January 2015 - openSUSE Security Announce

[security-announce] openSUSE-SU-2015:0150-1: critical: Security update for flash-player
by opensuse-security＠opensuse.org 27 Jan '15

27 Jan '15

openSUSE Security Update: Security update for flash-player ______________________________________________________________________________ Announcement ID: openSUSE-SU-2015:0150-1 Rating: critical References: #914463 Cross-References: CVE-2015-0311 Affected Products: openSUSE 13.2:NonFree openSUSE 13.1:NonFree ______________________________________________________________________________ An update that fixes one vulnerability is now available. Description: Adobe Flash Player was updated to 11.2.202.440 (bsc#914463, APSA15-01, CVE-2015-0311). More information can be found on https://helpx.adobe.com/security/products/flash-player/apsa15-01.html An update of flashplayer (executable binary) for i386 is currently not available. Disabled! Patch Instructions: To install this openSUSE Security Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE 13.2:NonFree: zypper in -t patch openSUSE-2015-78 - openSUSE 13.1:NonFree: zypper in -t patch openSUSE-2015-78 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE 13.2:NonFree (i586 x86_64): flash-player-11.2.202.440-2.29.1 flash-player-gnome-11.2.202.440-2.29.1 flash-player-kde4-11.2.202.440-2.29.1 - openSUSE 13.1:NonFree (i586 x86_64): flash-player-11.2.202.440-94.1 flash-player-gnome-11.2.202.440-94.1 flash-player-kde4-11.2.202.440-94.1 References: http://support.novell.com/security/cve/CVE-2015-0311.html https://bugzilla.suse.com/show_bug.cgi?id=914463 -- To unsubscribe, e-mail: opensuse-security-announce+unsubscribe(a)opensuse.org For additional commands, e-mail: opensuse-security-announce+help(a)opensuse.org

1 0

[security-announce] openSUSE-SU-2015:0147-1: critical: update for Flash player
by opensuse-security＠opensuse.org 26 Jan '15

26 Jan '15

openSUSE Security Update: update for Flash player ______________________________________________________________________________ Announcement ID: openSUSE-SU-2015:0147-1 Rating: critical References: Cross-References: 2015-0310 2015-0311 Affected Products: openSUSE Evergreen 11.4 ______________________________________________________________________________ An update that fixes two vulnerabilities is now available. Description: This update for Flash player fixes known security issues. Patch Instructions: To install this openSUSE Security Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE Evergreen 11.4: zypper in -t patch 2015-5 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE Evergreen 11.4 (i586 x86_64): flash-player-11.2.202.440-143.1 flash-player-gnome-11.2.202.440-143.1 flash-player-kde4-11.2.202.440-143.1 References: http://support.novell.com/security/cve/2015-0310.html http://support.novell.com/security/cve/2015-0311.html -- To unsubscribe, e-mail: opensuse-security-announce+unsubscribe(a)opensuse.org For additional commands, e-mail: opensuse-security-announce+help(a)opensuse.org

1 0

[security-announce] openSUSE-SU-2015:0138-1: important: Firefox update to latest 31ESR release
by opensuse-security＠opensuse.org 25 Jan '15

25 Jan '15

openSUSE Security Update: Firefox update to latest 31ESR release ______________________________________________________________________________ Announcement ID: openSUSE-SU-2015:0138-1 Rating: important References: #876833 #894370 #900639 #900941 #908009 #910669 Cross-References: 2013-5611 2013-5612 2013-5614 2013-5619 2013-6672 2014-1480 2014-1483 2014-1484 2014-1485 2014-1488 2014-1489 2014-1492 2014-1498 2014-1499 2014-1500 2014-1502 2014-1504 2014-1519 2014-1522 2014-1525 2014-1526 2014-1528 2014-1539 2014-1540 2014-1542 2014-1543 2014-1549 2014-1550 2014-1552 2014-1553 2014-1558 2014-1559 2014-1560 2014-1561 2014-1563 2014-1564 2014-1565 2014-1574 2014-1576 2014-1577 2014-1578 2014-1581 2014-1583 2014-1585 2014-1586 2014-1587 2014-1590 2014-1592 2014-1593 2014-1594 2014-8634 2014-8635 2014-8638 2014-8639 2014-8641 CVE-2014-1553 CVE-2014-1562 CVE-2014-1563 CVE-2014-1564 CVE-2014-1565 CVE-2014-1567 CVE-2014-1569 CVE-2014-1574 CVE-2014-1576 CVE-2014-1577 CVE-2014-1578 CVE-2014-1581 CVE-2014-1585 CVE-2014-1586 CVE-2014-1587 CVE-2014-1590 CVE-2014-1592 CVE-2014-1593 CVE-2014-1594 Affected Products: openSUSE Evergreen 11.4 ______________________________________________________________________________ An update that fixes 74 vulnerabilities is now available. Description: This update lifts Firefox to the latest 31 ESR release to fix known security issues. Patch Instructions: To install this openSUSE Security Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE Evergreen 11.4: zypper in -t patch 2015-4 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE Evergreen 11.4 (i586 x86_64): MozillaFirefox-31.4.0-133.1 MozillaFirefox-branding-upstream-31.4.0-133.1 MozillaFirefox-buildsymbols-31.4.0-133.1 MozillaFirefox-debuginfo-31.4.0-133.1 MozillaFirefox-debugsource-31.4.0-133.1 MozillaFirefox-devel-31.4.0-133.1 MozillaFirefox-translations-common-31.4.0-133.1 MozillaFirefox-translations-other-31.4.0-133.1 libfreebl3-3.17.3-104.1 libfreebl3-debuginfo-3.17.3-104.1 libsoftokn3-3.17.3-104.1 libsoftokn3-debuginfo-3.17.3-104.1 mozilla-nspr-4.10.7-49.1 mozilla-nspr-debuginfo-4.10.7-49.1 mozilla-nspr-debugsource-4.10.7-49.1 mozilla-nspr-devel-4.10.7-49.1 mozilla-nss-3.17.3-104.1 mozilla-nss-certs-3.17.3-104.1 mozilla-nss-certs-debuginfo-3.17.3-104.1 mozilla-nss-debuginfo-3.17.3-104.1 mozilla-nss-debugsource-3.17.3-104.1 mozilla-nss-devel-3.17.3-104.1 mozilla-nss-sysinit-3.17.3-104.1 mozilla-nss-sysinit-debuginfo-3.17.3-104.1 mozilla-nss-tools-3.17.3-104.1 mozilla-nss-tools-debuginfo-3.17.3-104.1 - openSUSE Evergreen 11.4 (x86_64): libfreebl3-32bit-3.17.3-104.1 libfreebl3-debuginfo-32bit-3.17.3-104.1 libsoftokn3-32bit-3.17.3-104.1 libsoftokn3-debuginfo-32bit-3.17.3-104.1 mozilla-nspr-32bit-4.10.7-49.1 mozilla-nspr-debuginfo-32bit-4.10.7-49.1 mozilla-nss-32bit-3.17.3-104.1 mozilla-nss-certs-32bit-3.17.3-104.1 mozilla-nss-certs-debuginfo-32bit-3.17.3-104.1 mozilla-nss-debuginfo-32bit-3.17.3-104.1 mozilla-nss-sysinit-32bit-3.17.3-104.1 mozilla-nss-sysinit-debuginfo-32bit-3.17.3-104.1 - openSUSE Evergreen 11.4 (ia64): libfreebl3-debuginfo-x86-3.17.3-104.1 libfreebl3-x86-3.17.3-104.1 libsoftokn3-debuginfo-x86-3.17.3-104.1 libsoftokn3-x86-3.17.3-104.1 mozilla-nspr-debuginfo-x86-4.10.7-49.1 mozilla-nspr-x86-4.10.7-49.1 mozilla-nss-certs-debuginfo-x86-3.17.3-104.1 mozilla-nss-certs-x86-3.17.3-104.1 mozilla-nss-debuginfo-x86-3.17.3-104.1 mozilla-nss-sysinit-debuginfo-x86-3.17.3-104.1 mozilla-nss-sysinit-x86-3.17.3-104.1 mozilla-nss-x86-3.17.3-104.1 References: http://support.novell.com/security/cve/2013-5611.html http://support.novell.com/security/cve/2013-5612.html http://support.novell.com/security/cve/2013-5614.html http://support.novell.com/security/cve/2013-5619.html http://support.novell.com/security/cve/2013-6672.html http://support.novell.com/security/cve/2014-1480.html http://support.novell.com/security/cve/2014-1483.html http://support.novell.com/security/cve/2014-1484.html http://support.novell.com/security/cve/2014-1485.html http://support.novell.com/security/cve/2014-1488.html http://support.novell.com/security/cve/2014-1489.html http://support.novell.com/security/cve/2014-1492.html http://support.novell.com/security/cve/2014-1498.html http://support.novell.com/security/cve/2014-1499.html http://support.novell.com/security/cve/2014-1500.html http://support.novell.com/security/cve/2014-1502.html http://support.novell.com/security/cve/2014-1504.html http://support.novell.com/security/cve/2014-1519.html http://support.novell.com/security/cve/2014-1522.html http://support.novell.com/security/cve/2014-1525.html http://support.novell.com/security/cve/2014-1526.html http://support.novell.com/security/cve/2014-1528.html http://support.novell.com/security/cve/2014-1539.html http://support.novell.com/security/cve/2014-1540.html http://support.novell.com/security/cve/2014-1542.html http://support.novell.com/security/cve/2014-1543.html http://support.novell.com/security/cve/2014-1549.html http://support.novell.com/security/cve/2014-1550.html http://support.novell.com/security/cve/2014-1552.html http://support.novell.com/security/cve/2014-1553.html http://support.novell.com/security/cve/2014-1558.html http://support.novell.com/security/cve/2014-1559.html http://support.novell.com/security/cve/2014-1560.html http://support.novell.com/security/cve/2014-1561.html http://support.novell.com/security/cve/2014-1563.html http://support.novell.com/security/cve/2014-1564.html http://support.novell.com/security/cve/2014-1565.html http://support.novell.com/security/cve/2014-1574.html http://support.novell.com/security/cve/2014-1576.html http://support.novell.com/security/cve/2014-1577.html http://support.novell.com/security/cve/2014-1578.html http://support.novell.com/security/cve/2014-1581.html http://support.novell.com/security/cve/2014-1583.html http://support.novell.com/security/cve/2014-1585.html http://support.novell.com/security/cve/2014-1586.html http://support.novell.com/security/cve/2014-1587.html http://support.novell.com/security/cve/2014-1590.html http://support.novell.com/security/cve/2014-1592.html http://support.novell.com/security/cve/2014-1593.html http://support.novell.com/security/cve/2014-1594.html http://support.novell.com/security/cve/2014-8634.html http://support.novell.com/security/cve/2014-8635.html http://support.novell.com/security/cve/2014-8638.html http://support.novell.com/security/cve/2014-8639.html http://support.novell.com/security/cve/2014-8641.html http://support.novell.com/security/cve/CVE-2014-1553.html http://support.novell.com/security/cve/CVE-2014-1562.html http://support.novell.com/security/cve/CVE-2014-1563.html http://support.novell.com/security/cve/CVE-2014-1564.html http://support.novell.com/security/cve/CVE-2014-1565.html http://support.novell.com/security/cve/CVE-2014-1567.html http://support.novell.com/security/cve/CVE-2014-1569.html http://support.novell.com/security/cve/CVE-2014-1574.html http://support.novell.com/security/cve/CVE-2014-1576.html http://support.novell.com/security/cve/CVE-2014-1577.html http://support.novell.com/security/cve/CVE-2014-1578.html http://support.novell.com/security/cve/CVE-2014-1581.html http://support.novell.com/security/cve/CVE-2014-1585.html http://support.novell.com/security/cve/CVE-2014-1586.html http://support.novell.com/security/cve/CVE-2014-1587.html http://support.novell.com/security/cve/CVE-2014-1590.html http://support.novell.com/security/cve/CVE-2014-1592.html http://support.novell.com/security/cve/CVE-2014-1593.html http://support.novell.com/security/cve/CVE-2014-1594.html https://bugzilla.suse.com/show_bug.cgi?id=876833 https://bugzilla.suse.com/show_bug.cgi?id=894370 https://bugzilla.suse.com/show_bug.cgi?id=900639 https://bugzilla.suse.com/show_bug.cgi?id=900941 https://bugzilla.suse.com/show_bug.cgi?id=908009 https://bugzilla.suse.com/show_bug.cgi?id=910669 -- To unsubscribe, e-mail: opensuse-security-announce+unsubscribe(a)opensuse.org For additional commands, e-mail: opensuse-security-announce+help(a)opensuse.org

1 0

[security-announce] SUSE-SU-2015:0136-1: important: Security update for vsftpd
by opensuse-security＠opensuse.org 24 Jan '15

24 Jan '15

SUSE Security Update: Security update for vsftpd ______________________________________________________________________________ Announcement ID: SUSE-SU-2015:0136-1 Rating: important References: #900326 Affected Products: SUSE Linux Enterprise Server 11 SP3 for VMware SUSE Linux Enterprise Server 11 SP3 ______________________________________________________________________________ An update that contains security fixes can now be installed. Description: The vsftp daemon was not handling the "deny_file" option properly, allowing unauthorized access in some specific scenarios.(bnc#900326). Patch Instructions: To install this SUSE Security Update use YaST online_update. Alternatively you can run the command listed for your product: - SUSE Linux Enterprise Server 11 SP3 for VMware: zypper in -t patch slessp3-vsftpd-10161 - SUSE Linux Enterprise Server 11 SP3: zypper in -t patch slessp3-vsftpd-10161 To bring your system up-to-date, use "zypper patch". Package List: - SUSE Linux Enterprise Server 11 SP3 for VMware (i586 x86_64): vsftpd-2.0.7-4.27.1 - SUSE Linux Enterprise Server 11 SP3 (i586 ia64 ppc64 s390x x86_64): vsftpd-2.0.7-4.27.1 References: https://bugzilla.suse.com/show_bug.cgi?id=900326 http://download.suse.com/patch/finder/?keywords=c6526212ede876aeb795aefc7af… -- To unsubscribe, e-mail: opensuse-security-announce+unsubscribe(a)opensuse.org For additional commands, e-mail: opensuse-security-announce+help(a)opensuse.org

1 0

[security-announce] SUSE-SU-2015:0135-1: critical: Security update for flash-player
by opensuse-security＠opensuse.org 24 Jan '15

24 Jan '15

SUSE Security Update: Security update for flash-player ______________________________________________________________________________ Announcement ID: SUSE-SU-2015:0135-1 Rating: critical References: #914333 Cross-References: CVE-2015-0310 Affected Products: SUSE Linux Enterprise Desktop 11 SP3 ______________________________________________________________________________ An update that fixes one vulnerability is now available. It includes one version update. Description: Adobe Flash Player was updated to version 11.2.202.438 to fix one security issue. (APSB15-02, CVE-2015-0310) For more details refer to the vendor advisory at http://helpx.adobe.com/security/products/flash-player/apsb15-02.html <http://helpx.adobe.com/security/products/flash-player/apsb15-02.html> . Security Issues: * CVE-2015-0310 <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2015-0310> Patch Instructions: To install this SUSE Security Update use YaST online_update. Alternatively you can run the command listed for your product: - SUSE Linux Enterprise Desktop 11 SP3: zypper in -t patch sledsp3-flash-player-10215 To bring your system up-to-date, use "zypper patch". Package List: - SUSE Linux Enterprise Desktop 11 SP3 (i586 x86_64) [New Version: 11.2.202.438]: flash-player-11.2.202.438-0.3.1 flash-player-gnome-11.2.202.438-0.3.1 flash-player-kde4-11.2.202.438-0.3.1 References: http://support.novell.com/security/cve/CVE-2015-0310.html https://bugzilla.suse.com/show_bug.cgi?id=914333 http://download.suse.com/patch/finder/?keywords=23c46c7c451b73f11ea60613d28… -- To unsubscribe, e-mail: opensuse-security-announce+unsubscribe(a)opensuse.org For additional commands, e-mail: opensuse-security-announce+help(a)opensuse.org

1 0

[security-announce] openSUSE-SU-2015:0130-1: important: Security update for openssl
by opensuse-security＠opensuse.org 23 Jan '15

23 Jan '15

openSUSE Security Update: Security update for openssl ______________________________________________________________________________ Announcement ID: openSUSE-SU-2015:0130-1 Rating: important References: #911399 #912014 #912015 #912018 #912292 #912293 #912294 #912296 Cross-References: CVE-2014-3569 CVE-2014-3570 CVE-2014-3571 CVE-2014-3572 CVE-2014-8275 CVE-2015-0204 CVE-2015-0205 CVE-2015-0206 Affected Products: openSUSE 13.2 openSUSE 13.1 ______________________________________________________________________________ An update that fixes 8 vulnerabilities is now available. Description: openssl was updated to 1.0.1k to fix various security issues and bugs. More information can be found in the openssl advisory: http://openssl.org/news/secadv_20150108.txt Following issues were fixed: * CVE-2014-3570 (bsc#912296): Bignum squaring (BN_sqr) may have produced incorrect results on some platforms, including x86_64. * CVE-2014-3571 (bsc#912294): Fixed crash in dtls1_get_record whilst in the listen state where you get two separate reads performed - one for the header and one for the body of the handshake record. * CVE-2014-3572 (bsc#912015): Don't accept a handshake using an ephemeral ECDH ciphersuites with the server key exchange message omitted. * CVE-2014-8275 (bsc#912018): Fixed various certificate fingerprint issues. * CVE-2015-0204 (bsc#912014): Only allow ephemeral RSA keys in export ciphersuites * CVE-2015-0205 (bsc#912293): A fixwas added to prevent use of DH client certificates without sending certificate verify message. * CVE-2015-0206 (bsc#912292): A memory leak was fixed in dtls1_buffer_record. Patch Instructions: To install this openSUSE Security Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE 13.2: zypper in -t patch openSUSE-2015-67 - openSUSE 13.1: zypper in -t patch openSUSE-2015-67 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE 13.2 (i586 x86_64): libopenssl-devel-1.0.1k-2.16.2 libopenssl1_0_0-1.0.1k-2.16.2 libopenssl1_0_0-debuginfo-1.0.1k-2.16.2 libopenssl1_0_0-hmac-1.0.1k-2.16.2 openssl-1.0.1k-2.16.2 openssl-debuginfo-1.0.1k-2.16.2 openssl-debugsource-1.0.1k-2.16.2 - openSUSE 13.2 (x86_64): libopenssl-devel-32bit-1.0.1k-2.16.2 libopenssl1_0_0-32bit-1.0.1k-2.16.2 libopenssl1_0_0-debuginfo-32bit-1.0.1k-2.16.2 libopenssl1_0_0-hmac-32bit-1.0.1k-2.16.2 - openSUSE 13.2 (noarch): openssl-doc-1.0.1k-2.16.2 - openSUSE 13.1 (i586 x86_64): libopenssl-devel-1.0.1k-11.64.2 libopenssl1_0_0-1.0.1k-11.64.2 libopenssl1_0_0-debuginfo-1.0.1k-11.64.2 openssl-1.0.1k-11.64.2 openssl-debuginfo-1.0.1k-11.64.2 openssl-debugsource-1.0.1k-11.64.2 - openSUSE 13.1 (x86_64): libopenssl-devel-32bit-1.0.1k-11.64.2 libopenssl1_0_0-32bit-1.0.1k-11.64.2 libopenssl1_0_0-debuginfo-32bit-1.0.1k-11.64.2 - openSUSE 13.1 (noarch): openssl-doc-1.0.1k-11.64.2 References: http://support.novell.com/security/cve/CVE-2014-3569.html http://support.novell.com/security/cve/CVE-2014-3570.html http://support.novell.com/security/cve/CVE-2014-3571.html http://support.novell.com/security/cve/CVE-2014-3572.html http://support.novell.com/security/cve/CVE-2014-8275.html http://support.novell.com/security/cve/CVE-2015-0204.html http://support.novell.com/security/cve/CVE-2015-0205.html http://support.novell.com/security/cve/CVE-2015-0206.html https://bugzilla.suse.com/show_bug.cgi?id=911399 https://bugzilla.suse.com/show_bug.cgi?id=912014 https://bugzilla.suse.com/show_bug.cgi?id=912015 https://bugzilla.suse.com/show_bug.cgi?id=912018 https://bugzilla.suse.com/show_bug.cgi?id=912292 https://bugzilla.suse.com/show_bug.cgi?id=912293 https://bugzilla.suse.com/show_bug.cgi?id=912294 https://bugzilla.suse.com/show_bug.cgi?id=912296 -- To unsubscribe, e-mail: opensuse-security-announce+unsubscribe(a)opensuse.org For additional commands, e-mail: opensuse-security-announce+help(a)opensuse.org

1 0

[security-announce] SUSE-SU-2015:0129-1: critical: Security update for flash-player
by opensuse-security＠opensuse.org 23 Jan '15

23 Jan '15

SUSE Security Update: Security update for flash-player ______________________________________________________________________________ Announcement ID: SUSE-SU-2015:0129-1 Rating: critical References: #914333 Cross-References: CVE-2015-0310 Affected Products: SUSE Linux Enterprise Workstation Extension 12 SUSE Linux Enterprise Desktop 12 ______________________________________________________________________________ An update that fixes one vulnerability is now available. Description: Adobe Flash Player was updated to 11.2.202.438 to fix one security isssue. http://helpx.adobe.com/security/products/flash-player/apsb15-02.html (APSB15-02, CVE-2015-0310) Patch Instructions: To install this SUSE Security Update use YaST online_update. Alternatively you can run the command listed for your product: - SUSE Linux Enterprise Workstation Extension 12: zypper in -t patch SUSE-SLE-WE-12-2015-42 - SUSE Linux Enterprise Desktop 12: zypper in -t patch SUSE-SLE-DESKTOP-12-2015-42 To bring your system up-to-date, use "zypper patch". Package List: - SUSE Linux Enterprise Workstation Extension 12 (i586 x86_64): flash-player-11.2.202.438-27.1 flash-player-gnome-11.2.202.438-27.1 - SUSE Linux Enterprise Desktop 12 (i586 x86_64): flash-player-11.2.202.438-27.1 flash-player-gnome-11.2.202.438-27.1 References: http://support.novell.com/security/cve/CVE-2015-0310.html https://bugzilla.suse.com/show_bug.cgi?id=914333 -- To unsubscribe, e-mail: opensuse-security-announce+unsubscribe(a)opensuse.org For additional commands, e-mail: opensuse-security-announce+help(a)opensuse.org

1 0

[security-announce] openSUSE-SU-2015:0110-1: critical: Security update for flash-player
by opensuse-security＠opensuse.org 22 Jan '15

22 Jan '15

openSUSE Security Update: Security update for flash-player ______________________________________________________________________________ Announcement ID: openSUSE-SU-2015:0110-1 Rating: critical References: #914333 Cross-References: CVE-2015-0310 Affected Products: openSUSE 13.2:NonFree openSUSE 13.1:NonFree ______________________________________________________________________________ An update that fixes one vulnerability is now available. Description: Adobe Flash Player was updated to 11.2.202.438 to fix one security isssue. http://helpx.adobe.com/security/products/flash-player/apsb15-02.html (APSB15-02, CVE-2015-0310) Patch Instructions: To install this openSUSE Security Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE 13.2:NonFree: zypper in -t patch openSUSE-2015-49 - openSUSE 13.1:NonFree: zypper in -t patch openSUSE-2015-49 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE 13.2:NonFree (i586 x86_64): flash-player-11.2.202.438-2.25.1 flash-player-gnome-11.2.202.438-2.25.1 flash-player-kde4-11.2.202.438-2.25.1 - openSUSE 13.1:NonFree (i586 x86_64): flash-player-11.2.202.438-90.1 flash-player-gnome-11.2.202.438-90.1 flash-player-kde4-11.2.202.438-90.1 References: http://support.novell.com/security/cve/CVE-2015-0310.html https://bugzilla.suse.com/show_bug.cgi?id=914333 -- To unsubscribe, e-mail: opensuse-security-announce+unsubscribe(a)opensuse.org For additional commands, e-mail: opensuse-security-announce+help(a)opensuse.org

1 0

[security-announce] SUSE-SU-2015:0107-1: important: Security update for rpm
by opensuse-security＠opensuse.org 22 Jan '15

22 Jan '15

SUSE Security Update: Security update for rpm ______________________________________________________________________________ Announcement ID: SUSE-SU-2015:0107-1 Rating: important References: #892431 #906803 #908128 #911228 Cross-References: CVE-2013-6435 CVE-2014-8118 Affected Products: SUSE Linux Enterprise Software Development Kit 12 SUSE Linux Enterprise Server 12 SUSE Linux Enterprise Desktop 12 ______________________________________________________________________________ An update that solves two vulnerabilities and has two fixes is now available. Description: This rpm update fixes the following security and non-security issues: - bnc#908128: Check for bad invalid name sizes (CVE-2014-8118) - bnc#906803: Create files with mode 0 (CVE-2013-6435) - bnc#892431: Honor --noglob in install mode - bnc#911228: Fix noglob patch, it broke files with space. Patch Instructions: To install this SUSE Security Update use YaST online_update. Alternatively you can run the command listed for your product: - SUSE Linux Enterprise Software Development Kit 12: zypper in -t patch SUSE-SLE-SDK-12-2015-40 - SUSE Linux Enterprise Server 12: zypper in -t patch SUSE-SLE-SERVER-12-2015-40 - SUSE Linux Enterprise Desktop 12: zypper in -t patch SUSE-SLE-DESKTOP-12-2015-40 To bring your system up-to-date, use "zypper patch". Package List: - SUSE Linux Enterprise Software Development Kit 12 (ppc64le s390x x86_64): rpm-debuginfo-4.11.2-10.1 rpm-debugsource-4.11.2-10.1 rpm-devel-4.11.2-10.1 - SUSE Linux Enterprise Server 12 (ppc64le s390x x86_64): rpm-4.11.2-10.1 rpm-build-4.11.2-10.1 rpm-build-debuginfo-4.11.2-10.1 rpm-debuginfo-4.11.2-10.1 rpm-debugsource-4.11.2-10.1 rpm-python-4.11.2-10.1 rpm-python-debuginfo-4.11.2-10.1 rpm-python-debugsource-4.11.2-10.1 - SUSE Linux Enterprise Server 12 (s390x x86_64): rpm-32bit-4.11.2-10.1 rpm-debuginfo-32bit-4.11.2-10.1 - SUSE Linux Enterprise Desktop 12 (x86_64): rpm-32bit-4.11.2-10.1 rpm-4.11.2-10.1 rpm-build-4.11.2-10.1 rpm-build-debuginfo-4.11.2-10.1 rpm-debuginfo-32bit-4.11.2-10.1 rpm-debuginfo-4.11.2-10.1 rpm-debugsource-4.11.2-10.1 rpm-python-4.11.2-10.1 rpm-python-debuginfo-4.11.2-10.1 rpm-python-debugsource-4.11.2-10.1 References: http://support.novell.com/security/cve/CVE-2013-6435.html http://support.novell.com/security/cve/CVE-2014-8118.html https://bugzilla.suse.com/show_bug.cgi?id=892431 https://bugzilla.suse.com/show_bug.cgi?id=906803 https://bugzilla.suse.com/show_bug.cgi?id=908128 https://bugzilla.suse.com/show_bug.cgi?id=911228 -- To unsubscribe, e-mail: opensuse-security-announce+unsubscribe(a)opensuse.org For additional commands, e-mail: opensuse-security-announce+help(a)opensuse.org

1 0

[security-announce] SUSE-SU-2015:0096-1: important: Security update for bind
by opensuse-security＠opensuse.org 21 Jan '15

21 Jan '15

SUSE Security Update: Security update for bind ______________________________________________________________________________ Announcement ID: SUSE-SU-2015:0096-1 Rating: important References: #908994 Cross-References: CVE-2014-8500 Affected Products: SUSE Linux Enterprise Software Development Kit 12 SUSE Linux Enterprise Server 12 SUSE Linux Enterprise Desktop 12 ______________________________________________________________________________ An update that fixes one vulnerability is now available. Description: This update of bind to 9.9.6P1 fixes bugs and also the following security issue: A flaw in delegation handling could be exploited to put named into an infinite loop. This has been addressed by placing limits on the number of levels of recursion named will allow (default 7), and the number of iterative queries that it will send (default 50) before terminating a recursive query (CVE-2014-8500, bnc#908994). The recursion depth limit is configured via the "max-recursion-depth" option, and the query limit via the "max-recursion-queries" option. Also the rpz2 patch was removed as it is no longer maintained. Patch Instructions: To install this SUSE Security Update use YaST online_update. Alternatively you can run the command listed for your product: - SUSE Linux Enterprise Software Development Kit 12: zypper in -t patch SUSE-SLE-SDK-12-2015-36 - SUSE Linux Enterprise Server 12: zypper in -t patch SUSE-SLE-SERVER-12-2015-36 - SUSE Linux Enterprise Desktop 12: zypper in -t patch SUSE-SLE-DESKTOP-12-2015-36 To bring your system up-to-date, use "zypper patch". Package List: - SUSE Linux Enterprise Software Development Kit 12 (ppc64le s390x x86_64): bind-debuginfo-9.9.5P1-8.1 bind-debugsource-9.9.5P1-8.1 bind-devel-9.9.5P1-8.1 - SUSE Linux Enterprise Server 12 (ppc64le s390x x86_64): bind-9.9.5P1-8.1 bind-chrootenv-9.9.5P1-8.1 bind-debuginfo-9.9.5P1-8.1 bind-debugsource-9.9.5P1-8.1 bind-libs-9.9.5P1-8.1 bind-libs-debuginfo-9.9.5P1-8.1 bind-utils-9.9.5P1-8.1 bind-utils-debuginfo-9.9.5P1-8.1 - SUSE Linux Enterprise Server 12 (s390x x86_64): bind-libs-32bit-9.9.5P1-8.1 bind-libs-debuginfo-32bit-9.9.5P1-8.1 - SUSE Linux Enterprise Server 12 (noarch): bind-doc-9.9.5P1-8.1 - SUSE Linux Enterprise Desktop 12 (x86_64): bind-debuginfo-9.9.5P1-8.1 bind-debugsource-9.9.5P1-8.1 bind-libs-32bit-9.9.5P1-8.1 bind-libs-9.9.5P1-8.1 bind-libs-debuginfo-32bit-9.9.5P1-8.1 bind-libs-debuginfo-9.9.5P1-8.1 bind-utils-9.9.5P1-8.1 bind-utils-debuginfo-9.9.5P1-8.1 References: http://support.novell.com/security/cve/CVE-2014-8500.html https://bugzilla.suse.com/show_bug.cgi?id=908994 -- To unsubscribe, e-mail: opensuse-security-announce+unsubscribe(a)opensuse.org For additional commands, e-mail: opensuse-security-announce+help(a)opensuse.org

1 0