January 2015 - openSUSE Security Announce

[security-announce] SUSE-SU-2015:0180-1: important: Security update for Mozilla Firefox
by opensuse-security＠opensuse.org 31 Jan '15

31 Jan '15

SUSE Security Update: Security update for Mozilla Firefox ______________________________________________________________________________ Announcement ID: SUSE-SU-2015:0180-1 Rating: important References: #910647 #910669 #913064 #913066 #913067 #913068 #913102 #913103 #913104 Cross-References: CVE-2014-1569 CVE-2014-8634 CVE-2014-8636 CVE-2014-8637 CVE-2014-8638 CVE-2014-8639 CVE-2014-8640 CVE-2014-8641 Affected Products: SUSE Linux Enterprise Software Development Kit 11 SP3 SUSE Linux Enterprise Server 11 SP3 for VMware SUSE Linux Enterprise Server 11 SP3 SUSE Linux Enterprise Desktop 11 SP3 ______________________________________________________________________________ An update that solves 8 vulnerabilities and has one errata is now available. It includes two new package versions. Description: Mozilla Firefox has been updated to the 31.4.0ESR release, fixing bugs and security issues. Mozilla NSS has been updated to 3.17.3, fixing a security issue and updating the root certificate list. For more information, please see https://www.mozilla.org/en-US/security/advisories/ <https://www.mozilla.org/en-US/security/advisories/> Security Issues: * CVE-2014-1569 <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-1569> * CVE-2014-8634 <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-8634> * CVE-2014-8639 <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-8639> * CVE-2014-8641 <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-8641> * CVE-2014-8638 <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-8638> * CVE-2014-8636 <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-8636> * CVE-2014-8637 <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-8637> * CVE-2014-8640 <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-8640> Patch Instructions: To install this SUSE Security Update use YaST online_update. Alternatively you can run the command listed for your product: - SUSE Linux Enterprise Software Development Kit 11 SP3: zypper in -t patch sdksp3-firefox-201501-10225 - SUSE Linux Enterprise Server 11 SP3 for VMware: zypper in -t patch slessp3-firefox-201501-10225 - SUSE Linux Enterprise Server 11 SP3: zypper in -t patch slessp3-firefox-201501-10225 - SUSE Linux Enterprise Desktop 11 SP3: zypper in -t patch sledsp3-firefox-201501-10225 To bring your system up-to-date, use "zypper patch". Package List: - SUSE Linux Enterprise Software Development Kit 11 SP3 (i586 ia64 ppc64 s390x x86_64) [New Version: 3.17.3]: MozillaFirefox-devel-31.4.0esr-0.8.7 mozilla-nss-devel-3.17.3-0.8.11 - SUSE Linux Enterprise Server 11 SP3 for VMware (i586 x86_64) [New Version: 3.17.3 and 31.4.0esr]: MozillaFirefox-31.4.0esr-0.8.7 MozillaFirefox-translations-31.4.0esr-0.8.7 libfreebl3-3.17.3-0.8.11 libsoftokn3-3.17.3-0.8.11 mozilla-nss-3.17.3-0.8.11 mozilla-nss-tools-3.17.3-0.8.11 - SUSE Linux Enterprise Server 11 SP3 for VMware (x86_64) [New Version: 3.17.3]: libfreebl3-32bit-3.17.3-0.8.11 libsoftokn3-32bit-3.17.3-0.8.11 mozilla-nss-32bit-3.17.3-0.8.11 - SUSE Linux Enterprise Server 11 SP3 (i586 ia64 ppc64 s390x x86_64) [New Version: 3.17.3 and 31.4.0esr]: MozillaFirefox-31.4.0esr-0.8.7 MozillaFirefox-translations-31.4.0esr-0.8.7 libfreebl3-3.17.3-0.8.11 libsoftokn3-3.17.3-0.8.11 mozilla-nss-3.17.3-0.8.11 mozilla-nss-tools-3.17.3-0.8.11 - SUSE Linux Enterprise Server 11 SP3 (ppc64 s390x x86_64) [New Version: 3.17.3]: libfreebl3-32bit-3.17.3-0.8.11 libsoftokn3-32bit-3.17.3-0.8.11 mozilla-nss-32bit-3.17.3-0.8.11 - SUSE Linux Enterprise Server 11 SP3 (ia64) [New Version: 3.17.3]: libfreebl3-x86-3.17.3-0.8.11 libsoftokn3-x86-3.17.3-0.8.11 mozilla-nss-x86-3.17.3-0.8.11 - SUSE Linux Enterprise Desktop 11 SP3 (i586 x86_64) [New Version: 3.17.3 and 31.4.0esr]: MozillaFirefox-31.4.0esr-0.8.7 MozillaFirefox-translations-31.4.0esr-0.8.7 libfreebl3-3.17.3-0.8.11 libsoftokn3-3.17.3-0.8.11 mozilla-nss-3.17.3-0.8.11 mozilla-nss-tools-3.17.3-0.8.11 - SUSE Linux Enterprise Desktop 11 SP3 (x86_64) [New Version: 3.17.3]: libfreebl3-32bit-3.17.3-0.8.11 libsoftokn3-32bit-3.17.3-0.8.11 mozilla-nss-32bit-3.17.3-0.8.11 References: http://support.novell.com/security/cve/CVE-2014-1569.html http://support.novell.com/security/cve/CVE-2014-8634.html http://support.novell.com/security/cve/CVE-2014-8636.html http://support.novell.com/security/cve/CVE-2014-8637.html http://support.novell.com/security/cve/CVE-2014-8638.html http://support.novell.com/security/cve/CVE-2014-8639.html http://support.novell.com/security/cve/CVE-2014-8640.html http://support.novell.com/security/cve/CVE-2014-8641.html https://bugzilla.suse.com/show_bug.cgi?id=910647 https://bugzilla.suse.com/show_bug.cgi?id=910669 https://bugzilla.suse.com/show_bug.cgi?id=913064 https://bugzilla.suse.com/show_bug.cgi?id=913066 https://bugzilla.suse.com/show_bug.cgi?id=913067 https://bugzilla.suse.com/show_bug.cgi?id=913068 https://bugzilla.suse.com/show_bug.cgi?id=913102 https://bugzilla.suse.com/show_bug.cgi?id=913103 https://bugzilla.suse.com/show_bug.cgi?id=913104 http://download.suse.com/patch/finder/?keywords=fb2c01e4f4df7d6aef0a039442f… -- To unsubscribe, e-mail: opensuse-security-announce+unsubscribe(a)opensuse.org For additional commands, e-mail: opensuse-security-announce+help(a)opensuse.org

1 0

[security-announce] SUSE-SU-2015:0178-1: important: Security update for the Linux Kernel
by opensuse-security＠opensuse.org 30 Jan '15

30 Jan '15

SUSE Security Update: Security update for the Linux Kernel ______________________________________________________________________________ Announcement ID: SUSE-SU-2015:0178-1 Rating: important References: #800255 #809493 #829110 #856659 #862374 #873252 #875220 #884407 #887108 #887597 #889192 #891086 #891277 #893428 #895387 #895814 #902232 #902346 #902349 #903279 #903640 #904053 #904177 #904659 #904969 #905087 #905100 #906027 #906140 #906545 #907069 #907325 #907536 #907593 #907714 #907818 #907969 #907970 #907971 #907973 #908057 #908163 #908198 #908803 #908825 #908904 #909077 #909092 #909095 #909829 #910249 #910697 #911181 #911325 #912129 #912278 #912281 #912290 #912514 #912705 #912946 #913233 #913387 #913466 Cross-References: CVE-2014-3687 CVE-2014-3690 CVE-2014-8559 CVE-2014-9420 CVE-2014-9585 Affected Products: SUSE Linux Enterprise Workstation Extension 12 SUSE Linux Enterprise Software Development Kit 12 SUSE Linux Enterprise Server 12 SUSE Linux Enterprise Module for Public Cloud 12 SUSE Linux Enterprise Desktop 12 SUSE Linux Enterprise Build System Kit 12 ______________________________________________________________________________ An update that solves 5 vulnerabilities and has 59 fixes is now available. Description: The SUSE Linux Enterprise 12 kernel was updated to 3.12.36 to receive various security and bugfixes. Following security bugs were fixed: - CVE-2014-8559: The d_walk function in fs/dcache.c in the Linux kernel through 3.17.2 did not properly maintain the semantics of rename_lock, which allowed local users to cause a denial of service (deadlock and system hang) via a crafted application (bnc#903640). - CVE-2014-9420: The rock_continue function in fs/isofs/rock.c in the Linux kernel through 3.18.1 did not restrict the number of Rock Ridge continuation entries, which allowed local users to cause a denial of service (infinite loop, and system crash or hang) via a crafted iso9660 image (bnc#906545 911325). - CVE-2014-3690: arch/x86/kvm/vmx.c in the KVM subsystem in the Linux kernel before 3.17.2 on Intel processors did not ensure that the value in the CR4 control register remained the same after a VM entry, which allowed host OS users to kill arbitrary processes or cause a denial of service (system disruption) by leveraging /dev/kvm access, as demonstrated by PR_SET_TSC prctl calls within a modified copy of QEMU (bnc#902232). - CVE-2014-3687: The sctp_assoc_lookup_asconf_ack function in net/sctp/associola.c in the SCTP implementation in the Linux kernel through 3.17.2 allowed remote attackers to cause a denial of service (panic) via duplicate ASCONF chunks that triggered an incorrect uncork within the side-effect interpreter (bnc#902349). - CVE-2014-9585: The vdso_addr function in arch/x86/vdso/vma.c in the Linux kernel through 3.18.2 did not properly choose memory locations for the vDSO area, which made it easier for local users to bypass the ASLR protection mechanism by guessing a location at the end of a PMD (bnc#912705). The following non-security bugs were fixed: - ACPI idle: permit sparse C-state sub-state numbers (bnc#907969). - ALSA: hda - verify pin:converter connection on unsol event for HSW and VLV. - ALSA: hda - verify pin:cvt connection on preparing a stream for Intel HDMI codec. - ALSA: hda/hdmi - apply Valleyview fix-ups to Cherryview display codec. - ALSA: hda_intel: Add Device IDs for Intel Sunrise Point PCH. - ALSA: hda_intel: Add DeviceIDs for Sunrise Point-LP. - Btrfs: Disable patches.suse/Btrfs-fix-abnormal-long-waiting-in-fsync.patch (bnc#910697) because it needs to be revisited due partial msync behavior. - Btrfs: Fix misuse of chunk mutex (bnc#912514). - Btrfs: always clear a block group node when removing it from the tree (bnc#912514). - Btrfs: collect only the necessary ordered extents on ranged fsync (bnc#912946). - Btrfs: do not access non-existent key when csum tree is empty. - Btrfs: do not delay inode ref updates during log replay. - Btrfs: do not ignore log btree writeback errors (bnc#912946). - Btrfs: ensure btrfs_prev_leaf does not miss 1 item. - Btrfs: ensure deletion from pinned_chunks list is protected (bnc#908198). - Btrfs: ensure ordered extent errors are not missed on fsync (bnc#912946). - Btrfs: fix abnormal long waiting in fsync (VM/FS Micro-optimisations). - Btrfs: fix abnormal long waiting in fsync (bnc#912946). - Btrfs: fix crash caused by block group removal (bnc#912514). - Btrfs: fix freeing used extent after removing empty block group (bnc#912514). - Btrfs: fix freeing used extents after removing empty block group (bnc#912514). - Btrfs: fix fs corruption on transaction abort if device supports discard (bnc#908198). - Btrfs: fix fs mapping extent map leak (bnc#908198). - Btrfs: fix invalid block group rbtree access after bg is removed (bnc#912514). - Btrfs: fix memory leak after block remove + trimming (bnc#908198). - Btrfs: fix race between fs trimming and block group remove/allocation (bnc#908198). - Btrfs: fix race between writing free space cache and trimming (bnc#908198). - Btrfs: fix transaction leak during fsync call. - Btrfs: fix unprotected deletion from pending_chunks list (bnc#908198). - Btrfs: fix unprotected system chunk array insertion (bnc#912514). - Btrfs: free ulist in qgroup_shared_accounting() error path. - Btrfs: ioctl, do not re-lock extent range when not necessary. - Btrfs: make btrfs_abort_transaction consider existence of new block groups (bnc#908198). - Btrfs: make sure logged extents complete in the current transaction V3 (bnc#912946). - Btrfs: make sure we wait on logged extents when fsycning two subvols (bnc#912946). - Btrfs: make xattr replace operations atomic (bnc#913466). - Btrfs: remove empty block groups automatically (bnc#912514). - Btrfs: remove unused wait queue in struct extent_buffer. - Btrfs: replace EINVAL with ERANGE for resize when ULLONG_MAX. - Btrfs: use helpers for last_trans_log_full_commit instead of opencode (bnc#912946). - Drivers: hv: kvp,vss: Fast propagation of userspace communication failure. - Drivers: hv: util: Properly pack the data for file copy functionality. - Drivers: hv: util: make struct hv_do_fcopy match Hyper-V host messages. - Drivers: hv: vmbus: Fix a race condition when unregistering a device. - Drivers: hv: vss: Introduce timeout for communication with userspace. - Fixed warning on DP unplugging driver in intel_dp.c (bnc#907536). - Fixed warning on suspend in intel_display.c (bnc#907593). - KEYS: Fix stale key registration at error path (bnc#908163). - PCI/MSI: Add pci_enable_msi_range() and pci_enable_msix_range() (bug#912281). - PCI/MSI: Add pci_enable_msi_range() and pci_enable_msix_range() (bug#912281). - Refresh patches.xen/xen3-patch-3.9 (bsc#909829). - Remove filesize checks for sync I/O journal commit (bnc#800255). - SELinux: fix selinuxfs policy file on big endian systems (bsc#913233). - Tools: hv: vssdaemon: ignore the EBUSY on multiple freezing the same partition. - Tools: hv: vssdaemon: report freeze errors. - Tools: hv: vssdaemon: skip all filesystems mounted readonly. - Update Xen patches to 3.12.35. - Update s390x kabi files again (bnc#903279, LTC#118177) - benet: Use pci_enable_msix_range() instead of pci_enable_msix() (bug#912281). - bfa: check for terminated commands (bnc#906027). - cpuidle / menu: Return (-1) if there are no suitable states (cpuidle performance). - cpuidle / menu: move repeated correction factor check to init (cpuidle performance). - cpuidle: Do not substract exit latency from assumed sleep length (cpuidle performance). - cpuidle: Ensure menu coefficients stay within domain (cpuidle performance). - cpuidle: Move perf multiplier calculation out of the selection loop (cpuidle performance). - cpuidle: Use actual state latency in menu governor (cpuidle performance). - cpuidle: menu governor - remove unused macro STDDEV_THRESH (cpuidle performance). - cpuidle: menu: Call nr_iowait_cpu less times (cpuidle performance). - cpuidle: menu: Lookup CPU runqueues less (cpuidle performance). - cpuidle: menu: Use ktime_to_us instead of reinventing the wheel (cpuidle performance). - cpuidle: menu: Use shifts when calculating averages where possible (cpuidle performance). - cpuidle: rename expected_us to next_timer_us in menu governor (cpuidle performance). - crypto: aesni - Add support for 192 & 256 bit keys to AESNI RFC4106 (bsc#913387). - crypto: kernel oops at insmod of the z90crypt device driver (bnc#908057, LTC#119591). - cxgb4: Add the MC1 registers to read in the interrupt handler (bsc#912290). - cxgb4: Allow T4/T5 firmware sizes up to 1MB (bsc#912290). - cxgb4: Fix FW flash logic using ethtool (bsc#912290). - cxgb4: Fix T5 adapter accessing T4 adapter registers (bsc#912290). - cxgb4: Fix for handling 1Gb/s SFP+ Transceiver Modules (bsc#912290). - cxgb4: Fix race condition in cleanup (bsc#912290). - cxgb4: Free completed tx skbs promptly (bsc#912290). - cxgb4: Not need to hold the adap_rcu_lock lock when read adap_rcu_list (bsc#912290). - cxgb4: Use FW interface to get BAR0 value (bsc#912290). - drm/i915: Do a dummy DPCD read before the actual read (bnc#907714). - drm: add MIPI DSI encoder and connector types (bnc#907971). - ext4: cache extent hole in extent status tree for ext4_da_map_blocks() (bnc#893428). - ext4: change LRU to round-robin in extent status tree shrinker (bnc#893428). - ext4: cleanup flag definitions for extent status tree (bnc#893428). - ext4: fix block reservation for bigalloc filesystems (bnc#893428). - ext4: improve extents status tree trace point (bnc#893428). - ext4: introduce aging to extent status tree (bnc#893428). - ext4: limit number of scanned extents in status tree shrinker (bnc#893428). - ext4: move handling of list of shrinkable inodes into extent status code (bnc#893428). - ext4: track extent status tree shrinker delay statictics (bnc#893428). - fix kABI after "x86: use custom dma_get_required_mask()". - fsnotify: next_i is freed during fsnotify_unmount_inodes (bnc#908904). - hv: hv_balloon: avoid memory leak on alloc_error of 2MB memory block. - hyperv: Add processing of MTU reduced by the host. - hyperv: Fix some variable name typos in send-buffer init/revoke. - hyperv: Fix the total_data_buflen in send path. - intel_idle: Add CPU model 54 (Atom N2000 series) (bnc#907969). - intel_idle: allow sparse sub-state numbering, for Bay Trail (bnc#907969). - intel_idle: support Bay Trail (bnc#907969). - intel_pstate: Add setting voltage value for baytrail P states (bnc#907973). - intel_pstate: Add support for Baytrail turbo P states (bnc#907973). - intel_pstate: Fix BYT frequency reporting (bnc#907973). - intel_pstate: Fix setting VID (bnc#907973). - intel_pstate: Set turbo VID for BayTrail (bnc#907973). - intel_pstate: Use LFM bus ratio as min ratio/P state (bnc#907973). - iommu/vt-d: Fix an off-by-one bug in __domain_mapping() (bsc#908825). - ipc/sem.c: change memory barrier in sem_lock() to smp_rmb() (IPC scalability). - isofs: Fix unchecked printing of ER records. - kABI: fix for move of d_rcu (bnc#903640 CVE-2014-8559). - kABI: protect ipv6.h include in drivers/net. - kABI: protect rmap include in mm/truncate.c. - kABI: protect struct iwl_trans. - kABI: protect struct pci_dev. - kABI: protect struct user_namespace. - kABI: protect user_namespace.h include in kernel/groups.c. - kABI: reintroduce generic_write_sync. - kABI: uninline of_property_count_string* functions. Omitted ppc64le kabi fix for 3.12.33. - kernel: kprobes instruction corruption (bnc#908057, LTC#119330). - kernel: reduce function tracer overhead (bnc#903279, LTC#118177). - kgr: allow to search various types of struct kgr_patch_fun. - kgr: be consistent when applying patches on loaded modules. - kgr: fix replace_all. - kgr: fix typo in error message. - kgr: fix unwinder and user addresses (bnc#908803). - kgr: handle IRQ context using global variable. - kgr: mark even more kthreads (bnc#905087 bnc#906140). - kgr: prevent recursive loops of stubs in ftrace. - kgr: set revert slow state for all reverted symbols when loading patched module. - kgr: unregister only the used ftrace ops when removing a patched module. - kprobes: introduce weak arch_check_ftrace_location() helper function (bnc#903279, LTC#118177). - kvm: Do not expose MONITOR cpuid as available (bnc#887597) - lpfc: Fix race on command completion (bnc#906027). - macvlan: allow setting LRO independently of lower device (bnc#829110 bnc#891277 bnc#904053). - mm, cma: drain single zone pcplists (VM Performance, bnc#904177). - mm, compaction: always update cached scanner positions (VM Performance, bnc#904177). - mm, compaction: defer each zone individually instead of preferred zone (VM Performance, bnc#904177). - mm, compaction: defer only on COMPACT_COMPLETE (VM Performance, bnc#904177). - mm, compaction: do not count compact_stall if all zones skipped compaction (VM Performance, bnc#904177). - mm, compaction: do not recheck suitable_migration_target under lock (VM Performance, bnc#904177). - mm, compaction: khugepaged should not give up due to need_resched() (VM Performance, bnc#904177). - mm, compaction: more focused lru and pcplists draining (VM Performance, bnc#904177). - mm, compaction: move pageblock checks up from isolate_migratepages_range() (VM Performance, bnc#904177). - mm, compaction: pass classzone_idx and alloc_flags to watermark checking (VM Performance, bnc#904177). - mm, compaction: pass gfp mask to compact_control (VM Cleanup, bnc#904177). - mm, compaction: periodically drop lock and restore IRQs in scanners (VM Performance, bnc#904177). - mm, compaction: prevent infinite loop in compact_zone (VM Functionality, bnc#904177). - mm, compaction: reduce zone checking frequency in the migration scanner (VM Performance, bnc#904177). - mm, compaction: remember position within pageblock in free pages scanner (VM Performance, bnc#904177). - mm, compaction: simplify deferred compaction (VM Performance, bnc#904177). - mm, compaction: skip buddy pages by their order in the migrate scanner (VM Performance, bnc#904177). - mm, compaction: skip rechecks when lock was already held (VM Performance, bnc#904177). - mm, memory_hotplug/failure: drain single zone pcplists (VM Performance, bnc#904177). - mm, page_isolation: drain single zone pcplists (VM Performance, bnc#904177). - mm, thp: avoid excessive compaction latency during fault (VM Performance, bnc#904177). - mm, thp: restructure thp avoidance of light synchronous migration (VM Performance, bnc#904177). - mm/compaction.c: avoid premature range skip in isolate_migratepages_range (VM Functionality, bnc#904177). - mm/compaction: skip the range until proper target pageblock is met (VM Performance, bnc#904177). - mm/vmscan.c: use DIV_ROUND_UP for calculation of zones balance_gap and correct comments (VM Cleanup, bnc#904177). - mm/vmscan: do not check compaction_ready on promoted zones (VM Cleanup, bnc#904177). - mm/vmscan: restore sc->gfp_mask after promoting it to __GFP_HIGHMEM (VM Cleanup, bnc#904177). - mm: Disable patches.suse/msync-fix-incorrect-fstart-calculation.patch (bnc#910697) because it needs to be revisited due partial msync behavior. - mm: Disabled patches.suse/mm-msync.c-sync-only-the-requested-range-in-msync.patch (bnc#910697) because it needs to be revisited due partial msync behavior. - mm: improve documentation of page_order (VM Cleanup, bnc#904177). - mm: introduce single zone pcplists drain (VM Performance, bnc#904177). - mm: memcontrol: remove hierarchy restrictions for swappiness and oom_control (VM Cleanup, bnc#904177). - mm: page_alloc: determine migratetype only once (VM Performance, bnc#904177). - mm: rename allocflags_to_migratetype for clarity (VM Cleanup, bnc#904177). - mm: unmapped page migration avoid unmap+remap overhead (MM performance). - mm: vmscan: clean up struct scan_control (VM Cleanup, bnc#904177). - mm: vmscan: move call to shrink_slab() to shrink_zones() (VM Cleanup, bnc#904177). - mm: vmscan: move swappiness out of scan_control (VM Cleanup, bnc#904177). - mm: vmscan: remove all_unreclaimable() (VM Cleanup, bnc#904177). - mm: vmscan: remove remains of kswapd-managed zone->all_unreclaimable (VM Cleanup, bnc#904177). - mm: vmscan: remove shrink_control arg from do_try_to_free_pages() (VM Cleanup, bnc#904177). - mm: vmscan: rework compaction-ready signaling in direct reclaim (VM Cleanup, bnc#904177). - msync: fix incorrect fstart calculation (VM/FS Micro-optimisations). - net, sunrpc: suppress allocation warning in rpc_malloc() (bnc#904659). - net: Find the nesting level of a given device by type (bnc#829110 bnc#891277 bnc#904053). - net: Hyper-V: Deletion of an unnecessary check before the function call "vfree". - net: generic dev_disable_lro() stacked device handling (bnc#829110 bnc#891277 bnc#904053). - nvme: Add missing hunk from backport (bnc#873252). - parport: parport_pc, do not remove parent devices early (bnc#856659). - patches.suse/supported-flag: fix mis-reported supported status (bnc#809493). - patches.xen/xen-privcmd-hcall-preemption: Fix EFLAGS.IF check. - powerpc/fadump: Fix endianess issues in firmware assisted dump handling (bsc#889192). - powerpc/pseries/hvcserver: Fix endian issue in hvcs_get_partner_info (bsc#912129). - powerpc/pseries: Make CPU hotplug path endian safe (bsc#907069). - powerpc: fix dlpar memory - pseries: Fix endian issues in cpu hot-removal (bsc#907069). - pseries: Fix endian issues in onlining cpu threads (bsc#907069). - rpm/constraints.in: Require 10GB disk space on POWER A debuginfo build currently requires about 8.5 GB on POWER. Also, require at least 8 CPUs, so that builds do not get accidentally scheduled on slow machines. - rpm/gitlog-fixups: Fix invalid address in two commits - s390/ftrace,kprobes: allow to patch first instruction (bnc#903279, LTC#118177). - s390/ftrace: add HAVE_DYNAMIC_FTRACE_WITH_REGS support (bnc#903279, LTC#118177). - s390/ftrace: add code replacement sanity checks (bnc#903279, LTC#118177). - s390/ftrace: enforce DYNAMIC_FTRACE if FUNCTION_TRACER is selected (bnc#903279, LTC#118177). - s390/ftrace: optimize function graph caller code (bnc#903279, LTC#118177). - s390/ftrace: optimize mcount code (bnc#903279, LTC#118177). - s390/ftrace: remove 31 bit ftrace support (bnc#903279, LTC#118177). - s390/ftrace: remove check of obsolete variable function_trace_stop (bnc#903279, LTC#118177). - s390/ftrace: revert mcount_adjust change (bnc#903279, LTC#118177). - s390/ftrace: simplify enabling/disabling of ftrace_graph_caller (bnc#903279, LTC#118177). - s390: pass march flag to assembly files as well (bnc#903279, LTC#118177). - sched/fair: cleanup: Remove useless assignment in select_task_rq_fair() (cpuidle performance). - scripts/tags.sh: Do not specify kind-spec for emacs ctags/etags. - scripts/tags.sh: fix DEFINE_HASHTABLE in emacs case. - scripts/tags.sh: include compat_sys_* symbols in the generated tags. - scsi: call device handler for failed TUR command (bnc#895814). - series.conf: remove orphan bnc comments - storvsc: ring buffer failures may result in I/O freeze. - supported.conf: mark tcm_qla2xxx as supported Has not been ported from SLES11 SP3 automatically. - tags.sh: Fixup regex definition for etags. - tcm_loop: Wrong I_T nexus association (bnc#907325). - tools: hv: ignore ENOBUFS and ENOMEM in the KVP daemon. - tools: hv: introduce -n/--no-daemon option. - udf: Check component length before reading it. - udf: Check path length when reading symlink. - udf: Verify i_size when loading inode. - udf: Verify symlink size before loading it. - vmscan: memcg: always use swappiness of the reclaimed memcg (VM Cleanup, bnc#904177). - x86, cpu: Detect more TLB configuration (TLB Performance). - x86-64/MCE: flip CPU and bank numbers in log message. - x86/UV: Fix conditional in gru_exit() (bsc#909095). - x86/early quirk: use gen6 stolen detection for VLV (bnc#907970). - x86/efi: Do not export efi runtime map in case old map (bsc#904969). - x86/mm: Add tracepoints for TLB flushes (TLB Performance). - x86/mm: Rip out complicated, out-of-date, buggy TLB flushing (TLB Performance). - x86/uv: Update the UV3 TLB shootdown logic (bsc#909092). - x86: UV BAU: Avoid NULL pointer reference in ptc_seq_show (bsc#911181). - x86: UV BAU: Increase maximum CPUs per socket/hub (bsc#911181). - x86: fix step size adjustment during initial memory mapping (bsc#910249). - x86: use custom dma_get_required_mask(). - x86: use optimized ioresource lookup in ioremap function (Boot time optimisations (bnc#895387)). Patch Instructions: To install this SUSE Security Update use YaST online_update. Alternatively you can run the command listed for your product: - SUSE Linux Enterprise Workstation Extension 12: zypper in -t patch SUSE-SLE-WE-12-2015-48 - SUSE Linux Enterprise Software Development Kit 12: zypper in -t patch SUSE-SLE-SDK-12-2015-48 - SUSE Linux Enterprise Server 12: zypper in -t patch SUSE-SLE-SERVER-12-2015-48 - SUSE Linux Enterprise Module for Public Cloud 12: zypper in -t patch SUSE-SLE-Module-Public-Cloud-12-2015-48 - SUSE Linux Enterprise Desktop 12: zypper in -t patch SUSE-SLE-DESKTOP-12-2015-48 - SUSE Linux Enterprise Build System Kit 12: zypper in -t patch SUSE-SLE-BSK-12-2015-48 To bring your system up-to-date, use "zypper patch". Package List: - SUSE Linux Enterprise Workstation Extension 12 (x86_64): kernel-default-debuginfo-3.12.36-38.1 kernel-default-debugsource-3.12.36-38.1 kernel-default-extra-3.12.36-38.1 kernel-default-extra-debuginfo-3.12.36-38.1 - SUSE Linux Enterprise Software Development Kit 12 (ppc64le s390x x86_64): kernel-obs-build-3.12.36-38.2 kernel-obs-build-debugsource-3.12.36-38.2 - SUSE Linux Enterprise Software Development Kit 12 (noarch): kernel-docs-3.12.36-38.3 - SUSE Linux Enterprise Server 12 (ppc64le s390x x86_64): kernel-default-3.12.36-38.1 kernel-default-base-3.12.36-38.1 kernel-default-base-debuginfo-3.12.36-38.1 kernel-default-debuginfo-3.12.36-38.1 kernel-default-debugsource-3.12.36-38.1 kernel-default-devel-3.12.36-38.1 kernel-syms-3.12.36-38.1 - SUSE Linux Enterprise Server 12 (x86_64): kernel-xen-3.12.36-38.1 kernel-xen-base-3.12.36-38.1 kernel-xen-base-debuginfo-3.12.36-38.1 kernel-xen-debuginfo-3.12.36-38.1 kernel-xen-debugsource-3.12.36-38.1 kernel-xen-devel-3.12.36-38.1 - SUSE Linux Enterprise Server 12 (noarch): kernel-devel-3.12.36-38.1 kernel-macros-3.12.36-38.1 kernel-source-3.12.36-38.1 - SUSE Linux Enterprise Server 12 (s390x): kernel-default-man-3.12.36-38.1 - SUSE Linux Enterprise Module for Public Cloud 12 (x86_64): kernel-ec2-3.12.36-38.1 kernel-ec2-debuginfo-3.12.36-38.1 kernel-ec2-debugsource-3.12.36-38.1 kernel-ec2-devel-3.12.36-38.1 kernel-ec2-extra-3.12.36-38.1 kernel-ec2-extra-debuginfo-3.12.36-38.1 - SUSE Linux Enterprise Desktop 12 (x86_64): kernel-default-3.12.36-38.1 kernel-default-debuginfo-3.12.36-38.1 kernel-default-debugsource-3.12.36-38.1 kernel-default-devel-3.12.36-38.1 kernel-default-extra-3.12.36-38.1 kernel-default-extra-debuginfo-3.12.36-38.1 kernel-syms-3.12.36-38.1 kernel-xen-3.12.36-38.1 kernel-xen-debuginfo-3.12.36-38.1 kernel-xen-debugsource-3.12.36-38.1 kernel-xen-devel-3.12.36-38.1 - SUSE Linux Enterprise Desktop 12 (noarch): kernel-devel-3.12.36-38.1 kernel-macros-3.12.36-38.1 kernel-source-3.12.36-38.1 - SUSE Linux Enterprise Build System Kit 12 (s390x): kernel-zfcpdump-3.12.36-38.1 kernel-zfcpdump-debuginfo-3.12.36-38.1 kernel-zfcpdump-debugsource-3.12.36-38.1 References: http://support.novell.com/security/cve/CVE-2014-3687.html http://support.novell.com/security/cve/CVE-2014-3690.html http://support.novell.com/security/cve/CVE-2014-8559.html http://support.novell.com/security/cve/CVE-2014-9420.html http://support.novell.com/security/cve/CVE-2014-9585.html https://bugzilla.suse.com/show_bug.cgi?id=800255 https://bugzilla.suse.com/show_bug.cgi?id=809493 https://bugzilla.suse.com/show_bug.cgi?id=829110 https://bugzilla.suse.com/show_bug.cgi?id=856659 https://bugzilla.suse.com/show_bug.cgi?id=862374 https://bugzilla.suse.com/show_bug.cgi?id=873252 https://bugzilla.suse.com/show_bug.cgi?id=875220 https://bugzilla.suse.com/show_bug.cgi?id=884407 https://bugzilla.suse.com/show_bug.cgi?id=887108 https://bugzilla.suse.com/show_bug.cgi?id=887597 https://bugzilla.suse.com/show_bug.cgi?id=889192 https://bugzilla.suse.com/show_bug.cgi?id=891086 https://bugzilla.suse.com/show_bug.cgi?id=891277 https://bugzilla.suse.com/show_bug.cgi?id=893428 https://bugzilla.suse.com/show_bug.cgi?id=895387 https://bugzilla.suse.com/show_bug.cgi?id=895814 https://bugzilla.suse.com/show_bug.cgi?id=902232 https://bugzilla.suse.com/show_bug.cgi?id=902346 https://bugzilla.suse.com/show_bug.cgi?id=902349 https://bugzilla.suse.com/show_bug.cgi?id=903279 https://bugzilla.suse.com/show_bug.cgi?id=903640 https://bugzilla.suse.com/show_bug.cgi?id=904053 https://bugzilla.suse.com/show_bug.cgi?id=904177 https://bugzilla.suse.com/show_bug.cgi?id=904659 https://bugzilla.suse.com/show_bug.cgi?id=904969 https://bugzilla.suse.com/show_bug.cgi?id=905087 https://bugzilla.suse.com/show_bug.cgi?id=905100 https://bugzilla.suse.com/show_bug.cgi?id=906027 https://bugzilla.suse.com/show_bug.cgi?id=906140 https://bugzilla.suse.com/show_bug.cgi?id=906545 https://bugzilla.suse.com/show_bug.cgi?id=907069 https://bugzilla.suse.com/show_bug.cgi?id=907325 https://bugzilla.suse.com/show_bug.cgi?id=907536 https://bugzilla.suse.com/show_bug.cgi?id=907593 https://bugzilla.suse.com/show_bug.cgi?id=907714 https://bugzilla.suse.com/show_bug.cgi?id=907818 https://bugzilla.suse.com/show_bug.cgi?id=907969 https://bugzilla.suse.com/show_bug.cgi?id=907970 https://bugzilla.suse.com/show_bug.cgi?id=907971 https://bugzilla.suse.com/show_bug.cgi?id=907973 https://bugzilla.suse.com/show_bug.cgi?id=908057 https://bugzilla.suse.com/show_bug.cgi?id=908163 https://bugzilla.suse.com/show_bug.cgi?id=908198 https://bugzilla.suse.com/show_bug.cgi?id=908803 https://bugzilla.suse.com/show_bug.cgi?id=908825 https://bugzilla.suse.com/show_bug.cgi?id=908904 https://bugzilla.suse.com/show_bug.cgi?id=909077 https://bugzilla.suse.com/show_bug.cgi?id=909092 https://bugzilla.suse.com/show_bug.cgi?id=909095 https://bugzilla.suse.com/show_bug.cgi?id=909829 https://bugzilla.suse.com/show_bug.cgi?id=910249 https://bugzilla.suse.com/show_bug.cgi?id=910697 https://bugzilla.suse.com/show_bug.cgi?id=911181 https://bugzilla.suse.com/show_bug.cgi?id=911325 https://bugzilla.suse.com/show_bug.cgi?id=912129 https://bugzilla.suse.com/show_bug.cgi?id=912278 https://bugzilla.suse.com/show_bug.cgi?id=912281 https://bugzilla.suse.com/show_bug.cgi?id=912290 https://bugzilla.suse.com/show_bug.cgi?id=912514 https://bugzilla.suse.com/show_bug.cgi?id=912705 https://bugzilla.suse.com/show_bug.cgi?id=912946 https://bugzilla.suse.com/show_bug.cgi?id=913233 https://bugzilla.suse.com/show_bug.cgi?id=913387 https://bugzilla.suse.com/show_bug.cgi?id=913466 -- To unsubscribe, e-mail: opensuse-security-announce+unsubscribe(a)opensuse.org For additional commands, e-mail: opensuse-security-announce+help(a)opensuse.org

1 0

[security-announce] openSUSE-SU-2015:0174-1: critical: Security update for flash-player
by opensuse-security＠opensuse.org 29 Jan '15

29 Jan '15

openSUSE Security Update: Security update for flash-player ______________________________________________________________________________ Announcement ID: openSUSE-SU-2015:0174-1 Rating: critical References: #856386 #913057 #914333 #914463 Cross-References: CVE-2015-0301 CVE-2015-0302 CVE-2015-0303 CVE-2015-0304 CVE-2015-0305 CVE-2015-0306 CVE-2015-0307 CVE-2015-0308 CVE-2015-0309 CVE-2015-0310 CVE-2015-0311 Affected Products: openSUSE 12.3:NonFree ______________________________________________________________________________ An update that fixes 11 vulnerabilities is now available. Description: Adobe Flash Player was updated to 11.2.202.440 (bsc#914463): * APSA15-01, CVE-2015-0311 - Update of flashplayer (executable binary) for i386 is not available. This binary was disabled. - Security update to 11.2.202.438 (bsc#914333): * APSB15-02, CVE-2015-0310 - Security update to 11.2.202.429 (bsc#913057): * APSB15-01, CVE-2015-0301, CVE-2015-0302, CVE-2015-0303, CVE-2015-0304, CVE-2015-0305, CVE-2015-0306, CVE-2015-0307, CVE-2015-0308, CVE-2015-0309. - Disable flash player on machines without SSE2 (bnc#856386). - Remove outdated README and keep only up-to-date readme.txt. Patch Instructions: To install this openSUSE Security Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE 12.3:NonFree: zypper in -t patch openSUSE-2015-81 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE 12.3:NonFree (i586 x86_64): flash-player-11.2.202.440-2.115.1 flash-player-gnome-11.2.202.440-2.115.1 flash-player-kde4-11.2.202.440-2.115.1 References: http://support.novell.com/security/cve/CVE-2015-0301.html http://support.novell.com/security/cve/CVE-2015-0302.html http://support.novell.com/security/cve/CVE-2015-0303.html http://support.novell.com/security/cve/CVE-2015-0304.html http://support.novell.com/security/cve/CVE-2015-0305.html http://support.novell.com/security/cve/CVE-2015-0306.html http://support.novell.com/security/cve/CVE-2015-0307.html http://support.novell.com/security/cve/CVE-2015-0308.html http://support.novell.com/security/cve/CVE-2015-0309.html http://support.novell.com/security/cve/CVE-2015-0310.html http://support.novell.com/security/cve/CVE-2015-0311.html https://bugzilla.suse.com/show_bug.cgi?id=856386 https://bugzilla.suse.com/show_bug.cgi?id=913057 https://bugzilla.suse.com/show_bug.cgi?id=914333 https://bugzilla.suse.com/show_bug.cgi?id=914463 -- To unsubscribe, e-mail: opensuse-security-announce+unsubscribe(a)opensuse.org For additional commands, e-mail: opensuse-security-announce+help(a)opensuse.org

1 0

[security-announce] SUSE-SU-2015:0173-1: important: Security update for Mozilla Firefox
by opensuse-security＠opensuse.org 29 Jan '15

29 Jan '15

SUSE Security Update: Security update for Mozilla Firefox ______________________________________________________________________________ Announcement ID: SUSE-SU-2015:0173-1 Rating: important References: #906111 #909563 #910647 #910669 Cross-References: CVE-2014-1569 CVE-2014-8634 CVE-2014-8636 CVE-2014-8637 CVE-2014-8638 CVE-2014-8639 CVE-2014-8640 CVE-2014-8641 Affected Products: SUSE Linux Enterprise Server 11 SP2 LTSS SUSE Linux Enterprise Server 11 SP1 LTSS ______________________________________________________________________________ An update that fixes 8 vulnerabilities is now available. It includes two new package versions. Description: Mozilla Firefox has been updated to the 31.4.0ESR release, fixing bugs and security issues. Mozilla NSS has been updated to 3.17.3, fixing a security issue and updating the root certificates list. For more information, please refer to https://www.mozilla.org/en-US/security/advisories/ <https://www.mozilla.org/en-US/security/advisories/> . Security Issues: * CVE-2014-1569 <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-1569> * CVE-2014-8634 <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-8634> * CVE-2014-8639 <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-8639> * CVE-2014-8641 <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-8641> * CVE-2014-8638 <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-8638> * CVE-2014-8636 <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-8636> * CVE-2014-8637 <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-8637> * CVE-2014-8640 <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-8640> Patch Instructions: To install this SUSE Security Update use YaST online_update. Alternatively you can run the command listed for your product: - SUSE Linux Enterprise Server 11 SP2 LTSS: zypper in -t patch slessp2-firefox-201501-10167 - SUSE Linux Enterprise Server 11 SP1 LTSS: zypper in -t patch slessp1-firefox-201501-10168 To bring your system up-to-date, use "zypper patch". Package List: - SUSE Linux Enterprise Server 11 SP2 LTSS (i586 s390x x86_64) [New Version: 3.17.3 and 31.4.0esr]: MozillaFirefox-31.4.0esr-0.3.1 MozillaFirefox-translations-31.4.0esr-0.3.1 libfreebl3-3.17.3-0.3.1 mozilla-nss-3.17.3-0.3.1 mozilla-nss-devel-3.17.3-0.3.1 mozilla-nss-tools-3.17.3-0.3.1 - SUSE Linux Enterprise Server 11 SP2 LTSS (s390x x86_64) [New Version: 3.17.3]: libfreebl3-32bit-3.17.3-0.3.1 mozilla-nss-32bit-3.17.3-0.3.1 - SUSE Linux Enterprise Server 11 SP1 LTSS (i586 s390x x86_64) [New Version: 3.17.3 and 31.4.0esr]: MozillaFirefox-31.4.0esr-0.3.1 MozillaFirefox-translations-31.4.0esr-0.3.1 libfreebl3-3.17.3-0.3.1 mozilla-nss-3.17.3-0.3.1 mozilla-nss-tools-3.17.3-0.3.1 - SUSE Linux Enterprise Server 11 SP1 LTSS (s390x x86_64) [New Version: 3.17.3]: libfreebl3-32bit-3.17.3-0.3.1 mozilla-nss-32bit-3.17.3-0.3.1 References: http://support.novell.com/security/cve/CVE-2014-1569.html http://support.novell.com/security/cve/CVE-2014-8634.html http://support.novell.com/security/cve/CVE-2014-8636.html http://support.novell.com/security/cve/CVE-2014-8637.html http://support.novell.com/security/cve/CVE-2014-8638.html http://support.novell.com/security/cve/CVE-2014-8639.html http://support.novell.com/security/cve/CVE-2014-8640.html http://support.novell.com/security/cve/CVE-2014-8641.html https://bugzilla.suse.com/show_bug.cgi?id=906111 https://bugzilla.suse.com/show_bug.cgi?id=909563 https://bugzilla.suse.com/show_bug.cgi?id=910647 https://bugzilla.suse.com/show_bug.cgi?id=910669 http://download.suse.com/patch/finder/?keywords=962d0b7b7ca9d1110cf2d237780… http://download.suse.com/patch/finder/?keywords=f7933e6a871816421d62da11913… -- To unsubscribe, e-mail: opensuse-security-announce+unsubscribe(a)opensuse.org For additional commands, e-mail: opensuse-security-announce+help(a)opensuse.org

1 0

[security-announce] SUSE-SU-2015:0171-1: important: Security update for Mozilla Firefox
by opensuse-security＠opensuse.org 29 Jan '15

29 Jan '15

SUSE Security Update: Security update for Mozilla Firefox ______________________________________________________________________________ Announcement ID: SUSE-SU-2015:0171-1 Rating: important References: #909563 #910647 #910669 Cross-References: CVE-2014-1569 CVE-2014-8634 CVE-2014-8636 CVE-2014-8637 CVE-2014-8638 CVE-2014-8639 CVE-2014-8640 CVE-2014-8641 Affected Products: SUSE Linux Enterprise Server 10 SP4 LTSS ______________________________________________________________________________ An update that fixes 8 vulnerabilities is now available. It includes one version update. Description: Mozilla Firefox has been updated to the 31.4.0ESR release, fixing bugs and security issues. Mozilla NSS has been updated to 3.17.3, fixing a security issue and updating the root certificate list. For more information, please see https://www.mozilla.org/en-US/security/advisories/ <https://www.mozilla.org/en-US/security/advisories/> Security Issues: * CVE-2014-1569 <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-1569> * CVE-2014-8634 <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-8634> * CVE-2014-8639 <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-8639> * CVE-2014-8641 <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-8641> * CVE-2014-8638 <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-8638> * CVE-2014-8636 <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-8636> * CVE-2014-8637 <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-8637> * CVE-2014-8640 <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-8640> Package List: - SUSE Linux Enterprise Server 10 SP4 LTSS (i586 s390x x86_64) [New Version: 3.17.3]: mozilla-nss-3.17.3-0.5.1 mozilla-nss-devel-3.17.3-0.5.1 mozilla-nss-tools-3.17.3-0.5.1 - SUSE Linux Enterprise Server 10 SP4 LTSS (s390x x86_64) [New Version: 3.17.3]: mozilla-nss-32bit-3.17.3-0.5.1 - SUSE Linux Enterprise Server 10 SP4 LTSS (i586 s390x): MozillaFirefox-31.4.0esr-0.5.1 MozillaFirefox-translations-31.4.0esr-0.5.1 References: http://support.novell.com/security/cve/CVE-2014-1569.html http://support.novell.com/security/cve/CVE-2014-8634.html http://support.novell.com/security/cve/CVE-2014-8636.html http://support.novell.com/security/cve/CVE-2014-8637.html http://support.novell.com/security/cve/CVE-2014-8638.html http://support.novell.com/security/cve/CVE-2014-8639.html http://support.novell.com/security/cve/CVE-2014-8640.html http://support.novell.com/security/cve/CVE-2014-8641.html https://bugzilla.suse.com/show_bug.cgi?id=909563 https://bugzilla.suse.com/show_bug.cgi?id=910647 https://bugzilla.suse.com/show_bug.cgi?id=910669 http://download.suse.com/patch/finder/?keywords=b6b2353659cdca6dc3d8d5d591e… -- To unsubscribe, e-mail: opensuse-security-announce+unsubscribe(a)opensuse.org For additional commands, e-mail: opensuse-security-announce+help(a)opensuse.org

1 0

[security-announce] SUSE-SU-2015:0163-1: critical: Security update for flash-player
by opensuse-security＠opensuse.org 28 Jan '15

28 Jan '15

SUSE Security Update: Security update for flash-player ______________________________________________________________________________ Announcement ID: SUSE-SU-2015:0163-1 Rating: critical References: #914463 Cross-References: CVE-2015-0311 Affected Products: SUSE Linux Enterprise Desktop 11 SP3 ______________________________________________________________________________ An update that fixes one vulnerability is now available. It includes one version update. Description: Adobe Flash Player was updated to version 11.2.202.440 (bsc#914463, APSA15-01, CVE-2015-0311). More information can be found at https://helpx.adobe.com/security/products/flash-player/apsa15-01.html <https://helpx.adobe.com/security/products/flash-player/apsa15-01.html> . An update of flashplayer (executable binary) for i386 is currently not available and was thus disabled. Security Issues: * CVE-2015-0311 <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2015-0311> Patch Instructions: To install this SUSE Security Update use YaST online_update. Alternatively you can run the command listed for your product: - SUSE Linux Enterprise Desktop 11 SP3: zypper in -t patch sledsp3-flash-player-10226 To bring your system up-to-date, use "zypper patch". Package List: - SUSE Linux Enterprise Desktop 11 SP3 (i586 x86_64) [New Version: 11.2.202.440]: flash-player-11.2.202.440-0.3.1 flash-player-gnome-11.2.202.440-0.3.1 flash-player-kde4-11.2.202.440-0.3.1 References: http://support.novell.com/security/cve/CVE-2015-0311.html https://bugzilla.suse.com/show_bug.cgi?id=914463 http://download.suse.com/patch/finder/?keywords=7db1258290d221d2ae042f2c780… -- To unsubscribe, e-mail: opensuse-security-announce+unsubscribe(a)opensuse.org For additional commands, e-mail: opensuse-security-announce+help(a)opensuse.org

1 0

[security-announce] openSUSE-SU-2015:0162-1: critical: glibc
by opensuse-security＠opensuse.org 28 Jan '15

28 Jan '15

openSUSE Security Update: glibc ______________________________________________________________________________ Announcement ID: openSUSE-SU-2015:0162-1 Rating: critical References: #913646 Cross-References: 2015-0235 Affected Products: openSUSE Evergreen 11.4 ______________________________________________________________________________ An update that fixes one vulnerability is now available. Description: CVE-2015-0235: A vulnerability was found and fixed in the GNU C Library, specifically in the function gethostbyname(), that could lead to a local or remote buffer overflow. (bsc#913646) Patch Instructions: To install this openSUSE Security Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE Evergreen 11.4: zypper in -t patch 2015-6 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE Evergreen 11.4 (i586 x86_64): glibc-2.11.3-12.62.1 glibc-debuginfo-2.11.3-12.62.1 glibc-debugsource-2.11.3-12.62.1 glibc-devel-2.11.3-12.62.1 glibc-devel-debuginfo-2.11.3-12.62.1 glibc-html-2.11.3-12.62.1 glibc-i18ndata-2.11.3-12.62.1 glibc-info-2.11.3-12.62.1 glibc-locale-2.11.3-12.62.1 glibc-locale-debuginfo-2.11.3-12.62.1 glibc-obsolete-2.11.3-12.62.1 glibc-profile-2.11.3-12.62.1 nscd-2.11.3-12.62.1 nscd-debuginfo-2.11.3-12.62.1 - openSUSE Evergreen 11.4 (i586): glibc-obsolete-debuginfo-2.11.3-12.62.1 References: http://support.novell.com/security/cve/2015-0235.html https://bugzilla.suse.com/show_bug.cgi?id=913646 -- To unsubscribe, e-mail: opensuse-security-announce+unsubscribe(a)opensuse.org For additional commands, e-mail: opensuse-security-announce+help(a)opensuse.org

1 0

[security-announce] openSUSE-SU-2015:0161-1: important: Security update for libpng16
by opensuse-security＠opensuse.org 28 Jan '15

28 Jan '15

openSUSE Security Update: Security update for libpng16 ______________________________________________________________________________ Announcement ID: openSUSE-SU-2015:0161-1 Rating: important References: #912076 #912929 Cross-References: CVE-2014-9495 CVE-2015-0973 Affected Products: openSUSE 13.2 openSUSE 13.1 ______________________________________________________________________________ An update that fixes two vulnerabilities is now available. Description: libpng was updated to fix some security issues: * CVE-2014-9495 [bnc#912076]: Heap-buffer overflow png_combine_row() with very wide interlaced images * CVE-2015-0973 [bnc#912929]: overflow in png_read_IDAT_data libpng is now also build with -DPNG_SAFE_LIMITS_SUPPORTED. Patch Instructions: To install this openSUSE Security Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE 13.2: zypper in -t patch openSUSE-2015-79 - openSUSE 13.1: zypper in -t patch openSUSE-2015-79 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE 13.2 (i586 x86_64): libpng16-16-1.6.13-2.4.1 libpng16-16-debuginfo-1.6.13-2.4.1 libpng16-compat-devel-1.6.13-2.4.1 libpng16-debugsource-1.6.13-2.4.1 libpng16-devel-1.6.13-2.4.1 libpng16-tools-1.6.13-2.4.1 libpng16-tools-debuginfo-1.6.13-2.4.1 - openSUSE 13.2 (x86_64): libpng16-16-32bit-1.6.13-2.4.1 libpng16-16-debuginfo-32bit-1.6.13-2.4.1 libpng16-compat-devel-32bit-1.6.13-2.4.1 libpng16-devel-32bit-1.6.13-2.4.1 - openSUSE 13.1 (i586 x86_64): libpng16-16-1.6.6-16.1 libpng16-16-debuginfo-1.6.6-16.1 libpng16-compat-devel-1.6.6-16.1 libpng16-debugsource-1.6.6-16.1 libpng16-devel-1.6.6-16.1 libpng16-tools-1.6.6-16.1 libpng16-tools-debuginfo-1.6.6-16.1 - openSUSE 13.1 (x86_64): libpng16-16-32bit-1.6.6-16.1 libpng16-16-debuginfo-32bit-1.6.6-16.1 libpng16-compat-devel-32bit-1.6.6-16.1 libpng16-devel-32bit-1.6.6-16.1 References: http://support.novell.com/security/cve/CVE-2014-9495.html http://support.novell.com/security/cve/CVE-2015-0973.html https://bugzilla.suse.com/show_bug.cgi?id=912076 https://bugzilla.suse.com/show_bug.cgi?id=912929 -- To unsubscribe, e-mail: opensuse-security-announce+unsubscribe(a)opensuse.org For additional commands, e-mail: opensuse-security-announce+help(a)opensuse.org

1 0

[security-announce] SUSE-SU-2015:0158-1: critical: Security update for glibc
by opensuse-security＠opensuse.org 28 Jan '15

28 Jan '15

SUSE Security Update: Security update for glibc ______________________________________________________________________________ Announcement ID: SUSE-SU-2015:0158-1 Rating: critical References: #913646 Cross-References: CVE-2015-0235 Affected Products: SUSE Linux Enterprise Software Development Kit 11 SP3 SUSE Linux Enterprise Server 11 SP3 for VMware SUSE Linux Enterprise Server 11 SP3 SUSE Linux Enterprise Server 11 SP2 LTSS SUSE Linux Enterprise Server 11 SP1 LTSS SUSE Linux Enterprise Server 10 SP4 LTSS SUSE Linux Enterprise Desktop 11 SP3 ______________________________________________________________________________ An update that fixes one vulnerability is now available. Description: This update for glibc fixes the following security issue: CVE-2015-0235: A vulnerability was found and fixed in the GNU C Library, specifically in the function gethostbyname(), that could lead to a local or remote buffer overflow. (bsc#913646) Security Issues: * CVE-2015-0235 <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2015-0235> Patch Instructions: To install this SUSE Security Update use YaST online_update. Alternatively you can run the command listed for your product: - SUSE Linux Enterprise Software Development Kit 11 SP3: zypper in -t patch sdksp3-glibc-10206 - SUSE Linux Enterprise Server 11 SP3 for VMware: zypper in -t patch slessp3-glibc-10206 - SUSE Linux Enterprise Server 11 SP3: zypper in -t patch slessp3-glibc-10206 - SUSE Linux Enterprise Server 11 SP2 LTSS: zypper in -t patch slessp2-glibc-10204 - SUSE Linux Enterprise Server 11 SP1 LTSS: zypper in -t patch slessp1-glibc-10202 - SUSE Linux Enterprise Desktop 11 SP3: zypper in -t patch sledsp3-glibc-10206 To bring your system up-to-date, use "zypper patch". Package List: - SUSE Linux Enterprise Software Development Kit 11 SP3 (i586 x86_64): glibc-html-2.11.3-17.74.13 glibc-info-2.11.3-17.74.13 - SUSE Linux Enterprise Server 11 SP3 for VMware (i586 x86_64): glibc-2.11.3-17.74.13 glibc-devel-2.11.3-17.74.13 glibc-html-2.11.3-17.74.13 glibc-i18ndata-2.11.3-17.74.13 glibc-info-2.11.3-17.74.13 glibc-locale-2.11.3-17.74.13 glibc-profile-2.11.3-17.74.13 nscd-2.11.3-17.74.13 - SUSE Linux Enterprise Server 11 SP3 for VMware (x86_64): glibc-32bit-2.11.3-17.74.13 glibc-devel-32bit-2.11.3-17.74.13 glibc-locale-32bit-2.11.3-17.74.13 glibc-profile-32bit-2.11.3-17.74.13 - SUSE Linux Enterprise Server 11 SP3 (i586 i686 ia64 ppc64 s390x x86_64): glibc-2.11.3-17.74.13 glibc-devel-2.11.3-17.74.13 - SUSE Linux Enterprise Server 11 SP3 (i586 ia64 ppc64 s390x x86_64): glibc-html-2.11.3-17.74.13 glibc-i18ndata-2.11.3-17.74.13 glibc-info-2.11.3-17.74.13 glibc-locale-2.11.3-17.74.13 glibc-profile-2.11.3-17.74.13 nscd-2.11.3-17.74.13 - SUSE Linux Enterprise Server 11 SP3 (ppc64 s390x x86_64): glibc-32bit-2.11.3-17.74.13 glibc-devel-32bit-2.11.3-17.74.13 glibc-locale-32bit-2.11.3-17.74.13 glibc-profile-32bit-2.11.3-17.74.13 - SUSE Linux Enterprise Server 11 SP3 (ia64): glibc-locale-x86-2.11.3-17.74.13 glibc-profile-x86-2.11.3-17.74.13 glibc-x86-2.11.3-17.74.13 - SUSE Linux Enterprise Server 11 SP2 LTSS (i586 i686 s390x x86_64): glibc-2.11.3-17.45.55.5 glibc-devel-2.11.3-17.45.55.5 - SUSE Linux Enterprise Server 11 SP2 LTSS (i586 s390x x86_64): glibc-html-2.11.3-17.45.55.5 glibc-i18ndata-2.11.3-17.45.55.5 glibc-info-2.11.3-17.45.55.5 glibc-locale-2.11.3-17.45.55.5 glibc-profile-2.11.3-17.45.55.5 nscd-2.11.3-17.45.55.5 - SUSE Linux Enterprise Server 11 SP2 LTSS (s390x x86_64): glibc-32bit-2.11.3-17.45.55.5 glibc-devel-32bit-2.11.3-17.45.55.5 glibc-locale-32bit-2.11.3-17.45.55.5 glibc-profile-32bit-2.11.3-17.45.55.5 - SUSE Linux Enterprise Server 11 SP1 LTSS (i586 i686 s390x x86_64): glibc-2.11.1-0.60.1 glibc-devel-2.11.1-0.60.1 - SUSE Linux Enterprise Server 11 SP1 LTSS (i586 s390x x86_64): glibc-html-2.11.1-0.60.1 glibc-i18ndata-2.11.1-0.60.1 glibc-info-2.11.1-0.60.1 glibc-locale-2.11.1-0.60.1 glibc-profile-2.11.1-0.60.1 nscd-2.11.1-0.60.1 - SUSE Linux Enterprise Server 11 SP1 LTSS (s390x x86_64): glibc-32bit-2.11.1-0.60.1 glibc-devel-32bit-2.11.1-0.60.1 glibc-locale-32bit-2.11.1-0.60.1 glibc-profile-32bit-2.11.1-0.60.1 - SUSE Linux Enterprise Server 10 SP4 LTSS (i586 i686 s390x x86_64): glibc-2.4-31.113.3 glibc-devel-2.4-31.113.3 - SUSE Linux Enterprise Server 10 SP4 LTSS (i586 s390x x86_64): glibc-html-2.4-31.113.3 glibc-i18ndata-2.4-31.113.3 glibc-info-2.4-31.113.3 glibc-locale-2.4-31.113.3 glibc-profile-2.4-31.113.3 nscd-2.4-31.113.3 - SUSE Linux Enterprise Server 10 SP4 LTSS (s390x x86_64): glibc-32bit-2.4-31.113.3 glibc-devel-32bit-2.4-31.113.3 glibc-locale-32bit-2.4-31.113.3 glibc-profile-32bit-2.4-31.113.3 - SUSE Linux Enterprise Desktop 11 SP3 (i586 i686 x86_64): glibc-2.11.3-17.74.13 glibc-devel-2.11.3-17.74.13 - SUSE Linux Enterprise Desktop 11 SP3 (i586 x86_64): glibc-i18ndata-2.11.3-17.74.13 glibc-locale-2.11.3-17.74.13 nscd-2.11.3-17.74.13 - SUSE Linux Enterprise Desktop 11 SP3 (x86_64): glibc-32bit-2.11.3-17.74.13 glibc-devel-32bit-2.11.3-17.74.13 glibc-locale-32bit-2.11.3-17.74.13 References: http://support.novell.com/security/cve/CVE-2015-0235.html https://bugzilla.suse.com/show_bug.cgi?id=913646 http://download.suse.com/patch/finder/?keywords=1ca03fa8282503d216439947cd1… http://download.suse.com/patch/finder/?keywords=663c904782de77d808d74a6c283… http://download.suse.com/patch/finder/?keywords=7fbea3f9bf3b0ca0902540ea678… http://download.suse.com/patch/finder/?keywords=fbc502d34a8bffb84719dc9a5ec… -- To unsubscribe, e-mail: opensuse-security-announce+unsubscribe(a)opensuse.org For additional commands, e-mail: opensuse-security-announce+help(a)opensuse.org

1 0

[security-announce] SUSE-SU-2015:0151-1: critical: Security update for flash-player
by opensuse-security＠opensuse.org 27 Jan '15

27 Jan '15

SUSE Security Update: Security update for flash-player ______________________________________________________________________________ Announcement ID: SUSE-SU-2015:0151-1 Rating: critical References: #914463 Cross-References: CVE-2015-0311 Affected Products: SUSE Linux Enterprise Workstation Extension 12 SUSE Linux Enterprise Desktop 12 ______________________________________________________________________________ An update that fixes one vulnerability is now available. Description: Adobe Flash Player was updated to 11.2.202.440 (bsc#914463, APSA15-01, CVE-2015-0311). More information can be found on https://helpx.adobe.com/security/products/flash-player/apsa15-01.html An update of flashplayer (executable binary) for i386 is currently not available. Disabled! Patch Instructions: To install this SUSE Security Update use YaST online_update. Alternatively you can run the command listed for your product: - SUSE Linux Enterprise Workstation Extension 12: zypper in -t patch SUSE-SLE-WE-12-2015-43 - SUSE Linux Enterprise Desktop 12: zypper in -t patch SUSE-SLE-DESKTOP-12-2015-43 To bring your system up-to-date, use "zypper patch". Package List: - SUSE Linux Enterprise Workstation Extension 12 (i586 x86_64): flash-player-11.2.202.440-31.1 flash-player-gnome-11.2.202.440-31.1 - SUSE Linux Enterprise Desktop 12 (i586 x86_64): flash-player-11.2.202.440-31.1 flash-player-gnome-11.2.202.440-31.1 References: http://support.novell.com/security/cve/CVE-2015-0311.html https://bugzilla.suse.com/show_bug.cgi?id=914463 -- To unsubscribe, e-mail: opensuse-security-announce+unsubscribe(a)opensuse.org For additional commands, e-mail: opensuse-security-announce+help(a)opensuse.org

1 0

[security-announce] openSUSE-SU-2015:0150-1: critical: Security update for flash-player
by opensuse-security＠opensuse.org 27 Jan '15

27 Jan '15

openSUSE Security Update: Security update for flash-player ______________________________________________________________________________ Announcement ID: openSUSE-SU-2015:0150-1 Rating: critical References: #914463 Cross-References: CVE-2015-0311 Affected Products: openSUSE 13.2:NonFree openSUSE 13.1:NonFree ______________________________________________________________________________ An update that fixes one vulnerability is now available. Description: Adobe Flash Player was updated to 11.2.202.440 (bsc#914463, APSA15-01, CVE-2015-0311). More information can be found on https://helpx.adobe.com/security/products/flash-player/apsa15-01.html An update of flashplayer (executable binary) for i386 is currently not available. Disabled! Patch Instructions: To install this openSUSE Security Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE 13.2:NonFree: zypper in -t patch openSUSE-2015-78 - openSUSE 13.1:NonFree: zypper in -t patch openSUSE-2015-78 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE 13.2:NonFree (i586 x86_64): flash-player-11.2.202.440-2.29.1 flash-player-gnome-11.2.202.440-2.29.1 flash-player-kde4-11.2.202.440-2.29.1 - openSUSE 13.1:NonFree (i586 x86_64): flash-player-11.2.202.440-94.1 flash-player-gnome-11.2.202.440-94.1 flash-player-kde4-11.2.202.440-94.1 References: http://support.novell.com/security/cve/CVE-2015-0311.html https://bugzilla.suse.com/show_bug.cgi?id=914463 -- To unsubscribe, e-mail: opensuse-security-announce+unsubscribe(a)opensuse.org For additional commands, e-mail: opensuse-security-announce+help(a)opensuse.org

1 0

[security-announce] openSUSE-SU-2015:0147-1: critical: update for Flash player
by opensuse-security＠opensuse.org 26 Jan '15

26 Jan '15

openSUSE Security Update: update for Flash player ______________________________________________________________________________ Announcement ID: openSUSE-SU-2015:0147-1 Rating: critical References: Cross-References: 2015-0310 2015-0311 Affected Products: openSUSE Evergreen 11.4 ______________________________________________________________________________ An update that fixes two vulnerabilities is now available. Description: This update for Flash player fixes known security issues. Patch Instructions: To install this openSUSE Security Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE Evergreen 11.4: zypper in -t patch 2015-5 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE Evergreen 11.4 (i586 x86_64): flash-player-11.2.202.440-143.1 flash-player-gnome-11.2.202.440-143.1 flash-player-kde4-11.2.202.440-143.1 References: http://support.novell.com/security/cve/2015-0310.html http://support.novell.com/security/cve/2015-0311.html -- To unsubscribe, e-mail: opensuse-security-announce+unsubscribe(a)opensuse.org For additional commands, e-mail: opensuse-security-announce+help(a)opensuse.org

1 0

[security-announce] openSUSE-SU-2015:0138-1: important: Firefox update to latest 31ESR release
by opensuse-security＠opensuse.org 25 Jan '15

25 Jan '15

openSUSE Security Update: Firefox update to latest 31ESR release ______________________________________________________________________________ Announcement ID: openSUSE-SU-2015:0138-1 Rating: important References: #876833 #894370 #900639 #900941 #908009 #910669 Cross-References: 2013-5611 2013-5612 2013-5614 2013-5619 2013-6672 2014-1480 2014-1483 2014-1484 2014-1485 2014-1488 2014-1489 2014-1492 2014-1498 2014-1499 2014-1500 2014-1502 2014-1504 2014-1519 2014-1522 2014-1525 2014-1526 2014-1528 2014-1539 2014-1540 2014-1542 2014-1543 2014-1549 2014-1550 2014-1552 2014-1553 2014-1558 2014-1559 2014-1560 2014-1561 2014-1563 2014-1564 2014-1565 2014-1574 2014-1576 2014-1577 2014-1578 2014-1581 2014-1583 2014-1585 2014-1586 2014-1587 2014-1590 2014-1592 2014-1593 2014-1594 2014-8634 2014-8635 2014-8638 2014-8639 2014-8641 CVE-2014-1553 CVE-2014-1562 CVE-2014-1563 CVE-2014-1564 CVE-2014-1565 CVE-2014-1567 CVE-2014-1569 CVE-2014-1574 CVE-2014-1576 CVE-2014-1577 CVE-2014-1578 CVE-2014-1581 CVE-2014-1585 CVE-2014-1586 CVE-2014-1587 CVE-2014-1590 CVE-2014-1592 CVE-2014-1593 CVE-2014-1594 Affected Products: openSUSE Evergreen 11.4 ______________________________________________________________________________ An update that fixes 74 vulnerabilities is now available. Description: This update lifts Firefox to the latest 31 ESR release to fix known security issues. Patch Instructions: To install this openSUSE Security Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE Evergreen 11.4: zypper in -t patch 2015-4 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE Evergreen 11.4 (i586 x86_64): MozillaFirefox-31.4.0-133.1 MozillaFirefox-branding-upstream-31.4.0-133.1 MozillaFirefox-buildsymbols-31.4.0-133.1 MozillaFirefox-debuginfo-31.4.0-133.1 MozillaFirefox-debugsource-31.4.0-133.1 MozillaFirefox-devel-31.4.0-133.1 MozillaFirefox-translations-common-31.4.0-133.1 MozillaFirefox-translations-other-31.4.0-133.1 libfreebl3-3.17.3-104.1 libfreebl3-debuginfo-3.17.3-104.1 libsoftokn3-3.17.3-104.1 libsoftokn3-debuginfo-3.17.3-104.1 mozilla-nspr-4.10.7-49.1 mozilla-nspr-debuginfo-4.10.7-49.1 mozilla-nspr-debugsource-4.10.7-49.1 mozilla-nspr-devel-4.10.7-49.1 mozilla-nss-3.17.3-104.1 mozilla-nss-certs-3.17.3-104.1 mozilla-nss-certs-debuginfo-3.17.3-104.1 mozilla-nss-debuginfo-3.17.3-104.1 mozilla-nss-debugsource-3.17.3-104.1 mozilla-nss-devel-3.17.3-104.1 mozilla-nss-sysinit-3.17.3-104.1 mozilla-nss-sysinit-debuginfo-3.17.3-104.1 mozilla-nss-tools-3.17.3-104.1 mozilla-nss-tools-debuginfo-3.17.3-104.1 - openSUSE Evergreen 11.4 (x86_64): libfreebl3-32bit-3.17.3-104.1 libfreebl3-debuginfo-32bit-3.17.3-104.1 libsoftokn3-32bit-3.17.3-104.1 libsoftokn3-debuginfo-32bit-3.17.3-104.1 mozilla-nspr-32bit-4.10.7-49.1 mozilla-nspr-debuginfo-32bit-4.10.7-49.1 mozilla-nss-32bit-3.17.3-104.1 mozilla-nss-certs-32bit-3.17.3-104.1 mozilla-nss-certs-debuginfo-32bit-3.17.3-104.1 mozilla-nss-debuginfo-32bit-3.17.3-104.1 mozilla-nss-sysinit-32bit-3.17.3-104.1 mozilla-nss-sysinit-debuginfo-32bit-3.17.3-104.1 - openSUSE Evergreen 11.4 (ia64): libfreebl3-debuginfo-x86-3.17.3-104.1 libfreebl3-x86-3.17.3-104.1 libsoftokn3-debuginfo-x86-3.17.3-104.1 libsoftokn3-x86-3.17.3-104.1 mozilla-nspr-debuginfo-x86-4.10.7-49.1 mozilla-nspr-x86-4.10.7-49.1 mozilla-nss-certs-debuginfo-x86-3.17.3-104.1 mozilla-nss-certs-x86-3.17.3-104.1 mozilla-nss-debuginfo-x86-3.17.3-104.1 mozilla-nss-sysinit-debuginfo-x86-3.17.3-104.1 mozilla-nss-sysinit-x86-3.17.3-104.1 mozilla-nss-x86-3.17.3-104.1 References: http://support.novell.com/security/cve/2013-5611.html http://support.novell.com/security/cve/2013-5612.html http://support.novell.com/security/cve/2013-5614.html http://support.novell.com/security/cve/2013-5619.html http://support.novell.com/security/cve/2013-6672.html http://support.novell.com/security/cve/2014-1480.html http://support.novell.com/security/cve/2014-1483.html http://support.novell.com/security/cve/2014-1484.html http://support.novell.com/security/cve/2014-1485.html http://support.novell.com/security/cve/2014-1488.html http://support.novell.com/security/cve/2014-1489.html http://support.novell.com/security/cve/2014-1492.html http://support.novell.com/security/cve/2014-1498.html http://support.novell.com/security/cve/2014-1499.html http://support.novell.com/security/cve/2014-1500.html http://support.novell.com/security/cve/2014-1502.html http://support.novell.com/security/cve/2014-1504.html http://support.novell.com/security/cve/2014-1519.html http://support.novell.com/security/cve/2014-1522.html http://support.novell.com/security/cve/2014-1525.html http://support.novell.com/security/cve/2014-1526.html http://support.novell.com/security/cve/2014-1528.html http://support.novell.com/security/cve/2014-1539.html http://support.novell.com/security/cve/2014-1540.html http://support.novell.com/security/cve/2014-1542.html http://support.novell.com/security/cve/2014-1543.html http://support.novell.com/security/cve/2014-1549.html http://support.novell.com/security/cve/2014-1550.html http://support.novell.com/security/cve/2014-1552.html http://support.novell.com/security/cve/2014-1553.html http://support.novell.com/security/cve/2014-1558.html http://support.novell.com/security/cve/2014-1559.html http://support.novell.com/security/cve/2014-1560.html http://support.novell.com/security/cve/2014-1561.html http://support.novell.com/security/cve/2014-1563.html http://support.novell.com/security/cve/2014-1564.html http://support.novell.com/security/cve/2014-1565.html http://support.novell.com/security/cve/2014-1574.html http://support.novell.com/security/cve/2014-1576.html http://support.novell.com/security/cve/2014-1577.html http://support.novell.com/security/cve/2014-1578.html http://support.novell.com/security/cve/2014-1581.html http://support.novell.com/security/cve/2014-1583.html http://support.novell.com/security/cve/2014-1585.html http://support.novell.com/security/cve/2014-1586.html http://support.novell.com/security/cve/2014-1587.html http://support.novell.com/security/cve/2014-1590.html http://support.novell.com/security/cve/2014-1592.html http://support.novell.com/security/cve/2014-1593.html http://support.novell.com/security/cve/2014-1594.html http://support.novell.com/security/cve/2014-8634.html http://support.novell.com/security/cve/2014-8635.html http://support.novell.com/security/cve/2014-8638.html http://support.novell.com/security/cve/2014-8639.html http://support.novell.com/security/cve/2014-8641.html http://support.novell.com/security/cve/CVE-2014-1553.html http://support.novell.com/security/cve/CVE-2014-1562.html http://support.novell.com/security/cve/CVE-2014-1563.html http://support.novell.com/security/cve/CVE-2014-1564.html http://support.novell.com/security/cve/CVE-2014-1565.html http://support.novell.com/security/cve/CVE-2014-1567.html http://support.novell.com/security/cve/CVE-2014-1569.html http://support.novell.com/security/cve/CVE-2014-1574.html http://support.novell.com/security/cve/CVE-2014-1576.html http://support.novell.com/security/cve/CVE-2014-1577.html http://support.novell.com/security/cve/CVE-2014-1578.html http://support.novell.com/security/cve/CVE-2014-1581.html http://support.novell.com/security/cve/CVE-2014-1585.html http://support.novell.com/security/cve/CVE-2014-1586.html http://support.novell.com/security/cve/CVE-2014-1587.html http://support.novell.com/security/cve/CVE-2014-1590.html http://support.novell.com/security/cve/CVE-2014-1592.html http://support.novell.com/security/cve/CVE-2014-1593.html http://support.novell.com/security/cve/CVE-2014-1594.html https://bugzilla.suse.com/show_bug.cgi?id=876833 https://bugzilla.suse.com/show_bug.cgi?id=894370 https://bugzilla.suse.com/show_bug.cgi?id=900639 https://bugzilla.suse.com/show_bug.cgi?id=900941 https://bugzilla.suse.com/show_bug.cgi?id=908009 https://bugzilla.suse.com/show_bug.cgi?id=910669 -- To unsubscribe, e-mail: opensuse-security-announce+unsubscribe(a)opensuse.org For additional commands, e-mail: opensuse-security-announce+help(a)opensuse.org

1 0

[security-announce] SUSE-SU-2015:0136-1: important: Security update for vsftpd
by opensuse-security＠opensuse.org 24 Jan '15

24 Jan '15

SUSE Security Update: Security update for vsftpd ______________________________________________________________________________ Announcement ID: SUSE-SU-2015:0136-1 Rating: important References: #900326 Affected Products: SUSE Linux Enterprise Server 11 SP3 for VMware SUSE Linux Enterprise Server 11 SP3 ______________________________________________________________________________ An update that contains security fixes can now be installed. Description: The vsftp daemon was not handling the "deny_file" option properly, allowing unauthorized access in some specific scenarios.(bnc#900326). Patch Instructions: To install this SUSE Security Update use YaST online_update. Alternatively you can run the command listed for your product: - SUSE Linux Enterprise Server 11 SP3 for VMware: zypper in -t patch slessp3-vsftpd-10161 - SUSE Linux Enterprise Server 11 SP3: zypper in -t patch slessp3-vsftpd-10161 To bring your system up-to-date, use "zypper patch". Package List: - SUSE Linux Enterprise Server 11 SP3 for VMware (i586 x86_64): vsftpd-2.0.7-4.27.1 - SUSE Linux Enterprise Server 11 SP3 (i586 ia64 ppc64 s390x x86_64): vsftpd-2.0.7-4.27.1 References: https://bugzilla.suse.com/show_bug.cgi?id=900326 http://download.suse.com/patch/finder/?keywords=c6526212ede876aeb795aefc7af… -- To unsubscribe, e-mail: opensuse-security-announce+unsubscribe(a)opensuse.org For additional commands, e-mail: opensuse-security-announce+help(a)opensuse.org

1 0

[security-announce] SUSE-SU-2015:0135-1: critical: Security update for flash-player
by opensuse-security＠opensuse.org 24 Jan '15

24 Jan '15

SUSE Security Update: Security update for flash-player ______________________________________________________________________________ Announcement ID: SUSE-SU-2015:0135-1 Rating: critical References: #914333 Cross-References: CVE-2015-0310 Affected Products: SUSE Linux Enterprise Desktop 11 SP3 ______________________________________________________________________________ An update that fixes one vulnerability is now available. It includes one version update. Description: Adobe Flash Player was updated to version 11.2.202.438 to fix one security issue. (APSB15-02, CVE-2015-0310) For more details refer to the vendor advisory at http://helpx.adobe.com/security/products/flash-player/apsb15-02.html <http://helpx.adobe.com/security/products/flash-player/apsb15-02.html> . Security Issues: * CVE-2015-0310 <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2015-0310> Patch Instructions: To install this SUSE Security Update use YaST online_update. Alternatively you can run the command listed for your product: - SUSE Linux Enterprise Desktop 11 SP3: zypper in -t patch sledsp3-flash-player-10215 To bring your system up-to-date, use "zypper patch". Package List: - SUSE Linux Enterprise Desktop 11 SP3 (i586 x86_64) [New Version: 11.2.202.438]: flash-player-11.2.202.438-0.3.1 flash-player-gnome-11.2.202.438-0.3.1 flash-player-kde4-11.2.202.438-0.3.1 References: http://support.novell.com/security/cve/CVE-2015-0310.html https://bugzilla.suse.com/show_bug.cgi?id=914333 http://download.suse.com/patch/finder/?keywords=23c46c7c451b73f11ea60613d28… -- To unsubscribe, e-mail: opensuse-security-announce+unsubscribe(a)opensuse.org For additional commands, e-mail: opensuse-security-announce+help(a)opensuse.org

1 0

[security-announce] openSUSE-SU-2015:0130-1: important: Security update for openssl
by opensuse-security＠opensuse.org 23 Jan '15

23 Jan '15

openSUSE Security Update: Security update for openssl ______________________________________________________________________________ Announcement ID: openSUSE-SU-2015:0130-1 Rating: important References: #911399 #912014 #912015 #912018 #912292 #912293 #912294 #912296 Cross-References: CVE-2014-3569 CVE-2014-3570 CVE-2014-3571 CVE-2014-3572 CVE-2014-8275 CVE-2015-0204 CVE-2015-0205 CVE-2015-0206 Affected Products: openSUSE 13.2 openSUSE 13.1 ______________________________________________________________________________ An update that fixes 8 vulnerabilities is now available. Description: openssl was updated to 1.0.1k to fix various security issues and bugs. More information can be found in the openssl advisory: http://openssl.org/news/secadv_20150108.txt Following issues were fixed: * CVE-2014-3570 (bsc#912296): Bignum squaring (BN_sqr) may have produced incorrect results on some platforms, including x86_64. * CVE-2014-3571 (bsc#912294): Fixed crash in dtls1_get_record whilst in the listen state where you get two separate reads performed - one for the header and one for the body of the handshake record. * CVE-2014-3572 (bsc#912015): Don't accept a handshake using an ephemeral ECDH ciphersuites with the server key exchange message omitted. * CVE-2014-8275 (bsc#912018): Fixed various certificate fingerprint issues. * CVE-2015-0204 (bsc#912014): Only allow ephemeral RSA keys in export ciphersuites * CVE-2015-0205 (bsc#912293): A fixwas added to prevent use of DH client certificates without sending certificate verify message. * CVE-2015-0206 (bsc#912292): A memory leak was fixed in dtls1_buffer_record. Patch Instructions: To install this openSUSE Security Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE 13.2: zypper in -t patch openSUSE-2015-67 - openSUSE 13.1: zypper in -t patch openSUSE-2015-67 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE 13.2 (i586 x86_64): libopenssl-devel-1.0.1k-2.16.2 libopenssl1_0_0-1.0.1k-2.16.2 libopenssl1_0_0-debuginfo-1.0.1k-2.16.2 libopenssl1_0_0-hmac-1.0.1k-2.16.2 openssl-1.0.1k-2.16.2 openssl-debuginfo-1.0.1k-2.16.2 openssl-debugsource-1.0.1k-2.16.2 - openSUSE 13.2 (x86_64): libopenssl-devel-32bit-1.0.1k-2.16.2 libopenssl1_0_0-32bit-1.0.1k-2.16.2 libopenssl1_0_0-debuginfo-32bit-1.0.1k-2.16.2 libopenssl1_0_0-hmac-32bit-1.0.1k-2.16.2 - openSUSE 13.2 (noarch): openssl-doc-1.0.1k-2.16.2 - openSUSE 13.1 (i586 x86_64): libopenssl-devel-1.0.1k-11.64.2 libopenssl1_0_0-1.0.1k-11.64.2 libopenssl1_0_0-debuginfo-1.0.1k-11.64.2 openssl-1.0.1k-11.64.2 openssl-debuginfo-1.0.1k-11.64.2 openssl-debugsource-1.0.1k-11.64.2 - openSUSE 13.1 (x86_64): libopenssl-devel-32bit-1.0.1k-11.64.2 libopenssl1_0_0-32bit-1.0.1k-11.64.2 libopenssl1_0_0-debuginfo-32bit-1.0.1k-11.64.2 - openSUSE 13.1 (noarch): openssl-doc-1.0.1k-11.64.2 References: http://support.novell.com/security/cve/CVE-2014-3569.html http://support.novell.com/security/cve/CVE-2014-3570.html http://support.novell.com/security/cve/CVE-2014-3571.html http://support.novell.com/security/cve/CVE-2014-3572.html http://support.novell.com/security/cve/CVE-2014-8275.html http://support.novell.com/security/cve/CVE-2015-0204.html http://support.novell.com/security/cve/CVE-2015-0205.html http://support.novell.com/security/cve/CVE-2015-0206.html https://bugzilla.suse.com/show_bug.cgi?id=911399 https://bugzilla.suse.com/show_bug.cgi?id=912014 https://bugzilla.suse.com/show_bug.cgi?id=912015 https://bugzilla.suse.com/show_bug.cgi?id=912018 https://bugzilla.suse.com/show_bug.cgi?id=912292 https://bugzilla.suse.com/show_bug.cgi?id=912293 https://bugzilla.suse.com/show_bug.cgi?id=912294 https://bugzilla.suse.com/show_bug.cgi?id=912296 -- To unsubscribe, e-mail: opensuse-security-announce+unsubscribe(a)opensuse.org For additional commands, e-mail: opensuse-security-announce+help(a)opensuse.org

1 0

[security-announce] SUSE-SU-2015:0129-1: critical: Security update for flash-player
by opensuse-security＠opensuse.org 23 Jan '15

23 Jan '15

SUSE Security Update: Security update for flash-player ______________________________________________________________________________ Announcement ID: SUSE-SU-2015:0129-1 Rating: critical References: #914333 Cross-References: CVE-2015-0310 Affected Products: SUSE Linux Enterprise Workstation Extension 12 SUSE Linux Enterprise Desktop 12 ______________________________________________________________________________ An update that fixes one vulnerability is now available. Description: Adobe Flash Player was updated to 11.2.202.438 to fix one security isssue. http://helpx.adobe.com/security/products/flash-player/apsb15-02.html (APSB15-02, CVE-2015-0310) Patch Instructions: To install this SUSE Security Update use YaST online_update. Alternatively you can run the command listed for your product: - SUSE Linux Enterprise Workstation Extension 12: zypper in -t patch SUSE-SLE-WE-12-2015-42 - SUSE Linux Enterprise Desktop 12: zypper in -t patch SUSE-SLE-DESKTOP-12-2015-42 To bring your system up-to-date, use "zypper patch". Package List: - SUSE Linux Enterprise Workstation Extension 12 (i586 x86_64): flash-player-11.2.202.438-27.1 flash-player-gnome-11.2.202.438-27.1 - SUSE Linux Enterprise Desktop 12 (i586 x86_64): flash-player-11.2.202.438-27.1 flash-player-gnome-11.2.202.438-27.1 References: http://support.novell.com/security/cve/CVE-2015-0310.html https://bugzilla.suse.com/show_bug.cgi?id=914333 -- To unsubscribe, e-mail: opensuse-security-announce+unsubscribe(a)opensuse.org For additional commands, e-mail: opensuse-security-announce+help(a)opensuse.org

1 0

[security-announce] openSUSE-SU-2015:0110-1: critical: Security update for flash-player
by opensuse-security＠opensuse.org 22 Jan '15

22 Jan '15

openSUSE Security Update: Security update for flash-player ______________________________________________________________________________ Announcement ID: openSUSE-SU-2015:0110-1 Rating: critical References: #914333 Cross-References: CVE-2015-0310 Affected Products: openSUSE 13.2:NonFree openSUSE 13.1:NonFree ______________________________________________________________________________ An update that fixes one vulnerability is now available. Description: Adobe Flash Player was updated to 11.2.202.438 to fix one security isssue. http://helpx.adobe.com/security/products/flash-player/apsb15-02.html (APSB15-02, CVE-2015-0310) Patch Instructions: To install this openSUSE Security Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE 13.2:NonFree: zypper in -t patch openSUSE-2015-49 - openSUSE 13.1:NonFree: zypper in -t patch openSUSE-2015-49 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE 13.2:NonFree (i586 x86_64): flash-player-11.2.202.438-2.25.1 flash-player-gnome-11.2.202.438-2.25.1 flash-player-kde4-11.2.202.438-2.25.1 - openSUSE 13.1:NonFree (i586 x86_64): flash-player-11.2.202.438-90.1 flash-player-gnome-11.2.202.438-90.1 flash-player-kde4-11.2.202.438-90.1 References: http://support.novell.com/security/cve/CVE-2015-0310.html https://bugzilla.suse.com/show_bug.cgi?id=914333 -- To unsubscribe, e-mail: opensuse-security-announce+unsubscribe(a)opensuse.org For additional commands, e-mail: opensuse-security-announce+help(a)opensuse.org

1 0

[security-announce] SUSE-SU-2015:0107-1: important: Security update for rpm
by opensuse-security＠opensuse.org 22 Jan '15

22 Jan '15

SUSE Security Update: Security update for rpm ______________________________________________________________________________ Announcement ID: SUSE-SU-2015:0107-1 Rating: important References: #892431 #906803 #908128 #911228 Cross-References: CVE-2013-6435 CVE-2014-8118 Affected Products: SUSE Linux Enterprise Software Development Kit 12 SUSE Linux Enterprise Server 12 SUSE Linux Enterprise Desktop 12 ______________________________________________________________________________ An update that solves two vulnerabilities and has two fixes is now available. Description: This rpm update fixes the following security and non-security issues: - bnc#908128: Check for bad invalid name sizes (CVE-2014-8118) - bnc#906803: Create files with mode 0 (CVE-2013-6435) - bnc#892431: Honor --noglob in install mode - bnc#911228: Fix noglob patch, it broke files with space. Patch Instructions: To install this SUSE Security Update use YaST online_update. Alternatively you can run the command listed for your product: - SUSE Linux Enterprise Software Development Kit 12: zypper in -t patch SUSE-SLE-SDK-12-2015-40 - SUSE Linux Enterprise Server 12: zypper in -t patch SUSE-SLE-SERVER-12-2015-40 - SUSE Linux Enterprise Desktop 12: zypper in -t patch SUSE-SLE-DESKTOP-12-2015-40 To bring your system up-to-date, use "zypper patch". Package List: - SUSE Linux Enterprise Software Development Kit 12 (ppc64le s390x x86_64): rpm-debuginfo-4.11.2-10.1 rpm-debugsource-4.11.2-10.1 rpm-devel-4.11.2-10.1 - SUSE Linux Enterprise Server 12 (ppc64le s390x x86_64): rpm-4.11.2-10.1 rpm-build-4.11.2-10.1 rpm-build-debuginfo-4.11.2-10.1 rpm-debuginfo-4.11.2-10.1 rpm-debugsource-4.11.2-10.1 rpm-python-4.11.2-10.1 rpm-python-debuginfo-4.11.2-10.1 rpm-python-debugsource-4.11.2-10.1 - SUSE Linux Enterprise Server 12 (s390x x86_64): rpm-32bit-4.11.2-10.1 rpm-debuginfo-32bit-4.11.2-10.1 - SUSE Linux Enterprise Desktop 12 (x86_64): rpm-32bit-4.11.2-10.1 rpm-4.11.2-10.1 rpm-build-4.11.2-10.1 rpm-build-debuginfo-4.11.2-10.1 rpm-debuginfo-32bit-4.11.2-10.1 rpm-debuginfo-4.11.2-10.1 rpm-debugsource-4.11.2-10.1 rpm-python-4.11.2-10.1 rpm-python-debuginfo-4.11.2-10.1 rpm-python-debugsource-4.11.2-10.1 References: http://support.novell.com/security/cve/CVE-2013-6435.html http://support.novell.com/security/cve/CVE-2014-8118.html https://bugzilla.suse.com/show_bug.cgi?id=892431 https://bugzilla.suse.com/show_bug.cgi?id=906803 https://bugzilla.suse.com/show_bug.cgi?id=908128 https://bugzilla.suse.com/show_bug.cgi?id=911228 -- To unsubscribe, e-mail: opensuse-security-announce+unsubscribe(a)opensuse.org For additional commands, e-mail: opensuse-security-announce+help(a)opensuse.org

1 0

[security-announce] SUSE-SU-2015:0096-1: important: Security update for bind
by opensuse-security＠opensuse.org 21 Jan '15

21 Jan '15

SUSE Security Update: Security update for bind ______________________________________________________________________________ Announcement ID: SUSE-SU-2015:0096-1 Rating: important References: #908994 Cross-References: CVE-2014-8500 Affected Products: SUSE Linux Enterprise Software Development Kit 12 SUSE Linux Enterprise Server 12 SUSE Linux Enterprise Desktop 12 ______________________________________________________________________________ An update that fixes one vulnerability is now available. Description: This update of bind to 9.9.6P1 fixes bugs and also the following security issue: A flaw in delegation handling could be exploited to put named into an infinite loop. This has been addressed by placing limits on the number of levels of recursion named will allow (default 7), and the number of iterative queries that it will send (default 50) before terminating a recursive query (CVE-2014-8500, bnc#908994). The recursion depth limit is configured via the "max-recursion-depth" option, and the query limit via the "max-recursion-queries" option. Also the rpz2 patch was removed as it is no longer maintained. Patch Instructions: To install this SUSE Security Update use YaST online_update. Alternatively you can run the command listed for your product: - SUSE Linux Enterprise Software Development Kit 12: zypper in -t patch SUSE-SLE-SDK-12-2015-36 - SUSE Linux Enterprise Server 12: zypper in -t patch SUSE-SLE-SERVER-12-2015-36 - SUSE Linux Enterprise Desktop 12: zypper in -t patch SUSE-SLE-DESKTOP-12-2015-36 To bring your system up-to-date, use "zypper patch". Package List: - SUSE Linux Enterprise Software Development Kit 12 (ppc64le s390x x86_64): bind-debuginfo-9.9.5P1-8.1 bind-debugsource-9.9.5P1-8.1 bind-devel-9.9.5P1-8.1 - SUSE Linux Enterprise Server 12 (ppc64le s390x x86_64): bind-9.9.5P1-8.1 bind-chrootenv-9.9.5P1-8.1 bind-debuginfo-9.9.5P1-8.1 bind-debugsource-9.9.5P1-8.1 bind-libs-9.9.5P1-8.1 bind-libs-debuginfo-9.9.5P1-8.1 bind-utils-9.9.5P1-8.1 bind-utils-debuginfo-9.9.5P1-8.1 - SUSE Linux Enterprise Server 12 (s390x x86_64): bind-libs-32bit-9.9.5P1-8.1 bind-libs-debuginfo-32bit-9.9.5P1-8.1 - SUSE Linux Enterprise Server 12 (noarch): bind-doc-9.9.5P1-8.1 - SUSE Linux Enterprise Desktop 12 (x86_64): bind-debuginfo-9.9.5P1-8.1 bind-debugsource-9.9.5P1-8.1 bind-libs-32bit-9.9.5P1-8.1 bind-libs-9.9.5P1-8.1 bind-libs-debuginfo-32bit-9.9.5P1-8.1 bind-libs-debuginfo-9.9.5P1-8.1 bind-utils-9.9.5P1-8.1 bind-utils-debuginfo-9.9.5P1-8.1 References: http://support.novell.com/security/cve/CVE-2014-8500.html https://bugzilla.suse.com/show_bug.cgi?id=908994 -- To unsubscribe, e-mail: opensuse-security-announce+unsubscribe(a)opensuse.org For additional commands, e-mail: opensuse-security-announce+help(a)opensuse.org

1 0

[security-announce] SUSE-SU-2015:0092-1: important: Security update for libpng16
by opensuse-security＠opensuse.org 20 Jan '15

20 Jan '15

SUSE Security Update: Security update for libpng16 ______________________________________________________________________________ Announcement ID: SUSE-SU-2015:0092-1 Rating: important References: #912076 #912929 Cross-References: CVE-2014-9495 CVE-2015-0973 Affected Products: SUSE Linux Enterprise Software Development Kit 12 SUSE Linux Enterprise Server 12 SUSE Linux Enterprise Desktop 12 ______________________________________________________________________________ An update that fixes two vulnerabilities is now available. Description: This update fixes the following security issues: * CVE-2014-9495: libpng versions heap overflow vulnerability, that under certain circumstances could be exploit. [bnc#912076] * CVE-2015-0973: A heap-based overflow was found in the png_combine_row() function of the libpng library, when very large interlaced images were used.[bnc#912929] Patch Instructions: To install this SUSE Security Update use YaST online_update. Alternatively you can run the command listed for your product: - SUSE Linux Enterprise Software Development Kit 12: zypper in -t patch SUSE-SLE-SDK-12-2015-33 - SUSE Linux Enterprise Server 12: zypper in -t patch SUSE-SLE-SERVER-12-2015-33 - SUSE Linux Enterprise Desktop 12: zypper in -t patch SUSE-SLE-DESKTOP-12-2015-33 To bring your system up-to-date, use "zypper patch". Package List: - SUSE Linux Enterprise Software Development Kit 12 (ppc64le s390x x86_64): libpng16-compat-devel-1.6.8-5.1 libpng16-debugsource-1.6.8-5.1 libpng16-devel-1.6.8-5.1 - SUSE Linux Enterprise Server 12 (ppc64le s390x x86_64): libpng16-16-1.6.8-5.1 libpng16-16-debuginfo-1.6.8-5.1 libpng16-debugsource-1.6.8-5.1 - SUSE Linux Enterprise Server 12 (s390x x86_64): libpng16-16-32bit-1.6.8-5.1 libpng16-16-debuginfo-32bit-1.6.8-5.1 - SUSE Linux Enterprise Desktop 12 (x86_64): libpng16-16-1.6.8-5.1 libpng16-16-32bit-1.6.8-5.1 libpng16-16-debuginfo-1.6.8-5.1 libpng16-16-debuginfo-32bit-1.6.8-5.1 libpng16-debugsource-1.6.8-5.1 References: http://support.novell.com/security/cve/CVE-2014-9495.html http://support.novell.com/security/cve/CVE-2015-0973.html https://bugzilla.suse.com/show_bug.cgi?id=912076 https://bugzilla.suse.com/show_bug.cgi?id=912929 -- To unsubscribe, e-mail: opensuse-security-announce+unsubscribe(a)opensuse.org For additional commands, e-mail: opensuse-security-announce+help(a)opensuse.org

1 0

[security-announce] openSUSE-SU-2015:0077-2: important: Security update for MozillaFirefox
by opensuse-security＠opensuse.org 19 Jan '15

19 Jan '15

openSUSE Security Update: Security update for MozillaFirefox ______________________________________________________________________________ Announcement ID: openSUSE-SU-2015:0077-2 Rating: important References: #908892 #910669 Cross-References: CVE-2014-8634 CVE-2014-8635 CVE-2014-8636 CVE-2014-8637 CVE-2014-8638 CVE-2014-8639 CVE-2014-8640 CVE-2014-8641 CVE-2014-8642 CVE-2014-8643 Affected Products: openSUSE 13.2 ______________________________________________________________________________ An update that fixes 10 vulnerabilities is now available. Description: MozillaFirefox was updated to version 35.0 (bnc#910669) Notable features: * Firefox Hello with new rooms-based conversations model * Implemented HTTP Public Key Pinning Extension (for enhanced authentication of encrypted connections) Security fixes: * MFSA 2015-01/CVE-2014-8634/CVE-2014-8635 Miscellaneous memory safety hazards * MFSA 2015-02/CVE-2014-8637 (bmo#1094536) Uninitialized memory use during bitmap rendering * MFSA 2015-03/CVE-2014-8638 (bmo#1080987) sendBeacon requests lack an Origin header * MFSA 2015-04/CVE-2014-8639 (bmo#1095859) Cookie injection through Proxy Authenticate responses * MFSA 2015-05/CVE-2014-8640 (bmo#1100409) Read of uninitialized memory in Web Audio * MFSA 2015-06/CVE-2014-8641 (bmo#1108455) Read-after-free in WebRTC * MFSA 2015-07/CVE-2014-8643 (bmo#1114170) (Windows-only) Gecko Media Plugin sandbox escape * MFSA 2015-08/CVE-2014-8642 (bmo#1079658) Delegated OCSP responder certificates failure with id-pkix-ocsp-nocheck extension * MFSA 2015-09/CVE-2014-8636 (bmo#987794) XrayWrapper bypass through DOM objects - obsolete tracker-miner-firefox < 0.15 because it leads to startup crashes (bnc#908892) Patch Instructions: To install this openSUSE Security Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE 13.2: zypper in -t patch openSUSE-2015-40 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE 13.2 (i586 x86_64): MozillaFirefox-35.0-9.1 MozillaFirefox-branding-upstream-35.0-9.1 MozillaFirefox-buildsymbols-35.0-9.1 MozillaFirefox-debuginfo-35.0-9.1 MozillaFirefox-debugsource-35.0-9.1 MozillaFirefox-devel-35.0-9.1 MozillaFirefox-translations-common-35.0-9.1 MozillaFirefox-translations-other-35.0-9.1 References: http://support.novell.com/security/cve/CVE-2014-8634.html http://support.novell.com/security/cve/CVE-2014-8635.html http://support.novell.com/security/cve/CVE-2014-8636.html http://support.novell.com/security/cve/CVE-2014-8637.html http://support.novell.com/security/cve/CVE-2014-8638.html http://support.novell.com/security/cve/CVE-2014-8639.html http://support.novell.com/security/cve/CVE-2014-8640.html http://support.novell.com/security/cve/CVE-2014-8641.html http://support.novell.com/security/cve/CVE-2014-8642.html http://support.novell.com/security/cve/CVE-2014-8643.html https://bugzilla.suse.com/show_bug.cgi?id=908892 https://bugzilla.suse.com/show_bug.cgi?id=910669 -- To unsubscribe, e-mail: opensuse-security-announce+unsubscribe(a)opensuse.org For additional commands, e-mail: opensuse-security-announce+help(a)opensuse.org

1 0

[security-announce] openSUSE-SU-2015:0077-1: important: Security update for MozillaFirefox
by opensuse-security＠opensuse.org 19 Jan '15

19 Jan '15

openSUSE Security Update: Security update for MozillaFirefox ______________________________________________________________________________ Announcement ID: openSUSE-SU-2015:0077-1 Rating: important References: #908892 #910669 Cross-References: CVE-2014-8634 CVE-2014-8635 CVE-2014-8636 CVE-2014-8637 CVE-2014-8638 CVE-2014-8639 CVE-2014-8640 CVE-2014-8641 CVE-2014-8642 CVE-2014-8643 Affected Products: openSUSE 13.1 ______________________________________________________________________________ An update that fixes 10 vulnerabilities is now available. Description: MozillaFirefox was updated to version 35.0 (bnc#910669) Notable features: * Firefox Hello with new rooms-based conversations model * Implemented HTTP Public Key Pinning Extension (for enhanced authentication of encrypted connections) Security fixes: * MFSA 2015-01/CVE-2014-8634/CVE-2014-8635 Miscellaneous memory safety hazards * MFSA 2015-02/CVE-2014-8637 (bmo#1094536) Uninitialized memory use during bitmap rendering * MFSA 2015-03/CVE-2014-8638 (bmo#1080987) sendBeacon requests lack an Origin header * MFSA 2015-04/CVE-2014-8639 (bmo#1095859) Cookie injection through Proxy Authenticate responses * MFSA 2015-05/CVE-2014-8640 (bmo#1100409) Read of uninitialized memory in Web Audio * MFSA 2015-06/CVE-2014-8641 (bmo#1108455) Read-after-free in WebRTC * MFSA 2015-07/CVE-2014-8643 (bmo#1114170) (Windows-only) Gecko Media Plugin sandbox escape * MFSA 2015-08/CVE-2014-8642 (bmo#1079658) Delegated OCSP responder certificates failure with id-pkix-ocsp-nocheck extension * MFSA 2015-09/CVE-2014-8636 (bmo#987794) XrayWrapper bypass through DOM objects - obsolete tracker-miner-firefox < 0.15 because it leads to startup crashes (bnc#908892) Patch Instructions: To install this openSUSE Security Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE 13.1: zypper in -t patch openSUSE-2015-40 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE 13.1 (i586 x86_64): MozillaFirefox-35.0-54.2 MozillaFirefox-branding-upstream-35.0-54.2 MozillaFirefox-buildsymbols-35.0-54.2 MozillaFirefox-debuginfo-35.0-54.2 MozillaFirefox-debugsource-35.0-54.2 MozillaFirefox-devel-35.0-54.2 MozillaFirefox-translations-common-35.0-54.2 MozillaFirefox-translations-other-35.0-54.2 References: http://support.novell.com/security/cve/CVE-2014-8634.html http://support.novell.com/security/cve/CVE-2014-8635.html http://support.novell.com/security/cve/CVE-2014-8636.html http://support.novell.com/security/cve/CVE-2014-8637.html http://support.novell.com/security/cve/CVE-2014-8638.html http://support.novell.com/security/cve/CVE-2014-8639.html http://support.novell.com/security/cve/CVE-2014-8640.html http://support.novell.com/security/cve/CVE-2014-8641.html http://support.novell.com/security/cve/CVE-2014-8642.html http://support.novell.com/security/cve/CVE-2014-8643.html https://bugzilla.suse.com/show_bug.cgi?id=908892 https://bugzilla.suse.com/show_bug.cgi?id=910669 -- To unsubscribe, e-mail: opensuse-security-announce+unsubscribe(a)opensuse.org For additional commands, e-mail: opensuse-security-announce+help(a)opensuse.org

1 0

[security-announce] SUSE-SU-2015:0076-1: important: Security update for MozillaFirefox
by opensuse-security＠opensuse.org 19 Jan '15

19 Jan '15

SUSE Security Update: Security update for MozillaFirefox ______________________________________________________________________________ Announcement ID: SUSE-SU-2015:0076-1 Rating: important References: #909563 #910647 #910669 Cross-References: CVE-2014-1569 CVE-2014-8634 CVE-2014-8635 CVE-2014-8638 CVE-2014-8639 CVE-2014-8641 Affected Products: SUSE Linux Enterprise Software Development Kit 12 SUSE Linux Enterprise Server 12 SUSE Linux Enterprise Desktop 12 ______________________________________________________________________________ An update that fixes 6 vulnerabilities is now available. Description: This update fixes the following security issues in MozillaFirefox: - MFSA 2015-01/CVE-2014-8634/CVE-2014-8635 (bmo#1109889, bmo#1111737, bmo#1026774, bmo#1027300, bmo#1054538, bmo#1067473, bmo#1070962, bmo#1072130, bmo#1072871, bmo#1098583) Miscellaneous memory safety hazards (rv:35.0 / rv:31.4) - MFSA 2015-03/CVE-2014-8638 (bmo#1080987) sendBeacon requests lack an Origin header - MFSA 2015-04/CVE-2014-8639 (bmo#1095859) Cookie injection through Proxy Authenticate responses - MFSA 2015-06/CVE-2014-8641 (bmo#1108455) Read-after-free in WebRTC Also Mozilla NSS was updated to 3.17.3 to fix: * The QuickDER decoder now decodes lengths robustly (bmo#1064670/CVE-2014-1569) * Support for TLS_FALLBACK_SCSV has been added to the ssltap and tstclnt utilities * Changes in CA certificates Patch Instructions: To install this SUSE Security Update use YaST online_update. Alternatively you can run the command listed for your product: - SUSE Linux Enterprise Software Development Kit 12: zypper in -t patch SUSE-SLE-SDK-12-2015-26 - SUSE Linux Enterprise Server 12: zypper in -t patch SUSE-SLE-SERVER-12-2015-26 - SUSE Linux Enterprise Desktop 12: zypper in -t patch SUSE-SLE-DESKTOP-12-2015-26 To bring your system up-to-date, use "zypper patch". Package List: - SUSE Linux Enterprise Software Development Kit 12 (ppc64le s390x x86_64): MozillaFirefox-debuginfo-31.4.0esr-20.1 MozillaFirefox-debugsource-31.4.0esr-20.1 MozillaFirefox-devel-31.4.0esr-20.1 mozilla-nss-debuginfo-3.17.3-16.1 mozilla-nss-debugsource-3.17.3-16.1 mozilla-nss-devel-3.17.3-16.1 - SUSE Linux Enterprise Server 12 (ppc64le s390x x86_64): MozillaFirefox-31.4.0esr-20.1 MozillaFirefox-debuginfo-31.4.0esr-20.1 MozillaFirefox-debugsource-31.4.0esr-20.1 MozillaFirefox-translations-31.4.0esr-20.1 libfreebl3-3.17.3-16.1 libfreebl3-debuginfo-3.17.3-16.1 libfreebl3-hmac-3.17.3-16.1 libsoftokn3-3.17.3-16.1 libsoftokn3-debuginfo-3.17.3-16.1 libsoftokn3-hmac-3.17.3-16.1 mozilla-nss-3.17.3-16.1 mozilla-nss-certs-3.17.3-16.1 mozilla-nss-certs-debuginfo-3.17.3-16.1 mozilla-nss-debuginfo-3.17.3-16.1 mozilla-nss-debugsource-3.17.3-16.1 mozilla-nss-tools-3.17.3-16.1 mozilla-nss-tools-debuginfo-3.17.3-16.1 - SUSE Linux Enterprise Server 12 (s390x x86_64): libfreebl3-32bit-3.17.3-16.1 libfreebl3-debuginfo-32bit-3.17.3-16.1 libfreebl3-hmac-32bit-3.17.3-16.1 libsoftokn3-32bit-3.17.3-16.1 libsoftokn3-debuginfo-32bit-3.17.3-16.1 libsoftokn3-hmac-32bit-3.17.3-16.1 mozilla-nss-32bit-3.17.3-16.1 mozilla-nss-certs-32bit-3.17.3-16.1 mozilla-nss-certs-debuginfo-32bit-3.17.3-16.1 mozilla-nss-debuginfo-32bit-3.17.3-16.1 - SUSE Linux Enterprise Desktop 12 (x86_64): MozillaFirefox-31.4.0esr-20.1 MozillaFirefox-debuginfo-31.4.0esr-20.1 MozillaFirefox-debugsource-31.4.0esr-20.1 MozillaFirefox-translations-31.4.0esr-20.1 libfreebl3-3.17.3-16.1 libfreebl3-32bit-3.17.3-16.1 libfreebl3-debuginfo-3.17.3-16.1 libfreebl3-debuginfo-32bit-3.17.3-16.1 libsoftokn3-3.17.3-16.1 libsoftokn3-32bit-3.17.3-16.1 libsoftokn3-debuginfo-3.17.3-16.1 libsoftokn3-debuginfo-32bit-3.17.3-16.1 mozilla-nss-3.17.3-16.1 mozilla-nss-32bit-3.17.3-16.1 mozilla-nss-certs-3.17.3-16.1 mozilla-nss-certs-32bit-3.17.3-16.1 mozilla-nss-certs-debuginfo-3.17.3-16.1 mozilla-nss-certs-debuginfo-32bit-3.17.3-16.1 mozilla-nss-debuginfo-3.17.3-16.1 mozilla-nss-debuginfo-32bit-3.17.3-16.1 mozilla-nss-debugsource-3.17.3-16.1 mozilla-nss-tools-3.17.3-16.1 mozilla-nss-tools-debuginfo-3.17.3-16.1 References: http://support.novell.com/security/cve/CVE-2014-1569.html http://support.novell.com/security/cve/CVE-2014-8634.html http://support.novell.com/security/cve/CVE-2014-8635.html http://support.novell.com/security/cve/CVE-2014-8638.html http://support.novell.com/security/cve/CVE-2014-8639.html http://support.novell.com/security/cve/CVE-2014-8641.html https://bugzilla.suse.com/show_bug.cgi?id=909563 https://bugzilla.suse.com/show_bug.cgi?id=910647 https://bugzilla.suse.com/show_bug.cgi?id=910669 -- To unsubscribe, e-mail: opensuse-security-announce+unsubscribe(a)opensuse.org For additional commands, e-mail: opensuse-security-announce+help(a)opensuse.org

1 0

[security-announce] Upcoming update for shim requires confirmation on reboot
by Johannes Segitz 16 Jan '15

16 Jan '15

Hello, we will release a security update for shim next week that fixes three security issues, tracked in bnc#889332: - OOB read access when parsing DHCPv6 packets (remote DoS) (CVE-2014-3675). - Heap overflow when parsing IPv6 addresses provided by tftp:// DHCPv6 boot option (RCE) (CVE-2014-3676). - Memory corruption when processing user provided MOK lists (CVE-2014-3677). Because of those issues we update shim to version 0.7.318.81ee561d. This version includes a patch that requires the user to confirm a dialog once on the first boot after the update is installed. You will need to be able to confirm this dialog, which appears before the bootloader, or your system will not boot. This only affects users that are still on openSUSE 13.1 and use a secure boot setup. You can check with 'bootctl' if you're using a secure boot configuration if you're not sure. Best regards, Johannes Segitz -- GPG Key E7C81FA0 EE16 6BCE AD56 E034 BFB3 3ADD 7BF7 29D5 E7C8 1FA0 Subkey fingerprint: 250F 43F5 F7CE 6F1E 9C59 4F95 BC27 DD9D 2CC4 FD66 SUSE LINUX GmbH Maxfeldstraße 5 90409 Nürnberg, Germany GF: Felix Imendörffer, Jane Smithard, Jennifer Guild, Dilip Upmanyu, Graham Norton, HRB 21284 (AG Nürnberg)

1 0