September 2014 - openSUSE Security Announce

[security-announce] openSUSE-SU-2014:1232-1: critical: mozilla-nss: update to avoid signature forgery
by opensuse-security＠opensuse.org 28 Sep '14

28 Sep '14

openSUSE Security Update: mozilla-nss: update to avoid signature forgery ______________________________________________________________________________ Announcement ID: openSUSE-SU-2014:1232-1 Rating: critical References: #897890 Cross-References: CVE-2014-1568 Affected Products: openSUSE 13.1 openSUSE 12.3 ______________________________________________________________________________ An update that fixes one vulnerability is now available. Description: Mozilla NSS is vulnerable to a variant of a signature forgery attack previously published by Daniel Bleichenbacher. This is due to lenient parsing of ASN.1 values involved in a signature and could lead to the forging of RSA certificates. Patch Instructions: To install this openSUSE Security Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE 13.1: zypper in -t patch openSUSE-2014-562 - openSUSE 12.3: zypper in -t patch openSUSE-2014-562 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE 13.1 (i586 x86_64): libfreebl3-3.16.5-39.1 libfreebl3-debuginfo-3.16.5-39.1 libsoftokn3-3.16.5-39.1 libsoftokn3-debuginfo-3.16.5-39.1 mozilla-nss-3.16.5-39.1 mozilla-nss-certs-3.16.5-39.1 mozilla-nss-certs-debuginfo-3.16.5-39.1 mozilla-nss-debuginfo-3.16.5-39.1 mozilla-nss-debugsource-3.16.5-39.1 mozilla-nss-devel-3.16.5-39.1 mozilla-nss-sysinit-3.16.5-39.1 mozilla-nss-sysinit-debuginfo-3.16.5-39.1 mozilla-nss-tools-3.16.5-39.1 mozilla-nss-tools-debuginfo-3.16.5-39.1 - openSUSE 13.1 (x86_64): libfreebl3-32bit-3.16.5-39.1 libfreebl3-debuginfo-32bit-3.16.5-39.1 libsoftokn3-32bit-3.16.5-39.1 libsoftokn3-debuginfo-32bit-3.16.5-39.1 mozilla-nss-32bit-3.16.5-39.1 mozilla-nss-certs-32bit-3.16.5-39.1 mozilla-nss-certs-debuginfo-32bit-3.16.5-39.1 mozilla-nss-debuginfo-32bit-3.16.5-39.1 mozilla-nss-sysinit-32bit-3.16.5-39.1 mozilla-nss-sysinit-debuginfo-32bit-3.16.5-39.1 - openSUSE 12.3 (i586 x86_64): libfreebl3-3.16.5-1.55.1 libfreebl3-debuginfo-3.16.5-1.55.1 libsoftokn3-3.16.5-1.55.1 libsoftokn3-debuginfo-3.16.5-1.55.1 mozilla-nss-3.16.5-1.55.1 mozilla-nss-certs-3.16.5-1.55.1 mozilla-nss-certs-debuginfo-3.16.5-1.55.1 mozilla-nss-debuginfo-3.16.5-1.55.1 mozilla-nss-debugsource-3.16.5-1.55.1 mozilla-nss-devel-3.16.5-1.55.1 mozilla-nss-sysinit-3.16.5-1.55.1 mozilla-nss-sysinit-debuginfo-3.16.5-1.55.1 mozilla-nss-tools-3.16.5-1.55.1 mozilla-nss-tools-debuginfo-3.16.5-1.55.1 - openSUSE 12.3 (x86_64): libfreebl3-32bit-3.16.5-1.55.1 libfreebl3-debuginfo-32bit-3.16.5-1.55.1 libsoftokn3-32bit-3.16.5-1.55.1 libsoftokn3-debuginfo-32bit-3.16.5-1.55.1 mozilla-nss-32bit-3.16.5-1.55.1 mozilla-nss-certs-32bit-3.16.5-1.55.1 mozilla-nss-certs-debuginfo-32bit-3.16.5-1.55.1 mozilla-nss-debuginfo-32bit-3.16.5-1.55.1 mozilla-nss-sysinit-32bit-3.16.5-1.55.1 mozilla-nss-sysinit-debuginfo-32bit-3.16.5-1.55.1 References: http://support.novell.com/security/cve/CVE-2014-1568.html https://bugzilla.suse.com/show_bug.cgi?id=897890 -- To unsubscribe, e-mail: opensuse-security-announce+unsubscribe(a)opensuse.org For additional commands, e-mail: opensuse-security-announce+help(a)opensuse.org

1 0

[security-announce] openSUSE-SU-2014:1229-1: important: bash
by opensuse-security＠opensuse.org 28 Sep '14

28 Sep '14

openSUSE Security Update: bash ______________________________________________________________________________ Announcement ID: openSUSE-SU-2014:1229-1 Rating: important References: #898346 #898603 #898604 Cross-References: CVE-2014-7169 CVE-2014-7186 CVE-2014-7187 Affected Products: openSUSE 12.3 ______________________________________________________________________________ An update that fixes three vulnerabilities is now available. Description: The command-line shell 'bash' evaluates environment variables, which allows the injection of characters and might be used to access files on the system in some circumstances (CVE-2014-7169). Please note that this issue is different from a previously fixed vulnerability tracked under CVE-2014-6271 and it is less serious due to the special, non-default system configuration that is needed to create an exploitable situation. To remove further exploitation potential we now limit the function-in-environment variable to variables prefixed with BASH_FUNC_ . This hardening feature is work in progress and might be improved in later updates. Additionaly two more security issues were fixed in bash: CVE-2014-7186: Nested HERE documents could lead to a crash of bash. CVE-2014-7187: Nesting of for loops could lead to a crash of bash. Patch Instructions: To install this openSUSE Security Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE 12.3: zypper in -t patch openSUSE-2014-563 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE 12.3 (i586 x86_64): bash-4.2-61.15.1 bash-debuginfo-4.2-61.15.1 bash-debugsource-4.2-61.15.1 bash-devel-4.2-61.15.1 bash-loadables-4.2-61.15.1 bash-loadables-debuginfo-4.2-61.15.1 libreadline6-6.2-61.15.1 libreadline6-debuginfo-6.2-61.15.1 readline-devel-6.2-61.15.1 - openSUSE 12.3 (x86_64): bash-debuginfo-32bit-4.2-61.15.1 libreadline6-32bit-6.2-61.15.1 libreadline6-debuginfo-32bit-6.2-61.15.1 readline-devel-32bit-6.2-61.15.1 - openSUSE 12.3 (noarch): bash-doc-4.2-61.15.1 bash-lang-4.2-61.15.1 readline-doc-6.2-61.15.1 References: http://support.novell.com/security/cve/CVE-2014-7169.html http://support.novell.com/security/cve/CVE-2014-7186.html http://support.novell.com/security/cve/CVE-2014-7187.html https://bugzilla.suse.com/show_bug.cgi?id=898346 https://bugzilla.suse.com/show_bug.cgi?id=898603 https://bugzilla.suse.com/show_bug.cgi?id=898604 -- To unsubscribe, e-mail: opensuse-security-announce+unsubscribe(a)opensuse.org For additional commands, e-mail: opensuse-security-announce+help(a)opensuse.org

1 0

[security-announce] openSUSE-SU-2014:1226-1: critical: bash: security and bugfix update
by opensuse-security＠opensuse.org 28 Sep '14

28 Sep '14

openSUSE Security Update: bash: security and bugfix update ______________________________________________________________________________ Announcement ID: openSUSE-SU-2014:1226-1 Rating: critical References: #868822 #895475 #896776 Cross-References: CVE-2014-2524 CVE-2014-6271 Affected Products: openSUSE 13.1 openSUSE 12.3 ______________________________________________________________________________ An update that solves two vulnerabilities and has one errata is now available. Description: bash was updated to fix a critical security issue, a minor security issue and bugs: In some circumstances, the shell would evaluate shellcode in environment variables passed at startup time. This allowed code execution by local or remote attackers who could pass environment variables to bash scripts. (CVE-2014-6271) Fixed a temporary file misuse in _rl_tropen (bnc#868822) Even if used only by developers to debug readline library do not open temporary files from public location without O_EXCL (CVE-2014-2524) Additional bugfixes: - Backported corrected german error message for a failing getpwd (bnc#895475) - Add bash upstream patch 47 to fix a problem where the function that shortens pathnames for $PS1 according to the value of $PROMPT_DIRTRIM uses memcpy on potentially-overlapping regions of memory, when it should use memmove. The result is garbled pathnames in prompt strings. - Add bash upstream patch 46 to fix a problem introduced by patch 32 a problem with "$@" and arrays expanding empty positional parameters or array elements when using substring expansion, pattern substitution, or case modfication. The empty parameters or array elements are removed instead of expanding to empty strings (""). - Add bash-4.2-strcpy.patch from upstream mailing list to patch collection tar ball to avoid when using \w in the prompt and changing the directory outside of HOME the a strcpy work on overlapping memory areas. Patch Instructions: To install this openSUSE Security Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE 13.1: zypper in -t patch openSUSE-2014-559 - openSUSE 12.3: zypper in -t patch openSUSE-2014-559 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE 13.1 (i586 x86_64): bash-4.2-68.4.1 bash-debuginfo-4.2-68.4.1 bash-debugsource-4.2-68.4.1 bash-devel-4.2-68.4.1 bash-loadables-4.2-68.4.1 bash-loadables-debuginfo-4.2-68.4.1 libreadline6-6.2-68.4.1 libreadline6-debuginfo-6.2-68.4.1 readline-devel-6.2-68.4.1 - openSUSE 13.1 (x86_64): bash-debuginfo-32bit-4.2-68.4.1 libreadline6-32bit-6.2-68.4.1 libreadline6-debuginfo-32bit-6.2-68.4.1 readline-devel-32bit-6.2-68.4.1 - openSUSE 13.1 (noarch): bash-doc-4.2-68.4.1 bash-lang-4.2-68.4.1 readline-doc-6.2-68.4.1 - openSUSE 12.3 (i586 x86_64): bash-4.2-61.9.1 bash-debuginfo-4.2-61.9.1 bash-debugsource-4.2-61.9.1 bash-devel-4.2-61.9.1 bash-loadables-4.2-61.9.1 bash-loadables-debuginfo-4.2-61.9.1 libreadline6-6.2-61.9.1 libreadline6-debuginfo-6.2-61.9.1 readline-devel-6.2-61.9.1 - openSUSE 12.3 (x86_64): bash-debuginfo-32bit-4.2-61.9.1 libreadline6-32bit-6.2-61.9.1 libreadline6-debuginfo-32bit-6.2-61.9.1 readline-devel-32bit-6.2-61.9.1 - openSUSE 12.3 (noarch): bash-doc-4.2-61.9.1 bash-lang-4.2-61.9.1 readline-doc-6.2-61.9.1 References: http://support.novell.com/security/cve/CVE-2014-2524.html http://support.novell.com/security/cve/CVE-2014-6271.html https://bugzilla.suse.com/show_bug.cgi?id=868822 https://bugzilla.suse.com/show_bug.cgi?id=895475 https://bugzilla.suse.com/show_bug.cgi?id=896776 -- To unsubscribe, e-mail: opensuse-security-announce+unsubscribe(a)opensuse.org For additional commands, e-mail: opensuse-security-announce+help(a)opensuse.org

1 0

[security-announce] openSUSE-SU-2014:1224-1: critical: NSS update to avoid signature forgery
by opensuse-security＠opensuse.org 28 Sep '14

28 Sep '14

openSUSE Security Update: NSS update to avoid signature forgery ______________________________________________________________________________ Announcement ID: openSUSE-SU-2014:1224-1 Rating: critical References: #897890 Cross-References: CVE-2014-1568 Affected Products: openSUSE Evergreen 11.4 ______________________________________________________________________________ An update that fixes one vulnerability is now available. Description: NSS is vulnerable to a variant of a signature forgery attack previously published by Daniel Bleichenbacher. This is due to lenient parsing of ASN.1 values involved in a signature and could lead to the forging of RSA certificates. Patch Instructions: To install this openSUSE Security Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE Evergreen 11.4: zypper in -t patch 2014-87 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE Evergreen 11.4 (i586 x86_64): libfreebl3-3.16.5-98.1 libfreebl3-debuginfo-3.16.5-98.1 libsoftokn3-3.16.5-98.1 libsoftokn3-debuginfo-3.16.5-98.1 mozilla-nss-3.16.5-98.1 mozilla-nss-certs-3.16.5-98.1 mozilla-nss-certs-debuginfo-3.16.5-98.1 mozilla-nss-debuginfo-3.16.5-98.1 mozilla-nss-debugsource-3.16.5-98.1 mozilla-nss-devel-3.16.5-98.1 mozilla-nss-sysinit-3.16.5-98.1 mozilla-nss-sysinit-debuginfo-3.16.5-98.1 mozilla-nss-tools-3.16.5-98.1 mozilla-nss-tools-debuginfo-3.16.5-98.1 - openSUSE Evergreen 11.4 (x86_64): libfreebl3-32bit-3.16.5-98.1 libfreebl3-debuginfo-32bit-3.16.5-98.1 libsoftokn3-32bit-3.16.5-98.1 libsoftokn3-debuginfo-32bit-3.16.5-98.1 mozilla-nss-32bit-3.16.5-98.1 mozilla-nss-certs-32bit-3.16.5-98.1 mozilla-nss-certs-debuginfo-32bit-3.16.5-98.1 mozilla-nss-debuginfo-32bit-3.16.5-98.1 mozilla-nss-sysinit-32bit-3.16.5-98.1 mozilla-nss-sysinit-debuginfo-32bit-3.16.5-98.1 - openSUSE Evergreen 11.4 (ia64): libfreebl3-debuginfo-x86-3.16.5-98.1 libfreebl3-x86-3.16.5-98.1 libsoftokn3-debuginfo-x86-3.16.5-98.1 libsoftokn3-x86-3.16.5-98.1 mozilla-nss-certs-debuginfo-x86-3.16.5-98.1 mozilla-nss-certs-x86-3.16.5-98.1 mozilla-nss-debuginfo-x86-3.16.5-98.1 mozilla-nss-sysinit-debuginfo-x86-3.16.5-98.1 mozilla-nss-sysinit-x86-3.16.5-98.1 mozilla-nss-x86-3.16.5-98.1 References: http://support.novell.com/security/cve/CVE-2014-1568.html https://bugzilla.suse.com/show_bug.cgi?id=897890 -- To unsubscribe, e-mail: opensuse-security-announce+unsubscribe(a)opensuse.org For additional commands, e-mail: opensuse-security-announce+help(a)opensuse.org

1 0

[security-announce] openSUSE 11.4 has reached end of Evergreen support
by Wolfgang Rosenauer 27 Sep '14

27 Sep '14

Hi, as you probably know our initial commitment to support 11.4 within Evergreen was until July 2014. http://en.opensuse.org/openSUSE:Evergreen While I was hoping that we can keep 11.4 alive for some time longer this is currently not possible from what I would call the "core team" which is Stefan and myself. We are too busy nowadays to be able to scan and patch every issue we get aware of. Thanks to you all who contributed to the success of Evergreen/11.4! The important message is: openSUSE 11.4 Evergreen is not actively maintained anymore! So if you can, we recommend to switch to openSUSE 13.1 as soon as possible which is still planned to be an Evergreen release. Some more details below: The repository already got and will most likely get more updates from package maintainers who care about 11.4 and/or their packages though. You noticed that with recent releases of patches for the bash and NSS issues already, BUT this is _no_ guarantee that every security issue will be fixed. We will accept contributions from anyone though and I will try to take care about "my" packages. Some numbers from 11.4 Evergreen (as far as I was able to get them easily): Evergreen lifetime: 21 months 11.4 overall lifetime (incl. Evergreen): 41 months / 3 years 5 months Evergreen lifetime numbers (w/o official maintenance period): Released update source packages: 804 Unique touched source packages: 177 rough number of patches (based on incident counter): 320 Let me also quote Marcus' numbers from official maintenance lifetime: Total updates: 723 Security: 416 Recommended: 306 Optional: 1 Thanks, Wolfgang -- To unsubscribe, e-mail: opensuse-security-announce+unsubscribe(a)opensuse.org For additional commands, e-mail: opensuse-security-announce+help(a)opensuse.org

1 0

[security-announce] SUSE-SU-2014:1223-1: critical: Security update for bash
by opensuse-security＠opensuse.org 26 Sep '14

26 Sep '14

SUSE Security Update: Security update for bash ______________________________________________________________________________ Announcement ID: SUSE-SU-2014:1223-1 Rating: critical References: #896776 Cross-References: CVE-2014-6271 Affected Products: SUSE Manager 1.7 for SLE 11 SP2 ______________________________________________________________________________ An update that fixes one vulnerability is now available. Description: bash has been updated to fix a critical security issue. In some circumstances, the shell would evaluate shellcode in environment variables passed at startup time. This allowed code execution by local or remote attackers who could pass environment variables to bash scripts. (CVE-2014-6271) Security Issues: * CVE-2014-6271 <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-6271> Patch Instructions: To install this SUSE Security Update use YaST online_update. Alternatively you can run the command listed for your product: - SUSE Manager 1.7 for SLE 11 SP2: zypper in -t patch sleman17sp2-bash-9764 To bring your system up-to-date, use "zypper patch". Package List: - SUSE Manager 1.7 for SLE 11 SP2 (x86_64): bash-3.2-147.14.20.1 bash-doc-3.2-147.14.20.1 libreadline5-32bit-5.2-147.14.20.1 libreadline5-5.2-147.14.20.1 readline-doc-5.2-147.14.20.1 References: http://support.novell.com/security/cve/CVE-2014-6271.html https://bugzilla.suse.com/896776 http://download.suse.com/patch/finder/?keywords=634668818756ed213c0d0c59381… -- To unsubscribe, e-mail: opensuse-security-announce+unsubscribe(a)opensuse.org For additional commands, e-mail: opensuse-security-announce+help(a)opensuse.org

1 0

[security-announce] SUSE-SU-2014:1221-1: important: Security update for wireshark
by opensuse-security＠opensuse.org 26 Sep '14

26 Sep '14

SUSE Security Update: Security update for wireshark ______________________________________________________________________________ Announcement ID: SUSE-SU-2014:1221-1 Rating: important References: #889854 #889899 #889900 #889901 #889906 #897055 Cross-References: CVE-2014-6421 CVE-2014-6422 CVE-2014-6423 CVE-2014-6424 CVE-2014-6427 CVE-2014-6428 CVE-2014-6429 CVE-2014-6430 CVE-2014-6431 CVE-2014-6432 Affected Products: SUSE Linux Enterprise Software Development Kit 11 SP3 SUSE Linux Enterprise Server 11 SP3 for VMware SUSE Linux Enterprise Server 11 SP3 SUSE Linux Enterprise Desktop 11 SP3 ______________________________________________________________________________ An update that fixes 10 vulnerabilities is now available. It includes one version update. Description: The wireshark package was upgraded to 1.10.10 from 1.8.x as 1.8 was discontinued. This update fixes vulnerabilities that could allow an attacker to crash Wireshark or make it become unresponsive by sending specific packets onto the network or have them loaded via a capture file while the dissectors are running. It also contains a number of other bug fixes. * RTP dissector crash. (wnpa-sec-2014-12 CVE-2014-6421 CVE-2014-6422) * MEGACO dissector infinite loop. (wnpa-sec-2014-13 CVE-2014-6423) * Netflow dissector crash. (wnpa-sec-2014-14 CVE-2014-6424) * RTSP dissector crash. (wnpa-sec-2014-17 CVE-2014-6427) * SES dissector crash. (wnpa-sec-2014-18 CVE-2014-6428) * Sniffer file parser crash. (wnpa-sec-2014-19 CVE-2014-6429 CVE-2014-6430 CVE-2014-6431 CVE-2014-6432) * The Catapult DCT2000 and IrDA dissectors could underrun a buffer. (wnpa-sec-2014-08 CVE-2014-5161 CVE-2014-5162, bnc#889901) * The GSM Management dissector could crash. (wnpa-sec-2014-09 CVE-2014-5163, bnc#889906) * The RLC dissector could crash. (wnpa-sec-2014-10 CVE-2014-5164, bnc#889900) * The ASN.1 BER dissector could crash. (wnpa-sec-2014-11 CVE-2014-5165, bnc#889899) Further bug fixes as listed in: https://www.wireshark.org/docs/relnotes/wireshark-1.10.10.html <https://www.wireshark.org/docs/relnotes/wireshark-1.10.10.html> and https://www.wireshark.org/docs/relnotes/wireshark-1.10.9.html <https://www.wireshark.org/docs/relnotes/wireshark-1.10.9.html> . Security Issues: * CVE-2014-5161 <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-5161> * CVE-2014-5162 <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-5162> * CVE-2014-5163 <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-5163> * CVE-2014-5164 <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-5164> * CVE-2014-5165 <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-5165> * CVE-2014-6421 <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-6421> * CVE-2014-6422 <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-6422> * CVE-2014-6423 <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-6423> * CVE-2014-6424 <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-6424> * CVE-2014-6427 <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-6427> * CVE-2014-6428 <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-6428> * CVE-2014-6429 <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-6429> * CVE-2014-6430 <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-6430> * CVE-2014-6431 <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-6431> * CVE-2014-6432 <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-6432> Patch Instructions: To install this SUSE Security Update use YaST online_update. Alternatively you can run the command listed for your product: - SUSE Linux Enterprise Software Development Kit 11 SP3: zypper in -t patch sdksp3-wireshark-9745 - SUSE Linux Enterprise Server 11 SP3 for VMware: zypper in -t patch slessp3-wireshark-9745 - SUSE Linux Enterprise Server 11 SP3: zypper in -t patch slessp3-wireshark-9745 - SUSE Linux Enterprise Desktop 11 SP3: zypper in -t patch sledsp3-wireshark-9745 To bring your system up-to-date, use "zypper patch". Package List: - SUSE Linux Enterprise Software Development Kit 11 SP3 (i586 ia64 ppc64 s390x x86_64) [New Version: 1.10.10]: wireshark-devel-1.10.10-0.2.1 - SUSE Linux Enterprise Software Development Kit 11 SP3 (i586 x86_64) [New Version: 1.10.10]: wireshark-1.10.10-0.2.1 - SUSE Linux Enterprise Server 11 SP3 for VMware (i586 x86_64) [New Version: 1.10.10]: wireshark-1.10.10-0.2.1 - SUSE Linux Enterprise Server 11 SP3 (i586 ia64 ppc64 s390x x86_64) [New Version: 1.10.10]: wireshark-1.10.10-0.2.1 - SUSE Linux Enterprise Desktop 11 SP3 (i586 x86_64) [New Version: 1.10.10]: wireshark-1.10.10-0.2.1 References: http://support.novell.com/security/cve/CVE-2014-6421.html http://support.novell.com/security/cve/CVE-2014-6422.html http://support.novell.com/security/cve/CVE-2014-6423.html http://support.novell.com/security/cve/CVE-2014-6424.html http://support.novell.com/security/cve/CVE-2014-6427.html http://support.novell.com/security/cve/CVE-2014-6428.html http://support.novell.com/security/cve/CVE-2014-6429.html http://support.novell.com/security/cve/CVE-2014-6430.html http://support.novell.com/security/cve/CVE-2014-6431.html http://support.novell.com/security/cve/CVE-2014-6432.html https://bugzilla.suse.com/889854 https://bugzilla.suse.com/889899 https://bugzilla.suse.com/889900 https://bugzilla.suse.com/889901 https://bugzilla.suse.com/889906 https://bugzilla.suse.com/897055 http://download.suse.com/patch/finder/?keywords=25a84c702b8b4fdaea63a171632… -- To unsubscribe, e-mail: opensuse-security-announce+unsubscribe(a)opensuse.org For additional commands, e-mail: opensuse-security-announce+help(a)opensuse.org

1 0

[security-announce] SUSE-SU-2014:1220-1: important: Security update for mozilla-nss
by opensuse-security＠opensuse.org 26 Sep '14

26 Sep '14

SUSE Security Update: Security update for mozilla-nss ______________________________________________________________________________ Announcement ID: SUSE-SU-2014:1220-1 Rating: important References: #897890 Cross-References: CVE-2014-1568 Affected Products: SUSE Linux Enterprise Software Development Kit 11 SP3 SUSE Linux Enterprise Server 11 SP3 for VMware SUSE Linux Enterprise Server 11 SP3 SUSE Linux Enterprise Desktop 11 SP3 ______________________________________________________________________________ An update that fixes one vulnerability is now available. It includes one version update. Description: Mozilla NSS was updated to version 3.16.5 to fix a RSA certificate forgery issue. MFSA 2014-73 / CVE-2014-1568: Antoine Delignat-Lavaud, security researcher at Inria Paris in team Prosecco, reported an issue in Network Security Services (NSS) libraries affecting all versions. He discovered that NSS is vulnerable to a variant of a signature forgery attack previously published by Daniel Bleichenbacher. This is due to lenient parsing of ASN.1 values involved in a signature and could lead to the forging of RSA certificates. The Advanced Threat Research team at Intel Security also independently discovered and reported this issue. Security Issues: * CVE-2014-1568 <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-1568> Patch Instructions: To install this SUSE Security Update use YaST online_update. Alternatively you can run the command listed for your product: - SUSE Linux Enterprise Software Development Kit 11 SP3: zypper in -t patch sdksp3-libfreebl3-9777 - SUSE Linux Enterprise Server 11 SP3 for VMware: zypper in -t patch slessp3-libfreebl3-9777 - SUSE Linux Enterprise Server 11 SP3: zypper in -t patch slessp3-libfreebl3-9777 - SUSE Linux Enterprise Desktop 11 SP3: zypper in -t patch sledsp3-libfreebl3-9777 To bring your system up-to-date, use "zypper patch". Package List: - SUSE Linux Enterprise Software Development Kit 11 SP3 (i586 ia64 ppc64 s390x x86_64) [New Version: 3.16.5]: mozilla-nss-devel-3.16.5-0.7.1 - SUSE Linux Enterprise Server 11 SP3 for VMware (i586 x86_64) [New Version: 3.16.5]: libfreebl3-3.16.5-0.7.1 libsoftokn3-3.16.5-0.7.1 mozilla-nss-3.16.5-0.7.1 mozilla-nss-tools-3.16.5-0.7.1 - SUSE Linux Enterprise Server 11 SP3 for VMware (x86_64) [New Version: 3.16.5]: libfreebl3-32bit-3.16.5-0.7.1 libsoftokn3-32bit-3.16.5-0.7.1 mozilla-nss-32bit-3.16.5-0.7.1 - SUSE Linux Enterprise Server 11 SP3 (i586 ia64 ppc64 s390x x86_64) [New Version: 3.16.5]: libfreebl3-3.16.5-0.7.1 libsoftokn3-3.16.5-0.7.1 mozilla-nss-3.16.5-0.7.1 mozilla-nss-tools-3.16.5-0.7.1 - SUSE Linux Enterprise Server 11 SP3 (ppc64 s390x x86_64) [New Version: 3.16.5]: libfreebl3-32bit-3.16.5-0.7.1 libsoftokn3-32bit-3.16.5-0.7.1 mozilla-nss-32bit-3.16.5-0.7.1 - SUSE Linux Enterprise Server 11 SP3 (ia64) [New Version: 3.16.5]: libfreebl3-x86-3.16.5-0.7.1 libsoftokn3-x86-3.16.5-0.7.1 mozilla-nss-x86-3.16.5-0.7.1 - SUSE Linux Enterprise Desktop 11 SP3 (i586 x86_64) [New Version: 3.16.5]: libfreebl3-3.16.5-0.7.1 libsoftokn3-3.16.5-0.7.1 mozilla-nss-3.16.5-0.7.1 mozilla-nss-tools-3.16.5-0.7.1 - SUSE Linux Enterprise Desktop 11 SP3 (x86_64) [New Version: 3.16.5]: libfreebl3-32bit-3.16.5-0.7.1 libsoftokn3-32bit-3.16.5-0.7.1 mozilla-nss-32bit-3.16.5-0.7.1 References: http://support.novell.com/security/cve/CVE-2014-1568.html https://bugzilla.suse.com/897890 http://download.suse.com/patch/finder/?keywords=9099e9b629979a0004c403f74aa… -- To unsubscribe, e-mail: opensuse-security-announce+unsubscribe(a)opensuse.org For additional commands, e-mail: opensuse-security-announce+help(a)opensuse.org

1 0

[security-announce] SUSE-SU-2014:1218-1: important: Security update for spacewalk-java
by opensuse-security＠opensuse.org 25 Sep '14

25 Sep '14

SUSE Security Update: Security update for spacewalk-java ______________________________________________________________________________ Announcement ID: SUSE-SU-2014:1218-1 Rating: important References: #889721 #896012 Cross-References: CVE-2014-3595 Affected Products: SUSE Manager Server ______________________________________________________________________________ An update that solves one vulnerability and has one errata is now available. Description: The Spacewalk frontend displayed a logfile without escaping content, allowing remote attackers to inject cross site scripting (XSS) into the admin's session. (CVE-2014-3595) Additionally, the following bug was fixed: * Fixed package upgrade via SSM when using the Oracle DB as backend. (bnc#889721) Security Issues: * CVE-2014-3595 <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-3595> Patch Instructions: To install this SUSE Security Update use YaST online_update. Alternatively you can run the command listed for your product: - SUSE Manager Server: zypper in -t patch sleman21-spacewalk-java-9719 To bring your system up-to-date, use "zypper patch". Package List: - SUSE Manager Server (noarch): spacewalk-java-2.1.165.6-0.11.1 spacewalk-java-config-2.1.165.6-0.11.1 spacewalk-java-lib-2.1.165.6-0.11.1 spacewalk-java-oracle-2.1.165.6-0.11.1 spacewalk-java-postgresql-2.1.165.6-0.11.1 spacewalk-taskomatic-2.1.165.6-0.11.1 References: http://support.novell.com/security/cve/CVE-2014-3595.html https://bugzilla.suse.com/889721 https://bugzilla.suse.com/896012 http://download.suse.com/patch/finder/?keywords=a50d8ce1310e48a468cc85ce6ed… -- To unsubscribe, e-mail: opensuse-security-announce+unsubscribe(a)opensuse.org For additional commands, e-mail: opensuse-security-announce+help(a)opensuse.org

1 0

[security-announce] SUSE-SU-2014:1214-1: critical: Security update for bash
by opensuse-security＠opensuse.org 24 Sep '14

24 Sep '14

SUSE Security Update: Security update for bash ______________________________________________________________________________ Announcement ID: SUSE-SU-2014:1214-1 Rating: critical References: #688469 #770795 #896776 Cross-References: CVE-2012-3410 CVE-2014-0475 Affected Products: SUSE Linux Enterprise Server 10 SP3 LTSS ______________________________________________________________________________ An update that solves two vulnerabilities and has one errata is now available. Description: bash has been updated to fix a critical security issue. In some circumstances, the shell would evaluate shellcode in environment variables passed at startup time. This allowed code execution by local or remote attackers who could pass environment variables to bash scripts. (CVE-2014-6271) Additionally, the following bugs have been fixed: * Avoid possible buffer overflow when expanding the /dev/fd prefix with e.g. the test built-in. (CVE-2012-3410) * Enable workaround for changed behavior of sshd. (bnc#688469) Security Issues: * CVE-2014-6271 <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-6271> * CVE-2012-3410 <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2012-3410> Package List: - SUSE Linux Enterprise Server 10 SP3 LTSS (i586 s390x x86_64): bash-3.1-24.32.1 readline-5.1-24.32.1 readline-devel-5.1-24.32.1 - SUSE Linux Enterprise Server 10 SP3 LTSS (s390x x86_64): readline-32bit-5.1-24.32.1 readline-devel-32bit-5.1-24.32.1 References: http://support.novell.com/security/cve/CVE-2012-3410.html http://support.novell.com/security/cve/CVE-2014-0475.html https://bugzilla.suse.com/688469 https://bugzilla.suse.com/770795 https://bugzilla.suse.com/896776 http://download.suse.com/patch/finder/?keywords=fd9fa24daf4d325c609035f0c77… -- To unsubscribe, e-mail: opensuse-security-announce+unsubscribe(a)opensuse.org For additional commands, e-mail: opensuse-security-announce+help(a)opensuse.org

1 0