January 2015 - openSUSE Security Announce

[security-announce] SUSE-SU-2015:0092-1: important: Security update for libpng16
by opensuse-security＠opensuse.org 20 Jan '15

20 Jan '15

SUSE Security Update: Security update for libpng16 ______________________________________________________________________________ Announcement ID: SUSE-SU-2015:0092-1 Rating: important References: #912076 #912929 Cross-References: CVE-2014-9495 CVE-2015-0973 Affected Products: SUSE Linux Enterprise Software Development Kit 12 SUSE Linux Enterprise Server 12 SUSE Linux Enterprise Desktop 12 ______________________________________________________________________________ An update that fixes two vulnerabilities is now available. Description: This update fixes the following security issues: * CVE-2014-9495: libpng versions heap overflow vulnerability, that under certain circumstances could be exploit. [bnc#912076] * CVE-2015-0973: A heap-based overflow was found in the png_combine_row() function of the libpng library, when very large interlaced images were used.[bnc#912929] Patch Instructions: To install this SUSE Security Update use YaST online_update. Alternatively you can run the command listed for your product: - SUSE Linux Enterprise Software Development Kit 12: zypper in -t patch SUSE-SLE-SDK-12-2015-33 - SUSE Linux Enterprise Server 12: zypper in -t patch SUSE-SLE-SERVER-12-2015-33 - SUSE Linux Enterprise Desktop 12: zypper in -t patch SUSE-SLE-DESKTOP-12-2015-33 To bring your system up-to-date, use "zypper patch". Package List: - SUSE Linux Enterprise Software Development Kit 12 (ppc64le s390x x86_64): libpng16-compat-devel-1.6.8-5.1 libpng16-debugsource-1.6.8-5.1 libpng16-devel-1.6.8-5.1 - SUSE Linux Enterprise Server 12 (ppc64le s390x x86_64): libpng16-16-1.6.8-5.1 libpng16-16-debuginfo-1.6.8-5.1 libpng16-debugsource-1.6.8-5.1 - SUSE Linux Enterprise Server 12 (s390x x86_64): libpng16-16-32bit-1.6.8-5.1 libpng16-16-debuginfo-32bit-1.6.8-5.1 - SUSE Linux Enterprise Desktop 12 (x86_64): libpng16-16-1.6.8-5.1 libpng16-16-32bit-1.6.8-5.1 libpng16-16-debuginfo-1.6.8-5.1 libpng16-16-debuginfo-32bit-1.6.8-5.1 libpng16-debugsource-1.6.8-5.1 References: http://support.novell.com/security/cve/CVE-2014-9495.html http://support.novell.com/security/cve/CVE-2015-0973.html https://bugzilla.suse.com/show_bug.cgi?id=912076 https://bugzilla.suse.com/show_bug.cgi?id=912929 -- To unsubscribe, e-mail: opensuse-security-announce+unsubscribe(a)opensuse.org For additional commands, e-mail: opensuse-security-announce+help(a)opensuse.org

1 0

[security-announce] openSUSE-SU-2015:0077-2: important: Security update for MozillaFirefox
by opensuse-security＠opensuse.org 19 Jan '15

19 Jan '15

openSUSE Security Update: Security update for MozillaFirefox ______________________________________________________________________________ Announcement ID: openSUSE-SU-2015:0077-2 Rating: important References: #908892 #910669 Cross-References: CVE-2014-8634 CVE-2014-8635 CVE-2014-8636 CVE-2014-8637 CVE-2014-8638 CVE-2014-8639 CVE-2014-8640 CVE-2014-8641 CVE-2014-8642 CVE-2014-8643 Affected Products: openSUSE 13.2 ______________________________________________________________________________ An update that fixes 10 vulnerabilities is now available. Description: MozillaFirefox was updated to version 35.0 (bnc#910669) Notable features: * Firefox Hello with new rooms-based conversations model * Implemented HTTP Public Key Pinning Extension (for enhanced authentication of encrypted connections) Security fixes: * MFSA 2015-01/CVE-2014-8634/CVE-2014-8635 Miscellaneous memory safety hazards * MFSA 2015-02/CVE-2014-8637 (bmo#1094536) Uninitialized memory use during bitmap rendering * MFSA 2015-03/CVE-2014-8638 (bmo#1080987) sendBeacon requests lack an Origin header * MFSA 2015-04/CVE-2014-8639 (bmo#1095859) Cookie injection through Proxy Authenticate responses * MFSA 2015-05/CVE-2014-8640 (bmo#1100409) Read of uninitialized memory in Web Audio * MFSA 2015-06/CVE-2014-8641 (bmo#1108455) Read-after-free in WebRTC * MFSA 2015-07/CVE-2014-8643 (bmo#1114170) (Windows-only) Gecko Media Plugin sandbox escape * MFSA 2015-08/CVE-2014-8642 (bmo#1079658) Delegated OCSP responder certificates failure with id-pkix-ocsp-nocheck extension * MFSA 2015-09/CVE-2014-8636 (bmo#987794) XrayWrapper bypass through DOM objects - obsolete tracker-miner-firefox < 0.15 because it leads to startup crashes (bnc#908892) Patch Instructions: To install this openSUSE Security Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE 13.2: zypper in -t patch openSUSE-2015-40 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE 13.2 (i586 x86_64): MozillaFirefox-35.0-9.1 MozillaFirefox-branding-upstream-35.0-9.1 MozillaFirefox-buildsymbols-35.0-9.1 MozillaFirefox-debuginfo-35.0-9.1 MozillaFirefox-debugsource-35.0-9.1 MozillaFirefox-devel-35.0-9.1 MozillaFirefox-translations-common-35.0-9.1 MozillaFirefox-translations-other-35.0-9.1 References: http://support.novell.com/security/cve/CVE-2014-8634.html http://support.novell.com/security/cve/CVE-2014-8635.html http://support.novell.com/security/cve/CVE-2014-8636.html http://support.novell.com/security/cve/CVE-2014-8637.html http://support.novell.com/security/cve/CVE-2014-8638.html http://support.novell.com/security/cve/CVE-2014-8639.html http://support.novell.com/security/cve/CVE-2014-8640.html http://support.novell.com/security/cve/CVE-2014-8641.html http://support.novell.com/security/cve/CVE-2014-8642.html http://support.novell.com/security/cve/CVE-2014-8643.html https://bugzilla.suse.com/show_bug.cgi?id=908892 https://bugzilla.suse.com/show_bug.cgi?id=910669 -- To unsubscribe, e-mail: opensuse-security-announce+unsubscribe(a)opensuse.org For additional commands, e-mail: opensuse-security-announce+help(a)opensuse.org

1 0

[security-announce] openSUSE-SU-2015:0077-1: important: Security update for MozillaFirefox
by opensuse-security＠opensuse.org 19 Jan '15

19 Jan '15

openSUSE Security Update: Security update for MozillaFirefox ______________________________________________________________________________ Announcement ID: openSUSE-SU-2015:0077-1 Rating: important References: #908892 #910669 Cross-References: CVE-2014-8634 CVE-2014-8635 CVE-2014-8636 CVE-2014-8637 CVE-2014-8638 CVE-2014-8639 CVE-2014-8640 CVE-2014-8641 CVE-2014-8642 CVE-2014-8643 Affected Products: openSUSE 13.1 ______________________________________________________________________________ An update that fixes 10 vulnerabilities is now available. Description: MozillaFirefox was updated to version 35.0 (bnc#910669) Notable features: * Firefox Hello with new rooms-based conversations model * Implemented HTTP Public Key Pinning Extension (for enhanced authentication of encrypted connections) Security fixes: * MFSA 2015-01/CVE-2014-8634/CVE-2014-8635 Miscellaneous memory safety hazards * MFSA 2015-02/CVE-2014-8637 (bmo#1094536) Uninitialized memory use during bitmap rendering * MFSA 2015-03/CVE-2014-8638 (bmo#1080987) sendBeacon requests lack an Origin header * MFSA 2015-04/CVE-2014-8639 (bmo#1095859) Cookie injection through Proxy Authenticate responses * MFSA 2015-05/CVE-2014-8640 (bmo#1100409) Read of uninitialized memory in Web Audio * MFSA 2015-06/CVE-2014-8641 (bmo#1108455) Read-after-free in WebRTC * MFSA 2015-07/CVE-2014-8643 (bmo#1114170) (Windows-only) Gecko Media Plugin sandbox escape * MFSA 2015-08/CVE-2014-8642 (bmo#1079658) Delegated OCSP responder certificates failure with id-pkix-ocsp-nocheck extension * MFSA 2015-09/CVE-2014-8636 (bmo#987794) XrayWrapper bypass through DOM objects - obsolete tracker-miner-firefox < 0.15 because it leads to startup crashes (bnc#908892) Patch Instructions: To install this openSUSE Security Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE 13.1: zypper in -t patch openSUSE-2015-40 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE 13.1 (i586 x86_64): MozillaFirefox-35.0-54.2 MozillaFirefox-branding-upstream-35.0-54.2 MozillaFirefox-buildsymbols-35.0-54.2 MozillaFirefox-debuginfo-35.0-54.2 MozillaFirefox-debugsource-35.0-54.2 MozillaFirefox-devel-35.0-54.2 MozillaFirefox-translations-common-35.0-54.2 MozillaFirefox-translations-other-35.0-54.2 References: http://support.novell.com/security/cve/CVE-2014-8634.html http://support.novell.com/security/cve/CVE-2014-8635.html http://support.novell.com/security/cve/CVE-2014-8636.html http://support.novell.com/security/cve/CVE-2014-8637.html http://support.novell.com/security/cve/CVE-2014-8638.html http://support.novell.com/security/cve/CVE-2014-8639.html http://support.novell.com/security/cve/CVE-2014-8640.html http://support.novell.com/security/cve/CVE-2014-8641.html http://support.novell.com/security/cve/CVE-2014-8642.html http://support.novell.com/security/cve/CVE-2014-8643.html https://bugzilla.suse.com/show_bug.cgi?id=908892 https://bugzilla.suse.com/show_bug.cgi?id=910669 -- To unsubscribe, e-mail: opensuse-security-announce+unsubscribe(a)opensuse.org For additional commands, e-mail: opensuse-security-announce+help(a)opensuse.org

1 0

[security-announce] SUSE-SU-2015:0076-1: important: Security update for MozillaFirefox
by opensuse-security＠opensuse.org 19 Jan '15

19 Jan '15

SUSE Security Update: Security update for MozillaFirefox ______________________________________________________________________________ Announcement ID: SUSE-SU-2015:0076-1 Rating: important References: #909563 #910647 #910669 Cross-References: CVE-2014-1569 CVE-2014-8634 CVE-2014-8635 CVE-2014-8638 CVE-2014-8639 CVE-2014-8641 Affected Products: SUSE Linux Enterprise Software Development Kit 12 SUSE Linux Enterprise Server 12 SUSE Linux Enterprise Desktop 12 ______________________________________________________________________________ An update that fixes 6 vulnerabilities is now available. Description: This update fixes the following security issues in MozillaFirefox: - MFSA 2015-01/CVE-2014-8634/CVE-2014-8635 (bmo#1109889, bmo#1111737, bmo#1026774, bmo#1027300, bmo#1054538, bmo#1067473, bmo#1070962, bmo#1072130, bmo#1072871, bmo#1098583) Miscellaneous memory safety hazards (rv:35.0 / rv:31.4) - MFSA 2015-03/CVE-2014-8638 (bmo#1080987) sendBeacon requests lack an Origin header - MFSA 2015-04/CVE-2014-8639 (bmo#1095859) Cookie injection through Proxy Authenticate responses - MFSA 2015-06/CVE-2014-8641 (bmo#1108455) Read-after-free in WebRTC Also Mozilla NSS was updated to 3.17.3 to fix: * The QuickDER decoder now decodes lengths robustly (bmo#1064670/CVE-2014-1569) * Support for TLS_FALLBACK_SCSV has been added to the ssltap and tstclnt utilities * Changes in CA certificates Patch Instructions: To install this SUSE Security Update use YaST online_update. Alternatively you can run the command listed for your product: - SUSE Linux Enterprise Software Development Kit 12: zypper in -t patch SUSE-SLE-SDK-12-2015-26 - SUSE Linux Enterprise Server 12: zypper in -t patch SUSE-SLE-SERVER-12-2015-26 - SUSE Linux Enterprise Desktop 12: zypper in -t patch SUSE-SLE-DESKTOP-12-2015-26 To bring your system up-to-date, use "zypper patch". Package List: - SUSE Linux Enterprise Software Development Kit 12 (ppc64le s390x x86_64): MozillaFirefox-debuginfo-31.4.0esr-20.1 MozillaFirefox-debugsource-31.4.0esr-20.1 MozillaFirefox-devel-31.4.0esr-20.1 mozilla-nss-debuginfo-3.17.3-16.1 mozilla-nss-debugsource-3.17.3-16.1 mozilla-nss-devel-3.17.3-16.1 - SUSE Linux Enterprise Server 12 (ppc64le s390x x86_64): MozillaFirefox-31.4.0esr-20.1 MozillaFirefox-debuginfo-31.4.0esr-20.1 MozillaFirefox-debugsource-31.4.0esr-20.1 MozillaFirefox-translations-31.4.0esr-20.1 libfreebl3-3.17.3-16.1 libfreebl3-debuginfo-3.17.3-16.1 libfreebl3-hmac-3.17.3-16.1 libsoftokn3-3.17.3-16.1 libsoftokn3-debuginfo-3.17.3-16.1 libsoftokn3-hmac-3.17.3-16.1 mozilla-nss-3.17.3-16.1 mozilla-nss-certs-3.17.3-16.1 mozilla-nss-certs-debuginfo-3.17.3-16.1 mozilla-nss-debuginfo-3.17.3-16.1 mozilla-nss-debugsource-3.17.3-16.1 mozilla-nss-tools-3.17.3-16.1 mozilla-nss-tools-debuginfo-3.17.3-16.1 - SUSE Linux Enterprise Server 12 (s390x x86_64): libfreebl3-32bit-3.17.3-16.1 libfreebl3-debuginfo-32bit-3.17.3-16.1 libfreebl3-hmac-32bit-3.17.3-16.1 libsoftokn3-32bit-3.17.3-16.1 libsoftokn3-debuginfo-32bit-3.17.3-16.1 libsoftokn3-hmac-32bit-3.17.3-16.1 mozilla-nss-32bit-3.17.3-16.1 mozilla-nss-certs-32bit-3.17.3-16.1 mozilla-nss-certs-debuginfo-32bit-3.17.3-16.1 mozilla-nss-debuginfo-32bit-3.17.3-16.1 - SUSE Linux Enterprise Desktop 12 (x86_64): MozillaFirefox-31.4.0esr-20.1 MozillaFirefox-debuginfo-31.4.0esr-20.1 MozillaFirefox-debugsource-31.4.0esr-20.1 MozillaFirefox-translations-31.4.0esr-20.1 libfreebl3-3.17.3-16.1 libfreebl3-32bit-3.17.3-16.1 libfreebl3-debuginfo-3.17.3-16.1 libfreebl3-debuginfo-32bit-3.17.3-16.1 libsoftokn3-3.17.3-16.1 libsoftokn3-32bit-3.17.3-16.1 libsoftokn3-debuginfo-3.17.3-16.1 libsoftokn3-debuginfo-32bit-3.17.3-16.1 mozilla-nss-3.17.3-16.1 mozilla-nss-32bit-3.17.3-16.1 mozilla-nss-certs-3.17.3-16.1 mozilla-nss-certs-32bit-3.17.3-16.1 mozilla-nss-certs-debuginfo-3.17.3-16.1 mozilla-nss-certs-debuginfo-32bit-3.17.3-16.1 mozilla-nss-debuginfo-3.17.3-16.1 mozilla-nss-debuginfo-32bit-3.17.3-16.1 mozilla-nss-debugsource-3.17.3-16.1 mozilla-nss-tools-3.17.3-16.1 mozilla-nss-tools-debuginfo-3.17.3-16.1 References: http://support.novell.com/security/cve/CVE-2014-1569.html http://support.novell.com/security/cve/CVE-2014-8634.html http://support.novell.com/security/cve/CVE-2014-8635.html http://support.novell.com/security/cve/CVE-2014-8638.html http://support.novell.com/security/cve/CVE-2014-8639.html http://support.novell.com/security/cve/CVE-2014-8641.html https://bugzilla.suse.com/show_bug.cgi?id=909563 https://bugzilla.suse.com/show_bug.cgi?id=910647 https://bugzilla.suse.com/show_bug.cgi?id=910669 -- To unsubscribe, e-mail: opensuse-security-announce+unsubscribe(a)opensuse.org For additional commands, e-mail: opensuse-security-announce+help(a)opensuse.org

1 0

[security-announce] Upcoming update for shim requires confirmation on reboot
by Johannes Segitz 16 Jan '15

16 Jan '15

Hello, we will release a security update for shim next week that fixes three security issues, tracked in bnc#889332: - OOB read access when parsing DHCPv6 packets (remote DoS) (CVE-2014-3675). - Heap overflow when parsing IPv6 addresses provided by tftp:// DHCPv6 boot option (RCE) (CVE-2014-3676). - Memory corruption when processing user provided MOK lists (CVE-2014-3677). Because of those issues we update shim to version 0.7.318.81ee561d. This version includes a patch that requires the user to confirm a dialog once on the first boot after the update is installed. You will need to be able to confirm this dialog, which appears before the bootloader, or your system will not boot. This only affects users that are still on openSUSE 13.1 and use a secure boot setup. You can check with 'bootctl' if you're using a secure boot configuration if you're not sure. Best regards, Johannes Segitz -- GPG Key E7C81FA0 EE16 6BCE AD56 E034 BFB3 3ADD 7BF7 29D5 E7C8 1FA0 Subkey fingerprint: 250F 43F5 F7CE 6F1E 9C59 4F95 BC27 DD9D 2CC4 FD66 SUSE LINUX GmbH Maxfeldstraße 5 90409 Nürnberg, Germany GF: Felix Imendörffer, Jane Smithard, Jennifer Guild, Dilip Upmanyu, Graham Norton, HRB 21284 (AG Nürnberg)

1 0

[security-announce] SUSE-SU-2015:0068-1: important: Security update for the Linux Kernel
by opensuse-security＠opensuse.org 16 Jan '15

16 Jan '15

SUSE Security Update: Security update for the Linux Kernel ______________________________________________________________________________ Announcement ID: SUSE-SU-2015:0068-1 Rating: important References: #851603 #853040 #860441 #862957 #863526 #870498 #873228 #874025 #877622 #879255 #880767 #880892 #881085 #883139 #887046 #887382 #887418 #889295 #889297 #891259 #891619 #892254 #892612 #892650 #892860 #893454 #894057 #894863 #895221 #895387 #895468 #895680 #895983 #896391 #897101 #897736 #897770 #897912 #898234 #898297 #899192 #899489 #899551 #899785 #899787 #899908 #900126 #901090 #901774 #901809 #901925 #902010 #902016 #902346 #902893 #902898 #903279 #903307 #904013 #904077 #904115 #904354 #904871 #905087 #905100 #905296 #905758 #905772 #907818 #908184 #909077 #910251 #910697 Cross-References: CVE-2013-6405 CVE-2014-3185 CVE-2014-3610 CVE-2014-3611 CVE-2014-3647 CVE-2014-3673 CVE-2014-7826 CVE-2014-7841 CVE-2014-8133 CVE-2014-9090 CVE-2014-9322 Affected Products: SUSE Linux Enterprise Workstation Extension 12 SUSE Linux Enterprise Software Development Kit 12 SUSE Linux Enterprise Server 12 SUSE Linux Enterprise Module for Public Cloud 12 SUSE Linux Enterprise Desktop 12 SUSE Linux Enterprise Build System Kit 12 ______________________________________________________________________________ An update that solves 11 vulnerabilities and has 62 fixes is now available. Description: The SUSE Linux Enterprise 12 kernel was updated to 3.12.31 to receive various security and bugfixes. Security issues fixed: CVE-2014-9322: A local privilege escalation in the x86_64 32bit compatibility signal handling was fixed, which could be used by local attackers to crash the machine or execute code. CVE-2014-9090: Various issues in LDT handling in 32bit compatibility mode on the x86_64 platform were fixed, where local attackers could crash the machine. CVE-2014-8133: Insufficient validation of TLS register usage could leak information from the kernel stack to userspace. CVE-2014-7826: kernel/trace/trace_syscalls.c in the Linux kernel did not properly handle private syscall numbers during use of the ftrace subsystem, which allowed local users to gain privileges or cause a denial of service (invalid pointer dereference) via a crafted application. CVE-2014-3647: Nadav Amit reported that the KVM (Kernel Virtual Machine) mishandled noncanonical addresses when emulating instructions that change the rip (Instruction Pointer). A guest user with access to I/O or the MMIO could use this flaw to cause a denial of service (system crash) of the guest. CVE-2014-3611: A race condition flaw was found in the way the Linux kernel's KVM subsystem handled PIT (Programmable Interval Timer) emulation. A guest user who has access to the PIT I/O ports could use this flaw to crash the host. CVE-2014-3610: If the guest writes a noncanonical value to certain MSR registers, KVM will write that value to the MSR in the host context and a #GP will be raised leading to kernel panic. A privileged guest user could have used this flaw to crash the host. CVE-2014-7841: A remote attacker could have used a flaw in SCTP to crash the system by sending a maliciously prepared SCTP packet in order to trigger a NULL pointer dereference on the server. CVE-2014-3673: The SCTP implementation in the Linux kernel allowed remote attackers to cause a denial of service (system crash) via a malformed ASCONF chunk, related to net/sctp/sm_make_chunk.c and net/sctp/sm_statefuns.c. CVE-2014-3185: Multiple buffer overflows in the command_port_read_callback function in drivers/usb/serial/whiteheat.c in the Whiteheat USB Serial Driver in the Linux kernel allowed physically proximate attackers to execute arbitrary code or cause a denial of service (memory corruption and system crash) via a crafted device that provides a large amount of (1) EHCI or (2) XHCI data associated with a bulk response. Bugs fixed: BTRFS: - btrfs: fix race that makes btrfs_lookup_extent_info miss skinny extent items (bnc#904077). - btrfs: fix invalid leaf slot access in btrfs_lookup_extent() (bnc#904077). - btrfs: avoid returning -ENOMEM in convert_extent_bit() too early (bnc#902016). - btrfs: make find_first_extent_bit be able to cache any state (bnc#902016). - btrfs: deal with convert_extent_bit errors to avoid fs corruption (bnc#902016). - btrfs: be aware of btree inode write errors to avoid fs corruption (bnc#899551). - btrfs: add missing end_page_writeback on submit_extent_page failure (bnc#899551). - btrfs: fix crash of btrfs_release_extent_buffer_page (bnc#899551). - btrfs: ensure readers see new data after a clone operation (bnc#898234). - btrfs: avoid visiting all extent items when cloning a range (bnc#898234). - btrfs: fix clone to deal with holes when NO_HOLES feature is enabled (bnc#898234). - btrfs: make fsync work after cloning into a file (bnc#898234). - btrfs: fix use-after-free when cloning a trailing file hole (bnc#898234). - btrfs: clone, don't create invalid hole extent map (bnc#898234). - btrfs: limit the path size in send to PATH_MAX (bnc#897770). - btrfs: send, fix more issues related to directory renames (bnc#897770). - btrfs: send, remove dead code from __get_cur_name_and_parent (bnc#897770). - btrfs: send, account for orphan directories when building path strings (bnc#897770). - btrfs: send, avoid unnecessary inode item lookup in the btree (bnc#897770). - btrfs: send, fix incorrect ref access when using extrefs (bnc#897770). - btrfs: send, build path string only once in send_hole (bnc#897770). - btrfs: part 2, fix incremental send's decision to delay a dir move/rename (bnc#897770). - btrfs: fix incremental send's decision to delay a dir move/rename (bnc#897770). - btrfs: remove unnecessary inode generation lookup in send (bnc#897770). - btrfs: avoid unnecessary utimes update in incremental send (bnc#897770). - btrfs: fix send issuing outdated paths for utimes, chown and chmod (bnc#897770). - btrfs: fix send attempting to rmdir non-empty directories (bnc#897770). - btrfs: send, don't send rmdir for same target multiple times (bnc#897770). - btrfs: incremental send, fix invalid path after dir rename (bnc#897770). - btrfs: fix assert screwup for the pending move stuff (bnc#897770). - btrfs: make some tree searches in send.c more efficient (bnc#897770). - btrfs: use right extent item position in send when finding extent clones (bnc#897770). - btrfs: more send support for parent/child dir relationship inversion (bnc#897770). - btrfs: fix send dealing with file renames and directory moves (bnc#897770). - btrfs: add missing error check in incremental send (bnc#897770). - btrfs: make send's file extent item search more efficient (bnc#897770). - btrfs: fix infinite path build loops in incremental send (bnc#897770). - btrfs: send, don't delay dir move if there's a new parent inode (bnc#897770). - btrfs: add helper btrfs_fdatawrite_range (bnc#902010). - btrfs: correctly flush compressed data before/after direct IO (bnc#902010). - btrfs: make inode.c:compress_file_range() return void (bnc#902010). - btrfs: report error after failure inlining extent in compressed write path (bnc#902010). - btrfs: don't ignore compressed bio write errors (bnc#902010). - btrfs: make inode.c:submit_compressed_extents() return void (bnc#902010). - btrfs: process all async extents on compressed write failure (bnc#902010). - btrfs: don't leak pages and memory on compressed write error (bnc#902010). - btrfs: fix hang on compressed write error (bnc#902010). - btrfs: set page and mapping error on compressed write failure (bnc#902010). - btrfs: fix kfree on list_head in btrfs_lookup_csums_range error cleanup (bnc#904115). Hyper-V: - hyperv: Fix a bug in netvsc_send(). - hyperv: Fix a bug in netvsc_start_xmit(). - drivers: hv: vmbus: Enable interrupt driven flow control. - drivers: hv: vmbus: Properly protect calls to smp_processor_id(). - drivers: hv: vmbus: Cleanup hv_post_message(). - drivers: hv: vmbus: Cleanup vmbus_close_internal(). - drivers: hv: vmbus: Fix a bug in vmbus_open(). - drivers: hv: vmbus: Cleanup vmbus_establish_gpadl(). - drivers: hv: vmbus: Cleanup vmbus_teardown_gpadl(). - drivers: hv: vmbus: Cleanup vmbus_post_msg(). - storvsc: get rid of overly verbose warning messages. - hyperv: NULL dereference on error. - hyperv: Increase the buffer length for netvsc_channel_cb(). zSeries / S390: - s390: pass march flag to assembly files as well (bnc#903279, LTC#118177). - kernel: reduce function tracer overhead (bnc#903279, LTC#118177). - SUNRPC: Handle EPIPE in xprt_connect_status (bnc#901090). - SUNRPC: Ensure that we handle ENOBUFS errors correctly (bnc#901090). - SUNRPC: Ensure call_connect_status() deals correctly with SOFTCONN tasks (bnc#901090). - SUNRPC: Ensure that call_connect times out correctly (bnc#901090). - SUNRPC: Handle connect errors ECONNABORTED and EHOSTUNREACH (bnc#901090). - SUNRPC: Ensure xprt_connect_status handles all potential connection errors (bnc#901090). - SUNRPC: call_connect_status should recheck bind and connect status on error (bnc#901090). kGraft: - kgr: force patching process to succeed (fate#313296). - kgr: usb-storage, mark kthread safe (fate#313296 bnc#899908). - Refresh patches.suse/kgr-0039-kgr-fix-ugly-race.patch. Fix few bugs, and also races (immutable vs mark_processes vs other threads). - kgr: always use locked bit ops for thread_info->flags (fate#313296). - kgr: lower the workqueue scheduling timeout (fate#313296 bnc#905087). - kgr: mark even more kthreads (fate#313296 bnc#904871). - rpm/kernel-binary.spec.in: Provide name-version-release for kgraft packages (bnc#901925) Other: - NFSv4: test SECINFO RPC_AUTH_GSS pseudoflavors for support (bnc#905758). - Enable cmac(aes) and cmac(3des_ede) for FIPS mode (bnc#905296 bnc#905772). - scsi_dh_alua: disable ALUA handling for non-disk devices (bnc#876633). - powerpc/vphn: NUMA node code expects big-endian (bsc#900126). - net: fix checksum features handling in netif_skb_features() (bnc#891259). - be2net: Fix invocation of be_close() after be_clear() (bnc#895468). - PCI: pciehp: Clear Data Link Layer State Changed during init (bnc#898297). - PCI: pciehp: Use symbolic constants, not hard-coded bitmask (bnc#898297). - PCI: pciehp: Use link change notifications for hot-plug and removal (bnc#898297). - PCI: pciehp: Make check_link_active() non-static (bnc#898297). - PCI: pciehp: Enable link state change notifications (bnc#898297). - ALSA: hda - Treat zero connection as non-error (bnc#902898). - bcache: add mutex lock for bch_is_open (bnc#902893). - futex: Fix a race condition between REQUEUE_PI and task death (bcn #851603 (futex scalability series)). - Linux 3.12.31 (bnc#895983 bnc#897912). - futex: Ensure get_futex_key_refs() always implies a barrier (bcn #851603 (futex scalability series)). - usbback: don't access request fields in shared ring more than once. - Update Xen patches to 3.12.30. - locking/rwsem: Avoid double checking before try acquiring write lock (Locking scalability.). - zcrypt: toleration of new crypto adapter hardware (bnc#894057, LTC#117041). - zcrypt: support for extended number of ap domains (bnc#894057, LTC#117041). - kABI: protect linux/fs.h include in mm/internal.h. - Linux 3.12.30 (FATE#315482 bnc#862957 bnc#863526 bnc#870498). - Update patches.fixes/xfs-mark-all-internal-workqueues-as-freezable.patch (bnc#899785). - xfs: mark all internal workqueues as freezable. - drm/i915: Move DP port disable to post_disable for pch platforms (bnc#899787). - pagecachelimit: reduce lru_lock congestion for heavy parallel reclaim fix (bnc#895680). - Linux 3.12.29 (bnc#879255 bnc#880892 bnc#887046 bnc#887418 bnc#891619 bnc#892612 bnc#892650 bnc#897101). - iommu/vt-d: Work around broken RMRR firmware entries (bnc#892860). - iommu/vt-d: Store bus information in RMRR PCI device path (bnc#892860). - iommu/vt-d: Only remove domain when device is removed (bnc#883139). - driver core: Add BUS_NOTIFY_REMOVED_DEVICE event (bnc#883139). - Update config files: Re-enable CONFIG_FUNCTION_PROFILER (bnc#899489) Option FUNCTION_PROFILER was enabled in debug and trace kernels so far, but it was accidentally disabled before tracing features were merged into the default kernel and the trace flavor was discarded. So all kernels are missing the feature now. Re-enable it. - xfs: xlog_cil_force_lsn doesn't always wait correctly. - scsi: clear 'host_scribble' upon successful abort (bnc#894863). - module: warn if module init + probe takes long (bnc#889297 bnc#877622 bnc#889295 bnc#893454). - mm, THP: don't hold mmap_sem in khugepaged when allocating THP (bnc#880767, VM Performance). - pagecache_limit: batch large nr_to_scan targets (bnc#895221). - iommu/vt-d: Check return value of acpi_bus_get_device() (bnc#903307). - rpm/kernel-binary.spec.in: Fix including the secure boot cert in /etc/uefi/certs - sched: Reduce contention in update_cfs_rq_blocked_load() (Scheduler/core performance). - x86: use optimized ioresource lookup in ioremap function (Boot time optimisations (bnc#895387)). - x86: optimize resource lookups for ioremap (Boot time optimisations (bnc#895387)). - usb: Do not re-read descriptors for wired devices in usb_authorize_device() (bnc#904354). - netxen: Fix link event handling (bnc#873228). - x86, cpu: Detect more TLB configuration -xen (TLB Performance). - x86/mm: Fix RCU splat from new TLB tracepoints (TLB Performance). - x86/mm: Set TLB flush tunable to sane value (33) (TLB Performance). - x86/mm: New tunable for single vs full TLB flush (TLB Performance). - x86/mm: Add tracepoints for TLB flushes (TLB Performance). - x86/mm: Unify remote INVLPG code (TLB Performance). - x86/mm: Fix missed global TLB flush stat (TLB Performance). - x86/mm: Rip out complicated, out-of-date, buggy TLB flushing (TLB Performance). - x86, cpu: Detect more TLB configuration (TLB Performance). - mm, x86: Revisit tlb_flushall_shift tuning for page flushes except on IvyBridge (TLB Performance). - x86/mm: Clean up the TLB flushing code (TLB Performance). - mm: free compound page with correct order (VM Functionality). - bnx2x: Utilize FW 7.10.51 (bnc#887382). - bnx2x: Remove unnecessary internal mem config (bnc#887382). - rtnetlink: fix oops in rtnl_link_get_slave_info_data_size (bnc#901774). - dm: do not call dm_sync_table() when creating new devices (bnc#901809). - [media] uvc: Fix destruction order in uvc_delete() (bnc#897736). - uas: replace WARN_ON_ONCE() with lockdep_assert_held() (FATE#315595). - cxgb4/cxgb4vf: Add Devicde ID for two more adapter (bsc#903999). - cxgb4/cxgb4vf: Add device ID for new adapter and remove for dbg adapter (bsc#903999). - cxgb4: Adds device ID for few more Chelsio T4 Adapters (bsc#903999). - cxgb4: Check if rx checksum offload is enabled, while reading hardware calculated checksum (bsc#903999). - xen-pciback: drop SR-IOV VFs when PF driver unloads (bsc#901839). This update also includes fixes contained in the Linux 3.12.stable release series, not seperately listed here. Patch Instructions: To install this SUSE Security Update use YaST online_update. Alternatively you can run the command listed for your product: - SUSE Linux Enterprise Workstation Extension 12: zypper in -t patch SUSE-SLE-WE-12-2015-21 - SUSE Linux Enterprise Software Development Kit 12: zypper in -t patch SUSE-SLE-SDK-12-2015-21 - SUSE Linux Enterprise Server 12: zypper in -t patch SUSE-SLE-SERVER-12-2015-21 - SUSE Linux Enterprise Module for Public Cloud 12: zypper in -t patch SUSE-SLE-Module-Public-Cloud-12-2015-21 - SUSE Linux Enterprise Desktop 12: zypper in -t patch SUSE-SLE-DESKTOP-12-2015-21 - SUSE Linux Enterprise Build System Kit 12: zypper in -t patch SUSE-SLE-BSK-12-2015-21 To bring your system up-to-date, use "zypper patch". Package List: - SUSE Linux Enterprise Workstation Extension 12 (x86_64): kernel-default-debuginfo-3.12.32-33.1 kernel-default-debugsource-3.12.32-33.1 kernel-default-extra-3.12.32-33.1 kernel-default-extra-debuginfo-3.12.32-33.1 - SUSE Linux Enterprise Software Development Kit 12 (ppc64le s390x x86_64): kernel-obs-build-3.12.32-33.1 kernel-obs-build-debugsource-3.12.32-33.1 - SUSE Linux Enterprise Software Development Kit 12 (noarch): kernel-docs-3.12.32-33.3 - SUSE Linux Enterprise Server 12 (ppc64le s390x x86_64): kernel-default-3.12.32-33.1 kernel-default-base-3.12.32-33.1 kernel-default-base-debuginfo-3.12.32-33.1 kernel-default-debuginfo-3.12.32-33.1 kernel-default-debugsource-3.12.32-33.1 kernel-default-devel-3.12.32-33.1 kernel-syms-3.12.32-33.1 - SUSE Linux Enterprise Server 12 (x86_64): kernel-xen-3.12.32-33.1 kernel-xen-base-3.12.32-33.1 kernel-xen-base-debuginfo-3.12.32-33.1 kernel-xen-debuginfo-3.12.32-33.1 kernel-xen-debugsource-3.12.32-33.1 kernel-xen-devel-3.12.32-33.1 - SUSE Linux Enterprise Server 12 (noarch): kernel-devel-3.12.32-33.1 kernel-macros-3.12.32-33.1 kernel-source-3.12.32-33.1 - SUSE Linux Enterprise Server 12 (s390x): kernel-default-man-3.12.32-33.1 - SUSE Linux Enterprise Module for Public Cloud 12 (x86_64): kernel-ec2-3.12.32-33.1 kernel-ec2-debuginfo-3.12.32-33.1 kernel-ec2-debugsource-3.12.32-33.1 kernel-ec2-devel-3.12.32-33.1 kernel-ec2-extra-3.12.32-33.1 kernel-ec2-extra-debuginfo-3.12.32-33.1 - SUSE Linux Enterprise Desktop 12 (x86_64): kernel-default-3.12.32-33.1 kernel-default-debuginfo-3.12.32-33.1 kernel-default-debugsource-3.12.32-33.1 kernel-default-devel-3.12.32-33.1 kernel-default-extra-3.12.32-33.1 kernel-default-extra-debuginfo-3.12.32-33.1 kernel-syms-3.12.32-33.1 kernel-xen-3.12.32-33.1 kernel-xen-debuginfo-3.12.32-33.1 kernel-xen-debugsource-3.12.32-33.1 kernel-xen-devel-3.12.32-33.1 - SUSE Linux Enterprise Desktop 12 (noarch): kernel-devel-3.12.32-33.1 kernel-macros-3.12.32-33.1 kernel-source-3.12.32-33.1 - SUSE Linux Enterprise Build System Kit 12 (s390x): kernel-zfcpdump-3.12.32-33.1 kernel-zfcpdump-debuginfo-3.12.32-33.1 kernel-zfcpdump-debugsource-3.12.32-33.1 References: http://support.novell.com/security/cve/CVE-2013-6405.html http://support.novell.com/security/cve/CVE-2014-3185.html http://support.novell.com/security/cve/CVE-2014-3610.html http://support.novell.com/security/cve/CVE-2014-3611.html http://support.novell.com/security/cve/CVE-2014-3647.html http://support.novell.com/security/cve/CVE-2014-3673.html http://support.novell.com/security/cve/CVE-2014-7826.html http://support.novell.com/security/cve/CVE-2014-7841.html http://support.novell.com/security/cve/CVE-2014-8133.html http://support.novell.com/security/cve/CVE-2014-9090.html http://support.novell.com/security/cve/CVE-2014-9322.html https://bugzilla.suse.com/show_bug.cgi?id=851603 https://bugzilla.suse.com/show_bug.cgi?id=853040 https://bugzilla.suse.com/show_bug.cgi?id=860441 https://bugzilla.suse.com/show_bug.cgi?id=862957 https://bugzilla.suse.com/show_bug.cgi?id=863526 https://bugzilla.suse.com/show_bug.cgi?id=870498 https://bugzilla.suse.com/show_bug.cgi?id=873228 https://bugzilla.suse.com/show_bug.cgi?id=874025 https://bugzilla.suse.com/show_bug.cgi?id=877622 https://bugzilla.suse.com/show_bug.cgi?id=879255 https://bugzilla.suse.com/show_bug.cgi?id=880767 https://bugzilla.suse.com/show_bug.cgi?id=880892 https://bugzilla.suse.com/show_bug.cgi?id=881085 https://bugzilla.suse.com/show_bug.cgi?id=883139 https://bugzilla.suse.com/show_bug.cgi?id=887046 https://bugzilla.suse.com/show_bug.cgi?id=887382 https://bugzilla.suse.com/show_bug.cgi?id=887418 https://bugzilla.suse.com/show_bug.cgi?id=889295 https://bugzilla.suse.com/show_bug.cgi?id=889297 https://bugzilla.suse.com/show_bug.cgi?id=891259 https://bugzilla.suse.com/show_bug.cgi?id=891619 https://bugzilla.suse.com/show_bug.cgi?id=892254 https://bugzilla.suse.com/show_bug.cgi?id=892612 https://bugzilla.suse.com/show_bug.cgi?id=892650 https://bugzilla.suse.com/show_bug.cgi?id=892860 https://bugzilla.suse.com/show_bug.cgi?id=893454 https://bugzilla.suse.com/show_bug.cgi?id=894057 https://bugzilla.suse.com/show_bug.cgi?id=894863 https://bugzilla.suse.com/show_bug.cgi?id=895221 https://bugzilla.suse.com/show_bug.cgi?id=895387 https://bugzilla.suse.com/show_bug.cgi?id=895468 https://bugzilla.suse.com/show_bug.cgi?id=895680 https://bugzilla.suse.com/show_bug.cgi?id=895983 https://bugzilla.suse.com/show_bug.cgi?id=896391 https://bugzilla.suse.com/show_bug.cgi?id=897101 https://bugzilla.suse.com/show_bug.cgi?id=897736 https://bugzilla.suse.com/show_bug.cgi?id=897770 https://bugzilla.suse.com/show_bug.cgi?id=897912 https://bugzilla.suse.com/show_bug.cgi?id=898234 https://bugzilla.suse.com/show_bug.cgi?id=898297 https://bugzilla.suse.com/show_bug.cgi?id=899192 https://bugzilla.suse.com/show_bug.cgi?id=899489 https://bugzilla.suse.com/show_bug.cgi?id=899551 https://bugzilla.suse.com/show_bug.cgi?id=899785 https://bugzilla.suse.com/show_bug.cgi?id=899787 https://bugzilla.suse.com/show_bug.cgi?id=899908 https://bugzilla.suse.com/show_bug.cgi?id=900126 https://bugzilla.suse.com/show_bug.cgi?id=901090 https://bugzilla.suse.com/show_bug.cgi?id=901774 https://bugzilla.suse.com/show_bug.cgi?id=901809 https://bugzilla.suse.com/show_bug.cgi?id=901925 https://bugzilla.suse.com/show_bug.cgi?id=902010 https://bugzilla.suse.com/show_bug.cgi?id=902016 https://bugzilla.suse.com/show_bug.cgi?id=902346 https://bugzilla.suse.com/show_bug.cgi?id=902893 https://bugzilla.suse.com/show_bug.cgi?id=902898 https://bugzilla.suse.com/show_bug.cgi?id=903279 https://bugzilla.suse.com/show_bug.cgi?id=903307 https://bugzilla.suse.com/show_bug.cgi?id=904013 https://bugzilla.suse.com/show_bug.cgi?id=904077 https://bugzilla.suse.com/show_bug.cgi?id=904115 https://bugzilla.suse.com/show_bug.cgi?id=904354 https://bugzilla.suse.com/show_bug.cgi?id=904871 https://bugzilla.suse.com/show_bug.cgi?id=905087 https://bugzilla.suse.com/show_bug.cgi?id=905100 https://bugzilla.suse.com/show_bug.cgi?id=905296 https://bugzilla.suse.com/show_bug.cgi?id=905758 https://bugzilla.suse.com/show_bug.cgi?id=905772 https://bugzilla.suse.com/show_bug.cgi?id=907818 https://bugzilla.suse.com/show_bug.cgi?id=908184 https://bugzilla.suse.com/show_bug.cgi?id=909077 https://bugzilla.suse.com/show_bug.cgi?id=910251 https://bugzilla.suse.com/show_bug.cgi?id=910697 -- To unsubscribe, e-mail: opensuse-security-announce+unsubscribe(a)opensuse.org For additional commands, e-mail: opensuse-security-announce+help(a)opensuse.org

1 0

[security-announce] SUSE-SU-2015:0062-1: important: Security update for flash-player
by opensuse-security＠opensuse.org 16 Jan '15

16 Jan '15

SUSE Security Update: Security update for flash-player ______________________________________________________________________________ Announcement ID: SUSE-SU-2015:0062-1 Rating: important References: #856386 #913057 Cross-References: CVE-2015-0301 CVE-2015-0302 CVE-2015-0303 CVE-2015-0304 CVE-2015-0305 CVE-2015-0306 CVE-2015-0307 CVE-2015-0308 CVE-2015-0309 Affected Products: SUSE Linux Enterprise Desktop 11 SP3 ______________________________________________________________________________ An update that fixes 9 vulnerabilities is now available. It includes one version update. Description: Adobe Flash Player was updated to fix several vulnerabilities. More information can be found at http://helpx.adobe.com/security/products/flash-player/apsb15-01.html <http://helpx.adobe.com/security/products/flash-player/apsb15-01.html> . Security Issues: * CVE-2015-0301 <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2015-0301> * CVE-2015-0302 <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2015-0302> * CVE-2015-0303 <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2015-0303> * CVE-2015-0304 <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2015-0304> * CVE-2015-0305 <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2015-0305> * CVE-2015-0306 <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2015-0306> * CVE-2015-0307 <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2015-0307> * CVE-2015-0308 <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2015-0308> * CVE-2015-0309 <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2015-0309> Patch Instructions: To install this SUSE Security Update use YaST online_update. Alternatively you can run the command listed for your product: - SUSE Linux Enterprise Desktop 11 SP3: zypper in -t patch sledsp3-flash-player-10164 To bring your system up-to-date, use "zypper patch". Package List: - SUSE Linux Enterprise Desktop 11 SP3 (i586 x86_64) [New Version: 11.2.202.429]: flash-player-11.2.202.429-0.4.1 flash-player-gnome-11.2.202.429-0.4.1 flash-player-kde4-11.2.202.429-0.4.1 References: http://support.novell.com/security/cve/CVE-2015-0301.html http://support.novell.com/security/cve/CVE-2015-0302.html http://support.novell.com/security/cve/CVE-2015-0303.html http://support.novell.com/security/cve/CVE-2015-0304.html http://support.novell.com/security/cve/CVE-2015-0305.html http://support.novell.com/security/cve/CVE-2015-0306.html http://support.novell.com/security/cve/CVE-2015-0307.html http://support.novell.com/security/cve/CVE-2015-0308.html http://support.novell.com/security/cve/CVE-2015-0309.html https://bugzilla.suse.com/show_bug.cgi?id=856386 https://bugzilla.suse.com/show_bug.cgi?id=913057 http://download.suse.com/patch/finder/?keywords=6699dd4415e0f8176f6147b7057… -- To unsubscribe, e-mail: opensuse-security-announce+unsubscribe(a)opensuse.org For additional commands, e-mail: opensuse-security-announce+help(a)opensuse.org

1 0

[security-announce] openSUSE-SU-2015:0061-1: important: flashplayer to version 11.2.202.429
by opensuse-security＠opensuse.org 15 Jan '15

15 Jan '15

openSUSE Security Update: flashplayer to version 11.2.202.429 ______________________________________________________________________________ Announcement ID: openSUSE-SU-2015:0061-1 Rating: important References: Cross-References: CVE-2015-0301 CVE-2015-0302 CVE-2015-0303 CVE-2015-0304 CVE-2015-0305 CVE-2015-0306 CVE-2015-0307 CVE-2015-0308 CVE-2015-0309 Affected Products: openSUSE Evergreen 11.4 ______________________________________________________________________________ An update that fixes 9 vulnerabilities is now available. Description: Following issues was resolved in this update: *an improper file validation issue CVE-2015-0301), *an information disclosure vulnerability that could be exploited to capture keystrokes on the affected system (CVE-2015-0302), *memory corruption vulnerabilities that could lead to code execution (CVE-2015-0303, CVE-2015-0306), *heap-based buffer overflow vulnerabilities that could lead to code execution (CVE-2015-0304,CVE-2015-0309), *type confusion vulnerability that could lead to code execution (CVE-2015-0305), *an out-of-bounds read vulnerability that could be exploited to leak memory addresses (CVE-2015-0307), *a use-after-free vulnerability that could lead to code execution (CVE-2015-0308). Patch Instructions: To install this openSUSE Security Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE Evergreen 11.4: zypper in -t patch 2015-2 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE Evergreen 11.4 (i586 x86_64): flash-player-11.2.202.429-139.1 flash-player-gnome-11.2.202.429-139.1 flash-player-kde4-11.2.202.429-139.1 References: http://support.novell.com/security/cve/CVE-2015-0301.html http://support.novell.com/security/cve/CVE-2015-0302.html http://support.novell.com/security/cve/CVE-2015-0303.html http://support.novell.com/security/cve/CVE-2015-0304.html http://support.novell.com/security/cve/CVE-2015-0305.html http://support.novell.com/security/cve/CVE-2015-0306.html http://support.novell.com/security/cve/CVE-2015-0307.html http://support.novell.com/security/cve/CVE-2015-0308.html http://support.novell.com/security/cve/CVE-2015-0309.html -- To unsubscribe, e-mail: opensuse-security-announce+unsubscribe(a)opensuse.org For additional commands, e-mail: opensuse-security-announce+help(a)opensuse.org

1 0

[security-announce] openSUSE-SU-2015:0059-1: important: Security update for flash-player
by opensuse-security＠opensuse.org 15 Jan '15

15 Jan '15

openSUSE Security Update: Security update for flash-player ______________________________________________________________________________ Announcement ID: openSUSE-SU-2015:0059-1 Rating: important References: #856386 #913057 Cross-References: CVE-2015-0301 CVE-2015-0302 CVE-2015-0303 CVE-2015-0304 CVE-2015-0305 CVE-2015-0306 CVE-2015-0307 CVE-2015-0308 CVE-2015-0309 Affected Products: openSUSE 13.2:NonFree openSUSE 13.1:NonFree ______________________________________________________________________________ An update that fixes 9 vulnerabilities is now available. Description: Adobe Flash Player was updated to 11.2.202.429 (bsc#913057): * APSB15-01, CVE-2015-0301, CVE-2015-0302, CVE-2015-0303, CVE-2015-0304, CVE-2015-0305, CVE-2015-0306, CVE-2015-0307, CVE-2015-0308, CVE-2015-0309. - Disable flash player on machines without SSE2 (bnc#856386). More information can be found on http://helpx.adobe.com/security/products/flash-player/apsb15-01.html Patch Instructions: To install this openSUSE Security Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE 13.2:NonFree: zypper in -t patch openSUSE-2015-30 - openSUSE 13.1:NonFree: zypper in -t patch openSUSE-2015-30 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE 13.2:NonFree (i586 x86_64): flash-player-11.2.202.429-2.21.1 flash-player-gnome-11.2.202.429-2.21.1 flash-player-kde4-11.2.202.429-2.21.1 - openSUSE 13.1:NonFree (i586 x86_64): flash-player-11.2.202.429-86.1 flash-player-gnome-11.2.202.429-86.1 flash-player-kde4-11.2.202.429-86.1 References: http://support.novell.com/security/cve/CVE-2015-0301.html http://support.novell.com/security/cve/CVE-2015-0302.html http://support.novell.com/security/cve/CVE-2015-0303.html http://support.novell.com/security/cve/CVE-2015-0304.html http://support.novell.com/security/cve/CVE-2015-0305.html http://support.novell.com/security/cve/CVE-2015-0306.html http://support.novell.com/security/cve/CVE-2015-0307.html http://support.novell.com/security/cve/CVE-2015-0308.html http://support.novell.com/security/cve/CVE-2015-0309.html https://bugzilla.suse.com/show_bug.cgi?id=856386 https://bugzilla.suse.com/show_bug.cgi?id=913057 -- To unsubscribe, e-mail: opensuse-security-announce+unsubscribe(a)opensuse.org For additional commands, e-mail: opensuse-security-announce+help(a)opensuse.org

1 0

[security-announce] SUSE-SU-2015:0052-1: important: Security update for flash-player
by opensuse-security＠opensuse.org 15 Jan '15

15 Jan '15

SUSE Security Update: Security update for flash-player ______________________________________________________________________________ Announcement ID: SUSE-SU-2015:0052-1 Rating: important References: #856386 #913057 Cross-References: CVE-2015-0301 CVE-2015-0302 CVE-2015-0303 CVE-2015-0304 CVE-2015-0305 CVE-2015-0306 CVE-2015-0307 CVE-2015-0308 CVE-2015-0309 Affected Products: SUSE Linux Enterprise Workstation Extension 12 SUSE Linux Enterprise Desktop 12 ______________________________________________________________________________ An update that fixes 9 vulnerabilities is now available. Description: Adobe Flash Player was updated to 11.2.202.429 (bsc#913057): * APSB15-01, CVE-2015-0301, CVE-2015-0302, CVE-2015-0303, CVE-2015-0304, CVE-2015-0305, CVE-2015-0306, CVE-2015-0307, CVE-2015-0308, CVE-2015-0309. More information can be found on http://helpx.adobe.com/security/products/flash-player/apsb15-01.html - Disable flash player on machines without SSE2 (bnc#856386). Patch Instructions: To install this SUSE Security Update use YaST online_update. Alternatively you can run the command listed for your product: - SUSE Linux Enterprise Workstation Extension 12: zypper in -t patch SUSE-SLE-WE-12-2015-19 - SUSE Linux Enterprise Desktop 12: zypper in -t patch SUSE-SLE-DESKTOP-12-2015-19 To bring your system up-to-date, use "zypper patch". Package List: - SUSE Linux Enterprise Workstation Extension 12 (i586 x86_64): flash-player-11.2.202.429-23.1 flash-player-gnome-11.2.202.429-23.1 - SUSE Linux Enterprise Desktop 12 (i586 x86_64): flash-player-11.2.202.429-23.1 flash-player-gnome-11.2.202.429-23.1 References: http://support.novell.com/security/cve/CVE-2015-0301.html http://support.novell.com/security/cve/CVE-2015-0302.html http://support.novell.com/security/cve/CVE-2015-0303.html http://support.novell.com/security/cve/CVE-2015-0304.html http://support.novell.com/security/cve/CVE-2015-0305.html http://support.novell.com/security/cve/CVE-2015-0306.html http://support.novell.com/security/cve/CVE-2015-0307.html http://support.novell.com/security/cve/CVE-2015-0308.html http://support.novell.com/security/cve/CVE-2015-0309.html https://bugzilla.suse.com/show_bug.cgi?id=856386 https://bugzilla.suse.com/show_bug.cgi?id=913057 -- To unsubscribe, e-mail: opensuse-security-announce+unsubscribe(a)opensuse.org For additional commands, e-mail: opensuse-security-announce+help(a)opensuse.org

1 0