March 2015 - openSUSE Security Announce

[security-announce] openSUSE-SU-2015:0567-1: important: update to Firefox 31.5.3
by opensuse-security＠opensuse.org 22 Mar '15

22 Mar '15

openSUSE Security Update: update to Firefox 31.5.3 ______________________________________________________________________________ Announcement ID: openSUSE-SU-2015:0567-1 Rating: important References: #917597 #923534 Cross-References: CVE-2015-0817 CVE-2015-0818 CVE-2015-0822 CVE-2015-0827 CVE-2015-0831 CVE-2015-0833 CVE-2015-0836 Affected Products: openSUSE Evergreen 11.4 ______________________________________________________________________________ An update that fixes 7 vulnerabilities is now available. Description: Update to Firefox 31.5.3 (bnc#923534) * MFSA 2015-28/CVE-2015-0818 (bmo#1144988) Privilege escalation through SVG navigation * MFSA 2015-29/CVE-2015-0817 (bmo#1145255) Code execution through incorrect JavaScript bounds checking elimination - update to Firefox 31.5.0esr (bnc#917597) * MFSA 2015-11/CVE-2015-0836 Miscellaneous memory safety hazards * MFSA 2015-12/CVE-2015-0833 (bmo#945192) Invoking Mozilla updater will load locally stored DLL files (Windows only) * MFSA 2015-16/CVE-2015-0831 (bmo#1130514) Use-after-free in IndexedDB * MFSA 2015-19/CVE-2015-0827 (bmo#1117304) Out-of-bounds read and write while rendering SVG content * MFSA 2015-24/CVE-2015-0822 (bmo#1110557) Reading of local files through manipulation of form autocomplete Patch Instructions: To install this openSUSE Security Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE Evergreen 11.4: zypper in -t patch 2015-11=1 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE Evergreen 11.4 (i586 x86_64): MozillaFirefox-31.5.3-137.1 MozillaFirefox-branding-upstream-31.5.3-137.1 MozillaFirefox-buildsymbols-31.5.3-137.1 MozillaFirefox-debuginfo-31.5.3-137.1 MozillaFirefox-debugsource-31.5.3-137.1 MozillaFirefox-devel-31.5.3-137.1 MozillaFirefox-translations-common-31.5.3-137.1 MozillaFirefox-translations-other-31.5.3-137.1 References: http://support.novell.com/security/cve/CVE-2015-0817.html http://support.novell.com/security/cve/CVE-2015-0818.html http://support.novell.com/security/cve/CVE-2015-0822.html http://support.novell.com/security/cve/CVE-2015-0827.html http://support.novell.com/security/cve/CVE-2015-0831.html http://support.novell.com/security/cve/CVE-2015-0833.html http://support.novell.com/security/cve/CVE-2015-0836.html https://bugzilla.suse.com/917597 https://bugzilla.suse.com/923534 -- To unsubscribe, e-mail: opensuse-security-announce+unsubscribe(a)opensuse.org For additional commands, e-mail: opensuse-security-announce+help(a)opensuse.org

1 0

[security-announce] openSUSE-SU-2015:0566-1: important: kernel update for Evergreen 11.4, includes leap second deadlock fix
by opensuse-security＠opensuse.org 21 Mar '15

21 Mar '15

openSUSE Security Update: kernel update for Evergreen 11.4, includes leap second deadlock fix ______________________________________________________________________________ Announcement ID: openSUSE-SU-2015:0566-1 Rating: important References: #771619 #778463 #833588 #835839 #847652 #853040 #864049 #865442 #867531 #867723 #870161 #875051 #876633 #880892 #883096 #883724 #883948 #887082 #892490 #892782 #895680 #896382 #896390 #896391 #896392 #897995 #898693 #899192 #901885 #902232 #902346 #902349 #902351 #902675 #903640 #904013 #904700 #905100 #905312 #905799 #906586 #907189 #907338 #907396 #907818 #909077 #909078 #910251 #912654 #912705 #915335 Cross-References: CVE-2012-4398 CVE-2013-2893 CVE-2013-2897 CVE-2013-2899 CVE-2013-2929 CVE-2013-7263 CVE-2014-0131 CVE-2014-0181 CVE-2014-2309 CVE-2014-3181 CVE-2014-3184 CVE-2014-3185 CVE-2014-3186 CVE-2014-3601 CVE-2014-3610 CVE-2014-3646 CVE-2014-3647 CVE-2014-3673 CVE-2014-3687 CVE-2014-3688 CVE-2014-3690 CVE-2014-4508 CVE-2014-4608 CVE-2014-4943 CVE-2014-5471 CVE-2014-5472 CVE-2014-7826 CVE-2014-7841 CVE-2014-7842 CVE-2014-8133 CVE-2014-8134 CVE-2014-8369 CVE-2014-8559 CVE-2014-8709 CVE-2014-9090 CVE-2014-9322 CVE-2014-9584 CVE-2014-9585 Affected Products: openSUSE Evergreen 11.4 ______________________________________________________________________________ An update that solves 38 vulnerabilities and has 13 fixes is now available. Description: kernel update for Evergreen 11.4, includes leap second deadlock fix and fixes for other security and stability issues Patch Instructions: To install this openSUSE Security Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE Evergreen 11.4: zypper in -t patch 2015-10=1 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE Evergreen 11.4 (i586 x86_64): kernel-debug-3.0.101-99.1 kernel-debug-base-3.0.101-99.1 kernel-debug-base-debuginfo-3.0.101-99.1 kernel-debug-debuginfo-3.0.101-99.1 kernel-debug-debugsource-3.0.101-99.1 kernel-debug-devel-3.0.101-99.1 kernel-debug-devel-debuginfo-3.0.101-99.1 kernel-debug-hmac-3.0.101-99.1 kernel-default-3.0.101-99.1 kernel-default-base-3.0.101-99.1 kernel-default-base-debuginfo-3.0.101-99.1 kernel-default-debuginfo-3.0.101-99.1 kernel-default-debugsource-3.0.101-99.1 kernel-default-devel-3.0.101-99.1 kernel-default-devel-debuginfo-3.0.101-99.1 kernel-default-hmac-3.0.101-99.1 kernel-desktop-3.0.101-99.1 kernel-desktop-base-3.0.101-99.1 kernel-desktop-base-debuginfo-3.0.101-99.1 kernel-desktop-debuginfo-3.0.101-99.1 kernel-desktop-debugsource-3.0.101-99.1 kernel-desktop-devel-3.0.101-99.1 kernel-desktop-devel-debuginfo-3.0.101-99.1 kernel-desktop-hmac-3.0.101-99.1 kernel-ec2-3.0.101-99.1 kernel-ec2-base-3.0.101-99.1 kernel-ec2-base-debuginfo-3.0.101-99.1 kernel-ec2-debuginfo-3.0.101-99.1 kernel-ec2-debugsource-3.0.101-99.1 kernel-ec2-devel-3.0.101-99.1 kernel-ec2-devel-debuginfo-3.0.101-99.1 kernel-ec2-extra-3.0.101-99.1 kernel-ec2-extra-debuginfo-3.0.101-99.1 kernel-ec2-hmac-3.0.101-99.1 kernel-source-3.0.101-99.1 kernel-source-vanilla-3.0.101-99.1 kernel-syms-3.0.101-99.1 kernel-trace-3.0.101-99.1 kernel-trace-base-3.0.101-99.1 kernel-trace-base-debuginfo-3.0.101-99.1 kernel-trace-debuginfo-3.0.101-99.1 kernel-trace-debugsource-3.0.101-99.1 kernel-trace-devel-3.0.101-99.1 kernel-trace-devel-debuginfo-3.0.101-99.1 kernel-trace-hmac-3.0.101-99.1 kernel-vanilla-3.0.101-99.1 kernel-vanilla-base-3.0.101-99.1 kernel-vanilla-base-debuginfo-3.0.101-99.1 kernel-vanilla-debuginfo-3.0.101-99.1 kernel-vanilla-debugsource-3.0.101-99.1 kernel-vanilla-devel-3.0.101-99.1 kernel-vanilla-devel-debuginfo-3.0.101-99.1 kernel-vanilla-hmac-3.0.101-99.1 kernel-xen-3.0.101-99.1 kernel-xen-base-3.0.101-99.1 kernel-xen-base-debuginfo-3.0.101-99.1 kernel-xen-debuginfo-3.0.101-99.1 kernel-xen-debugsource-3.0.101-99.1 kernel-xen-devel-3.0.101-99.1 kernel-xen-devel-debuginfo-3.0.101-99.1 kernel-xen-hmac-3.0.101-99.1 preload-1.2-6.77.1 preload-debuginfo-1.2-6.77.1 preload-debugsource-1.2-6.77.1 preload-kmp-default-1.2_3.0.101_99-6.77.1 preload-kmp-default-debuginfo-1.2_3.0.101_99-6.77.1 preload-kmp-desktop-1.2_3.0.101_99-6.77.1 preload-kmp-desktop-debuginfo-1.2_3.0.101_99-6.77.1 - openSUSE Evergreen 11.4 (noarch): kernel-docs-3.0.101-99.2 - openSUSE Evergreen 11.4 (i586): kernel-pae-3.0.101-99.1 kernel-pae-base-3.0.101-99.1 kernel-pae-base-debuginfo-3.0.101-99.1 kernel-pae-debuginfo-3.0.101-99.1 kernel-pae-debugsource-3.0.101-99.1 kernel-pae-devel-3.0.101-99.1 kernel-pae-devel-debuginfo-3.0.101-99.1 kernel-pae-hmac-3.0.101-99.1 kernel-vmi-3.0.101-99.1 kernel-vmi-base-3.0.101-99.1 kernel-vmi-base-debuginfo-3.0.101-99.1 kernel-vmi-debuginfo-3.0.101-99.1 kernel-vmi-debugsource-3.0.101-99.1 kernel-vmi-devel-3.0.101-99.1 kernel-vmi-devel-debuginfo-3.0.101-99.1 kernel-vmi-hmac-3.0.101-99.1 References: http://support.novell.com/security/cve/CVE-2012-4398.html http://support.novell.com/security/cve/CVE-2013-2893.html http://support.novell.com/security/cve/CVE-2013-2897.html http://support.novell.com/security/cve/CVE-2013-2899.html http://support.novell.com/security/cve/CVE-2013-2929.html http://support.novell.com/security/cve/CVE-2013-7263.html http://support.novell.com/security/cve/CVE-2014-0131.html http://support.novell.com/security/cve/CVE-2014-0181.html http://support.novell.com/security/cve/CVE-2014-2309.html http://support.novell.com/security/cve/CVE-2014-3181.html http://support.novell.com/security/cve/CVE-2014-3184.html http://support.novell.com/security/cve/CVE-2014-3185.html http://support.novell.com/security/cve/CVE-2014-3186.html http://support.novell.com/security/cve/CVE-2014-3601.html http://support.novell.com/security/cve/CVE-2014-3610.html http://support.novell.com/security/cve/CVE-2014-3646.html http://support.novell.com/security/cve/CVE-2014-3647.html http://support.novell.com/security/cve/CVE-2014-3673.html http://support.novell.com/security/cve/CVE-2014-3687.html http://support.novell.com/security/cve/CVE-2014-3688.html http://support.novell.com/security/cve/CVE-2014-3690.html http://support.novell.com/security/cve/CVE-2014-4508.html http://support.novell.com/security/cve/CVE-2014-4608.html http://support.novell.com/security/cve/CVE-2014-4943.html http://support.novell.com/security/cve/CVE-2014-5471.html http://support.novell.com/security/cve/CVE-2014-5472.html http://support.novell.com/security/cve/CVE-2014-7826.html http://support.novell.com/security/cve/CVE-2014-7841.html http://support.novell.com/security/cve/CVE-2014-7842.html http://support.novell.com/security/cve/CVE-2014-8133.html http://support.novell.com/security/cve/CVE-2014-8134.html http://support.novell.com/security/cve/CVE-2014-8369.html http://support.novell.com/security/cve/CVE-2014-8559.html http://support.novell.com/security/cve/CVE-2014-8709.html http://support.novell.com/security/cve/CVE-2014-9090.html http://support.novell.com/security/cve/CVE-2014-9322.html http://support.novell.com/security/cve/CVE-2014-9584.html http://support.novell.com/security/cve/CVE-2014-9585.html https://bugzilla.suse.com/771619 https://bugzilla.suse.com/778463 https://bugzilla.suse.com/833588 https://bugzilla.suse.com/835839 https://bugzilla.suse.com/847652 https://bugzilla.suse.com/853040 https://bugzilla.suse.com/864049 https://bugzilla.suse.com/865442 https://bugzilla.suse.com/867531 https://bugzilla.suse.com/867723 https://bugzilla.suse.com/870161 https://bugzilla.suse.com/875051 https://bugzilla.suse.com/876633 https://bugzilla.suse.com/880892 https://bugzilla.suse.com/883096 https://bugzilla.suse.com/883724 https://bugzilla.suse.com/883948 https://bugzilla.suse.com/887082 https://bugzilla.suse.com/892490 https://bugzilla.suse.com/892782 https://bugzilla.suse.com/895680 https://bugzilla.suse.com/896382 https://bugzilla.suse.com/896390 https://bugzilla.suse.com/896391 https://bugzilla.suse.com/896392 https://bugzilla.suse.com/897995 https://bugzilla.suse.com/898693 https://bugzilla.suse.com/899192 https://bugzilla.suse.com/901885 https://bugzilla.suse.com/902232 https://bugzilla.suse.com/902346 https://bugzilla.suse.com/902349 https://bugzilla.suse.com/902351 https://bugzilla.suse.com/902675 https://bugzilla.suse.com/903640 https://bugzilla.suse.com/904013 https://bugzilla.suse.com/904700 https://bugzilla.suse.com/905100 https://bugzilla.suse.com/905312 https://bugzilla.suse.com/905799 https://bugzilla.suse.com/906586 https://bugzilla.suse.com/907189 https://bugzilla.suse.com/907338 https://bugzilla.suse.com/907396 https://bugzilla.suse.com/907818 https://bugzilla.suse.com/909077 https://bugzilla.suse.com/909078 https://bugzilla.suse.com/910251 https://bugzilla.suse.com/912654 https://bugzilla.suse.com/912705 https://bugzilla.suse.com/915335 -- To unsubscribe, e-mail: opensuse-security-announce+unsubscribe(a)opensuse.org For additional commands, e-mail: opensuse-security-announce+help(a)opensuse.org

1 0

[security-announce] SUSE-SU-2015:0553-2: important: Security update for compat-openssl098
by opensuse-security＠opensuse.org 20 Mar '15

20 Mar '15

SUSE Security Update: Security update for compat-openssl098 ______________________________________________________________________________ Announcement ID: SUSE-SU-2015:0553-2 Rating: important References: #915976 #919648 #920236 #922488 #922496 #922499 #922500 #922501 Cross-References: CVE-2009-5146 CVE-2015-0209 CVE-2015-0286 CVE-2015-0287 CVE-2015-0288 CVE-2015-0289 CVE-2015-0292 CVE-2015-0293 Affected Products: SUSE Linux Enterprise Desktop 12 ______________________________________________________________________________ An update that fixes 8 vulnerabilities is now available. Description: OpenSSL was updated to fix various security issues. Following security issues were fixed: - CVE-2015-0209: A Use After Free following d2i_ECPrivatekey error was fixed which could lead to crashes for attacker supplied Elliptic Curve keys. This could be exploited over SSL connections with client supplied keys. - CVE-2015-0286: A segmentation fault in ASN1_TYPE_cmp was fixed that could be exploited by attackers when e.g. client authentication is used. This could be exploited over SSL connections. - CVE-2015-0287: A ASN.1 structure reuse memory corruption was fixed. This problem can not be exploited over regular SSL connections, only if specific client programs use specific ASN.1 routines. - CVE-2015-0288: A X509_to_X509_REQ NULL pointer dereference was fixed, which could lead to crashes. This function is not commonly used, and not reachable over SSL methods. - CVE-2015-0289: Several PKCS7 NULL pointer dereferences were fixed, which could lead to crashes of programs using the PKCS7 APIs. The SSL apis do not use those by default. - CVE-2015-0292: Various issues in base64 decoding were fixed, which could lead to crashes with memory corruption, for instance by using attacker supplied PEM data. - CVE-2015-0293: Denial of service via reachable assert in SSLv2 servers, could be used by remote attackers to terminate the server process. Note that this requires SSLv2 being allowed, which is not the default. - CVE-2009-5146: A memory leak in the TLS hostname extension was fixed, which could be used by remote attackers to run SSL services out of memory. Patch Instructions: To install this SUSE Security Update use YaST online_update. Alternatively you can run the command listed for your product: - SUSE Linux Enterprise Desktop 12: zypper in -t patch SUSE-SLE-DESKTOP-12-2015-135=1 To bring your system up-to-date, use "zypper patch". Package List: - SUSE Linux Enterprise Desktop 12 (x86_64): compat-openssl098-debugsource-0.9.8j-73.2 libopenssl0_9_8-0.9.8j-73.2 libopenssl0_9_8-32bit-0.9.8j-73.2 libopenssl0_9_8-debuginfo-0.9.8j-73.2 libopenssl0_9_8-debuginfo-32bit-0.9.8j-73.2 References: http://support.novell.com/security/cve/CVE-2009-5146.html http://support.novell.com/security/cve/CVE-2015-0209.html http://support.novell.com/security/cve/CVE-2015-0286.html http://support.novell.com/security/cve/CVE-2015-0287.html http://support.novell.com/security/cve/CVE-2015-0288.html http://support.novell.com/security/cve/CVE-2015-0289.html http://support.novell.com/security/cve/CVE-2015-0292.html http://support.novell.com/security/cve/CVE-2015-0293.html https://bugzilla.suse.com/915976 https://bugzilla.suse.com/919648 https://bugzilla.suse.com/920236 https://bugzilla.suse.com/922488 https://bugzilla.suse.com/922496 https://bugzilla.suse.com/922499 https://bugzilla.suse.com/922500 https://bugzilla.suse.com/922501 -- To unsubscribe, e-mail: opensuse-security-announce+unsubscribe(a)opensuse.org For additional commands, e-mail: opensuse-security-announce+help(a)opensuse.org

1 0

[security-announce] SUSE-SU-2015:0553-1: important: Security update for compat-openssl098
by opensuse-security＠opensuse.org 20 Mar '15

20 Mar '15

SUSE Security Update: Security update for compat-openssl098 ______________________________________________________________________________ Announcement ID: SUSE-SU-2015:0553-1 Rating: important References: #915976 #919648 #920236 #922488 #922496 #922499 #922500 #922501 Cross-References: CVE-2009-5146 CVE-2015-0209 CVE-2015-0286 CVE-2015-0287 CVE-2015-0288 CVE-2015-0289 CVE-2015-0292 CVE-2015-0293 Affected Products: SUSE Linux Enterprise Module for Legacy Software 12 ______________________________________________________________________________ An update that fixes 8 vulnerabilities is now available. Description: OpenSSL was updated to fix various security issues. Following security issues were fixed: - CVE-2015-0209: A Use After Free following d2i_ECPrivatekey error was fixed which could lead to crashes for attacker supplied Elliptic Curve keys. This could be exploited over SSL connections with client supplied keys. - CVE-2015-0286: A segmentation fault in ASN1_TYPE_cmp was fixed that could be exploited by attackers when e.g. client authentication is used. This could be exploited over SSL connections. - CVE-2015-0287: A ASN.1 structure reuse memory corruption was fixed. This problem can not be exploited over regular SSL connections, only if specific client programs use specific ASN.1 routines. - CVE-2015-0288: A X509_to_X509_REQ NULL pointer dereference was fixed, which could lead to crashes. This function is not commonly used, and not reachable over SSL methods. - CVE-2015-0289: Several PKCS7 NULL pointer dereferences were fixed, which could lead to crashes of programs using the PKCS7 APIs. The SSL apis do not use those by default. - CVE-2015-0292: Various issues in base64 decoding were fixed, which could lead to crashes with memory corruption, for instance by using attacker supplied PEM data. - CVE-2015-0293: Denial of service via reachable assert in SSLv2 servers, could be used by remote attackers to terminate the server process. Note that this requires SSLv2 being allowed, which is not the default. - CVE-2009-5146: A memory leak in the TLS hostname extension was fixed, which could be used by remote attackers to run SSL services out of memory. Patch Instructions: To install this SUSE Security Update use YaST online_update. Alternatively you can run the command listed for your product: - SUSE Linux Enterprise Module for Legacy Software 12: zypper in -t patch SUSE-SLE-Module-Legacy-12-2015-135=1 To bring your system up-to-date, use "zypper patch". Package List: - SUSE Linux Enterprise Module for Legacy Software 12 (s390x x86_64): compat-openssl098-debugsource-0.9.8j-73.2 libopenssl0_9_8-0.9.8j-73.2 libopenssl0_9_8-32bit-0.9.8j-73.2 libopenssl0_9_8-debuginfo-0.9.8j-73.2 libopenssl0_9_8-debuginfo-32bit-0.9.8j-73.2 References: http://support.novell.com/security/cve/CVE-2009-5146.html http://support.novell.com/security/cve/CVE-2015-0209.html http://support.novell.com/security/cve/CVE-2015-0286.html http://support.novell.com/security/cve/CVE-2015-0287.html http://support.novell.com/security/cve/CVE-2015-0288.html http://support.novell.com/security/cve/CVE-2015-0289.html http://support.novell.com/security/cve/CVE-2015-0292.html http://support.novell.com/security/cve/CVE-2015-0293.html https://bugzilla.suse.com/915976 https://bugzilla.suse.com/919648 https://bugzilla.suse.com/920236 https://bugzilla.suse.com/922488 https://bugzilla.suse.com/922496 https://bugzilla.suse.com/922499 https://bugzilla.suse.com/922500 https://bugzilla.suse.com/922501 -- To unsubscribe, e-mail: opensuse-security-announce+unsubscribe(a)opensuse.org For additional commands, e-mail: opensuse-security-announce+help(a)opensuse.org

1 0

[security-announce] SUSE-SU-2015:0541-1: important: Security update for openssl
by opensuse-security＠opensuse.org 19 Mar '15

19 Mar '15

SUSE Security Update: Security update for openssl ______________________________________________________________________________ Announcement ID: SUSE-SU-2015:0541-1 Rating: important References: #919648 #920236 #922488 #922496 #922499 #922500 Cross-References: CVE-2015-0209 CVE-2015-0286 CVE-2015-0287 CVE-2015-0288 CVE-2015-0289 CVE-2015-0293 Affected Products: SUSE Linux Enterprise Software Development Kit 12 SUSE Linux Enterprise Server 12 SUSE Linux Enterprise Desktop 12 ______________________________________________________________________________ An update that fixes 6 vulnerabilities is now available. Description: OpenSSL was updated to fix various security issues. Following security issues were fixed: - CVE-2015-0209: A Use After Free following d2i_ECPrivatekey error was fixed which could lead to crashes for attacker supplied Elliptic Curve keys. This could be exploited over SSL connections with client supplied keys. - CVE-2015-0286: A segmentation fault in ASN1_TYPE_cmp was fixed that could be exploited by attackers when e.g. client authentication is used. This could be exploited over SSL connections. - CVE-2015-0287: A ASN.1 structure reuse memory corruption was fixed. This problem can not be exploited over regular SSL connections, only if specific client programs use specific ASN.1 routines. - CVE-2015-0288: A X509_to_X509_REQ NULL pointer dereference was fixed, which could lead to crashes. This function is not commonly used, and not reachable over SSL methods. - CVE-2015-0289: Several PKCS7 NULL pointer dereferences were fixed, which could lead to crashes of programs using the PKCS7 APIs. The SSL apis do not use those by default. - CVE-2015-0293: Denial of service via reachable assert in SSLv2 servers, could be used by remote attackers to terminate the server process. Note that this requires SSLv2 being allowed, which is not the default. Patch Instructions: To install this SUSE Security Update use YaST online_update. Alternatively you can run the command listed for your product: - SUSE Linux Enterprise Software Development Kit 12: zypper in -t patch SUSE-SLE-SDK-12-2015-133=1 - SUSE Linux Enterprise Server 12: zypper in -t patch SUSE-SLE-SERVER-12-2015-133=1 - SUSE Linux Enterprise Desktop 12: zypper in -t patch SUSE-SLE-DESKTOP-12-2015-133=1 To bring your system up-to-date, use "zypper patch". Package List: - SUSE Linux Enterprise Software Development Kit 12 (ppc64le s390x x86_64): libopenssl-devel-1.0.1i-20.1 openssl-debuginfo-1.0.1i-20.1 openssl-debugsource-1.0.1i-20.1 - SUSE Linux Enterprise Server 12 (ppc64le s390x x86_64): libopenssl1_0_0-1.0.1i-20.1 libopenssl1_0_0-debuginfo-1.0.1i-20.1 libopenssl1_0_0-hmac-1.0.1i-20.1 openssl-1.0.1i-20.1 openssl-debuginfo-1.0.1i-20.1 openssl-debugsource-1.0.1i-20.1 - SUSE Linux Enterprise Server 12 (s390x x86_64): libopenssl1_0_0-32bit-1.0.1i-20.1 libopenssl1_0_0-debuginfo-32bit-1.0.1i-20.1 libopenssl1_0_0-hmac-32bit-1.0.1i-20.1 - SUSE Linux Enterprise Server 12 (noarch): openssl-doc-1.0.1i-20.1 - SUSE Linux Enterprise Desktop 12 (x86_64): libopenssl1_0_0-1.0.1i-20.1 libopenssl1_0_0-32bit-1.0.1i-20.1 libopenssl1_0_0-debuginfo-1.0.1i-20.1 libopenssl1_0_0-debuginfo-32bit-1.0.1i-20.1 openssl-1.0.1i-20.1 openssl-debuginfo-1.0.1i-20.1 openssl-debugsource-1.0.1i-20.1 References: http://support.novell.com/security/cve/CVE-2015-0209.html http://support.novell.com/security/cve/CVE-2015-0286.html http://support.novell.com/security/cve/CVE-2015-0287.html http://support.novell.com/security/cve/CVE-2015-0288.html http://support.novell.com/security/cve/CVE-2015-0289.html http://support.novell.com/security/cve/CVE-2015-0293.html https://bugzilla.suse.com/919648 https://bugzilla.suse.com/920236 https://bugzilla.suse.com/922488 https://bugzilla.suse.com/922496 https://bugzilla.suse.com/922499 https://bugzilla.suse.com/922500 -- To unsubscribe, e-mail: opensuse-security-announce+unsubscribe(a)opensuse.org For additional commands, e-mail: opensuse-security-announce+help(a)opensuse.org

1 0

[security-announce] Today openssl security release
by Marcus Meissner 19 Mar '15

19 Mar '15

Hi folks, The OpenSSL team has just announced a new round of security releases. http://openssl.org/news/secadv_20150319.txt Foremost: Do Not Panic. While the advisory lists 12 fixes, only 2 of them are rated "High". The first fix rarted"High", CVE-2015-0291, affects only openssl 1.0.2, which we have not yet included in any of our codestreams or products, making us not affected. The second fix rated "High", CVE-2015-0204, is a changed rating for an already fixed security vulnerability. We have released fixes for this in January 2015: https://www.suse.com/security/cve/CVE-2015-0204.html All other new issues disclosed today are rated "Moderate" and "Low" by the OpenSSL team. We are currently releasing the first updates and wrapping up QA on the the others, so you will get fixed packages today (in some hours) or tomorrow. Ciao, Marcus

1 0

[security-announce] SUSE-SU-2015:0529-1: important: Security update for the Linux Kernel
by opensuse-security＠opensuse.org 18 Mar '15

18 Mar '15

SUSE Security Update: Security update for the Linux Kernel ______________________________________________________________________________ Announcement ID: SUSE-SU-2015:0529-1 Rating: important References: #799216 #800255 #860346 #875220 #877456 #884407 #895805 #896484 #897736 #898687 #900270 #902286 #902346 #902349 #903640 #904177 #904883 #904899 #904901 #905100 #905304 #905329 #905482 #905783 #906196 #907069 #908069 #908322 #908825 #908904 #909829 #910322 #911326 #912202 #912654 #912705 #913059 #914112 #914126 #914254 #914291 #914294 #914300 #914457 #914464 #914726 #915188 #915322 #915335 #915425 #915454 #915456 #915550 #915660 #916107 #916513 #916646 #917089 #917128 #918161 #918255 Cross-References: CVE-2014-3673 CVE-2014-3687 CVE-2014-7822 CVE-2014-7841 CVE-2014-8160 CVE-2014-8559 CVE-2014-9419 CVE-2014-9584 Affected Products: SUSE Linux Enterprise Workstation Extension 12 SUSE Linux Enterprise Software Development Kit 12 SUSE Linux Enterprise Server 12 SUSE Linux Enterprise Module for Public Cloud 12 SUSE Linux Enterprise Live Patching 12 SUSE Linux Enterprise Desktop 12 ______________________________________________________________________________ An update that solves 8 vulnerabilities and has 53 fixes is now available. Description: The SUSE Linux Enterprise 12 kernel was updated to 3.12.38 to receive various security and bugfixes. This update contains the following feature enablements: - The remote block device (rbd) and ceph drivers have been enabled and are now supported. (FATE#318350) These can be used e.g. for accessing the SUSE Enterprise Storage product services. - Support for Intel Select Bay trail CPUs has been added. (FATE#316038) Following security issues were fixed: - CVE-2014-9419: The __switch_to function in arch/x86/kernel/process_64.c in the Linux kernel through 3.18.1 did not ensure that Thread Local Storage (TLS) descriptors were loaded before proceeding with other steps, which made it easier for local users to bypass the ASLR protection mechanism via a crafted application that reads a TLS base address (bnc#911326). - CVE-2014-7822: A flaw was found in the way the Linux kernels splice() system call validated its parameters. On certain file systems, a local, unprivileged user could have used this flaw to write past the maximum file size, and thus crash the system. - CVE-2014-8160: The connection tracking module could be bypassed if a specific protocol module was not loaded, e.g. allowing SCTP traffic while the firewall should have filtered it. - CVE-2014-9584: The parse_rock_ridge_inode_internal function in fs/isofs/rock.c in the Linux kernel before 3.18.2 did not validate a length value in the Extensions Reference (ER) System Use Field, which allowed local users to obtain sensitive information from kernel memory via a crafted iso9660 image (bnc#912654). The following non-security bugs were fixed: - audit: Allow login in non-init namespaces (bnc#916107). - btrfs: avoid unnecessary switch of path locks to blocking mode. - btrfs: fix directory inconsistency after fsync log replay (bnc#915425). - btrfs: fix fsync log replay for inodes with a mix of regular refs and extrefs (bnc#915425). - btrfs: fix fsync race leading to ordered extent memory leaks (bnc#917128). - btrfs: fix fsync when extend references are added to an inode (bnc#915425). - btrfs: fix missing error handler if submiting re-read bio fails. - btrfs: fix race between transaction commit and empty block group removal (bnc#915550). - btrfs: fix scrub race leading to use-after-free (bnc#915456). - btrfs: fix setup_leaf_for_split() to avoid leaf corruption (bnc#915454). - btrfs: improve free space cache management and space allocation. - btrfs: make btrfs_search_forward return with nodes unlocked. - btrfs: scrub, fix sleep in atomic context (bnc#915456). - btrfs: unlock nodes earlier when inserting items in a btree. - drm/i915: On G45 enable cursor plane briefly after enabling the display plane (bnc#918161). - Fix Module.supported handling for external modules (bnc#905304). - keys: close race between key lookup and freeing (bnc#912202). - msi: also reject resource with flags all clear. - pci: Add ACS quirk for Emulex NICs (bug#917089). - pci: Add ACS quirk for Intel 10G NICs (bug#917089). - pci: Add ACS quirk for Solarflare SFC9120 & SFC9140 (bug#917089). - Refresh other Xen patches (bsc#909829). - Update patches.suse/btrfs-8177-improve-free-space-cache-management-and-space-.patc h (bnc#895805). - be2net: avoid flashing SH-B0 UFI image on SH-P2 chip (bug#908322). - be2net: refactor code that checks flash file compatibility (bug#908322). - ceph: Add necessary clean up if invalid reply received in handle_reply() (bsc#918255). - crush: CHOOSE_LEAF -> CHOOSELEAF throughout (bsc#918255). - crush: add SET_CHOOSE_TRIES rule step (bsc#918255). - crush: add note about r in recursive choose (bsc#918255). - crush: add set_choose_local_[fallback_]tries steps (bsc#918255). - crush: apply chooseleaf_tries to firstn mode too (bsc#918255). - crush: attempts -> tries (bsc#918255). - crush: clarify numrep vs endpos (bsc#918255). - crush: eliminate CRUSH_MAX_SET result size limitation (bsc#918255). - crush: factor out (trivial) crush_destroy_rule() (bsc#918255). - crush: fix crush_choose_firstn comment (bsc#918255). - crush: fix some comments (bsc#918255). - crush: generalize descend_once (bsc#918255). - crush: new SET_CHOOSE_LEAF_TRIES command (bsc#918255). - crush: pass parent r value for indep call (bsc#918255). - crush: pass weight vector size to map function (bsc#918255). - crush: reduce scope of some local variables (bsc#918255). - crush: return CRUSH_ITEM_UNDEF for failed placements with indep (bsc#918255). - crush: strip firstn conditionals out of crush_choose, rename (bsc#918255). - crush: use breadth-first search for indep mode (bsc#918255). - crypto: drbg - panic on continuous self test error (bsc#905482). - dasd: List corruption in error recovery (bnc#914291, LTC#120865). - epoll: optimize setting task running after blocking (epoll-performance). - fips: We need to activate gcm(aes) in FIPS mode, RFCs 4106 and 4543 (bsc#914126,bsc#914457). - fips: __driver-gcm-aes-aesni needs to be listed explicitly inside the testmgr.c file (bsc#914457). - flow_dissector: add tipc support (bnc#916513). - hotplug, powerpc, x86: Remove cpu_hotplug_driver_lock() (bsc#907069). - hyperv: Add support for vNIC hot removal. - kernel: incorrect clock_gettime result (bnc#914291, LTC#121184). - kvm: iommu: Add cond_resched to legacy device assignment code (bsc#898687). - libceph: CEPH_OSD_FLAG_* enum update (bsc#918255). - libceph: add ceph_kv{malloc,free}() and switch to them (bsc#918255). - libceph: add ceph_pg_pool_by_id() (bsc#918255). - libceph: all features fields must be u64 (bsc#918255). - libceph: dout() is missing a newline (bsc#918255). - libceph: factor out logic from ceph_osdc_start_request() (bsc#918255). - libceph: fix error handling in ceph_osdc_init() (bsc#918255). - libceph: follow redirect replies from osds (bsc#918255). - libceph: follow {read,write}_tier fields on osd request submission (bsc#918255). - libceph: introduce and start using oid abstraction (bsc#918255). - libceph: rename MAX_OBJ_NAME_SIZE to CEPH_MAX_OID_NAME_LEN (bsc#918255). - libceph: rename ceph_osd_request::r_{oloc,oid} to r_base_{oloc,oid} (bsc#918255). - libceph: replace ceph_calc_ceph_pg() with ceph_oloc_oid_to_pg() (bsc#918255). - libceph: start using oloc abstraction (bsc#918255). - libceph: take map_sem for read in handle_reply() (bsc#918255). - libceph: update ceph_features.h (bsc#918255). - libceph: use CEPH_MON_PORT when the specified port is 0 (bsc#918255). - locking/mutex: Explicitly mark task as running after wakeup (mutex scalability). - locking/osq: No need for load/acquire when acquire-polling (mutex scalability). - locking/rtmutex: Optimize setting task running after being blocked (mutex scalability). - mm/compaction: fix wrong order check in compact_finished() (VM Performance, bnc#904177). - mm/compaction: stop the isolation when we isolate enough freepage (VM Performance, bnc#904177). - mm: fix negative nr_isolated counts (VM Performance). - mutex-debug: Always clear owner field upon mutex_unlock() (mutex bugfix). - net: 8021q/bluetooth/bridge/can/ceph: Remove extern from function prototypes (bsc#918255). - net: allow macvlans to move to net namespace (bnc#915660). - net:socket: set msg_namelen to 0 if msg_name is passed as NULL in msghdr struct from userland (bnc#900270). - nfs_prime_dcache needs fh to be set (bnc#908069 bnc#896484). - ocfs2: remove filesize checks for sync I/O journal commit (bnc#800255). Update references. - powerpc/xmon: Fix another endiannes issue in RTAS call from xmon (bsc#915188). - pvscsi: support suspend/resume (bsc#902286). - random: account for entropy loss due to overwrites (bsc#904883,bsc#904901). - random: allow fractional bits to be tracked (bsc#904883,bsc#904901). - random: statically compute poolbitshift, poolbytes, poolbits (bsc#904883,bsc#904901). - rbd: add "^A" sysfs rbd device attribute (bsc#918255). - rbd: add support for single-major device number allocation scheme (bsc#918255). - rbd: enable extended devt in single-major mode (bsc#918255). - rbd: introduce rbd_dev_header_unwatch_sync() and switch to it (bsc#918255). - rbd: rbd_device::dev_id is an int, format it as such (bsc#918255). - rbd: refactor rbd_init() a bit (bsc#918255). - rbd: switch to ida for rbd id assignments (bsc#918255). - rbd: tear down watch request if rbd_dev_device_setup() fails (bsc#918255). - rbd: tweak "loaded" message and module description (bsc#918255). - rbd: wire up is_visible() sysfs callback for rbd bus (bsc#918255). - rpm/kernel-binary.spec.in: Own the modules directory in the devel package (bnc#910322) - s390/dasd: fix infinite loop during format (bnc#914291, LTC#120608). - s390/dasd: remove unused code (bnc#914291, LTC#120608). - sched/Documentation: Remove unneeded word (mutex scalability). - sched/completion: Add lock-free checking of the blocking case (scheduler scalability). - scsifront: avoid acquiring same lock twice if ring is full. - scsifront: do not use bitfields for indicators modified under different locks. - swiotlb: Warn on allocation failure in swiotlb_alloc_coherent (bsc#905783). - uas: Add NO_ATA_1X for VIA VL711 devices (bnc#914254). - uas: Add US_FL_NO_ATA_1X for 2 more Seagate disk enclosures (bnc#914254). - uas: Add US_FL_NO_ATA_1X for Seagate devices with usb-id 0bc2:a013 (bnc#914254). - uas: Add US_FL_NO_ATA_1X quirk for 1 more Seagate model (bnc#914254). - uas: Add US_FL_NO_ATA_1X quirk for 2 more Seagate models (bnc#914254). - uas: Add US_FL_NO_ATA_1X quirk for Seagate (0bc2:ab20) drives (bnc#914254). - uas: Add a quirk for rejecting ATA_12 and ATA_16 commands (bnc#914254). - uas: Add missing le16_to_cpu calls to asm1051 / asm1053 usb-id check (bnc#914294). - uas: Add no-report-opcodes quirk (bnc#914254). - uas: Disable uas on ASM1051 devices (bnc#914294). - uas: Do not blacklist ASM1153 disk enclosures (bnc#914294). - uas: Use streams on upcoming 10Gbps / 3.1 USB (bnc#914464). - uas: disable UAS on Apricorn SATA dongles (bnc#914300). - usb-storage: support for more than 8 LUNs (bsc#906196). - x86, crash: Allocate enough low-mem when crashkernel=high (bsc#905783). - x86, crash: Allocate enough low-mem when crashkernel=high (bsc#905783). - x86, swiotlb: Try coherent allocations with __GFP_NOWARN (bsc#905783). - x86/hpet: Make boot_hpet_disable extern (bnc#916646). - x86/intel: Add quirk to disable HPET for the Baytrail platform (bnc#916646). - x86: irq: Check for valid irq descriptor incheck_irq_vectors_for_cpu_disable (bnc#914726). - x86: irq: Check for valid irq descriptor in check_irq_vectors_for_cpu_disable (bnc#914726). - xhci: Add broken-streams quirk for Fresco Logic FL1000G xhci controllers (bnc#914112). - zcrypt: Number of supported ap domains is not retrievable (bnc#914291, LTC#120788). Patch Instructions: To install this SUSE Security Update use YaST online_update. Alternatively you can run the command listed for your product: - SUSE Linux Enterprise Workstation Extension 12: zypper in -t patch SUSE-SLE-WE-12-2015-130=1 - SUSE Linux Enterprise Software Development Kit 12: zypper in -t patch SUSE-SLE-SDK-12-2015-130=1 - SUSE Linux Enterprise Server 12: zypper in -t patch SUSE-SLE-SERVER-12-2015-130=1 - SUSE Linux Enterprise Module for Public Cloud 12: zypper in -t patch SUSE-SLE-Module-Public-Cloud-12-2015-130=1 - SUSE Linux Enterprise Live Patching 12: zypper in -t patch SUSE-SLE-Live-Patching-12-2015-130=1 - SUSE Linux Enterprise Desktop 12: zypper in -t patch SUSE-SLE-DESKTOP-12-2015-130=1 To bring your system up-to-date, use "zypper patch". Package List: - SUSE Linux Enterprise Workstation Extension 12 (x86_64): kernel-default-debuginfo-3.12.38-44.1 kernel-default-debugsource-3.12.38-44.1 kernel-default-extra-3.12.38-44.1 kernel-default-extra-debuginfo-3.12.38-44.1 - SUSE Linux Enterprise Software Development Kit 12 (ppc64le s390x x86_64): kernel-obs-build-3.12.38-44.1 kernel-obs-build-debugsource-3.12.38-44.1 - SUSE Linux Enterprise Software Development Kit 12 (noarch): kernel-docs-3.12.38-44.5 - SUSE Linux Enterprise Server 12 (ppc64le s390x x86_64): kernel-default-3.12.38-44.1 kernel-default-base-3.12.38-44.1 kernel-default-base-debuginfo-3.12.38-44.1 kernel-default-debuginfo-3.12.38-44.1 kernel-default-debugsource-3.12.38-44.1 kernel-default-devel-3.12.38-44.1 kernel-syms-3.12.38-44.1 - SUSE Linux Enterprise Server 12 (x86_64): kernel-xen-3.12.38-44.1 kernel-xen-base-3.12.38-44.1 kernel-xen-base-debuginfo-3.12.38-44.1 kernel-xen-debuginfo-3.12.38-44.1 kernel-xen-debugsource-3.12.38-44.1 kernel-xen-devel-3.12.38-44.1 - SUSE Linux Enterprise Server 12 (noarch): kernel-devel-3.12.38-44.1 kernel-macros-3.12.38-44.1 kernel-source-3.12.38-44.1 - SUSE Linux Enterprise Server 12 (s390x): kernel-default-man-3.12.38-44.1 - SUSE Linux Enterprise Module for Public Cloud 12 (x86_64): kernel-ec2-3.12.38-44.1 kernel-ec2-debuginfo-3.12.38-44.1 kernel-ec2-debugsource-3.12.38-44.1 kernel-ec2-devel-3.12.38-44.1 kernel-ec2-extra-3.12.38-44.1 kernel-ec2-extra-debuginfo-3.12.38-44.1 - SUSE Linux Enterprise Live Patching 12 (x86_64): kgraft-patch-3_12_38-44-default-1-2.2 kgraft-patch-3_12_38-44-xen-1-2.2 - SUSE Linux Enterprise Desktop 12 (x86_64): kernel-default-3.12.38-44.1 kernel-default-debuginfo-3.12.38-44.1 kernel-default-debugsource-3.12.38-44.1 kernel-default-devel-3.12.38-44.1 kernel-default-extra-3.12.38-44.1 kernel-default-extra-debuginfo-3.12.38-44.1 kernel-syms-3.12.38-44.1 kernel-xen-3.12.38-44.1 kernel-xen-debuginfo-3.12.38-44.1 kernel-xen-debugsource-3.12.38-44.1 kernel-xen-devel-3.12.38-44.1 - SUSE Linux Enterprise Desktop 12 (noarch): kernel-devel-3.12.38-44.1 kernel-macros-3.12.38-44.1 kernel-source-3.12.38-44.1 References: http://support.novell.com/security/cve/CVE-2014-3673.html http://support.novell.com/security/cve/CVE-2014-3687.html http://support.novell.com/security/cve/CVE-2014-7822.html http://support.novell.com/security/cve/CVE-2014-7841.html http://support.novell.com/security/cve/CVE-2014-8160.html http://support.novell.com/security/cve/CVE-2014-8559.html http://support.novell.com/security/cve/CVE-2014-9419.html http://support.novell.com/security/cve/CVE-2014-9584.html https://bugzilla.suse.com/799216 https://bugzilla.suse.com/800255 https://bugzilla.suse.com/860346 https://bugzilla.suse.com/875220 https://bugzilla.suse.com/877456 https://bugzilla.suse.com/884407 https://bugzilla.suse.com/895805 https://bugzilla.suse.com/896484 https://bugzilla.suse.com/897736 https://bugzilla.suse.com/898687 https://bugzilla.suse.com/900270 https://bugzilla.suse.com/902286 https://bugzilla.suse.com/902346 https://bugzilla.suse.com/902349 https://bugzilla.suse.com/903640 https://bugzilla.suse.com/904177 https://bugzilla.suse.com/904883 https://bugzilla.suse.com/904899 https://bugzilla.suse.com/904901 https://bugzilla.suse.com/905100 https://bugzilla.suse.com/905304 https://bugzilla.suse.com/905329 https://bugzilla.suse.com/905482 https://bugzilla.suse.com/905783 https://bugzilla.suse.com/906196 https://bugzilla.suse.com/907069 https://bugzilla.suse.com/908069 https://bugzilla.suse.com/908322 https://bugzilla.suse.com/908825 https://bugzilla.suse.com/908904 https://bugzilla.suse.com/909829 https://bugzilla.suse.com/910322 https://bugzilla.suse.com/911326 https://bugzilla.suse.com/912202 https://bugzilla.suse.com/912654 https://bugzilla.suse.com/912705 https://bugzilla.suse.com/913059 https://bugzilla.suse.com/914112 https://bugzilla.suse.com/914126 https://bugzilla.suse.com/914254 https://bugzilla.suse.com/914291 https://bugzilla.suse.com/914294 https://bugzilla.suse.com/914300 https://bugzilla.suse.com/914457 https://bugzilla.suse.com/914464 https://bugzilla.suse.com/914726 https://bugzilla.suse.com/915188 https://bugzilla.suse.com/915322 https://bugzilla.suse.com/915335 https://bugzilla.suse.com/915425 https://bugzilla.suse.com/915454 https://bugzilla.suse.com/915456 https://bugzilla.suse.com/915550 https://bugzilla.suse.com/915660 https://bugzilla.suse.com/916107 https://bugzilla.suse.com/916513 https://bugzilla.suse.com/916646 https://bugzilla.suse.com/917089 https://bugzilla.suse.com/917128 https://bugzilla.suse.com/918161 https://bugzilla.suse.com/918255 -- To unsubscribe, e-mail: opensuse-security-announce+unsubscribe(a)opensuse.org For additional commands, e-mail: opensuse-security-announce+help(a)opensuse.org

1 0

[security-announce] openSUSE-SU-2015:0505-1: important: Security update to Chromium 41.0.2272.76
by opensuse-security＠opensuse.org 16 Mar '15

16 Mar '15

openSUSE Security Update: Security update to Chromium 41.0.2272.76 ______________________________________________________________________________ Announcement ID: openSUSE-SU-2015:0505-1 Rating: important References: #920825 Cross-References: CVE-2015-1212 CVE-2015-1213 CVE-2015-1214 CVE-2015-1215 CVE-2015-1216 CVE-2015-1217 CVE-2015-1218 CVE-2015-1219 CVE-2015-1220 CVE-2015-1221 CVE-2015-1222 CVE-2015-1223 CVE-2015-1224 CVE-2015-1225 CVE-2015-1226 CVE-2015-1227 CVE-2015-1228 CVE-2015-1229 CVE-2015-1230 CVE-2015-1231 Affected Products: openSUSE 13.2 openSUSE 13.1 ______________________________________________________________________________ An update that fixes 20 vulnerabilities is now available. Description: Chromium was updated to 41.0.2272.76 (bnc#920825) Security fixes: * CVE-2015-1212: Out-of-bounds write in media * CVE-2015-1213: Out-of-bounds write in skia filters * CVE-2015-1214: Out-of-bounds write in skia filters * CVE-2015-1215: Out-of-bounds write in skia filters * CVE-2015-1216: Use-after-free in v8 bindings * CVE-2015-1217: Type confusion in v8 bindings * CVE-2015-1218: Use-after-free in dom * CVE-2015-1219: Integer overflow in webgl * CVE-2015-1220: Use-after-free in gif decoder * CVE-2015-1221: Use-after-free in web databases * CVE-2015-1222: Use-after-free in service workers * CVE-2015-1223: Use-after-free in dom * CVE-2015-1230: Type confusion in v8 * CVE-2015-1224: Out-of-bounds read in vpxdecoder * CVE-2015-1225: Out-of-bounds read in pdfium * CVE-2015-1226: Validation issue in debugger * CVE-2015-1227: Uninitialized value in blink * CVE-2015-1228: Uninitialized value in rendering * CVE-2015-1229: Cookie injection via proxies * CVE-2015-1231: Various fixes from internal audits * Multiple vulnerabilities in V8 fixed at the tip of the 4.1 branch Patch Instructions: To install this openSUSE Security Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE 13.2: zypper in -t patch openSUSE-2015-228=1 - openSUSE 13.1: zypper in -t patch openSUSE-2015-228=1 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE 13.2 (i586 x86_64): chromedriver-41.0.2272.76-17.1 chromedriver-debuginfo-41.0.2272.76-17.1 chromium-41.0.2272.76-17.1 chromium-debuginfo-41.0.2272.76-17.1 chromium-debugsource-41.0.2272.76-17.1 chromium-desktop-gnome-41.0.2272.76-17.1 chromium-desktop-kde-41.0.2272.76-17.1 chromium-ffmpegsumo-41.0.2272.76-17.1 chromium-ffmpegsumo-debuginfo-41.0.2272.76-17.1 - openSUSE 13.1 (i586 x86_64): chromedriver-41.0.2272.76-72.1 chromedriver-debuginfo-41.0.2272.76-72.1 chromium-41.0.2272.76-72.1 chromium-debuginfo-41.0.2272.76-72.1 chromium-debugsource-41.0.2272.76-72.1 chromium-desktop-gnome-41.0.2272.76-72.1 chromium-desktop-kde-41.0.2272.76-72.1 chromium-ffmpegsumo-41.0.2272.76-72.1 chromium-ffmpegsumo-debuginfo-41.0.2272.76-72.1 References: http://support.novell.com/security/cve/CVE-2015-1212.html http://support.novell.com/security/cve/CVE-2015-1213.html http://support.novell.com/security/cve/CVE-2015-1214.html http://support.novell.com/security/cve/CVE-2015-1215.html http://support.novell.com/security/cve/CVE-2015-1216.html http://support.novell.com/security/cve/CVE-2015-1217.html http://support.novell.com/security/cve/CVE-2015-1218.html http://support.novell.com/security/cve/CVE-2015-1219.html http://support.novell.com/security/cve/CVE-2015-1220.html http://support.novell.com/security/cve/CVE-2015-1221.html http://support.novell.com/security/cve/CVE-2015-1222.html http://support.novell.com/security/cve/CVE-2015-1223.html http://support.novell.com/security/cve/CVE-2015-1224.html http://support.novell.com/security/cve/CVE-2015-1225.html http://support.novell.com/security/cve/CVE-2015-1226.html http://support.novell.com/security/cve/CVE-2015-1227.html http://support.novell.com/security/cve/CVE-2015-1228.html http://support.novell.com/security/cve/CVE-2015-1229.html http://support.novell.com/security/cve/CVE-2015-1230.html http://support.novell.com/security/cve/CVE-2015-1231.html https://bugzilla.suse.com/920825 -- To unsubscribe, e-mail: opensuse-security-announce+unsubscribe(a)opensuse.org For additional commands, e-mail: opensuse-security-announce+help(a)opensuse.org

1 0

[security-announce] SUSE-SU-2015:0503-1: important: Security update for java-1_7_0-openjdk
by opensuse-security＠opensuse.org 16 Mar '15

16 Mar '15

SUSE Security Update: Security update for java-1_7_0-openjdk ______________________________________________________________________________ Announcement ID: SUSE-SU-2015:0503-1 Rating: important References: #901223 #914041 Cross-References: CVE-2014-3566 CVE-2014-6585 CVE-2014-6587 CVE-2014-6591 CVE-2014-6593 CVE-2014-6601 CVE-2015-0383 CVE-2015-0395 CVE-2015-0400 CVE-2015-0407 CVE-2015-0408 CVE-2015-0410 CVE-2015-0412 Affected Products: SUSE Linux Enterprise Server 12 SUSE Linux Enterprise Desktop 12 ______________________________________________________________________________ An update that fixes 13 vulnerabilities is now available. Description: This update fixes 13 security issues. These security issues were fixed: - CVE-2015-0395: Unspecified vulnerability in Oracle Java SE 5.0u75, 6u85, 7u72, and 8u25 allowed remote attackers to affect confidentiality, integrity, and availability via unknown vectors related to Hotspot (bnc#914041). - CVE-2015-0400: Unspecified vulnerability in Oracle Java SE 6u85, 7u72, and 8u25 allowed remote attackers to affect confidentiality via unknown vectors related to Libraries (bnc#914041). - CVE-2015-0383: Unspecified vulnerability in Oracle Java SE 5.0u75, 6u85, 7u72, and 8u25; Java SE Embedded 7u71 and 8u6; and JRockit R27.8.4 and R28.3.4 allowed local users to affect integrity and availability via unknown vectors related to Hotspot (bnc#914041). - CVE-2015-0412: Unspecified vulnerability in Oracle Java SE 6u85, 7u72, and 8u25 allowed remote attackers to affect confidentiality, integrity, and availability via vectors related to JAX-WS (bnc#914041). - CVE-2015-0407: Unspecified vulnerability in Oracle Java SE 5.0u75, 6u85, 7u72, and 8u25 allowed remote attackers to affect confidentiality via unknown vectors related to Swing (bnc#914041). - CVE-2015-0408: Unspecified vulnerability in Oracle Java SE 5.0u75, 6u85, 7u72, and 8u25 allowed remote attackers to affect confidentiality, integrity, and availability via vectors related to RMI (bnc#914041). - CVE-2014-6585: Unspecified vulnerability in Oracle Java SE 5.0u75, 6u85, 7u72, and 8u25 allowed remote attackers to affect confidentiality via unknown vectors reelated to 2D, a different vulnerability than CVE-2014-6591 (bnc#914041). - CVE-2014-6587: Unspecified vulnerability in Oracle Java SE 6u85, 7u72, and 8u25 allowed local users to affect confidentiality, integrity, and availability via unknown vectors related to Libraries (bnc#914041). - CVE-2014-6591: Unspecified vulnerability in the Java SE component in Oracle Java SE 5.0u75, 6u85, 7u72, and 8u25 allowed remote attackers to affect confidentiality via unknown vectors related to 2D, a different vulnerability than CVE-2014-6585 (bnc#914041). - CVE-2014-6593: Unspecified vulnerability in Oracle Java SE 5.0u75, 6u85, 7u72, and 8u25; Java SE Embedded 7u71 and 8u6; and JRockit 27.8.4 and 28.3.4 allowed remote attackers to affect confidentiality and integrity via vectors related to JSSE (bnc#914041). - CVE-2014-6601: Unspecified vulnerability in Oracle Java SE 6u85, 7u72, and 8u25 allowed remote attackers to affect confidentiality, integrity, and availability via unknown vectors related to Hotspot (bnc#914041). - CVE-2015-0410: Unspecified vulnerability in the Java SE, Java SE Embedded, JRockit component in Oracle Java SE 5.0u75, 6u85, 7u72, and 8u25; Java SE Embedded 7u71 and 8u6; and JRockit R27.8.4 and R28.3.4 allowed remote attackers to affect availability via unknown vectors related to Security (bnc#914041). - CVE-2014-3566: The SSL protocol 3.0, as used in OpenSSL through 1.0.1i and other products, used nondeterministic CBC padding, which made it easier for man-in-the-middle attackers to obtain cleartext data via a padding-oracle attack, aka the "POODLE" issue (bnc#901223). These non-security issues were fixed: - Update protocol support (S8046656). - Fewer escapes from escape analysis (S8047130). - Better GC validation (S8049253). - TLAB stability (S8055479). Patch Instructions: To install this SUSE Security Update use YaST online_update. Alternatively you can run the command listed for your product: - SUSE Linux Enterprise Server 12: zypper in -t patch SUSE-SLE-SERVER-12-2015-122=1 - SUSE Linux Enterprise Desktop 12: zypper in -t patch SUSE-SLE-DESKTOP-12-2015-122=1 To bring your system up-to-date, use "zypper patch". Package List: - SUSE Linux Enterprise Server 12 (ppc64le s390x x86_64): java-1_7_0-openjdk-1.7.0.75-11.3 java-1_7_0-openjdk-debuginfo-1.7.0.75-11.3 java-1_7_0-openjdk-debugsource-1.7.0.75-11.3 java-1_7_0-openjdk-demo-1.7.0.75-11.3 java-1_7_0-openjdk-demo-debuginfo-1.7.0.75-11.3 java-1_7_0-openjdk-devel-1.7.0.75-11.3 java-1_7_0-openjdk-devel-debuginfo-1.7.0.75-11.3 java-1_7_0-openjdk-headless-1.7.0.75-11.3 java-1_7_0-openjdk-headless-debuginfo-1.7.0.75-11.3 - SUSE Linux Enterprise Desktop 12 (x86_64): java-1_7_0-openjdk-1.7.0.75-11.3 java-1_7_0-openjdk-debuginfo-1.7.0.75-11.3 java-1_7_0-openjdk-debugsource-1.7.0.75-11.3 java-1_7_0-openjdk-headless-1.7.0.75-11.3 java-1_7_0-openjdk-headless-debuginfo-1.7.0.75-11.3 References: http://support.novell.com/security/cve/CVE-2014-3566.html http://support.novell.com/security/cve/CVE-2014-6585.html http://support.novell.com/security/cve/CVE-2014-6587.html http://support.novell.com/security/cve/CVE-2014-6591.html http://support.novell.com/security/cve/CVE-2014-6593.html http://support.novell.com/security/cve/CVE-2014-6601.html http://support.novell.com/security/cve/CVE-2015-0383.html http://support.novell.com/security/cve/CVE-2015-0395.html http://support.novell.com/security/cve/CVE-2015-0400.html http://support.novell.com/security/cve/CVE-2015-0407.html http://support.novell.com/security/cve/CVE-2015-0408.html http://support.novell.com/security/cve/CVE-2015-0410.html http://support.novell.com/security/cve/CVE-2015-0412.html https://bugzilla.suse.com/901223 https://bugzilla.suse.com/914041 -- To unsubscribe, e-mail: opensuse-security-announce+unsubscribe(a)opensuse.org For additional commands, e-mail: opensuse-security-announce+help(a)opensuse.org

1 0

[security-announce] openSUSE-SU-2015:0496-1: important: flashplayer to version 11.2.202.451
by opensuse-security＠opensuse.org 14 Mar '15

14 Mar '15

openSUSE Security Update: flashplayer to version 11.2.202.451 ______________________________________________________________________________ Announcement ID: openSUSE-SU-2015:0496-1 Rating: important References: Cross-References: CVE-2015-0333 CVE-2015-0334 CVE-2015-0335 CVE-2015-0336 CVE-2015-0337 CVE-2015-0338 CVE-2015-0339 CVE-2015-0340 CVE-2015-0341 CVE-2015-0342 CVE-2016-0332 Affected Products: openSUSE Evergreen 11.4 ______________________________________________________________________________ An update that fixes 11 vulnerabilities is now available. Description: Adobe Flash Player was updated to 11.2.202.451 (bsc#922033). These security issues were fixed: - Memory corruption vulnerabilities that could lead to code execution(CVE-2016-0332,CVE-2015-0333, CVE-2015-0335, CVE-2015-0339). - Type confusion vulnerabilities that could lead to code execution(CVE-2015-0334, CVE-2015-0336). - A vulnerability that could lead to a cross-domain policy bypass(CVE-2015-0337). - A vulnerability that could lead to a file upload restriction bypass(CVE-2015-0340). - An integer overflow vulnerability that could lead to code execution(CVE-2015-0338). - Use-after-free vulnerabilities that could lead to code execution(CVE-2015-0341, CVE-2015-0342). Patch Instructions: To install this openSUSE Security Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE Evergreen 11.4: zypper in -t patch 2015-8=1 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE Evergreen 11.4 (i586 x86_64): flash-player-11.2.202.451-151.1 flash-player-gnome-11.2.202.451-151.1 flash-player-kde4-11.2.202.451-151.1 References: http://support.novell.com/security/cve/CVE-2015-0333.html http://support.novell.com/security/cve/CVE-2015-0334.html http://support.novell.com/security/cve/CVE-2015-0335.html http://support.novell.com/security/cve/CVE-2015-0336.html http://support.novell.com/security/cve/CVE-2015-0337.html http://support.novell.com/security/cve/CVE-2015-0338.html http://support.novell.com/security/cve/CVE-2015-0339.html http://support.novell.com/security/cve/CVE-2015-0340.html http://support.novell.com/security/cve/CVE-2015-0341.html http://support.novell.com/security/cve/CVE-2015-0342.html http://support.novell.com/security/cve/CVE-2016-0332.html -- To unsubscribe, e-mail: opensuse-security-announce+unsubscribe(a)opensuse.org For additional commands, e-mail: opensuse-security-announce+help(a)opensuse.org

1 0