June 2015 - openSUSE Security Announce

[security-announce] openSUSE-SU-2015:1061-1: important: Security update for Adobe Flash Player
by opensuse-security＠opensuse.org 13 Jun '15

13 Jun '15

openSUSE Security Update: Security update for Adobe Flash Player ______________________________________________________________________________ Announcement ID: openSUSE-SU-2015:1061-1 Rating: important References: #934088 Cross-References: CVE-2015-3096 CVE-2015-3098 CVE-2015-3099 CVE-2015-3100 CVE-2015-3102 CVE-2015-3103 CVE-2015-3104 CVE-2015-3105 CVE-2015-3106 CVE-2015-3107 CVE-2015-3108 Affected Products: openSUSE Evergreen 11.4 ______________________________________________________________________________ An update that fixes 11 vulnerabilities is now available. Description: Adobe Flash Player was updated to 11.2.202.466 to fix multiple security issues. The following vulnerabilities were fixed: * CVE-2015-3096: bypass for CVE-2014-5333 * CVE-2015-3098: vulnerabilities that could be exploited to bypass the same-origin-policy and lead to information disclosure * CVE-2015-3099: vulnerabilities that could be exploited to bypass the same-origin-policy and lead to information disclosure * CVE-2015-3100: stack overflow vulnerability that could lead to code execution * CVE-2015-3102: vulnerabilities that could be exploited to bypass the same-origin-policy and lead to information disclosure * CVE-2015-3103: use-after-free vulnerabilities that could lead to code execution * CVE-2015-3104: integer overflow vulnerability that could lead to code execution * CVE-2015-3105: memory corruption vulnerability that could lead to code execution * CVE-2015-3106: use-after-free vulnerabilities that could lead to code execution * CVE-2015-3107: use-after-free vulnerabilities that could lead to code execution * CVE-2015-3108: memory leak vulnerability that could be used to bypass ASLR Patch Instructions: To install this openSUSE Security Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE Evergreen 11.4: zypper in -t patch 2015-17=1 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE Evergreen 11.4 (i586 x86_64): flash-player-11.2.202.466-164.1 flash-player-gnome-11.2.202.466-164.1 flash-player-kde4-11.2.202.466-164.1 References: https://www.suse.com/security/cve/CVE-2015-3096.html https://www.suse.com/security/cve/CVE-2015-3098.html https://www.suse.com/security/cve/CVE-2015-3099.html https://www.suse.com/security/cve/CVE-2015-3100.html https://www.suse.com/security/cve/CVE-2015-3102.html https://www.suse.com/security/cve/CVE-2015-3103.html https://www.suse.com/security/cve/CVE-2015-3104.html https://www.suse.com/security/cve/CVE-2015-3105.html https://www.suse.com/security/cve/CVE-2015-3106.html https://www.suse.com/security/cve/CVE-2015-3107.html https://www.suse.com/security/cve/CVE-2015-3108.html https://bugzilla.suse.com/934088 -- To unsubscribe, e-mail: opensuse-security-announce+unsubscribe(a)opensuse.org For additional commands, e-mail: opensuse-security-announce+help(a)opensuse.org

1 0

[security-announce] openSUSE-SU-2015:1056-1: critical: Security update for cups
by opensuse-security＠opensuse.org 12 Jun '15

12 Jun '15

openSUSE Security Update: Security update for cups ______________________________________________________________________________ Announcement ID: openSUSE-SU-2015:1056-1 Rating: critical References: #924208 Cross-References: CVE-2012-5519 CVE-2015-1158 CVE-2015-1159 Affected Products: openSUSE 13.2 openSUSE 13.1 ______________________________________________________________________________ An update that fixes three vulnerabilities is now available. Description: This update fixes the following issues: - CVE-2015-1158 and CVE-2015-1159 fixes a possible privilege escalation via cross-site scripting and bad print job submission used to replace cupsd.conf on server (CUPS STR#4609 CERT-VU-810572 CVE-2015-1158 CVE-2015-1159 bugzilla.suse.com bsc#924208). In general it is crucial to limit access to CUPS to trustworthy users who do not misuse their permission to submit print jobs which means to upload arbitrary data onto the CUPS server, see https://en.opensuse.org/SDB:CUPS_and_SANE_Firewall_settings and cf. the entries about CVE-2012-5519 below. Patch Instructions: To install this openSUSE Security Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE 13.2: zypper in -t patch openSUSE-2015-418=1 - openSUSE 13.1: zypper in -t patch openSUSE-2015-418=1 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE 13.2 (i586 x86_64): cups-1.5.4-21.9.1 cups-client-1.5.4-21.9.1 cups-client-debuginfo-1.5.4-21.9.1 cups-ddk-1.5.4-21.9.1 cups-ddk-debuginfo-1.5.4-21.9.1 cups-debuginfo-1.5.4-21.9.1 cups-debugsource-1.5.4-21.9.1 cups-devel-1.5.4-21.9.1 cups-libs-1.5.4-21.9.1 cups-libs-debuginfo-1.5.4-21.9.1 - openSUSE 13.2 (x86_64): cups-libs-32bit-1.5.4-21.9.1 cups-libs-debuginfo-32bit-1.5.4-21.9.1 - openSUSE 13.1 (i586 x86_64): cups-1.5.4-12.20.1 cups-client-1.5.4-12.20.1 cups-client-debuginfo-1.5.4-12.20.1 cups-ddk-1.5.4-12.20.1 cups-ddk-debuginfo-1.5.4-12.20.1 cups-debuginfo-1.5.4-12.20.1 cups-debugsource-1.5.4-12.20.1 cups-devel-1.5.4-12.20.1 cups-libs-1.5.4-12.20.1 cups-libs-debuginfo-1.5.4-12.20.1 - openSUSE 13.1 (x86_64): cups-libs-32bit-1.5.4-12.20.1 cups-libs-debuginfo-32bit-1.5.4-12.20.1 References: https://www.suse.com/security/cve/CVE-2012-5519.html https://www.suse.com/security/cve/CVE-2015-1158.html https://www.suse.com/security/cve/CVE-2015-1159.html https://bugzilla.suse.com/924208 -- To unsubscribe, e-mail: opensuse-security-announce+unsubscribe(a)opensuse.org For additional commands, e-mail: opensuse-security-announce+help(a)opensuse.org

1 0

[security-announce] openSUSE-SU-2015:1047-1: important: Security update for Adobe Flash Player
by opensuse-security＠opensuse.org 11 Jun '15

11 Jun '15

openSUSE Security Update: Security update for Adobe Flash Player ______________________________________________________________________________ Announcement ID: openSUSE-SU-2015:1047-1 Rating: important References: #934088 Cross-References: CVE-2015-3096 CVE-2015-3098 CVE-2015-3099 CVE-2015-3100 CVE-2015-3102 CVE-2015-3103 CVE-2015-3104 CVE-2015-3105 CVE-2015-3106 CVE-2015-3107 CVE-2015-3108 Affected Products: openSUSE 13.2:NonFree openSUSE 13.1:NonFree ______________________________________________________________________________ An update that fixes 11 vulnerabilities is now available. Description: Adobe Flash Player was updated to 11.2.202.466 to fix multiple security issues. The following vulnerabilities were fixed: * CVE-2015-3096: bypass for CVE-2014-5333 * CVE-2015-3098: vulnerabilities that could be exploited to bypass the same-origin-policy and lead to information disclosure * CVE-2015-3099: vulnerabilities that could be exploited to bypass the same-origin-policy and lead to information disclosure * CVE-2015-3100: stack overflow vulnerability that could lead to code execution * CVE-2015-3102: vulnerabilities that could be exploited to bypass the same-origin-policy and lead to information disclosure * CVE-2015-3103: use-after-free vulnerabilities that could lead to code execution * CVE-2015-3104: integer overflow vulnerability that could lead to code execution * CVE-2015-3105: memory corruption vulnerability that could lead to code execution * CVE-2015-3106: use-after-free vulnerabilities that could lead to code execution * CVE-2015-3107: use-after-free vulnerabilities that could lead to code execution * CVE-2015-3108: memory leak vulnerability that could be used to bypass ASLR Patch Instructions: To install this openSUSE Security Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE 13.2:NonFree: zypper in -t patch openSUSE-2015-412=1 - openSUSE 13.1:NonFree: zypper in -t patch openSUSE-2015-412=1 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE 13.2:NonFree (i586 x86_64): flash-player-11.2.202.466-2.55.1 flash-player-gnome-11.2.202.466-2.55.1 flash-player-kde4-11.2.202.466-2.55.1 - openSUSE 13.1:NonFree (i586 x86_64): flash-player-11.2.202.466-120.1 flash-player-gnome-11.2.202.466-120.1 flash-player-kde4-11.2.202.466-120.1 References: https://www.suse.com/security/cve/CVE-2015-3096.html https://www.suse.com/security/cve/CVE-2015-3098.html https://www.suse.com/security/cve/CVE-2015-3099.html https://www.suse.com/security/cve/CVE-2015-3100.html https://www.suse.com/security/cve/CVE-2015-3102.html https://www.suse.com/security/cve/CVE-2015-3103.html https://www.suse.com/security/cve/CVE-2015-3104.html https://www.suse.com/security/cve/CVE-2015-3105.html https://www.suse.com/security/cve/CVE-2015-3106.html https://www.suse.com/security/cve/CVE-2015-3107.html https://www.suse.com/security/cve/CVE-2015-3108.html https://bugzilla.suse.com/934088 -- To unsubscribe, e-mail: opensuse-security-announce+unsubscribe(a)opensuse.org For additional commands, e-mail: opensuse-security-announce+help(a)opensuse.org

1 0

[security-announce] SUSE-SU-2015:1044-2: critical: Security update for cups154
by opensuse-security＠opensuse.org 11 Jun '15

11 Jun '15

SUSE Security Update: Security update for cups154 ______________________________________________________________________________ Announcement ID: SUSE-SU-2015:1044-2 Rating: critical References: #924208 Cross-References: CVE-2012-5519 CVE-2015-1158 CVE-2015-1159 Affected Products: SUSE Linux Enterprise Module for Legacy Software 12 ______________________________________________________________________________ An update that fixes three vulnerabilities is now available. Description: The following issues are fixed by this update: * CVE-2012-5519: privilege escalation via cross-site scripting and bad print job submission used to replace cupsd.conf on server (bsc#924208). * CVE-2015-1158: Improper Update of Reference Count * CVE-2015-1159: Cross-Site Scripting Special Instructions and Notes: Please reboot the system after installing this update. Patch Instructions: To install this SUSE Security Update use YaST online_update. Alternatively you can run the command listed for your product: - SUSE Linux Enterprise Module for Legacy Software 12: zypper in -t patch SUSE-SLE-Module-Legacy-12-2015-265=1 To bring your system up-to-date, use "zypper patch". Package List: - SUSE Linux Enterprise Module for Legacy Software 12 (s390x): cups154-1.5.4-9.1 cups154-client-1.5.4-9.1 cups154-client-debuginfo-1.5.4-9.1 cups154-debuginfo-1.5.4-9.1 cups154-debugsource-1.5.4-9.1 cups154-filters-1.5.4-9.1 cups154-filters-debuginfo-1.5.4-9.1 cups154-libs-1.5.4-9.1 cups154-libs-debuginfo-1.5.4-9.1 References: https://www.suse.com/security/cve/CVE-2012-5519.html https://www.suse.com/security/cve/CVE-2015-1158.html https://www.suse.com/security/cve/CVE-2015-1159.html https://bugzilla.suse.com/924208 -- To unsubscribe, e-mail: opensuse-security-announce+unsubscribe(a)opensuse.org For additional commands, e-mail: opensuse-security-announce+help(a)opensuse.org

1 0

[security-announce] SUSE-SU-2015:1045-1: important: Security update for Xen
by opensuse-security＠opensuse.org 11 Jun '15

11 Jun '15

SUSE Security Update: Security update for Xen ______________________________________________________________________________ Announcement ID: SUSE-SU-2015:1045-1 Rating: important References: #931625 #931626 #931627 #931628 #932770 #932790 #932996 Cross-References: CVE-2015-3209 CVE-2015-4103 CVE-2015-4104 CVE-2015-4105 CVE-2015-4106 CVE-2015-4163 CVE-2015-4164 Affected Products: SUSE Linux Enterprise Software Development Kit 11 SP3 SUSE Linux Enterprise Server 11 SP3 SUSE Linux Enterprise Desktop 11 SP3 ______________________________________________________________________________ An update that fixes 7 vulnerabilities is now available. Description: Xen was updated to fix seven security vulnerabilities: * CVE-2015-4103: Potential unintended writes to host MSI message data field via qemu. (XSA-128, bnc#931625) * CVE-2015-4104: PCI MSI mask bits inadvertently exposed to guests. (XSA-129, bnc#931626) * CVE-2015-4105: Guest triggerable qemu MSI-X pass-through error messages. (XSA-130, bnc#931627) * CVE-2015-4106: Unmediated PCI register access in qemu. (XSA-131, bnc#931628) * CVE-2015-4163: GNTTABOP_swap_grant_ref operation misbehavior. (XSA-134, bnc#932790) * CVE-2015-3209: Heap overflow in qemu pcnet controller allowing guest to host escape. (XSA-135, bnc#932770) * CVE-2015-4164: DoS through iret hypercall handler. (XSA-136, bnc#932996) Security Issues: * CVE-2015-4103 <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2015-4103> * CVE-2015-4104 <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2015-4104> * CVE-2015-4105 <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2015-4105> * CVE-2015-4106 <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2015-4106> * CVE-2015-4163 <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2015-4163> * CVE-2015-4164 <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2015-4164> * CVE-2015-3209 <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2015-3209> Special Instructions and Notes: Please reboot the system after installing this update. Patch Instructions: To install this SUSE Security Update use YaST online_update. Alternatively you can run the command listed for your product: - SUSE Linux Enterprise Software Development Kit 11 SP3: zypper in -t patch sdksp3-xen-201506=10727 - SUSE Linux Enterprise Server 11 SP3: zypper in -t patch slessp3-xen-201506=10727 - SUSE Linux Enterprise Desktop 11 SP3: zypper in -t patch sledsp3-xen-201506=10727 To bring your system up-to-date, use "zypper patch". Package List: - SUSE Linux Enterprise Software Development Kit 11 SP3 (i586 x86_64): xen-devel-4.2.5_08-0.9.1 - SUSE Linux Enterprise Server 11 SP3 (i586 x86_64): xen-kmp-default-4.2.5_08_3.0.101_0.47.55-0.9.1 xen-libs-4.2.5_08-0.9.1 xen-tools-domU-4.2.5_08-0.9.1 - SUSE Linux Enterprise Server 11 SP3 (x86_64): xen-4.2.5_08-0.9.1 xen-doc-html-4.2.5_08-0.9.1 xen-doc-pdf-4.2.5_08-0.9.1 xen-libs-32bit-4.2.5_08-0.9.1 xen-tools-4.2.5_08-0.9.1 - SUSE Linux Enterprise Server 11 SP3 (i586): xen-kmp-pae-4.2.5_08_3.0.101_0.47.55-0.9.1 - SUSE Linux Enterprise Desktop 11 SP3 (i586 x86_64): xen-kmp-default-4.2.5_08_3.0.101_0.47.55-0.9.1 xen-libs-4.2.5_08-0.9.1 xen-tools-domU-4.2.5_08-0.9.1 - SUSE Linux Enterprise Desktop 11 SP3 (x86_64): xen-4.2.5_08-0.9.1 xen-doc-html-4.2.5_08-0.9.1 xen-doc-pdf-4.2.5_08-0.9.1 xen-libs-32bit-4.2.5_08-0.9.1 xen-tools-4.2.5_08-0.9.1 - SUSE Linux Enterprise Desktop 11 SP3 (i586): xen-kmp-pae-4.2.5_08_3.0.101_0.47.55-0.9.1 References: https://www.suse.com/security/cve/CVE-2015-3209.html https://www.suse.com/security/cve/CVE-2015-4103.html https://www.suse.com/security/cve/CVE-2015-4104.html https://www.suse.com/security/cve/CVE-2015-4105.html https://www.suse.com/security/cve/CVE-2015-4106.html https://www.suse.com/security/cve/CVE-2015-4163.html https://www.suse.com/security/cve/CVE-2015-4164.html https://bugzilla.suse.com/931625 https://bugzilla.suse.com/931626 https://bugzilla.suse.com/931627 https://bugzilla.suse.com/931628 https://bugzilla.suse.com/932770 https://bugzilla.suse.com/932790 https://bugzilla.suse.com/932996 https://download.suse.com/patch/finder/?keywords=3ae6793ddbacaa600cc65649e1… -- To unsubscribe, e-mail: opensuse-security-announce+unsubscribe(a)opensuse.org For additional commands, e-mail: opensuse-security-announce+help(a)opensuse.org

1 0

[security-announce] SUSE-SU-2015:1044-1: critical: Security update for cups154
by opensuse-security＠opensuse.org 11 Jun '15

11 Jun '15

SUSE Security Update: Security update for cups154 ______________________________________________________________________________ Announcement ID: SUSE-SU-2015:1044-1 Rating: critical References: #924208 Cross-References: CVE-2012-5519 CVE-2015-1158 CVE-2015-1159 Affected Products: SUSE Linux Enterprise Module for Legacy Software 12 ______________________________________________________________________________ An update that fixes three vulnerabilities is now available. Description: The following issues are fixed by this update: * CVE-2012-5519: privilege escalation via cross-site scripting and bad print job submission used to replace cupsd.conf on server (bsc#924208). * CVE-2015-1158: Improper Update of Reference Count * CVE-2015-1159: Cross-Site Scripting Patch Instructions: To install this SUSE Security Update use YaST online_update. Alternatively you can run the command listed for your product: - SUSE Linux Enterprise Module for Legacy Software 12: zypper in -t patch SUSE-SLE-Module-Legacy-12-2015-265=1 To bring your system up-to-date, use "zypper patch". Package List: - SUSE Linux Enterprise Module for Legacy Software 12 (ppc64le x86_64): cups154-1.5.4-9.1 cups154-client-1.5.4-9.1 cups154-client-debuginfo-1.5.4-9.1 cups154-debuginfo-1.5.4-9.1 cups154-debugsource-1.5.4-9.1 cups154-filters-1.5.4-9.1 cups154-filters-debuginfo-1.5.4-9.1 cups154-libs-1.5.4-9.1 cups154-libs-debuginfo-1.5.4-9.1 References: https://www.suse.com/security/cve/CVE-2012-5519.html https://www.suse.com/security/cve/CVE-2015-1158.html https://www.suse.com/security/cve/CVE-2015-1159.html https://bugzilla.suse.com/924208 -- To unsubscribe, e-mail: opensuse-security-announce+unsubscribe(a)opensuse.org For additional commands, e-mail: opensuse-security-announce+help(a)opensuse.org

1 0

[security-announce] SUSE-SU-2015:1043-1: important: Security update for flash-player
by opensuse-security＠opensuse.org 11 Jun '15

11 Jun '15

SUSE Security Update: Security update for flash-player ______________________________________________________________________________ Announcement ID: SUSE-SU-2015:1043-1 Rating: important References: #934088 Cross-References: CVE-2015-3096 CVE-2015-3098 CVE-2015-3099 CVE-2015-3100 CVE-2015-3102 CVE-2015-3103 CVE-2015-3104 CVE-2015-3105 CVE-2015-3106 CVE-2015-3107 CVE-2015-3108 Affected Products: SUSE Linux Enterprise Workstation Extension 12 SUSE Linux Enterprise Desktop 12 ______________________________________________________________________________ An update that fixes 11 vulnerabilities is now available. Description: The following issues are fixed by this updated: * CVE-2015-3096: These updates resolve a vulnerability that could be exploited to bypass the fix for CVE-2014-5333. * CVE-2015-3098, CVE-2015-3099, CVE-2015-3102:These updates resolve vulnerabilities that could be exploited to bypass the same-origin-policy and lead to information disclosure. * CVE-2015-3100: These updates resolve a stack overflow vulnerability that could lead to code execution. * CVE-2015-3103, CVE-2015-3106, CVE-2015-3107: These updates resolve use-after-free vulnerabilities that could lead to code execution. * CVE-2015-3104: These updates resolve an integer overflow vulnerability that could lead to code execution. * CVE-2015-3105: These updates resolve a memory corruption vulnerability that could lead to code execution. * CVE-2015-3108: These updates resolve a memory leak vulnerability that could be used to bypass ASLR (CVE-2015-3108). (bsc#934088) Patch Instructions: To install this SUSE Security Update use YaST online_update. Alternatively you can run the command listed for your product: - SUSE Linux Enterprise Workstation Extension 12: zypper in -t patch SUSE-SLE-WE-12-2015-263=1 - SUSE Linux Enterprise Desktop 12: zypper in -t patch SUSE-SLE-DESKTOP-12-2015-263=1 To bring your system up-to-date, use "zypper patch". Package List: - SUSE Linux Enterprise Workstation Extension 12 (i586 x86_64): flash-player-11.2.202.466-86.1 flash-player-gnome-11.2.202.466-86.1 - SUSE Linux Enterprise Desktop 12 (i586 x86_64): flash-player-11.2.202.466-86.1 flash-player-gnome-11.2.202.466-86.1 References: https://www.suse.com/security/cve/CVE-2015-3096.html https://www.suse.com/security/cve/CVE-2015-3098.html https://www.suse.com/security/cve/CVE-2015-3099.html https://www.suse.com/security/cve/CVE-2015-3100.html https://www.suse.com/security/cve/CVE-2015-3102.html https://www.suse.com/security/cve/CVE-2015-3103.html https://www.suse.com/security/cve/CVE-2015-3104.html https://www.suse.com/security/cve/CVE-2015-3105.html https://www.suse.com/security/cve/CVE-2015-3106.html https://www.suse.com/security/cve/CVE-2015-3107.html https://www.suse.com/security/cve/CVE-2015-3108.html https://bugzilla.suse.com/934088 -- To unsubscribe, e-mail: opensuse-security-announce+unsubscribe(a)opensuse.org For additional commands, e-mail: opensuse-security-announce+help(a)opensuse.org

1 0

[security-announce] SUSE-SU-2015:1042-1: important: Security update for xen
by opensuse-security＠opensuse.org 11 Jun '15

11 Jun '15

SUSE Security Update: Security update for xen ______________________________________________________________________________ Announcement ID: SUSE-SU-2015:1042-1 Rating: important References: #906689 #931625 #931626 #931627 #931628 #932770 #932790 #932996 Cross-References: CVE-2015-3209 CVE-2015-4103 CVE-2015-4104 CVE-2015-4105 CVE-2015-4106 CVE-2015-4163 CVE-2015-4164 Affected Products: SUSE Linux Enterprise Software Development Kit 12 SUSE Linux Enterprise Server 12 SUSE Linux Enterprise Desktop 12 ______________________________________________________________________________ An update that solves 7 vulnerabilities and has one errata is now available. Description: Xen was updated to fix seven security issues and one non-security bug. The following vulnerabilities were fixed: * CVE-2015-4103: Potential unintended writes to host MSI message data field via qemu (XSA-128) (bnc#931625) * CVE-2015-4104: PCI MSI mask bits inadvertently exposed to guests (XSA-129) (bnc#931626) * CVE-2015-4105: Guest triggerable qemu MSI-X pass-through error messages (XSA-130) (bnc#931627) * CVE-2015-4106: Unmediated PCI register access in qemu (XSA-131) (bnc#931628) * CVE-2015-4163: GNTTABOP_swap_grant_ref operation misbehavior (XSA-134) (bnc#932790) * CVE-2015-3209: heap overflow in qemu pcnet controller allowing guest to host escape (XSA-135) (bnc#932770) * CVE-2015-4164: DoS through iret hypercall handler (XSA-136) (bnc#932996) The following non-security bug was fixed: * bnc#906689: let systemd schedule xencommons after network-online.target and remote-fs.target so that xendomains has access to remote shares Patch Instructions: To install this SUSE Security Update use YaST online_update. Alternatively you can run the command listed for your product: - SUSE Linux Enterprise Software Development Kit 12: zypper in -t patch SUSE-SLE-SDK-12-2015-262=1 - SUSE Linux Enterprise Server 12: zypper in -t patch SUSE-SLE-SERVER-12-2015-262=1 - SUSE Linux Enterprise Desktop 12: zypper in -t patch SUSE-SLE-DESKTOP-12-2015-262=1 To bring your system up-to-date, use "zypper patch". Package List: - SUSE Linux Enterprise Software Development Kit 12 (x86_64): xen-debugsource-4.4.2_06-21.1 xen-devel-4.4.2_06-21.1 - SUSE Linux Enterprise Server 12 (x86_64): xen-4.4.2_06-21.1 xen-debugsource-4.4.2_06-21.1 xen-doc-html-4.4.2_06-21.1 xen-kmp-default-4.4.2_06_k3.12.39_47-21.1 xen-kmp-default-debuginfo-4.4.2_06_k3.12.39_47-21.1 xen-libs-32bit-4.4.2_06-21.1 xen-libs-4.4.2_06-21.1 xen-libs-debuginfo-32bit-4.4.2_06-21.1 xen-libs-debuginfo-4.4.2_06-21.1 xen-tools-4.4.2_06-21.1 xen-tools-debuginfo-4.4.2_06-21.1 xen-tools-domU-4.4.2_06-21.1 xen-tools-domU-debuginfo-4.4.2_06-21.1 - SUSE Linux Enterprise Desktop 12 (x86_64): xen-4.4.2_06-21.1 xen-debugsource-4.4.2_06-21.1 xen-kmp-default-4.4.2_06_k3.12.39_47-21.1 xen-kmp-default-debuginfo-4.4.2_06_k3.12.39_47-21.1 xen-libs-32bit-4.4.2_06-21.1 xen-libs-4.4.2_06-21.1 xen-libs-debuginfo-32bit-4.4.2_06-21.1 xen-libs-debuginfo-4.4.2_06-21.1 References: https://www.suse.com/security/cve/CVE-2015-3209.html https://www.suse.com/security/cve/CVE-2015-4103.html https://www.suse.com/security/cve/CVE-2015-4104.html https://www.suse.com/security/cve/CVE-2015-4105.html https://www.suse.com/security/cve/CVE-2015-4106.html https://www.suse.com/security/cve/CVE-2015-4163.html https://www.suse.com/security/cve/CVE-2015-4164.html https://bugzilla.suse.com/906689 https://bugzilla.suse.com/931625 https://bugzilla.suse.com/931626 https://bugzilla.suse.com/931627 https://bugzilla.suse.com/931628 https://bugzilla.suse.com/932770 https://bugzilla.suse.com/932790 https://bugzilla.suse.com/932996 -- To unsubscribe, e-mail: opensuse-security-announce+unsubscribe(a)opensuse.org For additional commands, e-mail: opensuse-security-announce+help(a)opensuse.org

1 0

[security-announce] SUSE-SU-2015:1041-1: critical: Security update for cups
by opensuse-security＠opensuse.org 11 Jun '15

11 Jun '15

SUSE Security Update: Security update for cups ______________________________________________________________________________ Announcement ID: SUSE-SU-2015:1041-1 Rating: critical References: #924208 Cross-References: CVE-2012-5519 CVE-2015-1158 CVE-2015-1159 Affected Products: SUSE Linux Enterprise Software Development Kit 12 SUSE Linux Enterprise Server 12 SUSE Linux Enterprise Desktop 12 ______________________________________________________________________________ An update that fixes three vulnerabilities is now available. Description: The following issues are fixed by this update: * CVE-2012-5519: privilege escalation via cross-site scripting and bad print job submission used to replace cupsd.conf on server (bsc#924208). * CVE-2015-1158: Improper Update of Reference Count * CVE-2015-1159: Cross-Site Scripting Patch Instructions: To install this SUSE Security Update use YaST online_update. Alternatively you can run the command listed for your product: - SUSE Linux Enterprise Software Development Kit 12: zypper in -t patch SUSE-SLE-SDK-12-2015-264=1 - SUSE Linux Enterprise Server 12: zypper in -t patch SUSE-SLE-SERVER-12-2015-264=1 - SUSE Linux Enterprise Desktop 12: zypper in -t patch SUSE-SLE-DESKTOP-12-2015-264=1 To bring your system up-to-date, use "zypper patch". Package List: - SUSE Linux Enterprise Software Development Kit 12 (ppc64le s390x x86_64): cups-debuginfo-1.7.5-9.1 cups-debugsource-1.7.5-9.1 cups-devel-1.7.5-9.1 - SUSE Linux Enterprise Server 12 (ppc64le s390x x86_64): cups-1.7.5-9.1 cups-client-1.7.5-9.1 cups-client-debuginfo-1.7.5-9.1 cups-debuginfo-1.7.5-9.1 cups-debugsource-1.7.5-9.1 cups-libs-1.7.5-9.1 cups-libs-debuginfo-1.7.5-9.1 - SUSE Linux Enterprise Server 12 (s390x x86_64): cups-libs-32bit-1.7.5-9.1 cups-libs-debuginfo-32bit-1.7.5-9.1 - SUSE Linux Enterprise Desktop 12 (x86_64): cups-1.7.5-9.1 cups-client-1.7.5-9.1 cups-client-debuginfo-1.7.5-9.1 cups-debuginfo-1.7.5-9.1 cups-debugsource-1.7.5-9.1 cups-libs-1.7.5-9.1 cups-libs-32bit-1.7.5-9.1 cups-libs-debuginfo-1.7.5-9.1 cups-libs-debuginfo-32bit-1.7.5-9.1 References: https://www.suse.com/security/cve/CVE-2012-5519.html https://www.suse.com/security/cve/CVE-2015-1158.html https://www.suse.com/security/cve/CVE-2015-1159.html https://bugzilla.suse.com/924208 -- To unsubscribe, e-mail: opensuse-security-announce+unsubscribe(a)opensuse.org For additional commands, e-mail: opensuse-security-announce+help(a)opensuse.org

1 0

[security-announce] SUSE-SU-2015:1011-1: critical: Security update for cups
by opensuse-security＠opensuse.org 08 Jun '15

08 Jun '15

SUSE Security Update: Security update for cups ______________________________________________________________________________ Announcement ID: SUSE-SU-2015:1011-1 Rating: critical References: #924208 Affected Products: SUSE Linux Enterprise Software Development Kit 11 SP3 SUSE Linux Enterprise Server 11 SP3 for VMware SUSE Linux Enterprise Server 11 SP3 SUSE Linux Enterprise Desktop 11 SP3 ______________________________________________________________________________ An update that contains security fixes can now be installed. Description: This update fixes a privilege escalation via cross-site scripting and bad print job submission used to replace cupsd.conf on the server. This combination of issues could lead to remote code execution. CERT-VU-810572 has been assigned to this issue. Indications: Everybody should update. Patch Instructions: To install this SUSE Security Update use YaST online_update. Alternatively you can run the command listed for your product: - SUSE Linux Enterprise Software Development Kit 11 SP3: zypper in -t patch sdksp3-cups=10707 - SUSE Linux Enterprise Server 11 SP3 for VMware: zypper in -t patch slessp3-cups=10707 - SUSE Linux Enterprise Server 11 SP3: zypper in -t patch slessp3-cups=10707 - SUSE Linux Enterprise Desktop 11 SP3: zypper in -t patch sledsp3-cups=10707 To bring your system up-to-date, use "zypper patch". Package List: - SUSE Linux Enterprise Software Development Kit 11 SP3 (i586 ia64 ppc64 s390x x86_64): cups-devel-1.3.9-8.46.56.1 - SUSE Linux Enterprise Server 11 SP3 for VMware (i586 x86_64): cups-1.3.9-8.46.56.1 cups-client-1.3.9-8.46.56.1 cups-libs-1.3.9-8.46.56.1 - SUSE Linux Enterprise Server 11 SP3 for VMware (x86_64): cups-libs-32bit-1.3.9-8.46.56.1 - SUSE Linux Enterprise Server 11 SP3 (i586 ia64 ppc64 s390x x86_64): cups-1.3.9-8.46.56.1 cups-client-1.3.9-8.46.56.1 cups-libs-1.3.9-8.46.56.1 - SUSE Linux Enterprise Server 11 SP3 (ppc64 s390x x86_64): cups-libs-32bit-1.3.9-8.46.56.1 - SUSE Linux Enterprise Server 11 SP3 (ia64): cups-libs-x86-1.3.9-8.46.56.1 - SUSE Linux Enterprise Desktop 11 SP3 (i586 x86_64): cups-1.3.9-8.46.56.1 cups-client-1.3.9-8.46.56.1 cups-libs-1.3.9-8.46.56.1 - SUSE Linux Enterprise Desktop 11 SP3 (x86_64): cups-libs-32bit-1.3.9-8.46.56.1 References: https://bugzilla.suse.com/924208 https://download.suse.com/patch/finder/?keywords=cfe8bb7d17a9116bd37d397cd4… -- To unsubscribe, e-mail: opensuse-security-announce+unsubscribe(a)opensuse.org For additional commands, e-mail: opensuse-security-announce+help(a)opensuse.org

1 0