x x86_64): bash-debuginfo-4.2-77.1 bash-debugsource-4.2-77.1 bash-devel-4.2-77.1 readline-devel-6.2-77.1 - SUSE Linux Enterprise Server 12 (ppc64le s390x x86_64): bash-4.2-77.1 bash-debuginfo-4.2-77.1 bash-debugsource-4.2-77.1 libreadline6-6.2-77.1 libreadline6-debuginfo-6.2-77.1 - SUSE Linux Enterprise Server 12 (noarch): bash-doc-4.2-77.1 readline-doc-6.2-77.1 - SUSE Linux Enterprise Desktop 12 (x86_64): bash-4.2-77.1 bash-debuginfo-4.2-77.1 bash-debugsource-4.2-77.1 libreadline6-6.2-77.1 libreadline6-debuginfo-6.2-77.1 - SUSE Linux Enterprise Desktop 12 (noarch): bash-doc-4.2-77.1 bash-lang-4.2-77.1 readline-doc-6.2-77.1 - 12 (noarch): bash-lang-4.2-77.1 References: http://support.novell.com/security/cve/CVE-2014-6271.html https://bugzilla.suse.com/show_bug.cgi?id=896776 -- To unsubscribe, e-mail: opensuse-security-announce+unsubscribe(a)opensuse.org For additional commands, e-mail: opensuse-security-announce+help(a)opensuse.org

1 0

[security-announce] SUSE-SU-2014:1259-1: important: bash
by opensuse-security＠opensuse.org 30 Sep '14

30 Sep '14

SUSE Security Update: bash ______________________________________________________________________________ Announcement ID: SUSE-SU-2014:1259-1 Rating: important References: #898346 #898603 #898604 Cross-References: CVE-2014-7169 CVE-2014-7186 CVE-2014-7187 Affected Products: SUSE Linux Enterprise Software Development Kit 12 SUSE Linux Enterprise Server 12 SUSE Linux Enterprise Desktop 12 12 ______________________________________________________________________________ An update that fixes three vulnerabilities is now available. Description: The command-line shell 'bash' evaluates environment variables, which allows the injection of characters and might be used to access files on the system in some circumstances (CVE-2014-7169). Please note that this issue is different from a previously fixed vulnerability tracked under CVE-2014-6271 and it is less serious due to the special, non-default system configuration that is needed to create an exploitable situation. To remove further exploitation potential we now limit the function-in-environment variable to variables prefixed with BASH_FUNC_ . This hardening feature is work in progress and might be improved in later updates. Additionaly two more security issues were fixed in bash: CVE-2014-7186: Nested HERE documents could lead to a crash of bash. CVE-2014-7187: Nesting of for loops could lead to a crash of bash. Patch Instructions: To install this SUSE Security Update use YaST online_update. Alternatively you can run the command listed for your product: - SUSE Linux Enterprise Software Development Kit 12: zypper in -t patch SUSE-SLE-SDK-12-2014-63 - SUSE Linux Enterprise Server 12: zypper in -t patch SUSE-SLE-SERVER-12-2014-63 - SUSE Linux Enterprise Desktop 12: zypper in -t patch SUSE-SLE-DESKTOP-12-2014-63 - 12: zypper in -t patch SUSE-SLE-WE-12-2014-63 To bring your system up-to-date, use "zypper patch". Package List: - SUSE Linux Enterprise Software Development Kit 12 (ppc64le s390x x86_64): bash-debuginfo-4.2-81.1 bash-debugsource-4.2-81.1 bash-devel-4.2-81.1 readline-devel-6.2-81.1 - SUSE Linux Enterprise Server 12 (ppc64le s390x x86_64): bash-4.2-81.1 bash-debuginfo-4.2-81.1 bash-debugsource-4.2-81.1 libreadline6-6.2-81.1 libreadline6-debuginfo-6.2-81.1 - SUSE Linux Enterprise Server 12 (noarch): bash-doc-4.2-81.1 readline-doc-6.2-81.1 - SUSE Linux Enterprise Desktop 12 (x86_64): bash-4.2-81.1 bash-debuginfo-4.2-81.1 bash-debugsource-4.2-81.1 libreadline6-6.2-81.1 libreadline6-debuginfo-6.2-81.1 - SUSE Linux Enterprise Desktop 12 (noarch): bash-doc-4.2-81.1 bash-lang-4.2-81.1 readline-doc-6.2-81.1 - 12 (noarch): bash-lang-4.2-81.1 References: http://support.novell.com/security/cve/CVE-2014-7169.html http://support.novell.com/security/cve/CVE-2014-7186.html http://support.novell.com/security/cve/CVE-2014-7187.html https://bugzilla.suse.com/show_bug.cgi?id=898346 https://bugzilla.suse.com/show_bug.cgi?id=898603 https://bugzilla.suse.com/show_bug.cgi?id=898604 -- To unsubscribe, e-mail: opensuse-security-announce+unsubscribe(a)opensuse.org For additional commands, e-mail: opensuse-security-announce+help(a)opensuse.org

1 0

[security-announce] SUSE-SU-2014:1220-3: important: Security update for mozilla-nss
by opensuse-security＠opensuse.org 29 Sep '14

29 Sep '14

SUSE Security Update: Security update for mozilla-nss ______________________________________________________________________________ Announcement ID: SUSE-SU-2014:1220-3 Rating: important References: #897890 Cross-References: CVE-2014-1568 Affected Products: SUSE Linux Enterprise Server 11 SP1 LTSS SUSE Linux Enterprise Server 10 SP3 LTSS ______________________________________________________________________________ An update that fixes one vulnerability is now available. It includes one version update. Description: Mozilla NSS was updated to version 3.16.5 to fix a RSA certificate forgery issue. MFSA 2014-73 / CVE-2014-1568: Antoine Delignat-Lavaud, security researcher at Inria Paris in team Prosecco, reported an issue in Network Security Services (NSS) libraries affecting all versions. He discovered that NSS is vulnerable to a variant of a signature forgery attack previously published by Daniel Bleichenbacher. This is due to lenient parsing of ASN.1 values involved in a signature and could lead to the forging of RSA certificates. The Advanced Threat Research team at Intel Security also independently discovered and reported this issue. Security Issues: * CVE-2014-1568 <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-1568> Patch Instructions: To install this SUSE Security Update use YaST online_update. Alternatively you can run the command listed for your product: - SUSE Linux Enterprise Server 11 SP1 LTSS: zypper in -t patch slessp1-libfreebl3-9775 To bring your system up-to-date, use "zypper patch". Package List: - SUSE Linux Enterprise Server 11 SP1 LTSS (i586 s390x x86_64) [New Version: 3.16.5]: libfreebl3-3.16.5-0.4.2.1 mozilla-nss-3.16.5-0.4.2.1 mozilla-nss-tools-3.16.5-0.4.2.1 - SUSE Linux Enterprise Server 11 SP1 LTSS (s390x x86_64) [New Version: 3.16.5]: libfreebl3-32bit-3.16.5-0.4.2.1 mozilla-nss-32bit-3.16.5-0.4.2.1 - SUSE Linux Enterprise Server 10 SP3 LTSS (i586 s390x x86_64) [New Version: 3.16.5]: mozilla-nss-3.16.5-0.5.1 mozilla-nss-devel-3.16.5-0.5.1 mozilla-nss-tools-3.16.5-0.5.1 - SUSE Linux Enterprise Server 10 SP3 LTSS (s390x x86_64) [New Version: 3.16.5]: mozilla-nss-32bit-3.16.5-0.5.1 References: http://support.novell.com/security/cve/CVE-2014-1568.html https://bugzilla.suse.com/show_bug.cgi?id=897890 http://download.suse.com/patch/finder/?keywords=2ee24d8f2ff89770e348b8257c8… http://download.suse.com/patch/finder/?keywords=c6f6720a0652853ecb54d85b96a… -- To unsubscribe, e-mail: opensuse-security-announce+unsubscribe(a)opensuse.org For additional commands, e-mail: opensuse-security-announce+help(a)opensuse.org

1 0

[security-announce] SUSE-SU-2014:1247-2: important: Security update for bash
by opensuse-security＠opensuse.org 29 Sep '14

29 Sep '14

SUSE Security Update: Security update for bash ______________________________________________________________________________ Announcement ID: SUSE-SU-2014:1247-2 Rating: important References: #898346 #898603 #898604 Cross-References: CVE-2014-7169 CVE-2014-7186 CVE-2014-7187 Affected Products: SUSE Manager 1.7 for SLE 11 SP2 ______________________________________________________________________________ An update that fixes three vulnerabilities is now available. Description: The command-line shell 'bash' evaluates environment variables, which allows the injection of characters and might be used to access files on the system in some circumstances (CVE-2014-7169). Please note that this issue is different from a previously fixed vulnerability tracked under CVE-2014-6271 and is less serious due to the special, non-default system configuration that is needed to create an exploitable situation. To remove further exploitation potential we now limit the function-in-environment variable to variables prefixed with BASH_FUNC_. This hardening feature is work in progress and might be improved in later updates. Additionally, two other security issues have been fixed: * CVE-2014-7186: Nested HERE documents could lead to a crash of bash. * CVE-2014-7187: Nesting of for loops could lead to a crash of bash. Security Issues: * CVE-2014-7169 <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-7169> * CVE-2014-7186 <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-7186> * CVE-2014-7187 <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-7187> Patch Instructions: To install this SUSE Security Update use YaST online_update. Alternatively you can run the command listed for your product: - SUSE Manager 1.7 for SLE 11 SP2: zypper in -t patch sleman17sp2-bash-9779 To bring your system up-to-date, use "zypper patch". Package List: - SUSE Manager 1.7 for SLE 11 SP2 (x86_64): bash-3.2-147.14.22.1 bash-doc-3.2-147.14.22.1 libreadline5-32bit-5.2-147.14.22.1 libreadline5-5.2-147.14.22.1 readline-doc-5.2-147.14.22.1 References: http://support.novell.com/security/cve/CVE-2014-7169.html http://support.novell.com/security/cve/CVE-2014-7186.html http://support.novell.com/security/cve/CVE-2014-7187.html https://bugzilla.suse.com/show_bug.cgi?id=898346 https://bugzilla.suse.com/show_bug.cgi?id=898603 https://bugzilla.suse.com/show_bug.cgi?id=898604 http://download.suse.com/patch/finder/?keywords=991d0956c7a6a53ad424c0964c1… -- To unsubscribe, e-mail: opensuse-security-announce+unsubscribe(a)opensuse.org For additional commands, e-mail: opensuse-security-announce+help(a)opensuse.org

1 0

[security-announce] SUSE-SU-2014:1220-2: important: Security update for mozilla-nss
by opensuse-security＠opensuse.org 29 Sep '14

29 Sep '14

SUSE Security Update: Security update for mozilla-nss ______________________________________________________________________________ Announcement ID: SUSE-SU-2014:1220-2 Rating: important References: #897890 Cross-References: CVE-2014-1568 Affected Products: SUSE Linux Enterprise Server 11 SP2 LTSS ______________________________________________________________________________ An update that fixes one vulnerability is now available. It includes one version update. Description: Mozilla NSS was updated to 3.16.5 to fix a RSA certificate forgery issue. MFSA 2014-73 / CVE-2014-1568: Antoine Delignat-Lavaud, security researcher at Inria Paris in team Prosecco, reported an issue in Network Security Services (NSS) libraries affecting all versions. He discovered that NSS is vulnerable to a variant of a signature forgery attack previously published by Daniel Bleichenbacher. This is due to lenient parsing of ASN.1 values involved in a signature and could lead to the forging of RSA certificates. The Advanced Threat Research team at Intel Security also independently discovered and reported this issue. Security Issues: * CVE-2014-1568 <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-1568> Patch Instructions: To install this SUSE Security Update use YaST online_update. Alternatively you can run the command listed for your product: - SUSE Linux Enterprise Server 11 SP2 LTSS: zypper in -t patch slessp2-libfreebl3-9774 To bring your system up-to-date, use "zypper patch". Package List: - SUSE Linux Enterprise Server 11 SP2 LTSS (i586 s390x x86_64) [New Version: 3.16.5]: libfreebl3-3.16.5-0.4.2.1 mozilla-nss-3.16.5-0.4.2.1 mozilla-nss-devel-3.16.5-0.4.2.1 mozilla-nss-tools-3.16.5-0.4.2.1 - SUSE Linux Enterprise Server 11 SP2 LTSS (s390x x86_64) [New Version: 3.16.5]: libfreebl3-32bit-3.16.5-0.4.2.1 mozilla-nss-32bit-3.16.5-0.4.2.1 References: http://support.novell.com/security/cve/CVE-2014-1568.html https://bugzilla.suse.com/show_bug.cgi?id=897890 http://download.suse.com/patch/finder/?keywords=d63b0bfb5e439b036b903e3aa94… -- To unsubscribe, e-mail: opensuse-security-announce+unsubscribe(a)opensuse.org For additional commands, e-mail: opensuse-security-announce+help(a)opensuse.org

1 0

[security-announce] openSUSE-SU-2014:1254-1: critical: bash
by opensuse-security＠opensuse.org 29 Sep '14

29 Sep '14

openSUSE Security Update: bash ______________________________________________________________________________ Announcement ID: openSUSE-SU-2014:1254-1 Rating: critical References: #895475 #896776 Cross-References: CVE-2014-6271 CVE-2014-7169 CVE-2014-7186 CVE-2014-7187 Affected Products: openSUSE 13.2 ______________________________________________________________________________ An update that fixes four vulnerabilities is now available. Description: bash was updated to fix command injection via environment variables. (CVE-2014-6271,CVE-2014-7169) Also a hardening patch was applied that only imports functions over BASH_FUNC_ prefixed environment variables. Also fixed: CVE-2014-7186, CVE-2014-7187: bad handling of HERE documents and for loop issue Patch Instructions: To install this openSUSE Security Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE 13.2: zypper in -t patch openSUSE-2014-567 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE 13.2 (i586 x86_64): bash-4.2-75.4.1 bash-debuginfo-4.2-75.4.1 bash-debugsource-4.2-75.4.1 bash-devel-4.2-75.4.1 bash-loadables-4.2-75.4.1 bash-loadables-debuginfo-4.2-75.4.1 libreadline6-6.2-75.4.1 libreadline6-debuginfo-6.2-75.4.1 readline-devel-6.2-75.4.1 - openSUSE 13.2 (x86_64): bash-debuginfo-32bit-4.2-75.4.1 libreadline6-32bit-6.2-75.4.1 libreadline6-debuginfo-32bit-6.2-75.4.1 readline-devel-32bit-6.2-75.4.1 - openSUSE 13.2 (noarch): bash-doc-4.2-75.4.1 bash-lang-4.2-75.4.1 readline-doc-6.2-75.4.1 References: http://support.novell.com/security/cve/CVE-2014-6271.html http://support.novell.com/security/cve/CVE-2014-7169.html http://support.novell.com/security/cve/CVE-2014-7186.html http://support.novell.com/security/cve/CVE-2014-7187.html https://bugzilla.suse.com/show_bug.cgi?id=895475 https://bugzilla.suse.com/show_bug.cgi?id=896776 -- To unsubscribe, e-mail: opensuse-security-announce+unsubscribe(a)opensuse.org For additional commands, e-mail: opensuse-security-announce+help(a)opensuse.org

1 0

[security-announce] openSUSE-SU-2014:1248-1: important: update for bash
by opensuse-security＠opensuse.org 28 Sep '14

28 Sep '14

openSUSE Security Update: update for bash ______________________________________________________________________________ Announcement ID: openSUSE-SU-2014:1248-1 Rating: important References: #896776 Affected Products: openSUSE Evergreen 11.4 ______________________________________________________________________________ An update that contains security fixes can now be installed. Description: This update for bash completely disables the importing of shell functions from the environment and thereby remove the exposure of the parser from untrusted/harmful environment. Patch Instructions: To install this openSUSE Security Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE Evergreen 11.4: zypper in -t patch 2014-90 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE Evergreen 11.4 (i586 x86_64): bash-4.1-20.35.1 bash-debuginfo-4.1-20.35.1 bash-debugsource-4.1-20.35.1 bash-devel-4.1-18.35.1 bash-loadables-4.1-18.35.1 bash-loadables-debuginfo-4.1-18.35.1 libreadline6-6.1-18.35.1 libreadline6-debuginfo-6.1-18.35.1 readline-devel-6.1-18.35.1 - openSUSE Evergreen 11.4 (x86_64): bash-debuginfo-32bit-4.1-20.35.1 libreadline6-32bit-6.1-18.35.1 libreadline6-debuginfo-32bit-6.1-18.35.1 readline-devel-32bit-6.1-18.35.1 - openSUSE Evergreen 11.4 (noarch): bash-doc-4.1-18.35.1 bash-lang-4.1-20.35.1 readline-doc-6.1-18.35.1 - openSUSE Evergreen 11.4 (ia64): bash-debuginfo-x86-4.1-20.35.1 bash-x86-4.1-20.35.1 libreadline6-debuginfo-x86-6.1-18.35.1 libreadline6-x86-6.1-18.35.1 References: https://bugzilla.suse.com/show_bug.cgi?id=896776 -- To unsubscribe, e-mail: opensuse-security-announce+unsubscribe(a)opensuse.org For additional commands, e-mail: opensuse-security-announce+help(a)opensuse.org

1 0

[security-announce] SUSE-SU-2014:1247-1: important: Security update for bash
by opensuse-security＠opensuse.org 28 Sep '14

28 Sep '14

SUSE Security Update: Security update for bash ______________________________________________________________________________ Announcement ID: SUSE-SU-2014:1247-1 Rating: important References: #898346 #898603 #898604 Cross-References: CVE-2014-7169 CVE-2014-7186 CVE-2014-7187 Affected Products: SUSE Linux Enterprise Software Development Kit 11 SP3 SUSE Linux Enterprise Server 11 SP3 for VMware SUSE Linux Enterprise Server 11 SP3 SUSE Linux Enterprise Server 11 SP2 LTSS SUSE Linux Enterprise Server 11 SP1 LTSS SUSE Linux Enterprise Server 10 SP4 LTSS SUSE Linux Enterprise Server 10 SP3 LTSS SUSE Linux Enterprise Desktop 11 SP3 ______________________________________________________________________________ An update that fixes three vulnerabilities is now available. Description: The command-line shell 'bash' evaluates environment variables, which allows the injection of characters and might be used to access files on the system in some circumstances (CVE-2014-7169). Please note that this issue is different from a previously fixed vulnerability tracked under CVE-2014-6271 and is less serious due to the special, non-default system configuration that is needed to create an exploitable situation. To remove further exploitation potential we now limit the function-in-environment variable to variables prefixed with BASH_FUNC_. This hardening feature is work in progress and might be improved in later updates. Additionally, two other security issues have been fixed: * CVE-2014-7186: Nested HERE documents could lead to a crash of bash. * CVE-2014-7187: Nesting of for loops could lead to a crash of bash. Security Issues: * CVE-2014-7169 <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-7169> * CVE-2014-7186 <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-7186> * CVE-2014-7187 <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-7187> Patch Instructions: To install this SUSE Security Update use YaST online_update. Alternatively you can run the command listed for your product: - SUSE Linux Enterprise Software Development Kit 11 SP3: zypper in -t patch sdksp3-bash-9780 - SUSE Linux Enterprise Server 11 SP3 for VMware: zypper in -t patch slessp3-bash-9780 - SUSE Linux Enterprise Server 11 SP3: zypper in -t patch slessp3-bash-9780 - SUSE Linux Enterprise Server 11 SP2 LTSS: zypper in -t patch slessp2-bash-9781 - SUSE Linux Enterprise Server 11 SP1 LTSS: zypper in -t patch slessp1-bash-9782 - SUSE Linux Enterprise Desktop 11 SP3: zypper in -t patch sledsp3-bash-9780 To bring your system up-to-date, use "zypper patch". Package List: - SUSE Linux Enterprise Software Development Kit 11 SP3 (i586 ia64 ppc64 s390x x86_64): readline-devel-5.2-147.22.1 - SUSE Linux Enterprise Software Development Kit 11 SP3 (ppc64 s390x x86_64): readline-devel-32bit-5.2-147.22.1 - SUSE Linux Enterprise Software Development Kit 11 SP3 (i586 x86_64): libreadline5-5.2-147.22.1 - SUSE Linux Enterprise Server 11 SP3 for VMware (i586 x86_64): bash-3.2-147.22.1 bash-doc-3.2-147.22.1 libreadline5-5.2-147.22.1 readline-doc-5.2-147.22.1 - SUSE Linux Enterprise Server 11 SP3 for VMware (x86_64): libreadline5-32bit-5.2-147.22.1 - SUSE Linux Enterprise Server 11 SP3 (i586 ia64 ppc64 s390x x86_64): bash-3.2-147.22.1 bash-doc-3.2-147.22.1 libreadline5-5.2-147.22.1 readline-doc-5.2-147.22.1 - SUSE Linux Enterprise Server 11 SP3 (ppc64 s390x x86_64): libreadline5-32bit-5.2-147.22.1 - SUSE Linux Enterprise Server 11 SP3 (ia64): bash-x86-3.2-147.22.1 libreadline5-x86-5.2-147.22.1 - SUSE Linux Enterprise Server 11 SP2 LTSS (i586 s390x x86_64): bash-3.2-147.14.22.1 bash-doc-3.2-147.14.22.1 libreadline5-5.2-147.14.22.1 readline-doc-5.2-147.14.22.1 - SUSE Linux Enterprise Server 11 SP2 LTSS (s390x x86_64): libreadline5-32bit-5.2-147.14.22.1 - SUSE Linux Enterprise Server 11 SP1 LTSS (i586 s390x x86_64): bash-3.2-147.14.22.1 bash-doc-3.2-147.14.22.1 libreadline5-5.2-147.14.22.1 readline-doc-5.2-147.14.22.1 - SUSE Linux Enterprise Server 11 SP1 LTSS (s390x x86_64): libreadline5-32bit-5.2-147.14.22.1 - SUSE Linux Enterprise Server 10 SP4 LTSS (i586 s390x x86_64): bash-3.1-24.34.1 readline-5.1-24.34.1 readline-devel-5.1-24.34.1 - SUSE Linux Enterprise Server 10 SP4 LTSS (s390x x86_64): readline-32bit-5.1-24.34.1 readline-devel-32bit-5.1-24.34.1 - SUSE Linux Enterprise Server 10 SP3 LTSS (i586 s390x x86_64): bash-3.1-24.34.1 readline-5.1-24.34.1 readline-devel-5.1-24.34.1 - SUSE Linux Enterprise Server 10 SP3 LTSS (s390x x86_64): readline-32bit-5.1-24.34.1 readline-devel-32bit-5.1-24.34.1 - SUSE Linux Enterprise Desktop 11 SP3 (i586 x86_64): bash-3.2-147.22.1 bash-doc-3.2-147.22.1 libreadline5-5.2-147.22.1 readline-doc-5.2-147.22.1 - SUSE Linux Enterprise Desktop 11 SP3 (x86_64): libreadline5-32bit-5.2-147.22.1 References: http://support.novell.com/security/cve/CVE-2014-7169.html http://support.novell.com/security/cve/CVE-2014-7186.html http://support.novell.com/security/cve/CVE-2014-7187.html https://bugzilla.suse.com/show_bug.cgi?id=898346 https://bugzilla.suse.com/show_bug.cgi?id=898603 https://bugzilla.suse.com/show_bug.cgi?id=898604 http://download.suse.com/patch/finder/?keywords=01d7685e480d31be1641e845919… http://download.suse.com/patch/finder/?keywords=1143502d673561f6e5895393ba9… http://download.suse.com/patch/finder/?keywords=7c3a2e9a2aa61a2702de17e1ed7… http://download.suse.com/patch/finder/?keywords=b6868a6fc575e34338a7d5fd749… http://download.suse.com/patch/finder/?keywords=d6f3fbe6b7cd7f9bd580be31dd2… -- To unsubscribe, e-mail: opensuse-security-announce+unsubscribe(a)opensuse.org For additional commands, e-mail: opensuse-security-announce+help(a)opensuse.org

1 0

[security-announce] openSUSE-SU-2014:1242-1: important: bash
by opensuse-security＠opensuse.org 28 Sep '14

28 Sep '14

openSUSE Security Update: bash ______________________________________________________________________________ Announcement ID: openSUSE-SU-2014:1242-1 Rating: important References: #898346 #898603 #898604 Cross-References: CVE-2014-7169 CVE-2014-7186 CVE-2014-7187 Affected Products: openSUSE 13.1 ______________________________________________________________________________ An update that fixes three vulnerabilities is now available. Description: The command-line shell 'bash' evaluates environment variables, which allows the injection of characters and might be used to access files on the system in some circumstances (CVE-2014-7169). Please note that this issue is different from a previously fixed vulnerability tracked under CVE-2014-6271 and it is less serious due to the special, non-default system configuration that is needed to create an exploitable situation. To remove further exploitation potential we now limit the function-in-environment variable to variables prefixed with BASH_FUNC_ . This hardening feature is work in progress and might be improved in later updates. Additionaly two more security issues were fixed in bash: CVE-2014-7186: Nested HERE documents could lead to a crash of bash. CVE-2014-7187: Nesting of for loops could lead to a crash of bash. Patch Instructions: To install this openSUSE Security Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE 13.1: zypper in -t patch openSUSE-2014-564 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE 13.1 (i586 x86_64): bash-4.2-68.8.1 bash-debuginfo-4.2-68.8.1 bash-debugsource-4.2-68.8.1 bash-devel-4.2-68.8.1 bash-loadables-4.2-68.8.1 bash-loadables-debuginfo-4.2-68.8.1 libreadline6-6.2-68.8.1 libreadline6-debuginfo-6.2-68.8.1 readline-devel-6.2-68.8.1 - openSUSE 13.1 (x86_64): bash-debuginfo-32bit-4.2-68.8.1 libreadline6-32bit-6.2-68.8.1 libreadline6-debuginfo-32bit-6.2-68.8.1 readline-devel-32bit-6.2-68.8.1 - openSUSE 13.1 (noarch): bash-doc-4.2-68.8.1 bash-lang-4.2-68.8.1 readline-doc-6.2-68.8.1 References: http://support.novell.com/security/cve/CVE-2014-7169.html http://support.novell.com/security/cve/CVE-2014-7186.html http://support.novell.com/security/cve/CVE-2014-7187.html https://bugzilla.suse.com/show_bug.cgi?id=898346 https://bugzilla.suse.com/show_bug.cgi?id=898603 https://bugzilla.suse.com/show_bug.cgi?id=898604 -- To unsubscribe, e-mail: opensuse-security-announce+unsubscribe(a)opensuse.org For additional commands, e-mail: opensuse-security-announce+help(a)opensuse.org

1 0

[security-announce] openSUSE-SU-2014:1238-1: important: Important security fix for bash that allows the injection of commands.
by opensuse-security＠opensuse.org 28 Sep '14

28 Sep '14

openSUSE Security Update: Important security fix for bash that allows the injection of commands. ______________________________________________________________________________ Announcement ID: openSUSE-SU-2014:1238-1 Rating: important References: #896776 Cross-References: CVE-2014-6271 Affected Products: openSUSE Evergreen 11.4 ______________________________________________________________________________ An update that fixes one vulnerability is now available. Description: This update fixes a bug in the bash shell that allows an attacker to execute arbitrary commands upon shell invocation if he can control the shell's environment. This is particularly dangerous if the shell is used as a cgi interpreter for a web server, or if the shell handles untrusted input inherited in the environment from other sources. Patch Instructions: To install this openSUSE Security Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE Evergreen 11.4: zypper in -t patch 2014-86 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE Evergreen 11.4 (i586 x86_64): bash-4.1-20.31.1 bash-debuginfo-4.1-20.31.1 bash-debugsource-4.1-20.31.1 bash-devel-4.1-18.31.1 bash-loadables-4.1-18.31.1 bash-loadables-debuginfo-4.1-18.31.1 libreadline6-6.1-18.31.1 libreadline6-debuginfo-6.1-18.31.1 readline-devel-6.1-18.31.1 - openSUSE Evergreen 11.4 (x86_64): bash-debuginfo-32bit-4.1-20.31.1 libreadline6-32bit-6.1-18.31.1 libreadline6-debuginfo-32bit-6.1-18.31.1 readline-devel-32bit-6.1-18.31.1 - openSUSE Evergreen 11.4 (noarch): bash-doc-4.1-18.31.1 bash-lang-4.1-20.31.1 readline-doc-6.1-18.31.1 - openSUSE Evergreen 11.4 (ia64): bash-debuginfo-x86-4.1-20.31.1 bash-x86-4.1-20.31.1 libreadline6-debuginfo-x86-6.1-18.31.1 libreadline6-x86-6.1-18.31.1 References: http://support.novell.com/security/cve/CVE-2014-6271.html https://bugzilla.suse.com/show_bug.cgi?id=896776 -- To unsubscribe, e-mail: opensuse-security-announce+unsubscribe(a)opensuse.org For additional commands, e-mail: opensuse-security-announce+help(a)opensuse.org

1 0

[security-announce] openSUSE-SU-2014:1232-1: critical: mozilla-nss: update to avoid signature forgery
by opensuse-security＠opensuse.org 28 Sep '14

28 Sep '14

openSUSE Security Update: mozilla-nss: update to avoid signature forgery ______________________________________________________________________________ Announcement ID: openSUSE-SU-2014:1232-1 Rating: critical References: #897890 Cross-References: CVE-2014-1568 Affected Products: openSUSE 13.1 openSUSE 12.3 ______________________________________________________________________________ An update that fixes one vulnerability is now available. Description: Mozilla NSS is vulnerable to a variant of a signature forgery attack previously published by Daniel Bleichenbacher. This is due to lenient parsing of ASN.1 values involved in a signature and could lead to the forging of RSA certificates. Patch Instructions: To install this openSUSE Security Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE 13.1: zypper in -t patch openSUSE-2014-562 - openSUSE 12.3: zypper in -t patch openSUSE-2014-562 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE 13.1 (i586 x86_64): libfreebl3-3.16.5-39.1 libfreebl3-debuginfo-3.16.5-39.1 libsoftokn3-3.16.5-39.1 libsoftokn3-debuginfo-3.16.5-39.1 mozilla-nss-3.16.5-39.1 mozilla-nss-certs-3.16.5-39.1 mozilla-nss-certs-debuginfo-3.16.5-39.1 mozilla-nss-debuginfo-3.16.5-39.1 mozilla-nss-debugsource-3.16.5-39.1 mozilla-nss-devel-3.16.5-39.1 mozilla-nss-sysinit-3.16.5-39.1 mozilla-nss-sysinit-debuginfo-3.16.5-39.1 mozilla-nss-tools-3.16.5-39.1 mozilla-nss-tools-debuginfo-3.16.5-39.1 - openSUSE 13.1 (x86_64): libfreebl3-32bit-3.16.5-39.1 libfreebl3-debuginfo-32bit-3.16.5-39.1 libsoftokn3-32bit-3.16.5-39.1 libsoftokn3-debuginfo-32bit-3.16.5-39.1 mozilla-nss-32bit-3.16.5-39.1 mozilla-nss-certs-32bit-3.16.5-39.1 mozilla-nss-certs-debuginfo-32bit-3.16.5-39.1 mozilla-nss-debuginfo-32bit-3.16.5-39.1 mozilla-nss-sysinit-32bit-3.16.5-39.1 mozilla-nss-sysinit-debuginfo-32bit-3.16.5-39.1 - openSUSE 12.3 (i586 x86_64): libfreebl3-3.16.5-1.55.1 libfreebl3-debuginfo-3.16.5-1.55.1 libsoftokn3-3.16.5-1.55.1 libsoftokn3-debuginfo-3.16.5-1.55.1 mozilla-nss-3.16.5-1.55.1 mozilla-nss-certs-3.16.5-1.55.1 mozilla-nss-certs-debuginfo-3.16.5-1.55.1 mozilla-nss-debuginfo-3.16.5-1.55.1 mozilla-nss-debugsource-3.16.5-1.55.1 mozilla-nss-devel-3.16.5-1.55.1 mozilla-nss-sysinit-3.16.5-1.55.1 mozilla-nss-sysinit-debuginfo-3.16.5-1.55.1 mozilla-nss-tools-3.16.5-1.55.1 mozilla-nss-tools-debuginfo-3.16.5-1.55.1 - openSUSE 12.3 (x86_64): libfreebl3-32bit-3.16.5-1.55.1 libfreebl3-debuginfo-32bit-3.16.5-1.55.1 libsoftokn3-32bit-3.16.5-1.55.1 libsoftokn3-debuginfo-32bit-3.16.5-1.55.1 mozilla-nss-32bit-3.16.5-1.55.1 mozilla-nss-certs-32bit-3.16.5-1.55.1 mozilla-nss-certs-debuginfo-32bit-3.16.5-1.55.1 mozilla-nss-debuginfo-32bit-3.16.5-1.55.1 mozilla-nss-sysinit-32bit-3.16.5-1.55.1 mozilla-nss-sysinit-debuginfo-32bit-3.16.5-1.55.1 References: http://support.novell.com/security/cve/CVE-2014-1568.html https://bugzilla.suse.com/show_bug.cgi?id=897890 -- To unsubscribe, e-mail: opensuse-security-announce+unsubscribe(a)opensuse.org For additional commands, e-mail: opensuse-security-announce+help(a)opensuse.org

1 0

[security-announce] openSUSE-SU-2014:1229-1: important: bash
by opensuse-security＠opensuse.org 28 Sep '14

28 Sep '14

openSUSE Security Update: bash ______________________________________________________________________________ Announcement ID: openSUSE-SU-2014:1229-1 Rating: important References: #898346 #898603 #898604 Cross-References: CVE-2014-7169 CVE-2014-7186 CVE-2014-7187 Affected Products: openSUSE 12.3 ______________________________________________________________________________ An update that fixes three vulnerabilities is now available. Description: The command-line shell 'bash' evaluates environment variables, which allows the injection of characters and might be used to access files on the system in some circumstances (CVE-2014-7169). Please note that this issue is different from a previously fixed vulnerability tracked under CVE-2014-6271 and it is less serious due to the special, non-default system configuration that is needed to create an exploitable situation. To remove further exploitation potential we now limit the function-in-environment variable to variables prefixed with BASH_FUNC_ . This hardening feature is work in progress and might be improved in later updates. Additionaly two more security issues were fixed in bash: CVE-2014-7186: Nested HERE documents could lead to a crash of bash. CVE-2014-7187: Nesting of for loops could lead to a crash of bash. Patch Instructions: To install this openSUSE Security Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE 12.3: zypper in -t patch openSUSE-2014-563 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE 12.3 (i586 x86_64): bash-4.2-61.15.1 bash-debuginfo-4.2-61.15.1 bash-debugsource-4.2-61.15.1 bash-devel-4.2-61.15.1 bash-loadables-4.2-61.15.1 bash-loadables-debuginfo-4.2-61.15.1 libreadline6-6.2-61.15.1 libreadline6-debuginfo-6.2-61.15.1 readline-devel-6.2-61.15.1 - openSUSE 12.3 (x86_64): bash-debuginfo-32bit-4.2-61.15.1 libreadline6-32bit-6.2-61.15.1 libreadline6-debuginfo-32bit-6.2-61.15.1 readline-devel-32bit-6.2-61.15.1 - openSUSE 12.3 (noarch): bash-doc-4.2-61.15.1 bash-lang-4.2-61.15.1 readline-doc-6.2-61.15.1 References: http://support.novell.com/security/cve/CVE-2014-7169.html http://support.novell.com/security/cve/CVE-2014-7186.html http://support.novell.com/security/cve/CVE-2014-7187.html https://bugzilla.suse.com/show_bug.cgi?id=898346 https://bugzilla.suse.com/show_bug.cgi?id=898603 https://bugzilla.suse.com/show_bug.cgi?id=898604 -- To unsubscribe, e-mail: opensuse-security-announce+unsubscribe(a)opensuse.org For additional commands, e-mail: opensuse-security-announce+help(a)opensuse.org

1 0

[security-announce] openSUSE-SU-2014:1226-1: critical: bash: security and bugfix update
by opensuse-security＠opensuse.org 28 Sep '14

28 Sep '14

openSUSE Security Update: bash: security and bugfix update ______________________________________________________________________________ Announcement ID: openSUSE-SU-2014:1226-1 Rating: critical References: #868822 #895475 #896776 Cross-References: CVE-2014-2524 CVE-2014-6271 Affected Products: openSUSE 13.1 openSUSE 12.3 ______________________________________________________________________________ An update that solves two vulnerabilities and has one errata is now available. Description: bash was updated to fix a critical security issue, a minor security issue and bugs: In some circumstances, the shell would evaluate shellcode in environment variables passed at startup time. This allowed code execution by local or remote attackers who could pass environment variables to bash scripts. (CVE-2014-6271) Fixed a temporary file misuse in _rl_tropen (bnc#868822) Even if used only by developers to debug readline library do not open temporary files from public location without O_EXCL (CVE-2014-2524) Additional bugfixes: - Backported corrected german error message for a failing getpwd (bnc#895475) - Add bash upstream patch 47 to fix a problem where the function that shortens pathnames for $PS1 according to the value of $PROMPT_DIRTRIM uses memcpy on potentially-overlapping regions of memory, when it should use memmove. The result is garbled pathnames in prompt strings. - Add bash upstream patch 46 to fix a problem introduced by patch 32 a problem with "$@" and arrays expanding empty positional parameters or array elements when using substring expansion, pattern substitution, or case modfication. The empty parameters or array elements are removed instead of expanding to empty strings (""). - Add bash-4.2-strcpy.patch from upstream mailing list to patch collection tar ball to avoid when using \w in the prompt and changing the directory outside of HOME the a strcpy work on overlapping memory areas. Patch Instructions: To install this openSUSE Security Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE 13.1: zypper in -t patch openSUSE-2014-559 - openSUSE 12.3: zypper in -t patch openSUSE-2014-559 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE 13.1 (i586 x86_64): bash-4.2-68.4.1 bash-debuginfo-4.2-68.4.1 bash-debugsource-4.2-68.4.1 bash-devel-4.2-68.4.1 bash-loadables-4.2-68.4.1 bash-loadables-debuginfo-4.2-68.4.1 libreadline6-6.2-68.4.1 libreadline6-debuginfo-6.2-68.4.1 readline-devel-6.2-68.4.1 - openSUSE 13.1 (x86_64): bash-debuginfo-32bit-4.2-68.4.1 libreadline6-32bit-6.2-68.4.1 libreadline6-debuginfo-32bit-6.2-68.4.1 readline-devel-32bit-6.2-68.4.1 - openSUSE 13.1 (noarch): bash-doc-4.2-68.4.1 bash-lang-4.2-68.4.1 readline-doc-6.2-68.4.1 - openSUSE 12.3 (i586 x86_64): bash-4.2-61.9.1 bash-debuginfo-4.2-61.9.1 bash-debugsource-4.2-61.9.1 bash-devel-4.2-61.9.1 bash-loadables-4.2-61.9.1 bash-loadables-debuginfo-4.2-61.9.1 libreadline6-6.2-61.9.1 libreadline6-debuginfo-6.2-61.9.1 readline-devel-6.2-61.9.1 - openSUSE 12.3 (x86_64): bash-debuginfo-32bit-4.2-61.9.1 libreadline6-32bit-6.2-61.9.1 libreadline6-debuginfo-32bit-6.2-61.9.1 readline-devel-32bit-6.2-61.9.1 - openSUSE 12.3 (noarch): bash-doc-4.2-61.9.1 bash-lang-4.2-61.9.1 readline-doc-6.2-61.9.1 References: http://support.novell.com/security/cve/CVE-2014-2524.html http://support.novell.com/security/cve/CVE-2014-6271.html https://bugzilla.suse.com/show_bug.cgi?id=868822 https://bugzilla.suse.com/show_bug.cgi?id=895475 https://bugzilla.suse.com/show_bug.cgi?id=896776 -- To unsubscribe, e-mail: opensuse-security-announce+unsubscribe(a)opensuse.org For additional commands, e-mail: opensuse-security-announce+help(a)opensuse.org

1 0

[security-announce] openSUSE-SU-2014:1224-1: critical: NSS update to avoid signature forgery
by opensuse-security＠opensuse.org 28 Sep '14

28 Sep '14

openSUSE Security Update: NSS update to avoid signature forgery ______________________________________________________________________________ Announcement ID: openSUSE-SU-2014:1224-1 Rating: critical References: #897890 Cross-References: CVE-2014-1568 Affected Products: openSUSE Evergreen 11.4 ______________________________________________________________________________ An update that fixes one vulnerability is now available. Description: NSS is vulnerable to a variant of a signature forgery attack previously published by Daniel Bleichenbacher. This is due to lenient parsing of ASN.1 values involved in a signature and could lead to the forging of RSA certificates. Patch Instructions: To install this openSUSE Security Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE Evergreen 11.4: zypper in -t patch 2014-87 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE Evergreen 11.4 (i586 x86_64): libfreebl3-3.16.5-98.1 libfreebl3-debuginfo-3.16.5-98.1 libsoftokn3-3.16.5-98.1 libsoftokn3-debuginfo-3.16.5-98.1 mozilla-nss-3.16.5-98.1 mozilla-nss-certs-3.16.5-98.1 mozilla-nss-certs-debuginfo-3.16.5-98.1 mozilla-nss-debuginfo-3.16.5-98.1 mozilla-nss-debugsource-3.16.5-98.1 mozilla-nss-devel-3.16.5-98.1 mozilla-nss-sysinit-3.16.5-98.1 mozilla-nss-sysinit-debuginfo-3.16.5-98.1 mozilla-nss-tools-3.16.5-98.1 mozilla-nss-tools-debuginfo-3.16.5-98.1 - openSUSE Evergreen 11.4 (x86_64): libfreebl3-32bit-3.16.5-98.1 libfreebl3-debuginfo-32bit-3.16.5-98.1 libsoftokn3-32bit-3.16.5-98.1 libsoftokn3-debuginfo-32bit-3.16.5-98.1 mozilla-nss-32bit-3.16.5-98.1 mozilla-nss-certs-32bit-3.16.5-98.1 mozilla-nss-certs-debuginfo-32bit-3.16.5-98.1 mozilla-nss-debuginfo-32bit-3.16.5-98.1 mozilla-nss-sysinit-32bit-3.16.5-98.1 mozilla-nss-sysinit-debuginfo-32bit-3.16.5-98.1 - openSUSE Evergreen 11.4 (ia64): libfreebl3-debuginfo-x86-3.16.5-98.1 libfreebl3-x86-3.16.5-98.1 libsoftokn3-debuginfo-x86-3.16.5-98.1 libsoftokn3-x86-3.16.5-98.1 mozilla-nss-certs-debuginfo-x86-3.16.5-98.1 mozilla-nss-certs-x86-3.16.5-98.1 mozilla-nss-debuginfo-x86-3.16.5-98.1 mozilla-nss-sysinit-debuginfo-x86-3.16.5-98.1 mozilla-nss-sysinit-x86-3.16.5-98.1 mozilla-nss-x86-3.16.5-98.1 References: http://support.novell.com/security/cve/CVE-2014-1568.html https://bugzilla.suse.com/show_bug.cgi?id=897890 -- To unsubscribe, e-mail: opensuse-security-announce+unsubscribe(a)opensuse.org For additional commands, e-mail: opensuse-security-announce+help(a)opensuse.org

1 0

[security-announce] openSUSE 11.4 has reached end of Evergreen support
by Wolfgang Rosenauer 27 Sep '14

27 Sep '14

Hi, as you probably know our initial commitment to support 11.4 within Evergreen was until July 2014. http://en.opensuse.org/openSUSE:Evergreen While I was hoping that we can keep 11.4 alive for some time longer this is currently not possible from what I would call the "core team" which is Stefan and myself. We are too busy nowadays to be able to scan and patch every issue we get aware of. Thanks to you all who contributed to the success of Evergreen/11.4! The important message is: openSUSE 11.4 Evergreen is not actively maintained anymore! So if you can, we recommend to switch to openSUSE 13.1 as soon as possible which is still planned to be an Evergreen release. Some more details below: The repository already got and will most likely get more updates from package maintainers who care about 11.4 and/or their packages though. You noticed that with recent releases of patches for the bash and NSS issues already, BUT this is _no_ guarantee that every security issue will be fixed. We will accept contributions from anyone though and I will try to take care about "my" packages. Some numbers from 11.4 Evergreen (as far as I was able to get them easily): Evergreen lifetime: 21 months 11.4 overall lifetime (incl. Evergreen): 41 months / 3 years 5 months Evergreen lifetime numbers (w/o official maintenance period): Released update source packages: 804 Unique touched source packages: 177 rough number of patches (based on incident counter): 320 Let me also quote Marcus' numbers from official maintenance lifetime: Total updates: 723 Security: 416 Recommended: 306 Optional: 1 Thanks, Wolfgang -- To unsubscribe, e-mail: opensuse-security-announce+unsubscribe(a)opensuse.org For additional commands, e-mail: opensuse-security-announce+help(a)opensuse.org

1 0

[security-announce] SUSE-SU-2014:1223-1: critical: Security update for bash
by opensuse-security＠opensuse.org 26 Sep '14

26 Sep '14

SUSE Security Update: Security update for bash ______________________________________________________________________________ Announcement ID: SUSE-SU-2014:1223-1 Rating: critical References: #896776 Cross-References: CVE-2014-6271 Affected Products: SUSE Manager 1.7 for SLE 11 SP2 ______________________________________________________________________________ An update that fixes one vulnerability is now available. Description: bash has been updated to fix a critical security issue. In some circumstances, the shell would evaluate shellcode in environment variables passed at startup time. This allowed code execution by local or remote attackers who could pass environment variables to bash scripts. (CVE-2014-6271) Security Issues: * CVE-2014-6271 <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-6271> Patch Instructions: To install this SUSE Security Update use YaST online_update. Alternatively you can run the command listed for your product: - SUSE Manager 1.7 for SLE 11 SP2: zypper in -t patch sleman17sp2-bash-9764 To bring your system up-to-date, use "zypper patch". Package List: - SUSE Manager 1.7 for SLE 11 SP2 (x86_64): bash-3.2-147.14.20.1 bash-doc-3.2-147.14.20.1 libreadline5-32bit-5.2-147.14.20.1 libreadline5-5.2-147.14.20.1 readline-doc-5.2-147.14.20.1 References: http://support.novell.com/security/cve/CVE-2014-6271.html https://bugzilla.suse.com/896776 http://download.suse.com/patch/finder/?keywords=634668818756ed213c0d0c59381… -- To unsubscribe, e-mail: opensuse-security-announce+unsubscribe(a)opensuse.org For additional commands, e-mail: opensuse-security-announce+help(a)opensuse.org

1 0

[security-announce] SUSE-SU-2014:1221-1: important: Security update for wireshark
by opensuse-security＠opensuse.org 26 Sep '14

26 Sep '14

SUSE Security Update: Security update for wireshark ______________________________________________________________________________ Announcement ID: SUSE-SU-2014:1221-1 Rating: important References: #889854 #889899 #889900 #889901 #889906 #897055 Cross-References: CVE-2014-6421 CVE-2014-6422 CVE-2014-6423 CVE-2014-6424 CVE-2014-6427 CVE-2014-6428 CVE-2014-6429 CVE-2014-6430 CVE-2014-6431 CVE-2014-6432 Affected Products: SUSE Linux Enterprise Software Development Kit 11 SP3 SUSE Linux Enterprise Server 11 SP3 for VMware SUSE Linux Enterprise Server 11 SP3 SUSE Linux Enterprise Desktop 11 SP3 ______________________________________________________________________________ An update that fixes 10 vulnerabilities is now available. It includes one version update. Description: The wireshark package was upgraded to 1.10.10 from 1.8.x as 1.8 was discontinued. This update fixes vulnerabilities that could allow an attacker to crash Wireshark or make it become unresponsive by sending specific packets onto the network or have them loaded via a capture file while the dissectors are running. It also contains a number of other bug fixes. * RTP dissector crash. (wnpa-sec-2014-12 CVE-2014-6421 CVE-2014-6422) * MEGACO dissector infinite loop. (wnpa-sec-2014-13 CVE-2014-6423) * Netflow dissector crash. (wnpa-sec-2014-14 CVE-2014-6424) * RTSP dissector crash. (wnpa-sec-2014-17 CVE-2014-6427) * SES dissector crash. (wnpa-sec-2014-18 CVE-2014-6428) * Sniffer file parser crash. (wnpa-sec-2014-19 CVE-2014-6429 CVE-2014-6430 CVE-2014-6431 CVE-2014-6432) * The Catapult DCT2000 and IrDA dissectors could underrun a buffer. (wnpa-sec-2014-08 CVE-2014-5161 CVE-2014-5162, bnc#889901) * The GSM Management dissector could crash. (wnpa-sec-2014-09 CVE-2014-5163, bnc#889906) * The RLC dissector could crash. (wnpa-sec-2014-10 CVE-2014-5164, bnc#889900) * The ASN.1 BER dissector could crash. (wnpa-sec-2014-11 CVE-2014-5165, bnc#889899) Further bug fixes as listed in: https://www.wireshark.org/docs/relnotes/wireshark-1.10.10.html <https://www.wireshark.org/docs/relnotes/wireshark-1.10.10.html> and https://www.wireshark.org/docs/relnotes/wireshark-1.10.9.html <https://www.wireshark.org/docs/relnotes/wireshark-1.10.9.html> . Security Issues: * CVE-2014-5161 <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-5161> * CVE-2014-5162 <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-5162> * CVE-2014-5163 <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-5163> * CVE-2014-5164 <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-5164> * CVE-2014-5165 <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-5165> * CVE-2014-6421 <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-6421> * CVE-2014-6422 <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-6422> * CVE-2014-6423 <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-6423> * CVE-2014-6424 <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-6424> * CVE-2014-6427 <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-6427> * CVE-2014-6428 <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-6428> * CVE-2014-6429 <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-6429> * CVE-2014-6430 <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-6430> * CVE-2014-6431 <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-6431> * CVE-2014-6432 <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-6432> Patch Instructions: To install this SUSE Security Update use YaST online_update. Alternatively you can run the command listed for your product: - SUSE Linux Enterprise Software Development Kit 11 SP3: zypper in -t patch sdksp3-wireshark-9745 - SUSE Linux Enterprise Server 11 SP3 for VMware: zypper in -t patch slessp3-wireshark-9745 - SUSE Linux Enterprise Server 11 SP3: zypper in -t patch slessp3-wireshark-9745 - SUSE Linux Enterprise Desktop 11 SP3: zypper in -t patch sledsp3-wireshark-9745 To bring your system up-to-date, use "zypper patch". Package List: - SUSE Linux Enterprise Software Development Kit 11 SP3 (i586 ia64 ppc64 s390x x86_64) [New Version: 1.10.10]: wireshark-devel-1.10.10-0.2.1 - SUSE Linux Enterprise Software Development Kit 11 SP3 (i586 x86_64) [New Version: 1.10.10]: wireshark-1.10.10-0.2.1 - SUSE Linux Enterprise Server 11 SP3 for VMware (i586 x86_64) [New Version: 1.10.10]: wireshark-1.10.10-0.2.1 - SUSE Linux Enterprise Server 11 SP3 (i586 ia64 ppc64 s390x x86_64) [New Version: 1.10.10]: wireshark-1.10.10-0.2.1 - SUSE Linux Enterprise Desktop 11 SP3 (i586 x86_64) [New Version: 1.10.10]: wireshark-1.10.10-0.2.1 References: http://support.novell.com/security/cve/CVE-2014-6421.html http://support.novell.com/security/cve/CVE-2014-6422.html http://support.novell.com/security/cve/CVE-2014-6423.html http://support.novell.com/security/cve/CVE-2014-6424.html http://support.novell.com/security/cve/CVE-2014-6427.html http://support.novell.com/security/cve/CVE-2014-6428.html http://support.novell.com/security/cve/CVE-2014-6429.html http://support.novell.com/security/cve/CVE-2014-6430.html http://support.novell.com/security/cve/CVE-2014-6431.html http://support.novell.com/security/cve/CVE-2014-6432.html https://bugzilla.suse.com/889854 https://bugzilla.suse.com/889899 https://bugzilla.suse.com/889900 https://bugzilla.suse.com/889901 https://bugzilla.suse.com/889906 https://bugzilla.suse.com/897055 http://download.suse.com/patch/finder/?keywords=25a84c702b8b4fdaea63a171632… -- To unsubscribe, e-mail: opensuse-security-announce+unsubscribe(a)opensuse.org For additional commands, e-mail: opensuse-security-announce+help(a)opensuse.org

1 0

[security-announce] SUSE-SU-2014:1220-1: important: Security update for mozilla-nss
by opensuse-security＠opensuse.org 26 Sep '14

26 Sep '14

SUSE Security Update: Security update for mozilla-nss ______________________________________________________________________________ Announcement ID: SUSE-SU-2014:1220-1 Rating: important References: #897890 Cross-References: CVE-2014-1568 Affected Products: SUSE Linux Enterprise Software Development Kit 11 SP3 SUSE Linux Enterprise Server 11 SP3 for VMware SUSE Linux Enterprise Server 11 SP3 SUSE Linux Enterprise Desktop 11 SP3 ______________________________________________________________________________ An update that fixes one vulnerability is now available. It includes one version update. Description: Mozilla NSS was updated to version 3.16.5 to fix a RSA certificate forgery issue. MFSA 2014-73 / CVE-2014-1568: Antoine Delignat-Lavaud, security researcher at Inria Paris in team Prosecco, reported an issue in Network Security Services (NSS) libraries affecting all versions. He discovered that NSS is vulnerable to a variant of a signature forgery attack previously published by Daniel Bleichenbacher. This is due to lenient parsing of ASN.1 values involved in a signature and could lead to the forging of RSA certificates. The Advanced Threat Research team at Intel Security also independently discovered and reported this issue. Security Issues: * CVE-2014-1568 <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-1568> Patch Instructions: To install this SUSE Security Update use YaST online_update. Alternatively you can run the command listed for your product: - SUSE Linux Enterprise Software Development Kit 11 SP3: zypper in -t patch sdksp3-libfreebl3-9777 - SUSE Linux Enterprise Server 11 SP3 for VMware: zypper in -t patch slessp3-libfreebl3-9777 - SUSE Linux Enterprise Server 11 SP3: zypper in -t patch slessp3-libfreebl3-9777 - SUSE Linux Enterprise Desktop 11 SP3: zypper in -t patch sledsp3-libfreebl3-9777 To bring your system up-to-date, use "zypper patch". Package List: - SUSE Linux Enterprise Software Development Kit 11 SP3 (i586 ia64 ppc64 s390x x86_64) [New Version: 3.16.5]: mozilla-nss-devel-3.16.5-0.7.1 - SUSE Linux Enterprise Server 11 SP3 for VMware (i586 x86_64) [New Version: 3.16.5]: libfreebl3-3.16.5-0.7.1 libsoftokn3-3.16.5-0.7.1 mozilla-nss-3.16.5-0.7.1 mozilla-nss-tools-3.16.5-0.7.1 - SUSE Linux Enterprise Server 11 SP3 for VMware (x86_64) [New Version: 3.16.5]: libfreebl3-32bit-3.16.5-0.7.1 libsoftokn3-32bit-3.16.5-0.7.1 mozilla-nss-32bit-3.16.5-0.7.1 - SUSE Linux Enterprise Server 11 SP3 (i586 ia64 ppc64 s390x x86_64) [New Version: 3.16.5]: libfreebl3-3.16.5-0.7.1 libsoftokn3-3.16.5-0.7.1 mozilla-nss-3.16.5-0.7.1 mozilla-nss-tools-3.16.5-0.7.1 - SUSE Linux Enterprise Server 11 SP3 (ppc64 s390x x86_64) [New Version: 3.16.5]: libfreebl3-32bit-3.16.5-0.7.1 libsoftokn3-32bit-3.16.5-0.7.1 mozilla-nss-32bit-3.16.5-0.7.1 - SUSE Linux Enterprise Server 11 SP3 (ia64) [New Version: 3.16.5]: libfreebl3-x86-3.16.5-0.7.1 libsoftokn3-x86-3.16.5-0.7.1 mozilla-nss-x86-3.16.5-0.7.1 - SUSE Linux Enterprise Desktop 11 SP3 (i586 x86_64) [New Version: 3.16.5]: libfreebl3-3.16.5-0.7.1 libsoftokn3-3.16.5-0.7.1 mozilla-nss-3.16.5-0.7.1 mozilla-nss-tools-3.16.5-0.7.1 - SUSE Linux Enterprise Desktop 11 SP3 (x86_64) [New Version: 3.16.5]: libfreebl3-32bit-3.16.5-0.7.1 libsoftokn3-32bit-3.16.5-0.7.1 mozilla-nss-32bit-3.16.5-0.7.1 References: http://support.novell.com/security/cve/CVE-2014-1568.html https://bugzilla.suse.com/897890 http://download.suse.com/patch/finder/?keywords=9099e9b629979a0004c403f74aa… -- To unsubscribe, e-mail: opensuse-security-announce+unsubscribe(a)opensuse.org For additional commands, e-mail: opensuse-security-announce+help(a)opensuse.org

1 0

[security-announce] SUSE-SU-2014:1218-1: important: Security update for spacewalk-java
by opensuse-security＠opensuse.org 25 Sep '14

25 Sep '14

SUSE Security Update: Security update for spacewalk-java ______________________________________________________________________________ Announcement ID: SUSE-SU-2014:1218-1 Rating: important References: #889721 #896012 Cross-References: CVE-2014-3595 Affected Products: SUSE Manager Server ______________________________________________________________________________ An update that solves one vulnerability and has one errata is now available. Description: The Spacewalk frontend displayed a logfile without escaping content, allowing remote attackers to inject cross site scripting (XSS) into the admin's session. (CVE-2014-3595) Additionally, the following bug was fixed: * Fixed package upgrade via SSM when using the Oracle DB as backend. (bnc#889721) Security Issues: * CVE-2014-3595 <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-3595> Patch Instructions: To install this SUSE Security Update use YaST online_update. Alternatively you can run the command listed for your product: - SUSE Manager Server: zypper in -t patch sleman21-spacewalk-java-9719 To bring your system up-to-date, use "zypper patch". Package List: - SUSE Manager Server (noarch): spacewalk-java-2.1.165.6-0.11.1 spacewalk-java-config-2.1.165.6-0.11.1 spacewalk-java-lib-2.1.165.6-0.11.1 spacewalk-java-oracle-2.1.165.6-0.11.1 spacewalk-java-postgresql-2.1.165.6-0.11.1 spacewalk-taskomatic-2.1.165.6-0.11.1 References: http://support.novell.com/security/cve/CVE-2014-3595.html https://bugzilla.suse.com/889721 https://bugzilla.suse.com/896012 http://download.suse.com/patch/finder/?keywords=a50d8ce1310e48a468cc85ce6ed… -- To unsubscribe, e-mail: opensuse-security-announce+unsubscribe(a)opensuse.org For additional commands, e-mail: opensuse-security-announce+help(a)opensuse.org

1 0

[security-announce] SUSE-SU-2014:1214-1: critical: Security update for bash
by opensuse-security＠opensuse.org 24 Sep '14

24 Sep '14

SUSE Security Update: Security update for bash ______________________________________________________________________________ Announcement ID: SUSE-SU-2014:1214-1 Rating: critical References: #688469 #770795 #896776 Cross-References: CVE-2012-3410 CVE-2014-0475 Affected Products: SUSE Linux Enterprise Server 10 SP3 LTSS ______________________________________________________________________________ An update that solves two vulnerabilities and has one errata is now available. Description: bash has been updated to fix a critical security issue. In some circumstances, the shell would evaluate shellcode in environment variables passed at startup time. This allowed code execution by local or remote attackers who could pass environment variables to bash scripts. (CVE-2014-6271) Additionally, the following bugs have been fixed: * Avoid possible buffer overflow when expanding the /dev/fd prefix with e.g. the test built-in. (CVE-2012-3410) * Enable workaround for changed behavior of sshd. (bnc#688469) Security Issues: * CVE-2014-6271 <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-6271> * CVE-2012-3410 <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2012-3410> Package List: - SUSE Linux Enterprise Server 10 SP3 LTSS (i586 s390x x86_64): bash-3.1-24.32.1 readline-5.1-24.32.1 readline-devel-5.1-24.32.1 - SUSE Linux Enterprise Server 10 SP3 LTSS (s390x x86_64): readline-32bit-5.1-24.32.1 readline-devel-32bit-5.1-24.32.1 References: http://support.novell.com/security/cve/CVE-2012-3410.html http://support.novell.com/security/cve/CVE-2014-0475.html https://bugzilla.suse.com/688469 https://bugzilla.suse.com/770795 https://bugzilla.suse.com/896776 http://download.suse.com/patch/finder/?keywords=fd9fa24daf4d325c609035f0c77… -- To unsubscribe, e-mail: opensuse-security-announce+unsubscribe(a)opensuse.org For additional commands, e-mail: opensuse-security-announce+help(a)opensuse.org

1 0

[security-announce] SUSE-SU-2014:1213-1: critical: Security update for bash
by opensuse-security＠opensuse.org 24 Sep '14

24 Sep '14

SUSE Security Update: Security update for bash ______________________________________________________________________________ Announcement ID: SUSE-SU-2014:1213-1 Rating: critical References: #896776 Cross-References: CVE-2014-0475 Affected Products: SUSE Linux Enterprise Software Development Kit 11 SP3 SUSE Linux Enterprise Server 11 SP3 for VMware SUSE Linux Enterprise Server 11 SP3 SUSE Linux Enterprise Server 11 SP2 LTSS SUSE Linux Enterprise Server 10 SP4 LTSS SUSE Linux Enterprise Desktop 11 SP3 ______________________________________________________________________________ An update that fixes one vulnerability is now available. Description: bash has been updated to fix a critical security issue. In some circumstances, the shell would evaluate shellcode in environment variables passed at startup time. This allowed code execution by local or remote attackers who could pass environment variables to bash scripts. (CVE-2014-6271) Security Issues: * CVE-2014-6271 <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-6271> Patch Instructions: To install this SUSE Security Update use YaST online_update. Alternatively you can run the command listed for your product: - SUSE Linux Enterprise Software Development Kit 11 SP3: zypper in -t patch sdksp3-bash-9740 - SUSE Linux Enterprise Server 11 SP3 for VMware: zypper in -t patch slessp3-bash-9740 - SUSE Linux Enterprise Server 11 SP3: zypper in -t patch slessp3-bash-9740 - SUSE Linux Enterprise Server 11 SP2 LTSS: zypper in -t patch slessp2-bash-9736 - SUSE Linux Enterprise Desktop 11 SP3: zypper in -t patch sledsp3-bash-9740 To bring your system up-to-date, use "zypper patch". Package List: - SUSE Linux Enterprise Software Development Kit 11 SP3 (i586 ia64 ppc64 s390x x86_64): readline-devel-5.2-147.20.1 - SUSE Linux Enterprise Software Development Kit 11 SP3 (ppc64 s390x x86_64): readline-devel-32bit-5.2-147.20.1 - SUSE Linux Enterprise Software Development Kit 11 SP3 (i586 x86_64): libreadline5-5.2-147.20.1 - SUSE Linux Enterprise Server 11 SP3 for VMware (i586 x86_64): bash-3.2-147.20.1 bash-doc-3.2-147.20.1 libreadline5-5.2-147.20.1 readline-doc-5.2-147.20.1 - SUSE Linux Enterprise Server 11 SP3 for VMware (x86_64): libreadline5-32bit-5.2-147.20.1 - SUSE Linux Enterprise Server 11 SP3 (i586 ia64 ppc64 s390x x86_64): bash-3.2-147.20.1 bash-doc-3.2-147.20.1 libreadline5-5.2-147.20.1 readline-doc-5.2-147.20.1 - SUSE Linux Enterprise Server 11 SP3 (ppc64 s390x x86_64): libreadline5-32bit-5.2-147.20.1 - SUSE Linux Enterprise Server 11 SP3 (ia64): bash-x86-3.2-147.20.1 libreadline5-x86-5.2-147.20.1 - SUSE Linux Enterprise Server 11 SP2 LTSS (i586 s390x x86_64): bash-3.2-147.14.20.1 bash-doc-3.2-147.14.20.1 libreadline5-5.2-147.14.20.1 readline-doc-5.2-147.14.20.1 - SUSE Linux Enterprise Server 11 SP2 LTSS (s390x x86_64): libreadline5-32bit-5.2-147.14.20.1 - SUSE Linux Enterprise Server 10 SP4 LTSS (i586 s390x x86_64): bash-3.1-24.32.1 readline-5.1-24.32.1 readline-devel-5.1-24.32.1 - SUSE Linux Enterprise Server 10 SP4 LTSS (s390x x86_64): readline-32bit-5.1-24.32.1 readline-devel-32bit-5.1-24.32.1 - SUSE Linux Enterprise Desktop 11 SP3 (i586 x86_64): bash-3.2-147.20.1 bash-doc-3.2-147.20.1 libreadline5-5.2-147.20.1 readline-doc-5.2-147.20.1 - SUSE Linux Enterprise Desktop 11 SP3 (x86_64): libreadline5-32bit-5.2-147.20.1 References: http://support.novell.com/security/cve/CVE-2014-0475.html https://bugzilla.suse.com/896776 http://download.suse.com/patch/finder/?keywords=083b250348bb7e8f6f3e4afc8a2… http://download.suse.com/patch/finder/?keywords=5aa8890d421145a022bf2205e01… http://download.suse.com/patch/finder/?keywords=c0975ef449afcaa55a27dfd2df7… -- To unsubscribe, e-mail: opensuse-security-announce+unsubscribe(a)opensuse.org For additional commands, e-mail: opensuse-security-announce+help(a)opensuse.org

1 0

[security-announce] SUSE-SU-2014:1212-1: critical: Security update for bash
by opensuse-security＠opensuse.org 24 Sep '14

24 Sep '14

SUSE Security Update: Security update for bash ______________________________________________________________________________ Announcement ID: SUSE-SU-2014:1212-1 Rating: critical References: #776694 #819783 #820149 #844550 #896776 Cross-References: CVE-2014-0475 Affected Products: SUSE Linux Enterprise Server 11 SP1 LTSS ______________________________________________________________________________ An update that solves one vulnerability and has four fixes is now available. Description: bash has been updated to fix a critical security issue. In some circumstances, the shell would evaluate shellcode in environment variables passed at startup time. This allowed code execution by local or remote attackers who could pass environment variables to bash scripts. (CVE-2014-6271) Additionally, the following bugs have been fixed: * Fix crash when expanding '$[' without matching ']'. (bnc#844550) * Do not restart the signal handler after a trap is reset. (bnc#820149) * Work around a crash in libreadline. (bnc#819783) * Make skeleton files configurations files. (bnc#776694) Security Issues: * CVE-2014-6271 <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-6271> Patch Instructions: To install this SUSE Security Update use YaST online_update. Alternatively you can run the command listed for your product: - SUSE Linux Enterprise Server 11 SP1 LTSS: zypper in -t patch slessp1-bash-9738 To bring your system up-to-date, use "zypper patch". Package List: - SUSE Linux Enterprise Server 11 SP1 LTSS (i586 s390x x86_64): bash-3.2-147.14.20.1 bash-doc-3.2-147.14.20.1 libreadline5-5.2-147.14.20.1 readline-doc-5.2-147.14.20.1 - SUSE Linux Enterprise Server 11 SP1 LTSS (s390x x86_64): libreadline5-32bit-5.2-147.14.20.1 References: http://support.novell.com/security/cve/CVE-2014-0475.html https://bugzilla.suse.com/776694 https://bugzilla.suse.com/819783 https://bugzilla.suse.com/820149 https://bugzilla.suse.com/844550 https://bugzilla.suse.com/896776 http://download.suse.com/patch/finder/?keywords=55e9078b7e861e70ae3998e079b… -- To unsubscribe, e-mail: opensuse-security-announce+unsubscribe(a)opensuse.org For additional commands, e-mail: opensuse-security-announce+help(a)opensuse.org

1 0

[security-announce] openSUSE-SU-2014:1151-1: important: chromium to 37.0.2062.94
by opensuse-security＠opensuse.org 22 Sep '14

22 Sep '14

openSUSE Security Update: chromium to 37.0.2062.94 ______________________________________________________________________________ Announcement ID: openSUSE-SU-2014:1151-1 Rating: important References: #893720 Cross-References: CVE-2014-3168 CVE-2014-3169 CVE-2014-3170 CVE-2014-3171 CVE-2014-3172 CVE-2014-3173 CVE-2014-3174 CVE-2014-3176 CVE-2014-3177 Affected Products: openSUSE 13.1 openSUSE 12.3 ______________________________________________________________________________ An update that fixes 9 vulnerabilities is now available. Description: Chromium was updated to 37.0.2062.94 containing security Fixes (bnc#893720). A full list of changes is available in the log: https://chromium.googlesource.com/chromium/src/+log/36.0.1985.0..37.0.2062. 0?pretty=full This update includes 50 security fixes. Below, we highlight fixes that were either contributed by external researchers or particularly interesting. Please see the Chromium security page for more information. Critical CVE-2014-3176, CVE-2014-3177: A special reward to lokihardt@asrt for a combination of bugs in V8, IPC, sync, and extensions that can lead to remote code execution outside of the sandbox. High CVE-2014-3168: Use-after-free in SVG. Credit to cloudfuzzer. High CVE-2014-3169: Use-after-free in DOM. Credit to Andrzej Dyjak. High CVE-2014-3170: Extension permission dialog spoofing. Credit to Rob Wu. High CVE-2014-3171: Use-after-free in bindings. Credit to cloudfuzzer. Medium CVE-2014-3172: Issue related to extension debugging. Credit to Eli Grey. Medium CVE-2014-3173: Uninitialized memory read in WebGL. Credit to jmuizelaar. Medium CVE-2014-3174: Uninitialized memory read in Web Audio. Credit to Atte Kettunen from OUSPG. We would also like to thank Collin Payne, Christoph Diehl, Sebastian Mauer, Atte Kettunen, and cloudfuzzer for working with us during the development cycle to prevent security bugs from ever reaching the stable channel. $8000 in additional rewards were issued. As usual, our ongoing internal security work responsible for a wide range of fixes: CVE-2014-3175: Various fixes from internal audits, fuzzing and other initiatives (Chrome 37). Many of the above bugs were detected using AddressSanitizer. Patch Instructions: To install this openSUSE Security Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE 13.1: zypper in -t patch openSUSE-2014-550 - openSUSE 12.3: zypper in -t patch openSUSE-2014-550 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE 13.1 (i586 x86_64): chromedriver-37.0.2062.94-50.1 chromedriver-debuginfo-37.0.2062.94-50.1 chromium-37.0.2062.94-50.1 chromium-debuginfo-37.0.2062.94-50.1 chromium-debugsource-37.0.2062.94-50.1 chromium-desktop-gnome-37.0.2062.94-50.1 chromium-desktop-kde-37.0.2062.94-50.1 chromium-ffmpegsumo-37.0.2062.94-50.1 chromium-ffmpegsumo-debuginfo-37.0.2062.94-50.1 - openSUSE 12.3 (i586 x86_64): chromedriver-37.0.2062.94-1.55.3 chromedriver-debuginfo-37.0.2062.94-1.55.3 chromium-37.0.2062.94-1.55.3 chromium-debuginfo-37.0.2062.94-1.55.3 chromium-debugsource-37.0.2062.94-1.55.3 chromium-desktop-gnome-37.0.2062.94-1.55.3 chromium-desktop-kde-37.0.2062.94-1.55.3 chromium-ffmpegsumo-37.0.2062.94-1.55.3 chromium-ffmpegsumo-debuginfo-37.0.2062.94-1.55.3 References: http://support.novell.com/security/cve/CVE-2014-3168.html http://support.novell.com/security/cve/CVE-2014-3169.html http://support.novell.com/security/cve/CVE-2014-3170.html http://support.novell.com/security/cve/CVE-2014-3171.html http://support.novell.com/security/cve/CVE-2014-3172.html http://support.novell.com/security/cve/CVE-2014-3173.html http://support.novell.com/security/cve/CVE-2014-3174.html http://support.novell.com/security/cve/CVE-2014-3176.html http://support.novell.com/security/cve/CVE-2014-3177.html https://bugzilla.novell.com/893720 -- To unsubscribe, e-mail: opensuse-security-announce+unsubscribe(a)opensuse.org For additional commands, e-mail: opensuse-security-announce+help(a)opensuse.org

1 0

[security-announce] SUSE-SU-2014:1146-1: important: Security update for dbus-1
by opensuse-security＠opensuse.org 19 Sep '14

19 Sep '14

SUSE Security Update: Security update for dbus-1 ______________________________________________________________________________ Announcement ID: SUSE-SU-2014:1146-1 Rating: important References: #896453 Cross-References: CVE-2014-3638 Affected Products: SUSE Linux Enterprise Software Development Kit 11 SP3 SUSE Linux Enterprise Server 11 SP3 for VMware SUSE Linux Enterprise Server 11 SP3 SUSE Linux Enterprise Desktop 11 SP3 ______________________________________________________________________________ An update that fixes one vulnerability is now available. Description: Various denial of service issues were fixed in the DBUS service. * CVE-2014-3638: dbus-daemon tracks whether method call messages expect a reply, so that unsolicited replies can be dropped. As currently implemented, if there are n parallel method calls in progress, each method reply takes O(n) CPU time. A malicious user could exploit this by opening the maximum allowed number of parallel connections and sending the maximum number of parallel method calls on each one, causing subsequent method calls to be unreasonably slow, a denial of service. * CVE-2014-3639: dbus-daemon allows a small number of "incomplete" connections (64 by default) whose identity has not yet been confirmed. When this limit has been reached, subsequent connections are dropped. Alban's testing indicates that one malicious process that makes repeated connection attempts, but never completes the authentication handshake and instead waits for dbus-daemon to time out and disconnect it, can cause the majority of legitimate connection attempts to fail. Security Issues: * CVE-2014-3638 <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-3638> * CVE-2014-3638 <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-3638> Patch Instructions: To install this SUSE Security Update use YaST online_update. Alternatively you can run the command listed for your product: - SUSE Linux Enterprise Software Development Kit 11 SP3: zypper in -t patch sdksp3-dbus-1-9733 - SUSE Linux Enterprise Server 11 SP3 for VMware: zypper in -t patch slessp3-dbus-1-9733 - SUSE Linux Enterprise Server 11 SP3: zypper in -t patch slessp3-dbus-1-9733 - SUSE Linux Enterprise Desktop 11 SP3: zypper in -t patch sledsp3-dbus-1-9733 To bring your system up-to-date, use "zypper patch". Package List: - SUSE Linux Enterprise Software Development Kit 11 SP3 (i586 ia64 ppc64 s390x x86_64): dbus-1-devel-1.2.10-3.31.1 dbus-1-devel-doc-1.2.10-3.31.1 - SUSE Linux Enterprise Server 11 SP3 for VMware (i586 x86_64): dbus-1-1.2.10-3.31.1 dbus-1-x11-1.2.10-3.31.1 - SUSE Linux Enterprise Server 11 SP3 for VMware (x86_64): dbus-1-32bit-1.2.10-3.31.1 - SUSE Linux Enterprise Server 11 SP3 (i586 ia64 ppc64 s390x x86_64): dbus-1-1.2.10-3.31.1 dbus-1-x11-1.2.10-3.31.1 - SUSE Linux Enterprise Server 11 SP3 (ppc64 s390x x86_64): dbus-1-32bit-1.2.10-3.31.1 - SUSE Linux Enterprise Server 11 SP3 (ia64): dbus-1-x86-1.2.10-3.31.1 - SUSE Linux Enterprise Desktop 11 SP3 (i586 x86_64): dbus-1-1.2.10-3.31.1 dbus-1-x11-1.2.10-3.31.1 - SUSE Linux Enterprise Desktop 11 SP3 (x86_64): dbus-1-32bit-1.2.10-3.31.1 References: http://support.novell.com/security/cve/CVE-2014-3638.html https://bugzilla.novell.com/896453 http://download.suse.com/patch/finder/?keywords=d849773a0381e2782725dff6711… -- To unsubscribe, e-mail: opensuse-security-announce+unsubscribe(a)opensuse.org For additional commands, e-mail: opensuse-security-announce+help(a)opensuse.org

1 0

[security-announce] SUSE-SU-2014:1140-1: important: Security update for squid3
by opensuse-security＠opensuse.org 17 Sep '14

17 Sep '14

SUSE Security Update: Security update for squid3 ______________________________________________________________________________ Announcement ID: SUSE-SU-2014:1140-1 Rating: important References: #893649 Cross-References: CVE-2014-3609 Affected Products: SUSE Linux Enterprise Server 11 SP3 for VMware SUSE Linux Enterprise Server 11 SP3 ______________________________________________________________________________ An update that fixes one vulnerability is now available. Description: Squid3 was updated to fix a denial of service in Range Header processing, which would have allowed proxy users to crash the squid proxy process. (CVE-2014-3609) Security Issues: * CVE-2014-3609 <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-3609> Patch Instructions: To install this SUSE Security Update use YaST online_update. Alternatively you can run the command listed for your product: - SUSE Linux Enterprise Server 11 SP3 for VMware: zypper in -t patch slessp3-squid3-9729 - SUSE Linux Enterprise Server 11 SP3: zypper in -t patch slessp3-squid3-9729 To bring your system up-to-date, use "zypper patch". Package List: - SUSE Linux Enterprise Server 11 SP3 for VMware (i586 x86_64): squid3-3.1.12-8.16.20.1 - SUSE Linux Enterprise Server 11 SP3 (i586 ia64 ppc64 s390x x86_64): squid3-3.1.12-8.16.20.1 References: http://support.novell.com/security/cve/CVE-2014-3609.html https://bugzilla.novell.com/893649 http://download.suse.com/patch/finder/?keywords=3bbd1bc6081bef0e6021f21703b… -- To unsubscribe, e-mail: opensuse-security-announce+unsubscribe(a)opensuse.org For additional commands, e-mail: opensuse-security-announce+help(a)opensuse.org

1 0

[security-announce] openSUSE-SU-2014:1139-1: important: curl
by opensuse-security＠opensuse.org 17 Sep '14

17 Sep '14

openSUSE Security Update: curl ______________________________________________________________________________ Announcement ID: openSUSE-SU-2014:1139-1 Rating: important References: #894575 #895991 Cross-References: CVE-2014-3613 CVE-2014-3620 Affected Products: openSUSE 13.1 openSUSE 12.3 ______________________________________________________________________________ An update that fixes two vulnerabilities is now available. Description: libcurl was updated to fix security issues: CVE-2014-3613: Cookies for hosts specified by numeric IP could be assigned or used for other numeric IP hosts if portions of the numerics were the same. CVE-2014-3620: libcurl allowed cookies to be set for toplevel domains, making them to broad. Patch Instructions: To install this openSUSE Security Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE 13.1: zypper in -t patch openSUSE-2014-547 - openSUSE 12.3: zypper in -t patch openSUSE-2014-547 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE 13.1 (i586 x86_64): curl-7.32.0-2.27.1 curl-debuginfo-7.32.0-2.27.1 curl-debugsource-7.32.0-2.27.1 libcurl-devel-7.32.0-2.27.1 libcurl4-7.32.0-2.27.1 libcurl4-debuginfo-7.32.0-2.27.1 - openSUSE 13.1 (x86_64): libcurl4-32bit-7.32.0-2.27.1 libcurl4-debuginfo-32bit-7.32.0-2.27.1 - openSUSE 12.3 (i586 x86_64): curl-7.28.1-4.43.1 curl-debuginfo-7.28.1-4.43.1 curl-debugsource-7.28.1-4.43.1 libcurl-devel-7.28.1-4.43.1 libcurl4-7.28.1-4.43.1 libcurl4-debuginfo-7.28.1-4.43.1 - openSUSE 12.3 (x86_64): libcurl4-32bit-7.28.1-4.43.1 libcurl4-debuginfo-32bit-7.28.1-4.43.1 References: http://support.novell.com/security/cve/CVE-2014-3613.html http://support.novell.com/security/cve/CVE-2014-3620.html https://bugzilla.novell.com/894575 https://bugzilla.novell.com/895991 -- To unsubscribe, e-mail: opensuse-security-announce+unsubscribe(a)opensuse.org For additional commands, e-mail: opensuse-security-announce+help(a)opensuse.org

1 0

[security-announce] SUSE-SU-2014:1138-1: important: Security update for the Linux Kernel
by opensuse-security＠opensuse.org 16 Sep '14

16 Sep '14

SUSE Security Update: Security update for the Linux Kernel ______________________________________________________________________________ Announcement ID: SUSE-SU-2014:1138-1 Rating: important References: #794824 #806431 #831058 #854722 #856756 #871797 #877257 #879921 #880484 #881051 #882809 #883526 #883724 #883795 #884530 #885422 #885725 #887082 #889173 #892490 Cross-References: CVE-2013-1860 CVE-2013-4162 CVE-2013-7266 CVE-2013-7267 CVE-2013-7268 CVE-2013-7269 CVE-2013-7270 CVE-2013-7271 CVE-2014-0203 CVE-2014-3144 CVE-2014-3145 CVE-2014-3917 CVE-2014-4508 CVE-2014-4652 CVE-2014-4653 CVE-2014-4654 CVE-2014-4655 CVE-2014-4656 CVE-2014-4667 CVE-2014-4699 CVE-2014-4943 CVE-2014-5077 Affected Products: SUSE Linux Enterprise Server 11 SP1 LTSS SLE 11 SERVER Unsupported Extras ______________________________________________________________________________ An update that fixes 22 vulnerabilities is now available. It includes one version update. Description: The SUSE Linux Enterprise Server 11 SP1 LTSS received a roll up update to fix several security and non-security issues. The following security issues have been fixed: * CVE-2013-1860: Heap-based buffer overflow in the wdm_in_callback function in drivers/usb/class/cdc-wdm.c in the Linux kernel before 3.8.4 allows physically proximate attackers to cause a denial of service (system crash) or possibly execute arbitrary code via a crafted cdc-wdm USB device. (bnc#806431) * CVE-2013-4162: The udp_v6_push_pending_frames function in net/ipv6/udp.c in the IPv6 implementation in the Linux kernel through 3.10.3 makes an incorrect function call for pending data, which allows local users to cause a denial of service (BUG and system crash) via a crafted application that uses the UDP_CORK option in a setsockopt system call. (bnc#831058) * CVE-2014-0203: The __do_follow_link function in fs/namei.c in the Linux kernel before 2.6.33 does not properly handle the last pathname component during use of certain filesystems, which allows local users to cause a denial of service (incorrect free operations and system crash) via an open system call. (bnc#883526) * CVE-2014-3144: The (1) BPF_S_ANC_NLATTR and (2) BPF_S_ANC_NLATTR_NEST extension implementations in the sk_run_filter function in net/core/filter.c in the Linux kernel through 3.14.3 do not check whether a certain length value is sufficiently large, which allows local users to cause a denial of service (integer underflow and system crash) via crafted BPF instructions. NOTE: the affected code was moved to the __skb_get_nlattr and __skb_get_nlattr_nest functions before the vulnerability was announced. (bnc#877257) * CVE-2014-3145: The BPF_S_ANC_NLATTR_NEST extension implementation in the sk_run_filter function in net/core/filter.c in the Linux kernel through 3.14.3 uses the reverse order in a certain subtraction, which allows local users to cause a denial of service (over-read and system crash) via crafted BPF instructions. NOTE: the affected code was moved to the __skb_get_nlattr_nest function before the vulnerability was announced. (bnc#877257) * CVE-2014-3917: kernel/auditsc.c in the Linux kernel through 3.14.5, when CONFIG_AUDITSYSCALL is enabled with certain syscall rules, allows local users to obtain potentially sensitive single-bit values from kernel memory or cause a denial of service (OOPS) via a large value of a syscall number. (bnc#880484) * CVE-2014-4508: arch/x86/kernel/entry_32.S in the Linux kernel through 3.15.1 on 32-bit x86 platforms, when syscall auditing is enabled and the sep CPU feature flag is set, allows local users to cause a denial of service (OOPS and system crash) via an invalid syscall number, as demonstrated by number 1000. (bnc#883724) * CVE-2014-4652: Race condition in the tlv handler functionality in the snd_ctl_elem_user_tlv function in sound/core/control.c in the ALSA control implementation in the Linux kernel before 3.15.2 allows local users to obtain sensitive information from kernel memory by leveraging /dev/snd/controlCX access. (bnc#883795) * CVE-2014-4653: sound/core/control.c in the ALSA control implementation in the Linux kernel before 3.15.2 does not ensure possession of a read/write lock, which allows local users to cause a denial of service (use-after-free) and obtain sensitive information from kernel memory by leveraging /dev/snd/controlCX access. (bnc#883795) * CVE-2014-4654: The snd_ctl_elem_add function in sound/core/control.c in the ALSA control implementation in the Linux kernel before 3.15.2 does not check authorization for SNDRV_CTL_IOCTL_ELEM_REPLACE commands, which allows local users to remove kernel controls and cause a denial of service (use-after-free and system crash) by leveraging /dev/snd/controlCX access for an ioctl call. (bnc#883795) * CVE-2014-4655: The snd_ctl_elem_add function in sound/core/control.c in the ALSA control implementation in the Linux kernel before 3.15.2 does not properly maintain the user_ctl_count value, which allows local users to cause a denial of service (integer overflow and limit bypass) by leveraging /dev/snd/controlCX access for a large number of SNDRV_CTL_IOCTL_ELEM_REPLACE ioctl calls. (bnc#883795) * CVE-2014-4656: Multiple integer overflows in sound/core/control.c in the ALSA control implementation in the Linux kernel before 3.15.2 allow local users to cause a denial of service by leveraging /dev/snd/controlCX access, related to (1) index values in the snd_ctl_add function and (2) numid values in the snd_ctl_remove_numid_conflict function. (bnc#883795) * CVE-2014-4667: The sctp_association_free function in net/sctp/associola.c in the Linux kernel before 3.15.2 does not properly manage a certain backlog value, which allows remote attackers to cause a denial of service (socket outage) via a crafted SCTP packet. (bnc#885422) * CVE-2014-4699: The Linux kernel before 3.15.4 on Intel processors does not properly restrict use of a non-canonical value for the saved RIP address in the case of a system call that does not use IRET, which allows local users to leverage a race condition and gain privileges, or cause a denial of service (double fault), via a crafted application that makes ptrace and fork system calls. (bnc#885725) * CVE-2014-4943: The PPPoL2TP feature in net/l2tp/l2tp_ppp.c in the Linux kernel through 3.15.6 allows local users to gain privileges by leveraging data-structure differences between an l2tp socket and an inet socket. (bnc#887082) * CVE-2014-5077: The sctp_assoc_update function in net/sctp/associola.c in the Linux kernel through 3.15.8, when SCTP authentication is enabled, allows remote attackers to cause a denial of service (NULL pointer dereference and OOPS) by starting to establish an association between two endpoints immediately after an exchange of INIT and INIT ACK chunks to establish an earlier association between these endpoints in the opposite direction. (bnc#889173) * CVE-2013-7266: The mISDN_sock_recvmsg function in drivers/isdn/mISDN/socket.c in the Linux kernel before 3.12.4 does not ensure that a certain length value is consistent with the size of an associated data structure, which allows local users to obtain sensitive information from kernel memory via a (1) recvfrom, (2) recvmmsg, or (3) recvmsg system call. (bnc#854722) * CVE-2013-7267: The atalk_recvmsg function in net/appletalk/ddp.c in the Linux kernel before 3.12.4 updates a certain length value without ensuring that an associated data structure has been initialized, which allows local users to obtain sensitive information from kernel memory via a (1) recvfrom, (2) recvmmsg, or (3) recvmsg system call. (bnc#854722) * CVE-2013-7268: The ipx_recvmsg function in net/ipx/af_ipx.c in the Linux kernel before 3.12.4 updates a certain length value without ensuring that an associated data structure has been initialized, which allows local users to obtain sensitive information from kernel memory via a (1) recvfrom, (2) recvmmsg, or (3) recvmsg system call. (bnc#854722) * CVE-2013-7269: The nr_recvmsg function in net/netrom/af_netrom.c in the Linux kernel before 3.12.4 updates a certain length value without ensuring that an associated data structure has been initialized, which allows local users to obtain sensitive information from kernel memory via a (1) recvfrom, (2) recvmmsg, or (3) recvmsg system call. (bnc#854722) * CVE-2013-7270: The packet_recvmsg function in net/packet/af_packet.c in the Linux kernel before 3.12.4 updates a certain length value before ensuring that an associated data structure has been initialized, which allows local users to obtain sensitive information from kernel memory via a (1) recvfrom, (2) recvmmsg, or (3) recvmsg system call. (bnc#854722) * CVE-2013-7271: The x25_recvmsg function in net/x25/af_x25.c in the Linux kernel before 3.12.4 updates a certain length value without ensuring that an associated data structure has been initialized, which allows local users to obtain sensitive information from kernel memory via a (1) recvfrom, (2) recvmmsg, or (3) recvmsg system call. (bnc#854722) The following bugs have been fixed: * mac80211: Fix AP powersave TX vs. wakeup race (bnc#871797). * tcp: Allow to disable cwnd moderation in TCP_CA_Loss state (bnc#879921). * tcp: Adapt selected parts of RFC 5682 and PRR logic (bnc#879921). * flock: Fix allocation and BKL (bnc#882809). * sunrpc: Close a rare race in xs_tcp_setup_socket (bnc#794824, bnc#884530). * isofs: Fix unbounded recursion when processing relocated directories (bnc#892490). * bonding: Fix a race condition on cleanup in bond_send_unsolicited_na() (bnc#856756). * block: Fix race between request completion and timeout handling (bnc#881051). * Fix kABI breakage due to addition of user_ctl_lock (bnc#883795). Security Issues: * CVE-2013-1860 <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2013-1860> * CVE-2013-4162 <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2013-4162> * CVE-2013-7266 <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2013-7266> * CVE-2013-7267 <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2013-7267> * CVE-2013-7268 <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2013-7268> * CVE-2013-7269 <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2013-7269> * CVE-2013-7270 <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2013-7270> * CVE-2013-7271 <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2013-7271> * CVE-2014-0203 <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-0203> * CVE-2014-3144 <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-3144> * CVE-2014-3145 <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-3145> * CVE-2014-3917 <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-3917> * CVE-2014-4508 <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-4508> * CVE-2014-4652 <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-4652> * CVE-2014-4653 <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-4653> * CVE-2014-4654 <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-4654> * CVE-2014-4655 <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-4655> * CVE-2014-4656 <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-4656> * CVE-2014-4667 <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-4667> * CVE-2014-4699 <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-4699> * CVE-2014-4943 <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-4943> * CVE-2014-5077 <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-5077> Indications: Everyone using the Linux Kernel on x86_64 architecture should update. Special Instructions and Notes: Please reboot the system after installing this update. Patch Instructions: To install this SUSE Security Update use YaST online_update. Alternatively you can run the command listed for your product: - SUSE Linux Enterprise Server 11 SP1 LTSS: zypper in -t patch slessp1-kernel-9658 slessp1-kernel-9660 slessp1-kernel-9667 To bring your system up-to-date, use "zypper patch". Package List: - SUSE Linux Enterprise Server 11 SP1 LTSS (i586 s390x x86_64) [New Version: 2.6.32.59]: kernel-default-2.6.32.59-0.15.2 kernel-default-base-2.6.32.59-0.15.2 kernel-default-devel-2.6.32.59-0.15.2 kernel-source-2.6.32.59-0.15.2 kernel-syms-2.6.32.59-0.15.2 kernel-trace-2.6.32.59-0.15.2 kernel-trace-base-2.6.32.59-0.15.2 kernel-trace-devel-2.6.32.59-0.15.2 - SUSE Linux Enterprise Server 11 SP1 LTSS (i586 x86_64) [New Version: 2.6.32.59]: kernel-ec2-2.6.32.59-0.15.2 kernel-ec2-base-2.6.32.59-0.15.2 kernel-ec2-devel-2.6.32.59-0.15.2 kernel-xen-2.6.32.59-0.15.2 kernel-xen-base-2.6.32.59-0.15.2 kernel-xen-devel-2.6.32.59-0.15.2 xen-kmp-default-4.0.3_21548_16_2.6.32.59_0.15-0.5.26 xen-kmp-trace-4.0.3_21548_16_2.6.32.59_0.15-0.5.26 - SUSE Linux Enterprise Server 11 SP1 LTSS (s390x) [New Version: 2.6.32.59]: kernel-default-man-2.6.32.59-0.15.2 - SUSE Linux Enterprise Server 11 SP1 LTSS (i586) [New Version: 2.6.32.59]: kernel-pae-2.6.32.59-0.15.2 kernel-pae-base-2.6.32.59-0.15.2 kernel-pae-devel-2.6.32.59-0.15.2 xen-kmp-pae-4.0.3_21548_16_2.6.32.59_0.15-0.5.26 - SLE 11 SERVER Unsupported Extras (i586 s390x x86_64): kernel-default-extra-2.6.32.59-0.15.2 - SLE 11 SERVER Unsupported Extras (i586 x86_64): kernel-xen-extra-2.6.32.59-0.15.2 - SLE 11 SERVER Unsupported Extras (i586): kernel-pae-extra-2.6.32.59-0.15.2 References: http://support.novell.com/security/cve/CVE-2013-1860.html http://support.novell.com/security/cve/CVE-2013-4162.html http://support.novell.com/security/cve/CVE-2013-7266.html http://support.novell.com/security/cve/CVE-2013-7267.html http://support.novell.com/security/cve/CVE-2013-7268.html http://support.novell.com/security/cve/CVE-2013-7269.html http://support.novell.com/security/cve/CVE-2013-7270.html http://support.novell.com/security/cve/CVE-2013-7271.html http://support.novell.com/security/cve/CVE-2014-0203.html http://support.novell.com/security/cve/CVE-2014-3144.html http://support.novell.com/security/cve/CVE-2014-3145.html http://support.novell.com/security/cve/CVE-2014-3917.html http://support.novell.com/security/cve/CVE-2014-4508.html http://support.novell.com/security/cve/CVE-2014-4652.html http://support.novell.com/security/cve/CVE-2014-4653.html http://support.novell.com/security/cve/CVE-2014-4654.html http://support.novell.com/security/cve/CVE-2014-4655.html http://support.novell.com/security/cve/CVE-2014-4656.html http://support.novell.com/security/cve/CVE-2014-4667.html http://support.novell.com/security/cve/CVE-2014-4699.html http://support.novell.com/security/cve/CVE-2014-4943.html http://support.novell.com/security/cve/CVE-2014-5077.html https://bugzilla.novell.com/794824 https://bugzilla.novell.com/806431 https://bugzilla.novell.com/831058 https://bugzilla.novell.com/854722 https://bugzilla.novell.com/856756 https://bugzilla.novell.com/871797 https://bugzilla.novell.com/877257 https://bugzilla.novell.com/879921 https://bugzilla.novell.com/880484 https://bugzilla.novell.com/881051 https://bugzilla.novell.com/882809 https://bugzilla.novell.com/883526 https://bugzilla.novell.com/883724 https://bugzilla.novell.com/883795 https://bugzilla.novell.com/884530 https://bugzilla.novell.com/885422 https://bugzilla.novell.com/885725 https://bugzilla.novell.com/887082 https://bugzilla.novell.com/889173 https://bugzilla.novell.com/892490 http://download.suse.com/patch/finder/?keywords=33223d7de0d6fcaf9f12c0175a7… http://download.suse.com/patch/finder/?keywords=753dcd87154cfcee28dc062d042… http://download.suse.com/patch/finder/?keywords=ad20790f90bee656575f760123b… http://download.suse.com/patch/finder/?keywords=bb89429b2b6bbf8e51a9b446b5a… http://download.suse.com/patch/finder/?keywords=cc2185e1b7bb5f72a49d967c7dc… http://download.suse.com/patch/finder/?keywords=f3d32743e8c31acee5f4fb83692… -- To unsubscribe, e-mail: opensuse-security-announce+unsubscribe(a)opensuse.org For additional commands, e-mail: opensuse-security-announce+help(a)opensuse.org

1 0

[security-announce] SUSE-SU-2014:1137-1: important: Security update for procmail
by opensuse-security＠opensuse.org 16 Sep '14

16 Sep '14

SUSE Security Update: Security update for procmail ______________________________________________________________________________ Announcement ID: SUSE-SU-2014:1137-1 Rating: important References: #894999 Cross-References: CVE-2014-3618 Affected Products: SUSE Linux Enterprise Server 11 SP3 for VMware SUSE Linux Enterprise Server 11 SP3 SUSE Linux Enterprise Desktop 11 SP3 ______________________________________________________________________________ An update that fixes one vulnerability is now available. Description: procmail was updated to fix a security issue in its formail helper. * When formail processed specially crafted e-mail headers a heap corruption could be triggered, which would lead to a crash of formail. (CVE-2014-3618) Security Issues: * CVE-2014-3618 <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-3618> Patch Instructions: To install this SUSE Security Update use YaST online_update. Alternatively you can run the command listed for your product: - SUSE Linux Enterprise Server 11 SP3 for VMware: zypper in -t patch slessp3-procmail-9689 - SUSE Linux Enterprise Server 11 SP3: zypper in -t patch slessp3-procmail-9689 - SUSE Linux Enterprise Desktop 11 SP3: zypper in -t patch sledsp3-procmail-9689 To bring your system up-to-date, use "zypper patch". Package List: - SUSE Linux Enterprise Server 11 SP3 for VMware (i586 x86_64): procmail-3.22-240.8.1 - SUSE Linux Enterprise Server 11 SP3 (i586 ia64 ppc64 s390x x86_64): procmail-3.22-240.8.1 - SUSE Linux Enterprise Desktop 11 SP3 (i586 x86_64): procmail-3.22-240.8.1 References: http://support.novell.com/security/cve/CVE-2014-3618.html https://bugzilla.novell.com/894999 http://download.suse.com/patch/finder/?keywords=04c0ff20564be8dcec09a614771… -- To unsubscribe, e-mail: opensuse-security-announce+unsubscribe(a)opensuse.org For additional commands, e-mail: opensuse-security-announce+help(a)opensuse.org

1 0

[security-announce] openSUSE-SU-2014:1130-1: important: update flash-player to 11.2.202.40
by opensuse-security＠opensuse.org 15 Sep '14

15 Sep '14

openSUSE Security Update: update flash-player to 11.2.202.40 ______________________________________________________________________________ Announcement ID: openSUSE-SU-2014:1130-1 Rating: important References: #895856 Cross-References: CVE-2014-0547 CVE-2014-0548 CVE-2014-0549 CVE-2014-0550 CVE-2014-0551 CVE-2014-0552 CVE-2014-0553 CVE-2014-0554 CVE-2014-0555 CVE-2014-0556 CVE-2014-0557 CVE-2014-0559 Affected Products: openSUSE 11.4 ______________________________________________________________________________ An update that fixes 12 vulnerabilities is now available. Description: Adobe Flash Player was updated to 11.2.202.406 (bnc#895856): * APSB14-21, CVE-2014-0547, CVE-2014-0548, CVE-2014-0549, CVE-2014-0550, CVE-2014-0551, CVE-2014-0552, CVE-2014-0553, CVE-2014-0554, CVE-2014-0555, CVE-2014-0556, CVE-2014-0557, CVE-2014-0559 More information can be found on: http://helpx.adobe.com/security/products/flash-player/apsb14-21.html Patch Instructions: To install this openSUSE Security Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE 11.4: zypper in -t patch 2014-83 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE 11.4 (i586 x86_64): flash-player-11.2.202.406-127.1 flash-player-gnome-11.2.202.406-127.1 flash-player-kde4-11.2.202.406-127.1 References: http://support.novell.com/security/cve/CVE-2014-0547.html http://support.novell.com/security/cve/CVE-2014-0548.html http://support.novell.com/security/cve/CVE-2014-0549.html http://support.novell.com/security/cve/CVE-2014-0550.html http://support.novell.com/security/cve/CVE-2014-0551.html http://support.novell.com/security/cve/CVE-2014-0552.html http://support.novell.com/security/cve/CVE-2014-0553.html http://support.novell.com/security/cve/CVE-2014-0554.html http://support.novell.com/security/cve/CVE-2014-0555.html http://support.novell.com/security/cve/CVE-2014-0556.html http://support.novell.com/security/cve/CVE-2014-0557.html http://support.novell.com/security/cve/CVE-2014-0559.html https://bugzilla.novell.com/895856 -- To unsubscribe, e-mail: opensuse-security-announce+unsubscribe(a)opensuse.org For additional commands, e-mail: opensuse-security-announce+help(a)opensuse.org

1 0

[security-announce] SUSE-SU-2014:1129-1: important: Security update for glibc
by opensuse-security＠opensuse.org 15 Sep '14

15 Sep '14

SUSE Security Update: Security update for glibc ______________________________________________________________________________ Announcement ID: SUSE-SU-2014:1129-1 Rating: important References: #836746 #844309 #892073 #894553 #894556 Cross-References: CVE-2012-6656 CVE-2013-4357 CVE-2014-5119 CVE-2014-6040 Affected Products: SUSE Linux Enterprise Server 11 SP2 LTSS ______________________________________________________________________________ An update that solves four vulnerabilities and has one errata is now available. Description: This glibc update fixes a critical privilege escalation problem and two additional issues: * bnc#892073: An off-by-one error leading to a heap-based buffer overflow was found in __gconv_translit_find(). An exploit that targets the problem is publicly available. (CVE-2014-5119) * bnc#836746: Avoid race between {, __de}allocate_stack and __reclaim_stacks during fork. * bnc#844309: Fixed various overflows, reading large /etc/hosts or long names. (CVE-2013-4357) * bnc#894553, bnc#894556: Fixed various crashes on invalid input in IBM gconv modules. (CVE-2014-6040, CVE-2012-6656) Security Issues: * CVE-2012-6656 <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2012-6656> * CVE-2013-4357 <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2013-4357> * CVE-2014-5119 <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-5119> * CVE-2014-6040 <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-6040> Patch Instructions: To install this SUSE Security Update use YaST online_update. Alternatively you can run the command listed for your product: - SUSE Linux Enterprise Server 11 SP2 LTSS: zypper in -t patch slessp2-glibc-9721 To bring your system up-to-date, use "zypper patch". Package List: - SUSE Linux Enterprise Server 11 SP2 LTSS (i586 i686 s390x x86_64): glibc-2.11.3-17.45.53.1 glibc-devel-2.11.3-17.45.53.1 - SUSE Linux Enterprise Server 11 SP2 LTSS (i586 s390x x86_64): glibc-html-2.11.3-17.45.53.1 glibc-i18ndata-2.11.3-17.45.53.1 glibc-info-2.11.3-17.45.53.1 glibc-locale-2.11.3-17.45.53.1 glibc-profile-2.11.3-17.45.53.1 nscd-2.11.3-17.45.53.1 - SUSE Linux Enterprise Server 11 SP2 LTSS (s390x x86_64): glibc-32bit-2.11.3-17.45.53.1 glibc-devel-32bit-2.11.3-17.45.53.1 glibc-locale-32bit-2.11.3-17.45.53.1 glibc-profile-32bit-2.11.3-17.45.53.1 References: http://support.novell.com/security/cve/CVE-2012-6656.html http://support.novell.com/security/cve/CVE-2013-4357.html http://support.novell.com/security/cve/CVE-2014-5119.html http://support.novell.com/security/cve/CVE-2014-6040.html https://bugzilla.novell.com/836746 https://bugzilla.novell.com/844309 https://bugzilla.novell.com/892073 https://bugzilla.novell.com/894553 https://bugzilla.novell.com/894556 http://download.suse.com/patch/finder/?keywords=cd8403453563e9d5a949d2219d6… -- To unsubscribe, e-mail: opensuse-security-announce+unsubscribe(a)opensuse.org For additional commands, e-mail: opensuse-security-announce+help(a)opensuse.org

1 0

[security-announce] SUSE-SU-2014:1128-1: important: Security update for glibc
by opensuse-security＠opensuse.org 15 Sep '14

15 Sep '14

SUSE Security Update: Security update for glibc ______________________________________________________________________________ Announcement ID: SUSE-SU-2014:1128-1 Rating: important References: #779320 #801246 #824639 #834594 #839870 #842291 #860501 #882600 #892073 #894553 #894556 Cross-References: CVE-2012-4412 CVE-2013-0242 CVE-2013-4237 CVE-2013-4332 CVE-2014-4043 CVE-2014-5119 Affected Products: SUSE Linux Enterprise Server 10 SP3 LTSS ______________________________________________________________________________ An update that solves 6 vulnerabilities and has 5 fixes is now available. Description: This glibc update fixes a critical privilege escalation problem and the following security and non-security issues: * bnc#892073: An off-by-one error leading to a heap-based buffer overflow was found in __gconv_translit_find(). An exploit that targets the problem is publicly available. (CVE-2014-5119) * bnc#882600: Copy filename argument in posix_spawn_file_actions_addopen. (CVE-2014-4043) * bnc#860501: Use O_LARGEFILE for utmp file. * bnc#842291: Fix typo in glibc-2.5-dlopen-lookup-race.diff. * bnc#839870: Fix integer overflows in malloc. (CVE-2013-4332) * bnc#834594: Fix readdir_r with long file names. (CVE-2013-4237) * bnc#824639: Drop lock before calling malloc_printerr. * bnc#801246: Fix buffer overrun in regexp matcher. (CVE-2013-0242) * bnc#779320: Fix buffer overflow in strcoll. (CVE-2012-4412) * bnc#894556 / bnc#894553: Fix crashes on invalid input in IBM gconv modules. (CVE-2014-6040, CVE-2012-6656, bnc#894553, bnc#894556, BZ#17325, BZ#14134) Security Issues: * CVE-2014-5119 <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-5119> * CVE-2014-4043 <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-4043> * CVE-2013-4332 <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2013-4332> * CVE-2013-4237 <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2013-4237> * CVE-2013-0242 <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2013-0242> * CVE-2012-4412 <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2012-4412> Package List: - SUSE Linux Enterprise Server 10 SP3 LTSS (i586 i686 s390x x86_64): glibc-2.4-31.77.112.1 glibc-devel-2.4-31.77.112.1 - SUSE Linux Enterprise Server 10 SP3 LTSS (i586 s390x x86_64): glibc-html-2.4-31.77.112.1 glibc-i18ndata-2.4-31.77.112.1 glibc-info-2.4-31.77.112.1 glibc-locale-2.4-31.77.112.1 glibc-profile-2.4-31.77.112.1 nscd-2.4-31.77.112.1 - SUSE Linux Enterprise Server 10 SP3 LTSS (s390x x86_64): glibc-32bit-2.4-31.77.112.1 glibc-devel-32bit-2.4-31.77.112.1 glibc-locale-32bit-2.4-31.77.112.1 glibc-profile-32bit-2.4-31.77.112.1 References: http://support.novell.com/security/cve/CVE-2012-4412.html http://support.novell.com/security/cve/CVE-2013-0242.html http://support.novell.com/security/cve/CVE-2013-4237.html http://support.novell.com/security/cve/CVE-2013-4332.html http://support.novell.com/security/cve/CVE-2014-4043.html http://support.novell.com/security/cve/CVE-2014-5119.html https://bugzilla.novell.com/779320 https://bugzilla.novell.com/801246 https://bugzilla.novell.com/824639 https://bugzilla.novell.com/834594 https://bugzilla.novell.com/839870 https://bugzilla.novell.com/842291 https://bugzilla.novell.com/860501 https://bugzilla.novell.com/882600 https://bugzilla.novell.com/892073 https://bugzilla.novell.com/894553 https://bugzilla.novell.com/894556 http://download.suse.com/patch/finder/?keywords=190862be14e3ed91b361e0b0a66… -- To unsubscribe, e-mail: opensuse-security-announce+unsubscribe(a)opensuse.org For additional commands, e-mail: opensuse-security-announce+help(a)opensuse.org

1 0

[security-announce] openSUSE-SU-2014:1126-1: important: LibreOffice: two security fixes
by opensuse-security＠opensuse.org 15 Sep '14

15 Sep '14

openSUSE Security Update: LibreOffice: two security fixes ______________________________________________________________________________ Announcement ID: openSUSE-SU-2014:1126-1 Rating: important References: #831578 #893141 Cross-References: CVE-2013-4156 CVE-2014-3575 Affected Products: openSUSE 13.1 openSUSE 12.3 ______________________________________________________________________________ An update that fixes two vulnerabilities is now available. Description: This update fixes memory corruption vulnerability in DOCM import and data exposure using crafted OLE objects. Patch Instructions: To install this openSUSE Security Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE 13.1: zypper in -t patch openSUSE-2014-540 - openSUSE 12.3: zypper in -t patch openSUSE-2014-540 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE 13.1 (i586 x86_64): libreoffice-4.1.6.2-25.1 libreoffice-base-4.1.6.2-25.1 libreoffice-base-debuginfo-4.1.6.2-25.1 libreoffice-base-drivers-mysql-4.1.6.2-25.1 libreoffice-base-drivers-mysql-debuginfo-4.1.6.2-25.1 libreoffice-base-drivers-postgresql-4.1.6.2-25.1 libreoffice-base-drivers-postgresql-debuginfo-4.1.6.2-25.1 libreoffice-base-extensions-4.1.6.2-25.1 libreoffice-calc-4.1.6.2-25.1 libreoffice-calc-debuginfo-4.1.6.2-25.1 libreoffice-calc-extensions-4.1.6.2-25.1 libreoffice-debuginfo-4.1.6.2-25.1 libreoffice-debugsource-4.1.6.2-25.1 libreoffice-draw-4.1.6.2-25.1 libreoffice-draw-debuginfo-4.1.6.2-25.1 libreoffice-draw-extensions-4.1.6.2-25.1 libreoffice-filters-optional-4.1.6.2-25.1 libreoffice-gnome-4.1.6.2-25.1 libreoffice-gnome-debuginfo-4.1.6.2-25.1 libreoffice-icon-themes-prebuilt-4.1.6.2-25.1 libreoffice-impress-4.1.6.2-25.1 libreoffice-impress-debuginfo-4.1.6.2-25.1 libreoffice-impress-extensions-4.1.6.2-25.1 libreoffice-impress-extensions-debuginfo-4.1.6.2-25.1 libreoffice-kde-4.1.6.2-25.1 libreoffice-kde-debuginfo-4.1.6.2-25.1 libreoffice-kde4-4.1.6.2-25.1 libreoffice-kde4-debuginfo-4.1.6.2-25.1 libreoffice-l10n-prebuilt-4.1.6.2-25.1 libreoffice-mailmerge-4.1.6.2-25.1 libreoffice-math-4.1.6.2-25.1 libreoffice-math-debuginfo-4.1.6.2-25.1 libreoffice-officebean-4.1.6.2-25.1 libreoffice-officebean-debuginfo-4.1.6.2-25.1 libreoffice-pyuno-4.1.6.2-25.1 libreoffice-pyuno-debuginfo-4.1.6.2-25.1 libreoffice-sdk-4.1.6.2-25.1 libreoffice-sdk-debuginfo-4.1.6.2-25.1 libreoffice-sdk-doc-4.1.6.2-25.1 libreoffice-writer-4.1.6.2-25.1 libreoffice-writer-debuginfo-4.1.6.2-25.1 libreoffice-writer-extensions-4.1.6.2-25.1 - openSUSE 13.1 (noarch): libreoffice-branding-upstream-4.1.6.2-25.1 libreoffice-help-ast-4.1.6.2-25.1 libreoffice-help-bg-4.1.6.2-25.1 libreoffice-help-ca-4.1.6.2-25.1 libreoffice-help-cs-4.1.6.2-25.1 libreoffice-help-da-4.1.6.2-25.1 libreoffice-help-de-4.1.6.2-25.1 libreoffice-help-el-4.1.6.2-25.1 libreoffice-help-en-GB-4.1.6.2-25.1 libreoffice-help-en-US-4.1.6.2-25.1 libreoffice-help-en-ZA-4.1.6.2-25.1 libreoffice-help-es-4.1.6.2-25.1 libreoffice-help-et-4.1.6.2-25.1 libreoffice-help-eu-4.1.6.2-25.1 libreoffice-help-fi-4.1.6.2-25.1 libreoffice-help-fr-4.1.6.2-25.1 libreoffice-help-gl-4.1.6.2-25.1 libreoffice-help-gu-IN-4.1.6.2-25.1 libreoffice-help-hi-IN-4.1.6.2-25.1 libreoffice-help-hu-4.1.6.2-25.1 libreoffice-help-it-4.1.6.2-25.1 libreoffice-help-ja-4.1.6.2-25.1 libreoffice-help-km-4.1.6.2-25.1 libreoffice-help-ko-4.1.6.2-25.1 libreoffice-help-mk-4.1.6.2-25.1 libreoffice-help-nb-4.1.6.2-25.1 libreoffice-help-nl-4.1.6.2-25.1 libreoffice-help-pl-4.1.6.2-25.1 libreoffice-help-pt-4.1.6.2-25.1 libreoffice-help-pt-BR-4.1.6.2-25.1 libreoffice-help-ru-4.1.6.2-25.1 libreoffice-help-sk-4.1.6.2-25.1 libreoffice-help-sl-4.1.6.2-25.1 libreoffice-help-sv-4.1.6.2-25.1 libreoffice-help-tr-4.1.6.2-25.1 libreoffice-help-vi-4.1.6.2-25.1 libreoffice-help-zh-CN-4.1.6.2-25.1 libreoffice-help-zh-TW-4.1.6.2-25.1 libreoffice-icon-theme-crystal-4.1.6.2-25.1 libreoffice-icon-theme-galaxy-4.1.6.2-25.1 libreoffice-icon-theme-hicontrast-4.1.6.2-25.1 libreoffice-icon-theme-oxygen-4.1.6.2-25.1 libreoffice-icon-theme-tango-4.1.6.2-25.1 libreoffice-l10n-af-4.1.6.2-25.2 libreoffice-l10n-am-4.1.6.2-25.2 libreoffice-l10n-ar-4.1.6.2-25.2 libreoffice-l10n-as-4.1.6.2-25.2 libreoffice-l10n-ast-4.1.6.2-25.2 libreoffice-l10n-be-BY-4.1.6.2-25.2 libreoffice-l10n-bg-4.1.6.2-25.2 libreoffice-l10n-br-4.1.6.2-25.2 libreoffice-l10n-ca-4.1.6.2-25.2 libreoffice-l10n-cs-4.1.6.2-25.2 libreoffice-l10n-cy-4.1.6.2-25.2 libreoffice-l10n-da-4.1.6.2-25.2 libreoffice-l10n-de-4.1.6.2-25.2 libreoffice-l10n-el-4.1.6.2-25.2 libreoffice-l10n-en-GB-4.1.6.2-25.2 libreoffice-l10n-en-ZA-4.1.6.2-25.2 libreoffice-l10n-eo-4.1.6.2-25.2 libreoffice-l10n-es-4.1.6.2-25.2 libreoffice-l10n-et-4.1.6.2-25.2 libreoffice-l10n-eu-4.1.6.2-25.2 libreoffice-l10n-fi-4.1.6.2-25.2 libreoffice-l10n-fr-4.1.6.2-25.2 libreoffice-l10n-ga-4.1.6.2-25.2 libreoffice-l10n-gd-4.1.6.2-25.2 libreoffice-l10n-gl-4.1.6.2-25.2 libreoffice-l10n-gu-IN-4.1.6.2-25.2 libreoffice-l10n-he-4.1.6.2-25.2 libreoffice-l10n-hi-IN-4.1.6.2-25.2 libreoffice-l10n-hr-4.1.6.2-25.2 libreoffice-l10n-hu-4.1.6.2-25.2 libreoffice-l10n-id-4.1.6.2-25.2 libreoffice-l10n-is-4.1.6.2-25.2 libreoffice-l10n-it-4.1.6.2-25.2 libreoffice-l10n-ja-4.1.6.2-25.2 libreoffice-l10n-ka-4.1.6.2-25.2 libreoffice-l10n-km-4.1.6.2-25.2 libreoffice-l10n-kn-4.1.6.2-25.2 libreoffice-l10n-ko-4.1.6.2-25.2 libreoffice-l10n-lt-4.1.6.2-25.2 libreoffice-l10n-mk-4.1.6.2-25.2 libreoffice-l10n-ml-4.1.6.2-25.2 libreoffice-l10n-mr-4.1.6.2-25.2 libreoffice-l10n-nb-4.1.6.2-25.2 libreoffice-l10n-nl-4.1.6.2-25.2 libreoffice-l10n-nn-4.1.6.2-25.2 libreoffice-l10n-nr-4.1.6.2-25.2 libreoffice-l10n-om-4.1.6.2-25.2 libreoffice-l10n-or-4.1.6.2-25.2 libreoffice-l10n-pa-IN-4.1.6.2-25.2 libreoffice-l10n-pl-4.1.6.2-25.2 libreoffice-l10n-pt-4.1.6.2-25.2 libreoffice-l10n-pt-BR-4.1.6.2-25.2 libreoffice-l10n-ro-4.1.6.2-25.2 libreoffice-l10n-ru-4.1.6.2-25.2 libreoffice-l10n-rw-4.1.6.2-25.2 libreoffice-l10n-sh-4.1.6.2-25.2 libreoffice-l10n-sk-4.1.6.2-25.2 libreoffice-l10n-sl-4.1.6.2-25.2 libreoffice-l10n-sr-4.1.6.2-25.2 libreoffice-l10n-ss-4.1.6.2-25.2 libreoffice-l10n-st-4.1.6.2-25.2 libreoffice-l10n-sv-4.1.6.2-25.2 libreoffice-l10n-ta-4.1.6.2-25.2 libreoffice-l10n-te-4.1.6.2-25.2 libreoffice-l10n-tg-4.1.6.2-25.2 libreoffice-l10n-th-4.1.6.2-25.2 libreoffice-l10n-tr-4.1.6.2-25.2 libreoffice-l10n-ts-4.1.6.2-25.2 libreoffice-l10n-ug-4.1.6.2-25.2 libreoffice-l10n-uk-4.1.6.2-25.2 libreoffice-l10n-ve-4.1.6.2-25.2 libreoffice-l10n-vi-4.1.6.2-25.2 libreoffice-l10n-xh-4.1.6.2-25.2 libreoffice-l10n-zh-CN-4.1.6.2-25.2 libreoffice-l10n-zh-TW-4.1.6.2-25.2 libreoffice-l10n-zu-4.1.6.2-25.2 - openSUSE 12.3 (i586 x86_64): libreoffice-3.6.3.2.4-2.9.1 libreoffice-base-3.6.3.2.4-2.9.1 libreoffice-base-debuginfo-3.6.3.2.4-2.9.1 libreoffice-base-drivers-mysql-3.6.3.2.4-2.9.1 libreoffice-base-drivers-mysql-debuginfo-3.6.3.2.4-2.9.1 libreoffice-base-drivers-postgresql-3.6.3.2.4-2.9.1 libreoffice-base-drivers-postgresql-debuginfo-3.6.3.2.4-2.9.1 libreoffice-base-extensions-3.6.3.2.4-2.9.1 libreoffice-calc-3.6.3.2.4-2.9.1 libreoffice-calc-debuginfo-3.6.3.2.4-2.9.1 libreoffice-calc-extensions-3.6.3.2.4-2.9.1 libreoffice-debuginfo-3.6.3.2.4-2.9.1 libreoffice-debugsource-3.6.3.2.4-2.9.1 libreoffice-draw-3.6.3.2.4-2.9.1 libreoffice-draw-extensions-3.6.3.2.4-2.9.1 libreoffice-draw-extensions-debuginfo-3.6.3.2.4-2.9.1 libreoffice-filters-optional-3.6.3.2.4-2.9.1 libreoffice-filters-optional-debuginfo-3.6.3.2.4-2.9.1 libreoffice-gnome-3.6.3.2.4-2.9.1 libreoffice-gnome-debuginfo-3.6.3.2.4-2.9.1 libreoffice-icon-themes-prebuilt-3.6.3.2.4-2.9.1 libreoffice-impress-3.6.3.2.4-2.9.1 libreoffice-impress-debuginfo-3.6.3.2.4-2.9.1 libreoffice-impress-extensions-3.6.3.2.4-2.9.1 libreoffice-impress-extensions-debuginfo-3.6.3.2.4-2.9.1 libreoffice-kde-3.6.3.2.4-2.9.1 libreoffice-kde-debuginfo-3.6.3.2.4-2.9.1 libreoffice-kde4-3.6.3.2.4-2.9.1 libreoffice-kde4-debuginfo-3.6.3.2.4-2.9.1 libreoffice-l10n-prebuilt-3.6.3.2.4-2.9.1 libreoffice-mailmerge-3.6.3.2.4-2.9.1 libreoffice-math-3.6.3.2.4-2.9.1 libreoffice-math-debuginfo-3.6.3.2.4-2.9.1 libreoffice-officebean-3.6.3.2.4-2.9.1 libreoffice-officebean-debuginfo-3.6.3.2.4-2.9.1 libreoffice-pyuno-3.6.3.2.4-2.9.1 libreoffice-pyuno-debuginfo-3.6.3.2.4-2.9.1 libreoffice-sdk-3.6.3.2.4-2.9.1 libreoffice-sdk-debuginfo-3.6.3.2.4-2.9.1 libreoffice-sdk-doc-3.6.3.2.4-2.9.1 libreoffice-writer-3.6.3.2.4-2.9.1 libreoffice-writer-debuginfo-3.6.3.2.4-2.9.1 libreoffice-writer-extensions-3.6.3.2.4-2.9.1 - openSUSE 12.3 (noarch): libreoffice-branding-upstream-3.6.3.2.4-2.9.1 libreoffice-help-ast-3.6.3.2.4-2.9.1 libreoffice-help-bg-3.6.3.2.4-2.9.1 libreoffice-help-ca-3.6.3.2.4-2.9.1 libreoffice-help-cs-3.6.3.2.4-2.9.1 libreoffice-help-da-3.6.3.2.4-2.9.1 libreoffice-help-de-3.6.3.2.4-2.9.1 libreoffice-help-el-3.6.3.2.4-2.9.1 libreoffice-help-en-GB-3.6.3.2.4-2.9.1 libreoffice-help-en-US-3.6.3.2.4-2.9.1 libreoffice-help-en-ZA-3.6.3.2.4-2.9.1 libreoffice-help-es-3.6.3.2.4-2.9.1 libreoffice-help-et-3.6.3.2.4-2.9.1 libreoffice-help-eu-3.6.3.2.4-2.9.1 libreoffice-help-fi-3.6.3.2.4-2.9.1 libreoffice-help-fr-3.6.3.2.4-2.9.1 libreoffice-help-gl-3.6.3.2.4-2.9.1 libreoffice-help-gu-IN-3.6.3.2.4-2.9.1 libreoffice-help-hi-IN-3.6.3.2.4-2.9.1 libreoffice-help-hu-3.6.3.2.4-2.9.1 libreoffice-help-it-3.6.3.2.4-2.9.1 libreoffice-help-ja-3.6.3.2.4-2.9.1 libreoffice-help-km-3.6.3.2.4-2.9.1 libreoffice-help-ko-3.6.3.2.4-2.9.1 libreoffice-help-mk-3.6.3.2.4-2.9.1 libreoffice-help-nb-3.6.3.2.4-2.9.1 libreoffice-help-nl-3.6.3.2.4-2.9.1 libreoffice-help-pl-3.6.3.2.4-2.9.1 libreoffice-help-pt-3.6.3.2.4-2.9.1 libreoffice-help-pt-BR-3.6.3.2.4-2.9.1 libreoffice-help-ru-3.6.3.2.4-2.9.1 libreoffice-help-sk-3.6.3.2.4-2.9.1 libreoffice-help-sl-3.6.3.2.4-2.9.1 libreoffice-help-sv-3.6.3.2.4-2.9.1 libreoffice-help-tr-3.6.3.2.4-2.9.1 libreoffice-help-vi-3.6.3.2.4-2.9.1 libreoffice-help-zh-CN-3.6.3.2.4-2.9.1 libreoffice-help-zh-TW-3.6.3.2.4-2.9.1 libreoffice-icon-theme-crystal-3.6.3.2.4-2.9.1 libreoffice-icon-theme-galaxy-3.6.3.2.4-2.9.1 libreoffice-icon-theme-hicontrast-3.6.3.2.4-2.9.1 libreoffice-icon-theme-oxygen-3.6.3.2.4-2.9.1 libreoffice-icon-theme-tango-3.6.3.2.4-2.9.1 libreoffice-l10n-af-3.6.3.2.4-2.9.3 libreoffice-l10n-am-3.6.3.2.4-2.9.3 libreoffice-l10n-ar-3.6.3.2.4-2.9.3 libreoffice-l10n-as-3.6.3.2.4-2.9.3 libreoffice-l10n-ast-3.6.3.2.4-2.9.3 libreoffice-l10n-be-BY-3.6.3.2.4-2.9.3 libreoffice-l10n-bg-3.6.3.2.4-2.9.3 libreoffice-l10n-br-3.6.3.2.4-2.9.3 libreoffice-l10n-ca-3.6.3.2.4-2.9.3 libreoffice-l10n-cs-3.6.3.2.4-2.9.3 libreoffice-l10n-cy-3.6.3.2.4-2.9.3 libreoffice-l10n-da-3.6.3.2.4-2.9.3 libreoffice-l10n-de-3.6.3.2.4-2.9.3 libreoffice-l10n-el-3.6.3.2.4-2.9.3 libreoffice-l10n-en-GB-3.6.3.2.4-2.9.3 libreoffice-l10n-en-ZA-3.6.3.2.4-2.9.3 libreoffice-l10n-eo-3.6.3.2.4-2.9.3 libreoffice-l10n-es-3.6.3.2.4-2.9.3 libreoffice-l10n-et-3.6.3.2.4-2.9.3 libreoffice-l10n-eu-3.6.3.2.4-2.9.3 libreoffice-l10n-fi-3.6.3.2.4-2.9.3 libreoffice-l10n-fr-3.6.3.2.4-2.9.3 libreoffice-l10n-ga-3.6.3.2.4-2.9.3 libreoffice-l10n-gd-3.6.3.2.4-2.9.3 libreoffice-l10n-gl-3.6.3.2.4-2.9.3 libreoffice-l10n-gu-IN-3.6.3.2.4-2.9.3 libreoffice-l10n-he-3.6.3.2.4-2.9.3 libreoffice-l10n-hi-IN-3.6.3.2.4-2.9.3 libreoffice-l10n-hr-3.6.3.2.4-2.9.3 libreoffice-l10n-hu-3.6.3.2.4-2.9.3 libreoffice-l10n-id-3.6.3.2.4-2.9.3 libreoffice-l10n-is-3.6.3.2.4-2.9.3 libreoffice-l10n-it-3.6.3.2.4-2.9.3 libreoffice-l10n-ja-3.6.3.2.4-2.9.3 libreoffice-l10n-ka-3.6.3.2.4-2.9.3 libreoffice-l10n-km-3.6.3.2.4-2.9.3 libreoffice-l10n-kn-3.6.3.2.4-2.9.3 libreoffice-l10n-ko-3.6.3.2.4-2.9.3 libreoffice-l10n-lt-3.6.3.2.4-2.9.3 libreoffice-l10n-mk-3.6.3.2.4-2.9.3 libreoffice-l10n-ml-3.6.3.2.4-2.9.3 libreoffice-l10n-mr-3.6.3.2.4-2.9.3 libreoffice-l10n-nb-3.6.3.2.4-2.9.3 libreoffice-l10n-nl-3.6.3.2.4-2.9.3 libreoffice-l10n-nn-3.6.3.2.4-2.9.3 libreoffice-l10n-nr-3.6.3.2.4-2.9.3 libreoffice-l10n-om-3.6.3.2.4-2.9.3 libreoffice-l10n-or-3.6.3.2.4-2.9.3 libreoffice-l10n-pa-IN-3.6.3.2.4-2.9.3 libreoffice-l10n-pl-3.6.3.2.4-2.9.3 libreoffice-l10n-pt-3.6.3.2.4-2.9.3 libreoffice-l10n-pt-BR-3.6.3.2.4-2.9.3 libreoffice-l10n-ro-3.6.3.2.4-2.9.3 libreoffice-l10n-ru-3.6.3.2.4-2.9.3 libreoffice-l10n-rw-3.6.3.2.4-2.9.3 libreoffice-l10n-sh-3.6.3.2.4-2.9.3 libreoffice-l10n-sk-3.6.3.2.4-2.9.3 libreoffice-l10n-sl-3.6.3.2.4-2.9.3 libreoffice-l10n-sr-3.6.3.2.4-2.9.3 libreoffice-l10n-ss-3.6.3.2.4-2.9.3 libreoffice-l10n-st-3.6.3.2.4-2.9.3 libreoffice-l10n-sv-3.6.3.2.4-2.9.3 libreoffice-l10n-ta-3.6.3.2.4-2.9.3 libreoffice-l10n-te-3.6.3.2.4-2.9.3 libreoffice-l10n-tg-3.6.3.2.4-2.9.3 libreoffice-l10n-th-3.6.3.2.4-2.9.3 libreoffice-l10n-tr-3.6.3.2.4-2.9.3 libreoffice-l10n-ts-3.6.3.2.4-2.9.3 libreoffice-l10n-ug-3.6.3.2.4-2.9.3 libreoffice-l10n-uk-3.6.3.2.4-2.9.3 libreoffice-l10n-ve-3.6.3.2.4-2.9.3 libreoffice-l10n-vi-3.6.3.2.4-2.9.3 libreoffice-l10n-xh-3.6.3.2.4-2.9.3 libreoffice-l10n-zh-CN-3.6.3.2.4-2.9.3 libreoffice-l10n-zh-TW-3.6.3.2.4-2.9.3 libreoffice-l10n-zu-3.6.3.2.4-2.9.3 References: http://support.novell.com/security/cve/CVE-2013-4156.html http://support.novell.com/security/cve/CVE-2014-3575.html https://bugzilla.novell.com/831578 https://bugzilla.novell.com/893141 -- To unsubscribe, e-mail: opensuse-security-announce+unsubscribe(a)opensuse.org For additional commands, e-mail: opensuse-security-announce+help(a)opensuse.org

1 0

[security-announce] SUSE-SU-2014:1125-1: important: Security update for glibc
by opensuse-security＠opensuse.org 13 Sep '14

13 Sep '14

SUSE Security Update: Security update for glibc ______________________________________________________________________________ Announcement ID: SUSE-SU-2014:1125-1 Rating: important References: #888347 #892065 #892073 Cross-References: CVE-2014-5119 Affected Products: SUSE Linux Enterprise Software Development Kit 11 SP3 SUSE Linux Enterprise Server 11 SP3 for VMware SUSE Linux Enterprise Server 11 SP3 SUSE Linux Enterprise Desktop 11 SP3 ______________________________________________________________________________ An update that solves one vulnerability and has two fixes is now available. Description: This glibc update fixes a critical privilege escalation problem and two non-security issues: * bnc#892073: An off-by-one error leading to a heap-based buffer overflow was found in __gconv_translit_find(). An exploit that targets the problem is publicly available. (CVE-2014-5119) * bnc#892065: setenv-alloca.patch: Avoid unbound alloca in setenv. * bnc#888347: printf-multibyte-format.patch: Don't parse %s format argument as multi-byte string. Security Issues: * CVE-2014-5119 <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-5119> Patch Instructions: To install this SUSE Security Update use YaST online_update. Alternatively you can run the command listed for your product: - SUSE Linux Enterprise Software Development Kit 11 SP3: zypper in -t patch sdksp3-glibc-9669 - SUSE Linux Enterprise Server 11 SP3 for VMware: zypper in -t patch slessp3-glibc-9669 - SUSE Linux Enterprise Server 11 SP3: zypper in -t patch slessp3-glibc-9669 - SUSE Linux Enterprise Desktop 11 SP3: zypper in -t patch sledsp3-glibc-9669 To bring your system up-to-date, use "zypper patch". Package List: - SUSE Linux Enterprise Software Development Kit 11 SP3 (i586 x86_64): glibc-html-2.11.3-17.72.14 glibc-info-2.11.3-17.72.14 - SUSE Linux Enterprise Server 11 SP3 for VMware (i586 x86_64): glibc-2.11.3-17.72.14 glibc-devel-2.11.3-17.72.14 glibc-html-2.11.3-17.72.14 glibc-i18ndata-2.11.3-17.72.14 glibc-info-2.11.3-17.72.14 glibc-locale-2.11.3-17.72.14 glibc-profile-2.11.3-17.72.14 nscd-2.11.3-17.72.14 - SUSE Linux Enterprise Server 11 SP3 for VMware (x86_64): glibc-32bit-2.11.3-17.72.14 glibc-devel-32bit-2.11.3-17.72.14 glibc-locale-32bit-2.11.3-17.72.14 glibc-profile-32bit-2.11.3-17.72.14 - SUSE Linux Enterprise Server 11 SP3 (i586 i686 ia64 ppc64 s390x x86_64): glibc-2.11.3-17.72.14 glibc-devel-2.11.3-17.72.14 - SUSE Linux Enterprise Server 11 SP3 (i586 ia64 ppc64 s390x x86_64): glibc-html-2.11.3-17.72.14 glibc-i18ndata-2.11.3-17.72.14 glibc-info-2.11.3-17.72.14 glibc-locale-2.11.3-17.72.14 glibc-profile-2.11.3-17.72.14 nscd-2.11.3-17.72.14 - SUSE Linux Enterprise Server 11 SP3 (ppc64 s390x x86_64): glibc-32bit-2.11.3-17.72.14 glibc-devel-32bit-2.11.3-17.72.14 glibc-locale-32bit-2.11.3-17.72.14 glibc-profile-32bit-2.11.3-17.72.14 - SUSE Linux Enterprise Server 11 SP3 (ia64): glibc-locale-x86-2.11.3-17.72.14 glibc-profile-x86-2.11.3-17.72.14 glibc-x86-2.11.3-17.72.14 - SUSE Linux Enterprise Desktop 11 SP3 (i586 i686 x86_64): glibc-2.11.3-17.72.14 glibc-devel-2.11.3-17.72.14 - SUSE Linux Enterprise Desktop 11 SP3 (i586 x86_64): glibc-i18ndata-2.11.3-17.72.14 glibc-locale-2.11.3-17.72.14 nscd-2.11.3-17.72.14 - SUSE Linux Enterprise Desktop 11 SP3 (x86_64): glibc-32bit-2.11.3-17.72.14 glibc-devel-32bit-2.11.3-17.72.14 glibc-locale-32bit-2.11.3-17.72.14 References: http://support.novell.com/security/cve/CVE-2014-5119.html https://bugzilla.novell.com/888347 https://bugzilla.novell.com/892065 https://bugzilla.novell.com/892073 http://download.suse.com/patch/finder/?keywords=b84219db4b55e263e5f4c158906… -- To unsubscribe, e-mail: opensuse-security-announce+unsubscribe(a)opensuse.org For additional commands, e-mail: opensuse-security-announce+help(a)opensuse.org

1 0

[security-announce] SUSE-SU-2014:1124-1: important: Security update for flash-player
by opensuse-security＠opensuse.org 12 Sep '14

12 Sep '14

SUSE Security Update: Security update for flash-player ______________________________________________________________________________ Announcement ID: SUSE-SU-2014:1124-1 Rating: important References: #895856 Cross-References: CVE-2014-0547 CVE-2014-0548 CVE-2014-0549 CVE-2014-0550 CVE-2014-0551 CVE-2014-0552 CVE-2014-0553 CVE-2014-0554 CVE-2014-0555 CVE-2014-0556 CVE-2014-0557 CVE-2014-0559 Affected Products: SUSE Linux Enterprise Desktop 11 SP3 ______________________________________________________________________________ An update that fixes 12 vulnerabilities is now available. It includes one version update. Description: Adobe Flash Player has been updated to 11.2.202.406 which fixes various security issues. These updates: * resolve a memory leakage vulnerability that could have been used to bypass memory address randomization (CVE-2014-0557). * resolve a security bypass vulnerability (CVE-2014-0554). * resolve a use-after-free vulnerability that could have lead to code execution (CVE-2014-0553). * resolve memory corruption vulnerabilities that could have lead to code execution (CVE-2014-0547, CVE-2014-0549, CVE-2014-0550, CVE-2014-0551, CVE-2014-0552, CVE-2014-0555). * resolve a vulnerability that could have been used to bypass the same origin policy (CVE-2014-0548). * resolve a heap buffer overflow vulnerability that could have lead to code execution (CVE-2014-0556, CVE-2014-0559). More information can be found on http://helpx.adobe.com/security/products/flash-player/apsb14-21.html <http://helpx.adobe.com/security/products/flash-player/apsb14-21.html> Security Issues: * CVE-2014-0547 <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-0547> * CVE-2014-0548 <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-0548> * CVE-2014-0549 <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-0549> * CVE-2014-0550 <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-0550> * CVE-2014-0551 <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-0551> * CVE-2014-0552 <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-0552> * CVE-2014-0553 <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-0553> * CVE-2014-0554 <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-0554> * CVE-2014-0555 <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-0555> * CVE-2014-0556 <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-0556> * CVE-2014-0557 <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-0557> * CVE-2014-0559 <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-0559> Patch Instructions: To install this SUSE Security Update use YaST online_update. Alternatively you can run the command listed for your product: - SUSE Linux Enterprise Desktop 11 SP3: zypper in -t patch sledsp3-flash-player-9704 To bring your system up-to-date, use "zypper patch". Package List: - SUSE Linux Enterprise Desktop 11 SP3 (i586 x86_64) [New Version: 11.2.202.406]: flash-player-11.2.202.406-0.3.1 flash-player-gnome-11.2.202.406-0.3.1 flash-player-kde4-11.2.202.406-0.3.1 References: http://support.novell.com/security/cve/CVE-2014-0547.html http://support.novell.com/security/cve/CVE-2014-0548.html http://support.novell.com/security/cve/CVE-2014-0549.html http://support.novell.com/security/cve/CVE-2014-0550.html http://support.novell.com/security/cve/CVE-2014-0551.html http://support.novell.com/security/cve/CVE-2014-0552.html http://support.novell.com/security/cve/CVE-2014-0553.html http://support.novell.com/security/cve/CVE-2014-0554.html http://support.novell.com/security/cve/CVE-2014-0555.html http://support.novell.com/security/cve/CVE-2014-0556.html http://support.novell.com/security/cve/CVE-2014-0557.html http://support.novell.com/security/cve/CVE-2014-0559.html https://bugzilla.novell.com/895856 http://download.suse.com/patch/finder/?keywords=3bb66ba5895adc6dc1e2753dafc… -- To unsubscribe, e-mail: opensuse-security-announce+unsubscribe(a)opensuse.org For additional commands, e-mail: opensuse-security-announce+help(a)opensuse.org

1 0

[security-announce] SUSE-SU-2014:1112-2: important: Security update for MozillaFirefox
by opensuse-security＠opensuse.org 12 Sep '14

12 Sep '14

SUSE Security Update: Security update for MozillaFirefox ______________________________________________________________________________ Announcement ID: SUSE-SU-2014:1112-2 Rating: important References: #894370 Affected Products: SUSE Linux Enterprise Server 11 SP1 LTSS ______________________________________________________________________________ An update that contains security fixes can now be installed. It includes three new package versions. Description: Mozilla Firefox was updated to the 24.8.0ESR release, fixing security issues and bugs. Only some of the published security advisories affect the Mozilla Firefox 24ESR codestream: * MFSA 2014-72 / CVE-2014-1567: Security researcher regenrecht reported, via TippingPoint's Zero Day Initiative, a use-after-free during text layout when interacting with the setting of text direction. This results in a use-after-free which can lead to arbitrary code execution. * MFSA 2014-67: Mozilla developers and community identified and fixed several memory safety bugs in the browser engine used in Firefox and other Mozilla-based products. Some of these bugs showed evidence of memory corruption under certain circumstances, and we presume that with enough effort at least some of these could be exploited to run arbitrary code. * Jan de Mooij reported a memory safety problem that affects Firefox ESR 24.7, ESR 31 and Firefox 31. (CVE-2014-1562) More information is referenced on: https://www.mozilla.org/security/announce/ <https://www.mozilla.org/security/announce/> . Security Issues: * CVE-2014-1562 <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-1562> * CVE-2014-1567 <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-1567> Patch Instructions: To install this SUSE Security Update use YaST online_update. Alternatively you can run the command listed for your product: - SUSE Linux Enterprise Server 11 SP1 LTSS: zypper in -t patch slessp1-firefox-201409-9681 To bring your system up-to-date, use "zypper patch". Package List: - SUSE Linux Enterprise Server 11 SP1 LTSS (i586 s390x x86_64) [New Version: 24.8.0esr,3.16.4 and 4.10.7]: MozillaFirefox-24.8.0esr-0.3.1 MozillaFirefox-translations-24.8.0esr-0.3.1 libfreebl3-3.16.4-0.3.1 mozilla-nspr-4.10.7-0.3.1 mozilla-nss-3.16.4-0.3.1 mozilla-nss-tools-3.16.4-0.3.1 - SUSE Linux Enterprise Server 11 SP1 LTSS (s390x x86_64) [New Version: 3.16.4 and 4.10.7]: libfreebl3-32bit-3.16.4-0.3.1 mozilla-nspr-32bit-4.10.7-0.3.1 mozilla-nss-32bit-3.16.4-0.3.1 References: https://bugzilla.novell.com/894370 http://download.suse.com/patch/finder/?keywords=163464dc8eaa4994ed25dd8ac41… -- To unsubscribe, e-mail: opensuse-security-announce+unsubscribe(a)opensuse.org For additional commands, e-mail: opensuse-security-announce+help(a)opensuse.org

1 0

[security-announce] SUSE-SU-2014:1120-2: important: Security update for MozillaFirefox
by opensuse-security＠opensuse.org 12 Sep '14

12 Sep '14

SUSE Security Update: Security update for MozillaFirefox ______________________________________________________________________________ Announcement ID: SUSE-SU-2014:1120-2 Rating: important References: #882881 #894370 Cross-References: CVE-2014-1562 CVE-2014-1567 Affected Products: SUSE Linux Enterprise Server 10 SP4 LTSS ______________________________________________________________________________ An update that fixes two vulnerabilities is now available. It includes two new package versions. Description: Mozilla Firefox was updated to the 24.8.0ESR release, fixing security issues and bugs. Only some of the published security advisories affect the Mozilla Firefox 24ESR codestream: * MFSA 2014-72 / CVE-2014-1567: Security researcher regenrecht reported, via TippingPoint's Zero Day Initiative, a use-after-free during text layout when interacting with the setting of text direction. This results in a use-after-free which can lead to arbitrary code execution. * MFSA 2014-67: Mozilla developers and community identified and fixed several memory safety bugs in the browser engine used in Firefox and other Mozilla-based products. Some of these bugs showed evidence of memory corruption under certain circumstances, and we presume that with enough effort at least some of these could be exploited to run arbitrary code. * Jan de Mooij reported a memory safety problem that affects Firefox ESR 24.7, ESR 31 and Firefox 31. (CVE-2014-1562) More information is referenced on: https://www.mozilla.org/security/announce/ <https://www.mozilla.org/security/announce/> . Security Issues: * CVE-2014-1567 <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-1567> * CVE-2014-1562 <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-1562> Package List: - SUSE Linux Enterprise Server 10 SP4 LTSS (i586 s390x x86_64) [New Version: 3.16.4 and 4.10.7]: firefox-gtk2-2.18.9-0.11.1 firefox-gtk2-lang-2.18.9-0.11.1 mozilla-nspr-4.10.7-0.5.1 mozilla-nspr-devel-4.10.7-0.5.1 mozilla-nss-3.16.4-0.5.2 mozilla-nss-devel-3.16.4-0.5.2 mozilla-nss-tools-3.16.4-0.5.2 - SUSE Linux Enterprise Server 10 SP4 LTSS (s390x x86_64) [New Version: 3.16.4 and 4.10.7]: firefox-gtk2-32bit-2.18.9-0.11.1 mozilla-nspr-32bit-4.10.7-0.5.1 mozilla-nss-32bit-3.16.4-0.5.2 - SUSE Linux Enterprise Server 10 SP4 LTSS (i586 s390x): MozillaFirefox-24.8.0esr-0.5.1 MozillaFirefox-translations-24.8.0esr-0.5.1 References: http://support.novell.com/security/cve/CVE-2014-1562.html http://support.novell.com/security/cve/CVE-2014-1567.html https://bugzilla.novell.com/882881 https://bugzilla.novell.com/894370 http://download.suse.com/patch/finder/?keywords=24d0f20857a99b68fbd08945af7… -- To unsubscribe, e-mail: opensuse-security-announce+unsubscribe(a)opensuse.org For additional commands, e-mail: opensuse-security-announce+help(a)opensuse.org

1 0

[security-announce] SUSE-SU-2014:1122-1: important: Security update for glibc
by opensuse-security＠opensuse.org 12 Sep '14

12 Sep '14

SUSE Security Update: Security update for glibc ______________________________________________________________________________ Announcement ID: SUSE-SU-2014:1122-1 Rating: important References: #750741 #779320 #801246 #830268 #834594 #836746 #839870 #843735 #864081 #882600 #883022 #886416 #892073 Cross-References: CVE-2012-4412 CVE-2013-0242 CVE-2013-4237 CVE-2013-4332 CVE-2013-4788 CVE-2014-4043 CVE-2014-5119 Affected Products: SUSE Linux Enterprise Server 11 SP1 LTSS ______________________________________________________________________________ An update that solves 7 vulnerabilities and has 6 fixes is now available. Description: This glibc update fixes a critical privilege escalation vulnerability and the following security and non-security issues: * bnc#892073: An off-by-one error leading to a heap-based buffer overflow was found in __gconv_translit_find(). An exploit that targets the problem is publicly available. (CVE-2014-5119) * bnc#886416: Avoid redundant shift character in iconv output at block boundary. * bnc#883022: Initialize errcode in sysdeps/unix/opendir.c. * bnc#882600: Copy filename argument in posix_spawn_file_actions_addopen. (CVE-2014-4043) * bnc#864081: Take lock in pthread_cond_wait cleanup handler only when needed. * bnc#843735: Don't crash on unresolved weak symbol reference. * bnc#839870: Fix integer overflows in malloc. (CVE-2013-4332) * bnc#836746: Avoid race between {,__de}allocate_stack and __reclaim_stacks during fork. * bnc#834594: Fix readdir_r with long file names. (CVE-2013-4237) * bnc#830268: Initialize pointer guard also in static executables. (CVE-2013-4788) * bnc#801246: Fix buffer overrun in regexp matcher. (CVE-2013-0242) * bnc#779320: Fix buffer overflow in strcoll. (CVE-2012-4412) * bnc#750741: Use absolute timeout in x86 pthread_cond_timedwait. Security Issues: * CVE-2014-5119 <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-5119> * CVE-2014-4043 <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-4043> * CVE-2012-4412 <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2012-4412> * CVE-2013-0242 <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2013-0242> * CVE-2013-4788 <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2013-4788> * CVE-2013-4237 <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2013-4237> * CVE-2013-4332 <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2013-4332> Patch Instructions: To install this SUSE Security Update use YaST online_update. Alternatively you can run the command listed for your product: - SUSE Linux Enterprise Server 11 SP1 LTSS: zypper in -t patch slessp1-glibc-9664 To bring your system up-to-date, use "zypper patch". Package List: - SUSE Linux Enterprise Server 11 SP1 LTSS (i586 i686 s390x x86_64): glibc-2.11.1-0.58.1 glibc-devel-2.11.1-0.58.1 - SUSE Linux Enterprise Server 11 SP1 LTSS (i586 s390x x86_64): glibc-html-2.11.1-0.58.1 glibc-i18ndata-2.11.1-0.58.1 glibc-info-2.11.1-0.58.1 glibc-locale-2.11.1-0.58.1 glibc-profile-2.11.1-0.58.1 nscd-2.11.1-0.58.1 - SUSE Linux Enterprise Server 11 SP1 LTSS (s390x x86_64): glibc-32bit-2.11.1-0.58.1 glibc-devel-32bit-2.11.1-0.58.1 glibc-locale-32bit-2.11.1-0.58.1 glibc-profile-32bit-2.11.1-0.58.1 References: http://support.novell.com/security/cve/CVE-2012-4412.html http://support.novell.com/security/cve/CVE-2013-0242.html http://support.novell.com/security/cve/CVE-2013-4237.html http://support.novell.com/security/cve/CVE-2013-4332.html http://support.novell.com/security/cve/CVE-2013-4788.html http://support.novell.com/security/cve/CVE-2014-4043.html http://support.novell.com/security/cve/CVE-2014-5119.html https://bugzilla.novell.com/750741 https://bugzilla.novell.com/779320 https://bugzilla.novell.com/801246 https://bugzilla.novell.com/830268 https://bugzilla.novell.com/834594 https://bugzilla.novell.com/836746 https://bugzilla.novell.com/839870 https://bugzilla.novell.com/843735 https://bugzilla.novell.com/864081 https://bugzilla.novell.com/882600 https://bugzilla.novell.com/883022 https://bugzilla.novell.com/886416 https://bugzilla.novell.com/892073 http://download.suse.com/patch/finder/?keywords=8ba147c0ad19c1883fe7425b33e… -- To unsubscribe, e-mail: opensuse-security-announce+unsubscribe(a)opensuse.org For additional commands, e-mail: opensuse-security-announce+help(a)opensuse.org

1 0

[security-announce] SUSE-SU-2014:1120-1: important: Security update for MozillaFirefox
by opensuse-security＠opensuse.org 12 Sep '14

12 Sep '14

SUSE Security Update: Security update for MozillaFirefox ______________________________________________________________________________ Announcement ID: SUSE-SU-2014:1120-1 Rating: important References: #882881 #894370 Cross-References: CVE-2014-1562 CVE-2014-1567 Affected Products: SUSE Linux Enterprise Server 10 SP3 LTSS ______________________________________________________________________________ An update that fixes two vulnerabilities is now available. It includes two new package versions. Description: Mozilla Firefox was updated to the 24.8.0ESR release, fixing security issues and bugs. Only some of the published security advisories affect the Mozilla Firefox 24ESR codestream: * MFSA 2014-72 / CVE-2014-1567: Security researcher regenrecht reported, via TippingPoint's Zero Day Initiative, a use-after-free during text layout when interacting with the setting of text direction. This results in a use-after-free which can lead to arbitrary code execution. * MFSA 2014-67: Mozilla developers and community identified and fixed several memory safety bugs in the browser engine used in Firefox and other Mozilla-based products. Some of these bugs showed evidence of memory corruption under certain circumstances, and we presume that with enough effort at least some of these could be exploited to run arbitrary code. * Jan de Mooij reported a memory safety problem that affects Firefox ESR 24.7, ESR 31 and Firefox 31. (CVE-2014-1562) More information is referenced on: https://www.mozilla.org/security/announce/ <https://www.mozilla.org/security/announce/> . Security Issues: * CVE-2014-1567 <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-1567> * CVE-2014-1562 <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-1562> Package List: - SUSE Linux Enterprise Server 10 SP3 LTSS (i586 s390x x86_64) [New Version: 3.16.4 and 4.10.7]: firefox-gtk2-2.18.9-0.11.1 firefox-gtk2-lang-2.18.9-0.11.1 mozilla-nspr-4.10.7-0.5.1 mozilla-nspr-devel-4.10.7-0.5.1 mozilla-nss-3.16.4-0.5.2 mozilla-nss-devel-3.16.4-0.5.2 mozilla-nss-tools-3.16.4-0.5.2 - SUSE Linux Enterprise Server 10 SP3 LTSS (s390x x86_64) [New Version: 3.16.4 and 4.10.7]: firefox-gtk2-32bit-2.18.9-0.11.1 mozilla-nspr-32bit-4.10.7-0.5.1 mozilla-nss-32bit-3.16.4-0.5.2 - SUSE Linux Enterprise Server 10 SP3 LTSS (i586 s390x): MozillaFirefox-24.8.0esr-0.5.1 MozillaFirefox-translations-24.8.0esr-0.5.1 References: http://support.novell.com/security/cve/CVE-2014-1562.html http://support.novell.com/security/cve/CVE-2014-1567.html https://bugzilla.novell.com/882881 https://bugzilla.novell.com/894370 http://download.suse.com/patch/finder/?keywords=401ac4583a90138bdc8c41d347a… -- To unsubscribe, e-mail: opensuse-security-announce+unsubscribe(a)opensuse.org For additional commands, e-mail: opensuse-security-announce+help(a)opensuse.org

1 0

[security-announce] SUSE-SU-2014:1119-1: important: Security update for glibc
by opensuse-security＠opensuse.org 12 Sep '14

12 Sep '14

SUSE Security Update: Security update for glibc ______________________________________________________________________________ Announcement ID: SUSE-SU-2014:1119-1 Rating: important References: #772242 #779320 #818630 #828235 #828637 #834594 #892073 Cross-References: CVE-2012-4412 CVE-2013-4237 CVE-2014-5119 Affected Products: SUSE Linux Enterprise Server 10 SP4 LTSS ______________________________________________________________________________ An update that solves three vulnerabilities and has four fixes is now available. Description: This glibc update fixes a critical privilege escalation problem and the following security and non security issues: * bnc#892073: An off-by-one error leading to a heap-based buffer overflow was found in __gconv_translit_find(). An exploit that targets the problem is publicly available. (CVE-2014-5119) * bnc#772242: Replace scope handing with master state * bnc#779320: Fix buffer overflow in strcoll (CVE-2012-4412) * bnc#818630: Fall back to localhost if no nameserver defined * bnc#828235: Fix missing character in IBM-943 charset * bnc#828637: Fix use of alloca in gaih_inet * bnc#834594: Fix readdir_r with long file names (CVE-2013-4237) Security Issues: * CVE-2014-5119 <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-5119> * CVE-2013-4237 <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2013-4237> * CVE-2012-4412 <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2012-4412> Package List: - SUSE Linux Enterprise Server 10 SP4 LTSS (i586 i686 s390x x86_64): glibc-2.4-31.111.1 glibc-devel-2.4-31.111.1 - SUSE Linux Enterprise Server 10 SP4 LTSS (i586 s390x x86_64): glibc-html-2.4-31.111.1 glibc-i18ndata-2.4-31.111.1 glibc-info-2.4-31.111.1 glibc-locale-2.4-31.111.1 glibc-profile-2.4-31.111.1 nscd-2.4-31.111.1 - SUSE Linux Enterprise Server 10 SP4 LTSS (s390x x86_64): glibc-32bit-2.4-31.111.1 glibc-devel-32bit-2.4-31.111.1 glibc-locale-32bit-2.4-31.111.1 glibc-profile-32bit-2.4-31.111.1 References: http://support.novell.com/security/cve/CVE-2012-4412.html http://support.novell.com/security/cve/CVE-2013-4237.html http://support.novell.com/security/cve/CVE-2014-5119.html https://bugzilla.novell.com/772242 https://bugzilla.novell.com/779320 https://bugzilla.novell.com/818630 https://bugzilla.novell.com/828235 https://bugzilla.novell.com/828637 https://bugzilla.novell.com/834594 https://bugzilla.novell.com/892073 http://download.suse.com/patch/finder/?keywords=767429925ce018c15cbe14c33d6… -- To unsubscribe, e-mail: opensuse-security-announce+unsubscribe(a)opensuse.org For additional commands, e-mail: opensuse-security-announce+help(a)opensuse.org

1 0

[security-announce] SUSE-SU-2014:1116-1: important: Security update for LibreOffice
by opensuse-security＠opensuse.org 11 Sep '14

11 Sep '14

SUSE Security Update: Security update for LibreOffice ______________________________________________________________________________ Announcement ID: SUSE-SU-2014:1116-1 Rating: important References: #382137 #593612 #654230 #753460 #757432 #779620 #779642 #780044 #783433 #802888 #816593 #817956 #819614 #819822 #819865 #820077 #820273 #820503 #820504 #820509 #820788 #820800 #820819 #820836 #821567 #821795 #822908 #823626 #823651 #823655 #823675 #823935 #825305 #825891 #825976 #828390 #828598 #829017 #830205 #831457 #831578 #834035 #834705 #834720 #834722 #835985 #837302 #839727 #862510 #863021 #864396 #870234 #878854 #893141 Cross-References: CVE-2013-4156 CVE-2014-3575 Affected Products: SUSE Linux Enterprise Software Development Kit 11 SP3 SUSE Linux Enterprise Desktop 11 SP3 ______________________________________________________________________________ An update that solves two vulnerabilities and has 52 fixes is now available. It includes one version update. Description: LibreOffice was updated to version 4.0.3.3.26. (SUSE 4.0-patch26, tag suse-4.0-26, based on upstream 4.0.3.3). Two security issues have been fixed: * DOCM memory corruption vulnerability. (CVE-2013-4156, bnc#831578) * Data exposure using crafted OLE objects. (CVE-2014-3575, bnc#893141) The following non-security issues have been fixed: * chart shown flipped (bnc#834722) * chart missing dataset (bnc#839727) * import new line in text (bnc#828390) * lines running off screens (bnc#819614) * add set-all language menu (bnc#863021) * text rotation (bnc#783433, bnc#862510) * page border shadow testcase (bnc#817956) * one more clickable field fix (bnc#802888) * multilevel labels are rotated (bnc#820273) * incorrect nested table margins (bnc#816593) * use BitmapURL only if its valid (bnc#821567) * import gradfill for text colors (bnc#870234) * fix undo of paragraph attributes (bnc#828598) * stop-gap solution to avoid crash (bnc#830205) * import images with duotone filter (bnc#820077) * missing drop downs for autofilter (bnc#834705) * typos in first page style creation (bnc#820836) * labels wrongly interpreted as dates (bnc#834720) * RTF import of fFilled shape property (bnc#825305) * placeholders text size is not correct (bnc#831457) * cells value formatted with wrong output (bnc#821795) * RTF import of freeform shape coordinates (bnc#823655) * styles (rename &) copy to different decks (bnc#757432) * XLSX Chart import with internal data table (bnc#819822) * handle M.d.yyyy date format in DOCX import (bnc#820509) * paragraph style in empty first page header (bnc#823651) * copying slides having same master page name (bnc#753460) * printing handouts using the default, 'Order' (bnc#835985) * wrap polygon was based on dest size of picture (bnc#820800) * added common flags support for SEQ field import (bnc#825976) * hyperlinks of illustration index in DOCX export (bnc#834035) * allow insertion of redlines with an empty author (bnc#837302) * handle drawinglayer rectangle inset in VML import (bnc#779642) * don't apply complex font size to non-complex font (bnc#820819) * issue with negative seeks in win32 shell extension (bnc#829017) * slide appears quite garbled when imported from PPTX (bnc#593612) * initial MCE support in writerfilter ooxml tokenizer (bnc#820503) * MSWord uses \xb for linebreaks in DB fields, take 2 (bnc#878854) * try harder to convert floating tables to text frames (bnc#779620) * itemstate in parent style incorrectly reported as set (bnc#819865) * default color hidden by Default style in writerfilter (bnc#820504) * DOCX document crashes when using internal OOXML filter (bnc#382137) * ugly workaround for external leading with symbol fonts (bnc#823626) * followup fix for exported xlsx causes errors for mso2007 (bnc#823935) * we only support simple labels in the InternalDataProvider (bnc#864396) * RTF import: fix import of numbering bullet associated font (bnc#823675) * page specific footer extended to every pages in DOCX export (bnc#654230) * v:textbox mso-fit-shape-to-text style property in VML import (bnc#820788) * w:spacing in a paragraph should also apply to as-char objects (bnc#780044) * compatibility setting for MS Word wrapping text in less space (bnc#822908) * fix SwWrtShell::SelAll() to work with empty table at doc start (bnc#825891) Security Issues: * CVE-2014-3575 <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-3575> * CVE-2013-4156 <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2013-4156> Patch Instructions: To install this SUSE Security Update use YaST online_update. Alternatively you can run the command listed for your product: - SUSE Linux Enterprise Software Development Kit 11 SP3: zypper in -t patch sdksp3-libreoffice-201409-9677 - SUSE Linux Enterprise Desktop 11 SP3: zypper in -t patch sledsp3-libreoffice-201409-9677 To bring your system up-to-date, use "zypper patch". Package List: - SUSE Linux Enterprise Software Development Kit 11 SP3 (i586 x86_64) [New Version: 4.0.3.3.26]: libreoffice-4.0.3.3.26-0.6.2 libreoffice-base-4.0.3.3.26-0.6.2 libreoffice-base-drivers-postgresql-4.0.3.3.26-0.6.2 libreoffice-base-extensions-4.0.3.3.26-0.6.2 libreoffice-calc-4.0.3.3.26-0.6.2 libreoffice-calc-extensions-4.0.3.3.26-0.6.2 libreoffice-draw-4.0.3.3.26-0.6.2 libreoffice-draw-extensions-4.0.3.3.26-0.6.2 libreoffice-filters-optional-4.0.3.3.26-0.6.2 libreoffice-gnome-4.0.3.3.26-0.6.2 libreoffice-impress-4.0.3.3.26-0.6.2 libreoffice-impress-extensions-4.0.3.3.26-0.6.2 libreoffice-kde-4.0.3.3.26-0.6.2 libreoffice-kde4-4.0.3.3.26-0.6.2 libreoffice-l10n-prebuilt-4.0.3.3.26-0.6.2 libreoffice-mailmerge-4.0.3.3.26-0.6.2 libreoffice-math-4.0.3.3.26-0.6.2 libreoffice-mono-4.0.3.3.26-0.6.2 libreoffice-officebean-4.0.3.3.26-0.6.2 libreoffice-pyuno-4.0.3.3.26-0.6.2 libreoffice-sdk-4.0.3.3.26-0.6.2 libreoffice-writer-4.0.3.3.26-0.6.2 libreoffice-writer-extensions-4.0.3.3.26-0.6.2 - SUSE Linux Enterprise Software Development Kit 11 SP3 (noarch) [New Version: 4.0.3.3.26]: libreoffice-branding-upstream-4.0.3.3.26-0.6.1 libreoffice-help-cs-4.0.3.3.26-0.6.1 libreoffice-help-da-4.0.3.3.26-0.6.1 libreoffice-help-de-4.0.3.3.26-0.6.1 libreoffice-help-en-GB-4.0.3.3.26-0.6.1 libreoffice-help-en-US-4.0.3.3.26-0.6.1 libreoffice-help-es-4.0.3.3.26-0.6.1 libreoffice-help-fr-4.0.3.3.26-0.6.1 libreoffice-help-gu-IN-4.0.3.3.26-0.6.1 libreoffice-help-hi-IN-4.0.3.3.26-0.6.1 libreoffice-help-hu-4.0.3.3.26-0.6.1 libreoffice-help-it-4.0.3.3.26-0.6.1 libreoffice-help-ja-4.0.3.3.26-0.6.1 libreoffice-help-ko-4.0.3.3.26-0.6.1 libreoffice-help-nl-4.0.3.3.26-0.6.1 libreoffice-help-pl-4.0.3.3.26-0.6.1 libreoffice-help-pt-4.0.3.3.26-0.6.1 libreoffice-help-pt-BR-4.0.3.3.26-0.6.1 libreoffice-help-ru-4.0.3.3.26-0.6.1 libreoffice-help-sv-4.0.3.3.26-0.6.1 libreoffice-help-zh-CN-4.0.3.3.26-0.6.1 libreoffice-help-zh-TW-4.0.3.3.26-0.6.1 libreoffice-icon-themes-4.0.3.3.26-0.6.2 libreoffice-l10n-af-4.0.3.3.26-0.6.2 libreoffice-l10n-ar-4.0.3.3.26-0.6.2 libreoffice-l10n-ca-4.0.3.3.26-0.6.2 libreoffice-l10n-cs-4.0.3.3.26-0.6.2 libreoffice-l10n-da-4.0.3.3.26-0.6.2 libreoffice-l10n-de-4.0.3.3.26-0.6.2 libreoffice-l10n-el-4.0.3.3.26-0.6.2 libreoffice-l10n-en-GB-4.0.3.3.26-0.6.2 libreoffice-l10n-es-4.0.3.3.26-0.6.2 libreoffice-l10n-fi-4.0.3.3.26-0.6.2 libreoffice-l10n-fr-4.0.3.3.26-0.6.2 libreoffice-l10n-gu-IN-4.0.3.3.26-0.6.2 libreoffice-l10n-hi-IN-4.0.3.3.26-0.6.2 libreoffice-l10n-hu-4.0.3.3.26-0.6.2 libreoffice-l10n-it-4.0.3.3.26-0.6.2 libreoffice-l10n-ja-4.0.3.3.26-0.6.2 libreoffice-l10n-ko-4.0.3.3.26-0.6.2 libreoffice-l10n-nb-4.0.3.3.26-0.6.2 libreoffice-l10n-nl-4.0.3.3.26-0.6.2 libreoffice-l10n-nn-4.0.3.3.26-0.6.2 libreoffice-l10n-pl-4.0.3.3.26-0.6.2 libreoffice-l10n-pt-4.0.3.3.26-0.6.2 libreoffice-l10n-pt-BR-4.0.3.3.26-0.6.2 libreoffice-l10n-ru-4.0.3.3.26-0.6.2 libreoffice-l10n-sk-4.0.3.3.26-0.6.2 libreoffice-l10n-sv-4.0.3.3.26-0.6.2 libreoffice-l10n-xh-4.0.3.3.26-0.6.2 libreoffice-l10n-zh-CN-4.0.3.3.26-0.6.2 libreoffice-l10n-zh-TW-4.0.3.3.26-0.6.2 libreoffice-l10n-zu-4.0.3.3.26-0.6.2 - SUSE Linux Enterprise Desktop 11 SP3 (i586 x86_64) [New Version: 4.0.3.3.26]: libreoffice-4.0.3.3.26-0.6.2 libreoffice-base-4.0.3.3.26-0.6.2 libreoffice-base-drivers-postgresql-4.0.3.3.26-0.6.2 libreoffice-base-extensions-4.0.3.3.26-0.6.2 libreoffice-calc-4.0.3.3.26-0.6.2 libreoffice-calc-extensions-4.0.3.3.26-0.6.2 libreoffice-draw-4.0.3.3.26-0.6.2 libreoffice-draw-extensions-4.0.3.3.26-0.6.2 libreoffice-filters-optional-4.0.3.3.26-0.6.2 libreoffice-gnome-4.0.3.3.26-0.6.2 libreoffice-impress-4.0.3.3.26-0.6.2 libreoffice-impress-extensions-4.0.3.3.26-0.6.2 libreoffice-kde-4.0.3.3.26-0.6.2 libreoffice-kde4-4.0.3.3.26-0.6.2 libreoffice-mailmerge-4.0.3.3.26-0.6.2 libreoffice-math-4.0.3.3.26-0.6.2 libreoffice-mono-4.0.3.3.26-0.6.2 libreoffice-officebean-4.0.3.3.26-0.6.2 libreoffice-pyuno-4.0.3.3.26-0.6.2 libreoffice-writer-4.0.3.3.26-0.6.2 libreoffice-writer-extensions-4.0.3.3.26-0.6.2 - SUSE Linux Enterprise Desktop 11 SP3 (noarch) [New Version: 4.0.3.3.26]: libreoffice-help-cs-4.0.3.3.26-0.6.1 libreoffice-help-da-4.0.3.3.26-0.6.1 libreoffice-help-de-4.0.3.3.26-0.6.1 libreoffice-help-en-GB-4.0.3.3.26-0.6.1 libreoffice-help-en-US-4.0.3.3.26-0.6.1 libreoffice-help-es-4.0.3.3.26-0.6.1 libreoffice-help-fr-4.0.3.3.26-0.6.1 libreoffice-help-gu-IN-4.0.3.3.26-0.6.1 libreoffice-help-hi-IN-4.0.3.3.26-0.6.1 libreoffice-help-hu-4.0.3.3.26-0.6.1 libreoffice-help-it-4.0.3.3.26-0.6.1 libreoffice-help-ja-4.0.3.3.26-0.6.1 libreoffice-help-ko-4.0.3.3.26-0.6.1 libreoffice-help-nl-4.0.3.3.26-0.6.1 libreoffice-help-pl-4.0.3.3.26-0.6.1 libreoffice-help-pt-4.0.3.3.26-0.6.1 libreoffice-help-pt-BR-4.0.3.3.26-0.6.1 libreoffice-help-ru-4.0.3.3.26-0.6.1 libreoffice-help-sv-4.0.3.3.26-0.6.1 libreoffice-help-zh-CN-4.0.3.3.26-0.6.1 libreoffice-help-zh-TW-4.0.3.3.26-0.6.1 libreoffice-icon-themes-4.0.3.3.26-0.6.2 libreoffice-l10n-af-4.0.3.3.26-0.6.2 libreoffice-l10n-ar-4.0.3.3.26-0.6.2 libreoffice-l10n-ca-4.0.3.3.26-0.6.2 libreoffice-l10n-cs-4.0.3.3.26-0.6.2 libreoffice-l10n-da-4.0.3.3.26-0.6.2 libreoffice-l10n-de-4.0.3.3.26-0.6.2 libreoffice-l10n-en-GB-4.0.3.3.26-0.6.2 libreoffice-l10n-es-4.0.3.3.26-0.6.2 libreoffice-l10n-fi-4.0.3.3.26-0.6.2 libreoffice-l10n-fr-4.0.3.3.26-0.6.2 libreoffice-l10n-gu-IN-4.0.3.3.26-0.6.2 libreoffice-l10n-hi-IN-4.0.3.3.26-0.6.2 libreoffice-l10n-hu-4.0.3.3.26-0.6.2 libreoffice-l10n-it-4.0.3.3.26-0.6.2 libreoffice-l10n-ja-4.0.3.3.26-0.6.2 libreoffice-l10n-ko-4.0.3.3.26-0.6.2 libreoffice-l10n-nb-4.0.3.3.26-0.6.2 libreoffice-l10n-nl-4.0.3.3.26-0.6.2 libreoffice-l10n-nn-4.0.3.3.26-0.6.2 libreoffice-l10n-pl-4.0.3.3.26-0.6.2 libreoffice-l10n-pt-4.0.3.3.26-0.6.2 libreoffice-l10n-pt-BR-4.0.3.3.26-0.6.2 libreoffice-l10n-ru-4.0.3.3.26-0.6.2 libreoffice-l10n-sk-4.0.3.3.26-0.6.2 libreoffice-l10n-sv-4.0.3.3.26-0.6.2 libreoffice-l10n-xh-4.0.3.3.26-0.6.2 libreoffice-l10n-zh-CN-4.0.3.3.26-0.6.2 libreoffice-l10n-zh-TW-4.0.3.3.26-0.6.2 libreoffice-l10n-zu-4.0.3.3.26-0.6.2 References: http://support.novell.com/security/cve/CVE-2013-4156.html http://support.novell.com/security/cve/CVE-2014-3575.html https://bugzilla.novell.com/382137 https://bugzilla.novell.com/593612 https://bugzilla.novell.com/654230 https://bugzilla.novell.com/753460 https://bugzilla.novell.com/757432 https://bugzilla.novell.com/779620 https://bugzilla.novell.com/779642 https://bugzilla.novell.com/780044 https://bugzilla.novell.com/783433 https://bugzilla.novell.com/802888 https://bugzilla.novell.com/816593 https://bugzilla.novell.com/817956 https://bugzilla.novell.com/819614 https://bugzilla.novell.com/819822 https://bugzilla.novell.com/819865 https://bugzilla.novell.com/820077 https://bugzilla.novell.com/820273 https://bugzilla.novell.com/820503 https://bugzilla.novell.com/820504 https://bugzilla.novell.com/820509 https://bugzilla.novell.com/820788 https://bugzilla.novell.com/820800 https://bugzilla.novell.com/820819 https://bugzilla.novell.com/820836 https://bugzilla.novell.com/821567 https://bugzilla.novell.com/821795 https://bugzilla.novell.com/822908 https://bugzilla.novell.com/823626 https://bugzilla.novell.com/823651 https://bugzilla.novell.com/823655 https://bugzilla.novell.com/823675 https://bugzilla.novell.com/823935 https://bugzilla.novell.com/825305 https://bugzilla.novell.com/825891 https://bugzilla.novell.com/825976 https://bugzilla.novell.com/828390 https://bugzilla.novell.com/828598 https://bugzilla.novell.com/829017 https://bugzilla.novell.com/830205 https://bugzilla.novell.com/831457 https://bugzilla.novell.com/831578 https://bugzilla.novell.com/834035 https://bugzilla.novell.com/834705 https://bugzilla.novell.com/834720 https://bugzilla.novell.com/834722 https://bugzilla.novell.com/835985 https://bugzilla.novell.com/837302 https://bugzilla.novell.com/839727 https://bugzilla.novell.com/862510 https://bugzilla.novell.com/863021 https://bugzilla.novell.com/864396 https://bugzilla.novell.com/870234 https://bugzilla.novell.com/878854 https://bugzilla.novell.com/893141 http://download.suse.com/patch/finder/?keywords=d2e2531d51923f3c40bbd114b7e… -- To unsubscribe, e-mail: opensuse-security-announce+unsubscribe(a)opensuse.org For additional commands, e-mail: opensuse-security-announce+help(a)opensuse.org

1 0

[security-announce] openSUSE-SU-2014:1115-1: important: glibc
by opensuse-security＠opensuse.org 11 Sep '14

11 Sep '14

openSUSE Security Update: glibc ______________________________________________________________________________ Announcement ID: openSUSE-SU-2014:1115-1 Rating: important References: #887022 #892073 #894553 Cross-References: CVE-2014-0475 CVE-2014-5119 CVE-2014-6040 Affected Products: openSUSE 13.1 openSUSE 12.3 ______________________________________________________________________________ An update that fixes three vulnerabilities is now available. Description: glibc was updated to fix three security issues: - A directory traversal in locale environment handling was fixed (CVE-2014-0475, bnc#887022, GLIBC BZ #17137) - Disable gconv transliteration module loading which could be used for code execution (CVE-2014-5119, bnc#892073, GLIBC BZ #17187) - Fix crashes on invalid input in IBM gconv modules (CVE-2014-6040, bnc#894553, BZ #17325) Patch Instructions: To install this openSUSE Security Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE 13.1: zypper in -t patch openSUSE-2014-536 - openSUSE 12.3: zypper in -t patch openSUSE-2014-536 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE 13.1 (i586 i686 x86_64): glibc-2.18-4.21.1 glibc-debuginfo-2.18-4.21.1 glibc-debugsource-2.18-4.21.1 glibc-devel-2.18-4.21.1 glibc-devel-debuginfo-2.18-4.21.1 glibc-devel-static-2.18-4.21.1 glibc-extra-2.18-4.21.1 glibc-extra-debuginfo-2.18-4.21.1 glibc-locale-2.18-4.21.1 glibc-locale-debuginfo-2.18-4.21.1 glibc-profile-2.18-4.21.1 nscd-2.18-4.21.1 nscd-debuginfo-2.18-4.21.1 - openSUSE 13.1 (i586 x86_64): glibc-utils-2.18-4.21.1 glibc-utils-debuginfo-2.18-4.21.1 glibc-utils-debugsource-2.18-4.21.1 - openSUSE 13.1 (i586 i686): glibc-obsolete-2.18-4.21.1 glibc-obsolete-debuginfo-2.18-4.21.1 - openSUSE 13.1 (x86_64): glibc-32bit-2.18-4.21.1 glibc-debuginfo-32bit-2.18-4.21.1 glibc-devel-32bit-2.18-4.21.1 glibc-devel-debuginfo-32bit-2.18-4.21.1 glibc-devel-static-32bit-2.18-4.21.1 glibc-locale-32bit-2.18-4.21.1 glibc-locale-debuginfo-32bit-2.18-4.21.1 glibc-profile-32bit-2.18-4.21.1 glibc-utils-32bit-2.18-4.21.1 glibc-utils-debuginfo-32bit-2.18-4.21.1 - openSUSE 13.1 (noarch): glibc-html-2.18-4.21.1 glibc-i18ndata-2.18-4.21.1 glibc-info-2.18-4.21.1 - openSUSE 12.3 (i586 i686 x86_64): glibc-2.17-4.13.1 glibc-debuginfo-2.17-4.13.1 glibc-debugsource-2.17-4.13.1 glibc-devel-2.17-4.13.1 glibc-devel-debuginfo-2.17-4.13.1 glibc-devel-static-2.17-4.13.1 glibc-extra-2.17-4.13.1 glibc-extra-debuginfo-2.17-4.13.1 glibc-locale-2.17-4.13.1 glibc-locale-debuginfo-2.17-4.13.1 glibc-profile-2.17-4.13.1 nscd-2.17-4.13.1 nscd-debuginfo-2.17-4.13.1 - openSUSE 12.3 (i586 x86_64): glibc-utils-2.17-4.13.1 glibc-utils-debuginfo-2.17-4.13.1 glibc-utils-debugsource-2.17-4.13.1 - openSUSE 12.3 (i586 i686): glibc-obsolete-2.17-4.13.1 glibc-obsolete-debuginfo-2.17-4.13.1 - openSUSE 12.3 (x86_64): glibc-32bit-2.17-4.13.1 glibc-debuginfo-32bit-2.17-4.13.1 glibc-devel-32bit-2.17-4.13.1 glibc-devel-debuginfo-32bit-2.17-4.13.1 glibc-devel-static-32bit-2.17-4.13.1 glibc-locale-32bit-2.17-4.13.1 glibc-locale-debuginfo-32bit-2.17-4.13.1 glibc-profile-32bit-2.17-4.13.1 glibc-utils-32bit-2.17-4.13.1 glibc-utils-debuginfo-32bit-2.17-4.13.1 - openSUSE 12.3 (noarch): glibc-html-2.17-4.13.1 glibc-i18ndata-2.17-4.13.1 glibc-info-2.17-4.13.1 References: http://support.novell.com/security/cve/CVE-2014-0475.html http://support.novell.com/security/cve/CVE-2014-5119.html http://support.novell.com/security/cve/CVE-2014-6040.html https://bugzilla.novell.com/887022 https://bugzilla.novell.com/892073 https://bugzilla.novell.com/894553 -- To unsubscribe, e-mail: opensuse-security-announce+unsubscribe(a)opensuse.org For additional commands, e-mail: opensuse-security-announce+help(a)opensuse.org

1 0

[security-announce] openSUSE-SU-2014:1114-1: important: procmail: fixed a heap overflow in formail
by opensuse-security＠opensuse.org 11 Sep '14

11 Sep '14

openSUSE Security Update: procmail: fixed a heap overflow in formail ______________________________________________________________________________ Announcement ID: openSUSE-SU-2014:1114-1 Rating: important References: #894999 Cross-References: CVE-2014-3618 Affected Products: openSUSE 13.1 openSUSE 12.3 ______________________________________________________________________________ An update that fixes one vulnerability is now available. Description: procmail was updated to fix a heap-overflow in procmail's formail utility when processing specially-crafted email headers (bnc#894999, CVE-2014-3618) Patch Instructions: To install this openSUSE Security Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE 13.1: zypper in -t patch openSUSE-2014-537 - openSUSE 12.3: zypper in -t patch openSUSE-2014-537 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE 13.1 (i586 x86_64): procmail-3.22-264.6.1 procmail-debuginfo-3.22-264.6.1 procmail-debugsource-3.22-264.6.1 - openSUSE 12.3 (i586 x86_64): procmail-3.22-260.6.1 procmail-debuginfo-3.22-260.6.1 procmail-debugsource-3.22-260.6.1 References: http://support.novell.com/security/cve/CVE-2014-3618.html https://bugzilla.novell.com/894999 -- To unsubscribe, e-mail: opensuse-security-announce+unsubscribe(a)opensuse.org For additional commands, e-mail: opensuse-security-announce+help(a)opensuse.org

1 0

[security-announce] SUSE-SU-2014:1112-1: important: Security update for MozillaFirefox
by opensuse-security＠opensuse.org 10 Sep '14

10 Sep '14

SUSE Security Update: Security update for MozillaFirefox ______________________________________________________________________________ Announcement ID: SUSE-SU-2014:1112-1 Rating: important References: #894370 Affected Products: SUSE Linux Enterprise Server 11 SP2 LTSS ______________________________________________________________________________ An update that contains security fixes can now be installed. It includes three new package versions. Description: Mozilla Firefox was updated to the 24.8.0ESR release, fixing security issues and bugs. Only some of the published security advisories affect the Mozilla Firefox 24ESR codestream: * MFSA 2014-72 / CVE-2014-1567: Security researcher regenrecht reported, via TippingPoint's Zero Day Initiative, a use-after-free during text layout when interacting with the setting of text direction. This results in a use-after-free which can lead to arbitrary code execution. * MFSA 2014-67: Mozilla developers and community identified and fixed several memory safety bugs in the browser engine used in Firefox and other Mozilla-based products. Some of these bugs showed evidence of memory corruption under certain circumstances, and we presume that with enough effort at least some of these could be exploited to run arbitrary code. * Jan de Mooij reported a memory safety problem that affects Firefox ESR 24.7, ESR 31 and Firefox 31. (CVE-2014-1562) More information is referenced on: https://www.mozilla.org/security/announce/ <https://www.mozilla.org/security/announce/> . Security Issues: * CVE-2014-1562 <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-1562> * CVE-2014-1567 <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-1567> Patch Instructions: To install this SUSE Security Update use YaST online_update. Alternatively you can run the command listed for your product: - SUSE Linux Enterprise Server 11 SP2 LTSS: zypper in -t patch slessp2-firefox-201409-9682 To bring your system up-to-date, use "zypper patch". Package List: - SUSE Linux Enterprise Server 11 SP2 LTSS (i586 s390x x86_64) [New Version: 24.8.0esr,3.16.4 and 4.10.7]: MozillaFirefox-24.8.0esr-0.3.1 MozillaFirefox-translations-24.8.0esr-0.3.1 libfreebl3-3.16.4-0.3.1 mozilla-nspr-4.10.7-0.3.1 mozilla-nspr-devel-4.10.7-0.3.1 mozilla-nss-3.16.4-0.3.1 mozilla-nss-devel-3.16.4-0.3.1 mozilla-nss-tools-3.16.4-0.3.1 - SUSE Linux Enterprise Server 11 SP2 LTSS (s390x x86_64) [New Version: 3.16.4 and 4.10.7]: libfreebl3-32bit-3.16.4-0.3.1 mozilla-nspr-32bit-4.10.7-0.3.1 mozilla-nss-32bit-3.16.4-0.3.1 References: https://bugzilla.novell.com/894370 http://download.suse.com/patch/finder/?keywords=e1c935e0f16e49f1e16fa6831a4… -- To unsubscribe, e-mail: opensuse-security-announce+unsubscribe(a)opensuse.org For additional commands, e-mail: opensuse-security-announce+help(a)opensuse.org

1 0

[security-announce] openSUSE-SU-2014:1110-1: important: flash-player to 11.2.202.40
by opensuse-security＠opensuse.org 10 Sep '14

10 Sep '14

openSUSE Security Update: flash-player to 11.2.202.40 ______________________________________________________________________________ Announcement ID: openSUSE-SU-2014:1110-1 Rating: important References: #895856 Cross-References: CVE-2014-0547 CVE-2014-0548 CVE-2014-0549 CVE-2014-0550 CVE-2014-0551 CVE-2014-0552 CVE-2014-0553 CVE-2014-0554 CVE-2014-0555 CVE-2014-0556 CVE-2014-0557 CVE-2014-0559 Affected Products: openSUSE 13.1:NonFree openSUSE 12.3:NonFree ______________________________________________________________________________ An update that fixes 12 vulnerabilities is now available. Description: Adobe Flash Player was updated to 11.2.202.406 (bnc#895856): * APSB14-21, CVE-2014-0547, CVE-2014-0548, CVE-2014-0549, CVE-2014-0550, CVE-2014-0551, CVE-2014-0552, CVE-2014-0553, CVE-2014-0554, CVE-2014-0555, CVE-2014-0556, CVE-2014-0557, CVE-2014-0559 More information can be found on: http://helpx.adobe.com/security/products/flash-player/apsb14-21.html Patch Instructions: To install this openSUSE Security Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE 13.1:NonFree: zypper in -t patch openSUSE-2014-535 - openSUSE 12.3:NonFree: zypper in -t patch openSUSE-2014-535 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE 13.1:NonFree (i586 x86_64): flash-player-11.2.202.406-66.1 flash-player-gnome-11.2.202.406-66.1 flash-player-kde4-11.2.202.406-66.1 - openSUSE 12.3:NonFree (i586 x86_64): flash-player-11.2.202.406-2.92.1 flash-player-gnome-11.2.202.406-2.92.1 flash-player-kde4-11.2.202.406-2.92.1 References: http://support.novell.com/security/cve/CVE-2014-0547.html http://support.novell.com/security/cve/CVE-2014-0548.html http://support.novell.com/security/cve/CVE-2014-0549.html http://support.novell.com/security/cve/CVE-2014-0550.html http://support.novell.com/security/cve/CVE-2014-0551.html http://support.novell.com/security/cve/CVE-2014-0552.html http://support.novell.com/security/cve/CVE-2014-0553.html http://support.novell.com/security/cve/CVE-2014-0554.html http://support.novell.com/security/cve/CVE-2014-0555.html http://support.novell.com/security/cve/CVE-2014-0556.html http://support.novell.com/security/cve/CVE-2014-0557.html http://support.novell.com/security/cve/CVE-2014-0559.html https://bugzilla.novell.com/895856 -- To unsubscribe, e-mail: opensuse-security-announce+unsubscribe(a)opensuse.org For additional commands, e-mail: opensuse-security-announce+help(a)opensuse.org

1 0

[security-announce] SUSE-SU-2014:1107-1: important: Security update for MozillaFirefox
by opensuse-security＠opensuse.org 10 Sep '14

10 Sep '14

SUSE Security Update: Security update for MozillaFirefox ______________________________________________________________________________ Announcement ID: SUSE-SU-2014:1107-1 Rating: important References: #894370 Cross-References: CVE-2014-1562 CVE-2014-1567 Affected Products: SUSE Linux Enterprise Software Development Kit 11 SP3 SUSE Linux Enterprise Server 11 SP3 for VMware SUSE Linux Enterprise Server 11 SP3 SUSE Linux Enterprise Desktop 11 SP3 ______________________________________________________________________________ An update that fixes two vulnerabilities is now available. It includes three new package versions. Description: Mozilla Firefox was updated to the 24.8.0ESR release, fixing security issues and bugs. Only some of the published security advisories affect the Mozilla Firefox 24ESR codestream: * MFSA 2014-72 / CVE-2014-1567: Security researcher regenrecht reported, via TippingPoint's Zero Day Initiative, a use-after-free during text layout when interacting with the setting of text direction. This results in a use-after-free which can lead to arbitrary code execution. * MFSA 2014-67: Mozilla developers and community identified and fixed several memory safety bugs in the browser engine used in Firefox and other Mozilla-based products. Some of these bugs showed evidence of memory corruption under certain circumstances, and we presume that with enough effort at least some of these could be exploited to run arbitrary code. * Jan de Mooij reported a memory safety problem that affects Firefox ESR 24.7, ESR 31 and Firefox 31. (CVE-2014-1562) More information is referenced on: https://www.mozilla.org/security/announce/ <https://www.mozilla.org/security/announce/> . Security Issues: * CVE-2014-1562 <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-1562> * CVE-2014-1567 <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-1567> Patch Instructions: To install this SUSE Security Update use YaST online_update. Alternatively you can run the command listed for your product: - SUSE Linux Enterprise Software Development Kit 11 SP3: zypper in -t patch sdksp3-firefox-201409-9687 - SUSE Linux Enterprise Server 11 SP3 for VMware: zypper in -t patch slessp3-firefox-201409-9687 - SUSE Linux Enterprise Server 11 SP3: zypper in -t patch slessp3-firefox-201409-9687 - SUSE Linux Enterprise Desktop 11 SP3: zypper in -t patch sledsp3-firefox-201409-9687 To bring your system up-to-date, use "zypper patch". Package List: - SUSE Linux Enterprise Software Development Kit 11 SP3 (i586 ia64 ppc64 s390x x86_64) [New Version: 3.16.4 and 4.10.7]: MozillaFirefox-devel-24.8.0esr-0.8.1 mozilla-nspr-devel-4.10.7-0.3.1 mozilla-nss-devel-3.16.4-0.8.1 - SUSE Linux Enterprise Server 11 SP3 for VMware (i586 x86_64) [New Version: 24.8.0esr,3.16.4 and 4.10.7]: MozillaFirefox-24.8.0esr-0.8.1 MozillaFirefox-translations-24.8.0esr-0.8.1 libfreebl3-3.16.4-0.8.1 libsoftokn3-3.16.4-0.8.1 mozilla-nspr-4.10.7-0.3.1 mozilla-nss-3.16.4-0.8.1 mozilla-nss-tools-3.16.4-0.8.1 - SUSE Linux Enterprise Server 11 SP3 for VMware (x86_64) [New Version: 3.16.4 and 4.10.7]: libfreebl3-32bit-3.16.4-0.8.1 libsoftokn3-32bit-3.16.4-0.8.1 mozilla-nspr-32bit-4.10.7-0.3.1 mozilla-nss-32bit-3.16.4-0.8.1 - SUSE Linux Enterprise Server 11 SP3 (i586 ia64 ppc64 s390x x86_64) [New Version: 24.8.0esr,3.16.4 and 4.10.7]: MozillaFirefox-24.8.0esr-0.8.1 MozillaFirefox-translations-24.8.0esr-0.8.1 libfreebl3-3.16.4-0.8.1 libsoftokn3-3.16.4-0.8.1 mozilla-nspr-4.10.7-0.3.1 mozilla-nss-3.16.4-0.8.1 mozilla-nss-tools-3.16.4-0.8.1 - SUSE Linux Enterprise Server 11 SP3 (ppc64 s390x x86_64) [New Version: 3.16.4 and 4.10.7]: libfreebl3-32bit-3.16.4-0.8.1 libsoftokn3-32bit-3.16.4-0.8.1 mozilla-nspr-32bit-4.10.7-0.3.1 mozilla-nss-32bit-3.16.4-0.8.1 - SUSE Linux Enterprise Server 11 SP3 (ia64) [New Version: 3.16.4 and 4.10.7]: libfreebl3-x86-3.16.4-0.8.1 libsoftokn3-x86-3.16.4-0.8.1 mozilla-nspr-x86-4.10.7-0.3.1 mozilla-nss-x86-3.16.4-0.8.1 - SUSE Linux Enterprise Desktop 11 SP3 (i586 x86_64) [New Version: 24.8.0esr,3.16.4 and 4.10.7]: MozillaFirefox-24.8.0esr-0.8.1 MozillaFirefox-translations-24.8.0esr-0.8.1 libfreebl3-3.16.4-0.8.1 libsoftokn3-3.16.4-0.8.1 mozilla-nspr-4.10.7-0.3.1 mozilla-nss-3.16.4-0.8.1 mozilla-nss-tools-3.16.4-0.8.1 - SUSE Linux Enterprise Desktop 11 SP3 (x86_64) [New Version: 3.16.4 and 4.10.7]: libfreebl3-32bit-3.16.4-0.8.1 libsoftokn3-32bit-3.16.4-0.8.1 mozilla-nspr-32bit-4.10.7-0.3.1 mozilla-nss-32bit-3.16.4-0.8.1 References: http://support.novell.com/security/cve/CVE-2014-1562.html http://support.novell.com/security/cve/CVE-2014-1567.html https://bugzilla.novell.com/894370 http://download.suse.com/patch/finder/?keywords=873315fb280696995d2133ee781… -- To unsubscribe, e-mail: opensuse-security-announce+unsubscribe(a)opensuse.org For additional commands, e-mail: opensuse-security-announce+help(a)opensuse.org

1 0

[security-announce] openSUSE-SU-2014:1100-1: important: Firefox update to 31.1esr
by opensuse-security＠opensuse.org 09 Sep '14

09 Sep '14

1 0

[security-announce] openSUSE-SU-2014:1098-1: important: MozillaThunderbird: Update to 31.1 release
by opensuse-security＠opensuse.org 09 Sep '14

09 Sep '14

openSUSE Security Update: MozillaThunderbird: Update to 31.1 release ______________________________________________________________________________ Announcement ID: openSUSE-SU-2014:1098-1 Rating: important References: #894370 Cross-References: CVE-2014-1553 CVE-2014-1562 CVE-2014-1563 CVE-2014-1564 CVE-2014-1565 CVE-2014-1567 Affected Products: openSUSE 13.1 openSUSE 12.3 ______________________________________________________________________________ An update that fixes 6 vulnerabilities is now available. Description: MozillaThunderbird was updated to Thunderbird 31.1.0 (bnc#894370), fixinfg security issues: * MFSA 2014-67/CVE-2014-1553/CVE-2014-1562 Miscellaneous memory safety hazards * MFSA 2014-68/CVE-2014-1563 (bmo#1018524) Use-after-free during DOM interactions with SVG * MFSA 2014-69/CVE-2014-1564 (bmo#1045977) Uninitialized memory use during GIF rendering * MFSA 2014-70/CVE-2014-1565 (bmo#1047831) Out-of-bounds read in Web Audio audio timeline * MFSA 2014-72/CVE-2014-1567 (bmo#1037641) Use-after-free setting text directionality - update to Thunderbird 31.0 * based on Gecko 31 * Autocompleting email addresses now matches against any part of the name or email * Composing a mail to a newsgroup will now autocomplete newsgroup names * Insecure NTLM (pre-NTLMv2) authentication disabled Patch Instructions: To install this openSUSE Security Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE 13.1: zypper in -t patch openSUSE-2014-531 - openSUSE 12.3: zypper in -t patch openSUSE-2014-531 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE 13.1 (i586 x86_64): MozillaThunderbird-31.1.0-70.31.1 MozillaThunderbird-buildsymbols-31.1.0-70.31.1 MozillaThunderbird-debuginfo-31.1.0-70.31.1 MozillaThunderbird-debugsource-31.1.0-70.31.1 MozillaThunderbird-devel-31.1.0-70.31.1 MozillaThunderbird-translations-common-31.1.0-70.31.1 MozillaThunderbird-translations-other-31.1.0-70.31.1 - openSUSE 12.3 (i586 x86_64): MozillaThunderbird-31.1.0-61.59.1 MozillaThunderbird-buildsymbols-31.1.0-61.59.1 MozillaThunderbird-debuginfo-31.1.0-61.59.1 MozillaThunderbird-debugsource-31.1.0-61.59.1 MozillaThunderbird-devel-31.1.0-61.59.1 MozillaThunderbird-translations-common-31.1.0-61.59.1 MozillaThunderbird-translations-other-31.1.0-61.59.1 References: http://support.novell.com/security/cve/CVE-2014-1553.html http://support.novell.com/security/cve/CVE-2014-1562.html http://support.novell.com/security/cve/CVE-2014-1563.html http://support.novell.com/security/cve/CVE-2014-1564.html http://support.novell.com/security/cve/CVE-2014-1565.html http://support.novell.com/security/cve/CVE-2014-1567.html https://bugzilla.novell.com/894370 -- To unsubscribe, e-mail: opensuse-security-announce+unsubscribe(a)opensuse.org For additional commands, e-mail: opensuse-security-announce+help(a)opensuse.org

1 0

[security-announce] SUSE-SU-2014:1082-1: important: Security update for apache2
by opensuse-security＠opensuse.org 02 Sep '14

02 Sep '14

SUSE Security Update: Security update for apache2 ______________________________________________________________________________ Announcement ID: SUSE-SU-2014:1082-1 Rating: important References: #829056 #829057 #869105 #869106 #887765 #887768 Cross-References: CVE-2013-1862 CVE-2013-1896 CVE-2013-6438 CVE-2014-0098 CVE-2014-0226 CVE-2014-0231 Affected Products: SUSE Linux Enterprise Server 10 SP4 LTSS SUSE Linux Enterprise Server 10 SP3 LTSS ______________________________________________________________________________ An update that fixes 6 vulnerabilities is now available. Description: This apache2 update fixes the following security issues: * log_cookie mod_log_config.c remote denial of service (CVE-2014-0098, bnc#869106) * mod_dav denial of service (CVE-2013-6438, bnc#869105) * mod_cgid denial of service (CVE-2014-0231, bnc#887768) * mod_status heap-based buffer overflow (CVE-2014-0226, bnc#887765) * mod_rewrite: escape logdata to avoid terminal escapes (CVE-2013-1862, bnc#829057) * mod_dav: segfault in merge request (CVE-2013-1896, bnc#829056) Security Issues: * CVE-2014-0098 <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-0098> * CVE-2013-6438 <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2013-6438> * CVE-2014-0226 <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-0226> * CVE-2014-0231 <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-0231> * CVE-2013-1862 <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2013-1862> * CVE-2013-1896 <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2013-1896> Package List: - SUSE Linux Enterprise Server 10 SP4 LTSS (i586 s390x x86_64): apache2-2.2.3-16.50.1 apache2-devel-2.2.3-16.50.1 apache2-doc-2.2.3-16.50.1 apache2-example-pages-2.2.3-16.50.1 apache2-prefork-2.2.3-16.50.1 apache2-worker-2.2.3-16.50.1 - SUSE Linux Enterprise Server 10 SP3 LTSS (i586 s390x x86_64): apache2-2.2.3-16.32.51.2 apache2-devel-2.2.3-16.32.51.2 apache2-doc-2.2.3-16.32.51.2 apache2-example-pages-2.2.3-16.32.51.2 apache2-prefork-2.2.3-16.32.51.2 apache2-worker-2.2.3-16.32.51.2 References: http://support.novell.com/security/cve/CVE-2013-1862.html http://support.novell.com/security/cve/CVE-2013-1896.html http://support.novell.com/security/cve/CVE-2013-6438.html http://support.novell.com/security/cve/CVE-2014-0098.html http://support.novell.com/security/cve/CVE-2014-0226.html http://support.novell.com/security/cve/CVE-2014-0231.html https://bugzilla.novell.com/829056 https://bugzilla.novell.com/829057 https://bugzilla.novell.com/869105 https://bugzilla.novell.com/869106 https://bugzilla.novell.com/887765 https://bugzilla.novell.com/887768 http://download.suse.com/patch/finder/?keywords=0593c1f59d8a810c00150b05cea… http://download.suse.com/patch/finder/?keywords=0ddc907bde6fcbad1e94944d867… -- To unsubscribe, e-mail: opensuse-security-announce+unsubscribe(a)opensuse.org For additional commands, e-mail: opensuse-security-announce+help(a)opensuse.org

1 0

[security-announce] SUSE-SU-2014:1081-1: important: Security update for apache2
by opensuse-security＠opensuse.org 02 Sep '14

02 Sep '14

SUSE Security Update: Security update for apache2 ______________________________________________________________________________ Announcement ID: SUSE-SU-2014:1081-1 Rating: important References: #852401 #859916 #869105 #869106 #887765 #887768 Cross-References: CVE-2013-6438 CVE-2014-0098 CVE-2014-0226 CVE-2014-0231 Affected Products: SUSE Linux Enterprise Server 11 SP1 LTSS ______________________________________________________________________________ An update that solves four vulnerabilities and has two fixes is now available. It includes one version update. Description: This apache2 update fixes the following security and non-security issues: * mod_cgid denial of service (CVE-2014-0231, bnc#887768) * mod_status heap-based buffer overflow (CVE-2014-0226, bnc#887765) * mod_dav denial of service (CVE-2013-6438, bnc#869105) * log_cookie mod_log_config.c remote denial of service (CVE-2014-0098, bnc#869106) * Support ECDH in Apache2 (bnc#859916) * apache fails to start with SSL on Xen kernel at boot time (bnc#852401) Security Issues: * CVE-2014-0098 <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-0098> * CVE-2013-6438 <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2013-6438> * CVE-2014-0226 <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-0226> * CVE-2014-0231 <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-0231> Patch Instructions: To install this SUSE Security Update use YaST online_update. Alternatively you can run the command listed for your product: - SUSE Linux Enterprise Server 11 SP1 LTSS: zypper in -t patch slessp1-apache2-9619 To bring your system up-to-date, use "zypper patch". Package List: - SUSE Linux Enterprise Server 11 SP1 LTSS (i586 s390x x86_64) [New Version: 2.2.12]: apache2-2.2.12-1.48.1 apache2-doc-2.2.12-1.48.1 apache2-example-pages-2.2.12-1.48.1 apache2-prefork-2.2.12-1.48.1 apache2-utils-2.2.12-1.48.1 apache2-worker-2.2.12-1.48.1 References: http://support.novell.com/security/cve/CVE-2013-6438.html http://support.novell.com/security/cve/CVE-2014-0098.html http://support.novell.com/security/cve/CVE-2014-0226.html http://support.novell.com/security/cve/CVE-2014-0231.html https://bugzilla.novell.com/852401 https://bugzilla.novell.com/859916 https://bugzilla.novell.com/869105 https://bugzilla.novell.com/869106 https://bugzilla.novell.com/887765 https://bugzilla.novell.com/887768 http://download.suse.com/patch/finder/?keywords=9c5ea88101bc5060dd62e74ff4f… -- To unsubscribe, e-mail: opensuse-security-announce+unsubscribe(a)opensuse.org For additional commands, e-mail: opensuse-security-announce+help(a)opensuse.org

1 0

[security-announce] SUSE-SU-2014:1080-1: important: Security update for apache2
by opensuse-security＠opensuse.org 02 Sep '14

02 Sep '14

SUSE Security Update: Security update for apache2 ______________________________________________________________________________ Announcement ID: SUSE-SU-2014:1080-1 Rating: important References: #859916 #869105 #869106 #887765 #887768 Cross-References: CVE-2013-6438 CVE-2014-0098 CVE-2014-0226 CVE-2014-0231 Affected Products: SUSE Linux Enterprise Server 11 SP2 LTSS ______________________________________________________________________________ An update that solves four vulnerabilities and has one errata is now available. Description: This apache2 update fixes the following security and non security issues: * mod_cgid denial of service (CVE-2014-0231, bnc#887768) * mod_status heap-based buffer overflow (CVE-2014-0226, bnc#887765) * mod_dav denial of service (CVE-2013-6438, bnc#869105) * log_cookie mod_log_config.c remote denial of service (CVE-2014-0098, bnc#869106) * Support ECDH in Apache2 (bnc#859916) Security Issues: * CVE-2014-0098 <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-0098> * CVE-2013-6438 <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2013-6438> * CVE-2014-0226 <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-0226> * CVE-2014-0231 <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-0231> Patch Instructions: To install this SUSE Security Update use YaST online_update. Alternatively you can run the command listed for your product: - SUSE Linux Enterprise Server 11 SP2 LTSS: zypper in -t patch slessp2-apache2-9620 To bring your system up-to-date, use "zypper patch". Package List: - SUSE Linux Enterprise Server 11 SP2 LTSS (i586 s390x x86_64): apache2-2.2.12-1.48.1 apache2-doc-2.2.12-1.48.1 apache2-example-pages-2.2.12-1.48.1 apache2-prefork-2.2.12-1.48.1 apache2-utils-2.2.12-1.48.1 apache2-worker-2.2.12-1.48.1 References: http://support.novell.com/security/cve/CVE-2013-6438.html http://support.novell.com/security/cve/CVE-2014-0098.html http://support.novell.com/security/cve/CVE-2014-0226.html http://support.novell.com/security/cve/CVE-2014-0231.html https://bugzilla.novell.com/859916 https://bugzilla.novell.com/869105 https://bugzilla.novell.com/869106 https://bugzilla.novell.com/887765 https://bugzilla.novell.com/887768 http://download.suse.com/patch/finder/?keywords=9a43c85d7b1016ad740a0769515… -- To unsubscribe, e-mail: opensuse-security-announce+unsubscribe(a)opensuse.org For additional commands, e-mail: opensuse-security-announce+help(a)opensuse.org

1 0